@gajae-code/coding-agent 0.11.6 → 0.11.7

package/src/utils/shell-snapshot.ts

@@ -5,13 +5,15 @@
  * .bashrc/.zshrc, which can be sourced before each command to provide a familiar
  * shell experience.
  */
-import * as fs from "node:fs";
+import * as fs from "node:fs/promises";
 import * as os from "node:os";
 import * as path from "node:path";
 import { postmortem } from "@gajae-code/utils";
 
-const cachedSnapshotPaths = new Map<string, string>();
 const SNAPSHOT_TIMEOUT_MS = 2_000;
+const SNAPSHOT_ROOT_PREFIX = "gjc-shell-snapshots-";
+const PRIVATE_DIRECTORY_MODE = 0o700;
+const PRIVATE_FILE_MODE = 0o600;
 
 function sanitizeSnapshotEnv(env: Record<string, string | undefined>): Record<string, string | undefined> {
 	const sanitized = { ...env };
@@ -23,8 +25,7 @@ function sanitizeSnapshotEnv(env: Record<string, string | undefined>): Record<st
 /**
  * Get the user's shell config file path.
  */
-function getShellConfigFile(shell: string): string {
-	const home = os.homedir();
+function getShellConfigFile(shell: string, home: string): string {
 	if (shell.includes("zsh")) return path.join(home, ".zshrc");
 	if (shell.includes("bash")) return path.join(home, ".bashrc");
 	return path.join(home, ".profile");
@@ -35,8 +36,7 @@ function getShellConfigFile(shell: string): string {
  * This script sources the user's rc file and extracts functions, aliases, and options.
  * Matches Anthropic Code's snapshot generation logic.
  */
-function generateSnapshotScript(shell: string, snapshotPath: string, rcFile: string): string {
-	const hasRcFile = fs.existsSync(rcFile);
+function generateSnapshotScript(shell: string, snapshotPath: string, rcFile: string, hasRcFile: boolean): string {
 	const isZsh = shell.includes("zsh");
 	const commonToolsRegex =
 		"^(ls|dir|vdir|cat|head|tail|less|more|grep|egrep|fgrep|rg|find|fd|locate|sed|awk|perl|cp|mv|rm|mkdir|rmdir|touch|chmod|chown|ln|pwd|readlink|stat|cut|sort|uniq|xargs|tee|tr|basename|dirname)$";
@@ -79,6 +79,7 @@ echo "shopt -s expand_aliases" >> "$SNAPSHOT_FILE"
 `;
 
 	return `
+umask 077
 SNAPSHOT_FILE='${escapedPath}'
 
 # Source user's rc file if it exists
@@ -114,74 +115,183 @@ fi
 `.trim();
 }
 
-/**
- * Create a shell snapshot, caching the result.
- * Returns the path to the snapshot file, or null if creation failed.
- */
-export async function getOrCreateSnapshot(
-	shell: string,
-	env: Record<string, string | undefined>,
-): Promise<string | null> {
-	const cacheKey = shell;
-	// Return cached snapshot if valid
-	const cached = cachedSnapshotPaths.get(cacheKey);
-	if (cached && fs.existsSync(cached)) {
-		return cached;
-	}
-	if (cached) {
-		cachedSnapshotPaths.delete(cacheKey);
-	}
+interface ShellSnapshotCacheOptions {
+	tempRoot: string;
+	home: string | (() => string);
+	platform: NodeJS.Platform;
+}
 
-	// Skip on Windows (no .bashrc in standard location)
-	if (process.platform === "win32") {
-		return null;
+function ownedByCurrentUser(uid: number): boolean {
+	return typeof process.getuid !== "function" || uid === process.getuid();
+}
+
+async function isTrustedSnapshot(snapshotPath: string): Promise<boolean> {
+	try {
+		const stat = await fs.lstat(snapshotPath);
+		return stat.isFile() && !stat.isSymbolicLink() && ownedByCurrentUser(stat.uid) && (stat.mode & 0o077) === 0;
+	} catch {
+		return false;
 	}
+}
 
