wazap-mcp 0.9.2 → 0.9.3

package/README.md

@@ -186,14 +186,32 @@ created `0700` with credentials written `0600`:
   history/      per-chat message history, so a restart is not amnesia
   store.json    chat-list snapshot
   server.lock   pid of the running server
+  daemon.json   loopback endpoint a second wazap bridges to
   .env          optional settings, see .env.example
 ```
 
 Credential writes go to a temp file and are renamed into place, so killing the
 process mid-write cannot leave you re-linking your phone.
 
-One server per data directory: a second `wazap serve` on the same directory
-exits with code 2 and tells you the pid of the one already running.
+## Several clients at once
+
+Claude Desktop, Claude Code and Cursor each launch their own `wazap`. WhatsApp
+allows one socket per linked device, so they share one session instead of
+fighting over it. The first `wazap` on a data directory owns the session and
+opens an MCP endpoint on `127.0.0.1`; every later one bridges to it over that
+endpoint. There is nothing to configure, and no client can tell the difference.
+The owner publishes `<data-dir>/daemon.json` (`0600`) with its pid, its port
+and the token a bridge authenticates with.
+
+A bridge serves whatever the owner exposes, so an owner started `--read-only`
+makes every client read-only, whatever flags that client was launched with.
+
+When the owner exits, the bridges exit with it, and the next `wazap` a client
+starts becomes the new owner.
+
+`WAZAP_NO_SHARE=1` opts out: a second `wazap` on the same directory exits with
+code 2 naming the pid of the one already running. An explicit `--http` is a
+server of its own rather than a bridge, and is refused the same way.
 
 ## Read-only mode
 

package/dist/bridge.js

@@ -0,0 +1,64 @@
+import { Client } from "@modelcontextprotocol/sdk/client/index.js";
+import { StreamableHTTPClientTransport } from "@modelcontextprotocol/sdk/client/streamableHttp.js";
+import { Server } from "@modelcontextprotocol/sdk/server/index.js";
+import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
+import { CallToolRequestSchema, CallToolResultSchema, ListToolsRequestSchema, ListToolsResultSchema, } from "@modelcontextprotocol/sdk/types.js";
+import { WAZAP_VERSION } from "./config.js";
+import { readDaemon } from "./daemon.js";
+import { log } from "./logger.js";
+const HEARTBEAT_MS = 1_000;
+/**
+ * Serve this client from the session another process already owns: an MCP server
+ * on our stdio, every tool call forwarded to the daemon's loopback endpoint and
+ * its answer returned untouched.
+ *
+ * `daemonFile` is here because the heartbeat re-reads the sidecar, and DaemonInfo
+ * carries no path.
+ */
+export async function runBridge(daemon, daemonFile) {
+    let left = false;
+    /** Exit 1 so the client restarts us, and the restart becomes the new daemon. */
+    const leave = (reason) => {
+        if (left)
+            return;
+        left = true;
+        log(`${reason}, exiting so the next start can own the session`);
+        process.exit(1);
+    };
+    const client = new Client({ name: "wazap-bridge", version: WAZAP_VERSION });
+    await client.connect(new StreamableHTTPClientTransport(new URL(`http://127.0.0.1:${daemon.port}/mcp`), {
+        requestInit: { headers: { Authorization: `Bearer ${daemon.token}` } },
+    }));
+    const caps = client.getServerCapabilities() ?? {};
+    const server = new Server(client.getServerVersion() ?? { name: "wazap", version: daemon.version }, {
+        // Only what we forward: the daemon has no resources or prompts, and we have
+        // no handler for them.
+        capabilities: { tools: caps.tools ?? {} },
+        instructions: client.getInstructions(),
+    });
+    server.setRequestHandler(ListToolsRequestSchema, (req) => client.request({ method: "tools/list", params: req.params }, ListToolsResultSchema));
+    server.setRequestHandler(CallToolRequestSchema, (req) => client.request({ method: "tools/call", params: req.params }, CallToolResultSchema));
+    client.onclose = () => leave(`the session holder (pid ${daemon.pid}) closed the connection`);
+    client.onerror = () => leave(`lost the connection to the session holder (pid ${daemon.pid})`);
+    // A dead daemon does not close the client: the transport retries its stream and
+    // reports nothing, measured. So the liveness of the pid is ours to watch.
