chore(submodule): promote Pmoves-cipher → 2b4c4f7 (Phase B PR 2 + MCP SSE fix) - #2299
Conversation
… SSE fix) Advances cipher gitlink 986e6e2 → 2b4c4f7. Brings two fixes from Pmoves-cipher PR #12 (squash-merged 2026-07-30): 1. Per-agent token enforcement (Phase B PR 2): auth.ts resolves cipher_<uuid> tokens via Supabase cipher_agent_tokens table; memory-routes.ts + mcp-sse.ts enforce resolved identity on every tool call (403 on mismatch, 400 when missing + token present, 403 on wildcard in enforcement mode). 2. MCP SSE 400 fix: mount /mcp routes before express.json() so the MCP SDK's SSEServerTransport.handlePostMessage() gets the raw readable body stream (express.json() was consuming it first → "stream is not readable" → 400 → Crush pmoves-cipher MCP failed to initialize). Verified live: POST /mcp/messages returns 202 Accepted after fix.
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (3)
📝 WalkthroughWalkthroughThe PR repoints the ChangesCipher API integration
Estimated code review effort: 2 (Simple) | ~10 minutes Possibly related PRs
Suggested reviewers: 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches 💡 1🛠️ Fix failing CI checks 💡
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 165a61b91f
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| @@ -1 +1 @@ | |||
| Subproject commit 986e6e2fcf7476741e8f2b30799e45b718023456 | |||
| Subproject commit 2b4c4f79fe951788fa68f36281b2492f5350cc1c | |||
There was a problem hiding this comment.
When per-agent authentication is enabled, this revision resolves each cipher_<uuid> token through Supabase, but the checked compose configurations attach cipher-api only to pmoves_app, pmoves_data, pmoves_bus, and pmoves_external (pmoves/docker-compose.yml:3055 and pmoves/docker-compose.agents.yml:756), while supabase-kong is only on pmoves_api and pmoves_public (pmoves/docker-compose.yml:741-743). Consequently the default SUPABASE_REST_URL=http://supabase-kong:8000/rest/v1 cannot resolve from Cipher, so token lookups fail and authenticated REST/MCP requests are rejected; add the shared API network in both canonical and split compose definitions as part of this promotion.
Useful? React with 👍 / 👎.
POWERFULMOVES
left a comment
POWERFULMOVES
left a comment
There was a problem hiding this comment.
Crush Review (4090 node)
P1: Cipher API network attachment (Codex finding — valid)
Codex flagged that cipher-api is attached only to pmoves_app and pmoves_data networks. When per-agent auth resolves cipher_<uuid> tokens through Supabase, the Cipher service needs network reachability to supabase-kong:8000 (or supabase-db:5432 depending on the query path).
Action needed: Verify the compose network section for cipher-api includes the Supabase network. If this gitlink promotion doesn't change compose networking, the fix belongs in a follow-up compose PR.
Otherwise
Gitlink promotion looks clean — 2b4c4f7 matches the squash-merged PR #12 HEAD. No code changes in the parent repo beyond the submodule pointer.
— Crush (4090, noise-reducer ◉)
…lution Addresses Codex P1 + Crush 4090 review on PR #2299. Root cause: cipher-api was on pmoves_app, pmoves_data, pmoves_bus, pmoves_external — but NOT pmoves_api. The per-agent token enforcement (P #12) resolves cipher_<uuid> tokens via SUPABASE_REST_URL which defaults to http://supabase-kong:8000/rest/v1. supabase-kong is on pmoves_api + pmoves_public. Without pmoves_api, cipher cannot reach supabase-kong → token lookups fail → authenticated requests rejected. Fix: add pmoves_api to cipher-api networks in both canonical (docker-compose.yml) and split overlay (docker-compose.agents.yml). Also added to PMOVES_NETWORKS env var for consistency.
Review P1 addressed (Codex + Crush 4090)Codex P1: cipher-api missing Fixed in commit All review findings addressed. Ready for merge. |
Docker Hardening ValidationHardening Validation ReportValidated: Thu Jul 30 17:37:20 UTC 2026Services CheckedPMOVES.AI Docker Hardening Validation[INFO] Checking: pmoves/docker-compose.hardened.yml [INFO] Validating: hi-rag-gateway-v2 [INFO] Validating: extract-worker [INFO] Validating: langextract [INFO] Validating: presign [INFO] Validating: render-webhook [INFO] Validating: retrieval-eval [INFO] Validating: pdf-ingest [INFO] Validating: jellyfin-bridge [INFO] Validating: invidious-companion-proxy [INFO] Validating: ffmpeg-whisper [INFO] Validating: media-video [INFO] Validating: media-audio [INFO] Validating: hi-rag-gateway-v2-gpu [INFO] Validating: hi-rag-gateway-gpu [INFO] Validating: deepresearch [INFO] Validating: supaserch [INFO] Validating: publisher-discord [INFO] Validating: mesh-agent [INFO] Validating: nats-echo-req [INFO] Validating: nats-echo-res [INFO] Validating: comfy-watcher [INFO] Validating: grayjay-plugin-host [INFO] Validating: agent-zero [INFO] Validating: p7-room-orchestrator [INFO] Validating: archon [INFO] Validating: channel-monitor [INFO] Validating: pmoves-yt [INFO] Validating: notebook-sync [INFO] Validating: supabase_service_role_key [INFO] Validating: supabase_jwt_secret [INFO] Validating: p7_control_token ====================================== |
… fix) Fixes the router-per-request bug from #2299 that broke MCP SSE sessions. Router is now created ONCE; auth → /mcp → express.json() → /api order preserves both body stream and session Map integrity.
1 participant
Summary
Advances
Pmoves-ciphergitlink986e6e2→2b4c4f7— promotes Pmoves-cipher PR #12 (squash-merged 2026-07-30).What PR #12 shipped
Per-agent token enforcement (Phase B PR 2) —
auth.tsresolvescipher_<uuid>tokens via Supabasecipher_agent_tokenstable;memory-routes.ts+mcp-sse.tsenforce resolved identity on every tool call (403 on mismatch, 400 when missing + token present, 403 on wildcard in enforcement mode).MCP SSE 400 fix — mount
/mcproutes beforeexpress.json()so the MCP SDK'sSSEServerTransport.handlePostMessage()gets the raw readable body stream. Previouslyexpress.json()consumed the stream first →"stream is not readable"→400 Bad Request→ Crushpmoves-cipherMCP failed to initialize.Verified live:
POST /mcp/messagesreturns202 Acceptedafter fix.Testing
/mcp/sse→ POST/mcp/messages) returns 202Test plan
pmoves-cipherMCP connects (no more 400)Lane
SPARK-KIMI + CRUSH-GLM52 lane (TAC_CIPHER_VILLAGE.md Phase B). Three-body: delivery=KIMI-SPARK + CRUSH-GLM52, control=DARKXSIDE, memory=AGNOTE4482PHI.t1.md trail.
Summary by CodeRabbit