a2a-exposed 0.8.13 → 0.8.14

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "a2a-exposed",
-	"version": "0.8.13",
+	"version": "0.8.14",
 	"description": "Give any AI agent a public A2A (Agent2Agent) endpoint: a Cloudflare Worker, a wake webhook, or scheduled checks",
 	"type": "module",
 	"bin": {

package/worker/src/mcp.ts

@@ -80,8 +80,58 @@ export function cimdDocument(id: string, doc: any): { client_name: string; redir
 }
 export const CIMD = { maxBytes: 5120, timeoutMs: 5000, defaultTtlS: 3600, minTtlS: 60, maxTtlS: 86400, fetchesPerIpPerHour: 30, dohUrl: "https://cloudflare-dns.com/dns-query" };
 
-/** True for an IP address that is fine to fetch from: not private, loopback, link-local, CGNAT, unspecified, benchmark,
- *  documentation, multicast or reserved (IPv4 or IPv6, including IPv4-mapped / NAT64 forms). Not an IP: false. */
+/** More-specific allocations inside 2001::/23 whose IANA "Globally Reachable" flag is True (footnote 1). */
+const V6_REACHABLE = ["2001:1::1/128", "2001:1::2/128", "2001:1::3/128", "2001:3::/32", "2001:4:112::/48", "2001:20::/28", "2001:30::/28"];
+/** Blocks inside 2000::/3 that are not globally reachable. 2001::/23 covers Teredo, benchmarking, and deprecated ORCHID. */
+const V6_UNREACHABLE = ["2001::/23", "2001:db8::/32", "2002::/16", "3fff::/20"];
+
+/** Sixteen bytes, or null when `h` is not one IPv6 address (dotted tail allowed). */
+function ipv6Bytes(h: string): Uint8Array | null {
+	let s = h;
+	const tail = /^(.*:)(\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})$/.exec(s);
+	if (tail) {
+		const o = tail.slice(2).map(Number);
+		if (o.some((n) => n > 255)) return null;
+		s = `${tail[1]}${((o[0] << 8) | o[1]).toString(16)}:${((o[2] << 8) | o[3]).toString(16)}`;
+	}
+	if (s.includes(":::") || (s.includes("::") && s.indexOf("::") !== s.lastIndexOf("::"))) return null;
+	const compressed = s.includes("::");
+	const [head, rest] = compressed ? s.split("::") : [s, ""];
+	const left = head ? head.split(":") : [];
+	const right = compressed && rest ? rest.split(":") : [];
+	if (!compressed && left.length !== 8) return null;
+	if (compressed && left.length + right.length > 7) return null;
+	const groups = compressed ? [...left, ...Array(8 - left.length - right.length).fill("0"), ...right] : left;
+	if (groups.length !== 8 || groups.some((g) => !/^[0-9a-f]{1,4}$/.test(g))) return null;
+	const out = new Uint8Array(16);
+	groups.forEach((g, i) => {
+		const n = parseInt(g, 16);
+		out[i * 2] = n >> 8;
+		out[i * 2 + 1] = n & 0xff;
+	});
+	return out;
+}
+
+/** True when `addr` is inside `block` (`addr/bits`). */
+function v6Prefix(addr: Uint8Array, block: string): boolean {
+	const slash = block.lastIndexOf("/");
+	const net = ipv6Bytes(block.slice(0, slash));
+	const bits = Number(block.slice(slash + 1));
+	if (!net || !Number.isInteger(bits) || bits < 0 || bits > 128) return false;
+	let left = bits;
+	for (let i = 0; i < 16 && left > 0; i++) {
+		const take = Math.min(8, left);
+		const mask = take === 8 ? 0xff : (0xff << (8 - take)) & 0xff;
+		if ((addr[i] & mask) !== (net[i] & mask)) return false;
+		left -= take;
+	}
+	return true;
+}
+
+/** True for an IP address that is fine to fetch from: a public IPv4 address, or a parsed IPv6 address in global
+ *  unicast (2000::/3) outside the IANA special-purpose blocks that are not globally reachable. Not an IP: false.
+ *  Private, loopback, link-local, CGNAT, and unspecified addresses are refused, including IPv4 embedded in IPv6.
+ *  IPv4-mapped and NAT64 sit outside 2000::/3, so they are refused too. */
 export function isPublicIp(ip: string): boolean {
 	const h = ip.toLowerCase().replace(/^\[|\]$/g, "");
 	const v4 = h.match(/^(\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})$/);
@@ -92,11 +142,12 @@ export function isPublicIp(ip: string): boolean {
 		return !(a >= 224 || (a === 192 && b === 0 && (c === 0 || c === 2)) || (a === 198 && (b === 18 || b === 19)) ||
 			(a === 198 && b === 51 && c === 100) || (a === 203 && b === 0 && c === 113) || (a === 192 && b === 88 && c === 99));
 	}
-	if (!h.includes(":") || !/^[0-9a-f:.]+$/.test(h)) return false;
+	if (!h.includes(":")) return false;
 	if (isPrivateHost(h)) return false;
-	// only global unicast (2000::/3); within it, documentation and 6to4/Teredo (embed arbitrary IPv4) are refused
-	if (!/^[23][0-9a-f]{0,3}:/.test(h)) return false;
-	return !/^(2001:db8:|2001:0?db8:|2002:|2001:0{0,4}:|3fff:)/.test(h);
+	const bytes = ipv6Bytes(h);
+	if (!bytes || (bytes[0] & 0xe0) !== 0x20) return false;
+	if (V6_REACHABLE.some((b) => v6Prefix(bytes, b))) return true;
+	return !V6_UNREACHABLE.some((b) => v6Prefix(bytes, b));
 }
 
