@axlsdk/axl 0.20.1 → 0.21.0

package/README.md

@@ -71,6 +71,13 @@ Presets: `openrouter`, `azure`, `xai`, `deepseek`, `mistral`, `groq`, `bedrock`,
 
 Each provider also accepts an opt-in `rateLimit` (`{ maxConcurrent?, minIntervalMs?, acquireTimeoutMs? }`) for proactive client-side pacing on top of the automatic 429/503/529 backoff — useful when a large fan-out (e.g. an eval) shares one API key. It caps in-flight request concurrency (not token throughput) for that provider's chat calls. See [Providers → Rate limiting](../../docs/providers.md#rate-limiting-opt-in).
 
+Built-in providers require HTTPS for remote endpoints and never follow redirects.
+Literal loopback HTTP remains automatic for local inference; Docker service names,
+private-network URLs, and other remote HTTP endpoints require the provider-local
+`dangerouslyAllowInsecureHttp: true` acknowledgement. Keep Axl and proprietary
+system prompts on your trusted backend—see
+[Prompt confidentiality](../../docs/security.md#prompt-confidentiality-and-the-trusted-backend).
+
 State store options: `'memory'` (default), `'sqlite'` (requires `better-sqlite3`), or a `RedisStore` instance for multi-process deployments. See [State Stores](#state-stores).
 
 ### Tools, Agents, and Workflows

package/dist/index.cjs

@@ -705,7 +705,7 @@ async function fetchWithRetry(input, init, opts) {
     for (let attempt = 0; ; attempt++) {
       let res;
       try {
-        res = await fetch(input, init);
+        res = await fetch(input, { ...init, redirect: "manual" });
       } catch (err) {
         if (isAbortError2(err, init?.signal ?? void 0)) throw err;
         if (attempt >= maxRetries) {
@@ -911,6 +911,38 @@ function isBuiltinTablePricingEligible(profile, context) {
   return typeof effectiveTier === "string" && policy.supportedServiceTiers.includes(effectiveTier);
 }
 
