zidane 6.4.4 → 6.5.1

package/dist/origin-pinned-fetch-CqG8VZIq.js

@@ -0,0 +1,159 @@
+//#region src/mcp/origin-pinned-fetch.ts
+/**
+* `fetch` wrapper that refuses to carry configured headers across an origin
+* boundary.
+*
+* Why this exists
+* ---------------
+* Agent Plugins requires a client to "never forward configured headers to a
+* different origin". A plugin's `mcp.json` routinely puts a bearer token in
+* `headers`, and the platform `fetch` follows redirects internally WITH those
+* headers attached — so a server that answers `307` with
+* `Location: https://attacker.example/` receives the token verbatim. The
+* transport never sees the hop, so the check cannot live at the call site.
+*
+* The fix is to take redirect-following away from the platform: issue the
+* request with `redirect: 'manual'` and walk the chain ourselves, dropping
+* every configured header the instant a hop leaves the pinned origin.
+*
+* Scope
+* -----
+* The strip list is the configured header names PLUS `authorization`, which is
+* always included: the SDK's OAuth provider injects that header per request
+* rather than through `McpServerConfig.headers`, so a list derived only from
+* the config would miss the one credential most worth protecting. See
+* {@link originPinnedFetch} for why that case is the common one.
+*
+* The rest of the per-request plumbing (`content-type`, `accept`,
+* `mcp-session-id`, …) is not credential material and survives — stripping it
+* would break legitimate same-origin redirects for no security gain.
+*
+* A redirect to non-loopback cleartext is refused outright rather than
+* stripped: continuing the session over plain HTTP exposes the MCP traffic
+* itself, not just the token.
+*
+* Composes with {@link sseToJsonFetch}: pass that as `baseFetch` and this
+* wrapper handles each hop through it.
+*/
+/** Redirect statuses the fetch standard defines. */
+const REDIRECT_STATUSES = /* @__PURE__ */ new Set([
+	301,
+	302,
+	303,
+	307,
+	308
+]);
+/**
+* Hosts whose plaintext HTTP is acceptable. Everything else must be HTTPS —
+* a bearer token in cleartext is published to the local network.
+*
+* Lives here rather than in the Agent Plugins loader because both the
+* load-time URL check and the per-hop redirect check need it, and they sit on
+* opposite sides of that boundary.
+*/
+const LOOPBACK_HOSTS = /* @__PURE__ */ new Set([
+	"localhost",
+	"127.0.0.1",
+	"[::1]",
+	"::1"
+]);
+/** True when cleartext HTTP to this hostname stays on the machine. */
+function isLoopbackHost(hostname) {
+	return LOOPBACK_HOSTS.has(hostname);
+}
+/**
+* The transport-reachability rule for a remote MCP endpoint: HTTPS anywhere,
+* plaintext HTTP only when it stays on the machine, nothing else.
+*
+* THE single encoding of that policy. It's enforced at two points on opposite
+* sides of the plugin boundary — once when validating a plugin's `mcp.json`
+* (`plugins/mcp.ts`), and again per redirect hop inside
+* {@link originPinnedFetch} — and those two must never disagree. If they did,
+* a URL the loader refused could still be reached by redirect, which is the
+* exact hole the pinning exists to close. Relaxing the rule (private ranges,
+* `*.localhost`, …) is then a one-line change that both sites inherit.
