@kya-os/mcp-i-core 1.3.13 → 1.3.15

package/dist/config/remote-config.js

@@ -54,20 +54,17 @@ async function fetchRemoteConfig(options, cache) {
     }
     // Fetch from API
     try {
-        // Build API URL
-        let url;
-        if (projectId) {
-            // Use project-scoped endpoint (preferred)
-            url = `${apiUrl}${agentshield_api_1.AGENTSHIELD_ENDPOINTS.CONFIG(projectId)}`;
-        }
-        else if (agentDid) {
-            // Use agent-scoped endpoint
-            url = `${apiUrl}/api/v1/bouncer/config?agent_did=${encodeURIComponent(agentDid)}`;
-        }
-        else {
-            console.warn('[RemoteConfig] Neither projectId nor agentDid provided');
+        // ❌ REMOVED: Legacy agent-scoped endpoint fallback
+        // Agent-only scoping causes cross-user delegation leakage (Priority 3 fallback issue)
+        // projectId is now REQUIRED for proper user isolation
+        if (!projectId) {
+            console.error('[RemoteConfig] projectId is required for user-scoped delegation. ' +
+                'Agent-only scoping has been deprecated due to security concerns (cross-user delegation leakage). ' +
+                'Please configure AGENTSHIELD_PROJECT_ID environment variable.');
             return null;
         }
+        // ✅ PROJECT-SCOPED ENDPOINT: Ensures delegations are properly scoped to user+agent
+        const url = `${apiUrl}${agentshield_api_1.AGENTSHIELD_ENDPOINTS.CONFIG(projectId)}`;
         const response = await fetchProvider(url, {
             headers: {
                 'Authorization': `Bearer ${apiKey}`,

package/dist/runtime/base.d.ts

@@ -122,9 +122,10 @@ export declare class MCPIRuntimeBase {
      * @param session - Current session context
      * @param resumeToken - Token to resume after delegation
      * @param projectId - Project ID for AgentShield API
+     * @param provider - Provider name (e.g., "github", "credentials") to select specific auth method
      * @returns Full consent URL with snake_case parameters
      */
-    protected buildConsentUrl(toolName: string, scopes: string[], session?: any, resumeToken?: string, projectId?: string): string;
+    protected buildConsentUrl(toolName: string, scopes: string[], session?: any, resumeToken?: string, projectId?: string, provider?: string): string;
     /**
      * Issue a new nonce and register it in the cache
      * Use this to get a nonce for the session context before calling processToolCall

