@integsec/agentic-pentest-proxy 0.2.5 → 0.2.7

package/dist/src/sanitizer.js

@@ -12,10 +12,37 @@ const REDACTED = "[REDACTED]";
  * Regex that matches a key name that is *exactly* one of the sensitive words
  * (case-insensitive, full-string match).
  */
-const SENSITIVE_KEY_RE = /^(password|passwd|token|secret|key|credential|auth|apikey|api_key|authorization)$/i;
+const SENSITIVE_KEY_RE = /^(password|passwd|token|secret|key|credential|auth|apikey|authorization)$/i;
+const COMMAND_KEY_RE = /^(command|cmd|command_line|commandline|cmdline|shell_command|args|extra_args|additional_args)$/i;
+const UNSTRUCTURED_VALUE_KEY_RE = /^(body|payload|data|request|raw_request|headers|cookie|cookies)$/i;
 /** Returns true if the given key should have its value redacted. */
 function isSensitive(key) {
-    return SENSITIVE_KEY_RE.test(key);
+    const words = key
+        .replace(/([a-z])([A-Z])/g, "$1_$2")
+        .split(/[^a-z0-9]+/i)
+        .filter(Boolean);
+    return words.some((word) => SENSITIVE_KEY_RE.test(word)) ||
+        /password|passwd|token|secret|credential|apikey|authorization|auth/i.test(key);
+}
+/** Remove URL userinfo and sensitive query values without altering the call. */
+function sanitizeString(value) {
+    if (!/^https?:\/\//i.test(value))
+        return value;
+    try {
+        const url = new URL(value);
+        if (url.username)
+            url.username = "REDACTED";
+        if (url.password)
+            url.password = "REDACTED";
+        for (const key of url.searchParams.keys()) {
+            if (isSensitive(key))
+                url.searchParams.set(key, REDACTED);
+        }
+        return url.toString();
+    }
+    catch {
+        return REDACTED;
+    }
 }
 /**
  * Recursively sanitize an unknown value that may be a plain object, an array,
@@ -32,19 +59,18 @@ function sanitizeValue(value, key) {
     if (key !== undefined && isSensitive(key)) {
         return REDACTED;
     }
+    if (key !== undefined && (COMMAND_KEY_RE.test(key) || UNSTRUCTURED_VALUE_KEY_RE.test(key))) {
+        // A free-form shell command can embed headers, passwords and tokens in
+        // arbitrary syntax. There is no reliable way to redact only those pieces.
+        return REDACTED;
+    }
     if (Array.isArray(value)) {
-        return value.map((item) => {
-            // Array items do not inherit a key name, so we only recurse into objects.
-            if (item !== null && typeof item === "object" && !Array.isArray(item)) {
-                return sanitizeObject(item);
-            }
-            return item;
-        });
+        return value.map((item) => sanitizeValue(item));
     }
     if (value !== null && typeof value === "object") {
         return sanitizeObject(value);
     }
-    return value;
+    return typeof value === "string" ? sanitizeString(value) : value;
 }
 /** Shallow-copy an object and recursively sanitize every property. */
 function sanitizeObject(obj) {

package/dist/src/sanitizer.js.map

@@ -1 +1 @@
-{"version":3,"file":"sanitizer.js","sourceRoot":"","sources":["../../src/sanitizer.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,MAAM,QAAQ,GAAG,YAAY,CAAC;AAE9B;;;GAGG;AACH,MAAM,gBAAgB,GACpB,oFAAoF,CAAC;AAEvF,oEAAoE;AACpE,SAAS,WAAW,CAAC,GAAW;IAC9B,OAAO,gBAAgB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AACpC,CAAC;AAED;;;;;;;;GAQG;AACH,SAAS,aAAa,CAAC,KAAc,EAAE,GAAY;IACjD,oEAAoE;IACpE,wEAAwE;IACxE,IAAI,GAAG,KAAK,SAAS,IAAI,WAAW,CAAC,GAAG,CAAC,EAAE,CAAC;QAC1C,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE;YACxB,0EAA0E;YAC1E,IAAI,IAAI,KAAK,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;gBACtE,OAAO,cAAc,CAAC,IAA+B,CAAC,CAAC;YACzD,CAAC;YACD,OAAO,IAAI,CAAC;QACd,CAAC,CAAC,CAAC;IACL,CAAC;IAED,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAChD,OAAO,cAAc,CAAC,KAAgC,CAAC,CAAC;IAC1D,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC;AAED,sEAAsE;AACtE,SAAS,cAAc,CAAC,GAA4B;IAClD,MAAM,MAAM,GAA4B,EAAE,CAAC;IAC3C,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QACzC,MAAM,CAAC,CAAC,CAAC,GAAG,aAAa,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IAClC,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,cAAc,CAC5B,MAA+B;IAE/B,OAAO,cAAc,CAAC,MAAM,CAAC,CAAC;AAChC,CAAC"}
+{"version":3,"file":"sanitizer.js","sourceRoot":"","sources":["../../src/sanitizer.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,MAAM,QAAQ,GAAG,YAAY,CAAC;AAE9B;;;GAGG;AACH,MAAM,gBAAgB,GACpB,4EAA4E,CAAC;AAC/E,MAAM,cAAc,GAAG,iGAAiG,CAAC;AACzH,MAAM,yBAAyB,GAAG,mEAAmE,CAAC;AAEtG,oEAAoE;AACpE,SAAS,WAAW,CAAC,GAAW;IAC9B,MAAM,KAAK,GAAG,GAAG;SACd,OAAO,CAAC,iBAAiB,EAAE,OAAO,CAAC;SACnC,KAAK,CAAC,aAAa,CAAC;SACpB,MAAM,CAAC,OAAO,CAAC,CAAC;IACnB,OAAO,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACtD,oEAAoE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AACnF,CAAC;AAED,gFAAgF;AAChF,SAAS,cAAc,CAAC,KAAa;IACnC,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAC/C,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;QAC3B,IAAI,GAAG,CAAC,QAAQ;YAAE,GAAG,CAAC,QAAQ,GAAG,UAAU,CAAC;QAC5C,IAAI,GAAG,CAAC,QAAQ;YAAE,GAAG,CAAC,QAAQ,GAAG,UAAU,CAAC;QAC5C,KAAK,MAAM,GAAG,IAAI,GAAG,CAAC,YAAY,CAAC,IAAI,EAAE,EAAE,CAAC;YAC1C,IAAI,WAAW,CAAC,GAAG,CAAC;gBAAE,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;QAC5D,CAAC;QACD,OAAO,GAAG,CAAC,QAAQ,EAAE,CAAC;IACxB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,QAAQ,CAAC;IAClB,CAAC;AACH,CAAC;AAED;;;;;;;;GAQG;AACH,SAAS,aAAa,CAAC,KAAc,EAAE,GAAY;IACjD,oEAAoE;IACpE,wEAAwE;IACxE,IAAI,GAAG,KAAK,SAAS,IAAI,WAAW,CAAC,GAAG,CAAC,EAAE,CAAC;QAC1C,OAAO,QAAQ,CAAC;IAClB,CAAC;IACD,IAAI,GAAG,KAAK,SAAS,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,yBAAyB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;QAC3F,uEAAuE;QACvE,0EAA0E;QAC1E,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC;IAClD,CAAC;IAED,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAChD,OAAO,cAAc,CAAC,KAAgC,CAAC,CAAC;IAC1D,CAAC;IAED,OAAO,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;AACnE,CAAC;AAED,sEAAsE;AACtE,SAAS,cAAc,CAAC,GAA4B;IAClD,MAAM,MAAM,GAA4B,EAAE,CAAC;IAC3C,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QACzC,MAAM,CAAC,CAAC,CAAC,GAAG,aAAa,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IAClC,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,cAAc,CAC5B,MAA+B;IAE/B,OAAO,cAAc,CAAC,MAAM,CAAC,CAAC;AAChC,CAAC"}

package/dist/src/technique-checker.d.ts

@@ -20,6 +20,12 @@ export interface TechniqueMapping {
     patterns: string[];
 }
 export type TechniqueMappings = Record<string, TechniqueMapping>;
+/**
+ * Load custom technique mappings from a JSON file (TECHNIQUE_MAP_PATH).
+ * Throws with a descriptive message if the file is unreadable or malformed,
+ * so a typo in the map never silently disables a technique block.
+ */
+export declare function loadTechniqueMappings(filePath: string): TechniqueMappings;
 export declare class TechniqueChecker {
     private readonly mappings;
     /**
@@ -40,6 +46,14 @@ export declare class TechniqueChecker {
      * categorised).
      */
     isBlocked(toolName: string, excludedTechniques: string[]): boolean;
+    /**
+     * Patterns containing a separator (e.g. "nmap_", "shodan-", "msf_") match
+     * as plain substrings. Purely alphanumeric patterns (e.g. "dos", "flood")
+     * match whole words of the tool name, or the end of a word, so "dos"
+     * matches "dos_attack" and "ddos" but not "get_dossier"; "flood" matches
+     * "udp_flood" and "icmpflood".
+     */
+    private static matchesPattern;
     /**
      * Merges `custom` mappings into `base`, extending per-category arrays rather
      * than replacing them. Returns a deep-copied result so the originals are

