@qilin-agent/client-connection 3.1.3 → 3.1.5

package/README.i18n.yaml

@@ -5,33 +5,33 @@
 /:
   en: 13b131457d03a224
   zh: 541bd85b21259ff3
-/qilin-client-connection:
-  en: bfbb88dd96c1e4cb
-  zh: 37988d4aa00fa2a5
-/qilin-client-connection/summary:
+/qilin-agent-client-connection:
+  en: eec5c8484d97c773
+  zh: 86905b0501d26e73
+/qilin-agent-client-connection/summary:
   en: a83b5e9fd1968062
   zh: ac68628e185a4bff
-/qilin-client-connection/table-of-contents:
+/qilin-agent-client-connection/table-of-contents:
   en: 18792bf2fb4f8030
   zh: 84c63acc7e0099ae
-/qilin-client-connection/use-this-package:
+/qilin-agent-client-connection/use-this-package:
   en: ef04350968741ba3
   zh: abcded86153ddd9b
-/qilin-client-connection/browser-authentication-and-request-trust:
+/qilin-agent-client-connection/browser-authentication-and-request-trust:
   en: 73a9f2fd2c2d559e
   zh: 4b629185fecee159
-/qilin-client-connection/connection-generation:
-  en: 9ab2b92f7be612e3
-  zh: e2f6994b29f4a9cc
-/qilin-client-connection/model-experience:
+/qilin-agent-client-connection/connection-generation:
+  en: d260c2ac53a86c8f
+  zh: 3f1de43f27afd85e
+/qilin-agent-client-connection/model-experience:
   en: 88bbc33fe9ae9df8
   zh: bfbab6d51b4abd40
-/qilin-client-connection/model-experience/kv-cache-effect:
+/qilin-agent-client-connection/model-experience/kv-cache-effect:
   en: ca75c51c89c2c9b0
   zh: de54f3467ef3b9be
-/qilin-client-connection/known-limitations-and-deferred-work:
+/qilin-agent-client-connection/known-limitations-and-deferred-work:
   en: 21d90520c2e5d4b9
   zh: c9ae88395b272977
-/qilin-client-connection/known-limitations-and-deferred-work/dev-note:
+/qilin-agent-client-connection/known-limitations-and-deferred-work/dev-note:
   en: e67f633dc6fe7773
   zh: e88aeb617ffb74ea

