@suveren/gateway 0.19.1 → 0.19.2

package/bin/suveren-gateway.js

@@ -1610,6 +1610,10 @@ Environment:
   SUVEREN_DATA_DIR    Data directory (default ~/.suveren) — overrides a saved \`config set data-dir\`
   SUVEREN_AS_URL      Authority Server URL — overrides the saved as-url
   SUVEREN_SIMULATION  1 to force simulation mode for this run — overrides the saved setting
+  SUVEREN_BIND_HOST   Listen address (default 127.0.0.1 — this machine only). Anything
+                      else lets other machines connect as your agent, so it needs:
+  SUVEREN_MCP_TOKEN   Token an AI assistant must send to open a session
+                      (Authorization: Bearer <token>, or ?token=<token>)
   HTTP_PROXY / HTTPS_PROXY / NO_PROXY (upper or lower case)
                       Corporate proxy — honoured for every outbound call to the Authority
                       Server, the update checker, and a remote AI assistant endpoint. A

package/content/integrations/erp.json

@@ -9,7 +9,8 @@
   "npmVersion": "0.4.0",
   "mcp": {
     "command": "erp-mcp",
-    "args": []
+    "args": [],
+    "passEnv": ["ERP_COMPANY_FILE"]
   },
   "credentials": {
     "fields": [

package/dist/control-plane/index.mjs

@@ -5045,8 +5045,9 @@ if (existsSync11(UI_DIST)) {
     });
   });
 }
-app.listen(port, "0.0.0.0", () => {
-  console.error(`[Control Plane] Listening on http://0.0.0.0:${port}`);
+var bindHost = process.env.SUVEREN_BIND_HOST?.trim() || "127.0.0.1";
+app.listen(port, bindHost, () => {
+  console.error(`[Control Plane] Listening on http://${bindHost}:${port}`);
   if (process.env.SUVEREN_AUTOSTART === "1" && !vault.isUnlocked()) {
     const { title, message, url } = lockedNotification(port);
     notify(title, message, process.platform, url);

package/dist/mcp-server/http.mjs

@@ -5192,6 +5192,60 @@ function safeHost(url) {
   }
 }
 
+// src/lib/connector-env.ts
+var RUNTIME_VARS = [
+  // POSIX
+  "HOME",
+  "USER",
+  "LOGNAME",
+  "SHELL",
+  "TERM",
+  "TMPDIR",
+  "LANG",
+  "LC_ALL",
+  "LC_CTYPE",
+  "TZ",
+  "XDG_CONFIG_HOME",
+  "XDG_DATA_HOME",
+  "XDG_CACHE_HOME",
+  "XDG_RUNTIME_DIR",
+  // Windows (names are case-insensitive there; matched case-insensitively below)
+  "APPDATA",
+  "LOCALAPPDATA",
+  "USERPROFILE",
+  "USERNAME",
+  "HOMEDRIVE",
+  "HOMEPATH",
+  "SYSTEMROOT",
+  "SYSTEMDRIVE",
+  "WINDIR",
+  "COMSPEC",
+  "PATHEXT",
+  "TEMP",
+  "TMP",
+  "PROGRAMFILES",
+  "PROGRAMFILES(X86)",
+  "PROGRAMDATA",
+  "PROCESSOR_ARCHITECTURE",
+  "NUMBER_OF_PROCESSORS"
+];
+var NETWORK_VARS = [
+  "HTTP_PROXY",
+  "HTTPS_PROXY",
+  "NO_PROXY",
+  "NODE_EXTRA_CA_CERTS",
+  "SSL_CERT_FILE"
+];
+function inheritedConnectorEnv(parent, passEnv = []) {
+  const allowed = new Set([...RUNTIME_VARS, ...NETWORK_VARS, ...passEnv].map((n) => n.toUpperCase()));
+  const out = {};
+  for (const [name, value] of Object.entries(parent)) {
+    if (value === void 0) continue;
+    if (allowed.has(name.toUpperCase())) out[name] = value;
+  }
+  return out;
+}
+
 // src/lib/integration-manager.ts
 var DEFAULT_DATA_DIR2 = process.env.SUVEREN_DATA_DIR ?? join14(homedir10(), ".suveren");
 var INTEGRATIONS_DIR = process.env.SUVEREN_INTEGRATIONS_DIR ?? join14(DEFAULT_DATA_DIR2, "integrations");
@@ -5585,7 +5639,8 @@ var IntegrationManager = class {
         if (envVar) env[envVar] = "simulation";
       }
     }
-    const interpolate = (s) => s.replace(/\$\{([A-Za-z_][A-Za-z0-9_]*)\}/g, (_m, name) => env[name] ?? process.env[name] ?? "");
+    const inherited = inheritedConnectorEnv(process.env, getManifest(config.id)?.mcp.passEnv);
+    const interpolate = (s) => s.replace(/\$\{([A-Za-z_][A-Za-z0-9_]*)\}/g, (_m, name) => env[name] ?? inherited[name] ?? "");
     const args = config.args.map(interpolate);
     const remote = remotePreflightTarget(config.command, args);
     if (remote) {
@@ -5595,13 +5650,13 @@ var IntegrationManager = class {
     const transport = new StdioClientTransport({
       command: config.command,
       args,
-      // `...process.env` is also how a saved `--ca-file` reaches an
-      // integration: NODE_EXTRA_CA_CERTS (read by Node only at process
-      // start) is already set on THIS process by bundle/server.js before
-      // the MCP server ever starts, so every integration this manager spawns
-      // inherits it here for free — no separate handling needed.
+      // Only an allowlist of the gateway's environment — never its own
+      // secrets (connector-env.ts). The allowlist includes
+      // NODE_EXTRA_CA_CERTS, which is how a saved `--ca-file` reaches an
+      // integration: bundle/server.js sets it on THIS process before the MCP
+      // server starts, and Node reads it only at process start.
       env: {
-        ...process.env,
+        ...inherited,
         PATH: buildPath(),
         HAP_DATA_DIR: DEFAULT_DATA_DIR2,
         ...config.env,
@@ -6275,6 +6330,73 @@ async function scopeReportSourcesToStoredWindow(base, stored, opts) {
   return { ok: true, window, sources: scopedSources(base, window, loadedAt) };
 }
 
