@google/gemini-cli 0.59.0-nightly.20260902.g4963a4456 → 0.59.0

package/bundle/{chunk-DIOSE3BS.js → chunk-S4PJ76PA.js}

@@ -16728,7 +16728,7 @@ var require_dist2 = __commonJS({
     };
     Object.defineProperty(exports2, "__esModule", { value: true });
     exports2.HttpProxyAgent = void 0;
-    var net3 = __importStar(__require("net"));
+    var net2 = __importStar(__require("net"));
     var tls = __importStar(__require("tls"));
     var debug_1 = __importDefault(require_src());
     var events_1 = __require("events");
@@ -16801,7 +16801,7 @@ var require_dist2 = __commonJS({
           socket = tls.connect(this.connectOpts);
         } else {
           debug2("Creating `net.Socket`: %o", this.connectOpts);
-          socket = net3.connect(this.connectOpts);
+          socket = net2.connect(this.connectOpts);
         }
         await (0, events_1.once)(socket, "connect");
         return socket;
@@ -28153,8 +28153,8 @@ var require_utils = __commonJS({
     var HOST_DELIMS = { "@": "%40", "/": "%2F", "?": "%3F", "#": "%23", ":": "%3A" };
     var HOST_DELIM_RE = /[@/?#:]/g;
     var HOST_DELIM_NO_COLON_RE = /[@/?#]/g;
-    function reescapeHostDelimiters(host, isIP2) {
-      const re = isIP2 ? HOST_DELIM_NO_COLON_RE : HOST_DELIM_RE;
+    function reescapeHostDelimiters(host, isIP) {
+      const re = isIP ? HOST_DELIM_NO_COLON_RE : HOST_DELIM_RE;
       re.lastIndex = 0;
       return host.replace(re, (ch) => HOST_DELIMS[ch]);
     }
@@ -28636,7 +28636,7 @@ var require_fast_uri = __commonJS({
         fragment: void 0
       };
       let malformedAuthorityOrPort = false;
-      let isIP2 = false;
+      let isIP = false;
       if (options.reference === "suffix") {
         if (options.scheme) {
           uri = options.scheme + ":" + uri;
@@ -28666,9 +28666,9 @@ var require_fast_uri = __commonJS({
           if (ipv4result === false) {
             const ipv6result = normalizeIPv6(parsed.host);
             parsed.host = ipv6result.host.toLowerCase();
-            isIP2 = ipv6result.isIPV6;
+            isIP = ipv6result.isIPV6;
           } else {
-            isIP2 = true;
+            isIP = true;
           }
         }
         if (parsed.scheme === void 0 && parsed.userinfo === void 0 && parsed.host === void 0 && parsed.port === void 0 && parsed.query === void 0 && !parsed.path) {
@@ -28685,7 +28685,7 @@ var require_fast_uri = __commonJS({
         }
         const schemeHandler = getSchemeHandler(options.scheme || parsed.scheme);
         if (!options.unicodeSupport && (!schemeHandler || !schemeHandler.unicodeSupport)) {
-          if (parsed.host && (options.domainHost || schemeHandler && schemeHandler.domainHost) && isIP2 === false && nonSimpleDomain(parsed.host)) {
+          if (parsed.host && (options.domainHost || schemeHandler && schemeHandler.domainHost) && isIP === false && nonSimpleDomain(parsed.host)) {
             try {
               parsed.host = URL.domainToASCII(parsed.host.toLowerCase());
             } catch (e2) {
@@ -28699,7 +28699,7 @@ var require_fast_uri = __commonJS({
               parsed.scheme = unescape(parsed.scheme);
             }
             if (parsed.host !== void 0) {
-              parsed.host = reescapeHostDelimiters(unescape(parsed.host), isIP2);
+              parsed.host = reescapeHostDelimiters(unescape(parsed.host), isIP);
             }
           }
           if (parsed.path) {
@@ -58752,7 +58752,7 @@ var require_transport = __commonJS({
     var resolver_1 = require_resolver();
     var subchannel_address_1 = require_subchannel_address();
     var uri_parser_1 = require_uri_parser();
-    var net3 = __require("net");
+    var net2 = __require("net");
     var subchannel_call_1 = require_subchannel_call();
     var call_number_1 = require_call_number();
     var TRACER_NAME2 = "transport";
