@automattic/mcp-wordpress-remote 0.2.18 → 0.2.19

package/dist/proxy.js

@@ -36036,7 +36036,7 @@ async function selectCallbackPort(serverUrl, specifiedPort, _unused) {
 }
 
 // src/lib/config.ts
-var MCP_WORDPRESS_REMOTE_VERSION = "0.2.18";
+var MCP_WORDPRESS_REMOTE_VERSION = "0.2.19";
 var CONFIG = {
   // API Configuration
   WP_API_URL: process.env.WP_API_URL || "https://example.com",
@@ -36086,8 +36086,57 @@ var CONFIG = {
   CUSTOM_HEADERS: process.env.CUSTOM_HEADERS || "",
   // JSON string or comma-separated header:value pairs
   // Environment
-  NODE_ENV: process.env.NODE_ENV || "development"
+  NODE_ENV: process.env.NODE_ENV || "development",
+  // Proxy Configuration
+  USE_SYSTEM_PROXY: process.env.USE_SYSTEM_PROXY === "true"
+  // Enable system proxy detection (PAC files, env vars)
 };
+var getConfig = () => ({
+  /** WordPress site API endpoint */
+  wpApiUrl: CONFIG.WP_API_URL,
+  /** Whether OAuth authentication is enabled */
+  oauthEnabled: CONFIG.OAUTH_ENABLED,
+  /** Port for OAuth callback server (undefined for auto-detection on self-hosted sites) */
+  oauthCallbackPort: CONFIG.OAUTH_CALLBACK_PORT,
+  /** Hostname for OAuth callback */
+  oauthHost: CONFIG.OAUTH_HOST,
+  /** WordPress OAuth client ID */
+  wpOAuthClientId: CONFIG.WP_OAUTH_CLIENT_ID,
+  /** OAuth flow type (authorization_code recommended, implicit for legacy) */
+  oauthFlowType: CONFIG.OAUTH_FLOW_TYPE,
+  /** Whether to use PKCE (required for OAuth 2.1) */
+  oauthUsePKCE: CONFIG.OAUTH_USE_PKCE,
+  /** Whether to support dynamic client registration */
+  oauthDynamicRegistration: CONFIG.OAUTH_DYNAMIC_REGISTRATION,
+  /** Whether to use resource indicators (RFC 8707) */
+  oauthResourceIndicator: CONFIG.OAUTH_RESOURCE_INDICATOR,
+  /** Custom OAuth scopes (comma-separated) */
+  oauthScopes: CONFIG.OAUTH_SCOPES,
+  /** OAuth operation timeout in milliseconds */
+  oauthTimeout: CONFIG.OAUTH_TIMEOUT,
+  /** Lock operation timeout in milliseconds */
+  lockTimeout: CONFIG.LOCK_TIMEOUT,
+  /** Configuration directory path */
+  configDir: CONFIG.WP_MCP_CONFIG_DIR,
+  /** Log file path (null if not set) */
+  logFile: CONFIG.LOG_FILE,
+  /** WordPress API username (legacy) */
+  wpApiUsername: CONFIG.WP_API_USERNAME,
+  /** WordPress API password (legacy) */
+  wpApiPassword: CONFIG.WP_API_PASSWORD,
+  /** JWT token for authentication */
+  jwtToken: CONFIG.JWT_TOKEN,
+  /** WooCommerce customer key */
+  wooCustomerKey: CONFIG.WOO_CUSTOMER_KEY,
+  /** WooCommerce customer secret */
+  wooCustomerSecret: CONFIG.WOO_CUSTOMER_SECRET,
+  /** Custom headers for API requests */
+  customHeaders: CONFIG.CUSTOM_HEADERS,
+  /** Current environment */
+  nodeEnv: CONFIG.NODE_ENV,
+  /** Whether to use system proxy (PAC files on macOS, env vars on all platforms) */
+  useSystemProxy: CONFIG.USE_SYSTEM_PROXY
+});
 function parseOAuthScopes(envScopes, defaultScopes) {
   if (!envScopes || envScopes.trim() === "") {
     return defaultScopes;
@@ -36250,6 +36299,165 @@ function validateNodeVersion(requiredVersion = 18) {
   }
 }
 
+// src/lib/proxy-utils.ts
+import { execSync } from "child_process";
+import { SocksProxyAgent } from "socks-proxy-agent";
+import { HttpsProxyAgent } from "https-proxy-agent";
+var proxyConfig = { type: "none" };
+var initializationPromise = null;
+function detectMacOsPac() {
+  if (process.platform !== "darwin") return null;
+  try {
+    const output = execSync("scutil --proxy", { encoding: "utf-8", timeout: 3e3 });
+    const pacEnabled = output.match(/ProxyAutoConfigEnable\s*:\s*(\d)/)?.[1] === "1";
