open-managed-agents 0.1.0

package/dist/src/control-plane/sessions/pi/mcp/credential.js

@@ -0,0 +1,28 @@
+import { AsyncLocalStorage } from "node:async_hooks";
+const authOperation = new AsyncLocalStorage();
+export async function runMcpAuthOperation(fn) {
+    return authOperation.run({}, fn);
+}
+export function recordRejectedMcpAuthorization(snapshot) {
+    const context = authOperation.getStore();
+    if (context !== undefined)
+        context.rejectedAuthorization = snapshot;
+}
+const MCP_AUTH_SNAPSHOT = Symbol("oma.mcpAuthSnapshot");
+export function attachMcpAuthSnapshot(error) {
+    const normalized = error instanceof Error ? error : new Error(String(error));
+    const snapshot = authOperation.getStore()?.rejectedAuthorization;
+    if (snapshot !== undefined) {
+        Object.defineProperty(normalized, MCP_AUTH_SNAPSHOT, {
+            value: snapshot,
+            enumerable: false,
+            configurable: true,
+        });
+    }
+    return normalized;
+}
+export function getMcpAuthSnapshot(error) {
+    if (!(error instanceof Error))
+        return undefined;
+    return error[MCP_AUTH_SNAPSHOT];
+}

package/dist/src/control-plane/sessions/pi/mcp/fetch.js

@@ -0,0 +1,69 @@
+// SSRF-guarded fetch for control-plane MCP dials (plan 0122 §4.3).
+//
+// Agent configs carry attacker-influenceable URLs and the control plane dials
+// them; without a guard, `http://169.254.169.254/` or the admin API would be
+// reachable. The transport takes a custom fetch, so we hand it one whose
+// dialer resolves through the egress pinned lookup: every resolution is
+// checked against the blocked ranges, and the socket connects to exactly the
+// vetted address (Node's `lookup` seam — no re-resolution between check and
+// connect, so no TOCTOU). Probe-verified (2026-07-06): undici re-consults the
+// lookup per new connection, so a DNS rebind to a private range is re-checked
+// and rejected, and `redirect: "error"` refuses the classic 30x-to-internal
+// bypass.
+import { isIP } from "node:net";
+import { Agent, fetch as undiciFetch } from "undici";
+import { createPinnedLookup, isBlockedAddress, } from "../../../egress/ssrf.js";
+export function createGuardedMcpFetch(opts = {}) {
+    const dispatcher = new Agent({
+        connect: { lookup: ipv4FirstLookup(createPinnedLookup(opts)) },
+    });
+    return async (url, init) => {
+        // Node skips the lookup seam entirely for IP-literal hostnames, so a
+        // `http://127.0.0.1/…` target would bypass a lookup-only guard. Check
+        // literals explicitly, same as egress/proxy.ts does before dialing.
+        assertLiteralHostAllowed(url, opts);
+        return undiciFetch(url, {
+            ...init,
+            // After the init spread: callers (including the MCP SDK) can never
+            // relax the dialer or re-enable redirects.
+            dispatcher,
+            redirect: "error",
+        });
+    };
+}
+/**
+ * Reorder vetted addresses IPv4-first. Live smoke 48: dual-stack MCP hosts
+ * (e.g. DeepWiki on AWS) resolve v6-first, and on networks without working
+ * v6 egress each new connection burned ~15s of v6 SYN timeouts before
+ * falling back — racing the MCP handshake into its request timeout. Every
+ * address here has already passed the blocked-range check; only the dial
+ * order changes.
+ */
+function ipv4FirstLookup(inner) {
+    return ((hostname, options, callback) => {
+        inner(hostname, options, (err, address, family) => {
+            if (err || !Array.isArray(address)) {
+                callback(err, address, family);
+                return;
+            }
+            const sorted = [
+                ...address.filter((entry) => entry.family === 4),
+                ...address.filter((entry) => entry.family !== 4),
+            ];
+            callback(null, sorted);
+        });
+    });
+}
+function assertLiteralHostAllowed(url, opts) {
+    const parsed = typeof url === "string" ? new URL(url) : url;
+    // URL.hostname wraps IPv6 literals in brackets; strip for isIP.
+    const host = parsed.hostname.replace(/^\[|\]$/g, "");
+    const family = isIP(host);
+    if (family === 0)
+        return; // not a literal — the pinned lookup handles it
+    if (opts.allowAddress?.(host, family))
+        return;
+    if (!isBlockedAddress(host, family))
+        return;
+    throw Object.assign(new Error(`egress denied: ${host} is in a blocked (private/loopback/reserved) range`), { code: "EGRESS_SSRF_BLOCKED" });
+}

