claude-flow 3.28.0 → 3.30.0

package/v3/@claude-flow/shared/dist/mcp/transport/http.js

@@ -0,0 +1,476 @@
+/**
+ * V3 MCP HTTP Transport
+ *
+ * HTTP/REST transport for MCP communication:
+ * - Express-based with optimized middleware
+ * - WebSocket support for real-time notifications
+ * - Connection pooling for client connections
+ * - Security headers with helmet
+ *
+ * Performance Targets:
+ * - Request handling: <20ms overhead
+ * - WebSocket message: <5ms
+ */
+import { EventEmitter } from 'events';
+import express from 'express';
+import { createServer } from 'http';
+import { WebSocketServer, WebSocket } from 'ws';
+import cors from 'cors';
+import helmet from 'helmet';
+/**
+ * HTTP Transport Implementation
+ */
+export class HttpTransport extends EventEmitter {
+    logger;
+    config;
+    type = 'http';
+    requestHandler;
+    notificationHandler;
+    app;
+    server;
+    wss;
+    running = false;
+    activeConnections = new Set();
+    // Statistics
+    messagesReceived = 0;
+    messagesSent = 0;
+    errors = 0;
+    httpRequests = 0;
+    wsMessages = 0;
+    constructor(logger, config) {
+        super();
+        this.logger = logger;
+        this.config = config;
+        this.app = express();
+        this.setupMiddleware();
+        this.setupRoutes();
+    }
+    /**
+     * Start the transport
+     */
+    async start() {
+        if (this.running) {
+            throw new Error('HTTP transport already running');
+        }
+        this.logger.info('Starting HTTP transport', {
+            host: this.config.host,
+            port: this.config.port,
+        });
+        // Create HTTP server
+        this.server = createServer(this.app);
+        // Create WebSocket server
+        this.wss = new WebSocketServer({
+            server: this.server,
+            path: '/ws',
+        });
+        this.setupWebSocketHandlers();
+        // Start server
+        await new Promise((resolve, reject) => {
+            this.server.listen(this.config.port, this.config.host, () => {
+                resolve();
+            });
+            this.server.on('error', reject);
+        });
+        this.running = true;
+        this.logger.info('HTTP transport started', {
+            url: `http://${this.config.host}:${this.config.port}`,
+        });
+    }
+    /**
+     * Stop the transport
+     */
+    async stop() {
+        if (!this.running) {
+            return;
+        }
+        this.logger.info('Stopping HTTP transport');
+        this.running = false;
+        // Close all WebSocket connections
+        for (const ws of this.activeConnections) {
+            try {
+                ws.close(1000, 'Server shutting down');
+            }
+            catch {
+                // Ignore errors
+            }
+        }
+        this.activeConnections.clear();
+        // Close WebSocket server
+        if (this.wss) {
+            this.wss.close();
+            this.wss = undefined;
+        }
+        // Close HTTP server
+        if (this.server) {
+            await new Promise((resolve) => {
+                this.server.close(() => resolve());
+            });
+            this.server = undefined;
+        }
+        this.logger.info('HTTP transport stopped');
+    }
+    /**
+     * Register request handler
+     */
+    onRequest(handler) {
+        this.requestHandler = handler;
+    }
+    /**
+     * Register notification handler
+     */
+    onNotification(handler) {
+        this.notificationHandler = handler;
+    }
+    /**
+     * Get health status
+     */
+    async getHealthStatus() {
+        return {
+            healthy: this.running,
+            metrics: {
+                messagesReceived: this.messagesReceived,
+                messagesSent: this.messagesSent,
+                errors: this.errors,
+                httpRequests: this.httpRequests,
+                wsMessages: this.wsMessages,
+                activeConnections: this.activeConnections.size,
+            },
+        };
+    }
+    /**
+     * Send notification to all connected WebSocket clients
+     */
+    async sendNotification(notification) {
+        const message = JSON.stringify(notification);
+        for (const ws of this.activeConnections) {
+            try {
+                if (ws.readyState === WebSocket.OPEN) {
+                    ws.send(message);
+                    this.messagesSent++;
+                }
+            }
+            catch (error) {
+                this.logger.error('Failed to send notification', { error });
+                this.errors++;
+            }
+        }
+    }
+    /**
+     * Setup Express middleware
+     */
+    setupMiddleware() {
+        // Security headers
+        this.app.use(helmet({
+            contentSecurityPolicy: false, // Allow for flexibility
+        }));
+        // CORS - Secure defaults (no wildcard in production)
+        if (this.config.corsEnabled !== false) {
+            const allowedOrigins = this.config.corsOrigins;
+            // SECURITY: Reject wildcard CORS in production unless explicitly configured
+            if (!allowedOrigins || allowedOrigins.length === 0) {
+                this.logger.warn('CORS: No origins configured, restricting to same-origin only');
+            }
+            this.app.use(cors({
+                origin: (origin, callback) => {
+                    // Allow requests with no origin (same-origin, curl, etc.)
