@vfarcic/dot-ai 0.153.0 → 0.155.0

package/dist/interfaces/auth.d.ts

@@ -0,0 +1,26 @@
+/**
+ * Authentication module for HTTP transport
+ *
+ * Provides Bearer token authentication for the MCP HTTP server.
+ * Authentication is optional and only enabled when DOT_AI_AUTH_TOKEN is set.
+ */
+import { IncomingMessage } from 'node:http';
+export interface AuthResult {
+    authorized: boolean;
+    message?: string;
+}
+/**
+ * Check Bearer token authentication for HTTP requests.
+ *
+ * Authentication is only required when DOT_AI_AUTH_TOKEN environment variable is set.
+ * Uses constant-time comparison to prevent timing attacks.
+ *
+ * @param req - The incoming HTTP request
+ * @returns AuthResult indicating if request is authorized
+ */
+export declare function checkBearerAuth(req: IncomingMessage): AuthResult;
+/**
+ * Check if authentication is enabled (DOT_AI_AUTH_TOKEN is set)
+ */
+export declare function isAuthEnabled(): boolean;
+//# sourceMappingURL=auth.d.ts.map

package/dist/interfaces/auth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../src/interfaces/auth.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,eAAe,EAAE,MAAM,WAAW,CAAC;AAG5C,MAAM,WAAW,UAAU;IACzB,UAAU,EAAE,OAAO,CAAC;IACpB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED;;;;;;;;GAQG;AACH,wBAAgB,eAAe,CAAC,GAAG,EAAE,eAAe,GAAG,UAAU,CAoEhE;AAED;;GAEG;AACH,wBAAgB,aAAa,IAAI,OAAO,CAEvC"}

package/dist/interfaces/auth.js

@@ -0,0 +1,82 @@
+"use strict";
+/**
+ * Authentication module for HTTP transport
+ *
+ * Provides Bearer token authentication for the MCP HTTP server.
+ * Authentication is optional and only enabled when DOT_AI_AUTH_TOKEN is set.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.checkBearerAuth = checkBearerAuth;
+exports.isAuthEnabled = isAuthEnabled;
+const node_crypto_1 = require("node:crypto");
+/**
+ * Check Bearer token authentication for HTTP requests.
+ *
+ * Authentication is only required when DOT_AI_AUTH_TOKEN environment variable is set.
+ * Uses constant-time comparison to prevent timing attacks.
+ *
+ * @param req - The incoming HTTP request
+ * @returns AuthResult indicating if request is authorized
+ */
+function checkBearerAuth(req) {
+    const configuredToken = process.env.DOT_AI_AUTH_TOKEN;
+    // If no token configured, authentication is disabled (backward compatible)
+    if (!configuredToken) {
+        return { authorized: true };
+    }
+    const rawAuthHeader = req.headers['authorization'];
+    // Check if Authorization header is present
+    if (!rawAuthHeader) {
+        return {
+            authorized: false,
+            message: 'Authentication required. Provide Authorization: Bearer <token> header.'
+        };
+    }
+    // Normalize header to string (handle array case)
+    const authHeader = Array.isArray(rawAuthHeader)
+        ? (rawAuthHeader[0] ?? '')
+        : rawAuthHeader;
+    // Parse Bearer token (case-insensitive per RFC 7235)
+    // Use split instead of regex to avoid ReDoS vulnerability
+    const trimmedHeader = authHeader.trim();
+    const spaceIndex = trimmedHeader.indexOf(' ');
+    if (spaceIndex === -1) {
+        return {
+            authorized: false,
+            message: 'Invalid authorization format. Expected: Bearer <token>'
+        };
+    }
+    const scheme = trimmedHeader.slice(0, spaceIndex);
+    const providedToken = trimmedHeader.slice(spaceIndex + 1).trim();
+    // Validate Bearer scheme (case-insensitive)
+    if (scheme.toLowerCase() !== 'bearer') {
+        return {
+            authorized: false,
+            message: 'Invalid authorization format. Expected: Bearer <token>'
+        };
+    }
+    // Check if token is empty
+    if (!providedToken) {
+        return { authorized: false, message: 'Bearer token is empty.' };
+    }
+    // Use constant-time comparison to prevent timing attacks
+    // Both buffers must be same length for timingSafeEqual
+    const configuredBuffer = Buffer.from(configuredToken, 'utf8');
+    const providedBuffer = Buffer.from(providedToken, 'utf8');
+    // If lengths differ, tokens don't match (but still do constant-time operation to avoid timing leak)
+    if (configuredBuffer.length !== providedBuffer.length) {
+        // Perform a dummy comparison to maintain constant time
+        (0, node_crypto_1.timingSafeEqual)(configuredBuffer, configuredBuffer);
+        return { authorized: false, message: 'Invalid authentication token.' };
+    }
+    if (!(0, node_crypto_1.timingSafeEqual)(configuredBuffer, providedBuffer)) {
+        return { authorized: false, message: 'Invalid authentication token.' };
+    }
+    return { authorized: true };
+}
+/**
+ * Check if authentication is enabled (DOT_AI_AUTH_TOKEN is set)
+ */
+function isAuthEnabled() {
+    return !!process.env.DOT_AI_AUTH_TOKEN;
+}