+*
+* Scheme and host only. Authoring rules that apply to a CONFIGURED url but
+* have no meaning for a redirect target — no userinfo, no fragment — stay with
+* the loader.
+*/
+function isAllowedRemoteUrl(url) {
+	if (url.protocol === "https:") return true;
+	return url.protocol === "http:" && isLoopbackHost(url.hostname);
+}
+/**
+* Cap on hops. The platform default is 20; MCP endpoints legitimately
+* redirect once or twice (http→https, path canonicalization, load-balancer
+* hand-off), so 5 is generous while bounding a redirect loop.
+*/
+const MAX_REDIRECTS = 5;
+/**
+* Wrap `baseFetch` so `headerNames` are dropped on any hop that leaves the
+* origin of `configuredUrl`, and so a redirect cannot downgrade the session
+* to cleartext.
+*
+* `authorization` is ALWAYS protected, whether or not the caller listed it.
+* The MCP SDK's OAuth provider injects that header per request rather than
+* through `McpServerConfig.headers` — `bootstrapServer` attaches a provider to
+* a flagless server whenever stored tokens exist — so a strip list derived
+* only from the configured header names would leave the bearer token exposed
+* on exactly the servers that have one.
+*/
+function originPinnedFetch(configuredUrl, headerNames, baseFetch = fetch) {
+	let pinnedOrigin;
+	try {
+		pinnedOrigin = new URL(configuredUrl).origin;
+	} catch {
+		return baseFetch;
+	}
+	const protected_ = [.../* @__PURE__ */ new Set(["authorization", ...headerNames.map((name) => name.toLowerCase())])];
+	return async function originPinnedWrappedFetch(input, init) {
+		let url = new URL(input.toString());
+		let currentInit = {
+			...init,
+			redirect: "manual"
+		};
+		let stripped = false;
+		for (let hop = 0; hop <= MAX_REDIRECTS; hop++) {
+			const response = await baseFetch(url, currentInit);
+			if (!REDIRECT_STATUSES.has(response.status)) return response;
+			const location = response.headers.get("location");
+			if (!location) return response;
+			let next;
+			try {
+				next = new URL(location, url);
+			} catch {
+				return response;
+			}
+			if (!isAllowedRemoteUrl(next)) throw new Error(`Refusing redirect from ${url.origin} to ${next.protocol}//${next.host || next.pathname}`);
+			if (next.origin !== pinnedOrigin && !stripped) {
+				currentInit = {
+					...currentInit,
+					headers: withoutHeaders(currentInit.headers, protected_)
+				};
+				stripped = true;
+			}
+			const method = (currentInit.method ?? "GET").toString().toUpperCase();
+			if (response.status === 303 || (response.status === 301 || response.status === 302) && method === "POST") currentInit = {
+				...currentInit,
+				method: "GET",
+				body: void 0
+			};
+			url = next;
+		}
+		throw new Error(`Too many redirects (>${MAX_REDIRECTS}) following ${configuredUrl}`);
+	};
+}
+/**
+* Copy a `HeadersInit` minus the named headers. Handles all three
+* `HeadersInit` shapes the SDK may hand us (Headers, tuple array, record).
+*/
+function withoutHeaders(source, remove) {
+	const headers = new Headers(source);
+	for (const name of remove) headers.delete(name);
+	return headers;
+}
+//#endregion
+export { originPinnedFetch as n, isAllowedRemoteUrl as t };
+
+//# sourceMappingURL=origin-pinned-fetch-CqG8VZIq.js.map

