aura-code 0.6.3 → 0.10.1

package/dist/safety/permissions.js

@@ -32,197 +32,19 @@ var __importStar = (this && this.__importStar) || (function () {
         return result;
     };
 })();
-var __importDefault = (this && this.__importDefault) || function (mod) {
-    return (mod && mod.__esModule) ? mod : { "default": mod };
-};
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.PermissionSystem = exports.ShellCommandValidator = void 0;
+exports.PermissionSystem = void 0;
+exports.setSharedReadline = setSharedReadline;
+exports.getSharedReadline = getSharedReadline;
+exports.setConfirmHandler = setConfirmHandler;
 exports.confirm = confirm;
-const fs = __importStar(require("fs"));
-const path = __importStar(require("path"));
-const readline_1 = __importDefault(require("readline"));
+const readline = __importStar(require("readline"));
 const defaults_js_1 = require("../config/defaults.js");
-// ─────────────────────────────────────────────────────────────────────────────
-// ShellCommandValidator — prevents recursive commands from traversing into
-// unresponsive FUSE/network mounts where I/O can cause D-state hangs.
-// ─────────────────────────────────────────────────────────────────────────────
-/** Extract search-path arguments from find/grep/rg command strings. */
-function extractSearchPaths(base, args) {
-    if (base === 'find') {
-        // find [path] [expression] — first non-flag arg is the search path
-        for (const a of args) {
-            if (!a.startsWith('-') && a !== '!' && a !== '(' && a !== ')')
-                return [a];
-        }
-        return ['.'];
-    }
-    // grep / rg: look for paths after --, or the last non-flag arg that looks like a path
-    const paths = [];
-    let afterDoubleDash = false;
-    for (const a of args) {
-        if (a === '--') {
-            afterDoubleDash = true;
-            continue;
-        }
-        if (afterDoubleDash && !a.startsWith('-')) {
-            paths.push(a);
-            continue;
-        }
-        // Flags with values: skip the value part
-        if (a === '-e' || a === '-f' || a === '--regexp' || a === '--file')
-            continue;
-        if (a.startsWith('--max-count') || a.startsWith('--glob') || a.startsWith('--include') || a.startsWith('--exclude'))
-            continue;
-        if (a.startsWith('-') || a === '--')
-            continue;
-        // Only for -r/-R (recursive) commands — collect potential path args
-        paths.push(a);
-    }
-    return paths.length > 0 ? paths : [];
-}
-/** Detect whether a recursive search command targets a given path. */
-function hasRecursiveFlag(args) {
-    return args.some(a => a === '-r' || a === '-R' || a === '--recursive' ||
-        (a.startsWith('-') && !a.startsWith('--') && (a.includes('r') || a.includes('R'))));
-}
-class ShellCommandValidator {
-    blockedPrefixes;
-    constructor() {
-        // Merge static blocklist with dynamically discovered FUSE mounts
-        this.blockedPrefixes = [...defaults_js_1.BLOCKED_TRAVERSAL_PATHS];
-        this.discoverFuseMounts();
-    }
-    discoverFuseMounts() {
-        try {
-            const mounts = fs.readFileSync('/proc/mounts', 'utf8');
-            for (const line of mounts.split('\n')) {
-                const parts = line.split(' ');
-                if (parts.length >= 3 && defaults_js_1.FUSE_MOUNT_PATTERN.test(parts[2])) {
-                    const mountPoint = parts[1];
-                    if (mountPoint && !mountPoint.endsWith('/')) {
-                        this.blockedPrefixes.push(mountPoint + '/');
-                    }
-                    else if (mountPoint) {
-                        this.blockedPrefixes.push(mountPoint);
-                    }
-                }
-            }
-        }
-        catch {
-            // /proc/mounts not available (non-Linux, permissions) — static list only
-        }
-    }
-    validateCommand(cmd, projectRoot, config) {
-        const tokens = tokenize(cmd);
-        if (tokens.length === 0)
-            return { allowed: true };
-        const base = path.basename(tokens[0]);
-        if (!['find', 'grep', 'rg'].includes(base))
-            return { allowed: true };
-        // rg is recursive by default; grep/find require explicit -r flag
-        const isRecursive = base === 'find' || base === 'rg' || hasRecursiveFlag(tokens.slice(1));
-        if (!isRecursive)
-            return { allowed: true };
-        const searchPaths = extractSearchPaths(base, tokens.slice(1));
-        const normalizedRoot = projectRoot.endsWith('/') ? projectRoot : projectRoot + '/';
-        const allowed = config?.allowedMountPaths ?? [];
-        for (const raw of searchPaths) {
-            // Expand ~ to HOME
-            const expanded = raw === '~' || raw.startsWith('~/')
-                ? path.join(process.env.HOME ?? '/tmp', raw.slice(1))
-                : raw;
-            const resolved = path.resolve(projectRoot, expanded);
-            const normalizedResolved = resolved.endsWith('/') ? resolved : resolved + '/';
-            // 1) Check blocked mount prefixes first — allowedMountPaths override both
-            //    the mount block AND the root boundary (user explicitly opted in).
-            let whitelisted = false;
-            for (const prefix of this.blockedPrefixes) {
-                if (normalizedResolved.startsWith(prefix)) {
-                    const isExplicitlyAllowed = allowed.some(a => {
-                        const normAllowed = a.endsWith('/') ? a : a + '/';
-                        return normalizedResolved.startsWith(normAllowed);
-                    });
-                    if (isExplicitlyAllowed) {
-                        whitelisted = true;
-                        break;
-                    }
-                    return {
-                        allowed: false,
-                        reason: `Blocked: '${base}' would traverse into '${raw}' which matches a ` +
-                            `blocked mount prefix (${prefix}). This can cause hangs on unresponsive ` +
-                            `FUSE/network filesystems. Add '${raw}' to allowedMountPaths in .aura.json ` +
-                            `to override.`,
-                    };
-                }
-            }
-            // 2) Must be inside project root (skip if explicitly whitelisted above)
-            if (!whitelisted && !normalizedResolved.startsWith(normalizedRoot) && normalizedResolved !== normalizedRoot) {
-                return {
-                    allowed: false,
-                    reason: `Blocked: '${base}' search path '${raw}' resolves outside project root (${projectRoot}). ` +
-                        `To search outside the project, run the command directly in your terminal.`,
-                };
-            }
-        }
-        return { allowed: true };
-    }
-}
-exports.ShellCommandValidator = ShellCommandValidator;
-/**
- * Minimal shell tokenizer that handles quotes and backslash escapes.
