Add loopback HTTP JSON-RPC /rpc transport

2 months ago

5fd9aa0

Authored

mweinbach7/14/2026, 4:07:32 AM

Introduces a native-client loopback JSON-RPC endpoint at `POST /rpc` with sticky per-client sessions via `X-Cowork-Client-Id`, plus loopback-only access checks and browser-token protection parity with `/ws`/`/cowork/*`. Refactors shared HTTP JSON-RPC connection/payload handling out of the H3 server, extends transport metadata to include `http`, updates server startup output and docs for `COWORK_RPC_URL`, adds `dev:rpc`, and adds coverage for handshake/state behavior and header enforcement in new loopback tests.

Parent97582ad

14 files changed

README.md+9−0
docs/websocket-protocol.md+19−3
package.json+1−0
src/server/index.ts+10−2
src/server/jsonrpc/schema.core.ts+1−1
src/server/jsonrpc/transportAdapter.ts+2−1
src/server/runtime/ServerRuntime.ts+6−1
src/server/startServer.ts+24−2
src/server/startServer/types.ts

mweinbach / agent-coworker

Add loopback HTTP JSON-RPC /rpc transport