@wrongstack/mcp 1.0.27 → 1.0.28

package/dist/index.js

@@ -45,7 +45,9 @@ function parseMcpBearerChallenge(header, resource) {
   const resourceMetadata = challengeParameter(parameters, "resource_metadata");
   if (resourceMetadata) {
     const metadataUrl = validateMetadataUrl(resourceMetadata);
-    if (metadataUrl) challenge.resourceMetadataUrl = metadataUrl;
+    if (metadataUrl && isSameHost(metadataUrl, resource)) {
+      challenge.resourceMetadataUrl = metadataUrl;
+    }
   }
   const scope = challengeParameter(parameters, "scope");
   if (scope) {
@@ -194,6 +196,13 @@ function validateMetadataUrl(value) {
     return void 0;
   }
 }
+function isSameHost(candidate, resource) {
+  try {
+    return unbracket(new URL(candidate).hostname).toLowerCase() === unbracket(new URL(resource).hostname).toLowerCase();
+  } catch {
+    return false;
+  }
+}
 function record(value, label2) {
   if (!value || typeof value !== "object" || Array.isArray(value)) {
     throw new Error(`MCP ${label2} must be an object`);
@@ -1892,7 +1901,7 @@ function validateElicitationContent(fields, content) {
       out[field.name] = [];
       continue;
     }
-    if (raw === void 0 || raw === null || raw === "" || Array.isArray(raw) && raw.length === 0) {
+    if (raw === void 0 || raw === null || Array.isArray(raw) && raw.length === 0) {
       if (field.required) return { ok: false, error: `${label(field)} is required` };
       continue;
     }
@@ -4607,8 +4616,12 @@ function toUserInputRequest(request3, problem) {
 function answerValue(field, answer) {
   if (!answer || answer.delegated) return void 0;
   switch (field.kind) {
-    case "string":
-      return answer.text?.trim() ? answer.text : void 0;
+    case "string": {
+      const text = answer.text;
+      if (text === void 0) return void 0;
+      if (!text.trim() && !field.required) return void 0;
+      return text;
+    }
     case "number":
     case "integer":
       return answer.text?.trim() || void 0;
@@ -4695,8 +4708,14 @@ async function readConfig(path2) {
 async function writeConfig(path2, cfg) {
   const raw = JSON.stringify(cfg, null, 2);
   const tmp = `${path2}.${process.pid}.${randomBytes3(6).toString("hex")}.tmp`;
-  await fs.writeFile(tmp, raw, "utf8");
+  let mode = 384;
+  try {
+    mode = (await fs.stat(path2)).mode & 511;
+  } catch {
+  }
   try {
+    await fs.writeFile(tmp, raw, { encoding: "utf8", mode });
+    await fs.chmod(tmp, mode);
     await fs.rename(tmp, path2);
   } catch (err) {
     await fs.rm(tmp, { force: true });
@@ -5130,52 +5149,59 @@ function healthStateFor(connectionState, operations, enabled = true) {
 function evaluateHealthThresholds(operations, thresholds) {
   if (!thresholds) return [];
   const checks = [];
-  if (thresholds.connectionLatencyP95Ms !== void 0 && operations.connectionSamples.length > 0) {
+  const connectionP95 = thresholds.connectionLatencyP95Ms;
+  if (isUsableThreshold(connectionP95) && operations.connectionSamples.length > 0) {
     const value = percentile(
       [...operations.connectionSamples].sort((a, b) => a - b),
       0.95
     );
     checks.push({
       name: "connection-latency-p95",
-      passed: value <= thresholds.connectionLatencyP95Ms,
+      passed: value <= connectionP95,
       value,
-      threshold: thresholds.connectionLatencyP95Ms
+      threshold: connectionP95
     });
   }
-  if (thresholds.discoveryLatencyP95Ms !== void 0 && operations.discoverySamples.length > 0) {
