@businessmaps/bifrost 0.0.2 → 0.1.2

package/README.md

@@ -5,7 +5,9 @@
 
 MCP server that lets AI tools call functions running in your browser.
 
-The daemon sits between any MCP client and your browser tab. It speaks JSON-RPC over stdio on one side and WebSocket on the other. Your browser app connects, registers tools, and the AI can call them. No dependencies, just Node 18+.
+The daemon sits between any MCP client and your browser tab. It speaks JSON-RPC over stdio on one side and WebSocket on the other. Your browser app connects, registers tools, and the AI can call them.
+
+**Requirements:** Node.js 18+ · [`ws`](https://github.com/websockets/ws) (installed automatically)
 
 ## Install
 
@@ -13,18 +15,14 @@ The daemon sits between any MCP client and your browser tab. It speaks JSON-RPC
 npm i -g @businessmaps/bifrost
 ```
 
-or without npm
-
-```bash
-curl -fsSL https://raw.githubusercontent.com/Business-Maps/mcp/main/install.sh | sh
-```
-
 Then register it with your MCP client. For example:
 
 ```bash
-claude mcp add --transport stdio bifrost -- bifrost
+claude mcp add --transport stdio bifrost -- bifrost --no-auth
 ```
 
+> **Note:** The `--no-auth` flag is currently recommended because there is an unresolved issue with token authentication when MCP clients launch the daemon. Without it the client has no way to read the token printed to stderr.
+
 The MCP client starts the daemon automatically.
 
 ## Usage
@@ -91,7 +89,8 @@ Each tab registers its own tools. Calls route to whoever owns the tool. Disconne
 
