@twinsearth/w2m-dsh-plugin 0.54.0 → 0.55.0

package/CHANGELOG.md

@@ -4,6 +4,60 @@ All notable changes to this project are documented here. The format follows
 [Keep a Changelog](https://keepachangelog.com/en/1.1.0/), and this project
 adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [0.55.0] — 2026-10-15
+
+**A second transport binding — and `mcp.json` now declares both.**
+
+### The same protocol, two bindings, and no logic shared between them
+
+The MCP overview states it plainly: **"protocol semantics are identical on every transport. A transport is a
+binding."** So `src/mcp/http-transport.mjs` contains **no protocol decisions** — it decodes a request, hands the
+body to the same `handleMessage` the stdio binding uses, and encodes the reply. **Neither binding imports the
+other.** The single command reaches the fleet over both.
+
+### What revision `2026-07-28` removed, which made this smaller than expected
+
+* **The GET stream endpoint is gone.** A bare `GET /mcp` gets **405 naming the revision**, not a 404 — a client
+  written against the older revision should learn *why* rather than guess at the URL.
+* **Protocol-level sessions are gone.** No `Mcp-Session-Id`, no session table, no state between requests. Two
+  identical requests return identical bytes, and the test asserts it.
+
+`GET /mcp?discover` still answers, **gated on an explicit parameter**: a bare GET is what the removed stream
+client sends, and handing it a description document to parse as a stream would be worse than refusing it.
+
+### The `Origin` rule is a MUST, and it is easy to skip
+
+> **"Servers MUST validate the `Origin` header on all incoming connections to prevent DNS rebinding attacks."**
+
+A loopback MCP server is reachable by **any page the user's browser loads**, and a rebinding attack makes that
+page same-origin. So a refused `Origin` gets **403 before the body is read** — asserted with an unparseable body,
+because ordering is the property.
+
+**A missing `Origin` is allowed, and that is a decision rather than an oversight**: the header constrains
+*browsers*, an attacker's browser always sends one, and refusing an absent header would break every
+command-line client while stopping no attack. The default bind is **127.0.0.1**, per the specification's SHOULD.
+
+### `mcp.json` declares both, and one of them is not a subprocess
+
+```json
+"w2m-fleet":      { "type": "stdio",           "command": "node", "args": ["./bin/w2m-mcp.mjs"], "cwd": "${PLUGIN_ROOT}" },
+"w2m-fleet-http": { "type": "streamable-http", "url": "http://127.0.0.1:8766/mcp" }
+```
+
+**The HTTP entry names a server that must be started separately** — `node bin/w2m-mcp.mjs --http` — because a
+remote-transport entry has no `command` to launch. That is what the transport type means, and the alternative —
+declaring only stdio — would leave an HTTP-only client with nothing to connect to. **The `cwd` is
+`${PLUGIN_ROOT}` rather than a path, so the entry works wherever the package is installed**, and
+`plugin-manifest-check.mjs` validates both entries against the schema's closed per-transport field sets.
+
+### One assertion I wrote wrong, and the fix was the implementation
+
+My discovery handler matched `GET /mcp` **exactly**, while the test sent `GET /mcp?discover=1`. **The test was
+right and the code was wrong** — the two GETs are different callers with different needs, and telling them apart
+by a parameter is honest where guessing at intent is not. Fixed the handler, not the test.
+
+**16 new tests, 0 failures.** Full suite 2318 in 86 files. **Pre-flight GREEN with FIFTEEN checks.**
+
 ## [0.54.0] — 2026-10-15
 
 **The fleet is published as an MCP server — read-only, and every declared route is checked against the relay's

package/bin/w2m-mcp.mjs

@@ -337,10 +337,40 @@ export function serve({ input, output, deps }) {
   return pending;
 }
 
