Bugbot finding on #1442: loader.load/getEntrypoint threw outside the
outcome try/catch, leaving a dangling execution-requested record and an
executionId-less HTTP error. One try/catch now spans loading through
running.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Bugbot finding on #1442: loader.load/getEntrypoint threw outside the
outcome try/catch, leaving a dangling execution-requested record and an
executionId-less HTTP error. One try/catch now spans loading through
running.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Bugbot finding on #1442: loader.load/getEntrypoint threw outside the
outcome try/catch, leaving a dangling execution-requested record and an
executionId-less HTTP error. One try/catch now spans loading through
running.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Stacked on #1442. First slice of the codemode rip-out (itx-next.md §4):
the inbound MCP server's `exec_js` no longer touches codemode.

## What

- **exec_js scripts are itx scripts** — `async ({ itx }) => { ... }` —
run through the shared `runItxScript` harness, with the two-event
execution record landing on the MCP session's stream. Console capture
and result formatting preserved.
- **Each (MCP session, project) gets a child context** (`ctx_…`, the
prototype chain in action) seeded with three caps: `ai` (raw AI binding
ref), `os` (OrpcCapability, path-call), `gmail` (GmailCapability,
members). The caps' `instructions` feed both the exec_js tool
description and `itx.describe()`.
- **OrpcCapability** gains a real `call({ path, args })`; the legacy
`executeCodemodeFunctionCall` delegates to it. **GmailCapability needs
no adapter at all** — `request()` is a real method and members-replay
reaches it.
- **Security**: the registry now force-injects `projectId` into loopback
dial props (alongside `cap`/`context`), so dialable entrypoints that
scope by project can never be pointed at someone else's project by a
definer. Orpc + Gmail added to `DIALABLE_LOOPBACKS` with that contract
documented.
- Deleted from the MCP DO: tool-provider registrations, codemode session
start/wait, the stream-decoding result watcher, debug provider limits
(~200 lines).

Codemode itself still exists (agent loop + web UI consume it); parts 2
and 3 take those, then the domain deletes.

## Testing
typecheck / lint / format / unit (208 tests) green. e2e exec_js coverage
rides the existing inbound-MCP suite against a deployment.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

<!-- CURSOR_SUMMARY -->
---

> [!NOTE]
> **High Risk**
> Changes authenticated remote code execution and project-bound
API/Gmail loopback dialing; registry-injected projectId is the main
cross-tenant guard.
> 
> **Overview**
> Inbound MCP **`exec_js`** no longer uses codemode sessions,
tool-provider registrations, or stream polling for completion. Scripts
run as **`async ({ itx }) => { ... }`** via **`runItxScript`**, with
execution recorded on the MCP session stream and the same console/result
formatting for tool responses.
> 
> Each **(MCP session, project)** gets a persisted **child itx context**
(`ITX_CONTEXT`) parented to the project, seeded with **`ai`**, **`os`**
(path-call → **`OrpcCapability`**), and **`gmail`** (members →
**`GmailCapability`**). Cap **`instructions`** drive both the
**`exec_js`** tool docs and **`itx.describe()`**.
> 
> **`OrpcCapability`** adds **`call({ path, args })`** for itx
path-call; legacy **`executeCodemodeFunctionCall`** delegates to it
(with mount-aware **`listProcedures`** for old callers).
**`DIALABLE_LOOPBACKS`** now includes **`OrpcCapability`** and
**`GmailCapability`**, and the registry **force-injects `projectId`** on
loopback dial props so project-scoped entrypoints cannot be aimed at
another project. **`codemode-event-payload`** helpers are removed from
this path (~200 lines of MCP DO codemode wiring deleted).
> 
> <sup>Reviewed by [Cursor Bugbot](https://cursor.com/bugbot) for commit
d0c631f. Bugbot is set up for automated
code reviews on this repo. Configure
[here](https://www.cursor.com/dashboard/bugbot).</sup>
<!-- /CURSOR_SUMMARY -->

<!-- CLOUDFLARE_PREVIEW -->
## Environment Config Lease
<!-- CLOUDFLARE_PREVIEW_STATE -->
<!--
{
  "apps": {
    "os": {
      "appDisplayName": "OS",
      "appSlug": "os",
      "status": "deployed",
      "updatedAt": "2026-06-10T14:28:35.934Z",
      "headSha": "d0c631fac58817753474480f5926e72e6c09d814",
      "message": null,
      "publicUrl": "https://os.iterate-preview-3.com",
"runUrl": "https://github.com/iterate/iterate/actions/runs/27282903658",
      "shortSha": "d0c631f"
    },
    "semaphore": {
      "appDisplayName": "Semaphore",
      "appSlug": "semaphore",
      "status": "deployed",
      "updatedAt": "2026-06-10T14:13:37.187Z",
      "headSha": "071375e4a5b3d9f546ea4c6caae492d60891f6d3",
      "message": null,
      "publicUrl": "https://semaphore.iterate-preview-3.com",
"runUrl": "https://github.com/iterate/iterate/actions/runs/27282171935",
      "shortSha": "071375e"
    }
  },
  "environmentConfigLease": {
    "dopplerConfig": "preview_3",
    "leasedUntil": 1781104923528,
    "leaseId": "9fd945b0-2dbe-4589-83ce-0dd8370a9739",
    "slug": "preview-3",
    "type": "environment-config-lease"
  }
}
-->
<!-- /CLOUDFLARE_PREVIEW_STATE -->
Lease: `preview-3`
Doppler config: `preview_3`
Type: `environment-config-lease`
Leased until: 2026-06-10T15:22:03.528Z

### OS
Status: deployed
Commit: `d0c631f`
Preview: https://os.iterate-preview-3.com
[Workflow
run](https://github.com/iterate/iterate/actions/runs/27282903658)
Updated: 2026-06-10T14:28:35.934Z

### Semaphore
Status: deployed
Commit: `071375e`
Preview: https://semaphore.iterate-preview-3.com
[Workflow
run](https://github.com/iterate/iterate/actions/runs/27282171935)
Updated: 2026-06-10T14:13:37.187Z
<!-- /CLOUDFLARE_PREVIEW -->

---------

Co-authored-by: Claude Fable 5 <noreply@anthropic.com>