@wrongstack/acp 0.287.0 → 0.289.0

package/dist/wrongstack-acp-agent.js

@@ -833,7 +833,21 @@ var WrongStackACPServer = class {
   async startHttp(port) {
     const host = this.options.host ?? "127.0.0.1";
     const handler = this.handler;
+    const authToken = this.options.authToken;
+    let httpChain = Promise.resolve();
     this.httpServer = createServer(async (req, res) => {
+      if (authToken) {
+        const url = new URL(req.url ?? "/", `http://${host}:${port}`);
+        const queryToken = url.searchParams.get("token");
+        const authHeader = req.headers["authorization"];
+        const bearerToken = Array.isArray(authHeader) ? authHeader[0]?.replace(/^Bearer\s+/i, "") : authHeader?.replace(/^Bearer\s+/i, "");
+        const supplied = queryToken ?? bearerToken ?? "";
+        if (supplied !== authToken) {
+          res.writeHead(401, { "Content-Type": "application/json" });
+          res.end(JSON.stringify({ error: { code: -32001, message: "Unauthorized" } }));
+          return;
+        }
+      }
       const selfOrigin = `http://${host}:${port}`;
       const reqOrigin = Array.isArray(req.headers.origin) ? req.headers.origin[0] : req.headers.origin;
       if (reqOrigin && reqOrigin !== selfOrigin) {
@@ -843,7 +857,7 @@ var WrongStackACPServer = class {
       }
       if (reqOrigin) res.setHeader("Access-Control-Allow-Origin", reqOrigin);
       res.setHeader("Access-Control-Allow-Methods", "POST, OPTIONS");
-      res.setHeader("Access-Control-Allow-Headers", "Content-Type, Mcp-Session-Id");
+      res.setHeader("Access-Control-Allow-Headers", "Content-Type, Mcp-Session-Id, Authorization");
       if (req.method === "OPTIONS") {
         res.writeHead(204);
         res.end();
@@ -854,10 +868,23 @@ var WrongStackACPServer = class {
         res.end(JSON.stringify({ error: "method not allowed" }));
         return;
       }
+      const MAX_HTTP_BODY = 10 * 1024 * 1024;
       let body = "";
+      let bodyBytes = 0;
+      let tooLarge = false;
       for await (const chunk of req) {
+        bodyBytes += chunk.length;
+        if (bodyBytes > MAX_HTTP_BODY) {
+          tooLarge = true;
+          break;
+        }
         body += chunk;
       }
+      if (tooLarge) {
+        res.writeHead(413, { "Content-Type": "application/json" });
+        res.end(JSON.stringify({ error: { code: -32700, message: "Request body too large" } }));
+        return;
+      }
       let msg;
       try {
         msg = JSON.parse(body);
@@ -866,26 +893,43 @@ var WrongStackACPServer = class {
         res.end(JSON.stringify({ error: { code: -32700, message: "Parse error" } }));
         return;
       }
-      const notifications = [];
-      let response = null;
-      const originalSend = this.transport.send.bind(this.transport);
-      this.transport.send = async (m) => {
-        if (m.id !== void 0 && (m.result !== void 0 || m.error !== void 0)) {
-          response = m;
-        } else if (m.method === "session/update") {
-          notifications.push(m.params);
-        } else {
-          notifications.push(m);
+      const isNotification = typeof msg === "object" && msg !== null && msg.id === void 0 && typeof msg.method === "string";
+      if (isNotification) {
+        try {
+          await handler.handleMessage(msg);
+        } catch {
         }
-      };
+        res.writeHead(200, { "Content-Type": "application/json" });
+        res.end(JSON.stringify({ notifications: [] }));
+        return;
+      }
+      const requestPromise = httpChain.then(async () => {
+        const notifications = [];
+        let response = null;
+        const originalSend = this.transport.send.bind(this.transport);
+        this.transport.send = async (m) => {
+          if (m.id !== void 0 && (m.result !== void 0 || m.error !== void 0)) {
+            response = m;
+          } else if (m.method === "session/update") {
+            notifications.push(m.params);
+          } else {
+            notifications.push(m);
+          }
+        };
+        try {
+          await handler.handleMessage(msg);
+        } finally {
+          this.transport.send = originalSend;
+        }
+        res.writeHead(200, { "Content-Type": "application/json" });
+        const responseBody = response !== null ? { ...response, notifications } : { notifications };
+        res.end(JSON.stringify(responseBody));
+      });
+      httpChain = requestPromise.catch(() => void 0);
       try {
-        await handler.handleMessage(msg);
-      } finally {
-        this.transport.send = originalSend;
+        await requestPromise;
+      } catch {
       }
-      res.writeHead(200, { "Content-Type": "application/json" });
-      const responseBody = response !== null ? { ...response, notifications } : { notifications };
-      res.end(JSON.stringify(responseBody));
     });
     return new Promise((resolve) => {
       this.httpServer.listen(port, host, () => {