@integsec/agentic-pentest-proxy 0.2.5 → 0.2.6

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (146) hide show
  1. package/LICENSE +201 -0
  2. package/README.md +250 -54
  3. package/dist/bin/integsec-agentic-pentest-manifest.d.ts +3 -0
  4. package/dist/bin/integsec-agentic-pentest-manifest.d.ts.map +1 -0
  5. package/dist/bin/integsec-agentic-pentest-manifest.js +180 -0
  6. package/dist/bin/integsec-agentic-pentest-manifest.js.map +1 -0
  7. package/dist/bin/integsec-agentic-pentest-proxy.d.ts +1 -1
  8. package/dist/bin/integsec-agentic-pentest-proxy.d.ts.map +1 -1
  9. package/dist/bin/integsec-agentic-pentest-proxy.js +8 -4
  10. package/dist/bin/integsec-agentic-pentest-proxy.js.map +1 -1
  11. package/dist/src/audit/azure-monitor.d.ts +2 -2
  12. package/dist/src/audit/azure-monitor.d.ts.map +1 -1
  13. package/dist/src/audit/azure-monitor.js +8 -5
  14. package/dist/src/audit/azure-monitor.js.map +1 -1
  15. package/dist/src/audit/cloudwatch.d.ts.map +1 -1
  16. package/dist/src/audit/cloudwatch.js.map +1 -1
  17. package/dist/src/audit/gcp-logging.d.ts.map +1 -1
  18. package/dist/src/audit/gcp-logging.js +4 -6
  19. package/dist/src/audit/gcp-logging.js.map +1 -1
  20. package/dist/src/audit/index.d.ts +7 -0
  21. package/dist/src/audit/index.d.ts.map +1 -1
  22. package/dist/src/audit/index.js +11 -1
  23. package/dist/src/audit/index.js.map +1 -1
  24. package/dist/src/audit/local.d.ts.map +1 -1
  25. package/dist/src/audit/local.js +2 -1
  26. package/dist/src/audit/local.js.map +1 -1
  27. package/dist/src/builder/dry-run.d.ts +12 -0
  28. package/dist/src/builder/dry-run.d.ts.map +1 -0
  29. package/dist/src/builder/dry-run.js +103 -0
  30. package/dist/src/builder/dry-run.js.map +1 -0
  31. package/dist/src/builder/manifest-writer.d.ts +7 -0
  32. package/dist/src/builder/manifest-writer.d.ts.map +1 -0
  33. package/dist/src/builder/manifest-writer.js +17 -0
  34. package/dist/src/builder/manifest-writer.js.map +1 -0
  35. package/dist/src/builder/review-display.d.ts +10 -0
  36. package/dist/src/builder/review-display.d.ts.map +1 -0
  37. package/dist/src/builder/review-display.js +55 -0
  38. package/dist/src/builder/review-display.js.map +1 -0
  39. package/dist/src/builder/smart-validator.d.ts +39 -0
  40. package/dist/src/builder/smart-validator.d.ts.map +1 -0
  41. package/dist/src/builder/smart-validator.js +157 -0
  42. package/dist/src/builder/smart-validator.js.map +1 -0
  43. package/dist/src/builder/steps/domains.d.ts +10 -0
  44. package/dist/src/builder/steps/domains.d.ts.map +1 -0
  45. package/dist/src/builder/steps/domains.js +71 -0
  46. package/dist/src/builder/steps/domains.js.map +1 -0
  47. package/dist/src/builder/steps/engagement-info.d.ts +17 -0
  48. package/dist/src/builder/steps/engagement-info.d.ts.map +1 -0
  49. package/dist/src/builder/steps/engagement-info.js +49 -0
  50. package/dist/src/builder/steps/engagement-info.js.map +1 -0
  51. package/dist/src/builder/steps/engagement-window.d.ts +15 -0
  52. package/dist/src/builder/steps/engagement-window.d.ts.map +1 -0
  53. package/dist/src/builder/steps/engagement-window.js +57 -0
  54. package/dist/src/builder/steps/engagement-window.js.map +1 -0
  55. package/dist/src/builder/steps/exclusions.d.ts +13 -0
  56. package/dist/src/builder/steps/exclusions.d.ts.map +1 -0
  57. package/dist/src/builder/steps/exclusions.js +57 -0
  58. package/dist/src/builder/steps/exclusions.js.map +1 -0
  59. package/dist/src/builder/steps/ip-ranges.d.ts +10 -0
  60. package/dist/src/builder/steps/ip-ranges.d.ts.map +1 -0
  61. package/dist/src/builder/steps/ip-ranges.js +64 -0
  62. package/dist/src/builder/steps/ip-ranges.js.map +1 -0
  63. package/dist/src/builder/steps/review.d.ts +10 -0
  64. package/dist/src/builder/steps/review.d.ts.map +1 -0
  65. package/dist/src/builder/steps/review.js +29 -0
  66. package/dist/src/builder/steps/review.js.map +1 -0
  67. package/dist/src/builder/steps/techniques.d.ts +13 -0
  68. package/dist/src/builder/steps/techniques.d.ts.map +1 -0
  69. package/dist/src/builder/steps/techniques.js +68 -0
  70. package/dist/src/builder/steps/techniques.js.map +1 -0
  71. package/dist/src/builder/steps/urls-and-cloud.d.ts +15 -0
  72. package/dist/src/builder/steps/urls-and-cloud.d.ts.map +1 -0
  73. package/dist/src/builder/steps/urls-and-cloud.js +53 -0
  74. package/dist/src/builder/steps/urls-and-cloud.js.map +1 -0
  75. package/dist/src/builder/web/api.d.ts +9 -0
  76. package/dist/src/builder/web/api.d.ts.map +1 -0
  77. package/dist/src/builder/web/api.js +40 -0
  78. package/dist/src/builder/web/api.js.map +1 -0
  79. package/dist/src/builder/web/client-form.html +222 -0
  80. package/dist/src/builder/web/server.d.ts +14 -0
  81. package/dist/src/builder/web/server.d.ts.map +1 -0
  82. package/dist/src/builder/web/server.js +85 -0
  83. package/dist/src/builder/web/server.js.map +1 -0
  84. package/dist/src/builder/wizard.d.ts +9 -0
  85. package/dist/src/builder/wizard.d.ts.map +1 -0
  86. package/dist/src/builder/wizard.js +49 -0
  87. package/dist/src/builder/wizard.js.map +1 -0
  88. package/dist/src/config.d.ts +11 -1
  89. package/dist/src/config.d.ts.map +1 -1
  90. package/dist/src/config.js +15 -2
  91. package/dist/src/config.js.map +1 -1
  92. package/dist/src/dns-resolver.d.ts +10 -1
  93. package/dist/src/dns-resolver.d.ts.map +1 -1
  94. package/dist/src/dns-resolver.js +41 -3
  95. package/dist/src/dns-resolver.js.map +1 -1
  96. package/dist/src/extractor.d.ts +12 -0
  97. package/dist/src/extractor.d.ts.map +1 -1
  98. package/dist/src/extractor.js +386 -0
  99. package/dist/src/extractor.js.map +1 -1
  100. package/dist/src/index.d.ts +1 -1
  101. package/dist/src/index.js +1 -1
  102. package/dist/src/ip-matcher.d.ts +23 -0
  103. package/dist/src/ip-matcher.d.ts.map +1 -1
  104. package/dist/src/ip-matcher.js +96 -23
  105. package/dist/src/ip-matcher.js.map +1 -1
  106. package/dist/src/manifest-schema.d.ts +12 -62
  107. package/dist/src/manifest-schema.d.ts.map +1 -1
  108. package/dist/src/manifest.d.ts +6 -0
  109. package/dist/src/manifest.d.ts.map +1 -1
  110. package/dist/src/manifest.js +21 -6
  111. package/dist/src/manifest.js.map +1 -1
  112. package/dist/src/proxy.d.ts +19 -4
  113. package/dist/src/proxy.d.ts.map +1 -1
  114. package/dist/src/proxy.js +111 -33
  115. package/dist/src/proxy.js.map +1 -1
  116. package/dist/src/safe-filename.d.ts +3 -0
  117. package/dist/src/safe-filename.d.ts.map +1 -0
  118. package/dist/src/safe-filename.js +8 -0
  119. package/dist/src/safe-filename.js.map +1 -0
  120. package/dist/src/sanitizer.d.ts.map +1 -1
  121. package/dist/src/sanitizer.js +36 -10
  122. package/dist/src/sanitizer.js.map +1 -1
  123. package/dist/src/technique-checker.d.ts +14 -0
  124. package/dist/src/technique-checker.d.ts.map +1 -1
  125. package/dist/src/technique-checker.js +123 -2
  126. package/dist/src/technique-checker.js.map +1 -1