package/lib/index.js

@@ -128,23 +128,27 @@ function isLoopbackHostname(hostname) {
 * the attacker's domain while the socket reaches this server) and cross-site
 * requests fired from a malicious page. The Host fence binds every request,
 * browser-looking or not: over plain HTTP a browser attaches neither Origin
-* nor Fetch-Metadata to reads (images and navigations — those
-* headers go only to trustworthy destinations), so an unmarked request may
-* still be a rebound browser read and Host is the one header rebinding cannot
-* forge. Non-browser and remote clients pass the same fence via loopback,
-* deployment-derived LAN IP literals, or a declared `trustedHosts` authority.
-* Network reachability and authentication stay out of scope: binding policy
-* belongs to the webserver config, and this fence is not an auth layer.
+* nor Fetch-Metadata to reads (images and navigations — those headers go only
+* to trustworthy destinations), so an unmarked request may still be a rebound
+* browser read and Host is the one header rebinding cannot forge. Non-browser
+* and remote clients pass the same fence via loopback, the listener's bind IP
+* literal, or a declared `trustedHosts` authority. Binding policy belongs to
+* the webserver config; this fence never establishes identity.
 */
 function header$1(headers, name) {
 	if (headers instanceof Headers) return headers.get(name) ?? void 0;
 	const value = headers[name];
 	return typeof value === "string" ? value : void 0;
 }
-/** Normalized URL of a Host-header authority (hostname lowercased, default port stripped, IPv6 bracketed), or undefined when unparsable. */
-function parseAuthority(authority) {
+/**
+* Normalized URL of a bare authority (hostname lowercased, default port
+* stripped, IPv6 bracketed), or undefined when unparsable.
+* @param authority - `host` or `host:port` text.
+* @param scheme - special scheme to parse under; its default port is the one stripped.
+*/
+function parseAuthority(authority, scheme = "http:") {
 	try {
-		return new URL(`http://${authority}`);
+		return new URL(`${scheme}//${authority}`);
 	} catch {
 		return;
 	}
@@ -176,43 +180,74 @@ function assertTrustedAuthority(entry) {
 * shapes like `host:port ` as port-less.
 */
 function canonicalAuthority(entry, entryUrl) {
-	const port = entryUrl.port !== "" ? entryUrl.port : new URL(`https://${entry}`).port;
+	const port = entryUrl.port !== "" ? entryUrl.port : new URL(`${entryUrl.protocol === "http:" ? "https:" : "http:"}//${entry}`).port;
 	return port === "" ? entryUrl.hostname : `${entryUrl.hostname}:${port}`;
 }
 /**
 * Whether the request authority matches a `trustedHosts` entry. An entry with
 * an explicit port matches that exact authority; a port-less entry matches the
-* hostname on any port (the shape the CLI derives for IP-literal LAN serving,
-* where the bound port may be OS-assigned). Both sides compare through WHATWG
-* normalization, so case and a redundant `:80` never decide trust.
+* hostname on any port. Both sides compare through WHATWG normalization,
+* so case and a redundant scheme-default port never decide trust.
 */
-function isTrustedAuthority(hostUrl, trustedHosts) {
+function isTrustedAuthority(hostUrl, trustedHosts, protocol) {
 	return trustedHosts.some((entry) => {
-		const entryUrl = parseAuthority(entry);
+		const entryUrl = parseAuthority(entry, protocol);
 		if (entryUrl === void 0) return false;
 		return canonicalAuthority(entry, entryUrl) === entryUrl.hostname ? entryUrl.hostname === hostUrl.hostname : entryUrl.host === hostUrl.host;
 	});
 }
 /**
+* Whether a parsed authority names the deployment's own bind address. A browser
+* dialing that literal sends it as Host, and accepting it grants nothing
+* further: the literal is no rebinding target, the Origin and cross-site checks
+* still apply, and it stays outside `trustedHosts`. Matching ignores the port,
+* like a port-less entry, and any `%zone` id (an interface selector, not
+* address text).
+*/
+function isBindAddressAuthority(hostUrl, bindHost) {
+	if (bindHost === void 0) return false;
+	const zoneAt = bindHost.indexOf("%");
+	const address = zoneAt === -1 ? bindHost : bindHost.slice(0, zoneAt);
+	const bindUrl = parseAuthority(address.includes(":") ? `[${address}]` : address);
+	return bindUrl !== void 0 && bindUrl.hostname === hostUrl.hostname;
+}
+/**
 * Decide whether one /api request may reach the RPC bridge.
 * @param request - Node HTTP or Fetch request facts (headers).
 * @param trustedHosts - non-loopback authorities this deployment serves: exact `host:port`, or port-less `host` matching any port.
-* @returns true when the Host is ours (loopback or trusted) and any attached browser markers are same-origin.
+* @param bindHost - the listener's own bind IP literal, accepted on any port independently of `trustedHosts`.
+* @param protocol - listener protocol for default Host ports; HTTP when no Web carrier is mounted.
+* @returns true when the Host is ours (loopback, the bind address, or trusted) and any attached browser markers are same-origin.
 */
-function isTrustedApiRequest(request, trustedHosts) {
+function isTrustedApiRequest(request, trustedHosts, bindHost, protocol = "http:") {
 	const host = header$1(request.headers, "host");
 	if (host === void 0) return false;
-	const hostUrl = parseAuthority(host);
+	const hostUrl = parseAuthority(host, protocol);
 	if (hostUrl === void 0) return false;
-	if (!isLoopbackHostname(hostUrl.hostname) && !isTrustedAuthority(hostUrl, trustedHosts)) return false;
+	if (!isLoopbackHostname(hostUrl.hostname) && !isTrustedAuthority(hostUrl, trustedHosts, protocol) && !isBindAddressAuthority(hostUrl, bindHost)) return false;
 	if (header$1(request.headers, "sec-fetch-site") === "cross-site") return false;
 	const origin = header$1(request.headers, "origin");
 	if (origin === void 0) return true;
+	return isSameAuthorityOrigin(origin, host);
+}
+/**
+* Compare Host under the Origin's HTTP(S) scheme so default ports normalize
+* consistently. The transport may remain HTTP behind an HTTPS proxy.
+* @param origin - verbatim Origin header value.
+* @param host - verbatim Host header value already accepted by the Host fence.
+* @returns true only when the Origin is this listener's own `http(s)` authority.
+*/
+function isSameAuthorityOrigin(origin, host) {
+	let originUrl;
 	try {
-		return new URL(origin).host === hostUrl.host;
+		originUrl = new URL(origin);
 	} catch {
 		return false;
 	}
+	const scheme = originUrl.protocol === "https:" ? "https:" : originUrl.protocol === "http:" ? "http:" : void 0;
+	if (scheme === void 0) return false;
+	const hostUrl = parseAuthority(host, scheme);
+	return hostUrl !== void 0 && originUrl.host === hostUrl.host;
 }
 //#endregion
 //#region lib/types/web-entry.js
@@ -667,7 +702,8 @@ var HostConnectionService = class extends Service {
 	* cookie minted by the launch-token exchange.
 	*/
 	requestRejection(request) {
-		if (!isTrustedApiRequest(request, this.trustedHosts)) return 403;
+		const carrier = this.ctx.get("webServer");
+		if (!isTrustedApiRequest(request, this.trustedHosts, carrier?.host, carrier?.protocol ?? "http:")) return 403;
 		const authority = this.sessionAuthority;
 		if (authority === void 0) return this.browserAuth.isAuthenticated(request) ? void 0 : 401;
 		if (authority.isPublicApiRequest(request)) return void 0;

