hansjone/dsh-search-mcp
1
0
Fork 0
mirror of https://github.com/hansjone/dsh-search-mcp.git synced 2026-10-15 00:10:45 +08:00
Code Issues Projects Releases Packages Wiki Activity Actions

Inherit DSH process proxy for search-mcp HTTP egress.

Browse source 
Use proxyRouteFor when a policy is installed so HTTPS_PROXY/system proxy is not bypassed by the DNS-pinned Agent; keep the pinned direct path otherwise.

Co-authored-by: Cursor <cursoragent@cursor.com>
This commit is contained in:
oliver 2026-10-10 12:04:38 +08:00
parent 229a36d5f3
commit 26a8c2ecee
5 changed files with 93 additions and 15 deletions
Download patch file Download diff file Expand all files Collapse all files

28
lib/url-policy.js
View file

@ -4,11 +4,10 @@ import ipaddr from 'ipaddr.js';
const ALLOWED_PROTOCOLS = new Set(['http:', 'https:']);
/**
* Parse and resolve one HTTP endpoint before any request is sent.
* Every resolved address must be globally routable.
* Structural URL checks for one MCP HTTP endpoint (no DNS).
* Used by both the direct (DNS-pinned) path and the proxied path.
*/
export async function validateHttpEndpoint(input, options = {}) {
if (options.signal?.aborted) throw abortedPolicyError();
export function parseHttpEndpoint(input) {
if (typeof input !== 'string' || input.length === 0 || input !== input.trim()) {
throw policyError('endpoint must be a non-empty canonical URL');
}
@ -36,6 +35,27 @@ export async function validateHttpEndpoint(input, options = {}) {
}
rejectAmbiguousIpv4(input, comparable);
return Object.freeze({ url, hostname: comparable });
}
/**
* True when the host is a literal address that must not go through a local proxy
* (loopback / private / link-local). Matches web-fetch-http's proxy gate.
*/
export function isNonPublicIpLiteral(hostname) {
const unbracketed = stripIpv6Brackets(hostname);
if (!ipaddr.isValid(unbracketed)) return false;
return !isPublicAddress(unbracketed);
}
/**
* Parse and resolve one HTTP endpoint before any direct (non-proxy) request.
* Every resolved address must be globally routable (or Clash fake-IP).
*/
export async function validateHttpEndpoint(input, options = {}) {
if (options.signal?.aborted) throw abortedPolicyError();
const { url, hostname: comparable } = parseHttpEndpoint(input);
let addresses;
if (ipaddr.isValid(comparable)) {
addresses = [{ address: normalizeAddress(comparable), family: addressFamily(comparable) }];