@crewhaus/computer-use-driver 0.6.0 → 0.8.0

package/LICENSE

@@ -0,0 +1,201 @@
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright [yyyy] [name of copyright owner]
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.

package/NOTICE

@@ -0,0 +1,9 @@
+CrewHaus Factory
+Copyright 2026 Max Meier
+
+This product includes software developed by Max Meier
+(operating as StudioMax — https://studiomax.io) and contributors.
+
+The CrewHaus name and logo are trademarks of Max Meier. See
+https://github.com/crewhaus/factory/blob/main/TRADEMARK.md for the
+use-of-marks policy.

package/README.md

@@ -0,0 +1,9 @@
+# @crewhaus/computer-use-driver
+
+Cross-platform mouse/keyboard/screenshot driver — chromium backend (Section 25 BROW)
+
+Part of [CrewHaus](https://github.com/crewhaus/factory). Most people install the CLI (`npm install -g crewhaus`) rather than this package.
+
+Requires [Bun](https://bun.sh) `>=1.3.14`; plain Node is not supported.
+
+[Source](https://github.com/crewhaus/factory/tree/main/packages/computer-use-driver)

package/dist/ssrf-proxy.d.ts

@@ -15,12 +15,27 @@ export type StartSsrfPinningProxyOptions = {
     readonly _isIpBlocked?: (ip: string) => boolean;
 };
 /**
- * Normalise an IPv4 literal to canonical dotted-decimal. Browsers and many
- * HTTP stacks accept octal (`0177.0.0.1`), hex (`0x7f.0.0.1` / `0x7f000001`),
- * and 32-bit integer (`2130706433`) forms — all of which resolve to the same
- * address as `127.0.0.1`. Canonicalising first means `isPrivateIp` classifies
- * them. Returns dotted-decimal, or `null` if `raw` is not an IPv4 literal.
+ * Canonicalise an IPv4 literal.
+ *
+ * `inet_aton` forms are the classic allow-list bypass: `0177.0.0.1`,
+ * `0x7f.0.0.1`, `2130706433` and `127.1` are all 127.0.0.1, and a check that
+ * only understands dotted-decimal waves every one of them through. Returns
+ * `null` when the string is not an IPv4 literal at all.
  */
 export declare function normalizeIpv4(raw: string): string | null;
-export declare function isPrivateIp(addr: string): boolean;
+/**
+ * Expand an IPv6 literal to its eight 16-bit groups, or `null` when the string
+ * is not one.
+ *
+ * Classifying IPv6 by its TEXT is where the bypasses live, because one address
+ * has many spellings and the one a check was written against is rarely the one
+ * that arrives. `http://[::ffff:169.254.169.254]/` never reaches a guard in
+ * that form: the WHATWG URL parser re-serialises the embedded quad as hex
+ * pieces, so what the guard sees is `::ffff:a9fe:a9fe`. Normalising to numbers
+ * first means the prefix tests below are arithmetic, and spelling stops
+ * mattering.
+ */
+export declare function parseIpv6(raw: string): ReadonlyArray<number> | null;
+/** Ranges that are never a public RPC endpoint. */
+export declare function isPrivateIp(address: string): boolean;
 export declare function startSsrfPinningProxy(opts?: StartSsrfPinningProxyOptions): Promise<SsrfPinningProxy>;

