@askrjs/node 0.0.6 → 0.0.7

package/README.md

@@ -48,7 +48,8 @@ Pass an `AbortSignal` to integrate shutdown with your process lifecycle.
 
 Enable the built-in `ws` transport with `websocket: true`. It defaults to a
 1 MiB maximum message payload with compression disabled; pass
-`websocket: { maxPayload, perMessageDeflate }` to override those settings.
+`websocket: { maxPayload, maxRejectionBodyBytes, perMessageDeflate }` to override
+those settings. Rejected upgrade bodies are capped at 64 KiB by default.
 
 ```ts
 router.ws("/echo", (socket) => {
@@ -76,6 +77,8 @@ await running.close();
 ```
 
 `serve` handles static assets and closes both the HTTP server and the application during shutdown.
+Both `listen` and `serve` bind to `127.0.0.1` by default. A non-loopback
+`host` also requires `allowPublicBind: true` so public exposure is explicit.
 
 ## MCP over stdio
 

package/dist/index.d.ts

@@ -5,6 +5,7 @@ import { AddressInfo } from "node:net";
 //#region src/contracts.d.ts
 interface NodeWebSocketOptions {
   readonly maxPayload?: number;
+  readonly maxRejectionBodyBytes?: number;
   readonly perMessageDeflate?: boolean | PerMessageDeflateOptions;
   readonly allowedOrigins?: readonly string[];
 }
@@ -15,6 +16,7 @@ interface NodeHandlerOptions {
 interface ListenOptions {
   port?: number;
   host?: string;
+  allowPublicBind?: boolean;
   backlog?: number;
   signal?: AbortSignal;
   requestTimeout?: number;

