poe-code 3.0.299 → 3.0.301

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "poe-code",
-  "version": "3.0.299",
+  "version": "3.0.301",
   "description": "CLI tool to configure Poe API for developer workflows.",
   "type": "module",
   "main": "./dist/index.js",

package/packages/tiny-http-mcp-oauth-test-server/dist/cli.js

@@ -42,6 +42,9 @@ function parsePort(value) {
     if (value === undefined) {
         return 0;
     }
+    if (!isDecimalInteger(value)) {
+        throw new Error("--port must be an integer between 0 and 65535.");
+    }
     const port = Number(value);
     if (!Number.isInteger(port) || port < 0 || port > 65535) {
         throw new Error("--port must be an integer between 0 and 65535.");
@@ -52,12 +55,18 @@ function parsePositiveInteger(value, flagName) {
     if (value === undefined) {
         return 60;
     }
+    if (!isDecimalInteger(value)) {
+        throw new Error(`${flagName} must be a positive integer.`);
+    }
     const parsed = Number(value);
     if (!Number.isInteger(parsed) || parsed <= 0) {
         throw new Error(`${flagName} must be a positive integer.`);
     }
     return parsed;
 }
+function isDecimalInteger(value) {
+    return value.length > 0 && [...value].every((character) => character >= "0" && character <= "9");
+}
 function parseAbsoluteUrl(value, flagName) {
     if (value === undefined) {
         return undefined;
@@ -88,8 +97,10 @@ function parseScopes(value) {
     }
     const scopes = value
         .split(",")
-        .map((scope) => scope.trim())
-        .filter((scope) => scope.length > 0);
+        .map((scope) => scope.trim());
+    if (scopes.some((scope) => scope.length === 0)) {
+        throw new Error("--scopes must not contain empty entries.");
+    }
     if (scopes.length === 0) {
         throw new Error("--scopes must include at least one non-empty scope.");
     }
@@ -178,20 +189,27 @@ export async function runCli(args = process.argv.slice(2), dependencies = {}) {
         port: parsed.port,
         hostname: parsed.hostname,
     };
-    const server = createMcpOAuthTestServer(serverOptions);
-    const handle = await server.listen(listenOptions);
-    stdout.write(`${packageInfo.name} ${packageInfo.version}\n`);
-    stdout.write(`MCP URL: ${handle.mcpUrl}\n`);
-    stdout.write(`PRM URL: ${handle.prmUrl}\n`);
-    stdout.write(`AS issuer: ${handle.oauth.issuer}\n`);
-    stdout.write(`Resource: ${handle.resource}\n`);
-    if (parsed.printTestToken) {
-        const token = await handle.oauth.issueTokenFor({
-            clientId: "demo-client",
-            resource: handle.resource,
-            scopes: parsed.scopes ?? ["mcp.read"],
-        });
-        stdout.write(`Test bearer token: ${token}\n`);
+    let handle;
+    try {
+        const server = createMcpOAuthTestServer(serverOptions);
+        handle = await server.listen(listenOptions);
+        stdout.write(`${packageInfo.name} ${packageInfo.version}\n`);
+        stdout.write(`MCP URL: ${handle.mcpUrl}\n`);
+        stdout.write(`PRM URL: ${handle.prmUrl}\n`);
+        stdout.write(`AS issuer: ${handle.oauth.issuer}\n`);
+        stdout.write(`Resource: ${handle.resource}\n`);
+        if (parsed.printTestToken) {
+            const token = await handle.oauth.issueTokenFor({
+                clientId: "demo-client",
+                resource: handle.resource,
+                scopes: parsed.scopes ?? ["mcp.read"],
+            });
+            stdout.write(`Test bearer token: ${token}\n`);
+        }
+    }
+    catch (error) {
+        stderr.write(`${error instanceof Error ? error.message : String(error)}\n\n${HELP_TEXT}\n`);
+        return 1;
     }
     await (dependencies.waitForShutdown ?? waitForShutdown)(handle.close);
     return 0;

package/packages/tiny-http-mcp-oauth-test-server/dist/index.js

@@ -85,6 +85,9 @@ function normalizeScopes(scopes) {
     if (normalizedScopes.some((scope) => scope.trim().length === 0)) {
         throw new Error("scopes must contain non-empty values");
     }
+    if (normalizedScopes.some((scope) => scope.trim() !== scope || scope.includes(" "))) {
+        throw new Error("scope entries must not contain spaces");
+    }
     return normalizedScopes;
 }
 function normalizeTtlSeconds(ttlSeconds) {
@@ -94,6 +97,13 @@ function normalizeTtlSeconds(ttlSeconds) {
     }
     return normalizedTtlSeconds;
 }
+function normalizeListenPort(port) {
+    const normalizedPort = port ?? 0;
+    if (!Number.isInteger(normalizedPort) || normalizedPort < 0 || normalizedPort > 65535) {
+        throw new Error("port must be an integer between 0 and 65535");
+    }
+    return normalizedPort;
+}
 function closeServer(server) {
     return new Promise((resolve, reject) => {
         server.close((error) => {
@@ -135,9 +145,9 @@ export function createMcpOAuthTestServer(options = {}) {
             if (currentHandle !== null || listenPending) {
                 throw new Error("MCP OAuth test server is already listening");
             }
-            listenPending = true;
             const hostname = listenOptions.hostname ?? "127.0.0.1";
-            const requestedPort = listenOptions.port ?? 0;
+            const requestedPort = normalizeListenPort(listenOptions.port);
+            listenPending = true;
             let lastError;
             for (let attempt = 0; attempt < 10; attempt += 1) {
                 try {

