@wrongstack/mcp 0.286.0 → 0.287.0

package/dist/index.js

@@ -1014,66 +1014,96 @@ function normalizeMCPTools(value) {
   return tools;
 }
 
-// src/transport.ts
-import { randomBytes as randomBytes2 } from "node:crypto";
-import * as https2 from "node:https";
-import * as net2 from "node:net";
-import { ConfigError, ToolError } from "@wrongstack/core";
-function isTlsUnsafeAllowed() {
-  return process.env["WRONGSTACK_UNSAFE_MCP_TLS"] === "1";
-}
-function validateTransportUrl(rawUrl) {
-  let url;
-  try {
-    url = new URL(rawUrl);
-  } catch {
-    throw new ConfigError({
-      message: `MCP transport: invalid URL "${rawUrl}"`,
-      code: "CONFIG_INVALID",
-      context: { field: "url", rawUrl }
-    });
-  }
-  if (url.protocol !== "http:" && url.protocol !== "https:") {
-    throw new ConfigError({
-      message: `MCP transport: unsupported protocol "${url.protocol}" \u2014 only http/https allowed`,
-      code: "CONFIG_INVALID",
-      context: { field: "url", rawUrl, protocol: url.protocol }
-    });
+// src/transport-jsonrpc.ts
+import { ToolError } from "@wrongstack/core";
+function isJsonRpcResult(v) {
+  if (typeof v !== "object" || v === null) return false;
+  const r = v;
+  if (r["jsonrpc"] !== "2.0" || typeof r["id"] !== "number") return false;
+  if (Object.hasOwn(r, "method")) return false;
+  const hasResult = Object.hasOwn(r, "result");
+  const hasError = Object.hasOwn(r, "error");
+  if (hasResult === hasError) return false;
+  if (hasError) {
+    const error = r["error"];
+    return typeof error === "object" && error !== null && typeof error["code"] === "number" && typeof error["message"] === "string";
   }
-  const hostname = url.hostname;
-  const host = hostname.startsWith("[") && hostname.endsWith("]") ? hostname.slice(1, -1) : hostname;
-  const ipVersion = net2.isIP(host);
-  if (ipVersion === 4) {
-    const parts = host.split(".").map(Number);
-    if (parts[0] === 169 && parts[1] === 254) {
-      throw new ConfigError({
-        message: `MCP transport: blocked link-local/IMDS address "${hostname}" \u2014 likely not a valid MCP server`,
-        code: "CONFIG_INVALID",
-        context: { field: "url", rawUrl, hostname }
-      });
+  return true;
+}
+function isJsonRpcMethodEnvelope(v) {
+  if (typeof v !== "object" || v === null) return false;
+  const envelope = v;
+  if (envelope["jsonrpc"] !== "2.0" || typeof envelope["method"] !== "string") return false;
+  const id = envelope["id"];
+  return id === void 0 || typeof id === "number" || typeof id === "string";
+}
+function extractJsonRpcEnvelopes(text) {
+  const out = [];
+  let dataBuf = [];
+  const flush = () => {
+    if (dataBuf.length === 0) return;
+    const joined = dataBuf.join("\n").trim();
+    dataBuf = [];
+    if (!joined) return;
+    try {
+      const parsed = JSON.parse(joined);
+      if (isJsonRpcResult(parsed) || isJsonRpcMethodEnvelope(parsed)) out.push(parsed);
+    } catch {
     }
-  } else if (ipVersion === 6) {
-    const lower = host.toLowerCase();
-    const linkLocal = /^fe[89ab]/.test(lower);
-    if (linkLocal || lower === "fd00:ec2::254") {
-      throw new ConfigError({
-        message: `MCP transport: blocked link-local/IMDS address "${hostname}" \u2014 likely not a valid MCP server`,
-        code: "CONFIG_INVALID",
-        context: { field: "url", rawUrl, hostname }
-      });
+  };
+  for (const raw of text.split("\n")) {
+    const line = raw.replace(/\r$/, "");
+    if (line === "") {
+      flush();
+      continue;
     }
-  }
-  if (url.protocol === "http:") {
-    const isLoopback = hostname === "localhost" || hostname === "127.0.0.1" || hostname === "::1" || hostname === "[::1]";
-    if (!isLoopback) {
-      throw new ConfigError({
-        message: `MCP transport: http:// is only allowed for loopback addresses; use https:// for "${hostname}"`,
-        code: "CONFIG_INVALID",
-        context: { field: "url", rawUrl, hostname, protocol: url.protocol }
-      });
+    if (line.startsWith(":")) continue;
+    if (line.startsWith("data:")) {
+      let v = line.slice(5);
+      if (v.startsWith(" ")) v = v.slice(1);
+      dataBuf.push(v);
+      continue;
