@akira-tl/forgerelay 1.2.2 → 1.2.3

package/CHANGELOG.md

@@ -4,6 +4,13 @@ All notable ForgeRelay changes are documented here.
 
 ## [Unreleased]
 
+## [1.2.3] - 2026-09-14
+
+### Fixed
+
+- MCP App 静态资源现在在 API Origin validation 之前进入专用静态资源路由，使 ChatGPT `*.web-sandbox.oaiusercontent.com` iframe 可以跨域加载 JavaScript/CSS；MCP、OAuth 与其他 API 路由仍继续拒绝未授权 Origin，不扩大 API 信任边界。
+- 交互式 `7677` debug 实例现在复用生产 ForgeRelay 的 Skill source（默认 `~/.forgerelay/skills`），同时继续隔离 debug 的 config、auth、state 与端口，使 Activity Panel / Workspace Skill 展示与生产发现语义一致。
+
 ## [1.2.2] - 2026-09-13
 
 ### Fixed

package/dist/mcp/server/transport/http-server.js

@@ -1,6 +1,6 @@
 import { randomUUID } from "node:crypto";
 import { checkResourceAllowed, createMcpHandler, isInitializeRequest, isLegacyRequest, localhostAllowedOrigins, resourceUrlFromServerUrl, } from "@modelcontextprotocol/server";
-import { createMcpExpressApp, getOAuthProtectedResourceMetadataUrl, requireBearerAuth, } from "@modelcontextprotocol/express";
+import { getOAuthProtectedResourceMetadataUrl, hostHeaderValidation, localhostHostValidation, originValidation, requireBearerAuth, } from "@modelcontextprotocol/express";
 import { NodeStreamableHTTPServerTransport, toNodeHandler, toWebRequest, } from "@modelcontextprotocol/node";
 import express from "express";
 import { ActivityAuditStore } from "../../../activity/history/audit-store.js";
@@ -40,11 +40,14 @@ export function createHttpServer(config, options, createMcpServer) {
         ...localhostAllowedOrigins(),
         ...routeBaseUrls.map((baseUrl) => baseUrl.hostname),
     ]));
-    const app = createMcpExpressApp({
-        host: config.host,
-        ...(allowedHosts ? { allowedHosts } : {}),
-        allowedOrigins,
-    });
+    const app = express();
+    app.use(express.json());
+    if (allowedHosts) {
+        app.use(hostHeaderValidation(allowedHosts));
+    }
+    else if (["127.0.0.1", "localhost", "::1"].includes(config.host)) {
+        app.use(localhostHostValidation());
+    }
     const transports = new McpTransportRegistry({
         maxTransports: MAX_MCP_TRANSPORT_SESSIONS,
     });
@@ -193,16 +196,10 @@ export function createHttpServer(config, options, createMcpServer) {
         });
         next();
     });
-    app.use(createForgeRelayAuthRouter({
-        provider: oauthProvider,
-        cliAuthenticationProvider: oauthProvider,
-        instanceId: config.instanceId,
-        issuerUrl: new URL(config.publicBaseUrl),
-        resourceServerUrl,
-        routeBaseUrls,
-        scopesSupported: config.oauth.scopes,
-        resourceName: "ForgeRelay",
-    }));
+    // MCP App assets are intentionally public, cross-origin resources. ChatGPT
+    // renders an app on a dedicated `*.web-sandbox.oaiusercontent.com` origin,
+    // so these routes must run before MCP/API Origin validation. Host validation
+    // still applies above, while MCP, OAuth, and health routes remain protected.
     app.options(activityPanelAssetsPaths.map((assetPath) => `${assetPath}/{*asset}`), (_req, res) => {
         setActivityPanelAssetHeaders(res);
         res.sendStatus(204);
@@ -213,6 +210,17 @@ export function createHttpServer(config, options, createMcpServer) {
         fallthrough: false,
         setHeaders: setActivityPanelAssetHeaders,
     }));
+    app.use(originValidation(allowedOrigins));
+    app.use(createForgeRelayAuthRouter({
+        provider: oauthProvider,
+        cliAuthenticationProvider: oauthProvider,
+        instanceId: config.instanceId,
+        issuerUrl: new URL(config.publicBaseUrl),
+        resourceServerUrl,
+        routeBaseUrls,
+        scopesSupported: config.oauth.scopes,
+        resourceName: "ForgeRelay",
+    }));
     app.get(healthPaths, (_req, res) => {
         res.json({ ok: true, name: "forgerelay" });
     });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@akira-tl/forgerelay",
-  "version": "1.2.2",
+  "version": "1.2.3",
   "description": "Local development control plane for MCP coding agents.",
   "type": "module",
   "homepage": "https://github.com/Akira-TL/forgerelay#readme",

