@open-mercato/web-research-browser 0.9.1-develop.7548.1.ee60458c45 → 0.9.1-develop.7553.1.8dbab05b5a

package/dist/playwright.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../src/playwright.ts"],
-  "sourcesContent": ["import { spawn } from 'node:child_process'\nimport { assertPublicUrl } from '@open-mercato/web-research'\nimport { SidecarError } from './protocol'\n\n/**\n * Structural projections of the Playwright surface we touch.\n *\n * Playwright is a real dependency of this package \u2014 installing the adapter gets\n * you the tooling it needs \u2014 but it is still reached through a dynamic import\n * inside the sidecar, so the app and MCP processes never load it. The types stay\n * structural for the same reason: nothing here should pull the SDK into a bundle\n * that only ever spawns the child.\n */\nexport type PageHandle = {\n  goto(url: string, options?: { waitUntil?: string; timeout?: number }): Promise<unknown>\n  content(): Promise<string>\n  url(): string\n  close(): Promise<void>\n}\n\nexport type ContextHandle = {\n  newPage(): Promise<unknown>\n  close(): Promise<void>\n  route?(pattern: string, handler: (route: RouteHandle) => Promise<void> | void): Promise<void>\n}\n\nexport type RouteHandle = {\n  request(): { url(): string; isNavigationRequest(): boolean }\n  abort(reason?: string): Promise<void>\n  continue(): Promise<void>\n}\n\nexport type BrowserHandle = {\n  newContext(options?: Record<string, unknown>): Promise<ContextHandle>\n  close(): Promise<void>\n}\n\nexport type BrowserType = {\n  launch(options?: { headless?: boolean; args?: string[] }): Promise<BrowserHandle>\n}\n\nfunction isModuleNotFound(message: string): boolean {\n  return (\n    /cannot find (package|module) ['\"]?playwright/i.test(message) ||\n    /ERR_MODULE_NOT_FOUND/i.test(message) ||\n    /failed to resolve ['\"]?playwright/i.test(message)\n  )\n}\n\nexport async function importChromium(): Promise<BrowserType> {\n  try {\n    const playwright = (await import('playwright')) as unknown as { chromium: BrowserType }\n    return playwright.chromium\n  } catch (error) {\n    const message = error instanceof Error ? error.message : String(error)\n    // Playwright is a dependency of this package, so a module-not-found here\n    // means a broken install (hoisting, a pruned image layer), not a missing opt-in.\n    throw new SidecarError(\n      `Playwright could not be loaded even though it is a dependency of this package \u2014 reinstall dependencies. Underlying: ${message}`,\n      isModuleNotFound(message) ? 'needs-install' : 'init',\n    )\n  }\n}\n\n/**\n * Playwright's launch error when the npm package is installed but the browser\n * binary was never downloaded. The wording has been stable across 1.x, and it is\n * the only signal Playwright gives for this case.\n */\nfunction isMissingBrowserError(error: unknown): boolean {\n  return error instanceof Error && /Executable doesn'?t exist at/i.test(error.message)\n}\n\n/** Generous, but bounded \u2014 an unbounded install hangs the sidecar forever. */\nconst INSTALL_TIMEOUT_MS = 10 * 60_000\n\nexport type InstallRunner = (onProgress: (line: string) => void) => Promise<void>\n\nconst defaultInstallRunner: InstallRunner = async (onProgress) =>\n  new Promise((resolve, reject) => {\n    const child = spawn('npx', ['playwright', 'install', 'chromium'], { stdio: ['ignore', 'pipe', 'pipe'] })\n    let tail = ''\n    const collect = (chunk: Buffer): void => {\n      tail = `${tail}${chunk.toString('utf8')}`.slice(-4000)\n    }\n    child.stdout?.on('data', collect)\n    child.stderr?.on('data', collect)\n\n    const timer = setTimeout(() => {\n      child.kill('SIGKILL')\n      reject(new Error(`\\`npx playwright install chromium\\` exceeded ${INSTALL_TIMEOUT_MS}ms`))\n    }, INSTALL_TIMEOUT_MS)\n\n    child.once('error', (error) => {\n      clearTimeout(timer)\n      reject(error)\n    })\n    child.once('close', (code) => {\n      clearTimeout(timer)\n      if (code === 0) {\n        onProgress('chromium install complete')\n        resolve()\n        return\n      }\n      reject(new Error(`\\`npx playwright install chromium\\` failed (exit ${code}): ${tail.trim()}`))\n    })\n  })\n\n/**\n * Launches Chromium, downloading the binary once if it is missing.\n *\n * Installing the npm package does not fetch the ~150MB browser, so an operator\n * who enables this tier would otherwise hit a launch failure with no obvious\n * remedy. One retry only \u2014 a second failure is a real fault, not a cold cache.\n */\nexport async function launchChromium(\n  browserType: BrowserType,\n  options: { headless?: boolean; args?: string[] },\n  deps: { install?: InstallRunner; onProgress?: (line: string) => void } = {},\n): Promise<BrowserHandle> {\n  try {\n    return await browserType.launch(options)\n  } catch (error) {\n    // Deliberately not retried without the sandbox. Falling back silently would\n    // mean the security posture depends on whether a container happened to be\n    // configured, with nobody told which one they got.\n    if (isSandboxFailure(error)) {\n      throw new SidecarError(\n        `Chromium could not start its sandbox, and this adapter renders untrusted pages so it will not run without one. ` +\n          `Fix the container (run as a non-root user, or grant SYS_ADMIN, or enable user namespaces), ` +\n          `or accept the risk explicitly with ${SANDBOX_OPT_OUT_ENV}=1. Underlying: ${error instanceof Error ? error.message : String(error)}`,\n        'init',\n      )\n    }\n    if (!isMissingBrowserError(error)) throw error\n    const onProgress = deps.onProgress ?? (() => {})\n    onProgress('chromium binary missing, running `npx playwright install chromium` (one-time, ~150MB)')\n    try {\n      await (deps.install ?? defaultInstallRunner)(onProgress)\n    } catch (installError) {\n      const detail = installError instanceof Error ? installError.message : String(installError)\n      throw new SidecarError(\n        `Playwright browser auto-install failed: ${detail}. Run \\`npx playwright install chromium\\` manually.