@integsec/agentic-pentest-proxy 0.2.4 → 0.2.6

package/dist/src/transports/sse.js

@@ -0,0 +1,161 @@
+import { createInterface } from "readline";
+import { ScopeEnforcementProxy } from "../proxy.js";
+/**
+ * SSE transport — connects to an upstream MCP server via SSE protocol.
+ *
+ * MCP SSE protocol:
+ * 1. GET <upstream> → SSE stream, first event is "endpoint" with sessionId
+ * 2. POST <upstream><sessionId> with JSON-RPC body → sends messages
+ * 3. Responses arrive on the SSE stream as "message" events
+ *
+ * Agent communicates with us via stdio (stdin/stdout).
+ */
+export async function runSseProxy(proxy, upstreamUrl) {
+    const auditLogger = proxy.getAuditLogger();
+    auditLogger.start();
+    const TAG = "[integsec-agentic-pentest-proxy]";
+    // Step 1: Connect to SSE endpoint and get session ID
+    console.error(`${TAG} Connecting to upstream SSE at ${upstreamUrl}...`);
+    let sessionEndpoint;
+    let sseAbortController = new AbortController();
+    async function connectSse() {
+        return new Promise(async (resolve, reject) => {
+            try {
+                const resp = await fetch(upstreamUrl, {
+                    headers: { Accept: "text/event-stream" },
+                    signal: sseAbortController.signal,
+                });
+                if (!resp.ok) {
+                    reject(new Error(`SSE connection failed: ${resp.status} ${resp.statusText}`));
+                    return;
+                }
+                if (!resp.body) {
+                    reject(new Error("SSE response has no body"));
+                    return;
+                }
+                const reader = resp.body.getReader();
+                const decoder = new TextDecoder();
+                let buffer = "";
+                let currentEvent = "";
+                let resolved = false;
+                // Read SSE stream in background
+                (async () => {
+                    try {
+                        while (true) {
+                            const { done, value } = await reader.read();
+                            if (done)
+                                break;
+                            buffer += decoder.decode(value, { stream: true });
+                            const lines = buffer.split("\n");
+                            buffer = lines.pop() ?? "";
+                            for (const line of lines) {
+                                if (line.startsWith("event: ")) {
+                                    currentEvent = line.slice(7).trim();
+                                }
+                                else if (line.startsWith("data: ")) {
+                                    const data = line.slice(6);
+                                    if (currentEvent === "endpoint" && !resolved) {
+                                        // data is like "?sessionId=xxx"
+                                        resolved = true;
+                                        resolve(data);
+                                    }
+                                    else if (currentEvent === "message") {
+                                        // JSON-RPC response from upstream — forward to agent via stdout
+                                        // Capture server name from initialize response
+                                        if (!proxy.getServerName()) {
+                                            try {
+                                                const msg = JSON.parse(data);
+                                                const name = msg?.result?.serverInfo?.name;
+                                                if (name && typeof name === "string") {
+                                                    proxy.setServerName(name);
+                                                    console.error(`${TAG} Upstream server: ${name}`);
+                                                }
+                                            }
+                                            catch {
+                                                // Not parseable — ignore
+                                            }
+                                        }
+                                        process.stdout.write(data + "\n");
+                                    }
+                                    currentEvent = "";
+                                }
+                            }
+                        }
+                    }
+                    catch (err) {
+                        if (err.name !== "AbortError") {
+                            console.error(`${TAG} SSE stream error: ${err.message}`);
+                        }
+                    }
+                })();
+            }
+            catch (err) {
+                reject(err);
+            }
+        });
+    }
+    try {
+        sessionEndpoint = await connectSse();
+        console.error(`${TAG} SSE connected, session: ${sessionEndpoint}`);
+    }
+    catch (err) {
+        console.error(`${TAG} Failed to connect to SSE upstream: ${err.message}`);
+        process.exit(1);
+    }
+    // Step 2: Read agent messages from stdin, validate, POST to upstream
+    const postUrl = new URL(sessionEndpoint, upstreamUrl).toString();
+    console.error(`${TAG} POST endpoint: ${postUrl}`);
+    const agentInput = createInterface({ input: process.stdin, crlfDelay: Infinity });
+    agentInput.on("line", async (line) => {
+        if (line.trim() === "")
+            return;
+        let message;
+        try {
+            message = JSON.parse(line);
+        }
+        catch {
+            // Never forward what we could not inspect — fail closed.
+            process.stdout.write(JSON.stringify(ScopeEnforcementProxy.parseErrorResponse()) + "\n");
+            return;
+        }
+        let forward;
+        let response;
+        try {
+            ({ forward, response } = await proxy.handleMessage(message));
+        }
+        catch (err) {
+            console.error(`${TAG} Dropped message after proxy error: ${err.message}`);
+            return;
+        }
+        if (!forward) {
+            // Blocked — return error to agent
+            if (response)
+                process.stdout.write(JSON.stringify(response) + "\n");
+            return;
+        }
+        try {
+            // Forward to upstream via HTTP POST
+            const resp = await fetch(postUrl, {
+                method: "POST",
+                headers: { "Content-Type": "application/json" },
+                body: JSON.stringify(message),
+            });
+            if (!resp.ok) {
+                console.error(`${TAG} Upstream POST failed: ${resp.status} ${resp.statusText}`);
+            }
+            // Response comes back via SSE stream, not the POST response
+        }
+        catch (err) {
+            console.error(`${TAG} Failed to forward message: ${err.message}`);
+        }
+    });
+    // Cleanup
+    const cleanup = async () => {
+        sseAbortController.abort();
+        await auditLogger.stop();
+        process.exit(0);
+    };
+    process.on("SIGINT", cleanup);
+    process.on("SIGTERM", cleanup);
+}
+//# sourceMappingURL=sse.js.map

