@ggui-ai/mcp-server 0.6.3 → 0.8.0

package/dist/server.js

@@ -51,7 +51,8 @@ import { setLlmTraceSink } from "@ggui-ai/ui-gen/harness/llm-trace-sink";
 import { setValidatorTraceSink } from "@ggui-ai/ui-gen/harness/validator-trace-sink";
 import express from "express";
 import { AsyncLocalStorage } from "node:async_hooks";
-import { randomBytes } from "node:crypto";
+import { createHash, randomBytes } from "node:crypto";
+import fs from "node:fs";
 import path from "node:path";
 import { BoundedCacheTraceSink, mountConsoleCacheRoutes } from "./console-cache.js";
 import { applyDevtoolSecurityHeaders } from "./console-headers.js";
@@ -59,6 +60,7 @@ import { BoundedLlmTraceSink, mountConsoleLlmTraceRoutes } from "./console-llm-t
 import { BoundedPayloadTraceSink, mountConsolePayloadsRoutes } from "./console-payloads.js";
 import { mountDevtoolThemeRoutes, } from "./console-theme-routes.js";
 import { mountConsoleTimelineRoutes } from "./console-timeline.js";
+import { buildInlineRenderShellHtml } from "./mcp-apps-outbound.js";
 import { BoundedValidatorTraceSink, mountConsoleValidatorRoutes } from "./console-validator.js";
 // Operator-class MCP handlers — twelve `ggui_ops_*` handlers across
 // four domains (apps / orgs / connector-keys / coupon). Every factory
@@ -96,7 +98,9 @@ import { mountEmailLoginRoutes } from "./email-login.js";
 import { resolveMcpInstructions } from "./instructions-presets.js";
 import { buildLlmCaller, createLlmBackedHandshakeNegotiator } from "./llm-backed-negotiator.js";
 import { createConsoleLogger } from "./logger.js";
-import { buildControlService } from "./control-service.js";
+import { buildControlService, CONTROL_PATH } from "./control-service.js";
+import { createBrowserCorsMiddleware } from "./browser-cors.js";
+import { buildOriginHostPolicy, createOriginHostValidationMiddleware, validateOriginHost, } from "./origin-validation.js";
 import { composeHandlersWithMounts, validateMcpServices, validateServiceHandlers, } from "./mcp-mounts.js";
 import { mountOAuthLoginRoutes } from "./oauth-login.js";
 import { createOAuthProvidersStore } from "./oauth-providers-store.js";
@@ -202,6 +206,7 @@ export function defaultHandlers(deps) {
             embedding: deps.embedding,
             vectors: deps.vectors,
             ...(deps.blueprints ? { blueprints: deps.blueprints } : {}),
+            ...(deps.registrySearch ? { registry: deps.registrySearch } : {}),
         }),
         createListFeaturedBlueprintsHandler(deps.blueprints ? { blueprints: deps.blueprints } : {}),
         // Spec / discovery handlers — zero-deps. These may be tagged
@@ -272,6 +277,12 @@ export function defaultHandlers(deps) {
     if (deps.render) {
         handlers.push(createGguiSyncContextHandler({
             renderStore: deps.render.renderStore,
+            // Same store `ggui_render` writes identity records to — a
+            // snapshot sync re-commits the row, so the record's view of it
+            // is refreshed off the same seam.
