weflow-cli 1.8.2 → 1.9.0

package/dist/mcp-server/http.d.ts

@@ -0,0 +1,14 @@
+import type { Server as McpServer } from '@modelcontextprotocol/sdk/server/index.js';
+import { type HttpOptions } from './httpConfig.js';
+export declare const MCP_HTTP_PATH = "/mcp";
+export interface RunningHttpServer {
+    /** 实际绑定的地址（端口传 0 时是内核挑的，所以以这里为准） */
+    url: string;
+    port: number;
+    close: () => Promise<void>;
+}
+/**
+ * 起 HTTP 传输。`buildServer` 每次调用都必须返回一个**新的** Server（无状态模式每个请求一套）。
+ */
+export declare function startHttpServer(opts: HttpOptions, buildServer: () => McpServer, log?: (line: string) => void): Promise<RunningHttpServer>;
+//# sourceMappingURL=http.d.ts.map

package/dist/mcp-server/http.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"http.d.ts","sourceRoot":"","sources":["../../mcp-server/http.ts"],"names":[],"mappings":"AAoBA,OAAO,KAAK,EAAE,MAAM,IAAI,SAAS,EAAE,MAAM,2CAA2C,CAAA;AACpF,OAAO,EAIL,KAAK,WAAW,EACjB,MAAM,iBAAiB,CAAA;AAExB,eAAO,MAAM,aAAa,SAAS,CAAA;AAEnC,MAAM,WAAW,iBAAiB;IAChC,oCAAoC;IACpC,GAAG,EAAE,MAAM,CAAA;IACX,IAAI,EAAE,MAAM,CAAA;IACZ,KAAK,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAA;CAC3B;AAOD;;GAEG;AACH,wBAAsB,eAAe,CACnC,IAAI,EAAE,WAAW,EACjB,WAAW,EAAE,MAAM,SAAS,EAC5B,GAAG,GAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAe,GACrC,OAAO,CAAC,iBAAiB,CAAC,CA0D5B"}

