@algosuite/vo-mcp 0.2.0-beta.21 → 0.2.0-beta.22

package/dist/runner-supervisor.js

@@ -36,6 +36,31 @@ import { createRequire } from "node:module";
 import { fileURLToPath as fileURLToPath3 } from "node:url";
 import { dirname as dirname4, join as join5 } from "node:path";
 
+// ../../scripts/virtual-office/code-runner/installation-token.mjs
+var READ_TOKEN_TIMEOUT_MS = 15e3;
+async function fetchInstallationToken({ req, required = false, readOnly = false, repo = null }) {
+  const fail = (reason) => {
+    if (required) throw new Error(`installation-token required: ${reason}`);
+    return null;
+  };
+  try {
+    const res = await req(
+      "POST",
+      "/api/v1/github/installation-token",
+      readOnly ? { scope: "read", ...repo ? { repo } : {} } : {},
+      readOnly ? { timeoutMs: READ_TOKEN_TIMEOUT_MS } : {}
+    );
+    if (!res.ok) return fail(`HTTP ${res.status}`);
+    const json = await res.json();
+    if (!json || !json.token) return fail("missing token");
+    if (readOnly && json.scope !== "read") return fail("control plane did not confirm a read-only grant");
+    return { token: json.token, expiresAt: json.expires_at || null };
+  } catch (err) {
+    if (required) throw err;
+    return null;
+  }
+}
+
 // ../../scripts/virtual-office/code-runner/control-plane-client.mjs
 var cachedFirebaseToken = null;
 async function resolveBearer(env) {
@@ -345,37 +370,9 @@ function createControlPlaneClient({
       const json = await res.json();
       return json?.action || null;
     },
-    /**
-     * Mint a short-lived (~1h), repo-scoped GitHub App installation token for
-     * THIS runner's operator (M3). The control-plane keys the mint on the
-     * authenticated operator (ctx.operator_id), so the token covers only that
-     * operator's installation.
-     *
-     * Returns { token, expiresAt } on success. In legacy/admin mode it returns
-     * null on a miss so the caller may use ambient `gh`. In scoped-operator mode
-     * callers pass `{ required: true }`, which fails closed instead of letting a
-     * missing/mis-scoped installation fall through to the runner machine's `gh`.
-     *
-     * The minted token is only usable for push + PR if the GitHub App grants
-     * BOTH `Contents: write` (git push) AND `Pull requests: write` (gh pr
-     * create) — see docs/vo/github-app-setup-2026-06-18.md. A token missing
-     * either scope fails at push (→ ambient fallback) or at `gh pr create`.
-     */
-    async getInstallationToken({ required = false } = {}) {
-      const fail = (reason) => {
-        if (required) throw new Error(`installation-token required: ${reason}`);
-        return null;
-      };
-      try {
-        const res = await req("POST", "/api/v1/github/installation-token", {});
-        if (!res.ok) return fail(`HTTP ${res.status}`);
-        const json = await res.json();
-        if (!json || !json.token) return fail("missing token");
-        return { token: json.token, expiresAt: json.expires_at || null };
-      } catch (err) {
-        if (required) throw err;
-        return null;
-      }
+    /** Mint a GitHub App installation token — see installation-token.mjs. */
+    async getInstallationToken({ required = false, readOnly = false, repo = null } = {}) {
+      return fetchInstallationToken({ req, required, readOnly, repo });
     },
     /**
      * Read the operator's dispatch-mode config (Fast→Ultracode effort setting).