+            ...(deps.render.renderIdentityStore
+                ? { renderIdentityStore: deps.render.renderIdentityStore }
+                : {}),
         }));
         // `ggui_runtime_refresh_ws_token` — G14 (2026-05-23) signed-
         // envelope refresh tool. Registered only when a refresh seam is
@@ -345,6 +356,9 @@ export function defaultHandlers(deps) {
     if (deps.update) {
         handlers.push(createGguiUpdateHandler({
             renderStore: deps.update.renderStore,
+            ...(deps.update.renderIdentityStore
+                ? { renderIdentityStore: deps.update.renderIdentityStore }
+                : {}),
             ...(deps.update.propsUpdateNotifier
                 ? { propsUpdateNotifier: deps.update.propsUpdateNotifier }
                 : {}),
@@ -486,6 +500,9 @@ export function defaultHandlers(deps) {
     if (deps.render) {
         handlers.push(createGguiRenderHandler({
             renderStore: deps.render.renderStore,
+            ...(deps.render.renderTtlMs !== undefined
+                ? { renderTtlMs: deps.render.renderTtlMs }
+                : {}),
             // Plugin slice Commit 3 — render reads App.gadgets to
             // gate `clientCapabilities.gadgets[*].hook` references via
             // `assertGadgetsRegistered`. Same instance the
@@ -505,6 +522,9 @@ export function defaultHandlers(deps) {
                 : {}),
             ...(deps.render.rateLimiter ? { rateLimiter: deps.render.rateLimiter } : {}),
             ...(deps.render.shortCodeIndex ? { shortCodeIndex: deps.render.shortCodeIndex } : {}),
+            ...(deps.render.renderIdentityStore
+                ? { renderIdentityStore: deps.render.renderIdentityStore }
+                : {}),
             ...(deps.render.provisionalPreview
                 ? { provisionalPreview: deps.render.provisionalPreview }
                 : {}),
@@ -524,9 +544,11 @@ export function defaultHandlers(deps) {
                 ? { checkRenderContracts: deps.render.checkRenderContracts }
                 : {}),
             // Content-addressable code store. Both fields are forwarded
-            // together; the render handler
-            // requires both to emit `codeUrl`. Absent or partial =
-            // inline-base64 fallback (see render.ts handler body).
+            // together; the render handler requires both to emit
+            // `codeUrl`. Absent or partial = no cache-addressable static
+            // channel; the bootstrap still carries the inline `codeB64`
+            // twin for under-cap renders and mounts through the live trio
+            // where minted (see render.ts handler body).
             ...(deps.render.codeStore && deps.render.codeBaseUrl
                 ? {
                     codeStore: deps.render.codeStore,
@@ -613,7 +635,7 @@ export function buildOpsBundleHandlers(deps) {
     const handlers = [];
     if (deps.opsApps) {
         const { apps, userDefaultApp } = deps.opsApps;
-        handlers.push(createListAppsHandler({ apps }), createCreateAppHandler({ apps }), createUpdateAppHandler({ apps }), createSetAppThemeHandler({ apps }), createDeleteAppHandler({ apps }), createSetDefaultAppHandler({ apps, userDefaultApp }));
+        handlers.push(createListAppsHandler({ apps }), createCreateAppHandler({ apps }), createUpdateAppHandler({ apps }), createSetAppThemeHandler({ apps }), createDeleteAppHandler({ apps, userDefaultApp }), createSetDefaultAppHandler({ apps, userDefaultApp }));
     }
     if (deps.opsOrgs) {
         const { orgs, invites } = deps.opsOrgs;
@@ -752,7 +774,47 @@ export function createGguiServer(opts = {}) {
     const runtimeBundleFile = runtimeConfig.distDir !== undefined
         ? path.join(runtimeConfig.distDir, "iframe-runtime.js")
         : RUNTIME_BUNDLE_FILE;
-    const runtimeBootstrapUrl = runtimeConfig.url ?? runtimePath;
+    // Bundle bytes, captured ONCE at composition. Feed three consumers:
+    // the content hash below, the immutable hashed route (which must
+    // serve exactly the bytes its name hashes — see runtime-bundle-
+    // route.ts), and the opt-in inline-runtime shell. Unreadable file ⇒
+    // undefined ⇒ every consumer falls back to its pre-#472 behavior.
+    let runtimeBundleBytes;
+    if (runtimeEnabled) {
+        try {
+            runtimeBundleBytes = fs.readFileSync(runtimeBundleFile);
+        }
+        catch {
+            // The plain route's own existsSync handles the missing-bundle
+            // warning; nothing extra to say here.
