radioactive 0.1.1 → 0.1.3

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: db78ab47dc98a9125d0dde9cb3ec17e95b83cafc3fae5922fa3f48cbcb85f0f2
-  data.tar.gz: 8da7cf85d58c94bab1a13466ef7a236b24a2da1d6e021835bd5bf959b690d38c
+  metadata.gz: c9f817e25ec6dd75ec6f603f24df5a6c0f01eef4c1f47e5581da6a1f732fb9ad
+  data.tar.gz: 66a603a6d7ba82219ff172045a3c2577debfa4cb86d2c0d7df685687ac89a772
 SHA512:
-  metadata.gz: 594fcc7d8f2f3d670154b11d9d0194df8f9fe2da2e8d4eadf222516cb76b6b1d82ac70214e873ccdaaf9947f95f0ca6012aba1079ee8942e25ad50845b2035be
-  data.tar.gz: 35ee0b007e1e41807b9376d80c1e98d6b933af4388b8e4dae0aef6d5dc451d6ec0f012284619d9390cb4f055db82a5efce4199f73220df2ba8c26680a5006331
+  metadata.gz: 561781780d9e484a5984d7605b122f1be24deeeaceba4fae230191ef33d69458e9f451e5b160ddb8a7f52d334cae814a9f66c8abd701d19146356298252064c0
+  data.tar.gz: 23d1368172643c0736e75ff3a4db3b83af0075fd577b606a79ccd2bb28bc82d137237343d47309a077a0772e187a8086f54253dc7ff407b670a3481543e11efd

data/CHANGELOG.md

@@ -6,6 +6,83 @@ project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
 ## [Unreleased]
 
+## [0.1.3] - 2026-10-14
+
+No runtime behavior changes.
+
+### Changed
+
+- Minimum supported Ruby raised from 3.2 to 3.3 (`required_ruby_version
+  >= 3.3.0`). Ruby 3.2 reached end-of-life in March 2026.
+
+### Fixed
+
+- CI never ran on pushes: the workflow's `push` trigger pointed at a
+  placeholder branch (`.invalid`). It now runs on pushes to `main` as well as
+  on pull requests.
+- CI tested a single Ruby version. The `test` job now runs on every Ruby the
+  gemspec supports (3.3, 3.4, 4.0), installing without the `development` and
+  `tools` groups, whose gems require Ruby >= 4.0.
+- The packaged gem's file exclusion list still referenced the removed
+  `.rubocop.yml`. It now excludes the development-only `.rubyfmtignore`,
+  `.gitleaks.toml`, and `.pre-commit-config.yaml`, so they don't ship in the
+  `.gem`.
+- `rake types` (Steep) failed with two nil-safety errors in `Fetcher`:
+  `parse_url` re-read `uri.host` after its nil check, and the connect-fallback
+  error in `perform_request` had no declared type. Both are now typed
+  explicitly. Behavior is unchanged.
+
+### Security
+
+- Development dependencies with published advisories updated:
+  `concurrent-ruby` 1.3.6 → 1.3.8 and `json` 2.19.5 → 3.1.0 (both pulled in
+  by Steep). Neither is a runtime dependency of the gem.
+- New `rake security` task (bundler-audit + gitleaks), run by prek
+  pre-commit and pre-push hooks and by the CI `scan_ruby` and `secrets` jobs.
+
+### Development
+
+- Formatting moved from Standard/RuboCop to `rubyfmt`; the codebase was
+  reformatted accordingly. `rake lint` and `rake lint:all:autocorrect` now run
+  rubyfmt.
+- CI split into separate `test`, `lint`, `types`, `scan_ruby`, and `secrets`
+  jobs.
+
+## [0.1.2] - 2026-05-06
+
+### Fixed
+
+- Dual-stack hosts whose resolver returns AAAA before A on a network without
+  IPv6 reachability no longer surface `ResponseError: transport error:
+  Errno::EHOSTUNREACH`. `Fetcher#perform_request` now iterates over the full
+  pre-validated candidate list returned by `pin_addresses`, advancing to the
+  next address on connect-phase transport errors (`Errno::EHOSTUNREACH`,
+  `Errno::ENETUNREACH`, `Errno::ECONNREFUSED`, `Net::OpenTimeout`). Errors
+  raised after a connection is established (TLS handshake failure, read
+  timeout, post-connect `ECONNRESET`, non-2xx response) do **not** trigger
+  fallback — silently retrying against a different IP would mask real
+  problems.
+
+### Security
+
+- Strict dual-A SSRF rejection is preserved end-to-end. Validation runs
+  across the entire resolved address list before any socket opens, so the
+  fallback added above cannot weaken the "if any resolved address is in a
+  forbidden range, refuse the request" rule. A new HTTP-level test
+  exercises the dual-stack-with-one-forbidden-address case to lock this in.
+- Caller-supplied header validation now provably runs before any socket
+  attempt across the candidate list (regression-tested via the existing
+  CRLF / NUL header tests, which previously passed only because the single
+  pinned IP refused the connection first).
+
+### Documentation
+
+- `docs/REQUIREMENTS.md` §175 ("DNS resolution and IP pinning") rewritten:
+  step 4 now describes a candidate list rather than "the first remaining
+  address," and a new step 6 specifies the connect-phase fallback
+  semantics, what does *not* trigger fallback, and the exhaustion-error
+  shape (`TimeoutError` for `Net::OpenTimeout`, otherwise `ResponseError`).
+
 ## [0.1.1] - 2026-05-04
 