  127. package/dist/src/transports/http.d.ts +6 -2
  128. package/dist/src/transports/http.d.ts.map +1 -1
  129. package/dist/src/transports/http.js +101 -13
  130. package/dist/src/transports/http.js.map +1 -1
  131. package/dist/src/transports/sse.d.ts +1 -1
  132. package/dist/src/transports/sse.d.ts.map +1 -1
  133. package/dist/src/transports/sse.js +28 -18
  134. package/dist/src/transports/sse.js.map +1 -1
  135. package/dist/src/transports/stdio.d.ts +2 -2
  136. package/dist/src/transports/stdio.d.ts.map +1 -1
  137. package/dist/src/transports/stdio.js +77 -48
  138. package/dist/src/transports/stdio.js.map +1 -1
  139. package/dist/src/types.d.ts +1 -1
  140. package/dist/src/types.d.ts.map +1 -1
  141. package/dist/src/validator.d.ts +19 -28
  142. package/dist/src/validator.d.ts.map +1 -1
  143. package/dist/src/validator.js +315 -113
  144. package/dist/src/validator.js.map +1 -1
  145. package/examples/claude-desktop-burp-config.json +6 -6
  146. package/package.json +21 -11
package/dist/src/builder/web/client-form.html ADDED
@@ -0,0 +1,222 @@
1
+ <!DOCTYPE html>
2
+ <html lang="en">
3
+ <head>
4
+ <meta charset="utf-8">
5
+ <meta name="viewport" content="width=device-width, initial-scale=1">
6
+ <title>IntegSec — Scope Definition</title>
7
+ <style>
8
+ :root {
9
+ --bg: #0f1117;
10
+ --surface: #1a1d27;
11
+ --border: #2a2d3a;
12
+ --text: #e1e4ed;
13
+ --text-dim: #8b8fa3;
14
+ --accent: #6366f1;
15
+ --accent-hover: #818cf8;
16
+ --success: #10b981;
17
+ --error: #ef4444;
18
+ --warning: #f59e0b;
19
+ }
20
+ * { margin: 0; padding: 0; box-sizing: border-box; }
21
+ body {
22
+ font-family: -apple-system, BlinkMacSystemFont, "Segoe UI", Roboto, sans-serif;
23
+ background: var(--bg);
24
+ color: var(--text);
25
+ line-height: 1.6;
26
+ padding: 2rem;
27
+ max-width: 800px;
28
+ margin: 0 auto;
29
+ }
30
+ h1 { font-size: 1.5rem; margin-bottom: 0.25rem; }
31
+ .subtitle { color: var(--text-dim); margin-bottom: 2rem; }
32
+ .section {
33
+ background: var(--surface);
34
+ border: 1px solid var(--border);
35
+ border-radius: 8px;
36
+ padding: 1.5rem;
37
+ margin-bottom: 1.5rem;
38
+ }
39
+ .section h2 { font-size: 1.1rem; margin-bottom: 1rem; display: flex; align-items: center; gap: 0.5rem; }
40
+ label { display: block; font-size: 0.875rem; color: var(--text-dim); margin-bottom: 0.25rem; }
41
+ .tooltip { font-size: 0.75rem; color: var(--text-dim); margin-bottom: 0.5rem; font-style: italic; }
42
+ input, textarea {
43
+ width: 100%;
44
+ padding: 0.5rem 0.75rem;
45
+ background: var(--bg);
46
+ border: 1px solid var(--border);
47
+ border-radius: 4px;
48
+ color: var(--text);
49
+ font-family: "SF Mono", "Fira Code", monospace;
50
+ font-size: 0.875rem;
51
+ margin-bottom: 1rem;
52
+ }
53
+ input:focus, textarea:focus { outline: none; border-color: var(--accent); }
54
+ input:disabled { opacity: 0.5; cursor: not-allowed; }
55
+ input.valid { border-color: var(--success); }
56
+ input.invalid { border-color: var(--error); }
57
+ textarea { min-height: 80px; resize: vertical; }
58
+ button {
59
+ background: var(--accent);
60
+ color: white;
61
+ border: none;
62
+ padding: 0.75rem 2rem;
63
+ border-radius: 6px;
64
+ font-size: 1rem;
65
+ cursor: pointer;
66
+ display: block;
67
+ width: 100%;
68
+ margin-top: 1rem;
69
+ }
70
+ button:hover { background: var(--accent-hover); }
71
+ button:disabled { opacity: 0.5; cursor: not-allowed; }
72
+ .result { padding: 1rem; border-radius: 6px; margin-top: 1rem; text-align: center; }
73
+ .result.success { background: rgba(16, 185, 129, 0.1); border: 1px solid var(--success); color: var(--success); }
74
+ .result.error { background: rgba(239, 68, 68, 0.1); border: 1px solid var(--error); color: var(--error); }
75
+ .brand { display: flex; align-items: center; gap: 0.5rem; margin-bottom: 1.5rem; padding-bottom: 1rem; border-bottom: 1px solid var(--border); }
76
+ .brand-logo { font-weight: 700; font-size: 1.1rem; color: var(--accent); }
77
+ </style>
78
+ </head>
79
+ <body>
80
+ <div class="brand">
81
+ <span class="brand-logo">IntegSec</span>
82
+ <span class="subtitle" style="margin: 0">Scope Definition Form</span>
83
+ </div>
84
+
85
+ <form id="scopeForm" onsubmit="return submitForm(event)">
86
+ <div class="section">
87
+ <h2>Engagement Info</h2>
88
+ <label for="engagement_id">Engagement ID</label>
89
+ <input type="text" id="engagement_id" placeholder="ENG-2026-0001">
90
+ <label for="client">Client Organization</label>
91
+ <input type="text" id="client" placeholder="Acme Corp">
92
+ <label for="operator">Operator Contact</label>
93
+ <input type="text" id="operator" placeholder="operator@integsec.com">
94
+ </div>
95
+
96
+ <div class="section">
97
+ <h2>Engagement Window</h2>
98
+ <label for="window_start">Start (ISO 8601)</label>
99
+ <div class="tooltip">Example: 2026-04-01T08:00:00Z</div>
100
+ <input type="text" id="window_start" placeholder="2026-04-01T08:00:00Z">
101
+ <label for="window_end">End (ISO 8601)</label>
102
+ <input type="text" id="window_end" placeholder="2026-04-15T17:00:00Z">
103
+ </div>
104
+
105
+ <div class="section">
106
+ <h2>Authorized Targets</h2>
107
+ <label for="domains">Domains</label>
108
+ <div class="tooltip">One per line. Wildcards OK: *.acme.com matches app.acme.com but not acme.com</div>
109
+ <textarea id="domains" placeholder="*.acme.com&#10;acme-staging.example.com"></textarea>
110
+ <label for="ip_ranges">IP Ranges (CIDR)</label>
111
+ <div class="tooltip">CIDR notation. Example: 10.10.10.0/24 covers 10.10.10.0 through 10.10.10.255</div>
112
+ <textarea id="ip_ranges" placeholder="10.10.10.0/24&#10;203.0.113.0/28"></textarea>
113
+ <label for="urls">URLs (optional)</label>
114
+ <div class="tooltip">Reference URLs for the engagement. One per line.</div>
115
+ <textarea id="urls" placeholder="https://app.acme.com&#10;https://api.acme.com"></textarea>
116
+ <label for="cloud_accounts">Cloud Accounts (optional)</label>
117
+ <div class="tooltip">Format: provider:account-id. Example: aws:123456789012</div>
118
+ <textarea id="cloud_accounts" placeholder="aws:123456789012"></textarea>
119
+ </div>
120
+
121
+ <div class="section">
122
+ <h2>Exclusions</h2>
123
+ <label for="excluded_targets">Excluded Targets</label>
124
+ <div class="tooltip">Targets within scope that must NOT be tested. One per line.</div>
125
+ <textarea id="excluded_targets" placeholder="hr.acme.com&#10;203.0.113.5"></textarea>
126
+ </div>
127
+
128
+ <div class="section">
129
+ <h2>Techniques</h2>
130
+ <label for="authorized_techniques">Authorized Techniques</label>
131
+ <div class="tooltip">Comma-separated. Categories: recon, web_app, exploitation, cloud_audit. Tools in a category not listed here are blocked; leave empty for no restriction.</div>
132
+ <input type="text" id="authorized_techniques" placeholder="recon, web_app">
133
+ <label for="excluded_techniques">Excluded Techniques</label>