+    const heartbeat = setInterval(() => {
+        if (readDaemon(daemonFile)?.pid !== daemon.pid) {
+            leave(`the session holder (pid ${daemon.pid}) gave up the session`);
+            return;
+        }
+        try {
+            process.kill(daemon.pid, 0);
+        }
+        catch {
+            leave(`the session holder (pid ${daemon.pid}) is gone`);
+        }
+    }, HEARTBEAT_MS);
+    heartbeat.unref();
+    await server.connect(new StdioServerTransport());
+    log(`sharing the WhatsApp session held by pid ${daemon.pid}`);
+    // Our own client leaving is not a failure. The upstream stream holds the event
+    // loop open, so without this the bridge outlives the client it was started for.
+    process.stdin.on("end", () => process.exit(0));
+    process.stdin.on("close", () => process.exit(0));
+}

package/dist/cli.js

@@ -1,3 +1,4 @@
+import { randomBytes } from "node:crypto";
 import { mkdirSync, rmSync } from "node:fs";
 import { createInterface } from "node:readline/promises";
 import { setTimeout as sleep } from "node:timers/promises";
@@ -6,15 +7,18 @@ import qrcode from "qrcode";
 import qrcodeTerminal from "qrcode-terminal";
 import { clearAuth, readLinkedAccount, useAtomicAuthState } from "./auth-state.js";
 import { banner } from "./banner.js";
+import { runBridge } from "./bridge.js";
 import { BAILEYS_VERSION, WAZAP_VERSION, paths } from "./config.js";
 import { connectNext } from "./connect.js";
+import { decideRole, readDaemon, removeDaemon, writeDaemon } from "./daemon.js";
 import { checkLine, checkLines, runChecks } from "./doctor.js";
 import { RELINK_FIX, WazapError, asWazapError } from "./errors.js";
 import { normalizePhone } from "./ids.js";
 import { lockHolder, releaseLock, writeLock } from "./lock.js";
 import { log, logError, say } from "./logger.js";
 import { formatAge } from "./messages.js";
-import { runHttp, runStdio } from "./server.js";
+import { RateLimiter } from "./ratelimit.js";
+import { runHttp, runStdio, startLoopbackEndpoint } from "./server.js";
 import { applyWrites } from "./settings.js";
 import { bold, box, brand, humanLayout, dim, fail, info, maskNumber, next, ok, shortPath, spinner, step, tilde, warn, } from "./ui.js";
 import { WA_BROWSER, WhatsAppService } from "./whatsapp.js";
@@ -30,6 +34,8 @@ const SETTLED_STATUSES = [
 ];
 const LOGOUT_TIMEOUT_MS = 10_000;
 const LOOPBACK_HOSTS = ["127.0.0.1", "::1", "localhost"];
+/** Bind addresses a loopback bridge can still reach; the wildcards include 127.0.0.1. */
+const SHAREABLE_HOSTS = [...LOOPBACK_HOSTS, "0.0.0.0", "::"];
 const SILENT_LOGGER = {
     level: "silent",
     child: () => SILENT_LOGGER,
@@ -49,6 +55,11 @@ export async function runStatus(config) {
     catch {
         unreadable = true;
     }
+    // A sidecar outliving the process that wrote it is stale, so only the lock
+    // holder's own record counts as a session being shared.
