fix(egress): fold NAT64 addresses, and parse the boundary check properly

A DNS64 resolver returns an IPv4 destination wrapped in the RFC 6052 well-known
prefix, so `64:ff9b::a9fe:a9fe` is the metadata endpoint. Canonicalization did
not recognise that, and an allowlisted hostname resolving there was permitted —
probed and confirmed. Narrower than it first looked: `isPrivateIp` already
rejects every NAT64 form, so an ordinary destination was never exposed; the hole
was only for a vouched one, where the class check is skipped and the metadata
exception is all that stands in the way. Folding it also makes an operator's
IPv4 range match the NAT64 spelling of an address inside it.

The boundary check is parsed with the TypeScript AST instead of matched with a
regex. Two rounds found holes in both directions — a comment or string naming a
transport reported a violation that did not exist, and a regex literal
containing a quote hid one that did — which is what a scanner that does not
understand the grammar will keep doing. A template interpolation was the third.

Parsing surfaced a false positive the regex never had: `import { type X } from
'undici'` is elided under `verbatimModuleSyntax: false`, so it cannot load
anything. Elision is now modelled properly — a default or namespace binding
keeps an import alive, an all-type named import does not. Eleven forms verified
by probe.

That needs `@typescript/typescript6` declared at the root rather than relied on
by hoisting from apps/sim. It adds no new `tsc` bin, and check:native-typecheck
still reports 7.0.2.

Docs: the provenance table was missing `proxy`, and the line about naming a
destination read as though the allowlist reaches everything. It does not reach a
content fetch or a proxy — a proxy must be public, since it decides where every
other request may go.

Author: waleedlatif1

apps/docs/content/docs/platform/self-hosting/security.mdx

@@ -143,8 +143,9 @@ Sim blocks outbound requests to private, reserved, and loopback addresses. This
 | Request target | The HTTP block's URL, an A2A agent, an RSS feed, a Function block's `fetch` | Yes |
 | Database host | A database, cache, or mail connector's host | Yes |
 | Content fetch | An image URL, a file imported by URL, a link from a third-party API response | **No** |
+| Proxy | The outbound HTTP proxy itself | **No** |
 
-Content fetches never reach a private destination, allowlist or not — that is the class where SSRF is actually exploited.
+Content fetches never reach a private destination, allowlist or not — that is the class where SSRF is actually exploited. Nor does the proxy: it is the component deciding where everything else may go, so it is held to public destinations regardless of what the allowlist says.
 
 Deployments frequently need to reach an internal service by name or address. Name the destinations:
 
@@ -157,6 +158,8 @@ A wildcard (`*.svc.cluster.local`) and a broad range (`10.0.0.0/8`) are accepted
 
 Naming a destination permits plain HTTP to it and lifts the blocked-port list for it, since those are the same decision about the same host. Cloud metadata endpoints (`169.254.169.254` and equivalents) stay blocked no matter how broad the allowlist is, and both variables are ignored entirely on Sim Cloud.
 