134
+ <div class="tooltip">Comma-separated. Usually: dos, destructive, social_engineering</div>
135
+ <input type="text" id="excluded_techniques" placeholder="dos, destructive, social_engineering">
136
+ </div>
137
+
138
+ <button type="submit" id="submitBtn">Submit Scope Definition</button>
139
+ <div id="result"></div>
140
+ </form>
141
+
142
+ <script>
143
+ fetch("/template")
144
+ .then((r) => r.json())
145
+ .then((tpl) => {
146
+ const fieldMap = { engagement_id: "engagement_id", client: "client", operator: "operator" };
147
+ for (const [key, id] of Object.entries(fieldMap)) {
148
+ if (tpl[key]) { const el = document.getElementById(id); el.value = tpl[key]; el.disabled = true; }
149
+ }
150
+ if (tpl.engagement_window) {
151
+ if (tpl.engagement_window.start) { const el = document.getElementById("window_start"); el.value = tpl.engagement_window.start; el.disabled = true; }
152
+ if (tpl.engagement_window.end) { const el = document.getElementById("window_end"); el.value = tpl.engagement_window.end; el.disabled = true; }
153
+ }
154
+ if (tpl.excluded_techniques) { const el = document.getElementById("excluded_techniques"); el.value = tpl.excluded_techniques.join(", "); el.disabled = true; }
155
+ })
156
+ .catch(() => {});
157
+
158
+ document.querySelectorAll("input[type=text]").forEach((input) => {
159
+ input.addEventListener("blur", () => {
160
+ if (input.disabled) return;
161
+ if (input.value.trim()) { input.classList.add("valid"); input.classList.remove("invalid"); }
162
+ else if (["engagement_id", "client", "operator"].includes(input.id)) { input.classList.add("invalid"); input.classList.remove("valid"); }
163
+ });
164
+ });
165
+
166
+ function parseLines(id) {
167
+ return document.getElementById(id).value.split("\n").map((s) => s.trim()).filter(Boolean);
168
+ }
169
+ function parseComma(id) {
170
+ return document.getElementById(id).value.split(",").map((s) => s.trim()).filter(Boolean);
171
+ }
172
+ function val(id) { return document.getElementById(id).value.trim(); }
173
+
174
+ async function submitForm(e) {
175
+ e.preventDefault();
176
+ const btn = document.getElementById("submitBtn");
177
+ const result = document.getElementById("result");
178
+ btn.disabled = true;
179
+ btn.textContent = "Submitting...";
180
+
181
+ const manifest = {
182
+ engagement_id: val("engagement_id"),
183
+ client: val("client"),
184
+ operator: val("operator"),
185
+ authorized_targets: {
186
+ ip_ranges: parseLines("ip_ranges"),
187
+ domains: parseLines("domains"),
188
+ urls: parseLines("urls"),
189
+ cloud_accounts: parseLines("cloud_accounts"),
190
+ },
191
+ excluded_targets: parseLines("excluded_targets"),
192
+ authorized_techniques: parseComma("authorized_techniques"),
193
+ excluded_techniques: parseComma("excluded_techniques"),
194
+ engagement_window: { start: val("window_start"), end: val("window_end") },
195
+ };
196
+
197
+ try {
198
+ const res = await fetch("/submit", {
199
+ method: "POST",
200
+ headers: { "Content-Type": "application/json" },
201
+ body: JSON.stringify(manifest),
202
+ });
203
+ const data = await res.json();
204
+ if (data.success) {
205
+ result.className = "result success";
206
+ result.textContent = "Scope definition submitted successfully. Your operator will review it.";
207
+ } else {
208
+ result.className = "result error";
209
+ result.textContent = "Validation failed: " + (data.details?.join(", ") || data.error);
210
+ }
211
+ } catch (err) {
212
+ result.className = "result error";
213
+ result.textContent = "Network error: " + err.message;
214
+ }
215
+
216
+ btn.disabled = false;
217
+ btn.textContent = "Submit Scope Definition";
218
+ return false;
219
+ }
220
+ </script>
221
+ </body>
222
+ </html>
package/dist/src/builder/web/server.d.ts ADDED
@@ -0,0 +1,14 @@
1
+ import http from "http";
2
+ import https from "https";
3
+ import type { ScopeManifest } from "../../types.js";
4
+ export interface ServeOptions {
5
+ port: number;
6
+ host: string;
7
+ template?: Partial<ScopeManifest>;
8
+ outputDir: string;
9
+ tlsCert?: string;
10
+ tlsKey?: string;
11
+ timeoutMinutes: number;
12
+ }
13
+ export declare function startServer(options: ServeOptions): http.Server | https.Server;
14
+ //# sourceMappingURL=server.d.ts.map
package/dist/src/builder/web/server.d.ts.map ADDED
@@ -0,0 +1 @@
1
+ {"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../../../../src/builder/web/server.ts"],"names":[],"mappings":"AAAA,OAAO,IAAI,MAAM,MAAM,CAAC;AACxB,OAAO,KAAK,MAAM,OAAO,CAAC;AAI1B,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAGpD,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,CAAC,EAAE,OAAO,CAAC,aAAa,CAAC,CAAC;IAClC,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,cAAc,EAAE,MAAM,CAAC;CACxB;AAED,wBAAgB,WAAW,CAAC,OAAO,EAAE,YAAY,GAAG,IAAI,CAAC,MAAM,GAAG,KAAK,CAAC,MAAM,CAmF7E"}
package/dist/src/builder/web/server.js ADDED
@@ -0,0 +1,85 @@
1
+ import http from "http";
2
+ import https from "https";
3
+ import fs from "fs";
4
+ import path from "path";
5
+ import { fileURLToPath } from "url";
6
+ import { handleGetTemplate, handlePostSubmit } from "./api.js";
7
+ export function startServer(options) {
8
+ const { port, host, template, outputDir, tlsCert, tlsKey, timeoutMinutes } = options;
9
+ const isLocalhost = host === "127.0.0.1" || host === "localhost" || host === "::1";
10
+ if (!isLocalhost && (!tlsCert || !tlsKey)) {
11
+ console.error("Refusing to serve client intake form over plaintext on a non-localhost interface. " +
12
+ "Provide --tls-cert and --tls-key.");
13
+ process.exit(1);
14
+ }
15
+ const thisDir = path.dirname(fileURLToPath(import.meta.url));
16
+ const formPath = path.join(thisDir, "client-form.html");
17
+ const formHtml = fs.existsSync(formPath) ? fs.readFileSync(formPath, "utf-8") : "<h1>Form not found</h1>";
18
+ const handler = (req, res) => {
19
+ res.setHeader("Access-Control-Allow-Origin", "*");
20
+ res.setHeader("Access-Control-Allow-Methods", "GET, POST, OPTIONS");
21
+ res.setHeader("Access-Control-Allow-Headers", "Content-Type");
22
+ if (req.method === "OPTIONS") {
23
+ res.writeHead(204);
24
+ res.end();
25
+ return;
26
+ }
27
+ if (req.method === "GET" && (req.url === "/" || req.url === "")) {
28
+ res.writeHead(200, { "Content-Type": "text/html; charset=utf-8" });
29
+ res.end(formHtml);
30
+ return;
31
+ }
32
+ if (req.method === "GET" && req.url === "/template") {
33
+ const result = handleGetTemplate(template);
34
+ res.writeHead(result.status, { "Content-Type": result.contentType });
35
+ res.end(result.body);
36
+ return;
37
+ }
38
+ if (req.method === "POST" && req.url === "/submit") {
39
+ let body = "";
40
+ req.on("data", (chunk) => { body += chunk; });
41
+ req.on("end", () => {
42
+ const result = handlePostSubmit(body, outputDir);
43
+ res.writeHead(result.status, { "Content-Type": result.contentType });
44
+ res.end(result.body);
45
+ if (result.status === 200) {
46