package/dist/src/transports/sse.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sse.js","sourceRoot":"","sources":["../../../src/transports/sse.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,UAAU,CAAC;AAC3C,OAAO,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAC;AAEpD;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,KAA4B,EAC5B,WAAmB;IAEnB,MAAM,WAAW,GAAG,KAAK,CAAC,cAAc,EAAE,CAAC;IAC3C,WAAW,CAAC,KAAK,EAAE,CAAC;IAEpB,MAAM,GAAG,GAAG,kCAAkC,CAAC;IAE/C,qDAAqD;IACrD,OAAO,CAAC,KAAK,CAAC,GAAG,GAAG,kCAAkC,WAAW,KAAK,CAAC,CAAC;IAExE,IAAI,eAAmC,CAAC;IACxC,IAAI,kBAAkB,GAAG,IAAI,eAAe,EAAE,CAAC;IAE/C,KAAK,UAAU,UAAU;QACvB,OAAO,IAAI,OAAO,CAAS,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,EAAE;YACnD,IAAI,CAAC;gBACH,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,WAAW,EAAE;oBACpC,OAAO,EAAE,EAAE,MAAM,EAAE,mBAAmB,EAAE;oBACxC,MAAM,EAAE,kBAAkB,CAAC,MAAM;iBAClC,CAAC,CAAC;gBAEH,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;oBACb,MAAM,CAAC,IAAI,KAAK,CAAC,0BAA0B,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC;oBAC9E,OAAO;gBACT,CAAC;gBAED,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;oBACf,MAAM,CAAC,IAAI,KAAK,CAAC,0BAA0B,CAAC,CAAC,CAAC;oBAC9C,OAAO;gBACT,CAAC;gBAED,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;gBACrC,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAC;gBAClC,IAAI,MAAM,GAAG,EAAE,CAAC;gBAChB,IAAI,YAAY,GAAG,EAAE,CAAC;gBACtB,IAAI,QAAQ,GAAG,KAAK,CAAC;gBAErB,gCAAgC;gBAChC,CAAC,KAAK,IAAI,EAAE;oBACV,IAAI,CAAC;wBACH,OAAO,IAAI,EAAE,CAAC;4BACZ,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;4BAC5C,IAAI,IAAI;gCAAE,MAAM;4BAEhB,MAAM,IAAI,OAAO,CAAC,MAAM,CAAC,KAAK,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;4BAClD,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;4BACjC,MAAM,GAAG,KAAK,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC;4BAE3B,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;gCACzB,IAAI,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;oCAC/B,YAAY,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;gCACtC,CAAC;qCAAM,IAAI,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;oCACrC,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;oCAE3B,IAAI,YAAY,KAAK,UAAU,IAAI,CAAC,QAAQ,EAAE,CAAC;wCAC7C,gCAAgC;wCAChC,QAAQ,GAAG,IAAI,CAAC;wCAChB,OAAO,CAAC,IAAI,CAAC,CAAC;oCAChB,CAAC;yCAAM,IAAI,YAAY,KAAK,SAAS,EAAE,CAAC;wCACtC,gEAAgE;wCAChE,+CAA+C;wCAC/C,IAAI,CAAC,KAAK,CAAC,aAAa,EAAE,EAAE,CAAC;4CAC3B,IAAI,CAAC;gDACH,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;gDAC7B,MAAM,IAAI,GAAG,GAAG,EAAE,MAAM,EAAE,UAAU,EAAE,IAAI,CAAC;gDAC3C,IAAI,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;oDACrC,KAAK,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC;oDAC1B,OAAO,CAAC,KAAK,CAAC,GAAG,GAAG,qBAAqB,IAAI,EAAE,CAAC,CAAC;gDACnD,CAAC;4CACH,CAAC;4CAAC,MAAM,CAAC;gDACP,yBAAyB;4CAC3B,CAAC;wCACH,CAAC;wCACD,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,GAAG,IAAI,CAAC,CAAC;oCACpC,CAAC;oCACD,YAAY,GAAG,EAAE,CAAC;gCACpB,CAAC;4BACH,CAAC;wBACH,CAAC;oBACH,CAAC;oBAAC,OAAO,GAAQ,EAAE,CAAC;wBAClB,IAAI,GAAG,CAAC,IAAI,KAAK,YAAY,EAAE,CAAC;4BAC9B,OAAO,CAAC,KAAK,CAAC,GAAG,GAAG,sBAAsB,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;wBAC3D,CAAC;oBACH,CAAC;gBACH,CAAC,CAAC,EAAE,CAAC;YACP,CAAC;YAAC,OAAO,GAAQ,EAAE,CAAC;gBAClB,MAAM,CAAC,GAAG,CAAC,CAAC;YACd,CAAC;QACH,CAAC,CAAC,CAAC;IACL,CAAC;IAED,IAAI,CAAC;QACH,eAAe,GAAG,MAAM,UAAU,EAAE,CAAC;QACrC,OAAO,CAAC,KAAK,CAAC,GAAG,GAAG,4BAA4B,eAAe,EAAE,CAAC,CAAC;IACrE,CAAC;IAAC,OAAO,GAAQ,EAAE,CAAC;QAClB,OAAO,CAAC,KAAK,CAAC,GAAG,GAAG,uCAAuC,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;QAC1E,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,qEAAqE;IACrE,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,eAAe,EAAE,WAAW,CAAC,CAAC,QAAQ,EAAE,CAAC;IACjE,OAAO,CAAC,KAAK,CAAC,GAAG,GAAG,mBAAmB,OAAO,EAAE,CAAC,CAAC;IAElD,MAAM,UAAU,GAAG,eAAe,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,SAAS,EAAE,QAAQ,EAAE,CAAC,CAAC;IAElF,UAAU,CAAC,EAAE,CAAC,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE;QACnC,IAAI,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE;YAAE,OAAO;QAE/B,IAAI,OAAgB,CAAC;QACrB,IAAI,CAAC;YACH,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAC7B,CAAC;QAAC,MAAM,CAAC;YACP,yDAAyD;YACzD,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,qBAAqB,CAAC,kBAAkB,EAAE,CAAC,GAAG,IAAI,CAAC,CAAC;YACxF,OAAO;QACT,CAAC;QAED,IAAI,OAAgB,CAAC;QACrB,IAAI,QAAiB,CAAC;QACtB,IAAI,CAAC;YACH,CAAC,EAAE,OAAO,EAAE,QAAQ,EAAE,GAAG,MAAM,KAAK,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC,CAAC;QAC/D,CAAC;QAAC,OAAO,GAAQ,EAAE,CAAC;YAClB,OAAO,CAAC,KAAK,CAAC,GAAG,GAAG,uCAAuC,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;YAC1E,OAAO;QACT,CAAC;QAED,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,kCAAkC;YAClC,IAAI,QAAQ;gBAAE,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,GAAG,IAAI,CAAC,CAAC;YACpE,OAAO;QACT,CAAC;QAED,IAAI,CAAC;YACH,oCAAoC;YACpC,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,OAAO,EAAE;gBAChC,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;gBAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC;aAC9B,CAAC,CAAC;YAEH,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;gBACb,OAAO,CAAC,KAAK,CAAC,GAAG,GAAG,0BAA0B,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC,CAAC;YAClF,CAAC;YACD,4DAA4D;QAC9D,CAAC;QAAC,OAAO,GAAQ,EAAE,CAAC;YAClB,OAAO,CAAC,KAAK,CAAC,GAAG,GAAG,+BAA+B,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;QACpE,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,UAAU;IACV,MAAM,OAAO,GAAG,KAAK,IAAI,EAAE;QACzB,kBAAkB,CAAC,KAAK,EAAE,CAAC;QAC3B,MAAM,WAAW,CAAC,IAAI,EAAE,CAAC;QACzB,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC,CAAC;IAEF,OAAO,CAAC,EAAE,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IAC9B,OAAO,CAAC,EAAE,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;AACjC,CAAC"}

