@integsec/agentic-pentest-proxy 0.2.5 → 0.2.7

package/dist/src/builder/web/api.js

@@ -0,0 +1,40 @@
+import fs from "fs";
+import path from "path";
+import { ScopeManifestSchema } from "../../manifest-schema.js";
+import { engagementFileStem } from "../../safe-filename.js";
+export function handleGetTemplate(template) {
+    return {
+        status: 200,
+        body: JSON.stringify(template ?? {}),
+        contentType: "application/json",
+    };
+}
+export function handlePostSubmit(rawBody, outputDir) {
+    let data;
+    try {
+        data = JSON.parse(rawBody);
+    }
+    catch {
+        return { status: 400, body: JSON.stringify({ success: false, error: "Invalid JSON" }), contentType: "application/json" };
+    }
+    const parseResult = ScopeManifestSchema.safeParse(data);
+    if (!parseResult.success) {
+        return {
+            status: 400,
+            body: JSON.stringify({
+                success: false,
+                error: "Schema validation failed",
+                details: parseResult.error.issues.map((i) => i.message),
+            }),
+            contentType: "application/json",
+        };
+    }
+    if (!fs.existsSync(outputDir)) {
+        fs.mkdirSync(outputDir, { recursive: true });
+    }
+    const filename = `${engagementFileStem(parseResult.data.engagement_id)}-${Date.now()}.pending.json`;
+    const filePath = path.join(outputDir, filename);
+    fs.writeFileSync(filePath, JSON.stringify(parseResult.data, null, 2) + "\n", "utf-8");
+    return { status: 200, body: JSON.stringify({ success: true, file: filename }), contentType: "application/json" };
+}
+//# sourceMappingURL=api.js.map

package/dist/src/builder/web/api.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"api.js","sourceRoot":"","sources":["../../../../src/builder/web/api.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,IAAI,CAAC;AACpB,OAAO,IAAI,MAAM,MAAM,CAAC;AACxB,OAAO,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAC;AAE/D,OAAO,EAAE,kBAAkB,EAAE,MAAM,wBAAwB,CAAC;AAQ5D,MAAM,UAAU,iBAAiB,CAAC,QAA4C;IAC5E,OAAO;QACL,MAAM,EAAE,GAAG;QACX,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,QAAQ,IAAI,EAAE,CAAC;QACpC,WAAW,EAAE,kBAAkB;KAChC,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,OAAe,EAAE,SAAiB;IACjE,IAAI,IAAa,CAAC;IAClB,IAAI,CAAC;QAAC,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAAC,CAAC;IACnC,MAAM,CAAC;QACL,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC,EAAE,WAAW,EAAE,kBAAkB,EAAE,CAAC;IAC3H,CAAC;IAED,MAAM,WAAW,GAAG,mBAAmB,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;IACxD,IAAI,CAAC,WAAW,CAAC,OAAO,EAAE,CAAC;QACzB,OAAO;YACL,MAAM,EAAE,GAAG;YACX,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;gBACnB,OAAO,EAAE,KAAK;gBACd,KAAK,EAAE,0BAA0B;gBACjC,OAAO,EAAE,WAAW,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC;aACxD,CAAC;YACF,WAAW,EAAE,kBAAkB;SAChC,CAAC;IACJ,CAAC;IAED,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;QAAC,EAAE,CAAC,SAAS,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAAC,CAAC;IAEhF,MAAM,QAAQ,GAAG,GAAG,kBAAkB,CAAC,WAAW,CAAC,IAAI,CAAC,aAAa,CAAC,IAAI,IAAI,CAAC,GAAG,EAAE,eAAe,CAAC;IACpG,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;IAChD,EAAE,CAAC,aAAa,CAAC,QAAQ,EAAE,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,EAAE,OAAO,CAAC,CAAC;IAEtF,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,EAAE,WAAW,EAAE,kBAAkB,EAAE,CAAC;AACnH,CAAC"}