+                    if (!origin) {
+                        callback(null, true);
+                        return;
+                    }
+                    // Check against allowed origins
+                    if (allowedOrigins && allowedOrigins.length > 0) {
+                        if (allowedOrigins.includes(origin) || allowedOrigins.includes('*')) {
+                            callback(null, true);
+                        }
+                        else {
+                            callback(new Error(`CORS: Origin '${origin}' not allowed`));
+                        }
+                    }
+                    else {
+                        // No origins configured - reject cross-origin requests
+                        callback(new Error('CORS: Cross-origin requests not allowed'));
+                    }
+                },
+                credentials: true,
+                maxAge: 86400,
+                methods: ['GET', 'POST', 'OPTIONS'],
+                allowedHeaders: ['Content-Type', 'Authorization', 'X-Request-ID'],
+            }));
+        }
+        // Body parsing
+        this.app.use(express.json({
+            limit: this.config.maxRequestSize || '10mb',
+        }));
+        // Request timeout
+        if (this.config.requestTimeout) {
+            this.app.use((req, res, next) => {
+                res.setTimeout(this.config.requestTimeout, () => {
+                    res.status(408).json({
+                        jsonrpc: '2.0',
+                        id: null,
+                        error: { code: -32000, message: 'Request timeout' },
+                    });
+                });
+                next();
+            });
+        }
+        // Request logging
+        this.app.use((req, res, next) => {
+            const startTime = performance.now();
+            res.on('finish', () => {
+                const duration = performance.now() - startTime;
+                this.logger.debug('HTTP request', {
+                    method: req.method,
+                    path: req.path,
+                    status: res.statusCode,
+                    duration: `${duration.toFixed(2)}ms`,
+                });
+            });
+            next();
+        });
+    }
+    /**
+     * Setup Express routes
+     */
+    setupRoutes() {
+        // Health check
+        this.app.get('/health', (req, res) => {
+            res.json({
+                status: 'ok',
+                timestamp: new Date().toISOString(),
+                connections: this.activeConnections.size,
+            });
+        });
+        // MCP JSON-RPC endpoint
+        this.app.post('/rpc', async (req, res) => {
+            await this.handleHttpRequest(req, res);
+        });
+        // Alternative MCP endpoint
+        this.app.post('/mcp', async (req, res) => {
+            await this.handleHttpRequest(req, res);
+        });
+        // Server info
+        this.app.get('/info', (req, res) => {
+            res.json({
+                name: 'Claude-Flow MCP Server V3',
+                version: '3.0.0',
+                transport: 'http',
+                capabilities: {
+                    jsonrpc: true,
+                    websocket: true,
+                },
+            });
+        });
+        // 404 handler
+        this.app.use((req, res) => {
+            res.status(404).json({
+                error: 'Not found',
+                path: req.path,
+            });
+        });
+        // Error handler
+        this.app.use((err, req, res, next) => {
+            this.logger.error('Express error', { error: err });
+            this.errors++;
+            res.status(500).json({
+                jsonrpc: '2.0',
+                id: null,
+                error: { code: -32603, message: 'Internal error' },
+            });
+        });
+    }
+    /**
+     * Setup WebSocket handlers
+     */
+    setupWebSocketHandlers() {
+        if (!this.wss)
+            return;
+        this.wss.on('connection', (ws, req) => {
+            this.activeConnections.add(ws);
+            this.logger.info('WebSocket client connected', {
+                total: this.activeConnections.size,
+            });
+            ws.on('message', async (data) => {
+                await this.handleWebSocketMessage(ws, data.toString());
+            });
+            ws.on('close', () => {
+                this.activeConnections.delete(ws);
+                this.logger.info('WebSocket client disconnected', {
+                    total: this.activeConnections.size,
+                });
+            });
