poe-code 4.0.22 → 4.0.24

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "poe-code",
-  "version": "4.0.22",
+  "version": "4.0.24",
   "description": "CLI tool to configure Poe API for developer workflows.",
   "license": "MIT",
   "type": "module",

package/packages/tiny-http-mcp-server/dist/express-middleware.js

@@ -40,7 +40,7 @@ export function createProtectedResourceMetadataRouter(options) {
         if (path === "/") {
             return [PROTECTED_RESOURCE_METADATA_PATH];
         }
-        return [`${PROTECTED_RESOURCE_METADATA_PATH}${path}`];
+        return [PROTECTED_RESOURCE_METADATA_PATH, `${PROTECTED_RESOURCE_METADATA_PATH}${path}`];
     })();
     return (req, res, next) => {
         if (req.method !== "GET" || !metadataPaths.includes(req.path)) {

package/packages/tiny-http-mcp-server/dist/http-server.js

@@ -19,7 +19,7 @@ function getProtectedResourceMetadataPaths(path) {
     if (path === "/") {
         return [PROTECTED_RESOURCE_METADATA_PATH];
     }
-    return [`${PROTECTED_RESOURCE_METADATA_PATH}${path}`];
+    return [PROTECTED_RESOURCE_METADATA_PATH, `${PROTECTED_RESOURCE_METADATA_PATH}${path}`];
 }
 function formatHostnameForUrl(hostname) {
     if (hostname.includes(":") && !hostname.startsWith("[")) {
@@ -252,6 +252,9 @@ export function createHttpServer(options) {
         };
     };
     httpServer.handleRequest = async (req, res) => {
+        if (options.requestHandler !== undefined && (await options.requestHandler(req, res))) {
+            return;
+        }
         const { baseUrl } = req;
         const protectedResourcePath = typeof baseUrl === "string" && baseUrl.length > 0 ? baseUrl : "/mcp";
         if (!(await authorizeHttpRequest(req, res, protectedResourcePath))) {

package/packages/toolcraft/dist/http-hosted-oauth.compile-check.js

@@ -14,7 +14,17 @@ const ignoredHostedOAuth = hostedOAuth({
                 credential: `${ignoredPassword}:${ignoredSignal.aborted}`
             };
         },
-        services({ credentials }) {
+        services({ credentials, identity }) {
+            const ignoredSubject = identity.subject;
+            const ignoredClientId = identity.clientId;
+            const ignoredScopes = identity.scopes;
+            const ignoredResource = identity.resource;
+            const ignoredIssuer = identity.issuer;
+            void ignoredSubject;
+            void ignoredClientId;
+            void ignoredScopes;
+            void ignoredResource;
+            void ignoredIssuer;
             return { skylight: { credential: () => credentials.read() } };
         }
     }

package/packages/toolcraft/dist/http-hosted-oauth.d.ts

@@ -31,6 +31,7 @@ export interface HostedOAuthStorage<TCredential = unknown> {
     capabilities: HostedOAuthStorageCapabilities;
     signingKey(): Promise<OAuthAuthorizationServerSigningKey>;
     resolveSubject(providerName: string, accountId: string): Promise<string>;
+    healthCheck?(): Promise<void>;
     cleanup?(now?: number): Promise<void>;
 }
 export interface HostedOAuthCredentialAccess<TCredential = unknown> {
@@ -38,6 +39,13 @@ export interface HostedOAuthCredentialAccess<TCredential = unknown> {
     update(update: (credential: TCredential) => Promise<TCredential> | TCredential): Promise<TCredential>;
     delete(): Promise<void>;
 }
+export interface HostedOAuthIdentity {
+    issuer: string;
+    subject: string;
+    clientId: string;
+    scopes: readonly string[];
+    resource: string;
+}
 export interface HostedOAuthProvider<TCredential = unknown, TServices extends object = object> {
     name: string;
     login?: {
@@ -51,6 +59,7 @@ export interface HostedOAuthProvider<TCredential = unknown, TServices extends ob
     }>;
     services(input: {
         credentials: HostedOAuthCredentialAccess<TCredential>;
+        identity: HostedOAuthIdentity;
     }): Promise<Partial<TServices>> | Partial<TServices>;
 }
 export interface HostedOAuthInteractionAdapter<TCredential = unknown> {
@@ -106,7 +115,7 @@ export interface HostedOAuthRuntime<TServices extends object = object> {
     mcpPath: string;
     oauth: TinyHttpMcpServerOAuthOptions;
     requestHandler: HttpAdditionalRequestHandler;
-    requestServices(subject: string): Promise<Partial<TServices>>;
+    requestServices(identity: HostedOAuthIdentity): Promise<Partial<TServices>>;
 }
 export declare function createInMemoryHostedOAuthStorage<TCredential = unknown>(options: {
     development: true;