package/scripts/debug/runtime.mjs

@@ -67,6 +67,16 @@ export function createInteractiveDebugEnvironment({
   const configDir = interactiveDebugConfigDir({ env, home });
   const ownerToken = interactiveDebugOwnerToken(configDir);
   const { baseUrl, mcpUrl } = interactiveDebugUrls(configDir);
+  const productConfigDir = env.FORGERELAY_DEBUG_PRODUCT_CONFIG_DIR
+    ? resolve(env.FORGERELAY_DEBUG_PRODUCT_CONFIG_DIR.startsWith("~/")
+      ? join(home, env.FORGERELAY_DEBUG_PRODUCT_CONFIG_DIR.slice(2))
+      : env.FORGERELAY_DEBUG_PRODUCT_CONFIG_DIR)
+    : resolve(join(home, ".forgerelay"));
+  const productSkillPaths = [
+    join(productConfigDir, "skills"),
+    env.FORGERELAY_SKILL_PATHS,
+  ].filter((value) => typeof value === "string" && value.trim());
+  const productSkillsEnabled = env.FORGERELAY_SKILLS;
   mkdirSync(debugRoot, { recursive: true });
 
   const debugEnv = { ...env };
@@ -84,6 +94,10 @@ export function createInteractiveDebugEnvironment({
     }
   }
   debugEnv.FORGERELAY_CONFIG_DIR = configDir;
+  debugEnv.FORGERELAY_SKILL_PATHS = productSkillPaths.join(",");
+  if (productSkillsEnabled !== undefined) {
+    debugEnv.FORGERELAY_SKILLS = productSkillsEnabled;
+  }
 
   return { ownerToken, configDir, baseUrl, mcpUrl, env: debugEnv };
 }

package/scripts/debug/runtime.test.mjs

@@ -40,6 +40,8 @@ test("interactive debug uses one dedicated persisted config under ~/.forgerelay/
       FORGERELAY_ALLOWED_HOSTS: "wrong.example.test",
       FORGERELAY_OAUTH_OWNER_TOKEN: "wrong-owner-password-123456",
       FORGERELAY_WIDGETS: "off",
+      FORGERELAY_SKILL_PATHS: "/extra/product/skills",
+      FORGERELAY_SKILLS: "1",
       FORGERELAY_LOG_LEVEL: "debug",
     },
     home,
@@ -62,6 +64,11 @@ test("interactive debug uses one dedicated persisted config under ~/.forgerelay/
   assert.equal(result.env.FORGERELAY_ALLOWED_HOSTS, undefined);
   assert.equal(result.env.FORGERELAY_OAUTH_OWNER_TOKEN, undefined);
   assert.equal(result.env.FORGERELAY_WIDGETS, undefined);
+  assert.equal(
+    result.env.FORGERELAY_SKILL_PATHS,
+    [join(home, ".forgerelay", "skills"), "/extra/product/skills"].join(","),
+  );
+  assert.equal(result.env.FORGERELAY_SKILLS, "1");
   assert.equal(result.env.FORGERELAY_LOG_LEVEL, "debug");
 });
 
@@ -80,8 +87,12 @@ test("interactive debug config directory may be explicitly relocated without fal
   await writeFile(join(customDir, "config.json"), JSON.stringify({ host: "127.0.0.1", port: 6768 }) + "\n");
   await writeFile(join(customDir, "auth.json"), JSON.stringify({ ownerToken: "custom-debug-password-123456" }) + "\n");
 
+  const productConfigDir = join(home, "custom-product-config");
   const result = createInteractiveDebugEnvironment({
-    env: { FORGERELAY_DEBUG_CONFIG_DIR: customDir },
+    env: {
+      FORGERELAY_DEBUG_CONFIG_DIR: customDir,
+      FORGERELAY_DEBUG_PRODUCT_CONFIG_DIR: productConfigDir,
+    },
     home,
   });
 
@@ -90,4 +101,5 @@ test("interactive debug config directory may be explicitly relocated without fal
   assert.equal(result.env.FORGERELAY_CONFIG_DIR, customDir);
   assert.equal(result.baseUrl, "http://127.0.0.1:6768");
   assert.equal(result.mcpUrl, "http://127.0.0.1:6768/mcp");
+  assert.equal(result.env.FORGERELAY_SKILL_PATHS, join(productConfigDir, "skills"));
 });