chore(deps): bump vendor/meteor-wormhole from 69d83a2 to 8b2964b

[dependabot]

Bumps vendor/meteor-wormhole from 69d83a2 to 8b2964b.

Commits

• 8b2964b Merge pull request #3 from mieweb/docs/plugin-host
• 2aa7a1f fix(plugins): address review feedback on plugin host
• 8c81793 docs: document plugin host (Wormhole.use), context, and sanitizeToolName
• See full diff in compare view

[github-actions]

🗑️ Preview Environment Cleaned Up

The preview container for this PR has been deleted.

[Dharp02]

Closing this one — it isn't a version bump, it's a silent revert of a feature the backend depends on.

The pointer moves sideways, not forward

vendor/meteor-wormhole is currently pinned to 69d83a2, which lives only on origin/feat/invocation-context. That branch was never merged into the wormhole main. This PR retargets the submodule to 8b2964b, the tip of upstream main:

merge base:  e436886  (Merge pull request #2 from mieweb/feat/plugin-host)
  ├── origin/main                 +3 commits  → 8b2964b   (this PR's target)
  └── feat/invocation-context     +1 commit   → 69d83a2   (what we're pinned to)

$ git merge-base --is-ancestor 69d83a2 8b2964b   # → non-zero: divergent, not a fast-forward
$ git log --oneline 8b2964b..69d83a2
69d83a2 feat: per-invocation AsyncLocalStorage context with Authorization header access

So merging this gains the plugin-host docs commits but drops the invocation-context work: lib/invocation-context.js, plus the currentInvocation / currentBearerToken / parseBearerToken exports from packages/meteor-wormhole/server.js.

Why that breaks the backend

meteor-backend/server/auth-bridge.js imports one of those exports directly:

// meteor-backend/server/auth-bridge.js:21
import { currentBearerToken } from 'meteor/wreiske:meteor-wormhole';

Neither the module nor the export exists at the target commit:

$ git ls-tree -r --name-only 8b2964b | grep -i invocation          # → no matches
$ git show 8b2964b:packages/meteor-wormhole/server.js | grep currentBearerToken  # → no matches

That takes out PAT / Authorization: Bearer auth on the REST + MCP bridges.

Worth flagging one red herring: meteor-backend/server/bearer-context.js exports its own currentBearerToken() and is mounted as middleware in main.js for /api and /mcp. It is not a fallback — auth-bridge.js imports from the package, not the shim, and they use separate AsyncLocalStorage stores. It would not prevent the breakage.

Path forward

The underlying problem is that we're pinned to an unmerged feature branch, so Dependabot will keep trying to "upgrade" us onto main and keep proposing this same revert. The real fix is upstream: get feat/invocation-context merged into mieweb/meteor-wormhole main, then bump the submodule to a commit that contains both lines of work.

Note that this PR reported as MERGEABLE with no failing checks — nothing in CI would have caught it. Closing rather than leaving it open so it doesn't get waved through in a batch of dependency merges.

[dependabot]

OK, I won't notify you again about this release, but will get in touch when a new version is available. You can also ignore all major, minor, or patch releases for a dependency by adding an ignore condition with the desired update_types to your config file.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.