+            ws.on('error', (error) => {
+                this.logger.error('WebSocket error', { error });
+                this.errors++;
+                this.activeConnections.delete(ws);
+            });
+        });
+    }
+    /**
+     * Handle HTTP request
+     */
+    async handleHttpRequest(req, res) {
+        this.httpRequests++;
+        this.messagesReceived++;
+        // Validate authentication (ALWAYS check, not just when explicitly enabled)
+        // SECURITY: Auth should be opt-out, not opt-in
+        const requiresAuth = this.config.auth?.enabled !== false; // Default to requiring auth
+        if (requiresAuth && this.config.auth) {
+            const authResult = this.validateAuth(req);
+            if (!authResult.valid) {
+                this.logger.warn('Authentication failed', {
+                    ip: req.ip,
+                    path: req.path,
+                    error: authResult.error,
+                });
+                res.status(401).json({
+                    jsonrpc: '2.0',
+                    id: null,
+                    error: { code: -32001, message: 'Unauthorized' },
+                });
+                return;
+            }
+        }
+        else if (requiresAuth && !this.config.auth) {
+            // No auth configured but auth is required - warn and continue (development mode)
+            this.logger.warn('No authentication configured - running in development mode');
+        }
+        const message = req.body;
+        // Validate JSON-RPC format
+        if (message.jsonrpc !== '2.0') {
+            res.status(400).json({
+                jsonrpc: '2.0',
+                id: message.id || null,
+                error: { code: -32600, message: 'Invalid JSON-RPC version' },
+            });
+            return;
+        }
+        if (!message.method) {
+            res.status(400).json({
+                jsonrpc: '2.0',
+                id: message.id || null,
+                error: { code: -32600, message: 'Missing method' },
+            });
+            return;
+        }
+        // Handle notification vs request
+        if (message.id === undefined) {
+            // Notification
+            if (this.notificationHandler) {
+                await this.notificationHandler(message);
+            }
+            res.status(204).end();
+        }
+        else {
+            // Request
+            if (!this.requestHandler) {
+                res.status(500).json({
+                    jsonrpc: '2.0',
+                    id: message.id,
+                    error: { code: -32603, message: 'No request handler' },
+                });
+                return;
+            }
+            try {
+                const response = await this.requestHandler(message);
+                res.json(response);
+                this.messagesSent++;
+            }
+            catch (error) {
+                this.errors++;
+                res.status(500).json({
+                    jsonrpc: '2.0',
+                    id: message.id,
+                    error: {
+                        code: -32603,
+                        message: error instanceof Error ? error.message : 'Internal error',
+                    },
+                });
+            }
+        }
+    }
+    /**
+     * Handle WebSocket message
+     */
+    async handleWebSocketMessage(ws, data) {
+        this.wsMessages++;
+        this.messagesReceived++;
+        try {
+            const message = JSON.parse(data);
+            if (message.jsonrpc !== '2.0') {
+                ws.send(JSON.stringify({
+                    jsonrpc: '2.0',
+                    id: message.id || null,
+                    error: { code: -32600, message: 'Invalid JSON-RPC version' },
+                }));
+                return;
+            }
+            if (message.id === undefined) {
+                // Notification
+                if (this.notificationHandler) {
+                    await this.notificationHandler(message);
+                }
+            }
+            else {
+                // Request
+                if (!this.requestHandler) {
+                    ws.send(JSON.stringify({
+                        jsonrpc: '2.0',
+                        id: message.id,
+                        error: { code: -32603, message: 'No request handler' },
+                    }));
+                    return;
+                }
+                const response = await this.requestHandler(message);
+                ws.send(JSON.stringify(response));
+                this.messagesSent++;
+            }
+        }