package/dist/mcp-server/http.js

@@ -0,0 +1,84 @@
+/**
+ * MCP 的 **HTTP 传输**（Streamable HTTP）。stdio 那条路一个字没动，这是**另一条**路。
+ *
+ * 为什么要它：stdio 只能被"能起进程"的客户端用（Claude Code、IDE 插件）。HTTP 那条路在
+ * 生态里已是常态——chatlog 就是拿 Streamable HTTP / SSE 把同一批查询能力摊出来的，于是浏览器型
+ * 客户端、常驻服务、多个客户端同时连都能用。工具集**完全一样**（同一张 `TOOL_DEFS` 派生表），
+ * 变的只是搬运动作的方式。
+ *
+ * 三道边界（判定在 `httpConfig.ts`，纯函数、有测试）：
+ * 1. **默认不开**：不给 `--http` 就是 stdio，行为与以前逐字相同。
+ * 2. **必须带令牌**，且**只绑回环**（远程走 SSH 隧道，见 docs/MCP.md）。
+ * 3. **打开 DNS 重绑定防护**：SDK 的默认是 `false`，而本机 HTTP 服务最现实的攻击面就是
+ *    "你正在浏览的某个网页往 127.0.0.1 发请求"。打开后 Host 头必须对得上，带 Origin 的
+ *    浏览器请求也必须在白名单里。
+ *
+ * 采用**无状态**模式（每个请求一套 server+transport）：这一层只有只读查询，没有要跨请求维持的
+ * 会话，无状态就没有"会话之间串了"这类问题。
+ */
+import { createServer } from 'node:http';
+import { StreamableHTTPServerTransport } from '@modelcontextprotocol/sdk/server/streamableHttp.js';
+import { allowedHostsFor, allowedOriginsFor, isAuthorized, } from './httpConfig.js';
+export const MCP_HTTP_PATH = '/mcp';
+function json(res, code, body) {
+    res.writeHead(code, { 'content-type': 'application/json' });
+    res.end(JSON.stringify(body));
+}
+/**
+ * 起 HTTP 传输。`buildServer` 每次调用都必须返回一个**新的** Server（无状态模式每个请求一套）。
+ */
+export async function startHttpServer(opts, buildServer, log = () => { }) {
+    let allowedHosts = [];
+    let allowedOrigins = [];
+    const handler = async (req, res) => {
+        const url = req.url ?? '/';
+        if (url !== MCP_HTTP_PATH && !url.startsWith(MCP_HTTP_PATH + '?')) {
+            json(res, 404, { error: 'not found', hint: `MCP 端点在 ${MCP_HTTP_PATH}` });
+            return;
+        }
+        // 令牌先判、再谈别的：没令牌的请求连"MCP 认不认识这个方法"都不该知道。
+        if (!isAuthorized(req.headers.authorization, opts.token)) {
+            json(res, 401, { jsonrpc: '2.0', error: { code: -32001, message: '未授权：缺少或不对的 Bearer 令牌' }, id: null });
+            return;
+        }
+        const transport = new StreamableHTTPServerTransport({
+            sessionIdGenerator: undefined, // 无状态
+            enableJsonResponse: true, // 不强制 SSE：普通客户端拿 JSON 就好
+            enableDnsRebindingProtection: true, // SDK 默认 false，必须显式开
+            allowedHosts,
+            allowedOrigins,
+        });
+        const server = buildServer();
+        res.on('close', () => { void transport.close(); void server.close().catch(() => { }); });
+        try {
+            await server.connect(transport);
+            await transport.handleRequest(req, res);
+        }
+        catch (error) {
+            log(`[mcp-http] 请求处理失败: ${error?.message ?? error}`);
+            if (!res.headersSent) {
+                json(res, 500, { jsonrpc: '2.0', error: { code: -32603, message: '内部错误' }, id: null });
+            }
+        }
+    };
+    const httpServer = createServer((req, res) => { void handler(req, res); });
+    await new Promise((resolve, reject) => {
+        httpServer.once('error', reject);
+        httpServer.listen(opts.port, opts.host, () => {
+            httpServer.removeListener('error', reject);
+            resolve();
+        });
+    });
+    const address = httpServer.address();
+    const port = typeof address === 'object' && address ? address.port : opts.port;
+    // **绑定之后**才算白名单：端口传 0 时真实端口此刻才知道，而白名单必须用真实端口。
+    allowedHosts = allowedHostsFor(opts.host, port);
+    allowedOrigins = allowedOriginsFor(opts.host, port);
+    const shownHost = opts.host === '::1' ? '[::1]' : opts.host;
+    return {
+        url: `http://${shownHost}:${port}${MCP_HTTP_PATH}`,
+        port,
+        close: () => new Promise((resolve) => { httpServer.close(() => resolve()); }),
+    };
+}
+//# sourceMappingURL=http.js.map

