@aiwerk/mcp-bridge 1.6.0 → 1.6.2

package/README.md

@@ -228,6 +228,24 @@ Control which tools are visible and callable per server:
 - If both: allowed tools minus denied ones
 - Applied in both tool listing and execution (defense in depth)
 
+#### Max Result Size
+
+Prevent oversized responses from consuming your context:
+
+```json
+{
+  "maxResultChars": 50000,
+  "servers": {
+    "verbose-server": {
+      "maxResultChars": 10000
+    }
+  }
+}
+```
+
+- Global default + per-server override
+- Truncated results include `_truncated: true` and `_originalLength`
+
 ### Adaptive Promotion
 
 Frequently used tools can be automatically "promoted" to standalone tools alongside the `mcp` meta-tool. The promotion system tracks usage and reports which tools qualify — the host environment (e.g., OpenClaw plugin) decides how to register them.
@@ -257,24 +275,6 @@ mcp(action="promotions")
 
 Returns promoted tools (sorted by frequency) and full usage stats. All tracking is in-memory — promotion rebuilds naturally from usage after restart.
 
-#### Max Result Size
-
-Prevent oversized responses from consuming your context:
-
-```json
-{
-  "maxResultChars": 50000,
-  "servers": {
-    "verbose-server": {
-      "maxResultChars": 10000
-    }
-  }
-}
-```
-
-- Global default + per-server override
-- Truncated results include `_truncated: true` and `_originalLength`
-
 ### Modes
 
 | Mode | Tools exposed | Best for |

package/dist/src/protocol.js

@@ -3,14 +3,23 @@ import { join, dirname } from "path";
 import { fileURLToPath } from "url";
 const __filename = fileURLToPath(import.meta.url);
 const __dirname = dirname(__filename);
-export const PACKAGE_VERSION = (() => {
-    try {
-        return JSON.parse(readFileSync(join(__dirname, "..", "..", "package.json"), "utf-8")).version;
-    }
-    catch {
-        return "0.0.0";
+function loadPackageVersion() {
+    const candidates = [
+        join(__dirname, "..", "package.json"),
+        join(__dirname, "..", "..", "package.json"),
+        join(__dirname, "..", "..", "..", "package.json"),
+    ];
+    for (const p of candidates) {
+        try {
+            const pkg = JSON.parse(readFileSync(p, "utf-8"));
+            if (pkg.version)
+                return pkg.version;
+        }
+        catch { /* try next candidate */ }
     }
-})();
+    return "0.0.0";
+}
+export const PACKAGE_VERSION = loadPackageVersion();
 export async function initializeProtocol(transport, version) {
     const initRequest = {
         jsonrpc: "2.0",

package/dist/src/security.js

@@ -121,7 +121,19 @@ export function applyTrustLevel(result, serverName, serverConfig) {
  */
 export function processResult(result, serverName, serverConfig, clientConfig) {
     let processed = applyMaxResultSize(result, serverConfig, clientConfig);
+    const wasTruncated = processed !== null && typeof processed === "object" && processed._truncated === true;
     // Sanitize step (only for trust=sanitize, handled inside applyTrustLevel)
     processed = applyTrustLevel(processed, serverName, serverConfig);
+    // If both truncated and untrusted, flatten the metadata to top level
+    const trust = serverConfig.trust ?? "trusted";
+    if (wasTruncated && trust === "untrusted") {
+        return {
+            _trust: "untrusted",
+            _server: serverName,
+            _truncated: true,
+            _originalLength: processed.result?._originalLength,
+            result: processed.result?.result,
+        };
+    }
     return processed;
 }

