@wenrwa/marketplace-cli 0.4.0 → 0.4.2

package/dist/__tests__/bridge-config-mcp.test.js

@@ -88,6 +88,9 @@ describe('MCP auto-registration', () => {
         expect(addCall).toBeDefined();
         expect(addCall.join(' ')).toContain('wenrwa-marketplace');
         expect(addCall.join(' ')).toContain(`WENRWA_CONNECT_TOKEN=${token}`);
+        // User scope: the PTY shell starts in ~, and users run claude in any repo —
+        // a local (per-directory) registration would be invisible there.
+        expect(addCall.join(' ')).toContain('--scope user');
     });
     it('skips when already registered (idempotent)', async () => {
         const { calls, run } = runner('wenrwa-marketplace: npx @wenrwa/marketplace-mcp\n');

package/dist/__tests__/bridge-server.test.js

@@ -125,6 +125,21 @@ describe('bridge WebSocket server', () => {
         expect(bad.status).toBe(403);
         expect(bad.headers.get('access-control-allow-origin')).toBeNull();
     });
+    it('answers the Chrome Private-Network-Access preflight for the arena origin', async () => {
+        const res = await fetch(`http://127.0.0.1:${handle.port}/discovery`, {
+            method: 'OPTIONS',
+            headers: { origin: ORIGIN, 'Access-Control-Request-Private-Network': 'true' },
+        });
+        expect(res.status).toBe(204);
+        expect(res.headers.get('access-control-allow-origin')).toBe(ORIGIN);
+        expect(res.headers.get('access-control-allow-private-network')).toBe('true');
+        expect(res.headers.get('access-control-allow-methods')).toContain('GET');
+        const bad = await fetch(`http://127.0.0.1:${handle.port}/discovery`, {
+            method: 'OPTIONS',
+            headers: { origin: 'https://evil.example' },
+        });
+        expect(bad.status).toBe(403);
+    });
     it('unauthenticated frames are rejected', async () => {
         const ws = connect(handle.port);
         await new Promise((r) => ws.on('open', r));

package/dist/bridge/mcpRegister.js

@@ -22,10 +22,12 @@ async function registerMcpServer(opts) {
         return { action: 'already-registered' };
     }
     if (exists && opts.forceUpdate) {
-        await opts.run('claude', ['mcp', 'remove', exports.MCP_SERVER_NAME]);
+        await opts.run('claude', ['mcp', 'remove', '--scope', 'user', exports.MCP_SERVER_NAME]).catch(() => { });
+        // Also clear a stale default(local)-scope entry from older bridge versions.
+        await opts.run('claude', ['mcp', 'remove', exports.MCP_SERVER_NAME]).catch(() => { });
     }
     const args = [
-        'mcp', 'add', exports.MCP_SERVER_NAME,
+        'mcp', 'add', '--scope', 'user', exports.MCP_SERVER_NAME,
         '-e', `WENRWA_CONNECT_TOKEN=${opts.connectToken}`,
         '-e', `MARKETPLACE_API_URL=${opts.apiUrl}`,
         '--', 'npx', '@wenrwa/marketplace-mcp',

package/dist/bridge/server.js

@@ -63,6 +63,23 @@ function startBridgeServer(opts) {
     // read it. (Same-machine cross-user curl with a forged Origin remains
     // possible; documented as out of scope for v1 in PROTOCOL.md.)
     const httpServer = http.createServer((req, res) => {
+        // Chrome Private-Network-Access: a public origin (app.hiveop.io) calling a
+        // local address sends an OPTIONS preflight that MUST be answered with
+        // Access-Control-Allow-Private-Network, or the browser blocks discovery.
+        if (req.method === 'OPTIONS' && req.url === '/discovery') {
+            if (req.headers.origin !== opts.allowedOrigin) {
+                res.writeHead(403).end();
+                return;
+            }
+            res.writeHead(204, {
+                'access-control-allow-origin': opts.allowedOrigin,
+                'access-control-allow-private-network': 'true',
+                'access-control-allow-methods': 'GET, OPTIONS',
+                'access-control-max-age': '600',
+            });
+            res.end();
+            return;
+        }
         if (req.method === 'GET' && req.url === '/discovery') {
             if (req.headers.origin !== opts.allowedOrigin) {
                 res.writeHead(403).end();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wenrwa/marketplace-cli",
-  "version": "0.4.0",
+  "version": "0.4.2",
   "description": "CLI tool for the Wenrwa Agent Marketplace — monitor bounties, agents, workspaces, and treasury from your terminal",
   "author": "Wenrwa <dev@wenrwa.com>",
   "license": "MIT",