wolfpack-mcp 1.0.78 → 1.0.79

package/dist/apiClient.js

@@ -1,4 +1,4 @@
-import fetch from 'node-fetch';
+import { fetch } from './proxyFetch.js';
 import { config } from './config.js';
 export class ApiError extends Error {
     status;

package/dist/index.js

@@ -13,6 +13,7 @@ import { AGENT_BUILDER_TOOLS, handleAgentBuilderTool } from './agentBuilderTools
 import { PROCEDURE_TOOLS, handleProcedureTool } from './procedureTools.js';
 import { AGENT_SELF_TOOLS, handleAgentSelfTool } from './agentSelfTools.js';
 import { resolveRadarItemId } from './resolveRadarItemId.js';
+import { fetch as proxyFetch } from './proxyFetch.js';
 // Get current package version
 const require = createRequire(import.meta.url);
 const packageJson = require('../package.json');
@@ -21,7 +22,10 @@ const PACKAGE_NAME = packageJson.name;
 // Check for updates from npm registry
 async function checkForUpdates() {
     try {
-        const response = await fetch(`https://registry.npmjs.org/${PACKAGE_NAME}/latest`, {
+        // proxyFetch, not global fetch: in a restricted container the registry is
+        // only reachable through the proxy, and a direct attempt just stalls until
+        // the timeout on every start (#1793).
+        const response = await proxyFetch(`https://registry.npmjs.org/${PACKAGE_NAME}/latest`, {
             headers: { Accept: 'application/json' },
             signal: AbortSignal.timeout(5000), // 5 second timeout
         });

package/dist/proxyFetch.js

@@ -0,0 +1,61 @@
+import nodeFetch from 'node-fetch';
+import { HttpProxyAgent } from 'http-proxy-agent';
+import { HttpsProxyAgent } from 'https-proxy-agent';
+/**
+ * Whether a host is exempted from proxying by NO_PROXY. Entries match the host
+ * exactly or as a domain suffix (`.example.com`, or bare `example.com` for its
+ * subdomains); `*` exempts everything.
+ */
+export function bypassesProxy(hostname, noProxy) {
+    if (!noProxy)
+        return false;
+    const host = hostname.toLowerCase();
+    return noProxy
+        .split(',')
+        .map((entry) => entry.trim().toLowerCase())
+        .filter(Boolean)
+        .some((entry) => {
+        if (entry === '*')
+            return true;
+        const suffix = entry.startsWith('.') ? entry : `.${entry}`;
+        return host === entry.replace(/^\./, '') || host.endsWith(suffix);
+    });
+}
+/** The proxy URL that applies to a target, or null to connect directly. */
+export function proxyForUrl(target, env = process.env) {
+    if (bypassesProxy(target.hostname, env.NO_PROXY ?? env.no_proxy))
+        return null;
+    const proxy = target.protocol === 'https:'
+        ? (env.HTTPS_PROXY ?? env.https_proxy ?? env.HTTP_PROXY ?? env.http_proxy)
+        : (env.HTTP_PROXY ?? env.http_proxy);
+    return proxy || null;
+}
+const agents = new Map();
+function agentFor(target) {
+    const proxy = proxyForUrl(target);
+    if (!proxy)
+        return undefined;
+    const key = `${target.protocol}${proxy}`;
+    let agent = agents.get(key);
+    if (!agent) {
+        agent = target.protocol === 'https:' ? new HttpsProxyAgent(proxy) : new HttpProxyAgent(proxy);
+        agents.set(key, agent);
+    }
+    return agent;
+}
+/**
+ * `node-fetch` with the proxy from the environment applied.
+ *
+ * node-fetch does not read HTTP_PROXY/HTTPS_PROXY on its own, so inside a
+ * restricted agent container this client connected direct to the backend —
+ * which has no route out and no DNS, the container's only permitted egress
+ * being the Squid proxy (#1793). Agents are cached per origin, and requests
+ * are unaffected when no proxy variables are set.
+ */
+export function fetch(url, init = {}) {
+    if (init.agent !== undefined)
+        return nodeFetch(url, init);
+    const target = new URL(typeof url === 'string' ? url : url.url);
+    return nodeFetch(url, { ...init, agent: agentFor(target) });
+}
+export default fetch;

