@mhingston5/conduit 1.1.7 → 1.1.8

package/README.md

@@ -108,6 +108,7 @@ npx conduit auth \
   --auth-url <url> \
   --token-url <url> \
   --scopes <scopes>
+```
 
 For Atlassian (3LO), include `offline_access` and set the audience:
 
@@ -119,7 +120,6 @@ npx conduit auth \
   --token-url "https://auth.atlassian.com/oauth/token" \
   --scopes "offline_access,read:me"
 ```
-```
 
 This will start a temporary local server, open your browser for authorization, and print the generated `credentials` block for your `conduit.yaml`.
 

package/dist/index.js

@@ -2,6 +2,7 @@
 
 // src/index.ts
 import { Command } from "commander";
+import { createRequire } from "module";
 
 // src/core/config.service.ts
 import { z } from "zod";
@@ -1083,6 +1084,9 @@ import { StdioClientTransport } from "@modelcontextprotocol/sdk/client/stdio.js"
 import { StreamableHTTPClientTransport } from "@modelcontextprotocol/sdk/client/streamableHttp.js";
 import { SSEClientTransport } from "@modelcontextprotocol/sdk/client/sse.js";
 import { z as z2 } from "zod";
+import dns from "dns";
+import net2 from "net";
+import { Agent } from "undici";
 var UpstreamClient = class {
   logger;
   info;
@@ -1091,6 +1095,9 @@ var UpstreamClient = class {
   mcpClient;
   transport;
   connected = false;
+  // Pinned-IP dispatchers per upstream origin (defends against DNS rebinding)
+  dispatcherCache = /* @__PURE__ */ new Map();
+  pinned;
   constructor(logger, info, authService, urlValidator) {
     this.logger = logger.child({ upstreamId: info.id });
     this.info = info;
@@ -1116,7 +1123,9 @@ var UpstreamClient = class {
       return;
     }
     if (this.info.type === "streamableHttp") {
-      this.transport = new StreamableHTTPClientTransport(new URL(this.info.url), {
+      const upstreamUrl = new URL(this.info.url);
+      this.pinned = { origin: upstreamUrl.origin, hostname: upstreamUrl.hostname };
+      this.transport = new StreamableHTTPClientTransport(upstreamUrl, {
         fetch: this.createAuthedFetch()
       });
       this.mcpClient = new Client({
@@ -1128,6 +1137,8 @@ var UpstreamClient = class {
       return;
     }
     if (this.info.type === "sse") {
+      const upstreamUrl = new URL(this.info.url);
+      this.pinned = { origin: upstreamUrl.origin, hostname: upstreamUrl.hostname };
       this.mcpClient = new Client({
         name: "conduit-gateway",
         version: "1.0.0"
@@ -1136,16 +1147,65 @@ var UpstreamClient = class {
       });
     }
   }
+  getDispatcher(origin, hostname, resolvedIp) {
+    const existing = this.dispatcherCache.get(origin);
+    if (existing && existing.resolvedIp === resolvedIp) {
+      return existing.agent;
+    }
+    if (existing) {
+      try {
+        existing.agent.close();
+      } catch {
+      }
+    }
+    const agent = new Agent({
+      connect: {
+        lookup: (lookupHostname, options, callback) => {
+          if (lookupHostname === hostname) {
+            callback(null, resolvedIp, net2.isIP(resolvedIp));
+            return;
+          }
+          dns.lookup(lookupHostname, options, callback);
+        }
+      }
+    });
+    this.dispatcherCache.set(origin, { resolvedIp, agent });
+    return agent;
+  }
   createAuthedFetch() {
     const creds = this.info.credentials;
-    if (!creds) return fetch;
+    const pinned = this.pinned;
+    const baseFetch = fetch;
     return async (input, init = {}) => {
-      const headers = new Headers(init.headers || {});
-      const authHeaders = await this.authService.getAuthHeaders(creds);
-      for (const [k, v] of Object.entries(authHeaders)) {
-        headers.set(k, v);
+      const requestUrlStr = (() => {
+        if (typeof input === "string") return input;
+        if (input instanceof URL) return input.toString();
+        if (input instanceof Request) return input.url;
+        return String(input);
+      })();
+      const requestUrl = pinned ? new URL(requestUrlStr, pinned.origin) : new URL(requestUrlStr);
+      if (pinned && requestUrl.origin !== pinned.origin) {