package/dist/mcp-server/http.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"http.js","sourceRoot":"","sources":["../../mcp-server/http.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AACH,OAAO,EAAE,YAAY,EAA0D,MAAM,WAAW,CAAA;AAChG,OAAO,EAAE,6BAA6B,EAAE,MAAM,oDAAoD,CAAA;AAElG,OAAO,EACL,eAAe,EACf,iBAAiB,EACjB,YAAY,GAEb,MAAM,iBAAiB,CAAA;AAExB,MAAM,CAAC,MAAM,aAAa,GAAG,MAAM,CAAA;AASnC,SAAS,IAAI,CAAC,GAAmB,EAAE,IAAY,EAAE,IAAa;IAC5D,GAAG,CAAC,SAAS,CAAC,IAAI,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAA;IAC3D,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAA;AAC/B,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,IAAiB,EACjB,WAA4B,EAC5B,MAA8B,GAAG,EAAE,GAAE,CAAC;IAEtC,IAAI,YAAY,GAAa,EAAE,CAAA;IAC/B,IAAI,cAAc,GAAa,EAAE,CAAA;IAEjC,MAAM,OAAO,GAAG,KAAK,EAAE,GAAoB,EAAE,GAAmB,EAAiB,EAAE;QACjF,MAAM,GAAG,GAAG,GAAG,CAAC,GAAG,IAAI,GAAG,CAAA;QAC1B,IAAI,GAAG,KAAK,aAAa,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,aAAa,GAAG,GAAG,CAAC,EAAE,CAAC;YAClE,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,WAAW,EAAE,IAAI,EAAE,WAAW,aAAa,EAAE,EAAE,CAAC,CAAA;YACxE,OAAM;QACR,CAAC;QACD,wCAAwC;QACxC,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,aAAa,EAAE,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;YACzD,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,sBAAsB,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAA;YACtG,OAAM;QACR,CAAC;QAED,MAAM,SAAS,GAAG,IAAI,6BAA6B,CAAC;YAClD,kBAAkB,EAAE,SAAS,EAAW,MAAM;YAC9C,kBAAkB,EAAE,IAAI,EAAgB,yBAAyB;YACjE,4BAA4B,EAAE,IAAI,EAAM,qBAAqB;YAC7D,YAAY;YACZ,cAAc;SACf,CAAC,CAAA;QACF,MAAM,MAAM,GAAG,WAAW,EAAE,CAAA;QAC5B,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,GAAG,KAAK,SAAS,CAAC,KAAK,EAAE,CAAC,CAAC,KAAK,MAAM,CAAC,KAAK,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAA,CAAC,CAAC,CAAC,CAAA;QACtF,IAAI,CAAC;YACH,MAAM,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAA;YAC/B,MAAM,SAAS,CAAC,aAAa,CAAC,GAAG,EAAE,GAAG,CAAC,CAAA;QACzC,CAAC;QAAC,OAAO,KAAU,EAAE,CAAC;YACpB,GAAG,CAAC,sBAAsB,KAAK,EAAE,OAAO,IAAI,KAAK,EAAE,CAAC,CAAA;YACpD,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC;gBACrB,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAA;YACxF,CAAC;QACH,CAAC;IACH,CAAC,CAAA;IAED,MAAM,UAAU,GAAW,YAAY,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,GAAG,KAAK,OAAO,CAAC,GAAG,EAAE,GAAG,CAAC,CAAA,CAAC,CAAC,CAAC,CAAA;IAEjF,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QAC1C,UAAU,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAA;QAChC,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,GAAG,EAAE;YAC3C,UAAU,CAAC,cAAc,CAAC,OAAO,EAAE,MAAM,CAAC,CAAA;YAC1C,OAAO,EAAE,CAAA;QACX,CAAC,CAAC,CAAA;IACJ,CAAC,CAAC,CAAA;IAEF,MAAM,OAAO,GAAG,UAAU,CAAC,OAAO,EAAE,CAAA;IACpC,MAAM,IAAI,GAAG,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAA;IAC9E,8CAA8C;IAC9C,YAAY,GAAG,eAAe,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,CAAA;IAC/C,cAAc,GAAG,iBAAiB,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,CAAA;IAEnD,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,KAAK,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAA;IAC3D,OAAO;QACL,GAAG,EAAE,UAAU,SAAS,IAAI,IAAI,GAAG,aAAa,EAAE;QAClD,IAAI;QACJ,KAAK,EAAE,GAAG,EAAE,CAAC,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE,GAAG,UAAU,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC,CAAA,CAAC,CAAC,CAAC;KACnF,CAAA;AACH,CAAC"}