+        }
+    }
+    // Content-hashed runtime URL (#472). The stamped `runtimeUrl` (and
+    // the hashed route it points at) embeds sha256[0..12) of the bytes:
+    // clients cache one download per content version with zero
+    // revalidations, and a deploy rolls over by changing the URL. The
+    // rewrite applies to a configured absolute `runtime.url` ONLY when
+    // its filename matches the served bundle's route (a CDN fronting
+    // THIS server still resolves the hashed name at its origin); a URL
+    // pointing at a foreign copy is left untouched, and
+    // `runtime.hashedUrl: false` opts out entirely.
+    const runtimeBundleHash = runtimeBundleBytes !== undefined && runtimeConfig.hashedUrl !== false
+        ? createHash("sha256").update(runtimeBundleBytes).digest("hex").slice(0, 12)
+        : undefined;
+    const insertHash = (urlOrPath) => {
+        if (runtimeBundleHash === undefined)
+            return urlOrPath;
+        const plainName = runtimePath.slice(runtimePath.lastIndexOf("/") + 1);
+        const dot = plainName.lastIndexOf(".");
+        const hashedName = dot === -1
+            ? `${plainName}.${runtimeBundleHash}`
+            : `${plainName.slice(0, dot)}.${runtimeBundleHash}${plainName.slice(dot)}`;
+        if (!urlOrPath.endsWith(`/${plainName}`) && urlOrPath !== plainName)
+            return urlOrPath;
+        return `${urlOrPath.slice(0, urlOrPath.length - plainName.length)}${hashedName}`;
+    };
+    const hashedRuntimePath = runtimeBundleHash !== undefined ? insertHash(runtimePath) : undefined;
+    const runtimeBootstrapUrl = insertHash(runtimeConfig.url ?? runtimePath);
     // Lazy resolver: each render/update handler invocation looks up the
     // request-context-derived absolute base inside the request scope
     // (via AsyncLocalStorage). Static `publicBaseUrl` wins when set;
@@ -899,7 +961,19 @@ export function createGguiServer(opts = {}) {
     const generationWithCache = opts.generation
         ? {
             ...opts.generation,
-            cache: opts.generation.cache ?? { embedding, vectorStore: vectors, index },
+            cache: opts.generation.cache ??
+                {
+                    embedding,
+                    vectorStore: vectors,
+                    index,
+                    // Durable write-through rides the cache bundle because
+                    // registration is where it fires. Omitted entirely when
+                    // unwired so the bundle stays byte-identical to before on
+                    // deployments that bound no durable store.
+                    ...(opts.durableBlueprints !== undefined
+                        ? { durability: opts.durableBlueprints }
+                        : {}),
+                },
             // Thread the shared/seed pools into the generation deps so the
             // render handler's §6 reuse point-read can fall back to them on a
             // per-app miss. Same `opts.seedPools` fed to the negotiator below;
@@ -1155,6 +1229,7 @@ export function createGguiServer(opts = {}) {
             // Registers `ggui_runtime_declare_tool_catalog`.
             toolIdentityCatalogStore,
             ...(opts.blueprintProvider ? { blueprints: opts.blueprintProvider } : {}),
+            ...(opts.registrySearch ? { registrySearch: opts.registrySearch } : {}),
             // UI registry for `ggui_render_blueprint`. Absent = render tool
             // is NOT registered on this server (defaultHandlers' own opt-in
             // rule). OSS CLI wires a `LocalUiRegistry` here so manifest
@@ -1219,6 +1294,7 @@ export function createGguiServer(opts = {}) {
                 ? {
                     render: {
                         renderStore,
+                        ...(opts.renderTtlMs !== undefined ? { renderTtlMs: opts.renderTtlMs } : {}),
                         ...(mintBootstrap ? { mintBootstrap } : {}),
                         // G14 (2026-05-23) refresh seam. Same `channelBootstrap`
                         // the WS upgrade path uses — sharing it means one HMAC
@@ -1267,6 +1343,12 @@ export function createGguiServer(opts = {}) {
                         // index. Absent = hosted cloud (DDB side-table) / no
                         // console consumer.
