From 165a61b91ffb33394c9ad989209e021388caf74c Mon Sep 17 00:00:00 2001 From: Agent Zero Date: Thu, 30 Jul 2026 16:43:43 +0000 Subject: [PATCH 1/2] =?UTF-8?q?chore(submodule):=20promote=20Pmoves-cipher?= =?UTF-8?q?=20=E2=86=92=202b4c4f7=20(Phase=20B=20PR=202=20+=20MCP=20SSE=20?= =?UTF-8?q?fix)?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Advances cipher gitlink 986e6e2 → 2b4c4f7. Brings two fixes from Pmoves-cipher PR #12 (squash-merged 2026-07-30): 1. Per-agent token enforcement (Phase B PR 2): auth.ts resolves cipher_ tokens via Supabase cipher_agent_tokens table; memory-routes.ts + mcp-sse.ts enforce resolved identity on every tool call (403 on mismatch, 400 when missing + token present, 403 on wildcard in enforcement mode). 2. MCP SSE 400 fix: mount /mcp routes before express.json() so the MCP SDK's SSEServerTransport.handlePostMessage() gets the raw readable body stream (express.json() was consuming it first → "stream is not readable" → 400 → Crush pmoves-cipher MCP failed to initialize). Verified live: POST /mcp/messages returns 202 Accepted after fix. --- Pmoves-cipher | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/Pmoves-cipher b/Pmoves-cipher index 986e6e2fcf..2b4c4f79fe 160000 --- a/Pmoves-cipher +++ b/Pmoves-cipher @@ -1 +1 @@ -Subproject commit 986e6e2fcf7476741e8f2b30799e45b718023456 +Subproject commit 2b4c4f79fe951788fa68f36281b2492f5350cc1c From 3db520b9336f7d8cf91b8769f697f56036c8e971 Mon Sep 17 00:00:00 2001 From: Agent Zero Date: Thu, 30 Jul 2026 17:36:34 +0000 Subject: [PATCH 2/2] fix(compose): attach cipher-api to pmoves_api for Supabase token resolution MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Addresses Codex P1 + Crush 4090 review on PR #2299. Root cause: cipher-api was on pmoves_app, pmoves_data, pmoves_bus, pmoves_external — but NOT pmoves_api. The per-agent token enforcement (P #12) resolves cipher_ tokens via SUPABASE_REST_URL which defaults to http://supabase-kong:8000/rest/v1. supabase-kong is on pmoves_api + pmoves_public. Without pmoves_api, cipher cannot reach supabase-kong → token lookups fail → authenticated requests rejected. Fix: add pmoves_api to cipher-api networks in both canonical (docker-compose.yml) and split overlay (docker-compose.agents.yml). Also added to PMOVES_NETWORKS env var for consistency. --- pmoves/docker-compose.agents.yml | 4 ++-- pmoves/docker-compose.yml | 4 ++-- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/pmoves/docker-compose.agents.yml b/pmoves/docker-compose.agents.yml index 4cacb791be..e7a2523a94 100644 --- a/pmoves/docker-compose.agents.yml +++ b/pmoves/docker-compose.agents.yml @@ -742,7 +742,7 @@ services: - QDRANT_COLLECTION=pmoves_cipher_memory - EMBEDDING_MODEL=tensorzero::embedding_model_name::qwen3_embedding_4b_local - EMBEDDING_DIM=2560 - - PMOVES_NETWORKS=pmoves_app,pmoves_data,pmoves_bus,pmoves_external + - PMOVES_NETWORKS=pmoves_app,pmoves_data,pmoves_bus,pmoves_external,pmoves_api ports: - "${CIPHER_BIND:-127.0.0.1}:${CIPHER_PORT:-8105}:8105" depends_on: @@ -753,7 +753,7 @@ services: profiles: ["agents", "cipher"] extra_hosts: - "host.docker.internal:host-gateway" - networks: [pmoves_app, pmoves_data, pmoves_bus, pmoves_external] + networks: [pmoves_app, pmoves_data, pmoves_bus, pmoves_external, pmoves_api] healthcheck: test: ["CMD", "node", "-e", "const http=require('http');http.get('http://127.0.0.1:8105/health',r=>{process.exit(r.statusCode===200?0:1)}).on('error',()=>process.exit(1))"] interval: 30s diff --git a/pmoves/docker-compose.yml b/pmoves/docker-compose.yml index 9355b04ca4..82e0e3c2a1 100644 --- a/pmoves/docker-compose.yml +++ b/pmoves/docker-compose.yml @@ -3041,7 +3041,7 @@ services: - QDRANT_COLLECTION=pmoves_cipher_memory - EMBEDDING_MODEL=tensorzero::embedding_model_name::qwen3_embedding_4b_local - EMBEDDING_DIM=2560 - - PMOVES_NETWORKS=pmoves_app,pmoves_data,pmoves_bus,pmoves_external + - PMOVES_NETWORKS=pmoves_app,pmoves_data,pmoves_bus,pmoves_external,pmoves_api ports: - "${CIPHER_BIND:-127.0.0.1}:${CIPHER_PORT:-8105}:8105" depends_on: @@ -3052,7 +3052,7 @@ services: profiles: ["agents", "cipher"] extra_hosts: - "host.docker.internal:host-gateway" - networks: [pmoves_app, pmoves_data, pmoves_bus, pmoves_external] + networks: [pmoves_app, pmoves_data, pmoves_bus, pmoves_external, pmoves_api] healthcheck: test: ["CMD", "node", "-e", "const http=require('http');http.get('http://127.0.0.1:8105/health',r=>{process.exit(r.statusCode===200?0:1)}).on('error',()=>process.exit(1))"] interval: 30s