dsh-web-fetch-enhanced 0.0.1

package/lib/types/client/index.d.ts

@@ -0,0 +1,13 @@
+import type { Context } from '@deepseek-ai/cordis';
+import { type LocaleKey } from './locales.ts';
+declare module '@deepseek-ai/dsh-client-ui-slots' {
+    interface LocaleNamespaceMap {
+        'settings.webFetchEnhanced': LocaleKey;
+    }
+}
+export declare const name = "web-fetch-enhanced-client";
+export declare const inject: string[];
+export declare function apply(ctx: Context): void;
+export { AllowlistCard, parseLines } from './AllowlistCard.tsx';
+export type { AllowlistCardProps, AllowlistSettings } from './AllowlistCard.tsx';
+//# sourceMappingURL=index.d.ts.map

package/lib/types/client/locales.d.ts

@@ -0,0 +1,26 @@
+export declare const en: {
+    readonly title: "Enhanced web fetch allowlist";
+    readonly description: "Allow selected non-public destinations for web_fetch. Public addresses remain available by default.";
+    readonly expand: "Expand";
+    readonly collapse: "Collapse";
+    readonly unsaved: "Unsaved";
+    readonly cidrs: "Allowed CIDRs";
+    readonly cidrsHint: "One IPv4 or IPv6 CIDR per line. Keep the range as narrow as possible.";
+    readonly cidrsPlaceholder: "198.18.0.0/15";
+    readonly hostnames: "Allowed hostnames";
+    readonly hostnamesHint: "Optional second factor. Use an exact hostname or a left-most *. wildcard; omit protocols, paths, and ports.";
+    readonly hostnamesPlaceholder: "api.example.com\n*.docs.example.com";
+    readonly save: "Save";
+    readonly reset: "Reset to Profile";
+    readonly discard: "Discard";
+    readonly saving: "Saving…";
+    readonly saved: "Saved";
+    readonly failed: "The Host rejected the change. Review the entries and try again.";
+    readonly unavailable: "This settings namespace is not available in the current Profile.";
+    readonly readOnly: "This connection cannot persist Host Profile settings.";
+    readonly duplicate: "Duplicate entries are not allowed.";
+    readonly blank: "Blank entries are ignored.";
+};
+export type LocaleKey = keyof typeof en;
+export declare const zh: Record<LocaleKey, string>;
+//# sourceMappingURL=locales.d.ts.map

package/lib/types/index.d.ts

@@ -0,0 +1,44 @@
+/**
+ * DeepSeek Harness HTTP fetch provider with explicit non-public CIDR exceptions.
+ * It preserves the native security model while making non-public exceptions explicit.
+ *
+ * @module dsh-web-fetch-enhanced
+ */
+import type { Context } from '@deepseek-ai/cordis';
+import z from '@deepseek-ai/schemastery';
+import { EnhancedHttpFetchProvider } from './provider.ts';
+/** Explicit product User-Agent used by default. */
+export declare const DEFAULT_USER_AGENT = "dsh-web-fetch-enhanced/0.1.0";
+/** Default provider id; select it in the dsh-web row with fetchProvider. */
+export declare const DEFAULT_PROVIDER_ID = "http-enhanced";
+/** Settings namespace paired with the Web Profile configuration card. */
+export declare const SETTINGS_NAMESPACE: import("@deepseek-ai/dsh-settings").SettingsNamespace;
+/** Cordis plugin name used by loader diagnostics. */
+export declare const name = "web-fetch-enhanced";
+/** The web seam this provider contributes to. */
+export declare const inject: string[];
+/** Plugin configuration. Every non-public exception is explicit and deny-by-default. */
+export interface Config {
+    /** Provider id registered in ctx.web. Defaults to http-enhanced. */
+    providerId?: string;
+    /** Non-public IPv4/IPv6 CIDRs that may bypass the public-address filter. */
+    allowCidrs?: string[];
+    /** Optional exact hosts or left-most wildcard rules required in addition to allowCidrs. */
+    allowHostnames?: string[];
+    /** Maximum response body size in bytes. */
+    maxResponseBytes?: number;
+    /** Maximum decoded body length in characters. */
+    maxBodyChars?: number;
+    /** Default fetch timeout in milliseconds, within Node's timer range. */
+    timeoutMs?: number;
+    /** Maximum number of same-origin redirect hops to follow. */
+    maxRedirects?: number;
+    /** User-Agent header sent on every request. */
+    userAgent?: string;
+}
+export declare const Config: z<Config>;
+/** Construct the provider without mounting it, useful for tests and custom compositions. */
+export declare function createProvider(config?: Config): EnhancedHttpFetchProvider;
+/** Register the enhanced fetch provider and its live Web Profile settings section. */
+export declare function apply(ctx: Context, config: Config): void;
+//# sourceMappingURL=index.d.ts.map