 Tooling and documentation only. No runtime behavior changes.

data/CLAUDE.md

@@ -12,8 +12,6 @@ Radioactive is a hardened HTTP fetcher for URLs supplied by untrusted users —
 
 The scaffold from `bundle gem radioactive` is still mostly untouched: `lib/radioactive.rb` defines only the module and a base `Error` class, `test/test_radioactive.rb` contains the generator's failing `assert false`, and the gemspec metadata (`summary`, `description`, `homepage`, `allowed_push_host`, `source_code_uri`, `changelog_uri`) is still TODO placeholders. Implementation work is greenfield — match the API surface in `docs/REQUIREMENTS.md` rather than inventing one.
 
-Note: the parent directory `/Users/pablo/code/posiczko/CLAUDE.md` documents a different project (Ougai). It does not apply here — Radioactive uses Minitest (not RSpec), Standard (not RuboCop directly), and has no Oj/JrJackson dependency.
-
 ## Architectural constraints (from the spec)
 
 These are non-negotiable design choices in `docs/REQUIREMENTS.md`. Don't propose changes that violate them without flagging the spec change first:
@@ -35,11 +33,16 @@ These are non-negotiable design choices in `docs/REQUIREMENTS.md`. Don't propose
 
 - `bin/setup` — install dependencies (wraps `bundle install`).
 - `bin/console` — IRB session with the gem preloaded.
-- `bundle exec rake` — default task: runs `test` then `standard` (lint). Both must pass.
+- `bundle exec rake` — default task: runs `test`, `lint`, then `types`. All must pass.
 - `bundle exec rake test` — Minitest suite (driven by `Minitest::TestTask`, picks up `test/**/test_*.rb`).
 - `bundle exec rake test TESTOPTS="--name=/pattern/"` — run a single test or matching subset.
 - `ruby -Ilib -Itest test/test_radioactive.rb` — run one test file directly without rake.
-- `bundle exec rake standard` / `bundle exec rake standard:fix` — lint / autofix.
+- `bundle exec rake lint` / `bundle exec rake lint:all:autocorrect` — run all linters / autofix.
+- `bundle exec rake lint:rubyfmt` / `lint:rubyfmt:autocorrect` — `rubyfmt` (Homebrew binary, not a gem) check / reformat; skips paths in `.rubyfmtignore`.
+- `bundle exec rake security` — bundler-audit + gitleaks; also runs as a pre-push hook (`prek install --hook-type pre-push`).
+- `bundle exec rake security:audit` — `bundler-audit` update + scan; also runs as a pre-commit hook on every commit.
+- `bundle exec rake security:gitleaks` — secret scan of the working tree (respects `.gitignore`). gitleaks also runs on staged changes (pre-commit) and on PR commits (CI `secrets` job); config and allowlists in `.gitleaks.toml`.
+- Pre-commit hooks (`.pre-commit-config.yaml`, run by `prek`) cover gitleaks, security audit, and rubyfmt. Install with `prek install`.
 - `bundle exec rake build` / `install` / `release` — gem packaging tasks (release is maintainer-only and currently blocked by the `allowed_push_host` TODO in the gemspec).
 
