devframe 0.9.19 → 0.9.20

package/dist/adapters/cac.mjs

@@ -1,7 +1,7 @@
 import { s as colors } from "../nostics-D0PvLZsn.mjs";
 import { i as resolveDevServerPort, s as importRuntimeModule } from "../_shared-U8D-xzrp.mjs";
 import { createBuild } from "./build.mjs";
-import { t as createDevServer } from "../dev-DbWecpjA.mjs";
+import { t as createDevServer } from "../dev-BdKKOH8S.mjs";
 import process from "node:process";
 import cac$1 from "cac";
 //#region src/adapters/flags.ts

package/dist/adapters/dev.mjs

@@ -1,3 +1,3 @@
 import { i as resolveDevServerPort, o as resolveMcpConnectionMeta } from "../_shared-U8D-xzrp.mjs";
-import { t as createDevServer } from "../dev-DbWecpjA.mjs";
+import { t as createDevServer } from "../dev-BdKKOH8S.mjs";
 export { createDevServer, resolveDevServerPort, resolveMcpConnectionMeta };

package/dist/adapters/initiate.mjs

@@ -1,2 +1,2 @@
-import { n as getInstanceInternals, r as initDevframe } from "../dev-DbWecpjA.mjs";
+import { n as getInstanceInternals, r as initDevframe } from "../dev-BdKKOH8S.mjs";
 export { getInstanceInternals, initDevframe };

package/dist/adapters/mcp.d.mts

@@ -63,13 +63,26 @@ interface CreateMcpFetchHandlerOptions {
    */
   allowedOrigins?: readonly string[] | false;
 }
+/** Connection facts a host knows about a request beyond the `Request` itself. */
+interface McpConnectionInfo {
+  /**
+   * The connecting peer's remote address (a node socket's `remoteAddress`),
+   * used to prove a same-machine caller when the endpoint relies on the
+   * loopback origin default with no identity check. A host that can resolve a
+   * trustworthy peer address (the h3/node mount) supplies it; when it's
+   * omitted the origin gate stays the only locality signal.
+   */
+  remoteAddress?: string;
+}
 interface McpFetchHandler {
   /**
    * WHATWG-`fetch` handler for the MCP endpoint. Hand every method
    * (POST/GET/DELETE) on the endpoint's path to it; routing by path is the
-   * host's job.
+   * host's job. Pass {@link McpConnectionInfo} when the host can resolve the
+   * peer address so the default trust boundary can enforce same-machine
+   * locality.
    */
-  fetch: (request: Request) => Promise<Response>;
+  fetch: (request: Request, connection?: McpConnectionInfo) => Promise<Response>;
   /** Tear down the handler (aborts in-flight exchanges, drops the change bridge). */
   dispose: () => Promise<void>;
 }
@@ -89,13 +102,19 @@ interface McpFetchHandler {
  *
  * The origin gate guards every request: loopback-default DNS-rebinding
  * protection that (unlike the WS upgrade's `isAllowedOrigin`) also rejects
- * `Origin`-less requests, so a route-based endpoint isn't reachable by a
- * browser or a remote host (a disallowed origin gets `403`). It trusts
- * same-machine callers by default. When that isn't your trust boundary, add
- * an optional identity gate ({@link CreateMcpFetchHandlerOptions.authorization}),
- * checked after the origin gate: a bearer/callback check that proves *who* is
- * calling (a missing/invalid credential gets `401` with a
- * `WWW-Authenticate: Bearer` challenge).
+ * `Origin`-less requests, so a browser can't reach the route across origins (a
+ * disallowed origin gets `403`). The `Origin` header is only browser hardening:
+ * a non-browser client forges it. So on the zero-config default (no widened
+ * `allowedOrigins`, no identity check) a second locality gate requires the
+ * connected peer to be loopback, proven from the host-supplied
+ * {@link McpConnectionInfo.remoteAddress} (which a client cannot forge), so the
+ * "trusts same-machine callers" default holds against a remote raw client.
+ * When same-machine isn't your trust boundary, add an identity gate
+ * ({@link CreateMcpFetchHandlerOptions.authorization}), checked after the
+ * origin gate: a bearer/callback check that proves *who* is calling (a
+ * missing/invalid credential gets `401` with a `WWW-Authenticate: Bearer`
+ * challenge), which also lifts the loopback-peer restriction for authenticated
+ * callers.
  */
 export declare function createMcpFetchHandler(ctx: DevframeNodeContext, options: CreateMcpFetchHandlerOptions): McpFetchHandler;
 //#endregion
@@ -120,4 +139,4 @@ interface MountedMcpHttp {
  */
 export declare function mountMcpHttp(app: H3, ctx: DevframeNodeContext, path: string, options: MountMcpHttpOptions): MountedMcpHttp;
 //#endregion
-export type { CreateMcpFetchHandlerOptions, CreateMcpServerOptions, McpFetchHandler, McpServerHandle, MountMcpHttpOptions, MountedMcpHttp };
+export type { CreateMcpFetchHandlerOptions, CreateMcpServerOptions, McpConnectionInfo, McpFetchHandler, McpServerHandle, MountMcpHttpOptions, MountedMcpHttp };

