@integrity-labs/xero-broker 0.1.1 → 0.1.2

package/dist/index.js

@@ -20985,6 +20985,26 @@ var StdioServerTransport = class {
   }
 };
 
+// src/turn-initiator-marker.ts
+import { readFileSync } from "fs";
+var TURN_INITIATOR_MAX_AGE_MS = 5 * 60 * 1e3;
+function readTurnInitiator(maxAgeMs = TURN_INITIATOR_MAX_AGE_MS) {
+  const file = process.env["AGT_TURN_INITIATOR_FILE"];
+  if (!file) return null;
+  try {
+    const raw = readFileSync(file, "utf8");
+    const m = JSON.parse(raw);
+    if (typeof m.channel !== "string" || !m.channel) return null;
+    if (typeof m.sender_id !== "string" || !m.sender_id) return null;
+    if (typeof m.ts !== "number" || !Number.isFinite(m.ts)) return null;
+    const age = Date.now() - m.ts;
+    if (age < 0 || age > maxAgeMs) return null;
+    return { channel: m.channel, sender_id: m.sender_id };
+  } catch {
+    return null;
+  }
+}
+
 // src/broker-client.ts
 function makeBrokerError(status, message, detail) {
   const err = new Error(message);
@@ -21103,8 +21123,16 @@ var XeroBrokerClient = class {
     if (!runId) {
       throw makeBrokerError(400, "XeroBrokerClient.requestApproval requires runId");
     }
+    const turnInitiator = readTurnInitiator();
+    const { turn_initiator: _ignoredForged, ...safeArgs } = args;
+    void _ignoredForged;
     return this.request("POST", "/xero-broker/requests", {
-      body: { ...args, agent_id: agentId, run_id: runId }
+      body: {
+        ...safeArgs,
+        agent_id: agentId,
+        run_id: runId,
+        ...turnInitiator ? { turn_initiator: turnInitiator } : {}
+      }
     });
   }
   pollDecision(args) {
@@ -21179,7 +21207,7 @@ var awaitDecisionSchema = external_exports.object({
 // package.json
 var package_default = {
   name: "@integrity-labs/xero-broker",
-  version: "0.1.1",
+  version: "0.1.2",
   description: "Xero Broker \u2014 MCP server that routes money- and ledger-touching Xero writes through approval-core (HITL). Sibling to cloud-broker / channel-broker; the only write path for an agent once the vendor xero-mcp-server's write tools are stripped. ENG-4922.",
   type: "module",
   bin: {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@integrity-labs/xero-broker",
-  "version": "0.1.1",
+  "version": "0.1.2",
   "description": "Xero Broker — MCP server that routes money- and ledger-touching Xero writes through approval-core (HITL). Sibling to cloud-broker / channel-broker; the only write path for an agent once the vendor xero-mcp-server's write tools are stripped. ENG-4922.",
   "type": "module",
   "bin": {