session-collab-mcp 2.1.0 → 2.2.0

package/dist/cli.js

@@ -6,25 +6,18 @@ import {
   createLocalDatabase,
   getDefaultDbPath,
   getMcpTools,
-  handleMcpRequest
-} from "./chunk-V4APNPXF.js";
+  handleMcpRequest,
+  loadMigrationsFromDir
+} from "./chunk-SOUW3JSS.js";
 
 // src/cli.ts
 import { createInterface } from "readline";
-import { readFileSync } from "fs";
 import { join, dirname } from "path";
 import { fileURLToPath } from "url";
 var __dirname = dirname(fileURLToPath(import.meta.url));
 function loadMigrations() {
   const migrationsDir = join(__dirname, "..", "migrations");
-  return [
-    readFileSync(join(migrationsDir, "0001_init.sql"), "utf-8"),
-    readFileSync(join(migrationsDir, "0002_auth.sql"), "utf-8"),
-    readFileSync(join(migrationsDir, "0003_config.sql"), "utf-8"),
-    readFileSync(join(migrationsDir, "0004_symbols.sql"), "utf-8"),
-    readFileSync(join(migrationsDir, "0005_references.sql"), "utf-8"),
-    readFileSync(join(migrationsDir, "0006_composite_indexes.sql"), "utf-8")
-  ];
+  return loadMigrationsFromDir(migrationsDir);
 }
 function parseArgs() {
   const args = process.argv.slice(2);

package/dist/cli.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/cli.ts"],"sourcesContent":["#!/usr/bin/env node\n// Local MCP server for session collaboration\n// Runs via stdio, stores data in ~/.claude/session-collab/collab.db\n\nimport { createInterface } from 'readline';\nimport { createLocalDatabase, getDefaultDbPath } from './db/sqlite-adapter.js';\nimport { handleMcpRequest, getMcpTools } from './mcp/server.js';\nimport { VERSION, SERVER_NAME, SERVER_INSTRUCTIONS } from './constants.js';\nimport { readFileSync } from 'fs';\nimport { join, dirname } from 'path';\nimport { fileURLToPath } from 'url';\n\nconst __dirname = dirname(fileURLToPath(import.meta.url));\n\n// Load migrations\nfunction loadMigrations(): string[] {\n  const migrationsDir = join(__dirname, '..', 'migrations');\n  return [\n    readFileSync(join(migrationsDir, '0001_init.sql'), 'utf-8'),\n    readFileSync(join(migrationsDir, '0002_auth.sql'), 'utf-8'),\n    readFileSync(join(migrationsDir, '0003_config.sql'), 'utf-8'),\n    readFileSync(join(migrationsDir, '0004_symbols.sql'), 'utf-8'),\n    readFileSync(join(migrationsDir, '0005_references.sql'), 'utf-8'),\n    readFileSync(join(migrationsDir, '0006_composite_indexes.sql'), 'utf-8'),\n  ];\n}\n\n// Parse command line arguments\nfunction parseArgs(): { dbPath?: string } {\n  const args = process.argv.slice(2);\n  let dbPath: string | undefined;\n\n  for (let i = 0; i < args.length; i++) {\n    if (args[i] === '--db' && args[i + 1]) {\n      dbPath = args[i + 1];\n      i++;\n    }\n  }\n\n  return { dbPath };\n}\n\n// JSON-RPC response helpers\nfunction jsonRpcResponse(id: number | string | null, result: unknown): string {\n  return JSON.stringify({ jsonrpc: '2.0', id, result });\n}\n\nfunction jsonRpcError(id: number | string | null, code: number, message: string): string {\n  return JSON.stringify({ jsonrpc: '2.0', id, error: { code, message } });\n}\n\nasync function main(): Promise<void> {\n  const { dbPath } = parseArgs();\n  const db = createLocalDatabase(dbPath);\n\n  // Initialize schema\n  try {\n    const migrations = loadMigrations();\n    db.initSchema(migrations);\n  } catch (error) {\n    // Schema might already exist, that's fine\n    if (!(error instanceof Error && error.message.includes('already exists'))) {\n      console.error('Warning: Migration error:', error);\n    }\n  }\n\n  // Log startup to stderr (stdout is for JSON-RPC)\n  console.error(`Session Collab MCP Server (local)`);\n  console.error(`Database: ${dbPath ?? getDefaultDbPath()}`);\n\n  const rl = createInterface({\n    input: process.stdin,\n    output: process.stdout,\n    terminal: false,\n  });\n\n  rl.on('line', async (line) => {\n    if (!line.trim()) return;\n\n    try {\n      const request = JSON.parse(line);\n      const { id, method, params } = request;\n\n      // Handle MCP protocol methods\n      switch (method) {\n        case 'initialize': {\n          const response = jsonRpcResponse(id, {\n            protocolVersion: '2024-11-05',\n            capabilities: {\n              tools: {},\n            },\n            serverInfo: {\n              name: SERVER_NAME,\n              version: VERSION,\n            },\n            instructions: SERVER_INSTRUCTIONS,\n          });\n          console.log(response);\n          break;\n        }\n\n        case 'notifications/initialized': {\n          // No response needed for notifications\n          break;\n        }\n\n        case 'tools/list': {\n          const tools = getMcpTools();\n          const response = jsonRpcResponse(id, { tools });\n          console.log(response);\n          break;\n        }\n\n        case 'tools/call': {\n          const result = await handleMcpRequest(\n            db,\n            params.name,\n            params.arguments ?? {}\n          );\n          const response = jsonRpcResponse(id, result);\n          console.log(response);\n          break;\n        }\n\n        default: {\n          const errorResponse = jsonRpcError(id, -32601, `Method not found: ${method}`);\n          console.log(errorResponse);\n        }\n      }\n    } catch (error) {\n      const errorMessage = error instanceof Error ? error.message : 'Unknown error';\n      const errorResponse = jsonRpcError(null, -32700, `Parse error: ${errorMessage}`);\n      console.log(errorResponse);\n    }\n  });\n\n  rl.on('close', () => {\n    db.close();\n    process.exit(0);\n  });\n}\n\nmain().catch((error) => {\n  console.error('Fatal error:', error);\n  process.exit(1);\n});\n"],"mappings":";;;;;;;;;;;;AAIA,SAAS,uBAAuB;AAIhC,SAAS,oBAAoB;AAC7B,SAAS,MAAM,eAAe;AAC9B,SAAS,qBAAqB;AAE9B,IAAM,YAAY,QAAQ,cAAc,YAAY,GAAG,CAAC;AAGxD,SAAS,iBAA2B;AAClC,QAAM,gBAAgB,KAAK,WAAW,MAAM,YAAY;AACxD,SAAO;AAAA,IACL,aAAa,KAAK,eAAe,eAAe,GAAG,OAAO;AAAA,IAC1D,aAAa,KAAK,eAAe,eAAe,GAAG,OAAO;AAAA,IAC1D,aAAa,KAAK,eAAe,iBAAiB,GAAG,OAAO;AAAA,IAC5D,aAAa,KAAK,eAAe,kBAAkB,GAAG,OAAO;AAAA,IAC7D,aAAa,KAAK,eAAe,qBAAqB,GAAG,OAAO;AAAA,IAChE,aAAa,KAAK,eAAe,4BAA4B,GAAG,OAAO;AAAA,EACzE;AACF;AAGA,SAAS,YAAiC;AACxC,QAAM,OAAO,QAAQ,KAAK,MAAM,CAAC;AACjC,MAAI;AAEJ,WAAS,IAAI,GAAG,IAAI,KAAK,QAAQ,KAAK;AACpC,QAAI,KAAK,CAAC,MAAM,UAAU,KAAK,IAAI,CAAC,GAAG;AACrC,eAAS,KAAK,IAAI,CAAC;AACnB;AAAA,IACF;AAAA,EACF;AAEA,SAAO,EAAE,OAAO;AAClB;AAGA,SAAS,gBAAgB,IAA4B,QAAyB;AAC5E,SAAO,KAAK,UAAU,EAAE,SAAS,OAAO,IAAI,OAAO,CAAC;AACtD;AAEA,SAAS,aAAa,IAA4B,MAAc,SAAyB;AACvF,SAAO,KAAK,UAAU,EAAE,SAAS,OAAO,IAAI,OAAO,EAAE,MAAM,QAAQ,EAAE,CAAC;AACxE;AAEA,eAAe,OAAsB;AACnC,QAAM,EAAE,OAAO,IAAI,UAAU;AAC7B,QAAM,KAAK,oBAAoB,MAAM;AAGrC,MAAI;AACF,UAAM,aAAa,eAAe;AAClC,OAAG,WAAW,UAAU;AAAA,EAC1B,SAAS,OAAO;AAEd,QAAI,EAAE,iBAAiB,SAAS,MAAM,QAAQ,SAAS,gBAAgB,IAAI;AACzE,cAAQ,MAAM,6BAA6B,KAAK;AAAA,IAClD;AAAA,EACF;AAGA,UAAQ,MAAM,mCAAmC;AACjD,UAAQ,MAAM,aAAa,UAAU,iBAAiB,CAAC,EAAE;AAEzD,QAAM,KAAK,gBAAgB;AAAA,IACzB,OAAO,QAAQ;AAAA,IACf,QAAQ,QAAQ;AAAA,IAChB,UAAU;AAAA,EACZ,CAAC;AAED,KAAG,GAAG,QAAQ,OAAO,SAAS;AAC5B,QAAI,CAAC,KAAK,KAAK,EAAG;AAElB,QAAI;AACF,YAAM,UAAU,KAAK,MAAM,IAAI;AAC/B,YAAM,EAAE,IAAI,QAAQ,OAAO,IAAI;AAG/B,cAAQ,QAAQ;AAAA,QACd,KAAK,cAAc;AACjB,gBAAM,WAAW,gBAAgB,IAAI;AAAA,YACnC,iBAAiB;AAAA,YACjB,cAAc;AAAA,cACZ,OAAO,CAAC;AAAA,YACV;AAAA,YACA,YAAY;AAAA,cACV,MAAM;AAAA,cACN,SAAS;AAAA,YACX;AAAA,YACA,cAAc;AAAA,UAChB,CAAC;AACD,kBAAQ,IAAI,QAAQ;AACpB;AAAA,QACF;AAAA,QAEA,KAAK,6BAA6B;AAEhC;AAAA,QACF;AAAA,QAEA,KAAK,cAAc;AACjB,gBAAM,QAAQ,YAAY;AAC1B,gBAAM,WAAW,gBAAgB,IAAI,EAAE,MAAM,CAAC;AAC9C,kBAAQ,IAAI,QAAQ;AACpB;AAAA,QACF;AAAA,QAEA,KAAK,cAAc;AACjB,gBAAM,SAAS,MAAM;AAAA,YACnB;AAAA,YACA,OAAO;AAAA,YACP,OAAO,aAAa,CAAC;AAAA,UACvB;AACA,gBAAM,WAAW,gBAAgB,IAAI,MAAM;AAC3C,kBAAQ,IAAI,QAAQ;AACpB;AAAA,QACF;AAAA,QAEA,SAAS;AACP,gBAAM,gBAAgB,aAAa,IAAI,QAAQ,qBAAqB,MAAM,EAAE;AAC5E,kBAAQ,IAAI,aAAa;AAAA,QAC3B;AAAA,MACF;AAAA,IACF,SAAS,OAAO;AACd,YAAM,eAAe,iBAAiB,QAAQ,MAAM,UAAU;AAC9D,YAAM,gBAAgB,aAAa,MAAM,QAAQ,gBAAgB,YAAY,EAAE;AAC/E,cAAQ,IAAI,aAAa;AAAA,IAC3B;AAAA,EACF,CAAC;AAED,KAAG,GAAG,SAAS,MAAM;AACnB,OAAG,MAAM;AACT,YAAQ,KAAK,CAAC;AAAA,EAChB,CAAC;AACH;AAEA,KAAK,EAAE,MAAM,CAAC,UAAU;AACtB,UAAQ,MAAM,gBAAgB,KAAK;AACnC,UAAQ,KAAK,CAAC;AAChB,CAAC;","names":[]}