+    const serverPid = lockHolder(p.lockFile);
+    const daemon = readDaemon(p.daemonFile);
+    const sharing = daemon !== null && daemon.pid === serverPid ? { pid: daemon.pid, port: daemon.port } : null;
     const report = {
         data_dir: config.dataDir,
         linked: account !== null,
@@ -56,7 +67,8 @@ export async function runStatus(config) {
         account,
         wazap_version: WAZAP_VERSION,
         baileys_version: BAILEYS_VERSION,
-        server_pid: lockHolder(p.lockFile),
+        server_pid: serverPid,
+        daemon: sharing,
         checks: await runChecks(config),
     };
     if (config.live)
@@ -89,9 +101,16 @@ function plainStatus(report) {
     else {
         lines.push("linked: no");
     }
-    lines.push(`wazap: ${report.wazap_version}`, `baileys: ${report.baileys_version}`, report.server_pid === null ? "server: not running" : `server: running (pid ${report.server_pid})`, "", "checks:", ...report.checks.map(checkLine));
+    lines.push(`wazap: ${report.wazap_version}`, `baileys: ${report.baileys_version}`, `server: ${serverState(report)}`, "", "checks:", ...report.checks.map(checkLine));
     return lines;
 }
+/** The one place the sidecar becomes words, so the two renderers cannot drift. */
+function serverState(report) {
+    if (report.server_pid === null)
+        return "not running";
+    const shared = report.daemon === null ? "" : `, sharing on 127.0.0.1:${report.daemon.port}`;
+    return `running (pid ${report.server_pid}${shared})`;
+}
 const LABEL_WIDTH = 8;
 function row(label, value) {
     return `${dim(label.padEnd(LABEL_WIDTH))}  ${value}`;
@@ -106,7 +125,7 @@ function richStatus(report) {
         `${bold(`wazap ${report.wazap_version}`)}${dim(` · baileys ${report.baileys_version}`)}`,
         row("data dir", tilde(report.data_dir)),
         row("account", account),
-        row("server", report.server_pid === null ? "not running" : `running (pid ${report.server_pid})`),
+        row("server", serverState(report)),
         "",
         ...report.checks.flatMap(checkLines),
     ];
@@ -120,15 +139,29 @@ function liveLines(live) {
         `live: last message ${live.last_message_age ?? "unknown"}`,
     ];
 }
+/**
+ * Hold the session for a one-shot command: null once the lock is ours, otherwise
+ * the pid that owns it. The claim only fails while the file exists, so a lost
+ * race is looked up again rather than reported as a missing pid.
+ */
+function takeSessionLock(lockFile) {
+    for (let attempt = 0; attempt < 5; attempt++) {
+        const running = lockHolder(lockFile);
+        if (running !== null)
+            return running;
+        if (writeLock(lockFile))
+            return null;
+    }
+    throw new WazapError("WHATSAPP_ERROR", `Could not take the session lock in ${lockFile}.`, "Run the command again");
+}
 /** One process owns the session, so a probe only runs when no server holds the lock. */
 async function runLiveProbe(config) {
     const p = paths(config.dataDir);
-    const running = lockHolder(p.lockFile);
+    // The probe owns the session for as long as it runs, exactly like the server.
+    const running = takeSessionLock(p.lockFile);
     if (running !== null) {
-        throw new WazapError("WHATSAPP_ERROR", `A server (pid ${running}) already owns this session.`, "Ask it through your MCP client instead: call get_status");
+        throw new WazapError("WHATSAPP_ERROR", `A server (pid ${running}) already owns this session.`, "use get_status through your client, or wazap status");
     }
-    // The probe owns the session for as long as it runs, exactly like the server.
-    writeLock(p.lockFile);
     const wa = new WhatsAppService(config);
     const deadline = Date.now() + LIVE_TIMEOUT_MS;
     try {
@@ -181,22 +214,45 @@ export async function runGreet(config) {
 }
 export async function runServe(config) {
     const p = paths(config.dataDir);
-    const running = lockHolder(p.lockFile);
-    if (running !== null) {
-        say(fail(`wazap is already running (pid ${running}) using ${config.dataDir}. Stop it first or use --data-dir.`));
-        process.exit(2);
+    // Losing the atomic claim means another `serve` won it, and the next pass finds
+    // its sidecar and becomes a bridge onto it.
+    let claimed = false;
+    for (let attempt = 0; attempt < 5; attempt++) {
+        const role = await decideRole(config, p);
+        if (role.kind === "refuse") {
+            say(fail(role.message));
+            process.exit(2);
+        }
+        if (role.kind === "bridge") {
+            await runBridge(role.daemon, p.daemonFile);
+            return;
+        }
+        // Loopback with no token only gets runHttp's warning; off-loopback is refused.