package/dist/ssrf-proxy.js

@@ -27,138 +27,244 @@
  * attacker page fetch http://127.0.0.1:… directly. `<-loopback>` removes that
  * implicit bypass so loopback targets also route here — and get blocked.
  *
- * The IP-validation helpers mirror tool-fetch's `assertNotSsrf` family —
- * duplicated (like tool-navigate and crawler) rather than extracted to a
- * shared package, per the Pillar 3 convention; keep the copies in sync.
+ * The IP-validation helpers below are the synchronised private-address
+ * classifier, byte-identical to every other copy in the tree. Its own header
+ * explains why it parses addresses instead of matching their text; never edit
+ * one copy alone.
  *
- * The proxy binds 127.0.0.1 on an ephemeral port and refuses private targets,
- * so it cannot be leveraged by other local processes to reach internal
- * services.
+ * WHAT THE LOOPBACK BIND DOES AND DOES NOT GUARANTEE. The proxy listens on
+ * 127.0.0.1 on an ephemeral port, so only processes on this machine can reach
+ * it, and both request paths — the absolute-form URL and the CONNECT target —
+ * are classified by that same `isPrivateIp`, so no spelling of a private
+ * address is tunnelled or forwarded. It is NOT authenticated: any local process
+ * that finds the port can use it to reach PUBLIC hosts for as long as the
+ * browser session lasts. And an IPv4 address behind an operator-chosen NAT64
+ * prefix stays undecidable from the address alone (see the block header). Until
+ * 2026-09-18 this paragraph claimed flatly that the proxy "cannot be leveraged
+ * by other local processes to reach internal services"; it could, because the
+ * CONNECT target was classified by text and `CONNECT [0:0:0:0:0:0:0:1]:<port>`
+ * was answered with 200.
  */
 import { lookup as dnsLookup } from "node:dns/promises";
 import * as http from "node:http";
 import * as net from "node:net";
 import { ComputerUseDriverError } from "./errors";
 const defaultDnsLookup = (host) => dnsLookup(host, { verbatim: false });
+// ---------------------------------------------------------------------------
+// BEGIN SYNCHRONISED BLOCK — private-address classifier
+//
+// This block is BYTE-IDENTICAL across every package that guards an outbound
+// request. Do not edit one copy: `apps/cli/src/tool-registry.test.ts` hashes
+// them all and fails if any differs, and it asserts how many it found, because
+// a copy-scanning guard that matches nothing reports green.
+//
+// It exists in copies rather than a shared package because these files are
+// otherwise independent per-package networking layers; a guard proving the
+// copies are identical is cheaper and safer than the import graph a shared
+// package would need across `crawler`, `computer-use-driver` and ten tools.
+//
+// WHY IT PARSES INSTEAD OF MATCHING TEXT. Six copies were confirmed
+// exploitable on 2026-09-18 because they compared address STRINGS. The WHATWG
+// URL parser rewrites `[::ffff:169.254.169.254]` to `[::ffff:a9fe:a9fe]`, so a
+// text check never sees the spelling it was written for; and `64:ff9b::a9fe:a9fe`
+// IS 169.254.169.254 on any network running DNS64/NAT64. Parsing numerically and
+// recursing into the embedded IPv4 is the only form that holds.
+//
+// WHAT IT CANNOT DO. RFC 6052 lets an operator choose any Network-Specific
+// Prefix for NAT64, so an embedded IPv4 behind an arbitrary NSP is undecidable
+// from the address alone. That case is configuration, and the callers that need
+// it resolve the host and re-check the ANSWER before dialling.
+// ---------------------------------------------------------------------------
 /**
- * Normalise an IPv4 literal to canonical dotted-decimal. Browsers and many
- * HTTP stacks accept octal (`0177.0.0.1`), hex (`0x7f.0.0.1` / `0x7f000001`),
- * and 32-bit integer (`2130706433`) forms — all of which resolve to the same
