@byoky/openclaw-plugin 0.3.0 → 0.4.0

package/dist/index.js

@@ -293,17 +293,7 @@ async function startCallbackServer(ctx, requestProviderId) {
   return new Promise((resolve) => {
     let resolved = false;
     const server = createServer((req, res) => {
-      const reqOrigin = req.headers.origin || "";
-      let isLocalhost = false;
-      try {
-        const parsed = new URL(reqOrigin);
-        isLocalhost = parsed.hostname === "127.0.0.1" || parsed.hostname === "localhost";
-      } catch {
-      }
-      res.setHeader(
-        "Access-Control-Allow-Origin",
-        isLocalhost ? reqOrigin : "http://127.0.0.1"
-      );
+      res.setHeader("Access-Control-Allow-Origin", "http://127.0.0.1");
       res.setHeader("Access-Control-Allow-Methods", "POST, OPTIONS");
       res.setHeader("Access-Control-Allow-Headers", "Content-Type");
       if (req.method === "OPTIONS") {
@@ -312,11 +302,22 @@ async function startCallbackServer(ctx, requestProviderId) {
         return;
       }
       if (req.method === "POST" && req.url === "/callback") {
+        const MAX_BODY_SIZE = 1048576;
         let body = "";
+        let oversized = false;
         req.on("data", (chunk) => {
           body += chunk.toString();
+          if (body.length > MAX_BODY_SIZE) {
+            oversized = true;
+            req.destroy();
+          }
         });
         req.on("end", () => {
+          if (oversized) {
+            res.writeHead(413);
+            res.end("Request body too large");
+            return;
+          }
           try {
             const data = JSON.parse(body);
             res.writeHead(200, { "Content-Type": "application/json" });
@@ -324,8 +325,8 @@ async function startCallbackServer(ctx, requestProviderId) {
             if (!resolved) {
               resolved = true;
               resolve({
-                providers: data.providers || [],
-                port: data.bridgePort || DEFAULT_BRIDGE_PORT,
+                providers: Array.isArray(data.providers) ? data.providers : [],
+                port: typeof data.bridgePort === "number" ? data.bridgePort : DEFAULT_BRIDGE_PORT,
                 server
               });
             }
@@ -429,7 +430,7 @@ function buildAuthPage(requestProviderId) {
           id: requestId,
           requestId,
           payload: { providers: ${providerFilter} },
-        }, '*');
+        }, window.location.origin);
 
         const response = await new Promise((resolve, reject) => {
           function handler(event) {
@@ -461,7 +462,7 @@ function buildAuthPage(requestProviderId) {
           requestId: bridgeRequestId,
           action: 'startBridgeProxy',
           payload: { sessionKey: response.sessionKey, port: ${DEFAULT_BRIDGE_PORT} },
-        }, '*');
+        }, window.location.origin);
 
         const bridgeResult = await new Promise((resolve, reject) => {
           function handler(event) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@byoky/openclaw-plugin",
-  "version": "0.3.0",
+  "version": "0.4.0",
   "description": "Byoky wallet provider plugin for OpenClaw — manage AI API keys from your browser wallet",
   "type": "module",
   "main": "dist/index.js",
@@ -10,6 +10,10 @@
     "openclaw.plugin.json",
     "auth-page"
   ],
+  "scripts": {
+    "build": "tsup",
+    "dev": "tsup --watch"
+  },
   "openclaw": {
     "extensions": [
       "./dist/index.js"
@@ -34,9 +38,5 @@
     "openclaw": "^2026.3.13",
     "tsup": "^8.0.0",
     "typescript": "^5.5.0"
-  },
-  "scripts": {
-    "build": "tsup",
-    "dev": "tsup --watch"
   }
-}
+}

package/LICENSE

@@ -1,21 +0,0 @@
-MIT License
-
-Copyright (c) 2026 byoky contributors
-
-Permission is hereby granted, free of charge, to any person obtaining a copy
-of this software and associated documentation files (the "Software"), to deal
-in the Software without restriction, including without limitation the rights
-to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-copies of the Software, and to permit persons to whom the Software is
-furnished to do so, subject to the following conditions:
-
-The above copyright notice and this permission notice shall be included in all
-copies or substantial portions of the Software.
-
-THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
-SOFTWARE.