+    }
+    if (line.startsWith("event:") || line.startsWith("id:") || line.startsWith("retry:")) {
+      continue;
+    }
+    const trimmed = line.trim();
+    if (trimmed.startsWith("{") || trimmed.startsWith("[")) {
+      try {
+        const parsed = JSON.parse(trimmed);
+        if (isJsonRpcResult(parsed) || isJsonRpcMethodEnvelope(parsed)) out.push(parsed);
+      } catch {
+      }
     }
   }
+  flush();
+  return out;
 }
+function extractJsonRpcResults(text) {
+  return extractJsonRpcEnvelopes(text).filter(isJsonRpcResult);
+}
+function assertMatchingJsonRpcResult(data, expectedId, method) {
+  if (!isJsonRpcResult(data)) {
+    throw new ToolError({
+      message: "Invalid JSON-RPC response: not a JSON-RPC 2.0 envelope",
+      code: "TOOL_EXECUTION_FAILED",
+      toolName: "mcp_transport_jsonrpc",
+      context: { method, expectedId, reason: "not-jsonrpc-envelope" }
+    });
+  }
+  if (data.id !== expectedId) {
+    throw new ToolError({
+      message: `Invalid JSON-RPC response: id mismatch for ${method} (expected ${expectedId}, got ${data.id})`,
+      code: "TOOL_EXECUTION_FAILED",
+      toolName: "mcp_transport_jsonrpc",
+      context: { method, expectedId, actualId: data.id, reason: "id-mismatch" }
+    });
+  }
+  return data;
+}
+
+// src/sse-reader.ts
+import { ToolError as ToolError2 } from "@wrongstack/core";
 var SSE_READER_MAX_BUFFER = 256 * 1024;
 var SSE_READER_MAX_DATA_LINES = 1024;
 var SSEReader = class {
@@ -1089,7 +1119,7 @@ var SSEReader = class {
   }
   feed(chunk) {
     if (chunk.length > SSE_READER_MAX_BUFFER) {
-      throw new ToolError({
+      throw new ToolError2({
         message: `SSE: chunk size ${chunk.length} exceeds max buffer ${SSE_READER_MAX_BUFFER} \u2014 refusing to accumulate`,
         code: "TOOL_EXECUTION_FAILED",
         toolName: "mcp_transport_sse_reader",
@@ -1098,7 +1128,7 @@ var SSEReader = class {
     }
     this.buffer += chunk;
     if (this.buffer.length > SSE_READER_MAX_BUFFER) {
-      throw new ToolError({
+      throw new ToolError2({
         message: `SSE: pending line exceeds ${SSE_READER_MAX_BUFFER} bytes \u2014 upstream is not framing events`,
         code: "TOOL_EXECUTION_FAILED",
         toolName: "mcp_transport_sse_reader",
@@ -1130,7 +1160,7 @@ var SSEReader = class {
     if (field === "event") {
     } else if (field === "data") {
       if (this.dataLines.length >= SSE_READER_MAX_DATA_LINES) {
-        throw new ToolError({
+        throw new ToolError2({
           message: `SSE: exceeded ${SSE_READER_MAX_DATA_LINES} data lines per event \u2014 upstream is not sending blank-line delimiters`,
           code: "TOOL_EXECUTION_FAILED",
           toolName: "mcp_transport_sse_reader",
@@ -1171,91 +1201,71 @@ var SSEReader = class {
     this.listeners = [];
   }
 };
-function isJsonRpcResult(v) {
-  if (typeof v !== "object" || v === null) return false;
-  const r = v;
-  if (r["jsonrpc"] !== "2.0" || typeof r["id"] !== "number") return false;
-  if (Object.hasOwn(r, "method")) return false;
-  const hasResult = Object.hasOwn(r, "result");
-  const hasError = Object.hasOwn(r, "error");
-  if (hasResult === hasError) return false;
-  if (hasError) {
-    const error = r["error"];
-    return typeof error === "object" && error !== null && typeof error["code"] === "number" && typeof error["message"] === "string";
-  }
-  return true;
-}
-function isJsonRpcMethodEnvelope(v) {
-  if (typeof v !== "object" || v === null) return false;
-  const envelope = v;
-  if (envelope["jsonrpc"] !== "2.0" || typeof envelope["method"] !== "string") return false;
-  const id = envelope["id"];
-  return id === void 0 || typeof id === "number" || typeof id === "string";
-}
-function extractJsonRpcEnvelopes(text) {
-  const out = [];
-  let dataBuf = [];
-  const flush = () => {
-    if (dataBuf.length === 0) return;
-    const joined = dataBuf.join("\n").trim();
-    dataBuf = [];
-    if (!joined) return;
-    try {
-      const parsed = JSON.parse(joined);
-      if (isJsonRpcResult(parsed) || isJsonRpcMethodEnvelope(parsed)) out.push(parsed);
-    } catch {
-    }
-  };
-  for (const raw of text.split("\n")) {