- * address as `127.0.0.1`. Canonicalising first means `isPrivateIp` classifies
- * them. Returns dotted-decimal, or `null` if `raw` is not an IPv4 literal.
+ * Canonicalise an IPv4 literal.
+ *
+ * `inet_aton` forms are the classic allow-list bypass: `0177.0.0.1`,
+ * `0x7f.0.0.1`, `2130706433` and `127.1` are all 127.0.0.1, and a check that
+ * only understands dotted-decimal waves every one of them through. Returns
+ * `null` when the string is not an IPv4 literal at all.
  */
 export function normalizeIpv4(raw) {
     const trimmed = raw.trim();
-    if (trimmed === "")
+    if (trimmed === "" || /[^0-9a-fA-FxX.]/.test(trimmed))
+        return null;
+    const parts = trimmed.split(".");
+    if (parts.length === 0 || parts.length > 4)
         return null;
-    const parseComponent = (s) => {
-        if (s === "")
+    const values = [];
+    for (const part of parts) {
+        if (part === "")
             return null;
         let value;
-        if (/^0[xX][0-9a-fA-F]+$/.test(s)) {
-            value = Number.parseInt(s.slice(2), 16);
-        }
-        else if (/^0[0-7]+$/.test(s)) {
-            value = Number.parseInt(s, 8);
-        }
-        else if (/^[0-9]+$/.test(s)) {
-            value = Number.parseInt(s, 10);
-        }
-        else {
+        if (/^0[xX][0-9a-fA-F]+$/.test(part))
+            value = Number.parseInt(part.slice(2), 16);
+        else if (/^0[0-7]+$/.test(part))
+            value = Number.parseInt(part.slice(1), 8);
+        else if (/^\d+$/.test(part))
+            value = Number.parseInt(part, 10);
+        else
             return null;
-        }
-        return Number.isNaN(value) ? null : value;
-    };
-    const segments = trimmed.split(".");
-    if (segments.length > 4)
-        return null;
-    const components = [];
-    for (const seg of segments) {
-        const value = parseComponent(seg);
-        if (value === null || value < 0)
+        if (!Number.isFinite(value) || value < 0)
             return null;
-        components.push(value);
+        values.push(value);
     }
-    // RFC-3986-style packing: the final component absorbs the remaining bytes
-    // (e.g. `127.1` ⇒ 127.0.0.1, `2130706433` ⇒ 127.0.0.1, `0x7f.0.0.1`).
-    const n = components.length;
-    const octets = [0, 0, 0, 0];
-    for (let i = 0; i < n - 1; i++) {
-        const c = components[i];
-        if (c > 255)
+    // The short forms pack the remaining octets into the last part: `127.1` is
+    // 127.0.0.1, not 127.1.0.0. Getting this backwards is how a bypass survives.
+    const last = values[values.length - 1];
+    const leading = values.slice(0, -1);
+    if (leading.some((v) => v > 255))
+        return null;
+    const remaining = 4 - leading.length;
+    if (last >= 2 ** (8 * remaining))
+        return null;
+    const octets = [...leading];
+    for (let i = remaining - 1; i >= 0; i--)
+        octets.push((last >>> (8 * i)) & 0xff);
+    return octets.join(".");
+}
+/**
+ * Expand an IPv6 literal to its eight 16-bit groups, or `null` when the string
+ * is not one.
+ *
+ * Classifying IPv6 by its TEXT is where the bypasses live, because one address
+ * has many spellings and the one a check was written against is rarely the one
+ * that arrives. `http://[::ffff:169.254.169.254]/` never reaches a guard in
+ * that form: the WHATWG URL parser re-serialises the embedded quad as hex
+ * pieces, so what the guard sees is `::ffff:a9fe:a9fe`. Normalising to numbers
+ * first means the prefix tests below are arithmetic, and spelling stops
+ * mattering.
+ */
+export function parseIpv6(raw) {
+    let text = raw.trim().toLowerCase();
+    if (text.startsWith("["))
+        text = text.slice(1);
+    if (text.endsWith("]"))
+        text = text.slice(0, -1);
+    const zone = text.indexOf("%"); // fe80::1%eth0
+    if (zone !== -1)
+        text = text.slice(0, zone);
+    if (!text.includes(":"))
+        return null;
