@truefoundry/trueforge-core 0.2.0-rc.6 → 0.2.1

package/dist/core/util/ssrfGuard.js

@@ -0,0 +1,333 @@
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// src/core/util/ssrfGuard.ts
+var ssrfGuard_exports = {};
+__export(ssrfGuard_exports, {
+  assertSafeOutboundUrl: () => assertSafeOutboundUrl,
+  configureOutboundUrlGuard: () => configureOutboundUrlGuard,
+  mcpSsrfFetch: () => mcpSsrfFetch,
+  ssrfFetch: () => ssrfFetch
+});
+module.exports = __toCommonJS(ssrfGuard_exports);
+var import_node_dns = require("dns");
+var import_promises = require("dns/promises");
+var import_node_net = require("net");
+var import_undici = require("undici");
+var allowedHosts = [];
+var blockedHosts = [];
+var guardEnabled = true;
+var URL_VERIFY = {
+  allowedProtocols: ["http:", "https:"],
+  denyCidrsV4: [
+    "0.0.0.0/8",
+    // this host
+    "10.0.0.0/8",
+    // private
+    "100.64.0.0/10",
+    // CGNAT (EKS secondary pod CIDRs)
+    "127.0.0.0/8",
+    // loopback
+    "169.254.0.0/16",
+    // link-local + metadata
+    "172.16.0.0/12",
+    // private (docker, k8s service CIDRs)
+    "192.0.0.0/24",
+    // IETF protocol assignments
+    "192.0.2.0/24",
+    // TEST-NET-1
+    "192.88.99.0/24",
+    // 6to4 relay anycast
+    "192.168.0.0/16",
+    // private
+    "198.18.0.0/15",
+    // benchmarking
+    "198.51.100.0/24",
+    // TEST-NET-2
+    "203.0.113.0/24",
+    // TEST-NET-3
+    "224.0.0.0/4",
+    // multicast
+    "240.0.0.0/4"
+    // reserved + broadcast
+  ],
+  denyCidrsV6: [
+    "::/96",
+    // unspecified, ::1, IPv4-compatible
+    "64:ff9b::/96",
+    // NAT64 well-known
+    "64:ff9b:1::/48",
+    // NAT64 local-use
+    "100::/64",
+    // discard-only
+    "2001::/32",
+    // Teredo
+    "2001:10::/28",
+    // ORCHID
+    "2001:20::/28",
+    // ORCHIDv2
+    "2001:db8::/32",
+    // documentation
+    "2002::/16",
+    // 6to4
+    "fc00::/7",
+    // unique-local (IPv6 k8s service CIDRs)
+    "fe80::/10",
+    // link-local
+    "ff00::/8"
+    // multicast
+  ],
+  denyHostSuffixes: [
+    ".local",
+    ".localhost",
+    ".localdomain",
+    ".internal",
+    ".svc",
+    ".cluster",
+    ".arpa",
+    ".lan",
+    ".intranet",
+    ".corp",
+    ".home",
+    ".test",
+    ".invalid",
+    ".example"
+  ]
+};
+var privateNets = new import_node_net.BlockList();
+function addDenyCidrs(cidrs, family) {
+  for (const cidr of cidrs) {
+    const slash = cidr.lastIndexOf("/");
+    privateNets.addSubnet(cidr.slice(0, slash), Number(cidr.slice(slash + 1)), family);
+  }
+}
+addDenyCidrs(URL_VERIFY.denyCidrsV4, "ipv4");
+addDenyCidrs(URL_VERIFY.denyCidrsV6, "ipv6");
+var MAX_REDIRECTS = 20;
+var REDIRECT_STATUSES = /* @__PURE__ */ new Set([301, 302, 303, 307, 308]);
+var CROSS_ORIGIN_STRIPPED_HEADERS = ["authorization", "proxy-authorization", "cookie", "host"];
+function configureOutboundUrlGuard(config) {
+  guardEnabled = config.enabled ?? true;
+  allowedHosts = config.allowedHosts.map(normalizeHost);
+  blockedHosts = config.blockedHosts.map(normalizeHost);
+}
+function normalizeHost(hostname) {
+  const host = hostname.replace(/\.$/, "").toLowerCase();
+  return host.startsWith("[") && host.endsWith("]") ? host.slice(1, -1) : host;
+}
+function isPrivateIp(address) {
+  const ip = address.replace(/^::ffff:/i, "");
+  if ((0, import_node_net.isIP)(ip) === 4) {
+    return privateNets.check(ip, "ipv4");
+  }
+  if ((0, import_node_net.isIP)(ip) === 6) {
+    return privateNets.check(ip, "ipv6");
+  }
+  return true;
+}
+function blockedError(host, cause) {
+  return new Error(`Outbound URL blocked for host "${host}"`, { cause });
+}
+function deny(host, cause) {
+  throw blockedError(host, cause);
+}
+function assertHost(host) {
+  if (host === "" || blockedHosts.includes(host)) {
+    deny(host);
+  }
+  if (allowedHosts.includes(host)) {
+    return;
+  }
+  if ((0, import_node_net.isIP)(host) === 0) {
+    if (!host.includes(".") || URL_VERIFY.denyHostSuffixes.some((suffix) => host.endsWith(suffix))) {
+      deny(host);
+    }
+    return;
+  }
+  if (isPrivateIp(host)) {
+    deny(host);
+  }
+}
+function parseOutboundUrl(input) {
+  let url;
+  try {
+    url = new URL(input instanceof Request ? input.url : input);
+  } catch (error) {
+    throw new Error("Outbound URL blocked", { cause: error });
+  }
+  if (!URL_VERIFY.allowedProtocols.includes(url.protocol)) {
+    throw new Error("Outbound URL blocked: only http and https are allowed");
+  }
+  return url;
+}
+var guardedLookup = (hostname, options, callback) => {
+  if (!guardEnabled) {
+    (0, import_node_dns.lookup)(hostname, options, callback);
+    return;
+  }
+  const host = normalizeHost(hostname);
+  try {
+    assertHost(host);
+  } catch (error) {
+    callback(error instanceof Error ? error : blockedError(host, error), "");
+    return;
+  }
+  if (allowedHosts.includes(host) || (0, import_node_net.isIP)(host) !== 0) {
+    (0, import_node_dns.lookup)(hostname, options, callback);
+    return;
+  }
+  const allOptions = { ...options, all: true };
+  (0, import_node_dns.lookup)(hostname, allOptions, (err, addresses) => {
+    if (err) {
+      callback(err, "");
+      return;
+    }
+    const first = addresses[0];
+    if (first === void 0 || addresses.some((record) => isPrivateIp(record.address))) {
+      callback(blockedError(host), "");
+      return;
+    }
+    if (options.all) {
+      callback(null, addresses);
+      return;
+    }
+    callback(null, first.address, first.family);
+  });
+};
+var MCP_BODY_TIMEOUT_MS = 30 * 60 * 1e3;
+var outboundAgent = new import_undici.Agent({
+  connect: { lookup: guardedLookup }
+});
+var mcpOutboundAgent = new import_undici.Agent({
+  // MCP SSE/streamable-HTTP stays idle between tool calls; undici's 300s bodyTimeout kills it.