package/dist/src/builder/web/client-form.html

@@ -0,0 +1,222 @@
+<!DOCTYPE html>
+<html lang="en">
+<head>
+  <meta charset="utf-8">
+  <meta name="viewport" content="width=device-width, initial-scale=1">
+  <title>IntegSec — Scope Definition</title>
+  <style>
+    :root {
+      --bg: #0f1117;
+      --surface: #1a1d27;
+      --border: #2a2d3a;
+      --text: #e1e4ed;
+      --text-dim: #8b8fa3;
+      --accent: #6366f1;
+      --accent-hover: #818cf8;
+      --success: #10b981;
+      --error: #ef4444;
+      --warning: #f59e0b;
+    }
+    * { margin: 0; padding: 0; box-sizing: border-box; }
+    body {
+      font-family: -apple-system, BlinkMacSystemFont, "Segoe UI", Roboto, sans-serif;
+      background: var(--bg);
+      color: var(--text);
+      line-height: 1.6;
+      padding: 2rem;
+      max-width: 800px;
+      margin: 0 auto;
+    }
+    h1 { font-size: 1.5rem; margin-bottom: 0.25rem; }
+    .subtitle { color: var(--text-dim); margin-bottom: 2rem; }
+    .section {
+      background: var(--surface);
+      border: 1px solid var(--border);
+      border-radius: 8px;
+      padding: 1.5rem;
+      margin-bottom: 1.5rem;
+    }
+    .section h2 { font-size: 1.1rem; margin-bottom: 1rem; display: flex; align-items: center; gap: 0.5rem; }
+    label { display: block; font-size: 0.875rem; color: var(--text-dim); margin-bottom: 0.25rem; }
+    .tooltip { font-size: 0.75rem; color: var(--text-dim); margin-bottom: 0.5rem; font-style: italic; }
+    input, textarea {
+      width: 100%;
+      padding: 0.5rem 0.75rem;
+      background: var(--bg);
+      border: 1px solid var(--border);
+      border-radius: 4px;
+      color: var(--text);
+      font-family: "SF Mono", "Fira Code", monospace;
+      font-size: 0.875rem;
+      margin-bottom: 1rem;
+    }
+    input:focus, textarea:focus { outline: none; border-color: var(--accent); }
+    input:disabled { opacity: 0.5; cursor: not-allowed; }
+    input.valid { border-color: var(--success); }
+    input.invalid { border-color: var(--error); }
+    textarea { min-height: 80px; resize: vertical; }
+    button {
+      background: var(--accent);
+      color: white;
+      border: none;
+      padding: 0.75rem 2rem;
+      border-radius: 6px;
+      font-size: 1rem;
+      cursor: pointer;
+      display: block;
+      width: 100%;
+      margin-top: 1rem;
+    }
+    button:hover { background: var(--accent-hover); }
+    button:disabled { opacity: 0.5; cursor: not-allowed; }
+    .result { padding: 1rem; border-radius: 6px; margin-top: 1rem; text-align: center; }
+    .result.success { background: rgba(16, 185, 129, 0.1); border: 1px solid var(--success); color: var(--success); }
+    .result.error { background: rgba(239, 68, 68, 0.1); border: 1px solid var(--error); color: var(--error); }
+    .brand { display: flex; align-items: center; gap: 0.5rem; margin-bottom: 1.5rem; padding-bottom: 1rem; border-bottom: 1px solid var(--border); }
+    .brand-logo { font-weight: 700; font-size: 1.1rem; color: var(--accent); }
+  </style>
+</head>
+<body>
+  <div class="brand">
+    <span class="brand-logo">IntegSec</span>
+    <span class="subtitle" style="margin: 0">Scope Definition Form</span>
+  </div>
+
+  <form id="scopeForm" onsubmit="return submitForm(event)">
+    <div class="section">
+      <h2>Engagement Info</h2>
+      <label for="engagement_id">Engagement ID</label>
+      <input type="text" id="engagement_id" placeholder="ENG-2026-0001">
+      <label for="client">Client Organization</label>
+      <input type="text" id="client" placeholder="Acme Corp">
+      <label for="operator">Operator Contact</label>
+      <input type="text" id="operator" placeholder="operator@integsec.com">
+    </div>
+
+    <div class="section">
+      <h2>Engagement Window</h2>
+      <label for="window_start">Start (ISO 8601)</label>
+      <div class="tooltip">Example: 2026-04-01T08:00:00Z</div>
+      <input type="text" id="window_start" placeholder="2026-04-01T08:00:00Z">
+      <label for="window_end">End (ISO 8601)</label>
+      <input type="text" id="window_end" placeholder="2026-04-15T17:00:00Z">
+    </div>
+
+    <div class="section">
+      <h2>Authorized Targets</h2>
+      <label for="domains">Domains</label>
+      <div class="tooltip">One per line. Wildcards OK: *.acme.com matches app.acme.com but not acme.com</div>
+      <textarea id="domains" placeholder="*.acme.com&#10;acme-staging.example.com"></textarea>
+      <label for="ip_ranges">IP Ranges (CIDR)</label>
+      <div class="tooltip">CIDR notation. Example: 10.10.10.0/24 covers 10.10.10.0 through 10.10.10.255</div>
+      <textarea id="ip_ranges" placeholder="10.10.10.0/24&#10;203.0.113.0/28"></textarea>
+      <label for="urls">URLs (optional)</label>
+      <div class="tooltip">Reference URLs for the engagement. One per line.</div>
+      <textarea id="urls" placeholder="https://app.acme.com&#10;https://api.acme.com"></textarea>
+      <label for="cloud_accounts">Cloud Accounts (optional)</label>
+      <div class="tooltip">Format: provider:account-id. Example: aws:123456789012</div>
+      <textarea id="cloud_accounts" placeholder="aws:123456789012"></textarea>
+    </div>
+
+    <div class="section">
+      <h2>Exclusions</h2>
+      <label for="excluded_targets">Excluded Targets</label>
+      <div class="tooltip">Targets within scope that must NOT be tested. One per line.</div>
+      <textarea id="excluded_targets" placeholder="hr.acme.com&#10;203.0.113.5"></textarea>
+    </div>
+
+    <div class="section">
+      <h2>Techniques</h2>
+      <label for="authorized_techniques">Authorized Techniques</label>
+      <div class="tooltip">Comma-separated. Categories: recon, web_app, exploitation, cloud_audit. Tools in a category not listed here are blocked; leave empty for no restriction.</div>
+      <input type="text" id="authorized_techniques" placeholder="recon, web_app">
+      <label for="excluded_techniques">Excluded Techniques</label>
+      <div class="tooltip">Comma-separated. Usually: dos, destructive, social_engineering</div>
+      <input type="text" id="excluded_techniques" placeholder="dos, destructive, social_engineering">
+    </div>
+
+    <button type="submit" id="submitBtn">Submit Scope Definition</button>
+    <div id="result"></div>
+  </form>
+
+  <script>
+    fetch("/template")
+      .then((r) => r.json())
+      .then((tpl) => {
+        const fieldMap = { engagement_id: "engagement_id", client: "client", operator: "operator" };
+        for (const [key, id] of Object.entries(fieldMap)) {
+          if (tpl[key]) { const el = document.getElementById(id); el.value = tpl[key]; el.disabled = true; }
+        }
+        if (tpl.engagement_window) {
+          if (tpl.engagement_window.start) { const el = document.getElementById("window_start"); el.value = tpl.engagement_window.start; el.disabled = true; }
+          if (tpl.engagement_window.end) { const el = document.getElementById("window_end"); el.value = tpl.engagement_window.end; el.disabled = true; }
+        }
+        if (tpl.excluded_techniques) { const el = document.getElementById("excluded_techniques"); el.value = tpl.excluded_techniques.join(", "); el.disabled = true; }
+      })
+      .catch(() => {});
+
+    document.querySelectorAll("input[type=text]").forEach((input) => {
+      input.addEventListener("blur", () => {
+        if (input.disabled) return;
+        if (input.value.trim()) { input.classList.add("valid"); input.classList.remove("invalid"); }
+        else if (["engagement_id", "client", "operator"].includes(input.id)) { input.classList.add("invalid"); input.classList.remove("valid"); }
+      });
+    });
+
+    function parseLines(id) {
+      return document.getElementById(id).value.split("\n").map((s) => s.trim()).filter(Boolean);
+    }
+    function parseComma(id) {
+      return document.getElementById(id).value.split(",").map((s) => s.trim()).filter(Boolean);
+    }
+    function val(id) { return document.getElementById(id).value.trim(); }
+
+    async function submitForm(e) {
+      e.preventDefault();
+      const btn = document.getElementById("submitBtn");
+      const result = document.getElementById("result");
+      btn.disabled = true;
+      btn.textContent = "Submitting...";
+
+      const manifest = {
+        engagement_id: val("engagement_id"),
+        client: val("client"),
+        operator: val("operator"),
+        authorized_targets: {
+          ip_ranges: parseLines("ip_ranges"),
+          domains: parseLines("domains"),
+          urls: parseLines("urls"),
+          cloud_accounts: parseLines("cloud_accounts"),
+        },
+        excluded_targets: parseLines("excluded_targets"),
+        authorized_techniques: parseComma("authorized_techniques"),
+        excluded_techniques: parseComma("excluded_techniques"),
+        engagement_window: { start: val("window_start"), end: val("window_end") },
+      };
+
+      try {
+        const res = await fetch("/submit", {
+          method: "POST",
+          headers: { "Content-Type": "application/json" },
+          body: JSON.stringify(manifest),
+        });
+        const data = await res.json();
+        if (data.success) {
+          result.className = "result success";
+          result.textContent = "Scope definition submitted successfully. Your operator will review it.";
+        } else {
+          result.className = "result error";
+          result.textContent = "Validation failed: " + (data.details?.join(", ") || data.error);
+        }
+      } catch (err) {
+        result.className = "result error";
+        result.textContent = "Network error: " + err.message;
+      }
+
+      btn.disabled = false;
+      btn.textContent = "Submit Scope Definition";
+      return false;
+    }
+  </script>
+</body>
+</html>