 ```bash
 git clone https://github.com/Business-Maps/mcp.git && cd mcp
-npm test  # no install needed, no deps
+npm install
+npm test
 ```
 
 [Architecture](docs/architecture.md) · [Client API](docs/client-api.md) · [Contributing](CONTRIBUTING.md)

package/bin/bifrost

@@ -83,7 +83,7 @@ function printBanner(version) {
     `${c.bold}${c.RED}  ██████╔╝██║██║     ██║  ██║╚██████╔╝███████║   ██║   ${c.r}`,
     `${c.bold}${c.RED}  ╚═════╝ ╚═╝╚═╝     ╚═╝  ╚═╝ ╚═════╝ ╚══════╝   ╚═╝   ${c.r}`,
     "",
-    `${c.dim}${c.red}  ── SECURE BRIDGE PROTOCOL ──────────────── v${version} ──${c.r}`,
+    `${c.dim}${c.red}  ---------------------------------------- v${version} --${c.r}`,
     "",
     "",
     "",
@@ -111,7 +111,7 @@ function printBanner(version) {
 // ---------------------------------------------------------------------------
 function printHelp() {
   log("");
-  log(`  ${c.bold}${c.RED}BIFROST${c.r} ${c.dim}${c.red}── SECURE BRIDGE PROTOCOL${c.r}`);
+  log(`  ${c.bold}${c.RED}BIFROST${c.r} ${c.dim}${c.red}----------------------${c.r}`);
   log("");
   log(`  ${c.dim}MCP browser bridge daemon${c.r}`);
   log("");
@@ -125,7 +125,7 @@ function printHelp() {
   log(`    ${c.RED}--help${c.r}, ${c.RED}-h${c.r}           Show this message`);
   log(`    ${c.RED}--version${c.r}, ${c.RED}-v${c.r}        Show version`);
   log("");
-  log(`  ${c.dim}${c.red}────────────────────────────────────────────────────${c.r}`);
+  log(`  ${c.dim}${c.red}----------------------------------------------------${c.r}`);
   log("");
 }
 
@@ -356,7 +356,7 @@ const wss = new MiniWebSocketServer({ port: PORT }, () => {
 wss.on("connection", (ws, req) => {
   // Origin check — allow any localhost origin (any port)
   if (!isLocalOrigin(req.headers.origin)) {
-    ws.close();
+    ws.terminate();
     return;
   }
 
@@ -366,7 +366,7 @@ wss.on("connection", (ws, req) => {
     const queryToken = url.searchParams.get("token");
     const headerToken = req.headers["sec-websocket-protocol"];
     if (queryToken !== AUTH_TOKEN && headerToken !== AUTH_TOKEN) {
-      ws.close();
+      ws.terminate();
       return;
     }
   }

package/lib/websocket.js

@@ -1,274 +1,63 @@
 // ============================================================================
-// Hardened Minimal WebSocket server (RFC 6455 compliant core)
-// Zero dependencies
+// WebSocket server — thin wrapper around 'ws' for API compatibility
 // ============================================================================
 
 import { createServer } from "http";
-import { createHash } from "crypto";
 import { EventEmitter } from "events";
-
-const GUID = "258EAFA5-E914-47DA-95CA-5AB5DC65C97B";
-
-const MAX_PAYLOAD_SIZE = 100 * 1024 * 1024; // 100MB
-const MAX_BUFFER_SIZE = 200 * 1024 * 1024;  // 200MB total buffered
+import { WebSocketServer, WebSocket } from "ws";
 
 // ---------------------------------------------------------------------------
-// MiniWebSocket
+// MiniWebSocket — wraps a ws.WebSocket with the same API the daemon expects
 // ---------------------------------------------------------------------------
 export class MiniWebSocket extends EventEmitter {
-  constructor(socket) {
+  constructor(ws) {
     super();
-    this.socket = socket;
+    this._ws = ws;
     this.readyState = 1;
 
-    this._buffer = Buffer.alloc(0);
-
-    // fragmentation state
-    this._fragType = null;
-    this._fragBuffer = [];
-
-    socket.on("data", (c) => this._onData(c));
-    socket.on("close", () => this._handleClose());
-    socket.on("end", () => this._handleClose());
-    socket.on("error", (err) => {
-      this._handleClose();
-      this.emit("error", err);
+    ws.on("message", (data) => {
+      const text = typeof data === "string" ? data : data.toString();
+      this.emit("message", text);
     });
-  }
-
-  // -------------------------------------------------------------------------
-  // Public API
-  // -------------------------------------------------------------------------
-  send(data) {
-    if (this.readyState !== 1) return;
-
-    const payload = Buffer.isBuffer(data)
-      ? data
-      : Buffer.from(String(data));
-
-    this._writeFrame(0x1, payload);
-  }
-
-  close(code = 1000) {
-    if (this.readyState !== 1) return;