+  bodyTimeout: MCP_BODY_TIMEOUT_MS,
+  connect: { lookup: guardedLookup }
+});
+async function assertSafeOutboundUrl(input) {
+  const url = parseOutboundUrl(input);
+  if (!guardEnabled) {
+    return;
+  }
+  const host = normalizeHost(url.hostname);
+  assertHost(host);
+  if (allowedHosts.includes(host) || (0, import_node_net.isIP)(host) !== 0) {
+    return;
+  }
+  let addresses;
+  try {
+    addresses = (await (0, import_promises.lookup)(host, { all: true })).map((record) => record.address);
+  } catch (error) {
+    deny(host, error);
+  }
+  if (addresses.some(isPrivateIp)) {
+    deny(host);
+  }
+}
+function nextHop(response, location, current, init) {
+  let nextUrl;
+  try {
+    nextUrl = new URL(location, current);
+  } catch (error) {
+    throw new Error("Outbound URL blocked", { cause: error });
+  }
+  if (!URL_VERIFY.allowedProtocols.includes(nextUrl.protocol)) {
+    throw new Error("Outbound URL blocked: only http and https are allowed");
+  }
+  const headers = new Headers(init.headers);
+  let method = (init.method ?? "GET").toUpperCase();
+  let body = init.body ?? null;
+  const downgradesToGet = (response.status === 301 || response.status === 302) && method === "POST" || response.status === 303 && method !== "GET" && method !== "HEAD";
+  if (downgradesToGet) {
+    method = "GET";
+    body = null;
+    headers.delete("content-encoding");
+    headers.delete("content-language");
+    headers.delete("content-location");
+    headers.delete("content-type");
+    headers.delete("content-length");
+  }
+  if (nextUrl.origin !== current.origin) {
+    for (const header of CROSS_ORIGIN_STRIPPED_HEADERS) {
+      headers.delete(header);
+    }
+  }
+  return { url: nextUrl, init: { ...init, method, headers, body } };
+}
+function mergeRequestInit(input, init) {
+  if (!(input instanceof Request)) {
+    return init;
+  }
+  return {
+    method: input.method,
+    headers: input.headers,
+    body: input.body,
+    signal: input.signal,
+    redirect: input.redirect,
+    ...init
+  };
+}
+async function guardedFetch(input, init, hopsLeft, agent) {
+  const url = parseOutboundUrl(input);
+  if (guardEnabled) {
+    assertHost(normalizeHost(url.hostname));
+  }
+  const merged = mergeRequestInit(input, init);
+  const redirect = merged.redirect ?? "follow";
+  const followsRedirects = guardEnabled && redirect === "follow";
+  const requestInit = {
+    redirect: followsRedirects ? "manual" : redirect,
+    dispatcher: agent
+  };
+  Object.assign(requestInit, merged, {
+    redirect: followsRedirects ? "manual" : redirect,
+    dispatcher: agent,
+    ...merged.body != null && typeof merged.body === "object" && "getReader" in merged.body ? { duplex: "half" } : {}
+  });
+  const response = await (0, import_undici.fetch)(url.href, requestInit);
+  if (!followsRedirects) {
+    return response;
+  }
+  if (!REDIRECT_STATUSES.has(response.status)) {
+    return response;
+  }
+  const location = response.headers.get("location");
+  if (location === null) {
+    return response;
+  }
+  void response.body?.cancel().catch(() => void 0);
+  if (hopsLeft === 0) {
+    throw new Error("Outbound URL blocked: too many redirects");
+  }
+  const hop = nextHop(response, location, url, merged);
+  return guardedFetch(hop.url, hop.init, hopsLeft - 1, agent);
+}
+async function ssrfFetch(input, init) {
+  return guardedFetch(input, init ?? {}, MAX_REDIRECTS, outboundAgent);
+}
+async function mcpSsrfFetch(input, init) {
+  return guardedFetch(input, init ?? {}, MAX_REDIRECTS, mcpOutboundAgent);
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  assertSafeOutboundUrl,
+  configureOutboundUrlGuard,
+  mcpSsrfFetch,
+  ssrfFetch
+});
+//# sourceMappingURL=ssrfGuard.js.map

