webcake-landing-mcp 1.5.10 → 1.6.0

package/dist/changelog.json

@@ -1,4 +1,18 @@
 [
+  {
+    "v": "1.6.0",
+    "d": "14/10/2026",
+    "type": "Added",
+    "en": "The self-hosted screenshot route behind render_preview now caps concurrent Playwright captures at RENDER_SCREENSHOT_CONCURRENCY (default 2), queuing…",
+    "vi": "Route screenshot self-hosted phía sau render_preview nay giới hạn số lượt chụp Playwright chạy đồng thời theo RENDER_SCREENSHOT_CONCURRENCY (mặc…"
+  },
+  {
+    "v": "1.5.11",
+    "d": "13/10/2026",
+    "type": "Fixed",
+    "en": "The HTTP server now answers HEAD requests the same way it answers GET on every public read-only route (/privacy, /privacy-policy, /terms, /tos,…",
+    "vi": "HTTP server nay trả lời request HEAD giống như GET trên mọi route công khai chỉ-đọc (/privacy, /privacy-policy, /terms, /tos, /favicon.ico,…"
+  },
   {
     "v": "1.5.10",
     "d": "13/10/2026",
@@ -26,19 +40,5 @@
     "type": "Changed",
     "en": "The ingest_url and render_preview tool descriptions now link to the API docs (docs/tools.md for both, plus the Microlink API reference for…",
     "vi": "Mô tả của tool ingest_url và render_preview nay có thêm link tới tài liệu API (docs/tools.md cho cả hai, cùng với link tham chiếu API của Microlink…"
-  },
-  {
-    "v": "1.5.6",
-    "d": "13/10/2026",
-    "type": "Fixed",
-    "en": "The HTTP server now serves a 192px PNG at /favicon.ico, /favicon.png, and /apple-touch-icon.png (with matching <link rel=\"icon\">/<link…",
-    "vi": "HTTP server nay phục vụ PNG 192px tại /favicon.ico, /favicon.png, và /apple-touch-icon.png (kèm thẻ <link rel=\"icon\">/<link rel=\"apple-touch-icon\">…"
-  },
-  {
-    "v": "1.5.5",
-    "d": "13/10/2026",
-    "type": "Fixed",
-    "en": "The page/source/sections/patches parameters on validate_page, create_page, update_page, add_section, and patch_page now declare a typed JSON Schema…",
-    "vi": "Các tham số page/source/sections/patches của validate_page, create_page, update_page, add_section, và patch_page nay khai báo JSON Schema có kiểu rõ…"
   }
 ]

