kritya 0.8.22-beta → 0.8.24-beta

package/dist/mcp/client.js

@@ -10,6 +10,7 @@ import { assertSafeUrl as assertSafeUrlShared } from "../net/urlSafety.js";
 import { checkToolsShape, serverFingerprint } from "../trust/mcpTrust.js";
 import { probeStdioEra, probeHttpEra } from "./eraDetect.js";
 import { ModernMcpConnection } from "./clientModern.js";
+import { redactSecrets } from "../tools/secretScan.js";
 import { ModernHttpTransport, ReusedProcessTransport, validateToolHeaders, } from "./transportModern.js";
 import { checkSchemaSafety } from "./schemaSafety.js";
 /**
@@ -853,9 +854,12 @@ export async function connectServer(name, cfg, trace) {
             status.error = err instanceof Error ? err.message : String(err);
             process.stderr.write(`kritya: MCP server "${name}" failed to start: ${status.error}\n`);
             span.setStatus("ERROR", status.error);
+            // status.error comes from the (untrusted) server process's own error
+            // output, which could echo back an env var or header value it was
+            // configured with.
             trace?.audit?.logTool({
                 tool: "mcp_connect",
-                summary: `server "${name}" failed to start: ${status.error}`,
+                summary: redactSecrets(`server "${name}" failed to start: ${status.error}`).redacted,
                 outcome: "error",
             });
         }

package/dist/mcp/eraDetect.js

@@ -44,6 +44,7 @@ import { spawn } from "node:child_process";
 import { planSpawn } from "./spawnWin.js";
 import { minimalEnv } from "./transport.js";
 import { OAuthSession } from "./oauth.js";
+import { pinnedDispatcherAllowLoopback } from "../net/urlSafety.js";
 const DEFAULT_PROBE_TIMEOUT_MS = 5_000;
 /**
  * Probe a stdio server with `server/discover`, per
@@ -160,18 +161,22 @@ export async function probeHttpEra(url, headers, timeoutMs = DEFAULT_HTTP_PROBE_
         }
         return built;
     };
-    const post = async () => fetch(url, {
-        method: "POST",
-        headers: await buildHeaders(),
-        body: JSON.stringify({
-            jsonrpc: "2.0",
-            id: "discover-probe",
-            method: "server/discover",
-            params: { _meta: modernMeta() },
-        }),
-        redirect: "manual",
-        signal: AbortSignal.timeout(timeoutMs),
-    });
+    const post = async () => {
+        const init = {
+            method: "POST",
+            headers: await buildHeaders(),
+            body: JSON.stringify({
+                jsonrpc: "2.0",
+                id: "discover-probe",
+                method: "server/discover",
+                params: { _meta: modernMeta() },
+            }),
+            redirect: "manual",
+            signal: AbortSignal.timeout(timeoutMs),
+            dispatcher: pinnedDispatcherAllowLoopback,
+        };
+        return fetch(url, init);
+    };
     let res;
     try {
         res = await post();

