@modootoday/pmcp 0.8.1 → 0.8.2

package/README.md

@@ -191,12 +191,13 @@ export default { fetch: (request: Request) => skills.fetch(request) };
 
 The handler checks requests before they reach MCP:
 
-| Option            | Default | Effect                                                                                                                                                                                                         |
-| ----------------- | ------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| `allowedOrigins`  | none    | A request with an `Origin` other than the server's own gets 403. Listed origins are served with CORS headers, and their preflight is answered. Requests without `Origin` are not from a browser page and pass. |
-| `allowedHosts`    | any     | When set, a `Host` outside the list gets 403 (DNS rebinding).                                                                                                                                                  |
-| `maxRequestBytes` | 1 MiB   | A larger body gets 413; a declared length is refused before reading.                                                                                                                                           |
-| `rateLimit`       | off     | `{ perMinute }` per caller id; past it, 429 with `retry-after`.                                                                                                                                                |
+| Option            | Default | Effect                                                                                                                                                                                                                                  |
+| ----------------- | ------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| `allowedOrigins`  | none    | A request with an `Origin` other than the server's own gets 403. Listed origins are served with CORS headers, and their preflight is answered. `"*"` admits any origin. Requests without `Origin` are not from a browser page and pass. |
+| `publicOrigins`   | none    | The server's own origins as browsers see them, when a proxy ends TLS and the request URL is `http://`. Without it, a same-site page behind such a proxy gets 403.                                                                       |
+| `allowedHosts`    | any     | When set, a `Host` outside the list gets 403 (DNS rebinding).                                                                                                                                                                           |
+| `maxRequestBytes` | 1 MiB   | A larger body gets 413; a declared length is refused before reading.                                                                                                                                                                    |
+| `rateLimit`       | off     | `{ perMinute }` per caller id; past it, 429 with `retry-after`.                                                                                                                                                                         |
 
 An MCP config (`.mcp.json`) is never served as written: every `env` and `headers` value is
 replaced with `<redacted>`, whichever entry reaches the file, and listed digests describe

package/dist/{chunk-STBBSQ3R.js → chunk-3JNWCUHA.js}

@@ -1,6 +1,6 @@
 import {
   openDatabase
-} from "./chunk-MO3LLVVY.js";
+} from "./chunk-IRQTGYHA.js";
 
 // src/embed.ts
 var DEFAULT_MODEL_ID = "Xenova/multilingual-e5-small";
@@ -157,4 +157,4 @@ export {
   encodeEntries,
   openEntryVectors
 };
-//# sourceMappingURL=chunk-STBBSQ3R.js.map
+//# sourceMappingURL=chunk-3JNWCUHA.js.map

package/dist/{chunk-MO3LLVVY.js → chunk-IRQTGYHA.js}

@@ -1,6 +1,6 @@
 import {
   normaliseIntent
-} from "./chunk-HB4VJ5VW.js";
+} from "./chunk-UGRHZHHC.js";
 
 // src/cache.ts
 async function openDatabase(path) {
@@ -131,4 +131,4 @@ export {
   DEFAULT_INTENT_CACHE_LIMIT,
   openIntentCache
 };
-//# sourceMappingURL=chunk-MO3LLVVY.js.map
+//# sourceMappingURL=chunk-IRQTGYHA.js.map

package/dist/{chunk-DTQAN33I.js → chunk-O2P5AIHX.js}

@@ -2,7 +2,7 @@ import {
   frontmatterObject,
   readCatalog,
   specProblems
-} from "./chunk-HB4VJ5VW.js";
+} from "./chunk-UGRHZHHC.js";
 
 // src/config.ts
 import { existsSync, readFileSync } from "fs";
@@ -1139,4 +1139,4 @@ export {
   validateSkillDir,
   validateCatalog
 };
-//# sourceMappingURL=chunk-DTQAN33I.js.map
+//# sourceMappingURL=chunk-O2P5AIHX.js.map

package/dist/{chunk-HB4VJ5VW.js → chunk-UGRHZHHC.js}

@@ -1590,7 +1590,7 @@ function registerReadTool(server, tools) {
 
 // src/mcp.ts
 var SERVER_NAME = "pmcp";
-var SERVER_VERSION = "0.8.1";
+var SERVER_VERSION = "0.8.2";
 function registerSkillTools(server, tools) {
   registerCatalogTool(server, tools);
   registerFindTool(server, tools);
@@ -1661,4 +1661,4 @@ export {
   registerSkillTools,
   createSkillServer
 };
-//# sourceMappingURL=chunk-HB4VJ5VW.js.map
+//# sourceMappingURL=chunk-UGRHZHHC.js.map

package/dist/{chunk-K7BX33LH.js → chunk-UW7HTILA.js}

@@ -1,6 +1,6 @@
 import {
   createSkillServer
-} from "./chunk-HB4VJ5VW.js";
+} from "./chunk-UGRHZHHC.js";
 
 // src/stdio.ts
 import { serveStdio } from "@modelcontextprotocol/server/stdio";
@@ -38,4 +38,4 @@ export {
   serve,
   main
 };
-//# sourceMappingURL=chunk-K7BX33LH.js.map
+//# sourceMappingURL=chunk-UW7HTILA.js.map

package/dist/cli.js

@@ -2,7 +2,7 @@
 import {
   loadEmbedder,
   openEntryVectors
-} from "./chunk-STBBSQ3R.js";
+} from "./chunk-3JNWCUHA.js";
 import {
   ConfigError,
   ProjectError,
@@ -17,15 +17,15 @@ import {
   splitFrontmatter,
   validateCatalog,
   validateSkillDir
-} from "./chunk-DTQAN33I.js";
-import "./chunk-MO3LLVVY.js";
+} from "./chunk-O2P5AIHX.js";
+import "./chunk-IRQTGYHA.js";
 import {
   serve
-} from "./chunk-K7BX33LH.js";
+} from "./chunk-UW7HTILA.js";
 import {
   kindOf,
   readCatalog
-} from "./chunk-HB4VJ5VW.js";
+} from "./chunk-UGRHZHHC.js";
 