package/dist/src/builder/web/server.d.ts

@@ -0,0 +1,14 @@
+import http from "http";
+import https from "https";
+import type { ScopeManifest } from "../../types.js";
+export interface ServeOptions {
+    port: number;
+    host: string;
+    template?: Partial<ScopeManifest>;
+    outputDir: string;
+    tlsCert?: string;
+    tlsKey?: string;
+    timeoutMinutes: number;
+}
+export declare function startServer(options: ServeOptions): http.Server | https.Server;
+//# sourceMappingURL=server.d.ts.map

package/dist/src/builder/web/server.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../../../../src/builder/web/server.ts"],"names":[],"mappings":"AAAA,OAAO,IAAI,MAAM,MAAM,CAAC;AACxB,OAAO,KAAK,MAAM,OAAO,CAAC;AAI1B,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAGpD,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,CAAC,EAAE,OAAO,CAAC,aAAa,CAAC,CAAC;IAClC,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,cAAc,EAAE,MAAM,CAAC;CACxB;AAED,wBAAgB,WAAW,CAAC,OAAO,EAAE,YAAY,GAAG,IAAI,CAAC,MAAM,GAAG,KAAK,CAAC,MAAM,CAmF7E"}

package/dist/src/builder/web/server.js

@@ -0,0 +1,85 @@
+import http from "http";
+import https from "https";
+import fs from "fs";
+import path from "path";
+import { fileURLToPath } from "url";
+import { handleGetTemplate, handlePostSubmit } from "./api.js";
+export function startServer(options) {
+    const { port, host, template, outputDir, tlsCert, tlsKey, timeoutMinutes } = options;
+    const isLocalhost = host === "127.0.0.1" || host === "localhost" || host === "::1";
+    if (!isLocalhost && (!tlsCert || !tlsKey)) {
+        console.error("Refusing to serve client intake form over plaintext on a non-localhost interface. " +
+            "Provide --tls-cert and --tls-key.");
+        process.exit(1);
+    }
+    const thisDir = path.dirname(fileURLToPath(import.meta.url));
+    const formPath = path.join(thisDir, "client-form.html");
+    const formHtml = fs.existsSync(formPath) ? fs.readFileSync(formPath, "utf-8") : "<h1>Form not found</h1>";
+    const handler = (req, res) => {
+        res.setHeader("Access-Control-Allow-Origin", "*");
+        res.setHeader("Access-Control-Allow-Methods", "GET, POST, OPTIONS");
+        res.setHeader("Access-Control-Allow-Headers", "Content-Type");
+        if (req.method === "OPTIONS") {
+            res.writeHead(204);
+            res.end();
+            return;
+        }
+        if (req.method === "GET" && (req.url === "/" || req.url === "")) {
+            res.writeHead(200, { "Content-Type": "text/html; charset=utf-8" });
+            res.end(formHtml);
+            return;
+        }
+        if (req.method === "GET" && req.url === "/template") {
+            const result = handleGetTemplate(template);
+            res.writeHead(result.status, { "Content-Type": result.contentType });
+            res.end(result.body);
+            return;
+        }
+        if (req.method === "POST" && req.url === "/submit") {
+            let body = "";
+            req.on("data", (chunk) => { body += chunk; });
+            req.on("end", () => {
+                const result = handlePostSubmit(body, outputDir);
+                res.writeHead(result.status, { "Content-Type": result.contentType });
+                res.end(result.body);
+                if (result.status === 200) {
+                    console.log(`\n✓ Submission received and saved to ${outputDir}`);
+                }
+            });
+            return;
+        }
+        res.writeHead(404, { "Content-Type": "application/json" });
+        res.end(JSON.stringify({ error: "Not found" }));
+    };
+    let server;
+    if (tlsCert && tlsKey) {
+        const cert = fs.readFileSync(tlsCert, "utf-8");
+        const key = fs.readFileSync(tlsKey, "utf-8");
+        server = https.createServer({ cert, key }, handler);
+    }
+    else {
+        server = http.createServer(handler);
+    }
+    let timeout;
+    const resetTimeout = () => {
+        if (timeout)
+            clearTimeout(timeout);
+        timeout = setTimeout(() => {
+            console.log(`\nServer auto-shutdown after ${timeoutMinutes} minutes of inactivity.`);
+            server.close();
+            process.exit(0);
+        }, timeoutMinutes * 60_000);
+    };
+    server.on("request", resetTimeout);
+    server.listen(port, host, () => {
+        const protocol = tlsCert ? "https" : "http";
+        const displayHost = host === "0.0.0.0" ? "localhost" : host;
+        console.log(`\n🔒 Scope Manifest — Client Intake Form`);
+        console.log(`   ${protocol}://${displayHost}:${port}`);
+        console.log(`   Output: ${outputDir}`);
+        console.log(`   Auto-shutdown: ${timeoutMinutes} minutes\n`);
+        resetTimeout();
+    });
+    return server;
+}
+//# sourceMappingURL=server.js.map