package/dist/interfaces/error-response.d.ts

@@ -0,0 +1,34 @@
+/**
+ * Shared error response formatting for HTTP interfaces
+ *
+ * Provides consistent error response format across MCP server and REST API.
+ */
+import { ServerResponse } from 'node:http';
+export interface ErrorResponseBody {
+    success: false;
+    error: {
+        code: string;
+        message: string;
+        details?: unknown;
+    };
+}
+/**
+ * Format an error response body in the standard REST API format.
+ *
+ * @param code - Error code (e.g., 'UNAUTHORIZED', 'INTERNAL_ERROR')
+ * @param message - Human-readable error message
+ * @param details - Optional additional details
+ * @returns Formatted error response body
+ */
+export declare function formatErrorResponse(code: string, message: string, details?: unknown): ErrorResponseBody;
+/**
+ * Send an error response with consistent formatting.
+ *
+ * @param res - HTTP server response
+ * @param statusCode - HTTP status code
+ * @param code - Error code
+ * @param message - Human-readable error message
+ * @param details - Optional additional details
+ */
+export declare function sendErrorResponse(res: ServerResponse, statusCode: number, code: string, message: string, details?: unknown): void;
+//# sourceMappingURL=error-response.d.ts.map

package/dist/interfaces/error-response.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"error-response.d.ts","sourceRoot":"","sources":["../../src/interfaces/error-response.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AAE3C,MAAM,WAAW,iBAAiB;IAChC,OAAO,EAAE,KAAK,CAAC;IACf,KAAK,EAAE;QACL,IAAI,EAAE,MAAM,CAAC;QACb,OAAO,EAAE,MAAM,CAAC;QAChB,OAAO,CAAC,EAAE,OAAO,CAAC;KACnB,CAAC;CACH;AAED;;;;;;;GAOG;AACH,wBAAgB,mBAAmB,CACjC,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,MAAM,EACf,OAAO,CAAC,EAAE,OAAO,GAChB,iBAAiB,CASnB;AAED;;;;;;;;GAQG;AACH,wBAAgB,iBAAiB,CAC/B,GAAG,EAAE,cAAc,EACnB,UAAU,EAAE,MAAM,EAClB,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,MAAM,EACf,OAAO,CAAC,EAAE,OAAO,GAChB,IAAI,CAIN"}

package/dist/interfaces/error-response.js

@@ -0,0 +1,41 @@
+"use strict";
+/**
+ * Shared error response formatting for HTTP interfaces
+ *
+ * Provides consistent error response format across MCP server and REST API.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.formatErrorResponse = formatErrorResponse;
+exports.sendErrorResponse = sendErrorResponse;
+/**
+ * Format an error response body in the standard REST API format.
+ *
+ * @param code - Error code (e.g., 'UNAUTHORIZED', 'INTERNAL_ERROR')
+ * @param message - Human-readable error message
+ * @param details - Optional additional details
+ * @returns Formatted error response body
+ */
+function formatErrorResponse(code, message, details) {
+    return {
+        success: false,
+        error: {
+            code,
+            message,
+            ...(details !== undefined && { details })
+        }
+    };
+}
+/**
+ * Send an error response with consistent formatting.
+ *
+ * @param res - HTTP server response
+ * @param statusCode - HTTP status code
+ * @param code - Error code
+ * @param message - Human-readable error message
+ * @param details - Optional additional details
+ */
+function sendErrorResponse(res, statusCode, code, message, details) {
+    const body = formatErrorResponse(code, message, details);
+    res.writeHead(statusCode, { 'Content-Type': 'application/json' });
+    res.end(JSON.stringify(body));
+}

