@wrongstack/acp 0.296.2 → 0.296.3

package/dist/index.js

@@ -1206,8 +1206,9 @@ function toolToPriority(tool) {
 
 // src/agent/wrongstack-acp-agent.ts
 import { createServer } from "node:http";
+import { isIP } from "node:net";
 import { fileURLToPath } from "node:url";
-import { writeErr as writeErr2 } from "@wrongstack/core/utils";
+import { expandIPv6, writeErr as writeErr2 } from "@wrongstack/core/utils";
 var WrongStackACPServer = class {
   transport;
   handler;
@@ -1263,7 +1264,10 @@ var WrongStackACPServer = class {
   async startHttp(port) {
     const host = this.options.host ?? "127.0.0.1";
     const handler = this.handler;
-    const authToken = this.options.authToken;
+    const authToken = this.options.authToken?.trim();
+    if (!authToken && !isLoopbackHost(host)) {
+      throw new Error("ACP HTTP transport requires authToken for non-loopback hosts");
+    }
     let httpChain = Promise.resolve();
     this.httpServer = createServer(async (req, res) => {
       if (authToken) {
@@ -1391,6 +1395,16 @@ function headerValue(value) {
 function requestPath(value) {
   return value ?? "/";
 }
+function isLoopbackHost(host) {
+  const normalized = host.trim().toLowerCase();
+  if (normalized === "localhost") return true;
+  const literal = normalized.startsWith("[") && normalized.endsWith("]") ? normalized.slice(1, -1) : normalized;
+  const version = isIP(literal);
+  if (version === 4) return literal.startsWith("127.");
+  if (version !== 6) return false;
+  const groups = expandIPv6(literal);
+  return groups !== null && groups.slice(0, 7).every((group) => group === 0) && groups[7] === 1;
+}
 async function main() {
   const server = new WrongStackACPServer();
   await server.start();