@kynver-app/mcp-agent-os 0.3.62 → 0.3.65

package/dist/lib/kynver-client.js

@@ -49,8 +49,13 @@ function getHeaders() {
     const userId = ctx?.userId;
     const serviceSecret = process.env.KYNVER_SERVICE_SECRET;
     if (userId) {
+        const runnerToken = process.env.KYNVER_RUNNER_TOKEN?.trim();
+        if (runnerToken) {
+            headers["X-Kynver-Runner-Token"] = runnerToken;
+            return headers;
+        }
         if (!serviceSecret) {
-            throw new Error("X-Kynver-User-Id was set in context but KYNVER_SERVICE_SECRET is missing; refusing to send an unscoped request.");
+            throw new Error("User context requires authentication: set KYNVER_RUNNER_TOKEN (preferred) or KYNVER_SERVICE_SECRET in the MCP server environment.");
         }
         headers["X-Kynver-User-Id"] = userId;
         headers["X-Kynver-Service-Secret"] = serviceSecret;

package/dist/lib/mcp-sse-server.js

@@ -5,6 +5,13 @@ import { timingSafeEqual } from "node:crypto";
 import { SSEServerTransport } from "@modelcontextprotocol/sdk/server/sse.js";
 export const MAX_SSE_BODY_BYTES = 1 * 1024 * 1024;
 const FORBIDDEN_QUERY_KEYS = ["apiKey", "secret", "userId"];
+const TRUTHY_ENV = new Set(["1", "true", "yes", "on"]);
+function isServiceSecretImpersonationRejectedInProduction() {
+    const override = process.env.KYNVER_ALLOW_SERVICE_SECRET_IMPERSONATION?.trim().toLowerCase();
+    if (override !== undefined && TRUTHY_ENV.has(override))
+        return false;
+    return process.env.NODE_ENV === "production" || process.env.VERCEL_ENV === "production";
+}
 export function headerValue(req, name) {
     const v = req.headers[name];
     return typeof v === "string" ? v : Array.isArray(v) ? (v[0] ?? null) : null;
@@ -121,6 +128,8 @@ function resolveInternalAuth(req, serviceSecret) {
     const internalSecret = headerValue(req, "x-kynver-service-secret");
     if (!internalUserId || !serviceSecret || !internalSecret)
         return null;
+    if (isServiceSecretImpersonationRejectedInProduction())
+        return null;
     if (!timingSafeEqualString(internalSecret, serviceSecret))
         return null;
     return { userId: internalUserId, auth: { kind: "internal", userId: internalUserId } };

package/dist/tools/graph.d.ts

@@ -5,6 +5,9 @@
  * returns server-computed insights (bottlenecks, per-owner load, orphans) over
  * the operational graph. Read-only; the Kynver route enforces session +
  * workspace scope. Kept in its own module so server.ts stays slim.
+ *
+ * agent_os_memory_graph_expand (PR10) proxies scoped memory-entity neighborhood
+ * expansion through the authenticated app route — handles/previews only.
  */
 type ToolResult = {
     content: {

package/dist/tools/graph.js

@@ -5,6 +5,9 @@
  * returns server-computed insights (bottlenecks, per-owner load, orphans) over
  * the operational graph. Read-only; the Kynver route enforces session +
  * workspace scope. Kept in its own module so server.ts stays slim.
+ *
+ * agent_os_memory_graph_expand (PR10) proxies scoped memory-entity neighborhood
+ * expansion through the authenticated app route — handles/previews only.
  */
 import { z } from "zod";
 import { get, post } from "../lib/kynver-client.js";
@@ -110,4 +113,41 @@ export function registerGraphTools({ register, resolveToolSlug, jsonResult }) {
             source: "agent",
         }));
     });
+    register("agent_os_memory_graph_expand", [
+        "Expand a scoped memory-entity graph neighborhood from an opaque start handle.",
+        "Returns compact previews and expansion handles only — never raw entity IDs or full memory bodies.",
+        "Requires graph view + expansion security gates (scoped opt-in). Read-only.",
+    ].join(" "), {
+        slug: z.string().optional().describe("AgentOS slug. Defaults to env/primary."),
+        startEntityHandle: z
+            .string()
+            .describe("Opaque graph entity handle (gent:…) issued by the server."),
+        grantToken: z
+            .string()
+            .describe("Signed expansion grant (kve:g:…) bound to this graph handle and envelope."),
+        purpose: z
+            .string()
+            .describe("Informational only — the server enforces the graph-expansion purpose bound into the grant and ignores this value."),
+        envelopeId: z.string().describe("Active context envelope id binding this expansion."),
+        asOf: z.string().optional().describe("Optional UTC ISO as-of instant for temporal filtering."),
+        maxDepth: z
+            .number()
+            .int()
+            .min(1)
+            .max(1)
+            .optional()
+            .describe("Traversal depth; the server caps expansion depth at 1."),
+        maxNodes: z.number().int().min(1).max(36).optional(),
+    }, async (args) => {
+        const slug = await resolveToolSlug(args.slug);
+        return jsonResult(await post(`/agent-os/${slug}/memory-graph/expand`, {
+            startEntityHandle: args.startEntityHandle,
+            grantToken: args.grantToken,
+            purpose: args.purpose,
+            envelopeId: args.envelopeId,
+            asOf: args.asOf,
+            maxDepth: args.maxDepth,
+            maxNodes: args.maxNodes,
+        }));
+    });
 }

package/dist/tools/workbench.js

@@ -19,6 +19,20 @@ const commandKind = z.enum([
     "yield",
     "take",
 ]);
+/** Keep in sync with COMMAND_CENTER_VIEW_MODES in command-center-url-state.ts */
+const workbenchView = z.enum([
+    "overview",
+    "flow",
+    "marketing",
+    "projects",
+    "tasks",
+    "goals",
+    "dq",
+    "web",
+    "review",
+    "system",
+    "health",
+]);
 export function registerWorkbenchTools({ register, resolveToolSlug, jsonResult, }) {
     register("agent_os_workbench_query", [
         "Read the operator's current workbench focus (view mode, drilldown stack, focused entity)",
@@ -37,7 +51,7 @@ export function registerWorkbenchTools({ register, resolveToolSlug, jsonResult,
     ].join(" "), {
         slug: z.string().optional(),
         kind: commandKind,
-        view: z.enum(["projects", "tasks", "goals", "dq", "web"]).optional(),
+        view: workbenchView.optional(),
         target: z.string().optional().describe("EntityRef e.g. task:<id>, plan:<id>"),
         push: z.boolean().optional().describe("For drill: push onto stack (default true)"),
         panel: z.string().optional(),

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@kynver-app/mcp-agent-os",
-  "version": "0.3.62",
-  "description": "Kynver Agentic OS MCP server \u2014 slug-keyed agent identity, goals, projects, sessions, and long-term memory",
+  "version": "0.3.65",
+  "description": "Kynver Agentic OS MCP server — slug-keyed agent identity, goals, projects, sessions, and long-term memory",
   "type": "module",
   "bin": {
     "kynver-mcp-agent-os": "dist/index.js"