patchwork-rb 0.1.3 → 0.1.4

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 242267fcd3ddc369be17e976228f9106b9d1ecbc9b5a2e6d1c7848b3e021667a
-  data.tar.gz: '0396a4b146c596df95003bc844c96092c69daf6b0fa8535ee4259a9b0dd7efed'
+  metadata.gz: c5b4e037d427bdd50e672f5f08ff93f8f4e129c42c998224162f7a6296988d2c
+  data.tar.gz: 59c03fbcbbfff9f6b6c27a006f3b37da9f8d995c3bb1f29d1168af2c619d6f17
 SHA512:
-  metadata.gz: dada508727728393bce618506e53dbe5dd88b100a3c7bf83e1a09c6a641d4c84a3fea5c8301261b0fe0dc6ccfb92cf669389bf8024ee74d9d399441368f6aae0
-  data.tar.gz: 879dd1640710686be7ff031d2576b8b312f57cbbe019f636446f0328caff46c7e9b9774ad4fcd055ee6a0c2a8af4c2ff634d58734d17bcb98c4b21c1a5bd13f8
+  metadata.gz: ee481c8625a8556c87f7924a4766e77588c0dbcd9a3529cb1041b74cafcc4610cdb1063f00ff607daac78eb1ef93861086926be81b2a897d029b47bfbc472a08
+  data.tar.gz: b0392464c771cfd3323ac2384cce4982f9bf75f62fbe79f7c03f578480b9ed1be0817a6f5e4ad89a7dd0c23161e5306d693fa878c5098121e366d9d56191ecb3

data/README.md

@@ -32,6 +32,7 @@ end
 | `audience` | minting, tool calls | No default. Tokens carry `["patchwork", audience]`, and tool calls are verified against it. |
 | `request_secret` | tool calls, health check | Set `previous_request_secret` during a rotation. |
 | `signing_kid` | optional | Defaults to the key's RFC 7638 thumbprint, so a new key gets a new `kid` automatically. |
+| `connection_id` | optional | Set it when the agent has unpinned customer tools. A connection UUID, not a name. Minted tokens carry it as `conn`, including the ones the relay mint and the gateway issue. |
 | `token_ttl` | optional | Seconds. Defaults to 120. The browser remints as needed. |
 | `max_token_lifetime` | optional | Seconds. Defaults to 900. Verification refuses a token whose own `exp - iat` is longer, so a good signature over an absurd expiry is still rejected. `nil` turns the check off. |
 
@@ -137,9 +138,9 @@ end
 
 Build the subject from server state, never from request params. On the direct branch that is the whole of your authorisation.
 
-`Mint.relay` mints for exactly the subject Patchwork sent, never a default, and verifies the signature before it reads the subject at all. Pass `connection_id:` to `issue` when the agent has unpinned customer tools; it takes a connection UUID, not a name.
+Set `connection_id` in your configuration when the agent has unpinned customer tools, and every minted token carries it — the direct branch, the relay branch, and the gateway. `issue` also takes `connection_id:` for a one-off. It is a connection UUID, not a name.
 
-`jwks` publishes the public half of your signing key, so Patchwork can verify what you minted. Set its URL on your workspace.
+`Mint.relay` mints for exactly the subject Patchwork sent, never a default, and verifies the signature before it reads the subject at all. `jwks` publishes the public half of your signing key, so Patchwork can verify what you minted. Set its URL on your workspace.
 
 If you mount the gateway in section 4, `mint_path: "/patchwork/mint"` makes it answer the relay call before your controller sees it, and you can drop `relay_mint`. Your frontend's unsigned request still reaches `mint`.
 

data/lib/patchwork/configuration.rb

@@ -10,7 +10,7 @@ module Patchwork
     #                and the one it replaced while a rotation is in flight.
     attr_accessor :signing_key, :signing_kid, :issuer, :audience,
                   :request_secret, :previous_request_secret, :token_ttl,
-                  :max_token_lifetime
+                  :max_token_lifetime, :connection_id
 
     DEFAULT_TTL = 120
     DEFAULT_MAX_TOKEN_LIFETIME = 900
@@ -45,7 +45,7 @@ module Patchwork
     # Default #inspect prints every ivar, so a config that reaches a log line,
     # an error tracker or a console would carry the private key with it.
     def inspect
-      fields = %i[issuer audience signing_kid token_ttl max_token_lifetime].map { |name| "#{name}=#{public_send(name).inspect}" }
+      fields = %i[issuer audience signing_kid connection_id token_ttl max_token_lifetime].map { |name| "#{name}=#{public_send(name).inspect}" }
       fields += SECRETS.map { |name| "#{name}=#{public_send(name).to_s.empty? ? 'nil' : '[REDACTED]'}" }
       "#<Patchwork::Configuration #{fields.join(', ')}>"
     end

data/lib/patchwork/gateway.rb

@@ -97,7 +97,8 @@ module Patchwork
     def relay_mint(request, signature)
       body = verify_signature!(request, signature, limit: MAX_CONTROL_BODY_BYTES)
       subject = Mint.relay_subject(body)
-      json(201, { token: SessionToken.issue(subject: subject), expires_in: Patchwork.config.token_ttl })
+      token = SessionToken.issue(subject: subject, connection_id: Patchwork.config.connection_id)
+      json(201, { token: token, expires_in: Patchwork.config.token_ttl })
     rescue Mint::BadRequest => e
       json(400, { error: e.message })
     end

data/lib/patchwork/mint.rb

@@ -16,11 +16,13 @@ module Patchwork
     # Verifies the presenter signature, then mints for exactly the subject in
     # the body — never a default, never a widened one. Raises InvalidSignature,
     # StaleSignature or BadRequest.
-    def self.relay(body:, signature:, path:, secrets: Patchwork.config.request_secrets)
+    def self.relay(body:, signature:, path:, secrets: Patchwork.config.request_secrets,
+                   connection_id: Patchwork.config.connection_id)
       raise BadRequest, "mint body too large" if body.to_s.bytesize > MAX_BODY_BYTES
 
       Signature.verify!(secrets: secrets, header: signature, method: "POST", path: path, body: body)
-      { token: SessionToken.issue(subject: relay_subject(body)), expires_in: Patchwork.config.token_ttl }
+      token = SessionToken.issue(subject: relay_subject(body), connection_id: connection_id)
+      { token: token, expires_in: Patchwork.config.token_ttl }
     end
 
     def self.relay_subject(body)

data/lib/patchwork/version.rb

@@ -1,3 +1,3 @@
 module Patchwork
-  VERSION = "0.1.3".freeze
+  VERSION = "0.1.4".freeze
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: patchwork-rb
 version: !ruby/object:Gem::Version
-  version: 0.1.3
+  version: 0.1.4
 platform: ruby
 authors:
 - Chromablue Labs
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2026-10-04 00:00:00.000000000 Z
+date: 2026-10-05 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: jwt