machine-bridge-mcp 1.2.7 → 1.2.9

package/src/worker/index.ts

@@ -25,12 +25,18 @@ import {
   HttpError, applyCors, baseUrl, bearerToken, corsPreflight, json, methodNotAllowed,
   parseJsonRequest, workerErrorClass,
 } from "./http.ts";
+import {
+  asObject, isJsonRpcRequest, isJsonRpcResponse, requiredString, rpcError, rpcResult,
+  sessionInstructionText, textToolResult, validateProtocolVersionHeader, type JsonRpcRequest,
+} from "./mcp-jsonrpc.ts";
+import {
+  closeWebSocketQuietly, isObjectRecord, rejectDaemonMessage, sendWebSocketQuietly,
+} from "./websocket-protocol.ts";
 
 const SERVER_NAME = String(serverMetadata.name);
-const SERVER_VERSION = "1.2.7";
+const SERVER_VERSION = "1.2.9";
 const MCP_PROTOCOL_VERSION = String(serverMetadata.protocolVersion);
 const MCP_SUPPORTED_PROTOCOL_VERSIONS = serverMetadata.supportedProtocolVersions.map((value) => String(value));
-const JSONRPC_VERSION = "2.0";
 const DEFAULT_MAX_BODY_BYTES = 8 * 1024 * 1024;
 const MAX_BODY_BYTES = 16 * 1024 * 1024;
 const MAX_PENDING_CALLS = 32;
@@ -45,15 +51,6 @@ interface BridgeEnv extends OAuthControllerEnv {
   MBM_ALLOWED_ORIGINS?: string;
 }
 
-type JsonRpcId = string | number | null;
-
-interface JsonRpcRequest {
-  jsonrpc: "2.0";
-  id?: JsonRpcId;
-  method: string;
-  params?: unknown;
-}
-
 const MCP_INSTRUCTIONS = serverMetadata.instructions.map((value) => String(value)).join("\n");
 
 export class BridgeRoom extends DurableObject<BridgeEnv> {
@@ -295,7 +292,7 @@ export class BridgeRoom extends DurableObject<BridgeEnv> {
     const body = await parseJsonRequest(request, this.bodyLimitBytes());
     if (isJsonRpcResponse(body)) return new Response(null, { status: 202 });
     if (!isJsonRpcRequest(body)) return json(rpcError(null, -32600, "Invalid JSON-RPC request"), 400);
-    const protocolError = validateProtocolVersionHeader(request, body);
+    const protocolError = validateProtocolVersionHeader(request, body, MCP_SUPPORTED_PROTOCOL_VERSIONS);
     if (protocolError) return json(protocolError, 400);
 