package/packages/tiny-oauth-test-server/dist/cli.js

@@ -108,16 +108,27 @@ function parseScope(value) {
 function formatScope(scope) {
   return scope.length === 0 ? void 0 : scope.join(" ");
 }
+function isValidScopeEntry(scope) {
+  const parsed = parseScope(scope);
+  return scope.length > 0 && parsed.length === 1 && parsed[0] === scope;
+}
 function validateConfiguredScopes(scopes) {
   if (scopes === void 0) {
     return;
   }
   for (const scope of scopes) {
-    if (scope.length === 0 || parseScope(scope).length !== 1 || parseScope(scope)[0] !== scope) {
+    if (!isValidScopeEntry(scope)) {
       throw new Error("scope entries must not contain spaces");
     }
   }
 }
+function validateDirectTokenScopes(scopes) {
+  for (const scope of scopes) {
+    if (!isValidScopeEntry(scope)) {
+      throw new OAuthRequestError(400, "invalid_request", "scope entries must not contain spaces");
+    }
+  }
+}
 function createRandomToken() {
   return randomBytes(24).toString("base64url");
 }
@@ -341,6 +352,16 @@ function requireJsonContentType(headers) {
     );
   }
 }
+function requireFormContentType(headers) {
+  const contentType = headers["content-type"]?.split(";")[0]?.trim().toLowerCase();
+  if (contentType !== "application/x-www-form-urlencoded") {
+    throw new OAuthRequestError(
+      400,
+      "invalid_request",
+      "Content-Type must be application/x-www-form-urlencoded"
+    );
+  }
+}
 function normalizeRegistrationStringArray(value, field, fallback) {
   if (value === void 0) {
     return [...fallback];
@@ -391,7 +412,7 @@ function assertAllowedScopes(requestedScopes, client) {
   }
 }
 function normalizeStaticClient(input) {
-  if (input.clientId.length === 0) {
+  if (input.clientId.trim().length === 0) {
     throw new Error("staticClients[].clientId must be non-empty");
   }
   if (input.redirectUris.length === 0) {
@@ -526,11 +547,15 @@ function createOAuthTestServer(options = {}) {
     },
     async issueTokenFor(input) {
       const issuer = getIssuer();
+      if (input.clientId.trim().length === 0) {
+        throw new Error("clientId must be non-empty");
+      }
       const resource = parseAbsoluteUrl(input.resource, "resource");
       const ttlSeconds = input.ttlSeconds ?? defaultTokenTtlSeconds;
       if (!Number.isInteger(ttlSeconds) || ttlSeconds <= 0) {
         throw new Error("ttlSeconds must be a positive integer");
       }
+      validateDirectTokenScopes(input.scopes);
       const token = await issueAccessToken({
         issuer,
         clientId: input.clientId,
@@ -623,6 +648,7 @@ function createOAuthTestServer(options = {}) {
       if (method === "POST" && paths.tokenPaths.includes(url.pathname)) {
         const body = await readBody(request);
         appendRequestLog(body);
+        requireFormContentType(requestHeaders);
         await handleToken(new URLSearchParams(body), response);
         return;
       }
@@ -902,7 +928,7 @@ function createOAuthTestServer(options = {}) {
     const resource = getOwnEntry(payload, "resource");
     const ttlSeconds = getOwnEntry(payload, "ttl_seconds");
     const scopes = getOwnEntry(payload, "scopes");
-    if (typeof clientId !== "string" || clientId.length === 0) {
+    if (typeof clientId !== "string" || clientId.trim().length === 0) {
       throw new OAuthRequestError(400, "invalid_request", "client_id is required");
     }
     if (typeof resource !== "string" || resource.length === 0) {
@@ -912,6 +938,9 @@ function createOAuthTestServer(options = {}) {
       throw new OAuthRequestError(400, "invalid_request", "scopes must be a string or array");
     }
     const parsedScopes = typeof scopes === "string" ? parseScope(scopes) : scopes ?? [];
+    if (Array.isArray(scopes)) {
+      validateDirectTokenScopes(parsedScopes);
+    }
     if (ttlSeconds !== void 0 && (typeof ttlSeconds !== "number" || !Number.isInteger(ttlSeconds) || ttlSeconds <= 0)) {
       throw new OAuthRequestError(
         400,
@@ -1107,6 +1136,9 @@ function parsePort(value) {
   if (value === void 0) {
     return 0;
   }
+  if (!isDecimalInteger(value)) {
+    throw new Error("--port must be an integer between 0 and 65535.");
+  }
   const port = Number(value);
   if (!Number.isInteger(port) || port < 0 || port > 65535) {
     throw new Error("--port must be an integer between 0 and 65535.");
@@ -1117,12 +1149,18 @@ function parsePositiveInteger(value, flagName) {
   if (value === void 0) {
     return 60;
   }
+  if (!isDecimalInteger(value)) {
+    throw new Error(`${flagName} must be a positive integer.`);
+  }
   const parsed = Number(value);
   if (!Number.isInteger(parsed) || parsed <= 0) {
     throw new Error(`${flagName} must be a positive integer.`);
   }
   return parsed;
 }
+function isDecimalInteger(value) {
+  return value.length > 0 && [...value].every((character) => character >= "0" && character <= "9");
+}
 function parseIssuer(value) {
   if (value === void 0) {
     return void 0;

