magenta-canon 0.1.4 → 0.1.6

package/README.md

@@ -1,5 +1,5 @@
 <p align="center">
-  <img src="https://raw.githubusercontent.com/royal-ohio/magenta-canon/main/docs/magenta-canon-banner.png" alt="Magenta Canon — Verifiable MCP Gateway" width="820">
+  <img src="https://themagentacanon.com/assets/magenta-canon-banner_1780327038059-CLzCWO02.png" alt="Magenta Canon — Verifiable MCP Gateway" width="820">
 </p>
 
 # Magenta Canon

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "magenta-canon",
-  "version": "0.1.4",
+  "version": "0.1.6",
   "type": "module",
   "license": "Apache-2.0",
   "description": "A verifiable MCP accountability gateway for AI-agent tool calls: allows authorized calls, blocks unauthorized calls, records both, and produces cryptographic evidence anyone can verify.",
@@ -45,6 +45,7 @@
     "public/canon/spine/constitutional-spine.v1.json",
     "README.md",
     "LICENSE",
+    "!scripts/heartbeat-loop.cjs",
     "!**/*.test.ts",
     "!**/*.test.mjs",
     "!**/*.test.js"

package/server/index.ts

@@ -101,10 +101,13 @@ app.use((req: Request & { cspNonce?: string }, res, next) => {
     );
     res.setHeader("Strict-Transport-Security", "max-age=31536000; includeSubDomains");
   } else {
-    // Development: allow unsafe-inline since Vite needs it for HMR
+    // Development: allow unsafe-inline since Vite injects nonce-less inline
+    // scripts (React Fast Refresh preamble + HMR client). A nonce in script-src
+    // would make browsers ignore 'unsafe-inline', blocking those scripts and
+    // breaking the dev client ("can't detect preamble"), so omit the nonce here.
     res.setHeader(
       "Content-Security-Policy",
-      `default-src 'self'; script-src 'self' 'unsafe-inline' 'nonce-${nonce}'; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com; font-src 'self' https://fonts.gstatic.com; img-src 'self' data: https:; connect-src 'self'; frame-ancestors 'none'`
+      `default-src 'self'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com; font-src 'self' https://fonts.gstatic.com; img-src 'self' data: https:; connect-src 'self' ws: wss:; frame-ancestors 'none'`
     );
   }
 

package/scripts/heartbeat-loop.cjs

@@ -1,86 +0,0 @@
-const crypto = require('crypto');
-const fs = require('fs');
-const path = require('path');
-
-const BRAIN_HUB = process.env.BRAIN_HUB_URL || 'https://migration-hub.replit.app';
-const ACCESS_TOKEN = process.env.ACCESS_TOKEN;
-const REPO_NAME = process.env.REPO_NAME || 'magenta-canon';
-const IDENTITY_PATH = path.join(process.cwd(), '.reality-identity.json');
-const INTERVAL_MS = 45000;
-
-function stableStringify(obj) {
-  if (obj === null || obj === undefined) return 'null';
-  if (typeof obj === 'string') return JSON.stringify(obj);
-  if (typeof obj === 'number' || typeof obj === 'boolean') return String(obj);
-  if (Array.isArray(obj)) return '[' + obj.map(stableStringify).join(',') + ']';
-  return '{' + Object.keys(obj).sort().map(k => JSON.stringify(k) + ':' + stableStringify(obj[k])).join(',') + '}';
-}
-
-let identity = null;
-
-function loadIdentity() {
-  try {
-    identity = JSON.parse(fs.readFileSync(IDENTITY_PATH, 'utf8'));
-    return true;
-  } catch (e) {
-    console.error('[heartbeat] Failed to load identity:', e.message);
-    return false;
-  }
-}
-
-async function sendHeartbeat() {
-  if (!identity) {
-    if (!loadIdentity()) return;
-  }
-
-  const timestamp = new Date().toISOString();
-  const payload = { adapterId: REPO_NAME, version: '2.0.0', timestamp };
-  const canonical = stableStringify(payload);
-
-  const privateKey = crypto.createPrivateKey(identity.privateKeyPem);
-  const signature = crypto.sign(null, Buffer.from(canonical), privateKey).toString('hex');
-
-  const body = {
-    adapterId: REPO_NAME,
-    version: '2.0.0',
-    timestamp,
-    signature,
-    publicKey: identity.publicKeyHex,
-    algorithm: 'ed25519'
-  };
-
-  try {
-    const resp = await fetch(`${BRAIN_HUB}/api/adapters/${REPO_NAME}/heartbeat`, {
-      method: 'POST',
-      headers: { 'Content-Type': 'application/json', 'x-access-token': ACCESS_TOKEN },
-      body: JSON.stringify(body)
-    });
-    const result = await resp.json();
-    if (result.ok) {
-      console.log(`[heartbeat] Heartbeat accepted at ${timestamp}`);
-    } else {
-      console.error(`[heartbeat] Heartbeat rejected:`, JSON.stringify(result));
-      if (result.error && result.error.includes('mismatch')) {
-        console.log('[heartbeat] Reloading identity...');
-        loadIdentity();
-      }
-    }
-  } catch (e) {
-    console.error(`[heartbeat] Network error: ${e.message}`);
-  }
-}
-
-async function main() {
-  if (!loadIdentity()) {
-    console.error('[heartbeat] Cannot start without identity file at', IDENTITY_PATH);
-    process.exit(1);
-  }
-  console.log(`[heartbeat] Starting heartbeat loop for ${REPO_NAME} every ${INTERVAL_MS / 1000}s`);
-  console.log(`[heartbeat] Identity: ${identity.adapterId}`);
-  console.log(`[heartbeat] Brain Hub: ${BRAIN_HUB}`);
-
-  await sendHeartbeat();
-  setInterval(sendHeartbeat, INTERVAL_MS);
-}
-
-main();