@apitap/core 1.2.0 → 1.3.0

package/dist/skill/store.js.map

@@ -1 +1 @@
-{"version":3,"file":"store.js","sourceRoot":"","sources":["../../src/skill/store.ts"],"names":[],"mappings":"AAAA,qBAAqB;AACrB,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAC/E,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAGlC,MAAM,kBAAkB,GAAG,IAAI,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,QAAQ,CAAC,CAAC;AAEhE,MAAM,cAAc,GAAG;;;CAGtB,CAAC;AAEF,SAAS,SAAS,CAAC,MAAc,EAAE,SAAiB;IAClD,IAAI,CAAC,8BAA8B,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;QACjD,MAAM,IAAI,KAAK,CAAC,mBAAmB,MAAM,EAAE,CAAC,CAAC;IAC/C,CAAC;IACD,OAAO,IAAI,CAAC,SAAS,EAAE,GAAG,MAAM,OAAO,CAAC,CAAC;AAC3C,CAAC;AAED,KAAK,UAAU,eAAe,CAAC,SAAiB;IAC9C,MAAM,OAAO,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC;IACnC,MAAM,aAAa,GAAG,IAAI,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC;IAElD,IAAI,CAAC;QACH,MAAM,MAAM,CAAC,aAAa,CAAC,CAAC;QAC5B,+BAA+B;IACjC,CAAC;IAAC,MAAM,CAAC;QACP,gCAAgC;QAChC,MAAM,KAAK,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAC1C,MAAM,SAAS,CAAC,aAAa,EAAE,cAAc,CAAC,CAAC;IACjD,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,KAAgB,EAChB,YAAoB,kBAAkB;IAEtC,MAAM,KAAK,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC5C,MAAM,eAAe,CAAC,SAAS,CAAC,CAAC;IACjC,MAAM,QAAQ,GAAG,SAAS,CAAC,KAAK,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;IACpD,MAAM,SAAS,CAAC,QAAQ,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;IACjE,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,MAAc,EACd,YAAoB,kBAAkB,EACtC,OAA4D;IAE5D,iFAAiF;IACjF,MAAM,IAAI,GAAG,SAAS,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;IAC1C,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QAC9C,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAc,CAAC;QAE/C,6CAA6C;QAC7C,IAAI,OAAO,EAAE,eAAe,IAAI,OAAO,CAAC,UAAU,EAAE,CAAC;YACnD,IAAI,KAAK,CAAC,UAAU,KAAK,UAAU,EAAE,CAAC;gBACpC,0EAA0E;gBAC1E,2CAA2C;YAC7C,CAAC;iBAAM,IAAI,CAAC,KAAK,CAAC,SAAS,EAAE,CAAC;gBAC5B,4CAA4C;gBAC5C,MAAM,IAAI,KAAK,CAAC,kBAAkB,MAAM,0CAA0C,CAAC,CAAC;YACtF,CAAC;iBAAM,CAAC;gBACN,MAAM,EAAE,eAAe,EAAE,GAAG,MAAM,MAAM,CAAC,cAAc,CAAC,CAAC;gBACzD,IAAI,CAAC,eAAe,CAAC,KAAK,EAAE,OAAO,CAAC,UAAU,CAAC,EAAE,CAAC;oBAChD,MAAM,IAAI,KAAK,CAAC,gDAAgD,MAAM,yBAAyB,CAAC,CAAC;gBACnG,CAAC;YACH,CAAC;QACH,CAAC;QAED,OAAO,KAAK,CAAC;IACf,CAAC;IAAC,OAAO,CAAU,EAAE,CAAC;QACpB,IAAK,CAA2B,CAAC,IAAI,KAAK,QAAQ;YAAE,OAAO,IAAI,CAAC;QAChE,MAAM,CAAC,CAAC;IACV,