+        throw new Error(`Forbidden upstream redirect/origin: ${requestUrl.origin}`);
       }
-      return fetch(input, { ...init, headers });
+      if (pinned && !pinned.resolvedIp) {
+        const securityResult = await this.urlValidator.validateUrl(pinned.origin);
+        if (!securityResult.valid) {
+          throw new Error(securityResult.message || "Forbidden URL");
+        }
+        pinned.resolvedIp = securityResult.resolvedIp;
+      }
+      const headers = new Headers((input instanceof Request ? input.headers : void 0) || void 0);
+      const initHeaders = new Headers(init.headers || {});
+      for (const [k, v] of initHeaders.entries()) headers.set(k, v);
+      if (creds) {
+        const authHeaders = await this.authService.getAuthHeaders(creds);
+        for (const [k, v] of Object.entries(authHeaders)) {
+          headers.set(k, v);
+        }
+      }
+      const request = input instanceof Request ? new Request(input, { ...init, headers, redirect: init.redirect ?? "manual" }) : new Request(requestUrl.toString(), { ...init, headers, redirect: init.redirect ?? "manual" });
+      const dispatcher = pinned && pinned.resolvedIp ? this.getDispatcher(pinned.origin, pinned.hostname, pinned.resolvedIp) : void 0;
+      return baseFetch(request, dispatcher ? { dispatcher } : void 0);
     };
   }
   async ensureConnected() {
@@ -1166,6 +1226,9 @@ var UpstreamClient = class {
         this.logger.error({ url: this.info.url }, "Blocked upstream URL (SSRF)");
         throw new Error(securityResult.message || "Forbidden URL");
       }
+      if (this.pinned) {
+        this.pinned.resolvedIp = securityResult.resolvedIp;
+      }
     }
     try {
       this.logger.debug("Connecting to upstream transport...");
@@ -1935,8 +1998,8 @@ var GatewayService = class {
 };
 
 // src/core/network.policy.service.ts
-import dns from "dns/promises";
-import net2 from "net";
+import dns2 from "dns/promises";
+import net3 from "net";
 import { LRUCache as LRUCache2 } from "lru-cache";
 var NetworkPolicyService = class {
   logger;
@@ -1977,9 +2040,9 @@ var NetworkPolicyService = class {
           return { valid: false, message: "Access denied: private network access forbidden" };
         }
       }
-      if (!net2.isIP(hostname)) {
+      if (!net3.isIP(hostname)) {
         try {
-          const lookup = await dns.lookup(hostname, { all: true });
+          const lookup = await dns2.lookup(hostname, { all: true });
           const resolvedIps = [];
           for (const address of lookup) {
             let ip = address.address;
@@ -2080,13 +2143,14 @@ var SecurityService = class {
   checkRateLimit(key) {
     return this.networkPolicy.checkRateLimit(key);
   }
-  validateIpcToken(token) {
-    if (!this.ipcToken) {
-      return true;
-    }
+  isMasterToken(token) {
+    if (!this.ipcToken) return true;
     const expected = Buffer.from(this.ipcToken);
-    const actual = Buffer.from(token);
-    if (expected.length === actual.length && crypto2.timingSafeEqual(expected, actual)) {
+    const actual = Buffer.from(token || "");
+    return expected.length === actual.length && crypto2.timingSafeEqual(expected, actual);
+  }
+  validateIpcToken(token) {
+    if (this.isMasterToken(token)) {
       return true;
     }
     return !!this.sessionManager.getSession(token);
@@ -2709,26 +2773,30 @@ var IsolateExecutor = class {
       const jail = ctx.global;
       let currentLogBytes = 0;
       let currentErrorBytes = 0;
+      let totalLogEntries = 0;
       await jail.set("__log", new ivm.Callback((msg) => {
+        if (totalLogEntries + 1 > limits.maxLogEntries) {
+          throw new Error("[LIMIT_LOG_ENTRIES]");
+        }
         if (currentLogBytes + msg.length + 1 > limits.maxOutputBytes) {
           throw new Error("[LIMIT_LOG]");
         }
-        if (currentLogBytes < limits.maxOutputBytes) {
-          logs.push(msg);
-          currentLogBytes += msg.length + 1;
-        }
+        totalLogEntries++;
+        logs.push(msg);
+        currentLogBytes += msg.length + 1;
       }));