-    const line = raw.replace(/\r$/, "");
-    if (line === "") {
-      flush();
-      continue;
-    }
-    if (line.startsWith(":")) continue;
-    if (line.startsWith("data:")) {
-      let v = line.slice(5);
-      if (v.startsWith(" ")) v = v.slice(1);
-      dataBuf.push(v);
-      continue;
-    }
-    if (line.startsWith("event:") || line.startsWith("id:") || line.startsWith("retry:")) {
-      continue;
-    }
-    const trimmed = line.trim();
-    if (trimmed.startsWith("{") || trimmed.startsWith("[")) {
-      try {
-        const parsed = JSON.parse(trimmed);
-        if (isJsonRpcResult(parsed) || isJsonRpcMethodEnvelope(parsed)) out.push(parsed);
-      } catch {
-      }
-    }
-  }
-  flush();
-  return out;
-}
-function extractJsonRpcResults(text) {
-  return extractJsonRpcEnvelopes(text).filter(isJsonRpcResult);
+
+// src/transport-base.ts
+import * as https2 from "node:https";
+import { ConfigError as ConfigError2 } from "@wrongstack/core";
+
+// src/transport-security.ts
+import * as net2 from "node:net";
+import { ConfigError } from "@wrongstack/core";
+function isTlsUnsafeAllowed() {
+  return process.env["WRONGSTACK_UNSAFE_MCP_TLS"] === "1";
 }
-function assertMatchingJsonRpcResult(data, expectedId, method) {
-  if (!isJsonRpcResult(data)) {
-    throw new ToolError({
-      message: "Invalid JSON-RPC response: not a JSON-RPC 2.0 envelope",
-      code: "TOOL_EXECUTION_FAILED",
-      toolName: "mcp_transport_jsonrpc",
-      context: { method, expectedId, reason: "not-jsonrpc-envelope" }
+function validateTransportUrl(rawUrl) {
+  let url;
+  try {
+    url = new URL(rawUrl);
+  } catch {
+    throw new ConfigError({
+      message: `MCP transport: invalid URL "${rawUrl}"`,
+      code: "CONFIG_INVALID",
+      context: { field: "url", rawUrl }
     });
   }
-  if (data.id !== expectedId) {
-    throw new ToolError({
-      message: `Invalid JSON-RPC response: id mismatch for ${method} (expected ${expectedId}, got ${data.id})`,
-      code: "TOOL_EXECUTION_FAILED",
-      toolName: "mcp_transport_jsonrpc",
-      context: { method, expectedId, actualId: data.id, reason: "id-mismatch" }
+  if (url.protocol !== "http:" && url.protocol !== "https:") {
+    throw new ConfigError({
+      message: `MCP transport: unsupported protocol "${url.protocol}" \u2014 only http/https allowed`,
+      code: "CONFIG_INVALID",
+      context: { field: "url", rawUrl, protocol: url.protocol }
     });
   }
-  return data;
+  const hostname = url.hostname;
+  const host = hostname.startsWith("[") && hostname.endsWith("]") ? hostname.slice(1, -1) : hostname;
+  const ipVersion = net2.isIP(host);
+  if (ipVersion === 4) {
+    const parts = host.split(".").map(Number);
+    if (parts[0] === 169 && parts[1] === 254) {
+      throw new ConfigError({
+        message: `MCP transport: blocked link-local/IMDS address "${hostname}" \u2014 likely not a valid MCP server`,
+        code: "CONFIG_INVALID",
+        context: { field: "url", rawUrl, hostname }
+      });
+    }
+  } else if (ipVersion === 6) {
+    const lower = host.toLowerCase();
+    const linkLocal = /^fe[89ab]/.test(lower);
+    if (linkLocal || lower === "fd00:ec2::254") {
+      throw new ConfigError({
+        message: `MCP transport: blocked link-local/IMDS address "${hostname}" \u2014 likely not a valid MCP server`,
+        code: "CONFIG_INVALID",
+        context: { field: "url", rawUrl, hostname }
+      });
+    }
+  }
+  if (url.protocol === "http:") {
+    const isLoopback = hostname === "localhost" || hostname === "127.0.0.1" || hostname === "::1" || hostname === "[::1]";
+    if (!isLoopback) {
+      throw new ConfigError({
+        message: `MCP transport: http:// is only allowed for loopback addresses; use https:// for "${hostname}"`,
+        code: "CONFIG_INVALID",
+        context: { field: "url", rawUrl, hostname, protocol: url.protocol }
+      });
+    }
+  }
 }
+
+// src/transport-base.ts
 function makeAbortError(method) {
   const err = new Error(`MCP request "${method}" aborted by client`);
   err.name = "AbortError";
@@ -1312,7 +1322,7 @@ var BaseHTTPTransport = class {
     if (opts.tls) {