     const session = await resolveMcpSession(request, body.method, this.oauth.identityKey(), authorized.tokenKey);
@@ -700,109 +697,3 @@ export default {
     return stub.fetch(request);
   },
 } satisfies ExportedHandler<BridgeEnv>;
-
-function isObjectRecord(value: unknown): value is Record<string, unknown> {
-  return Boolean(value) && typeof value === "object" && !Array.isArray(value);
-}
-
-function rejectDaemonMessage(ws: WebSocket, error: string, closeCode: number, closeReason: string): void {
-  sendWebSocketQuietly(ws, { type: "error", error });
-  closeWebSocketQuietly(ws, closeCode, closeReason);
-}
-
-function sendWebSocketQuietly(ws: WebSocket, value: unknown): void {
-  try {
-    ws.send(typeof value === "string" ? value : JSON.stringify(value));
-  } catch {
-    // Best-effort protocol cleanup must not replace the primary timeout or rejection.
-  }
-}
-
-function closeWebSocketQuietly(ws: WebSocket, code?: number, reason?: string): void {
-  try {
-    ws.close(code, reason);
-  } catch {
-    // The socket may already be closed or detached; no recovery remains at this boundary.
-  }
-}
-
-function isJsonRpcRequest(value: unknown): value is JsonRpcRequest {
-  if (!value || typeof value !== "object" || Array.isArray(value)) return false;
-  const candidate = value as Record<string, unknown>;
-  if (candidate.jsonrpc !== JSONRPC_VERSION || typeof candidate.method !== "string" || !candidate.method.trim() || candidate.method.length > 256) return false;
-  if ("id" in candidate && !isJsonRpcId(candidate.id)) return false;
-  return true;
-}
-
-function isJsonRpcId(value: unknown): value is JsonRpcId {
-  return value === null || typeof value === "string" || (typeof value === "number" && Number.isFinite(value));
-}
-
-function isJsonRpcResponse(value: unknown): boolean {
-  if (!value || typeof value !== "object" || Array.isArray(value)) return false;
-  const candidate = value as Record<string, unknown>;
-  if (candidate.jsonrpc !== JSONRPC_VERSION || !("id" in candidate) || !isJsonRpcId(candidate.id) || typeof candidate.method === "string") return false;
-  return ("result" in candidate) !== ("error" in candidate);
-}
-
-function rpcResult(id: JsonRpcId | undefined, result: unknown): Record<string, unknown> | null {
-  if (id === undefined) return null;
-  return { jsonrpc: JSONRPC_VERSION, id, result };
-}
-
-function rpcError(id: JsonRpcId | undefined, code: number, message: string, data?: unknown): Record<string, unknown> {
-  const error: Record<string, unknown> = { code, message };
-  if (data !== undefined) error.data = data;
-  return { jsonrpc: JSONRPC_VERSION, id: id ?? null, error };
-}
-
-function textToolResult(value: unknown, isError = false): Record<string, unknown> {
-  const special = asObject(value).$mcp;
-  if (special && typeof special === "object" && !Array.isArray(special)) {
-    const specialObject = special as Record<string, unknown>;
-    if (Array.isArray(specialObject.content)) {
-      const result: Record<string, unknown> = { content: specialObject.content, isError };
-      if (specialObject.structuredContent && typeof specialObject.structuredContent === "object" && !Array.isArray(specialObject.structuredContent)) {
-        result.structuredContent = specialObject.structuredContent;
-      }
-      return result;
-    }
-  }
-  const result: Record<string, unknown> = {
-    content: [{ type: "text", text: typeof value === "string" ? value : JSON.stringify(value, null, 2) }],
-    isError,
-  };
-  if (value && typeof value === "object" && !Array.isArray(value)) result.structuredContent = value;
-  return result;
-}
-
-function asObject(value: unknown): Record<string, unknown> {
-  if (!value || typeof value !== "object" || Array.isArray(value)) return {};
-  return value as Record<string, unknown>;
-}
-
-function requiredString(value: Record<string, unknown>, key: string): string {
-  const field = value[key];
-  if (typeof field !== "string" || !field.trim()) throw new Error(`${key} must be a non-empty string`);
-  return field.trim();
-}
-
-function sessionInstructionText(value: unknown): string {
-  const object = asObject(value);
-  const instructions = typeof object.instructions === "string" ? object.instructions : "";
-  if (!instructions) return "";
-  const bytes = new TextEncoder().encode(instructions);
-  if (bytes.byteLength > 3 * 1024 * 1024) return "";
-  return instructions;
-}
-
-function validateProtocolVersionHeader(request: Request, body: JsonRpcRequest): Record<string, unknown> | null {
-  if (body.method === "initialize") return null;
-  const version = request.headers.get("MCP-Protocol-Version");
-  if (!version) return null;
-  if (MCP_SUPPORTED_PROTOCOL_VERSIONS.includes(version as typeof MCP_SUPPORTED_PROTOCOL_VERSIONS[number])) return null;
-  return rpcError(body.id, -32602, "Unsupported MCP protocol version", {
-    requested: version,
-    supported: [...MCP_SUPPORTED_PROTOCOL_VERSIONS],
-  });
-}

