aikido-zen 1.6.0 → 1.7.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: bbe496756f6406545bc23d9e0e485d819c71557b70ef240e41467d2c6078433e
-  data.tar.gz: f4518f842c1d8c6a510d978ff792dfbf1e8ef355abf6158f8287bd15499888bc
+  metadata.gz: 651c1ff033d7689d75fa83bc27e64249463e74ad5ecac534df46e2cae96fcda2
+  data.tar.gz: 8232034fd237b6b4be9cde3cbea8d35c9a796d05b6f72bb90ff4cfc63888d037
 SHA512:
-  metadata.gz: f30781c3f9fe4f0e990003b3ad037c7f3f3ced3872420b3530d3361f852b8a908ae88184045133003e6c6cb4e97e38fbe0f74568109cc0f8243baac06a142d4c
-  data.tar.gz: 0fe5077d3613a69fb44ff0dbb01914df3f3b7ea72515c221d380568e8340b0eaa0fa3737d65d454e19a4b0076591333c130f686598ce9ff77b8062573c112bde
+  metadata.gz: bf4940ca74224b195ddbe9447b5d14d61b6f677c152f484a5ed71b6fe100482e5bd71d917f57807b632b24e93e4b9f6d9dbb53f6cc5cdc280dcf3e3315fdbcfd
+  data.tar.gz: f7746da3d5a9bb8e4c54be18c689fc3338ba7598fe59a683921ff47a8455b6800572016a4ad1103bc42aa0f01e09f34d9e38aecf957474c8dbd18847632ac937

data/lib/aikido/zen/agent.rb

@@ -18,12 +18,14 @@ module Aikido::Zen
 
     def initialize(
       config: Aikido::Zen.config,
+      settings: Aikido::Zen.runtime_settings,
       collector: Aikido::Zen.collector,
       worker: Aikido::Zen::Worker.new(config: config),
       api_client: Aikido::Zen::APIClient.new(config: config),
       api_stream: Aikido::Zen::APIStream.new(config: config)
     )
       @config = config
+      @settings = settings
       @collector = collector
       @worker = worker
       @api_client = api_client
@@ -68,6 +70,15 @@ module Aikido::Zen
       report(Events::Started.new(time: @started_at)) do |response|
         if update_settings_from_runtime_config!(response, reason: "after start")
           updated_settings!
+
+          if @config.realtime_settings_updates_enabled? || @settings.realtime_settings_updates_enabled?
+            @api_stream.handle("config-updated") do |event|
+              @config.logger.debug("Received server-sent event: config-updated")
+              settings_updated(event)
+            end
+
+            @api_stream.start!
+          end
         # :nocov:
         else
           # empty
@@ -83,15 +94,6 @@ module Aikido::Zen
         @config.logger.error(err.message)
       end
 
-      if @config.realtime_settings_updates_enabled?
-        @api_stream.handle("config-updated") do |event|
-          @config.logger.debug("Received server-sent event: config-updated")
-          settings_updated(event)
-        end
-
-        @api_stream.start!
-      end
-
       poll_for_setting_updates
 
       @config.initial_heartbeat_delays.each do |heartbeat_delay|
@@ -197,7 +199,7 @@ module Aikido::Zen
     # @return [void]
     # @see Aikido::Zen::RuntimeSettings
     def poll_for_setting_updates
-      @worker.every(@config.polling_interval) do
+      @worker.every(@config.polling_interval, run_now: true) do
         if @api_client.should_fetch_settings?
           if update_settings_from_runtime_config!(@api_client.fetch_runtime_config, reason: "after polling")
             updated_settings!

data/lib/aikido/zen/runtime_settings/ip_list.rb

@@ -29,10 +29,13 @@ module Aikido::Zen
       @ipv6_ranges = []
 
       ips.each do |ip|
+        range = ip.to_range
+        ip_int_range = (range.begin.to_i..range.end.to_i)
+
         if ip.ipv4?
-          @ipv4_ranges << ip.to_range
+          @ipv4_ranges << ip_int_range
         elsif ip.ipv6?
-          @ipv6_ranges << ip.to_range
+          @ipv6_ranges << ip_int_range
         else
           raise ArgumentError, "Unsupported IP address family: #{ip.inspect}"
         end
@@ -50,10 +53,12 @@ module Aikido::Zen
       native_ip = nativize_ip(ip)
       return false if native_ip.nil?
 