package/dist/origin-pinned-fetch-CqG8VZIq.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"origin-pinned-fetch-CqG8VZIq.js","names":[],"sources":["../src/mcp/origin-pinned-fetch.ts"],"sourcesContent":["/**\n * `fetch` wrapper that refuses to carry configured headers across an origin\n * boundary.\n *\n * Why this exists\n * ---------------\n * Agent Plugins requires a client to \"never forward configured headers to a\n * different origin\". A plugin's `mcp.json` routinely puts a bearer token in\n * `headers`, and the platform `fetch` follows redirects internally WITH those\n * headers attached — so a server that answers `307` with\n * `Location: https://attacker.example/` receives the token verbatim. The\n * transport never sees the hop, so the check cannot live at the call site.\n *\n * The fix is to take redirect-following away from the platform: issue the\n * request with `redirect: 'manual'` and walk the chain ourselves, dropping\n * every configured header the instant a hop leaves the pinned origin.\n *\n * Scope\n * -----\n * The strip list is the configured header names PLUS `authorization`, which is\n * always included: the SDK's OAuth provider injects that header per request\n * rather than through `McpServerConfig.headers`, so a list derived only from\n * the config would miss the one credential most worth protecting. See\n * {@link originPinnedFetch} for why that case is the common one.\n *\n * The rest of the per-request plumbing (`content-type`, `accept`,\n * `mcp-session-id`, …) is not credential material and survives — stripping it\n * would break legitimate same-origin redirects for no security gain.\n *\n * A redirect to non-loopback cleartext is refused outright rather than\n * stripped: continuing the session over plain HTTP exposes the MCP traffic\n * itself, not just the token.\n *\n * Composes with {@link sseToJsonFetch}: pass that as `baseFetch` and this\n * wrapper handles each hop through it.\n */\n\n/** Redirect statuses the fetch standard defines. */\nconst REDIRECT_STATUSES = new Set([301, 302, 303, 307, 308])\n\n/**\n * Hosts whose plaintext HTTP is acceptable. Everything else must be HTTPS —\n * a bearer token in cleartext is published to the local network.\n *\n * Lives here rather than in the Agent Plugins loader because both the\n * load-time URL check and the per-hop redirect check need it, and they sit on\n * opposite sides of that boundary.\n */\nconst LOOPBACK_HOSTS = new Set(['localhost', '127.0.0.1', '[::1]', '::1'])\n\n/** True when cleartext HTTP to this hostname stays on the machine. */\nexport function isLoopbackHost(hostname: string): boolean {\n  return LOOPBACK_HOSTS.has(hostname)\n}\n\n/**\n * The transport-reachability rule for a remote MCP endpoint: HTTPS anywhere,\n * plaintext HTTP only when it stays on the machine, nothing else.\n *\n * THE single encoding of that policy. It's enforced at two points on opposite\n * sides of the plugin boundary — once when validating a plugin's `mcp.json`\n * (`plugins/mcp.ts`), and again per redirect hop inside\n * {@link originPinnedFetch} — and those two must never disagree. If they did,\n * a URL the loader refused could still be reached by redirect, which is the\n * exact hole the pinning exists to close. Relaxing the rule (private ranges,\n * `*.localhost`, …) is then a one-line change that both sites inherit.\n *\n * Scheme and host only. Authoring rules that apply to a CONFIGURED url but\n * have no meaning for a redirect target — no userinfo, no fragment — stay with\n * the loader.