package/src/worker/mcp-jsonrpc.ts

@@ -0,0 +1,94 @@
+const JSONRPC_VERSION = "2.0";
+const MAX_SESSION_INSTRUCTION_BYTES = 3 * 1024 * 1024;
+
+export type JsonRpcId = string | number | null;
+
+export interface JsonRpcRequest {
+  jsonrpc: "2.0";
+  id?: JsonRpcId;
+  method: string;
+  params?: unknown;
+}
+
+export function isJsonRpcRequest(value: unknown): value is JsonRpcRequest {
+  if (!value || typeof value !== "object" || Array.isArray(value)) return false;
+  const candidate = value as Record<string, unknown>;
+  if (candidate.jsonrpc !== JSONRPC_VERSION || typeof candidate.method !== "string" || !candidate.method.trim() || candidate.method.length > 256) return false;
+  if ("id" in candidate && !isJsonRpcId(candidate.id)) return false;
+  return true;
+}
+
+export function isJsonRpcResponse(value: unknown): boolean {
+  if (!value || typeof value !== "object" || Array.isArray(value)) return false;
+  const candidate = value as Record<string, unknown>;
+  if (candidate.jsonrpc !== JSONRPC_VERSION || !("id" in candidate) || !isJsonRpcId(candidate.id) || typeof candidate.method === "string") return false;
+  return ("result" in candidate) !== ("error" in candidate);
+}
+
+export function rpcResult(id: JsonRpcId | undefined, result: unknown): Record<string, unknown> | null {
+  if (id === undefined) return null;
+  return { jsonrpc: JSONRPC_VERSION, id, result };
+}
+
+export function rpcError(id: JsonRpcId | undefined, code: number, message: string, data?: unknown): Record<string, unknown> {
+  const error: Record<string, unknown> = { code, message };
+  if (data !== undefined) error.data = data;
+  return { jsonrpc: JSONRPC_VERSION, id: id ?? null, error };
+}
+
+export function textToolResult(value: unknown, isError = false): Record<string, unknown> {
+  const special = asObject(value).$mcp;
+  if (special && typeof special === "object" && !Array.isArray(special)) {
+    const specialObject = special as Record<string, unknown>;
+    if (Array.isArray(specialObject.content)) {
+      const result: Record<string, unknown> = { content: specialObject.content, isError };
+      if (specialObject.structuredContent && typeof specialObject.structuredContent === "object" && !Array.isArray(specialObject.structuredContent)) {
+        result.structuredContent = specialObject.structuredContent;
+      }
+      return result;
+    }
+  }
+  const result: Record<string, unknown> = {
+    content: [{ type: "text", text: typeof value === "string" ? value : JSON.stringify(value, null, 2) }],
+    isError,
+  };
+  if (value && typeof value === "object" && !Array.isArray(value)) result.structuredContent = value;
+  return result;
+}
+
+export function asObject(value: unknown): Record<string, unknown> {
+  if (!value || typeof value !== "object" || Array.isArray(value)) return {};
+  return value as Record<string, unknown>;
+}
+
+export function requiredString(value: Record<string, unknown>, key: string): string {
+  const field = value[key];
+  if (typeof field !== "string" || !field.trim()) throw new Error(`${key} must be a non-empty string`);
+  return field.trim();
+}
+
+export function sessionInstructionText(value: unknown): string {
+  const object = asObject(value);
+  const instructions = typeof object.instructions === "string" ? object.instructions : "";
+  if (!instructions) return "";
+  if (new TextEncoder().encode(instructions).byteLength > MAX_SESSION_INSTRUCTION_BYTES) return "";
+  return instructions;
+}
+
+export function validateProtocolVersionHeader(
+  request: Request,
+  body: JsonRpcRequest,
+  supportedVersions: readonly string[],
+): Record<string, unknown> | null {
+  if (body.method === "initialize") return null;
+  const version = request.headers.get("MCP-Protocol-Version");
+  if (!version || supportedVersions.includes(version)) return null;
+  return rpcError(body.id, -32602, "Unsupported MCP protocol version", {
+    requested: version,
+    supported: [...supportedVersions],
+  });
+}
+
+function isJsonRpcId(value: unknown): value is JsonRpcId {
+  return value === null || typeof value === "string" || (typeof value === "number" && Number.isFinite(value));
+}

