@sonoma-security/mcp-gateway 0.1.13 → 0.1.15

package/dist/http-proxy.js

@@ -1,34 +1,94 @@
 /**
  * HTTP Proxy Server for MCP Gateway
  *
- * Exposes per-server HTTP endpoints that transparently proxy MCP requests
- * to upstream servers. This allows plugins to keep their skills active
- * while traffic flows through the gateway for policy enforcement and telemetry.
+ * Transparent HTTP passthrough that forwards all MCP traffic (including OAuth
+ * discovery, auth headers, SSE streams) to upstream servers. Parses JSON-RPC
+ * request/response bodies for telemetry and policy enforcement.
  *
  * Architecture:
- *   Plugin (http://localhost:{port}/proxy/{serverName}) -> HTTP Proxy -> Upstream MCP Server
+ *   Client (http://localhost:{port}/proxy/{serverName}/mcp)
+ *     -> HTTP Proxy (parse JSON-RPC, enforce policy, record telemetry)
+ *       -> Upstream MCP Server (https://mcp.example.com/mcp)
  *
- * Each upstream server gets its own MCP Server + StreamableHTTPServerTransport,
- * which delegates tools/list and tools/call to the upstream Client connection
- * managed by the parent McpGateway.
+ * Unlike the previous MCP-level proxy (which terminated MCP sessions and
+ * created its own Server/Transport), this is a true HTTP passthrough.
+ * OAuth, SSE, session headers all flow through untouched.
  */
 import { createServer } from "node:http";
-import { randomUUID } from "node:crypto";
-import { Server } from "@modelcontextprotocol/sdk/server/index.js";
-import { StreamableHTTPServerTransport } from "@modelcontextprotocol/sdk/server/streamableHttp.js";
-import { CallToolRequestSchema, ListToolsRequestSchema, } from "@modelcontextprotocol/sdk/types.js";
-const TOOL_CALL_TIMEOUT_MS = 30_000;
+/**
+ * Bind an HTTP server to the given port immediately, returning both the server
+ * and a promise that resolves once it's listening. The server responds to any
+ * request with 503 Service Unavailable until `adoptHttpServer` swaps in a real
+ * handler. This lets the caller hold the port during slow startup work (auth,
+ * policy fetch, upstream connections) so clients probing the port get
+ * "service starting" instead of ECONNREFUSED.
+ *
+ * On EADDRINUSE, the bind is retried for up to ~10s. The launchd/Scheduled
+ * Task supervisor races its own bootout against the new process, and the
+ * old owner can hold the socket briefly during teardown. Without the retry
+ * the fresh daemon crashes immediately, and each crash-loop wipes any
+ * in-memory MCP session state, stranding clients with stale session IDs.
+ */
+export function preListenHttpServer(port) {
+    const server = createServer((_req, res) => {
+        res.setHeader("Access-Control-Allow-Origin", "*");
+        res.setHeader("Retry-After", "1");
+        res.writeHead(503, { "Content-Type": "application/json" });
+        res.end(JSON.stringify({ error: "gateway_starting" }));
+    });
+    const listening = new Promise((resolve, reject) => {
+        const deadline = Date.now() + 10_000;
+        const tryListen = () => {
+            const onError = (err) => {
+                if (err.code === "EADDRINUSE" && Date.now() < deadline) {
+                    setTimeout(tryListen, 500);
+                    return;
+                }
+                reject(err);
+            };
+            server.once("error", onError);
+            server.listen(port, () => {
+                server.off("error", onError);
+                resolve();
+            });
+        };
+        tryListen();
+    });
+    return { server, listening };
+}
 export class HttpProxyServer {
     httpServer;
     callbacks;
-    sessions = new Map();
     port;
-    constructor(port, callbacks) {
+    // Track the last server that triggered OAuth discovery so we can route
+    // root-level auth requests (the SDK strips the path from the server URL
+    // when constructing the authorization server URL, so root-level requests
+    // like /.well-known/oauth-authorization-server and /register lose the
+    // server name context).
+    lastOAuthServerName;
+    // Cache of upstream AS metadata per server so we can route /authorize,
+    // /token, /register to the real upstream endpoints (which may live at
+    // non-root paths like /oauth/authorize).
+    upstreamAsEndpoints = new Map();
+    constructor(port, callbacks, preboundServer) {
         this.port = port;
         this.callbacks = callbacks;
-        this.httpServer = createServer(this.handleRequest.bind(this));
+        if (preboundServer) {
+            this.httpServer = preboundServer;
+            this.preboundAdopted = true;
+            this.httpServer.removeAllListeners("request");
+            this.httpServer.on("request", this.handleRequest.bind(this));
+        }
+        else {
+            this.httpServer = createServer(this.handleRequest.bind(this));
+        }
     }
+    preboundAdopted = false;
     async start() {
+        if (this.preboundAdopted) {
+            this.callbacks.log(`HTTP proxy handler attached on port ${this.port} (prebound)`);
+            return;
+        }
         return new Promise((resolve, reject) => {
             this.httpServer.on("error", reject);
             this.httpServer.listen(this.port, () => {
@@ -38,17 +98,6 @@ export class HttpProxyServer {
         });
     }
     async stop() {
-        // Close all sessions
-        for (const [sessionId, session] of this.sessions) {
-            try {
-                await session.transport.close();
-                await session.server.close();
-            }
-            catch {
-                // Ignore close errors
-            }
-            this.sessions.delete(sessionId);
-        }
         return new Promise((resolve) => {
             this.httpServer.close(() => resolve());
         });
@@ -62,115 +111,245 @@ export class HttpProxyServer {
     }
     async handleRequest(req, res) {
         const url = new URL(req.url ?? "/", `http://localhost:${this.port}`);
+        const accept = req.headers["accept"] ?? "";
+        const contentType = req.headers["content-type"] ?? "";
+        const mcpSessionId = req.headers["mcp-session-id"] ?? "";
+        this.callbacks.log(`[http-proxy] ${req.method} ${url.pathname} accept=${accept} ct=${contentType} session=${mcpSessionId}`);
         // CORS headers for local access
         res.setHeader("Access-Control-Allow-Origin", "*");
         res.setHeader("Access-Control-Allow-Methods", "GET, POST, DELETE, OPTIONS");
-        res.setHeader("Access-Control-Allow-Headers", "Content-Type, Mcp-Session-Id, Last-Event-ID");
+        res.setHeader("Access-Control-Allow-Headers", "Content-Type, Authorization, Mcp-Session-Id, Last-Event-ID, Accept, MCP-Protocol-Version");
         res.setHeader("Access-Control-Expose-Headers", "Mcp-Session-Id");
         if (req.method === "OPTIONS") {
             res.writeHead(204);
             res.end();
             return;
         }
-        // Forward OAuth protected resource discovery to the upstream server so the
-        // MCP SDK learns where the real authorization endpoint is (e.g., slack.com)
-        // instead of constructing localhost:19880/authorize which doesn't exist.