+The allowlist reaches the four provenances marked **Yes** above. It does not reach a content fetch, and it does not reach a proxy: an HTTP block's `proxyUrl` must be a public address, because the proxy is what decides where every other request may go. Adding an internal proxy to the allowlist will not make it work.
+
 To reach a service on the Docker host, pair the allowlist with the host alias that Compose already sets up:
 
 ```bash

bun.lock

@@ -136,6 +136,7 @@
     "@clack/prompts": "1.7.0",
     "@octokit/rest": "^21.0.0",
     "@types/opentype.js": "1.3.10",
+    "@typescript/typescript6": "^6.0.2",
     "@typescript/native": "npm:typescript@^7.0.2",
     "@vercel/og": "0.6.8",
     "chalk": "5.6.2",

package.json

@@ -100,6 +100,14 @@ describe('cloud metadata is never reachable', () => {
     )
   })
 
+  it.each([
+    ['64:ff9b::a9fe:a9fe', 'the NAT64 form a DNS64 resolver returns'],
+    ['64:ff9b::169.254.169.254', 'NAT64 written long-hand'],
+  ])('blocks %s through an allowlisted hostname — %s', (address) => {
+    const permissive = createEgressPolicy({ allowedHosts: 'internal.corp' })
+    expect(reason(permissive, 'https://internal.corp/', address)).toBe('address-metadata')
+  })
+
   it('blocks the AWS IPv6 metadata address', () => {
     expect(reason(hosted, 'https://[fd00:ec2::254]/')).toBe('address-metadata')
   })
@@ -163,6 +171,7 @@ describe('an IPv4 range matches every spelling of the same address', () => {
     ['::a00:1', 'the IPv4-compatible form a resolver can return'],
     ['::ffff:10.0.0.1', 'the IPv4-mapped form'],
     ['::10.0.0.1', 'IPv4-compatible written long-hand'],
+    ['64:ff9b::a00:1', 'the NAT64 form'],
   ])('permits %s — %s', (address) => {
     expect(decide(ranged, 'https://svc.internal/', address).allowed).toBe(true)
   })

packages/security/src/egress.test.ts

@@ -263,26 +263,41 @@ function matchesRangeAllowlist(address: string, policy: EgressPolicy): boolean {
  * URL parser normalizes to `::a9fe:a9fe`), so comparing without this misses the
  * metadata endpoint written that way.
  */
+function embeddedIpv4(parts: readonly number[]): string {
+  return ipaddr
+    .fromByteArray([
+      (parts[6] >> 8) & 0xff,
+      parts[6] & 0xff,
+      (parts[7] >> 8) & 0xff,
+      parts[7] & 0xff,
+    ])
+    .toString()
+}
+
+/** RFC 6052 well-known NAT64 prefix, `64:ff9b::/96`. */
+const NAT64_WELL_KNOWN_PREFIX = [0x0064, 0xff9b, 0, 0, 0, 0] as const
+
 function canonicalAddress(address: string): string | null {
   const clean = unwrapIpv6Brackets(address)
   if (!ipaddr.isValid(clean)) return null
 
   const parsed = ipaddr.process(clean)
   if (parsed.kind() === 'ipv6') {
     const parts = (parsed as ipaddr.IPv6).parts
+
+    // A DNS64 resolver hands back the IPv4 destination wrapped in the well-known
+    // NAT64 prefix. Left unfolded, `64:ff9b::a9fe:a9fe` does not read as the
+    // metadata endpoint it is, and a vouched destination would reach it.
+    if (NAT64_WELL_KNOWN_PREFIX.every((part, index) => parts[index] === part)) {
+      return embeddedIpv4(parts)
+    }
+
     const embedded = ((parts[6] << 16) >>> 0) + parts[7]
     // `::` and `::1` are the unspecified and loopback addresses, not an IPv4
     // carried inside IPv6 — folding them would turn `::1` into `0.0.0.1` and
     // stop an operator's `::1/128` entry matching it.
     if (parts.slice(0, 6).every((part) => part === 0) && embedded > 1) {
-      return ipaddr
-        .fromByteArray([
-          (parts[6] >> 8) & 0xff,
-          parts[6] & 0xff,
-          (parts[7] >> 8) & 0xff,
-          parts[7] & 0xff,
-        ])
-        .toString()
+      return embeddedIpv4(parts)
     }
   }
   return parsed.toString()

packages/security/src/egress.ts

@@ -9,17 +9,24 @@
  * `undici` directly gets none of that, and the omission is invisible — the code
  * works, it just has no guard.
  *
- * This checks the import edge rather than the call, because that is the part
+ * This checks the module edge rather than the call, because that is the part
  * that cannot be hidden behind a helper.
  *
+ * Parsed with the TypeScript AST rather than matched with a regex. Two rounds of
+ * review found regex holes in both directions — a comment or string naming a
+ * transport reported a violation that was not there, and a regex literal