 ## Layout and conventions
@@ -48,5 +51,5 @@ These are non-negotiable design choices in `docs/REQUIREMENTS.md`. Don't propose
 - Long-form design docs live in `docs/`. `docs/REQUIREMENTS.md` is the spec; treat it as a contract and update it deliberately (in the same commit as behavior changes) rather than letting code and spec drift.
 - RBS signatures live in `sig/radioactive.rbs` — keep them in sync when adding public API.
 - Versioning: bump `Radioactive::VERSION` in `lib/radioactive/version.rb` for releases.
-- Ruby version: gemspec requires `>= 3.2.0`; `.standard.yml` pins the Standard target to `3.2`. Match that when writing code (no 3.3-only syntax unless you also bump these).
-- CI (`.github/workflows/main.yml`) only runs on pull requests — its `push` trigger is wired to a placeholder branch (`.invalid`), so pushes to `main` will not run CI until that's fixed. The matrix currently lists Ruby `'4.0.3'`, which does not exist; expect CI to fail until the version is corrected.
+- Ruby version: gemspec requires `>= 3.2.0`. Match that when writing code (no 3.3-only syntax unless you also bump it).
+- CI (`.github/workflows/main.yml`) runs on pushes to `main` and on pull requests. Jobs: `test` (matrix over Ruby 3.2–4.0, installed without the `development`/`tools` groups because some of those gems need Ruby >= 4.0, so tests are loaded directly rather than via rake), `lint` (rubyfmt binary, pinned to the Homebrew version), `types` (`rake types`), `scan_ruby` (bundler-audit), and `secrets` (gitleaks over the pushed/PR commits). When you add a Ruby version to the gemspec range or bump rubyfmt locally, update the workflow to match.

data/README.md

@@ -420,6 +420,13 @@ bundle exec ruby -Ilib -Itest test/test_fetcher.rb  # run one test file directly
 
 After checking out the repo, run `bin/setup` to install dependencies. Then, run `rake test` to run the tests. You can also run `bin/console` for an interactive prompt that will allow you to experiment.
 
+The formatter, secret scanner, and hook runner are standalone binaries rather than gems, so install them separately and then install the git hooks (see [Git hooks](#git-hooks)):
+
+```sh
+brew install rubyfmt gitleaks prek
+prek install && prek install --hook-type pre-push
+```
+
 To install this gem onto your local machine, run `bundle exec rake gem:install`. See [Releasing](#releasing) below for publishing a new version.
 
 ## Releasing
@@ -429,7 +436,7 @@ A release cuts a new version, tags it in git, and pushes the `.gem` to [rubygems
 ### Pre-flight
 
 1. `bundle exec rake` exits 0. Tests, lint, and type checks all green.
-2. `lib/radioactive/version.rb` bumped to the new version following [SemVer](https://semver.org).
+2. `lib/radioactive/version.rb` bumped to the new version following [SemVer](https://semver.org), followed by `bundle install` so the `radioactive (X.Y.Z)` lines in `Gemfile.lock` match. Commit both files together: if they disagree, the pre-commit `security:audit` hook fails because `bundle exec` rewrites the lockfile.
 3. `CHANGELOG.md` has a populated section for the new version with a date, and `[Unreleased]` is empty (or its contents have been moved into the new section).
 4. Working tree is clean (`rake gem:release` enforces this).
 5. You have an active rubygems session: `gem signin` if `gem whoami` returns nothing.
@@ -455,6 +462,18 @@ If anything fails midway (e.g. push rejected, MFA timeout), the tag may already
 - Bump `lib/radioactive/version.rb` to the next anticipated version with a `.dev` or `.alpha` suffix if you want subsequent local builds to be distinguishable from the release.
 - Push that commit; future changes accumulate under `[Unreleased]` until the next release.
 