-function main() {
+/**
+ * Start the server on the transport the caller asked for.
+ *
+ * **stdio is the default because it is what `mcp.json` declares and what a client launches.** `--http` is for
+ * the clients that require an HTTP endpoint -- one of them is known to insist on a local HTTP server with a
+ * discovery file rather than a subprocess -- and it is an explicit flag rather than a guess, because the two
+ * transports have different threat models: a subprocess talks to its parent, a socket talks to whatever can
+ * reach the port.
+ */
+async function main() {
+  const argv = process.argv.slice(2);
+  const flag = (name, dflt) => (argv.includes(name) ? argv[argv.indexOf(name) + 1] : dflt);
   const config = readConfig();
   log(`starting; relay ${config.relayUrl}; device ${config.device?.machine_name ?? '(none)'}`);
   log(`read-only tools: ${TOOL_NAMES.join(', ')}`);
+
+  if (argv.includes('--http')) {
+    const { createMcpHttpServer } = await import('../src/mcp/http-transport.mjs');
+    const host = flag('--host', '127.0.0.1');
+    const port = Number(flag('--port', 8766));
+    if (!Number.isInteger(port) || port < 0 || port > 65535) {
+      log(`--port ${flag('--port')} is not a port number`);
+      process.exit(2);
+    }
+    const running = await createMcpHttpServer({ host, port, deps: { config, fetchImpl: fetch } });
+    // Printed so a launcher can read the port when it asked for 0, and on stderr so it never touches a protocol
+    // stream -- this binding has no stdout protocol, but the rule is the same one the stdio binding follows.
+    log(`streamable-http listening on ${running.url}`);
+    const stop = async () => { await running.close(); process.exit(0); };
+    process.on('SIGINT', stop);
+    process.on('SIGTERM', stop);
+    return;
+  }
+
   serve({ input: process.stdin, output: process.stdout, deps: { config, fetchImpl: fetch } });
 }
 