`,\n        'init',\n      )\n    }\n    return await browserType.launch(options)\n  }\n}\n\nconst MAX_VERDICT_CACHE = 2048\n\n/**\n * Blocks private-origin navigations for the life of the context.\n *\n * The parent and the sidecar both vet the URL before a `goto`, but a page reached\n * through a legitimate public navigation can redirect or script-navigate itself\n * to a metadata endpoint, and those hops never pass through the RPC layer.\n *\n * Fails closed: Chromium resolves names with its own resolver, so a hostname\n * `node:dns` cannot vet must not be allowed through on the assumption it is dead.\n */\nexport async function installNavigationGuard(\n  context: ContextHandle,\n  options: { filterSubresources?: boolean; warn?: (message: string) => void } = {},\n): Promise<void> {\n  if (typeof context.route !== 'function') {\n    options.warn?.('context.route() unavailable \u2014 in-page navigation SSRF guard NOT installed')\n    return\n  }\n  const filterSubresources = options.filterSubresources ?? false\n  const verdicts = new Map<string, boolean>()\n  const remember = (host: string, blocked: boolean): void => {\n    if (verdicts.size >= MAX_VERDICT_CACHE) {\n      const oldest = verdicts.keys().next().value\n      if (oldest !== undefined) verdicts.delete(oldest)\n    }\n    verdicts.set(host, blocked)\n  }\n\n  await context.route('**/*', async (route) => {\n    const request = route.request()\n    const isNavigation = request.isNavigationRequest()\n    if (!isNavigation && !filterSubresources) return route.continue()\n\n    const url = request.url()\n    let host: string\n    try {\n      host = new URL(url).host\n    } catch {\n      return isNavigation ? route.abort('blockedbyclient') : route.continue()\n    }\n\n    const cached = isNavigation ? undefined : verdicts.get(host)\n    if (cached === true) return route.abort('blockedbyclient')\n    if (cached === false) return route.continue()\n\n    try {\n      await assertPublicUrl(url, isNavigation ? 'browser navigation' : 'browser subresource', {\n        failClosed: true,\n      })\n      remember(host, false)\n    } catch {\n      remember(host, true)\n      return route.abort('blockedbyclient')\n    }\n    return route.continue()\n  })\n}\n\n/**\n * Launch flags aimed at not announcing automation. Playwright's defaults set\n * `navigator.webdriver` and a headless UA, which the SERP endpoints this adapter\n * exists to reach specifically look for.\n *\n * `--disable-dev-shm-usage` is a sizing workaround, not a security control: it\n * makes Chromium write shared memory to /tmp instead of a container's small\n * /dev/shm. The sandbox is deliberately NOT disabled here \u2014 see\n * {@link resolveLaunchArgs}.\n */\nexport const LAUNCH_ARGS = [\n  '--disable-blink-features=AutomationControlled',\n  '--disable-dev-shm-usage',\n]\n\nexport const SANDBOX_OPT_OUT_ENV = 'OM_WEB_RESEARCH_BROWSER_NO_SANDBOX'\n\n/**\n * Launch flags for this process, sandbox included unless an operator opted out.\n *\n * This adapter exists to render pages chosen by a search engine or a model, so\n * the renderer is by definition parsing hostile input. `--no-sandbox` turns a\n * renderer compromise into code running as whatever user the app runs as, which\n * is the one mitigation Chromium provides for exactly this threat.\n *\n * It used to be on unconditionally because the sandbox needs privileges a\n * root-in-Docker container does not grant by default. That is a container\n * problem with container fixes (run as a non-root user, or grant `SYS_ADMIN`, or\n * enable user namespaces); silently shipping every deployment the insecure\n * variant to spare those is the wrong trade. The opt-out stays available for\n * environments that genuinely cannot, and it is loud.\n */\nexport function resolveLaunchArgs(env: NodeJS.ProcessEnv = process.env): string[] {\n  return env[SANDBOX_OPT_OUT_ENV] === '1' ? [...LAUNCH_ARGS, '--no-sandbox'] : [...LAUNCH_ARGS]\n}\n\nexport function isSandboxDisabled(env: NodeJS.ProcessEnv = process.env): boolean {\n  return env[SANDBOX_OPT_OUT_ENV] === '1'\n}\n\n/**\n * Chromium's refusal when it cannot set up its sandbox. The wording differs\n * between the root check and the namespace failure, so both shapes are matched.\n */\nexport function isSandboxFailure(error: unknown): boolean {\n  if (!(error instanceof Error)) return false\n  return (\n    /running as root without --no-sandbox/i.test(error.message) ||\n    /No usable sandbox/i.test(error.message) ||\n    /clone helper|namespace sandbox|SUID sandbox/i.test(error.message)\n  )\n}\n\nexport const DEFAULT_USER_AGENT =\n  'Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36'\n"],
-  "mappings": "AAAA,SAAS,aAAa;AACtB,SAAS,uBAAuB;AAChC,SAAS,oBAAoB;AAuC7B,SAAS,iBAAiB,SAA0B;AAClD,SACE,gDAAgD,KAAK,OAAO,KAC5D,wBAAwB,KAAK,OAAO,KACpC,qCAAqC,KAAK,OAAO;AAErD;AAEA,eAAsB,iBAAuC;AAC3D,MAAI;AACF,UAAM,aAAc,MAAM,OAAO,YAAY;AAC7C,WAAO,WAAW;AAAA,EACpB,SAAS,OAAO;AACd,UAAM,UAAU,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;AAGrE,UAAM,IAAI;AAAA,MACR,4HAAuH,OAAO;AAAA,MAC9H,iBAAiB,OAAO,IAAI,kBAAkB;AAAA,IAChD;AAAA,EACF;AACF;AAOA,SAAS,sBAAsB,OAAyB;AACtD,SAAO,iBAAiB,SAAS,gCAAgC,KAAK,MAAM,OAAO;AACrF;AAGA,MAAM,qBAAqB,KAAK;AAIhC,MAAM,uBAAsC,OAAO,eACjD,IAAI,QAAQ,CAAC,SAAS,WAAW;AAC/B,QAAM,QAAQ,MAAM,OAAO,CAAC,cAAc,WAAW,UAAU,GAAG,EAAE,OAAO,CAAC,UAAU,QAAQ,MAAM,EAAE,CAAC;AACvG,MAAI,OAAO;AACX,QAAM,UAAU,CAAC,UAAwB;AACvC,WAAO,GAAG,IAAI,GAAG,MAAM,SAAS,MAAM,CAAC,GAAG,MAAM,IAAK;AAAA,EACvD;AACA,QAAM,QAAQ,GAAG,QAAQ,OAAO;AAChC,QAAM,QAAQ,GAAG,QAAQ,OAAO;AAEhC,QAAM,QAAQ,WAAW,MAAM;AAC7B,UAAM,KAAK,SAAS;AACpB,WAAO,IAAI,MAAM,gDAAgD,kBAAkB,IAAI,CAAC;AAAA,EAC1F,GAAG,kBAAkB;AAErB,QAAM,KAAK,SAAS,CAAC,UAAU;AAC7B,iBAAa,KAAK;AAClB,WAAO,KAAK;AAAA,EACd,CAAC;AACD,QAAM,KAAK,SAAS,CAAC,SAAS;AAC5B,iBAAa,KAAK;AAClB,QAAI,SAAS,GAAG;AACd,iBAAW,2BAA2B;AACtC,cAAQ;AACR;AAAA,IACF;AACA,WAAO,IAAI,MAAM,oDAAoD,IAAI,MAAM,KAAK,KAAK,CAAC,EAAE,CAAC;AAAA,EAC/F,CAAC;AACH,CAAC;AASH,eAAsB,eACpB,aACA,SACA,OAAyE,CAAC,GAClD;AACxB,MAAI;AACF,WAAO,MAAM,YAAY,OAAO,OAAO;AAAA,EACzC,SAAS,OAAO;AAId,QAAI,iBAAiB,KAAK,GAAG;AAC3B,YAAM,IAAI;AAAA,QACR,gPAEwC,mBAAmB,mBAAmB,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,CAAC;AAAA,QACpI;AAAA,MACF;AAAA,IACF;AACA,QAAI,CAAC,sBAAsB,KAAK,EAAG,OAAM;AACzC,UAAM,aAAa,KAAK,eAAe,MAAM;AAAA,IAAC;AAC9C,eAAW,uFAAuF;AAClG,QAAI;AACF,aAAO,KAAK,WAAW,sBAAsB,UAAU;AAAA,IACzD,SAAS,cAAc;AACrB,YAAM,SAAS,wBAAwB,QAAQ,aAAa,UAAU,OAAO,YAAY;AACzF,YAAM,IAAI;AAAA,QACR,2CAA2C,MAAM;AAAA,QACjD;AAAA,MACF;AAAA,IACF;AACA,WAAO,MAAM,YAAY,OAAO,OAAO;AAAA,EACzC;AACF;AAEA,MAAM,oBAAoB;AAY1B,eAAsB,uBACpB,SACA,UAA8E,CAAC,GAChE;AACf,MAAI,OAAO,QAAQ,UAAU,YAAY;AACvC,YAAQ,OAAO,gFAA2E;AAC1F;AAAA,EACF;AACA,QAAM,qBAAqB,QAAQ,sBAAsB;AACzD,QAAM,WAAW,oBAAI,IAAqB;AAC1C,QAAM,WAAW,CAAC,MAAc,YAA2B;AACzD,QAAI,SAAS,QAAQ,mBAAmB;AACtC,YAAM,SAAS,SAAS,KAAK,EAAE,KAAK,EAAE;AACtC,UAAI,WAAW,OAAW,UAAS,OAAO,MAAM;AAAA,IAClD;AACA,aAAS,IAAI,MAAM,OAAO;AAAA,EAC5B;AAEA,QAAM,QAAQ,MAAM,QAAQ,OAAO,UAAU;AAC3C,UAAM,UAAU,MAAM,QAAQ;AAC9B,UAAM,eAAe,QAAQ,oBAAoB;AACjD,QAAI,CAAC,gBAAgB,CAAC,mBAAoB,QAAO,MAAM,SAAS;AAEhE,UAAM,MAAM,QAAQ,IAAI;AACxB,QAAI;AACJ,QAAI;AACF,aAAO,IAAI,IAAI,GAAG,EAAE;AAAA,IACtB,QAAQ;AACN,aAAO,eAAe,MAAM,MAAM,iBAAiB,IAAI,MAAM,SAAS;AAAA,IACxE;AAEA,UAAM,SAAS,eAAe,SAAY,SAAS,IAAI,IAAI;AAC3D,QAAI,WAAW,KAAM,QAAO,MAAM,MAAM,iBAAiB;AACzD,QAAI,WAAW,MAAO,QAAO,MAAM,SAAS;AAE5C,QAAI;AACF,YAAM,gBAAgB,KAAK,eAAe,uBAAuB,uBAAuB;AAAA,QACtF,YAAY;AAAA,MACd,CAAC;AACD,eAAS,MAAM,KAAK;AAAA,IACtB,QAAQ;AACN,eAAS,MAAM,IAAI;AACnB,aAAO,MAAM,MAAM,iBAAiB;AAAA,IACtC;AACA,WAAO,MAAM,SAAS;AAAA,EACxB,CAAC;AACH;AAYO,MAAM,cAAc;AAAA,EACzB;AAAA,EACA;AACF;AAEO,MAAM,sBAAsB;AAiB5B,SAAS,kBAAkB,MAAyB,QAAQ,KAAe;AAChF,SAAO,IAAI,mBAAmB,MAAM,MAAM,CAAC,GAAG,aAAa,cAAc,IAAI,CAAC,GAAG,WAAW;AAC9F;AAEO,SAAS,kBAAkB,MAAyB,QAAQ,KAAc;AAC/E,SAAO,IAAI,mBAAmB,MAAM;AACtC;AAMO,SAAS,iBAAiB,OAAyB;AACxD,MAAI,EAAE,iBAAiB,OAAQ,QAAO;AACtC,SACE,wCAAwC,KAAK,MAAM,OAAO,KAC1D,qBAAqB,KAAK,MAAM,OAAO,KACvC,+CAA+C,KAAK,MAAM,OAAO;AAErE;AAEO,MAAM,qBACX;",
+  "sourcesContent": ["import { spawn } from 'node:child_process'\nimport { assertPublicUrl, type LookupFn } from '@open-mercato/web-research'\nimport { SidecarError } from './protocol'\n\n/**\n * Structural projections of the Playwright surface we touch.\n *\n * Playwright is a real dependency of this package \u2014 installing the adapter gets\n * you the tooling it needs \u2014 but it is still reached through a dynamic import\n * inside the sidecar, so the app and MCP processes never load it. The types stay\n * structural for the same reason: nothing here should pull the SDK into a bundle\n * that only ever spawns the child.\n */\nexport type PageHandle = {\n  goto(url: string, options?: { waitUntil?: string; timeout?: number }): Promise<unknown>\n  content(): Promise<string>\n  url(): string\n  close(): Promise<void>\n}\n\nexport type ContextHandle = {\n  newPage(): Promise<unknown>\n  close(): Promise<void>\n  route?(pattern: string, handler: (route: RouteHandle) => Promise<void> | void): Promise<void>\n}\n\nexport type RouteHandle = {\n  request(): { url(): string; isNavigationRequest(): boolean }\n  abort(reason?: string): Promise<void>\n  continue(): Promise<void>\n}\n\nexport type BrowserHandle = {\n  newContext(options?: Record<string, unknown>): Promise<ContextHandle>\n  close(): Promise<void>\n}\n\nexport type LaunchOptions = {\n  headless?: boolean\n  args?: string[]\n  proxy?: { server: string; bypass?: string }\n}\n\nexport type BrowserType = {\n  launch(options?: LaunchOptions): Promise<BrowserHandle>\n}\n\nfunction isModuleNotFound(message: string): boolean {\n  return (\n    /cannot find (package|module) ['\"]?playwright/i.test(message) ||\n    /ERR_MODULE_NOT_FOUND/i.test(message) ||\n    /failed to resolve ['\"]?playwright/i.test(message)\n  )\n}\n\nexport async function importChromium(): Promise<BrowserType> {\n  try {\n    const playwright = (await import('playwright')) as unknown as { chromium: BrowserType }\n    return playwright.chromium\n  } catch (error) {\n    const message = error instanceof Error ? error.message : String(error)\n    // Playwright is a dependency of this package, so a module-not-found here\n    // means a broken install (hoisting, a pruned image layer), not a missing opt-in.\n    throw new SidecarError(\n      `Playwright could not be loaded even though it is a dependency of this package \u2014 reinstall dependencies. Underlying: ${message}`,\n      isModuleNotFound(message) ? 'needs-install' : 'init',\n    )\n  }\n}\n\n/**\n * Playwright's launch error when the npm package is installed but the browser\n * binary was never downloaded. The wording has been stable across 1.x, and it is\n * the only signal Playwright gives for this case.\n */\nfunction isMissingBrowserError(error: unknown): boolean {\n  return error instanceof Error && /Executable doesn'?t exist at/i.test(error.message)\n}\n\n/** Generous, but bounded \u2014 an unbounded install hangs the sidecar forever. */\nconst INSTALL_TIMEOUT_MS = 10 * 60_000\n\nexport type InstallRunner = (onProgress: (line: string) => void) => Promise<void>\n\nconst defaultInstallRunner: InstallRunner = async (onProgress) =>\n  new Promise((resolve, reject) => {\n    const child = spawn('npx', ['playwright', 'install', 'chromium'], { stdio: ['ignore', 'pipe', 'pipe'] })\n    let tail = ''\n    const collect = (chunk: Buffer): void => {\n      tail = `${tail}${chunk.toString('utf8')}`.slice(-4000)\n    }\n    child.stdout?.on('data', collect)\n    child.stderr?.on('data', collect)\n\n    const timer = setTimeout(() => {\n      child.kill('SIGKILL')\n      reject(new Error(`\\`npx playwright install chromium\\` exceeded ${INSTALL_TIMEOUT_MS}ms`))\n    }, INSTALL_TIMEOUT_MS)\n\n    child.once('error', (error) => {\n      clearTimeout(timer)\n      reject(error)\n    })\n    child.once('close', (code) => {\n      clearTimeout(timer)\n      if (code === 0) {\n        onProgress('chromium install complete')\n        resolve()\n        return\n      }\n      reject(new Error(`\\`npx playwright install chromium\\` failed (exit ${code}): ${tail.trim()}`))\n    })\n  })\n\n/**\n * Launches Chromium, downloading the binary once if it is missing.