package/dist/src/transports/stdio.d.ts

@@ -1,3 +1,3 @@
-import type { ScopeEnforcementProxy } from "../proxy.js";
-export declare function runStdioProxy(proxy: ScopeEnforcementProxy, upstreamCommand: string, upstreamArgs?: string[]): Promise<void>;
+import { ScopeEnforcementProxy } from "../proxy.js";
+export declare function runStdioProxy(proxy: ScopeEnforcementProxy, upstreamCommand: string, upstreamArgs?: string[], startupDelayMs?: number): Promise<void>;
 //# sourceMappingURL=stdio.d.ts.map

package/dist/src/transports/stdio.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"stdio.d.ts","sourceRoot":"","sources":["../../../src/transports/stdio.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAC;AAEzD,wBAAsB,aAAa,CACjC,KAAK,EAAE,qBAAqB,EAC5B,eAAe,EAAE,MAAM,EACvB,YAAY,GAAE,MAAM,EAAO,GAC1B,OAAO,CAAC,IAAI,CAAC,CA+Gf"}
+{"version":3,"file":"stdio.d.ts","sourceRoot":"","sources":["../../../src/transports/stdio.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAC;AAEpD,wBAAsB,aAAa,CACjC,KAAK,EAAE,qBAAqB,EAC5B,eAAe,EAAE,MAAM,EACvB,YAAY,GAAE,MAAM,EAAO,EAC3B,cAAc,SAAI,GACjB,OAAO,CAAC,IAAI,CAAC,CAkJf"}