package/dist/src/technique-checker.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"technique-checker.d.ts","sourceRoot":"","sources":["../../src/technique-checker.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,MAAM,WAAW,gBAAgB;IAC/B,6DAA6D;IAC7D,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,uFAAuF;IACvF,QAAQ,EAAE,MAAM,EAAE,CAAC;CACpB;AAED,MAAM,MAAM,iBAAiB,GAAG,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC;AAyBjE,qBAAa,gBAAgB;IAC3B,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAoB;IAE7C;;;;;OAKG;gBACS,cAAc,CAAC,EAAE,iBAAiB;IAQ9C;;;OAGG;IACH,WAAW,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI;IAoB5C;;;;OAIG;IACH,SAAS,CAAC,QAAQ,EAAE,MAAM,EAAE,kBAAkB,EAAE,MAAM,EAAE,GAAG,OAAO;IAalE;;;;OAIG;IACH,OAAO,CAAC,MAAM,CAAC,aAAa;CAsB7B"}
+{"version":3,"file":"technique-checker.d.ts","sourceRoot":"","sources":["../../src/technique-checker.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAKH,MAAM,WAAW,gBAAgB;IAC/B,6DAA6D;IAC7D,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,uFAAuF;IACvF,QAAQ,EAAE,MAAM,EAAE,CAAC;CACpB;AAED,MAAM,MAAM,iBAAiB,GAAG,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC;AA0GjE;;;;GAIG;AACH,wBAAgB,qBAAqB,CAAC,QAAQ,EAAE,MAAM,GAAG,iBAAiB,CAezE;AAMD,qBAAa,gBAAgB;IAC3B,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAoB;IAE7C;;;;;OAKG;gBACS,cAAc,CAAC,EAAE,iBAAiB;IAQ9C;;;OAGG;IACH,WAAW,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI;IAoB5C;;;;OAIG;IACH,SAAS,CAAC,QAAQ,EAAE,MAAM,EAAE,kBAAkB,EAAE,MAAM,EAAE,GAAG,OAAO;IAalE;;;;;;OAMG;IACH,OAAO,CAAC,MAAM,CAAC,cAAc;IAW7B;;;;OAIG;IACH,OAAO,CAAC,MAAM,CAAC,aAAa;CAsB7B"}

package/dist/src/technique-checker.js

@@ -13,6 +13,8 @@
  * (they do not replace them). Both exact lists and patterns are extended
  * per-category.
  */
+import * as fs from "node:fs";
+import { z } from "zod";
 // ---------------------------------------------------------------------------
 // Default technique map
 // ---------------------------------------------------------------------------
@@ -29,7 +31,108 @@ const DEFAULT_MAPPINGS = {
         exact: ["gophish", "setoolkit", "evilginx", "modlishka"],
         patterns: [],
     },
+    recon: {
+        exact: [
+            "amass", "alterx", "assetfinder", "cero", "crtsh",
+            "dnsx", "httpx", "katana", "gowitness", "masscan",
+            "shuffledns", "subfinder", "uncover", "waybackurls", "notify",
+            "nmap", "nmap_scan",
+            "trivy", "checkov", "kube-hunter", "kubeaudit", "kube-bench",
+            "shodan", "virustotal", "bloodhound",
+            // Hex Strike AI MCP
+            "rustscan_fast_scan", "subfinder_scan", "katana_crawl",
+            // Kali Linux MCP
+            "port_scan", "dns_enum", "network_discovery", "subdomain_enum",
+            "enum_shares", "ssl_analysis",
+            // Shodan MCP (BurtTheCoder)
+            "ip_lookup", "shodan_search", "dns_lookup", "reverse_dns_lookup",
+            // WireMCP
+            "check_ip_threats",
+            // VirusTotal MCP
+            "get_url_report", "get_ip_report", "get_domain_report", "submit_url",
+            "get_url_relationship", "get_ip_relationship", "get_domain_relationship",
+            // Awesome Kali MCP Servers (nmap variants)
+            "basic_scan", "intense_scan", "stealth_scan", "quick_scan",
+            // Semgrep MCP
+            "semgrep", "security_check", "semgrep_scan", "semgrep_scan_with_custom_rule", "semgrep_findings",
+            // Gitleaks MCP
+            "gitleaks", "gitleaks_scan",
+            // Ghidra MCP
+            "ghidra", "decompile_function",
+            // MobSF MCP
+            "mobsf", "scanFile",
+            // SSLScan MCP
+            "sslscan",
+            // HTTP headers Custom MCP
+            "http_headers", "check_http_headers",
+        ],
+        patterns: [
+            // Covers all nmap_* variants from Nmap MCP Server and Hex Strike
+            "nmap_",
+            // Covers all shodan-* hyphenated tools from Vorota-ai Shodan MCP
+            "shodan-",
+        ],
+    },
+    web_app: {
+        exact: [
+            "nuclei", "sqlmap", "ffuf", "dirb", "gobuster", "nikto",
+            "arjun", "smuggler", "wpscan", "nessus", "dalfox", "zap",
+            "burpsuite", "burp_scan", "burp_active_scan",
+            // Hex Strike AI MCP variants
+            "gobuster_scan", "nuclei_scan", "sqlmap_scan", "ffuf_scan", "feroxbuster_scan",
+            // Kali Linux MCP
+            "vulnerability_scan", "web_enumeration",
+            // Burp Suite MCP (PortSwigger official)
+            "start_scan",
+            // Acunetix MCP
+            "acunetix",
+            // Next.js CVE scanner / Unified all-in-one
+            "nextjs_scan", "nextjs_scanner", "unified_scan",
+        ],
+        patterns: [],
+    },
+    exploitation: {
+        exact: ["metasploit", "hydra", "hashcat",
+            // Hex Strike AI MCP
+            "hydra_attack", "hashcat_crack", "metasploit_run",
+            // Kali Linux MCP
+            "payload_generate", "reverse_shell",
+            // CrackMapExec
+            "crackmapexec",
+            // Commix — command injection exploitation
+            "commix",
+        ],
+        patterns: ["msf_"],
+    },
+    cloud_audit: {
+        exact: ["prowler", "scoutsuite"],
+        patterns: [],
+    },
 };
+const TechniqueMappingsSchema = z.record(z.string().min(1), z.object({
+    exact: z.array(z.string()).default([]),
+    patterns: z.array(z.string()).default([]),
+}));
+/**
+ * Load custom technique mappings from a JSON file (TECHNIQUE_MAP_PATH).
+ * Throws with a descriptive message if the file is unreadable or malformed,
+ * so a typo in the map never silently disables a technique block.
+ */
+export function loadTechniqueMappings(filePath) {
+    let raw;
+    try {
+        raw = JSON.parse(fs.readFileSync(filePath, "utf-8"));
+    }
+    catch (err) {
+        throw new Error(`Failed to read technique map at "${filePath}": ${err instanceof Error ? err.message : String(err)}`);
+    }
+    const parsed = TechniqueMappingsSchema.safeParse(raw);
+    if (!parsed.success) {
+        const issues = parsed.error.issues.map((i) => `${i.path.join(".")}: ${i.message}`).join("; ");
+        throw new Error(`Technique map at "${filePath}" is invalid: ${issues}`);
+    }
+    return parsed.data;
+}
 // ---------------------------------------------------------------------------
 // TechniqueChecker class
 // ---------------------------------------------------------------------------
@@ -60,8 +163,8 @@ export class TechniqueChecker {
             if (mapping.exact.some((name) => name.toLowerCase() === lower)) {
                 return category;
             }
-            // 2. Substring pattern match
-            if (mapping.patterns.some((pattern) => lower.includes(pattern.toLowerCase()))) {
+            // 2. Pattern match
+            if (mapping.patterns.some((pattern) => TechniqueChecker.matchesPattern(lower, pattern))) {
                 return category;
             }
         }
@@ -83,6 +186,24 @@ export class TechniqueChecker {
     // -------------------------------------------------------------------------
     // Private helpers
     // -------------------------------------------------------------------------
+    /**
+     * Patterns containing a separator (e.g. "nmap_", "shodan-", "msf_") match
+     * as plain substrings. Purely alphanumeric patterns (e.g. "dos", "flood")
+     * match whole words of the tool name, or the end of a word, so "dos"
+     * matches "dos_attack" and "ddos" but not "get_dossier"; "flood" matches
+     * "udp_flood" and "icmpflood".
+     */
+    static matchesPattern(lowerToolName, pattern) {
+        const p = pattern.toLowerCase();
+        if (p === "")
+            return false;
+        if (/[^a-z0-9]/.test(p)) {
+            return lowerToolName.includes(p);
+        }
+        return lowerToolName
+            .split(/[^a-z0-9]+/)
+            .some((word) => word === p || word.endsWith(p));
+    }
     /**
      * Merges `custom` mappings into `base`, extending per-category arrays rather
      * than replacing them. Returns a deep-copied result so the originals are