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,YAAoB,kBAAkB;IAEtC,IAAI,KAAe,CAAC;IACpB,IAAI,CAAC;QACH,KAAK,GAAG,MAAM,OAAO,CAAC,SAAS,CAAC,CAAC;IACnC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,MAAM,SAAS,GAAmB,EAAE,CAAC;IACrC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC;YAAE,SAAS;QACtC,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;QAC3C,MAAM,KAAK,GAAG,MAAM,aAAa,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;QACrD,IAAI,KAAK,EAAE,CAAC;YACV,SAAS,CAAC,IAAI,CAAC;gBACb,MAAM,EAAE,KAAK,CAAC,MAAM;gBACpB,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC;gBAChC,aAAa,EAAE,KAAK,CAAC,SAAS,CAAC,MAAM;gBACrC,UAAU,EAAE,KAAK,CAAC,UAAU;gBAC5B,UAAU,EAAE,KAAK,CAAC,UAAU,IAAI,UAAU;aAC3C,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,OAAO,SAAS,CAAC;AACnB,CAAC"}
+{"version":3,"file":"store.js","sourceRoot":"","sources":["../../src/skill/store.ts"],"names":[],"mappings":"AAAA,qBAAqB;AACrB,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAC/E,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAGlC,MAAM,kBAAkB,GAAG,IAAI,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,QAAQ,CAAC,CAAC;AAEhE,MAAM,cAAc,GAAG;;;CAGtB,CAAC;AAEF,SAAS,SAAS,CAAC,MAAc,EAAE,SAAiB;IAClD,IAAI,CAAC,8BAA8B,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;QACjD,MAAM,IAAI,KAAK,CAAC,mBAAmB,MAAM,EAAE,CAAC,CAAC;IAC/C,CAAC;IACD,OAAO,IAAI,CAAC,SAAS,EAAE,GAAG,MAAM,OAAO,CAAC,CAAC;AAC3C,CAAC;AAED,KAAK,UAAU,eAAe,CAAC,SAAiB;IAC9C,MAAM,OAAO,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC;IACnC,MAAM,aAAa,GAAG,IAAI,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC;IAElD,IAAI,CAAC;QACH,MAAM,MAAM,CAAC,aAAa,CAAC,CAAC;QAC5B,+BAA+B;IACjC,CAAC;IAAC,MAAM,CAAC;QACP,gCAAgC;QAChC,MAAM,KAAK,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAC1C,MAAM,SAAS,CAAC,aAAa,EAAE,cAAc,CAAC,CAAC;IACjD,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,KAAgB,EAChB,YAAoB,kBAAkB;IAEtC,MAAM,KAAK,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC5C,MAAM,eAAe,CAAC,SAAS,CAAC,CAAC;IACjC,MAAM,QAAQ,GAAG,SAAS,CAAC,KAAK,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;IACpD,MAAM,SAAS,CAAC,QAAQ,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAClF,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,MAAc,EACd,YAAoB,kBAAkB,EACtC,OAA4D;IAE5D,iFAAiF;IACjF,MAAM,IAAI,GAAG,SAAS,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;IAC1C,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QAC9C,