package/dist/mcp/oauth.js

@@ -2,7 +2,7 @@ import crypto from "node:crypto";
 import { VERSION } from "../version.js";
 import { debugLog } from "../config/debug.js";
 import { isExpired, loadAuth, saveAuth } from "./tokens.js";
-import { assertSafeUrl } from "../net/urlSafety.js";
+import { assertSafeUrl, pinnedDispatcherAllowLoopback, } from "../net/urlSafety.js";
 /**
  * OAuth 2.1 for remote (Streamable HTTP) MCP servers.
  *
@@ -55,7 +55,12 @@ function ua() {
  */
 async function getJson(url, timeoutMs = DISCOVERY_TIMEOUT_MS) {
     const safe = assertSafeUrl("OAuth discovery endpoint", url);
-    const res = await fetch(safe, { headers: ua(), signal: AbortSignal.timeout(timeoutMs) });
+    const init = {
+        headers: ua(),
+        signal: AbortSignal.timeout(timeoutMs),
+        dispatcher: pinnedDispatcherAllowLoopback,
+    };
+    const res = await fetch(safe, init);
     if (!res.ok)
         throw new Error(`HTTP ${res.status} from ${url}`);
     return res.json();
@@ -167,7 +172,7 @@ export async function registerClient(meta, redirectUri, scope) {
         throw new Error(`authorization server ${meta.issuer} does not support dynamic client registration; ` +
             `register kritya manually and put the client_id in mcp-auth.json`);
     }
-    const res = await fetch(assertSafeUrl("OAuth registration endpoint", meta.registrationEndpoint), {
+    const registrationInit = {
         method: "POST",
         headers: { ...ua(), "content-type": "application/json" },
         body: JSON.stringify({
@@ -180,7 +185,9 @@ export async function registerClient(meta, redirectUri, scope) {
             ...(scope ? { scope } : {}),
         }),
         signal: AbortSignal.timeout(TOKEN_TIMEOUT_MS),
-    });
+        dispatcher: pinnedDispatcherAllowLoopback,
+    };
+    const res = await fetch(assertSafeUrl("OAuth registration endpoint", meta.registrationEndpoint), registrationInit);
     if (!res.ok) {
         const body = await res.text().catch(() => "");
         throw new Error(`client registration failed: HTTP ${res.status}${body ? ` — ${body.slice(0, 200)}` : ""}`);
@@ -215,12 +222,14 @@ async function postToken(tokenEndpoint, params, clientSecret) {
         const basic = Buffer.from(`${params.client_id}:${clientSecret}`).toString("base64");
         headers.authorization = `Basic ${basic}`;
     }
-    const res = await fetch(assertSafeUrl("OAuth token endpoint", tokenEndpoint), {
+    const tokenInit = {
         method: "POST",
         headers,
         body: new URLSearchParams(params).toString(),
         signal: AbortSignal.timeout(TOKEN_TIMEOUT_MS),
-    });
+        dispatcher: pinnedDispatcherAllowLoopback,
+    };
+    const res = await fetch(assertSafeUrl("OAuth token endpoint", tokenEndpoint), tokenInit);
     const doc = (await res.json().catch(() => ({})));
     if (!res.ok || doc.error || !doc.access_token) {
         const detail = doc.error_description ?? doc.error ?? `HTTP ${res.status}`;
@@ -281,7 +290,7 @@ export async function revokeToken(auth) {
     const token = auth.refreshToken ?? auth.accessToken;
     const hint = auth.refreshToken ? "refresh_token" : "access_token";
     try {
-        const res = await fetch(assertSafeUrl("OAuth revocation endpoint", auth.revocationEndpoint), {
+        const revokeInit = {
             method: "POST",
             headers: { ...ua(), "content-type": "application/x-www-form-urlencoded" },
             body: new URLSearchParams({
@@ -290,7 +299,9 @@ export async function revokeToken(auth) {
                 client_id: auth.clientId,
             }).toString(),
             signal: AbortSignal.timeout(TOKEN_TIMEOUT_MS),
-        });
+            dispatcher: pinnedDispatcherAllowLoopback,
+        };
+        const res = await fetch(assertSafeUrl("OAuth revocation endpoint", auth.revocationEndpoint), revokeInit);
         return res.ok;
     }
     catch (err) {

package/dist/mcp/servers.js

@@ -1,5 +1,8 @@
 import fs from "node:fs";
 import path from "node:path";
+import { sanitizeMcpServersRecord } from "../config/config.js";
+import { assertJsonWithinLimits } from "../config/jsonSafety.js";
+import { warnUser } from "../config/debug.js";
 /**
  * Where MCP server definitions come from and how they combine:
  *
@@ -83,13 +86,23 @@ function isServerConfig(v) {
  * degrade to "no project servers", not break startup.
  */
 export function loadProjectMcpServers(workspace) {
-    let parsed;
+    const file = path.join(workspace, ".mcp.json");
+    let raw;
     try {
-        parsed = JSON.parse(fs.readFileSync(path.join(workspace, ".mcp.json"), "utf8"));
+        raw = fs.readFileSync(file, "utf8");
     }
     catch {
         return undefined;
     }
+    let parsed;
+    try {
+        assertJsonWithinLimits(raw, ".mcp.json");
+        parsed = JSON.parse(raw);
+    }
+    catch (err) {
+        warnUser(`loadProjectMcpServers(${file})`, err);
+        return undefined;
+    }
     if (!parsed?.mcpServers || typeof parsed.mcpServers !== "object")
         return undefined;
     const servers = {};
@@ -97,7 +110,9 @@ export function loadProjectMcpServers(workspace) {
         if (isServerConfig(cfg))
             servers[name] = cfg;
     }
-    return Object.keys(servers).length ? servers : undefined;
+    if (!Object.keys(servers).length)
+        return undefined;
+    return sanitizeMcpServersRecord(servers, ".mcp.json mcpServers");
 }
 /**
  * Combine plugin, project, and global server definitions, expanding ${VAR} in