package/dist/src/technique-checker.js.map

@@ -1 +1 @@
-{"version":3,"file":"technique-checker.js","sourceRoot":"","sources":["../../src/technique-checker.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAWH,8EAA8E;AAC9E,wBAAwB;AACxB,8EAA8E;AAE9E,MAAM,gBAAgB,GAAsB;IAC1C,GAAG,EAAE;QACH,KAAK,EAAE,CAAC,QAAQ,EAAE,WAAW,EAAE,UAAU,EAAE,UAAU,CAAC;QACtD,QAAQ,EAAE,CAAC,OAAO,EAAE,KAAK,CAAC;KAC3B;IACD,WAAW,EAAE;QACX,KAAK,EAAE,EAAE;QACT,QAAQ,EAAE,CAAC,SAAS,EAAE,MAAM,EAAE,OAAO,CAAC;KACvC;IACD,kBAAkB,EAAE;QAClB,KAAK,EAAE,CAAC,SAAS,EAAE,WAAW,EAAE,UAAU,EAAE,WAAW,CAAC;QACxD,QAAQ,EAAE,EAAE;KACb;CACF,CAAC;AAEF,8EAA8E;AAC9E,yBAAyB;AACzB,8EAA8E;AAE9E,MAAM,OAAO,gBAAgB;IACV,QAAQ,CAAoB;IAE7C;;;;;OAKG;IACH,YAAY,cAAkC;QAC5C,IAAI,CAAC,QAAQ,GAAG,gBAAgB,CAAC,aAAa,CAAC,gBAAgB,EAAE,cAAc,IAAI,EAAE,CAAC,CAAC;IACzF,CAAC;IAED,4EAA4E;IAC5E,aAAa;IACb,4EAA4E;IAE5E;;;OAGG;IACH,WAAW,CAAC,QAAgB;QAC1B,IAAI,QAAQ,KAAK,EAAE;YAAE,OAAO,IAAI,CAAC;QAEjC,MAAM,KAAK,GAAG,QAAQ,CAAC,WAAW,EAAE,CAAC;QAErC,KAAK,MAAM,CAAC,QAAQ,EAAE,OAAO,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;YAChE,uDAAuD;YACvD,IAAI,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,WAAW,EAAE,KAAK,KAAK,CAAC,EAAE,CAAC;gBAC/D,OAAO,QAAQ,CAAC;YAClB,CAAC;YAED,6BAA6B;YAC7B,IAAI,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC,CAAC,EAAE,CAAC;gBAC9E,OAAO,QAAQ,CAAC;YAClB,CAAC;QACH,CAAC;QAED,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;;;OAIG;IACH,SAAS,CAAC,QAAgB,EAAE,kBAA4B;QACtD,IAAI,kBAAkB,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,KAAK,CAAC;QAElD,MAAM,QAAQ,GAAG,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC;QAC5C,IAAI,QAAQ,KAAK,IAAI;YAAE,OAAO,KAAK,CAAC;QAEpC,OAAO,kBAAkB,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IAC/C,CAAC;IAED,4EAA4E;IAC5E,kBAAkB;IAClB,4EAA4E;IAE5E;;;;OAIG;IACK,MAAM,CAAC,aAAa,CAC1B,IAAuB,EACvB,MAAyB;QAEzB,iBAAiB;QACjB,MAAM,MAAM,GAAsB,EAAE,CAAC;QACrC,KAAK,MAAM,CAAC,GAAG,EAAE,OAAO,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;YAClD,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,EAAE,CAAC,GAAG,OAAO,CAAC,KAAK,CAAC,EAAE,QAAQ,EAAE,CAAC,GAAG,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC/E,CAAC;QAED,qCAAqC;QACrC,KAAK,MAAM,CAAC,GAAG,EAAE,OAAO,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;YACpD,IAAI,MAAM,CAAC,GAAG,CAAC,KAAK,SAAS,EAAE,CAAC;gBAC9B,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,EAAE,CAAC,GAAG,OAAO,CAAC,KAAK,CAAC,EAAE,QAAQ,EAAE,CAAC,GAAG,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC/E,CAAC;iBAAM,CAAC;gBACN,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC;gBACzC,MAAM,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;YACjD,CAAC;QACH,CAAC;QAED,OAAO,MAAM,CAAC;IAChB,CAAC;CACF"}
+{"version":3,"file":"technique-checker.js","sourceRoot":"","sources":["../../src/technique-checker.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAWxB,8EAA8E;AAC9E,wBAAwB;AACxB,8EAA8E;AAE9E,MAAM,gBAAgB,GAAsB;IAC1C,GAAG,EAAE;QACH,KAAK,EAAE,CAAC,QAAQ,EAAE,WAAW,EAAE,UAAU,EAAE,UAAU,CAAC;QACtD,QAAQ,EAAE,CAAC,OAAO,EAAE,KAAK,CAAC;KAC3B;IACD,WAAW,EAAE;QACX,KAAK,EAAE,EAAE;QACT,QAAQ,EAAE,CAAC,SAAS,EAAE,MAAM,EAAE,OAAO,CAAC;KACvC;IACD,kBAAkB,EAAE;QAClB,KAAK,EAAE,CAAC,SAAS,EAAE,WAAW,EAAE,UAAU,EAAE,WAAW,CAAC;QACxD,QAAQ,EAAE,EAAE;KACb;IACD,KAAK,EAAE;QACL,KAAK,EAAE;YACL,OAAO,EAAE,QAAQ,EAAE,aAAa,EAAE,MAAM,EAAE,OAAO;YACjD,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,SAAS;YACjD,YAAY,EAAE,WAAW,EAAE,SAAS,EAAE,aAAa,EAAE,QAAQ;YAC7D,MAAM,EAAE,WAAW;YACnB,OAAO,EAAE,SAAS,EAAE,aAAa,EAAE,WAAW,EAAE,YAAY;YAC5D,QAAQ,EAAE,YAAY,EAAE,YAAY;YACpC,oBAAoB;YACpB,oBAAoB,EAAE,gBAAgB,EAAE,cAAc;YACtD,iBAAiB;YACjB,WAAW,EAAE,UAAU,EAAE,mBAAmB,EAAE,gBAAgB;YAC9D,aAAa,EAAE,cAAc;YAC7B,4BAA4B;YAC5B,WAAW,EAAE,eAAe,EAAE,YAAY,EAAE,oBAAoB;YAChE,UAAU;YACV,kBAAkB;YAClB,iBAAiB;YACjB,gBAAgB,EAAE,eAAe,EAAE,mBAAmB,EAAE,YAAY;YACpE,sBAAsB,EAAE,qBAAqB,EAAE,yBAAyB;YACxE,2CAA2C;YAC3C,YAAY,EAAE,cAAc,EAAE,cAAc,EAAE,YAAY;YAC1D,cAAc;YACd,SAAS,EAAE,gBAAgB,EAAE,cAAc,EAAE,+BAA+B,EAAE,kBAAkB;YAChG,eAAe;YACf,UAAU,EAAE,eAAe;YAC3B,aAAa;YACb,QAAQ,EAAE,oBAAoB;YAC9B,YAAY;YACZ,OAAO,EAAE,UAAU;YACnB,cAAc;YACd,SAAS;YACT,0BAA0B;YAC1B,cAAc,EAAE,oBAAoB;SACrC;QACD,QAAQ,EAAE;YACR,iEAAiE;YACjE,OAAO;YACP,iEAAiE;YACjE,SAAS;SACV;KACF;IACD,OAAO,EAAE;QACP,KAAK,EAAE;YACL,QAAQ,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,OAAO;YACvD,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE,KAAK;YACxD,WAAW,EAAE,WAAW,EAAE,kBAAkB;YAC5C,6BAA6B;YAC7B,eAAe,EAAE,aAAa,EAAE,aAAa,EAAE,WAAW,EAAE,kBAAkB;YAC9E,iBAAiB;YACjB,oBAAoB,EAAE,iBAAiB;YACvC,wCAAwC;YACxC,YAAY;YACZ,eAAe;YACf,UAAU;YACV,2CAA2C;YAC3C,aAAa,EAAE,gBAAgB,EAAE,cAAc;SAChD;QACD,QAAQ,EAAE,EAAE;KACb;IACD,YAAY,EAAE;QACZ,KAAK,EAAE,CAAC,YAAY,EAAE,OAAO,EAAE,SAAS;YACtC,oBAAoB;YACpB,cAAc,EAAE,eAAe,EAAE,gBAAgB;YACjD,iBAAiB;YACjB,kBAAkB,EAAE,eAAe;YACnC,eAAe;YACf,cAAc;YACd,0CAA0C;YAC1C,QAAQ;SACT;QACD,QAAQ,EAAE,CAAC,MAAM,CAAC;KACnB;IACD,WAAW,EAAE;QACX,KAAK,EAAE,CAAC,SAAS,EAAE,YAAY,CAAC;QAChC,QAAQ,EAAE,EAAE;KACb;CACF,CAAC;AAEF,MAAM,uBAAuB,GAAG,CAAC,CAAC,MAAM,CACtC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EACjB,CAAC,CAAC,MAAM,CAAC;IACP,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IACtC,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;CAC1C,CAAC,CACH,CAAC;AAEF;;;;GAIG;AACH,MAAM,UAAU,qBAAqB,CAAC,QAAgB;IACpD,IAAI,GAAY,CAAC;IACjB,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC,CAAC;IACvD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,KAAK,CACb,oCAAoC,QAAQ,MAAM,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CACrG,CAAC;IACJ,CAAC;IACD,MAAM,MAAM,GAAG,uBAAuB,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;IACtD,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC9F,MAAM,IAAI,KAAK,CAAC,qBAAqB,QAAQ,iBAAiB,MAAM,EAAE,CAAC,CAAC;IAC1E,CAAC;IACD,OAAO,MAAM,CAAC,IAAI,CAAC;AACrB,CAAC;AAED,8EAA8E;AAC9E,yBAAyB;AACzB,8EAA8E;AAE9E,MAAM,OAAO,gBAAgB;IACV,QAAQ,CAAoB;IAE7C;;;;;OAKG;IACH,YAAY,cAAkC;QAC5C,IAAI,CAAC,QAAQ,GAAG,gBAAgB,CAAC,aAAa,CAAC,gBAAgB,EAAE,cAAc,IAAI,EAAE,CAAC,CAAC;IACzF,CAAC;IAED,4EAA4E;IAC5E,aAAa;IACb,4EAA4E;IAE5E;;;OAGG;IACH,WAAW,CAAC,QAAgB;QAC1B,IAAI,QAAQ,KAAK,EAAE;YAAE,OAAO,IAAI,CAAC;QAEjC,MAAM,KAAK,GAAG,QAAQ,CAAC,WAAW,EAAE,CAAC;QAErC,KAAK,MAAM,CAAC,QAAQ,EAAE,OAAO,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;YAChE,uDAAuD;YACvD,IAAI,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,WAAW,EAAE,KAAK,KAAK,CAAC,EAAE,CAAC;gBAC/D,OAAO,QAAQ,CAAC;YAClB,CAAC;YAED,mBAAmB;YACnB,IAAI,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,gBAAgB,CAAC,cAAc,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC,EAAE,CAAC;gBACxF,OAAO,QAAQ,CAAC;YAClB,CAAC;QACH,CAAC;QAED,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;;;OAIG;IACH,SAAS,CAAC,QAAgB,EAAE,kBAA4B;QACtD,IAAI,kBAAkB,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,KAAK,CAAC;QAElD,MAAM,QAAQ,GAAG,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC;QAC5C,IAAI,QAAQ,KAAK,IAAI;YAAE,OAAO,KAAK,CAAC;QAEpC,OAAO,kBAAkB,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IAC/C,CAAC;IAED,4EAA4E;IAC5E,kBAAkB;IAClB,4EAA4E;IAE5E;;;;;;OAMG;IACK,MAAM,CAAC,cAAc,CAAC,aAAqB,EAAE,OAAe;QAClE,MAAM,CAAC,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC;QAChC,IAAI,CAAC,KAAK,EAAE;YAAE,OAAO,KAAK,CAAC;QAC3B,IAAI,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;YACxB,OAAO,aAAa,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;QACnC,CAAC;QACD,OAAO,aAAa;aACjB,KAAK,CAAC,YAAY,CAAC;aACnB,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,KAAK,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;IACpD,CAAC;IAED;;;;OAIG;IACK,MAAM,CAAC,aAAa,CAC1B,IAAuB,EACvB,MAAyB;QAEzB,iBAAiB;QACjB,MAAM,MAAM,GAAsB,EAAE,CAAC;QACrC,KAAK,MAAM,CAAC,GAAG,EAAE,OAAO,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;YAClD,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,EAAE,CAAC,GAAG,OAAO,CAAC,KAAK,CAAC,EAAE,QAAQ,EAAE,CAAC,GAAG,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC/E,CAAC;QAED,qCAAqC;QACrC,KAAK,MAAM,CAAC,GAAG,EAAE,OAAO,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;YACpD,IAAI,MAAM,CAAC,GAAG,CAAC,KAAK,SAAS,EAAE,CAAC;gBAC9B,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,EAAE,CAAC,GAAG,OAAO,CAAC,KAAK,CAAC,EAAE,QAAQ,EAAE,CAAC,GAAG,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC/E,CAAC;iBAAM,CAAC;gBACN,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC;gBACzC,MAAM,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;YACjD,CAAC;QACH,CAAC;QAED,OAAO,MAAM,CAAC;IAChB,CAAC;CACF"}

