winhelm-mcp 1.1.0

package/dist/gateway/server.js

@@ -0,0 +1,337 @@
+import express from "express";
+import cors from "cors";
+import crypto from "node:crypto";
+import { ConfigManager } from "../config/config-manager.js";
+import { SseGateway } from "./sse-gateway.js";
+import { StreamableGateway } from "./streamable-gateway.js";
+import { logger } from "../utils/logger.js";
+import { fileLogger } from "../utils/file-logger.js";
+import { taskManager } from "../engine/task-manager.js";
+import { RateLimiter } from "./rate-limiter.js";
+import { getDashboardHtml } from "./dashboard-html.js";
+import { getFilePreviewHtml } from "./preview-html.js";
+import { getGpuInfo, getSystemInfo } from "../engine/system.js";
+export function safeCompare(a, b) {
+    const bufA = Buffer.from(a);
+    const bufB = Buffer.from(b);
+    if (bufA.length !== bufB.length)
+        return false;
+    return crypto.timingSafeEqual(bufA, bufB);
+}
+/**
+ * Validate Host header against loopback, bound interface, and allowed hosts whitelist (DNS Rebinding protection)
+ */
+export function isHostAllowed(hostHeader, allowedHosts = ["localhost", "127.0.0.1", "[::1]", "*.ts.net"], bindHost = "127.0.0.1") {
+    if (!hostHeader)
+        return false;
+    let hostname;
+    const cleanHeader = hostHeader.trim().toLowerCase();
+    // Handle IPv6 literal with brackets [::1]:port or naked ::1
+    if (cleanHeader.startsWith("[")) {
+        const endBracket = cleanHeader.indexOf("]");
+        hostname = endBracket !== -1 ? cleanHeader.slice(1, endBracket) : cleanHeader;
+    }
+    else if (cleanHeader === "::1" || cleanHeader.startsWith("::1:")) {
+        hostname = "::1";
+    }
+    else {
+        hostname = cleanHeader.split(":")[0];
+    }
+    // Always permit loopback interfaces
+    if (hostname === "localhost" ||
+        hostname === "127.0.0.1" ||
+        hostname === "::1" ||
+        hostname === "[::1]") {
+        return true;
+    }
+    // Permit explicitly configured bind host interface
+    if (bindHost && hostname === bindHost.toLowerCase()) {
+        return true;
+    }
+    // Check allowed hosts whitelist (supports wildcard prefixes like *.ts.net, *.example.com)
+    return allowedHosts.some((pattern) => {
+        const p = pattern.trim().toLowerCase();
+        if (p === "*")
+            return true;
+        if (p.startsWith("*.")) {
+            const suffix = p.slice(1);
+            return hostname.endsWith(suffix) || hostname === p.slice(2);
+        }
+        return hostname === p;
+    });
+}
+export function createServer(options) {
+    const app = express();
+    // Trust proxy for loopback reverse proxies (Tailscale Funnel, local tunnel clients)
+    app.set("trust proxy", "loopback");
+    const configManager = ConfigManager.getInstance();
+    const config = configManager.getConfig();
+    const authToken = options.authToken ?? config.authToken;
+    // 1. Global Security Headers (Prevent MIME sniffing and Clickjacking)
+    app.use((_req, res, next) => {
+        res.setHeader("X-Content-Type-Options", "nosniff");
+        res.setHeader("X-Frame-Options", "DENY");
+        next();
+    });
+    // 2. Host Header Validation Guard (Mitigates DNS Rebinding attacks)
+    app.use((req, res, next) => {
+        const hostHeader = req.get("host") || "";
+        const allowed = config.allowedHosts || ["localhost", "127.0.0.1", "[::1]", "*.ts.net"];
+        if (!isHostAllowed(hostHeader, allowed, options.host)) {
+            logger.security("Blocked request with unauthorized Host header (DNS Rebinding protection)", `Host: ${hostHeader} | IP: ${req.ip}`);
+            res.status(403).json({
+                error: "Forbidden: Host header not permitted by WinHelm security policy",
+            });
+            return;
+        }
+        next();
+    });
+    // 3. Remote Proxy / Tunnel Security Guard (Fail-closed when no auth token is configured)
+    if (!authToken) {
+        app.use((req, res, next) => {
+            if (req.headers["x-forwarded-for"] || req.headers["forwarded"]) {
+                logger.security("Blocked unauthenticated remote proxy/tunnel request", `Path: ${req.path} | IP: ${req.ip} | X-Forwarded-For: ${req.headers["x-forwarded-for"]}`);
+                res.status(403).json({
+                    error: "Forbidden: Remote proxy/tunnel access is strictly blocked when no authentication token is configured. Set an authToken or --auth.",
+                });
+                return;
+            }
+            next();
+        });
+    }
+    const sseGateway = new SseGateway(config.sessionIdleTimeoutMs, config.maxConcurrentSessions);
+    const streamableGateway = new StreamableGateway(config.sessionIdleTimeoutMs, config.maxConcurrentSessions);
+    const rateLimiter = new RateLimiter();
+    // Cache system info for 2.5s to avoid PowerShell overhead during continuous polling
+    let cachedSystemInfo = null;
+    let lastSystemInfoFetch = 0;
+    async function getCachedSystemInfo() {
+        const now = Date.now();
+        if (!cachedSystemInfo || now - lastSystemInfoFetch > 2500) {
+            try {
+                cachedSystemInfo = await getSystemInfo();
+                lastSystemInfoFetch = now;
+            }
+            catch {
+                // Fallback to previous cache if exists
+            }
+        }
+        return cachedSystemInfo || {};
+    }
+    // Cache GPU info for 5s
+    let cachedGpuInfo = null;
+    let lastGpuInfoFetch = 0;
+    async function getCachedGpuInfo() {
+        const now = Date.now();
+        if (!cachedGpuInfo || now - lastGpuInfoFetch > 5000) {
+            try {
+                cachedGpuInfo = await getGpuInfo();
