agent-oauth: use SSRF-safe fetch across discovery and token flows

[bokelley]

Problem

The Agent OAuth route performs synchronous URL validation, but its MCP/@adcp SDK discovery, dynamic registration, and token requests still default to global fetch. A public hostname can therefore pass preflight and rebind to a loopback/private address at dial time; redirects to private literals are also unsafe without per-hop validation.

This is an authenticated blind-SSRF reachable from org-managed agent contexts.

Acceptance criteria

• Inject a scoped SSRF-safe fetch into PRM discovery, authorization-server discovery, OAuth start/DCR, callback/token exchange, and status discovery.
• Support the SDK request shapes actually used: GET discovery plus JSON and URL-encoded POST bodies.
• Preserve abort signals and required headers.
• Validate every redirect hop and enforce connect-time DNS pinning using the existing safeFetch primitive.
• Tests prove fetch injection across each route flow and adapter request normalization.

Medium/P1 follow-up from Argus review of #5958. Keep trailing-dot hostname normalization separate in #5959.

[bokelley]

Triage

Classification: Bug
Bucket(s): security-sensitive, addie
Status: ready-for-human
Milestone: Evergreen (server-only, no protocol change)

What the experts said:

• security-reviewer: P1 confirmed; authentication requirement mitigates scope but does not reduce severity below ship-blocker. The /status endpoint (line 522) is flagged as higher-priority than the scope-hint path — unlike the other sites it returns data to the caller, making it an oracle. Adapter must normalize Request/URL input to string to avoid silently bypassing safeFetch. Also surfaced: agent-oauth-prompt.ts:42 and registry-api.ts:6184 create agent_contexts rows without SSRF pre-flight, widening which agent URLs can reach the unguarded fetch sites — scope worth confirming before the PR.
• code-reviewer: Four unprotected external fetch call sites confirmed in agent-oauth.ts (lines 75, 97, 522, plus SDK internals on /start and /callback). safeFetch injection is the right primitive; adapter needs BodyInit → string | Uint8Array narrowing. One open dependency: whether startWebOAuthFlow, completeWebOAuthFlow, and discoverOAuthMetadata in @adcp/sdk@9.6.2 expose a fetchFn option — node_modules not installed; verify against published types before writing the adapter. Current tests mock the SDK at module level and won't catch a wiring failure; tests asserting the injected fetch is called per route are a real gap. No changeset.

My take: Experts agree on fix approach and P1 priority. One pre-implementation gate: confirm @adcp/sdk/auth exposes a fetchFn seam; without it, the brief must scope to MCP SDK calls only and flag an SDK upgrade as a prerequisite. The two additional agent_contexts creation paths and the /status oracle path are worth a scope call before the PR opens.

---

Triaged by Claude Code. Session: https://claude.ai/code/session_01CsSopJF1MMkge7J6icxzxx

---

Generated by Claude Code