package/dist/core/util/ssrfGuard.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../src/core/util/ssrfGuard.ts"],"sourcesContent":["import type { LookupAllOptions, LookupOptions } from 'node:dns';\nimport { lookup as dnsLookup } from 'node:dns';\nimport { lookup as dnsLookupAsync } from 'node:dns/promises';\nimport { BlockList, isIP, type LookupFunction } from 'node:net';\nimport { Agent, fetch as undiciFetch } from 'undici';\n\nlet allowedHosts: string[] = [];\nlet blockedHosts: string[] = [];\nlet guardEnabled = true;\n\nconst URL_VERIFY = {\n  allowedProtocols: ['http:', 'https:'],\n  denyCidrsV4: [\n    '0.0.0.0/8', // this host\n    '10.0.0.0/8', // private\n    '100.64.0.0/10', // CGNAT (EKS secondary pod CIDRs)\n    '127.0.0.0/8', // loopback\n    '169.254.0.0/16', // link-local + metadata\n    '172.16.0.0/12', // private (docker, k8s service CIDRs)\n    '192.0.0.0/24', // IETF protocol assignments\n    '192.0.2.0/24', // TEST-NET-1\n    '192.88.99.0/24', // 6to4 relay anycast\n    '192.168.0.0/16', // private\n    '198.18.0.0/15', // benchmarking\n    '198.51.100.0/24', // TEST-NET-2\n    '203.0.113.0/24', // TEST-NET-3\n    '224.0.0.0/4', // multicast\n    '240.0.0.0/4', // reserved + broadcast\n  ],\n  denyCidrsV6: [\n    '::/96', // unspecified, ::1, IPv4-compatible\n    '64:ff9b::/96', // NAT64 well-known\n    '64:ff9b:1::/48', // NAT64 local-use\n    '100::/64', // discard-only\n    '2001::/32', // Teredo\n    '2001:10::/28', // ORCHID\n    '2001:20::/28', // ORCHIDv2\n    '2001:db8::/32', // documentation\n    '2002::/16', // 6to4\n    'fc00::/7', // unique-local (IPv6 k8s service CIDRs)\n    'fe80::/10', // link-local\n    'ff00::/8', // multicast\n  ],\n  denyHostSuffixes: [\n    '.local',\n    '.localhost',\n    '.localdomain',\n    '.internal',\n    '.svc',\n    '.cluster',\n    '.arpa',\n    '.lan',\n    '.intranet',\n    '.corp',\n    '.home',\n    '.test',\n    '.invalid',\n    '.example',\n  ],\n};\n\nconst privateNets = new BlockList();\nfunction addDenyCidrs(cidrs: readonly string[], family: 'ipv4' | 'ipv6'): void {\n  for (const cidr of cidrs) {\n    const slash = cidr.lastIndexOf('/');\n    privateNets.addSubnet(cidr.slice(0, slash), Number(cidr.slice(slash + 1)), family);\n  }\n}\naddDenyCidrs(URL_VERIFY.denyCidrsV4, 'ipv4');\naddDenyCidrs(URL_VERIFY.denyCidrsV6, 'ipv6');\n\nconst MAX_REDIRECTS = 20;\nconst REDIRECT_STATUSES = new Set([301, 302, 303, 307, 308]);\nconst CROSS_ORIGIN_STRIPPED_HEADERS = ['authorization', 'proxy-authorization', 'cookie', 'host'];\n\nexport function configureOutboundUrlGuard(config: {\n  enabled?: boolean;\n  allowedHosts: readonly string[];\n  blockedHosts: readonly string[];\n}): void {\n  guardEnabled = config.enabled ?? true;\n  allowedHosts = config.allowedHosts.map(normalizeHost);\n  blockedHosts = config.blockedHosts.map(normalizeHost);\n}\n\nfunction normalizeHost(hostname: string): string {\n  const host = hostname.replace(/\\.$/, '').toLowerCase();\n  return host.startsWith('[') && host.endsWith(']') ? host.slice(1, -1) : host;\n}\n\nfunction isPrivateIp(address: string): boolean {\n  const ip = address.replace(/^::ffff:/i, '');\n  if (isIP(ip) === 4) {\n    return privateNets.check(ip, 'ipv4');\n  }\n  if (isIP(ip) === 6) {\n    return privateNets.check(ip, 'ipv6');\n  }\n  return true;\n}\n\nfunction blockedError(host: string, cause?: unknown): Error {\n  return new Error(`Outbound URL blocked for host \"${host}\"`, { cause });\n}\n\nfunction deny(host: string, cause?: unknown): never {\n  throw blockedError(host, cause);\n}\n\nfunction assertHost(host: string): void {\n  if (host === '' || blockedHosts.includes(host)) {\n    deny(host);\n  }\n  if (allowedHosts.includes(host)) {\n    return;\n  }\n  if (isIP(host) === 0) {\n    if (!host.includes('.') || URL_VERIFY.denyHostSuffixes.some(suffix => host.endsWith(suffix))) {\n      deny(host);\n    }\n    return;\n  }\n  if (isPrivateIp(host)) {\n    deny(host);\n  }\n}\n\nfunction parseOutboundUrl(input: string | URL | Request): URL {\n  let url: URL;\n  try {\n    url = new URL(input instanceof Request ? input.url : input);\n  } catch (error) {\n    throw new Error('Outbound URL blocked', { cause: error });\n  }\n  if (!URL_VERIFY.allowedProtocols.includes(url.protocol)) {\n    throw new Error('Outbound URL blocked: only http and https are allowed');\n  }\n  return url;\n}\n\n/** undici runs this as the socket lookup, so the addresses we allow are the ones connected to. */\nconst guardedLookup: LookupFunction = (hostname, options: LookupOptions, callback) => {\n  if (!guardEnabled) {\n    dnsLookup(hostname, options, callback);\n    return;\n  }\n  const host = normalizeHost(hostname);\n  try {\n    assertHost(host);\n  } catch (error) {\n    callback(error instanceof Error ? error : blockedError(host, error), '');\n    return;\n  }\n  if (allowedHosts.includes(host) || isIP(host) !