-	const rcFile = getShellConfigFile(shell);
+function createShellSnapshotCache(options: ShellSnapshotCacheOptions) {
+	const cachedPaths = new Map<string, string>();
+	const inFlight = new Map<string, Promise<string | null>>();
+	let rootPath: string | null = null;
+	let rootInitialization: Promise<string> | null = null;
+	let cleanupAttempt: Promise<void> | null = null;
+	let cleaningUp = false;
+	let lifecycle = 0;
 
-	// Create snapshot directory
-	const snapshotDir = path.join(os.tmpdir(), "gjc-shell-snapshots");
-	fs.mkdirSync(snapshotDir, { recursive: true });
+	async function initializeRoot(): Promise<string> {
+		const root = await fs.mkdtemp(path.join(options.tempRoot, SNAPSHOT_ROOT_PREFIX));
+		try {
+			await fs.chmod(root, PRIVATE_DIRECTORY_MODE);
+			const stat = await fs.lstat(root);
+			if (
+				!stat.isDirectory() ||
+				stat.isSymbolicLink() ||
+				!ownedByCurrentUser(stat.uid) ||
+				(stat.mode & 0o777) !== 0o700
+			) {
+				throw new Error("Shell snapshot root is not owner-private");
+			}
+			return root;
+		} catch (error) {
+			await fs.rm(root, { recursive: true, force: true }).catch(() => {});
+			throw error;
+		}
+	}
+
+	async function getRoot(): Promise<string> {
+		if (rootPath) return rootPath;
+		if (rootInitialization) return await rootInitialization;
+		const attempt = initializeRoot();
+		rootInitialization = attempt;
+		try {
+			rootPath = await attempt;
+			return rootPath;
+		} catch (error) {
+			if (rootInitialization === attempt) rootInitialization = null;
+			throw error;
+		}
+	}
 
-	// Generate unique snapshot path
-	const shellName = shell.includes("zsh") ? "zsh" : shell.includes("bash") ? "bash" : "sh";
-	const snapshotPath = path.join(snapshotDir, `snapshot-${shellName}-${crypto.randomUUID()}.sh`);
+	async function createSnapshot(shell: string, env: Record<string, string | undefined>): Promise<string | null> {
+		const root = await getRoot();
+		const shellName = shell.includes("zsh") ? "zsh" : shell.includes("bash") ? "bash" : "sh";
+		const snapshotPath = path.join(root, `snapshot-${shellName}-${crypto.randomUUID()}.sh`);
+		let keep = false;
+		try {
+			const handle = await fs.open(snapshotPath, "wx", PRIVATE_FILE_MODE);
+			try {
+				await handle.chmod(PRIVATE_FILE_MODE);
+			} finally {
+				await handle.close();
+			}
 
-	// Generate and execute snapshot script
-	const script = generateSnapshotScript(shell, snapshotPath, rcFile);
+			const home = typeof options.home === "function" ? options.home() : options.home;
+			const rcFile = getShellConfigFile(shell, home);
+			const script = generateSnapshotScript(shell, snapshotPath, rcFile, await Bun.file(rcFile).exists());
+			const snapshotEnv = sanitizeSnapshotEnv(env);
+			const spawnEnv: Record<string, string> = {};
+			for (const [key, value] of Object.entries(snapshotEnv)) {
+				if (value !== undefined) spawnEnv[key] = value;
+			}
+			const child = Bun.spawn([shell, "-c", script], {
+				env: spawnEnv,
+				stdin: "ignore",
+				stdout: "ignore",
+				stderr: "ignore",
+				timeout: SNAPSHOT_TIMEOUT_MS,
+				killSignal: "SIGKILL",
+			});
 
-	try {
-		const snapshotEnv = sanitizeSnapshotEnv(env);
-		const spawnEnv: Record<string, string> = {};
-		for (const [key, value] of Object.entries(snapshotEnv)) {
-			if (value !== undefined) {
-				spawnEnv[key] = value;
+			await child.exited;
+			if (child.exitCode === 0 && (await isTrustedSnapshot(snapshotPath))) {
+				cachedPaths.set(shell, snapshotPath);
+				keep = true;
+				return snapshotPath;
 			}
+		} catch {
+			// Snapshot creation failed, proceed without it.
+		} finally {
+			if (!keep) await fs.unlink(snapshotPath).catch(() => {});
 		}
-		const child = Bun.spawn([shell, "-c", script], {
-			env: spawnEnv,
-			stdin: "ignore",
-			stdout: "ignore",
-			stderr: "ignore",
-			timeout: SNAPSHOT_TIMEOUT_MS,
-			killSignal: "SIGKILL",
-		});
-
-		await child.exited;
-		if (child.exitCode === 0 && fs.existsSync(snapshotPath)) {
-			cachedSnapshotPaths.set(cacheKey, snapshotPath);
-			return snapshotPath;
-		}
-	} catch {
-		// Snapshot creation failed, proceed without it
+		return null;
 	}
 