+### Release Cheatsheet
+
+1. Edit  CHANGELOG.md             — add the [0.1.2] - 2026-05-06 section
+2. Edit  lib/radioactive/version.rb  — "0.1.1" → "0.1.2", then `bundle install` to sync Gemfile.lock
+3. Run   bundle exec rake         — confirm tests + lint + types still green
+4. Run   git status               — sanity check what's about to be committed
+5. Run   git add -A && git commit — single commit covering fix + version + changelog
+6. Run   git push origin main     — gets the commit on the remote before the tag
+7. Run   bundle exec rake gem:release   — guard_clean → build → tag → push → publish (MFA)
+8. Edit  lib/radioactive/version.rb  — bump to 0.1.3.dev (post-release commit), then `bundle install`
+9. Run   git add ... && git commit && git push
+ 
 ### Stronger publishing setup (optional)
 
 For a security-focused gem, consider [RubyGems Trusted Publishing](https://guides.rubygems.org/trusted-publishing/) instead of pushing from a developer machine: a tagged commit triggers a GitHub Actions workflow that authenticates to rubygems via OIDC and publishes without any long-lived API key on disk. Removes the "stolen laptop = compromised gem" risk and complements the MFA requirement.
@@ -516,15 +535,65 @@ Bug reports and pull requests are welcome on GitHub at https://github.com/[USERN
 
 ### Before opening a PR
 
-1. **Run the full check locally.** `bundle exec rake` runs tests, RuboCop, and the type check (`rbs validate` + `steep`). All three must pass.
+1. **Run the full check locally.** `bundle exec rake` runs tests, rubyfmt, and the type check (`rbs validate` + `steep`). All three must pass.
 2. **Update the spec if you're changing behavior.** The contract lives at [docs/REQUIREMENTS.md](docs/REQUIREMENTS.md). Code and spec drift is a bug - fix them in the same commit.
 3. **Update the signatures if you're changing the public API.** Any change to a public method on `Radioactive`, `Fetcher`, `Result`, or any error class needs a matching update in `sig/radioactive.rbs`. The Type checking section above covers what to do; `bundle exec rake types` will tell you when something's off.
 4. **Add a test.** Especially for security-sensitive paths: every defense in the threat model should have a test that proves the failure path actually closes. See `test/test_fetcher.rb` and `test/test_fetcher_http.rb` for patterns.
 
+### Security checks
+
+```sh
+bundle exec rake security           # run both checks below
+bundle exec rake security:audit     # bundler-audit: update advisory DB, scan Gemfile.lock
+bundle exec rake security:gitleaks  # gitleaks: scan the working tree for secrets
+```
+
+Secrets are scanned with [gitleaks](https://github.com/gitleaks/gitleaks)
+(`brew install gitleaks`), configured in `.gitleaks.toml`.
+
+### Git hooks
+
+Hooks are defined in `.pre-commit-config.yaml` and run by
+[prek](https://github.com/j178/prek) (`brew install prek`). Install them once
+per clone:
+
+```sh
+prek install                        # pre-commit
+prek install --hook-type pre-push   # pre-push
+```
+
+* **pre-commit:** gitleaks on staged changes, `security:audit` on every commit,
+  rubyfmt on staged `.rb` files.
+* **pre-push:** `rake security` (bundler-audit + gitleaks).
+
+CI (`.github/workflows/main.yml`) runs bundler-audit and gitleaks too, so
+skipping a hook with `--no-verify` only delays the failure.
+
+### CI
+
+`.github/workflows/main.yml` runs on pushes to `main` and on pull requests:
+
+| Job         | What it does                                                                                     |
+|-------------|--------------------------------------------------------------------------------------------------|
+| `test`      | Test suite on Ruby 3.2, 3.3, 3.4, and 4.0 (every version the gemspec supports).                  |
+| `lint`      | `rubyfmt --check .`, using the release binary pinned in `RUBYFMT_VERSION`.                        |
+| `types`     | `rake types` (`rbs validate` + `steep check`) on Ruby 4.0.                                       |
+| `scan_ruby` | `rake security:audit` against a freshly updated advisory database.                               |
+| `secrets`   | gitleaks over the commits the push or PR adds.                                                   |
+
+The `test` job installs gems without the `development` and `tools` groups, because some of those gems require Ruby >= 4.0, and loads the test files directly instead of through rake. When you widen the gemspec's Ruby range or upgrade rubyfmt locally, update the matrix or `RUBYFMT_VERSION` to match.
+
 ### Security issues
 
 Please report security-sensitive issues privately rather than via a public GitHub issue. (TODO: contact email or GitHub Security Advisory link.)
 