+ console.log(`\n✓ Submission received and saved to ${outputDir}`);
47
+ }
48
+ });
49
+ return;
50
+ }
51
+ res.writeHead(404, { "Content-Type": "application/json" });
52
+ res.end(JSON.stringify({ error: "Not found" }));
53
+ };
54
+ let server;
55
+ if (tlsCert && tlsKey) {
56
+ const cert = fs.readFileSync(tlsCert, "utf-8");
57
+ const key = fs.readFileSync(tlsKey, "utf-8");
58
+ server = https.createServer({ cert, key }, handler);
59
+ }
60
+ else {
61
+ server = http.createServer(handler);
62
+ }
63
+ let timeout;
64
+ const resetTimeout = () => {
65
+ if (timeout)
66
+ clearTimeout(timeout);
67
+ timeout = setTimeout(() => {
68
+ console.log(`\nServer auto-shutdown after ${timeoutMinutes} minutes of inactivity.`);
69
+ server.close();
70
+ process.exit(0);
71
+ }, timeoutMinutes * 60_000);
72
+ };
73
+ server.on("request", resetTimeout);
74
+ server.listen(port, host, () => {
75
+ const protocol = tlsCert ? "https" : "http";
76
+ const displayHost = host === "0.0.0.0" ? "localhost" : host;
77
+ console.log(`\n🔒 Scope Manifest — Client Intake Form`);
78
+ console.log(` ${protocol}://${displayHost}:${port}`);
79
+ console.log(` Output: ${outputDir}`);
80
+ console.log(` Auto-shutdown: ${timeoutMinutes} minutes\n`);
81
+ resetTimeout();
82
+ });
83
+ return server;
84
+ }
85
+ //# sourceMappingURL=server.js.map
package/dist/src/builder/web/server.js.map ADDED
@@ -0,0 +1 @@
1
+ {"version":3,"file":"server.js","sourceRoot":"","sources":["../../../../src/builder/web/server.ts"],"names":[],"mappings":"AAAA,OAAO,IAAI,MAAM,MAAM,CAAC;AACxB,OAAO,KAAK,MAAM,OAAO,CAAC;AAC1B,OAAO,EAAE,MAAM,IAAI,CAAC;AACpB,OAAO,IAAI,MAAM,MAAM,CAAC;AACxB,OAAO,EAAE,aAAa,EAAE,MAAM,KAAK,CAAC;AAEpC,OAAO,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,MAAM,UAAU,CAAC;AAY/D,MAAM,UAAU,WAAW,CAAC,OAAqB;IAC/C,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,EAAE,cAAc,EAAE,GAAG,OAAO,CAAC;IAErF,MAAM,WAAW,GAAG,IAAI,KAAK,WAAW,IAAI,IAAI,KAAK,WAAW,IAAI,IAAI,KAAK,KAAK,CAAC;IACnF,IAAI,CAAC,WAAW,IAAI,CAAC,CAAC,OAAO,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;QAC1C,OAAO,CAAC,KAAK,CACX,oFAAoF;YACpF,mCAAmC,CACpC,CAAC;QACF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;IAC7D,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,kBAAkB,CAAC,CAAC;IACxD,MAAM,QAAQ,GAAG,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,YAAY,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,yBAAyB,CAAC;IAE1G,MAAM,OAAO,GAAG,CAAC,GAAyB,EAAE,GAAwB,EAAE,EAAE;QACtE,GAAG,CAAC,SAAS,CAAC,6BAA6B,EAAE,GAAG,CAAC,CAAC;QAClD,GAAG,CAAC,SAAS,CAAC,8BAA8B,EAAE,oBAAoB,CAAC,CAAC;QACpE,GAAG,CAAC,SAAS,CAAC,8BAA8B,EAAE,cAAc,CAAC,CAAC;QAE9D,IAAI,GAAG,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YAAC,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;YAAC,GAAG,CAAC,GAAG,EAAE,CAAC;YAAC,OAAO;QAAC,CAAC;QAExE,IAAI,GAAG,CAAC,MAAM,KAAK,KAAK,IAAI,CAAC,GAAG,CAAC,GAAG,KAAK,GAAG,IAAI,GAAG,CAAC,GAAG,KAAK,EAAE,CAAC,EAAE,CAAC;YAChE,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,0BAA0B,EAAE,CAAC,CAAC;YACnE,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;YAClB,OAAO;QACT,CAAC;QAED,IAAI,GAAG,CAAC,MAAM,KAAK,KAAK,IAAI,GAAG,CAAC,GAAG,KAAK,WAAW,EAAE,CAAC;YACpD,MAAM,MAAM,GAAG,iBAAiB,CAAC,QAAQ,CAAC,CAAC;YAC3C,GAAG,CAAC,SAAS,CAAC,MAAM,CAAC,MAAM,EAAE,EAAE,cAAc,EAAE,MAAM,CAAC,WAAW,EAAE,CAAC,CAAC;YACrE,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;YACrB,OAAO;QACT,CAAC;QAED,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM,IAAI,GAAG,CAAC,GAAG,KAAK,SAAS,EAAE,CAAC;YACnD,IAAI,IAAI,GAAG,EAAE,CAAC;YACd,GAAG,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE,EAAE,GAAG,IAAI,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;YAC9C,GAAG,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE;gBACjB,MAAM,MAAM,GAAG,gBAAgB,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;gBACjD,GAAG,CAAC,SAAS,CAAC,MAAM,CAAC,MAAM,EAAE,EAAE,cAAc,EAAE,MAAM,CAAC,WAAW,EAAE,CAAC,CAAC;gBACrE,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;gBACrB,IAAI,MAAM,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;oBAAC,OAAO,CAAC,GAAG,CAAC,wCAAwC,SAAS,EAAE,CAAC,CAAC;gBAAC,CAAC;YAClG,CAAC,CAAC,CAAC;YACH,OAAO;QACT,CAAC;QAED,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC;QAC3D,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC;IAClD,CAAC,CAAC;IAEF,IAAI,MAAkC,CAAC;IACvC,IAAI,OAAO,IAAI,MAAM,EAAE,CAAC;QACtB,MAAM,IAAI,GAAG,EAAE,CAAC,YAAY,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QAC/C,MAAM,GAAG,GAAG,EAAE,CAAC,YAAY,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QAC7C,MAAM,GAAG,KAAK,CAAC,YAAY,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,EAAE,OAAO,CAAC,CAAC;IACtD,CAAC;SAAM,CAAC;QACN,MAAM,GAAG,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC;IACtC,CAAC;IAED,IAAI,OAAsC,CAAC;IAC3C,MAAM,YAAY,GAAG,GAAG,EAAE;QACxB,IAAI,OAAO;YAAE,YAAY,CAAC,OAAO,CAAC,CAAC;QACnC,OAAO,GAAG,UAAU,CAAC,GAAG,EAAE;YACxB,OAAO,CAAC,GAAG,CAAC,gCAAgC,cAAc,yBAAyB,CAAC,CAAC;YACrF,MAAM,CAAC,KAAK,EAAE,CAAC;YACf,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC,EAAE,cAAc,GAAG,MAAM,CAAC,CAAC;IAC9B,CAAC,CAAC;IAEF,MAAM,CAAC,EAAE,CAAC,SAAS,EAAE,YAAY,CAAC,CAAC;IACnC,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,EAAE,GAAG,EAAE;QAC7B,MAAM,QAAQ,GAAG,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC;QAC5C,MAAM,WAAW,GAAG,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC;QAC5D,OAAO,CAAC,GAAG,CAAC,0CAA0C,CAAC,CAAC;QACxD,OAAO,CAAC,GAAG,CAAC,MAAM,QAAQ,MAAM,WAAW,IAAI,IAAI,EAAE,CAAC,CAAC;QACvD,OAAO,CAAC,GAAG,CAAC,cAAc,SAAS,EAAE,CAAC,CAAC;QACvC,OAAO,CAAC,GAAG,CAAC,qBAAqB,cAAc,YAAY,CAAC,CAAC;QAC7D,YAAY,EAAE,CAAC;IACjB,CAAC,CAAC,CAAC;IAEH,OAAO,MAAM,CAAC;AAChB,CAAC"}
package/dist/src/builder/wizard.d.ts ADDED
@@ -0,0 +1,9 @@
1
+ import React from "react";
2
+ import type { ScopeManifest } from "../types.js";
3
+ interface Props {
4
+ initial?: Partial<ScopeManifest>;
5
+ onFinish: (manifest: ScopeManifest) => void;
6
+ }
7
+ export declare function Wizard({ initial, onFinish }: Props): React.ReactElement;
8
+ export {};
9
+ //# sourceMappingURL=wizard.d.ts.map
package/dist/src/builder/wizard.d.ts.map ADDED
@@ -0,0 +1 @@
1
+ {"version":3,"file":"wizard.d.ts","sourceRoot":"","sources":["../../../src/builder/wizard.tsx"],"names":[],"mappings":"AACA,OAAO,KAAmB,MAAM,OAAO,CAAC;AAExC,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAYjD,UAAU,KAAK;IACb,OAAO,CAAC,EAAE,OAAO,CAAC,aAAa,CAAC,CAAC;IACjC,QAAQ,EAAE,CAAC,QAAQ,EAAE,aAAa,KAAK,IAAI,CAAC;CAC7C;AAkCD,wBAAgB,MAAM,CAAC,EAAE,OAAO,EAAE,QAAQ,EAAE,EAAE,KAAK,GAAG,KAAK,CAAC,YAAY,CAqFvE"}
package/dist/src/builder/wizard.js ADDED
@@ -0,0 +1,49 @@
1
+ import { jsxs as _jsxs, jsx as _jsx } from "react/jsx-runtime";
2
+ // src/builder/wizard.tsx
3
+ import { useState } from "react";
4
+ import { Box, Text } from "ink";
5
+ import { EngagementInfoStep } from "./steps/engagement-info.js";
6
+ import { EngagementWindowStep } from "./steps/engagement-window.js";
7
+ import { DomainsStep } from "./steps/domains.js";
8
+ import { IpRangesStep } from "./steps/ip-ranges.js";