package/dist/src/transports/stdio.js

@@ -1,6 +1,7 @@
 import { spawn } from "child_process";
 import { createInterface } from "readline";
-export async function runStdioProxy(proxy, upstreamCommand, upstreamArgs = []) {
+import { ScopeEnforcementProxy } from "../proxy.js";
+export async function runStdioProxy(proxy, upstreamCommand, upstreamArgs = [], startupDelayMs = 0) {
     // On Windows, commands like "npx" are .cmd wrappers that require shell
     // resolution, and paths may contain spaces (e.g. "C:\Program Files\...").
     // Build a single quoted command string and use shell: true with no args
@@ -16,63 +17,79 @@ export async function runStdioProxy(proxy, upstreamCommand, upstreamArgs = []) {
     }
     const auditLogger = proxy.getAuditLogger();
     auditLogger.start();
-    // Buffer messages until upstream is ready. Some upstream servers (e.g. Burp's
-    // Java MCP proxy) need time to establish their own connections before they can
-    // handle JSON-RPC messages. We detect readiness when the upstream produces its
-    // first stdout output, OR after a timeout (whichever comes first).
-    let upstreamReady = false;
+    // Standard MCP servers print nothing until they receive a request, and the
+    // child's stdin pipe buffers anything written before it starts reading, so
+    // by default messages are forwarded immediately. Some bridges (e.g. Burp's
+    // legacy Java stdio proxy) drop messages sent before they finish connecting;
+    // for those, UPSTREAM_STARTUP_DELAY_MS holds messages until the upstream
+    // prints its first line or the delay expires.
+    let upstreamReady = startupDelayMs <= 0;
     const pendingMessages = [];
-    const READY_TIMEOUT_MS = 20_000;
     function flushPending() {
         for (const msg of pendingMessages) {
             upstream.stdin.write(msg + "\n");
         }
         pendingMessages.length = 0;
     }
-    const readyTimer = setTimeout(() => {
-        if (!upstreamReady) {
-            upstreamReady = true;
-            console.error("[integsec-agentic-pentest-proxy] Upstream ready (timeout)");
-            flushPending();
+    function markReady(why) {
+        if (upstreamReady)
+            return;
+        upstreamReady = true;
+        clearTimeout(readyTimer);
+        console.error(`[integsec-agentic-pentest-proxy] Upstream ready (${why})`);
+        flushPending();
+    }
+    const readyTimer = setTimeout(() => markReady("startup delay elapsed"), Math.max(startupDelayMs, 0));
+    function sendUpstream(line) {
+        if (upstreamReady) {
+            upstream.stdin.write(line + "\n");
+        }
+        else {
+            pendingMessages.push(line);
         }
-    }, READY_TIMEOUT_MS);
+    }
+    function replyToAgent(message) {
+        process.stdout.write(JSON.stringify(message) + "\n");
+    }
     const agentInput = createInterface({ input: process.stdin, crlfDelay: Infinity });
     const upstreamOutput = createInterface({ input: upstream.stdout, crlfDelay: Infinity });
     // Agent → Proxy → Upstream
-    agentInput.on("line", async (line) => {
+    const inFlight = new Set();
+    agentInput.on("line", (line) => {
+        const task = handleAgentLine(line);
+        inFlight.add(task);
+        void task.finally(() => inFlight.delete(task));
+    });
+    async function handleAgentLine(line) {
+        if (line.trim() === "")
+            return;
+        let message;
+        try {
+            message = JSON.parse(line);
+        }
+        catch {
+            // Never forward what we could not inspect — fail closed.
+            replyToAgent(ScopeEnforcementProxy.parseErrorResponse());
+            return;
+        }
         try {
-            const message = JSON.parse(line);
             const { forward, response } = await proxy.handleMessage(message);
             if (forward) {
-                if (upstreamReady) {
-                    upstream.stdin.write(line + "\n");
-                }
-                else {
-                    pendingMessages.push(line);
-                }
+                // The upstream must receive the same parsed object that was checked.
+                // Reserializing removes duplicate-key parser differentials.
+                sendUpstream(JSON.stringify(message));
             }
             else if (response) {
-                process.stdout.write(JSON.stringify(response) + "\n");
+                replyToAgent(response);
             }
         }
-        catch {
-            // Malformed JSON — pass through conservatively
-            if (upstreamReady) {
-                upstream.stdin.write(line + "\n");
-            }
-            else {
-                pendingMessages.push(line);
-            }
+        catch (err) {
+            console.error(`[integsec-agentic-pentest-proxy] Dropped message after proxy error: ${err instanceof Error ? err.message : String(err)}`);
         }
-    });
+    }
     // Upstream → Agent (pass through all responses, capture server name)
     upstreamOutput.on("line", (line) => {
-        if (!upstreamReady) {
-            upstreamReady = true;
-            clearTimeout(readyTimer);
-            console.error("[integsec-agentic-pentest-proxy] Upstream ready (first output)");
-            flushPending();
-        }
+        markReady("first output");
         // Capture server name from the initialize response
         if (!proxy.getServerName()) {
             try {
@@ -89,19 +106,31 @@ export async function runStdioProxy(proxy, upstreamCommand, upstreamArgs = []) {
         }
         process.stdout.write(line + "\n");
     });
-    upstream.on("exit", async (code) => {
+    const shutdown = async (code) => {
         await auditLogger.stop();
-        process.exit(code ?? 0);
+        process.exit(code);
+    };
+    upstream.on("exit", (code) => {
+        void shutdown(code ?? 0);
     });
-    process.on("SIGINT", async () => {
-        await auditLogger.stop();
-        upstream.kill();
-        process.exit(0);
-    });
-    process.on("SIGTERM", async () => {
-        await auditLogger.stop();
-        upstream.kill();
-        process.exit(0);
+    // Agent closed its end (e.g. the MCP client quit): flush the audit trail,
+    // close the upstream's stdin so it can exit cleanly, and force-exit if it
+    // does not within a few seconds.
+    agentInput.on("close", async () => {
+        await Promise.allSettled([...inFlight]);
+        markReady("agent closed input");
+        await auditLogger.flush();
+        upstream.stdin?.end();
+        setTimeout(() => {
+            upstream.kill();
+            void shutdown(0);
+        }, 3000).unref();
     });
+    for (const signal of ["SIGINT", "SIGTERM"]) {
+        process.on(signal, async () => {
+            upstream.kill();
+            await shutdown(0);
+        });
+    }
 }
 //# sourceMappingURL=stdio.js.map