\n *\n * Installing the npm package does not fetch the ~150MB browser, so an operator\n * who enables this tier would otherwise hit a launch failure with no obvious\n * remedy. One retry only \u2014 a second failure is a real fault, not a cold cache.\n */\nexport async function launchChromium(\n  browserType: BrowserType,\n  options: LaunchOptions,\n  deps: { install?: InstallRunner; onProgress?: (line: string) => void } = {},\n): Promise<BrowserHandle> {\n  try {\n    return await browserType.launch(options)\n  } catch (error) {\n    // Deliberately not retried without the sandbox. Falling back silently would\n    // mean the security posture depends on whether a container happened to be\n    // configured, with nobody told which one they got.\n    if (isSandboxFailure(error)) {\n      throw new SidecarError(\n        `Chromium could not start its sandbox, and this adapter renders untrusted pages so it will not run without one. ` +\n          `Fix the container (run as a non-root user, or grant SYS_ADMIN, or enable user namespaces), ` +\n          `or accept the risk explicitly with ${SANDBOX_OPT_OUT_ENV}=1. Underlying: ${error instanceof Error ? error.message : String(error)}`,\n        'init',\n      )\n    }\n    if (!isMissingBrowserError(error)) throw error\n    const onProgress = deps.onProgress ?? (() => {})\n    onProgress('chromium binary missing, running `npx playwright install chromium` (one-time, ~150MB)')\n    try {\n      await (deps.install ?? defaultInstallRunner)(onProgress)\n    } catch (installError) {\n      const detail = installError instanceof Error ? installError.message : String(installError)\n      throw new SidecarError(\n        `Playwright browser auto-install failed: ${detail}. Run \\`npx playwright install chromium\\` manually.`,\n        'init',\n      )\n    }\n    return await browserType.launch(options)\n  }\n}\n\nconst MAX_VERDICT_CACHE = 2048\n\nexport type NavigationGuardOptions = {\n  /** @deprecated Every routed request is filtered now; this option is ignored. */\n  filterSubresources?: boolean\n  warn?: (message: string) => void\n  lookup?: LookupFn\n}\n\n/**\n * Aborts every routed request whose URL is not public, navigations and\n * subresources alike, for the life of the context.\n *\n * This is an early-abort layer, not the egress boundary: `context.route()` never\n * sees redirect hops, WebSockets, service workers or UDP, and it vets the name\n * with `node:dns` while Chromium dials whatever its own resolver returns. The\n * boundary is the pinned egress proxy every connection is forced through (see\n * `egressProxy.ts`). Navigation verdicts are never cached; subresource verdicts\n * are cached per host for the life of the context.\n *\n * Fails closed: a context without request interception is refused, and a URL\n * that cannot be parsed is aborted.\n */\nexport async function installNavigationGuard(\n  context: ContextHandle,\n  options: NavigationGuardOptions = {},\n): Promise<void> {\n  if (typeof context.route !== 'function') {\n    throw new SidecarError('context.route() is unavailable, so the request guard cannot be installed', 'init')\n  }\n  const verdicts = new Map<string, boolean>()\n  const remember = (host: string, blocked: boolean): void => {\n    if (verdicts.size >= MAX_VERDICT_CACHE) {\n      const oldest = verdicts.keys().next().value\n      if (oldest !== undefined) verdicts.delete(oldest)\n    }\n    verdicts.set(host, blocked)\n  }\n\n  await context.route('**/*', async (route) => {\n    const request = route.request()\n    const isNavigation = request.isNavigationRequest()\n    const url = request.url()\n    let host: string\n    try {\n      host = new URL(url).host\n    } catch {\n      return route.abort('blockedbyclient')\n    }\n\n    const cached = isNavigation ? undefined : verdicts.get(host)\n    if (cached === true) return route.abort('blockedbyclient')\n    if (cached === false) return route.continue()\n\n    try {\n      await assertPublicUrl(url, isNavigation ? 'browser navigation' : 'browser subresource', {\n        failClosed: true,\n        ...(options.lookup ? { lookup: options.lookup } : {}),\n      })\n      remember(host, false)\n    } catch {\n      remember(host, true)\n      return route.abort('blockedbyclient')\n    }\n    return route.continue()\n  })\n}\n\n/**\n * Denies Chromium its own DNS, so any path that bypasses the egress proxy by\n * hostname fails instead of resolving. The proxy address is a literal, so it is\n * unaffected. Only meaningful alongside the egress proxy, so it is kept out of\n * {@link LAUNCH_ARGS}.\n */\nexport const RESOLVER_LOCKDOWN_ARGS = ['--host-resolver-rules=MAP * ~NOTFOUND , EXCLUDE 127.0.0.1']\n\n/**\n * Launch flags aimed at not announcing automation. Playwright's defaults set\n * `navigator.webdriver` and a headless UA, which the SERP endpoints this adapter\n * exists to reach specifically look for.\n *\n * `--disable-dev-shm-usage` is a sizing workaround, not a security control: it\n * makes Chromium write shared memory to /tmp instead of a container's small\n * /dev/shm. The WebRTC policy and `--disable-quic` keep UDP from leaving outside\n * the egress proxy. The sandbox is deliberately NOT disabled here \u2014 see\n * {@link resolveLaunchArgs}.\n */\nexport const LAUNCH_ARGS = [\n  '--disable-blink-features=AutomationControlled',\n  '--disable-dev-shm-usage',\n  '--force-webrtc-ip-handling-policy=disable_non_proxied_udp',\n  '--disable-quic',\n]\n\nexport const SANDBOX_OPT_OUT_ENV = 'OM_WEB_RESEARCH_BROWSER_NO_SANDBOX'\n\n/**\n * Launch flags for this process, sandbox included unless an operator opted out.