== 0) {\n    dnsLookup(hostname, options, callback);\n    return;\n  }\n  const allOptions: LookupAllOptions = { ...options, all: true };\n  dnsLookup(hostname, allOptions, (err, addresses) => {\n    if (err) {\n      callback(err, '');\n      return;\n    }\n    const first = addresses[0];\n    if (first === undefined || addresses.some(record => isPrivateIp(record.address))) {\n      callback(blockedError(host), '');\n      return;\n    }\n    if (options.all) {\n      callback(null, addresses);\n      return;\n    }\n    callback(null, first.address, first.family);\n  });\n};\n\nconst MCP_BODY_TIMEOUT_MS = 30 * 60 * 1000;\n\nconst outboundAgent = new Agent({\n  connect: { lookup: guardedLookup },\n});\n\nconst mcpOutboundAgent = new Agent({\n  // MCP SSE/streamable-HTTP stays idle between tool calls; undici's 300s bodyTimeout kills it.\n  bodyTimeout: MCP_BODY_TIMEOUT_MS,\n  connect: { lookup: guardedLookup },\n});\n\nexport async function assertSafeOutboundUrl(input: string | URL | Request): Promise<void> {\n  const url = parseOutboundUrl(input);\n  if (!guardEnabled) {\n    return;\n  }\n  const host = normalizeHost(url.hostname);\n  assertHost(host);\n  if (allowedHosts.includes(host) || isIP(host) !== 0) {\n    return;\n  }\n  let addresses: string[];\n  try {\n    addresses = (await dnsLookupAsync(host, { all: true })).map(record => record.address);\n  } catch (error) {\n    deny(host, error);\n  }\n  if (addresses.some(isPrivateIp)) {\n    deny(host);\n  }\n}\n\nfunction nextHop(\n  response: Response,\n  location: string,\n  current: URL,\n  init: RequestInit,\n): { url: URL; init: RequestInit } {\n  let nextUrl: URL;\n  try {\n    nextUrl = new URL(location, current);\n  } catch (error) {\n    throw new Error('Outbound URL blocked', { cause: error });\n  }\n  if (!URL_VERIFY.allowedProtocols.includes(nextUrl.protocol)) {\n    throw new Error('Outbound URL blocked: only http and https are allowed');\n  }\n\n  const headers = new Headers(init.headers);\n  let method = (init.method ?? 'GET').toUpperCase();\n  let body = init.body ?? null;\n  const downgradesToGet =\n    ((response.status === 301 || response.status === 302) && method === 'POST') ||\n    (response.status === 303 && method !== 'GET' && method !== 'HEAD');\n  if (downgradesToGet) {\n    method = 'GET';\n    body = null;\n    headers.delete('content-encoding');\n    headers.delete('content-language');\n    headers.delete('content-location');\n    headers.delete('content-type');\n    headers.delete('content-length');\n  }\n  if (nextUrl.origin !== current.origin) {\n    for (const header of CROSS_ORIGIN_STRIPPED_HEADERS) {\n      headers.delete(header);\n    }\n  }\n  return { url: nextUrl, init: { ...init, method, headers, body } };\n}\n\nfunction mergeRequestInit(input: string | URL | Request, init: RequestInit): RequestInit {\n  if (!(input instanceof Request)) {\n    return init;\n  }\n  return {\n    method: input.method,\n    headers: input.headers,\n    body: input.body,\n    signal: input.signal,\n    redirect: input.redirect,\n    ...init,\n  };\n}\n\nasync function guardedFetch(\n  input: string | URL | Request,\n  init: RequestInit,\n  hopsLeft: number,\n  agent: Agent,\n): Promise<Response> {\n  const url = parseOutboundUrl(input);\n  if (guardEnabled) {\n    assertHost(normalizeHost(url.hostname));\n  }\n  const merged = mergeRequestInit(input, init);\n  const redirect = merged.redirect ?? 'follow';\n  const followsRedirects = guardEnabled && redirect === 'follow';\n  const requestInit = {\n    redirect: followsRedirects ? 