package/dist/mcp/transport.js

@@ -1,6 +1,7 @@
 import { spawn } from "node:child_process";
 import { McpAuthRequiredError, OAuthSession, parseWwwAuthenticate } from "./oauth.js";
 import { planSpawn } from "./spawnWin.js";
+import { pinnedDispatcherAllowLoopback } from "../net/urlSafety.js";
 /** Same-origin redirects we'll follow before calling it a loop. */
 const MAX_REDIRECTS = 5;
 function isRedirect(status) {
@@ -212,7 +213,7 @@ export class HttpTransport {
         let url = this.url;
         // Bounded, because a redirect chain is otherwise a free loop.
         for (let hop = 0;; hop++) {
-            const res = await fetch(url, {
+            const init = {
                 method: "POST",
                 headers: await this.buildHeaders(),
                 body,
@@ -224,7 +225,12 @@ export class HttpTransport {
                 // Cancelling has to tear the socket down too, or the request stays in
                 // flight for the full timeout after the user has walked away.
                 signal: withTimeout(timeoutMs, signal),
-            });
+                // DNS-pin every connection, not just the URL kritya validated once at
+                // server-config time — closes the DNS-rebinding gap between that
+                // check and the actual connect.
+                dispatcher: pinnedDispatcherAllowLoopback,
+            };
+            const res = await fetch(url, init);
             if (!isRedirect(res.status))
                 return res;
             const location = res.headers.get("location");
@@ -284,12 +290,16 @@ export class HttpTransport {
         if (!this.sessionId)
             return;
         this.buildHeaders()
-            .then((headers) => fetch(this.url, {
-            method: "DELETE",
-            headers,
-            redirect: "manual",
-            signal: AbortSignal.timeout(3_000),
-        }))
+            .then((headers) => {
+            const init = {
+                method: "DELETE",
+                headers,
+                redirect: "manual",
+                signal: AbortSignal.timeout(3_000),
+                dispatcher: pinnedDispatcherAllowLoopback,
+            };
+            return fetch(this.url, init);
+        })
             .catch(() => { });
     }
 }

package/dist/mcp/transportModern.js

@@ -1,6 +1,7 @@
 import { McpAuthRequiredError, OAuthSession, parseWwwAuthenticate } from "./oauth.js";
 import { withTimeout } from "./transport.js";
 import { modernMeta, MODERN_PROTOCOL_VERSION } from "./eraDetect.js";
+import { pinnedDispatcherAllowLoopback } from "../net/urlSafety.js";
 /** Same-origin redirects we'll follow before calling it a loop. */
 const MAX_REDIRECTS = 5;
 /** How much of a server's stderr to keep for diagnostics, and how much to report. */
@@ -333,13 +334,17 @@ export class ModernHttpTransport {
         const body = JSON.stringify(msg);
         let url = this.url;
         for (let hop = 0;; hop++) {
-            const res = await fetch(url, {
+            const init = {
                 method: "POST",
                 headers: await this.buildHeaders(msg),
                 body,
                 redirect: "manual",
                 signal: withTimeout(timeoutMs, signal),
-            });
+                // DNS-pin the connection so a rebind between server-config validation
+                // and this request can't redirect it to a private address.
+                dispatcher: pinnedDispatcherAllowLoopback,
+            };
+            const res = await fetch(url, init);
             if (!isRedirect(res.status))
                 return res;
             const location = res.headers.get("location");