package/src/worker/oauth-authorization-page.ts

@@ -0,0 +1,70 @@
+import type { ValidatedAuthorization } from "./oauth-state.ts";
+import {
+  escapeHtml, html, normalizeDisplayText, searchParamsEntries,
+} from "./http.ts";
+
+const AUTHORIZATION_FIELDS = new Set([
+  "response_type", "client_id", "redirect_uri", "code_challenge",
+  "code_challenge_method", "scope", "resource", "state",
+]);
+
+export interface AuthorizationPageOptions {
+  request: Request;
+  base: string;
+  serverName: string;
+  error?: string;
+  submitted?: Record<string, unknown>;
+  status?: number;
+  authorization?: ValidatedAuthorization;
+  allowSubmit?: boolean;
+}
+
+export function authorizationPage({
+  request,
+  base,
+  serverName,
+  error = "",
+  submitted,
+  status = 200,
+  authorization,
+  allowSubmit = true,
+}: AuthorizationPageOptions): Response {
+  const url = new URL(request.url);
+  const sourceEntries = submitted ? Object.entries(submitted) : searchParamsEntries(url.searchParams);
+  const hidden = sourceEntries
+    .filter(([key]) => AUTHORIZATION_FIELDS.has(key))
+    .map(([key, value]) => `<input type="hidden" name="${escapeHtml(key)}" value="${escapeHtml(String(value))}">`)
+    .join("\n");
+  const resource = normalizeDisplayText(
+    authorization?.requestedResource ?? String(submitted?.resource ?? url.searchParams.get("resource") ?? `${base}/mcp`),
+    1024,
+    `${base}/mcp`,
+  );
+  const clientBlock = authorization
+    ? `<p><strong>Client:</strong> ${escapeHtml(authorization.client.client_name)}</p>
+    <p><strong>Redirect URI:</strong> <code>${escapeHtml(authorization.redirectUri)}</code></p>`
+    : "";
+  const errorBlock = error ? `<p role="alert" aria-live="assertive" style="color:#b91c1c; font-weight:600">${escapeHtml(error)}</p>` : "";
+  const accountName = normalizeDisplayText(String(submitted?.account_name ?? ""), 64, "");
+  const form = allowSubmit
+    ? `<form method="post" action="/oauth/authorize">
+      ${hidden}
+      <label>Account name<br><input name="account_name" value="${escapeHtml(accountName)}" autocomplete="username" autofocus required style="width: 100%; box-sizing: border-box; padding: 8px;"></label>
+      <p><label>Account password<br><input name="account_password" type="password" autocomplete="current-password" required style="width: 100%; box-sizing: border-box; padding: 8px;"></label></p>
+      <p><button type="submit">Authorize</button></p>
+    </form>`
+    : "<p>Authorization cannot continue. Return to the MCP client and start the connection again.</p>";
+  const redirectOrigin = authorization ? new URL(authorization.redirectUri).origin : "";
+  return html(`<!doctype html>
+<html>
+  <head><meta charset="utf-8"><meta name="viewport" content="width=device-width, initial-scale=1"><title>Authorize ${serverName}</title></head>
+  <body style="font-family: system-ui, sans-serif; max-width: 640px; margin: 48px auto; line-height: 1.5; padding: 0 16px;">
+    <h1>Authorize ${serverName}</h1>
+    <p>Only continue if you initiated this MCP connection and recognize the client and redirect URI below.</p>
+    ${clientBlock}
+    <p><strong>Resource:</strong> <code>${escapeHtml(resource)}</code></p>
+    ${errorBlock}
+    ${form}
+  </body>
+</html>`, status, redirectOrigin);
+}

package/src/worker/oauth-controller.ts

@@ -5,12 +5,13 @@ import {
   AUTH_BLOCK_SECONDS, accountByName, authorizationIdentity, emptyOAuthStore,
   isCurrentOAuthStore, pruneAuthFailures, pruneClientRecordByExpiry, pruneRecordByExpiry, randomToken,
   recordAuthorizationFailure, safeEqual, sha256Hex, validateAuthorizationRequest, verifyAccountPassword,
-  type OAuthClient, type OAuthStore, type ValidatedAuthorization,
+  type OAuthClient, type OAuthStore,
 } from "./oauth-state.ts";
 import {
-  HttpError, authorizationRedirectLocation, escapeHtml, html, json, normalizeDisplayText,
-  normalizeRedirectUri, oauthRedirect, parseRequestBody, searchParamsEntries, searchParamsObject,
+  HttpError, authorizationRedirectLocation, json, normalizeDisplayText,
+  normalizeRedirectUri, oauthRedirect, parseRequestBody, searchParamsObject,
 } from "./http.ts";
+import { authorizationPage } from "./oauth-authorization-page.ts";
 