 export const ACCESS_TTL_S = 3600;

package/worker/src/version.ts

@@ -1,2 +1,2 @@
 /** Inbox build. Keep this equal to `version` in cli/package.json. */
-export const VERSION = "0.8.13";
+export const VERSION = "0.8.14";

package/worker/src/wake-target.ts

@@ -87,7 +87,7 @@ export async function lookupAddresses(host: string, signal?: AbortSignal): Promi
 /**
  * Why this URL must not be requested under public-https. Empty means it may be requested.
  * Names are resolved. Every returned address must be a public unicast address: private, loopback,
- * link-local (including metadata), CGNAT, multicast, and documentation ranges are refused.
+ * link-local (including metadata), CGNAT, multicast, benchmarking, Teredo, 6to4, and documentation ranges are refused.
  * A lookup that cannot be completed is refused.
  */
 export async function publicWakeProblem(url: string, lookup: AddressLookup = lookupAddresses): Promise<string> {

package/worker/test/mcp.test.ts

@@ -799,10 +799,16 @@ test("mcpLimitMessage names the A2A endpoint and the revoke command", () => {
 });
 
 test("isPublicIp: only global unicast addresses pass", () => {
-	for (const ip of ["93.184.216.34", "1.1.1.1", "2606:2800:220:1::1", "[2a00:1450::1]"]) assert.equal(M.isPublicIp(ip), true, ip);
+	for (const ip of ["93.184.216.34", "1.1.1.1", "2606:2800:220:1::1", "[2a00:1450::1]",
+		"2000::1", "3ffe::1", "2620:4f:8000::1", "3fff:1000::1",
+		"2001:1::1", "2001:1::2", "2001:1::3", "2001:3::1", "2001:4:112::1", "2001:20::1", "2001:30::1"]) assert.equal(M.isPublicIp(ip), true, ip);
 	for (const ip of ["10.1.2.3", "127.0.0.1", "172.16.0.1", "192.168.1.1", "169.254.169.254", "100.64.0.1", "0.0.0.0", "224.0.0.1", "255.255.255.255",
-		"192.0.2.1", "198.18.0.1", "203.0.113.5", "300.1.1.1", "::1", "::", "fd00::1", "fe80::1", "::ffff:10.0.0.1", "::ffff:7f00:1",
-		"64:ff9b::a00:1", "2001:db8::1", "2002:a00:1::", "2001:0:4136:e378::1", "ff02::1", "example.org"]) assert.equal(M.isPublicIp(ip), false, ip);
+		"192.0.2.1", "198.18.0.1", "203.0.113.5", "300.1.1.1", "::1", "::", "fd00::1", "fe80::1", "::ffff:10.0.0.1", "::ffff:7f00:1", "::ffff:8.8.8.8",
+		"64:ff9b::a00:1", "64:ff9b::8.8.8.8", "64:ff9b:1::8.8.8.8", "100::1", "5f00::1",
+		"2001:db8::1", "2001:DB8::1", "2001:0db8::1", "2002:a00:1::", "2002:0808:0808::", "2001:0:4136:e378::1", "2001::1",
+		"2001:2::1", "2001:0002::1", "2001:1::4", "2001:4:113::1", "2001:10::1",