package/dist/net/urlSafety.js

@@ -1,3 +1,5 @@
+import { lookup as dnsLookup } from "node:dns/promises";
+import { Agent } from "undici";
 /**
  * Shared "is this host on a private/internal network" check, used by both
  * fetch_url (src/tools/fetchUrl.ts) and the MCP HTTP transport guard
@@ -189,3 +191,57 @@ export function assertSafeUrl(label, url) {
     throw new Error(`${label} uses plain http:// (${parsed.host}), which would carry credentials in cleartext. ` +
         `Use https:// (localhost is exempt).`);
 }
+/**
+ * The actual SSRF boundary, shared by every outbound fetch kritya's own
+ * process makes on the user's behalf (fetch_url, MCP HTTP/SSE transports,
+ * OAuth discovery/registration/token/revocation, OTLP export): a connect-time
+ * `lookup` on a dedicated undici Agent, so the address that gets validated is
+ * the exact address the socket connects to — one DNS answer, not two.
+ * Checking a hostname once up front (assertSafeUrl) and letting `fetch`
+ * re-resolve it independently leaves a TOCTOU window: attacker-controlled or
+ * short-TTL DNS can answer differently the second time (DNS rebinding).
+ * Pinning the lookup closes that regardless of hop, hostname, or TTL.
+ *
+ * `isBlockedAddress` is pluggable because the two callers disagree on
+ * loopback: fetch_url refuses it outright (assertPublicUrl), while MCP
+ * servers and OAuth endpoints are routinely run locally during development
+ * and assertSafeUrl deliberately exempts loopback there. Each dispatcher
+ * instance holds no per-host state beyond ordinary connection pooling, so
+ * it's safe to share across every call site that uses the same policy.
+ */
+function createPinnedDispatcher(isBlockedAddress) {
+    return new Agent({
+        connect: {
+            lookup(hostname, options, callback) {
+                dnsLookup(hostname, { all: true })
+                    .then((addresses) => {
+                    if (addresses.length === 0) {
+                        callback(new Error(`Could not resolve ${hostname}`), []);
+                        return;
+                    }
+                    const bad = addresses.find((a) => isBlockedAddress(a.address));
+                    if (bad) {
+                        callback(new Error(`Refusing to connect to ${hostname}: resolves to private/internal address ${bad.address}`), []);
+                        return;
+                    }
+                    if (options.all) {
+                        callback(null, addresses);
+                    }
+                    else {
+                        const chosen = addresses[0];
+                        callback(null, chosen.address, chosen.family);
+                    }
+                })
+                    .catch((err) => callback(err, []));
+            },
+        },
+    });
+}
+/** For callers that never allow loopback either (fetch_url). */
+export const pinnedDispatcher = createPinnedDispatcher(isPrivateOrLoopbackHost);
+/**
+ * For callers that follow assertSafeUrl's policy: loopback is fine (a locally
+ * running MCP server or OAuth endpoint during development), other private/
+ * internal ranges are not.
+ */
+export const pinnedDispatcherAllowLoopback = createPinnedDispatcher((address) => !isLoopbackHost(address) && isPrivateOrLoopbackHost(address));

package/dist/permissions/danger.js

@@ -3,7 +3,31 @@
  * matches, kritya forces a permission prompt with a warning even if the
  * command would otherwise be covered by an allowlist rule or an "always allow"
  * choice — so a blanket `shell(*)` allow can't silently run `rm -rf /`.
+ *
+ * This is pattern matching over command text, not a shell parser — it can
+ * only see danger words that actually appear in the string. It normalizes
+ * one specific evasion ($IFS in place of a space) and flags several ways of
+ * running an opaque payload (eval, base64 -d, an interpreter's -c/-e,
+ * PowerShell's -EncodedCommand), but a command that reassembles a dangerous
+ * word at runtime without those (e.g. `a=r;b=m;$a$b -rf /`, or piping
+ * through `tr`/`rev`) has no literal substring left to match and will not be
+ * caught. Sandboxing (src/shell/sandbox.ts) is the actual backstop for that
+ * gap, not a replacement for closing it here.
  */
+/**
+ * `$IFS`/`${IFS}` in place of a literal space is a well-known filter-bypass
+ * trick (`rm${IFS}-rf${IFS}/` runs exactly like `rm -rf /`, but every
+ * pattern below that requires `\s+` between a command and its arguments
+ * never sees a whitespace character to match). Since this is purely a
+ * word-separator substitution — nothing about how the shell actually runs
+ * the command — normalizing it to a literal space before pattern matching
+ * catches the same commands the patterns already catch, without changing
+ * what any of them mean.
+ */
+const IFS_RE = /\$\{IFS[^}]*\}|\$IFS\b/g;
+function normalizeForDangerCheck(command) {
+    return command.replace(IFS_RE, " ");
+}
 const PATTERNS = [
     {
         re: /\brm\s+.*(-[a-z]*[rf][a-z]*\b|--recursive\b|--force\b|--no-preserve-root\b)/i,
@@ -83,11 +107,27 @@ const PATTERNS = [
         re: /\b(python3?|node|ruby|perl)\b\s+(-c|-e)\b/i,
         label: "running an inline script (bypasses command-text inspection)",
     },
+    {
+        // Shells' inline-command flag is -c specifically; unlike the
+        // interpreters above, -e means something else for a shell (errexit) and
+        // would false-positive on an ordinary `bash -e build.sh`.
+        re: /\b(bash|sh|zsh|dash|ksh)\b\s+-c\b/i,
+        label: "running an inline shell command (bypasses command-text inspection)",
+    },
+    {
+        // PowerShell accepts any unambiguous prefix of -EncodedCommand (-enc,
+        // -encodedcommand, ...); "en" is enough to disambiguate it from every
+        // other powershell.exe flag (-ExecutionPolicy starts "ex", not "en").
+        // This is the same base64-obfuscation evasion the generic `base64 -d`
+        // pattern above catches for POSIX shells, just spelled differently.
+        re: /\b(powershell(\.exe)?|pwsh)\b.*\s-en[a-z]*\b/i,
+        label: "running a base64-encoded PowerShell command (-EncodedCommand)",
+    },
     { re: /\bexec\s+\d*[<>]/i, label: "redirecting a shell's own file descriptors (exec)" },
 ];
 /** Returns a human-readable danger label if the command is destructive, else null. */
 export function classifyDanger(command) {
-    const cmd = command.trim();
+    const cmd = normalizeForDangerCheck(command.trim());
     for (const { re, label } of PATTERNS) {
         if (re.test(cmd))
             return label;