9
+ import { UrlsAndCloudStep } from "./steps/urls-and-cloud.js";
10
+ import { ExclusionsStep } from "./steps/exclusions.js";
11
+ import { TechniquesStep } from "./steps/techniques.js";
12
+ import { ReviewStep } from "./steps/review.js";
13
+ function buildManifest(state) {
14
+ return {
15
+ engagement_id: state.engagement_id,
16
+ client: state.client,
17
+ operator: state.operator,
18
+ authorized_targets: {
19
+ ip_ranges: state.ip_ranges,
20
+ domains: state.domains,
21
+ urls: state.urls,
22
+ cloud_accounts: state.cloud_accounts,
23
+ },
24
+ excluded_targets: state.excluded_targets,
25
+ authorized_techniques: state.authorized_techniques,
26
+ excluded_techniques: state.excluded_techniques,
27
+ engagement_window: state.engagement_window,
28
+ };
29
+ }
30
+ export function Wizard({ initial, onFinish }) {
31
+ const [step, setStep] = useState(1);
32
+ const [state, setState] = useState({
33
+ engagement_id: initial?.engagement_id ?? "",
34
+ client: initial?.client ?? "",
35
+ operator: initial?.operator ?? "",
36
+ engagement_window: initial?.engagement_window ?? { start: "", end: "" },
37
+ domains: initial?.authorized_targets?.domains ?? [],
38
+ ip_ranges: initial?.authorized_targets?.ip_ranges ?? [],
39
+ urls: initial?.authorized_targets?.urls ?? [],
40
+ cloud_accounts: initial?.authorized_targets?.cloud_accounts ?? [],
41
+ excluded_targets: initial?.excluded_targets ?? [],
42
+ authorized_techniques: initial?.authorized_techniques ?? [],
43
+ excluded_techniques: initial?.excluded_techniques ?? [],
44
+ });
45
+ const goBack = () => setStep((s) => Math.max(1, s - 1));
46
+ const goNext = () => setStep((s) => Math.min(8, s + 1));
47
+ return (_jsxs(Box, { flexDirection: "column", children: [_jsx(Box, { marginBottom: 1, children: _jsxs(Text, { dimColor: true, children: ["\u2500\u2500\u2500 Scope Manifest Builder \u2500\u2500\u2500 Step ", step, "/8 \u2500\u2500\u2500"] }) }), step === 1 && (_jsx(EngagementInfoStep, { initial: { engagement_id: state.engagement_id, client: state.client, operator: state.operator }, onComplete: (data) => { setState((s) => ({ ...s, ...data })); goNext(); } })), step === 2 && (_jsx(EngagementWindowStep, { initial: state.engagement_window, onComplete: (data) => { setState((s) => ({ ...s, engagement_window: data })); goNext(); }, onBack: goBack })), step === 3 && (_jsx(DomainsStep, { initial: state.domains, authorizedIpRanges: state.ip_ranges, onComplete: (domains) => { setState((s) => ({ ...s, domains })); goNext(); }, onBack: goBack })), step === 4 && (_jsx(IpRangesStep, { initial: state.ip_ranges, onComplete: (ranges) => { setState((s) => ({ ...s, ip_ranges: ranges })); goNext(); }, onBack: goBack })), step === 5 && (_jsx(UrlsAndCloudStep, { initial: { urls: state.urls, cloud_accounts: state.cloud_accounts }, onComplete: (data) => { setState((s) => ({ ...s, urls: data.urls, cloud_accounts: data.cloud_accounts })); goNext(); }, onBack: goBack })), step === 6 && (_jsx(ExclusionsStep, { initial: state.excluded_targets, authorized: { ip_ranges: state.ip_ranges, domains: state.domains }, onComplete: (excluded) => { setState((s) => ({ ...s, excluded_targets: excluded })); goNext(); }, onBack: goBack })), step === 7 && (_jsx(TechniquesStep, { initialAuthorized: state.authorized_techniques, initialExcluded: state.excluded_techniques, onComplete: (data) => { setState((s) => ({ ...s, authorized_techniques: data.authorized, excluded_techniques: data.excluded })); goNext(); }, onBack: goBack })), step === 8 && (_jsx(ReviewStep, { manifest: buildManifest(state), onConfirm: () => onFinish(buildManifest(state)), onBack: goBack }))] }));
48
+ }
49
+ //# sourceMappingURL=wizard.js.map
package/dist/src/builder/wizard.js.map ADDED
@@ -0,0 +1 @@
1
+ {"version":3,"file":"wizard.js","sourceRoot":"","sources":["../../../src/builder/wizard.tsx"],"names":[],"mappings":";AAAA,yBAAyB;AACzB,OAAc,EAAE,QAAQ,EAAE,MAAM,OAAO,CAAC;AACxC,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,MAAM,KAAK,CAAC;AAEhC,OAAO,EAAE,kBAAkB,EAAE,MAAM,4BAA4B,CAAC;AAChE,OAAO,EAAE,oBAAoB,EAAE,MAAM,8BAA8B,CAAC;AACpE,OAAO,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AACjD,OAAO,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AACpD,OAAO,EAAE,gBAAgB,EAAE,MAAM,2BAA2B,CAAC;AAC7D,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AACvD,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AACvD,OAAO,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAuB/C,SAAS,aAAa,CAAC,KAAkB;IACvC,OAAO;QACL,aAAa,EAAE,KAAK,CAAC,aAAa;QAClC,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,kBAAkB,EAAE;YAClB,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,cAAc,EAAE,KAAK,CAAC,cAAc;SACrC;QACD,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;QACxC,qBAAqB,EAAE,KAAK,CAAC,qBAAqB;QAClD,mBAAmB,EAAE,KAAK,CAAC,mBAAmB;QAC9C,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;KAC3C,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,MAAM,CAAC,EAAE,OAAO,EAAE,QAAQ,EAAS;IACjD,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,GAAG,QAAQ,CAAO,CAAC,CAAC,CAAC;IAC1C,MAAM,CAAC,KAAK,EAAE,QAAQ,CAAC,GAAG,QAAQ,CAAc;QAC9C,aAAa,EAAE,OAAO,EAAE,aAAa,IAAI,EAAE;QAC3C,MAAM,EAAE,OAAO,EAAE,MAAM,IAAI,EAAE;QAC7B,QAAQ,EAAE,OAAO,EAAE,QAAQ,IAAI,EAAE;QACjC,iBAAiB,EAAE,OAAO,EAAE,iBAAiB,IAAI,EAAE,KAAK,EAAE,EAAE,EAAE,GAAG,EAAE,EAAE,EAAE;QACvE,OAAO,EAAE,OAAO,EAAE,kBAAkB,EAAE,OAAO,IAAI,EAAE;QACnD,SAAS,EAAE,OAAO,EAAE,kBAAkB,EAAE,SAAS,IAAI,EAAE;QACvD,IAAI,EAAE,OAAO,EAAE,kBAAkB,EAAE,IAAI,IAAI,EAAE;QAC7C,cAAc,EAAE,OAAO,EAAE,kBAAkB,EAAE,cAAc,IAAI,EAAE;QACjE,gBAAgB,EAAE,OAAO,EAAE,gBAAgB,IAAI,EAAE;QACjD,qBAAqB,EAAE,OAAO,EAAE,qBAAqB,IAAI,EAAE;QAC3D,mBAAmB,EAAE,OAAO,EAAE,mBAAmB,IAAI,EAAE;KACxD,CAAC,CAAC;IAEH,MAAM,MAAM,GAAG,GAAG,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,CAAS,CAAC,CAAC;IAChE,MAAM,MAAM,GAAG,GAAG,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,CAAS,CAAC,CAAC;IAEhE,OAAO,CACL,MAAC,GAAG,IAAC,aAAa,EAAC,QAAQ,aACzB,KAAC,GAAG,IAAC,YAAY,EAAE,CAAC,YAClB,MAAC,IAAI,IAAC,QAAQ,yFAAsC,IAAI,6BAAc,GAClE,EAEL,IAAI,KAAK,CAAC,IAAI,CACb,KAAC,kBAAkB,IACjB,OAAO,EAAE,EAAE,aAAa,EAAE,KAAK,CAAC,aAAa,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,EAC/F,UAAU,EAAE,CAAC,IAAI,EAAE,EAAE,GAAG,QAAQ,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,GAAG,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,GACzE,CACH,EACA,IAAI,KAAK,CAAC,IAAI,CACb,KAAC,oBAAoB,IACnB,OAAO,EAAE,KAAK,CAAC,iBAAiB,EAChC,UAAU,EAAE,CAAC,IAAI,EAAE,EAAE,GAAG,QAAQ,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,iBAAiB,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EACzF,MAAM,EAAE,MAAM,GACd,CACH,EACA,IAAI,KAAK,CAAC,IAAI,CACb,KAAC,WAAW,IACV,OAAO,EAAE,KAAK,CAAC,OAAO,EACtB,kBAAkB,EAAE,KAAK,CAAC,SAAS,EACnC,UAAU,EAAE,CAAC,OAAO,EAAE,EAAE,GAAG,QAAQ,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAC5E,MAAM,EAAE,MAAM,GACd,CACH,EACA,IAAI,KAAK,CAAC,IAAI,CACb,KAAC,YAAY,IACX,OAAO,EAAE,KAAK,CAAC,SAAS,EACxB,UAAU,EAAE,CAAC,MAAM,EAAE,EAAE