sliccy 6.96.4 → 6.96.6

package/dist/node-server/bridge-security.js

@@ -111,6 +111,12 @@ const CORS_BASE_ALLOW_HEADERS = [
  * (`isProxyError` reads `X-Proxy-Error`) and the forbidden-response
  * bridge (`decodeForbiddenResponseHeaders` reads `X-Proxy-Set-Cookie`). MCP
  * clients also read protocol negotiation/session headers from proxy responses.
+ *
+ * `/api/fetch-proxy` overrides this per-response with the union of this base
+ * set and every forwarded upstream header name (see
+ * `buildFetchProxyExposeHeaders`) so agents can inspect non-CORS-safelisted
+ * headers such as Content-Security-Policy. Other `/api/*` routes keep this
+ * static list.
  */
 const CORS_EXPOSE_HEADERS = 'Link, X-Proxy-Error, X-Proxy-Set-Cookie, X-Proxy-Content-Length, Mcp-Session-Id, MCP-Protocol-Version';
 /**

package/dist/node-server/fetch-proxy-headers.d.ts

@@ -42,11 +42,27 @@ export declare const FETCH_PROXY_SKIP_RESPONSE_HEADERS: ReadonlySet<string>;
  * middleware remains the sole CORS authority. `x-proxy-` is the proxy's
  * own response-marker namespace — never echo an upstream value.
  */
+export declare const FETCH_PROXY_SKIP_RESPONSE_PREFIXES: readonly string[];
 /**
  * Proxy-set response header carrying the upstream `content-length` when it is
  * exact (identity encoding). Read by the webapp's `proxied-fetch.ts` to drive
  * determinate download progress; never copied from upstream (the `x-proxy-`
- * prefix below guarantees that).
+ * prefix above guarantees that).
  */
 export declare const FETCH_PROXY_CONTENT_LENGTH_HEADER = "X-Proxy-Content-Length";
-export declare const FETCH_PROXY_SKIP_RESPONSE_PREFIXES: readonly string[];
+/**
+ * Response headers the browser must always be allowed to read on the
+ * `/api/fetch-proxy` hop, even when the upstream response carries none of
+ * them. Kept in sync with `CORS_EXPOSE_HEADERS` in `bridge-security.ts` and
+ * `BridgeSecurity.corsExposeHeaders` in the Swift server. The route appends
+ * every forwarded upstream header name on top of this base so agents can
+ * inspect CSP / HSTS / ETag / etc. — browsers only surface non-CORS-safelisted
+ * response headers when they appear here (credentials mode forbids `*`).
+ */
+export declare const FETCH_PROXY_BASE_EXPOSE_HEADERS: readonly string[];
+/**
+ * Build the `Access-Control-Expose-Headers` value for a proxied response:
+ * the static proxy markers plus every header name we actually forwarded.
+ * Dedupes case-insensitively while preserving the first-seen spelling.
+ */
+export declare function buildFetchProxyExposeHeaders(forwardedHeaderNames: Iterable<string>): string;

package/dist/node-server/fetch-proxy-headers.js

@@ -65,14 +65,49 @@ export const FETCH_PROXY_SKIP_RESPONSE_HEADERS = new Set([
  * middleware remains the sole CORS authority. `x-proxy-` is the proxy's
  * own response-marker namespace — never echo an upstream value.
  */
+export const FETCH_PROXY_SKIP_RESPONSE_PREFIXES = [
+    'access-control-',
+    'x-proxy-',
+];
 /**
  * Proxy-set response header carrying the upstream `content-length` when it is
  * exact (identity encoding). Read by the webapp's `proxied-fetch.ts` to drive
  * determinate download progress; never copied from upstream (the `x-proxy-`
- * prefix below guarantees that).
+ * prefix above guarantees that).
  */
 export const FETCH_PROXY_CONTENT_LENGTH_HEADER = 'X-Proxy-Content-Length';
-export const FETCH_PROXY_SKIP_RESPONSE_PREFIXES = [
-    'access-control-',
-    'x-proxy-',
+/**
+ * Response headers the browser must always be allowed to read on the
+ * `/api/fetch-proxy` hop, even when the upstream response carries none of
+ * them. Kept in sync with `CORS_EXPOSE_HEADERS` in `bridge-security.ts` and
+ * `BridgeSecurity.corsExposeHeaders` in the Swift server. The route appends
+ * every forwarded upstream header name on top of this base so agents can
+ * inspect CSP / HSTS / ETag / etc. — browsers only surface non-CORS-safelisted
+ * response headers when they appear here (credentials mode forbids `*`).
+ */
+export const FETCH_PROXY_BASE_EXPOSE_HEADERS = [
+    'Link',
+    'X-Proxy-Error',
+    'X-Proxy-Set-Cookie',
+    FETCH_PROXY_CONTENT_LENGTH_HEADER,
+    'Mcp-Session-Id',
+    'MCP-Protocol-Version',
+    'Cache-Control',
 ];
+/**
+ * Build the `Access-Control-Expose-Headers` value for a proxied response:
+ * the static proxy markers plus every header name we actually forwarded.
+ * Dedupes case-insensitively while preserving the first-seen spelling.
+ */
+export function buildFetchProxyExposeHeaders(forwardedHeaderNames) {
+    const seen = new Set();
+    const out = [];
+    for (const name of [...FETCH_PROXY_BASE_EXPOSE_HEADERS, ...forwardedHeaderNames]) {
+        const lower = name.toLowerCase();
+        if (seen.has(lower))
+            continue;
+        seen.add(lower);
+        out.push(name);
+    }
+    return out.join(', ');
+}