+        if (config.transport === "http" && !config.readToken && !LOOPBACK_HOSTS.includes(config.httpHost)) {
+            say(fail(`Refusing to serve ${config.httpHost} without a token. Set WAZAP_READ_TOKEN, or bind 127.0.0.1.`));
+            process.exit(1);
+        }
+        mkdirSync(config.dataDir, { recursive: true, mode: 0o700 });
+        if (writeLock(p.lockFile)) {
+            claimed = true;
+            break;
+        }
     }
-    // Loopback with no token only gets runHttp's warning; off-loopback is refused.
-    if (config.transport === "http" && !config.readToken && !LOOPBACK_HOSTS.includes(config.httpHost)) {
-        say(fail(`Refusing to serve ${config.httpHost} without a token. Set WAZAP_READ_TOKEN, or bind 127.0.0.1.`));
-        process.exit(1);
+    if (!claimed) {
+        say(fail(`Another wazap keeps taking ${config.dataDir} as this one starts. Run it again.`));
+        process.exit(2);
     }
-    mkdirSync(config.dataDir, { recursive: true, mode: 0o700 });
-    writeLock(p.lockFile);
-    process.on("exit", () => releaseLock(p.lockFile));
+    process.on("exit", () => {
+        removeDaemon(p.daemonFile);
+        releaseLock(p.lockFile);
+    });
     const wa = new WhatsAppService(config);
-    const shutdown = (signal) => {
-        log(`received ${signal}, shutting down`);
+    let stopping = false;
+    const shutdown = (reason) => {
+        if (stopping)
+            return;
+        stopping = true;
+        log(`received ${reason}, shutting down`);
         // A wedged socket must not cost the user a kill -9; the lock goes on "exit".
         setTimeout(() => process.exit(0), 3_000).unref();
         void wa.stop().finally(() => process.exit(0));
@@ -206,10 +262,31 @@ export async function runServe(config) {
     // Connecting in the background: MCP startup never waits on WhatsApp, and the
     // tools answer NOT_LINKED until a session exists.
     wa.start().catch((err) => logError("whatsapp start", err));
-    if (config.transport === "http")
-        await runHttp(wa, config);
-    else
-        await runStdio(wa, config);
+    const token = config.share ? randomBytes(32).toString("hex") : null;
+    // One bucket for the process, not per endpoint: a bridge writing through the
+    // loopback endpoint spends from the same allowance as the daemon's own client.
+    const limiter = new RateLimiter(config.rateLimitPerMinute);
+    if (config.transport === "http") {
+        const port = await runHttp(wa, config, limiter, token === null ? undefined : { token, write: true });
+        // Off-loopback binds get no sidecar: a bridge on this machine could not reach them.
+        if (token !== null && SHAREABLE_HOSTS.includes(config.httpHost)) {
+            writeDaemon(p.daemonFile, { pid: process.pid, port, token, version: WAZAP_VERSION });
+        }
+        return;
+    }
+    if (token !== null) {
+        const port = await startLoopbackEndpoint(wa, config, token, limiter);
+        writeDaemon(p.daemonFile, { pid: process.pid, port, token, version: WAZAP_VERSION });
+    }
+    await runStdio(wa, config, limiter);
+    if (token === null)
+        return;
+    // The loopback endpoint keeps the event loop alive, so stdin EOF no longer ends
+    // the process on its own. When the daemon's own client goes away the daemon goes
+    // with it, rather than lingering for bridges. Registered after runStdio, so the
+    // transport is already reading and "end" fires.