\n *\n * This adapter exists to render pages chosen by a search engine or a model, so\n * the renderer is by definition parsing hostile input. `--no-sandbox` turns a\n * renderer compromise into code running as whatever user the app runs as, which\n * is the one mitigation Chromium provides for exactly this threat.\n *\n * It used to be on unconditionally because the sandbox needs privileges a\n * root-in-Docker container does not grant by default. That is a container\n * problem with container fixes (run as a non-root user, or grant `SYS_ADMIN`, or\n * enable user namespaces); silently shipping every deployment the insecure\n * variant to spare those is the wrong trade. The opt-out stays available for\n * environments that genuinely cannot, and it is loud.\n */\nexport function resolveLaunchArgs(env: NodeJS.ProcessEnv = process.env): string[] {\n  return env[SANDBOX_OPT_OUT_ENV] === '1' ? [...LAUNCH_ARGS, '--no-sandbox'] : [...LAUNCH_ARGS]\n}\n\nexport function isSandboxDisabled(env: NodeJS.ProcessEnv = process.env): boolean {\n  return env[SANDBOX_OPT_OUT_ENV] === '1'\n}\n\n/**\n * Chromium's refusal when it cannot set up its sandbox. The wording differs\n * between the root check and the namespace failure, so both shapes are matched.\n */\nexport function isSandboxFailure(error: unknown): boolean {\n  if (!(error instanceof Error)) return false\n  return (\n    /running as root without --no-sandbox/i.test(error.message) ||\n    /No usable sandbox/i.test(error.message) ||\n    /clone helper|namespace sandbox|SUID sandbox/i.test(error.message)\n  )\n}\n\nexport const DEFAULT_USER_AGENT =\n  'Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36'\n"],
+  "mappings": "AAAA,SAAS,aAAa;AACtB,SAAS,uBAAsC;AAC/C,SAAS,oBAAoB;AA6C7B,SAAS,iBAAiB,SAA0B;AAClD,SACE,gDAAgD,KAAK,OAAO,KAC5D,wBAAwB,KAAK,OAAO,KACpC,qCAAqC,KAAK,OAAO;AAErD;AAEA,eAAsB,iBAAuC;AAC3D,MAAI;AACF,UAAM,aAAc,MAAM,OAAO,YAAY;AAC7C,WAAO,WAAW;AAAA,EACpB,SAAS,OAAO;AACd,UAAM,UAAU,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;AAGrE,UAAM,IAAI;AAAA,MACR,4HAAuH,OAAO;AAAA,MAC9H,iBAAiB,OAAO,IAAI,kBAAkB;AAAA,IAChD;AAAA,EACF;AACF;AAOA,SAAS,sBAAsB,OAAyB;AACtD,SAAO,iBAAiB,SAAS,gCAAgC,KAAK,MAAM,OAAO;AACrF;AAGA,MAAM,qBAAqB,KAAK;AAIhC,MAAM,uBAAsC,OAAO,eACjD,IAAI,QAAQ,CAAC,SAAS,WAAW;AAC/B,QAAM,QAAQ,MAAM,OAAO,CAAC,cAAc,WAAW,UAAU,GAAG,EAAE,OAAO,CAAC,UAAU,QAAQ,MAAM,EAAE,CAAC;AACvG,MAAI,OAAO;AACX,QAAM,UAAU,CAAC,UAAwB;AACvC,WAAO,GAAG,IAAI,GAAG,MAAM,SAAS,MAAM,CAAC,GAAG,MAAM,IAAK;AAAA,EACvD;AACA,QAAM,QAAQ,GAAG,QAAQ,OAAO;AAChC,QAAM,QAAQ,GAAG,QAAQ,OAAO;AAEhC,QAAM,QAAQ,WAAW,MAAM;AAC7B,UAAM,KAAK,SAAS;AACpB,WAAO,IAAI,MAAM,gDAAgD,kBAAkB,IAAI,CAAC;AAAA,EAC1F,GAAG,kBAAkB;AAErB,QAAM,KAAK,SAAS,CAAC,UAAU;AAC7B,iBAAa,KAAK;AAClB,WAAO,KAAK;AAAA,EACd,CAAC;AACD,QAAM,KAAK,SAAS,CAAC,SAAS;AAC5B,iBAAa,KAAK;AAClB,QAAI,SAAS,GAAG;AACd,iBAAW,2BAA2B;AACtC,cAAQ;AACR;AAAA,IACF;AACA,WAAO,IAAI,MAAM,oDAAoD,IAAI,MAAM,KAAK,KAAK,CAAC,EAAE,CAAC;AAAA,EAC/F,CAAC;AACH,CAAC;AASH,eAAsB,eACpB,aACA,SACA,OAAyE,CAAC,GAClD;AACxB,MAAI;AACF,WAAO,MAAM,YAAY,OAAO,OAAO;AAAA,EACzC,SAAS,OAAO;AAId,QAAI,iBAAiB,KAAK,GAAG;AAC3B,YAAM,IAAI;AAAA,QACR,gPAEwC,mBAAmB,mBAAmB,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,CAAC;AAAA,QACpI;AAAA,MACF;AAAA,IACF;AACA,QAAI,CAAC,sBAAsB,KAAK,EAAG,OAAM;AACzC,UAAM,aAAa,KAAK,eAAe,MAAM;AAAA,IAAC;AAC9C,eAAW,uFAAuF;AAClG,QAAI;AACF,aAAO,KAAK,WAAW,sBAAsB,UAAU;AAAA,IACzD,SAAS,cAAc;AACrB,YAAM,SAAS,wBAAwB,QAAQ,aAAa,UAAU,OAAO,YAAY;AACzF,YAAM,IAAI;AAAA,QACR,2CAA2C,MAAM;AAAA,QACjD;AAAA,MACF;AAAA,IACF;AACA,WAAO,MAAM,YAAY,OAAO,OAAO;AAAA,EACzC;AACF;AAEA,MAAM,oBAAoB;AAuB1B,eAAsB,uBACpB,SACA,UAAkC,CAAC,GACpB;AACf,MAAI,OAAO,QAAQ,UAAU,YAAY;AACvC,UAAM,IAAI,aAAa,4EAA4E,MAAM;AAAA,EAC3G;AACA,QAAM,WAAW,oBAAI,IAAqB;AAC1C,QAAM,WAAW,CAAC,MAAc,YAA2B;AACzD,QAAI,SAAS,QAAQ,mBAAmB;AACtC,YAAM,SAAS,SAAS,KAAK,EAAE,KAAK,EAAE;AACtC,UAAI,WAAW,OAAW,UAAS,OAAO,MAAM;AAAA,IAClD;AACA,aAAS,IAAI,MAAM,OAAO;AAAA,EAC5B;AAEA,QAAM,QAAQ,MAAM,QAAQ,OAAO,UAAU;AAC3C,UAAM,UAAU,MAAM,QAAQ;AAC9B,UAAM,eAAe,QAAQ,oBAAoB;AACjD,UAAM,MAAM,QAAQ,IAAI;AACxB,QAAI;AACJ,QAAI;AACF,aAAO,IAAI,IAAI,GAAG,EAAE;AAAA,IACtB,QAAQ;AACN,aAAO,MAAM,MAAM,iBAAiB;AAAA,IACtC;AAEA,UAAM,SAAS,eAAe,SAAY,SAAS,IAAI,IAAI;AAC3D,QAAI,WAAW,KAAM,QAAO,MAAM,MAAM,iBAAiB;AACzD,QAAI,WAAW,MAAO,QAAO,MAAM,SAAS;AAE5C,QAAI;AACF,YAAM,gBAAgB,KAAK,eAAe,uBAAuB,uBAAuB;AAAA,QACtF,YAAY;AAAA,QACZ,GAAI,QAAQ,SAAS,EAAE,QAAQ,QAAQ,OAAO,IAAI,CAAC;AAAA,MACrD,CAAC;AACD,eAAS,MAAM,KAAK;AAAA,IACtB,QAAQ;AACN,eAAS,MAAM,IAAI;AACnB,aAAO,MAAM,MAAM,iBAAiB;AAAA,IACtC;AACA,WAAO,MAAM,SAAS;AAAA,EACxB,CAAC;AACH;AAQO,MAAM,yBAAyB,CAAC,2DAA2D;AAa3F,MAAM,cAAc;AAAA,EACzB;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AAEO,MAAM,sBAAsB;AAiB5B,SAAS,kBAAkB,MAAyB,QAAQ,KAAe;AAChF,SAAO,IAAI,mBAAmB,MAAM,MAAM,CAAC,GAAG,aAAa,cAAc,IAAI,CAAC,GAAG,WAAW;AAC9F;AAEO,SAAS,kBAAkB,MAAyB,QAAQ,KAAc;AAC/E,SAAO,IAAI,mBAAmB,MAAM;AACtC;AAMO,SAAS,iBAAiB,OAAyB;AACxD,MAAI,EAAE,iBAAiB,OAAQ,QAAO;AACtC,SACE,wCAAwC,KAAK,MAAM,OAAO,KAC1D,qBAAqB,KAAK,MAAM,OAAO,KACvC,+CAA+C,KAAK,MAAM,OAAO;AAErE;AAEO,MAAM,qBACX;",
   "names": []
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@open-mercato/web-research-browser",
-  "version": "0.9.1-develop.7548.1.ee60458c45",
+  "version": "0.9.1-develop.7553.1.8dbab05b5a",
   "license": "MIT",
   "type": "module",
   "main": "./dist/index.js",
@@ -38,12 +38,12 @@
     "@open-mercato/web-research": "^0.6.0"
   },
   "dependencies": {
-    "@open-mercato/web-research-serp": "0.9.1-develop.7548.1.ee60458c45",
+    "@open-mercato/web-research-serp": "0.9.1-develop.7553.1.8dbab05b5a",
     "playwright": "^1.40.0",
     "zod": "^4.4.3"
   },
   "devDependencies": {
-    "@open-mercato/web-research": "0.9.1-develop.7548.1.ee60458c45",
+    "@open-mercato/web-research": "0.9.1-develop.7553.1.8dbab05b5a",
     "@types/jest": "^30.0.0",
     "@types/node": "^26.0.1",
     "esbuild": "^0.28.1",

package/src/__tests__/egressProxy.test.ts

@@ -0,0 +1,481 @@
+import { createServer as createHttpServer, request as sendHttp, type IncomingHttpHeaders, type Server } from 'node:http'