+                lastGpuInfoFetch = now;
+            }
+            catch {
+                // Fallback
+            }
+        }
+        return cachedGpuInfo;
+    }
+    // 4. CORS configuration: restricts web browser cross-origin requests
+    const corsOption = config.corsOrigins;
+    if (corsOption === true || corsOption === "*") {
+        app.use(cors({ origin: "*" }));
+    }
+    else if (Array.isArray(corsOption) || typeof corsOption === "string") {
+        app.use(cors({ origin: corsOption }));
+    }
+    else {
+        // Default: permit local requests and loopback origins
+        app.use(cors({
+            origin: (origin, callback) => {
+                if (!origin)
+                    return callback(null, true);
+                if (/^https?:\/\/(localhost|127\.0\.0\.1)(:\d+)?$/.test(origin)) {
+                    return callback(null, true);
+                }
+                return callback(new Error("CORS origin not allowed by WinHelm security policy"));
+            },
+        }));
+    }
+    // Detailed Request Logger Middleware
+    app.use((req, res, next) => {
+        const start = Date.now();
+        res.on("finish", () => {
+            const duration = Date.now() - start;
+            const isInternalPolling = req.path === "/health" ||
+                req.path.startsWith("/api/monitor/") ||
+                req.path === "/" ||
+                req.path === "/dashboard";
+            // Only print terminal logs for MCP protocol and external actions, keeping terminal clean & stable
+            if (!isInternalPolling) {
+                const sessionId = (req.headers["mcp-session-id"] || req.query.sessionId);
+                const clientIp = req.ip || req.socket.remoteAddress || "-";
+                logger.req(req.method, req.originalUrl, res.statusCode, duration, clientIp, sessionId);
+            }
+        });
+        next();
+    });
+    // Rate Limiting Guard
+    app.use(rateLimiter.middleware());
+    // Bearer Authentication Guard
+    if (authToken) {
+        logger.security("Bearer authentication guard is ACTIVE");
+        app.use((req, res, next) => {
+            // Allow only lightweight public endpoints: health check and basic dashboard shell
+            if (req.path === "/health" || req.path === "/" || req.path === "/dashboard") {
+                return next();
+            }
+            // 1. Check standard Authorization header (timing-safe comparison)
+            const authHeader = req.headers.authorization;
+            if (authHeader && safeCompare(authHeader, `Bearer ${authToken}`)) {
+                return next();
+            }
+            // 2. Fallback for URL query parameter (Claude.ai custom connectors without header UI, browser dashboard, preview) or cookie
+            const queryToken = (req.query.token || req.query.auth);
+            const cookieHeader = req.headers.cookie;
+            let cookieToken;
+            if (cookieHeader) {
+                const match = cookieHeader.match(/(?:^|;\s*)(?:authToken|token|auth)=([^;]+)/);
+                if (match) {
+                    cookieToken = decodeURIComponent(match[1]);
+                }
+            }
+            const browserToken = queryToken || cookieToken;
+            if (browserToken && safeCompare(browserToken, authToken)) {
+                if (queryToken && !cookieToken) {
+                    const isSecure = req.secure || req.headers["x-forwarded-proto"] === "https";
+                    res.setHeader("Set-Cookie", `authToken=${encodeURIComponent(queryToken)}; Path=/; HttpOnly; SameSite=Lax; Max-Age=2592000${isSecure ? "; Secure" : ""}`);
+                }
+                return next();
+            }
+            logger.security("Unauthorized request blocked", `Path: ${req.path} | IP: ${req.ip}`);
+            res.status(401).json({ error: "Unauthorized: Invalid or missing Bearer token" });
+        });
+    }
+    else {
+        logger.info("Public network mode active (No auth token set)");
+    }
+    // Web Monitor Dashboard
+    app.get(["/", "/dashboard"], (_req, res) => {
+        res.setHeader("Content-Type", "text/html; charset=utf-8");
+        const activeProfile = configManager.getConfig().profile || "full";
+        res.send(getDashboardHtml(activeProfile));
+    });
+    // Interactive File & Markdown Previewer
+    app.get("/preview", async (req, res) => {
+        const filePath = req.query.path;
+        if (!filePath) {
+            res.status(400).send("Missing ?path= parameter");
+            return;
+        }
+        const html = await getFilePreviewHtml(filePath);
+        res.setHeader("Content-Type", "text/html; charset=utf-8");
+        res.setHeader("Content-Security-Policy", "default-src 'none'; script-src 'unsafe-inline'; style-src 'unsafe-inline'; img-src data:; frame-src data:; connect-src 'none'; form-action 'none'; frame-ancestors 'none';");
+        res.send(html);
+    });
+    // Health check endpoint
+    app.get("/health", (_req, res) => {
+        res.json({
+            status: "ok",
+            server: "winhelm-mcp",
+            version: "1.1.0",
+            activeSessions: {
+                sse: sseGateway.getActiveSessionCount(),
+                streamableHttp: streamableGateway.getActiveSessionCount(),
+            },
+            uptimeSeconds: Math.floor(process.uptime()),
+            timestamp: new Date().toISOString(),
+        });
+    });
+    // Monitor Stats API
+    app.get("/api/monitor/stats", async (_req, res) => {
+        const sys = await getCachedSystemInfo();
+        const gpu = await getCachedGpuInfo();
+        res.json({
+            server: "winhelm-mcp",
+            version: "1.1.0",