+    process.stdin.on("end", () => shutdown("stdin end"));
+    process.stdin.on("close", () => shutdown("stdin close"));
 }
 export function stepper(total) {
     let n = 0;
@@ -239,13 +316,11 @@ export async function runLogin(config) {
  */
 export async function linkAndSync(config, announce = () => { }) {
     const p = paths(config.dataDir);
-    const running = lockHolder(p.lockFile);
+    const running = takeSessionLock(p.lockFile);
     if (running !== null) {
         say(fail(`wazap is running (pid ${running}). Stop it first (or quit the client that launched it), then run this again.`));
         process.exit(1);
     }
-    mkdirSync(config.dataDir, { recursive: true, mode: 0o700 });
-    writeLock(p.lockFile);
     const release = () => releaseLock(p.lockFile);
     const onInterrupt = () => {
         release();

package/dist/config.js

@@ -15,6 +15,7 @@ export function paths(dataDir) {
         historyDir: join(dataDir, "history"),
         storeFile: join(dataDir, "store.json"),
         lockFile: join(dataDir, "server.lock"),
+        daemonFile: join(dataDir, "daemon.json"),
         envFile: join(dataDir, ".env"),
         qrFile: join(dataDir, "qr.png"),
     };
@@ -119,6 +120,7 @@ export function parseCli(argv = process.argv.slice(2)) {
             httpPort: values.port ? asInt(values.port, 8766) : asInt(process.env.WAZAP_PORT, 8766),
             readToken: (process.env.WAZAP_READ_TOKEN ?? "").trim() || null,
             writeToken: (process.env.WAZAP_WRITE_TOKEN ?? "").trim() || null,
+            share: !asBool(process.env.WAZAP_NO_SHARE, false),
             rateLimitPerMinute: asInt(process.env.WAZAP_RATE_LIMIT, 20),
             sources: {
                 // Resolved before dotenv runs, so the data dir's own .env cannot name it.

package/dist/daemon.js

@@ -0,0 +1,101 @@
+import { chmodSync, mkdirSync, readFileSync, renameSync, unlinkSync, writeFileSync } from "node:fs";
+import { dirname } from "node:path";
+import { setTimeout as sleep } from "node:timers/promises";
+import { lockHolder } from "./lock.js";
+function isPositiveInt(value) {
+    return typeof value === "number" && Number.isInteger(value) && value > 0;
+}
+/** The sidecar another process left behind, or null if it is missing, corrupt or the wrong shape. */
+export function readDaemon(file) {
+    let parsed;
+    try {
+        parsed = JSON.parse(readFileSync(file, "utf8"));
+    }
+    catch {
+        return null;
+    }
+    if (typeof parsed !== "object" || parsed === null)
+        return null;
+    const { pid, port, token, version } = parsed;
+    if (!isPositiveInt(pid) || !isPositiveInt(port))
+        return null;
+    if (typeof token !== "string" || token === "")
+        return null;
+    if (typeof version !== "string" || version === "")
+        return null;
+    return { pid, port, token, version };
+}
+export function writeDaemon(file, info) {
+    mkdirSync(dirname(file), { recursive: true, mode: 0o700 });
+    // Written aside and renamed in: a bridge polling for the sidecar reads either
+    // the old record or the new one, never half a token. The mode argument only
+    // applies when a file is created, so the chmod covers a leftover temp file
+    // from an earlier run keeping looser permissions.
+    const temp = `${file}.${process.pid}.tmp`;
+    writeFileSync(temp, `${JSON.stringify(info, null, 2)}\n`, { mode: 0o600 });
+    chmodSync(temp, 0o600);
+    renameSync(temp, file);
+}
+/** Remove the sidecar, but only if it is still ours. */
+export function removeDaemon(file) {
+    try {
+        if (readDaemon(file)?.pid !== process.pid)
+            return;
+        unlinkSync(file);
+    }
+    catch {
+        /* already gone */
+    }
+}
+/** Liveness of the loopback endpoint recorded in a sidecar. Never throws. */
+export async function daemonHealthy(port, timeoutMs) {
+    const controller = new AbortController();
+    const timer = setTimeout(() => controller.abort(), timeoutMs);
+    try {
+        const res = await fetch(`http://127.0.0.1:${port}/healthz`, { signal: controller.signal });
+        if (!res.ok)
+            return false;
+        const body = await res.json();
+        return typeof body === "object" && body !== null && body.ok === true;
+    }
+    catch {
+        return false;
+    }
+    finally {
+        clearTimeout(timer);
+    }
+}
+const ROLE_TIMEOUT_MS = 3_000;
+const ROLE_POLL_MS = 100;
+/**
+ * Who we are for this data dir: the process that owns the session, a bridge onto
+ * the one that already does, or neither. The lock is re-read every pass because
+ * the winner of a simultaneous start needs a moment to bind its port and publish
+ * the sidecar, and because a winner that crashes frees the lock mid-loop.
