claude-flow 3.63.2 → 3.63.4

package/v3/@claude-flow/shared/dist/mcp/transport/websocket.d.ts

@@ -26,6 +26,10 @@ export interface WebSocketTransportConfig {
     heartbeatTimeout?: number;
     maxMessageSize?: number;
     auth?: AuthConfig;
+    /** Accept a non-loopback bind with no token. */
+    allowUnauthenticated?: boolean;
+    /** Browser origins allowed to connect, by exact name. */
+    allowedOrigins?: string[];
     enableBinaryMode?: boolean;
 }
 /**
@@ -107,6 +111,8 @@ export declare class WebSocketTransport extends EventEmitter implements ITranspo
     /**
      * Handle incoming message
      */
+    /** Token from `Authorization: Bearer` or `?token=`, compared in constant time. */
+    private upgradeHasValidToken;
     private handleMessage;
     /**
      * Parse incoming message

package/v3/@claude-flow/shared/dist/mcp/transport/websocket.js

@@ -14,6 +14,8 @@
 import { EventEmitter } from 'events';
 import { WebSocketServer, WebSocket } from 'ws';
 import { createServer } from 'http';
+import { createHash, timingSafeEqual } from 'node:crypto';
+import { assertSafeBind, refuseOpenRequest } from './guard.js';
 /**
  * WebSocket Transport Implementation
  */
@@ -51,6 +53,7 @@ export class WebSocketTransport extends EventEmitter {
             port: this.config.port,
             path: this.config.path || '/ws',
         });
+        assertSafeBind(this.config.host, this.config.auth?.enabled === true, this.config.allowUnauthenticated);
         // Create HTTP server for WebSocket upgrade
         this.server = createServer((req, res) => {
             // Simple HTTP response for non-WebSocket requests
@@ -63,6 +66,9 @@ export class WebSocketTransport extends EventEmitter {
             path: this.config.path || '/ws',
             maxPayload: this.config.maxMessageSize || 10 * 1024 * 1024,
             perMessageDeflate: true, // Enable compression
+            verifyClient: (info) => this.config.auth?.enabled === true
+                ? this.upgradeHasValidToken(info.req)
+                : refuseOpenRequest(info.req, this.config.host, this.config.allowedOrigins) === undefined,
         });
         this.setupWebSocketHandlers();
         this.startHeartbeat();
@@ -225,7 +231,8 @@ export class WebSocketTransport extends EventEmitter {
                 lastActivity: new Date(),
                 messageCount: 0,
                 isAlive: true,
-                isAuthenticated: !this.config.auth?.enabled,
+                // With a token configured the upgrade itself was authenticated (verifyClient).
+                isAuthenticated: true,
             };
             this.clients.set(clientId, client);
             this.totalConnections++;
@@ -264,6 +271,22 @@ export class WebSocketTransport extends EventEmitter {
     /**
      * Handle incoming message
      */
+    /** Token from `Authorization: Bearer` or `?token=`, compared in constant time. */
+    upgradeHasValidToken(req) {
+        const header = req.headers.authorization;
+        const fromHeader = typeof header === 'string' ? header.match(/^Bearer\s+(.+)$/i)?.[1] : undefined;
+        const fromQuery = new URL(req.url ?? '', 'http://localhost').searchParams.get('token') ?? undefined;
+        const given = fromHeader ?? fromQuery;
+        if (!given)
+            return false;
+        const digest = (v) => createHash('sha256').update(v, 'utf8').digest();
+        let ok = false;
+        for (const valid of this.config.auth?.tokens ?? []) {
+            if (timingSafeEqual(digest(given), digest(valid)))
+                ok = true;
+        }
+        return ok;
+    }
     async handleMessage(client, data) {
         client.lastActivity = new Date();
         client.messageCount++;

package/v3/@claude-flow/shared/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@claude-flow/shared",
-  "version": "3.0.5",
+  "version": "3.0.6",
   "type": "module",
   "description": "Shared module - common types, events, utilities, core interfaces",
   "main": "dist/index.js",