poe-code 3.0.430 → 3.0.431

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "poe-code",
-  "version": "3.0.430",
+  "version": "3.0.431",
   "description": "CLI tool to configure Poe API for developer workflows.",
   "license": "MIT",
   "type": "module",

package/packages/tiny-http-mcp-server/dist/http-transport.d.ts

@@ -119,6 +119,7 @@ export declare class StreamableHttpTransport {
     private readOrigin;
     private readToolName;
     private getActiveSession;
+    private readAuthSubject;
     private touchSession;
     private isExpired;
     private purgeExpiredSessions;

package/packages/tiny-http-mcp-server/dist/http-transport.js

@@ -190,6 +190,7 @@ export class StreamableHttpTransport {
         }
         const initMessage = classified.messages.find((message) => this.isRequest(message) && message.method === "initialize");
         let sessionId;
+        let activeSession;
         if (this.sessionIdGenerator !== undefined) {
             const headerSessionId = this.readSessionId(req);
             if (headerSessionId === undefined) {
@@ -207,24 +208,28 @@ export class StreamableHttpTransport {
                     return;
                 }
                 sessionId = newSessionId;
-                this.sessionStore.create(newSessionId);
+                activeSession = this.sessionStore.create(newSessionId);
+                const authSubject = this.readAuthSubject(req);
+                if (authSubject !== undefined) {
+                    activeSession.authSubject = authSubject;
+                }
                 this.emit({ type: "session.created", sessionId: newSessionId });
                 this.createLocalMessageSession(newSessionId);
             }
             else {
-                const session = this.getActiveSession(headerSessionId);
-                if (session === undefined) {
+                activeSession = this.getActiveSession(headerSessionId, req);
+                if (activeSession === undefined) {
                     this.respondWithStatus(res, 404);
                     return;
                 }
                 sessionId = headerSessionId;
                 this.touchSession(sessionId);
-                if (session?.protocolVersion !== undefined &&
-                    !this.acceptsProtocolVersion(req, session.protocolVersion)) {
+                if (activeSession.protocolVersion !== undefined &&
+                    !this.acceptsProtocolVersion(req, activeSession.protocolVersion)) {
                     this.respondWithStatus(res, 400);
                     return;
                 }
-                await this.ensureLocalMessageSession(sessionId, session);
+                await this.ensureLocalMessageSession(sessionId, activeSession);
             }
         }
         const formattedResponses = await this.runWithRequestContext(req, async () => {
@@ -240,7 +245,7 @@ export class StreamableHttpTransport {
                 if (!("method" in message)) {
                     continue;
                 }
-                const session = sessionId === undefined ? undefined : this.sessionStore.get(sessionId);
+                const session = activeSession;
                 if (session !== undefined &&
                     message.method !== "initialize" &&
                     message.method !== "notifications/initialized" &&
@@ -359,7 +364,7 @@ export class StreamableHttpTransport {
             this.respondWithStatus(res, 400);
             return;
         }
-        const session = this.getActiveSession(sessionId);
+        const session = this.getActiveSession(sessionId, req);
         if (session === undefined) {
             this.respondWithStatus(res, 404);
             return;
@@ -426,8 +431,12 @@ export class StreamableHttpTransport {
             this.respondWithStatus(res, 400);
             return;
         }
-        const session = this.getActiveSession(sessionId);
-        if (session?.protocolVersion !== undefined &&
+        const session = this.getActiveSession(sessionId, req);
+        if (session === undefined) {
+            this.respondWithStatus(res, 404);
+            return;
+        }
+        if (session.protocolVersion !== undefined &&
             !this.acceptsProtocolVersion(req, session.protocolVersion)) {
             this.respondWithStatus(res, 400);
             return;
@@ -487,7 +496,7 @@ export class StreamableHttpTransport {
         const name = params.name;
         return typeof name === "string" ? name : undefined;
     }
-    getActiveSession(sessionId) {
+    getActiveSession(sessionId, req) {
         const session = this.sessionStore.get(sessionId);
         if (session === undefined) {
             return undefined;
@@ -496,8 +505,16 @@ export class StreamableHttpTransport {
             this.deleteSession(sessionId, "expired");
             return undefined;
         }
+        if (session.authSubject !== undefined && session.authSubject !== this.readAuthSubject(req)) {
+            return undefined;
+        }
         return session;
     }
+    readAuthSubject(req) {
+        const auth = req.auth;
+        const authSubject = auth?.subject ?? auth?.clientId;
+        return authSubject !== undefined && authSubject.length > 0 ? authSubject : undefined;
+    }
     touchSession(sessionId) {
         const session = this.sessionStore.get(sessionId);
         if (session === undefined) {

package/packages/tiny-http-mcp-server/dist/session.d.ts

@@ -1,6 +1,7 @@
 export interface Session {
     id: string;
     initialized: boolean;
+    authSubject?: string;
     protocolVersion?: string;
     createdAt: Date;
     lastSeenAt: Date;