-	return null;
+	return {
+		async getOrCreateSnapshot(shell: string, env: Record<string, string | undefined>) {
+			if (options.platform === "win32" || cleaningUp) return null;
+			const currentLifecycle = lifecycle;
+			const cached = cachedPaths.get(shell);
+			if (cached && (await isTrustedSnapshot(cached))) {
+				return cleaningUp || lifecycle !== currentLifecycle ? null : cached;
+			}
+			if (cleaningUp || lifecycle !== currentLifecycle) return null;
+			if (cached) cachedPaths.delete(shell);
+			const pending = inFlight.get(shell);
+			if (pending) {
+				const snapshot = await pending;
+				return cleaningUp || lifecycle !== currentLifecycle ? null : snapshot;
+			}
+			const attempt = createSnapshot(shell, env);
+			inFlight.set(shell, attempt);
+			try {
+				const snapshot = await attempt;
+				return cleaningUp || lifecycle !== currentLifecycle ? null : snapshot;
+			} finally {
+				if (inFlight.get(shell) === attempt) inFlight.delete(shell);
+			}
+		},
+		async cleanup() {
+			if (cleanupAttempt) return await cleanupAttempt;
+			const attempt = (async () => {
+				cleaningUp = true;
+				lifecycle += 1;
+				try {
+					const pending: Promise<unknown>[] = [...inFlight.values()];
+					if (rootInitialization) pending.push(rootInitialization);
+					await Promise.allSettled(pending);
+					const root = rootPath ?? (await rootInitialization?.catch(() => null)) ?? null;
+					cachedPaths.clear();
+					inFlight.clear();
+					rootPath = null;
+					rootInitialization = null;
+					if (root) await fs.rm(root, { recursive: true, force: true });
+				} finally {
+					cleaningUp = false;
+				}
+			})();
+			cleanupAttempt = attempt;
+			try {
+				await attempt;
+			} finally {
+				if (cleanupAttempt === attempt) cleanupAttempt = null;
+			}
+		},
+	};
 }
 
-postmortem.register("shell-snapshot", () => {
-	for (const snapshotPath of cachedSnapshotPaths.values()) {
-		fs.unlinkSync(snapshotPath);
-	}
-	cachedSnapshotPaths.clear();
+/** @internal Test-only factory for isolated filesystem and platform assertions. */
+export const createShellSnapshotCacheForTesting = createShellSnapshotCache;
+
+const processSnapshotCache = createShellSnapshotCache({
+	tempRoot: os.tmpdir(),
+	home: () => os.homedir(),
+	platform: process.platform,
 });
+
+/**
+ * Create a shell snapshot, caching the result.
+ * Returns the path to the snapshot file, or null if creation failed.
+ */
+export async function getOrCreateSnapshot(
+	shell: string,
+	env: Record<string, string | undefined>,
+): Promise<string | null> {
+	return await processSnapshotCache.getOrCreateSnapshot(shell, env);
+}
+
+postmortem.register("shell-snapshot", () => processSnapshotCache.cleanup());

package/src/web/insane/bridge.ts

@@ -31,6 +31,7 @@ const KILL_GRACE_MS = 2_000;
 