'manual' : redirect,\n    dispatcher: agent,\n  };\n  // npm undici vs @types/node undici-types: FormData/Headers do not line up under exactOptionalPropertyTypes.\n  Object.assign(requestInit, merged, {\n    redirect: followsRedirects ? 'manual' : redirect,\n    dispatcher: agent,\n    ...(merged.body != null && typeof merged.body === 'object' && 'getReader' in merged.body\n      ? { duplex: 'half' as const }\n      : {}),\n  });\n  const response = await undiciFetch(url.href, requestInit);\n  if (!followsRedirects) {\n    return response;\n  }\n  if (!REDIRECT_STATUSES.has(response.status)) {\n    return response;\n  }\n  const location = response.headers.get('location');\n  if (location === null) {\n    return response;\n  }\n  void response.body?.cancel().catch(() => undefined);\n  if (hopsLeft === 0) {\n    throw new Error('Outbound URL blocked: too many redirects');\n  }\n  const hop = nextHop(response, location, url, merged);\n  return guardedFetch(hop.url, hop.init, hopsLeft - 1, agent);\n}\n\nexport async function ssrfFetch(input: string | URL | Request, init?: RequestInit): Promise<Response> {\n  return guardedFetch(input, init ?? {}, MAX_REDIRECTS, outboundAgent);\n}\n\n/** Same as `ssrfFetch` with a 30m bodyTimeout for idle MCP SSE / streamable-HTTP. */\nexport async function mcpSsrfFetch(input: string | URL | Request, init?: RequestInit): Promise<Response> {\n  return guardedFetch(input, init ?? {}, MAX_REDIRECTS, mcpOutboundAgent);\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AACA,sBAAoC;AACpC,sBAAyC;AACzC,sBAAqD;AACrD,oBAA4C;AAE5C,IAAI,eAAyB,CAAC;AAC9B,IAAI,eAAyB,CAAC;AAC9B,IAAI,eAAe;AAEnB,IAAM,aAAa;AAAA,EACjB,kBAAkB,CAAC,SAAS,QAAQ;AAAA,EACpC,aAAa;AAAA,IACX;AAAA;AAAA,IACA;AAAA;AAAA,IACA;AAAA;AAAA,IACA;AAAA;AAAA,IACA;AAAA;AAAA,IACA;AAAA;AAAA,IACA;AAAA;AAAA,IACA;AAAA;AAAA,IACA;AAAA;AAAA,IACA;AAAA;AAAA,IACA;AAAA;AAAA,IACA;AAAA;AAAA,IACA;AAAA;AAAA,IACA;AAAA;AAAA,IACA;AAAA;AAAA,EACF;AAAA,EACA,aAAa;AAAA,IACX;AAAA;AAAA,IACA;AAAA;AAAA,IACA;AAAA;AAAA,IACA;AAAA;AAAA,IACA;AAAA;AAAA,IACA;AAAA;AAAA,IACA;AAAA;AAAA,IACA;AAAA;AAAA,IACA;AAAA;AAAA,IACA;AAAA;AAAA,IACA;AAAA;AAAA,IACA;AAAA;AAAA,EACF;AAAA,EACA,kBAAkB;AAAA,IAChB;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF;AACF;AAEA,IAAM,cAAc,IAAI,0BAAU;AAClC,SAAS,aAAa,OAA0B,QAA+B;AAC7E,aAAW,QAAQ,OAAO;AACxB,UAAM,QAAQ,KAAK,YAAY,GAAG;AAClC,gBAAY,UAAU,KAAK,MAAM,GAAG,KAAK,GAAG,OAAO,KAAK,MAAM,QAAQ,CAAC,CAAC,GAAG,MAAM;AAAA,EACnF;AACF;AACA,aAAa,WAAW,aAAa,MAAM;AAC3C,aAAa,WAAW,aAAa,MAAM;AAE3C,IAAM,gBAAgB;AACtB,IAAM,oBAAoB,oBAAI,IAAI,CAAC,KAAK,KAAK,KAAK,KAAK,GAAG,CAAC;AAC3D,IAAM,gCAAgC,CAAC,iBAAiB,uBAAuB,UAAU,MAAM;AAExF,SAAS,0BAA0B,QAIjC;AACP,iBAAe,OAAO,WAAW;AACjC,iBAAe,OAAO,aAAa,IAAI,aAAa;AACpD,iBAAe,OAAO,aAAa,IAAI,aAAa;AACtD;AAEA,SAAS,cAAc,UAA0B;AAC/C,QAAM,OAAO,SAAS,QAAQ,OAAO,EAAE,EAAE,YAAY;AACrD,SAAO,KAAK,WAAW,GAAG,KAAK,KAAK,SAAS,GAAG,IAAI,KAAK,MAAM,GAAG,EAAE,IAAI;AAC1E;AAEA,SAAS,YAAY,SAA0B;AAC7C,QAAM,KAAK,QAAQ,QAAQ,aAAa,EAAE;AAC1C,UAAI,sBAAK,EAAE,MAAM,GAAG;AAClB,WAAO,YAAY,MAAM,IAAI,MAAM;AAAA,EACrC;AACA,UAAI,sBAAK,EAAE,MAAM,GAAG;AAClB,WAAO,YAAY,MAAM,IAAI,MAAM;AAAA,EACrC;AACA,SAAO;AACT;AAEA,SAAS,aAAa,MAAc,OAAwB;AAC1D,SAAO,IAAI,MAAM,kCAAkC,IAAI,KAAK,EAAE,MAAM,CAAC;AACvE;AAEA,SAAS,KAAK,MAAc,OAAwB;AAClD,QAAM,aAAa,MAAM,KAAK;AAChC;AAEA,SAAS,WAAW,MAAoB;AACtC,MAAI,SAAS,MAAM,aAAa,SAAS,IAAI,GAAG;AAC9C,SAAK,IAAI;AAAA,EACX;AACA,MAAI,aAAa,SAAS,IAAI,GAAG;AAC/B;AAAA,EACF;AACA,UAAI,sBAAK,IAAI,MAAM,GAAG;AACpB,QAAI,CAAC,KAAK,SAAS,GAAG,KAAK,WAAW,iBAAiB,KAAK,YAAU,KAAK,SAAS,MAAM,CAAC,GAAG;AAC5F,WAAK,IAAI;AAAA,IACX;AACA;AAAA,EACF;AACA,MAAI,YAAY,IAAI,GAAG;AACrB,SAAK,IAAI;AAAA,EACX;AACF;AAEA,SAAS,iBAAiB,OAAoC;AAC5D,MAAI;AACJ,MAAI;AACF,UAAM,IAAI,IAAI,iBAAiB,UAAU,MAAM,MAAM,KAAK;AAAA,EAC5D,SAAS,OAAO;AACd,UAAM,IAAI,MAAM,wBAAwB,EAAE,OAAO,MAAM,CAAC;AAAA,EAC1D;AACA,MAAI,CAAC,WAAW,iBAAiB,SAAS,IAAI,QAAQ,GAAG;AACvD,UAAM,IAAI,MAAM,uDAAuD;AAAA,EACzE;AACA,SAAO;AACT;AAGA,IAAM,gBAAgC,CAAC,UAAU,SAAwB,aAAa;AACpF,MAAI,CAAC,cAAc;AACjB,wBAAAA,QAAU,UAAU,SAAS,QAAQ;AACrC;AAAA,EACF;AACA,QAAM,OAAO,cAAc,QAAQ;AACnC,MAAI;AACF,eAAW,IAAI;AAAA,EACjB,SAAS,OAAO;AACd,aAAS,iBAAiB,QAAQ,QAAQ,aAAa,MAAM,KAAK,GAAG,EAAE;AACvE;AAAA,EACF;AACA,MAAI,aAAa,SAAS,IAAI,SAAK,sBAAK,IAAI,MAAM,GAAG;AACnD,wBAAAA,QAAU,UAAU,SAAS,QAAQ;AACrC;AAAA,EACF;AACA,QAAM,aAA+B,EAAE,GAAG,SAAS,KAAK,KAAK;AAC7D,sBAAAA,QAAU,UAAU,YAAY,CAAC,KAAK,cAAc;AAClD,QAAI,KAAK;AACP,eAAS,KAAK,EAAE;AAChB;AAAA,IACF;AACA,UAAM,QAAQ,UAAU,CAAC;AACzB,QAAI,UAAU,UAAa,UAAU,KAAK,YAAU,YAAY,OAAO,OAAO,CAAC,GAAG;AAChF,eAAS,aAAa,IAAI,GAAG,EAAE;AAC/B;AAAA,IACF;AACA,QAAI,QAAQ,KAAK;AACf,eAAS,MAAM,SAAS;AACxB;AAAA,IACF;AACA,aAAS,MAAM,MAAM,SAAS,MAAM,MAAM;AAAA,EAC5C,CAAC;AACH;AAEA,IAAM,sBAAsB,KAAK,KAAK;AAEtC,IAAM,gBAAgB,IAAI,oBAAM;AAAA,EAC9B,SAAS,EAAE,QAAQ,cAAc;AACnC,CAAC;AAED,IAAM,mBAAmB,IAAI,oBAAM;AAAA;AAAA,EAEjC,aAAa;AAAA,EACb,SAAS,EAAE,QAAQ,cAAc;AACnC,CAAC;AAED,eAAsB,sBAAsB,OAA8C;AACxF,QAAM,MAAM,iBAAiB,KAAK;AAClC,MAAI,CAAC,cAAc;AACjB;AAAA,EACF;AACA,QAAM,OAAO,cAAc,IAAI,QAAQ;AACvC,aAAW,IAAI;AACf,MAAI,aAAa,SAAS,IAAI,SAAK,sBAAK,IAAI,MAAM,GAAG;AACnD;AAAA,EACF;AACA,MAAI;AACJ,MAAI;AACF,iBAAa,UAAM,gBAAAC,QAAe,MAAM,EAAE,KAAK,KAAK,CAAC,GAAG,IAAI,YAAU,OAAO,OAAO;AAAA,EACtF,SAAS,OAAO;AACd,SAAK,MAAM,KAAK;AAAA,EAClB;AACA,MAAI,UAAU,KAAK,WAAW,GAAG;AAC/B,SAAK,IAAI;AAAA,EACX;AACF;AAEA,SAAS,QACP,UACA,UACA,SACA,MACiC;AACjC,MAAI;AACJ,MAAI;AACF,cAAU,IAAI,IAAI,UAAU,OAAO;AAAA,EACrC,SAAS,OAAO;AACd,UAAM,IAAI,MAAM,wBAAwB,EAAE,OAAO,MAAM,CAAC;AAAA,EAC1D;AACA,MAAI,CAAC,WAAW,iBAAiB,SAAS,QAAQ,QAAQ,GAAG;AAC3D,UAAM,IAAI,MAAM,uDAAuD;AAAA,EACzE;AAEA,QAAM,UAAU,IAAI,QAAQ,KAAK,OAAO;AACxC,MAAI,UAAU,KAAK,UAAU,OAAO,YAAY;AAChD,MAAI,OAAO,KAAK,QAAQ;AACxB,QAAM,mBACF,SAAS,WAAW,OAAO,SAAS,WAAW,QAAQ,WAAW,UACnE,SAAS,WAAW,OAAO,WAAW,SAAS,WAAW;AAC7D,MAAI,iBAAiB;AACnB,aAAS;AACT,WAAO;AACP,YAAQ,OAAO,kBAAkB;AACjC,YAAQ,OAAO,kBAAkB;AACjC,YAAQ,OAAO,kBAAkB;AACjC,YAAQ,OAAO,cAAc;AAC7B,YAAQ,OAAO,gBAAgB;AAAA,EACjC;AACA,MAAI,QAAQ,WAAW,QAAQ,QAAQ;AACrC,eAAW,UAAU,+BAA+B;AAClD,cAAQ,OAAO,MAAM;AAAA,IACvB;AAAA,EACF;AACA,SAAO,EAAE,KAAK,SAAS,MAAM,EAAE,GAAG,MAAM,QAAQ,SAAS,KAAK,EAAE;AAClE;AAEA,SAAS,iBAAiB,OAA+B,MAAgC;AACvF,MAAI,EAAE,iBAAiB,UAAU;AAC/B,WAAO;AAAA,EACT;AACA,SAAO;AAAA,IACL,QAAQ,MAAM;AAAA,IACd,SAAS,MAAM;AAAA,IACf,MAAM,MAAM;AAAA,IACZ,QAAQ,MAAM;AAAA,IACd,UAAU,MAAM;AAAA,IAChB,GAAG;AAAA,EACL;AACF;AAEA,eAAe,aACb,OACA,MACA,UACA,OACmB;AACnB,QAAM,MAAM,iBAAiB,KAAK;AAClC,MAAI,cAAc;AAChB,eAAW,cAAc,IAAI,QAAQ,CAAC;AAAA,EACxC;AACA,QAAM,SAAS,iBAAiB,OAAO,IAAI;AAC3C,QAAM,WAAW,OAAO,YAAY;AACpC,QAAM,mBAAmB,gBAAgB,aAAa;AACtD,QAAM,cAAc;AAAA,IAClB,UAAU,mBAAmB,WAAW;AAAA,IACxC,YAAY;AAAA,EACd;AAEA,SAAO,OAAO,aAAa,QAAQ;AAAA,IACjC,UAAU,mBAAmB,WAAW;AAAA,IACxC,YAAY;AAAA,IACZ,GAAI,OAAO,QAAQ,QAAQ,OAAO,OAAO,SAAS,YAAY,eAAe,OAAO,OAChF,EAAE,QAAQ,OAAgB,IAC1B,CAAC;AAAA,EACP,CAAC;AACD,QAAM,WAAW,UAAM,cAAAC,OAAY,IAAI,MAAM,WAAW;AACxD,MAAI,CAAC,kBAAkB;AACrB,WAAO;AAAA,EACT;AACA,MAAI,CAAC,kBAAkB,IAAI,SAAS,MAAM,GAAG;AAC3C,WAAO;AAAA,EACT;AACA,QAAM,WAAW,SAAS,QAAQ,IAAI,UAAU;AAChD,MAAI,aAAa,MAAM;AACrB,WAAO;AAAA,EACT;AACA,OAAK,SAAS,MAAM,OAAO,EAAE,MAAM,MAAM,MAAS;AAClD,MAAI,aAAa,GAAG;AAClB,UAAM,IAAI,MAAM,0CAA0C;AAAA,EAC5D;AACA,QAAM,MAAM,QAAQ,UAAU,UAAU,KAAK,MAAM;AACnD,SAAO,aAAa,IAAI,KAAK,IAAI,MAAM,WAAW,GAAG,KAAK;AAC5D;AAEA,eAAsB,UAAU,OAA+B,MAAuC;AACpG,SAAO,aAAa,OAAO,QAAQ,CAAC,GAAG,eAAe,aAAa;AACrE;AAGA,eAAsB,aAAa,OAA+B,MAAuC;AACvG,SAAO,aAAa,OAAO,QAAQ,CAAC,GAAG,eAAe,gBAAgB;AACxE;","names":["dnsLookup","dnsLookupAsync","undiciFetch"]}

package/dist/core/util/ssrfGuard.mjs

@@ -0,0 +1,305 @@
+// src/core/util/ssrfGuard.ts
+import { lookup as dnsLookup } from "dns";
+import { lookup as dnsLookupAsync } from "dns/promises";
+import { BlockList, isIP } from "net";
+import { Agent, fetch as undiciFetch } from "undici";
+var allowedHosts = [];
+var blockedHosts = [];
+var guardEnabled = true;
+var URL_VERIFY = {
+  allowedProtocols: ["http:", "https:"],
+  denyCidrsV4: [
+    "0.0.0.0/8",
+    // this host
+    "10.0.0.0/8",
+    // private
+    "100.64.0.0/10",
+    // CGNAT (EKS secondary pod CIDRs)
+    "127.0.0.0/8",
+    // loopback
+    "169.254.0.0/16",
+    // link-local + metadata
+    "172.16.0.0/12",
+    // private (docker, k8s service CIDRs)
+    "192.0.0.0/24",
+    // IETF protocol assignments