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAc,CAAC;QAE/C,6CAA6C;QAC7C,IAAI,OAAO,EAAE,eAAe,IAAI,OAAO,CAAC,UAAU,EAAE,CAAC;YACnD,IAAI,KAAK,CAAC,UAAU,KAAK,UAAU,EAAE,CAAC;gBACpC,0EAA0E;gBAC1E,2CAA2C;YAC7C,CAAC;iBAAM,IAAI,CAAC,KAAK,CAAC,SAAS,EAAE,CAAC;gBAC5B,4CAA4C;gBAC5C,MAAM,IAAI,KAAK,CAAC,kBAAkB,MAAM,0CAA0C,CAAC,CAAC;YACtF,CAAC;iBAAM,CAAC;gBACN,MAAM,EAAE,eAAe,EAAE,GAAG,MAAM,MAAM,CAAC,cAAc,CAAC,CAAC;gBACzD,IAAI,CAAC,eAAe,CAAC,KAAK,EAAE,OAAO,CAAC,UAAU,CAAC,EAAE,CAAC;oBAChD,MAAM,IAAI,KAAK,CAAC,gDAAgD,MAAM,yBAAyB,CAAC,CAAC;gBACnG,CAAC;YACH,CAAC;QACH,CAAC;QAED,OAAO,KAAK,CAAC;IACf,CAAC;IAAC,OAAO,CAAU,EAAE,CAAC;QACpB,IAAK,CAA2B,CAAC,IAAI,KAAK,QAAQ;YAAE,OAAO,IAAI,CAAC;QAChE,MAAM,CAAC,CAAC;IACV,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,YAAoB,kBAAkB;IAEtC,IAAI,KAAe,CAAC;IACpB,IAAI,CAAC;QACH,KAAK,GAAG,MAAM,OAAO,CAAC,SAAS,CAAC,CAAC;IACnC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,MAAM,SAAS,GAAmB,EAAE,CAAC;IACrC,MAAM,SAAS,GAAG,8BAA8B,CAAC;IACjD,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC;YAAE,SAAS;QACtC,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;QAC3C,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,MAAM,CAAC;YAAE,SAAS,CAAC,gCAAgC;QACvE,MAAM,KAAK,GAAG,MAAM,aAAa,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;QACrD,IAAI,KAAK,EAAE,CAAC;YACV,SAAS,CAAC,IAAI,CAAC;gBACb,MAAM,EAAE,KAAK,CAAC,MAAM;gBACpB,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC;gBAChC,aAAa,EAAE,KAAK,CAAC,SAAS,CAAC,MAAM;gBACrC,UAAU,EAAE,KAAK,CAAC,UAAU;gBAC5B,UAAU,EAAE,KAAK,CAAC,UAAU,IAAI,UAAU;aAC3C,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,OAAO,SAAS,CAAC;AACnB,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@apitap/core",
-  "version": "1.2.0",
+  "version": "1.3.0",
   "description": "Intercept web API traffic during browsing. Generate portable skill files so AI agents can call APIs directly instead of scraping.",
   "type": "module",
   "main": "dist/index.js",
@@ -14,7 +14,8 @@
     "dev": "tsx src/cli.ts",
     "test": "node --import tsx --test 'test/**/*.test.ts'",
     "typecheck": "tsc --noEmit",
-    "prepublishOnly": "npm run build"
+    "prepublishOnly": "npm run build",
+    "postpublish": "gh release create v$(node -p \"require('./package.json').version\") --title \"v$(node -p \\\"require('./package.json').version\\\")\" --generate-notes && echo '✅ GitHub release created'"
   },
   "license": "BSL-1.1",
   "repository": {

