skillwiki 0.10.111 → 0.10.113

package/dist/{chunk-I6IRJCUJ.js → chunk-3TKNAOJH.js}

@@ -3,14 +3,14 @@ import {
   extractFrontmatter,
   scanSensitiveContent,
   scanVault
-} from "./chunk-X5GL2FCU.js";
+} from "./chunk-JL2SCLXT.js";
 import {
   MetaSchema,
   TypedKnowledgeSchema,
   detectSchema,
   err,
   ok
-} from "./chunk-UIEQIJXP.js";
+} from "./chunk-VNSZCK5V.js";
 
 // src/utils/index-universe.ts
 import { readFile } from "fs/promises";

package/dist/chunk-5D5HFQ76.js

@@ -0,0 +1,111 @@
+#!/usr/bin/env node
+import {
+  ExitCode,
+  err,
+  ipv4InCidr,
+  isBlockedHost,
+  ok
+} from "./chunk-VNSZCK5V.js";
+
+// src/commands/fetch-guard.ts
+var REDACT_PARAMS = /* @__PURE__ */ new Set(["api_key", "token", "key", "auth", "password", "secret", "access_token"]);
+var PATH_TOKEN_RE = /[A-Fa-f0-9]{32,}|[A-Za-z0-9_\-]{40,}/g;
+function runFetchGuard(input) {
+  return Promise.resolve(runFetchGuardSync(input));
+}
+function runFetchGuardSync(input) {
+  let u;
+  try {
+    u = new URL(input.url);
+  } catch {
+    return { exitCode: ExitCode.MALFORMED_URL, result: err("MALFORMED_URL", { url: input.url }) };
+  }
+  const sanitized = sanitizeUrl(u);
+  if (u.protocol !== "https:") {
+    return {
+      exitCode: ExitCode.SCHEME_REJECTED,
+      result: err("SCHEME_REJECTED", { sanitized_url: sanitized, scheme: u.protocol })
+    };
+  }
+  if (isBlockedHost(u.hostname)) {
+    return {
+      exitCode: ExitCode.HOST_BLOCKED,
+      result: err("HOST_BLOCKED", { sanitized_url: sanitized, host: u.hostname })
+    };
+  }
+  return { exitCode: ExitCode.OK, result: ok({ allowed: true, sanitized_url: sanitized, humanHint: `ALLOWED: ${sanitized}` }) };
+}
+function sanitizeUrl(u) {
+  const clone = new URL(u.toString());
+  if (clone.username || clone.password) {
+    clone.username = "";
+    clone.password = "";
+  }
+  for (const k of Array.from(clone.searchParams.keys())) {
+    if (REDACT_PARAMS.has(k.toLowerCase())) clone.searchParams.set(k, "REDACTED");
+  }
+  let s = clone.toString();
+  s = s.replace(PATH_TOKEN_RE, "REDACTED");
+  return s;
+}
+
+// src/clip-outbox/ssrf.ts
+import { isIP } from "net";
+import { lookup as dnsLookup } from "dns/promises";
+var extraBlockedV4 = [
+  ["0.0.0.0", 8],
+  ["100.64.0.0", 10],
+  ["192.0.2.0", 24],
+  ["198.18.0.0", 15],
+  ["198.51.100.0", 24],
+  ["203.0.113.0", 24],
+  ["224.0.0.0", 4],
+  ["240.0.0.0", 4]
+];
+function isBlockedAddress(address) {
+  if (isBlockedHost(address)) return true;
+  const version = isIP(address);
+  if (version === 4) {
+    return extraBlockedV4.some(([base, prefix]) => ipv4InCidr(address, base, prefix));
+  }
+  if (version === 6) {
+    const lower = address.toLowerCase();
+    return lower === "::" || lower === "::1" || lower.startsWith("fc") || lower.startsWith("fd") || lower.startsWith("fe80:");
+  }
+  return false;
+}
+async function assertPublicHttpsUrl(url, lookup = defaultLookup) {
+  const guard = runFetchGuardSync({ url });
+  if (!guard.result.ok) {
+    return { ok: false, reason: guard.result.error };
+  }
+  let parsed;
+  try {
+    parsed = new URL(url);
+  } catch {
+    return { ok: false, reason: "MALFORMED_URL" };
+  }
+  if (isBlockedAddress(parsed.hostname)) {
+    return { ok: false, reason: "HOST_BLOCKED" };
+  }
+  try {
+    const addresses = await lookup(parsed.hostname);
+    if (addresses.length === 0) return { ok: false, reason: "DNS_EMPTY" };
+    if (addresses.some(isBlockedAddress)) return { ok: false, reason: "HOST_BLOCKED" };
+  } catch {
+    return { ok: false, reason: "DNS_FAILED" };
+  }
+  return { ok: true, href: parsed.href };
+}
+async function defaultLookup(hostname) {
+  if (isIP(hostname)) return [hostname];
+  const v4 = await dnsLookup(hostname, { all: true, verbatim: true });
+  return v4.map((row) => row.address);
+}
+
+export {
+  runFetchGuard,
+  runFetchGuardSync,
+  assertPublicHttpsUrl,
+  defaultLookup
+};