                         ...(opts.shortCodeIndex ? { shortCodeIndex: opts.shortCodeIndex } : {}),
+                        // Durable render-identity side record. Same opt-in
+                        // posture: absent = no records written, every read path
+                        // unchanged.
+                        ...(opts.renderIdentityStore
+                            ? { renderIdentityStore: opts.renderIdentityStore }
+                            : {}),
                         // Provisional A2UI preview. When `opts.provisionalPreview.enabled`
                         // flipped on above, the deps object owns
                         // `sendEnvelope` (late-bound to the live channel) +
@@ -1339,9 +1421,11 @@ export function createGguiServer(opts = {}) {
                         // handler along with the base
                         // URL the code-blob route resolves to. We prefer the
                         // explicit `--public-base-url` (so the URL is reachable
-                        // from claude.ai's iframe sandbox); when absent we fall
-                        // back to "no codeUrl emission" — the inline-base64
-                        // path still mounts the iframe successfully via Path B.
+                        // from a remote host's iframe sandbox); when absent we
+                        // fall back to "no codeUrl emission" — the iframe then
+                        // mounts through the live trio and the WS subscribe
+                        // carries the render body, which is the delivery path a
+                        // render-channel deployment already has.
                         ...(opts.codeStore && opts.publicBaseUrl
                             ? {
                                 codeStore: opts.codeStore,
@@ -1413,6 +1497,11 @@ export function createGguiServer(opts = {}) {
                 ? {
                     update: {
                         renderStore,
+                        // Same instance the render deps got — one record per
+                        // render, written by render and refreshed by update.
+                        ...(opts.renderIdentityStore
+                            ? { renderIdentityStore: opts.renderIdentityStore }
+                            : {}),
                         propsUpdateNotifier: {
                             sendPropsUpdate: async (sessionId, props) => {
                                 if (!channelForHealth)
@@ -1552,6 +1641,45 @@ export function createGguiServer(opts = {}) {
     // (render/update resultMeta.runtimeUrl) can adapt to the tunnel host.
     // Trust gate lives inside the middleware — see request-context.ts.
     app.use(buildRequestContextMiddleware());
+    // DNS-rebinding defense (ggui#438a; Streamable HTTP spec §Security
+    // Warning). Mounted BEFORE the body parsers so a rejected request
+    // never allocates a parsed body, and before auth so the verdict does
+    // not depend on credentials. Reads RAW headers — see the module
+    // docstring for why the request-context-derived host is unsafe here.
+    //
+    // Origin enforcement is scoped to the MCP wire; the Host check is
+    // global. NOTE: per-app routing WITHOUT a pathPrefix mounts at
+    // `/:appId` — no distinguishing prefix exists, so those requests get
+    // the Host check only (which is the actual rebinding defense);
+    // enforcing Origin app-wide would 403 the public cross-origin read
+    // surfaces (runtime-bundle, /code, /api/renders).
+    const mcpOriginEnforcedPrefixes = [
+        opts.universalMcpPath ?? "/mcp",
+        CONTROL_PATH,
+        ...mcpServices.map((svc) => svc.path),
+        ...(opts.perAppRouting?.pathPrefix !== undefined ? [opts.perAppRouting.pathPrefix] : []),
+    ];
+    const originHostPolicy = buildOriginHostPolicy({
+        bindHost: opts.host ?? "127.0.0.1",
+        ...(opts.publicBaseUrl !== undefined ? { publicBaseUrl: opts.publicBaseUrl } : {}),
+        ...(opts.browserOrigins !== undefined ? { browserOrigins: opts.browserOrigins } : {}),
+    });
+    app.use(createOriginHostValidationMiddleware({
+        policy: originHostPolicy,
+        enforceOriginPathPrefixes: mcpOriginEnforcedPrefixes,
+        logger: logger.child({ middleware: "origin-validation" }),
+    }));
+    // Browser CORS (ggui#438b). Mounted app-wide and BEFORE auth:
+    // preflights carry no Authorization by spec, so an auth-gated OPTIONS
+    // would kill every authenticated browser session. One policy object
+    // covers every MCP surface — universal /mcp, the per-app route,
+    // /control, isolated services — and the OAuth discovery + token +
+    // registration routes a browser client must fetch to authenticate.