+            port: options.port,
+            host: options.host,
+            readOnly: configManager.isReadOnly(),
+            uptimeSeconds: Math.floor(process.uptime()),
+            activeSessions: {
+                sse: sseGateway.getActiveSessionCount(),
+                streamableHttp: streamableGateway.getActiveSessionCount(),
+            },
+            backgroundTasks: taskManager.listTasks().length,
+            system: sys,
+            gpu: gpu,
+        });
+    });
+    // Monitor Logs API
+    app.get("/api/monitor/logs", (_req, res) => {
+        res.json({
+            logs: logger.getRecentLogs(100),
+        });
+    });
+    app.delete("/api/monitor/logs", (_req, res) => {
+        logger.clearLogs();
+        res.json({ success: true, message: "Logs cleared" });
+    });
+    // Audit Logs Export API (JSON or CSV)
+    app.get("/api/monitor/export", async (req, res) => {
+        const format = req.query.format === "csv" ? "csv" : "json";
+        const data = await fileLogger.exportLogs(format);
+        if (format === "csv") {
+            res.setHeader("Content-Type", "text/csv");
+            res.setHeader("Content-Disposition", 'attachment; filename="winhelm-audit.csv"');
+        }
+        else {
+            res.setHeader("Content-Type", "application/json");
+            res.setHeader("Content-Disposition", 'attachment; filename="winhelm-audit.json"');
+        }
+        res.send(data);
+    });
+    // Streamable HTTP Endpoint (/mcp)
+    app.all("/mcp", (req, res) => streamableGateway.handleRequest(req, res));
+    // SSE Endpoints (/sse & /message)
+    app.get("/sse", (req, res) => sseGateway.handleSseConnect(req, res));
+    app.post("/message", (req, res) => sseGateway.handlePostMessage(req, res));
+    const start = () => {
+        return new Promise((resolve) => {
+            const server = app.listen(options.port, options.host, () => {
+                console.log(`\n======================================================`);
+                console.log(`  🚀 WinHelm MCP Server is running!`);
+                console.log(`======================================================`);
+                console.log(`  - Web Monitor:     http://localhost:${options.port}/`);
+                console.log(`  - Streamable HTTP: http://${options.host}:${options.port}/mcp`);
+                console.log(`  - SSE Endpoint:    http://${options.host}:${options.port}/sse`);
+                console.log(`  - SSE Message:     http://${options.host}:${options.port}/message`);
+                console.log(`  - Health Check:    http://${options.host}:${options.port}/health`);
+                console.log(`======================================================\n`);
+                resolve(server);
+            });
+        });
+    };
+    const stop = async (server) => {
+        // 1. Kill any active background tasks
+        taskManager.killAll();
+        // 2. Close MCP Sessions
+        await Promise.all([
+            sseGateway.closeAll().catch(() => { }),
+            streamableGateway.closeAll().catch(() => { }),
+        ]);
+        // 3. Close network sockets
+        return new Promise((resolve) => {
+            if (typeof server.closeAllConnections === "function") {
+                server.closeAllConnections();
+            }
+            server.close(() => {
+                resolve();
+            });
+            const safetyTimer = setTimeout(() => {
+                resolve();
+            }, 800);
+            safetyTimer.unref();
+        });
+    };
+    return { app, start, stop };
+}
+//# sourceMappingURL=server.js.map

package/dist/gateway/server.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"server.js","sourceRoot":"","sources":["../../src/gateway/server.ts"],"names":[],"mappings":"AAAA,OAAO,OAAyE,MAAM,SAAS,CAAC;AAChG,OAAO,IAAI,MAAM,MAAM,CAAC;AACxB,OAAO,MAAM,MAAM,aAAa,CAAC;AAEjC,OAAO,EAAE,aAAa,EAAE,MAAM,6BAA6B,CAAC;AAC5D,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAC9C,OAAO,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AAC5D,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAC5C,OAAO,EAAE,UAAU,EAAE,MAAM,yBAAyB,CAAC;AACrD,OAAO,EAAE,WAAW,EAAE,MAAM,2BAA2B,CAAC;AACxD,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AACvD,OAAO,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AACvD,OAAO,EAAE,UAAU,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAShE,MAAM,UAAU,WAAW,CAAC,CAAS,EAAE,CAAS;IAC9C,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC5B,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC5B,IAAI,IAAI,CAAC,MAAM,KAAK,IAAI,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IAC9C,OAAO,MAAM,CAAC,eAAe,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;AAC5C,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,aAAa,CAC3B,UAAmB,EACnB,YAAY,GAAa,CAAC,WAAW,EAAE,WAAW,EAAE,OAAO,EAAE,UAAU,CAAC,EACxE,QAAQ,GAAG,WAAW;IAEtB,IAAI,CAAC,UAAU;QAAE,OAAO,KAAK,CAAC;IAC9B,IAAI,QAAgB,CAAC;IACrB,MAAM,WAAW,GAAG,UAAU,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAEpD,4DAA4D;IAC5D,IAAI,WAAW,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QAChC,MAAM,UAAU,GAAG,WAAW,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAC5C,QAAQ,GAAG,UAAU,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,EAAE,UAAU,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC;IAChF,CAAC;SAAM,IAAI,WAAW,KAAK,KAAK,IAAI,WAAW,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;QACnE,QAAQ,GAAG,KAAK,CAAC;IACnB,CAAC;SAAM,CAAC;QACN,QAAQ,GAAG,WAAW,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IACvC,CAAC;IAED,oCAAoC;IACpC,IACE,QAAQ,KAAK,WAAW;QACxB,QAAQ,KAAK,WAAW;QACxB,QAAQ,KAAK,KAAK;QAClB,QAAQ,KAAK,OAAO,EACpB,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,mDAAmD;IACnD,IAAI,QAAQ,IAAI,QAAQ,KAAK,QAAQ,CAAC,WAAW,EAAE,EAAE,CAAC;QACpD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,0FAA0F;IAC1F,OAAO,YAAY,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE;QACnC,MAAM,CAAC,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QACvC,IAAI,CAAC,KAAK,GAAG;YAAE,OAAO,IAAI,CAAC;QAC3B,IAAI,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;YACvB,MAAM,MAAM,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;YAC1B,OAAO,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,QAAQ,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QAC9D,CAAC;QACD,OAAO,QAAQ,KAAK,CAAC,CAAC;IACxB,CAAC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,OAAsB;IAKjD,MAAM,GAAG,GAAG,OAAO,EAAE,CAAC;IACtB,oFAAoF;IACpF,GAAG,CAAC,GAAG,CAAC,aAAa,EAAE,UAAU,CAAC,CAAC;IACnC,MAAM,aAAa,GAAG,aAAa,CAAC,WAAW,EAAE,CAAC;IAClD,MAAM,MAAM,GAAG,aAAa,CAAC,SAAS,EAAE,CAAC;IACzC,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,MAAM,CAAC,SAAS,CAAC;IAExD,sEAAsE;IACtE,GAAG,CAAC,GAAG,CAAC,CAAC,IAAa,EAAE,GAAa,EAAE,IAAkB,EAAE,EAAE;QAC3D,GAAG,CAAC,SAAS,CAAC,wBAAwB,EAAE,SAAS,CAAC,CAAC;QACnD,GAAG,CAAC,SAAS,CAAC,iBAAiB,EAAE,MAAM,CAAC,CAAC;QACzC,IAAI,EAAE,CAAC;IACT,CAAC,CAAC,CAAC;IAEH,oEAAoE;IACpE,GAAG,CAAC,GAAG,CAAC,CAAC,GAAY,EAAE,GAAa,EAAE,IAAkB,EAAE,EAAE;QAC1D,MAAM,UAAU,GAAG,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;QACzC,MAAM,OAAO,GAAG,MAAM,CAAC,YAAY,IAAI,CAAC,WAAW,EAAE,WAAW,EAAE,OAAO,EAAE,UAAU,CAAC,CAAC;QACvF,IAAI,CAAC,aAAa,CAAC,UAAU,EAAE,OAAO,EAAE,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;YACtD,MAAM,CAAC,QAAQ,CACb,0EAA0E,EAC1E,SAAS,UAAU,UAAU,GAAG,CAAC,EAAE,EAAE,CACtC,CAAC;YACF,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBACnB,KAAK,EAAE,iEAAiE;aACzE,CAAC,CAAC;YACH,OAAO;QACT,CAAC;QACD,IAAI,EAAE,CAAC;IACT,CAAC,CAAC,CAAC;IAEH,yFAAyF;IACzF,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,GAAG,CAAC,GAAG,CAAC,CAAC,GAAY,EAAE,GAAa,EAAE,IAAkB,EAAE,EAAE;YAC1D,IAAI,GAAG,CAAC,OAAO,CAAC,iBAAiB,CAAC,IAAI,GAAG,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE,CAAC;gBAC/D,MAAM,CAAC,QAAQ,CACb,qDAAqD,EACrD,SAAS,GAAG,CAAC,IAAI,UAAU,GAAG,CAAC,EAAE,uBAAuB,GAAG,CAAC,OAAO,CAAC,iBAAiB,CAAC,EAAE,CACzF,CAAC;gBACF,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;oBACnB,KAAK,EAAE,mIAAmI;iBAC3I,CAAC,CAAC;gBACH,OAAO;YACT,CAAC;YACD,IAAI,EAAE,CAAC;QACT,CAAC,CAAC,CAAC;IACL,CAAC;IAED,MAAM,UAAU,GAAG,IAAI,UAAU,CAAC,MAAM,CAAC,oBAAoB,EAAE,MAAM,CAAC,qBAAqB,CAAC,CAAC;IAC7F,MAAM,iBAAiB,GAAG,IAAI,iBAAiB,CAAC,MAAM,CAAC,oBAAoB,EAAE,MAAM,CAAC,qBAAqB,CAAC,CAAC;IAC3G,MAAM,WAAW,GAAG,IAAI,WAAW,EAAE,CAAC;IAEtC,oFAAoF;IACpF,IAAI,gBAAgB,GAAsB,IAAI,CAAC;IAC/C,IAAI,mBAAmB,GAAG,CAAC,CAAC;IAE5B,KAAK,UAAU,mBAAmB;QAChC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,IAAI,CAAC,gBAAgB,IAAI,GAAG,GAAG,mBAAmB,GAAG,IAAI,EAAE,CAAC;YAC1D,IAAI,CAAC;gBACH,gBAAgB,GAAG,MAAM,aAAa,EAAE,CAAC;gBACzC,mBAAmB,GAAG,GAAG,CAAC;YAC5B,CAAC;YAAC,MAAM,CAAC;gBACP,uCAAuC;YACzC,CAAC;QACH,CAAC;QACD,OAAO,gBAAgB,IAAI,EAAE,CAAC;IAChC,CAAC;IAED,wBAAwB;IACxB,IAAI,aAAa,GAAyB,IAAI,CAAC;IAC/C,IAAI,gBAAgB,GAAG,CAAC,CAAC;IAEzB,KAAK,UAAU,gBAAgB;QAC7B,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,IAAI,CAAC,aAAa,IAAI,GAAG,GAAG,gBAAgB,GAAG,IAAI,EAAE,CAAC;YACpD,IAAI,CAAC;gBACH,aAAa,GAAG,MAAM,UAAU,EAAE,CAAC;gBACnC,gBAAgB,GAAG,GAAG,CAAC;YACzB,CAAC;YAAC,MAAM,CAAC;gBACP,WAAW;YACb,CAAC;QACH,CAAC;QACD,OAAO,aAAa,CAAC;IACvB,CAAC;IAED,qEAAqE;IACrE,MAAM,UAAU,GAAG,MAAM,CAAC,WAAW,CAAC;IACtC,IAAI,UAAU,KAAK,IAAI,IAAI,UAAU,KAAK,GAAG,EAAE,CAAC;QAC9C,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC;IACjC,CAAC;SAAM,IAAI,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,IAAI,OAAO,UAAU,KAAK,QAAQ,EAAE,CAAC;QACvE,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC;IACxC,CAAC;SAAM,CAAC;QACN,sDAAsD;QACtD,GAAG,CAAC,GAAG,CACL,IAAI,CAAC;YACH,MAAM,EAAE,CAAC,MAAM,EAAE,QAAQ,EAAE,EAAE;gBAC3B,IAAI,CAAC,MAAM;oBAAE,OAAO,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;gBACzC,IAAI,8CAA8C,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;oBAChE,OAAO,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;gBAC9B,CAAC;gBACD,OAAO,QAAQ,CAAC,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC,CAAC;YACnF,CAAC;SACF,CAAC,CACH,CAAC;IACJ,CAAC;IAED,qCAAqC;IACrC,GAAG,CAAC,GAAG,CAAC,CAAC,GAAY,EAAE,GAAa,EAAE,IAAkB,EAAE,EAAE;QAC1D,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACzB,GAAG,CAAC,EAAE,CAAC,QAAQ,EAAE,GAAG,EAAE;YACpB,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC;YACpC,MAAM,iBAAiB,GACrB,GAAG,CAAC,IAAI,KAAK,SAAS;gBACtB,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,eAAe,CAAC;gBACpC,GAAG,CAAC,IAAI,KAAK,GAAG;gBAChB,GAAG,CAAC,IAAI,KAAK,YAAY,CAAC;YAE5B,kGAAkG;YAClG,IAAI,CAAC,iBAAiB,EAAE,CAAC;gBACvB,MAAM,SAAS,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,gBAAgB,CAAC,IAAI,GAAG,CAAC,KAAK,CAAC,SAAS,CAAuB,CAAC;gBAC/F,MAAM,QAAQ,GAAG,GAAG,CAAC,EAAE,IAAI,GAAG,CAAC,MAAM,CAAC,aAAa,IAAI,GAAG,CAAC;gBAC3D,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,WAAW,EAAE,GAAG,CAAC,UAAU,EAAE,QAAQ,EAAE,QAAQ,EAAE,SAAS,CAAC,CAAC;YACzF,CAAC;QACH,CAAC,CAAC,CAAC;QACH,IAAI,EAAE,CAAC;IACT,CAAC,CAAC,CAAC;IAEH,sBAAsB;IACtB,GAAG,CAAC,GAAG,CAAC,WAAW,CAAC,UAAU,EAAE,CAAC,CAAC;IAElC,8BAA8B;IAC9B,IAAI,SAAS,EAAE,CAAC;QACd,MAAM,CAAC,QAAQ,CAAC,uCAAuC,CAAC,CAAC;QACzD,GAAG,CAAC,GAAG,CAAC,CAAC,GAAY,EAAE,GAAa,EAAE,IAAkB,EAAE,EAAE;YAC1D,kFAAkF;YAClF,IAAI,GAAG,CAAC,IAAI,KAAK,SAAS,IAAI,GAAG,CAAC,IAAI,KAAK,GAAG,IAAI,GAAG,CAAC,IAAI,KAAK,YAAY,EAAE,CAAC;gBAC5E,OAAO,IAAI,EAAE,CAAC;YAChB,CAAC;YAED,kEAAkE;YAClE,MAAM,UAAU,GAAG,GAAG,CAAC,OAAO,CAAC,aAAa,CAAC;YAC7C,IAAI,UAAU,IAAI,WAAW,CAAC,UAAU,EAAE,UAAU,SAAS,EAAE,CAAC,EAAE,CAAC;gBACjE,OAAO,IAAI,EAAE,CAAC;YAChB,CAAC;YAED,4HAA4H;YAC5H,MAAM,UAAU,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,IAAI,GAAG,CAAC,KAAK,CAAC,IAAI,CAAuB,CAAC;YAC7E,MAAM,YAAY,GAAG,