package/dist/mcp-server/httpConfig.d.ts

@@ -0,0 +1,50 @@
+/**
+ * HTTP 传输的**判定**——纯函数，不碰 socket、不连 MCP，所以能离线测。
+ *
+ * 为什么值得单独一个文件：这里每一条规则决定的都是"要不要把本机的私密数据摊到一个网络
+ * 端口上"。服务器本体要起 socket、要装 SDK，测起来重；把判定抽出来，规则就能一条一条钉住
+ * （`test/mcp-http.test.ts`）。
+ *
+ * 边界（写死在这里，不靠调用方自觉）：
+ * - **默认不开**：不给 `--http` 也不给 `WEFLOW_MCP_HTTP` 就还是 stdio，行为与以前逐字相同。
+ * - **必须带令牌**：没给就**拒绝启动**，不给默认值 —— 一个悄悄生成的默认口令比没有更坏，
+ *   因为它看起来是"配好了"。
+ * - **只绑回环**：远程访问自己走 SSH 隧道或反向代理。把私密聊天记录摊到局域网上，
+ *   不该由这个文件顺手打开。
+ */
+/** 默认端口。5030 是 chatlog 的，避开它免得两个服务打架。 */
+export declare const DEFAULT_HTTP_PORT = 8790;
+/**
+ * 令牌长度下限。128 位随机（32 个 hex 字符）是常态；24 个字符足够排除"随手敲一个"，
+ * 又不至于逼人非得用某个特定长度。
+ */
+export declare const MIN_TOKEN_CHARS = 24;
+/** 允许绑定的地址。**只回环**：`0.0.0.0` 不在此列，而且不是"忘了加"。 */
+export declare const LOOPBACK_HOSTS: string[];
+export interface HttpOptions {
+    host: string;
+    port: number;
+    token: string;
+}
+/** 这一轮是不是要走 HTTP。`--http`、`--http=8790`、`WEFLOW_MCP_HTTP=1` 都算。 */
+export declare function httpModeRequested(env: Record<string, string | undefined>, argv: string[]): boolean;
+/**
+ * 解出 HTTP 模式的参数。**不走 HTTP 就返回 `null`**；要走但配置不合法就**抛错**（fail closed，
+ * 绝不"降级成不安全的默认值"继续跑）。
+ *
+ * 端口允许 `0`：那是让内核挑一个空闲端口，测试要用；正式跑用默认端口。
+ */
+export declare function resolveHttpOptions(env: Record<string, string | undefined>, argv: string[]): HttpOptions | null;
+/**
+ * `Authorization` 头认不认。
+ *
+ * 比的是**摘要**而不是原文：`timingSafeEqual` 要求等长，直接比长度会漏出"令牌有多长"，
+ * 于是"不同长度直接返回 false"就成了一个可测的短路径。两边先过一遍 SHA-256，长度就固定了。
+ * 方案名按 RFC 7235 大小写不敏感。
+ */
+export declare function isAuthorized(header: string | undefined, token: string): boolean;
+/** Host 头允许的取值（DNS 重绑定防护用）。带端口，因为 SDK 比的是**原始 Host 头**。 */
+export declare function allowedHostsFor(host: string, port: number): string[];
+/** 允许的 Origin（浏览器来的请求会带；命令行客户端通常不带，不带就放行）。 */
+export declare function allowedOriginsFor(host: string, port: number): string[];
+//# sourceMappingURL=httpConfig.d.ts.map

package/dist/mcp-server/httpConfig.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"httpConfig.d.ts","sourceRoot":"","sources":["../../mcp-server/httpConfig.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAIH,yCAAyC;AACzC,eAAO,MAAM,iBAAiB,OAAO,CAAA;AAErC;;;GAGG;AACH,eAAO,MAAM,eAAe,KAAK,CAAA;AAEjC,gDAAgD;AAChD,eAAO,MAAM,cAAc,UAAoC,CAAA;AAE/D,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,MAAM,CAAA;IACZ,IAAI,EAAE,MAAM,CAAA;IACZ,KAAK,EAAE,MAAM,CAAA;CACd;AAED,mEAAmE;AACnE,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,OAAO,CAIlG;AAOD;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAChC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,EACvC,IAAI,EAAE,MAAM,EAAE,GACb,WAAW,GAAG,IAAI,CAoCpB;AAED;;;;;;GAMG;AACH,wBAAgB,YAAY,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAU/E;AAED,2DAA2D;AAC3D,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,EAAE,CAMpE;AAED,8CAA8C;AAC9C,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,EAAE,CAEtE"}

