webpeel 0.21.16 → 0.21.18

package/dist/cli/commands/fetch.js

@@ -148,6 +148,17 @@ export async function runFetch(url, options) {
         }
         process.exit(0);
     }
+    // --- #4b: Read URL from stdin (pipe mode) if no URL argument provided ---
+    if ((!url || url.trim() === '') && !process.stdin.isTTY) {
+        try {
+            const stdinData = await readStdin();
+            const stdinUrl = stdinData.trim().split('\n')[0].trim();
+            if (stdinUrl && (stdinUrl.startsWith('http://') || stdinUrl.startsWith('https://'))) {
+                url = stdinUrl;
+            }
+        }
+        catch { /* ignore stdin read errors */ }
+    }
     // --- #5: Concise error for missing URL (no help dump) ---
     if (!url || url.trim() === '') {
         if (isJson) {

package/dist/core/structured-extract.js

@@ -158,6 +158,13 @@ function heuristicExtractString(fieldName, content, pageUrl) {
         if (pageUrl)
             return pageUrl;
     }
+    // Creator / designer / founder / inventor
+    if (/creator|designer|founder|inventor|invented_by|created_by/.test(lf)) {
+        const m = content.match(/(?:created?|designed?|founded?|invented?)\s+by\s+([A-Z][^\n,·|–—]+?)(?:\s*[,·|–—]|\s+in\s+\d{4}|\.)/i)
+            ?? content.match(/(?:creator|designer|founder|inventor)[:\s]+([A-Z][^\n,·|]+?)(?:\s*[,·|–—]|\.)/i);
+        if (m?.[1])
+            return m[1].replace(/[*_`[\]]/g, '').trim().slice(0, 80);
+    }
     // Director (for movies/films)
     if (/director/.test(lf)) {
         const m = content.match(/Director[:\s*]+([^\n|,]+)/i) ?? content.match(/Directed by[:\s]+([^\n|,]+)/i);
@@ -312,12 +319,23 @@ function heuristicExtractNumber(fieldName, content) {
     }
     // Year
     if (/year/.test(lf)) {
-        // Match 4-digit years (1900-2099), prefer explicit "Year: YYYY" pattern first
+        // Explicit "Year: YYYY" label first
         const explicit = content.match(/\bYear[:\s]+(\d{4})\b/i);
         if (explicit?.[1]) {
             const n = parseInt(explicit[1]);
             return isNaN(n) ? null : n;
         }
+        // For "created_year" / "founded_year" / "released_year" — look for context
+        if (/creat|found|release|launch|start|born|inception/.test(lf)) {
+            const ctxMatch = content.match(/(?:created?|founded?|released?|launched?|started?|born|inception)[^\d]*(\b(?:19|20)\d{2}\b)/i)
+                ?? content.match(/\b(?:in|year)\s+(\b(?:19|20)\d{2}\b)/i)
+                ?? content.match(/(\b(?:19|20)\d{2}\b)/);
+            if (ctxMatch?.[1]) {
+                const n = parseInt(ctxMatch[1]);
+                return isNaN(n) ? null : n;
+            }
+        }
+        // Fallback: first year found
         const m = content.match(/\b((?:19|20)\d{2})\b/);
         if (m?.[1]) {
             const n = parseInt(m[1]);

package/dist/server/app.js

@@ -155,8 +155,11 @@ export function createApp(config = {}) {
                 return callback(null, true);
             if (corsOrigins.includes(origin))
                 return callback(null, origin);
-            // Unknown origins: allow (API key clients need cross-origin access) but no credentials
-            return callback(null, true);
+            // Unknown origins: allow (API key clients need cross-origin access) but no credentials.
+            // SECURITY: Return '*' instead of reflecting the origin — wildcard is incompatible with
+            // credentials (browsers reject Allow-Credentials + *), prevents origin-specific CORS caching,
+            // and avoids security-scanner false positives from reflected origins.
+            return callback(null, '*');
         },
         // credentials: set conditionally via post-cors middleware below
         credentials: false,