 ### Style
 
-The project uses [`standard`](https://github.com/standardrb/standard) (via RuboCop) for formatting. `bundle exec rake lint` reports issues; `bundle exec rake lint:rubocop:autocorrect` fixes the autocorrectable ones.
+The project uses [`rubyfmt`](https://github.com/fables-tales/rubyfmt) for formatting. It's a standalone binary, not a gem: `brew install rubyfmt`. Paths in `.rubyfmtignore` are skipped.
+
+```sh
+bundle exec rake lint                        # run all linters (currently rubyfmt)
+bundle exec rake lint:all:autocorrect        # apply all autocorrects
+bundle exec rake lint:rubyfmt                # check formatting
+bundle exec rake lint:rubyfmt:autocorrect    # reformat in place
+```

data/lib/radioactive/address_check.rb

@@ -29,7 +29,9 @@ module Radioactive
       fc00::/7
       fe80::/10
       ff00::/8
-    ].map { |cidr| IPAddr.new(cidr) }.freeze
+    ]
+      .map { |cidr| IPAddr.new(cidr) }
+      .freeze
 
     module_function
 

data/lib/radioactive/errors.rb

@@ -1,19 +1,26 @@
 # frozen_string_literal: true
 
 module Radioactive
-  class Error < StandardError; end
+  class Error < StandardError
+  end
 
-  class SchemeError < Error; end
+  class SchemeError < Error
+  end
 
-  class AddressError < Error; end
+  class AddressError < Error
+  end
 
-  class TimeoutError < Error; end
+  class TimeoutError < Error
+  end
 
-  class SizeError < Error; end
+  class SizeError < Error
+  end
 
-  class RedirectError < Error; end
+  class RedirectError < Error
+  end
 
-  class EncodingError < Error; end
+  class EncodingError < Error
+  end
 
   class ResponseError < Error
     attr_reader :status, :headers, :body

data/lib/radioactive/fetcher.rb

@@ -15,6 +15,18 @@ module Radioactive
     CHUNK_SIZE = 16 * 1024
     DEFAULT_USER_AGENT = "Radioactive/#{Radioactive::VERSION}"
 
+    # Connect-phase transport failures that justify trying the next pinned
+    # candidate. Anything else (TLS handshake failure, read timeout,
+    # post-connect ECONNRESET) is terminal — the server engaged with us, so
+    # silently retrying against a different IP would mask real problems and
+    # risks duplicating side-effecting requests in a future non-GET world.
+    CONNECT_FALLBACK_ERRORS = [
+      Errno::EHOSTUNREACH,
+      Errno::ENETUNREACH,
+      Errno::ECONNREFUSED,
+      Net::OpenTimeout
+    ].freeze
+
     # Single-label hosts that are entirely digits or 0x-prefix hex are not
     # valid RFC 1123 hostnames; they're SSRF-bypass attempts that some libc
     # getaddrinfo implementations historically resolved as IPs.
@@ -84,6 +96,7 @@ module Radioactive
       if opts.key?(:max_redirects) && opts[:max_redirects].negative?
         raise ArgumentError, "max_redirects must be >= 0"
       end
+
       if opts.key?(:max_size) && opts[:max_size] <= 0
         raise ArgumentError, "max_size must be > 0"
       end
@@ -110,8 +123,8 @@ module Radioactive
       loop do
         check_deadline(deadline, clock)
 
-        ip = pin_address(current, resolver, opts)
-        kind, status, headers, body = perform_request(current, ip, opts, deadline, clock, &chunk_block)
+        ips = pin_addresses(current, resolver, opts)
+        kind, status, headers, body = perform_request(current, ips, opts, deadline, clock, &chunk_block)
 
         case kind
         when :redirect
@@ -122,9 +135,13 @@ module Radioactive
           current = resolve_redirect(current, headers["location"], opts)
         when :final
           unless (200..299).cover?(status)
-            raise ResponseError.new(
-              "non-success status: #{status}",
-              status: status, headers: headers, body: body
+            raise(
+              ResponseError.new(
+                "non-success status: #{status}",
+                status: status,
+                headers: headers,
+                body: body
+              )
             )
           end
 
@@ -141,15 +158,17 @@ module Radioactive
 
     def parse_url(url, opts)
       uri = url.is_a?(URI) ? url.dup : URI.parse(url.to_s)
-      raise SchemeError, "URL has no host" if uri.host.nil? || uri.host.empty?
+      host = uri.host
+      raise SchemeError, "URL has no host" if host.nil? || host.empty?
       unless opts[:schemes].include?(uri.scheme)
         raise SchemeError, "scheme not allowed: #{uri.scheme.inspect}"
       end
+
       if (uri.userinfo || uri.user) && !opts[:allow_credentials]
         raise SchemeError, "embedded credentials not allowed"
       end
 