+        catch (error) {
+            this.errors++;
+            this.logger.error('WebSocket message error', { error });
+            try {
+                const parsed = JSON.parse(data);
+                ws.send(JSON.stringify({
+                    jsonrpc: '2.0',
+                    id: parsed.id || null,
+                    error: { code: -32700, message: 'Parse error' },
+                }));
+            }
+            catch {
+                ws.send(JSON.stringify({
+                    jsonrpc: '2.0',
+                    id: null,
+                    error: { code: -32700, message: 'Parse error' },
+                }));
+            }
+        }
+    }
+    /**
+     * Validate authentication
+     */
+    validateAuth(req) {
+        const auth = req.headers.authorization;
+        if (!auth) {
+            return { valid: false, error: 'Authorization header required' };
+        }
+        const tokenMatch = auth.match(/^Bearer\s+(.+)$/i);
+        if (!tokenMatch) {
+            return { valid: false, error: 'Invalid authorization format' };
+        }
+        const token = tokenMatch[1];
+        if (this.config.auth?.tokens?.length) {
+            if (!this.config.auth.tokens.includes(token)) {
+                return { valid: false, error: 'Invalid token' };
+            }
+        }
+        return { valid: true };
+    }
+}
+/**
+ * Create HTTP transport
+ */
+export function createHttpTransport(logger, config) {
+    return new HttpTransport(logger, config);
+}
+//# sourceMappingURL=http.js.map

package/v3/@claude-flow/shared/dist/mcp/transport/index.d.ts

@@ -0,0 +1,102 @@
+/**
+ * V3 MCP Transport Factory
+ *
+ * Central factory for creating transport instances:
+ * - Unified transport creation API
+ * - Transport type validation
+ * - Configuration defaults
+ * - Multi-transport support
+ *
+ * Supported transports:
+ * - stdio: Standard I/O (default for CLI)
+ * - http: HTTP/REST with WebSocket upgrade
+ * - websocket: Standalone WebSocket
+ * - in-process: Direct function calls (fastest)
+ */
+import { ITransport, TransportType, ILogger } from '../types.js';
+import { StdioTransportConfig } from './stdio.js';
+import { HttpTransportConfig } from './http.js';
+import { WebSocketTransportConfig } from './websocket.js';
+export { StdioTransport } from './stdio.js';
+export { HttpTransport } from './http.js';
+export { WebSocketTransport } from './websocket.js';
+export type { StdioTransportConfig } from './stdio.js';
+export type { HttpTransportConfig } from './http.js';
+export type { WebSocketTransportConfig } from './websocket.js';
+/**
+ * Transport configuration union
+ */
+export type TransportConfig = {
+    type: 'stdio';
+} & StdioTransportConfig | {
+    type: 'http';
+} & HttpTransportConfig | {
+    type: 'websocket';
+} & WebSocketTransportConfig | {
+    type: 'in-process';
+};
+/**
+ * Create a transport instance based on type
+ */
+export declare function createTransport(type: TransportType, logger: ILogger, config?: Partial<TransportConfig>): ITransport;
+/**
+ * Create in-process transport
+ */
+export declare function createInProcessTransport(logger: ILogger): ITransport;
+/**
+ * Transport manager for multi-transport scenarios
+ */
+export declare class TransportManager {
+    private readonly logger;
+    private transports;
+    private running;
+    constructor(logger: ILogger);
+    /**
+     * Add a transport
+     */
+    addTransport(name: string, transport: ITransport): void;
+    /**
+     * Remove a transport
+     */
+    removeTransport(name: string): Promise<boolean>;
+    /**
+     * Get a transport by name
+     */
+    getTransport(name: string): ITransport | undefined;
+    /**
+     * Get all transport names
+     */
+    getTransportNames(): string[];
+    /**
+     * Start all transports
+     */
+    startAll(): Promise<void>;
+    /**
+     * Stop all transports
+     */
+    stopAll(): Promise<void>;
+    /**
+     * Get health status of all transports
+     */
+    getHealthStatus(): Promise<Record<string, {
+        healthy: boolean;
+        error?: string;
+    }>>;
+    /**
+     * Check if any transport is running
+     */
+    isRunning(): boolean;
+}
+/**
+ * Create a transport manager
+ */
+export declare function createTransportManager(logger: ILogger): TransportManager;
+/**
+ * Default transport configurations
+ */
+export declare const DEFAULT_TRANSPORT_CONFIGS: {
+    readonly stdio: StdioTransportConfig;
+    readonly http: HttpTransportConfig;
+    readonly websocket: WebSocketTransportConfig;
+};
+//# sourceMappingURL=index.d.ts.map