package/dist/adapters/mcp.mjs

@@ -1,6 +1,6 @@
 import { t as Diagnostic } from "../nostics-D0PvLZsn.mjs";
 import { t as DEVFRAME_EVENTS } from "../events-BV4Dj59a.mjs";
-import { t as isAllowedOrigin } from "../origin-DZit9g29.mjs";
+import { n as isLoopbackAddress, t as isAllowedOrigin } from "../origin-D_eBKEzr.mjs";
 import { r as timingSafeEqual } from "../crypto-token-TVbGGFuj.mjs";
 import { t as diagnostics } from "../diagnostics-DZA6KQ_Z.mjs";
 import { t as createHostContext } from "../context-BLXXjoBW.mjs";
@@ -8,7 +8,7 @@ import { t as toAgentToolName } from "../agent-tool-name-DGzeuWcO.mjs";
 import { join } from "pathe";
 import process from "node:process";
 import { homedir } from "node:os";
-import { defineHandler } from "h3";
+import { defineHandler, getRequestIP } from "h3";
 import { Server, createMcpHandler } from "@modelcontextprotocol/server";
 //#region src/adapters/mcp/stringify.ts
 /**
@@ -512,13 +512,19 @@ async function isAuthorized(req, authorization) {
 *
 * The origin gate guards every request: loopback-default DNS-rebinding
 * protection that (unlike the WS upgrade's `isAllowedOrigin`) also rejects
-* `Origin`-less requests, so a route-based endpoint isn't reachable by a
-* browser or a remote host (a disallowed origin gets `403`). It trusts
-* same-machine callers by default. When that isn't your trust boundary, add
-* an optional identity gate ({@link CreateMcpFetchHandlerOptions.authorization}),
-* checked after the origin gate: a bearer/callback check that proves *who* is
-* calling (a missing/invalid credential gets `401` with a
-* `WWW-Authenticate: Bearer` challenge).
+* `Origin`-less requests, so a browser can't reach the route across origins (a
+* disallowed origin gets `403`). The `Origin` header is only browser hardening:
+* a non-browser client forges it. So on the zero-config default (no widened
+* `allowedOrigins`, no identity check) a second locality gate requires the
+* connected peer to be loopback, proven from the host-supplied
+* {@link McpConnectionInfo.remoteAddress} (which a client cannot forge), so the
+* "trusts same-machine callers" default holds against a remote raw client.
+* When same-machine isn't your trust boundary, add an identity gate
+* ({@link CreateMcpFetchHandlerOptions.authorization}), checked after the
+* origin gate: a bearer/callback check that proves *who* is calling (a
+* missing/invalid credential gets `401` with a `WWW-Authenticate: Bearer`
+* challenge), which also lifts the loopback-peer restriction for authenticated
+* callers.
 */
 function createMcpFetchHandler(ctx, options) {
 	const allowedOrigins = options.allowedOrigins;
@@ -536,9 +542,11 @@ function createMcpFetchHandler(ctx, options) {
 			handler.notify.resourcesChanged();
 		}
 	});
-	async function handle(req) {
+	const originOnlyDefault = allowedOrigins === void 0 && authorization === false;
+	async function handle(req, connection) {
 		const origin = req.headers.get("origin") ?? void 0;
 		if (allowedOrigins !== false && (origin === void 0 || !isAllowedOrigin(origin, allowedOrigins ?? []))) return new Response("Forbidden", { status: 403 });
+		if (originOnlyDefault && connection?.remoteAddress !== void 0 && !isLoopbackAddress(connection.remoteAddress)) return new Response("Forbidden", { status: 403 });
 		if (!await isAuthorized(req, authorization)) return new Response("Unauthorized", {
 			status: 401,
 			headers: { "WWW-Authenticate": "Bearer" }
@@ -570,7 +578,7 @@ function createMcpFetchHandler(ctx, options) {
 */
 function mountMcpHttp(app, ctx, path, options) {
 	const handler = createMcpFetchHandler(ctx, options);
-	app.use(path, defineHandler(async (event) => respond(event, await handler.fetch(event.req))));
+	app.use(path, defineHandler(async (event) => respond(event, await handler.fetch(event.req, { remoteAddress: getRequestIP(event) }))));
 	return { dispose: handler.dispose };
 }
 /**