+    const pacUrl = output.match(/ProxyAutoConfigURLString\s*:\s*(\S+)/)?.[1];
+    if (pacEnabled && pacUrl) {
+      return pacUrl;
+    }
+  } catch {
+  }
+  return null;
+}
+function isSocksProxy(url) {
+  return url.toLowerCase().startsWith("socks");
+}
+function sanitizeProxyUrl(url) {
+  try {
+    const parsed = new URL(url);
+    if (parsed.password) parsed.password = "***";
+    return parsed.toString();
+  } catch {
+    return url.replace(/\/\/[^:]+:[^@]+@/, "//***:***@");
+  }
+}
+function shouldBypassProxy(targetUrl) {
+  const noProxy = process.env.NO_PROXY || process.env.no_proxy;
+  if (!noProxy) return false;
+  let hostname2;
+  try {
+    hostname2 = new URL(targetUrl).hostname.toLowerCase();
+  } catch {
+    return false;
+  }
+  const rules = noProxy.split(",").map((r2) => r2.trim().toLowerCase()).filter((r2) => r2.length > 0);
+  for (const rule of rules) {
+    if (rule === "*") return true;
+    if (hostname2 === rule) return true;
+    if (rule.startsWith(".") && hostname2.endsWith(rule) || !rule.startsWith(".") && hostname2.endsWith(`.${rule}`)) {
+      return true;
+    }
+  }
+  return false;
+}
+function detectEnvProxy() {
+  const socksProxy = process.env.SOCKS_PROXY || process.env.socks_proxy;
+  if (socksProxy) {
+    return { url: socksProxy, type: "socks" };
+  }
+  const httpsProxy = process.env.HTTPS_PROXY || process.env.https_proxy;
+  if (httpsProxy) {
+    return { url: httpsProxy, type: isSocksProxy(httpsProxy) ? "socks" : "http" };
+  }
+  const allProxy = process.env.ALL_PROXY || process.env.all_proxy;
+  if (allProxy) {
+    return { url: allProxy, type: isSocksProxy(allProxy) ? "socks" : "http" };
+  }
+  const httpProxy = process.env.HTTP_PROXY || process.env.http_proxy;
+  if (httpProxy) {
+    return { url: httpProxy, type: isSocksProxy(httpProxy) ? "socks" : "http" };
+  }
+  return null;
+}
+async function initializeProxy() {
+  if (initializationPromise) {
+    return initializationPromise;
+  }
+  initializationPromise = doInitializeProxy().catch((error) => {
+    initializationPromise = null;
+    throw error;
+  });
+  return initializationPromise;
+}
+async function doInitializeProxy() {
+  const pacUrl = detectMacOsPac();
+  if (pacUrl) {
+    try {
+      const response = await fetch(pacUrl);
+      const pacScript = await response.text();
+      const { getQuickJS } = await import("@tootallnate/quickjs-emscripten");
+      const { createPacResolver } = await import("pac-resolver");
+      const qjs = await getQuickJS();
+      const resolver = createPacResolver(qjs, pacScript);
+      proxyConfig = {
+        type: "pac",
+        pacResolver: resolver
+      };
+      logger.info(`PAC proxy initialized from ${sanitizeProxyUrl(pacUrl)}`, "PROXY");
+      return;
+    } catch (error) {
+      logger.error(`Failed to initialize PAC proxy: ${error}`, "PROXY");
+    }
+  }
+  const envProxy = detectEnvProxy();
+  if (envProxy) {
+    proxyConfig = { type: "env", envProxy };
+    logger.info(`Proxy configured from environment: ${sanitizeProxyUrl(envProxy.url)}`, "PROXY");
+    return;
+  }
+  logger.debug("No proxy configured", "PROXY");
+  proxyConfig = { type: "none" };
+}
+async function getAgentForUrl(url) {
+  if (proxyConfig.type === "none") {
+    return void 0;
+  }
+  if (shouldBypassProxy(url)) {
+    logger.debug(`Bypassing proxy for ${url} (matches NO_PROXY)`, "PROXY");
+    return void 0;
+  }
+  if (proxyConfig.type === "pac" && proxyConfig.pacResolver) {
+    try {
+      const result = await proxyConfig.pacResolver(url);
+      const directives = result.split(";");
+      for (const rawDirective of directives) {
