@gethelio/proxy 0.1.1 → 0.2.0

package/dist/cli.js

@@ -47,7 +47,8 @@ var upstreamSchema = z.object({
   args: z.array(z.string()).optional(),
   connect_timeout: durationSchema.default("10s"),
   request_timeout: durationSchema.default("30s"),
-  forward_headers: z.array(z.string().min(1)).default([])
+  forward_headers: z.array(z.string().min(1)).default([]),
+  headers: z.record(z.string(), z.string()).default({})
 }).refine((data) => data.transport !== "stdio" || data.command !== void 0, {
   message: '"command" is required when transport is "stdio"',
   path: ["command"]
@@ -61,6 +62,22 @@ var upstreamSchema = z.object({
       });
     }
   }
+  const reserved = /* @__PURE__ */ new Set([
+    "mcp-session-id",
+    "mcp-protocol-version",
+    "content-type",
+    "content-length",
+    "host"
+  ]);
+  for (const name of Object.keys(data.headers)) {
+    if (reserved.has(name.toLowerCase())) {
+      ctx.addIssue({
+        code: "custom",
+        path: ["headers", name],
+        message: `upstream.headers must not set reserved header "${name}"`
+      });
+    }
+  }
 });
 var listenSchema = z.object({
   port: z.number().int().min(1).max(65535).default(3e3),
@@ -1237,6 +1254,20 @@ function describeUnreachableUpstream(error, url) {
   );
 }
 
+// src/upstream/merge-headers.ts
+function mergeUpstreamHeaders(base, forwarded, staticHeaders) {
+  const out = {};
+  const apply = (headers) => {
+    for (const [name, value] of Object.entries(headers)) {
+      out[name.toLowerCase()] = value;
+    }
+  };
+  apply(base);
+  apply(forwarded);
+  apply(staticHeaders);
+  return out;
+}
+
 // src/upstream/forwarder.ts
 var UpstreamForwarder = class {
   url;
@@ -1248,13 +1279,14 @@ var UpstreamForwarder = class {
     this.requestTimeoutMs = options.requestTimeoutMs ?? 3e4;
   }
   async forward(request) {
-    const requestHeaders = request.headers ?? {};
-    const headers = {
-      "content-type": "application/json",
-      accept: "application/json, text/event-stream",
-      ...this.staticHeaders,
-      ...requestHeaders
-    };
+    const headers = mergeUpstreamHeaders(
+      {
+        "content-type": "application/json",
+        accept: "application/json, text/event-stream"
+      },
+      request.headers ?? {},
+      this.staticHeaders
+    );
     if (request.sessionId) {
       headers["mcp-session-id"] = request.sessionId;
     }
@@ -1460,12 +1492,11 @@ var SseUpstreamForwarder = class {
     };
     if (request.id !== void 0) body["id"] = request.id;
     if (request.params !== void 0) body["params"] = request.params;
-    const requestHeaders = request.headers ?? {};
-    const headers = {
-      "content-type": "application/json",
-      ...this.staticHeaders,
-      ...requestHeaders
-    };
+    const headers = mergeUpstreamHeaders(
+      { "content-type": "application/json" },
+      request.headers ?? {},
+      this.staticHeaders
+    );
     if (request.sessionId) {
       headers["mcp-session-id"] = request.sessionId;
     }
@@ -1777,6 +1808,40 @@ var StdioForwarder = class {
   }
 };
 
+// src/cli-forwarder.ts
+async function createForwarderFromConfig(config) {
+  switch (config.upstream.transport) {
+    case "streamable-http": {
+      return {
+        forwarder: new UpstreamForwarder({
+          url: config.upstream.url,
+          headers: config.upstream.headers,
+          requestTimeoutMs: parseDuration(config.upstream.request_timeout)
+        })
+      };
+    }
+    case "sse": {
+      const sse = new SseUpstreamForwarder({
+        url: config.upstream.url,
+        headers: config.upstream.headers,
+        connectTimeoutMs: parseDuration(config.upstream.connect_timeout),
+        requestTimeoutMs: parseDuration(config.upstream.request_timeout)
+      });
+      await sse.connect();
+      return { forwarder: sse, close: () => sse.close() };
+    }
+    case "stdio": {
+      const stdio = new StdioForwarder({
+        command: config.upstream.command,
+        args: config.upstream.args,
+        requestTimeoutMs: parseDuration(config.upstream.request_timeout)
+      });
+      await stdio.start();
+      return { forwarder: stdio, close: () => stdio.close() };
+    }
+  }
+}
+
 // src/policy/matchers.ts
 var ANNOTATION_DEFAULTS = {
   readOnlyHint: false,
@@ -5880,6 +5945,8 @@ upstream:
   url: "http://localhost:8080/mcp"
   # Transport: streamable-http (default), sse, or stdio
   transport: streamable-http
+#   headers:
+#     Authorization: "Bearer \${UPSTREAM_TOKEN}"
 