+ */
+export async function decideRole(config, p) {
+    const deadline = Date.now() + ROLE_TIMEOUT_MS;
+    for (;;) {
+        const running = lockHolder(p.lockFile);
+        if (running === null)
+            return { kind: "daemon" };
+        // An explicit --http asks for an HTTP server of its own, not a stdio bridge.
+        if (config.share === false || config.transport === "http") {
+            return {
+                kind: "refuse",
+                message: `wazap is already running (pid ${running}) using ${config.dataDir}. Stop it first or use --data-dir.`,
+            };
+        }
+        const info = readDaemon(p.daemonFile);
+        if (info !== null && info.pid === running && (await daemonHealthy(info.port, 2_000))) {
+            return { kind: "bridge", daemon: info };
+        }
+        if (Date.now() >= deadline) {
+            return {
+                kind: "refuse",
+                message: `wazap is running (pid ${running}) but is not sharing its session (older version?). Stop it and start again.`,
+            };
+        }
+        await sleep(ROLE_POLL_MS);
+    }
+}

package/dist/index.js

@@ -42,7 +42,7 @@ Options:
 
 Environment: WAZAP_DATA_DIR, WAZAP_READ_ONLY, WAZAP_SYNC_FULL_HISTORY, WAZAP_PERSIST_HISTORY,
 WAZAP_TRANSPORT, WAZAP_HOST, WAZAP_PORT, WAZAP_READ_TOKEN, WAZAP_WRITE_TOKEN, WAZAP_RATE_LIMIT,
-WAZAP_NO_UPDATE_CHECK.
+WAZAP_NO_SHARE, WAZAP_NO_UPDATE_CHECK.
 An optional <data-dir>/.env is loaded if present.`;
 async function main() {
     const invocation = parseCli();

package/dist/lock.js

@@ -25,9 +25,32 @@ export function lockHolder(lockFile) {
         return err.code === "EPERM" ? pid : null;
     }
 }
+/** Create the lock file, or false if it already existed. */
+function claim(lockFile) {
+    try {
+        writeFileSync(lockFile, `${process.pid}\n`, { mode: 0o600, flag: "wx" });
+        return true;
+    }
+    catch (err) {
+        if (err.code === "EEXIST")
+            return false;
+        throw err;
+    }
+}
+/** Take the lock, or false if another live process holds it. */
 export function writeLock(lockFile) {
     mkdirSync(dirname(lockFile), { recursive: true, mode: 0o700 });
-    writeFileSync(lockFile, `${process.pid}\n`, { mode: 0o600 });
+    if (claim(lockFile))
+        return true;
+    if (lockHolder(lockFile) !== null)
+        return false;
+    try {
+        unlinkSync(lockFile);
+    }
+    catch {
+        /* someone else cleared the stale lock first */
+    }
+    return claim(lockFile);
 }
 /** Remove the lock, but only if it is still ours. */
 export function releaseLock(lockFile) {

package/dist/server.js

@@ -5,7 +5,6 @@ import { StreamableHTTPServerTransport } from "@modelcontextprotocol/sdk/server/
 import { isInitializeRequest } from "@modelcontextprotocol/sdk/types.js";
 import express from "express";
 import { WAZAP_VERSION } from "./config.js";
-import { RateLimiter } from "./ratelimit.js";
 import { registerTools } from "./tools.js";
 import { log, logError } from "./logger.js";
 function isAuthorized(header, expected) {
@@ -21,17 +20,14 @@ function buildMcpServer(wa, config, allowWrite, limiter) {
     registerTools(server, wa, { allowWrite: allowWrite && !config.readOnly, limiter });
     return server;
 }
-export async function runStdio(wa, config) {
-    const limiter = new RateLimiter(config.rateLimitPerMinute);
+export async function runStdio(wa, config, limiter) {
     const server = buildMcpServer(wa, config, true, limiter);
     const transport = new StdioServerTransport();
     await server.connect(transport);
     log("MCP server ready on stdio.");
 }
-export async function runHttp(wa, config) {
-    // One bucket for the whole process. A per-session bucket would let an HTTP
-    // client bypass the write limit by reconnecting.