package/lib/types/policy.d.ts

@@ -0,0 +1,16 @@
+/** Maximum accepted request URL length. */
+export declare const WEB_FETCH_MAX_URL_LENGTH = 2048;
+export type FetchableKind = 'html' | 'text';
+/** Parse a URL and enforce HTTP(S)-only, anonymous requests. */
+export declare function parseFetchUrl(input: string): URL;
+/** Validate URL length before parsing. */
+export declare function validateFetchUrl(input: string): URL;
+/** Same origin means the scheme, hostname, and port are all equal. */
+export declare function isSameOrigin(a: URL, b: URL): boolean;
+/** Classify supported textual response types. */
+export declare function classifyContentType(contentType: string | null): FetchableKind | undefined;
+/** Return the declared charset, normalized to lower case. */
+export declare function parseCharset(contentType: string | null): string | undefined;
+/** Create a decoder, rejecting unsupported charset labels. */
+export declare function decoderForCharset(charset: string | undefined): TextDecoder;
+//# sourceMappingURL=policy.d.ts.map

package/lib/types/provider.d.ts

@@ -0,0 +1,24 @@
+import type { WebFetchProvider, WebFetchRequest, WebFetchResult } from '@deepseek-ai/dsh-web';
+import type { FetchResolver } from './resolver.ts';
+/** Resolved transport and response limits. */
+export interface HttpFetchLimits {
+    maxResponseBytes: number;
+    maxBodyChars: number;
+    timeoutMs: number;
+    maxRedirects: number;
+    userAgent: string;
+}
+/** Anonymous HTTP(S) provider with allowlist-aware address validation. */
+export declare class EnhancedHttpFetchProvider implements WebFetchProvider {
+    readonly id: string;
+    private readonly limits;
+    private readonly resolveAddresses;
+    constructor(id: string, limits: HttpFetchLimits, resolveAddresses: FetchResolver);
+    available(): boolean;
+    fetch(request: WebFetchRequest, signal?: AbortSignal): Promise<WebFetchResult>;
+    private followAndRead;
+    private requestOnce;
+    private readBody;
+    private readCapped;
+}
+//# sourceMappingURL=provider.d.ts.map

package/lib/types/resolver.d.ts

@@ -0,0 +1,31 @@
+import type { LookupAddress, LookupOptions } from 'node:dns';
+import type { Response } from 'undici';
+import { AddressPolicy } from './address-policy.ts';
+/** DNS resolver shape used by Node and by focused tests. */
+export type AddressResolver = (hostname: string, options: {
+    all: true;
+    order: 'verbatim';
+}) => Promise<LookupAddress[]>;
+/** One validated address that the pinned transport may connect to. */
+export interface ValidatedAddress {
+    readonly address: string;
+    readonly family: 4 | 6;
+}
+/** Resolver accepted by the enhanced fetch provider. */
+export type FetchResolver = (hostname: string, signal: AbortSignal) => Promise<ValidatedAddress[]>;
+/** A response and the disposer for its request-local dispatcher. */
+export interface PinnedResponse {
+    readonly response: Response;
+    close(): Promise<void>;
+}
+/** Build the resolver injected into the address-pinned HTTP provider. */
+export declare function createAllowlistResolver(policy: AddressPolicy, resolver?: AddressResolver): FetchResolver;
+/** Resolve once and reject the complete answer set when any entry is disallowed. */
+export declare function resolveAllowedAddresses(hostname: string, signal: AbortSignal, policy: AddressPolicy, resolver?: AddressResolver): Promise<ValidatedAddress[]>;
+/** Fetch while preserving the URL hostname for Host and TLS SNI. */
+export declare function requestPinned(url: URL, addresses: readonly ValidatedAddress[], headers: Record<string, string>, signal: AbortSignal): Promise<PinnedResponse>;
+type LookupCallback = (error: NodeJS.ErrnoException | null, address: string | LookupAddress[], family?: number) => void;
+/** Create a Node lookup callback that returns only the prevalidated answer set. */
+export declare function createPinnedLookup(addresses: readonly ValidatedAddress[]): (hostname: string, options: LookupOptions, callback: LookupCallback) => void;
+export {};
+//# sourceMappingURL=resolver.d.ts.map