package/dist/src/transports/http.d.ts

@@ -1,3 +1,7 @@
-import type { ScopeEnforcementProxy } from "../proxy.js";
-export declare function runHttpProxy(proxy: ScopeEnforcementProxy, upstreamUrl: string, port: number): Promise<void>;
+import { type IncomingMessage } from "http";
+import { ScopeEnforcementProxy } from "../proxy.js";
+/** Accept only origin-form request targets, never an absolute or // URL. */
+export declare function resolveUpstreamUrl(requestTarget: string, upstreamUrl: string): URL;
+export declare function runHttpProxy(proxy: ScopeEnforcementProxy, upstreamUrl: string, port: number, host?: string, authToken?: string): Promise<void>;
+export declare function hasValidProxyToken(req: IncomingMessage, expected?: string): boolean;
 //# sourceMappingURL=http.d.ts.map

package/dist/src/transports/http.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"http.d.ts","sourceRoot":"","sources":["../../../src/transports/http.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAC;AAEzD,wBAAsB,YAAY,CAChC,KAAK,EAAE,qBAAqB,EAC5B,WAAW,EAAE,MAAM,EACnB,IAAI,EAAE,MAAM,GACX,OAAO,CAAC,IAAI,CAAC,CAwCf"}
+{"version":3,"file":"http.d.ts","sourceRoot":"","sources":["../../../src/transports/http.ts"],"names":[],"mappings":"AAAA,OAAO,EAAgB,KAAK,eAAe,EAAuB,MAAM,MAAM,CAAC;AAG/E,OAAO,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAC;AAIpD,4EAA4E;AAC5E,wBAAgB,kBAAkB,CAAC,aAAa,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,GAAG,CAUlF;AAED,wBAAsB,YAAY,CAChC,KAAK,EAAE,qBAAqB,EAC5B,WAAW,EAAE,MAAM,EACnB,IAAI,EAAE,MAAM,EACZ,IAAI,SAAc,EAClB,SAAS,CAAC,EAAE,MAAM,GACjB,OAAO,CAAC,IAAI,CAAC,CA+Ef;AAMD,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,eAAe,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,OAAO,CAOnF"}

