nostr-bray 1.28.0 → 1.28.1

package/dist/index.js

@@ -142,12 +142,10 @@ if (config.transport === 'stdio') {
 else {
     const { createServer } = await import('node:http');
     const { StreamableHTTPServerTransport } = await import('@modelcontextprotocol/sdk/server/streamableHttp.js');
-    const { randomUUID } = await import('node:crypto');
+    const { isInitializeRequest } = await import('@modelcontextprotocol/sdk/types.js');
+    const { randomUUID, timingSafeEqual } = await import('node:crypto');
     const token = process.env.BRAY_HTTP_TOKEN ?? randomUUID();
     console.error(`nostr-bray HTTP auth token: ${token}`);
-    const transport = new StreamableHTTPServerTransport({ sessionIdGenerator: () => randomUUID() });
-    await server.connect(transport);
-    const { timingSafeEqual } = await import('node:crypto');
     const expectedAuth = Buffer.from(`Bearer ${token}`);
     // Sliding window rate limiter (per-IP)
     const rateLimits = new Map();
@@ -163,6 +161,25 @@ else {
         entry.count++;
         return entry.count <= RATE_LIMIT;
     }
+    // Session map — each MCP session gets its own transport.
+    // The underlying McpServer is reused across sessions: when a session ends its
+    // transport closes, which sets server._transport = undefined, allowing the next
+    // session to call server.connect(newTransport).
+    // eslint-disable-next-line @typescript-eslint/no-explicit-any
+    const sessions = new Map();
+    async function createSession() {
+        // Close the current server connection so it can be reconnected below.
+        if (server.isConnected())
+            await server.close();
+        const t = new StreamableHTTPServerTransport({
+            sessionIdGenerator: () => randomUUID(),
+            onsessioninitialized: (id) => { sessions.set(id, t); },
+        });
+        t.onclose = () => { if (t.sessionId)
+            sessions.delete(t.sessionId); };
+        await server.connect(t);
+        return t;
+    }
     const httpServer = createServer(async (req, res) => {
         const clientIp = req.socket.remoteAddress ?? 'unknown';
         // Rate limiting
@@ -187,6 +204,7 @@ else {
             return;
         }
         // Parse body for POST requests (1MB limit)
+        let body;
         if (req.method === 'POST') {
             const MAX_BODY = 1_048_576;
             const chunks = [];
@@ -200,7 +218,6 @@ else {
                 }
                 chunks.push(chunk);
             }
-            let body;
             try {
                 body = JSON.parse(Buffer.concat(chunks).toString());
             }
@@ -209,11 +226,19 @@ else {
                 res.end(JSON.stringify({ error: 'Invalid JSON' }));
                 return;
             }
-            await transport.handleRequest(req, res, body);
         }
-        else {
-            await transport.handleRequest(req, res);
+        // Route to existing session or create a new one for initialize requests
+        const sessionId = req.headers['mcp-session-id'];
+        let transport = sessionId ? sessions.get(sessionId) : undefined;
+        if (!transport) {
+            if (req.method !== 'POST' || !isInitializeRequest(body)) {
+                res.writeHead(400, { 'Content-Type': 'application/json' });
+                res.end(JSON.stringify({ jsonrpc: '2.0', error: { code: -32000, message: 'Bad Request: no active session' }, id: null }));
+                return;
+            }
+            transport = await createSession();
         }
+        await transport.handleRequest(req, res, body);
     });
     httpServer.listen(config.port, config.bindAddress, () => {
         console.error(`nostr-bray HTTP on ${config.bindAddress}:${config.port}`);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "nostr-bray",
-  "version": "1.28.0",
+  "version": "1.28.1",
   "mcpName": "dev.forgesworn/bray",
   "description": "Trust-aware Nostr for AI and humans. Three dimensions of trust -- verification, proximity, and access -- woven into every interaction.",
   "type": "module",