@wardby/cli 0.2.1 → 0.4.0

package/dist/sandbox/fetch-policy.d.ts

@@ -4,15 +4,33 @@ export type ResolvedAddress = {
 };
 export type Resolver = (hostname: string) => Promise<ResolvedAddress[]>;
 export interface FetchPolicyOptions {
+    /**
+     * Egress allowlist, enforced only with `restrictToAllowedHosts`. It can only
+     * NARROW where fetch may go: a listed host must still resolve exclusively to
+     * global addresses. Tool-controlled lists belong here.
+     */
     allowedHosts?: string[];
-    allowPrivateHosts?: boolean;
-    resolve?: Resolver;
     restrictToAllowedHosts?: boolean;
+    /**
+     * Hosts that may resolve to a non-global (private/loopback/link-local)
+     * address. Operator-controlled ONLY (WARDBY_FETCH_ALLOWED_HOSTS) — never
+     * populate it from a tool's or caller's own capability list. Cloud metadata
+     * endpoints stay blocked even when listed here.
+     */
+    privateHostAllowlist?: string[];
+    resolve?: Resolver;
 }
 export declare class FetchPolicyError extends Error {
     constructor();
 }
 export declare function isGlobalAddress(address: string): boolean;
+/**
+ * True for a cloud metadata address, including IPv6 encodings of the IPv4
+ * ones: IPv4-mapped/-compatible (::ffff:0:0/96, ::/96), NAT64 well-known
+ * (64:ff9b::/96), RFC 8215 local-use NAT64 (64:ff9b:1::/48, /96 and RFC 6052
+ * /48 layouts) and 6to4 (2002::/16). A zone id is ignored for the comparison.
+ */
+export declare function isCloudMetadataAddress(address: string): boolean;
 export declare function normalizeHost(host: string): string;
 export declare function parseAllowedHosts(value: string | undefined): string[];
 export declare function resolveDestination(urlString: string, options?: FetchPolicyOptions): Promise<{

