fix: egress policy

plugin-sdk/src/egress-policy.ts

@@ -62,10 +62,33 @@ export function isBlockedIp(ip: string): boolean {
     }
     if ((g[0] & 0xffc0) === 0xfe80) return true; // fe80::/10 link-local
     if ((g[0] & 0xfe00) === 0xfc00) return true; // fc00::/7 ULA
+    // IPv6 transition addresses (NAT64/6to4/Teredo) embedding an IPv4 → re-check
+    // the embedded target, so a NAT64 spelling of 169.254.169.254 can't tunnel past.
+    const embedded = embeddedTransitionIpv4(g);
+    if (embedded) return isBlockedIp(embedded);
   }
   return false;
 }
 
+/**
+ * If the expanded hextets `g` are an IPv6 transition address that embeds an IPv4
+ * target, return that IPv4 in dotted form; otherwise null. Recognises the NAT64
+ * well-known prefix `64:ff9b::/96`, 6to4 `2002::/16`, and Teredo `2001:0000::/32`.
+ * Kept local so this module stays dependency-free for the isolated plugin child.
+ */
+function embeddedTransitionIpv4(g: number[]): string | null {
+  const v4 = (hi: number, lo: number) => `${hi >> 8}.${hi & 0xff}.${lo >> 8}.${lo & 0xff}`;
+  // NAT64 well-known 64:ff9b::/96 — first 96 bits fixed, last 32 = IPv4.
+  if (g[0] === 0x0064 && g[1] === 0xff9b && g[2] === 0 && g[3] === 0 && g[4] === 0 && g[5] === 0) {
+    return v4(g[6], g[7]);
+  }
+  // 6to4 2002::/16 — hextets 1,2 = IPv4.
+  if (g[0] === 0x2002) return v4(g[1], g[2]);
+  // Teredo 2001:0000::/32 — last 32 bits = client IPv4 XOR 0xffffffff.
+  if (g[0] === 0x2001 && g[1] === 0x0000) return v4(g[6] ^ 0xffff, g[7] ^ 0xffff);
+  return null;
+}
+
 /** Expand an IPv6 literal into its 8 numeric hextets, or null if not a valid IPv6. */
 function expandV6(ip: string): number[] | null {
   let h = ip.toLowerCase().replace(/%.*$/, '');