@@ -59219,7 +59219,7 @@ var require_transport = __commonJS({
               const errorCallback = (error40) => {
                 reject(error40);
               };
-              const socket = net3.connect(address, () => {
+              const socket = net2.connect(address, () => {
                 socket.removeListener("close", closeCallback);
                 socket.removeListener("error", errorCallback);
                 resolve29(socket);
@@ -113721,13 +113721,13 @@ var require_internet = __commonJS({
 var require_dockerSocket = __commonJS({
   "packages/core/node_modules/systeminformation/lib/dockerSocket.js"(exports2, module2) {
     "use strict";
-    var net3 = __require("net");
+    var net2 = __require("net");
     var isWin2 = __require("os").type() === "Windows_NT";
     var socketPath = isWin2 ? "//./pipe/docker_engine" : "/var/run/docker.sock";
     var DockerSocket = class {
       getInfo(callback) {
         try {
-          let socket = net3.createConnection({ path: socketPath });
+          let socket = net2.createConnection({ path: socketPath });
           let alldata = "";
           let data;
           socket.on("connect", () => {
@@ -113757,7 +113757,7 @@ var require_dockerSocket = __commonJS({
       }
       listImages(all2, callback) {
         try {
-          let socket = net3.createConnection({ path: socketPath });
+          let socket = net2.createConnection({ path: socketPath });
           let alldata = "";
           let data;
           socket.on("connect", () => {
@@ -113789,7 +113789,7 @@ var require_dockerSocket = __commonJS({
         id = id || "";
         if (id) {
           try {
-            let socket = net3.createConnection({ path: socketPath });
+            let socket = net2.createConnection({ path: socketPath });
             let alldata = "";
             let data;
             socket.on("connect", () => {
@@ -113822,7 +113822,7 @@ var require_dockerSocket = __commonJS({
       }
       listContainers(all2, callback) {
         try {
-          let socket = net3.createConnection({ path: socketPath });
+          let socket = net2.createConnection({ path: socketPath });
           let alldata = "";
           let data;
           socket.on("connect", () => {
@@ -113854,7 +113854,7 @@ var require_dockerSocket = __commonJS({
         id = id || "";
         if (id) {
           try {
-            let socket = net3.createConnection({ path: socketPath });
+            let socket = net2.createConnection({ path: socketPath });
             let alldata = "";
             let data;
             socket.on("connect", () => {
@@ -113889,7 +113889,7 @@ var require_dockerSocket = __commonJS({
         id = id || "";
         if (id) {
           try {
-            let socket = net3.createConnection({ path: socketPath });
+            let socket = net2.createConnection({ path: socketPath });
             let alldata = "";
             let data;
             socket.on("connect", () => {
@@ -113924,7 +113924,7 @@ var require_dockerSocket = __commonJS({
         id = id || "";
         if (id) {
           try {
-            let socket = net3.createConnection({ path: socketPath });
+            let socket = net2.createConnection({ path: socketPath });
             let alldata = "";
             let data;
             socket.on("connect", () => {
@@ -113957,7 +113957,7 @@ var require_dockerSocket = __commonJS({
       }
       listVolumes(callback) {
         try {
-          let socket = net3.createConnection({ path: socketPath });
+          let socket = net2.createConnection({ path: socketPath });
           let alldata = "";
           let data;
           socket.on("connect", () => {
@@ -210580,7 +210580,7 @@ var require_util20 = __commonJS({
     var { kDestroyed, kBodyUsed, kListeners, kBody } = require_symbols();