package/dist/src/transports/http.js

@@ -1,26 +1,82 @@
 import { createServer } from "http";
-export async function runHttpProxy(proxy, upstreamUrl, port) {
+import { Readable } from "node:stream";
+import { timingSafeEqual } from "node:crypto";
+import { ScopeEnforcementProxy } from "../proxy.js";
+const MAX_REQUEST_BYTES = 1024 * 1024;
+/** Accept only origin-form request targets, never an absolute or // URL. */
+export function resolveUpstreamUrl(requestTarget, upstreamUrl) {
+    if (!requestTarget.startsWith("/") || requestTarget.startsWith("//")) {
+        throw new Error("Only origin-form request paths are accepted");
+    }
+    const upstream = new URL(upstreamUrl);
+    const destination = new URL(requestTarget, upstream);
+    if (destination.origin !== upstream.origin) {
+        throw new Error("Request path cannot change the upstream origin");
+    }
+    return destination;
+}
+export async function runHttpProxy(proxy, upstreamUrl, port, host = "127.0.0.1", authToken) {
+    if (!isLoopback(host) && !authToken) {
+        throw new Error("PROXY_AUTH_TOKEN is required when PROXY_HOST is not loopback");
+    }
     const auditLogger = proxy.getAuditLogger();
     auditLogger.start();
     const server = createServer(async (req, res) => {
-        const body = await readBody(req);
+        if (req.url === "/healthz" && req.method === "GET") {
+            res.writeHead(200, { "Content-Type": "application/json" });
+            res.end('{"status":"ok"}');
+            return;
+        }
+        if (!hasValidProxyToken(req, authToken)) {
+            res.writeHead(401, { "Content-Type": "application/json" });
+            res.end('{"error":"Unauthorized"}');
+            return;
+        }
+        let body;
+        try {
+            resolveUpstreamUrl(req.url ?? "/", upstreamUrl);
+            body = await readBody(req);
+        }
+        catch (err) {
+            const oversized = err instanceof Error && err.message === "Request body too large";
+            res.writeHead(oversized ? 413 : 400, { "Content-Type": "application/json" });
+            res.end(JSON.stringify({ error: oversized ? "Request body too large" : "Invalid request target" }));
+            return;
+        }
+        // Bodiless requests (GET for the SSE stream, DELETE to end a session)
+        // carry no tool call and pass straight through.
+        if (body.trim() === "") {
+            return forwardRaw(upstreamUrl, req, body, res);
+        }
         let message;
         try {
             message = JSON.parse(body);
         }
         catch {
-            return forwardRaw(upstreamUrl, req, body, res);
+            // Never forward a body we could not inspect — fail closed.
+            res.writeHead(400, { "Content-Type": "application/json" });
+            res.end(JSON.stringify(ScopeEnforcementProxy.parseErrorResponse()));
+            return;
         }
-        const { forward, response } = await proxy.handleMessage(message);
-        if (!forward && response) {
+        let forward;
+        let response;
+        try {
+            ({ forward, response } = await proxy.handleMessage(message));
+        }
+        catch (err) {
+            res.writeHead(500, { "Content-Type": "application/json" });
+            res.end(JSON.stringify({ error: `Scope proxy error: ${err.message}` }));
+            return;
+        }
+        if (!forward) {
             res.writeHead(200, { "Content-Type": "application/json" });
-            res.end(JSON.stringify(response));
+            res.end(JSON.stringify(response ?? null));
             return;
         }
-        return forwardRaw(upstreamUrl, req, body, res);
+        return forwardRaw(upstreamUrl, req, JSON.stringify(message), res);
     });
-    server.listen(port, () => {
-        console.error(`[integsec-agentic-pentest-proxy] HTTP proxy listening on port ${port}, forwarding to ${upstreamUrl}`);
+    server.listen(port, host, () => {
+        console.error(`[integsec-agentic-pentest-proxy] HTTP proxy listening on ${host}:${port}, forwarding to ${upstreamUrl}`);
     });
     process.on("SIGINT", async () => {
         await auditLogger.stop();
@@ -33,31 +89,63 @@ export async function runHttpProxy(proxy, upstreamUrl, port) {
         process.exit(0);
     });
 }
+function isLoopback(host) {
+    return host === "127.0.0.1" || host === "localhost" || host === "::1";
+}
+export function hasValidProxyToken(req, expected) {
+    if (!expected)
+        return true;
+    const supplied = req.headers["x-proxy-token"];
+    if (typeof supplied !== "string")
+        return false;
+    const left = Buffer.from(supplied);
+    const right = Buffer.from(expected);
+    return left.length === right.length && timingSafeEqual(left, right);
+}
 function readBody(req) {
     return new Promise((resolve, reject) => {
         const chunks = [];
-        req.on("data", (chunk) => chunks.push(chunk));
+        let size = 0;
+        req.on("data", (chunk) => {
+            size += chunk.length;
+            if (size > MAX_REQUEST_BYTES) {
+                req.pause();
+                reject(new Error("Request body too large"));
+            }
+            else {
+                chunks.push(chunk);
+            }
+        });
         req.on("end", () => resolve(Buffer.concat(chunks).toString("utf-8")));
         req.on("error", reject);
     });
 }
 async function forwardRaw(upstreamUrl, originalReq, body, clientRes) {
     try {
-        const url = new URL(originalReq.url ?? "/", upstreamUrl);
+        const url = resolveUpstreamUrl(originalReq.url ?? "/", upstreamUrl);
         const headers = {};
         for (const [key, value] of Object.entries(originalReq.headers)) {
             if (typeof value === "string")
                 headers[key] = value;
         }
         delete headers.host;
+        delete headers["x-proxy-token"];
+        delete headers.connection;
+        delete headers["content-length"];
+        delete headers["transfer-encoding"];
+        headers["accept-encoding"] = "identity"; // disable compression — Node fetch re-adds br/gzip otherwise
         const resp = await fetch(url.toString(), {
             method: originalReq.method ?? "POST",
             headers,
             body: originalReq.method !== "GET" ? body : undefined,
         });
         clientRes.writeHead(resp.status, Object.fromEntries(resp.headers.entries()));
-        const respBody = await resp.text();
-        clientRes.end(respBody);
+        if (resp.body) {
+            Readable.fromWeb(resp.body).pipe(clientRes);
+        }
+        else {
+            clientRes.end();
+        }
     }
     catch (err) {
         clientRes.writeHead(502, { "Content-Type": "application/json" });