package/dist/src/builder/web/server.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"server.js","sourceRoot":"","sources":["../../../../src/builder/web/server.ts"],"names":[],"mappings":"AAAA,OAAO,IAAI,MAAM,MAAM,CAAC;AACxB,OAAO,KAAK,MAAM,OAAO,CAAC;AAC1B,OAAO,EAAE,MAAM,IAAI,CAAC;AACpB,OAAO,IAAI,MAAM,MAAM,CAAC;AACxB,OAAO,EAAE,aAAa,EAAE,MAAM,KAAK,CAAC;AAEpC,OAAO,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,MAAM,UAAU,CAAC;AAY/D,MAAM,UAAU,WAAW,CAAC,OAAqB;IAC/C,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,EAAE,cAAc,EAAE,GAAG,OAAO,CAAC;IAErF,MAAM,WAAW,GAAG,IAAI,KAAK,WAAW,IAAI,IAAI,KAAK,WAAW,IAAI,IAAI,KAAK,KAAK,CAAC;IACnF,IAAI,CAAC,WAAW,IAAI,CAAC,CAAC,OAAO,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;QAC1C,OAAO,CAAC,KAAK,CACX,oFAAoF;YACpF,mCAAmC,CACpC,CAAC;QACF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;IAC7D,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,kBAAkB,CAAC,CAAC;IACxD,MAAM,QAAQ,GAAG,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,YAAY,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,yBAAyB,CAAC;IAE1G,MAAM,OAAO,GAAG,CAAC,GAAyB,EAAE,GAAwB,EAAE,EAAE;QACtE,GAAG,CAAC,SAAS,CAAC,6BAA6B,EAAE,GAAG,CAAC,CAAC;QAClD,GAAG,CAAC,SAAS,CAAC,8BAA8B,EAAE,oBAAoB,CAAC,CAAC;QACpE,GAAG,CAAC,SAAS,CAAC,8BAA8B,EAAE,cAAc,CAAC,CAAC;QAE9D,IAAI,GAAG,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YAAC,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;YAAC,GAAG,CAAC,GAAG,EAAE,CAAC;YAAC,OAAO;QAAC,CAAC;QAExE,IAAI,GAAG,CAAC,MAAM,KAAK,KAAK,IAAI,CAAC,GAAG,CAAC,GAAG,KAAK,GAAG,IAAI,GAAG,CAAC,GAAG,KAAK,EAAE,CAAC,EAAE,CAAC;YAChE,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,0BAA0B,EAAE,CAAC,CAAC;YACnE,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;YAClB,OAAO;QACT,CAAC;QAED,IAAI,GAAG,CAAC,MAAM,KAAK,KAAK,IAAI,GAAG,CAAC,GAAG,KAAK,WAAW,EAAE,CAAC;YACpD,MAAM,MAAM,GAAG,iBAAiB,CAAC,QAAQ,CAAC,CAAC;YAC3C,GAAG,CAAC,SAAS,CAAC,MAAM,CAAC,MAAM,EAAE,EAAE,cAAc,EAAE,MAAM,CAAC,WAAW,EAAE,CAAC,CAAC;YACrE,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;YACrB,OAAO;QACT,CAAC;QAED,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM,IAAI,GAAG,CAAC,GAAG,KAAK,SAAS,EAAE,CAAC;YACnD,IAAI,IAAI,GAAG,EAAE,CAAC;YACd,GAAG,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE,EAAE,GAAG,IAAI,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;YAC9C,GAAG,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE;gBACjB,MAAM,MAAM,GAAG,gBAAgB,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;gBACjD,GAAG,CAAC,SAAS,CAAC,MAAM,CAAC,MAAM,EAAE,EAAE,cAAc,EAAE,MAAM,CAAC,WAAW,EAAE,CAAC,CAAC;gBACrE,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;gBACrB,IAAI,MAAM,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;oBAAC,OAAO,CAAC,GAAG,CAAC,wCAAwC,SAAS,EAAE,CAAC,CAAC;gBAAC,CAAC;YAClG,CAAC,CAAC,CAAC;YACH,OAAO;QACT,CAAC;QAED,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC;QAC3D,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC;IAClD,CAAC,CAAC;IAEF,IAAI,MAAkC,CAAC;IACvC,IAAI,OAAO,IAAI,MAAM,EAAE,CAAC;QACtB,MAAM,IAAI,GAAG,EAAE,CAAC,YAAY,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QAC/C,MAAM,GAAG,GAAG,EAAE,CAAC,YAAY,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QAC7C,MAAM,GAAG,KAAK,CAAC,YAAY,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,EAAE,OAAO,CAAC,CAAC;IACtD,CAAC;SAAM,CAAC;QACN,MAAM,GAAG,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC;IACtC,CAAC;IAED,IAAI,OAAsC,CAAC;IAC3C,MAAM,YAAY,GAAG,GAAG,EAAE;QACxB,IAAI,OAAO;YAAE,YAAY,CAAC,OAAO,CAAC,CAAC;QACnC,OAAO,GAAG,UAAU,CAAC,GAAG,EAAE;YACxB,OAAO,CAAC,GAAG,CAAC,gCAAgC,cAAc,yBAAyB,CAAC,CAAC;YACrF,MAAM,CAAC,KAAK,EAAE,CAAC;YACf,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC,EAAE,cAAc,GAAG,MAAM,CAAC,CAAC;IAC9B,CAAC,CAAC;IAEF,MAAM,CAAC,EAAE,CAAC,SAAS,EAAE,YAAY,CAAC,CAAC;IACnC,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,EAAE,GAAG,EAAE;QAC7B,MAAM,QAAQ,GAAG,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC;QAC5C,MAAM,WAAW,GAAG,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC;QAC5D,OAAO,CAAC,GAAG,CAAC,0CAA0C,CAAC,CAAC;QACxD,OAAO,CAAC,GAAG,CAAC,MAAM,QAAQ,MAAM,WAAW,IAAI,IAAI,EAAE,CAAC,CAAC;QACvD,OAAO,CAAC,GAAG,CAAC,cAAc,SAAS,EAAE,CAAC,CAAC;QACvC,OAAO,CAAC,GAAG,CAAC,qBAAqB,cAAc,YAAY,CAAC,CAAC;QAC7D,YAAY,EAAE,CAAC;IACjB,CAAC,CAAC,CAAC;IAEH,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/src/builder/wizard.d.ts

@@ -0,0 +1,9 @@
+import React from "react";
+import type { ScopeManifest } from "../types.js";
+interface Props {
+    initial?: Partial<ScopeManifest>;
+    onFinish: (manifest: ScopeManifest) => void;
+}
+export declare function Wizard({ initial, onFinish }: Props): React.ReactElement;
+export {};
+//# sourceMappingURL=wizard.d.ts.map

package/dist/src/builder/wizard.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"wizard.d.ts","sourceRoot":"","sources":["../../../src/builder/wizard.tsx"],"names":[],"mappings":"AACA,OAAO,KAAmB,MAAM,OAAO,CAAC;AAExC,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAYjD,UAAU,KAAK;IACb,OAAO,CAAC,EAAE,OAAO,CAAC,aAAa,CAAC,CAAC;IACjC,QAAQ,EAAE,CAAC,QAAQ,EAAE,aAAa,KAAK,IAAI,CAAC;CAC7C;AAkCD,wBAAgB,MAAM,CAAC,EAAE,OAAO,EAAE,QAAQ,EAAE,EAAE,KAAK,GAAG,KAAK,CAAC,YAAY,CAqFvE"}