+    // A trailing dotted quad is the last two groups written in IPv4. Require all
+    // three dots: without that, `::1` parses as a one-part inet_aton address and
+    // takes a path that has nothing to do with what was written.
+    const dotted = /^(.*:)(\d+(?:\.\d+){3})$/.exec(text);
+    if (dotted !== null) {
+        const quad = normalizeIpv4(dotted[2]);
+        if (quad === null)
             return null;
-        octets[i] = c;
+        const o = quad.split(".").map((n) => Number.parseInt(n, 10));
+        const hi = (o[0] << 8) | o[1];
+        const lo = (o[2] << 8) | o[3];
+        text = `${dotted[1]}${hi.toString(16)}:${lo.toString(16)}`;
     }
-    const last = components[n - 1];
-    const maxLast = 2 ** (8 * (4 - (n - 1)));
-    if (last >= maxLast)
+    const halves = text.split("::");
+    if (halves.length > 2)
+        return null;
+    const pieces = (part) => (part === "" ? [] : part.split(":"));
+    const head = pieces(halves[0]);
+    const tail = halves.length === 2 ? pieces(halves[1]) : [];
+    if (halves.length === 1 && head.length !== 8)
+        return null;
+    if (head.length + tail.length > 8)
         return null;
-    let rest = last;
-    for (let i = 3; i >= n - 1; i--) {
-        octets[i] = rest & 0xff;
-        rest = Math.floor(rest / 256);
+    const groups = [];
+    for (const piece of head) {
+        if (!/^[0-9a-f]{1,4}$/.test(piece))
+            return null;
+        groups.push(Number.parseInt(piece, 16));
     }
-    return octets.join(".");
+    for (let i = head.length + tail.length; i < 8; i++)
+        groups.push(0);
+    for (const piece of tail) {
+        if (!/^[0-9a-f]{1,4}$/.test(piece))
+            return null;
+        groups.push(Number.parseInt(piece, 16));
+    }
+    return groups.length === 8 ? groups : null;
 }
-export function isPrivateIp(addr) {
-    // Strip IPv6 brackets if present.
-    const ip = addr.replace(/^\[/, "").replace(/\]$/, "");
-    const lowerIp = ip.toLowerCase();
-    // IPv6 unspecified / loopback / link-local / unique-local
-    if (lowerIp === "::" || lowerIp === "::1")
-        return true;
-    if (lowerIp.startsWith("fe80:"))
-        return true;
-    if (lowerIp.startsWith("fc") || lowerIp.startsWith("fd"))
-        return true;
-    // IPv4-mapped IPv6 (e.g. ::ffff:127.0.0.1 / ::ffff:7f00:1) — classify by the
-    // embedded IPv4 address so a mapped literal can't smuggle past the checks.
-    const mapped = lowerIp.match(/^::ffff:(.+)$/);
-    if (mapped) {
-        const tail = mapped[1];
-        if (tail.includes(".")) {
-            return isPrivateIp(tail);
-        }
-        // Hex form ::ffff:7f00:0001 → 127.0.0.1
-        const hexGroups = tail.split(":");
-        if (hexGroups.length === 2 && hexGroups.every((g) => /^[0-9a-f]{1,4}$/.test(g))) {
-            const hi = Number.parseInt(hexGroups[0], 16);
-            const lo = Number.parseInt(hexGroups[1], 16);
-            return isPrivateIp([(hi >> 8) & 0xff, hi & 0xff, (lo >> 8) & 0xff, lo & 0xff].join("."));
-        }
-        return false;
+/**
+ * The IPv4 address an IPv6 address carries, when it carries one.
+ *
+ * Every transition mechanism embeds a v4 address somewhere, and every one of
+ * them is a way to reach a v4 destination while wearing a v6 spelling that no
+ * v4 range check looks at. The NAT64 well-known prefix is the sharpest: a
+ * DNS64 resolver answers an IPv4-only name with `64:ff9b::<the v4>`, so
+ * `64:ff9b::a9fe:a9fe` IS the metadata service on any network that runs one.
+ */
+function embeddedIpv4(g) {
+    const quad = (hi, lo) => `${(hi >>> 8) & 0xff}.${hi & 0xff}.${(lo >>> 8) & 0xff}.${lo & 0xff}`;
+    const zeros = (from, to) => g.slice(from, to).every((x) => x === 0);
+    const last = quad(g[6], g[7]);
+    if (zeros(0, 5) && g[5] === 0xffff)
+        return last; // ::ffff:0:0/96, IPv4-mapped
+    if (zeros(0, 4) && g[4] === 0xffff && g[5] === 0)
