web-comments 1.0.0 → 1.0.1

package/dist/connectors/mcp.js

@@ -302,9 +302,16 @@ var PAGE_HEADERS = {
   "cache-control": "no-store",
   "content-security-policy": "default-src 'none'; style-src 'unsafe-inline'; img-src https: data:; frame-ancestors 'none'; base-uri 'none'",
   "x-frame-options": "DENY",
-  "referrer-policy": "no-referrer",
+  // Not no-referrer: under it, browsers send the consent form's Origin as "null".
+  "referrer-policy": "same-origin",
   "x-content-type-options": "nosniff"
 };
+function fromThisOrigin(request) {
+  const site = request.headers.get("sec-fetch-site");
+  if (site) return site === "same-origin";
+  const origin = request.headers.get("origin");
+  return origin === null || origin === new URL(request.url).origin;
+}
 function page(html, status = 200) {
   return new Response(html, { status, headers: PAGE_HEADERS });
 }
@@ -387,9 +394,7 @@ async function authorize(request, context, options) {
 }
 async function decide(request, context, options) {
   const at = endpoints(context.url);
-  const ownOrigin = new URL(request.url).origin;
-  const origin = request.headers.get("origin");
-  if (origin !== null && origin !== ownOrigin || request.headers.get("sec-fetch-site") === "cross-site") {
+  if (!fromThisOrigin(request)) {
     return page(
       messagePage(options.name, "Not allowed", "This approval didn't come from this site."),
       403
@@ -540,7 +545,7 @@ async function handleOAuth(request, path, context, options) {
 }
 
 // src/connectors/mcp/index.ts
-var VERSION = "1.0.0";
+var VERSION = "1.0.1";
 var PROTOCOL_VERSIONS = ["2025-11-25", "2025-06-18", "2025-03-26", "2024-11-05"];
 function mcp(options = {}) {
   const oauth = {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "web-comments",
-  "version": "1.0.0",
+  "version": "1.0.1",
   "description": "Figma-style comments for any web page: drop a comment on an element, reply, resolve. Bring your own sign-in, database and screenshot storage; send threads to Linear, or to agents over MCP.",
   "keywords": [
     "annotations",