+    "192.0.2.0/24",
+    // TEST-NET-1
+    "192.88.99.0/24",
+    // 6to4 relay anycast
+    "192.168.0.0/16",
+    // private
+    "198.18.0.0/15",
+    // benchmarking
+    "198.51.100.0/24",
+    // TEST-NET-2
+    "203.0.113.0/24",
+    // TEST-NET-3
+    "224.0.0.0/4",
+    // multicast
+    "240.0.0.0/4"
+    // reserved + broadcast
+  ],
+  denyCidrsV6: [
+    "::/96",
+    // unspecified, ::1, IPv4-compatible
+    "64:ff9b::/96",
+    // NAT64 well-known
+    "64:ff9b:1::/48",
+    // NAT64 local-use
+    "100::/64",
+    // discard-only
+    "2001::/32",
+    // Teredo
+    "2001:10::/28",
+    // ORCHID
+    "2001:20::/28",
+    // ORCHIDv2
+    "2001:db8::/32",
+    // documentation
+    "2002::/16",
+    // 6to4
+    "fc00::/7",
+    // unique-local (IPv6 k8s service CIDRs)
+    "fe80::/10",
+    // link-local
+    "ff00::/8"
+    // multicast
+  ],
+  denyHostSuffixes: [
+    ".local",
+    ".localhost",
+    ".localdomain",
+    ".internal",
+    ".svc",
+    ".cluster",
+    ".arpa",
+    ".lan",
+    ".intranet",
+    ".corp",
+    ".home",
+    ".test",
+    ".invalid",
+    ".example"
+  ]
+};
+var privateNets = new BlockList();
+function addDenyCidrs(cidrs, family) {
+  for (const cidr of cidrs) {
+    const slash = cidr.lastIndexOf("/");
+    privateNets.addSubnet(cidr.slice(0, slash), Number(cidr.slice(slash + 1)), family);
+  }
+}
+addDenyCidrs(URL_VERIFY.denyCidrsV4, "ipv4");
+addDenyCidrs(URL_VERIFY.denyCidrsV6, "ipv6");
+var MAX_REDIRECTS = 20;
+var REDIRECT_STATUSES = /* @__PURE__ */ new Set([301, 302, 303, 307, 308]);
+var CROSS_ORIGIN_STRIPPED_HEADERS = ["authorization", "proxy-authorization", "cookie", "host"];
+function configureOutboundUrlGuard(config) {
+  guardEnabled = config.enabled ?? true;
+  allowedHosts = config.allowedHosts.map(normalizeHost);
+  blockedHosts = config.blockedHosts.map(normalizeHost);
+}
+function normalizeHost(hostname) {
+  const host = hostname.replace(/\.$/, "").toLowerCase();
+  return host.startsWith("[") && host.endsWith("]") ? host.slice(1, -1) : host;
+}
+function isPrivateIp(address) {
+  const ip = address.replace(/^::ffff:/i, "");
+  if (isIP(ip) === 4) {
+    return privateNets.check(ip, "ipv4");
+  }
+  if (isIP(ip) === 6) {
+    return privateNets.check(ip, "ipv6");
+  }
+  return true;
+}
+function blockedError(host, cause) {
+  return new Error(`Outbound URL blocked for host "${host}"`, { cause });
+}
+function deny(host, cause) {
+  throw blockedError(host, cause);
+}
+function assertHost(host) {
+  if (host === "" || blockedHosts.includes(host)) {
+    deny(host);
+  }
+  if (allowedHosts.includes(host)) {
+    return;
+  }
+  if (isIP(host) === 0) {
+    if (!host.includes(".") || URL_VERIFY.denyHostSuffixes.some((suffix) => host.endsWith(suffix))) {
+      deny(host);
+    }
+    return;
+  }
+  if (isPrivateIp(host)) {
+    deny(host);
+  }
+}
+function parseOutboundUrl(input) {
+  let url;
+  try {
+    url = new URL(input instanceof Request ? input.url : input);
+  } catch (error) {
+    throw new Error("Outbound URL blocked", { cause: error });
+  }
+  if (!URL_VERIFY.allowedProtocols.includes(url.protocol)) {
+    throw new Error("Outbound URL blocked: only http and https are allowed");
+  }
+  return url;
+}
+var guardedLookup = (hostname, options, callback) => {
+  if (!guardEnabled) {
+    dnsLookup(hostname, options, callback);
+    return;
+  }
+  const host = normalizeHost(hostname);
+  try {
+    assertHost(host);
+  } catch (error) {
+    callback(error instanceof Error ? error : blockedError(host, error), "");
+    return;
+  }
+  if (allowedHosts.includes(host) || isIP(host) !== 0) {
+    dnsLookup(hostname, options, callback);
+    return;
+  }
+  const allOptions = { ...options, all: true };
+  dnsLookup(hostname, allOptions, (err, addresses) => {
+    if (err) {
+      callback(err, "");
+      return;
+    }
+    const first = addresses[0];
+    if (first === void 0 || addresses.some((record) => isPrivateIp(record.address))) {
+      callback(blockedError(host), "");
+      return;
+    }