+    // Error responses (401/403/405) inherit the headers because the layer
+    // runs before the handlers that produce them. Routes that set their
+    // own ACAO (runtime-bundle, /code, /api/renders — all `*`) win: they
+    // setHeader later, which replaces this layer's value.
+    app.use(createBrowserCorsMiddleware({ policy: originHostPolicy }));
     app.use(express.json({ limit: bodyLimit }));
     // Form-urlencoded body parser for /oauth/token (RFC 6749 §4.1.3
     // requires application/x-www-form-urlencoded). JSON bodies still
@@ -1697,16 +1825,42 @@ export function createGguiServer(opts = {}) {
         oauthEnabled,
         ...(oauthConfig.issuerUrl !== undefined ? { oauthIssuerUrl: oauthConfig.issuerUrl } : {}),
         logger,
+        corsOrigins: originHostPolicy.allowedOrigins,
     });
+    // Inline-runtime shell (opt-in): embed the runtime bundle's source
+    // into the static-resource shell so fetch-blocked hosts (iframe CSP
+    // without external script-src) can still boot. Resolved ONCE at
+    // composition time from the same bundle file the runtime mount
+    // serves. An explicit `shellHtml` wins; a read failure warns and
+    // falls back to the thin shell (the server still works everywhere
+    // the thin shell worked).
+    let inlineShellHtml;
+    if (mcpAppsEnabled && mcpAppsConfig.inlineRuntimeShell === true) {
+        if (runtimeBundleBytes !== undefined) {
+            inlineShellHtml = buildInlineRenderShellHtml(runtimeBundleBytes.toString("utf8"));
+        }
+        else {
+            // inlineRuntimeShell is on but the runtime bundle could not be
+            // read at composition — serve the thin postMessage shell instead.
+            logger.warn("mcp_apps_inline_shell_bundle_unreadable", {
+                runtimeBundleFile,
+            });
+        }
+    }
     // Per-boot `buildMcpServer` options — every input below is fixed at
     // composition time, so the bundle is assembled once and the MCP
     // endpoint family spreads a fresh copy per request.
     const buildMcpOptions = {
         mcpAppsOutbound: mcpAppsEnabled,
-        // Caller-provided `shellHtml` overrides the default;
-        // `installMcpAppsOutbound` falls back to its baked
-        // `GGUI_RENDER_SHELL_HTML` constant when absent.
-        ...(mcpAppsConfig.shellHtml !== undefined ? { shellHtml: mcpAppsConfig.shellHtml } : {}),
+        // Caller-provided `shellHtml` overrides the default (and the
+        // inline-runtime shell); `installMcpAppsOutbound` falls back to
+        // its baked `GGUI_RENDER_SHELL_HTML` constant when both are
+        // absent.
+        ...(mcpAppsConfig.shellHtml !== undefined
+            ? { shellHtml: mcpAppsConfig.shellHtml }
+            : inlineShellHtml !== undefined
+                ? { shellHtml: inlineShellHtml }
+                : {}),
         // Forward the operator-supplied public origin so the static
         // `ui://ggui/render` resource declares `_meta.ui.csp` for
         // spec-compliant hosts (Claude Desktop / claude.ai Connector /
@@ -1740,14 +1894,21 @@ export function createGguiServer(opts = {}) {
                         : {}),
                     // Resume contract — registry-only fallback. Wired
                     // when the blueprint vector store is available so the
-                    // resource handler can render a render-evicted
-                    // rehydrate from the registered blueprint instead of
-                    // the dead loading shell. `defaultAppIdFallback`
-                    // bounds the registry lookup to the OSS single-tenant
-                    // identity; multi-tenant deployments leave this
-                    // undefined to fail-safe back to the loading shell
-                    // (no way to derive the right tenant from a missing
-                    // render).