     var { IncomingMessage } = __require("node:http");
     var stream2 = __require("node:stream");
-    var net3 = __require("node:net");
+    var net2 = __require("node:net");
     var { Blob: Blob2 } = __require("node:buffer");
     var nodeUtil = __require("node:util");
     var { stringify: stringify3 } = __require("node:querystring");
@@ -210726,7 +210726,7 @@ var require_util20 = __commonJS({
       }
       assert3(typeof host === "string");
       const servername = getHostname(host);
-      if (net3.isIP(servername)) {
+      if (net2.isIP(servername)) {
         return "";
       }
       return servername;
@@ -212038,7 +212038,7 @@ var require_dispatcher_base = __commonJS({
 var require_connect = __commonJS({
   "packages/core/node_modules/undici/lib/core/connect.js"(exports2, module2) {
     "use strict";
-    var net3 = __require("node:net");
+    var net2 = __require("node:net");
     var assert3 = __require("node:assert");
     var util4 = require_util20();
     var { InvalidArgumentError } = require_errors6();
@@ -212092,7 +212092,7 @@ var require_connect = __commonJS({
         }
       };
     }
-    function buildConnector2({ allowH2, maxCachedSessions, socketPath, timeout, session: customSession, ...opts }) {
+    function buildConnector({ allowH2, maxCachedSessions, socketPath, timeout, session: customSession, ...opts }) {
       if (maxCachedSessions != null && (!Number.isInteger(maxCachedSessions) || maxCachedSessions < 0)) {
         throw new InvalidArgumentError("maxCachedSessions must be a positive integer or zero");
       }
@@ -212130,7 +212130,7 @@ var require_connect = __commonJS({
         } else {
           assert3(!httpSocket, "httpSocket can only be sent on TLS update");
           port = port || 80;
-          socket = net3.connect({
+          socket = net2.connect({
             highWaterMark: 64 * 1024,
             // Same as nodejs fs streams.
             ...options,
@@ -212162,7 +212162,7 @@ var require_connect = __commonJS({
         return socket;
       };
     }
-    module2.exports = buildConnector2;
+    module2.exports = buildConnector;
   }
 });
 
@@ -217276,7 +217276,7 @@ var require_client2 = __commonJS({
   "packages/core/node_modules/undici/lib/dispatcher/client.js"(exports2, module2) {
     "use strict";
     var assert3 = __require("node:assert");
-    var net3 = __require("node:net");
+    var net2 = __require("node:net");
     var http3 = __require("node:http");
     var util4 = require_util20();
     var { ClientStats } = require_stats();
@@ -217288,7 +217288,7 @@ var require_client2 = __commonJS({
       InformationalError,
       ClientDestroyedError
     } = require_errors6();
-    var buildConnector2 = require_connect();
+    var buildConnector = require_connect();
     var {
       kUrl,
       kServerName,
@@ -217423,7 +217423,7 @@ var require_client2 = __commonJS({
         if (maxRequestsPerClient != null && (!Number.isInteger(maxRequestsPerClient) || maxRequestsPerClient < 0)) {
           throw new InvalidArgumentError("maxRequestsPerClient must be a positive number");
         }
-        if (localAddress != null && (typeof localAddress !== "string" || net3.isIP(localAddress) === 0)) {
+        if (localAddress != null && (typeof localAddress !== "string" || net2.isIP(localAddress) === 0)) {
           throw new InvalidArgumentError("localAddress must be valid string IP address");
         }
         if (maxResponseSize != null && (!Number.isInteger(maxResponseSize) || maxResponseSize < -1)) {
@@ -217440,7 +217440,7 @@ var require_client2 = __commonJS({
         }
         super();
         if (typeof connect2 !== "function") {
-          connect2 = buildConnector2({
+          connect2 = buildConnector({
             ...tls,
             maxCachedSessions,
             allowH2,
