@mrrlin-dev/mcp 0.4.127 → 0.4.129

package/dist/bin.cjs

@@ -37478,6 +37478,23 @@ var openApiOperationIds = {
   reconcilePendingCapabilityInvocations: "reconcilePendingCapabilityInvocations"
 };
 
+// ../../packages/schemas/dist/token-keys.js
+var encoder = new TextEncoder();
+var LEGACY_TOKEN_KEY_ACCEPTED_UNTIL = {
+  operator: Date.UTC(2026, 11, 14),
+  // 2026-12-14T00:00:00Z
+  "identity-assertion": Date.UTC(2026, 10, 30),
+  // 2026-11-30T00:00:00Z
+  "pending-link": Date.UTC(2026, 10, 30),
+  "link-intent": Date.UTC(2026, 10, 30)
+};
+var LEGACY_TOKEN_MAX_LIFETIME_MS = {
+  operator: 7 * 24 * 60 * 60 * 1e3,
+  "identity-assertion": 10 * 60 * 1e3,
+  "pending-link": 10 * 60 * 1e3,
+  "link-intent": 10 * 60 * 1e3
+};
+
 // ../../packages/schemas/dist/session.js
 var sessionEmailSchema = external_exports.string().email();
 var operatorSessionSchema = external_exports.object({
@@ -58153,12 +58170,81 @@ function emptyHooksDir() {
 function gitArgs(repo, args) {
   return ["-C", repo, "-c", `core.hooksPath=${emptyHooksDir()}`, ...args];
 }
+var STEP_ENV_NAMES = /* @__PURE__ */ new Set([
+  // user, shell, temp dirs, locale
+  "PATH",
+  "HOME",
+  "USER",
+  "LOGNAME",
+  "SHELL",
+  "TERM",
+  "TMPDIR",
+  "TMP",
+  "TEMP",
+  "LANG",
+  "LANGUAGE",
+  "TZ",
+  // what a Windows toolchain needs to start at all
+  "USERPROFILE",
+  "APPDATA",
+  "LOCALAPPDATA",
+  "PROGRAMDATA",
+  "PROGRAMFILES",
+  "SYSTEMROOT",
+  "WINDIR",
+  "COMSPEC",
+  "PATHEXT",
+  "HOMEDRIVE",
+  "HOMEPATH",
+  // proxies and the operator's own CA bundle
+  "HTTP_PROXY",
+  "HTTPS_PROXY",
+  "NO_PROXY",
+  "ALL_PROXY",
+  "NODE_EXTRA_CA_CERTS",
+  "SSL_CERT_FILE",
+  "SSL_CERT_DIR",
+  // Node and its version managers
+  "NODE_ENV",
+  "NODE_PATH",
+  "NVM_BIN",
+  "NVM_DIR",
+  "VOLTA_HOME",
+  "FNM_DIR",
+  "ASDF_DIR",
+  "ASDF_DATA_DIR",
+  // the toolchains a `make test` may drive
+  "JAVA_HOME",
+  "GOPATH",
+  "GOROOT",
+  "GOCACHE",
+  "GOMODCACHE",
+  "CARGO_HOME",
+  "RUSTUP_HOME",
+  "VIRTUAL_ENV",
+  "PYENV_ROOT",
+  // git+ssh dependencies and commit signing
+  "SSH_AUTH_SOCK",
+  "GNUPGHOME"
+]);
+var STEP_ENV_PREFIXES = ["LC_", "XDG_", "NPM_CONFIG_", "YARN_", "PNPM_", "COREPACK_"];
+var CREDENTIAL_NAME = /AUTH|TOKEN|PASSWORD|SECRET/;
+function buildLocalStepEnv(baseEnv = process.env) {
+  const env = {};
+  for (const [name, value] of Object.entries(baseEnv)) {
+    if (value === void 0) continue;
+    const upper = name.toUpperCase();
+    const inFamily = STEP_ENV_PREFIXES.some((prefix) => upper.startsWith(prefix));
+    if (STEP_ENV_NAMES.has(upper) || inFamily && !CREDENTIAL_NAME.test(upper)) env[name] = value;
+  }
+  return env;
+}
 function git(repo, args) {
   return (0, import_node_child_process15.execFileSync)("git", gitArgs(repo, args), {
     encoding: "utf8",
     timeout: 3e4,
     stdio: ["ignore", "pipe", "pipe"],
-    env: { ...process.env, GIT_TERMINAL_PROMPT: "0" }
+    env: { ...buildLocalStepEnv(), GIT_TERMINAL_PROMPT: "0" }
   }).trim();
 }
 function gitTry(repo, args) {
@@ -58166,7 +58252,7 @@ function gitTry(repo, args) {
     encoding: "utf8",
     timeout: 3e4,
     stdio: ["ignore", "pipe", "pipe"],
-    env: { ...process.env, GIT_TERMINAL_PROMPT: "0" }
+    env: { ...buildLocalStepEnv(), GIT_TERMINAL_PROMPT: "0" }
   });
   return {
     status: typeof result.status === "number" ? result.status : 1,
@@ -58244,7 +58330,7 @@ function createStepRunner(options = {}) {
     let killTimer = null;
     const child = (0, import_node_child_process15.spawn)(command.file, command.args, {
       cwd,
-      env: { ...process.env, CI: "1", GIT_TERMINAL_PROMPT: "0" },
+      env: { ...buildLocalStepEnv(), CI: "1", GIT_TERMINAL_PROMPT: "0" },
       stdio: ["ignore", "pipe", "pipe"],
       detached: process.platform !== "win32"
     });
@@ -58606,11 +58692,11 @@ function withDisabledGitHooksEnv(env, hooksDir) {
     [`GIT_CONFIG_VALUE_${count2}`]: hooksDir
   };
 }
-function git2(checkout, args, hooksDir) {
+function git2(checkout, args, hooksDir, baseEnv = process.env) {
   return (0, import_node_child_process16.execFileSync)("git", ["-C", checkout, "-c", `core.hooksPath=${hooksDir}`, ...args], {
     encoding: "utf8",
     timeout: 3e4,
-    env: { ...process.env, GIT_TERMINAL_PROMPT: "0" }
+    env: { ...baseEnv, GIT_TERMINAL_PROMPT: "0" }
   });
 }
 async function createRunWorktree(opts) {
@@ -58645,10 +58731,11 @@ async function openRunWorktree(opts) {
   const worktreePath = (0, import_node_path19.join)(opts.worktreeRoot, opts.slug, opts.runId);
   const hooksDir = prepareDisabledGitHooksDir(opts.locksDir, opts.runId);
   const branch = worktreeBranch(opts.runId);
+  const env = buildLocalStepEnv();
   await withCheckoutLock(opts.locksDir, opts.slug, async () => {
     if ((0, import_node_fs12.existsSync)(worktreePath)) {
       const real = (0, import_node_fs12.realpathSync)(worktreePath);
-      const listed = git2(opts.checkout, ["worktree", "list", "--porcelain"], hooksDir).split(/\n\s*\n/).map((block) => block.split("\n")).find((lines2) => {
+      const listed = git2(opts.checkout, ["worktree", "list", "--porcelain"], hooksDir, env).split(/\n\s*\n/).map((block) => block.split("\n")).find((lines2) => {
         const listedPath = lines2.find((line) => line.startsWith("worktree "))?.slice("worktree ".length);
         return listedPath !== void 0 && (0, import_node_fs12.existsSync)(listedPath) && (0, import_node_fs12.realpathSync)(listedPath) === real;
       });
@@ -58661,13 +58748,13 @@ async function openRunWorktree(opts) {
       return;
     }
     try {
-      git2(opts.checkout, ["rev-parse", "--verify", "--quiet", `refs/heads/${branch}`], hooksDir);
+      git2(opts.checkout, ["rev-parse", "--verify", "--quiet", `refs/heads/${branch}`], hooksDir, env);
     } catch {
       throw new Error(`run_branch_missing: ${opts.checkout} has no branch ${branch}`);
     }
     (0, import_node_fs12.mkdirSync)(opts.worktreeRoot, { recursive: true });
-    git2(opts.checkout, ["worktree", "prune"], hooksDir);
-    git2(opts.checkout, ["worktree", "add", worktreePath, branch], hooksDir);
+    git2(opts.checkout, ["worktree", "prune"], hooksDir, env);
+    git2(opts.checkout, ["worktree", "add", worktreePath, branch], hooksDir, env);
   });
   return worktreePath;
 }
@@ -58803,13 +58890,16 @@ async function sweepOrphanWorktrees(opts) {
 }
 