-      uri.host = canonicalize_host(uri.host)
+      uri.host = canonicalize_host(host)
       uri.fragment = nil
       uri
     rescue URI::InvalidURIError => e
@@ -170,8 +189,13 @@ module Radioactive
       host
     end
 
-    def pin_address(uri, resolver, opts)
-      host = uri.host or raise AddressError, "URL has no host"
+    # Resolve the host once and validate every address against the forbidden
+    # ranges before returning. Returns the full list in resolver order so the
+    # connect loop can fall back across dual-stack records when one path is
+    # down — the strict "any forbidden → reject" rule still defeats dual-A
+    # SSRF because validation runs upfront, before any socket opens.
+    def pin_addresses(uri, resolver, opts)
+      host = uri.host or raise(AddressError, "URL has no host")
       addresses = AddressCheck.resolve(host, resolver)
       raise AddressError, "no addresses for #{host}" if addresses.empty?
 
@@ -183,7 +207,7 @@ module Radioactive
         end
       end
 
-      addresses.first
+      addresses
     end
 
     def resolve_redirect(current, location, opts)
@@ -209,44 +233,84 @@ module Radioactive
       [value, remaining].min
     end
 
-    def perform_request(uri, ip, opts, deadline, clock, &chunk_block)
-      http = build_http(uri, ip, opts, deadline, clock)
+    def perform_request(uri, ips, opts, deadline, clock, &chunk_block)
+      # Build the request up front so caller-supplied input (e.g. CRLF in
+      # headers) is rejected before any socket opens — independent of which
+      # candidate we'd reach.
       req = build_request(uri, opts)
+      # @type var last_connect_error: Exception?
+      last_connect_error = nil
 
-      result = nil
-      begin
-        http.start do |conn|
-          conn.request(req) do |res|
-            code = res.code.to_i
-            headers = headers_hash(res)
-
-            if REDIRECT_STATUSES.include?(code) && headers["location"]
-              result = [:redirect, code, headers, nil]
-            elsif (200..299).cover?(code)
-              # 2xx: stream chunks straight to caller; no buffering here.
-              read_body!(res, headers, opts, deadline, clock, &chunk_block)
-              result = [:final, code, headers, nil]
-            else
-              # Non-2xx: buffer body so ResponseError can carry partial data.
-              error_body = String.new(capacity: CHUNK_SIZE)
-              read_body!(res, headers, opts, deadline, clock) { |chunk| error_body << chunk }
-              result = [:final, code, headers, error_body]
-            end
+      ips.each do |ip|
+        http = build_http(uri, ip, opts, deadline, clock)
+
+        begin
+          http.start
+        rescue *CONNECT_FALLBACK_ERRORS => e
+          last_connect_error = e
+          next
+        rescue OpenSSL::SSL::SSLError,
+          SocketError,
+          Errno::ECONNRESET,
+          IOError => e
+          raise ResponseError, "transport error: #{e.class}: #{e.message}"
+        end
+
+        begin
+          return execute_request(http, req, opts, deadline, clock, &chunk_block)
+        rescue Net::OpenTimeout, Net::ReadTimeout => e
+          raise TimeoutError, e.message
+        rescue OpenSSL::SSL::SSLError,
+          SocketError,
+          Errno::ECONNREFUSED,
+          Errno::EHOSTUNREACH,
+          Errno::ENETUNREACH,
+          Errno::ECONNRESET,
+          IOError => e
+          raise ResponseError, "transport error: #{e.class}: #{e.message}"
+        ensure
+          begin
+            http.finish if http.started?
+          rescue IOError
+            # already closed
           end
         end
-      rescue Net::OpenTimeout, Net::ReadTimeout => e
-        raise TimeoutError, e.message
-      rescue OpenSSL::SSL::SSLError, SocketError, Errno::ECONNREFUSED,
-        Errno::EHOSTUNREACH, Errno::ENETUNREACH, Errno::ECONNRESET,
-        IOError => e
-        raise ResponseError, "transport error: #{e.class}: #{e.message}"
+      end
+
+      # All candidates failed at connect. Surface the last error in the same
+      # shape a single-address failure would have taken. pin_addresses never
+      # returns an empty list, so the nil branch is unreachable.
+      raise ResponseError, "no candidate addresses" if last_connect_error.nil?
+      raise TimeoutError, last_connect_error.message if last_connect_error.is_a?(Net::OpenTimeout)
+      raise ResponseError, "transport error: #{last_connect_error.class}: #{last_connect_error.message}"
+    end
+
+    def execute_request(http, req, opts, deadline, clock, &chunk_block)
+      result = nil
+
+      http.request(req) do |res|
+        code = res.code.to_i
+        headers = headers_hash(res)
+
+        if REDIRECT_STATUSES.include?(code) && headers["location"]
+          result = [:redirect, code, headers, nil]
+        elsif (200..299).cover?(code)
+          # 2xx: stream chunks straight to caller; no buffering here.
+          read_body!(res, headers, opts, deadline, clock, &chunk_block)
+          result = [:final, code, headers, nil]
+        else
+          # Non-2xx: buffer body so ResponseError can carry partial data.
+          error_body = String.new(capacity: CHUNK_SIZE)
+          read_body!(res, headers, opts, deadline, clock) { |chunk| error_body << chunk }
+          result = [:final, code, headers, error_body]
+        end
       end
 