-        if (url.pathname.startsWith("/.well-known/oauth-protected-resource")) {
-            await this.handleOAuthDiscovery(url, res);
+        // OAuth discovery: rewrite path and forward to upstream
+        // e.g., /.well-known/oauth-protected-resource/proxy/sentry/mcp
+        //     -> https://mcp.sentry.dev/.well-known/oauth-protected-resource
+        const wellKnownMatch = url.pathname.match(/^\/\.well-known\/([^/]+)\/proxy\/([^/]+)\/mcp$/);
+        if (wellKnownMatch) {
+            const wellKnownType = wellKnownMatch[1];
+            const serverName = decodeURIComponent(wellKnownMatch[2]);
+            this.lastOAuthServerName = serverName;
+            await this.forwardOAuthDiscovery(wellKnownType, serverName, req, res);
             return;
         }
-        // Return 404 for /authorize and other .well-known endpoints.
-        if (url.pathname.startsWith("/.well-known/") || url.pathname === "/authorize") {
-            res.writeHead(404);
-            res.end();
+        // In-path .well-known: /proxy/{server}/mcp/.well-known/{type}
+        // Claude Code also probes this pattern for OpenID discovery.
+        const inPathWellKnown = url.pathname.match(/^\/proxy\/([^/]+)\/mcp\/\.well-known\/(.+)$/);
+        if (inPathWellKnown) {
+            const serverName = decodeURIComponent(inPathWellKnown[1]);
+            this.lastOAuthServerName = serverName;
+            await this.forwardOAuthDiscovery(inPathWellKnown[2], serverName, req, res);
+            return;
+        }
+        // Root-level OAuth requests: the MCP SDK constructs the authorization
+        // server URL as `new URL('/', serverUrl)` which strips the path, losing
+        // the server name. Forward these to the last server that triggered
+        // path-aware OAuth discovery.
+        const isRootOAuth = url.pathname.startsWith("/.well-known/")
+            || url.pathname === "/authorize"
+            || url.pathname === "/register"
+            || url.pathname === "/token"
+            || url.pathname.startsWith("/oauth/");
+        if (isRootOAuth) {
+            // For stdio servers, synthesize OAuth responses so Claude Code doesn't
+            // get stuck on "needs authentication". The proxy acts as a no-op OAuth
+            // server: it issues a dummy token that the SDK includes in POST headers,
+            // and the bridge ignores the Authorization header entirely.
+            if (this.lastOAuthServerName && this.callbacks.hasStdioUpstream(this.lastOAuthServerName)) {
+                await this.handleStdioOAuth(url, req, res);
+                return;
+            }
+            if (this.lastOAuthServerName) {
+                const upstreamUrl = this.callbacks.getUpstreamUrl(this.lastOAuthServerName);
+                if (upstreamUrl) {
+                    const upstreamOrigin = new URL(upstreamUrl).origin;
+                    const serverName = this.lastOAuthServerName;
+                    this.callbacks.log(`Root OAuth request ${url.pathname} -> forwarding to ${upstreamOrigin} (server: ${serverName})`);
+                    // /.well-known/oauth-authorization-server at root: fetch upstream
+                    // metadata and rewrite endpoints through forwardOAuthDiscovery.
+                    const rootWellKnown = url.pathname.match(/^\/\.well-known\/(.+)$/);
+                    if (rootWellKnown) {
+                        await this.forwardOAuthDiscovery(rootWellKnown[1], serverName, req, res);
+                        return;
+                    }
+                    // Look up the real upstream endpoint for this pathname. The upstream's
+                    // AS metadata may place /authorize, /token, /register at non-root
+                    // paths (e.g., betterstack serves /oauth/token).
+                    const endpoints = this.upstreamAsEndpoints.get(serverName);
+                    const upstreamEndpoint = endpoints
+                        ? (url.pathname === "/authorize" ? endpoints.authorization_endpoint
+                            : url.pathname === "/token" ? endpoints.token_endpoint
+                                : url.pathname === "/register" ? endpoints.registration_endpoint
+                                    : url.pathname === "/revoke" ? endpoints.revocation_endpoint
+                                        : url.pathname === "/introspect" ? endpoints.introspection_endpoint
+                                            : url.pathname === "/userinfo" ? endpoints.userinfo_endpoint
+                                                : undefined)
+                        : undefined;
+                    const target = upstreamEndpoint
+                        ? new URL(upstreamEndpoint)
+                        : new URL(`${upstreamOrigin}${url.pathname}`);
+                    // /authorize is browser-navigated; 302-redirect the browser to the
+                    // upstream's authorize endpoint with the `resource` param rewritten
+                    // from our proxy URL to the upstream's canonical resource URI.
