feat(runner): migrate vibn-agent-runner to use frontend MCP proxy tools and updated headless prompt

app/api/projects/[projectId]/agent/sessions/route.ts

@@ -11,6 +11,7 @@
 import { NextResponse } from "next/server";
 import { authSession } from "@/lib/auth/session-server";
 import { query } from "@/lib/db-postgres";
+import { listWorkspaceApiKeys, mintWorkspaceApiKey, revealWorkspaceApiKey } from "@/lib/auth/workspace-auth";
 
 const AGENT_RUNNER_URL = process.env.AGENT_RUNNER_URL ?? "http://localhost:3333";
 
@@ -78,6 +79,35 @@ export async function POST(
     );
     const sessionId = rows[0].id;
 
+    const wsResult = await query<{ workspace_id: string }>(
+      `SELECT vibn_workspace_id as workspace_id FROM fs_projects WHERE id = $1 LIMIT 1`,
+      [projectId]
+    );
+    if (!wsResult.length) {
+      return NextResponse.json({ error: "Project not found" }, { status: 404 });
+    }
+    const workspaceId = wsResult[0].workspace_id;
+
+    // Grab or mint a default API key for the runner to use
+    let mcpToken = "";
+    const keys = await listWorkspaceApiKeys(workspaceId);
+    let defaultKey = keys.find((k: any) => k.name === 'default' && !k.revoked_at);
+    if (!defaultKey) {
+      const minted = await mintWorkspaceApiKey({ workspaceId, name: 'default', createdBy: session.user.id, scopes: ['workspace:*'] });
+      mcpToken = minted.token;
+    } else {
+      const revealed = await revealWorkspaceApiKey(workspaceId, defaultKey.id);
+      if (revealed) mcpToken = revealed.token;
+      else {
+        const minted = await mintWorkspaceApiKey({ workspaceId, name: 'default', createdBy: session.user.id, scopes: ['workspace:*'] });
+        mcpToken = minted.token;
+      }
+    }
+    
+    // Add VIBN_API_URL so the runner knows where to send MCP requests
+    const vibnApiUrl = process.env.NEXT_PUBLIC_APP_URL || "http://localhost:3000";
+
+
     // Fire-and-forget: call agent-runner to start the execution loop.
     // autoApprove: true — agent commits + deploys automatically on completion.
     fetch(`${AGENT_RUNNER_URL}/agent/execute`, {
@@ -92,6 +122,8 @@ export async function POST(
         task: task.trim(),
         autoApprove: true,
         coolifyAppUuid,
+        mcpToken,
+        vibnApiUrl
       }),
     }).catch(err => {
       // Agent runner may not be wired yet — log but don't fail