\n */\nexport function isAllowedRemoteUrl(url: URL): boolean {\n  if (url.protocol === 'https:')\n    return true\n  return url.protocol === 'http:' && isLoopbackHost(url.hostname)\n}\n\n/**\n * Cap on hops. The platform default is 20; MCP endpoints legitimately\n * redirect once or twice (http→https, path canonicalization, load-balancer\n * hand-off), so 5 is generous while bounding a redirect loop.\n */\nconst MAX_REDIRECTS = 5\n\n/**\n * The fetch shape this wrapper supports — deliberately narrower than\n * `typeof fetch`, matching the MCP SDK's `FetchLike`.\n *\n * A `Request` input is NOT accepted: the wrapper rebuilds each hop from\n * `init`, so it would silently drop a Request's method, headers and body and\n * issue a bare credential-less GET. Narrowing the type makes that shape\n * unrepresentable rather than a quiet failure on a security-relevant helper.\n * Both SDK transports only ever pass a URL plus init.\n */\nexport type PinnedFetch = (url: string | URL, init?: RequestInit) => Promise<Response>\n\n/**\n * Wrap `baseFetch` so `headerNames` are dropped on any hop that leaves the\n * origin of `configuredUrl`, and so a redirect cannot downgrade the session\n * to cleartext.\n *\n * `authorization` is ALWAYS protected, whether or not the caller listed it.\n * The MCP SDK's OAuth provider injects that header per request rather than\n * through `McpServerConfig.headers` — `bootstrapServer` attaches a provider to\n * a flagless server whenever stored tokens exist — so a strip list derived\n * only from the configured header names would leave the bearer token exposed\n * on exactly the servers that have one.\n */\nexport function originPinnedFetch(\n  configuredUrl: string,\n  headerNames: readonly string[],\n  baseFetch: PinnedFetch = fetch,\n): PinnedFetch {\n  let pinnedOrigin: string\n  try {\n    pinnedOrigin = new URL(configuredUrl).origin\n  }\n  catch {\n    // An unparseable URL fails at the transport anyway; don't mask that\n    // error with one of ours.\n    return baseFetch\n  }\n\n  // Lowercased for case-insensitive header matching (HTTP header names are\n  // case-insensitive; `Headers.delete` already normalizes, but the manual\n  // record path below does not). `authorization` is unconditional — see the\n  // doc comment.\n  const protected_ = [...new Set(['authorization', ...headerNames.map(name => name.toLowerCase())])]\n\n  return async function originPinnedWrappedFetch(input, init) {\n    let url = new URL(input.toString())\n    let currentInit: RequestInit = { ...init, redirect: 'manual' }\n    let stripped = false\n\n    for (let hop = 0; hop <= MAX_REDIRECTS; hop++) {\n      const response = await baseFetch(url, currentInit)\n      if (!REDIRECT_STATUSES.has(response.status))\n        return response\n\n      const location = response.headers.get('location')\n      if (!location)\n        return response // redirect status with no target — hand it back as-is\n\n      let next: URL\n      try {\n        next = new URL(location, url)\n      }\n      catch {\n        return response\n      }\n\n      // A redirect must not reach a URL the configured one would have been\n      // refused for — same predicate the loader validates `mcp.json` with, so\n      // the two can't drift.\n      //\n      // Stripping credentials is not a sufficient response here — continuing\n      // the session over cleartext exposes the MCP traffic itself, and a\n      // non-http scheme (`file:`, `data:`) isn't a transport we ever intended\n      // to hand `baseFetch`. The platform `fetch` happens to reject unsupported\n      // protocols today, but this module exists precisely to stop delegating\n      // redirect decisions to it, and `baseFetch` is injectable.