poe-code 3.0.435 → 3.0.437

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "poe-code",
-  "version": "3.0.435",
+  "version": "3.0.437",
   "description": "CLI tool to configure Poe API for developer workflows.",
   "license": "MIT",
   "type": "module",

package/packages/tiny-http-mcp-server/dist/http-server.js

@@ -242,7 +242,9 @@ export function createHttpServer(options) {
         };
     };
     httpServer.handleRequest = async (req, res) => {
-        if (!(await authorizeHttpRequest(req, res, "/mcp"))) {
+        const { baseUrl } = req;
+        const protectedResourcePath = typeof baseUrl === "string" && baseUrl.length > 0 ? baseUrl : "/mcp";
+        if (!(await authorizeHttpRequest(req, res, protectedResourcePath))) {
             return;
         }
         await transport.handleRequest(req, res);

package/packages/tiny-http-mcp-server/dist/http-transport.d.ts

@@ -14,6 +14,7 @@ export type HttpObservabilityEvent = {
     statusCode: number;
     durationMs: number;
     sessionId?: string;
+    reason?: string;
 } | {
     type: "request.error";
     requestId: string;
@@ -103,6 +104,7 @@ export declare class StreamableHttpTransport {
     private readonly sseEventHistory;
     private readonly responseRequestIds;
     private readonly responseOrigins;
+    private readonly responseRejectionReasons;
     private nextNotificationEventId;
     private nextRequestId;
     private activeToolCalls;
@@ -154,6 +156,7 @@ export declare class StreamableHttpTransport {
     private isRequest;
     private isToolCallOk;
     private respondWithJsonRpcError;
+    private respondWithRejection;
     private respondWithStatus;
     private withSessionHeader;
     private emit;