+                    if (url.pathname === "/authorize") {
+                        const proxyResource = `http://localhost:${this.port}/proxy/${encodeURIComponent(serverName)}/mcp`;
+                        for (const [k, v] of url.searchParams) {
+                            target.searchParams.append(k, k === "resource" && v === proxyResource ? upstreamUrl : v);
+                        }
+                        res.writeHead(302, { Location: target.toString() });
+                        res.end();
+                        return;
+                    }
+                    await this.forwardRootOAuth(target.origin, target.pathname, url.search, req, res, serverName, upstreamUrl);
+                    return;
+                }
+            }
+            this.callbacks.log(`Root OAuth request ${url.pathname} -> no server context, returning 404`);
+            res.writeHead(404, { "Content-Type": "application/json" });
+            res.end(JSON.stringify({ error: "not_found" }));
             return;
         }
-        // Parse /proxy/{serverName}/mcp
-        const match = url.pathname.match(/^\/proxy\/([^/]+)\/mcp$/);
-        if (!match) {
+        // Parse /proxy/{serverName}/mcp (with optional trailing paths for future MCP extensions)
+        const proxyMatch = url.pathname.match(/^\/proxy\/([^/]+)\/mcp(\/.*)?$/);
+        if (!proxyMatch) {
             res.writeHead(404, { "Content-Type": "application/json" });
             res.end(JSON.stringify({ error: "Not found. Use /proxy/{serverName}/mcp" }));
             return;
         }
-        const serverName = decodeURIComponent(match[1]);
-        // Get or create session
-        const sessionId = req.headers["mcp-session-id"];
-        if (req.method === "GET" || req.method === "DELETE") {
-            // SSE or session termination: route to existing session
-            if (sessionId && this.sessions.has(sessionId)) {
-                // eslint-disable-next-line @typescript-eslint/no-non-null-assertion -- guarded by this.sessions.has(sessionId) above
-                const session = this.sessions.get(sessionId);
-                await session.transport.handleRequest(req, res);
-                if (req.method === "DELETE") {
-                    this.sessions.delete(sessionId);
-                }
-                return;
-            }
-            if (req.method === "DELETE") {
-                res.writeHead(200);
-                res.end();
-                return;
-            }
-            // GET without session: not valid
-            res.writeHead(400, { "Content-Type": "application/json" });
-            res.end(JSON.stringify({ error: "Session required for GET requests" }));
+        const serverName = decodeURIComponent(proxyMatch[1]);
+        const extraPath = proxyMatch[2] ?? "";
+        // Prefer the stdio bridge when the gateway has an active connection to
+        // the server. This bypasses OAuth discovery issues: the gateway already
+        // authenticated with the upstream, so the bridge reuses that connection.
+        // HTTP passthrough is only used when there's no gateway-level connection.
+        if (this.callbacks.hasStdioUpstream(serverName)) {
+            await this.bridgeToStdio(serverName, req, res);
             return;
         }
-        // POST: create new session or route to existing
-        if (sessionId && this.sessions.has(sessionId)) {
-            // eslint-disable-next-line @typescript-eslint/no-non-null-assertion -- guarded by this.sessions.has(sessionId) above
-            await this.sessions.get(sessionId).transport.handleRequest(req, res);
+        const upstreamUrl = this.callbacks.getUpstreamUrl(serverName);
+        if (!upstreamUrl) {
+            res.writeHead(502, { "Content-Type": "application/json" });
+            res.end(JSON.stringify({ error: `No upstream URL configured for server: ${serverName}` }));
             return;
         }
-        // New session: create a proxy MCP server for this server name.
-        // The session is created immediately (even if the upstream isn't connected
-        // yet) so the MCP handshake completes and Claude Code marks it as
-        // "connected". tools/list will return empty until the upstream connects,
-        // then we send toolListChanged.
-        const session = await this.createProxySession(serverName);
-        await session.transport.handleRequest(req, res);
+        await this.forwardMcpRequest(serverName, upstreamUrl, extraPath, req, res);
     }
     /**
-     * Forward OAuth protected resource metadata from the upstream server.
-     *
-     * The MCP SDK queries /.well-known/oauth-protected-resource{path} to discover
-     * where to send the user for authentication. We forward this from the real
-     * upstream (e.g., mcp.slack.com) but rewrite the `resource` field to match
-     * the proxy URL so the SDK's validation passes.
+     * Forward OAuth discovery requests to the upstream server.
+     * Rewrites the `resource` field in oauth-protected-resource responses
+     * to match the proxy URL so the SDK's validation passes.
      */
-    async handleOAuthDiscovery(url, res) {
-        // Extract server name from path suffix: /.well-known/oauth-protected-resource/proxy/{name}/mcp
-        const pathMatch = url.pathname.match(/^\/\.well-known\/oauth-protected-resource\/proxy\/([^/]+)\/mcp$/);
-        if (!pathMatch) {
-            res.writeHead(404);
-            res.end();
-            return;
-        }
-        const serverName = decodeURIComponent(pathMatch[1]);
-        const upstreamUrl = this.callbacks.getUpstreamUrl?.(serverName);
-        if (!upstreamUrl) {
-            res.writeHead(404);
-            res.end();
+    async forwardOAuthDiscovery(wellKnownType, serverName, _req, res) {
+        const upstreamUrl = this.callbacks.getUpstreamUrl(serverName);
+        const hasGatewayConnection = this.callbacks.hasStdioUpstream(serverName);
+        this.callbacks.log(`OAuth discovery: type=${wellKnownType}, server=${serverName}, upstream=${upstreamUrl ?? "STDIO"}, gatewayConnected=${hasGatewayConnection}`);
+        if (!upstreamUrl || hasGatewayConnection) {
+            // Server is bridged through the gateway (either stdio-only or HTTP with
+            // an active gateway connection). Synthesize OAuth responses so Claude
+            // Code's proactive auth flow succeeds and proceeds to the MCP POST,
+            // which the bridge handles using the gateway's own authenticated session.