package/dist/interfaces/mcp.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"mcp.d.ts","sourceRoot":"","sources":["../../src/interfaces/mcp.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAWH,OAAO,EAAE,KAAK,EAAE,MAAM,eAAe,CAAC;AAgDtC,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,SAAS,CAAC,EAAE,OAAO,GAAG,MAAM,CAAC;IAC7B,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,WAAW,CAAC,EAAE,UAAU,GAAG,WAAW,CAAC;CACxC;AAED,qBAAa,SAAS;IACpB,OAAO,CAAC,MAAM,CAAY;IAC1B,OAAO,CAAC,KAAK,CAAQ;IACrB,OAAO,CAAC,WAAW,CAAkB;IACrC,OAAO,CAAC,MAAM,CAAS;IACvB,OAAO,CAAC,gBAAgB,CAAa;IACrC,OAAO,CAAC,MAAM,CAAkB;IAChC,OAAO,CAAC,UAAU,CAAC,CAAkC;IACrD,OAAO,CAAC,aAAa,CAAC,CAAgC;IACtD,OAAO,CAAC,YAAY,CAAmB;IACvC,OAAO,CAAC,aAAa,CAAgB;gBAEzB,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,eAAe;IAsCjD;;OAEG;IACH,OAAO,CAAC,YAAY;IA2BpB;;OAEG;IACH,OAAO,CAAC,aAAa;IA6HrB;;OAEG;IACH,OAAO,CAAC,eAAe;IAqCvB,OAAO,CAAC,iBAAiB;IAInB,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;YAkBd,mBAAmB;YAMnB,kBAAkB;YA6GlB,gBAAgB;IAexB,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;IAgB3B,OAAO,IAAI,OAAO;CAGnB"}
+{"version":3,"file":"mcp.d.ts","sourceRoot":"","sources":["../../src/interfaces/mcp.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAWH,OAAO,EAAE,KAAK,EAAE,MAAM,eAAe,CAAC;AAkDtC,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,SAAS,CAAC,EAAE,OAAO,GAAG,MAAM,CAAC;IAC7B,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,WAAW,CAAC,EAAE,UAAU,GAAG,WAAW,CAAC;CACxC;AAED,qBAAa,SAAS;IACpB,OAAO,CAAC,MAAM,CAAY;IAC1B,OAAO,CAAC,KAAK,CAAQ;IACrB,OAAO,CAAC,WAAW,CAAkB;IACrC,OAAO,CAAC,MAAM,CAAS;IACvB,OAAO,CAAC,gBAAgB,CAAa;IACrC,OAAO,CAAC,MAAM,CAAkB;IAChC,OAAO,CAAC,UAAU,CAAC,CAAkC;IACrD,OAAO,CAAC,aAAa,CAAC,CAAgC;IACtD,OAAO,CAAC,YAAY,CAAmB;IACvC,OAAO,CAAC,aAAa,CAAgB;gBAEzB,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,eAAe;IAsCjD;;OAEG;IACH,OAAO,CAAC,YAAY;IA2BpB;;OAEG;IACH,OAAO,CAAC,aAAa;IA6HrB;;OAEG;IACH,OAAO,CAAC,eAAe;IAqCvB,OAAO,CAAC,iBAAiB;IAInB,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;YAkBd,mBAAmB;YAMnB,kBAAkB;YAmHlB,gBAAgB;IAexB,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;IAgB3B,OAAO,IAAI,OAAO;CAGnB"}

