#273 feat(web): /mcp-events-shim and /mcp-events-shim/api

Summary

Two pages for the MCP events shim (@agent-relay/events-shim, hosted by Cloud at /cloud/api/v1/events-shim):

• /mcp-events-shim — "Connect your agent, then post." Create an inbox (no sign-up), copy the one-line MCP install for Claude Code / Codex / Cursor / opencode / Gemini CLI / any MCP client, pick a verification mode (open, GitHub, Stripe, Linear, bearer), and watch posts arrive live with whether each one woke the agent. The difference from other webhook inboxes: Agent Relay injects each post into the session, so an idle agent wakes.
• /mcp-events-shim/api — "Want to use our API for your own MCP?" For MCP/mailbox vendors: inbox per agent, a text/plain nudge to the bearer URL is delivered verbatim, the agent fetches the real content from the vendor's MCP. Hosted or self-hosted (relay-control events_shim), priced per message.
• Analytics privacy: the page is blocked from session replay (ph-sensitive), events-shim API traffic is dropped from replay, and es*_ tokens plus the page-link fragment are scrubbed from captured events (tests added).
• Sitemap + tracked analytics prefix.

Hold: the try page calls Cloud's events-shim API, which ships with the Cloud PR (itself waiting on a relay release). Merge after Cloud is deployed, or the "Get my webhook" button errors.

Test Plan

• tsc --noEmit clean; vitest analytics/sitemap/site-analytics 22/22 (full suite 606/607 locally; the one failure is flow-workflows "removes the builds…", which depends on free disk and passes on main)
• Ran both pages under next dev against a local server using the real package: created an inbox, connected a real MCP client, linked a wake, posted with curl — feed showed woke agent; ran the API page's curl walkthrough verbatim (nudge delivered exactly, retry deduplicated, status woken); desktop and phone screenshots checked
• Real end-to-end wake of an idle Claude Code session through real Relaycast (see AgentWorkforce/relay#2151)

🤖 Generated with Claude Code

---

^{Open in [code]smith · Need help on this PR? Tag @codesmith-bot with what you need.}

---

Summary by cubic

Adds /mcp-events-shim and /mcp-events-shim/api, two pages for the MCP events shim backed by Cloud's /cloud/api/v1/events-shim (@agent-relay/events-shim).

• The try page creates an inbox without sign-up, prints a one-line install for Claude Code, Codex, Cursor, opencode, Gemini CLI or any MCP client, picks a verification mode (open, GitHub, Stripe, Linear, bearer), and shows each post live with whether it woke the agent.
• The API page documents per-agent inboxes, verbatim text/plain nudges to bearer URLs (trimmed, cut at 6,000 characters), delivery states (woken, read, waiting), idempotency, hosted vs self-hosted, and per-message pricing. Signed provider URLs wrap JSON bodies as data regardless of header, and a post is acknowledged with wake: "forwarding" before it is forwarded.
• Capability tokens (es*_) and the page-link fragment are scrubbed from captured analytics events, and the page plus its API traffic are excluded from session replay (tests added).
• Sitemap entries and a tracked analytics prefix were added.

Security

• Restored sessions must be an esk_ token and an MCP URL on this page's own API origin and path, so a crafted link can't make the page show someone else's command to copy; install commands shell-quote the URL.
• Feed requests are aborted when the inbox changes, so a late 404 can't clear a newer inbox.
• The page-link fragment is redacted even after a query string, and the copyable bearer curl references $WEBHOOK_TOKEN instead of a live token.
• Posts still being delivered are shown as "waking…" until the agent picks them up.

Hold: the try page calls Cloud's events-shim API, which ships with a separate Cloud PR waiting on a relay release. Merge after Cloud is deployed, otherwise the "Get my webhook" button errors.