+                    // resource handler can rehydrate a render-evicted
+                    // locator from the registered blueprint instead of
+                    // failing the read. `defaultAppIdFallback` bounds the
+                    // registry lookup to the OSS single-tenant identity.
+                    //
+                    // Leaving it undefined does not soften the response —
+                    // there is no placeholder shell to fall back to any more.
+                    // It removes the fallback, and reads it would have served
+                    // fail typed instead. The reason to leave it undefined is
+                    // that the lookup answers "a blueprint with this key
+                    // exists under this scope" to whoever asks, which a
+                    // deployment serving several tenants from one scope may
+                    // not want, and which it could not scope correctly anyway
+                    // (a missing render carries no way to derive whose it
+                    // was).
                     ...(vectors
                         ? {
                             vectorStore: vectors,
@@ -1760,9 +1921,15 @@ export function createGguiServer(opts = {}) {
                         }
                         : {}),
                     // T3-1 (2026-05-13) — content-addressable code delivery
-                    // for the MCP-resource shell. Without these the handler
-                    // emits the loading shell for compiled components; with
-                    // them, it inlines a `codeUrl` the iframe-runtime fetches.
+                    // for the MCP-resource shell. One of the handler's two
+                    // delivery channels: with these it inlines a `codeUrl` the
+                    // iframe-runtime fetches, and `mintWsToken` below is the
+                    // other. A compiled component needs at least one, and a
+                    // read that resolves a render this server can deliver by
+                    // neither fails NOT_MOUNTABLE rather than returning a
+                    // shell that would never paint. Wiring both (the shape
+                    // this factory produces) also means a fault on one
+                    // degrades to the other instead of failing the read.
                     ...(opts.codeStore && opts.publicBaseUrl
                         ? {
                             codeStore: opts.codeStore,
@@ -1786,6 +1953,37 @@ export function createGguiServer(opts = {}) {
                     // diagnosed live on 2026-05-18 against the cloudflared
                     // tunnel.
                     ...(opts.publicBaseUrl !== undefined ? { publicBaseUrl: opts.publicBaseUrl } : {}),
+                    // #430 slice 3 — the durable substrate, forwarded to the
+                    // READ side. Both stores are single top-level options with
+                    // two consumers: the write paths above spend them keeping
+                    // a record, and this is where the record is spent. A
+                    // factory that accepts them and forwards neither here
+                    // boots, compiles, and answers every evicted locator as
+                    // though the operator had wired nothing — which is what a
+                    // record-less server is supposed to do, so the regression
+                    // is invisible in the response.
+                    //
+                    // Forwarded independently, never as a pair: the template's
+                    // own accessor requires all three stores before it will
+                    // consult any of them, so a half-wired deployment is
+                    // already handled there, in one place.
+                    ...(opts.renderIdentityStore
+                        ? { renderIdentityStore: opts.renderIdentityStore }
+                        : {}),
+                    ...(opts.durableBlueprints !== undefined
+                        ? { durableBlueprints: opts.durableBlueprints }
+                        : {}),
+                    // Same retention knob `ggui_render` stamps new renders
+                    // with. The read path spends it on the row a re-mint
+                    // commits and on an expired-but-readable row it puts back
+                    // into service; unforwarded, both silently fall back to an
+                    // hour on a deployment whose renders live far longer.
+                    ...(opts.renderTtlMs !== undefined ? { renderTtlMs: opts.renderTtlMs } : {}),
+                    // #457 — the resurrection cap rides with the retention
+                    // knob; both surfaces it bounds live in the read path.