+ * containing a quote hid a real one — which is what a scanner that does not
+ * understand the grammar will keep doing.
+ *
  * Not checked: bare `fetch()`. It is used constantly for same-origin and
  * server-action calls where the guard does not apply, so flagging it would be
- * noise. The transports it can reach are covered by the rules above.
+ * noise. The transports it can reach are covered by the rules below.
  *
  * Usage: bun run scripts/check-egress-boundary.ts
  */
 import { readdirSync, readFileSync } from 'node:fs'
 import path from 'node:path'
+import ts from '@typescript/typescript6'
 
 const ROOT = path.resolve(import.meta.dir, '..')
 
@@ -36,31 +43,15 @@ const SCAN_DIRS = [
 const SKIP_DIRS = new Set(['node_modules', 'dist', '.next', '.turbo', 'coverage'])
 
 /** Modules that can open a socket directly. */
-const TRANSPORTS = ['http', 'https', 'undici', 'http-proxy-agent', 'https-proxy-agent']
-
-const MODULE_ALTERNATION = TRANSPORTS.map((name) => name.replace(/[-]/g, '\\-')).join('|')
-const SPECIFIER = `['"](?:node:)?(?:${MODULE_ALTERNATION})['"]`
-
-/**
- * Every way a module reaches one of these at runtime.
- *
- * Matched against the whole source rather than line by line, because an import
- * list broken across lines would otherwise slip past. `import type` is excluded:
- * a type has no runtime presence and cannot open anything.
- */
-const RUNTIME_LOADS: ReadonlyArray<{ pattern: RegExp; kind: string }> = [
-  {
-    pattern: new RegExp(`^[ \t]*import\\s+(?!type\\s)[\\s\\S]*?from\\s*${SPECIFIER}`, 'gm'),
-    kind: 'import',
-  },
-  { pattern: new RegExp(`^[ \t]*import\\s*${SPECIFIER}`, 'gm'), kind: 'side-effect import' },
-  {
-    pattern: new RegExp(`^[ \t]*export\\s+(?!type\\s)[\\s\\S]*?from\\s*${SPECIFIER}`, 'gm'),
-    kind: 're-export',
-  },
-  { pattern: new RegExp(`\\bimport\\s*\\(\\s*${SPECIFIER}\\s*\\)`, 'g'), kind: 'dynamic import' },
-  { pattern: new RegExp(`\\brequire\\s*\\(\\s*${SPECIFIER}\\s*\\)`, 'g'), kind: 'require' },
-]
+const TRANSPORTS = new Set([
+  'http',
+  'https',
+  'node:http',
+  'node:https',
+  'undici',
+  'http-proxy-agent',
+  'https-proxy-agent',
+])
 
 /**
  * Modules allowed to hold a transport import, each because it *is* part of the
@@ -75,58 +66,6 @@ const ALLOWED = new Set([
   'apps/sim/lib/core/utils/fetch-deadline.ts',
 ])
 
-/**
- * Blanks comment bodies, preserving byte offsets so reported line numbers stay
- * exact. Without this the rules match their own documentation: a comment warning
- * against `require('undici')` reads identically to the call.
- *
- * Strings are deliberately left intact — the module specifier is itself a string,
- * so blanking them would stop every rule matching anything. A match that starts
- * inside a string is rejected separately by {@link stringRanges}.
- */
-function blankComments(source: string): string {
-  const out = source.split('')
-  let i = 0
-  while (i < source.length) {
-    const two = source.slice(i, i + 2)
-    if (two === '//' || two === '/*') {
-      const end =
-        two === '//'
-          ? (source.indexOf('\n', i) + 1 || source.length + 1) - 1
-          : source.indexOf('*/', i + 2) + 2 || source.length
-      for (let j = i; j < end; j++) if (out[j] !== '\n') out[j] = ' '
-      i = end
-      continue
-    }
-    if (two[0] === '"' || two[0] === "'" || two[0] === '`') {
-      let j = i + 1
-      while (j < source.length && source[j] !== two[0]) j += source[j] === '\\' ? 2 : 1
-      i = j + 1
-      continue
-    }
-    i++
-  }
-  return out.join('')
-}
-
-/** Half-open [start, end) ranges covering every string literal body. */
-function stringRanges(source: string): Array<[number, number]> {
-  const ranges: Array<[number, number]> = []
-  let i = 0
-  while (i < source.length) {
-    const ch = source[i]
-    if (ch === '"' || ch === "'" || ch === '`') {
-      let j = i + 1
-      while (j < source.length && source[j] !== ch) j += source[j] === '\\' ? 2 : 1
-      ranges.push([i + 1, j])
-      i = j + 1
-      continue
-    }
-    i++
-  }
-  return ranges
-}
-
 function walk(dir: string, out: string[] = []): string[] {
   for (const entry of readdirSync(dir, { withFileTypes: true })) {
     if (SKIP_DIRS.has(entry.name)) continue
@@ -141,39 +80,82 @@ interface Violation {
   file: string
   line: number
   kind: string
-  snippet: string
+  specifier: string
+}