+{"version":3,"sources":["../src/cli.ts"],"sourcesContent":["#!/usr/bin/env node\n// Local MCP server for session collaboration\n// Runs via stdio, stores data in ~/.claude/session-collab/collab.db\n\nimport { createInterface } from 'readline';\nimport { createLocalDatabase, getDefaultDbPath } from './db/sqlite-adapter.js';\nimport { loadMigrationsFromDir } from './db/migrations.js';\nimport { handleMcpRequest, getMcpTools } from './mcp/server.js';\nimport { VERSION, SERVER_NAME, SERVER_INSTRUCTIONS } from './constants.js';\nimport { join, dirname } from 'path';\nimport { fileURLToPath } from 'url';\n\nconst __dirname = dirname(fileURLToPath(import.meta.url));\n\n// Load migrations in filename order. Historical duplicate numeric prefixes are\n// preserved, so the full filename defines the execution order.\nfunction loadMigrations(): string[] {\n  const migrationsDir = join(__dirname, '..', 'migrations');\n  return loadMigrationsFromDir(migrationsDir);\n}\n\n// Parse command line arguments\nfunction parseArgs(): { dbPath?: string } {\n  const args = process.argv.slice(2);\n  let dbPath: string | undefined;\n\n  for (let i = 0; i < args.length; i++) {\n    if (args[i] === '--db' && args[i + 1]) {\n      dbPath = args[i + 1];\n      i++;\n    }\n  }\n\n  return { dbPath };\n}\n\n// JSON-RPC response helpers\nfunction jsonRpcResponse(id: number | string | null, result: unknown): string {\n  return JSON.stringify({ jsonrpc: '2.0', id, result });\n}\n\nfunction jsonRpcError(id: number | string | null, code: number, message: string): string {\n  return JSON.stringify({ jsonrpc: '2.0', id, error: { code, message } });\n}\n\nasync function main(): Promise<void> {\n  const { dbPath } = parseArgs();\n  const db = createLocalDatabase(dbPath);\n\n  // Initialize schema\n  try {\n    const migrations = loadMigrations();\n    db.initSchema(migrations);\n  } catch (error) {\n    // Schema might already exist, that's fine\n    if (!(error instanceof Error && error.message.includes('already exists'))) {\n      console.error('Warning: Migration error:', error);\n    }\n  }\n\n  // Log startup to stderr (stdout is for JSON-RPC)\n  console.error(`Session Collab MCP Server (local)`);\n  console.error(`Database: ${dbPath ?? getDefaultDbPath()}`);\n\n  const rl = createInterface({\n    input: process.stdin,\n    output: process.stdout,\n    terminal: false,\n  });\n\n  rl.on('line', async (line) => {\n    if (!line.trim()) return;\n\n    try {\n      const request = JSON.parse(line);\n      const { id, method, params } = request;\n\n      // Handle MCP protocol methods\n      switch (method) {\n        case 'initialize': {\n          const response = jsonRpcResponse(id, {\n            protocolVersion: '2024-11-05',\n            capabilities: {\n              tools: {},\n            },\n            serverInfo: {\n              name: SERVER_NAME,\n              version: VERSION,\n            },\n            instructions: SERVER_INSTRUCTIONS,\n          });\n          console.log(response);\n          break;\n        }\n\n        case 'notifications/initialized': {\n          // No response needed for notifications\n          break;\n        }\n\n        case 'tools/list': {\n          const tools = getMcpTools();\n          const response = jsonRpcResponse(id, { tools });\n          console.log(response);\n          break;\n        }\n\n        case 'tools/call': {\n          const result = await handleMcpRequest(\n            db,\n            params.name,\n            params.arguments ?? {}\n          );\n          const response = jsonRpcResponse(id, result);\n          console.log(response);\n          break;\n        }\n\n        default: {\n          const errorResponse = jsonRpcError(id, -32601, `Method not found: ${method}`);\n          console.log(errorResponse);\n        }\n      }\n    } catch (error) {\n      const errorMessage = error instanceof Error ? error.message : 'Unknown error';\n      const errorResponse = jsonRpcError(null, -32700, `Parse error: ${errorMessage}`);\n      console.log(errorResponse);\n    }\n  });\n\n  rl.on('close', () => {\n    db.close();\n    process.exit(0);\n  });\n}\n\nmain().catch((error) => {\n  console.error('Fatal error:', error);\n  process.exit(1);\n});\n"],"mappings":";;;;;;;;;;;;;AAIA,SAAS,uBAAuB;AAKhC,SAAS,MAAM,eAAe;AAC9B,SAAS,qBAAqB;AAE9B,IAAM,YAAY,QAAQ,cAAc,YAAY,GAAG,CAAC;AAIxD,SAAS,iBAA2B;AAClC,QAAM,gBAAgB,KAAK,WAAW,MAAM,YAAY;AACxD,SAAO,sBAAsB,aAAa;AAC5C;AAGA,SAAS,YAAiC;AACxC,QAAM,OAAO,QAAQ,KAAK,MAAM,CAAC;AACjC,MAAI;AAEJ,WAAS,IAAI,GAAG,IAAI,KAAK,QAAQ,KAAK;AACpC,QAAI,KAAK,CAAC,MAAM,UAAU,KAAK,IAAI,CAAC,GAAG;AACrC,eAAS,KAAK,IAAI,CAAC;AACnB;AAAA,IACF;AAAA,EACF;AAEA,SAAO,EAAE,OAAO;AAClB;AAGA,SAAS,gBAAgB,IAA4B,QAAyB;AAC5E,SAAO,KAAK,UAAU,EAAE,SAAS,OAAO,IAAI,OAAO,CAAC;AACtD;AAEA,SAAS,aAAa,IAA4B,MAAc,SAAyB;AACvF,SAAO,KAAK,UAAU,EAAE,SAAS,OAAO,IAAI,OAAO,EAAE,MAAM,QAAQ,EAAE,CAAC;AACxE;AAEA,eAAe,OAAsB;AACnC,QAAM,EAAE,OAAO,IAAI,UAAU;AAC7B,QAAM,KAAK,oBAAoB,MAAM;AAGrC,MAAI;AACF,UAAM,aAAa,eAAe;AAClC,OAAG,WAAW,UAAU;AAAA,EAC1B,SAAS,OAAO;AAEd,QAAI,EAAE,iBAAiB,SAAS,MAAM,QAAQ,SAAS,gBAAgB,IAAI;AACzE,cAAQ,MAAM,6BAA6B,KAAK;AAAA,IAClD;AAAA,EACF;AAGA,UAAQ,MAAM,mCAAmC;AACjD,UAAQ,MAAM,aAAa,UAAU,iBAAiB,CAAC,EAAE;AAEzD,QAAM,KAAK,gBAAgB;AAAA,IACzB,OAAO,QAAQ;AAAA,IACf,QAAQ,QAAQ;AAAA,IAChB,UAAU;AAAA,EACZ,CAAC;AAED,KAAG,GAAG,QAAQ,OAAO,SAAS;AAC5B,QAAI,CAAC,KAAK,KAAK,EAAG;AAElB,QAAI;AACF,YAAM,UAAU,KAAK,MAAM,IAAI;AAC/B,YAAM,EAAE,IAAI,QAAQ,OAAO,IAAI;AAG/B,cAAQ,QAAQ;AAAA,QACd,KAAK,cAAc;AACjB,gBAAM,WAAW,gBAAgB,IAAI;AAAA,YACnC,iBAAiB;AAAA,YACjB,cAAc;AAAA,cACZ,OAAO,CAAC;AAAA,YACV;AAAA,YACA,YAAY;AAAA,cACV,MAAM;AAAA,cACN,SAAS;AAAA,YACX;AAAA,YACA,cAAc;AAAA,UAChB,CAAC;AACD,kBAAQ,IAAI,QAAQ;AACpB;AAAA,QACF;AAAA,QAEA,KAAK,6BAA6B;AAEhC;AAAA,QACF;AAAA,QAEA,KAAK,cAAc;AACjB,gBAAM,QAAQ,YAAY;AAC1B,gBAAM,WAAW,gBAAgB,IAAI,EAAE,MAAM,CAAC;AAC9C,kBAAQ,IAAI,QAAQ;AACpB;AAAA,QACF;AAAA,QAEA,KAAK,cAAc;AACjB,gBAAM,SAAS,MAAM;AAAA,YACnB;AAAA,YACA,OAAO;AAAA,YACP,OAAO,aAAa,CAAC;AAAA,UACvB;AACA,gBAAM,WAAW,gBAAgB,IAAI,MAAM;AAC3C,kBAAQ,IAAI,QAAQ;AACpB;AAAA,QACF;AAAA,QAEA,SAAS;AACP,gBAAM,gBAAgB,aAAa,IAAI,QAAQ,qBAAqB,MAAM,EAAE;AAC5E,kBAAQ,IAAI,aAAa;AAAA,QAC3B;AAAA,MACF;AAAA,IACF,SAAS,OAAO;AACd,YAAM,eAAe,iBAAiB,QAAQ,MAAM,UAAU;AAC9D,YAAM,gBAAgB,aAAa,MAAM,QAAQ,gBAAgB,YAAY,EAAE;AAC/E,cAAQ,IAAI,aAAa;AAAA,IAC3B;AAAA,EACF,CAAC;AAED,KAAG,GAAG,SAAS,MAAM;AACnB,OAAG,MAAM;AACT,YAAQ,KAAK,CAAC;AAAA,EAChB,CAAC;AACH;AAEA,KAAK,EAAE,MAAM,CAAC,UAAU;AACtB,UAAQ,MAAM,gBAAgB,KAAK;AACnC,UAAQ,KAAK,CAAC;AAChB,CAAC;","names":[]}

package/dist/http/cli.js

@@ -1,62 +1,161 @@
 #!/usr/bin/env node
 import {
+  JsonRpcRequestSchema,
+  McpServer,
   createLocalDatabase,
+  generateId,
   getDefaultDbPath,
   getMcpTools,
-  handleMcpRequest
-} from "../chunk-V4APNPXF.js";
+  handleMcpRequest,
+  loadMigrationsFromDir
+} from "../chunk-SOUW3JSS.js";
 
 // src/http/cli.ts
-import { readFileSync } from "fs";
 import { join, dirname } from "path";
 import { fileURLToPath } from "url";
 
 // src/http/server.ts
 import http from "http";
 import { URL } from "url";
-function sendJson(res, status, body) {
+var HttpRequestError = class extends Error {
+  constructor(status, code, message) {
+    super(message);
+    this.status = status;
+    this.code = code;
+    this.name = "HttpRequestError";
+  }
+};
+function normalizeHost(host) {
+  return host.trim().toLowerCase();
+}
+function normalizeHostHeader(rawHost) {
+  if (!rawHost) return null;
+  const first = rawHost.split(",")[0]?.trim();
+  if (!first) return null;
+  if (first.startsWith("[")) {
+    const closingIndex = first.indexOf("]");
+    if (closingIndex !== -1) {
+      return normalizeHost(first.slice(1, closingIndex));
+    }
+  }
+  const withoutPort = first.includes(":") ? first.split(":")[0] : first;
+  return normalizeHost(withoutPort);
+}
+function isLocalBindHost(host) {
+  const normalized = normalizeHost(host);
+  return normalized === "127.0.0.1" || normalized === "localhost" || normalized === "::1";
+}
+function buildAllowedHosts(host, configuredHosts = []) {
+  const allowedHosts = new Set(configuredHosts.map(normalizeHost).filter(Boolean));
+  if (isLocalBindHost(host)) {
+    allowedHosts.add("localhost");
+    allowedHosts.add("127.0.0.1");
+    allowedHosts.add("::1");
+  } else if (host !== "0.0.0.0" && host !== "::") {
+    allowedHosts.add(normalizeHost(host));
+  }
+  return allowedHosts;
+}
+function getTraceId(req) {
+  const requestId = req.headers["x-request-id"];
+  if (typeof requestId === "string" && requestId.trim()) {
+    return requestId.trim();
+  }
+  return generateId();
+}
+function sendJson(res, status, body, traceId, contentType = "application/json") {
   const payload = JSON.stringify(body);
   res.writeHead(status, {
-    "Content-Type": "application/json",
-    "Content-Length": Buffer.byteLength(payload)
+    "Content-Type": contentType,
+    "Content-Length": Buffer.byteLength(payload),
+    "X-Request-ID": traceId
   });
   res.end(payload);
 }
-function parseBody(req) {
-  return new Promise((resolve, reject) => {
+function sendHttpError(res, status, code, message, traceId) {
+  sendJson(res, status, { ok: false, error: code, code, message, trace_id: traceId }, traceId);
+}
+function sendJsonRpcResponse(res, status, response, traceId) {
+  sendJson(res, status, response, traceId);
+}
+function sendJsonRpcError(res, status, id, code, message, traceId) {
+  sendJson(
+    res,
+    status,