+                    ...(opts.maxRenderLifetimeMs !== undefined
+                        ? { maxRenderLifetimeMs: opts.maxRenderLifetimeMs }
+                        : {}),
                     // Live-channel wsToken minter — when wired, every
                     // per-render resource shell embeds `{wsUrl, wsToken}`
                     // so the iframe-runtime opens a WebSocket on mount and
@@ -1836,7 +2034,15 @@ export function createGguiServer(opts = {}) {
     // `runtime.url`. The bootstrap still carries a `runtimeUrl` so
     // the shell knows where to look — just not our HTTP listener.
     if (runtimeEnabled) {
-        mountRuntimeBundleRoute({ app, runtimePath, runtimeBundleFile, logger });
+        mountRuntimeBundleRoute({
+            app,
+            runtimePath,
+            runtimeBundleFile,
+            logger,
+            ...(hashedRuntimePath !== undefined && runtimeBundleBytes !== undefined
+                ? { hashed: { path: hashedRuntimePath, source: runtimeBundleBytes } }
+                : {}),
+        });
     }
     // R6 /state snapshot + R7 /events cursor-replay reads — see
     // `./api-renders-routes.ts` for the wsToken auth posture, tenancy
@@ -2567,6 +2773,18 @@ export function createGguiServer(opts = {}) {
                 ? { extraReservedValidators: composedReservedValidators }
                 : {}),
             ...(opts.versionPolicy !== undefined ? { versionPolicy: opts.versionPolicy } : {}),
+            // Pre-subscribe caps (ggui#444). Forwarded only when set — the
+            // channel resolves its own generous defaults otherwise.
+            ...(opts.wsMaxPayloadBytes !== undefined ? { maxPayloadBytes: opts.wsMaxPayloadBytes } : {}),
+            ...(opts.wsMaxPreSubscribePayloadBytes !== undefined
+                ? { maxPreSubscribePayloadBytes: opts.wsMaxPreSubscribePayloadBytes }
+                : {}),
+            ...(opts.wsPreSubscribeIdleMs !== undefined
+                ? { preSubscribeIdleMs: opts.wsPreSubscribeIdleMs }
+                : {}),
+            ...(opts.wsMaxPreSubscribeConnections !== undefined
+                ? { maxPreSubscribeConnections: opts.wsMaxPreSubscribeConnections }
+                : {}),
             ...(opts.onFirstSubscriber ? { onFirstSubscriber: opts.onFirstSubscriber } : {}),
             ...(opts.onLastSubscriberGone ? { onLastSubscriberGone: opts.onLastSubscriberGone } : {}),
             // Shared TelemetrySink — bound once at composition so future
@@ -2658,7 +2876,24 @@ export function createGguiServer(opts = {}) {
         blueprintStore,
         blueprintSelector,
         blueprintSearch,
-        async listen(port = 0, host = "127.0.0.1") {
+        async listen(port = 0, host = opts.host ?? "127.0.0.1") {
+            // The Origin/Host validation policy (ggui#438a) was built above
+            // from `opts.host ?? "127.0.0.1"` — the declared bind. A caller
+            // that passes an explicit, DIFFERENT host here binds somewhere
+            // the policy doesn't know about (e.g. a loopback-believing
+            // policy fronting a wide-open listener), silently reintroducing
+            // the rebinding gap the policy exists to close. Not thrown —
+            // some embedders call `listen()` directly without threading
+            // `CreateGguiServerOptions.host` — but always logged loudly so
+            // the divergence is visible in ops.
+            const declaredHost = opts.host ?? "127.0.0.1";
+            if (host !== declaredHost) {
+                logger.error("listen_host_policy_mismatch", {
+                    declaredHost,
+                    listenHost: host,
+                    hint: "Pass the same host via CreateGguiServerOptions.host — the Origin/Host validation policy was built from it and now describes a different bind.",
+                });
+            }
             return new Promise((resolve, reject) => {
                 const server = app.listen(port, host, () => {
                     const addr = server.address();
@@ -2683,7 +2918,36 @@ export function createGguiServer(opts = {}) {
                 // other paths (or a future second WS endpoint) are rejected.
                 if (channel) {
                     server.on("upgrade", (req, socket, head) => {
+                        // Second ingress (ggui#438a): upgrade requests never
+                        // traverse Express middleware, so the same validator runs
+                        // here explicitly. The channel is MCP-plane — Origin is
+                        // always enforced. WebSocket handshakes are exempt from
+                        // the same-origin policy (any page can open a socket), so
+                        // an unchecked upgrade is a cross-site WS hijack surface.