package/dist/src/transports/stdio.js.map

@@ -1 +1 @@
-{"version":3,"file":"stdio.js","sourceRoot":"","sources":["../../../src/transports/stdio.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAqB,MAAM,eAAe,CAAC;AACzD,OAAO,EAAE,eAAe,EAAE,MAAM,UAAU,CAAC;AAG3C,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,KAA4B,EAC5B,eAAuB,EACvB,eAAyB,EAAE;IAE3B,uEAAuE;IACvE,0EAA0E;IAC1E,wEAAwE;IACxE,qDAAqD;IACrD,MAAM,KAAK,GAAG,CAAC,CAAS,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC9D,MAAM,SAAS,GAAG,CAAC,KAAK,CAAC,eAAe,CAAC,EAAE,GAAG,YAAY,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACjF,MAAM,QAAQ,GAAiB,KAAK,CAAC,SAAS,EAAE;QAC9C,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,CAAC;QAClC,KAAK,EAAE,IAAI;KACZ,CAAC,CAAC;IAEH,IAAI,CAAC,QAAQ,CAAC,KAAK,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC;QACxC,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAC;IACvE,CAAC;IAED,MAAM,WAAW,GAAG,KAAK,CAAC,cAAc,EAAE,CAAC;IAC3C,WAAW,CAAC,KAAK,EAAE,CAAC;IAEpB,8EAA8E;IAC9E,+EAA+E;IAC/E,+EAA+E;IAC/E,mEAAmE;IACnE,IAAI,aAAa,GAAG,KAAK,CAAC;IAC1B,MAAM,eAAe,GAAa,EAAE,CAAC;IACrC,MAAM,gBAAgB,GAAG,MAAM,CAAC;IAEhC,SAAS,YAAY;QACnB,KAAK,MAAM,GAAG,IAAI,eAAe,EAAE,CAAC;YAClC,QAAQ,CAAC,KAAM,CAAC,KAAK,CAAC,GAAG,GAAG,IAAI,CAAC,CAAC;QACpC,CAAC;QACD,eAAe,CAAC,MAAM,GAAG,CAAC,CAAC;IAC7B,CAAC;IAED,MAAM,UAAU,GAAG,UAAU,CAAC,GAAG,EAAE;QACjC,IAAI,CAAC,aAAa,EAAE,CAAC;YACnB,aAAa,GAAG,IAAI,CAAC;YACrB,OAAO,CAAC,KAAK,CAAC,2DAA2D,CAAC,CAAC;YAC3E,YAAY,EAAE,CAAC;QACjB,CAAC;IACH,CAAC,EAAE,gBAAgB,CAAC,CAAC;IAErB,MAAM,UAAU,GAAG,eAAe,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,SAAS,EAAE,QAAQ,EAAE,CAAC,CAAC;IAClF,MAAM,cAAc,GAAG,eAAe,CAAC,EAAE,KAAK,EAAE,QAAQ,CAAC,MAAM,EAAE,SAAS,EAAE,QAAQ,EAAE,CAAC,CAAC;IAExF,2BAA2B;IAC3B,UAAU,CAAC,EAAE,CAAC,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE;QACnC,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YACjC,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,GAAG,MAAM,KAAK,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC;YACjE,IAAI,OAAO,EAAE,CAAC;gBACZ,IAAI,aAAa,EAAE,CAAC;oBAClB,QAAQ,CAAC,KAAM,CAAC,KAAK,CAAC,IAAI,GAAG,IAAI,CAAC,CAAC;gBACrC,CAAC;qBAAM,CAAC;oBACN,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;gBAC7B,CAAC;YACH,CAAC;iBAAM,IAAI,QAAQ,EAAE,CAAC;gBACpB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,GAAG,IAAI,CAAC,CAAC;YACxD,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,+CAA+C;YAC/C,IAAI,aAAa,EAAE,CAAC;gBAClB,QAAQ,CAAC,KAAM,CAAC,KAAK,CAAC,IAAI,GAAG,IAAI,CAAC,CAAC;YACrC,CAAC;iBAAM,CAAC;gBACN,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAC7B,CAAC;QACH,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,qEAAqE;IACrE,cAAc,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE;QACjC,IAAI,CAAC,aAAa,EAAE,CAAC;YACnB,aAAa,GAAG,IAAI,CAAC;YACrB,YAAY,CAAC,UAAU,CAAC,CAAC;YACzB,OAAO,CAAC,KAAK,CAAC,gEAAgE,CAAC,CAAC;YAChF,YAAY,EAAE,CAAC;QACjB,CAAC;QAED,mDAAmD;QACnD,IAAI,CAAC,KAAK,CAAC,aAAa,EAAE,EAAE,CAAC;YAC3B,IAAI,CAAC;gBACH,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;gBAC7B,MAAM,IAAI,GAAG,GAAG,EAAE,MAAM,EAAE,UAAU,EAAE,IAAI,CAAC;gBAC3C,IAAI,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;oBACrC,KAAK,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC;oBAC1B,OAAO,CAAC,KAAK,CAAC,qDAAqD,IAAI,EAAE,CAAC,CAAC;gBAC7E,CAAC;YACH,CAAC;YAAC,MAAM,CAAC;gBACP,oBAAoB;YACtB,CAAC;QACH,CAAC;QAED,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,GAAG,IAAI,CAAC,CAAC;IACpC,CAAC,CAAC,CAAC;IAEH,QAAQ,CAAC,EAAE,CAAC,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE;QACjC,MAAM,WAAW,CAAC,IAAI,EAAE,CAAC;QACzB,OAAO,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC;IAC1B,CAAC,CAAC,CAAC;IAEH,OAAO,CAAC,EAAE,CAAC,QAAQ,EAAE,KAAK,IAAI,EAAE;QAC9B,MAAM,WAAW,CAAC,IAAI,EAAE,CAAC;QACzB,QAAQ,CAAC,IAAI,EAAE,CAAC;QAChB,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC,CAAC,CAAC;IAEH,OAAO,CAAC,EAAE,CAAC,SAAS,EAAE,KAAK,IAAI,EAAE;QAC/B,MAAM,WAAW,CAAC,IAAI,EAAE,CAAC;QACzB,QAAQ,CAAC,IAAI,EAAE,CAAC;QAChB,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC,CAAC,CAAC;AACL,CAAC"}