package/packages/tiny-http-mcp-server/dist/http-transport.js

@@ -43,6 +43,7 @@ export class StreamableHttpTransport {
     sseEventHistory = new Map();
     responseRequestIds = new WeakMap();
     responseOrigins = new WeakMap();
+    responseRejectionReasons = new WeakMap();
     nextNotificationEventId = 1;
     nextRequestId = 1;
     activeToolCalls = 0;
@@ -105,11 +106,15 @@ export class StreamableHttpTransport {
         });
         try {
             if (this.closed) {
-                this.respondWithStatus(res, 503);
+                this.respondWithRejection(res, 503, "transport_closed", "The transport is closed; create or use an active transport.");
                 return;
             }
-            if (!this.acceptsHost(req) || !this.acceptsOrigin(req)) {
-                this.respondWithStatus(res, 403);
+            if (!this.acceptsHost(req)) {
+                this.respondWithRejection(res, 403, "host_not_allowed", `Host ${JSON.stringify(this.readRequestHost(req))} is not allowed; add it to allowedHosts.`);
+                return;
+            }
+            if (!this.acceptsOrigin(req)) {
+                this.respondWithRejection(res, 403, "origin_not_allowed", `Origin ${JSON.stringify(this.readOrigin(req) ?? "")} is not allowed; add it to allowedOrigins.`);
                 return;
             }
             switch (req.method) {
@@ -155,7 +160,10 @@ export class StreamableHttpTransport {
                 method: req.method ?? "",
                 statusCode: res.statusCode,
                 durationMs: Date.now() - startedAt,
-                sessionId: this.readSessionId(req)
+                sessionId: this.readSessionId(req),
+                ...(res.statusCode < 200 || res.statusCode >= 300
+                    ? { reason: this.responseRejectionReasons.get(res) ?? "http_error" }
+                    : {})
             });
         }
     }
@@ -184,7 +192,8 @@ export class StreamableHttpTransport {
             return;
         }
         if (!this.acceptsConfiguredResponse(req)) {
-            this.respondWithStatus(res, 406);
+            const expectedType = this.enableJsonResponse ? "application/json" : "text/event-stream";
+            this.respondWithRejection(res, 406, "response_type_not_acceptable", `Accept must allow ${expectedType}.`);
             return;
         }
         let classified;
@@ -216,11 +225,11 @@ export class StreamableHttpTransport {
             const headerSessionId = this.readSessionId(req);
             if (headerSessionId === undefined) {
                 if (initMessage === undefined) {
-                    this.respondWithStatus(res, 400);
+                    this.respondWithRejection(res, 400, "session_id_required", "Mcp-Session-Id is required; initialize a session first.");
                     return;
                 }
                 if (this.maxSessions !== undefined && this.sessionCount() >= this.maxSessions) {
-                    this.respondWithStatus(res, 503);
+                    this.respondWithRejection(res, 503, "session_limit_reached", "The server has reached its session limit; close a session or retry later.");
                     return;
                 }
                 const newSessionId = this.sessionIdGenerator();
@@ -240,14 +249,14 @@ export class StreamableHttpTransport {
             else {
                 activeSession = this.getActiveSession(headerSessionId, req);
                 if (activeSession === undefined) {
-                    this.respondWithStatus(res, 404);
+                    this.respondWithRejection(res, 404, "session_not_found", "Session was not found or has expired; reinitialize the session.");
                     return;
                 }
                 sessionId = headerSessionId;
                 this.touchSession(sessionId);
                 if (activeSession.protocolVersion !== undefined &&
                     !this.acceptsProtocolVersion(req, activeSession.protocolVersion)) {
-                    this.respondWithStatus(res, 400);
+                    this.respondWithRejection(res, 400, "protocol_version_mismatch", `MCP-Protocol-Version must match the session protocol version ${activeSession.protocolVersion}.`);
                     return;
                 }
                 await this.ensureLocalMessageSession(sessionId, activeSession);
@@ -377,30 +386,30 @@ export class StreamableHttpTransport {
             return;
         }
         if (!this.acceptsResponseType(req, "text/event-stream")) {
-            this.respondWithStatus(res, 406);
+            this.respondWithRejection(res, 406, "response_type_not_acceptable", "Accept must allow text/event-stream.");
             return;
         }
         const sessionId = this.readSessionId(req);
         if (sessionId === undefined) {
-            this.respondWithStatus(res, 400);
+            this.respondWithRejection(res, 400, "session_id_required", "Mcp-Session-Id is required; initialize a session first.");
             return;
         }
         const session = this.getActiveSession(sessionId, req);
         if (session === undefined) {
-            this.respondWithStatus(res, 404);
+            this.respondWithRejection(res, 404, "session_not_found", "Session was not found or has expired; reinitialize the session.");
             return;
         }
         this.touchSession(sessionId);
         if (session.initialized &&
             session.protocolVersion !== undefined &&
             !this.acceptsProtocolVersion(req, session.protocolVersion)) {
-            this.respondWithStatus(res, 400);
+            this.respondWithRejection(res, 400, "protocol_version_mismatch", `MCP-Protocol-Version must match the session protocol version ${session.protocolVersion}.`);
             return;
         }
         await this.ensureLocalMessageSession(sessionId, session);
         const existingStreams = this.sseStreams.get(sessionId);
         if ((existingStreams?.size ?? 0) >= this.maxStreamsPerSession) {
-            this.respondWithStatus(res, 409);
+            this.respondWithRejection(res, 409, "stream_limit_reached", "This session already has the maximum number of streams; close a stream and retry.");
             return;
         }
         let streams = this.sseStreams.get(sessionId);
@@ -454,21 +463,21 @@ export class StreamableHttpTransport {
         }
         const sessionId = this.readSessionId(req);
         if (sessionId === undefined) {
-            this.respondWithStatus(res, 400);
+            this.respondWithRejection(res, 400, "session_id_required", "Mcp-Session-Id is required; initialize a session first.");
             return;
         }
         const session = this.getActiveSession(sessionId, req);
         if (session === undefined) {
-            this.respondWithStatus(res, 404);
+            this.respondWithRejection(res, 404, "session_not_found", "Session was not found or has expired; reinitialize the session.");
             return;
         }
         if (session.protocolVersion !== undefined &&
             !this.acceptsProtocolVersion(req, session.protocolVersion)) {
-            this.respondWithStatus(res, 400);
+            this.respondWithRejection(res, 400, "protocol_version_mismatch", `MCP-Protocol-Version must match the session protocol version ${session.protocolVersion}.`);
             return;
         }
         if (!this.deleteSession(sessionId, "client")) {
-            this.respondWithStatus(res, 404);
+            this.respondWithRejection(res, 404, "session_not_found", "Session was not found or has expired; reinitialize the session.");
             return;
         }
         this.respondWithStatus(res, 204);
@@ -841,8 +850,13 @@ export class StreamableHttpTransport {
         return !(hasOwnProperty(result, "isError") && result.isError === true);
     }
     respondWithJsonRpcError(res, statusCode, errorCode, message, id = null) {
+        this.responseRejectionReasons.set(res, "json_rpc_error");
         this.respondWithStatus(res, statusCode, undefined, { "Content-Type": "application/json" }, formatErrorResponse(id, { code: errorCode, message }));
     }
+    respondWithRejection(res, statusCode, reason, message) {
+        this.responseRejectionReasons.set(res, reason);
+        this.respondWithStatus(res, statusCode, undefined, { "Content-Type": "application/json" }, JSON.stringify({ error: reason, message }));
+    }
     respondWithStatus(res, statusCode, sessionId, headers, body) {
         res.writeHead(statusCode, this.withSessionHeader(headers, sessionId, res));
         res.end(body);