 // src/local-apply.ts
+function gitEnv() {
+  return { ...buildLocalStepEnv(), GIT_TERMINAL_PROMPT: "0" };
+}
 function gitRead(cwd, args) {
   try {
     return (0, import_node_child_process17.execFileSync)("git", ["-C", cwd, ...args], {
       encoding: "utf8",
       stdio: ["ignore", "pipe", "pipe"],
       timeout: 3e4,
-      env: { ...process.env, GIT_TERMINAL_PROMPT: "0" }
+      env: gitEnv()
     }).trim();
   } catch {
     return null;
@@ -58972,7 +59062,7 @@ async function applyLocalRunForTool(deps, input) {
       return { outcome: "conflict", previousSha: null, headSha: delivered.headSha, detail: integration.files.join(", ") };
     }
     const build = await runDetectedBuild({ worktreePath, runStep: deps.runStep });
-    const headSha = (0, import_node_child_process17.execFileSync)("git", ["-C", worktreePath, "rev-parse", "HEAD"], { encoding: "utf8" }).trim();
+    const headSha = (0, import_node_child_process17.execFileSync)("git", ["-C", worktreePath, "rev-parse", "HEAD"], { encoding: "utf8", env: gitEnv() }).trim();
     if (build.failed) {
       record2({ integration, applied: false, reason: "build_failed", headSha, steps: build.steps, logs: build.logs });
       return { outcome: "build_failed", previousSha: null, headSha, detail: build.failed.command };
@@ -59018,7 +59108,8 @@ async function applyLocalRunForTool(deps, input) {
       if (!runBranchStillSigned()) return branchChanged();
       (0, import_node_child_process17.execFileSync)("git", ["-C", worktreePath, "-c", `core.hooksPath=${hooksDir}`, "checkout", "-q", "--detach", delivered.headSha], {
         stdio: ["ignore", "pipe", "pipe"],
-        timeout: 3e4
+        timeout: 3e4,
+        env: gitEnv()
       });
       try {
         return await reintegrate(worktreePath);
@@ -59027,9 +59118,14 @@ async function applyLocalRunForTool(deps, input) {
         if (runBranchStillSigned()) {
           (0, import_node_child_process17.execFileSync)("git", ["-C", worktreePath, "-c", `core.hooksPath=${hooksDir}`, "checkout", "-q", "-f", runBranch], {
             stdio: ["ignore", "pipe", "pipe"],
-            timeout: 3e4
+            timeout: 3e4,
+            env: gitEnv()
+          });
+          (0, import_node_child_process17.execFileSync)("git", ["-C", worktreePath, "clean", "-q", "-f", "-d"], {
+            stdio: ["ignore", "pipe", "pipe"],
+            timeout: 3e4,
+            env: gitEnv()
           });
-          (0, import_node_child_process17.execFileSync)("git", ["-C", worktreePath, "clean", "-q", "-f", "-d"], { stdio: ["ignore", "pipe", "pipe"], timeout: 3e4 });
         }
       }
     },
@@ -63221,7 +63317,7 @@ Do NOT derail the current task - if the operator has an in-flight question, answ
 }
 