package/dist/http.js

@@ -81,6 +81,12 @@ function iconPng() {
         return null;
     }
 }
+// Public pages/assets answer HEAD like GET (Node drops the body on HEAD): link
+// checkers — incl. the connector-directory form — probe with HEAD, and a 404
+// there made /privacy and /terms look missing.
+function isRead(req) {
+    return req.method === "GET" || req.method === "HEAD";
+}
 function sendJson(res, status, body) {
     res.writeHead(status, { "content-type": "application/json" });
     res.end(JSON.stringify(body));
@@ -186,12 +192,12 @@ function htmlError(res, status, message) {
 async function handleOAuth(req, res, path) {
     const issuer = publicBase(req);
     // ---- Metadata (RFC 8414 / RFC 9728) ----
-    if (req.method === "GET" && path === WELL_KNOWN_PR) {
+    if (isRead(req) && path === WELL_KNOWN_PR) {
         res.writeHead(200, { "content-type": "application/json", "access-control-allow-origin": "*" });
         res.end(JSON.stringify(protectedResourceMetadata(`${issuer}${MCP_PATH}`, issuer)));
         return true;
     }
-    if (req.method === "GET" && path === WELL_KNOWN_AS) {
+    if (isRead(req) && path === WELL_KNOWN_AS) {
         res.writeHead(200, { "content-type": "application/json", "access-control-allow-origin": "*" });
         res.end(JSON.stringify(authServerMetadata(issuer)));
         return true;
@@ -397,21 +403,21 @@ export async function startHttpServer(port) {
         const path = (req.url ?? "").split("?")[0];
         // Brand icon — clients (e.g. the claude.ai connector) fetch a favicon from the
         // server origin; without one they show a generic globe. Served raw as SVG.
-        if (req.method === "GET" && (path === "/favicon.ico" || path === "/favicon.png" || path === "/icon.png" || path === "/apple-touch-icon.png")) {
+        if (isRead(req) && (path === "/favicon.ico" || path === "/favicon.png" || path === "/icon.png" || path === "/apple-touch-icon.png")) {
             const png = iconPng();
             if (png) {
                 res.writeHead(200, { "content-type": "image/png", "cache-control": "public, max-age=86400" });
                 return res.end(png);
             }
         }
-        if (req.method === "GET" && (path === "/favicon.ico" || path === "/favicon.svg" || path === "/icon.svg")) {
+        if (isRead(req) && (path === "/favicon.ico" || path === "/favicon.svg" || path === "/icon.svg")) {
             res.writeHead(200, { "content-type": ICON_MIME, "cache-control": "public, max-age=86400" });
             return res.end(ICON_SVG);
         }
         // Social-card image referenced by the landing page's og:image / twitter:image.
         // PNG is the canonical og:image (unfurls everywhere); the SVG stays for clients
         // that prefer it (Slack/Telegram/Discord) and as a fallback if og.png is absent.
-        if (req.method === "GET" && path === "/og.png") {
+        if (isRead(req) && path === "/og.png") {
             const png = ogImagePng();
             if (png) {
                 res.writeHead(200, { "content-type": "image/png", "cache-control": "public, max-age=86400" });
@@ -421,21 +427,21 @@ export async function startHttpServer(port) {
             res.writeHead(200, { "content-type": ICON_MIME, "cache-control": "public, max-age=86400" });
             return res.end(ogImageSvg());
         }
-        if (req.method === "GET" && path === "/og.svg") {
+        if (isRead(req) && path === "/og.svg") {
             res.writeHead(200, { "content-type": ICON_MIME, "cache-control": "public, max-age=86400" });
             return res.end(ogImageSvg());
         }
         // Public legal pages — required URLs for the Claude/ChatGPT directory submission.
-        if (req.method === "GET" && (path === "/privacy" || path === "/privacy-policy")) {
+        if (isRead(req) && (path === "/privacy" || path === "/privacy-policy")) {
             res.writeHead(200, { "content-type": "text/html; charset=utf-8", "cache-control": "public, max-age=3600" });
             return res.end(privacyHtml());
         }
-        if (req.method === "GET" && (path === "/terms" || path === "/tos")) {
+        if (isRead(req) && (path === "/terms" || path === "/tos")) {
             res.writeHead(200, { "content-type": "text/html; charset=utf-8", "cache-control": "public, max-age=3600" });
             return res.end(termsHtml());
         }
         // Lightweight health check for hosting platforms.
-        if (req.method === "GET" && (path === "/" || path === "/health")) {
+        if (isRead(req) && (path === "/" || path === "/health")) {
             // A browser/connector probing the root with `Accept: text/html` gets a tiny
             // page that links the favicon (helps icon discovery); programmatic probes
             // (the container healthcheck uses `Accept: */*`) still get the JSON health.