package/dist/src/transports/http.js.map

@@ -1 +1 @@
-{"version":3,"file":"http.js","sourceRoot":"","sources":["../../../src/transports/http.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAA6C,MAAM,MAAM,CAAC;AAG/E,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,KAA4B,EAC5B,WAAmB,EACnB,IAAY;IAEZ,MAAM,WAAW,GAAG,KAAK,CAAC,cAAc,EAAE,CAAC;IAC3C,WAAW,CAAC,KAAK,EAAE,CAAC;IAEpB,MAAM,MAAM,GAAG,YAAY,CAAC,KAAK,EAAE,GAAoB,EAAE,GAAmB,EAAE,EAAE;QAC9E,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,GAAG,CAAC,CAAC;QAEjC,IAAI,OAAgB,CAAC;QACrB,IAAI,CAAC;YACH,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAC7B,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,UAAU,CAAC,WAAW,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;QACjD,CAAC;QAED,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,GAAG,MAAM,KAAK,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC;QAEjE,IAAI,CAAC,OAAO,IAAI,QAAQ,EAAE,CAAC;YACzB,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC;YAC3D,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,CAAC;YAClC,OAAO;QACT,CAAC;QAED,OAAO,UAAU,CAAC,WAAW,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;IACjD,CAAC,CAAC,CAAC;IAEH,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,GAAG,EAAE;QACvB,OAAO,CAAC,KAAK,CAAC,iEAAiE,IAAI,mBAAmB,WAAW,EAAE,CAAC,CAAC;IACvH,CAAC,CAAC,CAAC;IAEH,OAAO,CAAC,EAAE,CAAC,QAAQ,EAAE,KAAK,IAAI,EAAE;QAC9B,MAAM,WAAW,CAAC,IAAI,EAAE,CAAC;QACzB,MAAM,CAAC,KAAK,EAAE,CAAC;QACf,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC,CAAC,CAAC;IAEH,OAAO,CAAC,EAAE,CAAC,SAAS,EAAE,KAAK,IAAI,EAAE;QAC/B,MAAM,WAAW,CAAC,IAAI,EAAE,CAAC;QACzB,MAAM,CAAC,KAAK,EAAE,CAAC;QACf,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,QAAQ,CAAC,GAAoB;IACpC,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,MAAM,MAAM,GAAa,EAAE,CAAC;QAC5B,GAAG,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;QACtD,GAAG,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;QACtE,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IAC1B,CAAC,CAAC,CAAC;AACL,CAAC;AAED,KAAK,UAAU,UAAU,CACvB,WAAmB,EACnB,WAA4B,EAC5B,IAAY,EACZ,SAAyB;IAEzB,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,GAAG,IAAI,GAAG,EAAE,WAAW,CAAC,CAAC;QACzD,MAAM,OAAO,GAA2B,EAAE,CAAC;QAC3C,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,WAAW,CAAC,OAAO,CAAC,EAAE,CAAC;YAC/D,IAAI,OAAO,KAAK,KAAK,QAAQ;gBAAE,OAAO,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;QACtD,CAAC;QACD,OAAO,OAAO,CAAC,IAAI,CAAC;QAEpB,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,QAAQ,EAAE,EAAE;YACvC,MAAM,EAAE,WAAW,CAAC,MAAM,IAAI,MAAM;YACpC,OAAO;YACP,IAAI,EAAE,WAAW,CAAC,MAAM,KAAK,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS;SACtD,CAAC,CAAC;QAEH,SAAS,CAAC,SAAS,CAAC,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC,WAAW,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;QAC7E,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC;QACnC,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IAC1B,CAAC;IAAC,OAAO,GAAQ,EAAE,CAAC;QAClB,SAAS,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC;QACjE,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,mBAAmB,GAAG,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC;IAC7E,CAAC;AACH,CAAC"}
+{"version":3,"file":"http.js","sourceRoot":"","sources":["../../../src/transports/http.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAA6C,MAAM,MAAM,CAAC;AAC/E,OAAO,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AACvC,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAC9C,OAAO,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAC;AAEpD,MAAM,iBAAiB,GAAG,IAAI,GAAG,IAAI,CAAC;AAEtC,4EAA4E;AAC5E,MAAM,UAAU,kBAAkB,CAAC,aAAqB,EAAE,WAAmB;IAC3E,IAAI,CAAC,aAAa,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,aAAa,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;QACrE,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAC;IACjE,CAAC;IACD,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,CAAC;IACtC,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,aAAa,EAAE,QAAQ,CAAC,CAAC;IACrD,IAAI,WAAW,CAAC,MAAM,KAAK,QAAQ,CAAC,MAAM,EAAE,CAAC;QAC3C,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAC;IACpE,CAAC;IACD,OAAO,WAAW,CAAC;AACrB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,KAA4B,EAC5B,WAAmB,EACnB,IAAY,EACZ,IAAI,GAAG,WAAW,EAClB,SAAkB;IAElB,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;QACpC,MAAM,IAAI,KAAK,CAAC,8DAA8D,CAAC,CAAC;IAClF,CAAC;IACD,MAAM,WAAW,GAAG,KAAK,CAAC,cAAc,EAAE,CAAC;IAC3C,WAAW,CAAC,KAAK,EAAE,CAAC;IAEpB,MAAM,MAAM,GAAG,YAAY,CAAC,KAAK,EAAE,GAAoB,EAAE,GAAmB,EAAE,EAAE;QAC9E,IAAI,GAAG,CAAC,GAAG,KAAK,UAAU,IAAI,GAAG,CAAC,MAAM,KAAK,KAAK,EAAE,CAAC;YACnD,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC;YAC3D,GAAG,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC;YAC3B,OAAO;QACT,CAAC;QACD,IAAI,CAAC,kBAAkB,CAAC,GAAG,EAAE,SAAS,CAAC,EAAE,CAAC;YACxC,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC;YAC3D,GAAG,CAAC,GAAG,CAAC,0BAA0B,CAAC,CAAC;YACpC,OAAO;QACT,CAAC;QACD,IAAI,IAAY,CAAC;QACjB,IAAI,CAAC;YACH,kBAAkB,CAAC,GAAG,CAAC,GAAG,IAAI,GAAG,EAAE,WAAW,CAAC,CAAC;YAChD,IAAI,GAAG,MAAM,QAAQ,CAAC,GAAG,CAAC,CAAC;QAC7B,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,SAAS,GAAG,GAAG,YAAY,KAAK,IAAI,GAAG,CAAC,OAAO,KAAK,wBAAwB,CAAC;YACnF,GAAG,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC;YAC7E,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,SAAS,CAAC,CAAC,CAAC,wBAAwB,CAAC,CAAC,CAAC,wBAAwB,EAAE,CAAC,CAAC,CAAC;YACpG,OAAO;QACT,CAAC;QAED,sEAAsE;QACtE,gDAAgD;QAChD,IAAI,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;YACvB,OAAO,UAAU,CAAC,WAAW,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;QACjD,CAAC;QAED,IAAI,OAAgB,CAAC;QACrB,IAAI,CAAC;YACH,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAC7B,CAAC;QAAC,MAAM,CAAC;YACP,2DAA2D;YAC3D,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC;YAC3D,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,qBAAqB,CAAC,kBAAkB,EAAE,CAAC,CAAC,CAAC;YACpE,OAAO;QACT,CAAC;QAED,IAAI,OAAgB,CAAC;QACrB,IAAI,QAAiB,CAAC;QACtB,IAAI,CAAC;YACH,CAAC,EAAE,OAAO,EAAE,QAAQ,EAAE,GAAG,MAAM,KAAK,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC,CAAC;QAC/D,CAAC;QAAC,OAAO,GAAQ,EAAE,CAAC;YAClB,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC;YAC3D,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,sBAAsB,GAAG,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC;YACxE,OAAO;QACT,CAAC;QAED,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC;YAC3D,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,QAAQ,IAAI,IAAI,CAAC,CAAC,CAAC;YAC1C,OAAO;QACT,CAAC;QAED,OAAO,UAAU,CAAC,WAAW,EAAE,GAAG,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,GAAG,CAAC,CAAC;IACpE,CAAC,CAAC,CAAC;IAEH,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,EAAE,GAAG,EAAE;QAC7B,OAAO,CAAC,KAAK,CAAC,4DAA4D,IAAI,IAAI,IAAI,mBAAmB,WAAW,EAAE,CAAC,CAAC;IAC1H,CAAC,CAAC,CAAC;IAEH,OAAO,CAAC,EAAE,CAAC,QAAQ,EAAE,KAAK,IAAI,EAAE;QAC9B,MAAM,WAAW,CAAC,IAAI,EAAE,CAAC;QACzB,MAAM,CAAC,KAAK,EAAE,CAAC;QACf,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC,CAAC,CAAC;IAEH,OAAO,CAAC,EAAE,CAAC,SAAS,EAAE,KAAK,IAAI,EAAE;QAC/B,MAAM,WAAW,CAAC,IAAI,EAAE,CAAC;QACzB,MAAM,CAAC,KAAK,EAAE,CAAC;QACf,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,UAAU,CAAC,IAAY;IAC9B,OAAO,IAAI,KAAK,WAAW,IAAI,IAAI,KAAK,WAAW,IAAI,IAAI,KAAK,KAAK,CAAC;AACxE,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,GAAoB,EAAE,QAAiB;IACxE,IAAI,CAAC,QAAQ;QAAE,OAAO,IAAI,CAAC;IAC3B,MAAM,QAAQ,GAAG,GAAG,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC;IAC9C,IAAI,OAAO,QAAQ,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC/C,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACnC,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACpC,OAAO,IAAI,CAAC,MAAM,KAAK,KAAK,CAAC,MAAM,IAAI,eAAe,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;AACtE,CAAC;AAED,SAAS,QAAQ,CAAC,GAAoB;IACpC,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,MAAM,MAAM,GAAa,EAAE,CAAC;QAC5B,IAAI,IAAI,GAAG,CAAC,CAAC;QACb,GAAG,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE;YAC/B,IAAI,IAAI,KAAK,CAAC,MAAM,CAAC;YACrB,IAAI,IAAI,GAAG,iBAAiB,EAAE,CAAC;gBAC7B,GAAG,CAAC,KAAK,EAAE,CAAC;gBACZ,MAAM,CAAC,IAAI,KAAK,CAAC,wBAAwB,CAAC,CAAC,CAAC;YAC9C,CAAC;iBAAM,CAAC;gBACN,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACrB,CAAC;QACH,CAAC,CAAC,CAAC;QACH,GAAG,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;QACtE,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IAC1B,CAAC,CAAC,CAAC;AACL,CAAC;AAED,KAAK,UAAU,UAAU,CACvB,WAAmB,EACnB,WAA4B,EAC5B,IAAY,EACZ,SAAyB;IAEzB,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,kBAAkB,CAAC,WAAW,CAAC,GAAG,IAAI,GAAG,EAAE,WAAW,CAAC,CAAC;QACpE,MAAM,OAAO,GAA2B,EAAE,CAAC;QAC3C,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,WAAW,CAAC,OAAO,CAAC,EAAE,CAAC;YAC/D,IAAI,OAAO,KAAK,KAAK,QAAQ;gBAAE,OAAO,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;QACtD,CAAC;QACD,OAAO,OAAO,CAAC,IAAI,CAAC;QACpB,OAAO,OAAO,CAAC,eAAe,CAAC,CAAC;QAChC,OAAO,OAAO,CAAC,UAAU,CAAC;QAC1B,OAAO,OAAO,CAAC,gBAAgB,CAAC,CAAC;QACjC,OAAO,OAAO,CAAC,mBAAmB,CAAC,CAAC;QACpC,OAAO,CAAC,iBAAiB,CAAC,GAAG,UAAU,CAAC,CAAC,6DAA6D;QAEtG,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,QAAQ,EAAE,EAAE;YACvC,MAAM,EAAE,WAAW,CAAC,MAAM,IAAI,MAAM;YACpC,OAAO;YACP,IAAI,EAAE,WAAW,CAAC,MAAM,KAAK,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS;SACtD,CAAC,CAAC;QAEH,SAAS,CAAC,SAAS,CAAC,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC,WAAW,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;QAC7E,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;YACd,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,IAAW,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACrD,CAAC;aAAM,CAAC;YACN,SAAS,CAAC,GAAG,EAAE,CAAC;QAClB,CAAC;IACH,CAAC;IAAC,OAAO,GAAQ,EAAE,CAAC;QAClB,SAAS,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC;QACjE,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,mBAAmB,GAAG,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC;IAC7E,CAAC;AACH,CAAC"}

package/dist/src/transports/sse.d.ts

@@ -1,4 +1,4 @@
-import type { ScopeEnforcementProxy } from "../proxy.js";
+import { ScopeEnforcementProxy } from "../proxy.js";
 /**
  * SSE transport — connects to an upstream MCP server via SSE protocol.
  *

package/dist/src/transports/sse.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sse.d.ts","sourceRoot":"","sources":["../../../src/transports/sse.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAC;AAEzD;;;;;;;;;GASG;AACH,wBAAsB,WAAW,CAC/B,KAAK,EAAE,qBAAqB,EAC5B,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,IAAI,CAAC,CAqJf"}
+{"version":3,"file":"sse.d.ts","sourceRoot":"","sources":["../../../src/transports/sse.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAC;AAEpD;;;;;;;;;GASG;AACH,wBAAsB,WAAW,CAC/B,KAAK,EAAE,qBAAqB,EAC5B,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,IAAI,CAAC,CA6Jf"}

