@wrongstack/acp 0.295.1 → 0.296.3

package/dist/wrongstack-acp-agent.js

@@ -1,7 +1,8 @@
 // src/agent/wrongstack-acp-agent.ts
 import { createServer } from "node:http";
+import { isIP } from "node:net";
 import { fileURLToPath } from "node:url";
-import { writeErr as writeErr2 } from "@wrongstack/core/utils";
+import { expandIPv6, writeErr as writeErr2 } from "@wrongstack/core/utils";
 
 // src/types/acp-v1.ts
 var ACP_PROTOCOL_VERSION = 1;
@@ -920,7 +921,10 @@ var WrongStackACPServer = class {
   async startHttp(port) {
     const host = this.options.host ?? "127.0.0.1";
     const handler = this.handler;
-    const authToken = this.options.authToken;
+    const authToken = this.options.authToken?.trim();
+    if (!authToken && !isLoopbackHost(host)) {
+      throw new Error("ACP HTTP transport requires authToken for non-loopback hosts");
+    }
     let httpChain = Promise.resolve();
     this.httpServer = createServer(async (req, res) => {
       if (authToken) {
@@ -1048,7 +1052,22 @@ function headerValue(value) {
 function requestPath(value) {
   return value ?? "/";
 }
-var wrongStackACPServerCoverage = { defaultEchoRunTurn, headerValue, requestPath };
+function isLoopbackHost(host) {
+  const normalized = host.trim().toLowerCase();
+  if (normalized === "localhost") return true;
+  const literal = normalized.startsWith("[") && normalized.endsWith("]") ? normalized.slice(1, -1) : normalized;
+  const version = isIP(literal);
+  if (version === 4) return literal.startsWith("127.");
+  if (version !== 6) return false;
+  const groups = expandIPv6(literal);
+  return groups !== null && groups.slice(0, 7).every((group) => group === 0) && groups[7] === 1;
+}
+var wrongStackACPServerCoverage = {
+  defaultEchoRunTurn,
+  headerValue,
+  isLoopbackHost,
+  requestPath
+};
 async function main() {
   const server = new WrongStackACPServer();
   await server.start();