+            if (wellKnownType === "oauth-protected-resource") {
+                const proxyUrl = `http://localhost:${this.port}/proxy/${encodeURIComponent(serverName)}/mcp`;
+                const synthesized = {
+                    resource: proxyUrl,
+                    authorization_servers: [`http://localhost:${this.port}`],
+                };
+                this.callbacks.log(`OAuth discovery: synthesized oauth-protected-resource for stdio server ${serverName}`);
+                res.writeHead(200, { "Content-Type": "application/json" });
+                res.end(JSON.stringify(synthesized));
+                return;
+            }
+            if (wellKnownType === "oauth-authorization-server" || wellKnownType === "openid-configuration") {
+                const metadata = this.buildStdioAuthServerMetadata();
+                this.callbacks.log(`OAuth discovery: synthesized ${wellKnownType} for stdio server ${serverName}`);
+                res.writeHead(200, { "Content-Type": "application/json" });
+                res.end(JSON.stringify(metadata));
+                return;
+            }
+            res.writeHead(404, { "Content-Type": "application/json" });
+            res.end(JSON.stringify({ error: "not_found" }));
             return;
         }
         try {
-            const upstreamOrigin = new URL(upstreamUrl).origin;
-            const discoveryUrl = `${upstreamOrigin}/.well-known/oauth-protected-resource`;
+            const upstream = new URL(upstreamUrl);
+            const upstreamOrigin = upstream.origin;
+            // RFC 9728: oauth-protected-resource is served at
+            // /.well-known/oauth-protected-resource{path}, where {path} is the
+            // resource's path (e.g., "/mcp" for https://mcp.sentry.dev/mcp).
+            // RFC 8414 oauth-authorization-server lives at origin root.
+            const pathSuffix = wellKnownType === "oauth-protected-resource"
+                ? upstream.pathname.replace(/\/$/, "")
+                : "";
+            const discoveryUrl = `${upstreamOrigin}/.well-known/${wellKnownType}${pathSuffix}`;
             const response = await fetch(discoveryUrl, {
                 headers: { Accept: "application/json" },
                 redirect: "follow",
             });
             if (!response.ok) {
+                // If the upstream doesn't support oauth-protected-resource, synthesize
+                // one. Without this, the SDK falls back to root-level discovery at
+                // http://localhost:{port}/.well-known/oauth-authorization-server which
+                // has no server name in the path and can't be routed.
+                //
+                // The synthesized response tells the SDK:
+                // 1. The resource is our proxy URL (passes checkResourceAllowed)
+                // 2. The authorization server is the upstream origin (direct auth)
+                if (wellKnownType === "oauth-protected-resource" && response.status === 404) {
+                    const synthesized = {
+                        resource: `http://localhost:${this.port}/proxy/${encodeURIComponent(serverName)}/mcp`,
+                        authorization_servers: [upstreamOrigin],
+                    };
+                    this.callbacks.log(`OAuth discovery: synthesized oauth-protected-resource for ${serverName}`);
+                    res.writeHead(200, { "Content-Type": "application/json" });
+                    res.end(JSON.stringify(synthesized));
+                    return;
+                }
                 res.writeHead(response.status);
                 res.end();
                 return;
             }
             const metadata = await response.json();
-            // Rewrite the resource field to match the proxy URL so the SDK's
-            // "protected resource does not match" validation passes
-            metadata.resource = `http://localhost:${this.port}/proxy/${encodeURIComponent(serverName)}/mcp`;
+            // Rewrite discovery so the client treats our proxy as both the resource
+            // and the authorization server. This lets the SDK's checkResourceAllowed
+            // pass (resource == server URL), while /authorize, /token, /register
+            // route through our proxy so we can rewrite `resource` to the upstream's
+            // canonical URI (RFC 8707) before forwarding.
+            if (wellKnownType === "oauth-protected-resource") {
+                metadata.resource = `http://localhost:${this.port}/proxy/${encodeURIComponent(serverName)}/mcp`;
+                metadata.authorization_servers = [`http://localhost:${this.port}`];
+            }
+            else if (wellKnownType === "oauth-authorization-server"
+                || wellKnownType === "openid-configuration") {
+                const proxyOrigin = `http://localhost:${this.port}`;
+                // Cache the real upstream endpoints so /authorize, /token, /register
+                // on our proxy can forward to their true locations (which may be at
+                // non-root paths like /oauth/token).
+                this.upstreamAsEndpoints.set(serverName, {
+                    authorization_endpoint: typeof metadata.authorization_endpoint === "string" ? metadata.authorization_endpoint : undefined,
+                    token_endpoint: typeof metadata.token_endpoint === "string" ? metadata.token_endpoint : undefined,
+                    registration_endpoint: typeof metadata.registration_endpoint === "string" ? metadata.registration_endpoint : undefined,
+                    revocation_endpoint: typeof metadata.revocation_endpoint === "string" ? metadata.revocation_endpoint : undefined,
+                    introspection_endpoint: typeof metadata.introspection_endpoint === "string" ? metadata.introspection_endpoint : undefined,
+                    userinfo_endpoint: typeof metadata.userinfo_endpoint === "string" ? metadata.userinfo_endpoint : undefined,
+                });
+                metadata.issuer = proxyOrigin;
+                metadata.authorization_endpoint = `${proxyOrigin}/authorize`;
+                metadata.token_endpoint = `${proxyOrigin}/token`;
+                metadata.registration_endpoint = `${proxyOrigin}/register`;
+                if (metadata.revocation_endpoint)
+                    metadata.revocation_endpoint = `${proxyOrigin}/revoke`;
+                if (metadata.introspection_endpoint)
+                    metadata.introspection_endpoint = `${proxyOrigin}/introspect`;
+                if (metadata.userinfo_endpoint)
+                    metadata.userinfo_endpoint = `${proxyOrigin}/userinfo`;
+            }
+            const body = JSON.stringify(metadata);
             res.writeHead(200, { "Content-Type": "application/json" });
-            res.end(JSON.stringify(metadata));
+            res.end(body);
         }
         catch {
             res.writeHead(502);
@@ -178,139 +357,519 @@ export class HttpProxyServer {
         }
     }
     /**
-     * Create a new MCP Server that proxies requests to an upstream Client.
-     * Each session gets its own Server + Transport pair.
-     *
-     * The session is created immediately even if the upstream isn't connected yet.
-     * tools/list returns empty tools in that case, and tool calls return errors.
-     * When the upstream connects, the gateway sends toolListChanged which triggers
-     * the client to re-fetch tools.
+     * Forward root-level OAuth requests (/token, /register) to the upstream.
+     * Rewrites the `resource` parameter from the proxy URL to the upstream's
+     * canonical resource URI (RFC 8707) so the upstream AS accepts the token
+     * request bound to the resource it knows about.