package/dist/server/auth-store.d.ts

@@ -4,7 +4,7 @@
  */
 export interface ApiKeyInfo {
     key: string;
-    tier: 'free' | 'starter' | 'pro' | 'enterprise' | 'max';
+    tier: 'free' | 'starter' | 'pro' | 'enterprise' | 'max' | 'admin';
     rateLimit: number;
     accountId?: string;
     createdAt: Date;

package/dist/server/middleware/auth.js

@@ -127,8 +127,8 @@ export function createAuthMiddleware(authStore) {
                     }
                     return;
                 }
-                // Check limits (only for PostgresAuthStore)
-                if (authStore instanceof PostgresAuthStore) {
+                // Check limits (only for PostgresAuthStore, skip for admin tier)
+                if (authStore instanceof PostgresAuthStore && keyInfo?.tier !== 'admin') {
                     // HARD LIMIT: Check burst limit first (per-hour cap)
                     const { allowed: burstAllowed, burst } = await authStore.checkBurstLimit(apiKey);
                     if (!burstAllowed) {

package/dist/server/middleware/url-validator.js

@@ -25,6 +25,21 @@ export function validateUrlForSSRF(urlString) {
     if (localhostPatterns.some(pattern => hostname === pattern || hostname.endsWith('.' + pattern))) {
         throw new SSRFError('Cannot fetch localhost, private networks, or non-HTTP URLs');
     }
+    // SECURITY: Block well-known cloud metadata service hostnames.
+    // These hostnames resolve to link-local IPs (169.254.x.x) which are blocked
+    // by IP, but hostname-level blocking provides defense-in-depth against DNS
+    // rebinding attacks where a domain transiently resolves to a valid IP during
+    // validation, then resolves to a private IP for the actual fetch.
+    const metadataHostnames = [
+        'metadata.google.internal', // GCP: resolves to 169.254.169.254
+        'metadata.goog', // GCP alternate
+        'metadata.internal', // Generic internal
+        'instance-data.ec2.internal', // AWS alternate
+        'computeMetadata', // Partial GCP hostname
+    ];
+    if (metadataHostnames.some(m => hostname === m || hostname.endsWith('.' + m))) {
+        throw new SSRFError('Cannot fetch localhost, private networks, or non-HTTP URLs');
+    }
     // Parse and validate IP addresses
     const ipv4Info = parseIPv4(hostname);
     if (ipv4Info) {

package/dist/server/routes/stripe.js

@@ -14,6 +14,8 @@ const TIER_LIMITS = {
     free: { weekly_limit: 500, burst_limit: 50, rate_limit: 10 },
     pro: { weekly_limit: 1250, burst_limit: 100, rate_limit: 60 },
     max: { weekly_limit: 6250, burst_limit: 500, rate_limit: 200 },
+    admin: { weekly_limit: 100000, burst_limit: 10000, rate_limit: 1000 },
+    enterprise: { weekly_limit: 50000, burst_limit: 2000, rate_limit: 500 },
 };
 /**
  * Create Stripe Billing Portal router

package/llms.txt

@@ -39,7 +39,7 @@ webpeel mcp                      Start MCP server
 - Quick answers: Ask questions about any page (no LLM needed)
 - Anti-bot handling: Stealth mode, proxy rotation, graceful degradation
 - Format options: markdown, text, html, clean (AI-optimized)
-- MCP server: 18 tools for AI agent integration
+- MCP server: 7 tools for AI agent integration
 - Site search: Search eBay, Amazon, GitHub, and 20+ sites with structured output
 
 ## Formats

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "webpeel",
-  "version": "0.21.16",
+  "version": "0.21.18",
   "description": "Fast web fetcher for AI agents - stealth mode, crawl mode, page actions, structured extraction, PDF parsing, smart escalation from simple HTTP to headless browser",
   "author": "Jake Liu",
   "license": "AGPL-3.0-only",