@mnmal-ai/cortext-opencode 1.0.0-alpha.5 → 1.0.0-alpha.7

package/dist/plugin.js

@@ -49,7 +49,7 @@ function claimList(raw) {
 function b64url(buf) {
 	return buf.toString("base64").replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
 }
-function mint(kid, key, ns, capabilities) {
+function mint(kid, key, ns, capabilities, aud) {
 	const now = Math.floor(Date.now() / 1e3);
 	const exp = now + TTL_SECONDS;
 	const signingInput = `${b64url(Buffer.from(JSON.stringify({
@@ -58,6 +58,7 @@ function mint(kid, key, ns, capabilities) {
 		kid
 	}), "utf8"))}.${b64url(Buffer.from(JSON.stringify({
 		sub: kid,
+		aud,
 		iat: now,
 		exp,
 		ns,
@@ -68,6 +69,15 @@ function mint(kid, key, ns, capabilities) {
 		exp
 	};
 }
+/** The origin a token for `url` names as its `aud`; throws rather than mint a token without one. */
+function audienceOf(url) {
+	const raw = typeof url === "object" && url !== null && "url" in url ? url.url : url;
+	try {
+		return new URL(String(raw)).origin;
+	} catch {
+		throw new Error(`cannot mint an agent token without an audience: '${raw}' is not a URL`);
+	}
+}
 function misconfigured(detail) {
 	return {
 		claim: null,
@@ -118,12 +128,18 @@ function createAgentAuth(env, opts) {
 	const capabilities = opts.capabilities ?? claimList(env.SUBSTRATE_AGENT_CAPABILITIES) ?? DEFAULT_CAPABILITIES;
 	const ns = opts.namespaces ?? claimList(env.SYNOPTIC_AGENT_NAMESPACES) ?? DEFAULT_NAMESPACES;
 	if (capabilities.includes("*")) return misconfigured(`capabilities cannot be claimed as '*' — the capability gates do a bare \`includes\` with no wildcard branch, so a wildcard claim is refused everything. Enumerate them instead, e.g. SUBSTRATE_AGENT_CAPABILITIES=${DEFAULT_CAPABILITIES.join(",")}`);
-	let cached = null;
+	const cached = /* @__PURE__ */ new Map();
 	return {
-		getAuthHeader: () => {
+		/** @param {string|URL|Request} [url] The request URL; its origin is the token's `aud`. */
+		getAuthHeader: (url = env.SUBSTRATE_URL) => {
+			const aud = audienceOf(url);
 			const now = Math.floor(Date.now() / 1e3);
-			if (cached === null || cached.exp - REFRESH_SKEW <= now) cached = mint(kid, key, ns, capabilities);
-			return `Bearer ${cached.jwt}`;
+			let entry = cached.get(aud);
+			if (entry === void 0 || entry.exp - REFRESH_SKEW <= now) {
+				entry = mint(kid, key, ns, capabilities, aud);
+				cached.set(aud, entry);
+			}
+			return `Bearer ${entry.jwt}`;
 		},
 		warning: null,
 		/** What this identity CLAIMS — the request, never the grant. See `probeWhoami` for the grant. */
@@ -140,7 +156,7 @@ function createAgentAuth(env, opts) {
 */
 function makeSignedFetch(getAuthHeader, fetchImpl = fetch) {
 	return (url, init = {}) => {
-		const header = getAuthHeader();
+		const header = getAuthHeader(url);
 		if (header === null) return fetchImpl(url, init);
 		return fetchImpl(url, {
 			...init,
@@ -2655,26 +2671,44 @@ async function runColdStart(opts) {
 			}
 		})();
 		const rulesKey = `${namespace}/AgentRule`;
-		const rulesP = substrateQuery(substrateUrl, { [rulesKey]: {
-			params: {
-				where: {
-					...projectWhere(projectSlug),
-					active: { eq: true }
-				},
-				limit: 200
-			},
-			fields: {
-				shortId: true,
-				category: true,
-				severity: true,
-				pinned: true,
-				synopsis: true
+		const rulesP = (async () => {
+			const rows = [];
+			let cursor;
+			for (let page = 0; page < 20; page++) {
+				let pagination = {};
+				const data = await substrateQuery(substrateUrl, { [rulesKey]: {
+					params: {
+						where: {
+							...projectWhere(projectSlug),
+							active: { eq: true }
+						},
+						limit: 200,
+						...cursor !== void 0 ? { cursor } : {}
+					},
+					fields: {
+						shortId: true,
+						category: true,
+						severity: true,
+						pinned: true,
+						synopsis: true
+					}
+				} }, {
+					fetchImpl,
+					onUnexpectedProjection: (entries) => projectionAudit.record(entries),
+					onFrameFailure: (k, d) => projectionAudit.recordFailure(k, d),
+					onPagination: (p) => {
+						pagination = p;
+					}
+				});
+				if (!(rulesKey in data)) return data;
+				rows.push(...data[rulesKey]);
+				const { hasMore, nextCursor } = pagination[rulesKey] ?? {};
+				if (!hasMore) return { [rulesKey]: rows };
+				if (nextCursor === void 0) throw new Error(`${rulesKey}: hasMore with no nextCursor`);
+				cursor = nextCursor;
 			}
-		} }, {
-			fetchImpl,
-			onUnexpectedProjection: (entries) => projectionAudit.record(entries),
-			onFrameFailure: (k, d) => projectionAudit.recordFailure(k, d)
-		});
+			throw new Error(`${rulesKey}: more than 20 pages of rules`);
+		})();
 		const [data, inboxMd] = await Promise.all([rulesP, inboxP]);
 		await hostReportP;
 		const body = [

package/instructions/substrate-conventions.md

@@ -1,4 +1,4 @@
-<!-- substrate-conventions vsynoptic-1.0.0-alpha.5+9d0bf8e1 — opencode skin; plugin-owned, do not edit. Edit your own AGENTS.md instead. Body is shared with the Claude skin's fragment (test/instructions-sync.test.ts enforces it). -->
+<!-- substrate-conventions vsynoptic-1.0.0-alpha.7+9d0bf8e1 — opencode skin; plugin-owned, do not edit. Edit your own AGENTS.md instead. Body is shared with the Claude skin's fragment (test/instructions-sync.test.ts enforces it). -->
 
 # Substrate interaction conventions
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mnmal-ai/cortext-opencode",
-  "version": "1.0.0-alpha.5",
+  "version": "1.0.0-alpha.7",
   "description": "Cortext — the OpenCode skin: cold-start injection via experimental.chat.system.transform, bundling the @mnmal-ai/synoptic host into a committed dist artifact. Installed as an OpenCode plugin (\"plugin\": [\"@mnmal-ai/cortext-opencode\"]). Published to npm, not the Claude marketplace.",
   "license": "Apache-2.0",
   "repository": {
@@ -25,7 +25,7 @@
     "access": "public"
   },
   "devDependencies": {
-    "@mnmal-ai/synoptic": "1.0.0-alpha.5",
+    "@mnmal-ai/synoptic": "1.0.0-alpha.7",
     "@opencode-ai/plugin": "^1.18.35",
     "@opencode/plugin": "^2.0.24",
     "@types/node": "^26.6.4",