+        return last; // ::ffff:0:0:0/96, translated
+    if (g[0] === 0x64 && g[1] === 0xff9b)
+        return last; // 64:ff9b::/96 and 64:ff9b:1::/48, NAT64
+    if (g[0] === 0x2002)
+        return quad(g[1], g[2]); // 2002::/16, 6to4
+    // ::a.b.c.d, IPv4-compatible: deprecated, still routed by some stacks, and
+    // not to be confused with `::` or `::1`, which are handled before this.
+    if (zeros(0, 6))
+        return last;
+    return null;
+}
+/** Ranges that are never a public RPC endpoint. */
+export function isPrivateIp(address) {
+    const v4 = normalizeIpv4(address);
+    if (v4 !== null) {
+        const [a = 0, b = 0, c = 0, d = 0] = v4.split(".").map((n) => Number.parseInt(n, 10));
+        if (a === 0 || a === 10 || a === 127)
+            return true;
+        if (a === 169 && b === 254)
+            return true; // link-local, and the metadata service
+        if (a === 172 && b >= 16 && b <= 31)
+            return true;
+        if (a === 192 && b === 168)
+            return true;
+        if (a === 192 && b === 0 && c === 0)
+            return true;
+        if (a === 100 && b >= 64 && b <= 127)
+            return true; // carrier-grade NAT
+        if (a === 198 && (b === 18 || b === 19))
+            return true; // benchmarking
+        if (a >= 224)
+            return true; // multicast, reserved, broadcast
+        return a === 255 && b === 255 && c === 255 && d === 255;
     }
-    // IPv4 — normalise octal/hex/integer literals to dotted-decimal first.
-    const normalized = normalizeIpv4(ip);
-    if (normalized === null)
-        return false;
-    const parts = normalized.split(".").map((p) => Number.parseInt(p, 10));
-    if (parts.length !== 4 || parts.some((nn) => Number.isNaN(nn) || nn < 0 || nn > 255)) {
+    const groups = parseIpv6(address);
+    if (groups === null)
         return false;
-    }
-    const [a, b] = parts;
-    if (a === 127)
-        return true; // 127.0.0.0/8 loopback
-    if (a === 10)
-        return true; // 10.0.0.0/8 RFC1918
-    if (a === 169 && b === 254)
-        return true; // 169.254.0.0/16 link-local + AWS metadata
-    if (a === 172 && b >= 16 && b <= 31)
-        return true; // 172.16.0.0/12 RFC1918
-    if (a === 192 && b === 168)
-        return true; // 192.168.0.0/16 RFC1918
-    if (a === 100 && b >= 64 && b <= 127)
-        return true; // 100.64.0.0/10 CGNAT (RFC6598)
-    if (a === 192 && b === 0 && parts[2] === 0)
-        return true; // 192.0.0.0/24 IETF protocol (RFC6890)
-    if (a === 198 && (b === 18 || b === 19))
-        return true; // 198.18.0.0/15 benchmarking (RFC2544)
-    if (a === 0)
-        return true; // 0.0.0.0/8
-    return false;
+    if (groups.every((g) => g === 0))
+        return true; // ::, the unspecified address
+    if (groups.slice(0, 7).every((g) => g === 0) && groups[7] === 1)
+        return true; // ::1
+    const carried = embeddedIpv4(groups);
+    if (carried !== null)
+        return isPrivateIp(carried);
+    const head = groups[0];
+    if ((head & 0xfe00) === 0xfc00)
+        return true; // fc00::/7, unique-local
+    if ((head & 0xffc0) === 0xfe80)
+        return true; // fe80::/10, link-local
+    return (head & 0xff00) === 0xff00; // ff00::/8, multicast
 }
+// END SYNCHRONISED BLOCK
 class BlockedTargetError extends ComputerUseDriverError {
 }
+/**
+ * A host as the classifier must see it: brackets off, lower-cased.
+ *
+ * On the plain-HTTP path `new URL()` canonicalises the hostname before we ever
+ * look at it. The CONNECT path has no URL — its target is read straight off the
+ * request line, so whatever the client typed is what arrives, uncompressed IPv6
+ * and all. Both paths go through here and then through the same `isPrivateIp`,
+ * which parses rather than matches text; that, not this function, is what makes
+ * the spelling stop mattering.
+ */
+function unbracketHost(host) {