 # Operator dashboard + approval REST API. Bound to 127.0.0.1 by default \u2014 do
 # not change to 0.0.0.0 without putting an authenticating reverse proxy in
@@ -6027,43 +6094,7 @@ async function startCommand(configPath, options) {
     );
     process.exit(1);
   }
-  let forwarder;
-  let closeForwarder;
-  switch (config.upstream.transport) {
-    case "streamable-http": {
-      forwarder = new UpstreamForwarder({
-        url: config.upstream.url,
-        requestTimeoutMs: parseDuration(config.upstream.request_timeout)
-      });
-      break;
-    }
-    case "stdio": {
-      if (!config.upstream.command) {
-        console.error('Error: "command" is required for stdio transport');
-        process.exit(1);
-      }
-      const stdio = new StdioForwarder({
-        command: config.upstream.command,
-        args: config.upstream.args,
-        requestTimeoutMs: parseDuration(config.upstream.request_timeout)
-      });
-      await stdio.start();
-      forwarder = stdio;
-      closeForwarder = () => stdio.close();
-      break;
-    }
-    case "sse": {
-      const sse = new SseUpstreamForwarder({
-        url: config.upstream.url,
-        connectTimeoutMs: parseDuration(config.upstream.connect_timeout),
-        requestTimeoutMs: parseDuration(config.upstream.request_timeout)
-      });
-      await sse.connect();
-      forwarder = sse;
-      closeForwarder = () => sse.close();
-      break;
-    }
-  }
+  const { forwarder, close: closeForwarder } = await createForwarderFromConfig(config);
   const { policy, warnings } = compilePolicies(config.policies);
   for (const w of warnings) {
     const label = w.ruleName ? `rule "${w.ruleName}"` : `rule ${String(w.ruleIndex)}`;

package/dist/index.d.ts

@@ -113,6 +113,7 @@ declare const helioConfigSchema: z.ZodObject<{
         connect_timeout: z.ZodDefault<z.ZodString>;
         request_timeout: z.ZodDefault<z.ZodString>;
         forward_headers: z.ZodDefault<z.ZodArray<z.ZodString>>;
+        headers: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodString>>;
     }, z.core.$strip>;
     listen: z.ZodPrefault<z.ZodObject<{
         port: z.ZodDefault<z.ZodNumber>;

package/dist/index.js

@@ -37,7 +37,8 @@ var upstreamSchema = z.object({
   args: z.array(z.string()).optional(),
   connect_timeout: durationSchema.default("10s"),
   request_timeout: durationSchema.default("30s"),
-  forward_headers: z.array(z.string().min(1)).default([])
+  forward_headers: z.array(z.string().min(1)).default([]),
+  headers: z.record(z.string(), z.string()).default({})
 }).refine((data) => data.transport !== "stdio" || data.command !== void 0, {
   message: '"command" is required when transport is "stdio"',
   path: ["command"]
@@ -51,6 +52,22 @@ var upstreamSchema = z.object({
       });
     }
   }
+  const reserved = /* @__PURE__ */ new Set([
+    "mcp-session-id",
+    "mcp-protocol-version",
+    "content-type",
+    "content-length",
+    "host"
+  ]);
+  for (const name of Object.keys(data.headers)) {
+    if (reserved.has(name.toLowerCase())) {
+      ctx.addIssue({
+        code: "custom",
+        path: ["headers", name],
+        message: `upstream.headers must not set reserved header "${name}"`
+      });
+    }
+  }
 });
 var listenSchema = z.object({
   port: z.number().int().min(1).max(65535).default(3e3),
@@ -1131,6 +1148,20 @@ function describeUnreachableUpstream(error, url) {
   );
 }
 
+// src/upstream/merge-headers.ts
+function mergeUpstreamHeaders(base, forwarded, staticHeaders) {
+  const out = {};
+  const apply = (headers) => {
+    for (const [name, value] of Object.entries(headers)) {
+      out[name.toLowerCase()] = value;
+    }
+  };
+  apply(base);
+  apply(forwarded);
+  apply(staticHeaders);
+  return out;
+}
+
 // src/upstream/forwarder.ts
 var UpstreamForwarder = class {
   url;
@@ -1142,13 +1173,14 @@ var UpstreamForwarder = class {
     this.requestTimeoutMs = options.requestTimeoutMs ?? 3e4;
   }
   async forward(request) {
-    const requestHeaders = request.headers ?? {};
-    const headers = {
-      "content-type": "application/json",
-      accept: "application/json, text/event-stream",
-      ...this.staticHeaders,
-      ...requestHeaders
-    };
+    const headers = mergeUpstreamHeaders(
+      {
+        "content-type": "application/json",
+        accept: "application/json, text/event-stream"
+      },
+      request.headers ?? {},
+      this.staticHeaders
+    );
     if (request.sessionId) {
       headers["mcp-session-id"] = request.sessionId;
     }
@@ -1354,12 +1386,11 @@ var SseUpstreamForwarder = class {
     };
     if (request.id !== void 0) body["id"] = request.id;
     if (request.params !== void 0) body["params"] = request.params;
-    const requestHeaders = request.headers ?? {};
-    const headers = {
-      "content-type": "application/json",
-      ...this.staticHeaders,
-      ...requestHeaders
-    };
+    const headers = mergeUpstreamHeaders(
+      { "content-type": "application/json" },
+      request.headers ?? {},
+      this.staticHeaders
+    );
     if (request.sessionId) {
       headers["mcp-session-id"] = request.sessionId;
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@gethelio/proxy",
-  "version": "0.1.1",
+  "version": "0.2.0",
   "type": "module",
   "description": "Open-source MCP governance proxy for AI agents",
   "license": "Apache-2.0",