package/dist/sandbox/fetch-policy.js

@@ -33,6 +33,9 @@ function v6(ip) {
     return groups.reduce((n, g) => (n << 16n) + BigInt("0x" + g), 0n);
 }
 export function isGlobalAddress(address) {
+    // Zone-scoped (fe80::1%eth0) answers are link-local by nature; never global.
+    if (address.includes("%"))
+        return false;
     if (isIP(address) === 4)
         return !blockedV4.some(([net, prefix]) => v4(address) >>> (32 - prefix) === v4(net) >>> (32 - prefix));
     if (isIP(address) !== 6)
@@ -51,9 +54,57 @@ export function isGlobalAddress(address) {
             return n >> shift === v6(net) >> shift;
         }));
 }
+/**
+ * Cloud instance-metadata endpoints: GCP/AWS/Azure IMDS, GKE metadata proxy,
+ * ECS task credentials, EKS Pod Identity, Alibaba Cloud; plus the AWS, EKS and
+ * GCE IPv6 addresses.
+ */
+const METADATA_V4 = new Set([
+    "169.254.169.254",
+    "169.254.169.252",
+    "169.254.170.2",
+    "169.254.170.23",
+    "100.100.100.200",
+]);
+const METADATA_V6 = new Set(["fd00:ec2::254", "fd00:ec2::23", "fd20:ce::254"].map(v6));
+const METADATA_HOSTNAMES = new Set(["metadata.google.internal", "metadata"]);
+const NAT64_WELL_KNOWN = v6("64:ff9b::") >> 32n;
+const NAT64_LOCAL_USE = v6("64:ff9b:1::") >> 80n;
+const SIX_TO_FOUR = 0x2002n;
+function v4FromBits(bits) {
+    const n = Number(bits & 0xffffffffn);
+    return [24, 16, 8, 0].map((shift) => (n >>> shift) & 0xff).join(".");
+}
+/**
+ * True for a cloud metadata address, including IPv6 encodings of the IPv4
+ * ones: IPv4-mapped/-compatible (::ffff:0:0/96, ::/96), NAT64 well-known
+ * (64:ff9b::/96), RFC 8215 local-use NAT64 (64:ff9b:1::/48, /96 and RFC 6052
+ * /48 layouts) and 6to4 (2002::/16). A zone id is ignored for the comparison.
+ */
+export function isCloudMetadataAddress(address) {
+    const bare = address.split("%")[0];
+    if (isIP(bare) === 4)
+        return METADATA_V4.has(bare);
+    if (isIP(bare) !== 6)
+        return false;
+    const n = v6(new URL("http://[" + bare + "]").hostname.slice(1, -1));
+    if (METADATA_V6.has(n))
+        return true;
+    const embedded = [];
+    const high96 = n >> 32n;
+    if (high96 === 0n || high96 === 0xffffn || high96 === NAT64_WELL_KNOWN)
+        embedded.push(n);
+    if (n >> 80n === NAT64_LOCAL_USE)
+        embedded.push(n, (((n >> 64n) & 0xffffn) << 16n) | ((n >> 40n) & 0xffffn));
+    if (n >> 112n === SIX_TO_FOUR)
+        embedded.push(n >> 80n);
+    return embedded.some((bits) => METADATA_V4.has(v4FromBits(bits)));
+}
 export function normalizeHost(host) {
     if (!host || /[\s*/@?#\\]/.test(host))
         throw new FetchPolicyError();
+    if (host.startsWith("[") !== host.endsWith("]"))
+        throw new FetchPolicyError();
     const value = host.startsWith("[") ? host.slice(1, -1) : host;
     if (isIP(value))
         return new URL(isIP(value) === 6 ? "http://[" + value + "]" : "http://" + value).hostname
@@ -61,7 +112,10 @@ export function normalizeHost(host) {
             .toLowerCase();
     if (host.includes(":"))
         throw new FetchPolicyError();
-    return new URL("http://" + host).hostname.toLowerCase().replace(/\.$/, "");
+    const name = new URL("http://" + host).hostname.toLowerCase().replace(/\.+$/, "");
+    if (!name)
+        throw new FetchPolicyError();
+    return name;
 }
 export function parseAllowedHosts(value) {
     return value === undefined || value === "" ? [] : value.split(",").map((host) => normalizeHost(host.trim()));
@@ -77,17 +131,24 @@ export async function resolveDestination(urlString, options = {}) {
     if (!["http:", "https:"].includes(url.protocol) || url.username || url.password || urlString.length > 8192)
         throw new FetchPolicyError();
     const hostname = normalizeHost(url.hostname);
+    if (METADATA_HOSTNAMES.has(hostname))
+        throw new FetchPolicyError();
     const allowed = (options.allowedHosts ?? []).map(normalizeHost).includes(hostname);
     if (options.restrictToAllowedHosts && !allowed)
         throw new FetchPolicyError();
+    // Only the operator list may open a non-global destination; a restricted
+    // caller additionally needs the host in its own list (checked just above).
+    const privateAllowed = (options.privateHostAllowlist ?? []).map(normalizeHost).includes(hostname);
     const version = isIP(hostname);
     const addresses = version
         ? [{ address: hostname, family: version }]
         : await (options.resolve ?? ((host) => lookup(host, { all: true })))(hostname);
     if (!addresses.length ||
-        addresses.some((a) => !isIP(a.address) ||
+        addresses.some((a) => a.address.includes("%") ||
+            !isIP(a.address) ||
             isIP(a.address) !== a.family ||
-            (!isGlobalAddress(a.address) && !(allowed && options.allowPrivateHosts !== false))))
+            isCloudMetadataAddress(a.address) ||
+            (!isGlobalAddress(a.address) && !privateAllowed)))
         throw new FetchPolicyError();
     return { url, hostname, address: addresses[0].address, family: addresses[0].family };
 }

