@autokap/core 1.6.6 → 1.6.8

package/dist/config.d.ts

@@ -34,4 +34,18 @@ declare function assertAllowedApiOrigin(candidateUrl: string, baselineUrl: strin
  */
 export declare function validateServerOrigin(candidateUrl: string): void;
 export declare function validatePublicHttpUrl(candidateUrl: string, fieldLabel?: string): void;
+/**
+ * Validator for URLs that are dereferenced ONLY by the user's local machine —
+ * project baseUrls (Playwright local navigates there), credential loginUrls,
+ * etc. There is no SSRF surface here: the cloud server never fetches these.
+ *
+ * Accepts localhost, RFC1918 private ranges, link-local, IPv6 loopback,
+ * `.local` / `.internal` mDNS names. Still rejects non-http(s) schemes and
+ * unparseable URLs, because those aren't valid navigation targets anyway.
+ *
+ * Use this instead of `validatePublicHttpUrl` whenever the URL is consumed
+ * client-side. Reserve `validatePublicHttpUrl` for inputs the cloud server
+ * will fetch (apiBaseUrl, proxyUrl, webhookUrl).
+ */
+export declare function validateClientConsumedHttpUrl(candidateUrl: string, fieldLabel?: string): void;
 export { DEFAULT_API_BASE_URL, DEFAULT_WS_URL, LOCAL_API_BASE_URL, API_KEY_ENV_VAR, RUN_TOKEN_ENV_VAR, API_BASE_URL_ENV_VAR, WS_URL_ENV_VAR, ALLOW_UNSAFE_SERVER_ORIGIN_ENV_VAR, assertAllowedApiOrigin, };

package/dist/config.js

@@ -228,6 +228,31 @@ export function validatePublicHttpUrl(candidateUrl, fieldLabel = 'URL') {
             `Set ${ALLOW_UNSAFE_SERVER_ORIGIN_ENV_VAR}=1 to override (dev/test only).`);
     }
 }
+/**
+ * Validator for URLs that are dereferenced ONLY by the user's local machine —
+ * project baseUrls (Playwright local navigates there), credential loginUrls,
+ * etc. There is no SSRF surface here: the cloud server never fetches these.
+ *
+ * Accepts localhost, RFC1918 private ranges, link-local, IPv6 loopback,
+ * `.local` / `.internal` mDNS names. Still rejects non-http(s) schemes and
+ * unparseable URLs, because those aren't valid navigation targets anyway.
+ *
+ * Use this instead of `validatePublicHttpUrl` whenever the URL is consumed
+ * client-side. Reserve `validatePublicHttpUrl` for inputs the cloud server
+ * will fetch (apiBaseUrl, proxyUrl, webhookUrl).
+ */
+export function validateClientConsumedHttpUrl(candidateUrl, fieldLabel = 'URL') {
+    let parsed;
+    try {
+        parsed = new URL(candidateUrl);
+    }
+    catch {
+        throw new Error(`Invalid ${fieldLabel}: ${candidateUrl}`);
+    }
+    if (parsed.protocol !== 'http:' && parsed.protocol !== 'https:') {
+        throw new Error(`Refusing ${fieldLabel} with unsupported scheme "${parsed.protocol}"; only http(s) are allowed.`);
+    }
+}
 function isPrivateOrInternalHost(hostname) {
     const lower = hostname.toLowerCase();
     if (lower === 'localhost')

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@autokap/core",
-  "version": "1.6.6",
+  "version": "1.6.8",
   "description": "Shared core library for AutoKap CLI and MCP server",
   "license": "ISC",
   "author": "AutoKap",