@kynver-app/mcp-agent-os 0.3.63 → 0.3.65

package/dist/lib/kynver-client.js

@@ -49,8 +49,13 @@ function getHeaders() {
     const userId = ctx?.userId;
     const serviceSecret = process.env.KYNVER_SERVICE_SECRET;
     if (userId) {
+        const runnerToken = process.env.KYNVER_RUNNER_TOKEN?.trim();
+        if (runnerToken) {
+            headers["X-Kynver-Runner-Token"] = runnerToken;
+            return headers;
+        }
         if (!serviceSecret) {
-            throw new Error("X-Kynver-User-Id was set in context but KYNVER_SERVICE_SECRET is missing; refusing to send an unscoped request.");
+            throw new Error("User context requires authentication: set KYNVER_RUNNER_TOKEN (preferred) or KYNVER_SERVICE_SECRET in the MCP server environment.");
         }
         headers["X-Kynver-User-Id"] = userId;
         headers["X-Kynver-Service-Secret"] = serviceSecret;

package/dist/lib/mcp-sse-server.js

@@ -5,6 +5,13 @@ import { timingSafeEqual } from "node:crypto";
 import { SSEServerTransport } from "@modelcontextprotocol/sdk/server/sse.js";
 export const MAX_SSE_BODY_BYTES = 1 * 1024 * 1024;
 const FORBIDDEN_QUERY_KEYS = ["apiKey", "secret", "userId"];
+const TRUTHY_ENV = new Set(["1", "true", "yes", "on"]);
+function isServiceSecretImpersonationRejectedInProduction() {
+    const override = process.env.KYNVER_ALLOW_SERVICE_SECRET_IMPERSONATION?.trim().toLowerCase();
+    if (override !== undefined && TRUTHY_ENV.has(override))
+        return false;
+    return process.env.NODE_ENV === "production" || process.env.VERCEL_ENV === "production";
+}
 export function headerValue(req, name) {
     const v = req.headers[name];
     return typeof v === "string" ? v : Array.isArray(v) ? (v[0] ?? null) : null;
@@ -121,6 +128,8 @@ function resolveInternalAuth(req, serviceSecret) {
     const internalSecret = headerValue(req, "x-kynver-service-secret");
     if (!internalUserId || !serviceSecret || !internalSecret)
         return null;
+    if (isServiceSecretImpersonationRejectedInProduction())
+        return null;
     if (!timingSafeEqualString(internalSecret, serviceSecret))
         return null;
     return { userId: internalUserId, auth: { kind: "internal", userId: internalUserId } };

package/dist/tools/graph.js

@@ -125,10 +125,18 @@ export function registerGraphTools({ register, resolveToolSlug, jsonResult }) {
         grantToken: z
             .string()
             .describe("Signed expansion grant (kve:g:…) bound to this graph handle and envelope."),
-        purpose: z.string().describe("Why expansion is requested (audit-bound)."),
+        purpose: z
+            .string()
+            .describe("Informational only — the server enforces the graph-expansion purpose bound into the grant and ignores this value."),
         envelopeId: z.string().describe("Active context envelope id binding this expansion."),
         asOf: z.string().optional().describe("Optional UTC ISO as-of instant for temporal filtering."),
-        maxDepth: z.number().int().min(1).max(2).optional(),
+        maxDepth: z
+            .number()
+            .int()
+            .min(1)
+            .max(1)
+            .optional()
+            .describe("Traversal depth; the server caps expansion depth at 1."),
         maxNodes: z.number().int().min(1).max(36).optional(),
     }, async (args) => {
         const slug = await resolveToolSlug(args.slug);

package/dist/tools/workbench.js

@@ -19,6 +19,20 @@ const commandKind = z.enum([
     "yield",
     "take",
 ]);
+/** Keep in sync with COMMAND_CENTER_VIEW_MODES in command-center-url-state.ts */
+const workbenchView = z.enum([
+    "overview",
+    "flow",
+    "marketing",
+    "projects",
+    "tasks",
+    "goals",
+    "dq",
+    "web",
+    "review",
+    "system",
+    "health",
+]);
 export function registerWorkbenchTools({ register, resolveToolSlug, jsonResult, }) {
     register("agent_os_workbench_query", [
         "Read the operator's current workbench focus (view mode, drilldown stack, focused entity)",
@@ -37,7 +51,7 @@ export function registerWorkbenchTools({ register, resolveToolSlug, jsonResult,
     ].join(" "), {
         slug: z.string().optional(),
         kind: commandKind,
-        view: z.enum(["projects", "tasks", "goals", "dq", "web"]).optional(),
+        view: workbenchView.optional(),
         target: z.string().optional().describe("EntityRef e.g. task:<id>, plan:<id>"),
         push: z.boolean().optional().describe("For drill: push onto stack (default true)"),
         panel: z.string().optional(),

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kynver-app/mcp-agent-os",
-  "version": "0.3.63",
+  "version": "0.3.65",
   "description": "Kynver Agentic OS MCP server — slug-keyed agent identity, goals, projects, sessions, and long-term memory",
   "type": "module",
   "bin": {