package/dist/src/smart-filter.d.ts

@@ -62,15 +62,15 @@ export declare class SmartFilter {
     /**
      * Extract meaningful intent from last 1-3 user turns
      */
-    private synthesizeQuery;
-    private extractMeaningfulContent;
+    static synthesizeQuery(userTurns: UserTurn[]): string;
+    private static extractMeaningfulContent;
     private prepareFilterableServers;
     private normalizeKeywords;
     /**
      * Score servers using weighted overlap scoring
      */
     private scoreServers;
-    private tokenize;
+    static tokenize(text: string): string[];
     private calculateServerScore;
     private getSemanticScore;
     private countOverlap;
@@ -88,15 +88,8 @@ export declare class SmartFilter {
     private logTelemetry;
 }
 export declare const DEFAULTS: Required<SmartFilterConfig>;
-/** Lowercase, split on whitespace + punctuation, preserve numbers, drop empties. */
-export declare function tokenize(text: string): string[];
 /** Normalize keywords: lowercase, trim, dedup, strip empties, cap at MAX_KEYWORDS. */
 export declare function validateKeywords(raw: string[]): string[];
-/**
- * Extract a meaningful intent string from the last 1-3 user turns.
- * Returns null if no meaningful query can be extracted.
- */
-export declare function synthesizeQuery(userTurns: string[]): string | null;
 export interface ServerScore {
     name: string;
     score: number;

