@context-engine-bridge/context-engine-mcp-bridge 0.0.85 → 0.0.86

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@context-engine-bridge/context-engine-mcp-bridge",
-  "version": "0.0.85",
+  "version": "0.0.86",
   "description": "Context Engine MCP bridge (http/stdio proxy combining indexer + memory servers)",
   "bin": {
     "ctxce": "bin/ctxce.js",

package/src/mcpServer.js

@@ -13,7 +13,6 @@ import { StreamableHTTPClientTransport } from "@modelcontextprotocol/sdk/client/
 import { CallToolRequestSchema, ListToolsRequestSchema } from "@modelcontextprotocol/sdk/types.js";
 import {
   clearResolvedCollection,
-  loadAnyAuthEntry,
   loadAuthEntry,
   loadResolvedCollection,
   readConfig,
@@ -649,15 +648,8 @@ function resolveAuthBackendContext(indexerUrl, memoryUrl) {
     }
   }
 
-  try {
-    const any = loadAnyAuthEntry();
-    const stored = normalizeBackendUrl(any?.backendUrl || "");
-    if (stored) {
-      return { backendUrl: stored, source: "auth_entry" };
-    }
-  } catch {
-    // ignore auth config read failures
-  }
+  // Fail-closed: do NOT fall back to loadAnyAuthEntry() here.
+  // Borrowing a session from an unrelated backend is a cross-account leak.
   return { backendUrl: "", source: "" };
 }
 
@@ -1120,10 +1112,20 @@ async function createBridgeServer(options) {
   let sessionId = explicitSession;
 
   function sessionFromEntry(entry) {
-    if (!entry || typeof entry.sessionId !== "string" || !entry.sessionId) {
+    if (!entry || typeof entry !== "object") {
+      return "";
+    }
+    // Support both camelCase (sessionId/expiresAt) and snake_case (session_id/expires_at)
+    const sid = (typeof entry.sessionId === "string" && entry.sessionId)
+      ? entry.sessionId
+      : (typeof entry.session_id === "string" && entry.session_id)
+        ? entry.session_id
+        : "";
+    if (!sid) {
       return "";
     }
-    const expiresAt = entry.expiresAt;
+    const expiresAt = (typeof entry.expiresAt === "number") ? entry.expiresAt
+      : (typeof entry.expires_at === "number") ? entry.expires_at : undefined;
     if (
       typeof expiresAt === "number" &&
       Number.isFinite(expiresAt) &&
@@ -1136,9 +1138,9 @@ async function createBridgeServer(options) {
         return "";
       }
       debugLog("[ctxce] Session expired but within 5min grace period; using it (server will validate).");
-      return entry.sessionId;
+      return sid;
     }
-    return entry.sessionId;
+    return sid;
   }
 
   function findSavedSession(backends) {
@@ -1158,16 +1160,8 @@ async function createBridgeServer(options) {
         // ignore lookup failures
       }
     }
-    try {
-      const any = loadAnyAuthEntry();
-      const session = any ? sessionFromEntry(any.entry) : "";
-      if (session && any?.backendUrl) {
-        backendHint = any.backendUrl;
-        return session;
-      }
-    } catch {
-      // ignore lookup failures
-    }
+    // Fail-closed: do NOT fall back to loadAnyAuthEntry().
+    // Borrowing an unrelated account's session is a cross-account leak.
     return "";
   }