@@ -217578,7 +217578,7 @@ var require_client2 = __commonJS({
         const idx = hostname3.indexOf("]");
         assert3(idx !== -1);
         const ip = hostname3.substring(1, idx);
-        assert3(net3.isIPv6(ip));
+        assert3(net2.isIPv6(ip));
         hostname3 = ip;
       }
       client[kConnecting] = true;
@@ -218013,7 +218013,7 @@ var require_pool2 = __commonJS({
     } = require_errors6();
     var util4 = require_util20();
     var { kUrl } = require_symbols();
-    var buildConnector2 = require_connect();
+    var buildConnector = require_connect();
     var kOptions = Symbol("options");
     var kConnections = Symbol("connections");
     var kFactory = Symbol("factory");
@@ -218046,7 +218046,7 @@ var require_pool2 = __commonJS({
         }
         super();
         if (typeof connect !== "function") {
-          connect = buildConnector2({
+          connect = buildConnector({
             ...tls,
             maxCachedSessions,
             allowH2,
@@ -218361,7 +218361,7 @@ var require_proxy_agent = __commonJS({
     var Pool = require_pool2();
     var DispatcherBase = require_dispatcher_base();
     var { InvalidArgumentError, RequestAbortedError, SecureProxyConnectionError } = require_errors6();
-    var buildConnector2 = require_connect();
+    var buildConnector = require_connect();
     var Client3 = require_client2();
     var kAgent = Symbol("proxy agent");
     var kClient = Symbol("proxy client");
@@ -218459,8 +218459,8 @@ var require_proxy_agent = __commonJS({
           }
           return new Client3(origin2, options);
         } : void 0;
-        const connect = buildConnector2({ ...opts.proxyTls });
-        this[kConnectEndpoint] = buildConnector2({ ...opts.requestTls });
+        const connect = buildConnector({ ...opts.proxyTls });
+        this[kConnectEndpoint] = buildConnector({ ...opts.requestTls });
         this[kClient] = clientFactory(url3, { connect, factory });
         this[kTunnelProxy] = proxyTunnel;
         this[kAgent] = new Agent2({
@@ -221841,7 +221841,7 @@ var require_dump = __commonJS({
 var require_dns = __commonJS({
   "packages/core/node_modules/undici/lib/interceptor/dns.js"(exports2, module2) {
     "use strict";
-    var { isIP: isIP2 } = __require("node:net");
+    var { isIP } = __require("node:net");
     var { lookup: lookup3 } = __require("node:dns");
     var DecoratorHandler = require_decorator_handler();
     var { InvalidArgumentError, InformationalError } = require_errors6();
@@ -222140,7 +222140,7 @@ var require_dns = __commonJS({
       return (dispatch) => {
         return function dnsInterceptor(origDispatchOpts, handler) {
           const origin = origDispatchOpts.origin.constructor === URL ? origDispatchOpts.origin : new URL(origDispatchOpts.origin);
-          if (isIP2(origin.hostname) !== 0) {
+          if (isIP(origin.hostname) !== 0) {
             return dispatch(origDispatchOpts, handler);
           }
           instance2.runLookup(origin, origDispatchOpts, (err2, newOrigin) => {
@@ -230250,7 +230250,7 @@ var require_undici = __commonJS({
     var util4 = require_util20();
     var { InvalidArgumentError } = errors;
     var api = require_api2();
-    var buildConnector2 = require_connect();
+    var buildConnector = require_connect();
     var MockClient = require_mock_client();
     var { MockCallHistory, MockCallHistoryLog } = require_mock_call_history();
     var MockAgent = require_mock_agent();
@@ -230286,7 +230286,7 @@ var require_undici = __commonJS({
     };
     var SqliteCacheStore = require_sqlite_cache_store();
     module2.exports.cacheStores.SqliteCacheStore = SqliteCacheStore;
-    module2.exports.buildConnector = buildConnector2;
+    module2.exports.buildConnector = buildConnector;
     module2.exports.errors = errors;
     module2.exports.util = {