- * Splits a command string into tokens without invoking a shell.
- */
-function tokenize(cmd) {
-    const tokens = [];
-    let current = '';
-    let inSingle = false;
-    let inDouble = false;
-    let escape = false;
-    for (const ch of cmd) {
-        if (escape) {
-            current += ch;
-            escape = false;
-            continue;
-        }
-        if (ch === '\\' && !inSingle) {
-            escape = true;
-            continue;
-        }
-        if (ch === "'" && !inDouble) {
-            inSingle = !inSingle;
-            continue;
-        }
-        if (ch === '"' && !inSingle) {
-            inDouble = !inDouble;
-            continue;
-        }
-        if (/\s/.test(ch) && !inSingle && !inDouble) {
-            if (current.length > 0) {
-                tokens.push(current);
-                current = '';
-            }
-            continue;
-        }
-        current += ch;
-    }
-    if (current.length > 0)
-        tokens.push(current);
-    return tokens;
-}
-// ─────────────────────────────────────────────────────────────────────────────
-// PermissionSystem
-// ─────────────────────────────────────────────────────────────────────────────
 class PermissionSystem {
     level;
     sessionApprovals = new Set();
-    validator;
-    projectRoot;
-    config;
-    constructor(level = 'normal', projectRoot, config) {
+    constructor(level = 'normal') {
         this.level = level;
-        this.projectRoot = projectRoot ?? process.cwd();
-        this.config = config;
-        this.validator = new ShellCommandValidator();
     }
     check(toolName, input) {
         // Read-only mode: only allow read operations
@@ -240,76 +62,119 @@ class PermissionSystem {
                 if (this.isDangerous(cmd)) {
                     return { allowed: false, reason: `Dangerous command blocked: ${cmd}` };
                 }
-                const scopeCheck = this.validator.validateCommand(cmd, this.projectRoot, this.config);
-                if (!scopeCheck.allowed)
-                    return scopeCheck;
+            }
+            if (toolName === 'mcp' && String(input.action ?? '') === 'connect') {
+                const cmd = this.mcpConnectCommand(input);
+                if (this.isDangerous(cmd)) {
+                    return { allowed: false, reason: `Dangerous command blocked: ${cmd}` };
+                }
             }
             return { allowed: true };
         }
+        // mcp 'connect' spawns an arbitrary external server process — the same
+        // trust boundary as run_shell, so it gets the same dangerous-pattern
+        // screen plus an unconditional confirm (a server spawn is never on the
+        // safe list; once connected, its tools run without further prompts).
+        if (toolName === 'mcp' && String(input.action ?? '') === 'connect') {
+            const cmd = this.mcpConnectCommand(input);
+            if (this.isDangerous(cmd)) {
+                return { allowed: false, reason: `Dangerous command blocked: ${cmd}` };
+            }
+            return { allowed: true, needsConfirm: true };
+        }
         // Normal mode: safe ops auto-approved, destructive need confirm
         if (toolName === 'run_shell') {
             const cmd = String(input.command ?? '');
             if (this.isDangerous(cmd)) {
                 return { allowed: false, reason: `Dangerous command blocked: ${cmd}` };
             }
-            const scopeCheck = this.validator.validateCommand(cmd, this.projectRoot, this.config);
-            if (!scopeCheck.allowed)
-                return scopeCheck;
             if (!this.isSafe(cmd)) {
                 return { allowed: true, needsConfirm: true };
             }
         }
-        if (toolName === 'write_file' || toolName === 'edit_file') {
+        if (toolName === 'write_file') {
             const path = String(input.path ?? '');
-            const key = `${toolName}:${path}`;
+            const key = `write:${path}`;
             if (this.sessionApprovals.has(key))
                 return { allowed: true };
-            return { allowed: true, needsConfirm: true };
+            return { allowed: true };
         }
         return { allowed: true };
     }
     approveForSession(key) {
         this.sessionApprovals.add(key);
     }
+    /** Current enforcement level. */
+    getLevel() {
+        return this.level;
+    }
     /**
-     * Change the permission level mid-session. Used by `:approve all` — since
-     * RubyAlternator stores a reference to this same instance rather than its
-     * own copy, calling this also takes effect for any in-flight or future
-     * Ruby-alternated attempts, with no extra wiring needed.
+     * Change the level at runtime — used by the REPL `:approve` command to flip
+     * a session into auto-approve (no per-command confirm) and back. Dangerous
+     * commands are STILL blocked in 'auto'; this only removes the y/N prompt for
+     * ordinary destructive-but-safe operations.
      */
     setLevel(level) {
         this.level = level;
     }
-    getLevel() {
-        return this.level;
+    mcpConnectCommand(input) {
+        const args = Array.isArray(input.args_list) ? input.args_list.join(' ') : '';
+        return `${String(input.command ?? '')} ${args}`.trim();
     }
     isDangerous(cmd) {
         return defaults_js_1.DANGEROUS_PATTERNS.some(p => p.test(cmd));
     }
     isSafe(cmd) {
-        const lower = cmd.toLowerCase().trim();
-        return defaults_js_1.SAFE_SHELL_COMMANDS.some(s => lower.startsWith(s));
+        const trimmed = cmd.trim();
+        // A command containing shell control operators can't be judged safe from
+        // its prefix alone — `cat x; python3 -c '…'` starts with a safe command
+        // but chains an interpreter. Force confirmation for anything with
+        // chaining (`;` `&` `|`), redirection (`>` `<`), or command substitution
+        // (`$(…)`, backticks). This is the structural fix for prefix-smuggling.
+        if (/[;&|<>`]/.test(trimmed) || trimmed.includes('$('))
+            return false;
+        const lower = trimmed.toLowerCase();
+        // Anchor to a whole-command match so `curlx …` doesn't match `curl` and
+        // `lscpu` doesn't match `ls`.