package/mcp.json

@@ -6,6 +6,10 @@
       "command": "node",
       "args": ["./bin/w2m-mcp.mjs"],
       "cwd": "${PLUGIN_ROOT}"
+    },
+    "w2m-fleet-http": {
+      "type": "streamable-http",
+      "url": "http://127.0.0.1:8766/mcp"
     }
   }
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@twinsearth/w2m-dsh-plugin",
-  "version": "0.54.0",
+  "version": "0.55.0",
   "description": "DSH: Windows2MacOS — drive the same project on online Windows and macOS machines from one DeepSeek account, across networks and regions. P2P hole punching is the default path (relay + shared server as rendezvous, ledger and fallback), with a bundled STUN responder, Tailscale/public-VPS/tunnel shapes, Rabbit relay + per-machine Localside + eight DSH tools (replicate / split), nine aggregate verdicts and signed requests.",
   "type": "module",
   "main": "lib/index.js",
@@ -116,13 +116,13 @@
     }
   },
   "scripts": {
-    "test": "node --test --test-force-exit test/relay.test.mjs test/broadcast.test.mjs test/agent.test.mjs test/plan-sec-cmd.test.mjs test/authority.test.mjs test/blocks.test.mjs test/approval-index.test.mjs test/fleet-sync.test.mjs test/health.test.mjs test/storage.test.mjs test/exit-channel.test.mjs test/council.test.mjs test/council-session.test.mjs test/log-bounds.test.mjs test/test-report.test.mjs test/fleet-scale.test.mjs test/fleet-state.test.mjs test/crypto-blake2s.test.mjs test/installed-version.test.mjs test/permission.test.mjs test/machine-test-packet.test.mjs test/field-authority.test.mjs test/approval-gate.test.mjs test/authority-choice.test.mjs test/reachability-check.test.mjs test/reachability-classify.test.mjs test/accepted-orphans.test.mjs test/acceptance-doc.test.mjs test/layer-model.test.mjs test/cwd-containment.test.mjs test/cwd-outside-project.test.mjs test/memory.test.mjs test/tools.test.mjs  test/claims.test.mjs test/fleet-target.test.mjs test/client-bundle.test.mjs test/schedule.test.mjs test/auto-update.test.mjs test/update-source.test.mjs test/update-install.test.mjs test/update-wiring.test.mjs test/signing.test.mjs test/stress.test.mjs test/shared-config.test.mjs test/metrics.test.mjs test/metrics-route.test.mjs test/tool-cards.test.mjs test/p2p-stun.test.mjs test/p2p-transport.test.mjs test/p2p-signaling.test.mjs test/p2p-node.test.mjs test/p2p-transport-fields.test.mjs test/p2p-plugin.test.mjs test/p2p-crypto.test.mjs test/stun-server.test.mjs test/loader-entry.test.mjs test/mdns-wire.test.mjs test/mdns-discover.test.mjs test/chatops-approval.test.mjs test/chatops-policy.test.mjs test/chatops-file-safety.test.mjs test/chatops-outbound-queue.test.mjs test/chatops-commands.test.mjs test/chatops-bridge.test.mjs test/chatops-config-route.test.mjs test/chatops-apply.test.mjs test/chatops-ilink-contract.test.mjs test/chatops-fleet.test.mjs test/chatops-account.test.mjs test/chatops-auth.test.mjs test/chatops-fleet-scope.test.mjs test/chatops-handoff.test.mjs test/chatops-fleet-wiring.test.mjs test/chatops-fleet-live.test.mjs test/chatops-takeover.test.mjs test/chatops-device-signing.test.mjs test/chatops-relay-verify.test.mjs test/chatops-durability.test.mjs test/chatops-run-command.test.mjs test/secrets-guard.test.mjs test/chatops-ilink-fleet-bridge.test.mjs test/agent-plugins.test.mjs test/memory-layer.test.mjs test/mcp-server.test.mjs test/chatops-fleet-join.test.mjs",