package/dist/src/smart-filter.js

@@ -36,15 +36,22 @@ export class SmartFilter {
         let timeoutOccurred = false;
         try {
             // Set up timeout
+            let timeoutId;
             const timeoutPromise = new Promise((resolve) => {
-                setTimeout(() => {
+                timeoutId = setTimeout(() => {
                     timeoutOccurred = true;
                     this.logger.warn(`[smart-filter] Filter timeout after ${this.config.timeoutMs}ms, falling back to show all`);
                     resolve(this.createUnfilteredResult(servers, allTools, "keyword"));
                 }, this.config.timeoutMs);
             });
             const filterPromise = this.performFilter(servers, allTools, userTurns);
-            const result = await Promise.race([filterPromise, timeoutPromise]);
+            let result;
+            try {
+                result = await Promise.race([filterPromise, timeoutPromise]);
+            }
+            finally {
+                clearTimeout(timeoutId);
+            }
             result.metadata.timeoutOccurred = timeoutOccurred;
             const duration = Date.now() - startTime;
             if (this.config.telemetry) {
@@ -61,7 +68,7 @@ export class SmartFilter {
     }
     async performFilter(servers, allTools, userTurns) {
         // Step 1: Query synthesis
-        const query = this.synthesizeQuery(userTurns);
+        const query = SmartFilter.synthesizeQuery(userTurns);
         if (!query) {
             this.logger.debug("[smart-filter] No meaningful query found, showing all servers");
             return this.createUnfilteredResult(servers, allTools, "keyword", "");
@@ -89,7 +96,7 @@ export class SmartFilter {
     /**
      * Extract meaningful intent from last 1-3 user turns
      */
-    synthesizeQuery(userTurns) {
+    static synthesizeQuery(userTurns) {
         if (!userTurns || userTurns.length === 0) {
             return "";
         }
@@ -99,20 +106,20 @@ export class SmartFilter {
             .reverse()
             .map(turn => turn.content.trim());
         for (const content of recentTurns) {
-            const cleanedQuery = this.extractMeaningfulContent(content);
+            const cleanedQuery = SmartFilter.extractMeaningfulContent(content);
             if (cleanedQuery.length >= 3) {
                 return cleanedQuery;
             }
         }
         // If all recent turns are too short, try combining them
         const combined = recentTurns
-            .map(content => this.extractMeaningfulContent(content))
+            .map(content => SmartFilter.extractMeaningfulContent(content))
             .filter(content => content.length > 0)
             .join(" ")
             .trim();
         return combined.length >= 3 ? combined : "";
     }
-    extractMeaningfulContent(content) {
+    static extractMeaningfulContent(content) {
         // Remove metadata patterns
         const cleaned = content
             .replace(/\[.*?\]/g, "") // [timestamps], [commands]
@@ -157,13 +164,13 @@ export class SmartFilter {
      * Score servers using weighted overlap scoring
      */
     scoreServers(query, servers) {
-        const queryWords = this.tokenize(query.toLowerCase());
+        const queryWords = SmartFilter.tokenize(query.toLowerCase());
         return servers.map(server => ({
             server,
             score: this.calculateServerScore(queryWords, server),
         }));
     }
-    tokenize(text) {
+    static tokenize(text) {
         return text
             .toLowerCase()
             .replace(/[^\w\s]/g, " ")
@@ -173,7 +180,7 @@ export class SmartFilter {
     calculateServerScore(queryWords, server) {
         if (queryWords.length === 0)
             return 0;
-        const descriptionWords = this.tokenize(server.description);
+        const descriptionWords = SmartFilter.tokenize(server.description);
         const keywordWords = server.keywords;
         const allServerWords = [...descriptionWords, ...keywordWords];
         // Calculate overlaps
@@ -311,7 +318,7 @@ export class SmartFilter {
      * Filter tools within selected servers
      */
     filterTools(query, selectedServers) {
-        const queryWords = this.tokenize(query);
+        const queryWords = SmartFilter.tokenize(query);
         const allTools = [];
         for (const { server } of selectedServers) {
             for (const tool of server.tools) {
@@ -330,8 +337,8 @@ export class SmartFilter {
     calculateToolScore(queryWords, tool) {
         if (queryWords.length === 0)
             return 0;
-        const nameWords = this.tokenize(tool.name);
-        const descWords = this.tokenize(tool.description || "");
+        const nameWords = SmartFilter.tokenize(tool.name);
+        const descWords = SmartFilter.tokenize(tool.description || "");
         const nameMatches = this.countOverlap(queryWords, nameWords);
         const descMatches = this.countOverlap(queryWords, descWords) - this.countOverlap(queryWords, nameWords);
         // Weighted: description 1.0x, name 0.5x (name is less descriptive usually)
@@ -382,11 +389,6 @@ export class SmartFilter {
 }
 // ── Standalone utility exports (for testing and external use) ────────────────
 const MAX_KEYWORDS = 30;
-const NOISE_WORDS = new Set([
-    "yes", "no", "ok", "okay", "sure", "yep", "nope", "yeah", "nah",
-    "do", "it", "please", "thanks", "thank", "you", "hi", "hello",
-    "hey", "right", "alright", "fine", "got", "hmm", "hm",
-]);
 export const DEFAULTS = {
     enabled: true,
     embedding: "keyword",
@@ -400,13 +402,6 @@ export const DEFAULTS = {
     timeoutMs: 500,
     telemetry: false,
 };
-/** Lowercase, split on whitespace + punctuation, preserve numbers, drop empties. */
-export function tokenize(text) {
-    return text
-        .toLowerCase()
-        .split(/[\s\p{P}]+/u)
-        .filter(t => t.length > 0);
-}
 /** Normalize keywords: lowercase, trim, dedup, strip empties, cap at MAX_KEYWORDS. */
 export function validateKeywords(raw) {
     const seen = new Set();
@@ -422,20 +417,6 @@ export function validateKeywords(raw) {
     }
     return out;
 }
-/**
- * Extract a meaningful intent string from the last 1-3 user turns.
- * Returns null if no meaningful query can be extracted.
- */
-export function synthesizeQuery(userTurns) {
-    const recent = userTurns.slice(-3).reverse();
-    for (const turn of recent) {
-        const tokens = tokenize(turn).filter(t => !NOISE_WORDS.has(t));
-        if (tokens.length >= 2) {
-            return tokens.join(" ");
-        }
-    }
-    return null;
-}
 /**
  * Score a single server against a query using weighted word overlap.
  * desc_matches * 1.0 + kw_only_matches * 0.5, normalized by query length.
@@ -443,10 +424,10 @@ export function synthesizeQuery(userTurns) {
 export function scoreServer(queryTokens, serverName, description, keywords) {
     if (queryTokens.length === 0)
         return 0;
-    const descTokens = new Set(tokenize(description));
-    for (const t of tokenize(serverName))
+    const descTokens = new Set(SmartFilter.tokenize(description));
+    for (const t of SmartFilter.tokenize(serverName))
         descTokens.add(t);
-    const kwTokens = new Set(validateKeywords(keywords).flatMap(kw => tokenize(kw)));
+    const kwTokens = new Set(validateKeywords(keywords).flatMap(kw => SmartFilter.tokenize(kw)));
     let descMatches = 0;
     let kwOnlyMatches = 0;
     for (const qt of queryTokens) {
@@ -521,14 +502,15 @@ export function filterServers(servers, userTurns, config, logger) {
     try {
         const merged = { ...DEFAULTS, ...config };
         const startTime = Date.now();
-        const query = synthesizeQuery(userTurns);
+        const userTurnObjects = userTurns.map(content => ({ content, timestamp: Date.now() }));
+        const query = SmartFilter.synthesizeQuery(userTurnObjects) || null;
         if (!query)
             return showAll("no-query");
         if (Date.now() - startTime > merged.timeoutMs) {
             logger?.warn("[smart-filter] Timeout during query synthesis");
             return showAll("timeout", query);
         }
-        const queryTokens = tokenize(query);
+        const queryTokens = SmartFilter.tokenize(query);
         if (queryTokens.length === 0)
             return showAll("no-query");
         const scores = scoreAllServers(queryTokens, servers);