+        return defaults_js_1.SAFE_SHELL_COMMANDS.some(s => lower === s || lower.startsWith(s + ' '));
     }
 }
 exports.PermissionSystem = PermissionSystem;
+// Shared readline from the interactive REPL. confirm() must reuse it when
+// set: a second interface on the same stdin echoes every keypress twice, and
+// closing it pauses stdin without the REPL's interface knowing — its next
+// prompt never resumes the stream, the event loop drains, and the process
+// exits right after printing the prompt.
+let sharedRl = null;
+function setSharedReadline(rl) {
+    sharedRl = rl;
+}
+function getSharedReadline() {
+    return sharedRl;
+}
+// The TUI owns stdin in raw mode via its own 'data' handler — a plain
+// readline.Interface (below) forces stdin out of raw mode the moment it
+// attaches and never restores it, so a confirm() prompt during TUI mode
+// used to fight the TUI's own input handling for every keystroke (garbled
+// echo, dropped characters, leftover fragments on screen). setSharedReadline
+// was meant to prevent a *second* readline.Interface, but the TUI doesn't
+// use readline at all — it needs its own raw-mode-safe prompt. cli/index.ts
+// registers one via setConfirmHandler() when TUI mode starts; confirm()
+// prefers it over readline whenever it's set.
+let confirmHandler = null;
+function setConfirmHandler(fn) {
+    confirmHandler = fn;
+}
 /** Ask user to confirm in the terminal. Returns true if approved. */
 async function confirm(message) {
-    process.stdout.write(`\n⚠️  ${message} [y/N] `);
-    // Temporarily remove existing stdin data listeners (e.g. from REPL readline)
-    // to ensure only ONE reader is active at a time — prevents input doubling.
-    const existingListeners = process.stdin.rawListeners('data');
-    for (const listener of existingListeners) {
-        process.stdin.removeListener('data', listener);
-    }
+    if (confirmHandler)
+        return confirmHandler(message);
+    const rl = sharedRl ?? readline.createInterface({ input: process.stdin, output: process.stdout });
     return new Promise(resolve => {
-        const rl = readline_1.default.createInterface({ input: process.stdin, output: process.stdout });
-        rl.question('', (answer) => {
-            rl.close();
-            // Restore original listeners so REPL readline continues working
-            for (const listener of existingListeners) {
-                process.stdin.on('data', listener);
-            }
-            resolve(answer.trim().toLowerCase() === 'y' || answer.trim().toLowerCase() === 'yes');
+        rl.question(`\n⚠️  ${message} [y/N] `, answer => {
+            if (rl !== sharedRl)
+                rl.close();
+            resolve(answer.toLowerCase() === 'y' || answer.toLowerCase() === 'yes');
         });
     });
 }

package/dist/safety/permissions.js.map

@@ -1 +1 @@
-{"version":3,"file":"permissions.js","sourceRoot":"","sources":["../../src/safety/permissions.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA2QA,0BAmBC;AA9RD,uCAAyB;AACzB,2CAA6B;AAC7B,wDAAgC;AAChC,uDAG+B;AAc/B,gFAAgF;AAChF,2EAA2E;AAC3E,sEAAsE;AACtE,gFAAgF;AAEhF,uEAAuE;AACvE,SAAS,kBAAkB,CAAC,IAAY,EAAE,IAAc;IACtD,IAAI,IAAI,KAAK,MAAM,EAAE,CAAC;QACpB,mEAAmE;QACnE,KAAK,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;YACrB,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG;gBAAE,OAAO,CAAC,CAAC,CAAC,CAAC;QAC5E,CAAC;QACD,OAAO,CAAC,GAAG,CAAC,CAAC;IACf,CAAC;IACD,sFAAsF;IACtF,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,IAAI,eAAe,GAAG,KAAK,CAAC;IAC5B,KAAK,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;QACrB,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC;YAAC,eAAe,GAAG,IAAI,CAAC;YAAC,SAAS;QAAC,CAAC;QACrD,IAAI,eAAe,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAAC,SAAS;QAAC,CAAC;QACvE,yCAAyC;QACzC,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,UAAU,IAAI,CAAC,KAAK,QAAQ;YAAE,SAAS;QAC7E,IAAI,CAAC,CAAC,UAAU,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,UAAU,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,UAAU,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,UAAU,CAAC,WAAW,CAAC;YAAE,SAAS;QAC9H,IAAI,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,IAAI;YAAE,SAAS;QAC9C,oEAAoE;QACpE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAChB,CAAC;IACD,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;AACvC,CAAC;AAED,sEAAsE;AACtE,SAAS,gBAAgB,CAAC,IAAc;IACtC,OAAO,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CACnB,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,aAAa;QAC/C,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CACnF,CAAC;AACJ,CAAC;AAED,MAAa,qBAAqB;IACxB,eAAe,CAAW;IAElC;QACE,iEAAiE;QACjE,IAAI,CAAC,eAAe,GAAG,CAAC,GAAG,qCAAuB,CAAC,CAAC;QACpD,IAAI,CAAC,kBAAkB,EAAE,CAAC;IAC5B,CAAC;IAEO,kBAAkB;QACxB,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,EAAE,CAAC,YAAY,CAAC,cAAc,EAAE,MAAM,CAAC,CAAC;YACvD,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