@batalabs/virlow-mcp-core 3.68.0 → 3.69.1

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (5) hide show
  1. package/dist/http/local-origin.d.ts +7 -2
  2. package/dist/http/local-origin.d.ts.map +1 -1
  3. package/dist/http/local-origin.js +8 -3
  4. package/dist/http/local-origin.js.map +1 -1
  5. package/package.json +3 -3
package/dist/http/local-origin.d.ts CHANGED
@@ -52,8 +52,13 @@ export declare function rejectReason(headers: {
52
52
  *
53
53
  * The unlock page is a credential form, so it must not be framable and must not
54
54
  * be cached: its URL carries the one-time nonce, and a cached copy of the page
55
- * or its POST response outlives the server that issued it. `no-referrer` keeps
56
- * that nonce out of a Referer header. The CSP allows the inline <style> the
55
+ * or its POST response outlives the server that issued it. `same-origin` keeps
56
+ * that nonce out of any Referer sent to another site.
57
+ *
58
+ * Not `no-referrer`, which this was: under it a browser submits the page's own
59
+ * form with `Origin: null`, rejectReason refuses a null Origin as cross-site,
60
+ * and every unlock ended in Forbidden. `same-origin` sends the real loopback
61
+ * Origin on the form's POST back to this server and nothing anywhere else. The CSP allows the inline <style> the
57
62
  * form uses and nothing else — no script of any kind, so a gap in the error
58
63
  * escaping cannot become execution.
59
64
  */
package/dist/http/local-origin.d.ts.map CHANGED
@@ -1 +1 @@
1
- {"version":3,"file":"local-origin.d.ts","sourceRoot":"","sources":["../../src/http/local-origin.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAUH;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,UAAU,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,CAGtE;AAED;;;;;;;;GAQG;AACH,wBAAgB,eAAe,CAAC,YAAY,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,CAQzE;AAED;;;;;GAKG;AACH,wBAAgB,YAAY,CAC1B,OAAO,EAAE;IAAE,IAAI,CAAC,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,EAC3C,OAAO,EAAE,OAAO,GACf,MAAM,GAAG,IAAI,CAKf;AAED;;;;;;;;;GASG;AACH,eAAO,MAAM,gBAAgB,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAO5D,CAAC"}
1
+ {"version":3,"file":"local-origin.d.ts","sourceRoot":"","sources":["../../src/http/local-origin.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAUH;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,UAAU,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,CAGtE;AAED;;;;;;;;GAQG;AACH,wBAAgB,eAAe,CAAC,YAAY,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,CAQzE;AAED;;;;;GAKG;AACH,wBAAgB,YAAY,CAC1B,OAAO,EAAE;IAAE,IAAI,CAAC,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,EAC3C,OAAO,EAAE,OAAO,GACf,MAAM,GAAG,IAAI,CAKf;AAED;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,gBAAgB,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAO5D,CAAC"}
package/dist/http/local-origin.js CHANGED
@@ -77,8 +77,13 @@ export function rejectReason(headers, enforce) {
77
77
  *
78
78
  * The unlock page is a credential form, so it must not be framable and must not
79
79
  * be cached: its URL carries the one-time nonce, and a cached copy of the page
80
- * or its POST response outlives the server that issued it. `no-referrer` keeps
81
- * that nonce out of a Referer header. The CSP allows the inline <style> the
80
+ * or its POST response outlives the server that issued it. `same-origin` keeps
81
+ * that nonce out of any Referer sent to another site.
82
+ *
83
+ * Not `no-referrer`, which this was: under it a browser submits the page's own
84
+ * form with `Origin: null`, rejectReason refuses a null Origin as cross-site,
85
+ * and every unlock ended in Forbidden. `same-origin` sends the real loopback
86
+ * Origin on the form's POST back to this server and nothing anywhere else. The CSP allows the inline <style> the
82
87
  * form uses and nothing else — no script of any kind, so a gap in the error
83
88
  * escaping cannot become execution.