package/src/auth/crypto.ts

@@ -10,7 +10,7 @@ import {
 
 const ALGORITHM = 'aes-256-gcm';
 const KEY_LENGTH = 32; // 256 bits
-const IV_LENGTH = 16;
+const IV_LENGTH = 12; // NIST SP 800-38D recommended for GCM
 const PBKDF2_ITERATIONS = 100_000;
 // const PBKDF2_SALT = 'apitap-v0.2-key-derivation'; // fallback for migration
 import { readFileSync, writeFileSync, existsSync, mkdirSync } from 'node:fs';
@@ -66,7 +66,7 @@ export function encrypt(plaintext: string, key: Buffer): EncryptedData {
   const tag = cipher.getAuthTag();
 
   return {
-    salt: 'apitap-v0.2-key-derivation', // Legacy: stored for reference, not used in decrypt
+    salt: 'v2', // Format version marker — actual salt is per-install
     iv: iv.toString('hex'),
     ciphertext,
     tag: tag.toString('hex'),

package/src/auth/oauth-refresh.ts

@@ -5,7 +5,6 @@ import { resolveAndValidateUrl } from '../skill/ssrf.js';
 
 export interface OAuthRefreshResult {
   success: boolean;
-  accessToken?: string;
   tokenRotated?: boolean;
   error?: string;
 }
@@ -74,9 +73,14 @@ export async function refreshOAuth(
 
     if (!response.ok) {
       const errorText = await response.text().catch(() => '');
+      let errorSummary = `${response.status}`;
+      try {
+        const errJson = JSON.parse(errorText);
+        if (typeof errJson.error === 'string') errorSummary += `: ${errJson.error}`;
+      } catch { /* non-JSON, omit body */ }
       return {
         success: false,
-        error: `Token endpoint returned ${response.status}: ${errorText}`.trim(),
+        error: `Token endpoint returned ${errorSummary}`,
       };
     }
 
@@ -119,7 +123,7 @@ export async function refreshOAuth(
       tokenRotated = true;
     }
 
-    return { success: true, accessToken, tokenRotated };
+    return { success: true, tokenRotated };
   } catch (error) {
     return {
       success: false,

package/src/capture/body-variables.ts

@@ -136,8 +136,11 @@ export function substituteBodyVariables(
   return result;
 }
 
+const FORBIDDEN_KEYS = new Set(['__proto__', 'constructor', 'prototype']);
+
 function setNestedValue(obj: Record<string, unknown>, path: string, value: string): void {
   const parts = path.split('.');
+  if (parts.some(p => FORBIDDEN_KEYS.has(p))) return; // block prototype pollution
   let current = obj;
 
   for (let i = 0; i < parts.length - 1; i++) {

package/src/capture/verifier.ts

@@ -1,5 +1,6 @@
 // src/capture/verifier.ts
 import type { SkillFile, SkillEndpoint, Replayability } from '../types.js';
+import { validateUrl } from '../skill/ssrf.js';
 
 /**
  * Heuristic tier classification for non-GET endpoints (or when verification is skipped).
@@ -35,10 +36,17 @@ export function classifyHeuristic(endpoint: SkillEndpoint): Replayability {
  */
 async function verifySingle(
   endpoint: SkillEndpoint,
+  skipSsrf = false,
 ): Promise<Replayability> {
   const url = endpoint.examples.request.url;
   if (!url) return classifyHeuristic(endpoint);
 
+  // SSRF check before verification fetch
+  if (!skipSsrf) {
+    const ssrfResult = validateUrl(url);
+    if (!ssrfResult.safe) return classifyHeuristic(endpoint);
+  }
+
   // Build headers: use endpoint headers but exclude [stored] auth placeholders
   const headers: Record<string, string> = {};
   for (const [k, v] of Object.entries(endpoint.headers)) {
@@ -89,10 +97,17 @@ async function verifySingle(
  */
 async function verifySinglePost(
   endpoint: SkillEndpoint,
+  skipSsrf = false,
 ): Promise<Replayability> {
   const url = endpoint.examples.request.url;
   if (!url || !endpoint.requestBody) return classifyHeuristic(endpoint);
 
+  // SSRF check before verification fetch
+  if (!skipSsrf) {
+    const ssrfResult = validateUrl(url);
+    if (!ssrfResult.safe) return classifyHeuristic(endpoint);
+  }
+
   const headers: Record<string, string> = {};
   for (const [k, v] of Object.entries(endpoint.headers)) {
     if (v !== '[stored]') {
@@ -144,6 +159,8 @@ async function verifySinglePost(
 export interface VerifyOptions {
   /** Verify POST/PUT/PATCH endpoints by replaying them (opt-in, may cause side effects). */
   verifyPosts?: boolean;
+  /** @internal Skip SSRF check — for testing only */
+  _skipSsrfCheck?: boolean;
 }
 