package/packages/tiny-oauth-test-server/dist/index.js

@@ -106,16 +106,27 @@ function parseScope(value) {
 function formatScope(scope) {
     return scope.length === 0 ? undefined : scope.join(" ");
 }
+function isValidScopeEntry(scope) {
+    const parsed = parseScope(scope);
+    return scope.length > 0 && parsed.length === 1 && parsed[0] === scope;
+}
 function validateConfiguredScopes(scopes) {
     if (scopes === undefined) {
         return;
     }
     for (const scope of scopes) {
-        if (scope.length === 0 || parseScope(scope).length !== 1 || parseScope(scope)[0] !== scope) {
+        if (!isValidScopeEntry(scope)) {
             throw new Error("scope entries must not contain spaces");
         }
     }
 }
+function validateDirectTokenScopes(scopes) {
+    for (const scope of scopes) {
+        if (!isValidScopeEntry(scope)) {
+            throw new OAuthRequestError(400, "invalid_request", "scope entries must not contain spaces");
+        }
+    }
+}
 function createRandomToken() {
     return randomBytes(24).toString("base64url");
 }
@@ -347,6 +358,12 @@ function requireJsonContentType(headers) {
         throw new OAuthRequestError(400, "invalid_request", "Content-Type must be application/json");
     }
 }
+function requireFormContentType(headers) {
+    const contentType = headers["content-type"]?.split(";")[0]?.trim().toLowerCase();
+    if (contentType !== "application/x-www-form-urlencoded") {
+        throw new OAuthRequestError(400, "invalid_request", "Content-Type must be application/x-www-form-urlencoded");
+    }
+}
 function normalizeRegistrationStringArray(value, field, fallback) {
     if (value === undefined) {
         return [...fallback];
@@ -398,7 +415,7 @@ function assertAllowedScopes(requestedScopes, client) {
     }
 }
 function normalizeStaticClient(input) {
-    if (input.clientId.length === 0) {
+    if (input.clientId.trim().length === 0) {
         throw new Error("staticClients[].clientId must be non-empty");
     }
     if (input.redirectUris.length === 0) {
@@ -532,11 +549,15 @@ export function createOAuthTestServer(options = {}) {
         },
         async issueTokenFor(input) {
             const issuer = getIssuer();
+            if (input.clientId.trim().length === 0) {
+                throw new Error("clientId must be non-empty");
+            }
             const resource = parseAbsoluteUrl(input.resource, "resource");
             const ttlSeconds = input.ttlSeconds ?? defaultTokenTtlSeconds;
             if (!Number.isInteger(ttlSeconds) || ttlSeconds <= 0) {
                 throw new Error("ttlSeconds must be a positive integer");
             }
+            validateDirectTokenScopes(input.scopes);
             const token = await issueAccessToken({
                 issuer,
                 clientId: input.clientId,
@@ -629,6 +650,7 @@ export function createOAuthTestServer(options = {}) {
             if (method === "POST" && paths.tokenPaths.includes(url.pathname)) {
                 const body = await readBody(request);
                 appendRequestLog(body);
+                requireFormContentType(requestHeaders);
                 await handleToken(new URLSearchParams(body), response);
                 return;
             }
@@ -847,7 +869,7 @@ export function createOAuthTestServer(options = {}) {
         const resource = getOwnEntry(payload, "resource");
         const ttlSeconds = getOwnEntry(payload, "ttl_seconds");
         const scopes = getOwnEntry(payload, "scopes");
-        if (typeof clientId !== "string" || clientId.length === 0) {
+        if (typeof clientId !== "string" || clientId.trim().length === 0) {
             throw new OAuthRequestError(400, "invalid_request", "client_id is required");
         }
         if (typeof resource !== "string" || resource.length === 0) {
@@ -857,6 +879,9 @@ export function createOAuthTestServer(options = {}) {
             throw new OAuthRequestError(400, "invalid_request", "scopes must be a string or array");
         }
         const parsedScopes = typeof scopes === "string" ? parseScope(scopes) : scopes ?? [];
+        if (Array.isArray(scopes)) {
+            validateDirectTokenScopes(parsedScopes);
+        }
         if (ttlSeconds !== undefined
             && (typeof ttlSeconds !== "number" || !Number.isInteger(ttlSeconds) || ttlSeconds <= 0)) {
             throw new OAuthRequestError(400, "invalid_request", "ttl_seconds must be a positive integer");