 /** Stable note prefixes — tests assert on these without depending on full stderr. */
 export const INSANE_NOTES = {
+	securityDisabled: `insane fallback disabled: remote renderer cannot preserve validated network routing`,
 	guardBlocked: (reason: string) => `insane fallback blocked: target URL is not public HTTP(S): ${reason}`,
 	vendorMissing: `insane fallback unavailable: vendor engine missing at packages/coding-agent/vendor/insane-search`,
 	noPython: `insane fallback unavailable: python3 not found; install python3 and curl_cffi, then retry with web.insaneFallback=true`,
@@ -325,8 +326,11 @@ function mapEngineOutput(raw: EngineRawOutput, timeoutMs: number): InsaneBridgeR
  * (which MUST run before this is called). Never throws; always returns a result.
  */
 export async function tryInsaneFetch(url: string, options: TryInsaneFetchOptions = {}): Promise<InsaneBridgeResult> {
+	if (!options.runner) {
+		return { ok: false, reason: "disabled-security", notes: [INSANE_NOTES.securityDisabled] };
+	}
 	const prober = options.prober ?? probeInsaneDependencies;
-	const runner = options.runner ?? (inv => runEngineSubprocess(inv));
+	const runner = options.runner;
 	const limit = options.concurrencyLimit ?? DEFAULT_CONCURRENCY;
 
 	const deps = await prober();

package/src/web/insane/url-guard.ts

@@ -28,12 +28,36 @@ export type PublicUrlResult = PublicUrlAccepted | PublicUrlRejected;
 /** Resolver seam so tests can inject DNS results without real lookups. */
 export type AddressResolver = (hostname: string) => Promise<string[]>;
 
+type ProxyEnvironment = Record<string, string | undefined>;
+
+export type GuardedPublicFetchResult =
+	| { ok: true; response: Response; logicalUrl: URL; wireUrl: URL }
+	| { ok: false; reason: string; logicalUrl: string };
+
 const defaultResolver: AddressResolver = async hostname => {
 	const records = await dns.lookup(hostname, { all: true, verbatim: true });
 	return records.map(record => record.address);
 };
 
 const BLOCKED_HOSTNAMES = new Set(["localhost", "localhost.localdomain", "0.0.0.0", ""]);
+const PROXY_ENV_KEYS = ["HTTP_PROXY", "http_proxy", "HTTPS_PROXY", "https_proxy", "ALL_PROXY", "all_proxy"] as const;
+
+export function hasConfiguredProxy(env: ProxyEnvironment): boolean {
+	return PROXY_ENV_KEYS.some(key => Boolean(env[key]));
+}
+
+async function resolveWithSignal(resolver: AddressResolver, hostname: string, signal?: AbortSignal): Promise<string[]> {
+	if (!signal) return resolver(hostname);
+	if (signal.aborted) throw signal.reason;
+	const { promise, reject } = Promise.withResolvers<never>();
+	const onAbort = () => reject(signal.reason);
+	signal.addEventListener("abort", onAbort, { once: true });
+	try {
+		return await Promise.race([resolver(hostname), promise]);
+	} finally {
+		signal.removeEventListener("abort", onAbort);
+	}
+}
 
 function isBlockedHostname(hostname: string): boolean {
 	const normalized = hostname.toLowerCase().replace(/\.$/, "");
@@ -67,37 +91,81 @@ function isPrivateIPv4(address: string): boolean {
 	);
 }
 
-function normalizeIPv4MappedIPv6(address: string): string {
-	return address.toLowerCase().startsWith("::ffff:") ? address.slice(7) : address;
+function parseIPv6Bytes(address: string): Uint8Array | undefined {
+	let normalized = address.toLowerCase();
+	const ipv4Tail = normalized.slice(normalized.lastIndexOf(":") + 1);
+	if (ipv4Tail.includes(".")) {
+		const parts = ipv4Tail.split(".").map(part => Number.parseInt(part, 10));
+		if (parts.length !== 4 || parts.some(part => !Number.isInteger(part) || part < 0 || part > 255)) return;
+		normalized = `${normalized.slice(0, normalized.lastIndexOf(":") + 1)}${((parts[0] << 8) | parts[1]).toString(16)}:${((parts[2] << 8) | parts[3]).toString(16)}`;
+	}
+
+	const halves = normalized.split("::");
+	if (halves.length > 2) return;
+	const left = halves[0] ? halves[0].split(":") : [];
+	const right = halves[1] ? halves[1].split(":") : [];
+	const omitted = 8 - left.length - right.length;
+	if ((halves.length === 1 && omitted !== 0) || (halves.length === 2 && omitted < 1)) return;
+	const words = [...left, ...Array.from({ length: omitted }, () => "0"), ...right];
+	if (words.length !== 8 || words.some(word => !/^[0-9a-f]{1,4}$/.test(word))) return;
+
+	const bytes = new Uint8Array(16);
+	for (let index = 0; index < words.length; index++) {
+		const word = Number.parseInt(words[index], 16);
+		bytes[index * 2] = word >> 8;
+		bytes[index * 2 + 1] = word & 0xff;
+	}
+	return bytes;
+}
+
+interface IPv6Cidr {
+	network: Uint8Array;
+	prefixLength: number;
+}
+
+function ipv6Cidr(network: string, prefixLength: number): IPv6Cidr {
+	const bytes = parseIPv6Bytes(network);
+	if (!bytes) throw new Error(`Invalid static IPv6 CIDR: ${network}/${prefixLength}`);
+	return { network: bytes, prefixLength };
 }
 
