create-evda 0.1.9 → 0.1.10

package/lib/mcp-http.mjs

@@ -54,6 +54,23 @@ function limiter() {
   };
 }
 
+// HQ-2330: what a request carries beyond the protocol, by NAME only, so the log can show whether an
+// app sends something that names the conversation (claude.ai reuses one Mcp-Session-Id across chats).
+// Values are never logged: a header or a _meta value can carry anything.
+const PLAIN_HEADERS = new Set(["host", "content-type", "content-length", "authorization", "accept", "accept-encoding", "accept-language", "user-agent", "connection", "origin", "mcp-session-id", "mcp-protocol-version", "last-event-id", "via", "forwarded", "x-real-ip", "cache-control", "pragma", "te", "keep-alive"]);
+const clipName = (k) => String(k).replace(/[^\x21-\x7e]/g, "").slice(0, 64);
+export function extraNames(headers, params) {
+  const out = {};
+  const h = Object.keys(headers ?? {}).map((k) => k.toLowerCase()).filter((k) => !PLAIN_HEADERS.has(k) && !k.startsWith("x-forwarded-") && !k.startsWith("tailscale-") && !k.startsWith("sec-fetch-")).map(clipName).slice(0, 20);
+  if (h.length) out.header_names = h;
+  const meta = params?._meta;
+  if (meta && typeof meta === "object" && !Array.isArray(meta)) {
+    const m = Object.keys(meta).map(clipName).slice(0, 20);
+    if (m.length) out.meta_keys = m;
+  }
+  return out;
+}
+
 const esc = (s) => String(s ?? "").replace(/[&<>"']/g, (c) => ({ "&": "&amp;", "<": "&lt;", ">": "&gt;", '"': "&quot;", "'": "&#39;" })[c]);
 const shortId = (s) => auth.sha256(String(s)).slice(0, 8);
 
@@ -167,7 +184,7 @@ export function createMcpHttpServer({ dir, version, publicUrl, env = process.env
       if (batch.length !== 1) return send(400, { jsonrpc: "2.0", id: null, error: { code: -32600, message: "initialize must be sent alone" } });
       evictSessions(now);
       newSid = randomBytes(24).toString("hex");
-      session = { family: grant.family, last: now, ctx: { version, log: (s) => log(s), clock, env: readerEnv, evda: () => openEvda(dir), session: newSession(), caller: callerFrom({ env: readerEnv }) } };
+      session = { family: grant.family, last: now, ctx: { version, log: (s) => log(s), clock, env: readerEnv, evda: () => openEvda(dir), session: newSession(), caller: callerFrom({ env: readerEnv }), keepsToolList: true } };
       sessions.set(newSid, session);
     } else {
       if (!sid) return send(400, { jsonrpc: "2.0", id: null, error: { code: -32600, message: "Mcp-Session-Id header required; initialize first" } });
@@ -188,6 +205,7 @@ export function createMcpHttpServer({ dir, version, publicUrl, env = process.env
         const line = { call: method === "tools/call" ? (TOOL_NAMES.has(tool) ? tool : "unknown_tool") : METHODS.has(method) ? method : "unknown_method", status: st, ms: clock() - t0, session: shortId(sid ?? newSid), conn: note.who };
         // Which app connected (HQ-2207): initialize's clientInfo name and version, nothing else of it.
         if (method === "initialize") { const ci = clientInfoOf(one.params); line.client_name = ci.name; line.client_version = ci.version; }
+        Object.assign(line, extraNames(req.headers, one.params));
         if (auth.FALSIFY("log-content", env)) line.args = one.params?.arguments;
         record(line);
       }