+      ip_int = native_ip.to_i
+
       if native_ip.ipv4?
-        ranges_cover?(@ipv4_ranges, native_ip)
+        ranges_cover?(@ipv4_ranges, ip_int)
       elsif native_ip.ipv6?
-        ranges_cover?(@ipv6_ranges, native_ip)
+        ranges_cover?(@ipv6_ranges, ip_int)
       else
         raise ArgumentError, "Unsupported IP address family: #{ip.inspect}"
       end
@@ -78,12 +83,12 @@ module Aikido::Zen
       end
     end
 
-    def ranges_cover?(ranges, ip)
-      index = ranges.bsearch_index { |range| range.begin > ip }
+    def ranges_cover?(ranges, ip_int)
+      index = ranges.bsearch_index { |range| range.begin > ip_int }
       index = index ? index - 1 : ranges.size - 1
       return false if index < 0
 
-      ranges[index].cover?(ip)
+      ranges[index].cover?(ip_int)
     end
   end
 end

data/lib/aikido/zen/runtime_settings.rb

@@ -1,5 +1,7 @@
 # frozen_string_literal: true
 
+require "set"
+
 module Aikido::Zen
   # Stores the firewall configuration sourced from the Aikido dashboard. This
   # object is updated by the Agent regularly.
@@ -11,7 +13,25 @@ module Aikido::Zen
   #
   # You can subscribe to changes with +#add_observer(object, func_name)+, which
   # will call the function passing the settings as an argument
-  RuntimeSettings = Struct.new(:updated_at, :heartbeat_interval, :endpoints, :blocked_user_ids, :bypassed_ips, :received_any_stats, :blocking_mode, :blocked_user_agent_regexp, :monitored_user_agent_regexp, :user_agent_details, :blocked_ip_lists, :allowed_ip_lists, :monitored_ip_lists, :block_new_outbound, :domains, :excluded_user_ids_from_rate_limiting) do
+  RuntimeSettings = Struct.new(
+    :updated_at,
+    :heartbeat_interval,
+    :endpoints,
+    :blocked_user_ids,
+    :bypassed_ips,
+    :received_any_stats,
+    :blocking_mode,
+    :blocked_user_agent_regexp,
+    :monitored_user_agent_regexp,
+    :user_agent_details,
+    :blocked_ip_lists,
+    :allowed_ip_lists,
+    :monitored_ip_lists,
+    :block_new_outbound,
+    :domains,
+    :excluded_user_ids_from_rate_limiting,
+    :enabled_features
+  ) do
     def initialize(*)
       super
       self.endpoints ||= RuntimeSettings::Endpoints.new
@@ -20,6 +40,7 @@ module Aikido::Zen
       self.allowed_ip_lists ||= []
       self.monitored_ip_lists ||= []
       self.domains ||= RuntimeSettings::Domains.new
+      self.enabled_features ||= Set.new
     end
 
     # @!attribute [rw] updated_at
@@ -73,6 +94,9 @@ module Aikido::Zen
     #   @return [Array<String>, nil] the user IDs that should be skipped from
     #     rate limiting entirely.
 
+    # @!attribute [rw] enabled_features
+    #   @return [Set<String>]
+
     # Parse and interpret the JSON response from the core API with updated
     # runtime settings, and apply the changes.
     #
@@ -97,6 +121,8 @@ module Aikido::Zen
 
       self.excluded_user_ids_from_rate_limiting = data["excludedUserIdsFromRateLimiting"]
 
+      self.enabled_features = Set.new(data["enabledFeatures"])
+
       updated_at != last_updated_at
     end
 
@@ -223,6 +249,14 @@ module Aikido::Zen
 
       (!domain.nil? && domain.block?) || (domain.nil? && block_new_outbound)
     end
+
+    private def enabled_feature?(feature)
+      enabled_features.include?(feature)
+    end
+
+    def realtime_settings_updates_enabled?
+      enabled_feature?("realtime_updates")
+    end
   end
 end
 

data/lib/aikido/zen/sinks/httpx.rb

@@ -70,6 +70,10 @@ module Aikido::Zen
               Helpers.scan(wrapped_request, connection, "request")
 
               request.on(:response) do |response|
+                # HTTPX emits an ErrorResponse (no status/headers) through this
+                # same callback when the request fails at the transport level.
+                next if response.is_a?(::HTTPX::ErrorResponse)
+
                 Scanners::SSRFScanner.track_redirects(
                   request: wrapped_request,
                   response: Helpers.wrap_response(response)

data/lib/aikido/zen/version.rb

@@ -2,7 +2,7 @@
 
 module Aikido
   module Zen
-    VERSION = "1.6.0"
+    VERSION = "1.7.0"
 
     # The version of libzen_internals that we build against.
     LIBZEN_VERSION = "0.1.61"

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: aikido-zen
 version: !ruby/object:Gem::Version
-  version: 1.6.0
+  version: 1.7.0
 platform: ruby
 authors:
 - Aikido Security
 autorequire:
 bindir: exe
 cert_chain: []
-date: 2026-07-23 00:00:00.000000000 Z
+date: 2026-08-04 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: concurrent-ruby