@runeya/runeya 2.0.145 → 2.0.146

package/{chunk-Q4RPY3VW.js → chunk-UD42LACH.js}

@@ -17,7 +17,7 @@ import {
   serviceStore,
   setProjectServices,
   setProjectVault
-} from "./chunk-QF56Z6LI.js";
+} from "./chunk-KV4GJKXU.js";
 import {
   atomicWriteSecure,
   fingerprintFiles,
@@ -25,7 +25,7 @@ import {
   hasChangedSinceRead,
   rememberFile,
   wasRead
-} from "./chunk-NCO4OOYT.js";
+} from "./chunk-4LJQIQMN.js";
 import {
   findThreadDb,
   lastTurn,
@@ -52,7 +52,7 @@ import {
   unregisterLocalProjectDir,
   vaultFor,
   vaultIdOfRoot
-} from "./chunk-KS7A5CTW.js";
+} from "./chunk-VPSQJOSN.js";
 import {
   COMPANION_RELAY_CLOSE,
   COMPANION_RELAY_OPEN,
@@ -2180,14 +2180,27 @@ function getJwtSecret() {
   if (!jwtSecret) throw new Error("JWT secret not yet generated");
   return jwtSecret;
 }
-async function signJwt() {
+async function signJwt(opts = {}) {
   const secret = getJwtSecret();
-  return new SignJWT({ sub: "app" }).setProtectedHeader({ alg: "HS256" }).setIssuedAt().setExpirationTime(env.JWT_TTL).sign(secret);
+  return new SignJWT(opts.mcpClientId ? { sub: "app", mcp: opts.mcpClientId } : { sub: "app" }).setProtectedHeader({ alg: "HS256" }).setIssuedAt().setExpirationTime(opts.ttl ?? env.JWT_TTL).sign(secret);
 }
-async function verifyJwt(token) {
+var mcpClientCheck = null;
+function setMcpClientCheck(check) {
+  mcpClientCheck = check;
+}
+async function verifyJwt(token, opts = {}) {
   const secret = getJwtSecret();
   const { payload } = await jwtVerify(token, secret);
-  return { exp: payload.exp, iat: payload.iat };
+  const result = { exp: payload.exp, iat: payload.iat };
+  if (payload["mcp"] !== void 0) {
+    if (!opts.allowMcp) throw new Error("MCP client token not allowed here");
+    const clientId = payload["mcp"];
+    if (typeof clientId !== "string" || !mcpClientCheck || !await mcpClientCheck(clientId)) {
+      throw new Error("MCP client is no longer paired");
+    }
+    result.mcpClientId = clientId;
+  }
+  return result;
 }
 
 // ../server/src/services/live-pty.ts
@@ -2636,7 +2649,7 @@ async function runCompanionForTurn(conversationId) {
   if (!hasNew) {
     return skip(conversationId, "nothingNew", `rien de neuf \xE0 relire (${messageCount} messages)`);
   }
-  const { startCliSession } = await import("./chat-XYCHMTFE.js");
+  const { startCliSession } = await import("./chat-LPML22J5.js");
   const companionConv = await ensureCompanionConversation(conv);
   const exchange = formatExchange(conv.messages, from);
   const baseSha = await ensureCompanionBase(conv);
@@ -2755,7 +2768,7 @@ async function deliverToMainConversation(conv, message) {
 async function attemptDelivery(conv, message) {
   if (await writeToLivePty(conv.id, message)) return "pty";
   try {
-    const { startCliSession } = await import("./chat-XYCHMTFE.js");
+    const { startCliSession } = await import("./chat-LPML22J5.js");
     await startCliSession(conv.runner, conv.id, message, { jwt: await signJwt() });
     return "headless";
   } catch (err) {
@@ -2788,7 +2801,7 @@ function companionCreateDefaults(settings, convRunner) {
 }
 async function companionSettings() {
   try {
-    const { settingsManager } = await import("./settings-manager-QVQRJO6V.js");
+    const { settingsManager } = await import("./settings-manager-XPLBO35P.js");
     const settings = await settingsManager.getSettings();
     return settings.companion ?? { enabledByDefault: false };
   } catch {
@@ -2933,6 +2946,7 @@ export {
   generateJwtSecret,
   getJwtSecretGeneratedAt,
   signJwt,
+  setMcpClientCheck,
   verifyJwt,
   ensureDataGitignore,
   conversationSectionStore,
@@ -2993,4 +3007,4 @@ export {
   headCommit,
   initCompanion
 };
-//# sourceMappingURL=chunk-Q4RPY3VW.js.map
+//# sourceMappingURL=chunk-UD42LACH.js.map