a2acalling 0.6.73 → 0.6.75

package/src/lib/runtime-adapter.js

@@ -152,6 +152,11 @@ function normalizeOpenClawOutput(raw) {
 }
 
 
+function readPositiveIntEnv(name, fallback) {
+  const parsed = Number.parseInt(process.env[name] || '', 10);
+  return Number.isFinite(parsed) && parsed > 0 ? parsed : fallback;
+}
+
 function createRuntimeAdapter(options = {}) {
   const workspaceDir = options.workspaceDir || process.cwd();
   const modeInfo = resolveRuntimeMode();
@@ -172,6 +177,33 @@ function createRuntimeAdapter(options = {}) {
   // Design decision (A2A-29): we keep per-conversation state for prompt/metadata
   // continuity, but Claude execution itself is stateless (no `--resume`).
   const claudeSessions = new Map();
+  const CLAUDE_SESSION_TTL_MS = readPositiveIntEnv('A2A_CLAUDE_SESSION_TTL_MS', 6 * 60 * 60 * 1000);
+  const MAX_CLAUDE_SESSIONS = readPositiveIntEnv('A2A_CLAUDE_MAX_SESSIONS', 500);
+
+  // A2A-69: TTL-based pruning for Claude session state.
+  // Follows the same pattern as pruneCollaborationSessions() in server.js:
+  // 1. Evict entries older than TTL
+  // 2. If still over max, evict oldest-first
+  function pruneClaudeSessions() {
+    const now = Date.now();
+    for (const [id, session] of claudeSessions.entries()) {
+      const updatedAt = Number(session?.updatedAt || 0);
+      if (!updatedAt || now - updatedAt > CLAUDE_SESSION_TTL_MS) {
+        claudeSessions.delete(id);
+      }
+    }
+
+    if (claudeSessions.size <= MAX_CLAUDE_SESSIONS) {
+      return;
+    }
+
+    const oldest = Array.from(claudeSessions.entries())
+      .sort((a, b) => (a[1]?.updatedAt || 0) - (b[1]?.updatedAt || 0));
+    const toDelete = claudeSessions.size - MAX_CLAUDE_SESSIONS;
+    for (let i = 0; i < toDelete; i++) {
+      claudeSessions.delete(oldest[i][0]);
+    }
+  }
 
   async function runClaudeTurnAdapter({ sessionId, message, caller, context, timeoutMs }) {
     const traceId = context?.traceId || context?.trace_id;
@@ -179,6 +211,9 @@ function createRuntimeAdapter(options = {}) {
     const conversationId = context?.conversationId || context?.conversation_id;
     const startAt = Date.now();
 
+    // A2A-69: prune stale sessions before accessing/creating state
+    pruneClaudeSessions();
+
     // Get or create session state
     let session = claudeSessions.get(sessionId);
     if (!session) {
@@ -191,6 +226,7 @@ function createRuntimeAdapter(options = {}) {
         systemPrompt: '',
         turnCount: 0,
         lastMeta: null,
+        updatedAt: Date.now(),
         // Keep a permission snapshot so summary runs with the same policy envelope.
         permissionSnapshot: {
           capabilities: Array.isArray(context?.capabilities) ? context.capabilities : [],
@@ -227,6 +263,7 @@ function createRuntimeAdapter(options = {}) {
       claudeSessions.set(sessionId, session);
     }
 
+    session.updatedAt = Date.now();
     session.turnCount++;
 
     logger.debug('Invoking Claude subagent turn', {
@@ -651,7 +688,10 @@ function createRuntimeAdapter(options = {}) {
     runTurn,
     summarize,
     notify,
-    getLastTurnMeta
+    getLastTurnMeta,
+    // A2A-69: exposed for testing
+    _claudeSessions: claudeSessions,
+    _pruneClaudeSessions: pruneClaudeSessions
   };
 }
 

package/src/routes/a2a.js

@@ -12,6 +12,8 @@ const { TokenStore } = require('../lib/tokens');
 const crypto = require('crypto');
 const { createLogger, createTraceId } = require('../lib/logger');
 const { verifySignature, isTimestampValid, fingerprint } = require('../lib/crypto');
+const { buildAgentCard } = require('../lib/agent-card');
+const { isDirectLocalRequest } = require('../lib/local-request');
 