 const OAUTH_BODY_LIMIT_BYTES = 64 * 1024;
 const OAUTH_UNUSED_CLIENT_TTL_SECONDS = 60 * 60;
@@ -20,7 +21,6 @@ const OAUTH_CLIENT_IDLE_TTL_SECONDS = 60 * 60 * 24 * 90;
 const MAX_CODES_PER_CLIENT = 10;
 const MAX_OAUTH_CODES = 200;
 const MAX_AUTH_FAILURE_IDENTITIES = 200;
-const AUTHORIZATION_FIELDS = new Set(["response_type", "client_id", "redirect_uri", "code_challenge", "code_challenge_method", "scope", "resource", "state"]);
 
 export interface OAuthControllerEnv {
   ACCOUNT_ADMIN_SECRET: string;
@@ -176,75 +176,26 @@ export class OAuthController {
       const store = await this.oauthStore();
       const validation = validateAuthorizationRequest(body, base, this.serverName, store);
       if ("error" in validation) {
-        return this.authorizePage(request, base, validation.error, body, validation.status, undefined, false);
+        return authorizationPage({ request, base, serverName: this.serverName, error: validation.error, submitted: body, status: validation.status, allowSubmit: false });
       }
-      return this.authorizePage(request, base, "", body, 200, validation.value, true);
+      return authorizationPage({ request, base, serverName: this.serverName, submitted: body, authorization: validation.value });
     });
   }
 
-  private authorizePage(
-    request: Request,
-    base: string,
-    error = "",
-    submitted?: Record<string, unknown>,
-    status = 200,
-    authorization?: ValidatedAuthorization,
-    allowSubmit = true,
-  ): Response {
-    const url = new URL(request.url);
-    const sourceEntries = submitted ? Object.entries(submitted) : searchParamsEntries(url.searchParams);
-    const hidden = sourceEntries
-      .filter(([key]) => AUTHORIZATION_FIELDS.has(key))
-      .map(([key, value]) => `<input type="hidden" name="${escapeHtml(key)}" value="${escapeHtml(String(value))}">`)
-      .join("\n");
-    const resource = normalizeDisplayText(
-      authorization?.requestedResource ?? String(submitted?.resource ?? url.searchParams.get("resource") ?? `${base}/mcp`),
-      1024,
-      `${base}/mcp`,
-    );
-    const clientBlock = authorization
-      ? `<p><strong>Client:</strong> ${escapeHtml(authorization.client.client_name)}</p>
-    <p><strong>Redirect URI:</strong> <code>${escapeHtml(authorization.redirectUri)}</code></p>`
-      : "";
-    const errorBlock = error ? `<p role="alert" aria-live="assertive" style="color:#b91c1c; font-weight:600">${escapeHtml(error)}</p>` : "";
-    const accountName = normalizeDisplayText(String(submitted?.account_name ?? ""), 64, "");
-    const form = allowSubmit
-      ? `<form method="post" action="/oauth/authorize">
-      ${hidden}
-      <label>Account name<br><input name="account_name" value="${escapeHtml(accountName)}" autocomplete="username" autofocus required style="width: 100%; box-sizing: border-box; padding: 8px;"></label>
-      <p><label>Account password<br><input name="account_password" type="password" autocomplete="current-password" required style="width: 100%; box-sizing: border-box; padding: 8px;"></label></p>
-      <p><button type="submit">Authorize</button></p>
-    </form>`
-      : "<p>Authorization cannot continue. Return to the MCP client and start the connection again.</p>";
-    const redirectOrigin = authorization ? new URL(authorization.redirectUri).origin : "";
-    return html(`<!doctype html>
-<html>
-  <head><meta charset="utf-8"><meta name="viewport" content="width=device-width, initial-scale=1"><title>Authorize ${this.serverName}</title></head>
-  <body style="font-family: system-ui, sans-serif; max-width: 640px; margin: 48px auto; line-height: 1.5; padding: 0 16px;">
-    <h1>Authorize ${this.serverName}</h1>
-    <p>Only continue if you initiated this MCP connection and recognize the client and redirect URI below.</p>
-    ${clientBlock}
-    <p><strong>Resource:</strong> <code>${escapeHtml(resource)}</code></p>
-    ${errorBlock}
-    ${form}
-  </body>
-</html>`, status, redirectOrigin);
-  }
-
   async authorizeSubmit(request: Request, base: string): Promise<Response> {
     const body = await parseRequestBody(request, OAUTH_BODY_LIMIT_BYTES);
     return this.withOAuthLock(async () => {
       const store = await this.oauthStore();
       const validation = validateAuthorizationRequest(body, base, this.serverName, store);
       if ("error" in validation) {
-        return this.authorizePage(request, base, validation.error, body, validation.status, undefined, false);
+        return authorizationPage({ request, base, serverName: this.serverName, error: validation.error, submitted: body, status: validation.status, allowSubmit: false });
       }
       const { client, clientId, redirectUri, codeChallenge, requestedResource, scope, state } = validation.value;
       const now = Math.floor(Date.now() / 1000);
       const identity = await authorizationIdentity(request, this.identityKey());
       const failure = store.auth_failures[identity];
       if (failure?.blocked_until > now) {
-        return this.authorizePage(request, base, "Too many failed attempts. Try again later.", body, 429, validation.value);
+        return authorizationPage({ request, base, serverName: this.serverName, error: "Too many failed attempts. Try again later.", submitted: body, status: 429, authorization: validation.value });
       }
 