package/dist/provider/switchyardClient.js

@@ -29,6 +29,7 @@ export class SwitchyardProviderClient extends ProviderClient {
             let lastErr = err;
             for (const fb of this.fallbacks) {
                 try {
+                    callbacks.onFallback?.("switchyard", fb.model);
                     return await fb.client.chat(fb.model, messages, tools, callbacks, signal, trace);
                 }
                 catch (fbErr) {

package/dist/session/store.js

@@ -4,7 +4,56 @@ import path from "node:path";
 import { writeFileAtomicSync } from "../atomicWrite.js";
 import { CONFIG_DIR } from "../config/config.js";
 import { hardenWindowsDir } from "../config/winAcl.js";
-import { debugLog } from "../config/debug.js";
+import { debugLog, warnPersistenceFailure } from "../config/debug.js";
+/**
+ * A session file loaded whole into memory has no upper bound otherwise —
+ * `--continue` on a pathologically large transcript (corruption, a runaway
+ * write loop, or an adversarial file dropped into the session directory)
+ * would try to allocate the entire thing at once. Above this size, only the
+ * most recent bytes are read; older history is dropped rather than the
+ * resume failing outright.
+ */
+const MAX_SESSION_FILE_BYTES = 50 * 1024 * 1024;
+/**
+ * Upper bound on a single message body persisted to a session file. Guards
+ * against a runaway model response or tool result ballooning the transcript
+ * — the live in-memory turn is unaffected, only what gets written to disk
+ * (and so what a future `loadFile` would have to hold in memory at once).
+ */
+const MAX_MESSAGE_CONTENT_CHARS = 2_000_000;
+/** Cap `message.content` in place when it's a plain string over the limit. */
+function capMessageContent(message) {
+    if (typeof message.content !== "string" || message.content.length <= MAX_MESSAGE_CONTENT_CHARS) {
+        return message;
+    }
+    return {
+        ...message,
+        content: message.content.slice(0, MAX_MESSAGE_CONTENT_CHARS) +
+            `\n... [truncated, ${message.content.length - MAX_MESSAGE_CONTENT_CHARS} more characters]`,
+    };
+}
+/**
+ * Read `filePath`, capped to the last `maxBytes` bytes when it exceeds that
+ * size. The byte cut can land mid-line, so the leading partial line is
+ * dropped — callers parse one JSON message per line and would otherwise
+ * choke on (or silently misparse) a truncated first line.
+ */
+export function readSessionFileCapped(filePath, maxBytes = MAX_SESSION_FILE_BYTES) {
+    const size = fs.statSync(filePath).size;
+    if (size <= maxBytes)
+        return fs.readFileSync(filePath, "utf8");
+    const fd = fs.openSync(filePath, "r");
+    try {
+        const buffer = Buffer.alloc(maxBytes);
+        fs.readSync(fd, buffer, 0, maxBytes, size - maxBytes);
+        const text = buffer.toString("utf8");
+        const firstNewline = text.indexOf("\n");
+        return firstNewline === -1 ? "" : text.slice(firstNewline + 1);
+    }
+    finally {
+        fs.closeSync(fd);
+    }
+}
 function sessionDir(workspace) {
     const hash = crypto.createHash("sha1").update(workspace).digest("hex").slice(0, 12);
     return path.join(CONFIG_DIR, "sessions", hash);
@@ -78,7 +127,7 @@ export class SessionStore {
             writeSessionFile(this.tasksFilePath(), JSON.stringify(tasks));
         }
         catch (err) {
-            debugLog(`SessionStore.saveTasks(${this.tasksFilePath()})`, err);
+            warnPersistenceFailure(`SessionStore.saveTasks(${this.tasksFilePath()})`, err);
         }
     }
     /** Loads the task checklist saved alongside a given session file, if any. */
