@mrrlin-dev/mcp 0.4.126 → 0.4.127

package/dist/bin.cjs

@@ -63221,7 +63221,7 @@ Do NOT derail the current task - if the operator has an in-flight question, answ
 }
 
 // src/_generated/version.ts
-var PKG_VERSION = "0.4.126";
+var PKG_VERSION = "0.4.127";
 
 // src/receipt-signing.ts
 var import_node_crypto17 = __toESM(require("node:crypto"), 1);
@@ -69861,6 +69861,28 @@ function startArtifactsGc(baseStateDir, intervalMs = 10 * 60 * 1e3, options) {
   };
 }
 
+// src/bridge-host-guard.ts
+var LOOPBACK_HOST_NAMES = ["127.0.0.1", "localhost", "[::1]"];
+function hostHeaderName(host) {
+  const lower = host.trim().toLowerCase();
+  return lower.includes(":") && !lower.startsWith("[") ? `[${lower}]` : lower;
+}
+function isAllowedBridgeHost(hostHeader, opts) {
+  const { port, configuredHost } = opts;
+  if (!hostHeader || port === void 0) return false;
+  const names = new Set(LOOPBACK_HOST_NAMES);
+  if (configuredHost?.trim()) names.add(hostHeaderName(configuredHost));
+  const actual = hostHeader.trim().toLowerCase();
+  for (const name of names) {
+    if (actual === `${name}:${port}`) return true;
+    if (port === 80 && actual === name) return true;
+  }
+  return false;
+}
+function isAllowedBridgeRequestHost(req, configuredHost) {
+  return isAllowedBridgeHost(req.headers.host, { port: req.socket.localPort, configuredHost });
+}
+
 // src/chat-compaction.ts
 var DEFAULT_COMPACTION_SEED_BUDGET_BYTES = 8e3;
 var DEFAULT_COMPACTION_TIMEOUT_MS = 3e4;
@@ -76752,6 +76774,10 @@ function applyPnaHeaders(res, requestOrigin, allowed) {
 function createBridgeRequestListener(opts) {
   const { host, port, token, allowedOrigins, stateDir, getHealth } = opts;
   return (req, res) => {
+    if (!isAllowedBridgeRequestHost(req, host)) {
+      res.writeHead(421).end();
+      return;
+    }
     const requestOrigin = typeof req.headers.origin === "string" ? req.headers.origin : void 0;
     if (req.method === "OPTIONS") {
       applyPnaHeaders(res, requestOrigin, allowedOrigins);
@@ -76841,7 +76867,16 @@ function sessionIdOf(msg) {
 }
 function attachBridgeWss(server, opts) {
   const { token, allowedOrigins, onReady, logger, onPaired, bridgeInstanceId, selfUpdate, codex } = opts;
-  const wss = new import_websocket_server.default({ server, path: "/ws" });
+  const wss = new import_websocket_server.default({
+    server,
+    path: "/ws",
+    // The DNS-rebinding Host check from createBridgeRequestListener, applied to the upgrade: a bad
+    // Host is answered 421 and the socket is never opened, so no `ready` frame goes out.
+    verifyClient: (info, done) => {
+      if (isAllowedBridgeRequestHost(info.req, opts.host)) done(true);
+      else done(false, 421);
+    }
+  });
   wss.on("connection", (socket, request) => {
     const origin = request.headers.origin;
     if (!isOriginAllowed(origin, allowedOrigins)) {
@@ -78793,8 +78828,7 @@ async function startDirectorBridge() {
         inFlightRunIds: Array.from(consumerState.inFlightRunIds),
         inFlightCount: consumerState.inFlightRunIds.size,
         lastClaimAt: consumerState.lastClaimAt,
-        service: health.snapshot(),
-        localArtifactToken: config2.token
+        service: health.snapshot()
       })
     })
   );
@@ -79058,6 +79092,7 @@ async function startDirectorBridge() {
   attachBridgeWss(server, {
     token: config2.token,
     allowedOrigins: config2.allowedOrigins,
+    host: config2.host,
     onReady: createBridgeMessageHandler({
       ...sharedHandlerDeps,
       threads,
@@ -79111,6 +79146,10 @@ async function startDirectorBridge() {
   }
   const workerToken = readOrCreateWorkerToken();
   const dispatchServer = import_node_http3.default.createServer((req, res) => {
+    if (!isAllowedBridgeRequestHost(req, "127.0.0.1")) {
+      res.writeHead(421).end();
+      return;
+    }
     if (req.method !== "POST" || req.url !== "/worker/dispatch") {
       res.writeHead(404).end();
       return;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mrrlin-dev/mcp",
-  "version": "0.4.126",
+  "version": "0.4.127",
   "type": "module",
   "bin": {
     "mrrlin-mcp": "dist/bin.cjs"