+    {
+      jsonrpc: "2.0",
+      id,
+      error: {
+        code,
+        message,
+        data: { trace_id: traceId }
+      }
+    },
+    traceId
+  );
+}
+async function readJsonBody(req) {
+  return await new Promise((resolve, reject) => {
     let data = "";
+    let settled = false;
+    const rejectOnce = (error) => {
+      if (settled) return;
+      settled = true;
+      reject(error);
+    };
+    const resolveOnce = (value) => {
+      if (settled) return;
+      settled = true;
+      resolve(value);
+    };
     req.on("data", (chunk) => {
+      if (settled) return;
       data += chunk;
       if (data.length > 1e6) {
-        reject(new Error("Payload too large"));
+        rejectOnce(new HttpRequestError(413, "PAYLOAD_TOO_LARGE", "Payload too large"));
+        req.pause();
       }
     });
     req.on("end", () => {
+      if (settled) return;
       if (!data) {
-        resolve(void 0);
+        resolveOnce(void 0);
         return;
       }
       try {
-        resolve(JSON.parse(data));
-      } catch (error) {
-        reject(error);
+        resolveOnce(JSON.parse(data));
+      } catch {
+        rejectOnce(new HttpRequestError(400, "INVALID_JSON", "Request body must be valid JSON"));
       }
     });
+    req.on("error", (error) => rejectOnce(error instanceof Error ? error : new Error(String(error))));
   });
 }
-function normalizeToolResult(result) {
+function normalizeToolResult(result, traceId) {
   const text = result.content?.[0]?.text ?? "";
   try {
     const data = JSON.parse(text);
     if (result.isError) {
       const errorCode = data && typeof data === "object" && "error" in data ? String(data.error ?? "UNKNOWN") : "UNKNOWN";
       const message = data && typeof data === "object" && "message" in data ? String(data.message ?? "Error") : "Error";
-      return { ok: false, error: { code: errorCode, message } };
+      return {
+        ok: false,
+        error: errorCode,
+        code: errorCode,
+        message,
+        trace_id: traceId
+      };
     }
     return { ok: true, data };
   } catch {
     if (result.isError) {
-      return { ok: false, error: { code: "UNKNOWN", message: text || "Error" } };
+      return {
+        ok: false,
+        error: "UNKNOWN",
+        code: "UNKNOWN",
+        message: text || "Error",
+        trace_id: traceId
+      };
     }
     return { ok: true, data: text };
   }
@@ -77,132 +176,209 @@ function parseQueryParams(url) {
   }
   return params;
 }
-async function handleTool(db, name, args) {
+function enforceHttpSecurity(req, options) {
+  const allowedHosts = buildAllowedHosts(options.host, options.allowedHosts);
+  const hostHeader = normalizeHostHeader(req.headers.host);
+  if (allowedHosts.size > 0) {
+    if (!hostHeader || !allowedHosts.has(hostHeader)) {
+      throw new HttpRequestError(403, "INVALID_HOST", "Host header is not allowed");
+    }
+    const originHeader = req.headers.origin;
+    if (originHeader) {
+      let origin;
+      try {
+        origin = new URL(originHeader);
+      } catch {
+        throw new HttpRequestError(403, "INVALID_ORIGIN", "Origin header is invalid");
+      }
+      if (!allowedHosts.has(normalizeHost(origin.hostname))) {
+        throw new HttpRequestError(403, "INVALID_ORIGIN", "Origin header is not allowed");
+      }
+    }
+  }
+  if (options.apiToken) {
+    const authHeader = req.headers.authorization;
+    const expected = `Bearer ${options.apiToken}`;
+    if (authHeader !== expected) {
+      throw new HttpRequestError(401, "UNAUTHORIZED", "Valid bearer token is required");
+    }
+  }
+}
+async function handleRestTool(db, name, args, traceId) {
   const result = await handleMcpRequest(db, name, args);
-  return normalizeToolResult(result);
+  return normalizeToolResult(result, traceId);
 }
-function createHttpServer(db) {
+function createHttpServer(db, options = {}) {
+  const host = options.host ?? "127.0.0.1";
+  const mcpServer = new McpServer(db);
   return http.createServer(async (req, res) => {
+    const traceId = getTraceId(req);
     try {
       const method = req.method ?? "GET";
       const url = new URL(req.url ?? "/", "http://localhost");
       if (method === "GET" && url.pathname === "/health") {
-        sendJson(res, 200, { ok: true, data: { status: "ok" } });
+        sendJson(res, 200, { ok: true, data: { status: "ok" } }, traceId);