-    const limiter = new RateLimiter(config.rateLimitPerMinute);
+/** Serve /mcp and /healthz on one address. Resolves with the bound port, so port 0 works. */
+export async function startHttpEndpoint(wa, config, endpoint, limiter) {
     const app = express();
     app.use(express.json());
     app.use((req, res, next) => {
@@ -48,19 +44,17 @@ export async function runHttp(wa, config) {
         });
         next();
     });
-    if (!config.readToken) {
+    if (endpoint.openRead) {
         log("WARNING: no WAZAP_READ_TOKEN set, the /mcp endpoint is UNAUTHENTICATED. " +
             "Set WAZAP_READ_TOKEN before exposing this server beyond localhost.");
     }
-    // Two tokens: the read token (WAZAP_READ_TOKEN) and the write token
-    // (WAZAP_WRITE_TOKEN). A write-token request also unlocks the mutating tools,
+    // The first credential the bearer token matches decides the session's tools,
     // so a leaked read token can never message anyone.
     const requireAuth = (req, res, next) => {
         const auth = req.headers.authorization;
-        const writeOk = config.writeToken ? isAuthorized(auth, config.writeToken) : false;
-        const readOk = !config.readToken || isAuthorized(auth, config.readToken);
-        if (readOk || writeOk) {
-            req.mcpWrite = writeOk;
+        const credential = endpoint.credentials.find((entry) => isAuthorized(auth, entry.token));
+        if (credential || endpoint.openRead) {
+            req.mcpWrite = credential?.write === true;
             next();
             return;
         }
@@ -124,10 +118,29 @@ export async function runHttp(wa, config) {
     app.get("/healthz", (_req, res) => {
         res.json({ ok: true, status: wa.getStatus().status });
     });
-    await new Promise((resolve) => {
-        app.listen(config.httpPort, config.httpHost, () => {
-            log(`MCP server (Streamable HTTP) on http://${config.httpHost}:${config.httpPort}/mcp`);
-            resolve();
+    return await new Promise((resolve) => {
+        const server = app.listen(endpoint.port, endpoint.host, () => {
+            const bound = server.address();
+            resolve(typeof bound === "object" && bound !== null ? bound.port : endpoint.port);
         });
     });
 }
+/** The endpoint the user asked for: WAZAP_HOST/WAZAP_PORT and the two configured tokens. */
+export async function runHttp(wa, config, limiter, extra) {
+    const credentials = [];
+    if (config.readToken)
+        credentials.push({ token: config.readToken, write: false });
+    if (config.writeToken)
+        credentials.push({ token: config.writeToken, write: true });
+    if (extra)
+        credentials.push(extra);
+    const port = await startHttpEndpoint(wa, config, { host: config.httpHost, port: config.httpPort, credentials, openRead: !config.readToken }, limiter);
+    log(`MCP server (Streamable HTTP) on http://${config.httpHost}:${port}/mcp`);
+    return port;
+}
+/** A private endpoint on an ephemeral loopback port, reachable only with the token. */
+export async function startLoopbackEndpoint(wa, config, token, limiter) {
+    const port = await startHttpEndpoint(wa, config, { host: "127.0.0.1", port: 0, credentials: [{ token, write: true }], openRead: false }, limiter);
+    log(`sharing this session on 127.0.0.1:${port}`);
+    return port;
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "wazap-mcp",
-  "version": "0.9.2",
+  "version": "0.9.3",
   "description": "WhatsApp for your AI agent. MCP server over Baileys: pairing-code login, 22 tools, stdio or token-protected HTTP.",
   "license": "MIT",
   "author": "Răzvan Girgiz",