       result || raise(ResponseError, "request produced no response")
     end
 
     def build_http(uri, ip, opts, deadline, clock)
-      host = uri.host or raise SchemeError, "URL has no host"
+      host = uri.host or raise(SchemeError, "URL has no host")
       port = uri.port || ((uri.scheme == "https") ? 443 : 80)
       http = Net::HTTP.new(host, port)
       http.ipaddr = ip.to_s
@@ -256,12 +320,15 @@ module Radioactive
       if (open_t = clamp_timeout(opts[:open_timeout], deadline, clock))
         http.open_timeout = open_t
       end
+
       if (read_t = clamp_timeout(opts[:read_timeout], deadline, clock))
         http.read_timeout = read_t
       end
+
       if http.respond_to?(:write_timeout=) && (write_t = clamp_timeout(opts[:open_timeout], deadline, clock))
         http.write_timeout = write_t
       end
+
       http
     end
 
@@ -282,6 +349,7 @@ module Radioactive
 
         req[name] = value
       end
+
       req
     end
 
@@ -334,6 +402,7 @@ module Radioactive
 
           yield decoded unless decoded.empty?
         end
+
         tail = inflater.finish
         unless tail.empty?
           total += tail.bytesize
@@ -341,6 +410,7 @@ module Radioactive
 
           yield tail
         end
+
       rescue Zlib::Error => e
         raise EncodingError, "gzip decode failed: #{e.message}"
       ensure

data/lib/radioactive/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Radioactive
-  VERSION = "0.1.1"
+  VERSION = "0.1.3"
 end

data/lib/radioactive.rb

@@ -1,6 +1,7 @@
 # frozen_string_literal: true
 
 require "zeitwerk"
+
 loader = Zeitwerk::Loader.for_gem
 loader.ignore("#{__dir__}/radioactive/errors.rb")
 loader.setup

data/lib/tasks/lint/all.rake

@@ -1,11 +1,11 @@
 namespace :lint do
   desc "Run all linter checks"
-  task all: %i[rubocop] do
+  task all: %i[rubyfmt] do
     puts "All lints completed successfully!"
   end
 
   namespace :all do
     desc "Run all linter autocorrects"
-    task autocorrect: %i[rubocop:autocorrect]
+    task autocorrect: %i[rubyfmt:autocorrect]
   end
 end

data/lib/tasks/lint/rubyfmt.rake

@@ -0,0 +1,13 @@
+namespace :lint do
+  desc "Run rubyfmt formatter check"
+  task :rubyfmt do
+    sh "rubyfmt --check ."
+  end
+
+  namespace :rubyfmt do
+    desc "Run rubyfmt autocorrect"
+    task :autocorrect do
+      sh "rubyfmt --in-place ."
+    end
+  end
+end

data/lib/tasks/security/all.rake

@@ -0,0 +1,2 @@
+desc "Run all security checks (bundler-audit and gitleaks)"
+task security: %w[security:audit security:gitleaks]