+{"version":3,"file":"stdio.js","sourceRoot":"","sources":["../../../src/transports/stdio.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAqB,MAAM,eAAe,CAAC;AACzD,OAAO,EAAE,eAAe,EAAE,MAAM,UAAU,CAAC;AAC3C,OAAO,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAC;AAEpD,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,KAA4B,EAC5B,eAAuB,EACvB,eAAyB,EAAE,EAC3B,cAAc,GAAG,CAAC;IAElB,uEAAuE;IACvE,0EAA0E;IAC1E,wEAAwE;IACxE,qDAAqD;IACrD,MAAM,KAAK,GAAG,CAAC,CAAS,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC9D,MAAM,SAAS,GAAG,CAAC,KAAK,CAAC,eAAe,CAAC,EAAE,GAAG,YAAY,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACjF,MAAM,QAAQ,GAAiB,KAAK,CAAC,SAAS,EAAE;QAC9C,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,CAAC;QAClC,KAAK,EAAE,IAAI;KACZ,CAAC,CAAC;IAEH,IAAI,CAAC,QAAQ,CAAC,KAAK,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC;QACxC,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAC;IACvE,CAAC;IAED,MAAM,WAAW,GAAG,KAAK,CAAC,cAAc,EAAE,CAAC;IAC3C,WAAW,CAAC,KAAK,EAAE,CAAC;IAEpB,2EAA2E;IAC3E,2EAA2E;IAC3E,2EAA2E;IAC3E,6EAA6E;IAC7E,yEAAyE;IACzE,8CAA8C;IAC9C,IAAI,aAAa,GAAG,cAAc,IAAI,CAAC,CAAC;IACxC,MAAM,eAAe,GAAa,EAAE,CAAC;IAErC,SAAS,YAAY;QACnB,KAAK,MAAM,GAAG,IAAI,eAAe,EAAE,CAAC;YAClC,QAAQ,CAAC,KAAM,CAAC,KAAK,CAAC,GAAG,GAAG,IAAI,CAAC,CAAC;QACpC,CAAC;QACD,eAAe,CAAC,MAAM,GAAG,CAAC,CAAC;IAC7B,CAAC;IAED,SAAS,SAAS,CAAC,GAAW;QAC5B,IAAI,aAAa;YAAE,OAAO;QAC1B,aAAa,GAAG,IAAI,CAAC;QACrB,YAAY,CAAC,UAAU,CAAC,CAAC;QACzB,OAAO,CAAC,KAAK,CAAC,oDAAoD,GAAG,GAAG,CAAC,CAAC;QAC1E,YAAY,EAAE,CAAC;IACjB,CAAC;IAED,MAAM,UAAU,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,uBAAuB,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC,CAAC;IAErG,SAAS,YAAY,CAAC,IAAY;QAChC,IAAI,aAAa,EAAE,CAAC;YAClB,QAAQ,CAAC,KAAM,CAAC,KAAK,CAAC,IAAI,GAAG,IAAI,CAAC,CAAC;QACrC,CAAC;aAAM,CAAC;YACN,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC7B,CAAC;IACH,CAAC;IAED,SAAS,YAAY,CAAC,OAAgB;QACpC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,GAAG,IAAI,CAAC,CAAC;IACvD,CAAC;IAED,MAAM,UAAU,GAAG,eAAe,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,SAAS,EAAE,QAAQ,EAAE,CAAC,CAAC;IAClF,MAAM,cAAc,GAAG,eAAe,CAAC,EAAE,KAAK,EAAE,QAAQ,CAAC,MAAM,EAAE,SAAS,EAAE,QAAQ,EAAE,CAAC,CAAC;IAExF,2BAA2B;IAC3B,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAiB,CAAC;IAC1C,UAAU,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE;QAC7B,MAAM,IAAI,GAAG,eAAe,CAAC,IAAI,CAAC,CAAC;QACnC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACnB,KAAK,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;IACjD,CAAC,CAAC,CAAC;IAEH,KAAK,UAAU,eAAe,CAAC,IAAY;QACzC,IAAI,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE;YAAE,OAAO;QAE/B,IAAI,OAAgB,CAAC;QACrB,IAAI,CAAC;YACH,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAC7B,CAAC;QAAC,MAAM,CAAC;YACP,yDAAyD;YACzD,YAAY,CAAC,qBAAqB,CAAC,kBAAkB,EAAE,CAAC,CAAC;YACzD,OAAO;QACT,CAAC;QAED,IAAI,CAAC;YACH,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,GAAG,MAAM,KAAK,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC;YACjE,IAAI,OAAO,EAAE,CAAC;gBACZ,qEAAqE;gBACrE,4DAA4D;gBAC5D,YAAY,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC;YACxC,CAAC;iBAAM,IAAI,QAAQ,EAAE,CAAC;gBACpB,YAAY,CAAC,QAAQ,CAAC,CAAC;YACzB,CAAC;QACH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,CAAC,KAAK,CACX,uEAAuE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAC1H,CAAC;QACJ,CAAC;IACH,CAAC;IAED,qEAAqE;IACrE,cAAc,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE;QACjC,SAAS,CAAC,cAAc,CAAC,CAAC;QAE1B,mDAAmD;QACnD,IAAI,CAAC,KAAK,CAAC,aAAa,EAAE,EAAE,CAAC;YAC3B,IAAI,CAAC;gBACH,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;gBAC7B,MAAM,IAAI,GAAG,GAAG,EAAE,MAAM,EAAE,UAAU,EAAE,IAAI,CAAC;gBAC3C,IAAI,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;oBACrC,KAAK,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC;oBAC1B,OAAO,CAAC,KAAK,CAAC,qDAAqD,IAAI,EAAE,CAAC,CAAC;gBAC7E,CAAC;YACH,CAAC;YAAC,MAAM,CAAC;gBACP,oBAAoB;YACtB,CAAC;QACH,CAAC;QAED,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,GAAG,IAAI,CAAC,CAAC;IACpC,CAAC,CAAC,CAAC;IAEH,MAAM,QAAQ,GAAG,KAAK,EAAE,IAAY,EAAkB,EAAE;QACtD,MAAM,WAAW,CAAC,IAAI,EAAE,CAAC;QACzB,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACrB,CAAC,CAAC;IAEF,QAAQ,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE;QAC3B,KAAK,QAAQ,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC;IAC3B,CAAC,CAAC,CAAC;IAEH,0EAA0E;IAC1E,0EAA0E;IAC1E,iCAAiC;IACjC,UAAU,CAAC,EAAE,CAAC,OAAO,EAAE,KAAK,IAAI,EAAE;QAChC,MAAM,OAAO,CAAC,UAAU,CAAC,CAAC,GAAG,QAAQ,CAAC,CAAC,CAAC;QACxC,SAAS,CAAC,oBAAoB,CAAC,CAAC;QAChC,MAAM,WAAW,CAAC,KAAK,EAAE,CAAC;QAC1B,QAAQ,CAAC,KAAK,EAAE,GAAG,EAAE,CAAC;QACtB,UAAU,CAAC,GAAG,EAAE;YACd,QAAQ,CAAC,IAAI,EAAE,CAAC;YAChB,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC;QACnB,CAAC,EAAE,IAAI,CAAC,CAAC,KAAK,EAAE,CAAC;IACnB,CAAC,CAAC,CAAC;IAEH,KAAK,MAAM,MAAM,IAAI,CAAC,QAAQ,EAAE,SAAS,CAAU,EAAE,CAAC;QACpD,OAAO,CAAC,EAAE,CAAC,MAAM,EAAE,KAAK,IAAI,EAAE;YAC5B,QAAQ,CAAC,IAAI,EAAE,CAAC;YAChB,MAAM,QAAQ,CAAC,CAAC,CAAC,CAAC;QACpB,CAAC,CAAC,CAAC;IACL,CAAC;AACH,CAAC"}