package/dist/node-server/routes/fetch-proxy.js

@@ -1,7 +1,7 @@
 import { Readable, Transform } from 'node:stream';
 import { StringDecoder } from 'node:string_decoder';
 import { HMAC_SIGN_HEADER, isLoopbackOrigin, isTextContentType } from '../_shared/index.js';
-import { FETCH_PROXY_CONTENT_LENGTH_HEADER, FETCH_PROXY_SKIP_HEADERS, FETCH_PROXY_SKIP_RESPONSE_HEADERS, FETCH_PROXY_SKIP_RESPONSE_PREFIXES, } from '../fetch-proxy-headers.js';
+import { buildFetchProxyExposeHeaders, FETCH_PROXY_CONTENT_LENGTH_HEADER, FETCH_PROXY_SKIP_HEADERS, FETCH_PROXY_SKIP_RESPONSE_HEADERS, FETCH_PROXY_SKIP_RESPONSE_PREFIXES, } from '../fetch-proxy-headers.js';
 import { AgentActivityTracker, registerAgentActivityRoute } from './agent-activity.js';
 /** Pick the first value of a possibly-multi-valued request header. */
 function firstHeaderValue(value) {
@@ -141,10 +141,17 @@ function unmaskRequestBody(secretProxy, headers, rawBody, targetHostname) {
  * middleware remains the sole authority on the browser→bridge hop —
  * see `FETCH_PROXY_SKIP_RESPONSE_HEADERS` / `..._PREFIXES`. All header
  * values are secret-scrubbed.
+ *
+ * After forwarding, set `Access-Control-Expose-Headers` to the union of the
+ * proxy markers and every forwarded header name. Cross-origin thin-bridge
+ * callers (sliccy.ai → localhost) run under credentials mode, so the
+ * browser otherwise only surfaces CORS-safelisted headers and agents
+ * silently miss CSP / HSTS / X-Frame-Options / ETag / etc.
  */
 function forwardUpstreamHeaders(res, upstream, secretProxy) {
     res.status(upstream.status);
     res.setHeader('Cache-Control', 'no-store, no-cache');
+    const forwardedNames = [];
     const setCookieValues = upstream.headers.getSetCookie();
     upstream.headers.forEach((v, k) => {
         const lower = k.toLowerCase();
@@ -154,6 +161,7 @@ function forwardUpstreamHeaders(res, upstream, secretProxy) {
             return;
         // Headers are small — one-shot scrub, no per-chunk semantics.
         res.setHeader(k, secretProxy.scrubResponse(v));
+        forwardedNames.push(k);
     });
     if (setCookieValues.length > 0) {
         res.setHeader('X-Proxy-Set-Cookie', secretProxy.scrubResponse(JSON.stringify(setCookieValues)));
@@ -175,6 +183,9 @@ function forwardUpstreamHeaders(res, upstream, secretProxy) {
     if (upstreamLength && !upstream.headers.get('content-encoding') && /^\d+$/.test(upstreamLength)) {
         res.setHeader(FETCH_PROXY_CONTENT_LENGTH_HEADER, upstreamLength);
     }
+    // Override the thin-bridge middleware's static expose list with the
+    // full set for this response. Credentials mode forbids `*`.
+    res.setHeader('Access-Control-Expose-Headers', buildFetchProxyExposeHeaders(forwardedNames));
 }
 /**
  * Buffer-aware UTF-8 secret scrubber. A `StringDecoder` keeps trailing partial