package/dist/proxyFetch.test.js

@@ -0,0 +1,67 @@
+import { afterEach, beforeEach, describe, expect, it } from 'vitest';
+import { createServer } from 'node:http';
+import { once } from 'node:events';
+import { bypassesProxy, fetch, proxyForUrl } from './proxyFetch.js';
+const port = (server) => server.address().port;
+describe('bypassesProxy', () => {
+    it('exempts an exact host and its subdomains, on a dot boundary only', () => {
+        expect(bypassesProxy('localhost', 'localhost,127.0.0.1')).toBe(true);
+        expect(bypassesProxy('api.example.com', '.example.com')).toBe(true);
+        expect(bypassesProxy('example.com', 'example.com')).toBe(true);
+        expect(bypassesProxy('notexample.com', 'example.com')).toBe(false);
+        expect(bypassesProxy('wolfpacks.work', 'localhost,127.0.0.1')).toBe(false);
+    });
+    it('treats * as exempting everything, and no NO_PROXY as exempting nothing', () => {
+        expect(bypassesProxy('wolfpacks.work', '*')).toBe(true);
+        expect(bypassesProxy('wolfpacks.work', undefined)).toBe(false);
+    });
+});
+describe('proxyForUrl', () => {
+    it('prefers HTTPS_PROXY for https and falls back to HTTP_PROXY', () => {
+        const env = { HTTPS_PROXY: 'http://s:1', HTTP_PROXY: 'http://p:2' };
+        expect(proxyForUrl(new URL('https://wolfpacks.work/api'), env)).toBe('http://s:1');
+        expect(proxyForUrl(new URL('http://wolfpacks.work/api'), env)).toBe('http://p:2');
+        expect(proxyForUrl(new URL('https://wolfpacks.work/api'), { HTTP_PROXY: 'http://p:2' })).toBe('http://p:2');
+    });
+    it('returns null for a NO_PROXY host and when no proxy is configured', () => {
+        expect(proxyForUrl(new URL('http://localhost:3001/api'), {
+            NO_PROXY: 'localhost',
+            HTTP_PROXY: 'http://p:1',
+        })).toBeNull();
+        expect(proxyForUrl(new URL('https://wolfpacks.work/api'), {})).toBeNull();
+    });
+});
+describe('fetch', () => {
+    let proxy;
+    let seen;
+    beforeEach(async () => {
+        seen = [];
+        proxy = createServer((req, res) => {
+            seen.push(req.url ?? '');
+            res.writeHead(200, { 'content-type': 'application/json' });
+            res.end('{"proxied":true}');
+        });
+        proxy.listen(0);
+        await once(proxy, 'listening');
+    });
+    afterEach(() => {
+        proxy.close();
+        delete process.env.HTTP_PROXY;
+        delete process.env.NO_PROXY;
+    });
+    // Regression test for #1793: node-fetch does not read the proxy variables,
+    // so inside a restricted container this client connected direct to a backend
+    // it had neither a route to nor DNS for.
+    it('sends the request to the proxy, for a host it cannot itself resolve', async () => {
+        process.env.HTTP_PROXY = `http://127.0.0.1:${port(proxy)}`;
+        const res = await fetch('http://nowhere.invalid/api/mcp/work-items');
+        expect(res.status).toBe(200);
+        expect(seen).toEqual(['http://nowhere.invalid/api/mcp/work-items']);
+    });
+    it('connects direct when no proxy is configured', async () => {
+        const res = await fetch(`http://127.0.0.1:${port(proxy)}/direct`);
+        expect(res.status).toBe(200);
+        // Reached the server as an origin request, not as a proxy request
+        expect(seen).toEqual(['/direct']);
+    });
+});

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "wolfpack-mcp",
-  "version": "1.0.78",
+  "version": "1.0.79",
   "description": "MCP server for Wolfpack AI-enhanced software delivery tools",
   "main": "dist/index.js",
   "type": "module",
@@ -35,6 +35,8 @@
   },
   "dependencies": {
     "@modelcontextprotocol/sdk": "^1.26.0",
+    "http-proxy-agent": "^7.0.2",
+    "https-proxy-agent": "^7.0.6",
     "node-fetch": "^3.3.2",
     "yaml": "^2.8.0",
     "zod": "^3.24.1"