 /**
@@ -156,10 +173,11 @@ export async function verifyEndpoints(skill: SkillFile, opts?: VerifyOptions): P
   const verifiedEndpoints = await Promise.all(
     skill.endpoints.map(async (ep) => {
       let replayability: Replayability;
+      const skipSsrf = opts?._skipSsrfCheck ?? false;
       if (ep.method === 'GET') {
-        replayability = await verifySingle(ep);
+        replayability = await verifySingle(ep, skipSsrf);
       } else if (opts?.verifyPosts) {
-        replayability = await verifySinglePost(ep);
+        replayability = await verifySinglePost(ep, skipSsrf);
       } else {
         replayability = classifyHeuristic(ep);
       }

package/src/cli.ts

@@ -512,7 +512,12 @@ async function handleRefresh(positional: string[], flags: Record<string, string
   });
 
   if (json) {
-    console.log(JSON.stringify(result, null, 2));
+    // Redact token values from JSON output to prevent credential leaks in logs
+    const safeResult = {
+      ...result,
+      tokens: Object.fromEntries(Object.keys(result.tokens).map(k => [k, '[redacted]'])),
+    };
+    console.log(JSON.stringify(safeResult, null, 2));
   } else if (result.success) {
     if (result.oauthRefreshed) {
       console.log(`  ✓ OAuth token refreshed via token endpoint`);

package/src/discovery/fetch.ts

@@ -1,5 +1,5 @@
 // src/discovery/fetch.ts
-import { validateUrl } from '../skill/ssrf.js';
+import { validateUrl, resolveAndValidateUrl } from '../skill/ssrf.js';
 
 export interface FetchResult {
   status: number;
@@ -53,12 +53,12 @@ export async function safeFetch(
 
     clearTimeout(timer);
 
-    // SSRF-safe manual redirect (one hop max)
+    // SSRF-safe manual redirect (one hop max, with DNS resolution check)
     if (response.status >= 300 && response.status < 400 && response.headers.has('location')) {
       const location = response.headers.get('location');
       if (!location) return null;
       const redirectUrl = new URL(location, url).toString();
-      const ssrfResult = validateUrl(redirectUrl);
+      const ssrfResult = await resolveAndValidateUrl(redirectUrl);
       if (!ssrfResult.safe) return null;
       // Follow one redirect hop only
       return await safeFetch(redirectUrl, { ...options, skipSsrf: true });

package/src/mcp.ts

@@ -103,6 +103,12 @@ export function createMcpServer(options: McpServerOptions = {}): McpServer {
     },
     async ({ url }) => {
       try {
+        if (!options._skipSsrfCheck) {
+          const validation = await resolveAndValidateUrl(url);
+          if (!validation.safe) {
+            return { content: [{ type: 'text' as const, text: `Blocked: ${validation.reason}` }], isError: true };
+          }
+        }
         const result = await discover(url);
 