+// src/lib/agent-access.ts
+import { timingSafeEqual } from "crypto";
+var DEFAULT_BIND_HOST = "127.0.0.1";
+function resolveBindHost(env = process.env) {
+  const raw = env.SUVEREN_BIND_HOST?.trim();
+  return raw ? raw : DEFAULT_BIND_HOST;
+}
+function isLoopbackBind(host) {
+  const h = host.replace(/^\[|\]$/g, "").toLowerCase();
+  return h === "localhost" || h === "::1" || /^127\.\d{1,3}\.\d{1,3}\.\d{1,3}$/.test(h);
+}
+function resolveAgentToken(env = process.env) {
+  return env.SUVEREN_MCP_TOKEN?.trim() ?? "";
+}
+function bindRefusal(env = process.env) {
+  const host = resolveBindHost(env);
+  if (isLoopbackBind(host)) return null;
+  if (resolveAgentToken(env)) return null;
+  if (env.SUVEREN_CONTAINER === "1") return null;
+  return `SUVEREN_BIND_HOST=${host} would let other machines connect as this person's agent, but SUVEREN_MCP_TOKEN is not set. Set a token (long and random), or remove SUVEREN_BIND_HOST to listen on this machine only.`;
+}
+function hostnameOf(hostHeader) {
+  const trimmed = hostHeader.trim().toLowerCase();
+  const bracketed = trimmed.match(/^\[([^\]]+)\](?::\d+)?$/);
+  if (bracketed) return bracketed[1];
+  return trimmed.replace(/:\d+$/, "");
+}
+function isLocalHost(hostHeader) {
+  if (!hostHeader) return false;
+  const name = hostnameOf(hostHeader);
+  if (name === "localhost" || name.endsWith(".localhost")) return true;
+  if (/^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$/.test(name)) return true;
+  if (name.includes(":")) return true;
+  return false;
+}
+function presentedToken(req) {
+  const auth = req.headers.authorization;
+  if (typeof auth === "string") {
+    const m = auth.match(/^Bearer\s+(.+)$/i);
+    if (m) return m[1].trim();
+  }
+  const q = req.query.token;
+  return typeof q === "string" ? q : "";
+}
+function sameToken(a, b) {
+  const ab = Buffer.from(a);
+  const bb = Buffer.from(b);
+  return ab.length === bb.length && timingSafeEqual(ab, bb);
+}
+function agentAccess(token, opensSession) {
+  return (req, res, next) => {
+    if (!token) {
+      if (!isLocalHost(req.headers.host)) {
+        res.status(403).json({ error: "Forbidden host" });
+        return;
+      }
+      next();
+      return;
+    }
+    if (opensSession(req) && !sameToken(presentedToken(req), token)) {
+      res.status(401).json({ error: "Missing or wrong gateway token" });
+      return;
+    }
+    next();
+  };
+}
+
 // src/lib/profile-loader.ts
 import { readFileSync as readFileSync16, existsSync as existsSync15 } from "fs";
 import { join as join15, resolve as resolve2 } from "path";
@@ -7008,6 +7130,13 @@ var dataDir = process.env.SUVEREN_DATA_DIR ?? join19(homedir11(), ".suveren");
 var spUrl = resolveAsUrl(dataDir);
 validatePinTlsForUrl(resolvePinTls(dataDir), spUrl);
 var port = parseInt(process.env.SUVEREN_MCP_PORT ?? "3430", 10);
+var bindHost = resolveBindHost();
+var agentToken = resolveAgentToken();
+var bindProblem = bindRefusal();
+if (bindProblem) {
+  console.error(`[Suveren MCP] Refusing to start: ${bindProblem}`);
+  process.exit(1);
+}
 setAsBaseUrl(spUrl);
 var state = new SharedState(spUrl, void 0, dataDir);
 var reportSources = {