package/dist/src/transports/sse.js

@@ -1,4 +1,5 @@
 import { createInterface } from "readline";
+import { ScopeEnforcementProxy } from "../proxy.js";
 /**
  * SSE transport — connects to an upstream MCP server via SSE protocol.
  *
@@ -106,19 +107,38 @@ export async function runSseProxy(proxy, upstreamUrl) {
     console.error(`${TAG} POST endpoint: ${postUrl}`);
     const agentInput = createInterface({ input: process.stdin, crlfDelay: Infinity });
     agentInput.on("line", async (line) => {
+        if (line.trim() === "")
+            return;
+        let message;
         try {
-            const message = JSON.parse(line);
-            const { forward, response } = await proxy.handleMessage(message);
-            if (!forward && response) {
-                // Blocked — return error to agent
+            message = JSON.parse(line);
+        }
+        catch {
+            // Never forward what we could not inspect — fail closed.
+            process.stdout.write(JSON.stringify(ScopeEnforcementProxy.parseErrorResponse()) + "\n");
+            return;
+        }
+        let forward;
+        let response;
+        try {
+            ({ forward, response } = await proxy.handleMessage(message));
+        }
+        catch (err) {
+            console.error(`${TAG} Dropped message after proxy error: ${err.message}`);
+            return;
+        }
+        if (!forward) {
+            // Blocked — return error to agent
+            if (response)
                 process.stdout.write(JSON.stringify(response) + "\n");
-                return;
-            }
+            return;
+        }
+        try {
             // Forward to upstream via HTTP POST
             const resp = await fetch(postUrl, {
                 method: "POST",
                 headers: { "Content-Type": "application/json" },
-                body: line,
+                body: JSON.stringify(message),
             });
             if (!resp.ok) {
                 console.error(`${TAG} Upstream POST failed: ${resp.status} ${resp.statusText}`);
@@ -126,17 +146,7 @@ export async function runSseProxy(proxy, upstreamUrl) {
             // Response comes back via SSE stream, not the POST response
         }
         catch (err) {
-            // Malformed JSON or network error — try to forward anyway
-            try {
-                await fetch(postUrl, {
-                    method: "POST",
-                    headers: { "Content-Type": "application/json" },
-                    body: line,
-                });
-            }
-            catch {
-                console.error(`${TAG} Failed to forward message: ${err.message}`);
-            }
+            console.error(`${TAG} Failed to forward message: ${err.message}`);
         }
     });
     // Cleanup