+    "test": "node --test --test-force-exit test/relay.test.mjs test/broadcast.test.mjs test/agent.test.mjs test/plan-sec-cmd.test.mjs test/authority.test.mjs test/blocks.test.mjs test/approval-index.test.mjs test/fleet-sync.test.mjs test/health.test.mjs test/storage.test.mjs test/exit-channel.test.mjs test/council.test.mjs test/council-session.test.mjs test/log-bounds.test.mjs test/test-report.test.mjs test/fleet-scale.test.mjs test/fleet-state.test.mjs test/crypto-blake2s.test.mjs test/installed-version.test.mjs test/permission.test.mjs test/machine-test-packet.test.mjs test/field-authority.test.mjs test/approval-gate.test.mjs test/authority-choice.test.mjs test/reachability-check.test.mjs test/reachability-classify.test.mjs test/accepted-orphans.test.mjs test/acceptance-doc.test.mjs test/layer-model.test.mjs test/cwd-containment.test.mjs test/cwd-outside-project.test.mjs test/memory.test.mjs test/tools.test.mjs  test/claims.test.mjs test/fleet-target.test.mjs test/client-bundle.test.mjs test/schedule.test.mjs test/auto-update.test.mjs test/update-source.test.mjs test/update-install.test.mjs test/update-wiring.test.mjs test/signing.test.mjs test/stress.test.mjs test/shared-config.test.mjs test/metrics.test.mjs test/metrics-route.test.mjs test/tool-cards.test.mjs test/p2p-stun.test.mjs test/p2p-transport.test.mjs test/p2p-signaling.test.mjs test/p2p-node.test.mjs test/p2p-transport-fields.test.mjs test/p2p-plugin.test.mjs test/p2p-crypto.test.mjs test/stun-server.test.mjs test/loader-entry.test.mjs test/mdns-wire.test.mjs test/mdns-discover.test.mjs test/chatops-approval.test.mjs test/chatops-policy.test.mjs test/chatops-file-safety.test.mjs test/chatops-outbound-queue.test.mjs test/chatops-commands.test.mjs test/chatops-bridge.test.mjs test/chatops-config-route.test.mjs test/chatops-apply.test.mjs test/chatops-ilink-contract.test.mjs test/chatops-fleet.test.mjs test/chatops-account.test.mjs test/chatops-auth.test.mjs test/chatops-fleet-scope.test.mjs test/chatops-handoff.test.mjs test/chatops-fleet-wiring.test.mjs test/chatops-fleet-live.test.mjs test/chatops-takeover.test.mjs test/chatops-device-signing.test.mjs test/chatops-relay-verify.test.mjs test/chatops-durability.test.mjs test/chatops-run-command.test.mjs test/secrets-guard.test.mjs test/chatops-ilink-fleet-bridge.test.mjs test/agent-plugins.test.mjs test/memory-layer.test.mjs test/mcp-server.test.mjs test/mcp-http.test.mjs test/chatops-fleet-join.test.mjs",
     "test:e2e": "node --test --test-force-exit test/e2e.test.mjs test/crossnetwork.test.mjs test/signing-e2e.test.mjs test/outbound-only.test.mjs test/recovery.test.mjs test/pipeline-e2e.test.mjs test/p2p-agent.test.mjs",
     "test:relay": "node --test --test-force-exit test/relay.test.mjs",
     "test:agent": "node --test --test-force-exit test/agent.test.mjs test/memory.test.mjs",
     "test:tools": "node --test --test-force-exit test/tools.test.mjs",
     "test:crossnetwork": "node --test --test-force-exit test/crossnetwork.test.mjs",
-    "test:all": "node --test --test-force-exit test/relay.test.mjs test/broadcast.test.mjs test/agent.test.mjs test/plan-sec-cmd.test.mjs test/authority.test.mjs test/blocks.test.mjs test/approval-index.test.mjs test/fleet-sync.test.mjs test/health.test.mjs test/storage.test.mjs test/exit-channel.test.mjs test/council.test.mjs test/council-session.test.mjs test/log-bounds.test.mjs test/test-report.test.mjs test/fleet-scale.test.mjs test/fleet-state.test.mjs test/crypto-blake2s.test.mjs test/installed-version.test.mjs test/permission.test.mjs test/machine-test-packet.test.mjs test/field-authority.test.mjs test/approval-gate.test.mjs test/authority-choice.test.mjs test/reachability-check.test.mjs test/reachability-classify.test.mjs test/accepted-orphans.test.mjs test/acceptance-doc.test.mjs test/layer-model.test.mjs test/cwd-containment.test.mjs test/cwd-outside-project.test.mjs test/memory.test.mjs test/tools.test.mjs  test/claims.test.mjs test/fleet-target.test.mjs test/client-bundle.test.mjs test/schedule.test.mjs test/auto-update.test.mjs test/update-source.test.mjs test/update-install.test.mjs test/update-wiring.test.mjs test/signing.test.mjs test/stress.test.mjs test/e2e.test.mjs test/crossnetwork.test.mjs test/signing-e2e.test.mjs test/outbound-only.test.mjs test/recovery.test.mjs test/pipeline-e2e.test.mjs test/shared-config.test.mjs test/metrics.test.mjs test/metrics-route.test.mjs test/tool-cards.test.mjs test/p2p-stun.test.mjs