+  const discoveryP95 = thresholds.discoveryLatencyP95Ms;
+  if (isUsableThreshold(discoveryP95) && operations.discoverySamples.length > 0) {
     const value = percentile(
       [...operations.discoverySamples].sort((a, b) => a - b),
       0.95
     );
     checks.push({
       name: "discovery-latency-p95",
-      passed: value <= thresholds.discoveryLatencyP95Ms,
+      passed: value <= discoveryP95,
       value,
-      threshold: thresholds.discoveryLatencyP95Ms
+      threshold: discoveryP95
     });
   }
-  if (thresholds.callLatencyP95Ms !== void 0 && operations.callSamples.length > 0) {
+  const callP95 = thresholds.callLatencyP95Ms;
+  if (isUsableThreshold(callP95) && operations.callSamples.length > 0) {
     const value = percentile(
       [...operations.callSamples].sort((a, b) => a - b),
       0.95
     );
     checks.push({
       name: "call-latency-p95",
-      passed: value <= thresholds.callLatencyP95Ms,
+      passed: value <= callP95,
       value,
-      threshold: thresholds.callLatencyP95Ms
+      threshold: callP95
     });
   }
-  if (thresholds.inFlightCalls !== void 0) {
+  const inFlight = thresholds.inFlightCalls;
+  if (isUsableThreshold(inFlight)) {
     checks.push({
       name: "in-flight-calls",
-      passed: operations.peakInFlightCalls <= thresholds.inFlightCalls,
+      passed: operations.peakInFlightCalls <= inFlight,
       value: operations.peakInFlightCalls,
-      threshold: thresholds.inFlightCalls
+      threshold: inFlight
     });
   }
   return checks;
 }
+function isUsableThreshold(value) {
+  return typeof value === "number" && Number.isFinite(value);
+}
 function applyHealthThresholds(state, checks) {
   if (state !== "healthy") return state;
   return checks.some((c) => !c.passed) ? "degraded" : "healthy";
@@ -6902,6 +6928,7 @@ function serveStdio(server, opts = {}) {
   let bufferBytes = 0;
   let closed = false;
   let bufferTooLarge = false;
+  const decoder = new TextDecoder();
   let writeChain = Promise.resolve();
   const inFlightHandlers = /* @__PURE__ */ new Set();
   const writeLine = (s) => {
@@ -6924,7 +6951,7 @@ function serveStdio(server, opts = {}) {
   };
   const onData = (chunk) => {
     if (bufferTooLarge) return;
-    const text = typeof chunk === "string" ? chunk : chunk.toString("utf8");
+    const text = typeof chunk === "string" ? chunk : decoder.decode(chunk, { stream: true });
     buffer += text;
     bufferBytes += Buffer.byteLength(text, "utf8");
     if (bufferBytes > HTTP_BODY_CAP) {
@@ -7215,8 +7242,8 @@ var MCPVaultTokenStore = class {
   async readFile() {
     let raw;
     try {
-      const stat2 = await fs3.stat(this.filePath);
-      if (stat2.size > MAX_STORE_BYTES) throw new Error("MCP token store exceeds size limit");
+      const stat3 = await fs3.stat(this.filePath);
+      if (stat3.size > MAX_STORE_BYTES) throw new Error("MCP token store exceeds size limit");
       raw = await fs3.readFile(this.filePath, "utf8");
     } catch (error) {
       if (error.code === "ENOENT") return emptyFile();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wrongstack/mcp",
-  "version": "1.0.27",
+  "version": "1.0.28",
   "license": "MIT",
   "description": "WrongStack Model Context Protocol client and registry: stdio, SSE, and streamable HTTP transports.",
   "repository": {
@@ -26,7 +26,7 @@
     "!dist/**/*.map"
   ],
   "dependencies": {
-    "@wrongstack/core": "1.0.27",
+    "@wrongstack/core": "1.0.28",
     "undici": "^8.10.2"
   },
   "devDependencies": {