@kynver-app/mcp-agent-os 0.3.45 → 0.3.47

package/dist/lib/mcp-sse-server.js

@@ -4,7 +4,7 @@ import { createServer } from "node:http";
 import { timingSafeEqual } from "node:crypto";
 import { SSEServerTransport } from "@modelcontextprotocol/sdk/server/sse.js";
 export const MAX_SSE_BODY_BYTES = 1 * 1024 * 1024;
-const FORBIDDEN_QUERY_KEYS = ["secret", "userId"];
+const FORBIDDEN_QUERY_KEYS = ["apiKey", "secret", "userId"];
 export function headerValue(req, name) {
     const v = req.headers[name];
     return typeof v === "string" ? v : Array.isArray(v) ? (v[0] ?? null) : null;
@@ -19,9 +19,6 @@ export function timingSafeEqualString(a, b) {
 export function hasForbiddenQueryAuth(url) {
     return FORBIDDEN_QUERY_KEYS.some((key) => url.searchParams.has(key));
 }
-function queryApiKey(url) {
-    return url.searchParams.get("apiKey")?.trim() ?? "";
-}
 export function resolveListenHost() {
     const configured = process.env.MCP_SSE_HOST?.trim();
     return configured || "127.0.0.1";
@@ -130,7 +127,7 @@ function resolveInternalAuth(req, serviceSecret) {
 }
 function verifyPostAuth(req, url, sessionAuth, serviceSecret) {
     if (sessionAuth.kind === "apiKey") {
-        const token = bearerToken(req) || queryApiKey(url);
+        const token = bearerToken(req);
         return token.length > 0 && timingSafeEqualString(token, sessionAuth.apiKey);
     }
     const internal = resolveInternalAuth(req, serviceSecret);
@@ -170,7 +167,6 @@ export function startKynverMcpSseServer(options) {
     const maxSessionsPerUser = intFromEnv("MCP_SSE_MAX_SESSIONS_PER_USER", 20);
     const idleTimeoutMs = intFromEnv("MCP_SSE_IDLE_TIMEOUT_MS", 5 * 60 * 1000);
     const rateLimitPerMin = intFromEnv("MCP_SSE_RATE_LIMIT_PER_MIN", 120);
-    const rejectQueryApiKey = /^(1|true|yes)$/i.test(process.env.MCP_SSE_REJECT_QUERY_APIKEY ?? "");
     const rateLimiter = createFixedWindowRateLimiter(rateLimitPerMin, 60 * 1000);
     // Close idle SSE sessions so a flood of half-open connections can't pin memory.
     const idleSweep = setInterval(() => {
@@ -198,15 +194,6 @@ export function startKynverMcpSseServer(options) {
                 });
                 return;
             }
-            if (url.searchParams.has("apiKey")) {
-                if (rejectQueryApiKey) {
-                    json(res, 400, {
-                        error: "apiKey via query param is disabled. Use Authorization: Bearer <key>.",
-                    });
-                    return;
-                }
-                console.warn("[MCP SSE] WARNING: apiKey in query string may leak via logs. Prefer Authorization header when your client supports it.");
-            }
             let userId = null;
             let auth = null;
             const internal = serviceSecret ? resolveInternalAuth(req, serviceSecret) : null;
@@ -215,7 +202,7 @@ export function startKynverMcpSseServer(options) {
                 auth = internal.auth;
             }
             else {
-                const apiKey = bearerToken(req) || queryApiKey(url);
+                const apiKey = bearerToken(req);
                 if (apiKey) {
                     userId = await resolveUserFromApiKey(baseUrl, apiKey);
                     if (userId)

package/dist/server.js

@@ -11,6 +11,7 @@ import { z } from "zod";
 import { get, post, patch } from "./lib/kynver-client.js";
 import { registerPlanTools } from "./tools/plans.js";
 import { registerPlanProgressTools } from "./tools/plan-progress.js";
+import { registerPlanToFactoryTools } from "./tools/plan-to-factory.js";
 import { registerTaskTools } from "./tools/tasks.js";
 import { registerActionRequiredTools } from "./tools/action-required.js";
 import { registerGraphTools } from "./tools/graph.js";
@@ -709,6 +710,7 @@ export function createAgentOsServer() {
     // First-class AgentOS plans (Phase 5A): versioned operational artifacts.
     registerPlanTools({ register, resolveToolSlug, jsonResult, compact });
     registerPlanProgressTools({ register, resolveToolSlug, jsonResult, compact });
+    registerPlanToFactoryTools({ register, resolveToolSlug, jsonResult, compact });
     // Action Required inbox: agent_os_ask_human + agent_os_await_action (slice 1).
     registerActionRequiredTools({ register, jsonResult, compact });
     // Operational graph insights — Agent SEE (agent_os_graph_query).

package/dist/tools/plan-to-factory.d.ts

@@ -0,0 +1,2 @@
+import type { PlanToolDeps } from "./plans.js";
+export declare function registerPlanToFactoryTools({ register, resolveToolSlug, jsonResult, }: PlanToolDeps): void;

package/dist/tools/plan-to-factory.js

@@ -0,0 +1,23 @@
+import { z } from "zod";
+import { post } from "../lib/kynver-client.js";
+export function registerPlanToFactoryTools({ register, resolveToolSlug, jsonResult, }) {
+    const slugField = z
+        .string()
+        .optional()
+        .describe("AgentOS workspace slug. Omit to use env or the server-discovered primary.");
+    register("agent_os_plan_run_factory", "Run a plan through the factory: decompose progress rows, mint parent + child harness tasks, wire dependencies and owned paths, and return the next runnable slice.", {
+        planId: z.string(),
+        dryRun: z.boolean().optional(),
+        command: z
+            .string()
+            .optional()
+            .describe('Operator phrase; defaults to "run this plan through the factory".'),
+        slug: slugField,
+    }, async (args) => {
+        const s = await resolveToolSlug(args.slug);
+        return jsonResult(await post(`/agent-os/${s}/plans/${args.planId}/run-factory`, {
+            dryRun: args.dryRun,
+            command: args.command,
+        }));
+    });
+}

package/dist/tools/tasks.js

@@ -147,7 +147,7 @@ export function registerTaskTools({ register, resolveToolSlug, jsonResult, compa
         scheduledFor,
         dependsOnTaskIds,
         lastSummary: z.string().optional().describe("Latest progress summary."),
-        blocker: z.string().optional(),
+        blocker: z.string().nullable().optional().describe("Blocker text, or null to clear it."),
         branch: z.string().optional(),
         worktreePath: z.string().optional(),
         prUrl: z.string().optional(),

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@kynver-app/mcp-agent-os",
-  "version": "0.3.45",
-  "description": "Kynver Agentic OS MCP server — slug-keyed agent identity, goals, projects, sessions, and long-term memory",
+  "version": "0.3.47",
+  "description": "Kynver Agentic OS MCP server \u2014 slug-keyed agent identity, goals, projects, sessions, and long-term memory",
   "type": "module",
   "bin": {
     "kynver-mcp-agent-os": "dist/index.js"
@@ -18,6 +18,7 @@
     "build": "node --max-old-space-size=8192 ../../node_modules/typescript/bin/tsc",
     "dev": "node --max-old-space-size=8192 ../../node_modules/typescript/bin/tsc --watch",
     "start": "node dist/index.js",
+    "prepublishOnly": "npm run build && node ../../scripts/npm-publish-guard.mjs",
     "start:sse": "node dist/sse.js"
   },
   "engines": {