@wrongstack/acp 0.287.0 → 0.289.0

package/dist/agent/wrongstack-acp-agent.d.ts

@@ -11,6 +11,13 @@ export interface WrongStackACPServerOptions {
     transport?: 'stdio' | number | undefined;
     /** Host for HTTP transport. Defaults to '127.0.0.1'. */
     host?: string | undefined;
+    /**
+     * Bearer token required for HTTP transport authentication. When set,
+     * every HTTP request must include `Authorization: Bearer <token>` or
+     * `?token=<token>` in the query string. When unset, the server is
+     * unauthenticated (acceptable for loopback-only development).
+     */
+    authToken?: string | undefined;
     /** Emit the pre-v1 startup marker on stdio. Defaults to false. */
     legacyStartupMarker?: boolean | undefined;
     /**

package/dist/agent/wrongstack-acp-agent.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"wrongstack-acp-agent.d.ts","sourceRoot":"","sources":["../../src/agent/wrongstack-acp-agent.ts"],"names":[],"mappings":"AA8BA,OAAO,EAEL,KAAK,OAAO,EAEZ,KAAK,kBAAkB,EACxB,MAAM,uBAAuB,CAAC;AAG/B,MAAM,WAAW,0BAA0B;IACzC,OAAO,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;IAC9B,UAAU,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAChC,SAAS,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC/B;;;;OAIG;IACH,SAAS,CAAC,EAAE,OAAO,GAAG,MAAM,GAAG,SAAS,CAAC;IACzC,wDAAwD;IACxD,IAAI,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC1B,kEAAkE;IAClE,mBAAmB,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;IAC1C;;;;OAIG;IACH,SAAS,CAAC,EAAE,CAAC,CAAC,SAAS,EAAE,MAAM,KAAK,KAAK,CAAC;QAAE,aAAa,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,OAAO,CAAA;KAAE,CAAC,CAAC,GAAG,SAAS,CAAC;IACpG;;;OAGG;IACH,OAAO,CAAC,EAAE,CAAC,CAAC,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,CAAC;QAAE,aAAa,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,OAAO,CAAA;KAAE,CAAC,KAAK,IAAI,CAAC,GAAG,SAAS,CAAC;IACjH;;;OAGG;IACH,KAAK,CAAC,EAAE,kBAAkB,GAAG,SAAS,CAAC;CACxC;AAED,qBAAa,mBAAmB;IAC9B,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAiB;IAC3C,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAqB;IAC7C,OAAO,CAAC,QAAQ,CAAC,OAAO,CAA6B;IACrD,+CAA+C;IAC/C,OAAO,CAAC,UAAU,CAAuB;IACzC,OAAO,CAAC,OAAO,CAAS;IAExB,YAAY,IAAI,GAAE,0BAA+B,EAahD;IAED;;;;OAIG;IACG,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAO3B;YAEa,UAAU;YAcV,SAAS;IAkGvB,uBAAuB;IACvB,IAAI,IAAI,IAAI,CAOX;CACF"}
+{"version":3,"file":"wrongstack-acp-agent.d.ts","sourceRoot":"","sources":["../../src/agent/wrongstack-acp-agent.ts"],"names":[],"mappings":"AA8BA,OAAO,EAEL,KAAK,OAAO,EAEZ,KAAK,kBAAkB,EACxB,MAAM,uBAAuB,CAAC;AAG/B,MAAM,WAAW,0BAA0B;IACzC,OAAO,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;IAC9B,UAAU,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAChC,SAAS,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC/B;;;;OAIG;IACH,SAAS,CAAC,EAAE,OAAO,GAAG,MAAM,GAAG,SAAS,CAAC;IACzC,wDAAwD;IACxD,IAAI,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC1B;;;;;OAKG;IACH,SAAS,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC/B,kEAAkE;IAClE,mBAAmB,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;IAC1C;;;;OAIG;IACH,SAAS,CAAC,EAAE,CAAC,CAAC,SAAS,EAAE,MAAM,KAAK,KAAK,CAAC;QAAE,aAAa,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,OAAO,CAAA;KAAE,CAAC,CAAC,GAAG,SAAS,CAAC;IACpG;;;OAGG;IACH,OAAO,CAAC,EAAE,CAAC,CAAC,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,CAAC;QAAE,aAAa,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,OAAO,CAAA;KAAE,CAAC,KAAK,IAAI,CAAC,GAAG,SAAS,CAAC;IACjH;;;OAGG;IACH,KAAK,CAAC,EAAE,kBAAkB,GAAG,SAAS,CAAC;CACxC;AAED,qBAAa,mBAAmB;IAC9B,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAiB;IAC3C,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAqB;IAC7C,OAAO,CAAC,QAAQ,CAAC,OAAO,CAA6B;IACrD,+CAA+C;IAC/C,OAAO,CAAC,UAAU,CAAuB;IACzC,OAAO,CAAC,OAAO,CAAS;IAExB,YAAY,IAAI,GAAE,0BAA+B,EAahD;IAED;;;;OAIG;IACG,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAO3B;YAEa,UAAU;YAcV,SAAS;IAmKvB,uBAAuB;IACvB,IAAI,IAAI,IAAI,CAOX;CACF"}