@@ -7051,16 +7180,6 @@ integrationManager.setOnConfigMigrated((id, updates) => {
 });
 var app = express();
 app.use(express.json());
-app.use((_req, res, next) => {
-  res.header("Access-Control-Allow-Origin", "http://localhost:3000");
-  res.header("Access-Control-Allow-Methods", "GET, POST, DELETE, OPTIONS");
-  res.header("Access-Control-Allow-Headers", "Content-Type, mcp-session-id");
-  if (_req.method === "OPTIONS") {
-    res.sendStatus(204);
-    return;
-  }
-  next();
-});
 var INTERNAL_SECRET = process.env.SUVEREN_INTERNAL_SECRET ?? "";
 function internalOnly(req, res, next) {
   const ip = req.ip ?? req.socket.remoteAddress ?? "";
@@ -7296,7 +7415,11 @@ app.post("/internal/stop-all-running", internalOnly, async (_req, res) => {
   }
 });
 var sseSessions = /* @__PURE__ */ new Map();
-app.get("/sse", async (_req, res) => {
+var guardAgent = agentAccess(
+  agentToken,
+  (req) => req.path === "/sse" && req.method === "GET" || req.path === "/mcp" && req.method === "POST" && !req.headers["mcp-session-id"]
+);
+app.get("/sse", guardAgent, async (_req, res) => {
   const transport = new SSEServerTransport("/messages", res);
   const { server, refreshTools, registerProxiedTools } = createMcpServer(state, integrationManager);
   const sessionId = transport.sessionId;
@@ -7308,12 +7431,9 @@ app.get("/sse", async (_req, res) => {
     activeSessions.delete(sessionId);
     console.error(`[Suveren MCP] SSE session ${sessionId} closed`);
   });
-  server.registerTool("debug_test_tool", { description: "Debug test" }, async () => ({
-    content: [{ type: "text", text: "debug" }]
-  }));
   await server.connect(transport);
 });
-app.post("/messages", async (req, res) => {
+app.post("/messages", guardAgent, async (req, res) => {
   const sessionId = req.query.sessionId;
   const transport = sseSessions.get(sessionId);
   if (!transport) {
@@ -7323,7 +7443,7 @@ app.post("/messages", async (req, res) => {
   await transport.handlePostMessage(req, res, req.body);
 });
 var streamableSessions = /* @__PURE__ */ new Map();
-app.all("/mcp", async (req, res) => {
+app.all("/mcp", guardAgent, async (req, res) => {
   const sessionId = req.headers["mcp-session-id"];
   if (req.method === "GET" || req.method === "POST" || req.method === "DELETE") {
     if (sessionId && streamableSessions.has(sessionId)) {
@@ -7642,10 +7762,11 @@ process.on("SIGINT", async () => {
   await integrationManager.shutdown();
   process.exit(0);
 });
-app.listen(port, "0.0.0.0", () => {
-  console.error(`[Suveren MCP] HTTP server listening on http://0.0.0.0:${port}`);
-  console.error(`[Suveren MCP]   SSE:        http://0.0.0.0:${port}/sse`);
-  console.error(`[Suveren MCP]   Streamable: http://0.0.0.0:${port}/mcp`);
+app.listen(port, bindHost, () => {
+  console.error(`[Suveren MCP] HTTP server listening on http://${bindHost}:${port}`);
+  console.error(`[Suveren MCP]   SSE:        http://${bindHost}:${port}/sse`);
+  console.error(`[Suveren MCP]   Streamable: http://${bindHost}:${port}/mcp`);
+  console.error(`[Suveren MCP]   Agent token: ${agentToken ? "required" : "not set (this machine only)"}`);
   console.error(`[Suveren MCP]   SP server:  ${spUrl}`);
   profilesLoaded = loadProfiles();
   loadManifests();