package/dist/src/builder/wizard.js

@@ -0,0 +1,49 @@
+import { jsxs as _jsxs, jsx as _jsx } from "react/jsx-runtime";
+// src/builder/wizard.tsx
+import { useState } from "react";
+import { Box, Text } from "ink";
+import { EngagementInfoStep } from "./steps/engagement-info.js";
+import { EngagementWindowStep } from "./steps/engagement-window.js";
+import { DomainsStep } from "./steps/domains.js";
+import { IpRangesStep } from "./steps/ip-ranges.js";
+import { UrlsAndCloudStep } from "./steps/urls-and-cloud.js";
+import { ExclusionsStep } from "./steps/exclusions.js";
+import { TechniquesStep } from "./steps/techniques.js";
+import { ReviewStep } from "./steps/review.js";
+function buildManifest(state) {
+    return {
+        engagement_id: state.engagement_id,
+        client: state.client,
+        operator: state.operator,
+        authorized_targets: {
+            ip_ranges: state.ip_ranges,
+            domains: state.domains,
+            urls: state.urls,
+            cloud_accounts: state.cloud_accounts,
+        },
+        excluded_targets: state.excluded_targets,
+        authorized_techniques: state.authorized_techniques,
+        excluded_techniques: state.excluded_techniques,
+        engagement_window: state.engagement_window,
+    };
+}
+export function Wizard({ initial, onFinish }) {
+    const [step, setStep] = useState(1);
+    const [state, setState] = useState({
+        engagement_id: initial?.engagement_id ?? "",
+        client: initial?.client ?? "",
+        operator: initial?.operator ?? "",
+        engagement_window: initial?.engagement_window ?? { start: "", end: "" },
+        domains: initial?.authorized_targets?.domains ?? [],
+        ip_ranges: initial?.authorized_targets?.ip_ranges ?? [],
+        urls: initial?.authorized_targets?.urls ?? [],
+        cloud_accounts: initial?.authorized_targets?.cloud_accounts ?? [],
+        excluded_targets: initial?.excluded_targets ?? [],
+        authorized_techniques: initial?.authorized_techniques ?? [],
+        excluded_techniques: initial?.excluded_techniques ?? [],
+    });
+    const goBack = () => setStep((s) => Math.max(1, s - 1));
+    const goNext = () => setStep((s) => Math.min(8, s + 1));
+    return (_jsxs(Box, { flexDirection: "column", children: [_jsx(Box, { marginBottom: 1, children: _jsxs(Text, { dimColor: true, children: ["\u2500\u2500\u2500 Scope Manifest Builder \u2500\u2500\u2500 Step ", step, "/8 \u2500\u2500\u2500"] }) }), step === 1 && (_jsx(EngagementInfoStep, { initial: { engagement_id: state.engagement_id, client: state.client, operator: state.operator }, onComplete: (data) => { setState((s) => ({ ...s, ...data })); goNext(); } })), step === 2 && (_jsx(EngagementWindowStep, { initial: state.engagement_window, onComplete: (data) => { setState((s) => ({ ...s, engagement_window: data })); goNext(); }, onBack: goBack })), step === 3 && (_jsx(DomainsStep, { initial: state.domains, authorizedIpRanges: state.ip_ranges, onComplete: (domains) => { setState((s) => ({ ...s, domains })); goNext(); }, onBack: goBack })), step === 4 && (_jsx(IpRangesStep, { initial: state.ip_ranges, onComplete: (ranges) => { setState((s) => ({ ...s, ip_ranges: ranges })); goNext(); }, onBack: goBack })), step === 5 && (_jsx(UrlsAndCloudStep, { initial: { urls: state.urls, cloud_accounts: state.cloud_accounts }, onComplete: (data) => { setState((s) => ({ ...s, urls: data.urls, cloud_accounts: data.cloud_accounts })); goNext(); }, onBack: goBack })), step === 6 && (_jsx(ExclusionsStep, { initial: state.excluded_targets, authorized: { ip_ranges: state.ip_ranges, domains: state.domains }, onComplete: (excluded) => { setState((s) => ({ ...s, excluded_targets: excluded })); goNext(); }, onBack: goBack })), step === 7 && (_jsx(TechniquesStep, { initialAuthorized: state.authorized_techniques, initialExcluded: state.excluded_techniques, onComplete: (data) => { setState((s) => ({ ...s, authorized_techniques: data.authorized, excluded_techniques: data.excluded })); goNext(); }, onBack: goBack })), step === 8 && (_jsx(ReviewStep, { manifest: buildManifest(state), onConfirm: () => onFinish(buildManifest(state)), onBack: goBack }))] }));
+}
+//# sourceMappingURL=wizard.js.map