@@ -106,7 +155,7 @@ export class SessionStore {
         fs.mkdirSync(this.dir, { recursive: true, mode: 0o700 });
         hardenWindowsDir(CONFIG_DIR);
         if (seed.length) {
-            writeSessionFile(this.file, seed.map((m) => JSON.stringify(m) + "\n").join(""));
+            writeSessionFile(this.file, seed.map((m) => JSON.stringify(capMessageContent(m)) + "\n").join(""));
         }
     }
     /**
@@ -123,11 +172,13 @@ export class SessionStore {
         try {
             fs.mkdirSync(this.dir, { recursive: true, mode: 0o700 });
             hardenWindowsDir(CONFIG_DIR);
-            fs.appendFileSync(this.file, JSON.stringify(message) + "\n", { mode: 0o600 });
+            fs.appendFileSync(this.file, JSON.stringify(capMessageContent(message)) + "\n", {
+                mode: 0o600,
+            });
         }
         catch (err) {
             // Persistence is best-effort; never crash the session over it.
-            debugLog(`SessionStore.append(${this.file})`, err);
+            warnPersistenceFailure(`SessionStore.append(${this.file})`, err);
         }
     }
     /** Start over with a fresh session file (used by /clear). */
@@ -146,11 +197,11 @@ export class SessionStore {
         try {
             fs.mkdirSync(this.dir, { recursive: true, mode: 0o700 });
             hardenWindowsDir(CONFIG_DIR);
-            writeSessionFile(this.file, messages.map((m) => JSON.stringify(m) + "\n").join(""));
+            writeSessionFile(this.file, messages.map((m) => JSON.stringify(capMessageContent(m)) + "\n").join(""));
         }
         catch (err) {
             // Persistence is best-effort; never crash the session over it.
-            debugLog(`SessionStore.overwrite(${this.file})`, err);
+            warnPersistenceFailure(`SessionStore.overwrite(${this.file})`, err);
         }
     }
     /**
@@ -205,7 +256,7 @@ export class SessionStore {
         const messages = [];
         let raw;
         try {
-            raw = fs.readFileSync(filePath, "utf8");
+            raw = readSessionFileCapped(filePath);
         }
         catch {
             return messages;
@@ -226,7 +277,7 @@ export class SessionStore {
     static readLines(filePath) {
         let raw;
         try {
-            raw = fs.readFileSync(filePath, "utf8");
+            raw = readSessionFileCapped(filePath);
         }
         catch {
             return [];

package/dist/telemetry/metrics.js

@@ -1,4 +1,5 @@
 import { VERSION } from "../version.js";
+import { warnPersistenceFailure } from "../config/debug.js";
 import { encodeMetricsSnapshot, postOtlp, postOtlpAndWait, } from "./otlp.js";
 const NOOP_COUNTER = { add() { } };
 const NOOP_HISTOGRAM = { record() { } };
@@ -113,8 +114,10 @@ class RealMeter {
                 return;
             postOtlp(this.endpoint, "/v1/metrics", body, this.headers);
         }
-        catch {
-            // best-effort: metrics must never crash the process
+        catch (err) {
+            // best-effort: metrics must never crash the process, but a dropped
+            // export should still be visible to the user.
+            warnPersistenceFailure("metrics.flush", err);
         }
     }
     async flushAndWait() {
@@ -124,8 +127,8 @@ class RealMeter {
                 return;
             await postOtlpAndWait(this.endpoint, "/v1/metrics", body, this.headers);
         }
-        catch {
-            // best-effort: metrics must never crash the process
+        catch (err) {
+            warnPersistenceFailure("metrics.flushAndWait", err);
         }
     }
     stop() {