+    return host.trim().replace(/^\[/, "").replace(/\]$/, "").toLowerCase();
+}
 /**
  * Resolve `hostname` once and validate the result. Returns the pinned IP the
  * caller must dial — never let anything re-resolve after this.
@@ -169,8 +275,11 @@ async function resolvePinned(hostname, lookupFn, isBlocked) {
         throw new BlockedTargetError(`blocked host "${hostname}": loopback/mDNS name`);
     }
     // An IP literal is its own pinned target — no DNS lookup, nothing to rebind.
-    const unbracketed = lower.replace(/^\[/, "").replace(/\]$/, "");
-    const literal = normalizeIpv4(unbracketed) ?? (unbracketed.includes(":") ? unbracketed : null);
+    // A colon alone used to be enough to call something an IPv6 literal, which
+    // handed the dial an unvalidated string; `parseIpv6` decides now, and it
+    // accepts every spelling, so nothing takes this path unclassified.
+    const unbracketed = unbracketHost(lower);
+    const literal = normalizeIpv4(unbracketed) ?? (parseIpv6(unbracketed) === null ? null : unbracketed);
     if (literal !== null) {
         if (isBlocked(literal)) {
             throw new BlockedTargetError(`blocked target IP ${literal}`);
@@ -190,9 +299,21 @@ async function resolvePinned(hostname, lookupFn, isBlocked) {
     }
     return { ip: resolved.address, family: resolved.family };
 }
-/** Parse a CONNECT target ("host:port", "[::1]:443") into host + port. */
+/**
+ * Parse a CONNECT target ("host:port", "[::1]:443") into host + port.
+ *
+ * SECURITY: this is a regex over the raw request line, because CONNECT has no
+ * URL to parse — so the host arrives exactly as the client typed it, including
+ * spellings `new URL()` would have rewritten. Returning it unbracketed and
+ * lower-cased puts it in the same shape as a hostname taken off a parsed URL,
+ * and `resolvePinned` then classifies it with the same `isPrivateIp` the HTTP
+ * path uses. Until 2026-09-18 the classifier compared text, so
+ * `CONNECT [0:0:0:0:0:0:0:1]:<port>` was answered with 200 and tunnelled to
+ * loopback; the fix is that the classifier parses, not that this regex knows
+ * more spellings.
+ */
 function parseConnectTarget(target) {
-    const m = target.match(/^\[(.+)\]:(\d{1,5})$/) ?? target.match(/^([^:]+):(\d{1,5})$/);
+    const m = target.match(/^\[([^\]]+)\]:(\d{1,5})$/) ?? target.match(/^([^:]+):(\d{1,5})$/);
     if (m === null) {
         throw new BlockedTargetError(`malformed CONNECT target "${target}"`);
     }
@@ -200,7 +321,11 @@ function parseConnectTarget(target) {
     if (port < 1 || port > 65535) {
         throw new BlockedTargetError(`malformed CONNECT target "${target}": bad port`);
     }
-    return { host: m[1], port };
+    const host = unbracketHost(m[1]);
+    if (host === "") {
+        throw new BlockedTargetError(`malformed CONNECT target "${target}": empty host`);
+    }
+    return { host, port };
 }
 // Hop-by-hop headers must not be forwarded by a proxy (RFC 7230 §6.1).
 const HOP_BY_HOP = new Set([

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@crewhaus/computer-use-driver",
-  "version": "0.6.0",
+  "version": "0.8.0",
   "type": "module",
   "description": "Cross-platform mouse/keyboard/screenshot driver — chromium backend (Section 25 BROW)",
   "main": "dist/index.js",
@@ -8,14 +8,15 @@
   "exports": {
     ".": {
       "types": "./dist/index.d.ts",
-      "import": "./dist/index.js"
+      "import": "./dist/index.js",
+      "default": "./dist/index.js"
     }
   },
   "scripts": {
     "test": "bun test src"
   },
   "dependencies": {
-    "@crewhaus/errors": "0.6.0"
+    "@crewhaus/errors": "0.8.0"
   },
   "peerDependencies": {
     "playwright": "*"
@@ -43,5 +44,8 @@
   "publishConfig": {
     "access": "public"
   },
-  "files": ["dist", "README.md", "LICENSE", "NOTICE"]
+  "files": ["dist", "README.md", "LICENSE", "NOTICE"],
+  "engines": {
+    "bun": ">=1.3.14"
+  }
 }