@omnixal/openclaw-nats-plugin 0.2.13 → 0.2.14

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@omnixal/openclaw-nats-plugin",
-  "version": "0.2.13",
+  "version": "0.2.14",
   "description": "NATS JetStream event-driven plugin for OpenClaw",
   "license": "MIT",
   "type": "module",

package/plugins/nats-context-engine/http-handler.ts

@@ -2,11 +2,13 @@ import fs from 'node:fs/promises';
 import path from 'node:path';
 import { existsSync } from 'node:fs';
 import { homedir } from 'node:os';
+import http from 'node:http';
 import type { IncomingMessage, ServerResponse } from 'node:http';
 
 const ROUTE_PREFIX = '/nats-dashboard';
 const SIDECAR_URL = process.env.NATS_SIDECAR_URL || 'http://127.0.0.1:3104';
 const API_KEY = process.env.NATS_PLUGIN_API_KEY || 'dev-nats-plugin-key';
+const sidecarParsed = new URL(SIDECAR_URL);
 
 // Stable location (copied during setup) takes priority over in-package dist
 const STABLE_DIST = path.join(homedir(), '.openclaw', 'nats-plugin', 'dashboard');
@@ -52,7 +54,6 @@ async function proxyToSidecar(
   res: ServerResponse,
 ): Promise<boolean> {
   try {
-    const targetUrl = `${SIDECAR_URL}${subPath}${search}`;
     const headers: Record<string, string> = {
       'Authorization': `Bearer ${API_KEY}`,
     };
@@ -65,27 +66,61 @@ async function proxyToSidecar(
       body = await readBody(req);
     }
 
-    const upstream = await fetch(targetUrl, {
+    // Use node:http directly — global fetch() may be intercepted by gateway SSRF guards
+    const upstream = await httpRequest({
+      hostname: sidecarParsed.hostname,
+      port: Number(sidecarParsed.port),
+      path: `${subPath}${search}`,
       method: req.method || 'GET',
       headers,
-      body,
-      signal: AbortSignal.timeout(10000),
-    });
-
-    res.statusCode = upstream.status;
-    res.setHeader('content-type', upstream.headers.get('content-type') || 'application/json');
-    const responseBody = await upstream.text();
-    res.end(responseBody);
-  } catch {
+      timeout: 10_000,
+    }, body);
+
+    res.statusCode = upstream.statusCode;
+    res.setHeader('content-type', upstream.headers['content-type'] || 'application/json');
+    res.end(upstream.body);
+  } catch (err) {
+    const message = err instanceof Error ? err.message : String(err);
+    console.error(`[nats-dashboard] Sidecar proxy error: ${message} (url=${SIDECAR_URL}${subPath})`);
     res.statusCode = 502;
     res.setHeader('content-type', 'application/json');
-    res.end(JSON.stringify({ error: 'Sidecar unreachable' }));
+    res.end(JSON.stringify({ error: 'Sidecar unreachable', detail: message }));
   }
   return true;
 }
 
 const MAX_BODY_BYTES = 1_048_576; // 1MB
 
+interface HttpResponse {
+  statusCode: number;
+  headers: Record<string, string | string[] | undefined>;
+  body: string;
+}
+
+function httpRequest(
+  opts: http.RequestOptions,
+  body?: string,
+): Promise<HttpResponse> {
+  return new Promise((resolve, reject) => {
+    const req = http.request(opts, (res) => {
+      const chunks: Buffer[] = [];
+      res.on('data', (chunk: Buffer) => chunks.push(chunk));
+      res.on('end', () => {
+        resolve({
+          statusCode: res.statusCode || 500,
+          headers: res.headers,
+          body: Buffer.concat(chunks).toString(),
+        });
+      });
+      res.on('error', reject);
+    });
+    req.on('error', reject);
+    req.on('timeout', () => { req.destroy(); reject(new Error('Request timeout')); });
+    if (body) req.write(body);
+    req.end();
+  });
+}
+
 function readBody(req: IncomingMessage): Promise<string> {
   return new Promise((resolve, reject) => {
     const chunks: Buffer[] = [];