       if (opts.tls.rejectUnauthorized === false) {
         if (!isTlsUnsafeAllowed()) {
-          throw new ConfigError({
+          throw new ConfigError2({
             message: `[mcp:${transportName}] TLS verification disabled \u2014 set WRONGSTACK_UNSAFE_MCP_TLS=1 to allow. Rejecting insecure configuration for ${this.url}.`,
             code: "CONFIG_INVALID",
             context: { field: "tls.rejectUnauthorized", transportName, url: this.url }
@@ -1439,6 +1449,10 @@ var BaseHTTPTransport = class {
     }
   }
 };
+
+// src/transport-sse.ts
+import { randomBytes as randomBytes2 } from "node:crypto";
+import { ToolError as ToolError3 } from "@wrongstack/core";
 var SSETransport = class extends BaseHTTPTransport {
   _nextId = 1;
   readerDone = false;
@@ -1485,7 +1499,7 @@ var SSETransport = class extends BaseHTTPTransport {
       this.applyTlsAgent(fetchOpts);
       const response = await this.fetchWithAuthorization(sseUrl, fetchOpts, signal);
       if (!response.ok) {
-        throw new ToolError({
+        throw new ToolError3({
           message: `SSE connect HTTP ${response.status}: ${response.statusText}`,
           code: "TOOL_EXECUTION_FAILED",
           toolName: "mcp_transport_sse_connect",
@@ -1493,7 +1507,7 @@ var SSETransport = class extends BaseHTTPTransport {
         });
       }
       if (!response.body) {
-        throw new ToolError({
+        throw new ToolError3({
           message: "SSE response has no body",
           code: "TOOL_EXECUTION_FAILED",
           toolName: "mcp_transport_sse_connect",
@@ -1526,7 +1540,7 @@ var SSETransport = class extends BaseHTTPTransport {
         clientInfo: MCP_CONSTANTS.CLIENT_INFO
       });
       if (initRes.error) {
-        throw new ToolError({
+        throw new ToolError3({
           message: `initialize failed: ${initRes.error.message}`,
           code: "TOOL_EXECUTION_FAILED",
           toolName: "mcp_transport_initialize",
@@ -1601,7 +1615,7 @@ var SSETransport = class extends BaseHTTPTransport {
         const body2 = await res.text();
         const cap = MCP_CONSTANTS.REQUEST_LOG_CAP;
         const snippet = body2.length > cap ? `${body2.slice(0, cap)}\u2026 [${body2.length} bytes total]` : body2;
-        throw new ToolError({
+        throw new ToolError3({
           message: `HTTP ${res.status}: ${snippet}`,
           code: "TOOL_EXECUTION_FAILED",
           toolName: method,
@@ -1612,7 +1626,7 @@ var SSETransport = class extends BaseHTTPTransport {
       try {
         data = await res.json();
       } catch (err) {
-        throw new ToolError({
+        throw new ToolError3({
           message: `Invalid JSON-RPC response: ${err instanceof Error ? err.message : "parse failed"}`,
           code: "TOOL_EXECUTION_FAILED",
           toolName: method,
@@ -1637,7 +1651,7 @@ var SSETransport = class extends BaseHTTPTransport {
   }
   async callTool(name, input, opts) {
     if (this.state !== "connected") {
-      throw new ToolError({
+      throw new ToolError3({
         message: `SSE transport not connected (state=${this.state})`,
         code: "TOOL_EXECUTION_FAILED",
         toolName: name,
@@ -1674,7 +1688,7 @@ var SSETransport = class extends BaseHTTPTransport {
     try {
       const res = await this.fetchWithAuthorization(this.url, fetchOpts, timeoutSignal.signal);
       if (!res.ok) {
-        throw new ToolError({
+        throw new ToolError3({
           message: `HTTP ${res.status}: ${res.statusText}`,
           code: "TOOL_EXECUTION_FAILED",
           toolName: method,
@@ -1690,7 +1704,7 @@ var SSETransport = class extends BaseHTTPTransport {
       try {
         data = await res.json();
       } catch (err) {
-        throw new ToolError({
+        throw new ToolError3({
           message: `Invalid JSON-RPC response: ${err instanceof Error ? err.message : "parse failed"}`,
           code: "TOOL_EXECUTION_FAILED",
           toolName: method,
@@ -1731,6 +1745,8 @@ var SSETransport = class extends BaseHTTPTransport {
     this.state = "disconnected";
   }
 };
+
+// src/transport-streamable.ts
 var StreamableHTTPTransport = class extends BaseHTTPTransport {
   _nextId = 1;
   sessionId;