+    if (options.all) {
+      callback(null, addresses);
+      return;
+    }
+    callback(null, first.address, first.family);
+  });
+};
+var MCP_BODY_TIMEOUT_MS = 30 * 60 * 1e3;
+var outboundAgent = new Agent({
+  connect: { lookup: guardedLookup }
+});
+var mcpOutboundAgent = new Agent({
+  // MCP SSE/streamable-HTTP stays idle between tool calls; undici's 300s bodyTimeout kills it.
+  bodyTimeout: MCP_BODY_TIMEOUT_MS,
+  connect: { lookup: guardedLookup }
+});
+async function assertSafeOutboundUrl(input) {
+  const url = parseOutboundUrl(input);
+  if (!guardEnabled) {
+    return;
+  }
+  const host = normalizeHost(url.hostname);
+  assertHost(host);
+  if (allowedHosts.includes(host) || isIP(host) !== 0) {
+    return;
+  }
+  let addresses;
+  try {
+    addresses = (await dnsLookupAsync(host, { all: true })).map((record) => record.address);
+  } catch (error) {
+    deny(host, error);
+  }
+  if (addresses.some(isPrivateIp)) {
+    deny(host);
+  }
+}
+function nextHop(response, location, current, init) {
+  let nextUrl;
+  try {
+    nextUrl = new URL(location, current);
+  } catch (error) {
+    throw new Error("Outbound URL blocked", { cause: error });
+  }
+  if (!URL_VERIFY.allowedProtocols.includes(nextUrl.protocol)) {
+    throw new Error("Outbound URL blocked: only http and https are allowed");
+  }
+  const headers = new Headers(init.headers);
+  let method = (init.method ?? "GET").toUpperCase();
+  let body = init.body ?? null;
+  const downgradesToGet = (response.status === 301 || response.status === 302) && method === "POST" || response.status === 303 && method !== "GET" && method !== "HEAD";
+  if (downgradesToGet) {
+    method = "GET";
+    body = null;
+    headers.delete("content-encoding");
+    headers.delete("content-language");
+    headers.delete("content-location");
+    headers.delete("content-type");
+    headers.delete("content-length");
+  }
+  if (nextUrl.origin !== current.origin) {
+    for (const header of CROSS_ORIGIN_STRIPPED_HEADERS) {
+      headers.delete(header);
+    }
+  }
+  return { url: nextUrl, init: { ...init, method, headers, body } };
+}
+function mergeRequestInit(input, init) {
+  if (!(input instanceof Request)) {
+    return init;
+  }
+  return {
+    method: input.method,
+    headers: input.headers,
+    body: input.body,
+    signal: input.signal,
+    redirect: input.redirect,
+    ...init
+  };
+}
+async function guardedFetch(input, init, hopsLeft, agent) {
+  const url = parseOutboundUrl(input);
+  if (guardEnabled) {
+    assertHost(normalizeHost(url.hostname));
+  }
+  const merged = mergeRequestInit(input, init);
+  const redirect = merged.redirect ?? "follow";
+  const followsRedirects = guardEnabled && redirect === "follow";
+  const requestInit = {
+    redirect: followsRedirects ? "manual" : redirect,
+    dispatcher: agent
+  };
+  Object.assign(requestInit, merged, {
+    redirect: followsRedirects ? "manual" : redirect,
+    dispatcher: agent,
+    ...merged.body != null && typeof merged.body === "object" && "getReader" in merged.body ? { duplex: "half" } : {}
+  });
+  const response = await undiciFetch(url.href, requestInit);
+  if (!followsRedirects) {
+    return response;
+  }
+  if (!REDIRECT_STATUSES.has(response.status)) {
+    return response;
+  }
+  const location = response.headers.get("location");
+  if (location === null) {
+    return response;
+  }
+  void response.body?.cancel().catch(() => void 0);
+  if (hopsLeft === 0) {
+    throw new Error("Outbound URL blocked: too many redirects");
+  }
+  const hop = nextHop(response, location, url, merged);
+  return guardedFetch(hop.url, hop.init, hopsLeft - 1, agent);
+}
+async function ssrfFetch(input, init) {
+  return guardedFetch(input, init ?? {}, MAX_REDIRECTS, outboundAgent);
+}
+async function mcpSsrfFetch(input, init) {
+  return guardedFetch(input, init ?? {}, MAX_REDIRECTS, mcpOutboundAgent);
+}
+export {
+  assertSafeOutboundUrl,
+  configureOutboundUrlGuard,
+  mcpSsrfFetch,
+  ssrfFetch
+};
+//# sourceMappingURL=ssrfGuard.mjs.map