package/dist/src/types.d.ts

@@ -1,4 +1,4 @@
-export type Decision = "ALLOWED" | "BLOCKED_EXCLUDED_TARGET" | "BLOCKED_NOT_IN_SCOPE" | "BLOCKED_OUTSIDE_WINDOW" | "BLOCKED_TECHNIQUE" | "BLOCKED_DNS_FAILED" | "ALLOWED_NO_TARGET";
+export type Decision = "ALLOWED" | "BLOCKED_EXCLUDED_TARGET" | "BLOCKED_NOT_IN_SCOPE" | "BLOCKED_OUTSIDE_WINDOW" | "BLOCKED_TECHNIQUE" | "BLOCKED_DNS_FAILED" | "BLOCKED_RESTRICTED_IP" | "BLOCKED_INVALID_REQUEST" | "BLOCKED_UNINSPECTABLE_COMMAND" | "BLOCKED_INTERNAL_ERROR" | "ALLOWED_NO_TARGET";
 export interface ValidationResult {
     decision: Decision;
     reason: string;

package/dist/src/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/types.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,QAAQ,GAChB,SAAS,GACT,yBAAyB,GACzB,sBAAsB,GACtB,wBAAwB,GACxB,mBAAmB,GACnB,oBAAoB,GACpB,mBAAmB,CAAC;AAExB,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,EAAE,QAAQ,CAAC;IACnB,MAAM,EAAE,MAAM,CAAC;IACf,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;IACvB,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,UAAU;IACzB,SAAS,EAAE,MAAM,CAAC;IAClB,aAAa,EAAE,MAAM,CAAC;IACtB,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,eAAe,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACzC,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,QAAQ,EAAE,QAAQ,CAAC;IACnB,eAAe,EAAE,MAAM,CAAC;IACxB,kBAAkB,EAAE,MAAM,GAAG,IAAI,CAAC;IAClC,WAAW,EAAE,MAAM,CAAC;IACpB,aAAa,EAAE,MAAM,CAAC;IACtB,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,aAAa;IAC5B,aAAa,EAAE,MAAM,CAAC;IACtB,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,kBAAkB,EAAE;QAClB,SAAS,EAAE,MAAM,EAAE,CAAC;QACpB,OAAO,EAAE,MAAM,EAAE,CAAC;QAClB,IAAI,EAAE,MAAM,EAAE,CAAC;QACf,cAAc,EAAE,MAAM,EAAE,CAAC;KAC1B,CAAC;IACF,gBAAgB,EAAE,MAAM,EAAE,CAAC;IAC3B,qBAAqB,EAAE,MAAM,EAAE,CAAC;IAChC,mBAAmB,EAAE,MAAM,EAAE,CAAC;IAC9B,iBAAiB,EAAE;QACjB,KAAK,EAAE,MAAM,CAAC;QACd,GAAG,EAAE,MAAM,CAAC;KACb,CAAC;CACH"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/types.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,QAAQ,GAChB,SAAS,GACT,yBAAyB,GACzB,sBAAsB,GACtB,wBAAwB,GACxB,mBAAmB,GACnB,oBAAoB,GACpB,uBAAuB,GACvB,yBAAyB,GACzB,+BAA+B,GAC/B,wBAAwB,GACxB,mBAAmB,CAAC;AAExB,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,EAAE,QAAQ,CAAC;IACnB,MAAM,EAAE,MAAM,CAAC;IACf,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;IACvB,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,UAAU;IACzB,SAAS,EAAE,MAAM,CAAC;IAClB,aAAa,EAAE,MAAM,CAAC;IACtB,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,eAAe,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACzC,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,QAAQ,EAAE,QAAQ,CAAC;IACnB,eAAe,EAAE,MAAM,CAAC;IACxB,kBAAkB,EAAE,MAAM,GAAG,IAAI,CAAC;IAClC,WAAW,EAAE,MAAM,CAAC;IACpB,aAAa,EAAE,MAAM,CAAC;IACtB,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,aAAa;IAC5B,aAAa,EAAE,MAAM,CAAC;IACtB,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,kBAAkB,EAAE;QAClB,SAAS,EAAE,MAAM,EAAE,CAAC;QACpB,OAAO,EAAE,MAAM,EAAE,CAAC;QAClB,IAAI,EAAE,MAAM,EAAE,CAAC;QACf,cAAc,EAAE,MAAM,EAAE,CAAC;KAC1B,CAAC;IACF,gBAAgB,EAAE,MAAM,EAAE,CAAC;IAC3B,qBAAqB,EAAE,MAAM,EAAE,CAAC;IAChC,mBAAmB,EAAE,MAAM,EAAE,CAAC;IAC9B,iBAAiB,EAAE;QACjB,KAAK,EAAE,MAAM,CAAC;QACd,GAAG,EAAE,MAAM,CAAC;KACb,CAAC;CACH"}