package/dist/agent.js

@@ -1145,7 +1145,21 @@ var WrongStackACPServer = class {
   async startHttp(port) {
     const host = this.options.host ?? "127.0.0.1";
     const handler = this.handler;
+    const authToken = this.options.authToken;
+    let httpChain = Promise.resolve();
     this.httpServer = createServer(async (req, res) => {
+      if (authToken) {
+        const url = new URL(req.url ?? "/", `http://${host}:${port}`);
+        const queryToken = url.searchParams.get("token");
+        const authHeader = req.headers["authorization"];
+        const bearerToken = Array.isArray(authHeader) ? authHeader[0]?.replace(/^Bearer\s+/i, "") : authHeader?.replace(/^Bearer\s+/i, "");
+        const supplied = queryToken ?? bearerToken ?? "";
+        if (supplied !== authToken) {
+          res.writeHead(401, { "Content-Type": "application/json" });
+          res.end(JSON.stringify({ error: { code: -32001, message: "Unauthorized" } }));
+          return;
+        }
+      }
       const selfOrigin = `http://${host}:${port}`;
       const reqOrigin = Array.isArray(req.headers.origin) ? req.headers.origin[0] : req.headers.origin;
       if (reqOrigin && reqOrigin !== selfOrigin) {
@@ -1155,7 +1169,7 @@ var WrongStackACPServer = class {
       }
       if (reqOrigin) res.setHeader("Access-Control-Allow-Origin", reqOrigin);
       res.setHeader("Access-Control-Allow-Methods", "POST, OPTIONS");
-      res.setHeader("Access-Control-Allow-Headers", "Content-Type, Mcp-Session-Id");
+      res.setHeader("Access-Control-Allow-Headers", "Content-Type, Mcp-Session-Id, Authorization");
       if (req.method === "OPTIONS") {
         res.writeHead(204);
         res.end();
@@ -1166,10 +1180,23 @@ var WrongStackACPServer = class {
         res.end(JSON.stringify({ error: "method not allowed" }));
         return;
       }
+      const MAX_HTTP_BODY = 10 * 1024 * 1024;
       let body = "";
+      let bodyBytes = 0;
+      let tooLarge = false;
       for await (const chunk of req) {
+        bodyBytes += chunk.length;
+        if (bodyBytes > MAX_HTTP_BODY) {
+          tooLarge = true;
+          break;
+        }
         body += chunk;
       }
+      if (tooLarge) {
+        res.writeHead(413, { "Content-Type": "application/json" });
+        res.end(JSON.stringify({ error: { code: -32700, message: "Request body too large" } }));
+        return;
+      }
       let msg;
       try {
         msg = JSON.parse(body);
@@ -1178,26 +1205,43 @@ var WrongStackACPServer = class {
         res.end(JSON.stringify({ error: { code: -32700, message: "Parse error" } }));
         return;
       }
-      const notifications = [];
-      let response = null;
-      const originalSend = this.transport.send.bind(this.transport);
-      this.transport.send = async (m) => {
-        if (m.id !== void 0 && (m.result !== void 0 || m.error !== void 0)) {
-          response = m;
-        } else if (m.method === "session/update") {
-          notifications.push(m.params);
-        } else {
-          notifications.push(m);
+      const isNotification = typeof msg === "object" && msg !== null && msg.id === void 0 && typeof msg.method === "string";
+      if (isNotification) {
+        try {
+          await handler.handleMessage(msg);
+        } catch {
         }
-      };
+        res.writeHead(200, { "Content-Type": "application/json" });
+        res.end(JSON.stringify({ notifications: [] }));
+        return;
+      }
+      const requestPromise = httpChain.then(async () => {
+        const notifications = [];
+        let response = null;
+        const originalSend = this.transport.send.bind(this.transport);
+        this.transport.send = async (m) => {
+          if (m.id !== void 0 && (m.result !== void 0 || m.error !== void 0)) {
+            response = m;
+          } else if (m.method === "session/update") {
+            notifications.push(m.params);
+          } else {
+            notifications.push(m);
+          }
+        };
+        try {
+          await handler.handleMessage(msg);
+        } finally {
+          this.transport.send = originalSend;
+        }
+        res.writeHead(200, { "Content-Type": "application/json" });
+        const responseBody = response !== null ? { ...response, notifications } : { notifications };
+        res.end(JSON.stringify(responseBody));
+      });
+      httpChain = requestPromise.catch(() => void 0);
       try {
-        await handler.handleMessage(msg);
-      } finally {
-        this.transport.send = originalSend;
+        await requestPromise;
+      } catch {
       }
-      res.writeHead(200, { "Content-Type": "application/json" });
-      const responseBody = response !== null ? { ...response, notifications } : { notifications };
-      res.end(JSON.stringify(responseBody));
     });
     return new Promise((resolve) => {
       this.httpServer.listen(port, host, () => {