         return;
       }
+      enforceHttpSecurity(req, {
+        host,
+        allowedHosts: options.allowedHosts,
+        apiToken: options.apiToken
+      });
       if (method === "GET" && url.pathname === "/v1/tools") {
-        sendJson(res, 200, { ok: true, data: { tools: getMcpTools() } });
+        sendJson(res, 200, { ok: true, data: { tools: getMcpTools() } }, traceId);
         return;
       }
       if (method === "POST" && url.pathname === "/v1/tools/call") {
-        const body = await parseBody(req);
+        const body = await readJsonBody(req);
         if (!body?.name) {
-          sendJson(res, 400, { ok: false, error: { code: "INVALID_INPUT", message: "name is required" } });
+          sendHttpError(res, 400, "INVALID_INPUT", "name is required", traceId);
+          return;
+        }
+        const response = await handleRestTool(db, body.name, body.args ?? {}, traceId);
+        sendJson(res, response.ok ? 200 : 400, response, traceId);
+        return;
+      }
+      if (method === "POST" && url.pathname === "/mcp") {
+        const body = await readJsonBody(req);
+        const validation = JsonRpcRequestSchema.safeParse(body);
+        if (!validation.success) {
+          sendJsonRpcError(res, 400, null, -32600, "Invalid Request", traceId);
           return;
         }
-        const response = await handleTool(db, body.name, body.args ?? {});
-        sendJson(res, response.ok ? 200 : 400, response);
+        const response = await mcpServer.handleRequest(validation.data);
+        sendJsonRpcResponse(res, 200, response, traceId);
+        return;
+      }
+      if (method === "GET" && url.pathname === "/mcp") {
+        sendHttpError(
+          res,
+          501,
+          "STREAM_NOT_SUPPORTED",
+          "This server exposes MCP JSON-RPC over HTTP POST at /mcp. SSE streaming is not implemented.",
+          traceId
+        );
         return;
       }
       if (method === "POST" && url.pathname === "/v1/sessions/start") {
-        const body = await parseBody(req);
-        const response = await handleTool(db, "collab_session_start", body ?? {});
-        sendJson(res, response.ok ? 200 : 400, response);
+        const body = await readJsonBody(req);
+        const response = await handleRestTool(db, "collab_session_start", body ?? {}, traceId);
+        sendJson(res, response.ok ? 200 : 400, response, traceId);
         return;
       }
       if (method === "POST" && url.pathname === "/v1/sessions/end") {
-        const body = await parseBody(req);
-        const response = await handleTool(db, "collab_session_end", body ?? {});
-        sendJson(res, response.ok ? 200 : 400, response);
+        const body = await readJsonBody(req);
+        const response = await handleRestTool(db, "collab_session_end", body ?? {}, traceId);
+        sendJson(res, response.ok ? 200 : 400, response, traceId);
         return;
       }
       if (method === "GET" && url.pathname === "/v1/sessions") {
-        const args = parseQueryParams(url);
-        const response = await handleTool(db, "collab_session_list", args);
-        sendJson(res, response.ok ? 200 : 400, response);
+        const response = await handleRestTool(db, "collab_session_list", parseQueryParams(url), traceId);
+        sendJson(res, response.ok ? 200 : 400, response, traceId);
         return;
       }
       if (method === "POST" && url.pathname === "/v1/config") {
-        const body = await parseBody(req);
-        const response = await handleTool(db, "collab_config", body ?? {});
-        sendJson(res, response.ok ? 200 : 400, response);
+        const body = await readJsonBody(req);
+        const response = await handleRestTool(db, "collab_config", body ?? {}, traceId);
+        sendJson(res, response.ok ? 200 : 400, response, traceId);
         return;
       }
       if (method === "GET" && url.pathname === "/v1/status") {
-        const args = parseQueryParams(url);
-        const response = await handleTool(db, "collab_status", args);
-        sendJson(res, response.ok ? 200 : 400, response);
+        const response = await handleRestTool(db, "collab_status", parseQueryParams(url), traceId);
+        sendJson(res, response.ok ? 200 : 400, response, traceId);
         return;
       }
       if (method === "POST" && url.pathname === "/v1/claims") {
-        const body = await parseBody(req);