package/dist/mcp-server/httpConfig.js

@@ -0,0 +1,104 @@
+/**
+ * HTTP 传输的**判定**——纯函数，不碰 socket、不连 MCP，所以能离线测。
+ *
+ * 为什么值得单独一个文件：这里每一条规则决定的都是"要不要把本机的私密数据摊到一个网络
+ * 端口上"。服务器本体要起 socket、要装 SDK，测起来重；把判定抽出来，规则就能一条一条钉住
+ * （`test/mcp-http.test.ts`）。
+ *
+ * 边界（写死在这里，不靠调用方自觉）：
+ * - **默认不开**：不给 `--http` 也不给 `WEFLOW_MCP_HTTP` 就还是 stdio，行为与以前逐字相同。
+ * - **必须带令牌**：没给就**拒绝启动**，不给默认值 —— 一个悄悄生成的默认口令比没有更坏，
+ *   因为它看起来是"配好了"。
+ * - **只绑回环**：远程访问自己走 SSH 隧道或反向代理。把私密聊天记录摊到局域网上，
+ *   不该由这个文件顺手打开。
+ */
+import { createHash, timingSafeEqual } from 'node:crypto';
+/** 默认端口。5030 是 chatlog 的，避开它免得两个服务打架。 */
+export const DEFAULT_HTTP_PORT = 8790;
+/**
+ * 令牌长度下限。128 位随机（32 个 hex 字符）是常态；24 个字符足够排除"随手敲一个"，
+ * 又不至于逼人非得用某个特定长度。
+ */
+export const MIN_TOKEN_CHARS = 24;
+/** 允许绑定的地址。**只回环**：`0.0.0.0` 不在此列，而且不是"忘了加"。 */
+export const LOOPBACK_HOSTS = ['127.0.0.1', 'localhost', '::1'];
+/** 这一轮是不是要走 HTTP。`--http`、`--http=8790`、`WEFLOW_MCP_HTTP=1` 都算。 */
+export function httpModeRequested(env, argv) {
+    if (argv.some((a) => a === '--http' || a.startsWith('--http=')))
+        return true;
+    const value = String(env.WEFLOW_MCP_HTTP ?? '').trim();
+    return value !== '' && value !== '0' && value.toLowerCase() !== 'false';
+}
+function flagValue(argv, name) {
+    const hit = argv.find((a) => a.startsWith(`${name}=`));
+    return hit ? hit.slice(name.length + 1) : undefined;
+}
+/**
+ * 解出 HTTP 模式的参数。**不走 HTTP 就返回 `null`**；要走但配置不合法就**抛错**（fail closed，
+ * 绝不"降级成不安全的默认值"继续跑）。
+ *
+ * 端口允许 `0`：那是让内核挑一个空闲端口，测试要用；正式跑用默认端口。
+ */
+export function resolveHttpOptions(env, argv) {
+    if (!httpModeRequested(env, argv))
+        return null;
+    const token = String(flagValue(argv, '--token') ?? env.WEFLOW_MCP_TOKEN ?? '').trim();
+    if (!token) {
+        throw new Error('HTTP 模式必须给令牌：`--token=<随机串>` 或环境变量 WEFLOW_MCP_TOKEN。\n'
+            + '没有默认值是有意的 —— 一个自动生成、只在日志里露一面的口令，看起来像"配好了"。\n'
+            + '生成一个：node -e "console.log(require(\'crypto\').randomBytes(32).toString(\'hex\'))"');
+    }
+    if (token.length < MIN_TOKEN_CHARS) {
+        throw new Error(`令牌太短（${token.length} < ${MIN_TOKEN_CHARS} 个字符）。用随机串，别用可猜的短语。`);
+    }
+    const host = String(flagValue(argv, '--host') ?? '127.0.0.1').trim();
+    if (!LOOPBACK_HOSTS.includes(host)) {
+        throw new Error(`只允许绑回环地址（${LOOPBACK_HOSTS.join(' / ')}），收到 ${host}。\n`
+            + '要从别的机器连，用 SSH 隧道（ssh -L 8790:127.0.0.1:8790 <host>）或自己的反向代理 —— '
+            + '把聊天记录摊到局域网上不该由这个命令顺手打开。');
+    }
+    const raw = flagValue(argv, '--http') ?? flagValue(argv, '--port') ?? env.WEFLOW_MCP_HTTP_PORT ?? String(DEFAULT_HTTP_PORT);
+    const rawText = String(raw).trim();
+    // 先按"纯数字"卡一道：`Number('') === 0`，不卡的话空值会静默变成一个端口。
+    if (!/^\d{1,5}$/.test(rawText)) {
+        throw new Error(`端口要 0-65535 之间的整数（0 = 让系统挑一个空闲端口），收到 ${JSON.stringify(raw)}`);
+    }
+    const port = Number(rawText);
+    if (port > 65535) {
+        throw new Error(`端口要 0-65535 之间的整数，收到 ${JSON.stringify(raw)}`);
+    }
+    return { host, port, token };
+}
+/**
+ * `Authorization` 头认不认。
+ *
+ * 比的是**摘要**而不是原文：`timingSafeEqual` 要求等长，直接比长度会漏出"令牌有多长"，
+ * 于是"不同长度直接返回 false"就成了一个可测的短路径。两边先过一遍 SHA-256，长度就固定了。
+ * 方案名按 RFC 7235 大小写不敏感。
+ */
+export function isAuthorized(header, token) {
+    const raw = String(header ?? '');
+    const space = raw.indexOf(' ');
+    if (space < 0)
+        return false;
+    if (raw.slice(0, space).toLowerCase() !== 'bearer')
+        return false;
+    const presented = raw.slice(space + 1).trim();
+    if (!presented)
+        return false;
+    const digest = (value) => createHash('sha256').update(value, 'utf8').digest();
+    return timingSafeEqual(digest(presented), digest(token));
+}
+/** Host 头允许的取值（DNS 重绑定防护用）。带端口，因为 SDK 比的是**原始 Host 头**。 */
+export function allowedHostsFor(host, port) {
+    const forms = new Set();
+    for (const h of host === 'localhost' ? ['127.0.0.1', 'localhost'] : [host]) {
+        forms.add(h === '::1' ? `[::1]:${port}` : `${h}:${port}`);
+    }
+    return [...forms];
+}
+/** 允许的 Origin（浏览器来的请求会带；命令行客户端通常不带，不带就放行）。 */
+export function allowedOriginsFor(host, port) {
+    return allowedHostsFor(host, port).map((h) => `http://${h}`);
+}
+//# sourceMappingURL=httpConfig.js.map