data/lib/tasks/security/gitleaks.rake

@@ -0,0 +1,6 @@
+namespace :security do
+  desc "Scan the working tree for secrets with gitleaks"
+  task :gitleaks do
+    sh "gitleaks dir --no-banner --redact ."
+  end
+end

data/sig/radioactive.rbs

@@ -136,6 +136,7 @@ module Radioactive
     RESERVED_HEADERS: Array[String]
     CHUNK_SIZE: Integer
     DEFAULT_USER_AGENT: String
+    CONNECT_FALLBACK_ERRORS: Array[Class]
     NUMERIC_ONLY_HOST: Regexp
     HEADER_INVALID_CHAR: Regexp
     DEFAULTS: Hash[Symbol, untyped]
@@ -219,11 +220,12 @@ module Radioactive
     def run_streaming: (uri_like url, Hash[Symbol, untyped] call_opts) { (String) -> void } -> Hash[Symbol, untyped]
     def parse_url: (uri_like url, Hash[Symbol, untyped] opts) -> URI::Generic
     def canonicalize_host: (String host) -> String
-    def pin_address: (URI::Generic uri, AddressCheck::_Resolver resolver, Hash[Symbol, untyped] opts) -> IPAddr
+    def pin_addresses: (URI::Generic uri, AddressCheck::_Resolver resolver, Hash[Symbol, untyped] opts) -> Array[IPAddr]
     def resolve_redirect: (URI::Generic current, String location, Hash[Symbol, untyped] opts) -> URI::Generic
     def check_deadline: (Float? deadline, _Clock clock) -> void
     def clamp_timeout: ((Float | Integer)? value, Float? deadline, _Clock clock) -> (Float | Integer)?
-    def perform_request: (URI::Generic uri, IPAddr ip, Hash[Symbol, untyped] opts, Float? deadline, _Clock clock) { (String) -> void } -> Array[untyped]
+    def perform_request: (URI::Generic uri, Array[IPAddr] ips, Hash[Symbol, untyped] opts, Float? deadline, _Clock clock) { (String) -> void } -> Array[untyped]
+    def execute_request: (Net::HTTP http, Net::HTTPRequest req, Hash[Symbol, untyped] opts, Float? deadline, _Clock clock) { (String) -> void } -> Array[untyped]
     def build_http: (URI::Generic uri, IPAddr ip, Hash[Symbol, untyped] opts, Float? deadline, _Clock clock) -> Net::HTTP
     def build_request: (URI::Generic uri, Hash[Symbol, untyped] opts) -> Net::HTTPRequest
     def headers_hash: (Net::HTTPResponse res) -> header_hash

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: radioactive
 version: !ruby/object:Gem::Version
-  version: 0.1.1
+  version: 0.1.3
 platform: ruby
 authors:
 - Pawel Osiczko
@@ -75,8 +75,10 @@ files:
 - lib/radioactive/version.rb
 - lib/tasks/gem.rake
 - lib/tasks/lint/all.rake
-- lib/tasks/lint/rubocop.rake
-- lib/tasks/security.rake
+- lib/tasks/lint/rubyfmt.rake
+- lib/tasks/security/all.rake
+- lib/tasks/security/bundler_audit.rake
+- lib/tasks/security/gitleaks.rake
 - lib/tasks/types.rake
 - sig/radioactive.rbs
 - sig/zeitwerk.rbs
@@ -98,14 +100,14 @@ required_ruby_version: !ruby/object:Gem::Requirement
   requirements:
   - - ">="
     - !ruby/object:Gem::Version
-      version: 3.2.0
+      version: 3.3.0
 required_rubygems_version: !ruby/object:Gem::Requirement
   requirements:
   - - ">="
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 4.0.11
+rubygems_version: 4.0.23
 specification_version: 4
 summary: Hardened HTTP fetcher for Ruby. Safe to point at URLs supplied by untrusted
   users.

data/lib/tasks/lint/rubocop.rake

@@ -1,15 +0,0 @@
-require "rubocop/rake_task"
-
-namespace :lint do
-  desc "Run rubocop linter check"
-  task :rubocop do
-    exec "bundle exec rubocop"
-  end
-
-  namespace :rubocop do
-    desc "Run rubocop autocorrect"
-    task :autocorrect do
-      exec "bundle exec rubocop --autocorrect-all"
-    end
-  end
-end