+function matchesIPv6Cidr(address: Uint8Array, cidr: IPv6Cidr): boolean {
+	const wholeBytes = Math.floor(cidr.prefixLength / 8);
+	for (let index = 0; index < wholeBytes; index++) {
+		if (address[index] !== cidr.network[index]) return false;
+	}
+	const remainingBits = cidr.prefixLength % 8;
+	if (remainingBits === 0) return true;
+	const mask = (0xff << (8 - remainingBits)) & 0xff;
+	return (address[wholeBytes] & mask) === (cidr.network[wholeBytes] & mask);
+}
+
+const IPV6_GLOBAL_UNICAST = ipv6Cidr("2000::", 3);
+const BLOCKED_GLOBAL_IPV6_RANGES = [
+	ipv6Cidr("2001::", 23), // IETF protocol assignments
+	ipv6Cidr("2001:db8::", 32), // documentation
+	ipv6Cidr("2002::", 16), // 6to4
+	ipv6Cidr("2620:4f:8000::", 48), // AS112 service
+	ipv6Cidr("3ffe::", 16), // returned 6bone range
+	ipv6Cidr("3fff::", 20), // documentation
+] as const;
+
 function isPrivateIPv6(address: string): boolean {
-	const normalized = address.toLowerCase();
-	const mapped = normalizeIPv4MappedIPv6(normalized);
-	if (mapped !== normalized && net.isIP(mapped) === 4) return isPrivateIPv4(mapped);
+	const bytes = parseIPv6Bytes(address);
+	if (!bytes) return true;
+	const isIPv4Mapped = bytes.subarray(0, 10).every(byte => byte === 0) && bytes[10] === 0xff && bytes[11] === 0xff;
+	if (isIPv4Mapped) return isPrivateIPv4(`${bytes[12]}.${bytes[13]}.${bytes[14]}.${bytes[15]}`);
 	return (
-		normalized === "::" || // unspecified
-		normalized === "::1" || // loopback
-		normalized.startsWith("fc") || // ULA fc00::/7
-		normalized.startsWith("fd") || // ULA
-		normalized.startsWith("fe8") || // link-local fe80::/10
-		normalized.startsWith("fe9") ||
-		normalized.startsWith("fea") ||
-		normalized.startsWith("feb") ||
-		normalized.startsWith("ff") || // multicast ff00::/8
-		normalized.startsWith("2001:db8") || // documentation
-		normalized.startsWith("::ffff:") // any remaining IPv4-mapped form we could not classify
+		!matchesIPv6Cidr(bytes, IPV6_GLOBAL_UNICAST) ||
+		BLOCKED_GLOBAL_IPV6_RANGES.some(cidr => matchesIPv6Cidr(bytes, cidr))
 	);
 }
 
 /** True for any address that is not a routable public unicast address. */
 export function isPrivateOrSpecialAddress(address: string): boolean {
-	const normalized = normalizeIPv4MappedIPv6(address);
-	const family = net.isIP(normalized);
-	if (family === 4) return isPrivateIPv4(normalized);
-	if (family === 6) return isPrivateIPv6(normalized);
-	// Re-check the raw value in case it was an IPv4-mapped IPv6 literal.
-	if (net.isIP(address) === 6) return isPrivateIPv6(address);
+	const family = net.isIP(address);
+	if (family === 4) return isPrivateIPv4(address);
+	if (family === 6) return isPrivateIPv6(address);
 	return true; // not a recognizable IP -> treat as unsafe
 }
 