,GAAG,QAAQ,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EACrF,MAAM,EAAE,MAAM,GACd,CACH,EACA,IAAI,KAAK,CAAC,IAAI,CACb,KAAC,gBAAgB,IACf,OAAO,EAAE,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,cAAc,EAAE,KAAK,CAAC,cAAc,EAAE,EACnE,UAAU,EAAE,CAAC,IAAI,EAAE,EAAE,GAAG,QAAQ,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,cAAc,EAAE,IAAI,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EACtH,MAAM,EAAE,MAAM,GACd,CACH,EACA,IAAI,KAAK,CAAC,IAAI,CACb,KAAC,cAAc,IACb,OAAO,EAAE,KAAK,CAAC,gBAAgB,EAC/B,UAAU,EAAE,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,EAClE,UAAU,EAAE,CAAC,QAAQ,EAAE,EAAE,GAAG,QAAQ,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,gBAAgB,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAChG,MAAM,EAAE,MAAM,GACd,CACH,EACA,IAAI,KAAK,CAAC,IAAI,CACb,KAAC,cAAc,IACb,iBAAiB,EAAE,KAAK,CAAC,qBAAqB,EAC9C,eAAe,EAAE,KAAK,CAAC,mBAAmB,EAC1C,UAAU,EAAE,CAAC,IAAI,EAAE,EAAE,GAAG,QAAQ,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,qBAAqB,EAAE,IAAI,CAAC,UAAU,EAAE,mBAAmB,EAAE,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAC5I,MAAM,EAAE,MAAM,GACd,CACH,EACA,IAAI,KAAK,CAAC,IAAI,CACb,KAAC,UAAU,IACT,QAAQ,EAAE,aAAa,CAAC,KAAK,CAAC,EAC9B,SAAS,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,EAC/C,MAAM,EAAE,MAAM,GACd,CACH,IACG,CACP,CAAC;AACJ,CAAC"}
package/dist/src/config.d.ts CHANGED
@@ -1,18 +1,28 @@
1
+ export type Transport = "stdio" | "sse" | "http";
1
2
  export interface ProxyConfig {
2
3
  manifestPath?: string;
3
4
  manifestJson?: string;
4
5
  manifestSecretArn?: string;
5
6
  manifestKeyvaultUri?: string;
6
7
  manifestGcpSecret?: string;
7
- transport: "stdio" | "sse";
8
+ transport: Transport;
8
9
  upstreamMcpUrl?: string;
9
10
  upstreamMcpCommand?: string;
10
11
  upstreamMcpArgs?: string[];
12
+ /** stdio only: hold agent messages until the upstream prints or this many ms pass (0 = forward immediately). */
13
+ upstreamStartupDelayMs?: number;
11
14
  proxyPort: number;
15
+ /** http only: interface to bind (default 127.0.0.1). */
16
+ proxyHost?: string;
17
+ /** http only: shared secret required when binding a non-loopback interface. */
18
+ proxyAuthToken?: string;
19
+ /** Permit free-form command/argument fields despite incomplete inspection. */
20
+ allowUnstructuredCommands?: boolean;
12
21
  auditLogPath: string;
13
22
  awsLogGroup?: string;
14
23
  awsRegion?: string;
15
24
  azureLogWorkspaceId?: string;
25
+ azureLogIngestionEndpoint?: string;
16
26
  azureDcrImmutableId?: string;
17
27
  azureDcrStreamName: string;
18
28
  gcpProject?: string;
package/dist/src/config.d.ts.map CHANGED
@@ -1 +1 @@
1
- {"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../../src/config.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,WAAW;IAC1B,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,SAAS,EAAE,OAAO,GAAG,KAAK,CAAC;IAC3B,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,eAAe,CAAC,EAAE,MAAM,EAAE,CAAC;IAC3B,SAAS,EAAE,MAAM,CAAC;IAClB,YAAY,EAAE,MAAM,CAAC;IACrB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,kBAAkB,EAAE,MAAM,CAAC;IAC3B,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,CAAC;CACtB;AAED,wBAAgB,UAAU,IAAI,WAAW,CAwBxC"}
1
+ {"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../../src/config.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,SAAS,GAAG,OAAO,GAAG,KAAK,GAAG,MAAM,CAAC;AAIjD,MAAM,WAAW,WAAW;IAC1B,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,SAAS,EAAE,SAAS,CAAC;IACrB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,eAAe,CAAC,EAAE,MAAM,EAAE,CAAC;IAC3B,gHAAgH;IAChH,sBAAsB,CAAC,EAAE,MAAM,CAAC;IAChC,SAAS,EAAE,MAAM,CAAC;IAClB,wDAAwD;IACxD,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,+EAA+E;IAC/E,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,8EAA8E;IAC9E,yBAAyB,CAAC,EAAE,OAAO,CAAC;IACpC,YAAY,EAAE,MAAM,CAAC;IACrB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,yBAAyB,CAAC,EAAE,MAAM,CAAC;IACnC,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,kBAAkB,EAAE,MAAM,CAAC;IAC3B,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,CAAC;CACtB;AAYD,wBAAgB,UAAU,IAAI,WAAW,CA6BxC"}
package/dist/src/config.js CHANGED
@@ -1,3 +1,11 @@
1
+ const TRANSPORTS = ["stdio", "sse", "http"];
2
+ function parseTransport(value) {
3
+ const t = (value || "stdio").trim().toLowerCase();
4
+ if (!TRANSPORTS.includes(t)) {
5
+ throw new Error(`Invalid MCP_TRANSPORT "${value}". Use one of: ${TRANSPORTS.join(", ")}.`);
6
+ }
7
+ return t;
8
+ }
1
9
  export function loadConfig() {
2
10
  return {
3
11
  manifestPath: process.env.SCOPE_MANIFEST_PATH,
@@ -5,22 +13,27 @@ export function loadConfig() {
5
13
  manifestSecretArn: process.env.SCOPE_MANIFEST_SECRET_ARN,
6
14
  manifestKeyvaultUri: process.env.SCOPE_MANIFEST_KEYVAULT_URI,
7
15
  manifestGcpSecret: process.env.SCOPE_MANIFEST_GCP_SECRET,
8
- transport: process.env.MCP_TRANSPORT || "stdio",
16
+ transport: parseTransport(process.env.MCP_TRANSPORT),
9
17
  upstreamMcpUrl: process.env.UPSTREAM_MCP_URL,
10
18
  upstreamMcpCommand: process.env.UPSTREAM_MCP_COMMAND,
11
19
  upstreamMcpArgs: process.env.UPSTREAM_MCP_ARGS?.split(","),
20
+ upstreamStartupDelayMs: parseInt(process.env.UPSTREAM_STARTUP_DELAY_MS || "0", 10),
12
21
  proxyPort: parseInt(process.env.PROXY_PORT || "9090", 10),
22
+ proxyHost: process.env.PROXY_HOST || "127.0.0.1",
23
+ proxyAuthToken: process.env.PROXY_AUTH_TOKEN,
24
+ allowUnstructuredCommands: process.env.ALLOW_UNSTRUCTURED_COMMANDS === "true",
13
25
  auditLogPath: process.env.AUDIT_LOG_PATH || "./audit/",
14
26
  awsLogGroup: process.env.AWS_LOG_GROUP,
15
27
  awsRegion: process.env.AWS_REGION,
16
28
  azureLogWorkspaceId: process.env.AZURE_LOG_WORKSPACE_ID,
29
+ azureLogIngestionEndpoint: process.env.AZURE_LOG_INGESTION_ENDPOINT,
17
30
  azureDcrImmutableId: process.env.AZURE_DCR_IMMUTABLE_ID,
18
31
  azureDcrStreamName: process.env.AZURE_DCR_STREAM_NAME || "Custom-MCPProxyAudit_CL",
19
32
  gcpProject: process.env.GOOGLE_CLOUD_PROJECT,
20
33
  techniqueMapPath: process.env.TECHNIQUE_MAP_PATH,
21
34
  dnsCacheTtl: parseInt(process.env.DNS_CACHE_TTL || "60", 10),
22
35
  logLevel: process.env.LOG_LEVEL || "INFO",
23
- proxyVersion: process.env.PROXY_VERSION || "0.1.0",
36
+ proxyVersion: process.env.PROXY_VERSION || "0.2.6",
24
37
  };
25
38
  }
26
39
  //# sourceMappingURL=config.js.map
package/dist/src/config.js.map CHANGED
@@ -1 +1 @@
1