package/dist/{dev-DbWecpjA.mjs → dev-BdKKOH8S.mjs}

@@ -5,7 +5,7 @@ import { t as createHostContext } from "./context-BLXXjoBW.mjs";
 import { t as resolveStaticAssetsSource } from "./remote-assets-D0StJVLp.mjs";
 import { a as resolveMcpConfig, i as resolveDevServerPort, n as normalizeBasePath, r as resolveBasePath, s as importRuntimeModule, t as loadAutoMcpAdapter } from "./_shared-U8D-xzrp.mjs";
 import { t as createH3DevframeHost } from "./host-h3-BROI6SQ4.mjs";
-import { i as normalizeHttpServerUrl, n as resolveInstanceRegister, t as createInstanceShell } from "./instance-shell-370Oee9K.mjs";
+import { i as normalizeHttpServerUrl, n as resolveInstanceRegister, t as createInstanceShell } from "./instance-shell-yfrM3_vK.mjs";
 import { open } from "./utils/open.mjs";
 import { mountStaticHandler } from "./utils/serve-static.mjs";
 import { resolve } from "pathe";

package/dist/{instance-shell-370Oee9K.mjs → instance-shell-yfrM3_vK.mjs}

@@ -1,5 +1,5 @@
 import "./constants.mjs";
-import { r as validateOriginCandidate } from "./origin-DZit9g29.mjs";
+import { i as validateOriginCandidate } from "./origin-D_eBKEzr.mjs";
 import { t as diagnostics } from "./diagnostics-DZA6KQ_Z.mjs";
 import { t as getInternalContext } from "./context-jXO5vzjH.mjs";
 import { createInteractiveAuth } from "./recipes/interactive-auth.mjs";

package/dist/internal/index.mjs

@@ -5,6 +5,6 @@ import { n as coerceAgentPositionalArgs, r as toolInputToCommandArgs, t as Devfr
 import { a as resolveMcpConfig, n as normalizeBasePath, r as resolveBasePath, s as importRuntimeModule, t as loadAutoMcpAdapter } from "../_shared-U8D-xzrp.mjs";
 import { t as createH3DevframeHost } from "../host-h3-BROI6SQ4.mjs";
 import { i as registerDevframeInstance, n as listLiveDevframeInstances } from "../instance-registry-DCq762YJ.mjs";
-import { i as normalizeHttpServerUrl, n as resolveInstanceRegister, r as samePath, t as createInstanceShell } from "../instance-shell-370Oee9K.mjs";
+import { i as normalizeHttpServerUrl, n as resolveInstanceRegister, r as samePath, t as createInstanceShell } from "../instance-shell-yfrM3_vK.mjs";
 import { t as createContextRpcServer } from "../rpc-core-CvkU23bQ.mjs";
 export { DevframeAgentHost, coerceAgentPositionalArgs, createContextRpcServer, createH3DevframeHost, createInstanceShell, createRpcWireCodec, diagnostics, importRuntimeModule, listLiveDevframeInstances, loadAutoMcpAdapter, normalizeBasePath, normalizeHttpServerUrl, peekRpcWireFrame, registerDevframeInstance, resolveBasePath, resolveClientAssets, resolveInstanceRegister, resolveMcpConfig, samePath, toolInputToCommandArgs };

package/dist/{origin-DGDH8BI9.d.mts → origin-CY6BBHOy.d.mts}

@@ -22,6 +22,19 @@
  * those DNS names.
  */
 declare function isLoopbackHostname(hostname: string): boolean;
+/**
+ * Whether `address` is a loopback peer address as reported by a socket
+ * (`net.Socket.remoteAddress`): the IPv6 loopback `::1`, an IPv4 literal in
+ * `127.0.0.0/8`, or an IPv4-mapped IPv6 form of one (`::ffff:127.0.0.1`).
+ *
+ * Unlike {@link isLoopbackHostname} this takes a raw address, not a hostname:
+ * it never accepts a `localhost`-style name (a socket peer is always a literal
+ * address) and understands the IPv4-mapped IPv6 form the OS hands back on a
+ * dual-stack listener. Used to prove a same-machine caller from the connected
+ * peer, which a client cannot forge, rather than from the `Origin` header,
+ * which it can.
+ */
+declare function isLoopbackAddress(address: string): boolean;
 /**
  * Default origin policy for a localhost dev tool: allow requests with no
  * `Origin` header (native, non-browser clients), allow any loopback origin
@@ -42,4 +55,4 @@ declare function isAllowedOrigin(origin: string | undefined, allowedOrigins: rea
  */
 declare function validateOriginCandidate(candidate: string, allowedOrigins?: readonly string[]): string | undefined;
 //#endregion
-export { isLoopbackHostname as n, validateOriginCandidate as r, isAllowedOrigin as t };
+export { validateOriginCandidate as i, isLoopbackAddress as n, isLoopbackHostname as r, isAllowedOrigin as t };