;gBACtC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;gBAC9B,IAAI,KAAK,CAAC,MAAM,IAAI,CAAC,IAAI,gCAAkB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;oBAC3D,MAAM,UAAU,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;oBAC5B,IAAI,UAAU,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;wBAC5C,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,UAAU,GAAG,GAAG,CAAC,CAAC;oBAC9C,CAAC;yBAAM,IAAI,UAAU,EAAE,CAAC;wBACtB,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;oBACxC,CAAC;gBACH,CAAC;YACH,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,yEAAyE;QAC3E,CAAC;IACH,CAAC;IAED,eAAe,CAAC,GAAW,EAAE,WAAmB,EAAE,MAAyB;QACzE,MAAM,MAAM,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC;QAC7B,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;QAElD,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;QACtC,IAAI,CAAC,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC;YAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;QAErE,iEAAiE;QACjE,MAAM,WAAW,GAAG,IAAI,KAAK,MAAM,IAAI,IAAI,KAAK,IAAI,IAAI,gBAAgB,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QAC1F,IAAI,CAAC,WAAW;YAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;QAE3C,MAAM,WAAW,GAAG,kBAAkB,CAAC,IAAI,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QAC9D,MAAM,cAAc,GAAG,WAAW,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,WAAW,GAAG,GAAG,CAAC;QACnF,MAAM,OAAO,GAAG,MAAM,EAAE,iBAAiB,IAAI,EAAE,CAAC;QAEhD,KAAK,MAAM,GAAG,IAAI,WAAW,EAAE,CAAC;YAC9B,mBAAmB;YACnB,MAAM,QAAQ,GAAG,GAAG,KAAK,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC;gBAClD,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,IAAI,MAAM,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;gBACrD,CAAC,CAAC,GAAG,CAAC;YAER,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC;YACrD,MAAM,kBAAkB,GAAG,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,GAAG,GAAG,CAAC;YAE9E,0EAA0E;YAC1E,uEAAuE;YACvE,IAAI,WAAW,GAAG,KAAK,CAAC;YACxB,KAAK,MAAM,MAAM,IAAI,IAAI,CAAC,eAAe,EAAE,CAAC;gBAC1C,IAAI,kBAAkB,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;oBAC1C,MAAM,mBAAmB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE;wBAC3C,MAAM,WAAW,GAAG,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC;wBAClD,OAAO,kBAAkB,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC;oBACpD,CAAC,CAAC,CAAC;oBACH,IAAI,mBAAmB,EAAE,CAAC;wBAAC,WAAW,GAAG,IAAI,CAAC;wBAAC,MAAM;oBAAC,CAAC;oBACvD,OAAO;wBACL,OAAO,EAAE,KAAK;wBACd,MAAM,EAAE,aAAa,IAAI,0BAA0B,GAAG,oBAAoB;4BACxE,yBAAyB,MAAM,0CAA0C;4BACzE,kCAAkC,GAAG,uCAAuC;4BAC5E,cAAc;qBACjB,CAAC;gBACJ,CAAC;YACH,CAAC;YAED,wEAAwE;YACxE,IAAI,CAAC,WAAW,IAAI,CAAC,kBAAkB,CAAC,UAAU,CAAC,cAAc,CAAC,IAAI,kBAAkB,KAAK,cAAc,EAAE,CAAC;gBAC5G,OAAO;oBACL,OAAO,EAAE,KAAK;oBACd,MAAM,EAAE,aAAa,IAAI,kBAAkB,GAAG,oCAAoC,WAAW,KAAK;wBAChG,2EAA2E;iBAC9E,CAAC;YACJ,CAAC;QACH,CAAC;QAED,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAC3B,CAAC;CACF;AApFD,sDAoFC;AAED;;;GAGG;AACH,SAAS,QAAQ,CAAC,GAAW;IAC3B,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,IAAI,OAAO,GAAG,EAAE,CAAC;IACjB,IAAI,QAAQ,GAAG,KAAK,CAAC;IACrB,IAAI,QAAQ,GAAG,KAAK,CAAC;IACrB,IAAI,MAAM,GAAG,KAAK,CAAC;IAEnB,KAAK,MAAM,EAAE,IAAI,GAAG,EAAE,CAAC;QACrB,IAAI,MAAM,EAAE,CAAC;YACX,OAAO,IAAI,EAAE,CAAC;YACd,MAAM,GAAG,KAAK,CAAC;YACf,SAAS;QACX,CAAC;QACD,IAAI,EAAE,KAAK,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;YAAC,MAAM,GAAG,IAAI,CAAC;YAAC,SAAS;QAAC,CAAC;QAC1D,IAAI,EAAE,KAAK,GAAG,IAAI,CAAC,QAAQ,EAAE,CAAC;YAAC,QAAQ,GAAG,CAAC,QAAQ,CAAC;YAAC,SAAS;QAAC,CAAC;QAChE,IAAI,EAAE,KAAK,GAAG,IAAI,CAAC,QAAQ,EAAE,CAAC;YAAC,QAAQ,GAAG,CAAC,QAAQ,CAAC;YAAC,SAAS;QAAC,CAAC;QAChE,IAAI,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,QAAQ,IAAI,CAAC,QAAQ,EAAE,CAAC;YAC5C,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;gBAAC,OAAO,GAAG,EAAE,CAAC;YAAC,CAAC;YAC/D,SAAS;QACX,CAAC;QACD,OAAO,IAAI,EAAE,CAAC;IAChB,CAAC;IACD,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC;QAAE,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAC7C,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,gFAAgF;AAChF,mBAAmB;AACnB,gFAAgF;AAEhF,MAAa,gBAAgB;IACnB,KAAK,CAAkB;IACvB,gBAAgB,GAAG,IAAI,GAAG,EAAU,CAAC;IACrC,SAAS,CAAwB;IACjC,WAAW,CAAS;IACpB,MAAM,CAAoB;IAElC,YAAY,QAAyB,QAAQ,EAAE,WAAoB,EAAE,MAAyB;QAC5F,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC;QACnB,IAAI,CAAC,WAAW,GAAG,WAAW,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;QAChD,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,IAAI,CAAC,SAAS,GAAG,IAAI,qBAAqB,EAAE,CAAC;IAC/C,CAAC;IAED,KAAK,CAAC,QAAgB,EAAE,KAA8B;QACpD,6CAA6C;QAC7C,IAAI,IAAI,CAAC,KAAK,KAAK,WAAW,EAAE,CAAC;YAC/B,MAAM,QAAQ,GAAG,CAAC,WAAW,EAAE,UAAU,EAAE,aAAa,EAAE,YAAY,EAAE,UAAU,CAAC,CAAC;YACpF,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;gBACjC,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,QAAQ,iCAAiC,EAAE,CAAC;YACxF,CAAC;YACD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;QAC3B,CAAC;QAED,0DAA0D;QAC1D,IAAI,IAAI,CAAC,KAAK,KAAK,MAAM,EAAE,CAAC;YAC1B,IAAI,QAAQ,KAAK,WAAW,EAAE,CAAC;gBAC7B,MAAM,GAAG,GAAG,MAAM,CAAC,KAAK,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC;gBACxC,IAAI,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,EAAE,CAAC;oBAC1B,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,8BAA8B,GAAG,EAAE,EAAE,CAAC;gBACzE,CAAC;gBACD,MAAM,UAAU,GAAG,IAAI,CAAC,SAAS,CAAC,eAAe,CAAC,GAAG,EAAE,IAAI,CAAC,WAAW,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;gBACtF,IAAI,CAAC,UAAU,CAAC,OAAO;oBAAE,OAAO,UAAU,CAAC;YAC7C,CAAC;YACD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;QAC3B,CAAC;QAED,gEAAgE;QAChE,IAAI,QAAQ,KAAK,WAAW,EAAE,CAAC;YAC7B,MAAM,GAAG,GAAG,MAAM,CAAC,KAAK,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC;YACxC,IAAI,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,EAAE,CAAC;gBAC1B,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,8BAA8B,GAAG,EAAE,EAAE,CAAC;YACzE,CAAC;YACD,MAAM,UAAU,GAAG,IAAI,CAAC,SAAS,CAAC,eAAe,CAAC,GAAG,EAAE,IAAI,CAAC,WAAW,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;YACtF,IAAI,CAAC,UAAU,CAAC,OAAO;gBAAE,OAAO,UAAU,CAAC;YAC3C,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC;gBACtB,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC;YAC/C,CAAC;QACH,CAAC;QAED,IAAI,QAAQ,KAAK,YAAY,IAAI,QAAQ,KAAK,WAAW,EAAE,CAAC;YAC1D,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;YACtC,MAAM,GAAG,GAAG,GAAG,QAAQ,IAAI,IAAI,EAAE,CAAC;YAClC,IAAI,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,GAAG,CAAC;gBAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;YAC7D,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC;QAC/C,CAAC;QAED,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAC3B,CAAC;IAED,iBAAiB,CAAC,GAAW;QAC3B,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IACjC,CAAC;IAED;;;;;OAKG;IACH,QAAQ,CAAC,KAAsB;QAC7B,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC;IACrB,CAAC;IAED,QAAQ;QACN,OAAO,IAAI,CAAC,KAAK,CAAC;IACpB,CAAC;IAEO,WAAW,CAAC,GAAW;QAC7B,OAAO,gCAAkB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;IACnD,CAAC;IAEO,MAAM,CAAC,GAAW;QACxB,MAAM,KAAK,GAAG,GAAG,CAAC,WAAW,EAAE,CAAC,IAAI,EAAE,CAAC;QACvC,OAAO,iCAAmB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC;IAC5D,CAAC;CACF;AAtFD,4CAsFC;AAED,qEAAqE;AAC9D,KAAK,UAAU,OAAO,CAAC,OAAe;IAC3C,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,SAAS,OAAO,SAAS,CAAC,CAAC;IAChD,6EAA6E;IAC7E,2EAA2E;IAC3E,MAAM,iBAAiB,GAAG,OAAO,CAAC,KAAK,CAAC,YAAY,CAAC,MAAM,CAAoC,CAAC;IAChG,KAAK,MAAM,QAAQ,IAAI,iBAAiB,EAAE,CAAC;QACzC,OAAO,CAAC,KAAK,CAAC,cAAc,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;IACjD,CAAC;IACD,OAAO,IAAI,OAAO,CAAC,OAAO,CAAC,EAAE;QAC3B,MAAM,EAAE,GAAG,kBAAQ,CAAC,eAAe,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;QACtF,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC,MAAM,EAAE,EAAE;YACzB,EAAE,CAAC,KAAK,EAAE,CAAC;YACX,gEAAgE;YAChE,KAAK,MAAM,QAAQ,IAAI,iBAAiB,EAAE,CAAC;gBACzC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;YACrC,CAAC;YACD,OAAO,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,KAAK,GAAG,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,KAAK,KAAK,CAAC,CAAC;QACxF,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC"}
+{"version":3,"file":"permissions.js","sourceRoot":"","sources":["../../src/safety/permissions.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAmIA,8CAEC;AAED,8CAEC;AAaD,8CAEC;AAGD,0BASC;AApKD,mDAAqC;AACrC,uDAAgF;AAUhF,MAAa,gBAAgB;IACnB,KAAK,CAAkB;IACvB,gBAAgB,GAAG,IAAI,GAAG,EAAU,CAAC;IAE7C,YAAY,QAAyB,QAAQ;QAC3C,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC;IACrB,CAAC;IAED,KAAK,CAAC,QAAgB,EAAE,KAA8B;QACpD,6CAA6C;QAC7C,IAAI,IAAI,CAAC,KAAK,KAAK,WAAW,EAAE,CAAC;YAC/B,MAAM,QAAQ,GAAG,CAAC,WAAW,EAAE,UAAU,EAAE,aAAa,EAAE,YAAY,EAAE,UAAU,CAAC,CAAC;YACpF,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;gBACjC,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,QAAQ,iCAAiC,EAAE,CAAC;YACxF,CAAC;YACD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;QAC3B,CAAC;QAED,0DAA0D;QAC1D,IAAI,IAAI,CAAC,KAAK,KAAK,MAAM,EAAE,CAAC;YAC1B,IAAI,QAAQ,KAAK,WAAW,EAAE,CAAC;gBAC7B,MAAM,GAAG,GAAG,MAAM,CAAC,KAAK,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC;gBACxC,IAAI,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,EAAE,CAAC;oBAC1B,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,8BAA8B,GAAG,EAAE,EAAE,CAAC;gBACzE,CAAC;YACH,CAAC;YACD,IAAI,QAAQ,KAAK,KAAK,IAAI,MAAM,CAAC,KAAK,CAAC,MAAM,IAAI,EAAE,CAAC,KAAK,SAAS,EAAE,CAAC;gBACnE,MAAM,GAAG,GAAG,IAAI,CAAC,iBAAiB,CAAC,KAAK,CAAC,CAAC;gBAC1C,IAAI,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,EAAE,CAAC;oBAC1B,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,8BAA8B,GAAG,EAAE,EAAE,CAAC;gBACzE,CAAC;YACH,CAAC;YACD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;QAC3B,CAAC;QAED,uEAAuE;QACvE,qEAAqE;QACrE,uEAAuE;QACvE,qEAAqE;QACrE,IAAI,QAAQ,KAAK,KAAK,IAAI,MAAM,CAAC,KAAK,CAAC,MAAM,IAAI,EAAE,CAAC,KAAK,SAAS,EAAE,CAAC;YACnE,MAAM,GAAG,GAAG,IAAI,CAAC,iBAAiB,CAAC,KAAK,CAAC,CAAC;YAC1C,IAAI,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