         // If we got a skill file, save it automatically
@@ -250,6 +256,12 @@ export function createMcpServer(options: McpServerOptions = {}): McpServer {
       },
     },
     async ({ url, task, maxBytes }) => {
+      if (!options._skipSsrfCheck) {
+        const validation = await resolveAndValidateUrl(url);
+        if (!validation.safe) {
+          return { content: [{ type: 'text' as const, text: `Blocked: ${validation.reason}` }], isError: true };
+        }
+      }
       const { browse: doBrowse } = await import('./orchestration/browse.js');
       const result = await doBrowse(url, {
         skillsDir,
@@ -257,6 +269,8 @@ export function createMcpServer(options: McpServerOptions = {}): McpServer {
         task,
         maxBytes: maxBytes ?? 50_000,
         _skipSsrfCheck: options._skipSsrfCheck,
+        // In test mode, disable bridge to avoid connecting to real socket
+        ...(options._skipSsrfCheck ? { _bridgeSocketPath: '/nonexistent' } : {}),
       });
       // Only mark as untrusted if it contains external data
       if (result.success && result.data) {
@@ -285,6 +299,12 @@ export function createMcpServer(options: McpServerOptions = {}): McpServer {
     },
     async ({ url }) => {
       try {
+        if (!options._skipSsrfCheck) {
+          const validation = await resolveAndValidateUrl(url);
+          if (!validation.safe) {
+            return { content: [{ type: 'text' as const, text: `Blocked: ${validation.reason}` }], isError: true };
+          }
+        }
         const result = await peek(url);
         // Peek returns metadata, not content — but still from external source
         return wrapExternalContent(result, 'apitap_peek');
@@ -315,9 +335,11 @@ export function createMcpServer(options: McpServerOptions = {}): McpServer {
     },
     async ({ url, maxBytes }) => {
       try {
-        const validation = await resolveAndValidateUrl(url);
-        if (!validation.safe) {
-          throw new Error(validation.reason ?? 'URL validation failed');
+        if (!options._skipSsrfCheck) {
+          const validation = await resolveAndValidateUrl(url);
+          if (!validation.safe) {
+            throw new Error(validation.reason ?? 'URL validation failed');
+          }
         }
         const result = await read(url, { maxBytes: maxBytes ?? undefined });
         if (!result) {
@@ -354,6 +376,12 @@ export function createMcpServer(options: McpServerOptions = {}): McpServer {
       },
     },
     async ({ url, duration }) => {
+      if (!options._skipSsrfCheck) {
+        const validation = await resolveAndValidateUrl(url);
+        if (!validation.safe) {
+          return { content: [{ type: 'text' as const, text: `Blocked: ${validation.reason}` }], isError: true };
+        }
+      }
       const dur = duration ?? 30;
       const timeoutMs = (dur + 60) * 1000; // generous timeout: capture duration + 60s for start/finish
 
@@ -406,6 +434,12 @@ export function createMcpServer(options: McpServerOptions = {}): McpServer {
       },
     },
     async ({ url, headless, allDomains }) => {
+      if (!options._skipSsrfCheck) {
+        const validation = await resolveAndValidateUrl(url);
+        if (!validation.safe) {
+          return { content: [{ type: 'text' as const, text: `Blocked: ${validation.reason}` }], isError: true };
+        }
+      }
       if (sessions.size >= MAX_SESSIONS) {
         return {
           content: [{ type: 'text' as const, text: `Maximum ${MAX_SESSIONS} concurrent sessions. Finish or abort an existing session first.` }],

package/src/native-host.ts

@@ -193,7 +193,11 @@ export async function startSocketServer(
     });
 
     socketServer.on('error', reject);
-    socketServer.listen(socketPath, () => resolve());
+    socketServer.listen(socketPath, () => {
+      // Restrict socket permissions to owner only
+      fs.chmod(socketPath, 0o600).catch(() => {});
+      resolve();
+    });
   });
 }
 

package/src/read/decoders/deepwiki.ts

@@ -1,5 +1,6 @@
 // src/read/decoders/deepwiki.ts
 import type { Decoder, ReadResult } from '../types.js';
+import { validateUrl } from '../../skill/ssrf.js';
 
 function estimateTokens(text: string): number {
   return Math.ceil(text.length / 4);
@@ -35,8 +36,15 @@ export const deepwikiDecoder: Decoder = {
     const repo = match[3];
     const pagePath = match[4] || '';
 
+    // SSRF check
+    const ssrfResult = validateUrl(url);
+    if (!ssrfResult.safe) return null;
+
+    // Sanitize extracted values for header injection
+    const sanitize = (s: string) => s.replace(/[\r\n]/g, '');
+
     // Construct the path for the RSC request
-    const fullPath = `/${org}/${repo}${pagePath}`;
+    const fullPath = sanitize(`/${org}/${repo}${pagePath}`);
 
     try {
       const response = await fetch(url, {

package/src/replay/engine.ts

@@ -222,11 +222,18 @@ export async function replayEndpoint(
   let body: string | undefined;
   const headers = { ...endpoint.headers };
 