package/dist/runtime/base.js

@@ -271,7 +271,10 @@ class MCPIRuntimeBase {
                     const resumeToken = this.generateResumeToken(interceptedCall);
                     // Build consent URL with resume token
                     // Note: projectId is not available in base class - subclasses should override buildConsentUrl
-                    const consentUrl = this.buildConsentUrl(toolName, protection.requiredScopes, session, resumeToken);
+                    // Pass oauthProvider to ensure correct auth method is selected (e.g., "credentials" vs "github")
+                    const consentUrl = this.buildConsentUrl(toolName, protection.requiredScopes, session, resumeToken, undefined, // projectId - handled by subclass override
+                    protection.oauthProvider // Provider from tool config
+                    );
                     // Create error with intercepted call context and pre-generated resume token
                     const error = new tool_protection_js_1.DelegationRequiredError(toolName, protection.requiredScopes, consentUrl, interceptedCall, resumeToken);
                     // Store intercepted call for resumption
@@ -321,6 +324,17 @@ class MCPIRuntimeBase {
                             agent_did: identity.did,
                             scopes: protection.requiredScopes,
                         };
+                        // ✅ CRITICAL: Include user_did for user-scoped delegation verification
+                        // This prevents cross-user delegation leakage (Priority 3 fallback issue)
+                        // Without user_did, AgentShield cannot validate user isolation
+                        if (session?.userDid) {
+                            verifyRequest.user_did = session.userDid;
+                            if (this.config.audit?.enabled) {
+                                console.log("[MCP-I] 🔐 Including user_did in verification request", {
+                                    userDid: session.userDid.slice(0, 20) + "...",
+                                });
+                            }
+                        }
                         // Add delegation token if available (preferred over consent proof)
                         if (delegationToken) {
                             verifyRequest.delegation_token = delegationToken;
@@ -368,7 +382,9 @@ class MCPIRuntimeBase {
                                 expiresAt: this.clock.calculateExpiry(1800), // 30 minutes
                             };
                             const resumeToken = this.generateResumeToken(interceptedCall);
-                            const consentUrl = this.buildConsentUrl(toolName, protection.requiredScopes, session, resumeToken);
+                            const consentUrl = this.buildConsentUrl(toolName, protection.requiredScopes, session, resumeToken, undefined, // projectId - handled by subclass override
+                            protection.oauthProvider // Provider from tool config
+                            );
                             this.interceptedCalls.set(resumeToken, interceptedCall);
                             this.cleanupExpiredInterceptedCalls();
                             throw new tool_protection_js_1.DelegationRequiredError(toolName, protection.requiredScopes, consentUrl, interceptedCall, resumeToken);
@@ -402,7 +418,9 @@ class MCPIRuntimeBase {
                                     expiresAt: this.clock.calculateExpiry(1800), // 30 minutes
                                 };
                                 const resumeToken = this.generateResumeToken(interceptedCall);
-                                const consentUrl = this.buildConsentUrl(toolName, protection.requiredScopes, session, resumeToken);
+                                const consentUrl = this.buildConsentUrl(toolName, protection.requiredScopes, session, resumeToken, undefined, // projectId - handled by subclass override
+                                protection.oauthProvider // Provider from tool config
+                                );
                                 this.interceptedCalls.set(resumeToken, interceptedCall);
                                 this.cleanupExpiredInterceptedCalls();
                                 throw new tool_protection_js_1.DelegationRequiredError(toolName, protection.requiredScopes, consentUrl, interceptedCall, resumeToken);
@@ -466,7 +484,9 @@ class MCPIRuntimeBase {
                                 expiresAt: this.clock.calculateExpiry(1800),
                             };
                             const resumeToken = this.generateResumeToken(interceptedCall);
-                            const consentUrl = this.buildConsentUrl(toolName, protection.requiredScopes, session, resumeToken);
+                            const consentUrl = this.buildConsentUrl(toolName, protection.requiredScopes, session, resumeToken, undefined, // projectId - handled by subclass override
+                            protection.oauthProvider // Provider from tool config
+                            );
                             this.interceptedCalls.set(resumeToken, interceptedCall);
                             this.cleanupExpiredInterceptedCalls();
                             throw new tool_protection_js_1.DelegationRequiredError(toolName, protection.requiredScopes, consentUrl, interceptedCall, resumeToken);
@@ -489,7 +509,9 @@ class MCPIRuntimeBase {
                             expiresAt: this.clock.calculateExpiry(1800),
                         };
                         const resumeToken = this.generateResumeToken(interceptedCall);
-                        const consentUrl = this.buildConsentUrl(toolName, protection.requiredScopes, session, resumeToken);
+                        const consentUrl = this.buildConsentUrl(toolName, protection.requiredScopes, session, resumeToken, undefined, // projectId - handled by subclass override
+                        protection.oauthProvider // Provider from tool config
+                        );
                         this.interceptedCalls.set(resumeToken, interceptedCall);
                         this.cleanupExpiredInterceptedCalls();
                         throw new tool_protection_js_1.DelegationRequiredError(toolName, protection.requiredScopes, consentUrl, interceptedCall, resumeToken);
@@ -605,9 +627,10 @@ class MCPIRuntimeBase {
      * @param session - Current session context
      * @param resumeToken - Token to resume after delegation
      * @param projectId - Project ID for AgentShield API
+     * @param provider - Provider name (e.g., "github", "credentials") to select specific auth method
      * @returns Full consent URL with snake_case parameters
      */
-    buildConsentUrl(toolName, scopes, session, resumeToken, projectId) {
+    buildConsentUrl(toolName, scopes, session, resumeToken, projectId, provider) {
         // Default implementation - override in subclasses
         // This URL should point to AgentShield's consent page
         // Parameter names use snake_case for AgentShield API compatibility
@@ -625,6 +648,11 @@ class MCPIRuntimeBase {
         if (resumeToken) {
             params.set("resume_token", resumeToken);
         }
+        // Add provider if specified (allows selecting specific auth method like "credentials" or "github")
+        // This is critical when multiple providers are configured for a project
+        if (provider) {
+            params.set("provider", provider);
+        }
         // Use AgentShield consent endpoint
         return `https://kya.vouched.id/bouncer/consent?${params.toString()}`;
     }