,EAAE,CAAC;gBAC1B,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,8BAA8B,GAAG,EAAE,EAAE,CAAC;YACzE,CAAC;YACD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC;QAC/C,CAAC;QAED,gEAAgE;QAChE,IAAI,QAAQ,KAAK,WAAW,EAAE,CAAC;YAC7B,MAAM,GAAG,GAAG,MAAM,CAAC,KAAK,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC;YACxC,IAAI,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,EAAE,CAAC;gBAC1B,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,8BAA8B,GAAG,EAAE,EAAE,CAAC;YACzE,CAAC;YACD,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC;gBACtB,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC;YAC/C,CAAC;QACH,CAAC;QAED,IAAI,QAAQ,KAAK,YAAY,EAAE,CAAC;YAC9B,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;YACtC,MAAM,GAAG,GAAG,SAAS,IAAI,EAAE,CAAC;YAC5B,IAAI,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,GAAG,CAAC;gBAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;YAC7D,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;QAC3B,CAAC;QAED,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAC3B,CAAC;IAED,iBAAiB,CAAC,GAAW;QAC3B,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IACjC,CAAC;IAED,iCAAiC;IACjC,QAAQ;QACN,OAAO,IAAI,CAAC,KAAK,CAAC;IACpB,CAAC;IAED;;;;;OAKG;IACH,QAAQ,CAAC,KAAsB;QAC7B,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC;IACrB,CAAC;IAEO,iBAAiB,CAAC,KAA8B;QACtD,MAAM,IAAI,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7E,OAAO,GAAG,MAAM,CAAC,KAAK,CAAC,OAAO,IAAI,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,IAAI,EAAE,CAAC;IACzD,CAAC;IAEO,WAAW,CAAC,GAAW;QAC7B,OAAO,gCAAkB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;IACnD,CAAC;IAEO,MAAM,CAAC,GAAW;QACxB,MAAM,OAAO,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;QAE3B,yEAAyE;QACzE,wEAAwE;QACxE,kEAAkE;QAClE,yEAAyE;QACzE,wEAAwE;QACxE,IAAI,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC;YAAE,OAAO,KAAK,CAAC;QAErE,MAAM,KAAK,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC;QACpC,wEAAwE;QACxE,8BAA8B;QAC9B,OAAO,iCAAmB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,KAAK,KAAK,CAAC,IAAI,KAAK,CAAC,UAAU,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC;IACjF,CAAC;CACF;AA/GD,4CA+GC;AAED,0EAA0E;AAC1E,6EAA6E;AAC7E,0EAA0E;AAC1E,0EAA0E;AAC1E,yCAAyC;AACzC,IAAI,QAAQ,GAA8B,IAAI,CAAC;AAE/C,SAAgB,iBAAiB,CAAC,EAA6B;IAC7D,QAAQ,GAAG,EAAE,CAAC;AAChB,CAAC;AAED,SAAgB,iBAAiB;IAC/B,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,sEAAsE;AACtE,wEAAwE;AACxE,wEAAwE;AACxE,0EAA0E;AAC1E,6EAA6E;AAC7E,0EAA0E;AAC1E,4EAA4E;AAC5E,wEAAwE;AACxE,8CAA8C;AAC9C,IAAI,cAAc,GAAmD,IAAI,CAAC;AAE1E,SAAgB,iBAAiB,CAAC,EAAkD;IAClF,cAAc,GAAG,EAAE,CAAC;AACtB,CAAC;AAED,qEAAqE;AAC9D,KAAK,UAAU,OAAO,CAAC,OAAe;IAC3C,IAAI,cAAc;QAAE,OAAO,cAAc,CAAC,OAAO,CAAC,CAAC;IACnD,MAAM,EAAE,GAAG,QAAQ,IAAI,QAAQ,CAAC,eAAe,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IAClG,OAAO,IAAI,OAAO,CAAC,OAAO,CAAC,EAAE;QAC3B,EAAE,CAAC,QAAQ,CAAC,SAAS,OAAO,SAAS,EAAE,MAAM,CAAC,EAAE;YAC9C,IAAI,EAAE,KAAK,QAAQ;gBAAE,EAAE,CAAC,KAAK,EAAE,CAAC;YAChC,OAAO,CAAC,MAAM,CAAC,WAAW,EAAE,KAAK,GAAG,IAAI,MAAM,CAAC,WAAW,EAAE,KAAK,KAAK,CAAC,CAAC;QAC1E,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/safety/ssrf.d.ts

@@ -0,0 +1,29 @@
+/**
+ * SSRF guard for the outbound HTTP tools (web_fetch, http_request).
+ *
+ * Without this, the agent can be steered — including by prompt injection in a
+ * fetched page — to reach loopback services, RFC-1918 hosts, or the cloud
+ * metadata endpoint (169.254.169.254) to steal IAM credentials, then exfil
+ * them back out. We reject private/loopback/link-local targets, restrict the
+ * protocol to http/https, and re-validate on every redirect hop.
+ */
+export declare class SsrfError extends Error {
+    constructor(message: string);
+}
+/** True if the literal IP is one we refuse to connect to. Unknown → blocked. */
+export declare function isBlockedIp(ip: string): boolean;
+/**
+ * Validate a URL for outbound use: http/https only, and its host must not
+ * resolve to a blocked address. Returns the parsed URL on success.
+ */
+export declare function assertUrlAllowed(rawUrl: string): Promise<URL>;
+export interface SafeFetchOptions {
+    maxRedirects?: number;
+}
+/**
+ * fetch() wrapper that enforces {@link assertUrlAllowed} before the request
+ * and on every redirect hop. Redirects are followed manually (redirect:
+ * 'manual') so a public URL can't 302 to a private/metadata address without
+ * being re-checked.
+ */
+export declare function safeFetch(rawUrl: string, init: RequestInit, opts?: SafeFetchOptions): Promise<Response>;

package/dist/safety/ssrf.js

@@ -0,0 +1,185 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SsrfError = void 0;
+exports.isBlockedIp = isBlockedIp;
+exports.assertUrlAllowed = assertUrlAllowed;
+exports.safeFetch = safeFetch;
+const dns = __importStar(require("dns"));
+const net = __importStar(require("net"));
+/**
+ * SSRF guard for the outbound HTTP tools (web_fetch, http_request).