+import { connect as netConnect, createServer as createTcpServer, type AddressInfo, type Socket } from 'node:net'
+import type { LookupFn } from '@open-mercato/web-research'
+import { pinnedConnect, startEgressProxy, type EgressDialTarget, type EgressProxy } from '../egressProxy'
+
+const PUBLIC_IP = '93.184.216.34'
+const RESET_IP = '93.184.216.35'
+const DEAD_IP = '93.184.216.36'
+const MALFORMED_IP = '93.184.216.37'
+const PUBLIC_IPV6 = '2606:2800:220:1:248:1893:25c8:1946'
+
+type Recorded = { host: string | undefined; url: string | undefined; headers: IncomingHttpHeaders }
+
+type Harness = {
+  proxy: EgressProxy
+  proxyPort: number
+  dials: EgressDialTarget[]
+  privateConnections: () => number
+  publicRequests: Recorded[]
+  publicSockets: Set<Socket>
+  flipAnswers: string[]
+}
+
+const servers: Server[] = []
+const tcpServers: Array<ReturnType<typeof createTcpServer>> = []
+let harness: Harness
+
+async function listen(server: Server | ReturnType<typeof createTcpServer>): Promise<number> {
+  await new Promise<void>((resolve) => server.listen(0, '127.0.0.1', () => resolve()))
+  return (server.address() as AddressInfo).port
+}
+
+function closeAll(): Promise<void[]> {
+  const closing = [...servers, ...tcpServers].map(
+    (server) =>
+      new Promise<void>((resolve) => {
+        server.close(() => resolve())
+      }),
+  )
+  servers.length = 0
+  tcpServers.length = 0
+  return Promise.all(closing)
+}
+
+async function buildHarness(): Promise<Harness> {
+  let privateHits = 0
+  const privateServer = createTcpServer((socket) => {
+    privateHits += 1
+    socket.on('error', () => undefined)
+    socket.end('HTTP/1.1 200 OK\r\nContent-Length: 6\r\n\r\nSECRET')
+  })
+  tcpServers.push(privateServer)
+  const privatePort = await listen(privateServer)
+
+  const publicRequests: Recorded[] = []
+  const publicSockets = new Set<Socket>()
+  const publicServer = createHttpServer((req, res) => {
+    publicRequests.push({ host: req.headers.host, url: req.url, headers: req.headers })
+    if (req.url === '/redirect') {
+      res.writeHead(302, { location: 'http://private.test/secret' })
+      res.end()
+      return
+    }
+    res.writeHead(200, { 'content-type': 'text/plain' })
+    res.end(`public:${req.url}`)
+  })
+  publicServer.on('connection', (socket) => {
+    publicSockets.add(socket)
+    socket.once('close', () => publicSockets.delete(socket))
+  })
+  servers.push(publicServer)
+  const publicPort = await listen(publicServer)
+
+  const resetServer = createTcpServer((socket) => {
+    socket.on('error', () => undefined)
+    socket.resetAndDestroy()
+  })
+  tcpServers.push(resetServer)
+  const resetPort = await listen(resetServer)
+
+  const malformedServer = createTcpServer((socket) => {
+    socket.on('error', () => undefined)
+    let head = ''
+    socket.on('data', (chunk: Buffer) => {
+      head += chunk.toString('latin1')
+      if (!head.includes('\r\n\r\n')) return
+      const statusLine = head.startsWith('GET /low-status') ? 'HTTP/1.1 099 X' : 'HTTP/1.1 200 O\x01K'
+      socket.end(`${statusLine}\r\nContent-Length: 2\r\n\r\nok`)
+    })
+  })
+  tcpServers.push(malformedServer)
+  const malformedPort = await listen(malformedServer)
+
+  const deadServer = createTcpServer()
+  const deadPort = await listen(deadServer)
+  await new Promise<void>((resolve) => deadServer.close(() => resolve()))
+
+  const flipAnswers: string[] = []
+  const table: Record<string, string> = {
+    'public.test': PUBLIC_IP,
+    'redirect.test': PUBLIC_IP,
+    'private.test': '10.0.0.5',
+    'metadata.test': '169.254.169.254',
+    'reset.test': RESET_IP,
+    'dead.test': DEAD_IP,
+    'malformed.test': MALFORMED_IP,
+    'under_score.test': PUBLIC_IP,
+  }
+  const lookup: LookupFn = async (hostname) => {
+    if (hostname === 'flip.test') {
+      const address = flipAnswers.shift()
+      if (!address) throw new Error('no answer')
+      return [{ address, family: 4 }]
+    }
+    const address = table[hostname]
+    if (!address) throw new Error(`ENOTFOUND ${hostname}`)
+    return [{ address, family: 4 }]
+  }
+
+  const dials: EgressDialTarget[] = []
+  const portFor = (addresses: readonly string[]): number => {
+    if (addresses.length === 1 && (addresses[0] === PUBLIC_IP || addresses[0] === PUBLIC_IPV6)) return publicPort
+    if (addresses.length === 1 && addresses[0] === RESET_IP) return resetPort
+    if (addresses.length === 1 && addresses[0] === DEAD_IP) return deadPort
+    if (addresses.length === 1 && addresses[0] === MALFORMED_IP) return malformedPort
+    return privatePort
+  }
+  const proxy = await startEgressProxy({
+    lookup,
+    connect: (target) => {
+      dials.push(target)
+      return netConnect({ host: '127.0.0.1', port: portFor(target.addresses) })
+    },
+  })
+  return {
+    proxy,
+    proxyPort: Number(new URL(proxy.url).port),
+    dials,
+    privateConnections: () => privateHits,
+    publicRequests,
+    publicSockets,
+    flipAnswers,
+  }
+}
+
+type ConnectResult = { status: number; socket: Socket }
+
+function openConnect(authority: string): Promise<ConnectResult> {
+  return new Promise((resolve, reject) => {
+    const socket = netConnect({ host: '127.0.0.1', port: harness.proxyPort })
+    let buffered = ''
+    const onData = (chunk: Buffer): void => {
+      buffered += chunk.toString('latin1')
+      const end = buffered.indexOf('\r\n\r\n')
+      if (end === -1) return
+      socket.removeListener('data', onData)
+      const status = Number(/^HTTP\/1\.1 (\d{3})/.exec(buffered)?.[1] ?? 0)
+      resolve({ status, socket })
+    }
+    socket.on('data', onData)
+    socket.on('error', reject)
+    socket.once('close', () => resolve({ status: Number(/^HTTP\/1\.1 (\d{3})/.exec(buffered)?.[1] ?? 0), socket }))
+    socket.write(`CONNECT ${authority} HTTP/1.1\r\nHost: ${authority}\r\n\r\n`)
+  })
+}
+
+async function connectStatus(authority: string): Promise<number> {
+  const { status, socket } = await openConnect(authority)