package/dist/services/access-control.service.js

@@ -113,6 +113,11 @@ class AccessControlApiService {
             if (request.scopes !== undefined) {
                 requestBody.scopes = request.scopes;
             }
+            // ✅ CRITICAL: Include user_did for user-scoped delegation verification
+            // This prevents cross-user delegation leakage (Priority 3 fallback issue)
+            if (request.user_did !== undefined) {
+                requestBody.user_did = request.user_did;
+            }
             // Handle credential_jwt: prefer request, fallback to context
             if (request.credential_jwt !== undefined) {
                 requestBody.credential_jwt = request.credential_jwt;

package/dist/services/tool-protection.service.js

@@ -409,6 +409,10 @@ class ToolProtectionService {
             if (errorMessage.includes("API key is missing or empty")) {
                 throw error;
             }
+            // Re-throw projectId required errors (security fix - don't fallback)
+            if (errorMessage.includes("projectId is required")) {
+                throw error;
+            }
             // Re-throw HTTP errors (4xx, 5xx) - these indicate API issues, not network failures
             // Exception: 429 (rate limit) should fallback if fallback config is available
             if (errorMessage.includes("Failed to fetch bouncer config:")) {
@@ -541,15 +545,20 @@ class ToolProtectionService {
         // This endpoint returns config.toolProtection.tools with all tool rules
         let url;
         let useMergedEndpoint = false;
-        if (this.config.projectId) {
-            // ✅ MERGED CONFIG ENDPOINT: Returns config with embedded toolProtection.tools
-            url = `${this.config.apiUrl}/api/v1/bouncer/projects/${encodeURIComponent(this.config.projectId)}/config`;
-            useMergedEndpoint = true;
-        }
-        else {
-            // ⚠️ LEGACY ENDPOINT: Agent-scoped, returns tools array (backward compatibility)
-            url = `${this.config.apiUrl}/api/v1/bouncer/config?agent_did=${encodeURIComponent(agentDid)}`;
+        // ❌ REMOVED: Legacy agent-scoped endpoint fallback
+        // Agent-only scoping causes cross-user delegation leakage (Priority 3 fallback issue)
+        // projectId is now REQUIRED for proper user isolation
+        if (!this.config.projectId) {
+            const error = new Error("[ToolProtectionService] projectId is required for user-scoped delegation. " +
+                "Agent-only scoping has been deprecated due to security concerns (cross-user delegation leakage). " +
+                "Please configure AGENTSHIELD_PROJECT_ID environment variable.");
+            console.error("[ToolProtectionService]", error.message);
+            throw error;
         }
+        // ✅ PROJECT-SCOPED ENDPOINT: Returns config with embedded toolProtection.tools
+        // This endpoint ensures delegations are properly scoped to user+agent
+        url = `${this.config.apiUrl}/api/v1/bouncer/projects/${encodeURIComponent(this.config.projectId)}/config`;
+        useMergedEndpoint = true;
         // Add cache-busting query param when bypassing CDN cache
         // This is used during cache invalidation (clearAndRefresh) to ensure we get fresh data
         // from the origin server, not stale CDN-cached data

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kya-os/mcp-i-core",
-  "version": "1.3.13",
+  "version": "1.3.15",
   "description": "Core runtime and types for MCP-I framework",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
@@ -28,7 +28,7 @@
     "prepublishOnly": "npm run build && node ../create-mcpi-app/scripts/validate-no-workspace.js"
   },
   "dependencies": {
-    "@kya-os/contracts": "^1.6.5",
+    "@kya-os/contracts": "^1.6.8",
     "jose": "^5.6.3",
     "json-canonicalize": "^2.0.0",
     "zod": "^3.25.76"

package/.turbo/turbo-build.log

@@ -1,4 +0,0 @@
-
-> @kya-os/mcp-i-core@1.3.12 build /Users/dylanhobbs/Documents/@kya-os/xmcp-i/packages/mcp-i-core
-> tsc
-