      */
-    async createProxySession(serverName) {
-        const callbacks = this.callbacks;
-        const server = new Server({
-            name: `sonoma-proxy-${serverName}`,
-            version: "0.1.0",
-        }, {
-            capabilities: {
-                tools: { listChanged: true },
-            },
-        });
-        // Proxy tools/list: forward to upstream client if connected, empty otherwise
-        server.setRequestHandler(ListToolsRequestSchema, async () => {
-            const upstream = callbacks.getUpstreams().get(serverName);
-            if (!upstream?.connected) {
-                return { tools: [] };
+    async forwardRootOAuth(upstreamOrigin, pathname, search, req, res, serverName, upstreamUrl) {
+        let targetSearch = search;
+        let body;
+        if (req.method === "POST") {
+            body = await readBody(req);
+        }
+        if (serverName && upstreamUrl) {
+            const proxyResource = `http://localhost:${this.port}/proxy/${encodeURIComponent(serverName)}/mcp`;
+            // Rewrite `resource` in query string.
+            if (targetSearch.includes("resource=")) {
+                const params = new URLSearchParams(targetSearch);
+                if (params.get("resource") === proxyResource) {
+                    params.set("resource", upstreamUrl);
+                    targetSearch = `?${params.toString()}`;
+                }
+            }
+            // Rewrite `resource` in form-urlencoded body (e.g., /token exchange).
+            if (body) {
+                const contentType = String(req.headers["content-type"] ?? "");
+                if (contentType.includes("application/x-www-form-urlencoded")) {
+                    const params = new URLSearchParams(body.toString());
+                    if (params.get("resource") === proxyResource) {
+                        params.set("resource", upstreamUrl);
+                        body = Buffer.from(params.toString());
+                    }
+                }
             }
+        }
+        const targetUrl = `${upstreamOrigin}${pathname}${targetSearch}`;
+        const forwardHeaders = {};
+        for (const [key, value] of Object.entries(req.headers)) {
+            if (key === "host" || key === "connection" || key === "transfer-encoding" || key === "content-length")
+                continue;
+            if (value) {
+                forwardHeaders[key] = Array.isArray(value) ? value.join(", ") : value;
+            }
+        }
+        // Prevent compressed responses (e.g., zstd from Cloudflare) that the
+        // SDK's fetch may not decompress, causing JSON parse failures
+        forwardHeaders["accept-encoding"] = "identity";
+        try {
+            const response = await fetch(targetUrl, {
+                method: req.method ?? "GET",
+                headers: forwardHeaders,
+                body: body ? new Uint8Array(body) : undefined,
+                redirect: "follow",
+            });
+            const responseHeaders = {};
+            response.headers.forEach((value, key) => {
+                if (key === "transfer-encoding" || key === "connection")
+                    return;
+                if (key === "content-encoding")
+                    return;
+                responseHeaders[key] = value;
+            });
+            const responseBody = new Uint8Array(await response.arrayBuffer());
+            res.writeHead(response.status, responseHeaders);
+            res.end(responseBody);
+        }
+        catch {
+            res.writeHead(502);
+            res.end();
+        }
+    }
+    /**
+     * Build synthetic OAuth authorization server metadata for stdio-bridged servers.
+     * Points all OAuth endpoints back to this proxy so the full flow completes locally.
+     */
+    buildStdioAuthServerMetadata() {
+        const issuer = `http://localhost:${this.port}`;
+        return {
+            issuer,
+            authorization_endpoint: `${issuer}/authorize`,
+            token_endpoint: `${issuer}/token`,
+            registration_endpoint: `${issuer}/register`,
+            response_types_supported: ["code"],
+            grant_types_supported: ["authorization_code", "client_credentials", "refresh_token"],
+            token_endpoint_auth_methods_supported: ["client_secret_post", "none"],
+            code_challenge_methods_supported: ["S256"],
+        };
+    }
+    /**
+     * Handle OAuth endpoints for stdio-bridged servers.
+     * Synthesizes valid responses so Claude Code's proactive auth flow succeeds
+     * without requiring actual user authentication. The bridge ignores the
+     * Authorization header, so the dummy token is harmless.
+     */
+    async handleStdioOAuth(url, req, res) {
+        this.callbacks.log(`Stdio OAuth: ${req.method} ${url.pathname}`);
+        // .well-known discovery at root level
+        if (url.pathname === "/.well-known/oauth-authorization-server"
+            || url.pathname === "/.well-known/openid-configuration") {
+            const metadata = this.buildStdioAuthServerMetadata();
+            res.writeHead(200, { "Content-Type": "application/json" });
+            res.end(JSON.stringify(metadata));
+            return;
+        }
+        if (url.pathname === "/.well-known/oauth-protected-resource") {
+            // Return protected resource metadata pointing to this proxy
+            const synthesized = {
+                resource: `http://localhost:${this.port}`,
+                authorization_servers: [`http://localhost:${this.port}`],
+            };
+            res.writeHead(200, { "Content-Type": "application/json" });
+            res.end(JSON.stringify(synthesized));
+            return;
+        }
+        // Dynamic client registration: return a valid client_id
+        if (url.pathname === "/register" && req.method === "POST") {
+            const body = await readBody(req);
+            let clientMetadata = {};
             try {
-                const result = await upstream.client.listTools();
-                return { tools: result.tools };
+                clientMetadata = JSON.parse(body.toString());
             }
-            catch (error) {
-                callbacks.log(`Failed to list tools from ${serverName}: ${error}`);
-                return { tools: [] };
+            catch {
+                // Use defaults
             }
-        });
-        // Proxy tools/call: check policy, forward to upstream, record telemetry
-        server.setRequestHandler(CallToolRequestSchema, async (request) => {
-            const { name: toolName, arguments: args } = request.params;
-            const startTime = Date.now();
-            // Check policy before forwarding
-            if (callbacks.isToolBlocked(serverName, toolName)) {
-                callbacks.recordToolCall({
-                    serverName,
-                    toolName,
-                    durationMs: Date.now() - startTime,
-                    status: "blocked",
-                    argumentKeys: args ? Object.keys(args) : [],
-                });
-                return {
-                    isError: true,
-                    content: [
-                        {
-                            type: "text",
-                            text: `Tool ${serverName}.${toolName} is blocked by organization policy`,
-                        },
-                    ],
-                };
+            const clientId = `stdio-bridge-${Date.now()}`;
+            const registration = {
+                client_id: clientId,
+                client_name: clientMetadata.client_name ?? "stdio-bridge-client",
+                redirect_uris: clientMetadata.redirect_uris ?? [],
+                grant_types: ["authorization_code", "client_credentials", "refresh_token"],
+                response_types: ["code"],
+                token_endpoint_auth_method: "none",
+            };
+            this.callbacks.log(`Stdio OAuth: registered client ${clientId}`);
+            res.writeHead(200, { "Content-Type": "application/json" });
+            res.end(JSON.stringify(registration));
+            return;
+        }
+        // Token endpoint: issue a long-lived dummy token with a refresh token.