+  socket.destroy()
+  return status
+}
+
+function readAll(socket: Socket): Promise<string> {
+  return new Promise((resolve) => {
+    let text = ''
+    socket.on('data', (chunk: Buffer) => {
+      text += chunk.toString('utf8')
+    })
+    socket.once('close', () => resolve(text))
+  })
+}
+
+type ProxiedResponse = { status: number; headers: IncomingHttpHeaders; body: string }
+
+function proxiedRequest(path: string, headers: Record<string, string> = {}): Promise<ProxiedResponse> {
+  return new Promise((resolve, reject) => {
+    const request = sendHttp(
+      { host: '127.0.0.1', port: harness.proxyPort, path, method: 'GET', headers, agent: false },
+      (response) => {
+        let body = ''
+        response.setEncoding('utf8')
+        response.on('data', (chunk: string) => {
+          body += chunk
+        })
+        response.on('end', () => resolve({ status: response.statusCode ?? 0, headers: response.headers, body }))
+      },
+    )
+    request.on('error', reject)
+    request.end()
+  })
+}
+
+describe('browser egress proxy (#7218)', () => {
+  beforeEach(async () => {
+    harness = await buildHarness()
+  })
+
+  afterEach(async () => {
+    expect(harness.privateConnections()).toBe(0)
+    await harness.proxy.close()
+    await closeAll()
+  })
+
+  it('refuses a CONNECT to a host that resolves privately without dialling it', async () => {
+    expect(await connectStatus('private.test:443')).toBe(403)
+    expect(await connectStatus('metadata.test:80')).toBe(403)
+    expect(harness.dials).toEqual([])
+  })
+
+  it.each([
+    '[::1]:443',
+    '[::ffff:127.0.0.1]:443',
+    '127.0.0.1:443',
+    '169.254.169.254:80',
+    'localhost:443',
+    '0x7f.1:443',
+  ])('refuses the private literal %s without dialling it', async (authority) => {
+    expect(await connectStatus(authority)).toBe(403)
+    expect(harness.dials).toEqual([])
+  })
+
+  it.each(['a@b:1', 'public.test', 'public.test:0', 'public.test:70000', '[::1:443', 'public.test:443/x'])(
+    'answers the malformed authority %s with 400',
+    async (authority) => {
+      expect(await connectStatus(authority)).toBe(400)
+      expect(harness.dials).toEqual([])
+    },
+  )
+
+  it('tunnels a public CONNECT to exactly the vetted address', async () => {
+    const { status, socket } = await openConnect('public.test:443')
+    expect(status).toBe(200)
+    expect(harness.dials).toEqual([{ host: 'public.test', port: 443, addresses: [PUBLIC_IP] }])
+
+    const received = readAll(socket)
+    socket.write('GET /tunnel HTTP/1.1\r\nHost: public.test\r\nConnection: close\r\n\r\n')
+    expect(await received).toContain('public:/tunnel')
+  })
+
+  it('dials port 80 when the CONNECT authority names it', async () => {
+    const { status, socket } = await openConnect('public.test:80')
+    socket.destroy()
+    expect(status).toBe(200)
+    expect(harness.dials[0]?.port).toBe(80)
+  })
+
+  it('dials a bracketed public IPv6 literal through the pinned dial', async () => {
+    const { status, socket } = await openConnect(`[${PUBLIC_IPV6}]:443`)
+    socket.destroy()
+    expect(status).toBe(200)
+    expect(harness.dials).toEqual([{ host: PUBLIC_IPV6, port: 443, addresses: [PUBLIC_IPV6] }])
+  })
+
+  it('re-resolves every connection, so a host that turns private is refused', async () => {
+    harness.flipAnswers.push(PUBLIC_IP, '127.0.0.1')
+
+    const first = await openConnect('flip.test:443')
+    first.socket.destroy()
+    expect(first.status).toBe(200)
+    expect(await connectStatus('flip.test:443')).toBe(403)
+    expect(harness.dials).toHaveLength(1)
+  })
+
+  it('proxies an absolute-form public GET with the vetted Host and no proxy or hop-by-hop headers', async () => {
+    const response = await proxiedRequest('http://public.test/hello?q=1', {
+      host: 'evil.internal',
+      'proxy-authorization': 'Basic c2VjcmV0',
+      connection: 'keep-alive, x-hop',
+      'x-hop': 'drop-me',
+      'x-keep': 'kept',
+    })
+
+    expect(response.status).toBe(200)
+    expect(response.body).toBe('public:/hello?q=1')
+    expect(harness.dials).toEqual([{ host: 'public.test', port: 80, addresses: [PUBLIC_IP] }])
+    const seen = harness.publicRequests[0]
+    expect(seen?.host).toBe('public.test')
+    expect(seen?.headers['proxy-authorization']).toBeUndefined()
+    expect(seen?.headers['x-hop']).toBeUndefined()
+    expect(seen?.headers['x-keep']).toBe('kept')
+  })
+
+  it('refuses an absolute-form GET to a private target', async () => {
+    expect((await proxiedRequest('http://private.test/secret')).status).toBe(403)
+    expect((await proxiedRequest('http://127.0.0.1:5432/')).status).toBe(403)
+    expect((await proxiedRequest('http://[::1]/')).status).toBe(403)
+    expect(harness.dials).toEqual([])
+  })
+
+  it('re-vets a redirect hop followed as a new request', async () => {
+    const redirect = await proxiedRequest('http://redirect.test/redirect')
+    expect(redirect.status).toBe(302)
+    const location = String(redirect.headers.location)
+    expect(location).toBe('http://private.test/secret')
+
+    expect((await proxiedRequest(location)).status).toBe(403)
+    expect(harness.dials).toHaveLength(1)
+  })
+
+  it('answers an origin-form request with 400', async () => {
+    expect((await proxiedRequest('/hello')).status).toBe(400)
+    expect(harness.dials).toEqual([])
+  })
+
+  it('refuses an absolute-form request that asks for a protocol upgrade', async () => {
+    const response = await proxiedRequest('http://public.test/socket', {
+      connection: 'Upgrade',
+      upgrade: 'websocket',
+      'sec-websocket-version': '13',
+      'sec-websocket-key': 'dGhlIHNhbXBsZSBub25jZQ==',
+    })
+
+    expect(response.status).toBe(400)
+    expect(harness.dials).toEqual([])
+    expect(harness.publicRequests).toEqual([])
+  })
+
+  it('answers 502 when the vetted address cannot be reached', async () => {
+    expect(await connectStatus('dead.test:443')).toBe(502)