+		"3fff::1", "3fff:0fff::1", "2::1", "20::1", "200::1",
+		"ff02::1", "example.org", "", "2001:::1", "1:2:3:4:5:6:7:8:9", "gggg::1"]) assert.equal(M.isPublicIp(ip), false, ip);
 });
 
 test("parseHttpResponse: status, headers, content-length and chunked bodies; malformed input refused", () => {

package/worker/test/wake-target.test.ts

@@ -15,6 +15,7 @@ const publicLookup: AddressLookup = async (host) => {
 	if (host === "v6.example") return ["2606:4700:4700::1111"];
 	if (host === "split.example") return ["1.2.3.4", "10.0.0.1"];
 	if (host === "meta.example") return ["169.254.169.254"];
+	if (host === "bench.example") return ["2001:2::1"];
 	if (host === "missing.example") return [];
 	return null;
 };
@@ -32,6 +33,9 @@ test("public-https refuses private, metadata, and non-https URLs before any requ
 		"https://169.254.169.254/latest/meta-data",
 		"https://[::1]/wake",
 		"https://[fe80::1]/wake",
+		"https://[2001:2::1]/wake",
+		"https://[2001::1]/wake",
+		"https://[3fff::1]/wake",
 		"https://localhost/wake",
 		"https://metadata.google.internal/wake",
 		"https://agent.ts.net/wake",
@@ -42,10 +46,14 @@ test("public-https refuses private, metadata, and non-https URLs before any requ
 		const why = await publicWakeProblem(url, publicLookup);
 		assert.notEqual(why, "", url);
 	}
+	assert.equal(await publicWakeProblem("https://[2001:2::1]/wake", publicLookup), "private or reserved address");
+	assert.equal(await publicWakeProblem("https://[2001::1]/wake", publicLookup), "private or reserved address");
+	assert.equal(await publicWakeProblem("https://[3fff::1]/wake", publicLookup), "private or reserved address");
 	assert.equal(await publicWakeProblem("https://hook.example/wake", publicLookup), "");
 	assert.equal(await publicWakeProblem("https://1.2.3.4/wake", publicLookup), "");
 	assert.equal(await publicWakeProblem("https://split.example/wake", publicLookup), "resolves to a private or reserved address");
 	assert.equal(await publicWakeProblem("https://meta.example/wake", publicLookup), "resolves to a private or reserved address");
+	assert.equal(await publicWakeProblem("https://bench.example/wake", publicLookup), "resolves to a private or reserved address");
 	assert.equal(await publicWakeProblem("https://missing.example/wake", publicLookup), "the host has no address");
 	assert.equal(await publicWakeProblem("https://unknown.example/wake", publicLookup), "its address could not be checked");
 });