+        const directive = rawDirective.trim();
+        if (!directive) continue;
+        if (directive.toUpperCase() === "DIRECT") {
+          logger.debug(`PAC returned DIRECT for ${url}`, "PROXY");
+          return void 0;
+        }
+        const socksMatch = directive.match(/SOCKS5?\s+(\S+):(\d+)/i);
+        if (socksMatch) {
+          const proxyUrl = `socks5://${socksMatch[1]}:${socksMatch[2]}`;
+          logger.debug(`PAC returned SOCKS proxy for ${url}: ${sanitizeProxyUrl(proxyUrl)}`, "PROXY");
+          return new SocksProxyAgent(proxyUrl);
+        }
+        const proxyMatch = directive.match(/PROXY\s+(\S+):(\d+)/i);
+        if (proxyMatch) {
+          const proxyUrl = `http://${proxyMatch[1]}:${proxyMatch[2]}`;
+          logger.debug(`PAC returned HTTP proxy for ${url}: ${sanitizeProxyUrl(proxyUrl)}`, "PROXY");
+          return new HttpsProxyAgent(proxyUrl);
+        }
+      }
+      logger.debug(`PAC returned no usable proxy for ${url}: ${result}`, "PROXY");
+    } catch (error) {
+      logger.warn(`PAC evaluation failed for ${url}: ${error}`, "PROXY");
+    }
+    return void 0;
+  }
+  if (proxyConfig.type === "env" && proxyConfig.envProxy) {
+    const { url: proxyUrl, type } = proxyConfig.envProxy;
+    try {
+      logger.debug(`Using env proxy ${sanitizeProxyUrl(proxyUrl)} for ${url}`, "PROXY");
+      return type === "socks" ? new SocksProxyAgent(proxyUrl) : new HttpsProxyAgent(proxyUrl);
+    } catch (error) {
+      logger.error(`Invalid proxy URL "${proxyUrl}": ${error}`, "PROXY");
+      return void 0;
+    }
+  }
+  return void 0;
+}
+
 // src/lib/fetch-utils.ts
 async function setupFetchPolyfill() {
   if (typeof globalThis.fetch !== "function") {
@@ -36269,6 +36477,22 @@ async function setupFetchPolyfill() {
   } else {
     logger.info("Using native fetch API", "SYSTEM");
   }
+  if (getConfig().useSystemProxy) {
+    await initializeProxy();
+  } else {
+    logger.debug("System proxy support disabled (USE_SYSTEM_PROXY=false)", "PROXY");
+  }
+}
+async function proxyFetch(url, init) {
+  if (!getConfig().useSystemProxy) {
+    return fetch(url, init);
+  }
+  const agent = await getAgentForUrl(url);
+  if (agent) {
+    const nodeFetch = (await Promise.resolve().then(() => (init_src(), src_exports))).default;
+    return nodeFetch(url, { ...init, agent });
+  }
+  return fetch(url, init);
 }
 
 // src/lib/wordpress-api.ts
@@ -36783,7 +37007,7 @@ async function discoverAuthorizationServerMetadata(authorizationServerUrl) {
     const metadataUrl = new URL("/.well-known/oauth-authorization-server", authorizationServerUrl);
     logger.oauth(`Discovering authorization server metadata: ${metadataUrl}`);
     const customHeaders = getCustomHeaders();
-    const response = await fetch(metadataUrl.toString(), {
+    const response = await proxyFetch(metadataUrl.toString(), {
       headers: {
         "Accept": "application/json",
         ...customHeaders
@@ -36820,7 +37044,7 @@ async function discoverProtectedResourceMetadata(resourceUrl) {
     const metadataUrl = new URL("/.well-known/oauth-protected-resource", url.origin);
     logger.oauth(`Discovering protected resource metadata: ${metadataUrl}`);
     const customHeaders = getCustomHeaders();
-    const response = await fetch(metadataUrl.toString(), {
+    const response = await proxyFetch(metadataUrl.toString(), {
       headers: {
         "Accept": "application/json",
         ...customHeaders
@@ -36886,7 +37110,7 @@ async function registerDynamicClient(registrationEndpoint, registrationRequest)
   try {