package/dist/index.js

@@ -2,7 +2,7 @@ import { Readable } from "node:stream";
 import { createServer } from "node:http";
 import { WebSocketServer } from "ws";
 import { createReadStream } from "node:fs";
-import { stat } from "node:fs/promises";
+import { realpath, stat } from "node:fs/promises";
 import { extname, resolve, sep } from "node:path";
 //#region src/request.ts
 var NodeRequestError = class extends TypeError {};
@@ -14,7 +14,7 @@ function requestHeaders(request) {
 	}
 	return headers;
 }
-function requestFromNode(request, options, signal) {
+function resolveNodeRequestUrl(request, options) {
 	const host = request.headers.host;
 	if (!options.baseUrl && !options.allowedHosts?.length) throw new NodeRequestError("Node handling requires baseUrl or an allowedHosts allowlist.");
 	if (!host) throw new NodeRequestError("Request Host header is required.");
@@ -23,6 +23,10 @@ function requestFromNode(request, options, signal) {
 	const base = options.baseUrl ?? `http://${host}`;
 	const target = new URL(request.url ?? "/", base);
 	if (/^https?:\/\//i.test(request.url ?? "") && target.origin !== new URL(base).origin) throw new NodeRequestError("Absolute-form request target origin is not allowed.");
+	return target;
+}
+function requestFromNode(request, options, signal) {
+	const target = resolveNodeRequestUrl(request, options);
 	const method = request.method ?? "GET";
 	const body = method === "GET" || method === "HEAD" ? void 0 : Readable.toWeb(request);
 	return new Request(target, {
@@ -139,6 +143,16 @@ function createNodeHandler(app, options = {}) {
 	};
 }
 //#endregion
+//#region src/bind.ts
+function resolveBindHost(options) {
+	const host = options.host ?? "127.0.0.1";
+	if (!(host === "localhost" || host === "::1" || /^127(?:\.\d{1,3}){3}$/.test(host)) && options.allowPublicBind !== true) throw new TypeError(`Refusing to bind non-loopback host ${host} without allowPublicBind: true.`);
+	return host;
+}
+function formatHostForUrl(host) {
+	return host.includes(":") && !host.startsWith("[") ? `[${host}]` : host;
+}
+//#endregion
 //#region src/websocket.ts
 function subscribe(socket, event, listener) {
 	socket.on(event, listener);
@@ -163,15 +177,43 @@ function socketLike(socket) {
 		onError: (listener) => subscribe(socket, "error", listener)
 	};
 }
-async function rejectUpgrade(socket, response) {
-	const body = Buffer.from(await response.arrayBuffer());
+async function readRejectionBody(response, maxBytes) {
+	const lengthHeader = response.headers.get("content-length");
+	const declaredLength = lengthHeader === null ? void 0 : Number(lengthHeader);
+	if (declaredLength !== void 0 && Number.isFinite(declaredLength) && declaredLength > maxBytes) {
+		await response.body?.cancel("WebSocket rejection body exceeded maxRejectionBodyBytes");
+		return;
+	}
+	if (!response.body) return Buffer.alloc(0);
+	const reader = response.body.getReader();
+	const chunks = [];
+	let length = 0;
+	while (true) {
+		const part = await reader.read();
+		if (part.done) return Buffer.concat(chunks, length);
+		length += part.value.byteLength;
+		if (length > maxBytes) {
+			await reader.cancel("WebSocket rejection body exceeded maxRejectionBodyBytes");
+			return;
+		}
+		chunks.push(Buffer.from(part.value));
+	}
+}
+async function rejectUpgrade(socket, response, maxBodyBytes) {
+	const buffered = await readRejectionBody(response, maxBodyBytes);
+	if (!buffered) response = new Response("WebSocket rejection body exceeded configured limit", { status: 500 });
+	const body = buffered ?? Buffer.from(await response.arrayBuffer());
 	const lines = [`HTTP/1.1 ${response.status} ${response.statusText || "Rejected"}`];
-	response.headers.forEach((value, name) => lines.push(`${name}: ${value}`));
-	if (!response.headers.has("content-length")) lines.push(`content-length: ${body.byteLength}`);
+	response.headers.forEach((value, name) => {
+		if (name !== "content-length" && name !== "transfer-encoding") lines.push(`${name}: ${value}`);
+	});
+	lines.push(`content-length: ${body.byteLength}`);
 	lines.push("connection: close", "", "");
 	socket.end(Buffer.concat([Buffer.from(lines.join("\r\n")), body]));
 }
 function installWebSockets(server, app, options = {}, handlerOptions = {}) {
+	const maxRejectionBodyBytes = options.maxRejectionBodyBytes ?? 65536;
+	if (!Number.isInteger(maxRejectionBodyBytes) || maxRejectionBodyBytes <= 0) throw new TypeError("WebSocket maxRejectionBodyBytes must be a positive integer.");
 	const webSockets = new WebSocketServer({
 		noServer: true,
 		maxPayload: options.maxPayload ?? 1048576,
@@ -191,7 +233,7 @@ function installWebSockets(server, app, options = {}, handlerOptions = {}) {
 				normalizedOrigin = void 0;
 			}
 			if (!normalizedOrigin || !allowedOrigins.includes(normalizedOrigin)) {