package/dist/src/standalone-server.d.ts

@@ -13,7 +13,8 @@ export declare class StandaloneServer {
     private directConnections;
     constructor(config: BridgeConfig, logger: Logger);
     private isRouterMode;
-    /** Start stdio mode: read JSON-RPC from stdin, write responses to stdout. */
+    /** Start stdio mode: read JSON-RPC from stdin, write responses to stdout.
+     *  Supports both newline-delimited JSON and LSP Content-Length framing. */
     startStdio(): Promise<void>;
     private processLine;
     private writeResponse;

package/dist/src/standalone-server.js

@@ -27,19 +27,73 @@ export class StandaloneServer {
     isRouterMode() {
         return (this.config.mode ?? "router") === "router";
     }
-    /** Start stdio mode: read JSON-RPC from stdin, write responses to stdout. */
+    /** Start stdio mode: read JSON-RPC from stdin, write responses to stdout.
+     *  Supports both newline-delimited JSON and LSP Content-Length framing. */
     async startStdio() {
         const stdin = process.stdin;
         const stdout = process.stdout;
         stdin.setEncoding("utf8");
         let buffer = "";
+        // LSP framing state
+        let lspContentLength = -1; // -1 means not in LSP mode for current message
+        let lspHeadersDone = false;
         stdin.on("data", (chunk) => {
             buffer += chunk;
-            const lines = buffer.split("\n");
-            buffer = lines.pop() || "";
-            for (const line of lines) {
+            // Process buffer in a loop — it may contain multiple messages
+            let progress = true;
+            while (progress) {
+                progress = false;
+                // If we're reading an LSP body, check if we have enough bytes
+                if (lspContentLength >= 0 && lspHeadersDone) {
+                    if (buffer.length >= lspContentLength) {
+                        const body = buffer.slice(0, lspContentLength);
+                        buffer = buffer.slice(lspContentLength);
+                        lspContentLength = -1;
+                        lspHeadersDone = false;
+                        const trimmed = body.trim();
+                        if (trimmed) {
+                            this.processLine(trimmed, stdout);
+                        }
+                        progress = true;
+                        continue;
+                    }
+                    // Not enough data yet — wait for more
+                    break;
+                }
+                // Look for complete lines to detect framing
+                const newlineIdx = buffer.indexOf("\n");
+                if (newlineIdx === -1)
+                    break;
+                const line = buffer.slice(0, newlineIdx);
                 const trimmed = line.trim();
-                if (!trimmed)
+                // LSP header detection
+                if (lspContentLength >= 0 && !lspHeadersDone) {
+                    // We're reading LSP headers — consume until empty line
+                    buffer = buffer.slice(newlineIdx + 1);
+                    progress = true;
+                    if (trimmed === "") {
+                        // End of headers — next read the body
+                        lspHeadersDone = true;
+                    }
+                    // Ignore other headers (Content-Type, etc.)
+                    continue;
+                }
+                if (trimmed.startsWith("Content-Length:")) {
+                    // Start of LSP-framed message
+                    const lengthStr = trimmed.slice("Content-Length:".length).trim();
+                    const length = parseInt(lengthStr, 10);
+                    if (!isNaN(length) && length > 0) {
+                        lspContentLength = length;
+                        lspHeadersDone = false;
+                        buffer = buffer.slice(newlineIdx + 1);
+                        progress = true;
+                        continue;
+                    }
+                }
+                // Newline-delimited JSON: consume the line
+                buffer = buffer.slice(newlineIdx + 1);
+                progress = true;
+                if (!trimmed || !trimmed.startsWith("{"))
                     continue;
                 this.processLine(trimmed, stdout);
             }
@@ -185,7 +239,8 @@ export class StandaloneServer {
                     jsonrpc: "2.0",
                     id,
                     result: {
-                        content: [{ type: "text", text: JSON.stringify(result) }]
+                        content: [{ type: "text", text: JSON.stringify(result) }],
+                        isError: true
                     }
                 };
             }