+                        //
+                        // Opaque-origin ("null") admission is narrowed to sockets
+                        // that declare bootstrap intent via `?wsToken=` on the
+                        // upgrade URL — the srcdoc-bootstrap topology it exists to
+                        // serve. A bare opaque-origin socket with no bootstrap
+                        // intent is validated as the ordinary "http" ingress and
+                        // gets the standard rejection. Admission here is NOT
+                        // authentication: the subscribe-time handler
+                        // (`ggui-session-channel/subscribe.ts`) still rejects an
+                        // admitted socket outright unless it goes on to present a
+                        // verifying credential on the `subscribe` message itself.
                         const url = new URL(req.url ?? "/", "http://localhost");
+                        const bootstrapIntentDeclared = url.searchParams.has("wsToken");
+                        const wsRejection = validateOriginHost(req.headers.host, typeof req.headers.origin === "string" ? req.headers.origin : undefined, originHostPolicy, bootstrapIntentDeclared ? "ws-upgrade" : "http");
+                        if (wsRejection !== null) {
+                            logger.warn("origin_host_rejected", {
+                                header: wsRejection.header,
+                                value: wsRejection.value,
+                                transport: "websocket",
+                            });
+                            socket.write("HTTP/1.1 403 Forbidden\r\n" + "Connection: close\r\n\r\n");
+                            socket.destroy();
+                            return;
+                        }
                         if (url.pathname !== channel.path) {
                             socket.write("HTTP/1.1 404 Not Found\r\n" + "Connection: close\r\n\r\n");
                             socket.destroy();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ggui-ai/mcp-server",
-  "version": "0.6.3",
+  "version": "0.8.0",
   "description": "Self-hosted MCP server for the ggui protocol. An HTTP/MCP binding layer over @ggui-ai/mcp-server-handlers and the reference adapters from @ggui-ai/mcp-server-core — run it via `ggui serve`.",
   "keywords": [
     "ggui",
@@ -32,16 +32,16 @@
     "resend": "^6.12.2",
     "ws": "^8.20.1",
     "zod": "^4.3.6",
-    "@ggui-ai/console": "0.6.3",
-    "@ggui-ai/mcp-server-core": "0.6.3",
-    "@ggui-ai/negotiator": "0.6.3",
-    "@ggui-ai/iframe-runtime": "0.6.3",
-    "@ggui-ai/mcp-server-handlers": "0.6.3",
-    "@ggui-ai/preview-a2ui": "0.6.3",
-    "@ggui-ai/project-config": "0.6.3",
-    "@ggui-ai/ui-gen": "0.6.3",
-    "@ggui-ai/ui-registry": "0.6.3",
-    "@ggui-ai/protocol": "0.6.3"
+    "@ggui-ai/console": "0.8.0",
+    "@ggui-ai/mcp-server-handlers": "0.8.0",
+    "@ggui-ai/negotiator": "0.8.0",
+    "@ggui-ai/mcp-server-core": "0.8.0",
+    "@ggui-ai/iframe-runtime": "0.8.0",
+    "@ggui-ai/preview-a2ui": "0.8.0",
+    "@ggui-ai/protocol": "0.8.0",
+    "@ggui-ai/project-config": "0.8.0",
+    "@ggui-ai/ui-gen": "0.8.0",
+    "@ggui-ai/ui-registry": "0.8.0"
   },
   "devDependencies": {
     "@types/express": "^5.0.0",
@@ -50,7 +50,7 @@
     "@types/ws": "^8.5.10",
     "typescript": "^5.0.0",
     "vitest": "^3.2.6",
-    "@ggui-ai/protocol-conformance": "0.6.3"
+    "@ggui-ai/protocol-conformance": "0.8.0"
   },
   "repository": {
     "type": "git",