package/dist/persistence/screenshot-playwright.js

@@ -99,6 +99,62 @@ async function withContext(width, scale, fn) {
             error: "playwright is not installed on this host (run: npm i playwright && npx playwright install chromium)",
         };
     }
+    await acquireSlot();
+    try {
+        return await withContextUnlimited(width, scale, fn);
+    }
+    finally {
+        releaseSlot();
+    }
+}
+// ---------------------------------------------------------------------------
+// RAM guard for small VPSes: cap concurrent captures (each context is
+// ~100–300 MB) and close the browser after an idle spell so it doesn't sit on
+// memory / slowly leak. RENDER_SCREENSHOT_CONCURRENCY (default 2),
+// RENDER_SCREENSHOT_IDLE_MS (default 5 min, 0 = keep the browser forever).
+// ---------------------------------------------------------------------------
+const MAX_CONCURRENT = Math.max(1, parseInt(process.env.RENDER_SCREENSHOT_CONCURRENCY ?? "", 10) || 2);
+const idleEnv = parseInt(process.env.RENDER_SCREENSHOT_IDLE_MS ?? "", 10);
+const IDLE_CLOSE_MS = Number.isFinite(idleEnv) && idleEnv >= 0 ? idleEnv : 300_000;
+let active = 0;
+const waiters = [];
+let idleTimer = null;
+/** Wait for a capture slot. ponytail: unbounded FIFO queue — the HTTP caller's own timeout bounds the wait. */
+export async function acquireSlot() {
+    if (idleTimer) {
+        clearTimeout(idleTimer);
+        idleTimer = null;
+    }
+    if (active < MAX_CONCURRENT) {
+        active++;
+        return;
+    }
+    await new Promise((r) => waiters.push(r)); // releaseSlot hands its slot over (active unchanged)
+}
+/** Free a slot: hand it to the next waiter, else arm the idle close once nothing is running. */
+export function releaseSlot() {
+    const next = waiters.shift();
+    if (next)
+        return next();
+    active--;
+    if (active === 0 && IDLE_CLOSE_MS > 0) {
+        idleTimer = setTimeout(closeIdleBrowser, IDLE_CLOSE_MS);
+        idleTimer.unref?.();
+    }
+}
+/** Snapshot of the limiter (smoke coverage). */
+export function slotStats() {
+    return { active, waiting: waiters.length, max: MAX_CONCURRENT };
+}
+async function closeIdleBrowser() {
+    idleTimer = null;
+    const p = browserPromise;
+    browserPromise = null; // the next capture relaunches
+    const browser = p ? await p.catch(() => null) : null;
+    if (browser)
+        await browser.close().catch(() => { });
+}
+async function withContextUnlimited(width, scale, fn) {
     for (let attempt = 0; attempt < 2; attempt++) {
         let browser = await getBrowser();
         if (!browser)

package/dist/smoke.js

@@ -21,7 +21,7 @@ import { buildConnectUrl, parseCallback } from "./auth/login.js";
 import { redirectMatches } from "./auth/oauth-server.js";
 import { isLocalPath, resolveLocalPath, sniffMime, localContentType } from "./tools/media.js";
 import { buildMicrolinkUrl } from "./persistence/screenshot-client.js";
-import { isPrivateHost, isAllowedScreenshotUrl } from "./persistence/screenshot-playwright.js";
+import { isPrivateHost, isAllowedScreenshotUrl, acquireSlot, releaseSlot, slotStats } from "./persistence/screenshot-playwright.js";
 import { iconifyCandidates } from "./persistence/icon-client.js";
 import { collectExternalImageUrls, rewriteImageUrls, isRehostableImageUrl, isInlineBase64Image, parseInlineBase64Image } from "./persistence/rehost.js";
 import { key as rehostCacheKey } from "./persistence/rehost-cache.js";
@@ -2265,6 +2265,22 @@ console.log("== upload_images: localContentType (ext + magic, pure offline) ==")
 }
 // == /api/render/screenshot: SSRF url guard (pure offline) ==
 {
+    console.log("\n== render screenshot: concurrency cap (pure offline) ==");
+    {
+        const max = slotStats().max;
+        for (let i = 0; i < max; i++)
+            await acquireSlot();
+        let queuedGotSlot = false;
+        const queued = acquireSlot().then(() => (queuedGotSlot = true));
+        await Promise.resolve();
+        check("slots: capped at max, extra caller waits", slotStats().active === max && slotStats().waiting === 1 && !queuedGotSlot);
+        releaseSlot(); // hands the slot to the waiter
+        await queued;
+        check("slots: release hands slot to waiter", queuedGotSlot && slotStats().active === max && slotStats().waiting === 0);
+        for (let i = 0; i < max; i++)
+            releaseSlot();
+        check("slots: all released", slotStats().active === 0);
+    }
     console.log("\n== render screenshot route: SSRF url guard (pure offline) ==");
     // private / loopback / link-local hosts are blocked
     check("isPrivateHost: localhost", isPrivateHost("localhost"));

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "webcake-landing-mcp",
-  "version": "1.5.10",
+  "version": "1.6.0",
   "description": "MCP server exposing Webcake landing-page element schemas + AI usage hints, and persisting LLM-generated page sources to a Webcake backend.",
   "mcpName": "io.github.vuluu2k/webcake-landing-mcp",
   "type": "module",