+// src/http-transport.ts
+function assertSafeProviderBaseUrl(baseUrl, surface, dangerouslyAllowInsecureHttp = false) {
+  assertSafeHttpEndpoint(baseUrl, surface, dangerouslyAllowInsecureHttp, "prompts and credentials");
+}
+function assertSafeHttpEndpoint(endpoint, surface, dangerouslyAllowInsecureHttp = false, exposedData = "sensitive data") {
+  let url;
+  try {
+    url = new URL(endpoint);
+  } catch {
+    throw unsafeTransportError(surface, "a valid absolute HTTP(S) URL", exposedData);
+  }
+  if (url.protocol === "https:") return;
+  if (url.protocol !== "http:") {
+    throw unsafeTransportError(surface, "an HTTPS URL", exposedData);
+  }
+  if (dangerouslyAllowInsecureHttp || isLiteralLoopbackHost(url.hostname)) return;
+  throw unsafeTransportError(
+    surface,
+    "an HTTPS URL, or set dangerouslyAllowInsecureHttp: true only for a deliberately insecure endpoint",
+    exposedData
+  );
+}
+function isLiteralLoopbackHost(hostname) {
+  return hostname === "localhost" || hostname === "localhost." || /^127(?:\.\d{1,3}){3}$/.test(hostname) || hostname === "[::1]";
+}
+function unsafeTransportError(surface, remediation, exposedData) {
+  return new AxlError(
+    "UNSAFE_TRANSPORT",
+    `${surface} requires ${remediation}. Remote HTTP can expose ${exposedData} in transit.`
+  );
+}
+
 // src/providers/openai-compatible.ts
 function resolvePerModel(value, model, fallback) {
   if (value === void 0) return fallback;
@@ -1054,6 +1086,11 @@ var OpenAICompatibleProvider = class {
     const envBase = p.envBaseUrl ? process.env[p.envBaseUrl] : void 0;
     const explicitBase = options.baseUrl ?? envBase;
     this.baseUrl = (explicitBase ?? p.defaultBaseUrl).replace(/\/$/, "");
+    assertSafeProviderBaseUrl(
+      this.baseUrl,
+      `${p.label ?? p.name} provider`,
+      options.dangerouslyAllowInsecureHttp
+    );
     this.governor = options.rateLimit ? new RateLimiter(options.rateLimit) : void 0;
     const label = p.label ?? p.name;
     if (p.requireExplicitBaseUrl && explicitBase === void 0) {
@@ -1954,6 +1991,11 @@ var OpenAIResponsesProvider = class {
   constructor(options = {}) {
     this.apiKeySource = options.apiKey ?? process.env.OPENAI_API_KEY ?? "";
     this.baseUrl = (options.baseUrl ?? process.env.OPENAI_BASE_URL ?? "https://api.openai.com/v1").replace(/\/$/, "");
+    assertSafeProviderBaseUrl(
+      this.baseUrl,
+      "OpenAI Responses provider",
+      options.dangerouslyAllowInsecureHttp
+    );
     this.governor = options.rateLimit ? new RateLimiter(options.rateLimit) : void 0;
     if (typeof this.apiKeySource === "string" && !this.apiKeySource) {
       throw new Error("OpenAI API key is required. Set OPENAI_API_KEY or pass apiKey in options.");
@@ -2709,6 +2751,11 @@ var AnthropicProvider = class {
   constructor(options = {}) {
     this.apiKeySource = options.apiKey ?? process.env.ANTHROPIC_API_KEY ?? "";
     this.baseUrl = (options.baseUrl ?? "https://api.anthropic.com/v1").replace(/\/$/, "");
+    assertSafeProviderBaseUrl(
+      this.baseUrl,
+      "Anthropic provider",
+      options.dangerouslyAllowInsecureHttp
+    );
     this.governor = options.rateLimit ? new RateLimiter(options.rateLimit) : void 0;
     if (typeof this.apiKeySource === "string" && !this.apiKeySource) {
       throw new Error(
@@ -3399,6 +3446,11 @@ var GeminiProvider = class {
       /\/$/,
       ""
     );
+    assertSafeProviderBaseUrl(
+      this.baseUrl,
+      "Google provider",
+      options.dangerouslyAllowInsecureHttp
+    );
     this.governor = options.rateLimit ? new RateLimiter(options.rateLimit) : void 0;
     if (typeof this.apiKeySource === "string" && !this.apiKeySource) {
       throw new Error("Google API key is required. Set GOOGLE_API_KEY or pass apiKey in options.");
@@ -4286,6 +4338,7 @@ var builtinFactories = {
     return new OpenAIProvider({
       apiKey: opts.apiKey,
       baseUrl: opts.baseUrl,
+      dangerouslyAllowInsecureHttp: opts.dangerouslyAllowInsecureHttp,
       rateLimit: opts.rateLimit
     });
   },
@@ -4298,6 +4351,7 @@ var builtinFactories = {
     return new OpenAIResponsesProvider({
       apiKey: opts.apiKey,
       baseUrl: opts.baseUrl,
+      dangerouslyAllowInsecureHttp: opts.dangerouslyAllowInsecureHttp,
       rateLimit: opts.rateLimit
     });
   },
@@ -4306,6 +4360,7 @@ var builtinFactories = {
     return new AnthropicProvider({
       apiKey: opts.apiKey,
       baseUrl: opts.baseUrl,
+      dangerouslyAllowInsecureHttp: opts.dangerouslyAllowInsecureHttp,
       rateLimit: opts.rateLimit
     });
   },
@@ -4314,6 +4369,7 @@ var builtinFactories = {
     return new GeminiProvider({
       apiKey: opts.apiKey,
       baseUrl: opts.baseUrl,
+      dangerouslyAllowInsecureHttp: opts.dangerouslyAllowInsecureHttp,
       rateLimit: opts.rateLimit
     });
   }
@@ -4325,6 +4381,7 @@ function presetFactory(profile) {
       profile,
       apiKey: opts.apiKey,
       baseUrl: opts.baseUrl,
+      dangerouslyAllowInsecureHttp: opts.dangerouslyAllowInsecureHttp,
       authHeader: opts.authHeader,
       rateLimit: opts.rateLimit
     });
@@ -11335,6 +11392,14 @@ var HttpMcpClient = class {
     this.config = config;
     this.name = config.name;
     this.baseUrl = (config.uri ?? "").replace(/\/$/, "");
+    if (this.baseUrl) {
+      assertSafeHttpEndpoint(
+        this.baseUrl,
+        `MCP server "${this.name}"`,
+        config.dangerouslyAllowInsecureHttp,
+        "tool arguments and results"
+      );
+    }
   }
   name;
   tools = [];
@@ -11364,7 +11429,9 @@ var HttpMcpClient = class {
       method: "POST",
       headers: { "Content-Type": "application/json" },
       body: JSON.stringify(request),
-      signal: AbortSignal.timeout(timeoutMs)
+      signal: AbortSignal.timeout(timeoutMs),
+      // Tool calls can be non-idempotent: never forward or retry their body.
+      redirect: "manual"
     });
     if (!res.ok) {
       throw new Error(`MCP HTTP error (${res.status}): ${await res.text()}`);
@@ -14156,6 +14223,11 @@ var OpenAIEmbedder = class {
     }
     this.model = options.model ?? "text-embedding-3-small";
     this.baseUrl = options.baseUrl ?? "https://api.openai.com";
+    assertSafeProviderBaseUrl(
+      this.baseUrl,
+      "OpenAI embedder",
+      options.dangerouslyAllowInsecureHttp
+    );
     this.dimensions = options.dimensions ?? 1536;
   }
   async embed(texts, signal) {