     logger.oauth(`Attempting dynamic client registration: ${registrationEndpoint}`);
     const customHeaders = getCustomHeaders();
-    const response = await fetch(registrationEndpoint, {
+    const response = await proxyFetch(registrationEndpoint, {
       method: "POST",
       headers: {
         "Content-Type": "application/json",
@@ -36938,7 +37162,7 @@ async function exchangeAuthorizationCode(tokenEndpoint, code, redirectUri, clien
       params.set("resource", resource);
     }
     const customHeaders = getCustomHeaders();
-    const response = await fetch(tokenEndpoint, {
+    const response = await proxyFetch(tokenEndpoint, {
       method: "POST",
       headers: {
         "Content-Type": "application/x-www-form-urlencoded",
@@ -37406,7 +37630,7 @@ var MCPOAuthProvider = class {
     try {
       logger.oauth("Attempting discovery via 401 response method");
       const customHeaders = getCustomHeaders();
-      const response = await fetch(this.config.serverUrl, {
+      const response = await proxyFetch(this.config.serverUrl, {
         headers: {
           Accept: "application/json",
           ...customHeaders
@@ -37418,7 +37642,7 @@ var MCPOAuthProvider = class {
           const authInfo = parseWWWAuthenticateHeader(wwwAuthHeader);
           logger.oauth("WWW-Authenticate header parsed successfully");
           if (authInfo.resource_metadata_url) {
-            const metadataResponse = await fetch(authInfo.resource_metadata_url, {
+            const metadataResponse = await proxyFetch(authInfo.resource_metadata_url, {
               headers: {
                 "Accept": "application/json",
                 ...customHeaders
@@ -38493,7 +38717,7 @@ async function wpRequest(requestData, useJsonRpc = true) {
     logger.api("Sending request to WordPress API...");
     logger.debug(`Request URL: ${url}`, "API");
     logger.debug(`Request method: ${method}`, "API");
-    const response = await fetch(url, fetchOptions);
+    const response = await proxyFetch(url, fetchOptions);
     logger.debug(`Response status: ${response.status}`, "API");
     if (!response.ok) {
       const errorText = await response.text();
@@ -38914,7 +39138,7 @@ async function WordPressProxy() {
   const server = new Server(
     {
       name: "WordPress MCP Remote Proxy",
-      version: "0.2.17"
+      version: MCP_WORDPRESS_REMOTE_VERSION
     },
     {
       capabilities: {
@@ -38947,7 +39171,7 @@ async function WordPressProxy() {
         protocolVersion: "2025-06-18",
         serverInfo: {
           name: "WordPress MCP Remote Proxy",
-          version: "0.2.17"
+          version: MCP_WORDPRESS_REMOTE_VERSION
         },
         capabilities: {
           tools: {},

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@automattic/mcp-wordpress-remote",
-  "version": "0.2.18",
+  "version": "0.2.19",
   "description": "MCP WordPress Remote proxy server",
   "engines": {
     "node": ">=18.0.0"
@@ -59,9 +59,13 @@
   },
   "dependencies": {
     "@modelcontextprotocol/sdk": "^1.8.0",
+    "@tootallnate/quickjs-emscripten": "^0.23.0",
     "express": "^4.18.2",
+    "https-proxy-agent": "^7.0.6",
     "node-fetch": "^3.3.2",
-    "open": "^10.0.0"
+    "open": "^10.0.0",
+    "pac-resolver": "^7.0.1",
+    "socks-proxy-agent": "^8.0.5"
   },
   "devDependencies": {
     "@playwright/test": "^1.54.2",
@@ -101,7 +105,11 @@
       "open"
     ],
     "external": [
-      "node:*"
+      "node:*",
+      "@tootallnate/quickjs-emscripten",
+      "pac-resolver",
+      "socks-proxy-agent",
+      "https-proxy-agent"
     ],
     "minify": false,
     "sourcemap": false,