package/dist/telemetry/otlp.js

@@ -1,4 +1,5 @@
-import { debugLog } from "../config/debug.js";
+import { warnPersistenceFailure } from "../config/debug.js";
+import { assertSafeUrl, pinnedDispatcherAllowLoopback, } from "../net/urlSafety.js";
 function toAnyValue(value) {
     if (typeof value === "string")
         return { stringValue: value };
@@ -97,14 +98,21 @@ export function encodeMetricsSnapshot(points, resource) {
  */
 export function postOtlp(endpoint, path, body, headers) {
     try {
-        fetch(`${endpoint.replace(/\/+$/, "")}${path}`, {
+        // Same DNS-pinning + private-address policy as MCP server URLs and OAuth
+        // endpoints (loopback ok, other private ranges refused): KRITYA_OTEL_ENDPOINT
+        // is user config, not attacker input, but there's no reason this one
+        // outbound path should be less protected than the others.
+        const url = assertSafeUrl("OTLP endpoint", `${endpoint.replace(/\/+$/, "")}${path}`);
+        const init = {
             method: "POST",
             headers: { "content-type": "application/json", ...(headers ?? {}) },
             body: JSON.stringify(body),
-        }).catch((err) => debugLog(`postOtlp(${path})`, err));
+            dispatcher: pinnedDispatcherAllowLoopback,
+        };
+        fetch(url.href, init).catch((err) => warnPersistenceFailure(`postOtlp(${path})`, err));
     }
     catch (err) {
-        debugLog(`postOtlp(${path})`, err);
+        warnPersistenceFailure(`postOtlp(${path})`, err);
     }
 }
 /**
@@ -116,13 +124,16 @@ export function postOtlp(endpoint, path, body, headers) {
  */
 export async function postOtlpAndWait(endpoint, path, body, headers) {
     try {
-        await fetch(`${endpoint.replace(/\/+$/, "")}${path}`, {
+        const url = assertSafeUrl("OTLP endpoint", `${endpoint.replace(/\/+$/, "")}${path}`);
+        const init = {
             method: "POST",
             headers: { "content-type": "application/json", ...(headers ?? {}) },
             body: JSON.stringify(body),
-        });
+            dispatcher: pinnedDispatcherAllowLoopback,
+        };
+        await fetch(url.href, init);
     }
     catch (err) {
-        debugLog(`postOtlpAndWait(${path})`, err);
+        warnPersistenceFailure(`postOtlpAndWait(${path})`, err);
     }
 }

package/dist/telemetry/tracer.js

@@ -3,7 +3,7 @@ import fs from "node:fs";
 import path from "node:path";
 import { CONFIG_DIR } from "../config/config.js";
 import { hardenWindowsDir } from "../config/winAcl.js";
-import { debugLog } from "../config/debug.js";
+import { debugLog, warnPersistenceFailure } from "../config/debug.js";
 import { VERSION } from "../version.js";
 import { encodeSpan, postOtlp } from "./otlp.js";
 function nowUnixNano() {
@@ -158,7 +158,7 @@ function fileSink(file) {
         }
         catch (err) {
             // best-effort: telemetry must never crash a turn
-            debugLog(`tracer.fileSink(${file})`, err);
+            warnPersistenceFailure(`tracer.fileSink(${file})`, err);
         }
     };
 }

package/dist/tools/document/docx.js

@@ -1,7 +1,13 @@
 import mammoth from "mammoth";
 import { Document, HeadingLevel, Packer, Paragraph, TextRun } from "docx";
 import { validateBlocks } from "./types.js";
+import { loadSafeZip } from "./zipSafety.js";
 export async function readDocx(buf) {
+    // .docx is a zip container, and mammoth decompresses every entry with no
+    // size limit — same decompression-bomb exposure as .xlsx (see
+    // zipSafety.ts). Validate declared uncompressed size before handing the
+    // buffer to mammoth.
+    await loadSafeZip(buf);
     const result = await mammoth.extractRawText({ buffer: buf });
     return result.value;
 }