-				await rejectUpgrade(socket, new Response("Forbidden", { status: 403 }));
+				await rejectUpgrade(socket, new Response("Forbidden", { status: 403 }), maxRejectionBodyBytes);
 				return;
 			}
 			let marker;
@@ -205,7 +247,7 @@ function installWebSockets(server, app, options = {}, handlerOptions = {}) {
 				return marker;
 			} } });
 			if (!accepted || response !== accepted.response) {
-				await rejectUpgrade(socket, response);
+				await rejectUpgrade(socket, response, maxRejectionBodyBytes);
 				return;
 			}
 			webSockets.handleUpgrade(request, socket, head, (webSocket) => {
@@ -222,7 +264,8 @@ function installWebSockets(server, app, options = {}, handlerOptions = {}) {
 //#endregion
 //#region src/listen.ts
 function listen(app, options = {}) {
-	const handlerOptions = { allowedHosts: [options.host ?? "127.0.0.1", "localhost"] };
+	const host = resolveBindHost(options);
+	const handlerOptions = { allowedHosts: [host, "localhost"] };
 	const server = createServer(createNodeHandler(app, handlerOptions));
 	if (options.requestTimeout !== void 0) server.requestTimeout = options.requestTimeout;
 	if (options.headersTimeout !== void 0) server.headersTimeout = options.headersTimeout;
@@ -244,7 +287,7 @@ function listen(app, options = {}) {
 			reject(error);
 		};
 		server.once("error", onError);
-		server.listen(options.port ?? 0, options.host, options.backlog, () => {
+		server.listen(options.port ?? 0, host, options.backlog, () => {
 			server.off("error", onError);
 			resolve(server);
 		});
@@ -270,9 +313,14 @@ const mimeTypes = {
 function isAssetPath(pathname) {
 	return extname(pathname) !== "";
 }
+function isWithinRoot(root, candidate) {
+	const prefix = root.endsWith(sep) ? root : `${root}${sep}`;
+	return candidate === root || candidate.startsWith(prefix);
+}
 async function serve(app, options = {}) {
-	const root = options.assets ? resolve(options.assets.root) : void 0;
-	const handlerOptions = { allowedHosts: [options.host ?? "127.0.0.1", "localhost"] };
+	const host = resolveBindHost(options);
+	const root = options.assets ? await realpath(resolve(options.assets.root)) : void 0;
+	const handlerOptions = { allowedHosts: [host, "localhost"] };
 	const applicationHandler = createNodeHandler({ async fetch(request, dispatchOptions) {
 		const result = await app.fetch(request, dispatchOptions);
 		if (!result.headers.has("cache-control") && result.headers.get("content-type")?.includes("text/html")) {
@@ -289,7 +337,7 @@ async function serve(app, options = {}) {
 	const server = createServer(async (request, response) => {
 		let pathname;
 		try {
-			pathname = decodeURIComponent(new URL(request.url ?? "/", "http://askr.local").pathname);
+			pathname = decodeURIComponent(resolveNodeRequestUrl(request, handlerOptions).pathname);
 		} catch {
 			response.writeHead(400, { "content-type": "text/plain; charset=utf-8" }).end("Bad Request");
 			return;
@@ -297,15 +345,21 @@ async function serve(app, options = {}) {
 		const method = request.method ?? "GET";
 		if (root && (method === "GET" || method === "HEAD") && isAssetPath(pathname)) {
 			const extension = extname(pathname).toLowerCase();
-			const candidate = resolve(root, `.${pathname}`);
-			const inside = candidate.startsWith(`${root}${sep}`);
+			const unresolvedCandidate = resolve(root, `.${pathname}`);
+			const inside = isWithinRoot(root, unresolvedCandidate);
+			let candidate;
 			let file;
 			if (inside && extension !== ".map") try {
-				file = await stat(candidate);
+				const resolvedCandidate = await realpath(unresolvedCandidate);
+				if (isWithinRoot(root, resolvedCandidate)) {
+					candidate = resolvedCandidate;
+					file = await stat(candidate);
+				}
 			} catch {
+				candidate = void 0;
 				file = void 0;
 			}
-			if (!file?.isFile()) {
+			if (!candidate || !file?.isFile()) {
 				response.writeHead(404, {
 					"content-type": "text/plain; charset=utf-8",
 					"x-content-type-options": "nosniff"
@@ -354,7 +408,7 @@ async function serve(app, options = {}) {
 	for (const signal of signals) process.once(signal, shutdown);
 	await new Promise((resolveListen, rejectListen) => {
 		server.once("error", rejectListen);
-		server.listen(options.port ?? 0, options.host ?? "127.0.0.1", options.backlog, () => {
+		server.listen(options.port ?? 0, host, options.backlog, () => {
 			server.removeListener("error", rejectListen);
 			resolveListen();
 		});
@@ -367,10 +421,9 @@ async function serve(app, options = {}) {
 		await close();
 		throw new Error("serve requires a TCP address.");
 	}
-	const host = options.host ?? "127.0.0.1";
 	return Object.freeze({
 		server,
-		url: `http://${host}:${address.port}`,
+		url: `http://${formatHostForUrl(host)}:${address.port}`,
 		close
 	});
 }