package/dist/sandbox/host-functions.d.ts

@@ -8,8 +8,16 @@ import type { QuickJSContext, QuickJSRuntime } from "quickjs-emscripten";
 import type { Datastore } from "../providers/datastore/types.js";
 import type { SecretsAccessor } from "../core/secrets.js";
 import type { SharedDatastoreAccessor } from "../core/datastores.js";
+import { type FetchPolicyOptions } from "./fetch-policy.js";
 import { type Logger } from "../core/logger.js";
 import { type ParserWorkerPool } from "./parser-worker/pool.js";
+/**
+ * Fetch policy for one tool invocation. The tool's own host list only narrows
+ * egress; private destinations open solely via the operator's
+ * WARDBY_FETCH_ALLOWED_HOSTS (and, for a non-wildcard tool, only when the tool
+ * also lists the host). Cloud metadata stays blocked either way (fetch-policy.ts).
+ */
+export declare function sandboxFetchPolicy(toolHosts: readonly string[], operatorHosts?: readonly string[]): FetchPolicyOptions;
 export interface HostFunctionOptions {
     signal?: AbortSignal;
     agentId: string;
@@ -23,7 +31,7 @@ export interface HostFunctionOptions {
     logger?: Logger;
     /** Overrides the shared default parser-worker pool — mainly for tests. */
     parserPool?: ParserWorkerPool;
-    /** Hosts this specific tool attachment may fetch. Omitted/empty = no outbound fetch at all; a literal "*" element lifts the restriction (existing SSRF protection against private/link-local addresses still applies). */
+    /** Hosts this specific tool attachment may fetch. Omitted/empty = no outbound fetch at all; a literal "*" element lifts the restriction. Either way this list only narrows egress: private/link-local destinations need the operator's WARDBY_FETCH_ALLOWED_HOSTS, and cloud metadata is always blocked. */
     allowedFetchHosts?: string[];
 }
 export declare function installHostFunctions(context: QuickJSContext, runtime: QuickJSRuntime, options: HostFunctionOptions): void;

package/dist/sandbox/host-functions.js

@@ -19,6 +19,17 @@ import { redactPii } from "./pii-redaction.js";
 const MIN_REDACTABLE_SECRET_LENGTH = 6;
 const FETCH_ALLOWED_HOSTS = parseAllowedHosts(process.env.WARDBY_FETCH_ALLOWED_HOSTS);
 let sharedParserPool;
+/**
+ * Fetch policy for one tool invocation. The tool's own host list only narrows
+ * egress; private destinations open solely via the operator's
+ * WARDBY_FETCH_ALLOWED_HOSTS (and, for a non-wildcard tool, only when the tool
+ * also lists the host). Cloud metadata stays blocked either way (fetch-policy.ts).
+ */
+export function sandboxFetchPolicy(toolHosts, operatorHosts = FETCH_ALLOWED_HOSTS) {
+    if (toolHosts.includes(FETCH_WILDCARD))
+        return { privateHostAllowlist: [...operatorHosts] };
+    return { allowedHosts: [...toolHosts], restrictToAllowedHosts: true, privateHostAllowlist: [...operatorHosts] };
+}
 function args(argsJson) {
     return JSON.parse(argsJson);
 }
@@ -74,11 +85,7 @@ export function installHostFunctions(context, runtime, options) {
     });
     register("__bridge_fetch", async (argsJson) => {
         const [url, init] = args(argsJson);
-        const hosts = allowedFetchHosts ?? [];
-        if (hosts.includes(FETCH_WILDCARD)) {
-            return safeFetch(url, init, { allowedHosts: FETCH_ALLOWED_HOSTS, signal });
-        }
-        return safeFetch(url, init, { allowedHosts: hosts, restrictToAllowedHosts: true, signal });
+        return safeFetch(url, init, { ...sandboxFetchPolicy(allowedFetchHosts ?? []), signal });
     });
     register("__bridge_datastoreGet", async (argsJson) => {
         const [key] = args(argsJson);

package/dist/serve.js

@@ -33,12 +33,18 @@ export async function startServe(options = {}) {
     const concurrency = loadCodingConcurrencyConfig();
     const providers = options.providers ?? buildMcpProviders().providers;
     const mcp = await startMcp({ providers, schedulerAttached: true });
-    const reconciler = startReconciler({ executor: providers.executor });
+    const reconciler = startReconciler({
+        executor: providers.executor,
+        reviewHosts: providers.reviewHosts,
+        issueTrackers: providers.issueTrackers,
+    });
+    const selfDefects = { db: prisma, issueTrackers: providers.issueTrackers };
     const scheduler = startScheduler({
         executor: providers.executor,
         scope: options.scope,
+        selfDefects,
         onLeaderTick: async () => {
-            await drainCodingQueue({ db: prisma, executor: providers.executor, ...concurrency });
+            await drainCodingQueue({ db: prisma, executor: providers.executor, ...concurrency, selfDefects });
         },
     });
     return {