package/packages/toolcraft/dist/http-hosted-oauth.js

@@ -1,4 +1,4 @@
-import { createHmac, generateKeyPairSync, randomBytes } from "node:crypto";
+import { createHash, createHmac, generateKeyPairSync, randomBytes } from "node:crypto";
 import { exportJWK } from "jose";
 import { createAuthorizationInteractionSecurity, createInMemoryAuthorizationServerStore, createOAuthAuthorizationServer, verifyAuthorizationInteractionCsrf } from "mcp-oauth-server";
 export function isHostedOAuthConfiguration(value) {
@@ -12,6 +12,9 @@ function normalizePublicUrl(value) {
     if (url.username.length > 0 || url.password.length > 0) {
         throw new Error("hosted OAuth publicUrl must not contain credentials.");
     }
+    if (url.pathname === "/" || url.pathname.endsWith("/")) {
+        throw new Error("hosted OAuth publicUrl must contain a non-root path without a trailing slash.");
+    }
     return url;
 }
 function configurationErrors(config, production) {
@@ -117,6 +120,14 @@ function renderLogin(providerName, fields, transaction, csrfToken, error) {
         .join("");
     return `<!doctype html><html><head><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1"><title>Connect ${escapeHtml(providerName)}</title><style>body{font:16px system-ui;max-width:28rem;margin:10vh auto;padding:1rem;color:#171717}form{display:grid;gap:1rem}label{display:grid;gap:.35rem}input,button{font:inherit;padding:.7rem}button{cursor:pointer}${error === undefined ? "" : ".error{color:#b42318}"}</style></head><body><h1>Connect ${escapeHtml(providerName)}</h1>${error === undefined ? "" : `<p class="error">${escapeHtml(error)}</p>`}<form method="post" action="/oauth/connect"><input type="hidden" name="transaction" value="${escapeHtml(transaction.id)}"><input type="hidden" name="csrf" value="${escapeHtml(csrfToken)}">${controls}<button type="submit">Connect</button></form></body></html>`;
 }
+function loginContentSecurityPolicy(transaction) {
+    const callbackOrigin = new URL(transaction.redirectUri).origin;
+    return `default-src 'none'; style-src 'unsafe-inline'; form-action 'self' ${callbackOrigin}; base-uri 'none'; frame-ancestors 'none'`;
+}
+function interactionCookieName(transactionId) {
+    const suffix = createHash("sha256").update(transactionId).digest("base64url").slice(0, 22);
+    return `__Host-mcp_oauth_csrf_${suffix}`;
+}
 function writeWebResponse(response, webResponse) {
     webResponse.headers.forEach((value, name) => response.setHeader(name, value));
     response.statusCode = webResponse.status;
@@ -172,12 +183,14 @@ export async function prepareHostedOAuthRuntime(config) {
             if (customInteraction !== undefined) {
                 return customInteraction.start({ request, transaction });
             }
-            const security = createAuthorizationInteractionSecurity();
+            const security = createAuthorizationInteractionSecurity({
+                cookieName: interactionCookieName(transaction.id)
+            });
             return new Response(renderLogin(displayName, fields, transaction, security.csrfToken), {
                 status: 200,
                 headers: {
                     "content-type": "text/html; charset=utf-8",
-                    "content-security-policy": "default-src 'none'; style-src 'unsafe-inline'; form-action 'self'; base-uri 'none'; frame-ancestors 'none'",
+                    "content-security-policy": loginContentSecurityPolicy(transaction),
                     "cache-control": "no-store",
                     "referrer-policy": "no-referrer",
                     "x-content-type-options": "nosniff",
@@ -191,6 +204,7 @@ export async function prepareHostedOAuthRuntime(config) {
         issuer: prepared.issuer.href,
         resources: [prepared.publicUrl.href],
         scopesSupported: prepared.scopes,
+        defaultScopes: prepared.scopes,
         signingKey: await config.storage.signingKey(),
         additionalPublicJwks: config.advanced?.additionalPublicJwks,
         store: config.storage.authorizationServer,
@@ -203,8 +217,21 @@ export async function prepareHostedOAuthRuntime(config) {
     const requestHandler = async (request, response) => {
         const url = new URL(request.url ?? "/", prepared.issuer);
         if (request.method === "GET" && url.pathname === "/healthz") {
-            response.writeHead(200, { "content-type": "application/json", "cache-control": "no-store" });
-            response.end('{"ok":true}');
+            try {
+                await config.storage.healthCheck?.();
+                response.writeHead(200, {
+                    "content-type": "application/json",
+                    "cache-control": "no-store"
+                });
+                response.end('{"ok":true}');
+            }
+            catch {
+                response.writeHead(503, {
+                    "content-type": "application/json",
+                    "cache-control": "no-store"
+                });
+                response.end('{"ok":false}');
+            }
             return true;
         }
         if (customInteraction?.paths.includes(url.pathname) === true) {
@@ -213,11 +240,11 @@ export async function prepareHostedOAuthRuntime(config) {
                 request: toWebRequest(request, prepared.issuer, body),
                 async complete({ transactionId, accountId, credential }) {
                     const subject = await config.storage.resolveSubject(config.provider.name, accountId);
+                    await config.storage.credentials.set(subject, credential);
                     const completed = await authorizationServer.completeAuthorization({
                         transactionId,
                         subject
                     });
-                    await config.storage.credentials.set(subject, credential);
                     await config.storage.interactions.delete(transactionId);
                     return new Response(null, {
                         status: 303,
@@ -241,7 +268,8 @@ export async function prepareHostedOAuthRuntime(config) {
             if (transaction === undefined ||
                 !verifyAuthorizationInteractionCsrf({
                     cookieHeader: request.headers.cookie ?? null,
-                    submittedToken: csrf
+                    submittedToken: csrf,
+                    cookieName: interactionCookieName(transactionId)
                 }) ||
                 transaction.expiresAt <= Date.now()) {
                 response.writeHead(400, {
@@ -266,11 +294,11 @@ export async function prepareHostedOAuthRuntime(config) {
                 if (connected.accountId.trim().length === 0)
                     throw new Error("Provider returned an empty accountId.");
                 const subject = await config.storage.resolveSubject(config.provider.name, connected.accountId);
+                await config.storage.credentials.set(subject, connected.credential);
                 const completed = await authorizationServer.completeAuthorization({
                     transactionId,
                     subject
                 });
-                await config.storage.credentials.set(subject, connected.credential);
                 await config.storage.interactions.delete(transactionId);
                 response.writeHead(303, {
                     location: completed.redirectUrl.href,
@@ -286,7 +314,7 @@ export async function prepareHostedOAuthRuntime(config) {
                     : "Sign-in failed. Please try again.";
                 response.writeHead(400, {
                     "content-type": "text/html; charset=utf-8",
-                    "content-security-policy": "default-src 'none'; style-src 'unsafe-inline'; form-action 'self'; base-uri 'none'; frame-ancestors 'none'",
+                    "content-security-policy": loginContentSecurityPolicy(transaction),
                     "cache-control": "no-store",
                     "referrer-policy": "no-referrer"
                 });
@@ -332,9 +360,10 @@ export async function prepareHostedOAuthRuntime(config) {
             }
         },
         requestHandler,
-        async requestServices(subject) {
-            await credentialsFor(config.storage, subject).read();
-            return config.provider.services({ credentials: credentialsFor(config.storage, subject) });
+        async requestServices(identity) {
+            const credentials = credentialsFor(config.storage, identity.subject);
+            await credentials.read();
+            return config.provider.services({ credentials, identity });
         }
     };
 }

