@wrongstack/acp 0.299.0 → 0.301.0

package/dist/agent.js

@@ -1446,6 +1446,7 @@ var WsBridgeTransport = class {
 };
 
 // src/agent/wrongstack-acp-agent.ts
+import { timingSafeEqual } from "node:crypto";
 import { createServer } from "node:http";
 import { isIP } from "node:net";
 import { fileURLToPath } from "node:url";
@@ -1513,10 +1514,10 @@ var WrongStackACPServer = class {
     this.httpServer = createServer(async (req, res) => {
       if (authToken) {
         const url = new URL(requestPath(req.url), `http://${host}:${port}`);
-        const queryToken = url.searchParams.get("token");
         const bearerToken = headerValue(req.headers.authorization)?.replace(/^Bearer\s+/i, "");
-        const supplied = queryToken ?? bearerToken ?? "";
-        if (supplied !== authToken) {
+        const queryToken = url.searchParams.get("token");
+        const queryOk = queryToken !== null && isLoopbackPeer(req) && timingSafeTokenEqual(queryToken, authToken);
+        if (!queryOk && !timingSafeTokenEqual(bearerToken ?? "", authToken)) {
           res.writeHead(401, { "Content-Type": "application/json" });
           res.end(JSON.stringify({ error: { code: -32001, message: "Unauthorized" } }));
           return;
@@ -1630,6 +1631,17 @@ var WrongStackACPServer = class {
 var defaultEchoRunTurn = async (_input, _emit) => {
   return { stopReason: "end_turn" };
 };
+function timingSafeTokenEqual(supplied, expected) {
+  if (!supplied || !expected) return false;
+  const a = Buffer.from(supplied);
+  const b = Buffer.from(expected);
+  if (a.length !== b.length) return false;
+  return timingSafeEqual(a, b);
+}
+function isLoopbackPeer(req) {
+  const address = req.socket.remoteAddress?.replace(/^::ffff:/i, "");
+  return address !== void 0 && isLoopbackHost(address);
+}
 function headerValue(value) {
   return Array.isArray(value) ? value[0] : value;
 }

package/dist/index.js

@@ -1384,6 +1384,7 @@ function toolToPriority(tool) {
 }
 
 // src/agent/wrongstack-acp-agent.ts
+import { timingSafeEqual } from "node:crypto";
 import { createServer } from "node:http";
 import { isIP } from "node:net";
 import { fileURLToPath } from "node:url";
@@ -1451,10 +1452,10 @@ var WrongStackACPServer = class {
     this.httpServer = createServer(async (req, res) => {
       if (authToken) {
         const url = new URL(requestPath(req.url), `http://${host}:${port}`);
-        const queryToken = url.searchParams.get("token");
         const bearerToken = headerValue(req.headers.authorization)?.replace(/^Bearer\s+/i, "");
-        const supplied = queryToken ?? bearerToken ?? "";
-        if (supplied !== authToken) {
+        const queryToken = url.searchParams.get("token");
+        const queryOk = queryToken !== null && isLoopbackPeer(req) && timingSafeTokenEqual(queryToken, authToken);
+        if (!queryOk && !timingSafeTokenEqual(bearerToken ?? "", authToken)) {
           res.writeHead(401, { "Content-Type": "application/json" });
           res.end(JSON.stringify({ error: { code: -32001, message: "Unauthorized" } }));
           return;
@@ -1568,6 +1569,17 @@ var WrongStackACPServer = class {
 var defaultEchoRunTurn = async (_input, _emit) => {
   return { stopReason: "end_turn" };
 };
+function timingSafeTokenEqual(supplied, expected) {
+  if (!supplied || !expected) return false;
+  const a = Buffer.from(supplied);
+  const b = Buffer.from(expected);
+  if (a.length !== b.length) return false;
+  return timingSafeEqual(a, b);
+}
+function isLoopbackPeer(req) {
+  const address = req.socket.remoteAddress?.replace(/^::ffff:/i, "");
+  return address !== void 0 && isLoopbackHost(address);
+}
 function headerValue(value) {
   return Array.isArray(value) ? value[0] : value;
 }

package/dist/wrongstack-acp-agent.js

@@ -1,4 +1,5 @@
 // src/agent/wrongstack-acp-agent.ts
+import { timingSafeEqual } from "node:crypto";
 import { createServer } from "node:http";
 import { isIP } from "node:net";
 import { fileURLToPath } from "node:url";
@@ -1091,10 +1092,10 @@ var WrongStackACPServer = class {
     this.httpServer = createServer(async (req, res) => {
       if (authToken) {
         const url = new URL(requestPath(req.url), `http://${host}:${port}`);
-        const queryToken = url.searchParams.get("token");
         const bearerToken = headerValue(req.headers.authorization)?.replace(/^Bearer\s+/i, "");
-        const supplied = queryToken ?? bearerToken ?? "";
-        if (supplied !== authToken) {
+        const queryToken = url.searchParams.get("token");
+        const queryOk = queryToken !== null && isLoopbackPeer(req) && timingSafeTokenEqual(queryToken, authToken);
+        if (!queryOk && !timingSafeTokenEqual(bearerToken ?? "", authToken)) {
           res.writeHead(401, { "Content-Type": "application/json" });
           res.end(JSON.stringify({ error: { code: -32001, message: "Unauthorized" } }));
           return;
@@ -1208,6 +1209,17 @@ var WrongStackACPServer = class {
 var defaultEchoRunTurn = async (_input, _emit) => {
   return { stopReason: "end_turn" };
 };
+function timingSafeTokenEqual(supplied, expected) {
+  if (!supplied || !expected) return false;
+  const a = Buffer.from(supplied);
+  const b = Buffer.from(expected);
+  if (a.length !== b.length) return false;
+  return timingSafeEqual(a, b);
+}
+function isLoopbackPeer(req) {
+  const address = req.socket.remoteAddress?.replace(/^::ffff:/i, "");
+  return address !== void 0 && isLoopbackHost(address);
+}
 function headerValue(value) {
   return Array.isArray(value) ? value[0] : value;
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wrongstack/acp",
-  "version": "0.299.0",
+  "version": "0.301.0",
   "license": "MIT",
   "description": "ACP (Agent Client Protocol) integration for WrongStack — client + agent support",
   "keywords": [
@@ -52,7 +52,7 @@
   ],
   "dependencies": {
     "@agentclientprotocol/sdk": "^1.3.0",
-    "@wrongstack/core": "0.299.0"
+    "@wrongstack/core": "0.301.0"
   },
   "devDependencies": {
     "@types/node": "^26.1.2",