 // src/cli/command.ts
 var ArgumentError = class extends Error {
@@ -2347,7 +2347,7 @@ function dispatch(argv, options = {}) {
   }
   return run(command, rest, { ui, env, cwd });
 }
-var VERSION = "0.8.1";
+var VERSION = "0.8.2";
 async function run(command, argv, context) {
   try {
     return await command.run({

package/dist/http.d.ts

@@ -88,8 +88,10 @@ interface SkillHttpOptions extends SkillServerOptions {
      * here, so "private" unless the host knows every caller sees the same list.
      */
     readonly cacheScope?: "public" | "private";
-    /** Browser origins, besides the server's own, whose pages may call; others get 403. */
+    /** Browser origins, besides the server's own, whose pages may call; others get 403. "*" admits any. */
     readonly allowedOrigins?: readonly string[];
+    /** The server's own public origins when a proxy ends TLS, e.g. "https://skills.example.com". */
+    readonly publicOrigins?: readonly string[];
     /** Host header values the server answers to; unset means any. */
     readonly allowedHosts?: readonly string[];
     /** Largest request body accepted; larger ones get 413. */

package/dist/http.js

@@ -2,12 +2,12 @@ import {
   DEFAULT_MODEL_ID,
   encodeEntries,
   loadEmbedder
-} from "./chunk-STBBSQ3R.js";
-import "./chunk-MO3LLVVY.js";
+} from "./chunk-3JNWCUHA.js";
+import "./chunk-IRQTGYHA.js";
 import {
   createSkillServer,
   readCatalog
-} from "./chunk-HB4VJ5VW.js";
+} from "./chunk-UGRHZHHC.js";
 
 // src/http.ts
 import {
@@ -22,11 +22,15 @@ var json = (status, body, headers = {}) => new Response(JSON.stringify(body), {
   status,
   headers: { "content-type": "application/json", ...headers }
 });
-function checkOrigin(request, allowedOrigins = []) {
+function checkOrigin(request, allowedOrigins = [], publicOrigins = []) {
   const origin = request.headers.get("origin");
   if (origin === null) return { kind: "none" };
-  if (origin === new URL(request.url).origin) return { kind: "same" };
-  if (allowedOrigins.includes(origin)) return { kind: "allowed", origin };
+  if (origin === new URL(request.url).origin || publicOrigins.includes(origin)) {
+    return { kind: "same" };
+  }
+  if (allowedOrigins.includes(origin) || allowedOrigins.includes("*")) {
+    return { kind: "allowed", origin };
+  }
   return {
     kind: "refused",
     response: json(403, { error: "origin_not_allowed" })
@@ -192,7 +196,11 @@ function createSkillHttpHandler(options) {
     async fetch(request) {
       const wrongHost = checkHost(request, options.allowedHosts);
       if (wrongHost) return wrongHost;
-      const origin = checkOrigin(request, options.allowedOrigins);
+      const origin = checkOrigin(
+        request,
+        options.allowedOrigins,
+        options.publicOrigins
+      );
       if (origin.kind === "refused") return origin.response;
       if (origin.kind !== "allowed") return serve(request);
       if (request.method === "OPTIONS") return preflight(origin.origin);

package/dist/index.d.ts

@@ -304,7 +304,7 @@ declare function resolveSkillFileUri(uri: string, entries: readonly SkillEntry[]
 
 /** Reported to the host on connect. */
 declare const SERVER_NAME = "pmcp";
-declare const SERVER_VERSION = "0.8.1";
+declare const SERVER_VERSION = "0.8.2";
 /**
  * Registers the skill_* tools on a server.
  *

package/dist/index.js

@@ -14,11 +14,11 @@ import {
   readSpec,
   validateCatalog,
   validateSkillDir
-} from "./chunk-DTQAN33I.js";
+} from "./chunk-O2P5AIHX.js";
 import {
   DEFAULT_INTENT_CACHE_LIMIT,
   openIntentCache
-} from "./chunk-MO3LLVVY.js";
+} from "./chunk-IRQTGYHA.js";
 import {
   ASSET_KINDS,
   CATALOG_PAGE_MAX,
@@ -70,7 +70,7 @@ import {
   skillFileUri,
   specProblems,
   withoutBody
-} from "./chunk-HB4VJ5VW.js";
+} from "./chunk-UGRHZHHC.js";
 export {
   ASSET_KINDS,
   CATALOG_PAGE_MAX,

package/dist/stdio.js

@@ -3,8 +3,8 @@ import {
   main,
   resolveRoots,
   serve
-} from "./chunk-K7BX33LH.js";
-import "./chunk-HB4VJ5VW.js";
+} from "./chunk-UW7HTILA.js";
+import "./chunk-UGRHZHHC.js";
 export {
   main,
   resolveRoots,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@modootoday/pmcp",
-  "version": "0.8.1",
+  "version": "0.8.2",
   "license": "Elastic-2.0",
   "author": "modootoday",
   "description": "An MCP server that finds the skills your installed packages already ship. Reads SKILL.md out of node_modules by shape rather than by path, so it sees the skills, .agent, .claude, .gemini and .codex conventions alike, and keeps session startup flat as the number of installed skills grows.",