- {"version":3,"file":"config.js","sourceRoot":"","sources":["../../src/config.ts"],"names":[],"mappings":"AAwBA,MAAM,UAAU,UAAU;IACxB,OAAO;QACL,YAAY,EAAE,OAAO,CAAC,GAAG,CAAC,mBAAmB;QAC7C,YAAY,EAAE,OAAO,CAAC,GAAG,CAAC,mBAAmB;QAC7C,iBAAiB,EAAE,OAAO,CAAC,GAAG,CAAC,yBAAyB;QACxD,mBAAmB,EAAE,OAAO,CAAC,GAAG,CAAC,2BAA2B;QAC5D,iBAAiB,EAAE,OAAO,CAAC,GAAG,CAAC,yBAAyB;QACxD,SAAS,EAAG,OAAO,CAAC,GAAG,CAAC,aAAiC,IAAI,OAAO;QACpE,cAAc,EAAE,OAAO,CAAC,GAAG,CAAC,gBAAgB;QAC5C,kBAAkB,EAAE,OAAO,CAAC,GAAG,CAAC,oBAAoB;QACpD,eAAe,EAAE,OAAO,CAAC,GAAG,CAAC,iBAAiB,EAAE,KAAK,CAAC,GAAG,CAAC;QAC1D,SAAS,EAAE,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,IAAI,MAAM,EAAE,EAAE,CAAC;QACzD,YAAY,EAAE,OAAO,CAAC,GAAG,CAAC,cAAc,IAAI,UAAU;QACtD,WAAW,EAAE,OAAO,CAAC,GAAG,CAAC,aAAa;QACtC,SAAS,EAAE,OAAO,CAAC,GAAG,CAAC,UAAU;QACjC,mBAAmB,EAAE,OAAO,CAAC,GAAG,CAAC,sBAAsB;QACvD,mBAAmB,EAAE,OAAO,CAAC,GAAG,CAAC,sBAAsB;QACvD,kBAAkB,EAAE,OAAO,CAAC,GAAG,CAAC,qBAAqB,IAAI,yBAAyB;QAClF,UAAU,EAAE,OAAO,CAAC,GAAG,CAAC,oBAAoB;QAC5C,gBAAgB,EAAE,OAAO,CAAC,GAAG,CAAC,kBAAkB;QAChD,WAAW,EAAE,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,aAAa,IAAI,IAAI,EAAE,EAAE,CAAC;QAC5D,QAAQ,EAAE,OAAO,CAAC,GAAG,CAAC,SAAS,IAAI,MAAM;QACzC,YAAY,EAAE,OAAO,CAAC,GAAG,CAAC,aAAa,IAAI,OAAO;KACnD,CAAC;AACJ,CAAC"}
1
+ {"version":3,"file":"config.js","sourceRoot":"","sources":["../../src/config.ts"],"names":[],"mappings":"AAEA,MAAM,UAAU,GAAyB,CAAC,OAAO,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC;AAmClE,SAAS,cAAc,CAAC,KAAyB;IAC/C,MAAM,CAAC,GAAG,CAAC,KAAK,IAAI,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAClD,IAAI,CAAE,UAAgC,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC;QACnD,MAAM,IAAI,KAAK,CACb,0BAA0B,KAAK,kBAAkB,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAC1E,CAAC;IACJ,CAAC;IACD,OAAO,CAAc,CAAC;AACxB,CAAC;AAED,MAAM,UAAU,UAAU;IACxB,OAAO;QACL,YAAY,EAAE,OAAO,CAAC,GAAG,CAAC,mBAAmB;QAC7C,YAAY,EAAE,OAAO,CAAC,GAAG,CAAC,mBAAmB;QAC7C,iBAAiB,EAAE,OAAO,CAAC,GAAG,CAAC,yBAAyB;QACxD,mBAAmB,EAAE,OAAO,CAAC,GAAG,CAAC,2BAA2B;QAC5D,iBAAiB,EAAE,OAAO,CAAC,GAAG,CAAC,yBAAyB;QACxD,SAAS,EAAE,cAAc,CAAC,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC;QACpD,cAAc,EAAE,OAAO,CAAC,GAAG,CAAC,gBAAgB;QAC5C,kBAAkB,EAAE,OAAO,CAAC,GAAG,CAAC,oBAAoB;QACpD,eAAe,EAAE,OAAO,CAAC,GAAG,CAAC,iBAAiB,EAAE,KAAK,CAAC,GAAG,CAAC;QAC1D,sBAAsB,EAAE,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,yBAAyB,IAAI,GAAG,EAAE,EAAE,CAAC;QAClF,SAAS,EAAE,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,IAAI,MAAM,EAAE,EAAE,CAAC;QACzD,SAAS,EAAE,OAAO,CAAC,GAAG,CAAC,UAAU,IAAI,WAAW;QAChD,cAAc,EAAE,OAAO,CAAC,GAAG,CAAC,gBAAgB;QAC5C,yBAAyB,EAAE,OAAO,CAAC,GAAG,CAAC,2BAA2B,KAAK,MAAM;QAC7E,YAAY,EAAE,OAAO,CAAC,GAAG,CAAC,cAAc,IAAI,UAAU;QACtD,WAAW,EAAE,OAAO,CAAC,GAAG,CAAC,aAAa;QACtC,SAAS,EAAE,OAAO,CAAC,GAAG,CAAC,UAAU;QACjC,mBAAmB,EAAE,OAAO,CAAC,GAAG,CAAC,sBAAsB;QACvD,yBAAyB,EAAE,OAAO,CAAC,GAAG,CAAC,4BAA4B;QACnE,mBAAmB,EAAE,OAAO,CAAC,GAAG,CAAC,sBAAsB;QACvD,kBAAkB,EAAE,OAAO,CAAC,GAAG,CAAC,qBAAqB,IAAI,yBAAyB;QAClF,UAAU,EAAE,OAAO,CAAC,GAAG,CAAC,oBAAoB;QAC5C,gBAAgB,EAAE,OAAO,CAAC,GAAG,CAAC,kBAAkB;QAChD,WAAW,EAAE,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,aAAa,IAAI,IAAI,EAAE,EAAE,CAAC;QAC5D,QAAQ,EAAE,OAAO,CAAC,GAAG,CAAC,SAAS,IAAI,MAAM;QACzC,YAAY,EAAE,OAAO,CAAC,GAAG,CAAC,aAAa,IAAI,OAAO;KACnD,CAAC;AACJ,CAAC"}
package/dist/src/dns-resolver.d.ts CHANGED
@@ -13,9 +13,18 @@ export declare class DnsResolver {
13
13
  private readonly cache;
14
14
  /** Promises for in-flight lookups, keyed by hostname. */
15
15
  private readonly inflight;
16
- constructor(ttlSeconds?: number);
16
+ private readonly lookupTimeoutMs;
17
+ constructor(ttlSeconds?: number, lookupTimeoutMs?: number);
17
18
  resolve(target: string): Promise<string[]>;
18
19
  /** Perform the actual A + AAAA DNS queries in parallel. Never throws. */
19
20
  private _lookup;
21
+ /**
22
+ * Fallback to the operating system resolver (getaddrinfo). resolve4/6 query
23
+ * DNS servers directly and ignore the hosts file, VPN split-DNS and other
24
+ * OS-level name resolution that lab and internal targets often rely on.
25
+ * Never throws.
26
+ */
27
+ private _systemLookup;
28
+ private withTimeout;
20
29
  }
21
30
  //# sourceMappingURL=dns-resolver.d.ts.map
package/dist/src/dns-resolver.d.ts.map CHANGED
@@ -1 +1 @@
1
- {"version":3,"file":"dns-resolver.d.ts","sourceRoot":"","sources":["../../src/dns-resolver.ts"],"names":[],"mappings":"AAQA;;;;;;;;;GASG;AACH,qBAAa,WAAW;IACtB,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAS;IAC/B,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAiC;IACvD,yDAAyD;IACzD,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAwC;gBAErD,UAAU,GAAE,MAAW;IAI7B,OAAO,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IAoChD,yEAAyE;YAC3D,OAAO;CAkBtB"}
1
+ {"version":3,"file":"dns-resolver.d.ts","sourceRoot":"","sources":["../../src/dns-resolver.ts"],"names":[],"mappings":"AAQA;;;;;;;;;GASG;AACH,qBAAa,WAAW;IACtB,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAS;IAC/B,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAiC;IACvD,yDAAyD;IACzD,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAwC;IACjE,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAS;gBAE7B,UAAU,GAAE,MAAW,EAAE,eAAe,GAAE,MAAa;IAK7D,OAAO,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IA+ChD,yEAAyE;YAC3D,OAAO;IAuBrB;;;;;OAKG;YACW,aAAa;IAS3B,OAAO,CAAC,WAAW;CAUpB"}
package/dist/src/dns-resolver.js CHANGED
@@ -15,14 +15,26 @@ export class DnsResolver {
15
15
  cache = new Map();
16
16
  /** Promises for in-flight lookups, keyed by hostname. */
17
17
  inflight = new Map();
18
- constructor(ttlSeconds = 60) {
18
+ lookupTimeoutMs;
19
+ constructor(ttlSeconds = 60, lookupTimeoutMs = 1500) {
19
20
  this.ttlMs = ttlSeconds * 1000;
21
+ this.lookupTimeoutMs = lookupTimeoutMs;
20
22
  }
21
23
  async resolve(target) {
22
24
  // 1. Raw IP — return immediately, no lookup, no caching needed.
23
25
  if (isIP(target) !== 0) {
24
26
  return [target];
25
27
  }
28
+ // 2. CIDR notation (e.g. "10.0.0.0/24") — strip the prefix length and
29
+ // treat the host part as a raw IP so masscan/nmap range targets are
30
+ // passed through to the CIDR authorization check unchanged.
31
+ const slashIndex = target.indexOf("/");
32
+ if (slashIndex !== -1) {
33
+ const hostPart = target.slice(0, slashIndex);
34
+ if (isIP(hostPart) !== 0) {
35
+ return [target];
36
+ }
37
+ }
26
38
  // 2. Cache hit — return if still within TTL.
27
39
  const cached = this.cache.get(target);
28
40
  if (cached !== undefined && Date.now() < cached.expiresAt) {
@@ -52,8 +64,8 @@ export class DnsResolver {
52
64
  /** Perform the actual A + AAAA DNS queries in parallel. Never throws. */
53
65
  async _lookup(hostname) {
54
66
  const [v4Result, v6Result] = await Promise.allSettled([
55
- dns.resolve4(hostname),
56
- dns.resolve6(hostname),
67
+ this.withTimeout(dns.resolve4(hostname)),
68
+ this.withTimeout(dns.resolve6(hostname)),
57
69
  ]);
58
70
  const addresses = [];
59
71
  if (v4Result.status === "fulfilled") {
@@ -62,7 +74,33 @@ export class DnsResolver {
62
74
  if (v6Result.status === "fulfilled") {
63
75
  addresses.push(...v6Result.value);
64
76
  }
77
+ if (addresses.length === 0) {
78
+ addresses.push(...(await this._systemLookup(hostname)));
79
+ }
65
80
  return addresses;
66
81
  }
82
+ /**
83
+ * Fallback to the operating system resolver (getaddrinfo). resolve4/6 query
84
+ * DNS servers directly and ignore the hosts file, VPN split-DNS and other
85
+ * OS-level name resolution that lab and internal targets often rely on.