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC;YACxC,IAAI,WAA+B,CAAC;YACpC,IAAI,YAAY,EAAE,CAAC;gBACjB,MAAM,KAAK,GAAG,YAAY,CAAC,KAAK,CAAC,4CAA4C,CAAC,CAAC;gBAC/E,IAAI,KAAK,EAAE,CAAC;oBACV,WAAW,GAAG,kBAAkB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;gBAC7C,CAAC;YACH,CAAC;YAED,MAAM,YAAY,GAAG,UAAU,IAAI,WAAW,CAAC;YAC/C,IAAI,YAAY,IAAI,WAAW,CAAC,YAAY,EAAE,SAAS,CAAC,EAAE,CAAC;gBACzD,IAAI,UAAU,IAAI,CAAC,WAAW,EAAE,CAAC;oBAC/B,MAAM,QAAQ,GAAG,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,OAAO,CAAC,mBAAmB,CAAC,KAAK,OAAO,CAAC;oBAC5E,GAAG,CAAC,SAAS,CACX,YAAY,EACZ,aAAa,kBAAkB,CAAC,UAAU,CAAC,oDAAoD,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,EAAE,CAC5H,CAAC;gBACJ,CAAC;gBACD,OAAO,IAAI,EAAE,CAAC;YAChB,CAAC;YAED,MAAM,CAAC,QAAQ,CAAC,8BAA8B,EAAE,SAAS,GAAG,CAAC,IAAI,UAAU,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC;YACrF,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,+CAA+C,EAAE,CAAC,CAAC;QACnF,CAAC,CAAC,CAAC;IACL,CAAC;SAAM,CAAC;QACN,MAAM,CAAC,IAAI,CAAC,gDAAgD,CAAC,CAAC;IAChE,CAAC;IAED,wBAAwB;IACxB,GAAG,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,YAAY,CAAC,EAAE,CAAC,IAAa,EAAE,GAAa,EAAE,EAAE;QAC5D,GAAG,CAAC,SAAS,CAAC,cAAc,EAAE,0BAA0B,CAAC,CAAC;QAC1D,MAAM,aAAa,GAAG,aAAa,CAAC,SAAS,EAAE,CAAC,OAAO,IAAI,MAAM,CAAC;QAClE,GAAG,CAAC,IAAI,CAAC,gBAAgB,CAAC,aAAa,CAAC,CAAC,CAAC;IAC5C,CAAC,CAAC,CAAC;IAEH,wCAAwC;IACxC,GAAG,CAAC,GAAG,CAAC,UAAU,EAAE,KAAK,EAAE,GAAY,EAAE,GAAa,EAAE,EAAE;QACxD,MAAM,QAAQ,GAAG,GAAG,CAAC,KAAK,CAAC,IAAc,CAAC;QAC1C,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,0BAA0B,CAAC,CAAC;YACjD,OAAO;QACT,CAAC;QACD,MAAM,IAAI,GAAG,MAAM,kBAAkB,CAAC,QAAQ,CAAC,CAAC;QAChD,GAAG,CAAC,SAAS,CAAC,cAAc,EAAE,0BAA0B,CAAC,CAAC;QAC1D,GAAG,CAAC,SAAS,CACX,yBAAyB,EACzB,4KAA4K,CAC7K,CAAC;QACF,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACjB,CAAC,CAAC,CAAC;IAEH,wBAAwB;IACxB,GAAG,CAAC,GAAG,CAAC,SAAS,EAAE,CAAC,IAAa,EAAE,GAAa,EAAE,EAAE;QAClD,GAAG,CAAC,IAAI,CAAC;YACP,MAAM,EAAE,IAAI;YACZ,MAAM,EAAE,aAAa;YACrB,OAAO,EAAE,OAAO;YAChB,cAAc,EAAE;gBACd,GAAG,EAAE,UAAU,CAAC,qBAAqB,EAAE;gBACvC,cAAc,EAAE,iBAAiB,CAAC,qBAAqB,EAAE;aAC1D;YACD,aAAa,EAAE,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC;YAC3C,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;SACpC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,oBAAoB;IACpB,GAAG,CAAC,GAAG,CAAC,oBAAoB,EAAE,KAAK,EAAE,IAAa,EAAE,GAAa,EAAE,EAAE;QACnE,MAAM,GAAG,GAAG,MAAM,mBAAmB,EAAE,CAAC;QACxC,MAAM,GAAG,GAAG,MAAM,gBAAgB,EAAE,CAAC;QACrC,GAAG,CAAC,IAAI,CAAC;YACP,MAAM,EAAE,aAAa;YACrB,OAAO,EAAE,OAAO;YAChB,IAAI,EAAE,OAAO,CAAC,IAAI;YAClB,IAAI,EAAE,OAAO,CAAC,IAAI;YAClB,QAAQ,EAAE,aAAa,CAAC,UAAU,EAAE;YACpC,aAAa,EAAE,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC;YAC3C,cAAc,EAAE;gBACd,GAAG,EAAE,UAAU,CAAC,qBAAqB,EAAE;gBACvC,cAAc,EAAE,iBAAiB,CAAC,qBAAqB,EAAE;aAC1D;YACD,eAAe,EAAE,WAAW,CAAC,SAAS,EAAE,CAAC,MAAM;YAC/C,MAAM,EAAE,GAAG;YACX,GAAG,EAAE,GAAG;SACT,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,mBAAmB;IACnB,GAAG,CAAC,GAAG,CAAC,mBAAmB,EAAE,CAAC,IAAa,EAAE,GAAa,EAAE,EAAE;QAC5D,GAAG,CAAC,IAAI,CAAC;YACP,IAAI,EAAE,MAAM,CAAC,aAAa,CAAC,GAAG,CAAC;SAChC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,MAAM,CAAC,mBAAmB,EAAE,CAAC,IAAa,EAAE,GAAa,EAAE,EAAE;QAC/D,MAAM,CAAC,SAAS,EAAE,CAAC;QACnB,GAAG,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,cAAc,EAAE,CAAC,CAAC;IACvD,CAAC,CAAC,CAAC;IAEH,sCAAsC;IACtC,GAAG,CAAC,GAAG,CAAC,qBAAqB,EAAE,KAAK,EAAE,GAAY,EAAE,GAAa,EAAE,EAAE;QACnE,MAAM,MAAM,GAAG,GAAG,CAAC,KAAK,CAAC,MAAM,KAAK,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC;QAC3D,MAAM,IAAI,GAAG,MAAM,UAAU,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;QACjD,IAAI,MAAM,KAAK,KAAK,EAAE,CAAC;YACrB,GAAG,CAAC,SAAS,CAAC,cAAc,EAAE,UAAU,CAAC,CAAC;YAC1C,GAAG,CAAC,SAAS,CAAC,qBAAqB,EAAE,0CAA0C,CAAC,CAAC;QACnF,CAAC;aAAM,CAAC;YACN,GAAG,CAAC,SAAS,CAAC,cAAc,EAAE,kBAAkB,CAAC,CAAC;YAClD,GAAG,CAAC,SAAS,CAAC,qBAAqB,EAAE,2CAA2C,CAAC,CAAC;QACpF,CAAC;QACD,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACjB,CAAC,CAAC,CAAC;IAEH,kCAAkC;IAClC,GAAG,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC,GAAY,EAAE,GAAa,EAAE,EAAE,CAAC,iBAAiB,CAAC,aAAa,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC;IAE5F,kCAAkC;IAClC,GAAG,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC,GAAY,EAAE,GAAa,EAAE,EAAE,CAAC,UAAU,CAAC,gBAAgB,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC;IACxF,GAAG,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC,GAAY,EAAE,GAAa,EAAE,EAAE,CAAC,UAAU,CAAC,iBAAiB,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC;IAE9F,MAAM,KAAK,GAAG,GAAoB,EAAE;QAClC,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;YAC7B,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,GAAG,EAAE;gBACzD,OAAO,CAAC,GAAG,CAAC,0DAA0D,CAAC,CAAC;gBACxE,OAAO,CAAC,GAAG,CAAC,qCAAqC,CAAC,CAAC;gBACnD,OAAO,CAAC,GAAG,CAAC,wDAAwD,CAAC,CAAC;gBACtE,OAAO,CAAC,GAAG,CAAC,yCAAyC,OAAO,CAAC,IAAI,GAAG,CAAC,CAAC;gBACtE,OAAO,CAAC,GAAG,CAAC,+BAA+B,OAAO,CAAC,IAAI,IAAI,OAAO,CAAC,IAAI,MAAM,CAAC,CAAC;gBAC/E,OAAO,CAAC,GAAG,CAAC,+BAA+B,OAAO,CAAC,IAAI,IAAI,OAAO,CAAC,IAAI,MAAM,CAAC,CAAC;gBAC/E,OAAO,CAAC,GAAG,CAAC,+BAA+B,OAAO,CAAC,IAAI,IAAI,OAAO,CAAC,IAAI,UAAU,CAAC,CAAC;gBACnF,OAAO,CAAC,GAAG,CAAC,+BAA+B,OAAO,CAAC,IAAI,IAAI,OAAO,CAAC,IAAI,SAAS,CAAC,CAAC;gBAClF,OAAO,CAAC,GAAG,CAAC,0DAA0D,CAAC,CAAC;gBACxE,OAAO,CAAC,MAAM,CAAC,CAAC;YAClB,CAAC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;IACL,CAAC,CAAC;IAEF,MAAM,IAAI,GAAG,KAAK,EAAE,MAAc,EAAiB,EAAE;QACnD,sCAAsC;QACtC,WAAW,CAAC,OAAO,EAAE,CAAC;QAEtB,wBAAwB;QACxB,MAAM,OAAO,CAAC,GAAG,CAAC;YAChB,UAAU,CAAC,QAAQ,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC;YACrC,iBAAiB,CAAC,QAAQ,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC;SAC7C,CAAC,CAAC;QAEH,2BAA2B;QAC3B,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;YAC7B,IAAI,OAAO,MAAM,CAAC,mBAAmB,KAAK,UAAU,EAAE,CAAC;gBACrD,MAAM,CAAC,mBAAmB,EAAE,CAAC;YAC/B,CAAC;YAED,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE;gBAChB,OAAO,EAAE,CAAC;YACZ,CAAC,CAAC,CAAC;YAEH,MAAM,WAAW,GAAG,UAAU,CAAC,GAAG,EAAE;gBAClC,OAAO,EAAE,CAAC;YACZ,CAAC,EAAE,GAAG,CAAC,CAAC;YACR,WAAW,CAAC,KAAK,EAAE,CAAC;QACtB,CAAC,CAAC,CAAC;IACL,CAAC,CAAC;IAEF,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;AAC9B,CAAC"}