-        const response = await handleTool(db, "collab_claim", { action: "create", ...body ?? {} });
-        sendJson(res, response.ok ? 200 : 400, response);
+        const body = await readJsonBody(req);
+        const response = await handleRestTool(db, "collab_claim", { action: "create", ...body ?? {} }, traceId);
+        sendJson(res, response.ok ? 200 : 400, response, traceId);
         return;
       }
       if (method === "POST" && url.pathname === "/v1/claims/check") {
-        const body = await parseBody(req);
-        const response = await handleTool(db, "collab_claim", { action: "check", ...body ?? {} });
-        sendJson(res, response.ok ? 200 : 400, response);
+        const body = await readJsonBody(req);
+        const response = await handleRestTool(db, "collab_claim", { action: "check", ...body ?? {} }, traceId);
+        sendJson(res, response.ok ? 200 : 400, response, traceId);
         return;
       }
       if (method === "POST" && url.pathname === "/v1/claims/release") {
-        const body = await parseBody(req);
-        const response = await handleTool(db, "collab_claim", { action: "release", ...body ?? {} });
-        sendJson(res, response.ok ? 200 : 400, response);
+        const body = await readJsonBody(req);
+        const response = await handleRestTool(db, "collab_claim", { action: "release", ...body ?? {} }, traceId);
+        sendJson(res, response.ok ? 200 : 400, response, traceId);
         return;
       }
       if (method === "GET" && url.pathname === "/v1/claims") {
-        const args = parseQueryParams(url);
-        const response = await handleTool(db, "collab_claim", { action: "list", ...args });
-        sendJson(res, response.ok ? 200 : 400, response);
+        const response = await handleRestTool(
+          db,
+          "collab_claim",
+          { action: "list", ...parseQueryParams(url) },
+          traceId
+        );
+        sendJson(res, response.ok ? 200 : 400, response, traceId);
         return;
       }
       if (method === "POST" && url.pathname === "/v1/memory/save") {
-        const body = await parseBody(req);
-        const response = await handleTool(db, "collab_memory_save", body ?? {});
-        sendJson(res, response.ok ? 200 : 400, response);
+        const body = await readJsonBody(req);
+        const response = await handleRestTool(db, "collab_memory_save", body ?? {}, traceId);
+        sendJson(res, response.ok ? 200 : 400, response, traceId);
         return;
       }
       if (method === "POST" && url.pathname === "/v1/memory/recall") {
-        const body = await parseBody(req);
-        const response = await handleTool(db, "collab_memory_recall", body ?? {});
-        sendJson(res, response.ok ? 200 : 400, response);
+        const body = await readJsonBody(req);
+        const response = await handleRestTool(db, "collab_memory_recall", body ?? {}, traceId);
+        sendJson(res, response.ok ? 200 : 400, response, traceId);
         return;
       }
       if (method === "POST" && url.pathname === "/v1/memory/clear") {
-        const body = await parseBody(req);
-        const response = await handleTool(db, "collab_memory_clear", body ?? {});
-        sendJson(res, response.ok ? 200 : 400, response);
+        const body = await readJsonBody(req);
+        const response = await handleRestTool(db, "collab_memory_clear", body ?? {}, traceId);
+        sendJson(res, response.ok ? 200 : 400, response, traceId);
         return;
       }
       if (method === "POST" && url.pathname === "/v1/protect/register") {
-        const body = await parseBody(req);
-        const response = await handleTool(db, "collab_protect", { action: "register", ...body ?? {} });
-        sendJson(res, response.ok ? 200 : 400, response);
+        const body = await readJsonBody(req);
+        const response = await handleRestTool(db, "collab_protect", { action: "register", ...body ?? {} }, traceId);
+        sendJson(res, response.ok ? 200 : 400, response, traceId);
         return;
       }
       if (method === "POST" && url.pathname === "/v1/protect/check") {
-        const body = await parseBody(req);
-        const response = await handleTool(db, "collab_protect", { action: "check", ...body ?? {} });
-        sendJson(res, response.ok ? 200 : 400, response);
+        const body = await readJsonBody(req);