package/dist/src/transport-base.d.ts

@@ -54,7 +54,7 @@ export declare abstract class BaseTransport implements McpTransport {
  * @param contextDescription - Human-readable context for error messages (e.g. 'header "Authorization"')
  * @param extraEnv - Additional env vars to check before process.env (e.g. merged child process env)
  */
-export declare function resolveEnvVars(value: string, contextDescription: string, extraEnv?: Record<string, string | undefined>): string;
+export declare function resolveEnvVars(value: string, contextDescription: string, extraEnv?: Record<string, string | undefined>, envFallback?: () => Record<string, string>): string;
 /**
  * Resolve ${VAR} placeholders in all values of a Record<string, string>.
  *
@@ -62,14 +62,14 @@ export declare function resolveEnvVars(value: string, contextDescription: string
  * @param contextPrefix - Prefix for error context (e.g. "header", "env key")
  * @param extraEnv - Additional env vars to check before process.env
  */
-export declare function resolveEnvRecord(record: Record<string, string>, contextPrefix: string, extraEnv?: Record<string, string | undefined>): Record<string, string>;
+export declare function resolveEnvRecord(record: Record<string, string>, contextPrefix: string, extraEnv?: Record<string, string | undefined>, envFallback?: () => Record<string, string>): Record<string, string>;
 /**
  * Resolve ${VAR} placeholders in an array of command arguments.
  *
  * @param args - Array of argument strings with potential ${VAR} placeholders
  * @param extraEnv - Additional env vars to check before process.env
  */
-export declare function resolveArgs(args: string[], extraEnv?: Record<string, string | undefined>): string[];
+export declare function resolveArgs(args: string[], extraEnv?: Record<string, string | undefined>, envFallback?: () => Record<string, string>): string[];
 /**
  * Warn if a URL uses non-TLS HTTP to a remote (non-localhost) host.
  */