package/dist/{origin-DZit9g29.mjs → origin-D_eBKEzr.mjs}

@@ -26,6 +26,26 @@ function isLoopbackHostname(hostname) {
 	if (h === "localhost" || h.endsWith(".localhost") || h === "::1") return true;
 	return isLoopbackIPv4(h);
 }
+/**
+* Whether `address` is a loopback peer address as reported by a socket
+* (`net.Socket.remoteAddress`): the IPv6 loopback `::1`, an IPv4 literal in
+* `127.0.0.0/8`, or an IPv4-mapped IPv6 form of one (`::ffff:127.0.0.1`).
+*
+* Unlike {@link isLoopbackHostname} this takes a raw address, not a hostname:
+* it never accepts a `localhost`-style name (a socket peer is always a literal
+* address) and understands the IPv4-mapped IPv6 form the OS hands back on a
+* dual-stack listener. Used to prove a same-machine caller from the connected
+* peer, which a client cannot forge, rather than from the `Origin` header,
+* which it can.
+*/
+function isLoopbackAddress(address) {
+	let h = address.trim().replace(/^\[|\]$/g, "");
+	const zone = h.indexOf("%");
+	if (zone !== -1) h = h.slice(0, zone);
+	if (h === "::1") return true;
+	const mapped = /^::ffff:(.+)$/i.exec(h);
+	return isLoopbackIPv4(mapped ? mapped[1] : h);
+}
 /** A canonical dotted-decimal IPv4 literal in `127.0.0.0/8`. */
 function isLoopbackIPv4(hostname) {
 	const octets = hostname.split(".");
@@ -77,4 +97,4 @@ function validateOriginCandidate(candidate, allowedOrigins) {
 	if (isLoopbackHostname(url.hostname) || allowedOrigins?.includes(canonical)) return canonical;
 }
 //#endregion
-export { isLoopbackHostname as n, validateOriginCandidate as r, isAllowedOrigin as t };
+export { validateOriginCandidate as i, isLoopbackAddress as n, isLoopbackHostname as r, isAllowedOrigin as t };

package/dist/rpc/transports/sse-server.mjs

@@ -1,6 +1,6 @@
 import { DEVFRAME_SSE_SESSION_HEADER } from "../../constants.mjs";
 import { n as peekRpcWireFrame, t as createRpcWireCodec } from "../../wire-codec-B1W3zH3L.mjs";
-import { t as isAllowedOrigin } from "../../origin-DZit9g29.mjs";
+import { t as isAllowedOrigin } from "../../origin-D_eBKEzr.mjs";
 import { t as createRpcSessionMeta } from "../../session-DPfj6zQG.mjs";
 //#region src/rpc/transports/sse-server.ts
 const SSE_STREAM_HEADERS = {

package/dist/rpc/transports/ws-bun.mjs

@@ -1,4 +1,4 @@
-import { t as isAllowedOrigin } from "../../origin-DZit9g29.mjs";
+import { t as isAllowedOrigin } from "../../origin-D_eBKEzr.mjs";
 import { createWsRpcPeerHooks } from "./ws-server.mjs";
 //#region src/rpc/transports/ws-bun.ts
 /**

package/dist/rpc/transports/ws-deno.mjs

@@ -1,4 +1,4 @@
-import { t as isAllowedOrigin } from "../../origin-DZit9g29.mjs";
+import { t as isAllowedOrigin } from "../../origin-D_eBKEzr.mjs";
 import { createWsRpcPeerHooks } from "./ws-server.mjs";
 //#region src/rpc/transports/ws-deno.ts
 /**

