fix: harden /mcp rate-limit env parsing + wire-trace-tasks portability

[arapov]

Summary

Opened on behalf of codex's codex/final-release-preflight-fixes branch. Two targeted fixes plus the routine docs refresh.

Real footgun fixed

The pre-existing /mcp rate-limit env parser:

const rateLimitWindowMs = Number(process.env["MCP_HTTP_RATE_LIMIT_WINDOW_MS"]) || 60_000;

The || 60_000 falls back on 0 / NaN, but negative numbers are truthy. MCP_HTTP_RATE_LIMIT_WINDOW_MS=-500 → Number(-500) = -500 → kept verbatim → fed to express-rate-limit, which logs a validation error but coerces silently. Same for MCP_HTTP_RATE_LIMIT_MAX=-1. DEPLOY.md claimed "non-positive falls back" — it didn't.

Plus: values above Node's setInterval ceiling (2³¹-1 ms ≈ 24.8 days) overflow the timer in the in-memory store.

Fix: extract resolveMcpRateLimitConfig() using the existing readPositiveInt helper + clamp at MAX_MEMORY_STORE_WINDOW_MS. Behaviour now matches the docs.

Changes

File	Change
src/http/app.ts	New exported resolveMcpRateLimitConfig(), used by createApp(). Uses readPositiveInt from the shared env reader; clamps windowMs at 2³¹-1.
tests/http-app.test.ts	+3 tests: malformed/negative fallback to defaults; over-large window clamps; positive overrides + disable flag honored.
DEPLOY.md	Env-var descriptions now explicitly mention fallback + clamp behaviour.
scripts/wire-trace-tasks.sh	Secret discovery generalized: env vars (CLIENT_ID / CLIENT_SECRET directly, or MCP_OAUTH_CLIENT_*) → Secret Manager (overridable via CLIENT_ID_SECRET / CLIENT_SECRET_SECRET) → fallback to DEPLOY.md's capsulemcp-client-secret name. Portable to ops contexts that don't use our specific Secret Manager naming.
HOWTO.md	Test count 460 → 463; bundle sizes refined to exact 144.74 / 171.21 KB.
CHANGELOG.md	[Unreleased] entry with both fixes.

Test plan

• npm run typecheck — clean
• npm run lint — clean
• npm run format:check — clean
• npm run build — dist/index.js 144.74 KB, dist/http.js 171.21 KB
• npm test — 463 / 463 (was 460 + 3 new env-parser tests)
• Privacy sweep — no internal infra leaks
• Branch-protection check name matches the new CI workflow ordering

🤖 Generated with Claude Code