 // Lazy-load conversation store (optional dependency)
 let ConversationStore = null;
@@ -66,14 +68,6 @@ const MAX_MESSAGE_LENGTH = 10000;  // 10KB max message
 const MAX_TIMEOUT_SECONDS = 300;   // 5 min max timeout
 const MIN_TIMEOUT_SECONDS = 5;     // 5 sec min timeout
 
-function isLoopbackAddress(ip) {
-  if (!ip) return false;
-  if (ip === '::1' || ip === '127.0.0.1' || ip === '::ffff:127.0.0.1') {
-    return true;
-  }
-  return ip.startsWith('::ffff:127.');
-}
-
 function resolveTraceId(req) {
   const headerTrace = req.headers['x-trace-id'];
   if (typeof headerTrace === 'string' && headerTrace.trim()) {
@@ -234,6 +228,73 @@ function createRoutes(options = {}) {
     } catch (_) {}
   }
 
+  // A2A-78: shared inbound auth pipeline for /invoke, /message:send, /end
+  // Returns { validation, identityVerified, publicKeyFingerprint } or sends error response and returns null
+  async function validateInboundAuth(req, res, reqLogger, endpoint) {
+    const withTracePayload = (payload) => ({ ...payload, trace_id: res.getHeader('x-trace-id'), request_id: res.getHeader('x-request-id') });
+
+    const authHeader = req.headers.authorization;
+    if (!authHeader || !authHeader.startsWith('Bearer ')) {
+      reqLogger.warn('Request missing bearer token', {
+        error_code: 'AUTH_MISSING_BEARER',
+        status_code: 401,
+        hint: 'Send Authorization: Bearer <a2a_token>.'
+      });
+      res.status(401).json(withTracePayload({
+        success: false,
+        error: 'missing_token',
+        message: 'Authorization header required'
+      }));
+      return null;
+    }
+
+    const token = authHeader.slice(7);
+    const validation = tokenStore.validate(token);
+    if (!validation.valid) {
+      reqLogger.warn('Token validation failed', {
+        error_code: 'TOKEN_INVALID_OR_EXPIRED',
+        status_code: 401,
+        hint: 'Create a fresh invite token and retry with the new bearer token.'
+      });
+      res.status(401).json(withTracePayload({
+        success: false,
+        error: 'unauthorized',
+        message: 'Invalid or expired token'
+      }));
+      return null;
+    }
+
+    const rateCheck = checkRateLimit(validation.id, limits);
+    if (rateCheck.limited) {
+      reqLogger.warn('Request rate limited', {
+        tokenId: validation.id,
+        error_code: 'TOKEN_RATE_LIMITED',
+        status_code: 429,
+        hint: 'Respect Retry-After and reduce invoke frequency for this token.',
+        data: { retry_after: rateCheck.retryAfter }
+      });
+      res.set('Retry-After', rateCheck.retryAfter);
+      res.status(429).json(withTracePayload({
+        success: false,
+        error: rateCheck.error,
+        message: rateCheck.message
+      }));
+      return null;
+    }
+
+    const sigCheck = verifySigHeaders(req, validation, endpoint, reqLogger);
+    if (sigCheck.error) {
+      res.status(sigCheck.error.status).json(withTracePayload(sigCheck.error.body));
+      return null;
+    }
+
+    return {
+      validation,
+      identityVerified: sigCheck.identityVerified,
+      publicKeyFingerprint: sigCheck.publicKeyFingerprint
+    };
+  }
+
   // A2A-52: shared signature verification helper for /invoke and /end
   function verifySigHeaders(req, validation, endpoint, reqLogger, withTracePayload) {
     const sigHeader = req.headers['x-a2a-signature'];
@@ -285,6 +346,73 @@ function createRoutes(options = {}) {
     return result;
   }
 