+        const response = await handleRestTool(db, "collab_protect", { action: "check", ...body ?? {} }, traceId);
+        sendJson(res, response.ok ? 200 : 400, response, traceId);
         return;
       }
       if (method === "GET" && url.pathname === "/v1/protect/list") {
-        const args = parseQueryParams(url);
-        const response = await handleTool(db, "collab_protect", { action: "list", ...args });
-        sendJson(res, response.ok ? 200 : 400, response);
+        const response = await handleRestTool(
+          db,
+          "collab_protect",
+          { action: "list", ...parseQueryParams(url) },
+          traceId
+        );
+        sendJson(res, response.ok ? 200 : 400, response, traceId);
         return;
       }
-      sendJson(res, 404, { ok: false, error: { code: "NOT_FOUND", message: "Not found" } });
+      sendHttpError(res, 404, "NOT_FOUND", "Not found", traceId);
     } catch (error) {
+      if (error instanceof HttpRequestError) {
+        sendHttpError(res, error.status, error.code, error.message, traceId);
+        return;
+      }
       const message = error instanceof Error ? error.message : "Unexpected error";
-      sendJson(res, 500, { ok: false, error: { code: "INTERNAL_ERROR", message } });
+      sendHttpError(res, 500, "INTERNAL_ERROR", message, traceId);
     }
   });
 }
 async function startHttpServer(db, options) {
-  const server = createHttpServer(db);
+  const normalizedHost = normalizeHost(options.host);
+  if (!isLocalBindHost(normalizedHost)) {
+    if (!options.apiToken) {
+      throw new Error("Non-local HTTP binds require SESSION_COLLAB_HTTP_TOKEN");
+    }
+    const allowedHosts = buildAllowedHosts(normalizedHost, options.allowedHosts);
+    if (allowedHosts.size === 0) {
+      throw new Error("Non-local HTTP binds require at least one allowed host");
+    }
+  }
+  const server = createHttpServer(db, options);
   await new Promise((resolve, reject) => {
     server.listen(options.port, options.host, () => resolve());
     server.on("error", reject);
@@ -214,20 +390,14 @@ async function startHttpServer(db, options) {
 var __dirname2 = dirname(fileURLToPath(import.meta.url));
 function loadMigrations() {
   const migrationsDir = join(__dirname2, "..", "..", "migrations");
-  return [
-    readFileSync(join(migrationsDir, "0001_init.sql"), "utf-8"),
-    readFileSync(join(migrationsDir, "0002_auth.sql"), "utf-8"),
-    readFileSync(join(migrationsDir, "0003_config.sql"), "utf-8"),
-    readFileSync(join(migrationsDir, "0004_symbols.sql"), "utf-8"),
-    readFileSync(join(migrationsDir, "0005_references.sql"), "utf-8"),
-    readFileSync(join(migrationsDir, "0006_composite_indexes.sql"), "utf-8")
-  ];
+  return loadMigrationsFromDir(migrationsDir);
 }
 function parseArgs() {
   const args = process.argv.slice(2);
   let dbPath;
   let host = "127.0.0.1";
   let port = 8765;
+  const allowedHosts = [];
   for (let i = 0; i < args.length; i++) {
     const value = args[i + 1];
     if (args[i] === "--db" && value) {
@@ -239,13 +409,18 @@ function parseArgs() {
     } else if (args[i] === "--port" && value) {
       port = Number(value);
       i++;
+    } else if (args[i] === "--allowed-host" && value) {
+      allowedHosts.push(value);
+      i++;
     }
   }
-  return { dbPath, host, port };
+  return { dbPath, host, port, allowedHosts };
 }
 async function main() {
-  const { dbPath, host, port } = parseArgs();
+  const { dbPath, host, port, allowedHosts } = parseArgs();
   const db = createLocalDatabase(dbPath);
+  const apiToken = process.env.SESSION_COLLAB_HTTP_TOKEN;
+  const envAllowedHosts = (process.env.SESSION_COLLAB_ALLOWED_HOSTS ?? "").split(",").map((hostEntry) => hostEntry.trim()).filter(Boolean);
   try {
     const migrations = loadMigrations();
     db.initSchema(migrations);
@@ -254,9 +429,16 @@ async function main() {
       console.error("Warning: Migration error:", error);
     }
   }
-  await startHttpServer(db, { host, port });
+  await startHttpServer(db, {
+    host,
+    port,
+    apiToken,
+    allowedHosts: [...envAllowedHosts, ...allowedHosts]
+  });
   console.error(`Session Collab HTTP Server running at http://${host}:${port}`);
   console.error(`Database: ${dbPath ?? getDefaultDbPath()}`);
+  console.error(`MCP endpoint: POST /mcp`);
+  console.error(`Convenience REST API: /v1/*`);
 }
 main().catch((error) => {
   console.error("Fatal error:", error);