@@ -108,7 +176,7 @@ export function isPrivateOrSpecialAddress(address: string): boolean {
  */
 export async function validatePublicHttpUrl(
 	rawUrl: string,
-	options: { resolver?: AddressResolver } = {},
+	options: { resolver?: AddressResolver; signal?: AbortSignal } = {},
 ): Promise<PublicUrlResult> {
 	const resolver = options.resolver ?? defaultResolver;
 
@@ -128,18 +196,20 @@ export async function validatePublicHttpUrl(
 		return { ok: false, reason: "localhost or internal host" };
 	}
 
-	const literalFamily = net.isIP(url.hostname);
+	const hostname = url.hostname.replace(/^\[|\]$/g, "");
+	const literalFamily = net.isIP(hostname);
 	if (literalFamily !== 0) {
-		if (isPrivateOrSpecialAddress(url.hostname)) {
+		if (isPrivateOrSpecialAddress(hostname)) {
 			return { ok: false, reason: "private, loopback, link-local, or reserved IP literal" };
 		}
-		return { ok: true, url, addresses: [url.hostname] };
+		return { ok: true, url, addresses: [hostname] };
 	}
 
 	let addresses: string[];
 	try {
-		addresses = await resolver(url.hostname);
+		addresses = await resolveWithSignal(resolver, hostname, options.signal);
 	} catch {
+		if (options.signal?.aborted) return { ok: false, reason: "host resolution aborted" };
 		return { ok: false, reason: "host could not be resolved" };
 	}
 	if (addresses.length === 0) {
@@ -151,6 +221,47 @@ export async function validatePublicHttpUrl(
 	return { ok: true, url, addresses };
 }
 
+export async function guardedPublicFetch(
+	rawUrl: string,
+	init: BunFetchRequestInit = {},
+	options: { resolver?: AddressResolver } = {},
+): Promise<GuardedPublicFetchResult> {
+	if (Object.hasOwn(init, "proxy") || Object.hasOwn(init, "unix") || hasConfiguredProxy(process.env)) {
+		return { ok: false, reason: "proxy or Unix-socket routing is not allowed", logicalUrl: rawUrl };
+	}
+
+	const signal = init.signal ?? undefined;
+	const guard = await validatePublicHttpUrl(rawUrl, { resolver: options.resolver, signal });
+	if (signal?.aborted) throw signal.reason;
+	if (!guard.ok) return { ok: false, reason: guard.reason, logicalUrl: rawUrl };
+
+	const logicalUrl = guard.url;
+	const headers = new Headers(init.headers);
+	headers.delete("host");
+	headers.set("Host", logicalUrl.host);
+	const hostname = logicalUrl.hostname.replace(/^\[|\]$/g, "");
+	const tls =
+		logicalUrl.protocol === "https:"
+			? { rejectUnauthorized: true, ...(net.isIP(hostname) === 0 ? { serverName: hostname } : {}) }
+			: undefined;
+	let lastError: unknown;
+	for (const address of guard.addresses) {
+		if (hasConfiguredProxy(process.env)) {
+			return { ok: false, reason: "proxy routing appeared during resolution", logicalUrl: rawUrl };
+		}
+		const wireUrl = new URL(logicalUrl);
+		wireUrl.hostname = net.isIP(address) === 6 ? `[${address}]` : address;
+		try {
+			const response = await fetch(wireUrl, { ...init, headers, redirect: "manual", keepalive: false, tls });
+			return { ok: true, response, logicalUrl, wireUrl };
+		} catch (error) {
+			if (signal?.aborted) throw signal.reason;
+			lastError = error;
+		}
+	}
+	throw lastError;
+}
+
 export async function validatePublicHttpUrlForInsane(
 	rawUrl: string,
 	options: { resolver?: AddressResolver } = {},

package/src/web/scrapers/types.ts

@@ -5,7 +5,7 @@ import { ptree } from "@gajae-code/utils";
 import type { AgentStorage } from "../../session/agent-storage";
 import { ToolAbortError } from "../../tools/tool-errors";
 import type { AddressResolver } from "../insane/url-guard";
-import { validatePublicHttpUrl } from "../insane/url-guard";
+import { guardedPublicFetch } from "../insane/url-guard";
 
 export { formatNumber } from "@gajae-code/utils";
 