+  // A2A-78: Google A2A ↔ internal format translation
+  function translateGoogleToInternal(body) {
+    const msg = body?.message;
+    if (!msg || !Array.isArray(msg.parts) || msg.parts.length === 0) {
+      return { error: { status: 400, code: 'invalid_message', message: 'message.parts array is required and must not be empty' } };
+    }
+
+    const textParts = [];
+    let skippedNonText = 0;
+    for (const part of msg.parts) {
+      if (part?.content && typeof part.content.text === 'string') {
+        textParts.push(part.content.text);
+      } else {
+        skippedNonText++;
+      }
+    }
+
+    const message = textParts.join('\n');
+    if (!message) {
+      return { error: { status: 400, code: 'no_text_content', message: 'No text content in message parts' } };
+    }
+
+    const config = body.configuration || {};
+    const metadata = body.metadata || {};
+
+    return {
+      message,
+      conversation_id: msg.context_id || null,
+      caller: {
+        name: String(metadata.caller_name || '').slice(0, 100),
+        owner: String(metadata.caller_owner || '').slice(0, 100),
+        instance: String(metadata.caller_instance || '').slice(0, 200),
+        context: ''
+      },
+      timeout_seconds: Number(config.timeout_seconds) || 60,
+      blocking: config.blocking !== false,
+      skippedNonText
+    };
+  }
+
+  function translateInternalToGoogle(response, conversationId, tier, disclosure, callsRemaining) {
+    const canContinue = response.canContinue !== false;
+    const taskId = `task_${Date.now()}_${crypto.randomBytes(6).toString('hex')}`;
+    const messageId = `resp_${Date.now()}_${crypto.randomBytes(6).toString('hex')}`;
+
+    return {
+      task: {
+        id: taskId,
+        context_id: conversationId,
+        status: {
+          state: canContinue ? 'input-required' : 'completed',
+          message: {
+            message_id: messageId,
+            role: 'agent',
+            parts: [{ content: { text: response.text } }]
+          },
+          timestamp: new Date().toISOString()
+        },
+        metadata: {
+          'openclaw:tier': tier,
+          'openclaw:disclosure': disclosure,
+          'openclaw:calls_remaining': callsRemaining
+        }
+      }
+    };
+  }
+
   /**
    * GET /status
    * Check if A2A is enabled
@@ -305,6 +433,30 @@ function createRoutes(options = {}) {
     res.json(response);
   });
 
+  /**
+   * GET /agent-card
+   * Convenience mirror of /.well-known/a2a-agent-card (A2A-76)
+   */
+  router.get('/agent-card', (req, res) => {
+    const { A2AConfig } = require('../lib/config');
+    const { getTopicsForTier } = require('../lib/disclosure');
+    const cfg = new A2AConfig();
+    const agent = cfg.getAgent();
+    const manifest = getTopicsForTier('public');
+    const keypair = cfg.getKeypair();
+    const hostname = (agent && agent.hostname) || process.env.A2A_HOSTNAME || req.headers.host || 'localhost';
+    const protocol = req.protocol || 'https';
+    const card = buildAgentCard({
+      config: agent,
+      manifest,
+      publicKey: keypair ? keypair.publicKey : null,
+      serverUrl: `${protocol}://${hostname}`,
+      version: require('../../package.json').version
+    });
+    res.set('Cache-Control', 'public, max-age=3600');
+    res.json(card);
+  });
+
   /**
    * GET /ping
    * Simple health check
@@ -314,93 +466,268 @@ function createRoutes(options = {}) {
   });
 
   /**
-   * POST /invoke
-   * Call the agent
+   * POST /message:send
+   * Google A2A protocol inbound endpoint (A2A-78)
+   * Accepts standard A2A wire format and translates to internal invoke.
+   * Registered on both escaped-colon and percent-encoded paths for compatibility.
    */
-  router.post('/invoke', async (req, res) => {
+  async function handleMessageSend(req, res) {
     const startedAt = Date.now();
     const traceId = resolveTraceId(req);
     const requestId = resolveRequestId(req);
-    const reqLogger = logger.child({ traceId, requestId, event: 'invoke' });
+    const reqLogger = logger.child({ traceId, requestId, event: 'message_send' });
     const withTracePayload = (payload) => ({ ...payload, trace_id: traceId, request_id: requestId });
     res.set('x-trace-id', traceId);
     res.set('x-request-id', requestId);
-    reqLogger.info('Received invoke request', {
+    reqLogger.info('Received Google A2A message:send request', {
       data: {
         ip: req.ip,
         request_id: requestId,
         client_host: extractClientHost(req),
-        forwarded_for: req.headers['x-forwarded-for'] || null,
-        user_agent: req.headers['user-agent'] || null,
         has_auth_header: Boolean(req.headers.authorization)
       }
     });
-    reqLogger.debug('Invoke request metadata', {
-      event: 'invoke_request_metadata',
-      data: normalizeRequestMetadata(req)
-    });
 