test/p2p-transport.test.mjs test/p2p-signaling.test.mjs test/p2p-node.test.mjs test/p2p-transport-fields.test.mjs test/p2p-plugin.test.mjs test/p2p-agent.test.mjs test/stun-server.test.mjs test/loader-entry.test.mjs test/mdns-wire.test.mjs test/mdns-discover.test.mjs test/p2p-crypto.test.mjs test/chatops-approval.test.mjs test/chatops-policy.test.mjs test/chatops-file-safety.test.mjs test/chatops-outbound-queue.test.mjs test/chatops-commands.test.mjs test/chatops-bridge.test.mjs test/chatops-config-route.test.mjs test/chatops-apply.test.mjs test/chatops-ilink-contract.test.mjs test/chatops-fleet.test.mjs test/chatops-account.test.mjs test/chatops-auth.test.mjs test/chatops-fleet-scope.test.mjs test/chatops-handoff.test.mjs test/chatops-fleet-wiring.test.mjs test/chatops-fleet-live.test.mjs test/chatops-takeover.test.mjs test/chatops-device-signing.test.mjs test/chatops-relay-verify.test.mjs test/chatops-durability.test.mjs test/chatops-run-command.test.mjs test/secrets-guard.test.mjs test/chatops-ilink-fleet-bridge.test.mjs test/agent-plugins.test.mjs test/memory-layer.test.mjs test/mcp-server.test.mjs test/chatops-fleet-join.test.mjs",
+    "test:all": "node --test --test-force-exit test/relay.test.mjs test/broadcast.test.mjs test/agent.test.mjs test/plan-sec-cmd.test.mjs test/authority.test.mjs test/blocks.test.mjs test/approval-index.test.mjs test/fleet-sync.test.mjs test/health.test.mjs test/storage.test.mjs test/exit-channel.test.mjs test/council.test.mjs test/council-session.test.mjs test/log-bounds.test.mjs test/test-report.test.mjs test/fleet-scale.test.mjs test/fleet-state.test.mjs test/crypto-blake2s.test.mjs test/installed-version.test.mjs test/permission.test.mjs test/machine-test-packet.test.mjs test/field-authority.test.mjs test/approval-gate.test.mjs test/authority-choice.test.mjs test/reachability-check.test.mjs test/reachability-classify.test.mjs test/accepted-orphans.test.mjs test/acceptance-doc.test.mjs test/layer-model.test.mjs test/cwd-containment.test.mjs test/cwd-outside-project.test.mjs test/memory.test.mjs test/tools.test.mjs  test/claims.test.mjs test/fleet-target.test.mjs test/client-bundle.test.mjs test/schedule.test.mjs test/auto-update.test.mjs test/update-source.test.mjs test/update-install.test.mjs test/update-wiring.test.mjs test/signing.test.mjs test/stress.test.mjs test/e2e.test.mjs test/crossnetwork.test.mjs test/signing-e2e.test.mjs test/outbound-only.test.mjs test/recovery.test.mjs test/pipeline-e2e.test.mjs test/shared-config.test.mjs test/metrics.test.mjs test/metrics-route.test.mjs test/tool-cards.test.mjs test/p2p-stun.test.mjs test/p2p-transport.test.mjs test/p2p-signaling.test.mjs test/p2p-node.test.mjs test/p2p-transport-fields.test.mjs test/p2p-plugin.test.mjs test/p2p-agent.test.mjs test/stun-server.test.mjs test/loader-entry.test.mjs test/mdns-wire.test.mjs test/mdns-discover.test.mjs test/p2p-crypto.test.mjs test/chatops-approval.test.mjs test/chatops-policy.test.mjs test/chatops-file-safety.test.mjs test/chatops-outbound-queue.test.mjs test/chatops-commands.test.mjs test/chatops-bridge.test.mjs test/chatops-config-route.test.mjs test/chatops-apply.test.mjs test/chatops-ilink-contract.test.mjs test/chatops-fleet.test.mjs test/chatops-account.test.mjs test/chatops-auth.test.mjs test/chatops-fleet-scope.test.mjs test/chatops-handoff.test.mjs test/chatops-fleet-wiring.test.mjs test/chatops-fleet-live.test.mjs test/chatops-takeover.test.mjs test/chatops-device-signing.test.mjs test/chatops-relay-verify.test.mjs test/chatops-durability.test.mjs test/chatops-run-command.test.mjs test/secrets-guard.test.mjs test/chatops-ilink-fleet-bridge.test.mjs test/agent-plugins.test.mjs test/memory-layer.test.mjs test/mcp-server.test.mjs test/mcp-http.test.mjs test/chatops-fleet-join.test.mjs",
     "pack": "node scripts/pack.mjs",
     "verify:join": "node scripts/verify-join.mjs",
     "lint": "eslint .",