84
89
  */
@@ -86,7 +91,7 @@ export const SECURITY_HEADERS = Object.freeze({
86
91
  'content-security-policy': "default-src 'none'; style-src 'unsafe-inline'; form-action 'self'; frame-ancestors 'none'; base-uri 'none'",
87
92
  'x-frame-options': 'DENY',
88
93
  'x-content-type-options': 'nosniff',
89
- 'referrer-policy': 'no-referrer',
94
+ 'referrer-policy': 'same-origin',
90
95
  'cache-control': 'no-store',
91
96
  });
92
97
  //# sourceMappingURL=local-origin.js.map
package/dist/http/local-origin.js.map CHANGED
@@ -1 +1 @@
1
- {"version":3,"file":"local-origin.js","sourceRoot":"","sources":["../../src/http/local-origin.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,oEAAoE;AACpE,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC,CAAC,WAAW,EAAE,WAAW,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC;AAE3E,4EAA4E;AAC5E,SAAS,WAAW,CAAC,IAAY;IAC/B,OAAO,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;AACjD,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,cAAc,CAAC,UAA8B;IAC3D,IAAI,UAAU,KAAK,SAAS,IAAI,UAAU,KAAK,EAAE;QAAE,OAAO,KAAK,CAAC;IAChE,OAAO,cAAc,CAAC,GAAG,CAAC,WAAW,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;AAC5D,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,eAAe,CAAC,YAAgC;IAC9D,IAAI,YAAY,KAAK,SAAS,IAAI,YAAY,KAAK,EAAE;QAAE,OAAO,IAAI,CAAC;IACnE,IAAI,CAAC;QACH,OAAO,cAAc,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,YAAY,CAAC,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC,CAAC;IAC1E,CAAC;IAAC,MAAM,CAAC;QACP,6CAA6C;QAC7C,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,YAAY,CAC1B,OAA2C,EAC3C,OAAgB;IAEhB,IAAI,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC;IAC1B,IAAI,CAAC,cAAc,CAAC,OAAO,CAAC,IAAI,CAAC;QAAE,OAAO,mBAAmB,CAAC;IAC9D,IAAI,CAAC,eAAe,CAAC,OAAO,CAAC,MAAM,CAAC;QAAE,OAAO,mBAAmB,CAAC;IACjE,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAqC,MAAM,CAAC,MAAM,CAAC;IAC9E,yBAAyB,EACvB,4GAA4G;IAC9G,iBAAiB,EAAE,MAAM;IACzB,wBAAwB,EAAE,SAAS;IACnC,iBAAiB,EAAE,aAAa;IAChC,eAAe,EAAE,UAAU;CAC5B,CAAC,CAAC"}
1
+ {"version":3,"file":"local-origin.js","sourceRoot":"","sources":["../../src/http/local-origin.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,oEAAoE;AACpE,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC,CAAC,WAAW,EAAE,WAAW,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC;AAE3E,4EAA4E;AAC5E,SAAS,WAAW,CAAC,IAAY;IAC/B,OAAO,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;AACjD,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,cAAc,CAAC,UAA8B;IAC3D,IAAI,UAAU,KAAK,SAAS,IAAI,UAAU,KAAK,EAAE;QAAE,OAAO,KAAK,CAAC;IAChE,OAAO,cAAc,CAAC,GAAG,CAAC,WAAW,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;AAC5D,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,eAAe,CAAC,YAAgC;IAC9D,IAAI,YAAY,KAAK,SAAS,IAAI,YAAY,KAAK,EAAE;QAAE,OAAO,IAAI,CAAC;IACnE,IAAI,CAAC;QACH,OAAO,cAAc,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,YAAY,CAAC,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC,CAAC;IAC1E,CAAC;IAAC,MAAM,CAAC;QACP,6CAA6C;QAC7C,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,YAAY,CAC1B,OAA2C,EAC3C,OAAgB;IAEhB,IAAI,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC;IAC1B,IAAI,CAAC,cAAc,CAAC,OAAO,CAAC,IAAI,CAAC;QAAE,OAAO,mBAAmB,CAAC;IAC9D,IAAI,CAAC,eAAe,CAAC,OAAO,CAAC,MAAM,CAAC;QAAE,OAAO,mBAAmB,CAAC;IACjE,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAqC,MAAM,CAAC,MAAM,CAAC;IAC9E,yBAAyB,EACvB,4GAA4G;IAC9G,iBAAiB,EAAE,MAAM;IACzB,wBAAwB,EAAE,SAAS;IACnC,iBAAiB,EAAE,aAAa;IAChC,eAAe,EAAE,UAAU;CAC5B,CAAC,CAAC"}
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "@batalabs/virlow-mcp-core",
3
- "version": "3.68.0",
3
+ "version": "3.69.1",
4
4
  "type": "module",
5
5
  "description": "Virlow MCP connector core: encrypted note and memory access, folder exposure, and the memories opt-in. Shared by the local virlow-mcp CLI and the hosted connector.",
6
6
  "license": "UNLICENSED",
@@ -48,8 +48,8 @@
48
48
  "@modelcontextprotocol/sdk": "^1.12.0",
49
49
  "yaml": ">=2.8.3 <3",
50
50
  "zod": "^3.24.0",
51
- "@batalabs/virlow-crypto": "3.68.0",
52
- "@batalabs/virlow-memory": "3.68.0"
51
+ "@batalabs/virlow-crypto": "3.69.1",
52
+ "@batalabs/virlow-memory": "3.69.1"
53
53
  },
54
54
  "devDependencies": {
55
55
  "@types/node": "^22.10.0",