+        // Real auth is handled by the gateway's upstream OAuth; these tokens are
+        // placeholders so the MCP SDK has something to send in Authorization
+        // headers. The bridge ignores them. A refresh_token is included so
+        // Claude Code's UI treats the session as durably authenticated and
+        // doesn't flip to "not authenticated" when the access token expires.
+        if (url.pathname === "/token" && req.method === "POST") {
+            const tokenResponse = {
+                access_token: `stdio-bridge-token-${Date.now()}`,
+                token_type: "Bearer",
+                expires_in: 315_360_000,
+                refresh_token: `stdio-bridge-refresh-${Date.now()}`,
+                scope: "mcp",
+            };
+            this.callbacks.log("Stdio OAuth: issued dummy token");
+            res.writeHead(200, { "Content-Type": "application/json" });
+            res.end(JSON.stringify(tokenResponse));
+            return;
+        }
+        // Authorization endpoint: redirect back with an auth code immediately.
+        // Claude Code opens this in a browser; we redirect to the callback with
+        // a synthetic code that the token endpoint will accept.
+        if (url.pathname === "/authorize") {
+            const redirectUri = url.searchParams.get("redirect_uri");
+            const state = url.searchParams.get("state");
+            if (redirectUri) {
+                const callbackUrl = new URL(redirectUri);
+                callbackUrl.searchParams.set("code", `stdio-auth-code-${Date.now()}`);
+                if (state)
+                    callbackUrl.searchParams.set("state", state);
+                this.callbacks.log(`Stdio OAuth: redirecting to ${callbackUrl.origin}${callbackUrl.pathname}`);
+                res.writeHead(302, { Location: callbackUrl.toString() });
+                res.end();
+                return;
             }
-            const upstream = callbacks.getUpstreams().get(serverName);
-            if (!upstream?.connected) {
-                return {
-                    isError: true,
-                    content: [
-                        {
-                            type: "text",
-                            text: `Server ${serverName} is not connected yet. Please wait for the connection to be established.`,
+        }
+        // Fallback
+        res.writeHead(404, { "Content-Type": "application/json" });
+        res.end(JSON.stringify({ error: "not_found" }));
+    }
+    /**
+     * Bridge an HTTP MCP request to a stdio upstream via JSON-RPC.
+     *
+     * For command-based (stdio) servers that have no HTTP URL, we parse the
+     * incoming JSON-RPC request, forward it through the gateway's MCP Client
+     * connection, and return the response as HTTP.
+     *
+     * Handles: initialize, tools/list, tools/call, resources/list, etc.
+     * Also synthesizes MCP server metadata for the initial handshake.
+     */
+    async bridgeToStdio(serverName, req, res) {
+        // GET requests: the SDK sends GET with Accept: text/event-stream to open
+        // an SSE stream for server-initiated messages. Stdio servers don't push
+        // server-initiated messages, but some clients (Claude Code's /mcp status
+        // UI) treat a 405 response as a failed connection. Return an empty,
+        // long-lived SSE stream instead: 200 with Content-Type text/event-stream,
+        // keep-alive comments, and close when the client disconnects.
+        if (req.method === "GET") {
+            res.writeHead(200, {
+                "Content-Type": "text/event-stream",
+                "Cache-Control": "no-cache, no-transform",
+                "Connection": "keep-alive",
+            });
+            res.write(":ok\n\n");
+            const keepAlive = setInterval(() => {
+                if (!res.writableEnded)
+                    res.write(":keepalive\n\n");
+            }, 30_000);
+            const cleanup = () => {
+                clearInterval(keepAlive);
+                if (!res.writableEnded)
+                    res.end();
+            };
+            req.on("close", cleanup);
+            req.on("error", cleanup);
+            return;
+        }
+        if (req.method === "DELETE") {
+            // Session cleanup: no-op for stdio
+            res.writeHead(200);
+            res.end();
+            return;
+        }
+        // POST: parse JSON-RPC body
+        const body = await readBody(req);
+        let jsonRpc;
+        try {
+            jsonRpc = JSON.parse(body.toString());
+        }
+        catch {
+            res.writeHead(400, { "Content-Type": "application/json" });
+            res.end(JSON.stringify({ jsonrpc: "2.0", error: { code: -32700, message: "Parse error" }, id: null }));
+            return;
+        }
+        const requests = Array.isArray(jsonRpc) ? jsonRpc : [jsonRpc];
+        const responses = [];
+        for (const rpcReq of requests) {
+            const { method, params, id } = rpcReq;
+            // Policy enforcement for tools/call
+            if (method === "tools/call" && params) {
+                const p = params;
+                const toolName = p.name ?? "unknown";
+                if (this.callbacks.isToolBlocked(serverName, toolName)) {
+                    this.callbacks.recordToolCall({
+                        serverName,
+                        toolName,
+                        durationMs: 0,
+                        status: "blocked",
+                        argumentKeys: p.arguments ? Object.keys(p.arguments) : [],
+                    });
+                    responses.push({
+                        jsonrpc: "2.0",
+                        id: id ?? null,
+                        result: {
+                            isError: true,
+                            content: [{ type: "text", text: `Tool ${serverName}.${toolName} is blocked by organization policy` }],
                         },
-                    ],
-                };
+                    });
+                    continue;
+                }
             }
+            const startTime = Date.now();
             try {
-                const callPromise = upstream.client.callTool({
-                    name: toolName,
-                    arguments: args,
-                });
-                const callTimeout = new Promise((_, reject) => {
-                    setTimeout(() => reject(new Error(`Tool call timeout after ${TOOL_CALL_TIMEOUT_MS}ms`)), TOOL_CALL_TIMEOUT_MS);
-                });
-                const result = await Promise.race([callPromise, callTimeout]);
-                callbacks.recordToolCall({
-                    serverName,
-                    toolName,
-                    durationMs: Date.now() - startTime,
-                    status: "success",
-                    argumentKeys: args ? Object.keys(args) : [],
-                });
-                return result;
+                const result = await this.callbacks.forwardJsonRpc(serverName, method, params);
+                const durationMs = Date.now() - startTime;
+                // Record telemetry for tools/call
+                if (method === "tools/call" && params) {
+                    const p = params;
+                    this.callbacks.recordToolCall({
+                        serverName,
+                        toolName: p.name ?? "unknown",
+                        durationMs,
+                        status: result.error ? "error" : "success",
+                        argumentKeys: p.arguments ? Object.keys(p.arguments) : [],
+                        ...(result.error ? { errorMessage: result.error.message } : {}),
+                    });
+                }
+                if (result.error) {