package/packages/toolcraft/dist/http.js

@@ -91,12 +91,19 @@ export async function createHTTPMCPServer(roots, options) {
             sessionIdGenerator: undefined,
             enableJsonResponse: true,
             requestServices: async (context) => {
-                const subject = context.auth?.subject;
-                if (subject === undefined)
+                const auth = context.auth;
+                const subject = auth?.subject;
+                if (auth === undefined || subject === undefined)
                     throw new Error("Hosted OAuth request is missing a verified subject.");
                 return {
                     ...(applicationServices === undefined ? {} : await applicationServices(context)),
-                    ...(await runtime.requestServices(subject))
+                    ...(await runtime.requestServices({
+                        issuer: auth.issuer,
+                        subject,
+                        clientId: auth.clientId,
+                        scopes: auth.scopes,
+                        resource: auth.resource.href
+                    }))
                 };
             },
             requestHandler: runtime.requestHandler
@@ -118,10 +125,23 @@ export async function createHTTPMCPServer(roots, options) {
     }
     if (hostedMcpPath !== undefined) {
         const listenHttp = server.listenHttp.bind(server);
-        server.listenHttp = (listenOptions = {}) => listenHttp({
-            path: hostedMcpPath,
-            ...listenOptions
-        });
+        server.listenHttp = async (listenOptions = {}) => {
+            if (listenOptions.path !== undefined) {
+                const withLeadingSlash = listenOptions.path.startsWith("/")
+                    ? listenOptions.path
+                    : `/${listenOptions.path}`;
+                const requestedPath = withLeadingSlash.length > 1 && withLeadingSlash.endsWith("/")
+                    ? withLeadingSlash.slice(0, -1)
+                    : withLeadingSlash;
+                if (requestedPath !== hostedMcpPath) {
+                    throw new Error(`Hosted OAuth MCP path ${JSON.stringify(requestedPath)} conflicts with publicUrl path ${JSON.stringify(hostedMcpPath)}.`);
+                }
+            }
+            return listenHttp({
+                ...listenOptions,
+                path: hostedMcpPath
+            });
+        };
     }
     return server;
 }