package/package.json

@@ -0,0 +1,122 @@
+{
+  "name": "dsh-web-fetch-enhanced",
+  "version": "0.0.1",
+  "description": "Configurable non-public address allowlists for DeepSeek Harness web_fetch",
+  "type": "module",
+  "main": "./lib/index.js",
+  "types": "./lib/types/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./lib/types/index.d.ts",
+      "default": "./lib/index.js"
+    },
+    "./client": {
+      "types": "./lib/types/client/index.d.ts",
+      "default": "./lib/client.js"
+    },
+    "./cordis.patch.yml": "./cordis.patch.yml",
+    "./package.json": "./package.json"
+  },
+  "files": [
+    "lib/index.js",
+    "lib/client.js",
+    "lib/types/**/*.d.ts",
+    "cordis.patch.yml",
+    "docs",
+    "examples",
+    "README.md",
+    "README.en.md",
+    "LICENSE",
+    "NOTICE"
+  ],
+  "sideEffects": false,
+  "dsh": {
+    "bundle": {
+      "patch": "./cordis.patch.yml"
+    },
+    "client": {
+      "inject": [
+        "@deepseek-ai/dsh-client-ui-settings-plugins",
+        "@deepseek-ai/dsh-client-ui-settings",
+        "@deepseek-ai/dsh-client-locale",
+        "@deepseek-ai/dsh-client-ui-renderer"
+      ],
+      "platform": "web"
+    }
+  },
+  "keywords": [
+    "deepseek-harness",
+    "dsh-plugin",
+    "web-fetch",
+    "ssrf",
+    "fake-ip",
+    "allowlist"
+  ],
+  "license": "MIT",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/Yurzi/dsh-web-fetch-enhanced.git"
+  },
+  "homepage": "https://github.com/Yurzi/dsh-web-fetch-enhanced#readme",
+  "bugs": {
+    "url": "https://github.com/Yurzi/dsh-web-fetch-enhanced/issues"
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "engines": {
+    "node": "^22.19.0 || >=24.0.0"
+  },
+  "peerDependencies": {
+    "@deepseek-ai/cordis": "^4.0.1",
+    "@deepseek-ai/dsh-timeout": "^0.1.1-rc.2 || ^0.1.2-alpha.1",
+    "@deepseek-ai/dsh-settings": "^0.1.1-rc.2 || ^0.1.2-alpha.1",
+    "@deepseek-ai/dsh-client-runtime": "^0.1.1-rc.2 || ^0.1.2-alpha.1",
+    "@deepseek-ai/dsh-client-locale": "^0.1.1-rc.2 || ^0.1.2-alpha.1",
+    "@deepseek-ai/dsh-client-ui-renderer": "^0.1.1-rc.2 || ^0.1.2-alpha.1",
+    "@deepseek-ai/dsh-client-ui-settings": "^0.1.1-rc.2 || ^0.1.2-alpha.1",
+    "@deepseek-ai/dsh-client-ui-settings-plugins": "^0.1.1-rc.2 || ^0.1.2-alpha.1",
+    "@deepseek-ai/dsh-client-ui-slots": "^0.1.1-rc.2 || ^0.1.2-alpha.1",
+    "@deepseek-ai/dsh-web": "^0.1.1-rc.2 || ^0.1.2-alpha.1"
+  },
+  "dependencies": {
+    "@deepseek-ai/schemastery": "^3.18.1",
+    "ipaddr.js": "^2.5.0",
+    "undici": "^8.10.0"
+  },
+  "devDependencies": {
+    "@deepseek-ai/cordis": "^4.0.1",
+    "@deepseek-ai/dsh-timeout": "^0.1.1-rc.2",
+    "@deepseek-ai/dsh-settings": "^0.1.1-rc.2",
+    "@deepseek-ai/dsh-client-runtime": "^0.1.1-rc.2",
+    "@deepseek-ai/dsh-client-locale": "^0.1.1-rc.2",
+    "@deepseek-ai/dsh-client-ui-renderer": "^0.1.1-rc.2",
+    "@deepseek-ai/dsh-client-ui-settings": "^0.1.1-rc.2",
+    "@deepseek-ai/dsh-client-ui-settings-plugins": "^0.1.1-rc.2",
+    "@deepseek-ai/dsh-client-ui-slots": "^0.1.1-rc.2",
+    "@deepseek-ai/dsh-web": "^0.1.1-rc.2",
+    "@types/js-yaml": "^4.0.9",
+    "@types/node": "^22.19.13",
+    "@types/react": "~18.3.1",
+    "@vitest/coverage-v8": "^4.1.8",
+    "js-yaml": "^4.1.0",
+    "oxlint": "^1.51.0",
+    "oxlint-tsgolint": "7.0.2001",
+    "publint": "^0.3.21",
+    "react": "^18.2.0",
+    "tsdown": "^0.21.0",
+    "typescript": "^6.0.3",
+    "vitest": "^4.1.8"
+  },
+  "scripts": {
+    "build": "pnpm run build:types && pnpm run bundle",
+    "build:types": "tsc -p tsconfig.json",
+    "bundle": "tsdown",
+    "watch": "tsdown --watch",
+    "typecheck": "tsc -p tsconfig.check.json --noEmit",
+    "lint": "oxlint --type-aware --type-check -c .oxlintrc.json src tests",
+    "test": "vitest run",
+    "test:coverage": "vitest run --coverage",
+    "check": "pnpm run typecheck && pnpm run lint && pnpm run build && pnpm run test && publint"
+  }
+}