package/dist/src/builder/wizard.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"wizard.js","sourceRoot":"","sources":["../../../src/builder/wizard.tsx"],"names":[],"mappings":";AAAA,yBAAyB;AACzB,OAAc,EAAE,QAAQ,EAAE,MAAM,OAAO,CAAC;AACxC,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,MAAM,KAAK,CAAC;AAEhC,OAAO,EAAE,kBAAkB,EAAE,MAAM,4BAA4B,CAAC;AAChE,OAAO,EAAE,oBAAoB,EAAE,MAAM,8BAA8B,CAAC;AACpE,OAAO,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AACjD,OAAO,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AACpD,OAAO,EAAE,gBAAgB,EAAE,MAAM,2BAA2B,CAAC;AAC7D,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AACvD,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AACvD,OAAO,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAuB/C,SAAS,aAAa,CAAC,KAAkB;IACvC,OAAO;QACL,aAAa,EAAE,KAAK,CAAC,aAAa;QAClC,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,kBAAkB,EAAE;YAClB,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,cAAc,EAAE,KAAK,CAAC,cAAc;SACrC;QACD,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;QACxC,qBAAqB,EAAE,KAAK,CAAC,qBAAqB;QAClD,mBAAmB,EAAE,KAAK,CAAC,mBAAmB;QAC9C,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;KAC3C,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,MAAM,CAAC,EAAE,OAAO,EAAE,QAAQ,EAAS;IACjD,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,GAAG,QAAQ,CAAO,CAAC,CAAC,CAAC;IAC1C,MAAM,CAAC,KAAK,EAAE,QAAQ,CAAC,GAAG,QAAQ,CAAc;QAC9C,aAAa,EAAE,OAAO,EAAE,aAAa,IAAI,EAAE;QAC3C,MAAM,EAAE,OAAO,EAAE,MAAM,IAAI,EAAE;QAC7B,QAAQ,EAAE,OAAO,EAAE,QAAQ,IAAI,EAAE;QACjC,iBAAiB,EAAE,OAAO,EAAE,iBAAiB,IAAI,EAAE,KAAK,EAAE,EAAE,EAAE,GAAG,EAAE,EAAE,EAAE;QACvE,OAAO,EAAE,OAAO,EAAE,kBAAkB,EAAE,OAAO,IAAI,EAAE;QACnD,SAAS,EAAE,OAAO,EAAE,kBAAkB,EAAE,SAAS,IAAI,EAAE;QACvD,IAAI,EAAE,OAAO,EAAE,kBAAkB,EAAE,IAAI,IAAI,EAAE;QAC7C,cAAc,EAAE,OAAO,EAAE,kBAAkB,EAAE,cAAc,IAAI,EAAE;QACjE,gBAAgB,EAAE,OAAO,EAAE,gBAAgB,IAAI,EAAE;QACjD,qBAAqB,EAAE,OAAO,EAAE,qBAAqB,IAAI,EAAE;QAC3D,mBAAmB,EAAE,OAAO,EAAE,mBAAmB,IAAI,EAAE;KACxD,CAAC,CAAC;IAEH,MAAM,MAAM,GAAG,GAAG,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,CAAS,CAAC,CAAC;IAChE,MAAM,MAAM,GAAG,GAAG,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,CAAS,CAAC,CAAC;IAEhE,OAAO,CACL,MAAC,GAAG,IAAC,aAAa,EAAC,QAAQ,aACzB,KAAC,GAAG,IAAC,YAAY,EAAE,CAAC,YAClB,MAAC,IAAI,IAAC,QAAQ,yFAAsC,IAAI,6BAAc,GAClE,EAEL,IAAI,KAAK,CAAC,IAAI,CACb,KAAC,kBAAkB,IACjB,OAAO,EAAE,EAAE,aAAa,EAAE,KAAK,CAAC,aAAa,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,EAC/F,UAAU,EAAE,CAAC,IAAI,EAAE,EAAE,GAAG,QAAQ,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,GAAG,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,GACzE,CACH,EACA,IAAI,KAAK,CAAC,IAAI,CACb,KAAC,oBAAoB,IACnB,OAAO,EAAE,KAAK,CAAC,iBAAiB,EAChC,UAAU,EAAE,CAAC,IAAI,EAAE,EAAE,GAAG,QAAQ,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,iBAAiB,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EACzF,MAAM,EAAE,MAAM,GACd,CACH,EACA,IAAI,KAAK,CAAC,IAAI,CACb,KAAC,WAAW,IACV,OAAO,EAAE,KAAK,CAAC,OAAO,EACtB,kBAAkB,EAAE,KAAK,CAAC,SAAS,EACnC,UAAU,EAAE,CAAC,OAAO,EAAE,EAAE,GAAG,QAAQ,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAC5E,MAAM,EAAE,MAAM,GACd,CACH,EACA,IAAI,KAAK,CAAC,IAAI,CACb,KAAC,YAAY,IACX,OAAO,EAAE,KAAK,CAAC,SAAS,EACxB,UAAU,EAAE,CAAC,MAAM,EAAE,EAAE,GAAG,QAAQ,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EACrF,MAAM,EAAE,MAAM,GACd,CACH,EACA,IAAI,KAAK,CAAC,IAAI,CACb,KAAC,gBAAgB,IACf,OAAO,EAAE,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,cAAc,EAAE,KAAK,CAAC,cAAc,EAAE,EACnE,UAAU,EAAE,CAAC,IAAI,EAAE,EAAE,GAAG,QAAQ,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,cAAc,EAAE,IAAI,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EACtH,MAAM,EAAE,MAAM,GACd,CACH,EACA,IAAI,KAAK,CAAC,IAAI,CACb,KAAC,cAAc,IACb,OAAO,EAAE,KAAK,CAAC,gBAAgB,EAC/B,UAAU,EAAE,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,EAClE,UAAU,EAAE,CAAC,QAAQ,EAAE,EAAE,GAAG,QAAQ,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,gBAAgB,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAChG,MAAM,EAAE,MAAM,GACd,CACH,EACA,IAAI,KAAK,CAAC,IAAI,CACb,KAAC,cAAc,IACb,iBAAiB,EAAE,KAAK,CAAC,qBAAqB,EAC9C,eAAe,EAAE,KAAK,CAAC,mBAAmB,EAC1C,UAAU,EAAE,CAAC,IAAI,EAAE,EAAE,GAAG,QAAQ,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,qBAAqB,EAAE,IAAI,CAAC,UAAU,EAAE,mBAAmB,EAAE,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAC5I,MAAM,EAAE,MAAM,GACd,CACH,EACA,IAAI,KAAK,CAAC,IAAI,CACb,KAAC,UAAU,IACT,QAAQ,EAAE,aAAa,CAAC,KAAK,CAAC,EAC9B,SAAS,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,EAC/C,MAAM,EAAE,MAAM,GACd,CACH,IACG,CACP,CAAC;AACJ,CAAC"}

package/dist/src/config.d.ts

@@ -1,18 +1,28 @@
+export type Transport = "stdio" | "sse" | "http";
 export interface ProxyConfig {
     manifestPath?: string;
     manifestJson?: string;
     manifestSecretArn?: string;
     manifestKeyvaultUri?: string;
     manifestGcpSecret?: string;
-    transport: "stdio" | "sse";
+    transport: Transport;
     upstreamMcpUrl?: string;
     upstreamMcpCommand?: string;
     upstreamMcpArgs?: string[];
+    /** stdio only: hold agent messages until the upstream prints or this many ms pass (0 = forward immediately). */
+    upstreamStartupDelayMs?: number;
     proxyPort: number;
+    /** http only: interface to bind (default 127.0.0.1). */
+    proxyHost?: string;
+    /** http only: shared secret required when binding a non-loopback interface. */
+    proxyAuthToken?: string;
+    /** Permit free-form command/argument fields despite incomplete inspection. */
+    allowUnstructuredCommands?: boolean;
     auditLogPath: string;
     awsLogGroup?: string;
     awsRegion?: string;
     azureLogWorkspaceId?: string;
+    azureLogIngestionEndpoint?: string;
     azureDcrImmutableId?: string;
     azureDcrStreamName: string;
     gcpProject?: string;

package/dist/src/config.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../../src/config.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,WAAW;IAC1B,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,SAAS,EAAE,OAAO,GAAG,KAAK,CAAC;IAC3B,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,eAAe,CAAC,EAAE,MAAM,EAAE,CAAC;IAC3B,SAAS,EAAE,MAAM,CAAC;IAClB,YAAY,EAAE,MAAM,CAAC;IACrB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,kBAAkB,EAAE,MAAM,CAAC;IAC3B,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,CAAC;CACtB;AAED,wBAAgB,UAAU,IAAI,WAAW,CAwBxC"}
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../../src/config.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,SAAS,GAAG,OAAO,GAAG,KAAK,GAAG,MAAM,CAAC;AAIjD,MAAM,WAAW,WAAW;IAC1B,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,SAAS,EAAE,SAAS,CAAC;IACrB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,eAAe,CAAC,EAAE,MAAM,EAAE,CAAC;IAC3B,gHAAgH;IAChH,sBAAsB,CAAC,EAAE,MAAM,CAAC;IAChC,SAAS,EAAE,MAAM,CAAC;IAClB,wDAAwD;IACxD,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,+EAA+E;IAC/E,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,8EAA8E;IAC9E,yBAAyB,CAAC,EAAE,OAAO,CAAC;IACpC,YAAY,EAAE,MAAM,CAAC;IACrB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,yBAAyB,CAAC,EAAE,MAAM,CAAC;IACnC,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,kBAAkB,EAAE,MAAM,CAAC;IAC3B,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,CAAC;CACtB;AA6BD,wBAAgB,UAAU,IAAI,WAAW,CA6BxC"}