package/dist/mcp-server/httpConfig.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"httpConfig.js","sourceRoot":"","sources":["../../mcp-server/httpConfig.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,aAAa,CAAA;AAEzD,yCAAyC;AACzC,MAAM,CAAC,MAAM,iBAAiB,GAAG,IAAI,CAAA;AAErC;;;GAGG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,EAAE,CAAA;AAEjC,gDAAgD;AAChD,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,WAAW,EAAE,WAAW,EAAE,KAAK,CAAC,CAAA;AAQ/D,mEAAmE;AACnE,MAAM,UAAU,iBAAiB,CAAC,GAAuC,EAAE,IAAc;IACvF,IAAI,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;QAAE,OAAO,IAAI,CAAA;IAC5E,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,eAAe,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAA;IACtD,OAAO,KAAK,KAAK,EAAE,IAAI,KAAK,KAAK,GAAG,IAAI,KAAK,CAAC,WAAW,EAAE,KAAK,OAAO,CAAA;AACzE,CAAC;AAED,SAAS,SAAS,CAAC,IAAc,EAAE,IAAY;IAC7C,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,CAAA;IACtD,OAAO,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAA;AACrD,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,kBAAkB,CAChC,GAAuC,EACvC,IAAc;IAEd,IAAI,CAAC,iBAAiB,CAAC,GAAG,EAAE,IAAI,CAAC;QAAE,OAAO,IAAI,CAAA;IAE9C,MAAM,KAAK,GAAG,MAAM,CAAC,SAAS,CAAC,IAAI,EAAE,SAAS,CAAC,IAAI,GAAG,CAAC,gBAAgB,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAA;IACrF,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,IAAI,KAAK,CACb,wDAAwD;cACtD,8CAA8C;cAC9C,mFAAmF,CACtF,CAAA;IACH,CAAC;IACD,IAAI,KAAK,CAAC,MAAM,GAAG,eAAe,EAAE,CAAC;QACnC,MAAM,IAAI,KAAK,CAAC,QAAQ,KAAK,CAAC,MAAM,MAAM,eAAe,qBAAqB,CAAC,CAAA;IACjF,CAAC;IAED,MAAM,IAAI,GAAG,MAAM,CAAC,SAAS,CAAC,IAAI,EAAE,QAAQ,CAAC,IAAI,WAAW,CAAC,CAAC,IAAI,EAAE,CAAA;IACpE,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QACnC,MAAM,IAAI,KAAK,CACb,YAAY,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,IAAI,KAAK;cACrD,iEAAiE;cACjE,yBAAyB,CAC5B,CAAA;IACH,CAAC;IAED,MAAM,GAAG,GAAG,SAAS,CAAC,IAAI,EAAE,QAAQ,CAAC,IAAI,SAAS,CAAC,IAAI,EAAE,QAAQ,CAAC,IAAI,GAAG,CAAC,oBAAoB,IAAI,MAAM,CAAC,iBAAiB,CAAC,CAAA;IAC3H,MAAM,OAAO,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAA;IAClC,iDAAiD;IACjD,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QAC/B,MAAM,IAAI,KAAK,CAAC,wCAAwC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;IAChF,CAAC;IACD,MAAM,IAAI,GAAG,MAAM,CAAC,OAAO,CAAC,CAAA;IAC5B,IAAI,IAAI,GAAG,KAAK,EAAE,CAAC;QACjB,MAAM,IAAI,KAAK,CAAC,wBAAwB,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;IAChE,CAAC;IAED,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAA;AAC9B,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,YAAY,CAAC,MAA0B,EAAE,KAAa;IACpE,MAAM,GAAG,GAAG,MAAM,CAAC,MAAM,IAAI,EAAE,CAAC,CAAA;IAChC,MAAM,KAAK,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;IAC9B,IAAI,KAAK,GAAG,CAAC;QAAE,OAAO,KAAK,CAAA;IAC3B,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,WAAW,EAAE,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAA;IAChE,MAAM,SAAS,GAAG,GAAG,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAA;IAC7C,IAAI,CAAC,SAAS;QAAE,OAAO,KAAK,CAAA;IAE5B,MAAM,MAAM,GAAG,CAAC,KAAa,EAAE,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,MAAM,EAAE,CAAA;IACrF,OAAO,eAAe,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAA;AAC1D,CAAC;AAED,2DAA2D;AAC3D,MAAM,UAAU,eAAe,CAAC,IAAY,EAAE,IAAY;IACxD,MAAM,KAAK,GAAG,IAAI,GAAG,EAAU,CAAA;IAC/B,KAAK,MAAM,CAAC,IAAI,IAAI,KAAK,WAAW,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC;QAC3E,KAAK,CAAC,GAAG,CAAC,CAAC,KAAK,KAAK,CAAC,CAAC,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC,CAAA;IAC3D,CAAC;IACD,OAAO,CAAC,GAAG,KAAK,CAAC,CAAA;AACnB,CAAC;AAED,8CAA8C;AAC9C,MAAM,UAAU,iBAAiB,CAAC,IAAY,EAAE,IAAY;IAC1D,OAAO,eAAe,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,EAAE,CAAC,CAAA;AAC9D,CAAC"}

