webcake-landing-mcp 1.5.7 → 1.5.9

package/dist/auth/oauth-server.js

@@ -263,6 +263,27 @@ export async function getClient(clientId) {
         return undefined;
     return (await getStore()).getClient(clientId);
 }
+const LOOPBACK_HOSTS = new Set(["localhost", "127.0.0.1", "[::1]"]);
+/**
+ * Exact match, except an http loopback redirect ignores the port (RFC 8252 §7.3):
+ * native clients like Claude Code register `http://localhost/callback` and then
+ * redirect to an ephemeral port per session (`http://localhost:3118/callback`).
+ */
+export function redirectMatches(registered, requested) {
+    if (registered === requested)
+        return true;
+    let a, b;
+    try {
+        a = new URL(registered);
+        b = new URL(requested);
+    }
+    catch {
+        return false;
+    }
+    return (a.protocol === "http:" && b.protocol === "http:" &&
+        LOOPBACK_HOSTS.has(a.hostname) && a.hostname === b.hostname &&
+        a.pathname === b.pathname && a.search === b.search);
+}
 /**
  * Validate an /authorize request and park it. Returns an `internalState` to send
  * to the login page as its `state`; the callback uses it to find this request.
@@ -275,7 +296,7 @@ export async function startAuthorize(p) {
     if (!client) {
         return { ok: false, error: "invalid_client", error_description: "Unknown client_id. Register first via /register.", redirectable: false };
     }
-    if (!p.redirect_uri || !client.redirect_uris.includes(p.redirect_uri)) {
+    if (!p.redirect_uri || !client.redirect_uris.some((r) => redirectMatches(r, p.redirect_uri))) {
         return { ok: false, error: "invalid_request", error_description: "redirect_uri does not match a registered URI.", redirectable: false };
     }
     // From here errors CAN go back to the client's redirect_uri.

package/dist/changelog.json

@@ -1,4 +1,18 @@
 [
+  {
+    "v": "1.5.9",
+    "d": "13/10/2026",
+    "type": "Fixed",
+    "en": "The HTTP server now answers a request carrying an unknown mcp-session-id with 404 instead of 400, so clients re-initialize instead of staying stuck…",
+    "vi": "HTTP server nay trả về 404 (thay vì 400) khi nhận request với mcp-session-id không xác định, giúp client tự re-initialize thay vì bị kẹt ở trạng…"
+  },
+  {
+    "v": "1.5.8",
+    "d": "13/10/2026",
+    "type": "Fixed",
+    "en": "The OAuth authorize endpoint now accepts http://localhost/127.0.0.1/[::1] redirect URIs on any port as long as the scheme, host, path, and query…",
+    "vi": "Endpoint OAuth authorize nay chấp nhận redirect URI http://localhost/127.0.0.1/[::1] ở bất kỳ port nào miễn là scheme, host, path, và query khớp với…"
+  },
   {
     "v": "1.5.7",
     "d": "13/10/2026",
@@ -26,19 +40,5 @@
     "type": "Added",
     "en": "ingest_html and ingest_url now return font_groups (the page's self-hosted @font-face fonts, already shaped for settings.fontGroups) and…",
     "vi": "ingest_html và ingest_url nay trả về font_groups (các font @font-face tự host của trang, đã đóng gói theo đúng dạng settings.fontGroups) và…"
-  },
-  {
-    "v": "1.5.3",
-    "d": "17/09/2026",
-    "type": "Added",
-    "en": "validate_page now detects inline base64 images (data:image/…;base64,… URIs) anywhere in an element's specials, a styles background, gallery…",
-    "vi": "validate_page nay phát hiện ảnh base64 nhúng (URI data:image/…;base64,…) ở bất kỳ đâu trong specials của phần tử, nền styles, gallery item.link,…"
-  },
-  {
-    "v": "1.5.2",
-    "d": "25/08/2026",
-    "type": "Fixed",
-    "en": "Colors written in any CSS notation other than the legacy rgba(r,g,b,a) form (hex, rgb(), hsl(), CSS named colors, and the modern space/slash rgba()…",
-    "vi": "Các giá trị màu được viết ở bất kỳ dạng CSS nào khác ngoài dạng rgba(r,g,b,a) kiểu cũ (hex, rgb(), hsl(), tên màu CSS, và cú pháp rgba() mới dùng…"
   }
 ]

package/dist/http.js

@@ -497,6 +497,11 @@ export async function startHttpServer(port) {
                 await transport.handleRequest(req, res, body);
                 return;
             }
+            // Unknown session (e.g. sessions are in-memory and the server restarted):
+            // the spec requires 404 so the client re-initializes. A 400 here left
+            // claude.ai "connected" with no tools after every redeploy.
+            if (sessionId)
+                return rpcError(res, 404, "Session not found (expired or server restarted) — send a new initialize request.");
             // New session: only a POST `initialize` may open one.
             if (req.method === "POST") {
                 const body = await readBody(req);

package/dist/smoke.js

@@ -18,6 +18,7 @@ import { toEditorUrl, toEditorLoginUrl, toPreviewUrl, buildPublishRequestRedacte
 import { normalizePhoto, resolvePexelsKey, pexelsKeyFromHeaders, resolvePexelsProxyBase, buildSearchQuery, PEXELS_PROXY_DEFAULT, variantPixels, annotateVariantSizes } from "./persistence/pexels-client.js";
 import { putDraft, getDraft, updateDraft, deleteDraft } from "./persistence/draft-cache.js";
 import { buildConnectUrl, parseCallback } from "./auth/login.js";
+import { redirectMatches } from "./auth/oauth-server.js";
 import { isLocalPath, resolveLocalPath, sniffMime, localContentType } from "./tools/media.js";
 import { buildMicrolinkUrl } from "./persistence/screenshot-client.js";
 import { isPrivateHost, isAllowedScreenshotUrl } from "./persistence/screenshot-playwright.js";
@@ -122,6 +123,9 @@ const good = {
 };
 const r1 = validatePage(good);
 check("good page valid", r1.valid, r1.errors);
+check("oauth redirect: exact claude.ai match", redirectMatches("https://claude.ai/api/mcp/auth_callback", "https://claude.ai/api/mcp/auth_callback"));
+check("oauth redirect: loopback any port (Claude Code)", redirectMatches("http://localhost/callback", "http://localhost:3118/callback") && redirectMatches("http://127.0.0.1/callback", "http://127.0.0.1:51234/callback"));
+check("oauth redirect: rejects other path/host/https port drift", !redirectMatches("http://localhost/callback", "http://localhost:3118/evil") && !redirectMatches("http://localhost/callback", "http://127.0.0.1:3118/callback") && !redirectMatches("https://claude.ai/api/mcp/auth_callback", "https://claude.ai:8443/api/mcp/auth_callback") && !redirectMatches("http://evil.com/callback", "http://evil.com:1/callback"));
 check("good page has no dangling-target warnings", r1.warnings.length === 0, r1.warnings);
 check("good page stats", r1.stats.sections === 2 && r1.stats.ids === 3, r1.stats);
 console.log("== validate: catches problems ==");

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "webcake-landing-mcp",
-  "version": "1.5.7",
+  "version": "1.5.9",
   "description": "MCP server exposing Webcake landing-page element schemas + AI usage hints, and persisting LLM-generated page sources to a Webcake backend.",
   "mcpName": "io.github.vuluu2k/webcake-landing-mcp",
   "type": "module",