-    // Extract token
-    const authHeader = req.headers.authorization;
-    if (!authHeader || !authHeader.startsWith('Bearer ')) {
-      reqLogger.warn('Invoke request missing bearer token', {
-        error_code: 'AUTH_MISSING_BEARER',
-        status_code: 401,
-        hint: 'Send Authorization: Bearer <a2a_token>.'
+    // Warn if non-blocking mode requested (not yet supported)
+    const bodyConfig = req.body?.configuration;
+    if (bodyConfig?.blocking === false) {
+      reqLogger.warn('Non-blocking mode requested but not supported', {
+        hint: 'Async task polling is not yet implemented. Request will be processed synchronously.'
       });
-      return res.status(401).json(withTracePayload({ 
-        success: false, 
-        error: 'missing_token', 
-        message: 'Authorization header required' 
+    }
+
+    // Auth pipeline (shared with /invoke)
+    const auth = await validateInboundAuth(req, res, reqLogger, '/api/a2a/message:send');
+    if (!auth) return;
+    const { validation, identityVerified, publicKeyFingerprint } = auth;
+
+    // Translate Google A2A format to internal
+    const translated = translateGoogleToInternal(req.body);
+    if (translated.error) {
+      reqLogger.warn('Google A2A message validation failed', {
+        tokenId: validation.id,
+        error_code: translated.error.code,
+        status_code: translated.error.status
+      });
+      return res.status(translated.error.status).json(withTracePayload({
+        success: false,
+        error: translated.error.code,
+        message: translated.error.message
       }));
     }
 
-    const token = authHeader.slice(7);
+    if (translated.skippedNonText > 0) {
+      reqLogger.debug('Skipped non-text parts in Google A2A message', {
+        tokenId: validation.id,
+        data: { skipped_count: translated.skippedNonText }
+      });
+    }
 
-    // Validate token
-    const validation = tokenStore.validate(token);
-    if (!validation.valid) {
-      // Use generic error to prevent token enumeration
-      // All invalid token states return same response
-      reqLogger.warn('Invoke token validation failed', {
-        error_code: 'TOKEN_INVALID_OR_EXPIRED',
-        status_code: 401,
-        hint: 'Create a fresh invite token and retry with the new bearer token.'
+    // Validate message length
+    if (translated.message.length > MAX_MESSAGE_LENGTH) {
+      reqLogger.warn('Google A2A message too long', {
+        tokenId: validation.id,
+        error_code: 'REQUEST_INVALID_MESSAGE',
+        status_code: 400,
+        data: { message_length: translated.message.length }
       });
-      return res.status(401).json(withTracePayload({ 
-        success: false, 
-        error: 'unauthorized', 
-        message: 'Invalid or expired token' 
+      return res.status(400).json(withTracePayload({
+        success: false,
+        error: 'invalid_message',
+        message: `Message must be under ${MAX_MESSAGE_LENGTH} characters`
       }));
     }
 
