@sanctuary-framework/mcp-server 0.10.5 → 0.10.6

package/dist/cli.cjs

@@ -6715,6 +6715,11 @@ function generateDashboardHTML(options) {
     // SEC-038: Do NOT embed the long-lived auth token in page source.
     // Use only the session token stored in sessionStorage by the login flow.
     const AUTH_TOKEN = sessionStorage.getItem('authToken') || '';
+    // v0.10.6: server-baked flag mirroring _autoAuthLocalhost. When true,
+    // the init-time auth gate does NOT redirect to '/' on empty AUTH_TOKEN,
+    // because the server already admitted this loopback caller without a
+    // bearer token. See dashboard-html.ts generateDashboardHTML() doc.
+    const LOOPBACK_AUTH = ${JSON.stringify(options.loopbackAutoAuth === true)};
     const TIMEOUT_SECONDS = ${options.timeoutSeconds};
     const API_BASE = '';
 
@@ -7822,7 +7827,13 @@ function generateDashboardHTML(options) {
 
     // Initialize
     async function initialize() {
-      if (!AUTH_TOKEN) {
+      // v0.10.6: gate on BOTH sessionStorage and the server-baked loopback
+      // auto-auth mirror. Pre-fix, a fresh loopback tab had empty
+      // sessionStorage.authToken AND was admitted by the server via
+      // _autoAuthLocalhost \u2014 this single-operand gate redirected to '/'
+      // which reloaded the same page, which redirected again, infinitely.
+      // See generateDashboardHTML() header comment for full threat model.
+      if (!AUTH_TOKEN && !LOOPBACK_AUTH) {
         redirectToLogin();
         return;
       }
@@ -8867,7 +8878,11 @@ var init_dashboard = __esm({
         this.sessionTTLMs = isLocalhost ? SESSION_TTL_LOCAL_MS : SESSION_TTL_REMOTE_MS;
         this.dashboardHTML = generateDashboardHTML({
           timeoutSeconds: config.timeout_seconds,
-          serverVersion: SANCTUARY_VERSION
+          serverVersion: SANCTUARY_VERSION,
+          // Construction-time default; real value is set by setAutoAuthLocalhost()
+          // below (which regenerates this HTML). Default false preserves the
+          // pre-v0.10.6 remote-deployment behavior when auto-auth is not enabled.
+          loopbackAutoAuth: this._autoAuthLocalhost
         });
         this.loginHTML = generateLoginHTML({ serverVersion: SANCTUARY_VERSION });
         this.sessionCleanupTimer = setInterval(() => this.cleanupSessions(), 6e4);
@@ -8903,6 +8918,11 @@ var init_dashboard = __esm({
        */
       setAutoAuthLocalhost(enabled) {
         this._autoAuthLocalhost = enabled;
+        this.dashboardHTML = generateDashboardHTML({
+          timeoutSeconds: this.config.timeout_seconds,
+          serverVersion: SANCTUARY_VERSION,
+          loopbackAutoAuth: this._autoAuthLocalhost
+        });
       }
       /**
        * v0.10.2: is this request from a loopback interface? We treat the