+                    responses.push({ jsonrpc: "2.0", id: id ?? null, error: result.error });
+                }
+                else {
+                    responses.push({ jsonrpc: "2.0", id: id ?? null, result: result.result });
+                }
             }
             catch (error) {
+                const durationMs = Date.now() - startTime;
                 const errorMessage = error instanceof Error ? error.message : String(error);
-                callbacks.recordToolCall({
-                    serverName,
-                    toolName,
-                    durationMs: Date.now() - startTime,
-                    status: "error",
-                    errorMessage,
-                    argumentKeys: args ? Object.keys(args) : [],
+                if (method === "tools/call" && params) {
+                    const p = params;
+                    this.callbacks.recordToolCall({
+                        serverName,
+                        toolName: p.name ?? "unknown",
+                        durationMs,
+                        status: "error",
+                        errorMessage,
+                        argumentKeys: p.arguments ? Object.keys(p.arguments) : [],
+                    });
+                }
+                responses.push({
+                    jsonrpc: "2.0",
+                    id: id ?? null,
+                    error: { code: -32603, message: errorMessage },
                 });
-                return {
+            }
+        }
+        // If all messages are notifications (no id), return 202 Accepted (no body).
+        // The SDK expects 202 for notifications and only processes JSON for requests.
+        const allNotifications = requests.every((r) => r.id === undefined || r.id === null);
+        if (allNotifications) {
+            res.writeHead(202);
+            res.end();
+            return;
+        }
+        const responseBody = Array.isArray(jsonRpc) ? responses : responses[0];
+        res.writeHead(200, { "Content-Type": "application/json" });
+        res.end(JSON.stringify(responseBody));
+    }
+    /**
+     * Forward an MCP request to the upstream server.
+     * For POST requests, parses the JSON-RPC body to detect tools/call for
+     * policy enforcement and telemetry. All other requests pass through as-is.
+     */
+    async forwardMcpRequest(serverName, upstreamUrl, extraPath, req, res) {
+        // Build upstream target URL
+        const targetUrl = extraPath ? `${upstreamUrl}${extraPath}` : upstreamUrl;
+        // Read request body for POST (needed for JSON-RPC parsing)
+        let requestBody;
+        if (req.method === "POST") {
+            requestBody = await readBody(req);
+        }
+        // Parse JSON-RPC to detect tools/call for policy and telemetry
+        let toolCallInfo;
+        let blocked = false;
+        if (requestBody) {
+            try {
+                const jsonRpc = JSON.parse(requestBody.toString());
+                // Handle both single requests and batches
+                const requests = Array.isArray(jsonRpc) ? jsonRpc : [jsonRpc];
+                for (const rpcReq of requests) {
+                    if (rpcReq.method === "tools/call" && rpcReq.params) {
+                        const params = rpcReq.params;
+                        const toolName = params.name ?? "unknown";
+                        const argumentKeys = params.arguments ? Object.keys(params.arguments) : [];
+                        toolCallInfo = { toolName, argumentKeys };
+                        // Check policy before forwarding
+                        if (this.callbacks.isToolBlocked(serverName, toolName)) {
+                            blocked = true;
+                            this.callbacks.recordToolCall({
+                                serverName,
+                                toolName,
+                                durationMs: 0,
+                                status: "blocked",
+                                argumentKeys,
+                            });
+                        }
+                    }
+                }
+            }
+            catch {
+                // Not valid JSON or not JSON-RPC; forward as-is
+            }
+        }
+        // If tool is blocked by policy, return an MCP error response without forwarding
+        if (blocked && toolCallInfo) {
+            const errorResponse = {
+                jsonrpc: "2.0",
+                id: extractRequestId(requestBody),
+                result: {
                     isError: true,
                     content: [
                         {
                             type: "text",
-                            text: `Error calling ${serverName}.${toolName}: ${errorMessage}`,
+                            text: `Tool ${serverName}.${toolCallInfo.toolName} is blocked by organization policy`,
                         },
                     ],
+                },
+            };
+            res.writeHead(200, { "Content-Type": "application/json" });
+            res.end(JSON.stringify(errorResponse));
+            return;
+        }
+        // Forward the request to upstream
+        const startTime = Date.now();
+        // Build headers for upstream request
+        const forwardHeaders = {};
+        for (const [key, value] of Object.entries(req.headers)) {
+            // Skip hop-by-hop headers and host
+            if (key === "host" || key === "connection" || key === "transfer-encoding")
+                continue;
+            if (value) {
+                forwardHeaders[key] = Array.isArray(value) ? value.join(", ") : value;
+            }
+        }
+        // Prevent compressed responses (e.g., Brotli from Cloudflare) that fetch()
+        // auto-decompresses but whose content-encoding header would confuse the client
+        forwardHeaders["accept-encoding"] = "identity";
+        try {
+            const upstreamResponse = await fetch(targetUrl, {
+                method: req.method ?? "GET",
+                headers: forwardHeaders,
+                body: requestBody ? new Uint8Array(requestBody) : undefined,
+                redirect: "follow",
+            });
+            // Record telemetry for tool calls
+            if (toolCallInfo) {
+                const durationMs = Date.now() - startTime;
+                const status = upstreamResponse.ok ? "success" : "error";
+                this.callbacks.recordToolCall({
+                    serverName,
+                    toolName: toolCallInfo.toolName,
+                    durationMs,
+                    status,
+                    argumentKeys: toolCallInfo.argumentKeys,
+                    ...(status === "error" ? { errorMessage: `HTTP ${upstreamResponse.status}` } : {}),
+                });
+            }
+            // Forward response status and headers
+            const responseHeaders = {};
+            upstreamResponse.headers.forEach((value, key) => {
+                // Skip hop-by-hop headers
+                if (key === "transfer-encoding" || key === "connection")
+                    return;
+                // Strip content-encoding since we requested identity (fetch auto-decompresses)
+                if (key === "content-encoding")
+                    return;
+                responseHeaders[key] = value;
+            });
+            // On 401, rewrite resource_metadata in WWW-Authenticate to point to our
+            // path-aware discovery endpoint. Without this, the SDK uses the upstream's
+            // resource_metadata URL, discovers auth at the upstream origin, then falls
+            // back to root-level /.well-known/ on our proxy (which has no server name
+            // and can't be routed).