-    // Check rate limit
-    const rateCheck = checkRateLimit(validation.id, limits);
-    if (rateCheck.limited) {
-      reqLogger.warn('Invoke request rate limited', {
+    const boundedTimeout = Math.max(MIN_TIMEOUT_SECONDS, Math.min(MAX_TIMEOUT_SECONDS, translated.timeout_seconds));
+
+    // Build a2a context (same as /invoke)
+    const isNewConversation = !translated.conversation_id;
+    const conversationId = translated.conversation_id || `conv_${Date.now()}_${crypto.randomBytes(6).toString('hex')}`;
+    const sanitizedCaller = translated.caller;
+
+    const a2aContext = {
+      mode: 'a2a',
+      token_id: validation.id,
+      token_name: validation.name,
+      tier: validation.tier,
+      capabilities: validation.capabilities,
+      allowed_topics: validation.allowed_topics,
+      allowed_goals: validation.allowed_goals,
+      allowed_tools: validation.allowed_tools,
+      timeout_ms: validation.timeout_ms,
+      caller: sanitizedCaller,
+      conversation_id: conversationId,
+      trace_id: traceId,
+      request_id: requestId,
+      identity_verified: identityVerified,
+      public_key_fingerprint: publicKeyFingerprint
+    };
+
+    // Ensure inbound caller exists as a contact
+    let ensuredContact = null;
+    try {
+      ensuredContact = tokenStore.ensureInboundContact(sanitizedCaller, validation.id);
+    } catch (_) {
+      ensuredContact = null;
+    }
+
+    // Track conversation if store available
+    if (convStore) {
+      try {
+        convStore.startConversation({
+          id: conversationId,
+          contactId: ensuredContact?.id || validation.id,
+          contactName: ensuredContact?.name || sanitizedCaller.name || validation.name,
+          tokenId: validation.id,
+          direction: 'inbound'
+        });
+        if (isNewConversation && eventStore && eventStore.isAvailable && eventStore.isAvailable()) {
+          eventStore.emitEvent('call.inbound', {
+            conversation_id: conversationId,
+            token_id: validation.id,
+            caller_name: sanitizedCaller.name || validation.name || null,
+            caller_owner: sanitizedCaller.owner || null
+          }, {
+            conversationId,
+            contactId: ensuredContact?.id || validation.id
+          });
+        }
+        if (monitor) {
+          monitor.trackActivity(conversationId, {
+            ...sanitizedCaller,
+            tier: validation.tier,
+            capabilities: validation.capabilities,
+            allowed_topics: validation.allowed_topics,
+            allowed_goals: validation.allowed_goals,
+            allowed_tools: validation.allowed_tools,
+            trace_id: traceId,
+            request_id: requestId
+          });
+        }
+        convStore.addMessage(conversationId, {
+          direction: 'inbound',
+          role: 'user',
+          content: translated.message
+        });
+      } catch (err) {
+        reqLogger.error('Conversation tracking error', {
+          conversationId,
+          tokenId: validation.id,
+          error_code: 'CONVERSATION_TRACKING_FAILED',
+          error: err
+        });
+      }
+    }
+
+    try {
+      const response = await handleMessage(translated.message, a2aContext, { timeout: boundedTimeout * 1000 });
+
+      // Store outgoing response
+      if (convStore) {
+        try {
+          convStore.addMessage(conversationId, {
+            direction: 'outbound',
+            role: 'assistant',
+            content: response.text
+          });
+        } catch (err) {
+          reqLogger.error('Message storage error', {
+            conversationId,
+            tokenId: validation.id,
+            error_code: 'CONVERSATION_MESSAGE_STORE_FAILED',
+            error: err
+          });
+        }
+      }
+
+      // Notify owner if configured
+      if (validation.notify !== 'none') {
+        notifyOwner({
+          level: validation.notify,
+          token: validation,
+          caller: sanitizedCaller,
+          message: translated.message,
+          response: response.text,
+          conversation_id: conversationId,
+          trace_id: traceId,
+          request_id: requestId
+        }).catch(err => {
+          reqLogger.error('Failed to notify owner', {
+            conversationId,
+            tokenId: validation.id,
+            error_code: 'OWNER_NOTIFY_FAILED',
+            error: err
+          });
+        });
+      }
+
+      reqLogger.info('Google A2A message:send completed', {
+        conversationId,
         tokenId: validation.id,
-        error_code: 'TOKEN_RATE_LIMITED',
-        status_code: 429,
-        hint: 'Respect Retry-After and reduce invoke frequency for this token.',
         data: {
-          retry_after: rateCheck.retryAfter
+          duration_ms: Date.now() - startedAt,
+          message_length: translated.message.length,
+          is_new_conversation: isNewConversation
         }
       });
-      res.set('Retry-After', rateCheck.retryAfter);
-      return res.status(429).json(withTracePayload({ 
-        success: false, 
-        error: rateCheck.error, 
-        message: rateCheck.message 
+
+      // Translate response to Google A2A Task format
+      const disclosure = validation.disclosure || 'minimal';
+      const googleResponse = translateInternalToGoogle(
+        response, conversationId, validation.tier, disclosure, validation.calls_remaining
+      );
+      res.json(googleResponse);
+
+    } catch (err) {
+      reqLogger.error('Message handling error', {
+        conversationId,
+        tokenId: validation.id,
+        error_code: 'MESSAGE_SEND_HANDLER_FAILED',
+        status_code: 500,
+        error: err,
+        data: { duration_ms: Date.now() - startedAt }
+      });
+      res.status(500).json(withTracePayload({
+        success: false,
+        error: 'internal_error',
+        message: 'Failed to process message'
       }));
     }
+  }
+  router.post('/message\\:send', handleMessageSend);
+  router.post('/message%3Asend', handleMessageSend);
 