package/dist/src/config.js

@@ -1,3 +1,28 @@
+const TRANSPORTS = ["stdio", "sse", "http"];
+function parseTransport(value) {
+    const t = (value || "stdio").trim().toLowerCase();
+    if (!TRANSPORTS.includes(t)) {
+        throw new Error(`Invalid MCP_TRANSPORT "${value}". Use one of: ${TRANSPORTS.join(", ")}.`);
+    }
+    return t;
+}
+function parseUpstreamArgs() {
+    const json = process.env.UPSTREAM_MCP_ARGS_JSON;
+    if (json !== undefined) {
+        let args;
+        try {
+            args = JSON.parse(json);
+        }
+        catch {
+            throw new Error("UPSTREAM_MCP_ARGS_JSON must be a JSON array of strings.");
+        }
+        if (!Array.isArray(args) || !args.every((arg) => typeof arg === "string")) {
+            throw new Error("UPSTREAM_MCP_ARGS_JSON must be a JSON array of strings.");
+        }
+        return args;
+    }
+    return process.env.UPSTREAM_MCP_ARGS?.split(",");
+}
 export function loadConfig() {
     return {
         manifestPath: process.env.SCOPE_MANIFEST_PATH,
@@ -5,22 +30,27 @@ export function loadConfig() {
         manifestSecretArn: process.env.SCOPE_MANIFEST_SECRET_ARN,
         manifestKeyvaultUri: process.env.SCOPE_MANIFEST_KEYVAULT_URI,
         manifestGcpSecret: process.env.SCOPE_MANIFEST_GCP_SECRET,
-        transport: process.env.MCP_TRANSPORT || "stdio",
+        transport: parseTransport(process.env.MCP_TRANSPORT),
         upstreamMcpUrl: process.env.UPSTREAM_MCP_URL,
         upstreamMcpCommand: process.env.UPSTREAM_MCP_COMMAND,
-        upstreamMcpArgs: process.env.UPSTREAM_MCP_ARGS?.split(","),
+        upstreamMcpArgs: parseUpstreamArgs(),
+        upstreamStartupDelayMs: parseInt(process.env.UPSTREAM_STARTUP_DELAY_MS || "0", 10),
         proxyPort: parseInt(process.env.PROXY_PORT || "9090", 10),
+        proxyHost: process.env.PROXY_HOST || "127.0.0.1",
+        proxyAuthToken: process.env.PROXY_AUTH_TOKEN,
+        allowUnstructuredCommands: process.env.ALLOW_UNSTRUCTURED_COMMANDS === "true",
         auditLogPath: process.env.AUDIT_LOG_PATH || "./audit/",
         awsLogGroup: process.env.AWS_LOG_GROUP,
         awsRegion: process.env.AWS_REGION,
         azureLogWorkspaceId: process.env.AZURE_LOG_WORKSPACE_ID,
+        azureLogIngestionEndpoint: process.env.AZURE_LOG_INGESTION_ENDPOINT,
         azureDcrImmutableId: process.env.AZURE_DCR_IMMUTABLE_ID,
         azureDcrStreamName: process.env.AZURE_DCR_STREAM_NAME || "Custom-MCPProxyAudit_CL",
         gcpProject: process.env.GOOGLE_CLOUD_PROJECT,
         techniqueMapPath: process.env.TECHNIQUE_MAP_PATH,
         dnsCacheTtl: parseInt(process.env.DNS_CACHE_TTL || "60", 10),
         logLevel: process.env.LOG_LEVEL || "INFO",
-        proxyVersion: process.env.PROXY_VERSION || "0.1.0",
+        proxyVersion: process.env.PROXY_VERSION || "0.2.7",
     };
 }
 //# sourceMappingURL=config.js.map