package/dist/gateway/sse-gateway.d.ts

@@ -0,0 +1,43 @@
+import type { Request, Response } from "express";
+import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
+import { SSEServerTransport } from "@modelcontextprotocol/sdk/server/sse.js";
+interface SseSession {
+    transport: SSEServerTransport;
+    mcpServer: McpServer;
+    lastActivityAt: number;
+}
+export declare class SseGateway {
+    private sessions;
+    private cleanupTimer;
+    private idleTimeoutMs;
+    private maxSessions;
+    constructor(idleTimeoutMs?: number, maxSessions?: number);
+    private createMcpServerInstance;
+    /**
+     * Evict least recently used session if capacity is reached
+     */
+    private evictOldestIfNeeded;
+    /**
+     * Cleanup sessions that have been idle longer than idleTimeoutMs
+     */
+    cleanupIdleSessions(): number;
+    /**
+     * Handle GET /sse - Client initializes SSE stream
+     */
+    handleSseConnect(req: Request, res: Response): Promise<void>;
+    /**
+     * Handle POST /message - Client sends JSON-RPC message for SSE session
+     */
+    handlePostMessage(req: Request, res: Response): Promise<void>;
+    getActiveSessionCount(): number;
+    getSession(sessionId: string): SseSession | undefined;
+    setSessionLastActivity(sessionId: string, timestamp: number): boolean;
+    registerSessionForTest(sessionId: string, session?: {
+        transport?: any;
+        mcpServer?: any;
+        lastActivityAt?: number;
+    }): void;
+    closeAll(): Promise<void>;
+}
+export {};
+//# sourceMappingURL=sse-gateway.d.ts.map

package/dist/gateway/sse-gateway.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sse-gateway.d.ts","sourceRoot":"","sources":["../../src/gateway/sse-gateway.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AACjD,OAAO,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AACpE,OAAO,EAAE,kBAAkB,EAAE,MAAM,yCAAyC,CAAC;AAG7E,UAAU,UAAU;IAClB,SAAS,EAAE,kBAAkB,CAAC;IAC9B,SAAS,EAAE,SAAS,CAAC;IACrB,cAAc,EAAE,MAAM,CAAC;CACxB;AAED,qBAAa,UAAU;IACrB,OAAO,CAAC,QAAQ,CAAiC;IACjD,OAAO,CAAC,YAAY,CAA+B;IACnD,OAAO,CAAC,aAAa,CAAS;IAC9B,OAAO,CAAC,WAAW,CAAS;IAE5B,YAAY,aAAa,SAAiB,EAAE,WAAW,SAAM,EAW5D;IAED,OAAO,CAAC,uBAAuB;IAS/B;;OAEG;IACH,OAAO,CAAC,mBAAmB;IAwB3B;;OAEG;IACI,mBAAmB,IAAI,MAAM,CAWnC;IAED;;OAEG;IACU,gBAAgB,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC,CA4BxE;IAED;;OAEG;IACU,iBAAiB,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC,CAuBzE;IAEM,qBAAqB,IAAI,MAAM,CAErC;IAEM,UAAU,CAAC,SAAS,EAAE,MAAM,GAAG,UAAU,GAAG,SAAS,CAE3D;IAEM,sBAAsB,CAAC,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAO3E;IAEM,sBAAsB,CAC3B,SAAS,EAAE,MAAM,EACjB,OAAO,GAAE;QAAE,SAAS,CAAC,EAAE,GAAG,CAAC;QAAC,SAAS,CAAC,EAAE,GAAG,CAAC;QAAC,cAAc,CAAC,EAAE,MAAM,CAAA;KAAO,GAC1E,IAAI,CAON;IAEY,QAAQ,IAAI,OAAO,CAAC,IAAI,CAAC,CAarC;CACF"}

package/dist/gateway/sse-gateway.js

@@ -0,0 +1,161 @@
+import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
+import { SSEServerTransport } from "@modelcontextprotocol/sdk/server/sse.js";
+import { registerAllTools } from "../tools/index.js";
+export class SseGateway {
+    sessions = new Map();
+    cleanupTimer = null;
+    idleTimeoutMs;
+    maxSessions;
+    constructor(idleTimeoutMs = 45 * 60 * 1000, maxSessions = 100) {
+        this.idleTimeoutMs = idleTimeoutMs;
+        this.maxSessions = maxSessions;
+        const intervalMs = Math.min(60000, Math.max(1000, Math.floor(this.idleTimeoutMs / 2)));
+        this.cleanupTimer = setInterval(() => {
+            this.cleanupIdleSessions();
+        }, intervalMs);
+        if (this.cleanupTimer && this.cleanupTimer.unref) {
+            this.cleanupTimer.unref();
+        }
+    }
+    createMcpServerInstance() {
+        const server = new McpServer({
+            name: "winhelm-mcp",
+            version: "1.1.0",
+        });
+        registerAllTools(server);
+        return server;
+    }
+    /**
+     * Evict least recently used session if capacity is reached
+     */
+    evictOldestIfNeeded() {
+        while (this.sessions.size >= this.maxSessions) {
+            let oldestKey = null;
+            let oldestTime = Infinity;
+            for (const [key, session] of this.sessions.entries()) {
+                if (session.lastActivityAt < oldestTime) {
+                    oldestTime = session.lastActivityAt;
+                    oldestKey = key;
+                }
+            }
+            if (oldestKey) {
+                const session = this.sessions.get(oldestKey);
+                this.sessions.delete(oldestKey);
+                if (session) {
+                    session.mcpServer.close().catch(() => { });
+                }
+            }
+            else {
+                break;
+            }
+        }
+    }
+    /**
+     * Cleanup sessions that have been idle longer than idleTimeoutMs
+     */
+    cleanupIdleSessions() {
+        const now = Date.now();
+        let count = 0;
+        for (const [key, session] of this.sessions.entries()) {
+            if (now - session.lastActivityAt > this.idleTimeoutMs) {
+                this.sessions.delete(key);
+                session.mcpServer.close().catch(() => { });
+                count++;
+            }
+        }
+        return count;
+    }
+    /**
+     * Handle GET /sse - Client initializes SSE stream
+     */