+            if (upstreamResponse.status === 401) {
+                const proxyResourceMetadata = `http://localhost:${this.port}/.well-known/oauth-protected-resource/proxy/${encodeURIComponent(serverName)}/mcp`;
+                const existingAuth = responseHeaders["www-authenticate"] ?? "";
+                if (existingAuth.toLowerCase().startsWith("bearer")) {
+                    // Replace any existing resource_metadata with our proxy URL
+                    const rewritten = existingAuth.replace(/resource_metadata="[^"]*"/g, `resource_metadata="${proxyResourceMetadata}"`);
+                    // If there was no resource_metadata to replace, append it
+                    responseHeaders["www-authenticate"] = rewritten.includes("resource_metadata=")
+                        ? rewritten
+                        : `${existingAuth}, resource_metadata="${proxyResourceMetadata}"`;
+                }
+                else {
+                    responseHeaders["www-authenticate"] = `Bearer resource_metadata="${proxyResourceMetadata}"`;
+                }
+            }
+            // Check if this is an SSE response (streaming)
+            const contentType = upstreamResponse.headers.get("content-type") ?? "";
+            const isSSE = contentType.includes("text/event-stream");
+            res.writeHead(upstreamResponse.status, responseHeaders);
+            if (isSSE && upstreamResponse.body) {
+                // Stream SSE responses through as-is
+                const reader = upstreamResponse.body.getReader();
+                const pump = async () => {
+                    while (true) {
+                        const { done, value } = await reader.read();
+                        if (done)
+                            break;
+                        const canContinue = res.write(value);
+                        if (!canContinue) {
+                            await new Promise((resolve) => res.once("drain", resolve));
+                        }
+                    }
+                    res.end();
                 };
+                // If client disconnects, cancel the upstream stream
+                req.on("close", () => {
+                    reader.cancel().catch(() => { });
+                });
+                await pump();
             }
-        });
-        const transport = new StreamableHTTPServerTransport({
-            sessionIdGenerator: () => randomUUID(),
-        });
-        // Track session by ID once the transport assigns one
-        transport.onclose = () => {
-            if (transport.sessionId) {
-                this.sessions.delete(transport.sessionId);
+            else if (upstreamResponse.body) {
+                // Buffer non-streaming responses
+                const body = new Uint8Array(await upstreamResponse.arrayBuffer());
+                res.end(body);
             }
-        };
-        await server.connect(transport);
-        const session = { server, transport, serverName };
-        // Store session after transport is connected (sessionId is set during handleRequest)
-        // We'll store it by the transport's sessionId after the first request
-        if (transport.sessionId) {
-            this.sessions.set(transport.sessionId, session);
-        }
-        // Also set up a hook to store the session once the ID is assigned
-        const origHandleRequest = transport.handleRequest.bind(transport);
-        transport.handleRequest = async (req, res, body) => {
-            await origHandleRequest(req, res, body);
-            if (transport.sessionId && !this.sessions.has(transport.sessionId)) {
-                this.sessions.set(transport.sessionId, session);
-                callbacks.log(`HTTP proxy session created: ${transport.sessionId} -> ${serverName}`);
+            else {
+                res.end();
             }
-        };
-        return session;
+        }
+        catch (error) {
+            // Record telemetry for failed tool calls
+            if (toolCallInfo) {
+                this.callbacks.recordToolCall({
+                    serverName,
+                    toolName: toolCallInfo.toolName,
+                    durationMs: Date.now() - startTime,
+                    status: "error",
+                    errorMessage: error instanceof Error ? error.message : String(error),
+                    argumentKeys: toolCallInfo.argumentKeys,
+                });
+            }
+            this.callbacks.log(`Proxy error for ${serverName}: ${error instanceof Error ? error.message : error}`);
+            res.writeHead(502, { "Content-Type": "application/json" });
+            res.end(JSON.stringify({ error: "Failed to reach upstream server" }));
+        }
+    }
+}
+function readBody(req) {
+    return new Promise((resolve, reject) => {
+        const chunks = [];
+        req.on("data", (chunk) => chunks.push(chunk));
+        req.on("end", () => resolve(Buffer.concat(chunks)));
+        req.on("error", reject);
+    });
+}
+function extractRequestId(body) {
+    if (!body)
+        return null;
+    try {
+        const parsed = JSON.parse(body.toString());
+        const first = Array.isArray(parsed) ? parsed[0] : parsed;
+        return first?.id ?? null;
+    }
+    catch {
+        return null;
     }
 }
 //# sourceMappingURL=http-proxy.js.map