@kya-os/mcp-i-core 1.3.12 → 1.3.14

package/dist/config/remote-config.js

@@ -54,20 +54,17 @@ async function fetchRemoteConfig(options, cache) {
     }
     // Fetch from API
     try {
-        // Build API URL
-        let url;
-        if (projectId) {
-            // Use project-scoped endpoint (preferred)
-            url = `${apiUrl}${agentshield_api_1.AGENTSHIELD_ENDPOINTS.CONFIG(projectId)}`;
-        }
-        else if (agentDid) {
-            // Use agent-scoped endpoint
-            url = `${apiUrl}/api/v1/bouncer/config?agent_did=${encodeURIComponent(agentDid)}`;
-        }
-        else {
-            console.warn('[RemoteConfig] Neither projectId nor agentDid provided');
+        // ❌ REMOVED: Legacy agent-scoped endpoint fallback
+        // Agent-only scoping causes cross-user delegation leakage (Priority 3 fallback issue)
+        // projectId is now REQUIRED for proper user isolation
+        if (!projectId) {
+            console.error('[RemoteConfig] projectId is required for user-scoped delegation. ' +
+                'Agent-only scoping has been deprecated due to security concerns (cross-user delegation leakage). ' +
+                'Please configure AGENTSHIELD_PROJECT_ID environment variable.');
             return null;
         }
+        // ✅ PROJECT-SCOPED ENDPOINT: Ensures delegations are properly scoped to user+agent
+        const url = `${apiUrl}${agentshield_api_1.AGENTSHIELD_ENDPOINTS.CONFIG(projectId)}`;
         const response = await fetchProvider(url, {
             headers: {
                 'Authorization': `Bearer ${apiKey}`,

package/dist/runtime/base.js

@@ -321,6 +321,17 @@ class MCPIRuntimeBase {
                             agent_did: identity.did,
                             scopes: protection.requiredScopes,
                         };
+                        // ✅ CRITICAL: Include user_did for user-scoped delegation verification
+                        // This prevents cross-user delegation leakage (Priority 3 fallback issue)
+                        // Without user_did, AgentShield cannot validate user isolation
+                        if (session?.userDid) {
+                            verifyRequest.user_did = session.userDid;
+                            if (this.config.audit?.enabled) {
+                                console.log("[MCP-I] 🔐 Including user_did in verification request", {
+                                    userDid: session.userDid.slice(0, 20) + "...",
+                                });
+                            }
+                        }
                         // Add delegation token if available (preferred over consent proof)
                         if (delegationToken) {
                             verifyRequest.delegation_token = delegationToken;

package/dist/services/access-control.service.js

@@ -113,6 +113,11 @@ class AccessControlApiService {
             if (request.scopes !== undefined) {
                 requestBody.scopes = request.scopes;
             }
+            // ✅ CRITICAL: Include user_did for user-scoped delegation verification
+            // This prevents cross-user delegation leakage (Priority 3 fallback issue)
+            if (request.user_did !== undefined) {
+                requestBody.user_did = request.user_did;
+            }
             // Handle credential_jwt: prefer request, fallback to context
             if (request.credential_jwt !== undefined) {
                 requestBody.credential_jwt = request.credential_jwt;

package/dist/services/tool-protection.service.js

@@ -409,6 +409,10 @@ class ToolProtectionService {
             if (errorMessage.includes("API key is missing or empty")) {
                 throw error;
             }
+            // Re-throw projectId required errors (security fix - don't fallback)
+            if (errorMessage.includes("projectId is required")) {
+                throw error;
+            }
             // Re-throw HTTP errors (4xx, 5xx) - these indicate API issues, not network failures
             // Exception: 429 (rate limit) should fallback if fallback config is available
             if (errorMessage.includes("Failed to fetch bouncer config:")) {
@@ -541,15 +545,20 @@ class ToolProtectionService {
         // This endpoint returns config.toolProtection.tools with all tool rules
         let url;
         let useMergedEndpoint = false;
-        if (this.config.projectId) {
-            // ✅ MERGED CONFIG ENDPOINT: Returns config with embedded toolProtection.tools
-            url = `${this.config.apiUrl}/api/v1/bouncer/projects/${encodeURIComponent(this.config.projectId)}/config`;
-            useMergedEndpoint = true;
-        }
-        else {
-            // ⚠️ LEGACY ENDPOINT: Agent-scoped, returns tools array (backward compatibility)
-            url = `${this.config.apiUrl}/api/v1/bouncer/config?agent_did=${encodeURIComponent(agentDid)}`;
+        // ❌ REMOVED: Legacy agent-scoped endpoint fallback
+        // Agent-only scoping causes cross-user delegation leakage (Priority 3 fallback issue)
+        // projectId is now REQUIRED for proper user isolation
+        if (!this.config.projectId) {
+            const error = new Error("[ToolProtectionService] projectId is required for user-scoped delegation. " +
+                "Agent-only scoping has been deprecated due to security concerns (cross-user delegation leakage). " +
+                "Please configure AGENTSHIELD_PROJECT_ID environment variable.");
+            console.error("[ToolProtectionService]", error.message);
+            throw error;
         }
+        // ✅ PROJECT-SCOPED ENDPOINT: Returns config with embedded toolProtection.tools
+        // This endpoint ensures delegations are properly scoped to user+agent
+        url = `${this.config.apiUrl}/api/v1/bouncer/projects/${encodeURIComponent(this.config.projectId)}/config`;
+        useMergedEndpoint = true;
         // Add cache-busting query param when bypassing CDN cache
         // This is used during cache invalidation (clearAndRefresh) to ensure we get fresh data
         // from the origin server, not stale CDN-cached data

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kya-os/mcp-i-core",
-  "version": "1.3.12",
+  "version": "1.3.14",
   "description": "Core runtime and types for MCP-I framework",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
@@ -28,7 +28,7 @@
     "prepublishOnly": "npm run build && node ../create-mcpi-app/scripts/validate-no-workspace.js"
   },
   "dependencies": {
-    "@kya-os/contracts": "^1.6.5",
+    "@kya-os/contracts": "^1.6.7",
     "jose": "^5.6.3",
     "json-canonicalize": "^2.0.0",
     "zod": "^3.25.76"

package/.turbo/turbo-build.log

@@ -1,4 +0,0 @@
-
-> @kya-os/mcp-i-core@1.3.12 build /Users/dylanhobbs/Documents/@kya-os/xmcp-i/packages/mcp-i-core
-> tsc
-