package/dist/src/validator.d.ts

@@ -4,14 +4,22 @@
  * ScopeValidator — the core orchestrator that ties all validation together.
  *
  * Validation steps (in exact order):
- *  1. Technique block check
+ *  0. Request shape check (tool name string, arguments object) — fail closed
+ *  1. Technique check (excluded_techniques, then authorized_techniques)
  *  2. Time window check
- *  3. Target extraction
+ *  3. Target extraction — EVERY target in the call (arrays, lists, nested
+ *     options, command lines)
  *  4. If no target found → ALLOWED_NO_TARGET
- *  5. DNS resolution (fail closed on NXDOMAIN)
- *  6. Exclusion check (exclusions win over authorizations)
- *  7. Authorization check (domain pattern match OR IP CIDR match)
- *  8. No match → BLOCKED_NOT_IN_SCOPE
+ *  Then, for each target (the call is blocked if ANY target is blocked):
+ *  5. Cloud account match (authorized_targets.cloud_accounts)
+ *  6. CIDR targets: must not overlap an exclusion, must sit inside an
+ *     authorized range (no DNS)
+ *  7. DNS resolution (fail closed on NXDOMAIN)
+ *  8. Exclusion check (exclusions win over authorizations)
+ *  9. Authorization check (domain / URL host match, or IP CIDR match);
+ *     authorized hostnames resolving to loopback / link-local / metadata
+ *     addresses are blocked unless those IPs are explicitly in ip_ranges
+ * 10. No match → BLOCKED_NOT_IN_SCOPE
  *
  * SECURITY NOTE: This module is the gatekeeper for all tool calls. Every
  * check order matters — do not reorder without updating tests.
@@ -23,29 +31,12 @@ export declare class ScopeValidator {
     private readonly manifest;
     private readonly dnsResolver;
     private readonly techniqueChecker;
-    constructor(manifest: ScopeManifest, dnsResolver?: DnsResolver, techniqueChecker?: TechniqueChecker);
+    /** URL scope entries paired with their hostnames for prefix checks. */
+    private readonly urlHosts;
+    private readonly allowUnstructuredCommands;
+    constructor(manifest: ScopeManifest, dnsResolver?: DnsResolver, techniqueChecker?: TechniqueChecker, allowUnstructuredCommands?: boolean);
     validate(toolName: string, params: Record<string, unknown>): Promise<ValidationResult>;
-    /**
-     * Check whether `target` matches any entry in `excluded` (case-insensitive
-     * exact string match).
-     */
-    private isExcluded;
-    /**
-     * Find the first authorized domain pattern that matches `hostname`.
-     * Returns the matching pattern string, or null if no match.
-     */
-    private findMatchingDomain;
-    /**
-     * Find the first authorized CIDR range that contains `ip`.
-     * Returns the matching CIDR string, or null if no match.
-     *
-     * Note: RFC-1918 and cloud metadata IPs are only allowed if they explicitly
-     * appear within an authorized ip_range entry.  This function performs an
-     * exact `isIpInCidr` check — there is no implicit deny for private ranges
-     * because the exclusion of a private IP from the authorized list naturally
-     * means it will fall through to BLOCKED_NOT_IN_SCOPE in Step 8.
-     */
-    private findMatchingIpRange;
+    private validateTarget;
     /**
      * Build a ValidationResult, automatically populating durationMs.
      */

package/dist/src/validator.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"validator.d.ts","sourceRoot":"","sources":["../../src/validator.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,KAAK,EAAE,aAAa,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAElE,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAGhD,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAE1D,qBAAa,cAAc;IACzB,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAgB;IACzC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAc;IAC1C,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAmB;gBAGlD,QAAQ,EAAE,aAAa,EACvB,WAAW,CAAC,EAAE,WAAW,EACzB,gBAAgB,CAAC,EAAE,gBAAgB;IAO/B,QAAQ,CACZ,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC9B,OAAO,CAAC,gBAAgB,CAAC;IA0I5B;;;OAGG;IACH,OAAO,CAAC,UAAU;IAKlB;;;OAGG;IACH,OAAO,CAAC,kBAAkB;IAY1B;;;;;;;;;OASG;IACH,OAAO,CAAC,mBAAmB;IAS3B;;OAEG;IACH,OAAO,CAAC,MAAM;CASf"}
+{"version":3,"file":"validator.d.ts","sourceRoot":"","sources":["../../src/validator.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAGH,OAAO,KAAK,EAAE,aAAa,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAElE,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAGhD,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAY1D,qBAAa,cAAc;IACzB,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAgB;IACzC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAc;IAC1C,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAmB;IACpD,uEAAuE;IACvE,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAkC;IAC3D,OAAO,CAAC,QAAQ,CAAC,yBAAyB,CAAU;gBAGlD,QAAQ,EAAE,aAAa,EACvB,WAAW,CAAC,EAAE,WAAW,EACzB,gBAAgB,CAAC,EAAE,gBAAgB,EACnC,yBAAyB,UAAQ;IAW7B,QAAQ,CACZ,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC9B,OAAO,CAAC,gBAAgB,CAAC;YAyGd,cAAc;IAuJ5B;;OAEG;IACH,OAAO,CAAC,MAAM;CAMf"}