package/plugin.json

@@ -1,7 +1,7 @@
 {
   "$schema": "https://agent-plugins.org/schemas/1.0.0/plugin.schema.json",
   "name": "twinsearth-w2m-dsh",
-  "version": "0.54.0",
+  "version": "0.55.0",
   "description": "Cross-platform fleet execution between Windows and macOS: one DeepSeek Harness account, a Rabbit relay, and signed device identity. Ships four Agent Skills describing fleet dispatch, field-level memory acceptance, session references, and resource scheduling.",
   "license": "MIT",
   "keywords": [

package/src/mcp/http-transport.mjs

@@ -0,0 +1,216 @@
+/**
+ * The Streamable HTTP binding for the MCP server (v0.55.0).
+ *
+ * ## Why this is a separate file from the stdio binding
+ *
+ * The MCP overview says it directly: **"Protocol semantics are identical on every transport. A transport is a
+ * binding"** -- it defines framing and delivery, never meaning. So this file contains no protocol decisions: it
+ * decodes a request, hands the body to `handleMessage`, and encodes the reply. **`bin/w2m-mcp.mjs` holds the
+ * semantics and neither binding imports the other.**
+ *
+ * ## What revision 2026-07-28 removed, which simplifies this by a lot
+ *
+ * * **The GET stream endpoint is gone.** A GET is refused rather than half-supported.
+ * * **Protocol-level sessions are gone.** No `Mcp-Session-Id`, no session table, no state between requests --
+ *   which is what the overview means by "stateless, self-contained requests".
+ *
+ * ## The security requirement that is easy to skip
+ *
+ * **"Servers MUST validate the `Origin` header on all incoming connections to prevent DNS rebinding attacks."**
+ * A local MCP server bound to a loopback port is reachable by any page the user's browser loads, and a
+ * rebinding attack makes that page same-origin. So an invalid `Origin` gets **403**, and the default bind is
+ * **127.0.0.1** rather than every interface.
+ *
+ * ## Two response shapes, and why JSON is chosen
+ *
+ * The specification allows a plain JSON object or a request-scoped SSE stream. **SSE exists to interleave
+ * request-related notifications with the final response**, and this server emits no notifications during a call
+ * -- its only outbound messages are responses. So the JSON shape carries everything, and SSE would be a stream
+ * with one frame. `?stream=1` is honoured for a client that insists, because a client written against the
+ * stream form is entitled to it.
+ */
+import { createServer } from 'node:http';
+import { handleMessage, TOOL_NAMES, SUPPORTED_VERSIONS, SERVER_NAME, SERVER_VERSION } from '../../bin/w2m-mcp.mjs';
+
+/** The path the MCP endpoint is mounted at. A single endpoint, per the specification. */
+export const MCP_PATH = '/mcp';
+
+/**
+ * Origins that may call this server.
+ *
+ * **Loopback only, and by exact match.** A rebinding attack arrives with an `Origin` the attacker chose, so the
+ * rule has to be an allow-list rather than a check for something suspicious -- and `null` (a `file://` page, a
+ * sandboxed iframe) is refused for the same reason.
+ */
+export const ALLOWED_ORIGINS = Object.freeze([
+  'http://127.0.0.1',
+  'http://localhost',
+  'https://127.0.0.1',
+  'https://localhost',
+]);
+
+/**
+ * Is this `Origin` acceptable?
+ *
+ * A missing `Origin` is allowed: a non-browser client (curl, an SDK) sends none, and the header exists to
+ * constrain *browsers*. **Refusing an absent header would break every command-line client while stopping no
+ * attack**, because an attacker's browser always sends one.
+ *
+ * @param {string|undefined} origin
+ */
+export function originAllowed(origin) {
+  if (origin === undefined || origin === '') return true;
+  // Compare origin+port only, so any port on loopback is acceptable.
+  let parsed;
+  try {
+    parsed = new URL(origin);
+  } catch {
+    return false;
+  }
+  const bare = `${parsed.protocol}//${parsed.hostname}`;
+  return ALLOWED_ORIGINS.includes(bare);
+}
+
+/** Read a request body, bounded so a hostile client cannot exhaust memory. */
+const readBody = (req, limit = 4 * 1024 * 1024) => new Promise((resolve, reject) => {
+  const chunks = [];
+  let size = 0;
+  req.on('data', (chunk) => {
+    size += chunk.length;
+    if (size > limit) {
+      reject(new Error(`body exceeds ${limit} bytes`));
+      req.destroy();
+      return;
+    }
+    chunks.push(chunk);
+  });
+  req.on('end', () => resolve(Buffer.concat(chunks).toString('utf8')));
+  req.on('error', reject);
+});
+
+const sendJson = (res, status, body) => {
+  const text = JSON.stringify(body);
+  res.writeHead(status, { 'content-type': 'application/json; charset=utf-8', 'content-length': Buffer.byteLength(text) });
+  res.end(text);
+};
+
+/**
+ * Build the request handler.
+ *
+ * Exported separately from `createMcpHttpServer` so a test can call it with fake request and response objects --
+ * **the same reason `handleMessage` is exported**: a socket is not needed to prove framing.
+ *
+ * @param {{deps: object}} options
+ */
+export function createRequestHandler({ deps }) {
+  return async (req, res) => {
+    const url = new URL(req.url ?? '/', `http://${req.headers.host ?? '127.0.0.1'}`);