-  // Filter headers from skill file — block dangerous headers
+  // Filter headers from skill file — block dangerous headers and sanitize values
+  const allowedMethods = new Set(['GET', 'POST', 'PUT', 'PATCH', 'DELETE', 'HEAD', 'OPTIONS']);
+  if (!allowedMethods.has(endpoint.method)) {
+    throw new Error(`Blocked: unsupported HTTP method "${endpoint.method}"`);
+  }
   for (const key of Object.keys(headers)) {
     const lower = key.toLowerCase();
     if (BLOCKED_REPLAY_HEADERS.has(lower) || lower.startsWith('sec-')) {
       delete headers[key];
+    } else {
+      // Sanitize CRLF from header values to prevent header injection
+      headers[key] = headers[key].replace(/[\r\n]/g, '');
     }
   }
 
@@ -381,10 +388,22 @@ export async function replayEndpoint(
           throw new Error(`Redirect blocked (SSRF): ${redirectCheck.reason}`);
         }
       }
+      // Strip auth headers before cross-domain redirect
+      const redirectHeaders = { ...headers };
+      const originalHost = url.hostname;
+      const redirectHost = redirectUrl.hostname;
+      if (redirectHost !== originalHost && !redirectHost.endsWith('.' + originalHost)) {
+        delete redirectHeaders['authorization'];
+        for (const key of Object.keys(redirectHeaders)) {
+          if (key.toLowerCase() === 'authorization' || redirectHeaders[key] === '[stored]') {
+            delete redirectHeaders[key];
+          }
+        }
+      }
       // Follow the redirect manually (single hop to prevent chains)
       response = await fetch(redirectFetchUrl, {
         method: 'GET',  // Redirects typically become GET
-        headers,  // Forward headers (already filtered)
+        headers: redirectHeaders,
         signal: AbortSignal.timeout(30_000),
         redirect: 'manual',  // Prevent chaining
       });

package/src/serve.ts

@@ -153,7 +153,7 @@ export async function createServeServer(
             }],
           };
         } catch (err: any) {
-          console.error('Replay failed:', err);
+          console.error('Replay failed:', err instanceof Error ? err.message : String(err));
           return {
             content: [{
               type: 'text' as const,

package/src/skill/generator.ts

@@ -49,6 +49,12 @@ const STRIP_HEADERS = new Set([
 const AUTH_HEADERS = new Set([
   'authorization',
   'x-api-key',
+  'x-guest-token',
+  'x-csrf-token',
+  'x-xsrf-token',
+  'x-auth-token',
+  'x-access-token',
+  'x-session-token',
 ]);
 
 export interface GeneratorOptions {
@@ -165,25 +171,47 @@ function extractQueryParams(url: URL): Record<string, { type: string; example: s
   return params;
 }
 
+/** Query param names that carry API keys or tokens */
+const SENSITIVE_QUERY_KEYS = /api.?key|token|secret|credential|key|access.?key/i;
+
 function scrubQueryParams(
   params: Record<string, { type: string; example: string }>,
 ): Record<string, { type: string; example: string }> {
   const scrubbed: Record<string, { type: string; example: string }> = {};
   for (const [key, val] of Object.entries(params)) {
-    scrubbed[key] = { type: val.type, example: scrubPII(val.example) };
+    // Scrub known sensitive query param names
+    if (SENSITIVE_QUERY_KEYS.test(key)) {
+      scrubbed[key] = { type: val.type, example: '[scrubbed]' };
+    } else {
+      // Also apply entropy-based detection for unknown high-entropy values
+      const classification = isLikelyToken(key, val.example);
+      if (classification.isToken) {
+        scrubbed[key] = { type: val.type, example: '[scrubbed]' };
+      } else {
+        scrubbed[key] = { type: val.type, example: scrubPII(val.example) };
+      }
+    }
   }
   return scrubbed;
 }
 
