poe-code 3.0.433 → 3.0.434

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "poe-code",
-  "version": "3.0.433",
+  "version": "3.0.434",
   "description": "CLI tool to configure Poe API for developer workflows.",
   "license": "MIT",
   "type": "module",

package/packages/tiny-http-mcp-server/dist/auth.js

@@ -219,6 +219,18 @@ export async function authorizeBearerRequest(req, options) {
             authorizationServers: options.authorizationServers.map(toUrlString),
             requiredScopes,
         });
+        const verifiedScopes = new Set(verifiedToken.scopes);
+        if (requiredScopes.some((scope) => !verifiedScopes.has(scope))) {
+            return {
+                ok: false,
+                statusCode: 403,
+                challenge: createBearerChallenge(req, {
+                    error: "insufficient_scope",
+                    errorDescription: "insufficient scope",
+                    scope: requiredScopes,
+                }, options.protectedResourcePath, options.trustedProxy),
+            };
+        }
         const auth = toRequestAuthInfo(verifiedToken, toUrlString(options.resource));
         req.auth = auth;
         return {

package/packages/tiny-http-mcp-server/dist/express-middleware.js

@@ -62,6 +62,10 @@ export function createExpressOAuthHandlers(options) {
             path,
         }),
         mcpMiddleware: async (req, res, next) => {
+            if (req.method === "OPTIONS") {
+                await mcpMiddleware(req, res, next);
+                return;
+            }
             const authorization = await authorizeBearerRequest(req, {
                 ...options.oauth,
                 protectedResourcePath: path,

package/packages/tiny-http-mcp-server/dist/http-server.js

@@ -106,7 +106,7 @@ export function createHttpServer(options) {
         request: {}
     };
     const authorizeHttpRequest = async (req, res, protectedResourcePath) => {
-        if (options.oauth === undefined) {
+        if (options.oauth === undefined || req.method === "OPTIONS") {
             return true;
         }
         const authenticatedRequest = req;

package/packages/tiny-http-mcp-server/dist/http-transport.d.ts

@@ -99,6 +99,7 @@ export declare class StreamableHttpTransport {
     private readonly trustedProxy;
     private readonly sessionMessages;
     private readonly sseStreams;
+    private readonly sseExpiryTimers;
     private readonly sseEventHistory;
     private readonly responseRequestIds;
     private readonly responseOrigins;
@@ -130,6 +131,8 @@ export declare class StreamableHttpTransport {
     private createLocalMessageSession;
     private ensureLocalMessageSession;
     private closeStreamsForSession;
+    private scheduleSseExpiry;
+    private clearSseExpiryTimer;
     private startSseKeepAlive;
     private stopSseKeepAliveIfIdle;
     private stopSseKeepAlive;

package/packages/tiny-http-mcp-server/dist/http-transport.js

@@ -39,6 +39,7 @@ export class StreamableHttpTransport {
     trustedProxy;
     sessionMessages = new Map();
     sseStreams = new Map();
+    sseExpiryTimers = new Map();
     sseEventHistory = new Map();
     responseRequestIds = new WeakMap();
     responseOrigins = new WeakMap();
@@ -165,6 +166,10 @@ export class StreamableHttpTransport {
             this.sessionExpiryInterval = undefined;
         }
         this.stopSseKeepAlive();
+        for (const timer of this.sseExpiryTimers.values()) {
+            clearTimeout(timer);
+        }
+        this.sseExpiryTimers.clear();
         for (const sessionId of [...this.sseStreams.keys()]) {
             this.closeStreamsForSession(sessionId);
         }
@@ -411,6 +416,7 @@ export class StreamableHttpTransport {
             streamCount: streams.size
         });
         const cleanup = () => {
+            this.clearSseExpiryTimer(res);
             const activeStreams = this.sseStreams.get(sessionId);
             if (activeStreams === undefined) {
                 return;
@@ -431,6 +437,10 @@ export class StreamableHttpTransport {
         req.on("close", cleanup);
         res.on("close", cleanup);
         res.on("finish", cleanup);
+        const expiresAt = req.auth?.expiresAt;
+        if (expiresAt !== undefined) {
+            this.scheduleSseExpiry(res, expiresAt);
+        }
         res.writeHead(200, this.withSessionHeader(SSE_HEADERS, sessionId, res));
         this.replaySseEvents(req, res, sessionId);
         res.flushHeaders();
@@ -605,6 +615,7 @@ export class StreamableHttpTransport {
             return;
         }
         for (const response of streams) {
+            this.clearSseExpiryTimer(response);
             if (!response.writableEnded) {
                 response.end();
             }
@@ -612,6 +623,25 @@ export class StreamableHttpTransport {
         this.sseStreams.delete(sessionId);
         this.stopSseKeepAliveIfIdle();
     }
+    scheduleSseExpiry(response, expiresAt) {
+        const remainingMs = Math.max(0, expiresAt * 1_000 - Date.now());
+        const timer = setTimeout(() => {
+            this.sseExpiryTimers.delete(response);
+            if (!response.writableEnded) {
+                response.end();
+            }
+        }, remainingMs);
+        timer.unref();
+        this.sseExpiryTimers.set(response, timer);
+    }
+    clearSseExpiryTimer(response) {
+        const timer = this.sseExpiryTimers.get(response);
+        if (timer === undefined) {
+            return;
+        }
+        clearTimeout(timer);
+        this.sseExpiryTimers.delete(response);
+    }
     startSseKeepAlive() {
         if (this.sseKeepAliveMs === 0 || this.sseKeepAliveInterval !== undefined) {
             return;