+ *
+ * Without this, the agent can be steered — including by prompt injection in a
+ * fetched page — to reach loopback services, RFC-1918 hosts, or the cloud
+ * metadata endpoint (169.254.169.254) to steal IAM credentials, then exfil
+ * them back out. We reject private/loopback/link-local targets, restrict the
+ * protocol to http/https, and re-validate on every redirect hop.
+ */
+class SsrfError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = 'SsrfError';
+    }
+}
+exports.SsrfError = SsrfError;
+const BLOCKED_HOSTNAMES = new Set([
+    'localhost',
+    'ip6-localhost',
+    'ip6-loopback',
+]);
+function isBlockedV4(ip) {
+    const parts = ip.split('.').map(Number);
+    if (parts.length !== 4 || parts.some((o) => !Number.isInteger(o) || o < 0 || o > 255)) {
+        return true; // malformed → block
+    }
+    const [a, b] = parts;
+    if (a === 0)
+        return true; // 0.0.0.0/8 "this host"
+    if (a === 10)
+        return true; // 10.0.0.0/8 private
+    if (a === 127)
+        return true; // 127.0.0.0/8 loopback
+    if (a === 169 && b === 254)
+        return true; // 169.254.0.0/16 link-local (incl. metadata)
+    if (a === 172 && b >= 16 && b <= 31)
+        return true; // 172.16.0.0/12 private
+    if (a === 192 && b === 168)
+        return true; // 192.168.0.0/16 private
+    if (a === 192 && b === 0 && parts[2] === 0)
+        return true; // 192.0.0.0/24 protocol assignments
+    if (a === 100 && b >= 64 && b <= 127)
+        return true; // 100.64.0.0/10 CGNAT
+    if (a === 198 && (b === 18 || b === 19))
+        return true; // 198.18.0.0/15 benchmarking
+    if (a >= 224)
+        return true; // 224.0.0.0/4 multicast + 240.0.0.0/4 reserved
+    return false;
+}
+function isBlockedV6(ip) {
+    let addr = ip.toLowerCase();
+    const zone = addr.indexOf('%');
+    if (zone >= 0)
+        addr = addr.slice(0, zone);
+    if (addr === '::1' || addr === '::')
+        return true; // loopback / unspecified
+    // IPv4-mapped (::ffff:a.b.c.d) — evaluate the embedded IPv4.
+    const mapped = addr.match(/^::ffff:(\d+\.\d+\.\d+\.\d+)$/);
+    if (mapped)
+        return isBlockedV4(mapped[1]);
+    if (addr.startsWith('fe8') || addr.startsWith('fe9')
+        || addr.startsWith('fea') || addr.startsWith('feb'))
+        return true; // fe80::/10 link-local
+    if (addr.startsWith('fc') || addr.startsWith('fd'))
+        return true; // fc00::/7 unique-local
+    if (addr.startsWith('ff'))
+        return true; // ff00::/8 multicast
+    return false;
+}
+/** True if the literal IP is one we refuse to connect to. Unknown → blocked. */
+function isBlockedIp(ip) {
+    const kind = net.isIP(ip);
+    if (kind === 4)
+        return isBlockedV4(ip);
+    if (kind === 6)
+        return isBlockedV6(ip);
+    return true;
+}
+/**
+ * Validate a URL for outbound use: http/https only, and its host must not
+ * resolve to a blocked address. Returns the parsed URL on success.
+ */
+async function assertUrlAllowed(rawUrl) {
+    let url;
+    try {
+        url = new URL(rawUrl);
+    }
+    catch {
+        throw new SsrfError(`Invalid URL: ${rawUrl}`);
+    }
+    if (url.protocol !== 'http:' && url.protocol !== 'https:') {
+        throw new SsrfError(`Blocked protocol: ${url.protocol} (only http/https allowed)`);
+    }
+    const host = url.hostname.replace(/^\[|\]$/g, ''); // strip IPv6 brackets
+    if (net.isIP(host)) {
+        if (isBlockedIp(host))
+            throw new SsrfError(`Blocked address: ${host}`);
+        return url;
+    }
+    if (BLOCKED_HOSTNAMES.has(host.toLowerCase())) {
+        throw new SsrfError(`Blocked host: ${host}`);
+    }
+    let addrs;
+    try {
+        addrs = await dns.promises.lookup(host, { all: true });
+    }
+    catch {
+        throw new SsrfError(`Could not resolve host: ${host}`);
+    }
+    if (addrs.length === 0)
+        throw new SsrfError(`Could not resolve host: ${host}`);
+    for (const a of addrs) {
+        if (isBlockedIp(a.address)) {
+            throw new SsrfError(`Host ${host} resolves to blocked address ${a.address}`);
+        }
+    }
+    return url;
+}
+/**
+ * fetch() wrapper that enforces {@link assertUrlAllowed} before the request
+ * and on every redirect hop. Redirects are followed manually (redirect:
+ * 'manual') so a public URL can't 302 to a private/metadata address without
+ * being re-checked.