package/lib/types/api-request-trust.d.ts

@@ -4,13 +4,12 @@
  * the attacker's domain while the socket reaches this server) and cross-site
  * requests fired from a malicious page. The Host fence binds every request,
  * browser-looking or not: over plain HTTP a browser attaches neither Origin
- * nor Fetch-Metadata to reads (images and navigations — those
- * headers go only to trustworthy destinations), so an unmarked request may
- * still be a rebound browser read and Host is the one header rebinding cannot
- * forge. Non-browser and remote clients pass the same fence via loopback,
- * deployment-derived LAN IP literals, or a declared `trustedHosts` authority.
- * Network reachability and authentication stay out of scope: binding policy
- * belongs to the webserver config, and this fence is not an auth layer.
+ * nor Fetch-Metadata to reads (images and navigations — those headers go only
+ * to trustworthy destinations), so an unmarked request may still be a rebound
+ * browser read and Host is the one header rebinding cannot forge. Non-browser
+ * and remote clients pass the same fence via loopback, the listener's bind IP
+ * literal, or a declared `trustedHosts` authority. Binding policy belongs to
+ * the webserver config; this fence never establishes identity.
  */
 import type { ConnectionTrustRequest } from './rpc.ts';
 /**
@@ -28,11 +27,19 @@ import type { ConnectionTrustRequest } from './rpc.ts';
  * @param entry - the configured value, verbatim.
  */
 export declare function assertTrustedAuthority(entry: string): void;
+/**
+ * Classify an authority already accepted by {@link assertTrustedAuthority}.
+ * @param entry - the configured authority, verbatim.
+ * @returns true unless the entry parses as a loopback hostname.
+ */
+export declare function isRemoteAuthority(entry: string): boolean;
 /**
  * Decide whether one /api request may reach the RPC bridge.
  * @param request - Node HTTP or Fetch request facts (headers).
  * @param trustedHosts - non-loopback authorities this deployment serves: exact `host:port`, or port-less `host` matching any port.
- * @returns true when the Host is ours (loopback or trusted) and any attached browser markers are same-origin.
+ * @param bindHost - the listener's own bind IP literal, accepted on any port independently of `trustedHosts`.
+ * @param protocol - listener protocol for default Host ports; HTTP when no Web carrier is mounted.
+ * @returns true when the Host is ours (loopback, the bind address, or trusted) and any attached browser markers are same-origin.
  */
-export declare function isTrustedApiRequest(request: ConnectionTrustRequest, trustedHosts: readonly string[]): boolean;
+export declare function isTrustedApiRequest(request: ConnectionTrustRequest, trustedHosts: readonly string[], bindHost?: string, protocol?: 'http:' | 'https:'): boolean;
 //# sourceMappingURL=api-request-trust.d.ts.map

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@qilin-agent/client-connection",
   "description": "Authenticated RPC transport and generation lifecycle",
-  "version": "3.1.3",
+  "version": "3.1.5",
   "publishConfig": {
     "access": "public"
   },
@@ -38,7 +38,7 @@
   "license": "MIT",
   "dependencies": {
     "zod": "^4.4.3",
-    "@qilin-agent/credentials": "3.1.3",
+    "@qilin-agent/credentials": "3.1.5",
     "@qilin-agent/schemastery": "~3.18.3"
   },
   "files": [
@@ -47,22 +47,22 @@
     "lib/types/**/*.d.ts"
   ],
   "peerDependencies": {
-    "@qilin-agent/scope": "3.1.3",
-    "@qilin-agent/kylin": "~4.0.3"
+    "@qilin-agent/kylin": "~4.0.3",
+    "@qilin-agent/scope": "3.1.5"
   },
   "devDependencies": {
     "@qilin-agent/kylin": "~4.0.3",
-    "@qilin-agent/attachment": "3.1.3",
-    "@qilin-agent/brand": "3.1.3",
-    "@qilin-agent/host-webserver": "3.1.3",
-    "@qilin-agent/llm": "3.1.3",
-    "@qilin-agent/scope": "3.1.3",
-    "@qilin-agent/session": "3.1.3",
-    "@qilin-agent/typert-protocol": "3.1.3",
-    "@qilin-agent/tool-todo": "3.1.3",
-    "@qilin-agent/util-values": "3.1.3",
-    "@qilin-agent/commands": "3.1.3",
-    "@qilin-agent/settings": "3.1.3",
-    "@qilin-agent/host-directory-picker": "3.1.3"
+    "@qilin-agent/brand": "3.1.5",
+    "@qilin-agent/attachment": "3.1.5",
+    "@qilin-agent/host-webserver": "3.1.5",
+    "@qilin-agent/llm": "3.1.5",
+    "@qilin-agent/session": "3.1.5",
+    "@qilin-agent/typert-protocol": "3.1.5",
+    "@qilin-agent/scope": "3.1.5",
+    "@qilin-agent/tool-todo": "3.1.5",
+    "@qilin-agent/commands": "3.1.5",
+    "@qilin-agent/util-values": "3.1.5",
+    "@qilin-agent/settings": "3.1.5",
+    "@qilin-agent/host-directory-picker": "3.1.5"
   }
 }