Local-daemon HTTP

An HTTP client for a LOCAL daemon reached over a non-network transport — a Unix domain socket (Docker /var/run/docker.sock, systemd, containerd, tailscaled), a Windows named pipe, or a loopback TCP port + bearer token (the sandboxed-macOS shape). Distinct from b.httpClient, which does DNS + TCP/TLS + the SSRF gate.

This client is SSRF-safe by construction: a socket-path request never resolves DNS and never touches an IP, so it cannot be steered at an internal address; the loopback-TCP mode refuses any host that is not a loopback address. It always sets the caller-chosen Host header (many local APIs require an exact value such as local-tailscaled.sock) and NEVER sends Origin or Referer — the two headers a local daemon uses to reject drive-by / DNS-rebinding requests from a browser.

Responses are size-bounded and typed: { statusCode, headers, body, text(), json() }. The vendor glue (a tailscaled Host value, .whois/.status wrappers) belongs in the consumer, not here.

b.localHttp.create(opts) #

{
  socketPath:       string,          // Unix socket path OR Windows named pipe (exclusive with host/port)
  host:             string,          // loopback IP LITERAL for the TCP+token mode (127.0.0.0/8 or ::1 — a hostname like "localhost" is refused)
  port:             number,          // TCP port (with host)
  hostHeader:       string,          // the Host header to send (default: "localhost")
  bearerToken:      string,          // Authorization: Bearer  on every request
  defaultHeaders:   object,          // headers merged into every request (Origin/Referer stripped)
  timeoutMs:        number,          // per-request timeout (default: 10s)
  maxResponseBytes: number,          // response body cap; over-cap aborts (default: 8 MiB)
}

Build a client bound to ONE local transport. Provide EITHER socketPath (a Unix socket path or a Windows named pipe like \\.\pipe\name) OR host + port (which must be a loopback address). Returns a client with request, get, and postJson — every call sends the configured hostHeader and omits Origin/Referer.

var d = b.localHttp.create({ socketPath: "/run/tailscale/tailscaled.sock",
  hostHeader: "local-tailscaled.sock" });
var r = await d.get("/localapi/v0/status");
// → { statusCode: 200, headers, body, text(), json() }

b.localHttp.request(opts) #

{
  socketPath:       string,          // Unix socket path OR Windows named pipe (exclusive with host/port)
  host:             string,          // loopback IP LITERAL for the TCP+token mode (127.0.0.0/8 or ::1 — a hostname like "localhost" is refused)
  port:             number,          // TCP port (with host)
  hostHeader:       string,          // the Host header to send (default: "localhost")
  bearerToken:      string,          // Authorization: Bearer  on the request
  defaultHeaders:   object,          // headers merged into the request (Origin/Referer stripped)
  timeoutMs:        number,          // request timeout (default: 10s)
  maxResponseBytes: number,          // response body cap; over-cap aborts (default: 8 MiB)
  method:           string,          // HTTP method (default: "GET")
  path:             string,          // request path (must start with "/")
  headers:          object,          // per-request headers (merged over defaultHeaders)
  body:             Buffer | string, // request body
}

One-shot convenience: build a client from the transport fields and issue a single request. opts carries both the create transport fields (socketPath / host+port / hostHeader / bearerToken / timeoutMs / maxResponseBytes) and the per-request fields (method / path / headers / body). Resolves the same typed response as the client's request.

var r = await b.localHttp.request({
  socketPath: "/var/run/docker.sock", hostHeader: "localhost",
  path: "/v1.44/containers/json",
});

Last updated 2026-08-08T16:39:49.652Z by seeder.