\n      if (!isAllowedRemoteUrl(next))\n        throw new Error(`Refusing redirect from ${url.origin} to ${next.protocol}//${next.host || next.pathname}`)\n\n      if (next.origin !== pinnedOrigin && !stripped) {\n        currentInit = { ...currentInit, headers: withoutHeaders(currentInit.headers, protected_) }\n        stripped = true\n      }\n\n      // Per the fetch standard: 303 always becomes GET, and 301/302 become\n      // GET when the original request was a POST. A body cannot ride along\n      // on a GET, so drop it too.\n      const method = (currentInit.method ?? 'GET').toString().toUpperCase()\n      if (response.status === 303 || ((response.status === 301 || response.status === 302) && method === 'POST'))\n        currentInit = { ...currentInit, method: 'GET', body: undefined }\n\n      url = next\n    }\n\n    throw new Error(`Too many redirects (>${MAX_REDIRECTS}) following ${configuredUrl}`)\n  }\n}\n\n/**\n * Copy a `HeadersInit` minus the named headers. Handles all three\n * `HeadersInit` shapes the SDK may hand us (Headers, tuple array, record).\n */\nfunction withoutHeaders(source: HeadersInit | undefined, remove: readonly string[]): HeadersInit {\n  const headers = new Headers(source)\n  for (const name of remove)\n    headers.delete(name)\n  return headers\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAsCA,MAAM,oCAAoB,IAAI,IAAI;CAAC;CAAK;CAAK;CAAK;CAAK;AAAG,CAAC;;;;;;;;;AAU3D,MAAM,iCAAiB,IAAI,IAAI;CAAC;CAAa;CAAa;CAAS;AAAK,CAAC;;AAGzE,SAAgB,eAAe,UAA2B;CACxD,OAAO,eAAe,IAAI,QAAQ;AACpC;;;;;;;;;;;;;;;;;AAkBA,SAAgB,mBAAmB,KAAmB;CACpD,IAAI,IAAI,aAAa,UACnB,OAAO;CACT,OAAO,IAAI,aAAa,WAAW,eAAe,IAAI,QAAQ;AAChE;;;;;;AAOA,MAAM,gBAAgB;;;;;;;;;;;;;AA0BtB,SAAgB,kBACd,eACA,aACA,YAAyB,OACZ;CACb,IAAI;CACJ,IAAI;EACF,eAAe,IAAI,IAAI,aAAa,CAAC,CAAC;CACxC,QACM;EAGJ,OAAO;CACT;CAMA,MAAM,aAAa,CAAC,mBAAG,IAAI,IAAI,CAAC,iBAAiB,GAAG,YAAY,KAAI,SAAQ,KAAK,YAAY,CAAC,CAAC,CAAC,CAAC;CAEjG,OAAO,eAAe,yBAAyB,OAAO,MAAM;EAC1D,IAAI,MAAM,IAAI,IAAI,MAAM,SAAS,CAAC;EAClC,IAAI,cAA2B;GAAE,GAAG;GAAM,UAAU;EAAS;EAC7D,IAAI,WAAW;EAEf,KAAK,IAAI,MAAM,GAAG,OAAO,eAAe,OAAO;GAC7C,MAAM,WAAW,MAAM,UAAU,KAAK,WAAW;GACjD,IAAI,CAAC,kBAAkB,IAAI,SAAS,MAAM,GACxC,OAAO;GAET,MAAM,WAAW,SAAS,QAAQ,IAAI,UAAU;GAChD,IAAI,CAAC,UACH,OAAO;GAET,IAAI;GACJ,IAAI;IACF,OAAO,IAAI,IAAI,UAAU,GAAG;GAC9B,QACM;IACJ,OAAO;GACT;GAYA,IAAI,CAAC,mBAAmB,IAAI,GAC1B,MAAM,IAAI,MAAM,0BAA0B,IAAI,OAAO,MAAM,KAAK,SAAS,IAAI,KAAK,QAAQ,KAAK,UAAU;GAE3G,IAAI,KAAK,WAAW,gBAAgB,CAAC,UAAU;IAC7C,cAAc;KAAE,GAAG;KAAa,SAAS,eAAe,YAAY,SAAS,UAAU;IAAE;IACzF,WAAW;GACb;GAKA,MAAM,UAAU,YAAY,UAAU,MAAA,CAAO,SAAS,CAAC,CAAC,YAAY;GACpE,IAAI,SAAS,WAAW,QAAS,SAAS,WAAW,OAAO,SAAS,WAAW,QAAQ,WAAW,QACjG,cAAc;IAAE,GAAG;IAAa,QAAQ;IAAO,MAAM,KAAA;GAAU;GAEjE,MAAM;EACR;EAEA,MAAM,IAAI,MAAM,wBAAwB,cAAc,cAAc,eAAe;CACrF;AACF;;;;;AAMA,SAAS,eAAe,QAAiC,QAAwC;CAC/F,MAAM,UAAU,IAAI,QAAQ,MAAM;CAClC,KAAK,MAAM,QAAQ,QACjB,QAAQ,OAAO,IAAI;CACrB,OAAO;AACT"}

package/dist/output/stream-json.d.ts

@@ -1,4 +1,4 @@
-import { $n as HeadlessResult, Jn as FormattedHeadlessTurnEvent, Qn as HeadlessOutputFormat, Wi as Agent, Xn as HeadlessEvent, qn as FormattedHeadlessResult } from "../index-C-Nd2ZbV.js";
+import { $n as HeadlessResult, Jn as FormattedHeadlessTurnEvent, Qn as HeadlessOutputFormat, Wi as Agent, Xn as HeadlessEvent, qn as FormattedHeadlessResult } from "../index-CWBSrqI6.js";
 
 //#region src/output/stream-json.d.ts
 type StreamJsonOutputFormat = HeadlessOutputFormat;

package/dist/output/terminal.d.ts

@@ -1,4 +1,4 @@
-import { Ki as AgentHooks, Wi as Agent, t as Preset } from "../index-C-Nd2ZbV.js";
+import { Ki as AgentHooks, Wi as Agent, t as Preset } from "../index-CWBSrqI6.js";
 
 //#region src/output/terminal.d.ts
 interface TerminalOutputOptions {