       const account = accountByName(store, body.account_name);
@@ -254,7 +205,7 @@ export class OAuthController {
         pruneAuthFailures(store, MAX_AUTH_FAILURE_IDENTITIES);
         await this.ctx.storage.put("oauth", store);
         const status = store.auth_failures[identity]?.blocked_until > now ? 429 : 401;
-        return this.authorizePage(request, base, "Invalid account credentials.", body, status, validation.value);
+        return authorizationPage({ request, base, serverName: this.serverName, error: "Invalid account credentials.", submitted: body, status, authorization: validation.value });
       }
       delete store.auth_failures[identity];
       client.last_used_at = now;

package/src/worker/websocket-protocol.ts

@@ -0,0 +1,24 @@
+export function isObjectRecord(value: unknown): value is Record<string, unknown> {
+  return Boolean(value) && typeof value === "object" && !Array.isArray(value);
+}
+
+export function rejectDaemonMessage(ws: WebSocket, error: string, closeCode: number, closeReason: string): void {
+  sendWebSocketQuietly(ws, { type: "error", error });
+  closeWebSocketQuietly(ws, closeCode, closeReason);
+}
+
+export function sendWebSocketQuietly(ws: WebSocket, value: unknown): void {
+  try {
+    ws.send(typeof value === "string" ? value : JSON.stringify(value));
+  } catch {
+    // Best-effort protocol cleanup must not replace the primary timeout or rejection.
+  }
+}
+
+export function closeWebSocketQuietly(ws: WebSocket, code?: number, reason?: string): void {
+  try {
+    ws.close(code, reason);
+  } catch {
+    // The socket may already be closed or detached; no recovery remains at this boundary.
+  }
+}

package/tsconfig.local.json

@@ -22,6 +22,11 @@
     "src/local/agent-contract.mjs",
     "src/local/browser-extension-protocol.mjs",
     "src/local/call-registry.mjs",
-    "src/local/policy.mjs"
+    "src/local/policy.mjs",
+    "src/local/runtime-paths.mjs",
+    "src/local/agent-context-projection.mjs",
+    "src/local/agent-skill-discovery.mjs",
+    "src/local/agent-text-file.mjs",
+    "src/local/managed-job-projection.mjs"
   ]
 }