+
+/**
+ * Whether TypeScript drops this import at emit, leaving nothing that could load
+ * the module.
+ *
+ * True for `import type … from 'm'` and for a named import whose every binding
+ * is marked `type` — the repo compiles with `verbatimModuleSyntax: false`, so
+ * that form is elided rather than kept as a side-effect import. A default or
+ * namespace binding is a value and keeps the import alive, and a bare
+ * `import 'm'` has no clause at all and always runs.
+ */
+function isElidedImport(node: ts.ImportDeclaration): boolean {
+  const clause = node.importClause
+  if (!clause) return false
+  if (clause.isTypeOnly) return true
+  if (clause.name) return false
+
+  const bindings = clause.namedBindings
+  if (!bindings || !ts.isNamedImports(bindings)) return false
+  return bindings.elements.every((element) => element.isTypeOnly)
+}
+
+/**
+ * Every runtime reference to a transport module. An import TypeScript elides is
+ * skipped: it has no runtime presence and cannot open anything.
+ */
+function findTransportLoads(file: string, source: string): Array<Omit<Violation, 'file'>> {
+  const sourceFile = ts.createSourceFile(file, source, ts.ScriptTarget.Latest, true)
+  const found: Array<Omit<Violation, 'file'>> = []
+
+  const record = (node: ts.Node, specifier: string, kind: string) => {
+    if (!TRANSPORTS.has(specifier)) return
+    const { line } = sourceFile.getLineAndCharacterOfPosition(node.getStart(sourceFile))
+    found.push({ line: line + 1, kind, specifier })
+  }
+
+  const visit = (node: ts.Node): void => {
+    if (ts.isImportDeclaration(node) && ts.isStringLiteralLike(node.moduleSpecifier)) {
+      if (!isElidedImport(node)) {
+        record(node, node.moduleSpecifier.text, node.importClause ? 'import' : 'side-effect import')
+      }
+    } else if (
+      ts.isExportDeclaration(node) &&
+      node.moduleSpecifier &&
+      ts.isStringLiteralLike(node.moduleSpecifier) &&
+      !node.isTypeOnly
+    ) {
+      record(node, node.moduleSpecifier.text, 're-export')
+    } else if (ts.isCallExpression(node)) {
+      const isDynamicImport = node.expression.kind === ts.SyntaxKind.ImportKeyword
+      const isRequire = ts.isIdentifier(node.expression) && node.expression.text === 'require'
+      const argument = node.arguments[0]
+      if ((isDynamicImport || isRequire) && argument && ts.isStringLiteralLike(argument)) {
+        record(node, argument.text, isDynamicImport ? 'dynamic import' : 'require')
+      }
+    }
+    ts.forEachChild(node, visit)
+  }
+
+  visit(sourceFile)
+  return found
 }
 
 function main() {
   const violations: Violation[] = []
   let scanned = 0
 
   for (const scanDir of SCAN_DIRS) {
-    const abs = path.join(ROOT, scanDir)
-    for (const file of walk(abs)) {
+    for (const file of walk(path.join(ROOT, scanDir))) {
       const rel = path.relative(ROOT, file).split(path.sep).join('/')
       if (ALLOWED.has(rel)) continue
       scanned++
-      const raw = readFileSync(file, 'utf8')
-      const source = blankComments(raw)
-      const strings = stringRanges(source)
-      const insideString = (index: number) =>
-        strings.some(([from, to]) => index >= from && index < to)
-
-      for (const { pattern, kind } of RUNTIME_LOADS) {
-        pattern.lastIndex = 0
-        for (const match of source.matchAll(pattern)) {
-          if (match.index === undefined || insideString(match.index)) continue
-          violations.push({
-            file: rel,
-            line: source.slice(0, match.index).split('\n').length,
-            kind,
-            snippet: raw
-              .slice(match.index, match.index + match[0].length)
-              .replace(/\s+/g, ' ')
-              .trim(),
-          })
-        }
+      for (const load of findTransportLoads(rel, readFileSync(file, 'utf8'))) {
+        violations.push({ file: rel, ...load })
       }
     }
   }
@@ -186,7 +168,7 @@ function main() {
   console.error('✗ check-egress-boundary: raw HTTP transport outside the egress guard\n')
   for (const violation of violations) {
     console.error(`    ${violation.file}:${violation.line}  (${violation.kind})`)
-    console.error(`      ${violation.snippet}`)
+    console.error(`      ${violation.specifier}`)
   }
   console.error(
     '\n  These modules can open a socket without resolving and classifying the\n' +