package/dist/mcp-server/index.d.ts

@@ -1,3 +1,15 @@
 #!/usr/bin/env npx tsx
-export {};
+/**
+ * WeFlow MCP Server — 让 Claude Code 等 AI Agent 直接查询知识库。
+ *
+ * 启动: npx tsx mcp-server/index.ts                          （stdio，默认）
+ *      npx tsx mcp-server/index.ts --http --token=<随机串>    （HTTP，只绑回环）
+ *
+ * 两条传输的工具集**完全一样**（同一张 `TOOL_DEFS` 派生表），变的只是搬运动作的方式。
+ * HTTP 那条的边界（必须带令牌、只绑回环、DNS 重绑定防护）在 `httpConfig.ts` / `http.ts`，
+ * 理由与用法写在 docs/MCP.md 的「HTTP 传输」一节。
+ */
+import { Server } from '@modelcontextprotocol/sdk/server/index.js';
+/** 建一个 MCP Server（工具表与处理器）。stdio 与 HTTP 两条传输都用它，**每次都新建**无状态。 */
+export declare function buildServer(): Server;
 //# sourceMappingURL=index.d.ts.map

package/dist/mcp-server/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../mcp-server/index.ts"],"names":[],"mappings":""}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../mcp-server/index.ts"],"names":[],"mappings":";AACA;;;;;;;;;GASG;AACH,OAAO,EAAE,MAAM,EAAE,MAAM,2CAA2C,CAAA;AA6KlE,iEAAiE;AACjE,wBAAgB,WAAW,IAAI,MAAM,CAkIpC"}