+ */
+async function safeFetch(rawUrl, init, opts = {}) {
+    const maxRedirects = opts.maxRedirects ?? 5;
+    let currentUrl = rawUrl;
+    let redirects = 0;
+    while (true) {
+        await assertUrlAllowed(currentUrl);
+        const response = await fetch(currentUrl, { ...init, redirect: 'manual' });
+        const isRedirect = response.status >= 300 && response.status < 400;
+        const location = response.headers.get('location');
+        if (isRedirect && location) {
+            if (redirects >= maxRedirects)
+                throw new SsrfError('Too many redirects');
+            redirects++;
+            currentUrl = new URL(location, currentUrl).toString();
+            continue;
+        }
+        return response;
+    }
+}
+//# sourceMappingURL=ssrf.js.map

package/dist/safety/ssrf.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ssrf.js","sourceRoot":"","sources":["../../src/safety/ssrf.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA+DA,kCAKC;AAMD,4CAiCC;AAYD,8BAuBC;AA9ID,yCAA2B;AAC3B,yCAA2B;AAE3B;;;;;;;;GAQG;AACH,MAAa,SAAU,SAAQ,KAAK;IAClC,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,WAAW,CAAC;IAC1B,CAAC;CACF;AALD,8BAKC;AAED,MAAM,iBAAiB,GAAG,IAAI,GAAG,CAAC;IAChC,WAAW;IACX,eAAe;IACf,cAAc;CACf,CAAC,CAAC;AAEH,SAAS,WAAW,CAAC,EAAU;IAC7B,MAAM,KAAK,GAAG,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACxC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,GAAG,CAAC,EAAE,CAAC;QACtF,OAAO,IAAI,CAAC,CAAC,oBAAoB;IACnC,CAAC;IACD,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,KAAK,CAAC;IACrB,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC,CAAuB,wBAAwB;IACxE,IAAI,CAAC,KAAK,EAAE;QAAE,OAAO,IAAI,CAAC,CAAsB,qBAAqB;IACrE,IAAI,CAAC,KAAK,GAAG;QAAE,OAAO,IAAI,CAAC,CAAqB,uBAAuB;IACvE,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG;QAAE,OAAO,IAAI,CAAC,CAAQ,6CAA6C;IAC7F,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE;QAAE,OAAO,IAAI,CAAC,CAAC,wBAAwB;IAC1E,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG;QAAE,OAAO,IAAI,CAAC,CAAQ,yBAAyB;IACzE,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC,CAAC,oCAAoC;IAC7F,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,GAAG;QAAE,OAAO,IAAI,CAAC,CAAC,sBAAsB;IACzE,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,CAAC,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC;QAAE,OAAO,IAAI,CAAC,CAAC,6BAA6B;IACnF,IAAI,CAAC,IAAI,GAAG;QAAE,OAAO,IAAI,CAAC,CAAsB,+CAA+C;IAC/F,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,WAAW,CAAC,EAAU;IAC7B,IAAI,IAAI,GAAG,EAAE,CAAC,WAAW,EAAE,CAAC;IAC5B,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAC/B,IAAI,IAAI,IAAI,CAAC;QAAE,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;IAE1C,IAAI,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC,CAAC,yBAAyB;IAE3E,6DAA6D;IAC7D,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,+BAA+B,CAAC,CAAC;IAC3D,IAAI,MAAM;QAAE,OAAO,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;IAE1C,IAAI,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC;WAC/C,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC,CAAC,uBAAuB;IAC3F,IAAI,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC,CAAI,wBAAwB;IAC5F,IAAI,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC,CAA6B,qBAAqB;IACzF,OAAO,KAAK,CAAC;AACf,CAAC;AAED,gFAAgF;AAChF,SAAgB,WAAW,CAAC,EAAU;IACpC,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAC1B,IAAI,IAAI,KAAK,CAAC;QAAE,OAAO,WAAW,CAAC,EAAE,CAAC,CAAC;IACvC,IAAI,IAAI,KAAK,CAAC;QAAE,OAAO,WAAW,CAAC,EAAE,CAAC,CAAC;IACvC,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;GAGG;AACI,KAAK,UAAU,gBAAgB,CAAC,MAAc;IACnD,IAAI,GAAQ,CAAC;IACb,IAAI,CAAC;QAAC,GAAG,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC;IAAC,CAAC;IAC9B,MAAM,CAAC;QAAC,MAAM,IAAI,SAAS,CAAC,gBAAgB,MAAM,EAAE,CAAC,CAAC;IAAC,CAAC;IAExD,IAAI,GAAG,CAAC,QAAQ,KAAK,OAAO,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAC1D,MAAM,IAAI,SAAS,CAAC,qBAAqB,GAAG,CAAC,QAAQ,4BAA4B,CAAC,CAAC;IACrF,CAAC;IAED,MAAM,IAAI,GAAG,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC,CAAC,sBAAsB;IAEzE,IAAI,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QACnB,IAAI,WAAW,CAAC,IAAI,CAAC;YAAE,MAAM,IAAI,SAAS,CAAC,oBAAoB,IAAI,EAAE,CAAC,CAAC;QACvE,OAAO,GAAG,CAAC;IACb,CAAC;IAED,IAAI,iBAAiB,CAAC,GAAG,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,EAAE,CAAC;QAC9C,MAAM,IAAI,SAAS,CAAC,iBAAiB,IAAI,EAAE,CAAC,CAAC;IAC/C,CAAC;IAED,IAAI,KAA4B,CAAC;IACjC,IAAI,CAAC;QACH,KAAK,GAAG,MAAM,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC;IACzD,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,SAAS,CAAC,2BAA2B,IAAI,EAAE,CAAC,CAAC;IACzD,CAAC;IACD,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,MAAM,IAAI,SAAS,CAAC,2BAA2B,IAAI,EAAE,CAAC,CAAC;IAC/E,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;QACtB,IAAI,WAAW,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;YAC3B,MAAM,IAAI,SAAS,CAAC,QAAQ,IAAI,gCAAgC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;QAC/E,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAMD;;;;;GAKG;AACI,KAAK,UAAU,SAAS,CAC7B,MAAc,EACd,IAAiB,EACjB,OAAyB,EAAE;IAE3B,MAAM,YAAY,GAAG,IAAI,CAAC,YAAY,IAAI,CAAC,CAAC;IAC5C,IAAI,UAAU,GAAG,MAAM,CAAC;IACxB,IAAI,SAAS,GAAG,CAAC,CAAC;IAElB,OAAO,IAAI,EAAE,CAAC;QACZ,MAAM,gBAAgB,CAAC,UAAU,CAAC,CAAC;QACnC,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,UAAU,EAAE,EAAE,GAAG,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC,CAAC;QAE1E,MAAM,UAAU,GAAG,QAAQ,CAAC,MAAM,IAAI,GAAG,IAAI,QAAQ,CAAC,MAAM,GAAG,GAAG,CAAC;QACnE,MAAM,QAAQ,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;QAClD,IAAI,UAAU,IAAI,QAAQ,EAAE,CAAC;YAC3B,IAAI,SAAS,IAAI,YAAY;gBAAE,MAAM,IAAI,SAAS,CAAC,oBAAoB,CAAC,CAAC;YACzE,SAAS,EAAE,CAAC;YACZ,UAAU,GAAG,IAAI,GAAG,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC,QAAQ,EAAE,CAAC;YACtD,SAAS;QACX,CAAC;QACD,OAAO,QAAQ,CAAC;IAClB,CAAC;AACH,CAAC"}