       await jail.set("__error", new ivm.Callback((msg) => {
+        if (totalLogEntries + 1 > limits.maxLogEntries) {
+          throw new Error("[LIMIT_LOG_ENTRIES]");
+        }
         if (currentErrorBytes + msg.length + 1 > limits.maxOutputBytes) {
           throw new Error("[LIMIT_OUTPUT]");
         }
-        if (currentErrorBytes < limits.maxOutputBytes) {
-          errors.push(msg);
-          currentErrorBytes += msg.length + 1;
-        }
+        totalLogEntries++;
+        errors.push(msg);
+        currentErrorBytes += msg.length + 1;
       }));
       let requestIdCounter = 0;
-      const pendingToolCalls = /* @__PURE__ */ new Map();
       await jail.set("__dispatchToolCall", new ivm.Callback((nameStr, argsStr) => {
         const requestId = ++requestIdCounter;
         const name = nameStr;
@@ -2864,6 +2932,28 @@ var IsolateExecutor = class {
           }
         };
       }
+      if (message.includes("[LIMIT_LOG_ENTRIES]")) {
+        return {
+          stdout: logs.join("\n"),
+          stderr: errors.join("\n"),
+          exitCode: null,
+          error: {
+            code: -32014 /* LogLimitExceeded */,
+            message: "Log entry limit exceeded"
+          }
+        };
+      }
+      if (message.includes("[LIMIT_LOG]") || message.includes("[LIMIT_OUTPUT]")) {
+        return {
+          stdout: logs.join("\n"),
+          stderr: errors.join("\n"),
+          exitCode: null,
+          error: {
+            code: -32013 /* OutputLimitExceeded */,
+            message: "Output limit exceeded"
+          }
+        };
+      }
       this.logger.error({ err }, "Isolate execution failed");
       return {
         stdout: logs.join("\n"),
@@ -3276,13 +3366,13 @@ var ExecutionService = class {
     const packages = await this.gatewayService.listToolPackages();
     const allBindings = [];
     this.logger.debug({ packageCount: packages.length, packages: packages.map((p) => p.id) }, "Fetching tool bindings");
-    for (const pkg of packages) {
+    for (const pkg2 of packages) {
       try {
-        const stubs = await this.gatewayService.listToolStubs(pkg.id, context);
-        this.logger.debug({ packageId: pkg.id, stubCount: stubs.length }, "Got stubs from package");
+        const stubs = await this.gatewayService.listToolStubs(pkg2.id, context);
+        this.logger.debug({ packageId: pkg2.id, stubCount: stubs.length }, "Got stubs from package");
         allBindings.push(...stubs.map((s) => toToolBinding(s.id, void 0, s.description)));
       } catch (err) {
-        this.logger.warn({ packageId: pkg.id, err: err.message }, "Failed to list stubs for package");
+        this.logger.warn({ packageId: pkg2.id, err: err.message }, "Failed to list stubs for package");
       }
     }
     this.logger.info({ totalBindings: allBindings.length }, "Tool bindings ready for SDK generation");
@@ -3377,8 +3467,7 @@ var AuthMiddleware = class {
   }
   async handle(request, context, next) {
     const providedToken = request.auth?.bearerToken || "";
-    const masterToken = this.securityService.getIpcToken();
-    const isMaster = !masterToken || providedToken === masterToken;
+    const isMaster = this.securityService.isMasterToken(providedToken);
     const isSession = !isMaster && this.securityService.validateIpcToken(providedToken);
     if (!isMaster && !isSession) {
       return {
@@ -3639,7 +3728,9 @@ async function handleAuth(options) {
 
 // src/index.ts
 var program = new Command();
-program.name("conduit").description("A secure Code Mode execution substrate for MCP agents").version("1.0.0");
+var require2 = createRequire(import.meta.url);
+var pkg = require2("../package.json");
+program.name("conduit").description("A secure Code Mode execution substrate for MCP agents").version(pkg.version || "0.0.0");
 program.command("serve", { isDefault: true }).description("Start the Conduit server").option("--stdio", "Use stdio transport").option("--config <path>", "Path to config file").action(async (options) => {
   try {
     await startServer(options);