@@ -85,20 +85,6 @@ export interface LoadPageResult {
 	error?: string;
 }
 
-async function guardPublicFetchUrl(
-	rawUrl: string,
-	resolver: AddressResolver | undefined,
-	context: string,
-): Promise<{ ok: true; url: string } | { ok: false; error: string; finalUrl: string }> {
-	const guard = await validatePublicHttpUrl(rawUrl, { resolver });
-	if (guard.ok) return { ok: true, url: guard.url.toString() };
-	return {
-		ok: false,
-		error: `${context}: target URL is not public HTTP(S): ${guard.reason}`,
-		finalUrl: rawUrl,
-	};
-}
-
 function shouldRewriteRedirectMethod(status: number, method: string): boolean {
 	const normalized = method.toUpperCase();
 	return status === 303 || ((status === 301 || status === 302) && normalized === "POST");
@@ -120,20 +106,7 @@ export async function loadPage(url: string, options: LoadPageOptions = {}): Prom
 		maxRedirects = 10,
 	} = options;
 
-	let initialUrl = url;
-	if (publicUrlGuard) {
-		const guarded = await guardPublicFetchUrl(url, resolver, "Blocked URL fetch");
-		if (!guarded.ok) {
-			return {
-				content: "",
-				contentType: "",
-				finalUrl: guarded.finalUrl,
-				ok: false,
-				error: guarded.error,
-			};
-		}
-		initialUrl = guarded.url;
-	}
+	const initialUrl = url;
 
 	attempts: for (let attempt = 0; attempt < USER_AGENTS.length; attempt++) {
 		if (signal?.aborted) {
@@ -165,36 +138,33 @@ export async function loadPage(url: string, options: LoadPageOptions = {}): Prom
 					requestInit.body = currentBody;
 				}
 
-				const response = await fetch(currentUrl, requestInit);
+				const dial = publicUrlGuard
+					? await guardedPublicFetch(currentUrl, requestInit, { resolver })
+					: { ok: true as const, response: await fetch(currentUrl, requestInit), logicalUrl: new URL(currentUrl) };
+				if (!dial.ok) {
+					return {
+						content: "",
+						contentType: "",
+						finalUrl: dial.logicalUrl,
+						ok: false,
+						error: `Blocked URL fetch: target URL is not public HTTP(S): ${dial.reason}`,
+					};
+				}
+				const { response } = dial;
+				const logicalUrl = dial.logicalUrl.toString();
 				if (REDIRECT_STATUSES.has(response.status)) {
 					const location = response.headers.get("location");
 					if (!location) {
 						return {
 							content: "",
 							contentType: "",
-							finalUrl: currentUrl,
+							finalUrl: logicalUrl,
 							ok: false,
 							status: response.status,
 							error: "Redirect response missing Location header",
 						};
 					}
-					const redirectUrl = new URL(location, currentUrl).toString();
-					if (publicUrlGuard) {
-						const guarded = await guardPublicFetchUrl(redirectUrl, resolver, "Blocked URL redirect");
-						if (!guarded.ok) {
-							return {
-								content: "",
-								contentType: "",
-								finalUrl: guarded.finalUrl,
-								ok: false,
-								status: response.status,
-								error: guarded.error,
-							};
-						}
-						currentUrl = guarded.url;
-					} else {
-						currentUrl = redirectUrl;
-					}
+					currentUrl = new URL(location, logicalUrl).toString();
 					if (shouldRewriteRedirectMethod(response.status, currentMethod)) {
 						currentMethod = "GET";
 						currentBody = undefined;
@@ -203,7 +173,7 @@ export async function loadPage(url: string, options: LoadPageOptions = {}): Prom
 				}
 
 				const contentType = response.headers.get("content-type")?.split(";")[0]?.trim().toLowerCase() ?? "";
-				const finalUrl = response.url || currentUrl;
+				const finalUrl = logicalUrl;
 
 				const reader = response.body?.getReader();
 				if (!reader) {