package/dist/src/transport-base.js

@@ -117,16 +117,17 @@ export class BaseTransport {
  * @param contextDescription - Human-readable context for error messages (e.g. 'header "Authorization"')
  * @param extraEnv - Additional env vars to check before process.env (e.g. merged child process env)
  */
-export function resolveEnvVars(value, contextDescription, extraEnv) {
+export function resolveEnvVars(value, contextDescription, extraEnv, envFallback) {
     return value.replace(/\$\{(\w+)\}/g, (_, varName) => {
         const resolved = extraEnv?.[varName] ?? process.env[varName];
-        // If resolved is undefined or empty string, try the OpenClaw .env fallback.
-        // This handles the case where dotenv(override:false) didn't overwrite a
-        // pre-existing empty env var in process.env.
+        // If resolved is undefined or empty string, try the env fallback.
+        // Default fallback is loadOpenClawDotEnvFallback (handles the case where
+        // dotenv(override:false) didn't overwrite a pre-existing empty env var).
         if (resolved === undefined || resolved === "") {
-            const fallback = loadOpenClawDotEnvFallback()[varName];
-            if (fallback !== undefined && fallback !== "") {
-                return fallback;
+            const fallbackFn = envFallback ?? loadOpenClawDotEnvFallback;
+            const fallbackVal = fallbackFn()[varName];
+            if (fallbackVal !== undefined && fallbackVal !== "") {
+                return fallbackVal;
             }
         }
         if (resolved === undefined) {
@@ -142,10 +143,10 @@ export function resolveEnvVars(value, contextDescription, extraEnv) {
  * @param contextPrefix - Prefix for error context (e.g. "header", "env key")
  * @param extraEnv - Additional env vars to check before process.env
  */
-export function resolveEnvRecord(record, contextPrefix, extraEnv) {
+export function resolveEnvRecord(record, contextPrefix, extraEnv, envFallback) {
     const resolved = {};
     for (const [key, value] of Object.entries(record)) {
-        resolved[key] = resolveEnvVars(value, `${contextPrefix} "${key}"`, extraEnv);
+        resolved[key] = resolveEnvVars(value, `${contextPrefix} "${key}"`, extraEnv, envFallback);
     }
     return resolved;
 }
@@ -155,8 +156,8 @@ export function resolveEnvRecord(record, contextPrefix, extraEnv) {
  * @param args - Array of argument strings with potential ${VAR} placeholders
  * @param extraEnv - Additional env vars to check before process.env
  */
-export function resolveArgs(args, extraEnv) {
-    return args.map(arg => resolveEnvVars(arg, `arg "${arg}"`, extraEnv));
+export function resolveArgs(args, extraEnv, envFallback) {
+    return args.map(arg => resolveEnvVars(arg, `arg "${arg}"`, extraEnv, envFallback));
 }
 /**
  * Warn if a URL uses non-TLS HTTP to a remote (non-localhost) host.

package/dist/src/transport-sse.js

@@ -85,7 +85,8 @@ export class SseTransport extends BaseTransport {
             return;
         }
         if (trimmed.startsWith("data:")) {
-            state.dataBuffer.push(trimmed.substring(5).trimStart());
+            const rawData = trimmed.substring(5);
+            state.dataBuffer.push(rawData.startsWith(" ") ? rawData.substring(1) : rawData);
             return;
         }
         if (trimmed === "") {
@@ -100,7 +101,7 @@ export class SseTransport extends BaseTransport {
                     const base = new URL(this.config.url);
                     this.endpointUrl = `${base.origin}${data}`;
                 }
-                else if (data.startsWith("http")) {
+                else if (data.startsWith("http://") || data.startsWith("https://")) {
                     if (!this.isSameOrigin(data)) {
                         this.logger.warn(`[mcp-bridge] Rejected SSE endpoint with mismatched origin: ${data}`);
                         return;

package/dist/src/types.d.ts

@@ -40,6 +40,7 @@ export interface McpClientConfig {
         minScore?: number;
     };
     maxResultChars?: number;
+    envFallback?: () => Record<string, string>;
     adaptivePromotion?: {
         enabled?: boolean;
         maxPromoted?: number;

package/dist/src/types.js

@@ -1,4 +1,5 @@
 let globalRequestId = 1;
 export function nextRequestId() {
-    return globalRequestId++;
+    globalRequestId = (globalRequestId + 1) % Number.MAX_SAFE_INTEGER;
+    return globalRequestId;
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@aiwerk/mcp-bridge",
-  "version": "1.6.0",
+  "version": "1.6.2",
   "description": "Standalone MCP server that multiplexes multiple MCP servers into one interface",
   "type": "module",
   "main": "./dist/src/index.js",