package/dist/interfaces/mcp.js

@@ -23,6 +23,8 @@ const project_setup_1 = require("../tools/project-setup");
 const prompts_1 = require("../tools/prompts");
 const rest_registry_1 = require("./rest-registry");
 const rest_api_1 = require("./rest-api");
+const auth_1 = require("./auth");
+const error_response_1 = require("./error-response");
 const tracing_1 = require("../core/tracing");
 const api_1 = require("@opentelemetry/api");
 class MCPServer {
@@ -215,13 +217,21 @@ class MCPServer {
                     // Handle CORS for browser-based clients
                     res.setHeader('Access-Control-Allow-Origin', '*');
                     res.setHeader('Access-Control-Allow-Methods', 'GET, POST, DELETE, OPTIONS');
-                    res.setHeader('Access-Control-Allow-Headers', 'Content-Type, X-Session-Id');
+                    res.setHeader('Access-Control-Allow-Headers', 'Content-Type, X-Session-Id, Authorization');
                     if (req.method === 'OPTIONS') {
                         res.writeHead(204);
                         res.end();
                         endSpan(204);
                         return;
                     }
+                    // Check Bearer token authentication (only when DOT_AI_AUTH_TOKEN is set)
+                    const authResult = (0, auth_1.checkBearerAuth)(req);
+                    if (!authResult.authorized) {
+                        this.logger.warn('Authentication failed', { message: authResult.message });
+                        (0, error_response_1.sendErrorResponse)(res, 401, 'UNAUTHORIZED', authResult.message || 'Authentication required');
+                        endSpan(401);
+                        return;
+                    }
                     // Parse request body for POST requests
                     let body = undefined;
                     if (req.method === 'POST') {
@@ -240,8 +250,7 @@ class MCPServer {
                         catch (error) {
                             this.logger.error('REST API request failed', error);
                             if (!res.headersSent) {
-                                res.writeHead(500, { 'Content-Type': 'application/json' });
-                                res.end(JSON.stringify({ error: 'REST API internal server error' }));
+                                (0, error_response_1.sendErrorResponse)(res, 500, 'INTERNAL_ERROR', 'REST API internal server error');
                             }
                             endSpan(500);
                             return;
@@ -258,8 +267,7 @@ class MCPServer {
                     catch (error) {
                         this.logger.error('Error handling MCP HTTP request', error);
                         if (!res.headersSent) {
-                            res.writeHead(500, { 'Content-Type': 'application/json' });
-                            res.end(JSON.stringify({ error: 'MCP internal server error' }));
+                            (0, error_response_1.sendErrorResponse)(res, 500, 'INTERNAL_ERROR', 'MCP internal server error');
                         }
                         endSpan(500);
                     }
@@ -270,8 +278,7 @@ class MCPServer {
                     span.recordException(error);
                     endSpan(500);
                     if (!res.headersSent) {
-                        res.writeHead(500, { 'Content-Type': 'application/json' });
-                        res.end(JSON.stringify({ error: 'Internal server error' }));
+                        (0, error_response_1.sendErrorResponse)(res, 500, 'INTERNAL_ERROR', 'Internal server error');
                     }
                 }
             }); // Close context.with()

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vfarcic/dot-ai",
-  "version": "0.153.0",
+  "version": "0.155.0",
   "description": "AI-powered development productivity platform that enhances software development workflows through intelligent automation and AI-driven assistance",
   "mcpName": "io.github.vfarcic/dot-ai",
   "main": "dist/index.js",

package/shared-prompts/prd-create.md

@@ -154,9 +154,17 @@ Please enter 1 or 2:
 
 ### Option 1: Start Working Now
 
-If user chooses option 1, execute: **prd-start [issue-id]**
+If user chooses option 1, first commit and push the PRD (same as Option 2), then instruct them:
 
-This will help identify the first task and set up the development workflow.
+---
+
+**PRD committed and pushed.**
+
+To start working on this PRD, run the `prd-start` prompt with the PRD ID: `prd-start [issue-id]`
+
+*Note: Different agents/clients may have different syntax for executing commands and prompts (e.g., `/prd-start [issue-id]` in Claude Code, or other syntax in different MCP clients). Start a new conversation/context to run the prompt.*
+
+---
 
 ### Option 2: Commit and Push for Later