-    this.readyState = 2;
-
-    const buf = Buffer.alloc(2);
-    buf.writeUInt16BE(code, 0);
-
-    this._writeFrame(0x8, buf);
-    this.socket.end();
-  }
-
-  // -------------------------------------------------------------------------
-  // Core frame processing
-  // -------------------------------------------------------------------------
-  _onData(chunk) {
-    this._buffer = Buffer.concat([this._buffer, chunk]);
-
-    if (this._buffer.length > MAX_BUFFER_SIZE) {
-      this._fail(1009, "buffer overflow");
-      return;
-    }
-
-    while (true) {
-      const frame = this._decodeFrame(this._buffer);
-      if (!frame) break;
-
-      if (frame.error) {
-        this._fail(frame.code || 1002, frame.error);
-        return;
-      }
-
-      this._buffer = this._buffer.subarray(frame.totalLength);
-      this._handleFrame(frame);
-    }
-  }
-
-  _handleFrame(f) {
-    const { opcode, payload, fin } = f;
-
-    // control frames
-    if (opcode === 0x8) {
-      // close
-      this.close();
-      return;
-    }
-
-    if (opcode === 0x9) {
-      // ping → pong
-      this._writeFrame(0xA, payload);
-      return;
-    }
-
-    if (opcode === 0xA) {
-      this.emit("pong");
-      return;
-    }
 
-    // fragmentation handling
-    if (opcode === 0x0) {
-      if (!this._fragType) return this._fail(1002, "unexpected continuation");
-
-      this._fragBuffer.push(payload);
-
-      if (fin) {
-        const full = Buffer.concat(this._fragBuffer);
-        this._emitMessage(this._fragType, full);
-        this._fragType = null;
-        this._fragBuffer = [];
-      }
-      return;
-    }
-
-    if (opcode === 0x1 || opcode === 0x2) {
-      if (this._fragType) return this._fail(1002, "nested fragments");
+    ws.on("close", () => {
+      if (this.readyState === 3) return;
+      this.readyState = 3;
+      this.emit("close");
+    });
 
-      if (!fin) {
-        this._fragType = opcode;
-        this._fragBuffer = [payload];
-        return;
+    ws.on("error", (err) => {
+      if (this.readyState !== 3) {
+        this.readyState = 3;
+        this.emit("close");
       }
+      this.emit("error", err);
+    });
 
-      this._emitMessage(opcode, payload);
-      return;
-    }
-
-    this._fail(1002, "invalid opcode");
-  }
-
-  _emitMessage(opcode, payload) {
-    if (opcode === 0x1) {
-      // text
-      try {
-        const text = new TextDecoder("utf-8", { fatal: true }).decode(payload);
-        this.emit("message", text);
-      } catch {
-        this._fail(1007, "invalid utf8");
-      }
-    } else {
-      // binary
-      this.emit("message", payload);
-    }
+    ws.on("pong", () => this.emit("pong"));
   }
 
-  // -------------------------------------------------------------------------
-  // Frame decode (STRICT)
-  // -------------------------------------------------------------------------
-  _decodeFrame(buf) {
-    if (buf.length < 2) return null;
-
-    const b0 = buf[0];
-    const b1 = buf[1];
-
-    const fin = (b0 & 0x80) !== 0;
-    const opcode = b0 & 0x0f;
-
-    const masked = (b1 & 0x80) !== 0;
-    let payloadLen = b1 & 0x7f;
-
-    // MUST be masked (client → server)
-    if (!masked) return { error: "unmasked frame", code: 1002 };
-
-    // opcode validation
-    const valid = [0x0, 0x1, 0x2, 0x8, 0x9, 0xA];
-    if (!valid.includes(opcode)) {
-      return { error: "invalid opcode", code: 1002 };
-    }
-
-    let offset = 2;
-
-    if (payloadLen === 126) {
-      if (buf.length < 4) return null;
-      payloadLen = buf.readUInt16BE(2);
-      offset = 4;
-    } else if (payloadLen === 127) {
-      if (buf.length < 10) return null;
-      const big = buf.readBigUInt64BE(2);
-      if (big > BigInt(MAX_PAYLOAD_SIZE)) {
-        return { error: "too large", code: 1009 };
-      }
-      payloadLen = Number(big);
-      offset = 10;
-    }
-
-    if (payloadLen > MAX_PAYLOAD_SIZE) {
-      return { error: "too large", code: 1009 };
-    }
-
-    // control frames rules
-    if (opcode >= 0x8) {
-      if (!fin) return { error: "fragmented control", code: 1002 };
-      if (payloadLen > 125) return { error: "control too large", code: 1002 };
-    }
-
-    const total = offset + 4 + payloadLen;
-    if (buf.length < total) return null;