+
+    // 1. Origin, before anything else -- the specification makes this a MUST, and it must precede parsing.
+    if (!originAllowed(req.headers.origin)) {
+      sendJson(res, 403, { jsonrpc: '2.0', id: null, error: { code: -32600, message: `Origin ${JSON.stringify(req.headers.origin)} is not allowed`, data: { allowed: [...ALLOWED_ORIGINS] } } });
+      return;
+    }
+
+    /**
+     * 2. A discovery GET, so an operator can see what is here without speaking the protocol.
+     *
+     * **Gated on an explicit `?discover=1`, and that is not decoration.** A bare `GET /mcp` is what a client
+     * written against the removed stream endpoint sends, and it must be told the endpoint is gone rather than
+     * handed a document it will fail to parse as a stream. **Two different requests with two different answers,
+     * decided by a parameter rather than by guessing at the caller's intent.**
+     */
+    if (req.method === 'GET' && url.pathname === MCP_PATH && url.searchParams.has('discover')) {
+      sendJson(res, 200, {
+        server: { name: SERVER_NAME, version: SERVER_VERSION },
+        transport: 'streamable-http',
+        endpoint: MCP_PATH,
+        method: 'POST',
+        protocolVersions: [...SUPPORTED_VERSIONS],
+        tools: [...TOOL_NAMES],
+      });
+      return;
+    }
+
+    // 3. The GET *stream* endpoint was removed in 2026-07-28. Refused explicitly rather than 404, because a
+    //    client written against the older revision should learn why rather than guess.
+    if (req.method === 'GET') {
+      sendJson(res, 405, { jsonrpc: '2.0', id: null, error: { code: -32600, message: `the GET stream endpoint was removed in protocol revision 2026-07-28; POST to the MCP endpoint instead, or GET ${MCP_PATH}?discover for a description`, data: { endpoint: MCP_PATH } } });
+      return;
+    }
+
+    if (req.method !== 'POST') {
+      res.writeHead(405, { allow: 'POST, GET' });
+      res.end();
+      return;
+    }
+
+    if (url.pathname !== MCP_PATH) {
+      sendJson(res, 404, { jsonrpc: '2.0', id: null, error: { code: -32601, message: `no endpoint at ${url.pathname}; the MCP endpoint is ${MCP_PATH}` } });
+      return;
+    }
+
+    let raw;
+    try {
+      raw = await readBody(req);
+    } catch (error) {
+      sendJson(res, 413, { jsonrpc: '2.0', id: null, error: { code: -32600, message: error.message } });
+      return;
+    }
+
+    let message;
+    try {
+      message = JSON.parse(raw);
+    } catch (error) {
+      // A parse failure is a JSON-RPC error response, not an HTTP 400: the transport delivered the bytes, and
+      // the protocol layer is what rejects them.
+      sendJson(res, 200, { jsonrpc: '2.0', id: null, error: { code: -32700, message: `invalid JSON: ${error.message}` } });
+      return;
+    }
+
+    const reply = await handleMessage(message, deps);
+    if (reply === null) {
+      // A notification: JSON-RPC forbids a response, and the HTTP binding says so with 202 Accepted.
+      res.writeHead(202);
+      res.end();
+      return;
+    }
+
+    if (url.searchParams.get('stream') === '1') {
+      // Request-scoped SSE, for a client written against the stream form. One frame: this server emits no
+      // notifications during a call, so there is nothing to interleave.
+      res.writeHead(200, { 'content-type': 'text/event-stream; charset=utf-8', 'cache-control': 'no-store', connection: 'keep-alive' });
+      res.write(`event: message\ndata: ${JSON.stringify(reply)}\n\n`);
+      res.end();
+      return;
+    }
+
+    sendJson(res, 200, reply);
+  };
+}
+
+/**
+ * Start the server.
+ *
+ * **Binds 127.0.0.1 by default.** The specification says a local server SHOULD bind only to loopback, and a
+ * fleet-control endpoint reachable from the network is a different threat than one reachable from this machine.
+ *
+ * @param {{host?: string, port?: number, deps: object}} options
+ * @returns {Promise<{server: object, url: string, close: () => Promise<void>}>}
+ */
+export function createMcpHttpServer({ host = '127.0.0.1', port = 8766, deps }) {
+  const server = createServer(createRequestHandler({ deps }));
+  return new Promise((resolve, reject) => {
+    server.once('error', reject);
+    server.listen(port, host, () => {
+      const address = server.address();
+      resolve({
+        server,
+        url: `http://${host}:${address.port}${MCP_PATH}`,
+        // A block body, not a concise arrow: `() => done()` returns `done()`'s value into a Promise executor,
+        // which nothing reads.
+        close: () => new Promise((done) => { server.close(() => { done(); }); }),
+      });
+    });
+  });
+}

package/src/plugin/tools.mjs

@@ -208,7 +208,7 @@ const MAX_STAGES = 16;
  * `package.json` during `scripts/pack.mjs` rather than hand-maintained, and `W2M_PLUGIN_VERSION`
  * overrides it at runtime for tests and packagers.
  */
-const PLUGIN_VERSION = '0.54.0';
+const PLUGIN_VERSION = '0.55.0';
 
 /** How long any single HTTP call may take before it is aborted, in milliseconds. */
 const DEFAULT_REQUEST_TIMEOUT_MS = 15_000;