package/dist/src/control-plane/sessions/pi/mcp/probe.js

@@ -0,0 +1,202 @@
+import { LATEST_PROTOCOL_VERSION } from "@modelcontextprotocol/sdk/types.js";
+import { knownSecretRepresentations, scrubKnownSecrets, } from "../../../logging.js";
+const PROBE_REQUEST_ID = 1;
+export async function probeMcpInitialize(url, authorization, fetch, opts) {
+    const controller = new AbortController();
+    const timeout = setTimeout(() => controller.abort(), opts.timeoutMs);
+    try {
+        const headers = new Headers({
+            accept: "application/json, text/event-stream",
+            "content-type": "application/json",
+        });
+        if (authorization !== undefined)
+            headers.set("authorization", authorization);
+        let response;
+        try {
+            response = await fetch(url, {
+                method: "POST",
+                headers,
+                body: JSON.stringify({
+                    jsonrpc: "2.0",
+                    id: PROBE_REQUEST_ID,
+                    method: "initialize",
+                    params: {
+                        protocolVersion: LATEST_PROTOCOL_VERSION,
+                        capabilities: {},
+                        clientInfo: { name: "open-managed-agents", version: "0" },
+                    },
+                }),
+                signal: controller.signal,
+            });
+        }
+        catch {
+            return { reached: false };
+        }
+        const contentType = response.headers.get("content-type") ?? "";
+        let captured;
+        try {
+            captured = contentType.toLowerCase().includes("text/event-stream")
+                ? await readSseInitialize(response, opts.capBytes)
+                : await readCappedBody(response, opts.capBytes);
+        }
+        catch {
+            captured = { body: "", truncated: true };
+        }
+        const knownSecrets = opts.knownSecrets ?? [];
+        const scrubbedBody = scrubKnownSecrets(captured.body, knownSecrets);
+        return {
+            reached: true,
+            statusCode: response.status,
+            contentType: scrubKnownSecrets(contentType, knownSecrets),
+            body: captured.truncated
+                ? scrubTruncatedSecretSuffix(scrubbedBody, knownSecrets)
+                : scrubbedBody,
+            bodyTruncated: captured.truncated,
+            initializeSucceeded: response.ok && isInitializeResult(captured.initializeBody ?? captured.body),
+        };
+    }
+    finally {
+        clearTimeout(timeout);
+    }
+}
+async function readCappedBody(response, capBytes) {
+    if (response.body === null)
+        return { body: "", truncated: false };
+    const reader = response.body.getReader();
+    const chunks = [];
+    let total = 0;
+    let truncated = false;
+    try {
+        while (total < capBytes) {
+            const { value, done } = await reader.read();
+            if (done)
+                break;
+            if (value === undefined)
+                continue;
+            const remaining = capBytes - total;
+            if (value.byteLength > remaining) {
+                chunks.push(value.subarray(0, remaining));
+                total += remaining;
+                truncated = true;
+                await reader.cancel();
+                break;
+            }
+            chunks.push(value);
+            total += value.byteLength;
+            if (total === capBytes) {
+                const contentLengthHeader = response.headers.get("content-length");
+                const contentLength = Number(contentLengthHeader);
+                truncated =
+                    contentLengthHeader === null ||
+                        !Number.isFinite(contentLength) ||
+                        contentLength > capBytes;
+                await reader.cancel();
+                break;
+            }
+        }
+    }
+    catch (error) {
+        await reader.cancel().catch(() => undefined);
+        throw error;
+    }
+    finally {
+        reader.releaseLock();
+    }