package/dist/rpc/transports/ws-server.d.mts

@@ -1,4 +1,4 @@
 import { a as DevframeWsPeer, i as DevframeRpcTransportKind, n as DevframeRpcConnection, r as DevframeRpcConnectionRequest, t as DevframeNodeRpcSessionMeta } from "../../session-r6PDixP6.mjs";
-import { n as isLoopbackHostname, t as isAllowedOrigin } from "../../origin-DGDH8BI9.mjs";
+import { r as isLoopbackHostname, t as isAllowedOrigin } from "../../origin-CY6BBHOy.mjs";
 import { a as attachWsRpcTransport, i as WsRpcTransportOptions, n as WsOriginRegistry, o as createWsOriginRegistry, r as WsRpcTransport, s as createWsRpcPeerHooks, t as CreateWsOriginRegistryOptions } from "../../ws-server-BB8jhxeT.mjs";
 export { CreateWsOriginRegistryOptions, type DevframeNodeRpcSessionMeta, type DevframeRpcConnection, type DevframeRpcConnectionRequest, type DevframeRpcTransportKind, type DevframeWsPeer, WsOriginRegistry, WsRpcTransport, WsRpcTransportOptions, attachWsRpcTransport, createWsOriginRegistry, createWsRpcPeerHooks, isAllowedOrigin, isLoopbackHostname };

package/dist/rpc/transports/ws-server.mjs

@@ -1,6 +1,6 @@
 import "../../constants.mjs";
 import { t as createRpcWireCodec } from "../../wire-codec-B1W3zH3L.mjs";
-import { n as isLoopbackHostname, t as isAllowedOrigin } from "../../origin-DZit9g29.mjs";
+import { r as isLoopbackHostname, t as isAllowedOrigin } from "../../origin-D_eBKEzr.mjs";
 import { t as createRpcSessionMeta } from "../../session-DPfj6zQG.mjs";
 import { n as randomToken, r as timingSafeEqual } from "../../crypto-token-TVbGGFuj.mjs";
 import { createServer } from "node:http";

package/dist/utils/origin.d.mts

@@ -1,2 +1,2 @@
-import { n as isLoopbackHostname, r as validateOriginCandidate, t as isAllowedOrigin } from "../origin-DGDH8BI9.mjs";
-export { isAllowedOrigin, isLoopbackHostname, validateOriginCandidate };
+import { i as validateOriginCandidate, n as isLoopbackAddress, r as isLoopbackHostname, t as isAllowedOrigin } from "../origin-CY6BBHOy.mjs";
+export { isAllowedOrigin, isLoopbackAddress, isLoopbackHostname, validateOriginCandidate };

package/dist/utils/origin.mjs

@@ -26,6 +26,26 @@ function isLoopbackHostname(hostname) {
 	if (h === "localhost" || h.endsWith(".localhost") || h === "::1") return true;
 	return isLoopbackIPv4(h);
 }
+/**
+* Whether `address` is a loopback peer address as reported by a socket
+* (`net.Socket.remoteAddress`): the IPv6 loopback `::1`, an IPv4 literal in
+* `127.0.0.0/8`, or an IPv4-mapped IPv6 form of one (`::ffff:127.0.0.1`).
+*
+* Unlike {@link isLoopbackHostname} this takes a raw address, not a hostname:
+* it never accepts a `localhost`-style name (a socket peer is always a literal
+* address) and understands the IPv4-mapped IPv6 form the OS hands back on a
+* dual-stack listener. Used to prove a same-machine caller from the connected
+* peer, which a client cannot forge, rather than from the `Origin` header,
+* which it can.
+*/
+function isLoopbackAddress(address) {
+	let h = address.trim().replace(/^\[|\]$/g, "");
+	const zone = h.indexOf("%");
+	if (zone !== -1) h = h.slice(0, zone);
+	if (h === "::1") return true;
+	const mapped = /^::ffff:(.+)$/i.exec(h);
+	return isLoopbackIPv4(mapped ? mapped[1] : h);
+}
 /** A canonical dotted-decimal IPv4 literal in `127.0.0.0/8`. */
 function isLoopbackIPv4(hostname) {
 	const octets = hostname.split(".");
@@ -77,4 +97,4 @@ function validateOriginCandidate(candidate, allowedOrigins) {
 	if (isLoopbackHostname(url.hostname) || allowedOrigins?.includes(canonical)) return canonical;
 }
 //#endregion
-export { isAllowedOrigin, isLoopbackHostname, validateOriginCandidate };
+export { isAllowedOrigin, isLoopbackAddress, isLoopbackHostname, validateOriginCandidate };

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "devframe",
   "type": "module",
-  "version": "0.9.19",
+  "version": "0.9.20",
   "description": "Framework for building one portable devtool integration that runs in any viewer.",
   "author": "Anthony Fu <anthonyfu117@hotmail.com>",
   "license": "MIT",