-
-    const mask = buf.subarray(offset, offset + 4);
-    const payload = Buffer.alloc(payloadLen);
-
-    for (let i = 0; i < payloadLen; i++) {
-      payload[i] = buf[offset + 4 + i] ^ mask[i % 4];
-    }
+  get socket() { return this._ws._socket || null; }
+  get bufferedAmount() { return this._ws.bufferedAmount; }
 
-    return {
-      fin,
-      opcode,
-      payload,
-      totalLength: total,
-    };
+  send(data) {
+    if (this._ws.readyState !== WebSocket.OPEN) return;
+    this._ws.send(typeof data === "string" ? data : String(data));
   }
 
-  // -------------------------------------------------------------------------
-  // Frame encode
-  // -------------------------------------------------------------------------
-  _writeFrame(opcode, payload) {
-    if (this.readyState !== 1) return;
-
-    const len = payload.length;
-    let header;
-
-    if (len < 126) {
-      header = Buffer.alloc(2);
-      header[1] = len;
-    } else if (len < 65536) {
-      header = Buffer.alloc(4);
-      header[1] = 126;
-      header.writeUInt16BE(len, 2);
-    } else {
-      header = Buffer.alloc(10);
-      header[1] = 127;
-      header.writeBigUInt64BE(BigInt(len), 2);
-    }
-
-    header[0] = 0x80 | opcode;
-
-    const frame = Buffer.concat([header, payload]);
-
-    if (!this.socket.write(frame)) {
-      this.socket.once("drain", () => {});
+  close(code = 1000) {
+    if (this._ws.readyState === WebSocket.OPEN || this._ws.readyState === WebSocket.CONNECTING) {
+      this._ws.close(code);
     }
   }
 
-  _fail(code, reason) {
-    try {
-      const buf = Buffer.alloc(2);
-      buf.writeUInt16BE(code, 0);
-      this._writeFrame(0x8, buf);
-    } catch {}
-    this.socket.destroy();
-  }
-
-  _handleClose() {
-    if (this.readyState === 3) return;
-    this.readyState = 3;
-    this.emit("close");
+  terminate() {
+    this._ws.terminate();
   }
 }
 
 // ---------------------------------------------------------------------------
-// Server
+// MiniWebSocketServer — wraps ws.WebSocketServer, emits MiniWebSocket
 // ---------------------------------------------------------------------------
 export class MiniWebSocketServer extends EventEmitter {
   constructor({ port }, cb) {
@@ -279,51 +68,20 @@ export class MiniWebSocketServer extends EventEmitter {
       res.end("Upgrade required");
     });
 
-    this.server.on("upgrade", (req, socket, head) => {
-      // strict handshake validation
-      if (
-        req.headers["upgrade"]?.toLowerCase() !== "websocket" ||
-        !req.headers["connection"]?.toLowerCase().includes("upgrade") ||
-        req.headers["sec-websocket-version"] !== "13"
-      ) {
-        socket.destroy();
-        return;
-      }
-
-      const key = req.headers["sec-websocket-key"];
-      if (!key) {
-        socket.destroy();
-        return;
-      }
-
-      const accept = createHash("sha1")
-        .update(key + GUID)
-        .digest("base64");
-
-      // subprotocol (used for auth in your daemon)
-      const protocol = req.headers["sec-websocket-protocol"];
-
-      socket.setNoDelay(true);
-      socket.setTimeout(0);
-
-      socket.write(
-        "HTTP/1.1 101 Switching Protocols\r\n" +
-        "Upgrade: websocket\r\n" +
-        "Connection: Upgrade\r\n" +
-        `Sec-WebSocket-Accept: ${accept}\r\n` +
-        (protocol ? `Sec-WebSocket-Protocol: ${protocol}\r\n` : "") +
-        "\r\n"
-      );
-
-      if (head?.length) socket.unshift(head);
+    this._wss = new WebSocketServer({
+      server: this.server,
+      perMessageDeflate: false,
+    });
 
-      this.emit("connection", new MiniWebSocket(socket), req);
+    this._wss.on("connection", (ws, req) => {
+      this.emit("connection", new MiniWebSocket(ws), req);
     });
 
     this.server.listen(port, "127.0.0.1", cb);
   }
 
   close(cb) {
+    this._wss.close();
     this.server.close(cb);
   }
-}
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@businessmaps/bifrost",
-  "version": "0.0.2",
+  "version": "0.1.2",
   "description": "Bridge any browser web app to Claude Code via MCP",
   "type": "module",
   "bin": {
@@ -35,5 +35,8 @@
     "lib/",
     "LICENSE",
     "README.md"
-  ]
+  ],
+  "dependencies": {
+    "ws": "^8.20.0"
+  }
 }