86
+ * Never throws.
87
+ */
88
+ async _systemLookup(hostname) {
89
+ try {
90
+ const results = await this.withTimeout(dns.lookup(hostname, { all: true }));
91
+ return [...new Set(results.map((r) => r.address))];
92
+ }
93
+ catch {
94
+ return [];
95
+ }
96
+ }
97
+ withTimeout(operation) {
98
+ if (this.lookupTimeoutMs <= 0)
99
+ return operation;
100
+ return new Promise((resolve, reject) => {
101
+ const timer = setTimeout(() => reject(new Error("DNS lookup timed out")), this.lookupTimeoutMs);
102
+ operation.then((value) => { clearTimeout(timer); resolve(value); }, (error) => { clearTimeout(timer); reject(error); });
103
+ });
104
+ }
67
105
  }
68
106
  //# sourceMappingURL=dns-resolver.js.map
package/dist/src/dns-resolver.js.map CHANGED
@@ -1 +1 @@
1
- {"version":3,"file":"dns-resolver.js","sourceRoot":"","sources":["../../src/dns-resolver.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,KAAK,CAAC;AAC3B,OAAO,GAAG,MAAM,cAAc,CAAC;AAO/B;;;;;;;;;GASG;AACH,MAAM,OAAO,WAAW;IACL,KAAK,CAAS;IACd,KAAK,GAAG,IAAI,GAAG,EAAsB,CAAC;IACvD,yDAAyD;IACxC,QAAQ,GAAG,IAAI,GAAG,EAA6B,CAAC;IAEjE,YAAY,aAAqB,EAAE;QACjC,IAAI,CAAC,KAAK,GAAG,UAAU,GAAG,IAAI,CAAC;IACjC,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,MAAc;QAC1B,gEAAgE;QAChE,IAAI,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;YACvB,OAAO,CAAC,MAAM,CAAC,CAAC;QAClB,CAAC;QAED,6CAA6C;QAC7C,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QACtC,IAAI,MAAM,KAAK,SAAS,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC,SAAS,EAAE,CAAC;YAC1D,OAAO,MAAM,CAAC,SAAS,CAAC;QAC1B,CAAC;QAED,yEAAyE;QACzE,0EAA0E;QAC1E,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAC3C,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YAC3B,OAAO,QAAQ,CAAC;QAClB,CAAC;QAED,wDAAwD;QACxD,MAAM,aAAa,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE;YAC5D,0EAA0E;YAC1E,IAAI,IAAI,CAAC,KAAK,GAAG,CAAC,EAAE,CAAC;gBACnB,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,EAAE;oBACrB,SAAS;oBACT,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,KAAK;iBACnC,CAAC,CAAC;YACL,CAAC;YACD,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;YAC7B,OAAO,SAAS,CAAC;QACnB,CAAC,CAAC,CAAC;QAEH,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;QACzC,OAAO,aAAa,CAAC;IACvB,CAAC;IAED,yEAAyE;IACjE,KAAK,CAAC,OAAO,CAAC,QAAgB;QACpC,MAAM,CAAC,QAAQ,EAAE,QAAQ,CAAC,GAAG,MAAM,OAAO,CAAC,UAAU,CAAC;YACpD,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC;YACtB,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC;SACvB,CAAC,CAAC;QAEH,MAAM,SAAS,GAAa,EAAE,CAAC;QAE/B,IAAI,QAAQ,CAAC,MAAM,KAAK,WAAW,EAAE,CAAC;YACpC,SAAS,CAAC,IAAI,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC;QACpC,CAAC;QAED,IAAI,QAAQ,CAAC,MAAM,KAAK,WAAW,EAAE,CAAC;YACpC,SAAS,CAAC,IAAI,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC;QACpC,CAAC;QAED,OAAO,SAAS,CAAC;IACnB,CAAC;CACF"}
1
+ {"version":3,"file":"dns-resolver.js","sourceRoot":"","sources":["../../src/dns-resolver.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,KAAK,CAAC;AAC3B,OAAO,GAAG,MAAM,cAAc,CAAC;AAO/B;;;;;;;;;GASG;AACH,MAAM,OAAO,WAAW;IACL,KAAK,CAAS;IACd,KAAK,GAAG,IAAI,GAAG,EAAsB,CAAC;IACvD,yDAAyD;IACxC,QAAQ,GAAG,IAAI,GAAG,EAA6B,CAAC;IAChD,eAAe,CAAS;IAEzC,YAAY,aAAqB,EAAE,EAAE,kBAA0B,IAAI;QACjE,IAAI,CAAC,KAAK,GAAG,UAAU,GAAG,IAAI,CAAC;QAC/B,IAAI,CAAC,eAAe,GAAG,eAAe,CAAC;IACzC,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,MAAc;QAC1B,gEAAgE;QAChE,IAAI,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;YACvB,OAAO,CAAC,MAAM,CAAC,CAAC;QAClB,CAAC;QAED,sEAAsE;QACtE,uEAAuE;QACvE,+DAA+D;QAC/D,MAAM,UAAU,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACvC,IAAI,UAAU,KAAK,CAAC,CAAC,EAAE,CAAC;YACtB,MAAM,QAAQ,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,UAAU,CAAC,CAAC;YAC7C,IAAI,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;gBACzB,OAAO,CAAC,MAAM,CAAC,CAAC;YAClB,CAAC;QACH,CAAC;QAED,6CAA6C;QAC7C,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QACtC,IAAI,MAAM,KAAK,SAAS,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC,SAAS,EAAE,CAAC;YAC1D,OAAO,MAAM,CAAC,SAAS,CAAC;QAC1B,CAAC;QAED,yEAAyE;QACzE,0EAA0E;QAC1E,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAC3C,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YAC3B,OAAO,QAAQ,CAAC;QAClB,CAAC;QAED,wDAAwD;QACxD,MAAM,aAAa,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE;YAC5D,0EAA0E;YAC1E,IAAI,IAAI,CAAC,KAAK,GAAG,CAAC,EAAE,CAAC;gBACnB,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,EAAE;oBACrB,SAAS;oBACT,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,KAAK;iBACnC,CAAC,CAAC;YACL,CAAC;YACD,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;YAC7B,OAAO,SAAS,CAAC;QACnB,CAAC,CAAC,CAAC;QAEH,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;QACzC,OAAO,aAAa,CAAC;IACvB,CAAC;IAED,yEAAyE;IACjE,KAAK,CAAC,OAAO,CAAC,QAAgB;QACpC,MAAM,CAAC,QAAQ,EAAE,QAAQ,CAAC,GAAG,MAAM,OAAO,CAAC,UAAU,CAAC;YACpD,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;YACxC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;SACzC,CAAC,CAAC;QAEH,MAAM,SAAS,GAAa,EAAE,CAAC;QAE/B,IAAI,QAAQ,CAAC,MAAM,KAAK,WAAW,EAAE,CAAC;YACpC,SAAS,CAAC,IAAI,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC;QACpC,CAAC;QAED,IAAI,QAAQ,CAAC,MAAM,KAAK,WAAW,EAAE,CAAC;YACpC,SAAS,CAAC,IAAI,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC;QACpC,CAAC;QAED,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC3B,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,IAAI,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;QAC1D,CAAC;QAED,OAAO,SAAS,CAAC;IACnB,CAAC;IAED;;;;;OAKG;IACK,KAAK,CAAC,aAAa,CAAC,QAAgB;QAC1C,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;YAC5E,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;QACrD,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,EAAE,CAAC;QACZ,CAAC;IACH,CAAC;IAEO,WAAW,CAAI,SAAqB;QAC1C,IAAI,IAAI,CAAC,eAAe,IAAI,CAAC;YAAE,OAAO,SAAS,CAAC;QAChD,OAAO,IAAI,OAAO,CAAI,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YACxC,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,sBAAsB,CAAC,CAAC,EAAE,IAAI,CAAC,eAAe,CAAC,CAAC;YAChG,SAAS,CAAC,IAAI,CACZ,CAAC,KAAK,EAAE,EAAE,GAAG,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EACnD,CAAC,KAAK,EAAE,EAAE,GAAG,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CACnD,CAAC;QACJ,CAAC,CAAC,CAAC;IACL,CAAC;CACF"}
package/dist/src/extractor.d.ts CHANGED
@@ -19,6 +19,18 @@ export interface ExtractionResult {
19
19
  * fallback parameter list was used instead. */
20
20
  usedFallback: boolean;
21
21
  }
22
+ /**
23
+ * Extract EVERY target from a tool call's parameters.
24
+ *
25
+ * Unlike extractTarget(), which returns only the first candidate, this walks
26
+ * all target-like parameters (tool-specific, fallback and extra names, matched
27
+ * case-insensitively), every element of array values, nested option objects
28
+ * (e.g. metasploit `options: {RHOSTS: ...}`) and free-form command strings.
29
+ * The validator requires ALL returned targets to be in scope.
30
+ *
31
+ * Returns an empty array when the call has no network target.
32
+ */
33
+ export declare function extractTargets(toolName: string, params: Record<string, unknown>): ExtractionResult[];
22
34
  /**
23
35
  * Extract the primary target from a tool call's parameters.
24
36
  *