poe-code 3.0.432 → 3.0.434

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "poe-code",
-  "version": "3.0.432",
+  "version": "3.0.434",
   "description": "CLI tool to configure Poe API for developer workflows.",
   "license": "MIT",
   "type": "module",

package/packages/tiny-http-mcp-server/dist/auth.js

@@ -219,6 +219,18 @@ export async function authorizeBearerRequest(req, options) {
             authorizationServers: options.authorizationServers.map(toUrlString),
             requiredScopes,
         });
+        const verifiedScopes = new Set(verifiedToken.scopes);
+        if (requiredScopes.some((scope) => !verifiedScopes.has(scope))) {
+            return {
+                ok: false,
+                statusCode: 403,
+                challenge: createBearerChallenge(req, {
+                    error: "insufficient_scope",
+                    errorDescription: "insufficient scope",
+                    scope: requiredScopes,
+                }, options.protectedResourcePath, options.trustedProxy),
+            };
+        }
         const auth = toRequestAuthInfo(verifiedToken, toUrlString(options.resource));
         req.auth = auth;
         return {

package/packages/tiny-http-mcp-server/dist/express-middleware.js

@@ -62,6 +62,10 @@ export function createExpressOAuthHandlers(options) {
             path,
         }),
         mcpMiddleware: async (req, res, next) => {
+            if (req.method === "OPTIONS") {
+                await mcpMiddleware(req, res, next);
+                return;
+            }
             const authorization = await authorizeBearerRequest(req, {
                 ...options.oauth,
                 protectedResourcePath: path,

package/packages/tiny-http-mcp-server/dist/http-server.js

@@ -106,7 +106,7 @@ export function createHttpServer(options) {
         request: {}
     };
     const authorizeHttpRequest = async (req, res, protectedResourcePath) => {
-        if (options.oauth === undefined) {
+        if (options.oauth === undefined || req.method === "OPTIONS") {
             return true;
         }
         const authenticatedRequest = req;

package/packages/tiny-http-mcp-server/dist/http-transport.d.ts

@@ -99,12 +99,15 @@ export declare class StreamableHttpTransport {
     private readonly trustedProxy;
     private readonly sessionMessages;
     private readonly sseStreams;
+    private readonly sseExpiryTimers;
     private readonly sseEventHistory;
     private readonly responseRequestIds;
     private readonly responseOrigins;
     private nextNotificationEventId;
     private nextRequestId;
     private activeToolCalls;
+    private closed;
+    private sessionExpiryInterval;
     private sseKeepAliveInterval;
     constructor(server: Server, options?: StreamableHttpTransportOptions, runWithRequestContext?: RequestContextRunner);
     handleRequest(req: IncomingMessage, res: ServerResponse): Promise<void>;
@@ -128,6 +131,8 @@ export declare class StreamableHttpTransport {
     private createLocalMessageSession;
     private ensureLocalMessageSession;
     private closeStreamsForSession;
+    private scheduleSseExpiry;
+    private clearSseExpiryTimer;
     private startSseKeepAlive;
     private stopSseKeepAliveIfIdle;
     private stopSseKeepAlive;