package/dist/mcp.js

@@ -1,4 +1,3 @@
-import { createInterface } from "node:readline";
 //#region src/mcp.ts
 const anonymous = Object.freeze({
 	authenticated: false,
@@ -10,11 +9,6 @@ function connectMcpStdio(mcp, options) {
 	const input = options.input ?? process.stdin;
 	const output = options.output ?? process.stdout;
 	const diagnostics = options.diagnostics ?? process.stderr;
-	const lines = createInterface({
-		input,
-		crlfDelay: Infinity,
-		terminal: false
-	});
 	const controllers = /* @__PURE__ */ new Map();
 	const sessionId = crypto.randomUUID();
 	let finish;
@@ -27,13 +21,14 @@ function connectMcpStdio(mcp, options) {
 	if (!Number.isInteger(maxLineBytes) || maxLineBytes <= 0) throw new TypeError("MCP maxLineBytes must be a positive integer.");
 	if (!Number.isInteger(maxConcurrency) || maxConcurrency <= 0) throw new TypeError("MCP maxConcurrency must be a positive integer.");
 	let active = 0;
+	let cleanupInput = () => void 0;
 	const write = (message) => new Promise((resolve, reject) => {
 		output.write(`${JSON.stringify(message)}\n`, (error) => error ? reject(error) : resolve());
 	});
 	const close = async () => {
 		if (ended) return closed;
 		ended = true;
-		lines.close();
+		cleanupInput();
 		for (const controller of controllers.values()) controller.abort();
 		controllers.clear();
 		mcp.terminateSession(sessionId);
@@ -41,18 +36,7 @@ function connectMcpStdio(mcp, options) {
 		return closed;
 	};
 	options.signal?.addEventListener("abort", () => void close(), { once: true });
-	lines.on("line", (line) => {
-		if (Buffer.byteLength(line) > maxLineBytes) {
-			write({
-				jsonrpc: "2.0",
-				id: null,
-				error: {
-					code: -32600,
-					message: "Request line exceeds the configured limit"
-				}
-			}).catch(() => void close());
-			return;
-		}
+	const handleLine = (line) => {
 		if (active >= maxConcurrency) {
 			write({
 				jsonrpc: "2.0",
@@ -109,13 +93,63 @@ function connectMcpStdio(mcp, options) {
 		})().catch((error) => diagnostics.write(`MCP stdio error: ${error instanceof Error ? error.message : String(error)}\n`)).finally(() => {
 			active -= 1;
 		});
-	});
-	lines.once("close", () => {
+	};
+	const lineBuffer = Buffer.allocUnsafe(maxLineBytes);
+	let lineBytes = 0;
+	let discardingOversizedLine = false;
+	const rejectOversizedLine = () => {
+		write({
+			jsonrpc: "2.0",
+			id: null,
+			error: {
+				code: -32600,
+				message: "Request line exceeds the configured limit"
+			}
+		}).catch(() => void close());
+	};
+	const onData = (chunk) => {
+		const bytes = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk);
+		let offset = 0;
+		while (offset < bytes.byteLength) {
+			const newline = bytes.indexOf(10, offset);
+			const end = newline < 0 ? bytes.byteLength : newline;
+			const segmentBytes = end - offset;
+			if (!discardingOversizedLine) {
+				if (lineBytes + segmentBytes > maxLineBytes) {
+					discardingOversizedLine = true;
+					lineBytes = 0;
+					rejectOversizedLine();
+				} else if (segmentBytes > 0) {
+					bytes.copy(lineBuffer, lineBytes, offset, end);
+					lineBytes += segmentBytes;
+				}
+			}
+			if (newline < 0) break;
+			if (!discardingOversizedLine) {
+				const length = lineBytes > 0 && lineBuffer[lineBytes - 1] === 13 ? lineBytes - 1 : lineBytes;
+				handleLine(lineBuffer.subarray(0, length).toString("utf8"));
+			}
+			lineBytes = 0;
+			discardingOversizedLine = false;
+			offset = newline + 1;
+		}
+	};
+	const finishInput = () => {
 		if (!ended) {
+			if (!discardingOversizedLine && lineBytes > 0) handleLine(lineBuffer.subarray(0, lineBytes).toString("utf8"));
 			ended = true;
+			cleanupInput();
 			finish();
 		}
-	});
+	};
+	input.on("data", onData);
+	input.once("end", finishInput);
+	input.once("close", finishInput);
+	cleanupInput = () => {
+		input.off("data", onData);
+		input.off("end", finishInput);
+		input.off("close", finishInput);
+	};
 	return {
 		closed,
 		close

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@askrjs/node",
-  "version": "0.0.6",
+  "version": "0.0.7",
   "description": "Node http adapter for @askrjs/server",
   "keywords": [
     "askr",