+    async handleSseConnect(req, res) {
+        console.log(`[SSE] New SSE client connecting from ${req.ip}`);
+        try {
+            this.evictOldestIfNeeded();
+            const mcpServer = this.createMcpServerInstance();
+            const transport = new SSEServerTransport("/message", res);
+            await mcpServer.connect(transport);
+            const sessionId = transport.sessionId;
+            this.sessions.set(sessionId, {
+                transport,
+                mcpServer,
+                lastActivityAt: Date.now(),
+            });
+            console.log(`[SSE] Session initialized: ${sessionId}`);
+            req.on("close", () => {
+                console.log(`[SSE] Client disconnected (session: ${sessionId})`);
+                this.sessions.delete(sessionId);
+                mcpServer.close().catch(() => { });
+            });
+        }
+        catch (err) {
+            console.error("[SSE] Failed to establish SSE connection:", err);
+            if (!res.headersSent) {
+                res.status(500).send("Failed to initialize SSE connection");
+            }
+        }
+    }
+    /**
+     * Handle POST /message - Client sends JSON-RPC message for SSE session
+     */
+    async handlePostMessage(req, res) {
+        const sessionId = req.query.sessionId;
+        if (!sessionId) {
+            res.status(400).send("Missing sessionId parameter");
+            return;
+        }
+        const session = this.sessions.get(sessionId);
+        if (!session) {
+            res.status(404).send(`Active session not found for ID: ${sessionId}`);
+            return;
+        }
+        session.lastActivityAt = Date.now();
+        try {
+            await session.transport.handlePostMessage(req, res);
+        }
+        catch (err) {
+            console.error(`[SSE] Error processing POST message for session ${sessionId}:`, err);
+            if (!res.headersSent) {
+                res.status(500).send("Error handling message");
+            }
+        }
+    }
+    getActiveSessionCount() {
+        return this.sessions.size;
+    }
+    getSession(sessionId) {
+        return this.sessions.get(sessionId);
+    }
+    setSessionLastActivity(sessionId, timestamp) {
+        const session = this.sessions.get(sessionId);
+        if (session) {
+            session.lastActivityAt = timestamp;
+            return true;
+        }
+        return false;
+    }
+    registerSessionForTest(sessionId, session = {}) {
+        this.evictOldestIfNeeded();
+        this.sessions.set(sessionId, {
+            transport: session.transport || {},
+            mcpServer: session.mcpServer || { close: async () => { } },
+            lastActivityAt: session.lastActivityAt ?? Date.now(),
+        });
+    }
+    async closeAll() {
+        if (this.cleanupTimer) {
+            clearInterval(this.cleanupTimer);
+            this.cleanupTimer = null;
+        }
+        for (const session of this.sessions.values()) {
+            try {
+                await session.mcpServer.close();
+            }
+            catch {
+                // ignore
+            }
+        }
+        this.sessions.clear();
+    }
+}
+//# sourceMappingURL=sse-gateway.js.map

package/dist/gateway/sse-gateway.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sse-gateway.js","sourceRoot":"","sources":["../../src/gateway/sse-gateway.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AACpE,OAAO,EAAE,kBAAkB,EAAE,MAAM,yCAAyC,CAAC;AAC7E,OAAO,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AAQrD,MAAM,OAAO,UAAU;IACb,QAAQ,GAAG,IAAI,GAAG,EAAsB,CAAC;IACzC,YAAY,GAA0B,IAAI,CAAC;IAC3C,aAAa,CAAS;IACtB,WAAW,CAAS;IAE5B,YAAY,aAAa,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,EAAE,WAAW,GAAG,GAAG;QAC3D,IAAI,CAAC,aAAa,GAAG,aAAa,CAAC;QACnC,IAAI,CAAC,WAAW,GAAG,WAAW,CAAC;QAE/B,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,aAAa,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QACvF,IAAI,CAAC,YAAY,GAAG,WAAW,CAAC,GAAG,EAAE;YACnC,IAAI,CAAC,mBAAmB,EAAE,CAAC;QAC7B,CAAC,EAAE,UAAU,CAAC,CAAC;QACf,IAAI,IAAI,CAAC,YAAY,IAAI,IAAI,CAAC,YAAY,CAAC,KAAK,EAAE,CAAC;YACjD,IAAI,CAAC,YAAY,CAAC,KAAK,EAAE,CAAC;QAC5B,CAAC;IACH,CAAC;IAEO,uBAAuB;QAC7B,MAAM,MAAM,GAAG,IAAI,SAAS,CAAC;YAC3B,IAAI,EAAE,aAAa;YACnB,OAAO,EAAE,OAAO;SACjB,CAAC,CAAC;QACH,gBAAgB,CAAC,MAAM,CAAC,CAAC;QACzB,OAAO,MAAM,CAAC;IAChB,CAAC;IAED;;OAEG;IACK,mBAAmB;QACzB,OAAO,IAAI,CAAC,QAAQ,CAAC,IAAI,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;YAC9C,IAAI,SAAS,GAAkB,IAAI,CAAC;YACpC,IAAI,UAAU,GAAG,QAAQ,CAAC;YAE1B,KAAK,MAAM,CAAC,GAAG,EAAE,OAAO,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,EAAE,CAAC;gBACrD,IAAI,OAAO,CAAC,cAAc,GAAG,UAAU,EAAE,CAAC;oBACxC,UAAU,GAAG,OAAO,CAAC,cAAc,CAAC;oBACpC,SAAS,GAAG,GAAG,CAAC;gBAClB,CAAC;YACH,CAAC;YAED,IAAI,SAAS,EAAE,CAAC;gBACd,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;gBAC7C,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;gBAChC,IAAI,OAAO,EAAE,CAAC;oBACZ,OAAO,CAAC,SAAS,CAAC,KAAK,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;gBAC5C,CAAC;YACH,CAAC;iBAAM,CAAC;gBACN,MAAM;YACR,CAAC;QACH,CAAC;IACH,CAAC;IAED;;OAEG;IACI,mBAAmB;QACxB,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,IAAI,KAAK,GAAG,CAAC,CAAC;QACd,KAAK,MAAM,CAAC,GAAG,EAAE,OAAO,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,EAAE,CAAC;YACrD,IAAI,GAAG,GAAG,OAAO,CAAC,cAAc,GAAG,IAAI,CAAC,aAAa,EAAE,CAAC;gBACtD,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;gBAC1B,OAAO,CAAC,SAAS,CAAC,KAAK,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;gBAC1C,KAAK,EAAE,CAAC;YACV,CAAC;QACH,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IAED;;OAEG;IACI,KAAK,CAAC,gBAAgB,CAAC,GAAY,EAAE,GAAa;QACvD,OAAO,CAAC,GAAG,CAAC,wCAAwC,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC;QAC9D,IAAI,CAAC;YACH,IAAI,CAAC,mBAAmB,EAAE,CAAC;YAE3B,MAAM,SAAS,GAAG,IAAI,CAAC,uBAAuB,EAAE,CAAC;YACjD,MAAM,SAAS,GAAG,IAAI,kBAAkB,CAAC,UAAU,EAAE,GAAG,CAAC,CAAC;YAC1D,MAAM,SAAS,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;YAEnC,MAAM,SAAS,GAAG,SAAS,CAAC,SAAS,CAAC;YACtC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,SAAS,EAAE;gBAC3B,SAAS;gBACT,SAAS;gBACT,cAAc,EAAE,IAAI,CAAC,GAAG,EAAE;aAC3B,CAAC,CAAC;YACH,OAAO,CAAC,GAAG,CAAC,8BAA8B,SAAS,EAAE,CAAC,CAAC;YAEvD,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE;gBACnB,OAAO,CAAC,GAAG,CAAC,uCAAuC,SAAS,GAAG,CAAC,CAAC;gBACjE,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;gBAChC,SAAS,CAAC,KAAK,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;YACpC,CAAC,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,CAAC,KAAK,CAAC,2CAA2C,EAAE,GAAG,CAAC,CAAC;YAChE,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC;gBACrB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,qCAAqC,CAAC,CAAC;YAC9D,CAAC;QACH,CAAC;IACH,CAAC;IAED;;OAEG;IACI,KAAK,CAAC,iBAAiB,CAAC,GAAY,EAAE,GAAa;QACxD,MAAM,SAAS,GAAG,GAAG,CAAC,KAAK,CAAC,SAAmB,CAAC;QAChD,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,6BAA6B,CAAC,CAAC;YACpD,OAAO;QACT,CAAC;QAED,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QAC7C,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,oCAAoC,SAAS,EAAE,CAAC,CAAC;YACtE,OAAO;QACT,CAAC;QAED,OAAO,CAAC,cAAc,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAEpC,IAAI,CAAC;YACH,MAAM,OAAO,CAAC,SAAS,CAAC,iBAAiB,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QACtD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,CAAC,KAAK,CAAC,mDAAmD,SAAS,GAAG,EAAE,GAAG,CAAC,CAAC;YACpF,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC;gBACrB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,wBAAwB,CAAC,CAAC;YACjD,CAAC;QACH,CAAC;IACH,CAAC;IAEM,qBAAqB;QAC1B,OAAO,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC;IAC5B,CAAC;IAEM,UAAU,CAAC,SAAiB;QACjC,OAAO,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;IACtC,CAAC;IAEM,sBAAsB,CAAC,SAAiB,EAAE,SAAiB;QAChE,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QAC7C,IAAI,OAAO,EAAE,CAAC;YACZ,OAAO,CAAC,cAAc,GAAG,SAAS,CAAC;YACnC,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IAEM,sBAAsB,CAC3B,SAAiB,EACjB,OAAO,GAAkE,EAAE;QAE3E,IAAI,CAAC,mBAAmB,EAAE,CAAC;QAC3B,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,SAAS,EAAE;YAC3B,SAAS,EAAE,OAAO,CAAC,SAAS,IAAK,EAAU;YAC3C,SAAS,EAAE,OAAO,CAAC,SAAS,IAAK,EAAE,KAAK,EAAE,KAAK,IAAI,EAAE,GAAE,CAAC,EAAU;YAClE,cAAc,EAAE,OAAO,CAAC,cAAc,IAAI,IAAI,CAAC,GAAG,EAAE;SACrD,CAAC,CAAC;IACL,CAAC;IAEM,KAAK,CAAC,QAAQ;QACnB,IAAI,IAAI,CAAC,YAAY,EAAE,CAAC;YACtB,aAAa,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;YACjC,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC;QAC3B,CAAC;QACD,KAAK,MAAM,OAAO,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,EAAE,CAAC;YAC7C,IAAI,CAAC;gBACH,MAAM,OAAO,CAAC,SAAS,CAAC,KAAK,EAAE,CAAC;YAClC,CAAC;YAAC,MAAM,CAAC;gBACP,SAAS;YACX,CAAC;QACH,CAAC;QACD,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC;IACxB,CAAC;CACF"}

package/dist/gateway/streamable-gateway.d.ts

@@ -0,0 +1,39 @@
+import type { Request, Response } from "express";
+import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
+import { StreamableHTTPServerTransport } from "@modelcontextprotocol/sdk/server/streamableHttp.js";
+interface StreamableSession {
+    transport: StreamableHTTPServerTransport;
+    mcpServer: McpServer;
+    lastActivityAt: number;
+}
+export declare class StreamableGateway {
+    private sessions;
+    private cleanupTimer;
+    private idleTimeoutMs;
+    private maxSessions;
+    constructor(idleTimeoutMs?: number, maxSessions?: number);
+    private createMcpServerInstance;
+    /**
+     * Evict the least recently used session if capacity is reached
+     */
+    private evictOldestIfNeeded;
+    /**
+     * Cleanup sessions that have been idle longer than idleTimeoutMs
+     */
+    cleanupIdleSessions(): number;
+    /**
+     * Handle ALL /mcp - Streamable HTTP transport
+     */
+    handleRequest(req: Request, res: Response): Promise<void>;
+    getActiveSessionCount(): number;
+    getSession(sessionId: string): StreamableSession | undefined;
+    setSessionLastActivity(sessionId: string, timestamp: number): boolean;
+    registerSessionForTest(sessionId: string, session?: {
+        transport?: any;
+        mcpServer?: any;
+        lastActivityAt?: number;
+    }): void;
+    closeAll(): Promise<void>;
+}
+export {};
+//# sourceMappingURL=streamable-gateway.d.ts.map

package/dist/gateway/streamable-gateway.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"streamable-gateway.d.ts","sourceRoot":"","sources":["../../src/gateway/streamable-gateway.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAEjD,OAAO,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AACpE,OAAO,EAAE,6BAA6B,EAAE,MAAM,oDAAoD,CAAC;AAGnG,UAAU,iBAAiB;IACzB,SAAS,EAAE,6BAA6B,CAAC;IACzC,SAAS,EAAE,SAAS,CAAC;IACrB,cAAc,EAAE,MAAM,CAAC;CACxB;AAED,qBAAa,iBAAiB;IAC5B,OAAO,CAAC,QAAQ,CAAwC;IACxD,OAAO,CAAC,YAAY,CAA+B;IACnD,OAAO,CAAC,aAAa,CAAS;IAC9B,OAAO,CAAC,WAAW,CAAS;IAE5B,YAAY,aAAa,SAAiB,EAAE,WAAW,SAAM,EAY5D;IAED,OAAO,CAAC,uBAAuB;IAS/B;;OAEG;IACH,OAAO,CAAC,mBAAmB;IAwB3B;;OAEG;IACI,mBAAmB,IAAI,MAAM,CAWnC;IAED;;OAEG;IACU,aAAa,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC,CAsErE;IAEM,qBAAqB,IAAI,MAAM,CAErC;IAEM,UAAU,CAAC,SAAS,EAAE,MAAM,GAAG,iBAAiB,GAAG,SAAS,CAElE;IAEM,sBAAsB,CAAC,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAO3E;IAEM,sBAAsB,CAC3B,SAAS,EAAE,MAAM,EACjB,OAAO,GAAE;QAAE,SAAS,CAAC,EAAE,GAAG,CAAC;QAAC,SAAS,CAAC,EAAE,GAAG,CAAC;QAAC,cAAc,CAAC,EAAE,MAAM,CAAA;KAAO,GAC1E,IAAI,CAON;IAEY,QAAQ,IAAI,OAAO,CAAC,IAAI,CAAC,CAarC;CACF"}