package/packages/tiny-http-mcp-server/dist/http-transport.js

@@ -39,12 +39,15 @@ export class StreamableHttpTransport {
     trustedProxy;
     sessionMessages = new Map();
     sseStreams = new Map();
+    sseExpiryTimers = new Map();
     sseEventHistory = new Map();
     responseRequestIds = new WeakMap();
     responseOrigins = new WeakMap();
     nextNotificationEventId = 1;
     nextRequestId = 1;
     activeToolCalls = 0;
+    closed = false;
+    sessionExpiryInterval;
     sseKeepAliveInterval;
     constructor(server, options = {}, runWithRequestContext = async (_req, callback) => callback()) {
         this.server = server;
@@ -73,6 +76,17 @@ export class StreamableHttpTransport {
         this.requestIdGenerator = options.requestIdGenerator ?? (() => `req-${this.nextRequestId++}`);
         this.observability = options.observability ?? {};
         this.trustedProxy = options.trustedProxy ?? false;
+        if (this.sessionTtlMs !== undefined) {
+            this.sessionExpiryInterval = setInterval(() => {
+                try {
+                    this.purgeExpiredSessions();
+                }
+                catch {
+                    return;
+                }
+            }, Math.min(this.sessionTtlMs, 60_000));
+            this.sessionExpiryInterval.unref();
+        }
     }
     async handleRequest(req, res) {
         const startedAt = Date.now();
@@ -90,12 +104,10 @@ export class StreamableHttpTransport {
             sessionId: this.readSessionId(req)
         });
         try {
-            this.purgeExpiredSessions();
-        }
-        catch {
-            // Expiry cleanup must not make otherwise valid requests fail.
-        }
-        try {
+            if (this.closed) {
+                this.respondWithStatus(res, 503);
+                return;
+            }
             if (!this.acceptsHost(req) || !this.acceptsOrigin(req)) {
                 this.respondWithStatus(res, 403);
                 return;
@@ -148,7 +160,16 @@ export class StreamableHttpTransport {
         }
     }
     async close() {
+        this.closed = true;
+        if (this.sessionExpiryInterval !== undefined) {
+            clearInterval(this.sessionExpiryInterval);
+            this.sessionExpiryInterval = undefined;
+        }
         this.stopSseKeepAlive();
+        for (const timer of this.sseExpiryTimers.values()) {
+            clearTimeout(timer);
+        }
+        this.sseExpiryTimers.clear();
         for (const sessionId of [...this.sseStreams.keys()]) {
             this.closeStreamsForSession(sessionId);
         }
@@ -395,6 +416,7 @@ export class StreamableHttpTransport {
             streamCount: streams.size
         });
         const cleanup = () => {
+            this.clearSseExpiryTimer(res);
             const activeStreams = this.sseStreams.get(sessionId);
             if (activeStreams === undefined) {
                 return;
@@ -415,6 +437,10 @@ export class StreamableHttpTransport {
         req.on("close", cleanup);
         res.on("close", cleanup);
         res.on("finish", cleanup);
+        const expiresAt = req.auth?.expiresAt;
+        if (expiresAt !== undefined) {
+            this.scheduleSseExpiry(res, expiresAt);
+        }
         res.writeHead(200, this.withSessionHeader(SSE_HEADERS, sessionId, res));
         this.replaySseEvents(req, res, sessionId);
         res.flushHeaders();
@@ -589,6 +615,7 @@ export class StreamableHttpTransport {
             return;
         }
         for (const response of streams) {
+            this.clearSseExpiryTimer(response);
             if (!response.writableEnded) {
                 response.end();
             }
@@ -596,6 +623,25 @@ export class StreamableHttpTransport {
         this.sseStreams.delete(sessionId);
         this.stopSseKeepAliveIfIdle();
     }
+    scheduleSseExpiry(response, expiresAt) {
+        const remainingMs = Math.max(0, expiresAt * 1_000 - Date.now());
+        const timer = setTimeout(() => {
+            this.sseExpiryTimers.delete(response);
+            if (!response.writableEnded) {
+                response.end();
+            }
+        }, remainingMs);
+        timer.unref();
+        this.sseExpiryTimers.set(response, timer);
+    }
+    clearSseExpiryTimer(response) {
+        const timer = this.sseExpiryTimers.get(response);
+        if (timer === undefined) {
+            return;
+        }
+        clearTimeout(timer);
+        this.sseExpiryTimers.delete(response);
+    }
     startSseKeepAlive() {
         if (this.sseKeepAliveMs === 0 || this.sseKeepAliveInterval !== undefined) {
             return;
@@ -739,7 +785,7 @@ export class StreamableHttpTransport {
         if (host === undefined || host.length === 0) {
             return true;
         }
-        return this.allowedHosts.has(this.normalizeHost(host));
+        return this.allowedHosts.has(this.normalizeHost(this.readRequestHost(req)));
     }
     normalizeHost(host) {
         const normalized = host.trim().toLowerCase();