@mrrlin-dev/mcp 0.4.52 → 0.4.54

package/dist/bin.cjs

@@ -38200,6 +38200,10 @@ var mrrlinTaskCreateShapeSchema = external_exports.object({
   title: external_exports.string().min(1),
   type: mrrlinTaskTypeSchema.default("task"),
   verificationDueAt: external_exports.string().datetime().nullable().optional()
+  // `declaredOutcome` is deliberately ABSENT — «required at spec approval, never at creation», as
+  // the comment beside the READ schema's own field says. It is refused with a 400 at the route
+  // rather than declared-and-rejected here (`OQ-084`); see `rejectsDeclaredOutcomeAtCreation` in
+  // `apps/api/src/index.ts` for why the refusal cannot live in this schema.
 });
 function refineTaskCreateDomain(data, ctx) {
   if (data.domain === void 0 && data.parentTaskId == null) {
@@ -42437,7 +42441,7 @@ Do NOT derail the current task - if the operator has an in-flight question, answ
 }
 
 // src/_generated/version.ts
-var PKG_VERSION = "0.4.52";
+var PKG_VERSION = "0.4.54";
 
 // src/api-base-url-migrate.ts
 var import_node_fs4 = __toESM(require("node:fs"), 1);
@@ -42467,6 +42471,8 @@ function renderEcosystemConfig(opts) {
     PATH: opts.pathEnv,
     MRRLIN_DIRECTOR_BRIDGE_LOG: "1"
   };
+  const telemetryProject = opts.telemetryDefaultProject?.trim();
+  if (telemetryProject) env.MRRLIN_TELEMETRY_DEFAULT_PROJECT = telemetryProject;
   if (opts.user) env.USER = opts.user;
   if (opts.codexHome) env.CODEX_HOME = opts.codexHome;
   const retargeted = opts.apiBaseUrl ? retargetRetiredApiBaseUrl(opts.apiBaseUrl).baseUrl : void 0;
@@ -55931,12 +55937,13 @@ function isOriginAllowed(origin, allowed) {
 var CORS_ALLOW_METHODS = "GET, POST, OPTIONS";
 var CORS_ALLOW_HEADERS = "content-type, authorization, sec-websocket-protocol";
 function corsAllowOrigin(requestOrigin, allowed) {
-  if (requestOrigin) return requestOrigin;
+  if (requestOrigin) return isOriginAllowed(requestOrigin, allowed) ? requestOrigin : null;
   if (allowed?.length === 1) return allowed[0] ?? "*";
   return "*";
 }
 function applyPnaHeaders(res, requestOrigin, allowed) {
-  res.setHeader("Access-Control-Allow-Origin", corsAllowOrigin(requestOrigin, allowed));
+  const allowOrigin = corsAllowOrigin(requestOrigin, allowed);
+  if (allowOrigin !== null) res.setHeader("Access-Control-Allow-Origin", allowOrigin);
   res.setHeader("Access-Control-Allow-Private-Network", "true");
   res.setHeader("Vary", "Origin");
 }
@@ -55974,7 +55981,7 @@ function createBridgeRequestListener(opts) {
     if (url2.pathname === "/pair/token") {
       const origin = (url2.searchParams.get("origin") ?? "").trim();
       applyPnaHeaders(res, requestOrigin, allowedOrigins);
-      if (!isOriginAllowed(origin, allowedOrigins)) {
+      if (!isOriginAllowed(origin, allowedOrigins) || requestOrigin !== void 0 && !isOriginAllowed(requestOrigin, allowedOrigins)) {
         res.writeHead(403, { "content-type": "application/json" });
         res.end(JSON.stringify({ ok: false, error: "Origin not allowed." }));
         return;
@@ -68278,6 +68285,18 @@ function runSetCredential(args) {
 var import_node_os16 = __toESM(require("node:os"), 1);
 var import_node_fs22 = require("node:fs");
 var import_node_path33 = __toESM(require("node:path"), 1);
+function readExistingTelemetryDefaultProject(deps, ecoPath) {
+  try {
+    const existing = deps.readFile?.(ecoPath);
+    if (!existing) return void 0;
+    const match = existing.match(/\bMRRLIN_TELEMETRY_DEFAULT_PROJECT:\s*("(?:[^"\\]|\\.)*")/);
+    if (!match?.[1]) return void 0;
+    const value = JSON.parse(match[1]);
+    return typeof value === "string" && value.trim() ? value.trim() : void 0;
+  } catch {
+    return void 0;
+  }
+}
 var SYSTEM_PATH_DIRS = ["/usr/bin", "/bin", "/usr/sbin", "/sbin"];
 function defaultHomeOwnerUid(home) {
   try {
@@ -68346,6 +68365,8 @@ function installService(deps) {
   ).join(":");
   const apiBaseUrl = deps.env.MRRLIN_API_BASE_URL?.trim() || void 0;
   const staging = deps.env.MRRLIN_STAGING === "1" || !apiBaseUrl && bridgeUrlImpliesStaging(deps.env.MRRLIN_BRIDGE_URL);
+  const ecoPath = import_node_path33.default.join(home, ".mrrlin", "ecosystem.config.cjs");
+  const telemetryDefaultProject = "MRRLIN_TELEMETRY_DEFAULT_PROJECT" in deps.env ? deps.env.MRRLIN_TELEMETRY_DEFAULT_PROJECT?.trim() || void 0 : readExistingTelemetryDefaultProject(deps, ecoPath);
   const text = renderEcosystemConfig({
     cwd: resolved.cwd,
     home,
@@ -68353,9 +68374,9 @@ function installService(deps) {
     codexHome: deps.env.CODEX_HOME?.trim() || void 0,
     pathEnv,
     staging,
-    apiBaseUrl
+    apiBaseUrl,
+    telemetryDefaultProject
   });
-  const ecoPath = import_node_path33.default.join(home, ".mrrlin", "ecosystem.config.cjs");
   deps.writeFile(ecoPath, text);
   const start = deps.runPm2(["startOrReload", ecoPath]);
   if (start.code !== 0) {
@@ -68969,6 +68990,16 @@ async function main() {
           (0, import_node_fs23.mkdirSync)(import_node_path37.default.dirname(p), { recursive: true, mode: 448 });
           (0, import_node_fs23.writeFileSync)(p, c, { mode: 384 });
         },
+        // Swallows every error on purpose — the only caller uses this to recover settings from the
+        // config it is about to overwrite, and a missing or unreadable file means "no previous
+        // value", never a failed install. See readExistingTelemetryDefaultProject.
+        readFile: (p) => {
+          try {
+            return (0, import_node_fs23.readFileSync)(p, "utf8");
+          } catch {
+            return null;
+          }
+        },
         runPm2: pm2Runner,
         which: whichBin,
         hasSecret: () => Boolean(readAgentSecret()),

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mrrlin-dev/mcp",
-  "version": "0.4.52",
+  "version": "0.4.54",
   "type": "module",
   "bin": {
     "mrrlin-mcp": "dist/bin.cjs"
@@ -21,8 +21,8 @@
     "@types/ws": "^8.18.1",
     "esbuild": "^0.24.0",
     "tsx": "^4.22.3",
-    "@mrrlin/director-e2e": "0.0.0",
     "@mrrlin/agent-client": "0.0.0",
+    "@mrrlin/director-e2e": "0.0.0",
     "@mrrlin/client": "0.0.0",
     "@mrrlin/schemas": "0.0.0",
     "@mrrlin/tsconfig": "0.0.0",