package/dist/src/config.js.map

@@ -1 +1 @@
-{"version":3,"file":"config.js","sourceRoot":"","sources":["../../src/config.ts"],"names":[],"mappings":"AAwBA,MAAM,UAAU,UAAU;IACxB,OAAO;QACL,YAAY,EAAE,OAAO,CAAC,GAAG,CAAC,mBAAmB;QAC7C,YAAY,EAAE,OAAO,CAAC,GAAG,CAAC,mBAAmB;QAC7C,iBAAiB,EAAE,OAAO,CAAC,GAAG,CAAC,yBAAyB;QACxD,mBAAmB,EAAE,OAAO,CAAC,GAAG,CAAC,2BAA2B;QAC5D,iBAAiB,EAAE,OAAO,CAAC,GAAG,CAAC,yBAAyB;QACxD,SAAS,EAAG,OAAO,CAAC,GAAG,CAAC,aAAiC,IAAI,OAAO;QACpE,cAAc,EAAE,OAAO,CAAC,GAAG,CAAC,gBAAgB;QAC5C,kBAAkB,EAAE,OAAO,CAAC,GAAG,CAAC,oBAAoB;QACpD,eAAe,EAAE,OAAO,CAAC,GAAG,CAAC,iBAAiB,EAAE,KAAK,CAAC,GAAG,CAAC;QAC1D,SAAS,EAAE,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,IAAI,MAAM,EAAE,EAAE,CAAC;QACzD,YAAY,EAAE,OAAO,CAAC,GAAG,CAAC,cAAc,IAAI,UAAU;QACtD,WAAW,EAAE,OAAO,CAAC,GAAG,CAAC,aAAa;QACtC,SAAS,EAAE,OAAO,CAAC,GAAG,CAAC,UAAU;QACjC,mBAAmB,EAAE,OAAO,CAAC,GAAG,CAAC,sBAAsB;QACvD,mBAAmB,EAAE,OAAO,CAAC,GAAG,CAAC,sBAAsB;QACvD,kBAAkB,EAAE,OAAO,CAAC,GAAG,CAAC,qBAAqB,IAAI,yBAAyB;QAClF,UAAU,EAAE,OAAO,CAAC,GAAG,CAAC,oBAAoB;QAC5C,gBAAgB,EAAE,OAAO,CAAC,GAAG,CAAC,kBAAkB;QAChD,WAAW,EAAE,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,aAAa,IAAI,IAAI,EAAE,EAAE,CAAC;QAC5D,QAAQ,EAAE,OAAO,CAAC,GAAG,CAAC,SAAS,IAAI,MAAM;QACzC,YAAY,EAAE,OAAO,CAAC,GAAG,CAAC,aAAa,IAAI,OAAO;KACnD,CAAC;AACJ,CAAC"}
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../../src/config.ts"],"names":[],"mappings":"AAEA,MAAM,UAAU,GAAyB,CAAC,OAAO,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC;AAmClE,SAAS,cAAc,CAAC,KAAyB;IAC/C,MAAM,CAAC,GAAG,CAAC,KAAK,IAAI,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAClD,IAAI,CAAE,UAAgC,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC;QACnD,MAAM,IAAI,KAAK,CACb,0BAA0B,KAAK,kBAAkB,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAC1E,CAAC;IACJ,CAAC;IACD,OAAO,CAAc,CAAC;AACxB,CAAC;AAED,SAAS,iBAAiB;IACxB,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,sBAAsB,CAAC;IAChD,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QACvB,IAAI,IAAa,CAAC;QAClB,IAAI,CAAC;YACH,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAC1B,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,KAAK,CAAC,yDAAyD,CAAC,CAAC;QAC7E,CAAC;QACD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,OAAO,GAAG,KAAK,QAAQ,CAAC,EAAE,CAAC;YAC1E,MAAM,IAAI,KAAK,CAAC,yDAAyD,CAAC,CAAC;QAC7E,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,OAAO,CAAC,GAAG,CAAC,iBAAiB,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC;AACnD,CAAC;AAED,MAAM,UAAU,UAAU;IACxB,OAAO;QACL,YAAY,EAAE,OAAO,CAAC,GAAG,CAAC,mBAAmB;QAC7C,YAAY,EAAE,OAAO,CAAC,GAAG,CAAC,mBAAmB;QAC7C,iBAAiB,EAAE,OAAO,CAAC,GAAG,CAAC,yBAAyB;QACxD,mBAAmB,EAAE,OAAO,CAAC,GAAG,CAAC,2BAA2B;QAC5D,iBAAiB,EAAE,OAAO,CAAC,GAAG,CAAC,yBAAyB;QACxD,SAAS,EAAE,cAAc,CAAC,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC;QACpD,cAAc,EAAE,OAAO,CAAC,GAAG,CAAC,gBAAgB;QAC5C,kBAAkB,EAAE,OAAO,CAAC,GAAG,CAAC,oBAAoB;QACpD,eAAe,EAAE,iBAAiB,EAAE;QACpC,sBAAsB,EAAE,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,yBAAyB,IAAI,GAAG,EAAE,EAAE,CAAC;QAClF,SAAS,EAAE,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,IAAI,MAAM,EAAE,EAAE,CAAC;QACzD,SAAS,EAAE,OAAO,CAAC,GAAG,CAAC,UAAU,IAAI,WAAW;QAChD,cAAc,EAAE,OAAO,CAAC,GAAG,CAAC,gBAAgB;QAC5C,yBAAyB,EAAE,OAAO,CAAC,GAAG,CAAC,2BAA2B,KAAK,MAAM;QAC7E,YAAY,EAAE,OAAO,CAAC,GAAG,CAAC,cAAc,IAAI,UAAU;QACtD,WAAW,EAAE,OAAO,CAAC,GAAG,CAAC,aAAa;QACtC,SAAS,EAAE,OAAO,CAAC,GAAG,CAAC,UAAU;QACjC,mBAAmB,EAAE,OAAO,CAAC,GAAG,CAAC,sBAAsB;QACvD,yBAAyB,EAAE,OAAO,CAAC,GAAG,CAAC,4BAA4B;QACnE,mBAAmB,EAAE,OAAO,CAAC,GAAG,CAAC,sBAAsB;QACvD,kBAAkB,EAAE,OAAO,CAAC,GAAG,CAAC,qBAAqB,IAAI,yBAAyB;QAClF,UAAU,EAAE,OAAO,CAAC,GAAG,CAAC,oBAAoB;QAC5C,gBAAgB,EAAE,OAAO,CAAC,GAAG,CAAC,kBAAkB;QAChD,WAAW,EAAE,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,aAAa,IAAI,IAAI,EAAE,EAAE,CAAC;QAC5D,QAAQ,EAAE,OAAO,CAAC,GAAG,CAAC,SAAS,IAAI,MAAM;QACzC,YAAY,EAAE,OAAO,CAAC,GAAG,CAAC,aAAa,IAAI,OAAO;KACnD,CAAC;AACJ,CAAC"}

package/dist/src/dns-resolver.d.ts

@@ -13,9 +13,18 @@ export declare class DnsResolver {
     private readonly cache;
     /** Promises for in-flight lookups, keyed by hostname. */
     private readonly inflight;
-    constructor(ttlSeconds?: number);
+    private readonly lookupTimeoutMs;
+    constructor(ttlSeconds?: number, lookupTimeoutMs?: number);
     resolve(target: string): Promise<string[]>;
     /** Perform the actual A + AAAA DNS queries in parallel. Never throws. */
     private _lookup;
+    /**
+     * Fallback to the operating system resolver (getaddrinfo). resolve4/6 query
+     * DNS servers directly and ignore the hosts file, VPN split-DNS and other
+     * OS-level name resolution that lab and internal targets often rely on.
+     * Never throws.
+     */
+    private _systemLookup;
+    private withTimeout;
 }
 //# sourceMappingURL=dns-resolver.d.ts.map

package/dist/src/dns-resolver.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"dns-resolver.d.ts","sourceRoot":"","sources":["../../src/dns-resolver.ts"],"names":[],"mappings":"AAQA;;;;;;;;;GASG;AACH,qBAAa,WAAW;IACtB,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAS;IAC/B,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAiC;IACvD,yDAAyD;IACzD,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAwC;gBAErD,UAAU,GAAE,MAAW;IAI7B,OAAO,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IAoChD,yEAAyE;YAC3D,OAAO;CAkBtB"}
+{"version":3,"file":"dns-resolver.d.ts","sourceRoot":"","sources":["../../src/dns-resolver.ts"],"names":[],"mappings":"AAQA;;;;;;;;;GASG;AACH,qBAAa,WAAW;IACtB,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAS;IAC/B,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAiC;IACvD,yDAAyD;IACzD,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAwC;IACjE,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAS;gBAE7B,UAAU,GAAE,MAAW,EAAE,eAAe,GAAE,MAAa;IAK7D,OAAO,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IA+ChD,yEAAyE;YAC3D,OAAO;IAuBrB;;;;;OAKG;YACW,aAAa;IAS3B,OAAO,CAAC,WAAW;CAUpB"}