+/** Body field names that must always be scrubbed (credentials in POST bodies) */
+const SENSITIVE_BODY_KEYS = /^(password|passwd|pass|secret|client_secret|refresh_token|access_token|api_key|apikey|token|csrf_token|_csrf|xsrf_token|private_key|credential)$/i;
+
 function scrubBody(body: unknown, doScrub: boolean): unknown {
   if (!doScrub) return body;
   if (typeof body === 'string') {
     return scrubPII(body);
   }
+  if (Array.isArray(body)) {
+    return body.map(item => scrubBody(item, doScrub));
+  }
   if (body && typeof body === 'object') {
     const scrubbed: Record<string, unknown> = {};
     for (const [key, value] of Object.entries(body as Record<string, unknown>)) {
-      if (typeof value === 'string') {
+      if (SENSITIVE_BODY_KEYS.test(key) && typeof value === 'string') {
+        scrubbed[key] = '[scrubbed]';
+      } else if (typeof value === 'string') {
         scrubbed[key] = scrubPII(value);
       } else if (value && typeof value === 'object') {
         scrubbed[key] = scrubBody(value, doScrub);
@@ -310,8 +338,8 @@ export class SkillGenerator {
     let responsePreview: unknown = null;
     if (this.options.enablePreview) {
       const preview = truncatePreview(exchange.response.body);
-      responsePreview = this.options.scrub && typeof preview === 'string'
-        ? scrubPII(preview)
+      responsePreview = this.options.scrub
+        ? scrubBody(preview, true)
         : preview;
     }
 

package/src/skill/ssrf.ts

@@ -11,7 +11,7 @@ export interface ValidationResult {
 }
 
 const INTERNAL_HOSTNAMES = ['localhost'];
-const INTERNAL_SUFFIXES = ['.local', '.internal'];
+const INTERNAL_SUFFIXES = ['.local', '.internal', '.localhost', '.corp', '.intranet', '.lan', '.test', '.invalid', '.example'];
 
 /**
  * Check if a URL is safe to replay (not targeting internal infrastructure).
@@ -126,8 +126,17 @@ function isPrivateIp(ip: string): string | null {
   const v4mapped = ip.match(/^::ffff:(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})$/i);
   const ipv4 = v4mapped ? v4mapped[1] : ip;
 
+  // IPv4-mapped IPv6 hex form (e.g. ::ffff:7f00:1)
+  const v4mappedHex = ip.match(/^::ffff:([0-9a-f]{1,4}):([0-9a-f]{1,4})$/i);
+  if (v4mappedHex) {
+    const hi = parseInt(v4mappedHex[1], 16);
+    const lo = parseInt(v4mappedHex[2], 16);
+    const reconstructed = `${(hi >> 8) & 0xff}.${hi & 0xff}.${(lo >> 8) & 0xff}.${lo & 0xff}`;
+    return isPrivateIp(reconstructed);
+  }
+
   const parts = ipv4.match(/^(\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})$/);
-  if (!parts) return null; // Not an IPv4 — let it pass (non-private IPv6)
+  if (!parts) return 'unrecognized IP format'; // Fail closed for unrecognized formats
 
   const [, a, b] = parts;
   const first = Number(a);

package/src/skill/store.ts

@@ -39,7 +39,7 @@ export async function writeSkillFile(
   await mkdir(skillsDir, { recursive: true });
   await ensureGitignore(skillsDir);
   const filePath = skillPath(skill.domain, skillsDir);
-  await writeFile(filePath, JSON.stringify(skill, null, 2) + '\n');
+  await writeFile(filePath, JSON.stringify(skill, null, 2) + '\n', { mode: 0o600 });
   return filePath;
 }
 
@@ -88,9 +88,11 @@ export async function listSkillFiles(
   }
 
   const summaries: SkillSummary[] = [];
+  const DOMAIN_RE = /^[a-zA-Z0-9][a-zA-Z0-9._-]*$/;
   for (const file of files) {
     if (!file.endsWith('.json')) continue;
     const domain = file.replace(/\.json$/, '');
+    if (!DOMAIN_RE.test(domain)) continue; // skip non-conforming filenames
     const skill = await readSkillFile(domain, skillsDir);
     if (skill) {
       summaries.push({