package/dist/src/transports/sse.js.map

@@ -1 +1 @@
-{"version":3,"file":"sse.js","sourceRoot":"","sources":["../../../src/transports/sse.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,UAAU,CAAC;AAG3C;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,KAA4B,EAC5B,WAAmB;IAEnB,MAAM,WAAW,GAAG,KAAK,CAAC,cAAc,EAAE,CAAC;IAC3C,WAAW,CAAC,KAAK,EAAE,CAAC;IAEpB,MAAM,GAAG,GAAG,kCAAkC,CAAC;IAE/C,qDAAqD;IACrD,OAAO,CAAC,KAAK,CAAC,GAAG,GAAG,kCAAkC,WAAW,KAAK,CAAC,CAAC;IAExE,IAAI,eAAmC,CAAC;IACxC,IAAI,kBAAkB,GAAG,IAAI,eAAe,EAAE,CAAC;IAE/C,KAAK,UAAU,UAAU;QACvB,OAAO,IAAI,OAAO,CAAS,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,EAAE;YACnD,IAAI,CAAC;gBACH,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,WAAW,EAAE;oBACpC,OAAO,EAAE,EAAE,MAAM,EAAE,mBAAmB,EAAE;oBACxC,MAAM,EAAE,kBAAkB,CAAC,MAAM;iBAClC,CAAC,CAAC;gBAEH,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;oBACb,MAAM,CAAC,IAAI,KAAK,CAAC,0BAA0B,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC;oBAC9E,OAAO;gBACT,CAAC;gBAED,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;oBACf,MAAM,CAAC,IAAI,KAAK,CAAC,0BAA0B,CAAC,CAAC,CAAC;oBAC9C,OAAO;gBACT,CAAC;gBAED,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;gBACrC,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAC;gBAClC,IAAI,MAAM,GAAG,EAAE,CAAC;gBAChB,IAAI,YAAY,GAAG,EAAE,CAAC;gBACtB,IAAI,QAAQ,GAAG,KAAK,CAAC;gBAErB,gCAAgC;gBAChC,CAAC,KAAK,IAAI,EAAE;oBACV,IAAI,CAAC;wBACH,OAAO,IAAI,EAAE,CAAC;4BACZ,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;4BAC5C,IAAI,IAAI;gCAAE,MAAM;4BAEhB,MAAM,IAAI,OAAO,CAAC,MAAM,CAAC,KAAK,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;4BAClD,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;4BACjC,MAAM,GAAG,KAAK,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC;4BAE3B,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;gCACzB,IAAI,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;oCAC/B,YAAY,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;gCACtC,CAAC;qCAAM,IAAI,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;oCACrC,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;oCAE3B,IAAI,YAAY,KAAK,UAAU,IAAI,CAAC,QAAQ,EAAE,CAAC;wCAC7C,gCAAgC;wCAChC,QAAQ,GAAG,IAAI,CAAC;wCAChB,OAAO,CAAC,IAAI,CAAC,CAAC;oCAChB,CAAC;yCAAM,IAAI,YAAY,KAAK,SAAS,EAAE,CAAC;wCACtC,gEAAgE;wCAChE,+CAA+C;wCAC/C,IAAI,CAAC,KAAK,CAAC,aAAa,EAAE,EAAE,CAAC;4CAC3B,IAAI,CAAC;gDACH,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;gDAC7B,MAAM,IAAI,GAAG,GAAG,EAAE,MAAM,EAAE,UAAU,EAAE,IAAI,CAAC;gDAC3C,IAAI,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;oDACrC,KAAK,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC;oDAC1B,OAAO,CAAC,KAAK,CAAC,GAAG,GAAG,qBAAqB,IAAI,EAAE,CAAC,CAAC;gDACnD,CAAC;4CACH,CAAC;4CAAC,MAAM,CAAC;gDACP,yBAAyB;4CAC3B,CAAC;wCACH,CAAC;wCACD,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,GAAG,IAAI,CAAC,CAAC;oCACpC,CAAC;oCACD,YAAY,GAAG,EAAE,CAAC;gCACpB,CAAC;4BACH,CAAC;wBACH,CAAC;oBACH,CAAC;oBAAC,OAAO,GAAQ,EAAE,CAAC;wBAClB,IAAI,GAAG,CAAC,IAAI,KAAK,YAAY,EAAE,CAAC;4BAC9B,OAAO,CAAC,KAAK,CAAC,GAAG,GAAG,sBAAsB,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;wBAC3D,CAAC;oBACH,CAAC;gBACH,CAAC,CAAC,EAAE,CAAC;YACP,CAAC;YAAC,OAAO,GAAQ,EAAE,CAAC;gBAClB,MAAM,CAAC,GAAG,CAAC,CAAC;YACd,CAAC;QACH,CAAC,CAAC,CAAC;IACL,CAAC;IAED,IAAI,CAAC;QACH,eAAe,GAAG,MAAM,UAAU,EAAE,CAAC;QACrC,OAAO,CAAC,KAAK,CAAC,GAAG,GAAG,4BAA4B,eAAe,EAAE,CAAC,CAAC;IACrE,CAAC;IAAC,OAAO,GAAQ,EAAE,CAAC;QAClB,OAAO,CAAC,KAAK,CAAC,GAAG,GAAG,uCAAuC,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;QAC1E,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,qEAAqE;IACrE,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,eAAe,EAAE,WAAW,CAAC,CAAC,QAAQ,EAAE,CAAC;IACjE,OAAO,CAAC,KAAK,CAAC,GAAG,GAAG,mBAAmB,OAAO,EAAE,CAAC,CAAC;IAElD,MAAM,UAAU,GAAG,eAAe,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,SAAS,EAAE,QAAQ,EAAE,CAAC,CAAC;IAElF,UAAU,CAAC,EAAE,CAAC,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE;QACnC,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YACjC,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,GAAG,MAAM,KAAK,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC;YAEjE,IAAI,CAAC,OAAO,IAAI,QAAQ,EAAE,CAAC;gBACzB,kCAAkC;gBAClC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,GAAG,IAAI,CAAC,CAAC;gBACtD,OAAO;YACT,CAAC;YAED,oCAAoC;YACpC,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,OAAO,EAAE;gBAChC,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;gBAC/C,IAAI,EAAE,IAAI;aACX,CAAC,CAAC;YAEH,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;gBACb,OAAO,CAAC,KAAK,CAAC,GAAG,GAAG,0BAA0B,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC,CAAC;YAClF,CAAC;YACD,4DAA4D;QAC9D,CAAC;QAAC,OAAO,GAAQ,EAAE,CAAC;YAClB,0DAA0D;YAC1D,IAAI,CAAC;gBACH,MAAM,KAAK,CAAC,OAAO,EAAE;oBACnB,MAAM,EAAE,MAAM;oBACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;oBAC/C,IAAI,EAAE,IAAI;iBACX,CAAC,CAAC;YACL,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,CAAC,KAAK,CAAC,GAAG,GAAG,+BAA+B,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;YACpE,CAAC;QACH,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,UAAU;IACV,MAAM,OAAO,GAAG,KAAK,IAAI,EAAE;QACzB,kBAAkB,CAAC,KAAK,EAAE,CAAC;QAC3B,MAAM,WAAW,CAAC,IAAI,EAAE,CAAC;QACzB,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC,CAAC;IAEF,OAAO,CAAC,EAAE,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IAC9B,OAAO,CAAC,EAAE,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;AACjC,CAAC"}
+{"version":3,"file":"sse.js","sourceRoot":"","sources":["../../../src/transports/sse.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,UAAU,CAAC;AAC3C,OAAO,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAC;AAEpD;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,KAA4B,EAC5B,WAAmB;IAEnB,MAAM,WAAW,GAAG,KAAK,CAAC,cAAc,EAAE,CAAC;IAC3C,WAAW,CAAC,KAAK,EAAE,CAAC;IAEpB,MAAM,GAAG,GAAG,kCAAkC,CAAC;IAE/C,qDAAqD;IACrD,OAAO,CAAC,KAAK,CAAC,GAAG,GAAG,kCAAkC,WAAW,KAAK,CAAC,CAAC;IAExE,IAAI,eAAmC,CAAC;IACxC,IAAI,kBAAkB,GAAG,IAAI,eAAe,EAAE,CAAC;IAE/C,KAAK,UAAU,UAAU;QACvB,OAAO,IAAI,OAAO,CAAS,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,EAAE;YACnD,IAAI,CAAC;gBACH,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,WAAW,EAAE;oBACpC,OAAO,EAAE,EAAE,MAAM,EAAE,mBAAmB,EAAE;oBACxC,MAAM,EAAE,kBAAkB,CAAC,MAAM;iBAClC,CAAC,CAAC;gBAEH,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;oBACb,MAAM,CAAC,IAAI,KAAK,CAAC,0BAA0B,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC;oBAC9E,OAAO;gBACT,CAAC;gBAED,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;oBACf,MAAM,CAAC,IAAI,KAAK,CAAC,0BAA0B,CAAC,CAAC,CAAC;oBAC9C,OAAO;gBACT,CAAC;gBAED,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;gBACrC,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAC;gBAClC,IAAI,MAAM,GAAG,EAAE,CAAC;gBAChB,IAAI,YAAY,GAAG,EAAE,CAAC;gBACtB,IAAI,QAAQ,GAAG,KAAK,CAAC;gBAErB,gCAAgC;gBAChC,CAAC,KAAK,IAAI,EAAE;oBACV,IAAI,CAAC;wBACH,OAAO,IAAI,EAAE,CAAC;4BACZ,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;4BAC5C,IAAI,IAAI;gCAAE,MAAM;4BAEhB,MAAM,IAAI,OAAO,CAAC,MAAM,CAAC,KAAK,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;4BAClD,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;4BACjC,MAAM,GAAG,KAAK,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC;4BAE3B,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;gCACzB,IAAI,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;oCAC/B,YAAY,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;gCACtC,CAAC;qCAAM,IAAI,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;oCACrC,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;oCAE3B,IAAI,YAAY,KAAK,UAAU,IAAI,CAAC,QAAQ,EAAE,CAAC;wCAC7C,gCAAgC;wCAChC,QAAQ,GAAG,IAAI,CAAC;wCAChB,OAAO,CAAC,IAAI,CAAC,CAAC;oCAChB,CAAC;yCAAM,IAAI,YAAY,KAAK,SAAS,EAAE,CAAC;wCACtC,gEAAgE;wCAChE,+CAA+C;wCAC/C,IAAI,CAAC,KAAK,CAAC,aAAa,EAAE,EAAE,CAAC;4CAC3B,IAAI,CAAC;gDACH,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;gDAC7B,MAAM,IAAI,GAAG,GAAG,EAAE,MAAM,EAAE,UAAU,EAAE,IAAI,CAAC;gDAC3C,IAAI,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;oDACrC,KAAK,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC;oDAC1B,OAAO,CAAC,KAAK,CAAC,GAAG,GAAG,qBAAqB,IAAI,EAAE,CAAC,CAAC;gDACnD,CAAC;4CACH,CAAC;4CAAC,MAAM,CAAC;gDACP,yBAAyB;4CAC3B,CAAC;wCACH,CAAC;wCACD,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,GAAG,IAAI,CAAC,CAAC;oCACpC,CAAC;oCACD,YAAY,GAAG,EAAE,CAAC;gCACpB,CAAC;4BACH,CAAC;wBACH,CAAC;oBACH,CAAC;oBAAC,OAAO,GAAQ,EAAE,CAAC;wBAClB,IAAI,GAAG,CAAC,IAAI,KAAK,YAAY,EAAE,CAAC;4BAC9B,OAAO,CAAC,KAAK,CAAC,GAAG,GAAG,sBAAsB,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;wBAC3D,CAAC;oBACH,CAAC;gBACH,CAAC,CAAC,EAAE,CAAC;YACP,CAAC;YAAC,OAAO,GAAQ,EAAE,CAAC;gBAClB,MAAM,CAAC,GAAG,CAAC,CAAC;YACd,CAAC;QACH,CAAC,CAAC,CAAC;IACL,CAAC;IAED,IAAI,CAAC;QACH,eAAe,GAAG,MAAM,UAAU,EAAE,CAAC;QACrC,OAAO,CAAC,KAAK,CAAC,GAAG,GAAG,4BAA4B,eAAe,EAAE,CAAC,CAAC;IACrE,CAAC;IAAC,OAAO,GAAQ,EAAE,CAAC;QAClB,OAAO,CAAC,KAAK,CAAC,GAAG,GAAG,uCAAuC,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;QAC1E,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,qEAAqE;IACrE,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,eAAe,EAAE,WAAW,CAAC,CAAC,QAAQ,EAAE,CAAC;IACjE,OAAO,CAAC,KAAK,CAAC,GAAG,GAAG,mBAAmB,OAAO,EAAE,CAAC,CAAC;IAElD,MAAM,UAAU,GAAG,eAAe,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,SAAS,EAAE,QAAQ,EAAE,CAAC,CAAC;IAElF,UAAU,CAAC,EAAE,CAAC,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE;QACnC,IAAI,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE;YAAE,OAAO;QAE/B,IAAI,OAAgB,CAAC;QACrB,IAAI,CAAC;YACH,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAC7B,CAAC;QAAC,MAAM,CAAC;YACP,yDAAyD;YACzD,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,qBAAqB,CAAC,kBAAkB,EAAE,CAAC,GAAG,IAAI,CAAC,CAAC;YACxF,OAAO;QACT,CAAC;QAED,IAAI,OAAgB,CAAC;QACrB,IAAI,QAAiB,CAAC;QACtB,IAAI,CAAC;YACH,CAAC,EAAE,OAAO,EAAE,QAAQ,EAAE,GAAG,MAAM,KAAK,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC,CAAC;QAC/D,CAAC;QAAC,OAAO,GAAQ,EAAE,CAAC;YAClB,OAAO,CAAC,KAAK,CAAC,GAAG,GAAG,uCAAuC,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;YAC1E,OAAO;QACT,CAAC;QAED,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,kCAAkC;YAClC,IAAI,QAAQ;gBAAE,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,GAAG,IAAI,CAAC,CAAC;YACpE,OAAO;QACT,CAAC;QAED,IAAI,CAAC;YACH,oCAAoC;YACpC,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,OAAO,EAAE;gBAChC,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;gBAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC;aAC9B,CAAC,CAAC;YAEH,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;gBACb,OAAO,CAAC,KAAK,CAAC,GAAG,GAAG,0BAA0B,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC,CAAC;YAClF,CAAC;YACD,4DAA4D;QAC9D,CAAC;QAAC,OAAO,GAAQ,EAAE,CAAC;YAClB,OAAO,CAAC,KAAK,CAAC,GAAG,GAAG,+BAA+B,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;QACpE,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,UAAU;IACV,MAAM,OAAO,GAAG,KAAK,IAAI,EAAE;QACzB,kBAAkB,CAAC,KAAK,EAAE,CAAC;QAC3B,MAAM,WAAW,CAAC,IAAI,EAAE,CAAC;QACzB,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC,CAAC;IAEF,OAAO,CAAC,EAAE,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IAC9B,OAAO,CAAC,EAAE,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;AACjC,CAAC"}

package/dist/src/transports/stdio.d.ts

@@ -1,3 +1,3 @@
-import type { ScopeEnforcementProxy } from "../proxy.js";
-export declare function runStdioProxy(proxy: ScopeEnforcementProxy, upstreamCommand: string, upstreamArgs?: string[]): Promise<void>;
+import { ScopeEnforcementProxy } from "../proxy.js";
+export declare function runStdioProxy(proxy: ScopeEnforcementProxy, upstreamCommand: string, upstreamArgs?: string[], startupDelayMs?: number): Promise<void>;
 //# sourceMappingURL=stdio.d.ts.map

package/dist/src/transports/stdio.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"stdio.d.ts","sourceRoot":"","sources":["../../../src/transports/stdio.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAC;AAEzD,wBAAsB,aAAa,CACjC,KAAK,EAAE,qBAAqB,EAC5B,eAAe,EAAE,MAAM,EACvB,YAAY,GAAE,MAAM,EAAO,GAC1B,OAAO,CAAC,IAAI,CAAC,CA+Gf"}
+{"version":3,"file":"stdio.d.ts","sourceRoot":"","sources":["../../../src/transports/stdio.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAC;AAEpD,wBAAsB,aAAa,CACjC,KAAK,EAAE,qBAAqB,EAC5B,eAAe,EAAE,MAAM,EACvB,YAAY,GAAE,MAAM,EAAO,EAC3B,cAAc,SAAI,GACjB,OAAO,CAAC,IAAI,CAAC,CAkJf"}