-    // A2A-52: Ed25519 signature verification (after token auth, before message handling)
-    const sigCheck = verifySigHeaders(req, validation, '/api/a2a/invoke', reqLogger, withTracePayload);
-    if (sigCheck.error) {
-      return res.status(sigCheck.error.status).json(withTracePayload(sigCheck.error.body));
-    }
-    const identityVerified = sigCheck.identityVerified;
-    const publicKeyFingerprint = sigCheck.publicKeyFingerprint;
+  /**
+   * POST /invoke
+   * Call the agent
+   */
+  router.post('/invoke', async (req, res) => {
+    const startedAt = Date.now();
+    const traceId = resolveTraceId(req);
+    const requestId = resolveRequestId(req);
+    const reqLogger = logger.child({ traceId, requestId, event: 'invoke' });
+    const withTracePayload = (payload) => ({ ...payload, trace_id: traceId, request_id: requestId });
+    res.set('x-trace-id', traceId);
+    res.set('x-request-id', requestId);
+    reqLogger.info('Received invoke request', {
+      data: {
+        ip: req.ip,
+        request_id: requestId,
+        client_host: extractClientHost(req),
+        forwarded_for: req.headers['x-forwarded-for'] || null,
+        user_agent: req.headers['user-agent'] || null,
+        has_auth_header: Boolean(req.headers.authorization)
+      }
+    });
+    reqLogger.debug('Invoke request metadata', {
+      event: 'invoke_request_metadata',
+      data: normalizeRequestMetadata(req)
+    });
+
+    // Auth pipeline (shared with /message:send)
+    const auth = await validateInboundAuth(req, res, reqLogger, '/api/a2a/invoke');
+    if (!auth) return;
+    const { validation, identityVerified, publicKeyFingerprint } = auth;
 
     // Extract and validate request
     const { message, conversation_id, caller, context, timeout_seconds = 60 } = req.body;
@@ -797,7 +1124,7 @@ function createRoutes(options = {}) {
     // For now, require an admin token or local access
     const expected = process.env.A2A_ADMIN_TOKEN;
     const adminToken = req.headers['x-admin-token'];
-    if (!isLoopbackAddress(req.ip)) {
+    if (!isDirectLocalRequest(req)) {
       if (!expected) {
         return res.status(401).json({
           error: 'admin_token_required',
@@ -833,7 +1160,7 @@ function createRoutes(options = {}) {
   router.get('/conversations/:id', (req, res) => {
     const expected = process.env.A2A_ADMIN_TOKEN;
     const adminToken = req.headers['x-admin-token'];
-    if (!isLoopbackAddress(req.ip)) {
+    if (!isDirectLocalRequest(req)) {
       if (!expected) {
         return res.status(401).json({
           error: 'admin_token_required',

package/src/routes/dashboard.js

@@ -20,17 +20,10 @@ const { resolveInviteHost } = require('../lib/invite-host');
 const { CallbookStore } = require('../lib/callbook');
 const { DashboardEventStore } = require('../lib/dashboard-events');
 const { createLogger } = require('../lib/logger');
+const { isDirectLocalRequest } = require('../lib/local-request');
 
 const DASHBOARD_STATIC_DIR = path.join(__dirname, '..', 'dashboard', 'public');
 
-function isLoopbackAddress(ip) {
-  if (!ip) return false;
-  if (ip === '::1' || ip === '127.0.0.1' || ip === '::ffff:127.0.0.1') {
-    return true;
-  }
-  return ip.startsWith('::ffff:127.');
-}
-
 function parseCookieHeader(headerValue) {
   const raw = String(headerValue || '').trim();
   if (!raw) return {};
@@ -46,25 +39,6 @@ function parseCookieHeader(headerValue) {
   return cookies;
 }
 
-function isDirectLocalRequest(req) {
-  const ip = (req && req.socket && req.socket.remoteAddress) ? req.socket.remoteAddress : req.ip;
-  if (!isLoopbackAddress(ip)) return false;
-  const host = String(req.headers.host || '').toLowerCase();
-  const isLocalHost = host.startsWith('localhost') ||
-    host.startsWith('127.0.0.1') ||
-    host.startsWith('[::1]') ||
-    host.startsWith('::1');
-  if (!isLocalHost) return false;
-  // Avoid treating proxy-forwarded traffic as "local".
-  const forwarded = req.headers['x-forwarded-for'] ||
-    req.headers['x-forwarded-proto'] ||
-    req.headers['x-forwarded-host'] ||
-    req.headers['cf-connecting-ip'] ||
-    req.headers['x-forwarded-by'];
-  if (forwarded) return false;
-  return true;
-}
-
 function isHttpsRequest(req) {
   const proto = String(req.headers['x-forwarded-proto'] || '')
     .split(',')[0]