+    expect((await proxiedRequest('http://dead.test/')).status).toBe(502)
+  })
+
+  it('survives an upstream reset', async () => {
+    const tunnel = await openConnect('reset.test:443')
+    const closed = new Promise<void>((resolve) => tunnel.socket.once('close', () => resolve()))
+    tunnel.socket.on('error', () => undefined)
+    await closed
+
+    expect((await proxiedRequest('http://reset.test/')).status).toBe(502)
+    expect((await proxiedRequest('http://public.test/after')).status).toBe(200)
+  })
+
+  it('drops a reason phrase with control bytes instead of crashing on it', async () => {
+    const response = await proxiedRequest('http://malformed.test/bad-reason')
+    expect(response.status).toBe(200)
+    expect(response.body).toBe('ok')
+    expect((await proxiedRequest('http://public.test/after')).status).toBe(200)
+  })
+
+  it('answers 502 instead of crashing when an upstream sends a status below 200', async () => {
+    const outcome = await proxiedRequest('http://malformed.test/low-status').then(
+      (response) => response.status,
+      () => 'closed',
+    )
+    expect([502, 'closed']).toContain(outcome)
+    expect((await proxiedRequest('http://public.test/after')).status).toBe(200)
+  })
+
+  it('accepts an underscore in a CONNECT hostname and still vets it', async () => {
+    const { status, socket } = await openConnect('under_score.test:443')
+    socket.destroy()
+    expect(status).toBe(200)
+    expect(harness.dials).toEqual([{ host: 'under_score.test', port: 443, addresses: [PUBLIC_IP] }])
+  })
+
+  it('tears down live tunnels on close', async () => {
+    const tunnel = await openConnect('public.test:443')
+    expect(tunnel.status).toBe(200)
+    tunnel.socket.on('error', () => undefined)
+    const clientClosed = new Promise<void>((resolve) => tunnel.socket.once('close', () => resolve()))
+
+    await harness.proxy.close()
+    await clientClosed
+
+    await new Promise<void>((resolve) => setImmediate(resolve))
+    expect(harness.publicSockets.size).toBe(0)
+    await expect(
+      new Promise((resolve, reject) => {
+        const probe = netConnect({ host: '127.0.0.1', port: harness.proxyPort })
+        probe.once('connect', () => {
+          probe.destroy()
+          resolve('connected')
+        })
+        probe.once('error', reject)
+      }),
+    ).rejects.toThrow(/ECONNREFUSED/)
+  })
+})
+
+describe('pinned dial and vetting limits (#7218)', () => {
+  it('connects the default dial to the vetted address without resolving the hostname', async () => {
+    const target = createTcpServer((socket) => socket.end())
+    const port = await listen(target)
+    try {
+      const socket = pinnedConnect({ host: 'pinned.invalid', port, addresses: ['127.0.0.1'] })
+      const remote = await new Promise<string | undefined>((resolve, reject) => {
+        socket.once('connect', () => resolve(socket.remoteAddress))
+        socket.once('error', reject)
+      })
+      socket.destroy()
+      expect(remote).toBe('127.0.0.1')
+    } finally {
+      await new Promise<void>((resolve) => target.close(() => resolve()))
+    }
+  })
+
+  it('fails the default dial when nothing was vetted instead of falling back to DNS', async () => {
+    const socket = pinnedConnect({ host: 'localhost', port: 9, addresses: [] })
+    await expect(
+      new Promise((resolve, reject) => {
+        socket.once('connect', () => resolve('connected'))
+        socket.once('error', reject)
+      }),
+    ).rejects.toThrow(/No pinned address/)
+    socket.destroy()
+  })
+
+  it('refuses a connection whose name cannot be vetted in time', async () => {
+    const dials: EgressDialTarget[] = []
+    const proxy = await startEgressProxy({
+      vetTimeoutMs: 50,
+      lookup: () => new Promise(() => undefined),
+      connect: (dialTarget) => {
+        dials.push(dialTarget)
+        return netConnect({ host: '127.0.0.1', port: 9 })
+      },
+    })
+    try {
+      const status = await new Promise<number>((resolve, reject) => {
+        const socket = netConnect({ host: '127.0.0.1', port: Number(new URL(proxy.url).port) })
+        let buffered = ''
+        socket.on('data', (chunk: Buffer) => {
+          buffered += chunk.toString('latin1')
+        })
+        socket.once('close', () => resolve(Number(/^HTTP\/1\.1 (\d{3})/.exec(buffered)?.[1] ?? 0)))
+        socket.on('error', reject)
+        socket.write('CONNECT slow.test:443 HTTP/1.1\r\nHost: slow.test:443\r\n\r\n')
+      })
+      expect(status).toBe(504)
+      expect(dials).toEqual([])
+    } finally {
+      await proxy.close()
+    }
+  })
+
+  it('does not dial for a client that left while its destination was being vetted', async () => {
+    const dials: EgressDialTarget[] = []
+    let answer: (records: Array<{ address: string; family: number }>) => void = () => undefined
+    let lookupStarted: () => void = () => undefined
+    const started = new Promise<void>((resolve) => {
+      lookupStarted = resolve
+    })
+    const proxy = await startEgressProxy({
+      lookup: () =>
+        new Promise((resolve) => {
+          answer = resolve
+          lookupStarted()
+        }),
+      connect: (dialTarget) => {
+        dials.push(dialTarget)
+        return netConnect({ host: '127.0.0.1', port: 9 })
+      },
+    })
+    try {
+      const client = netConnect({ host: '127.0.0.1', port: Number(new URL(proxy.url).port) })
+      client.on('error', () => undefined)
+      client.write('CONNECT leaving.test:443 HTTP/1.1\r\nHost: leaving.test:443\r\n\r\n')
+      await started
+      const clientClosed = new Promise<void>((resolve) => client.once('close', () => resolve()))
+      client.destroy()
+      await clientClosed
+      await new Promise((resolve) => setTimeout(resolve, 20))
+      answer([{ address: PUBLIC_IP, family: 4 }])
+      await new Promise((resolve) => setTimeout(resolve, 20))
+
+      expect(dials).toEqual([])
+    } finally {
+      await proxy.close()
+    }
+  })
+})