 // src/_generated/version.ts
-var PKG_VERSION = "0.4.127";
+var PKG_VERSION = "0.4.129";
 
 // src/receipt-signing.ts
 var import_node_crypto17 = __toESM(require("node:crypto"), 1);
@@ -78488,14 +78584,20 @@ function createSelectedProviderRefresher(deps) {
     }
   });
 }
+var envSigningProvider;
 function buildBridgeSigningProvider() {
   const signingKeyId = process.env.MRRLIN_SIGNING_KEY_ID;
   const signingPrivateKey = process.env.MRRLIN_SIGNING_PRIVATE_KEY;
+  delete process.env.MRRLIN_SIGNING_PRIVATE_KEY;
   if (signingKeyId && signingPrivateKey) {
-    return new LocalEd25519SigningProvider({
+    envSigningProvider = new LocalEd25519SigningProvider({
       keyId: signingKeyId,
       privateKey: signingPrivateKey
     });
+    return envSigningProvider;
+  }
+  if (signingKeyId && envSigningProvider?.getKeyId() === signingKeyId) {
+    return envSigningProvider;
   }
   const isTestOrSmoke = process.env.NODE_ENV === "test" || process.env.MRRLIN_TEST === "1" || process.env.MRRLIN_SMOKE_TEST === "1";
   if (isTestOrSmoke) {
@@ -78507,6 +78609,7 @@ function buildBridgeSigningProvider() {
   return void 0;
 }
 async function startDirectorBridge() {
+  const signingProvider = buildBridgeSigningProvider();
   const config2 = parseConfig();
   const failureLog = createFailureLog();
   const suppressedPushLine = (label, error51) => {
@@ -78644,7 +78747,6 @@ async function startDirectorBridge() {
   });
   const checkoutRegistry = new CheckoutRegistry(config2.stateDir);
   const staleSeconds = readEnvInt("MRRLIN_DIRECTOR_BRIDGE_STALE_SECONDS", DEFAULT_STALE_SECONDS);
-  const signingProvider = buildBridgeSigningProvider();
   const consumerDeps = {
     client,
     signingProvider,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mrrlin-dev/mcp",
-  "version": "0.4.127",
+  "version": "0.4.129",
   "type": "module",
   "bin": {
     "mrrlin-mcp": "dist/bin.cjs"