+    return { body: decodeChunks(chunks, total), truncated };
+}
+async function readSseInitialize(response, capBytes) {
+    if (response.body === null)
+        return { body: "", truncated: false };
+    const reader = response.body.getReader();
+    const decoder = new TextDecoder();
+    let pending = "";
+    let bytesRead = 0;
+    let captured = "";
+    try {
+        while (bytesRead < capBytes) {
+            const { value, done } = await reader.read();
+            if (done)
+                break;
+            if (value === undefined)
+                continue;
+            const remaining = capBytes - bytesRead;
+            const part = value.byteLength > remaining ? value.subarray(0, remaining) : value;
+            bytesRead += part.byteLength;
+            pending += decoder.decode(part, { stream: true });
+            const frames = pending.split(/\r?\n\r?\n/);
+            pending = frames.pop() ?? "";
+            for (const frame of frames) {
+                const data = frame
+                    .split(/\r?\n/)
+                    .filter((line) => line.startsWith("data:"))
+                    .map((line) => line.slice(5).replace(/^ /, ""))
+                    .join("\n");
+                if (data.length === 0)
+                    continue;
+                captured = data;
+                if (isResponseForProbe(data)) {
+                    await reader.cancel();
+                    return { body: data, truncated: false, initializeBody: data };
+                }
+            }
+            if (value.byteLength > remaining || bytesRead === capBytes) {
+                await reader.cancel();
+                return { body: captured || pending, truncated: true };
+            }
+        }
+        return { body: captured || pending + decoder.decode(), truncated: false };
+    }
+    catch (error) {
+        await reader.cancel().catch(() => undefined);
+        throw error;
+    }
+    finally {
+        reader.releaseLock();
+    }
+}
+function isResponseForProbe(text) {
+    const value = parseObject(text);
+    return value?.jsonrpc === "2.0" && value.id === PROBE_REQUEST_ID;
+}
+function isInitializeResult(text) {
+    const value = parseObject(text);
+    return (value?.jsonrpc === "2.0" &&
+        value.id === PROBE_REQUEST_ID &&
+        typeof value.result === "object" &&
+        value.result !== null &&
+        !Array.isArray(value.result));
+}
+function parseObject(text) {
+    try {
+        const value = JSON.parse(text);
+        return typeof value === "object" && value !== null && !Array.isArray(value)
+            ? value
+            : undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+function decodeChunks(chunks, total) {
+    const bytes = new Uint8Array(total);
+    let offset = 0;
+    for (const chunk of chunks) {
+        bytes.set(chunk, offset);
+        offset += chunk.byteLength;
+    }
+    return new TextDecoder().decode(bytes);
+}
+function scrubTruncatedSecretSuffix(body, knownSecrets) {
+    let matchLength = 0;
+    for (const secret of knownSecrets.flatMap(knownSecretRepresentations)) {
+        for (let length = Math.min(secret.length, body.length); length > matchLength; length -= 1) {
+            if (body.endsWith(secret.slice(0, length))) {
+                matchLength = length;
+                break;
+            }
+        }
+    }
+    return matchLength === 0
+        ? body
+        : `${body.slice(0, -matchLength)}[redacted]`;
+}

package/dist/src/control-plane/sessions/pi/mcp/runtime.js

@@ -0,0 +1,13 @@
+import { RefreshCoordinator } from "../../../vaults/oauth-refresh.js";
+import { createGuardedMcpFetch } from "./fetch.js";
+/** Default production composition: one guarded fetch for MCP and OAuth refresh. */
+export function createDefaultMcpRuntime(store, fetch = createGuardedMcpFetch(), opts = {}) {
+    return {
+        fetch,
+        refreshCoordinator: new RefreshCoordinator({
+            store,
+            fetch,
+            ...(opts.onScheduled === undefined ? {} : { onScheduled: opts.onScheduled }),
+        }),
+    };
+}