       parseHeaders: util4.parseHeaders,
@@ -282909,8 +282909,8 @@ function isValidToolName(name3, options = {}) {
 }
 
 // packages/core/src/generated/git-commit.ts
-var GIT_COMMIT_INFO = "4963a4456";
-var CLI_VERSION = "0.59.0-nightly.20260825.g812f7a2bc";
+var GIT_COMMIT_INFO = "45e486b03";
+var CLI_VERSION = "0.59.0";
 
 // packages/core/src/ide/detect-ide.ts
 var IDE_DEFINITIONS = {
@@ -306530,7 +306530,7 @@ function getVersion() {
   }
   versionPromise = (async () => {
     const pkgJson = await getPackageJson(__dirname4);
-    return "0.59.0-nightly.20260825.g812f7a2bc";
+    return "0.59.0";
   })();
   return versionPromise;
 }
@@ -326310,10 +326310,9 @@ var ShellTool = class _ShellTool extends BaseDeclarativeTool {
 };
 
 // packages/core/src/utils/fetch.ts
-var undici = __toESM(require_undici(), 1);
+var import_undici2 = __toESM(require_undici(), 1);
 var import_ipaddr = __toESM(require_ipaddr(), 1);
 import { URL as URL5 } from "node:url";
-import * as net2 from "node:net";
 import { lookup } from "node:dns/promises";
 var FetchError = class extends Error {
   constructor(message, code, options) {
@@ -326331,113 +326330,8 @@ var PrivateIpError = class extends Error {
 var defaultHeadersTimeout = 6e4;
 var defaultBodyTimeout = 3e5;
 var currentProxy = void 0;
-function getBuildConnector() {
-  try {
-    const fn = undici.buildConnector;
-    return typeof fn === "function" ? fn : void 0;
-  } catch {
-    return void 0;
-  }
-}
-function safeLookup(hostname3, options, callback) {
-  const sanitized = sanitizeHostname(hostname3);
-  if (sanitized === "localhost" || sanitized.endsWith(".localhost") || sanitized.endsWith(".local") || sanitized.endsWith(".internal")) {
-    callback(
-      new PrivateIpError(`Access to internal host ${sanitized} is blocked`),
-      ""
-    );
-    return;
-  }
-  if (net2.isIP(sanitized)) {
-    if (isAddressPrivate(sanitized)) {
-      callback(
-        new PrivateIpError(`Access to private IP ${sanitized} is blocked`),
-        ""
-      );
-      return;
-    }
-    if (options?.all) {
-      callback(null, [{ address: sanitized, family: net2.isIP(sanitized) }]);
-    } else {
-      callback(null, sanitized, net2.isIP(sanitized));
-    }
-    return;
-  }
-  lookup(sanitized, { all: true }).then((addresses) => {
-    if (!addresses || addresses.length === 0) {
-      callback(new Error(`getaddrinfo ENOTFOUND ${sanitized}`), "");
-      return;
-    }
-    for (const addr2 of addresses) {
-      if (isAddressPrivate(addr2.address)) {
-        callback(
-          new PrivateIpError(
-            `Access to private IP ${addr2.address} (resolved from ${sanitized}) is blocked`
-          ),
-          ""
-        );
-        return;
-      }
-    }
-    if (options?.all) {
-      callback(null, addresses);
-    } else {
-      const family = options?.family;
-      const match2 = family ? addresses.find((a2) => a2.family === family) || addresses[0] : addresses[0];
-      callback(null, match2.address, match2.family);
-    }
-  }).catch((err2) => {
-    callback(err2 instanceof Error ? err2 : new Error(String(err2)), "");
-  });
-}
-function createSafeConnector(connectorOpts, customDefaultConnector) {
-  const buildConnectorFn = getBuildConnector();
-  const safeConnectorOpts = {
-    ...connectorOpts,
-    lookup: safeLookup
-  };
-  const defaultConnector = customDefaultConnector ?? (buildConnectorFn ? buildConnectorFn(safeConnectorOpts) : void 0);
-  return function safeConnect(opts, callback) {
-    if (!defaultConnector) {
-      callback(new Error("Connector is unavailable"), null);
-      return;
-    }
-    const rawHostname = opts.hostname;
-    const sanitized = sanitizeHostname(rawHostname);
-    if (sanitized === "localhost" || sanitized.endsWith(".localhost") || sanitized.endsWith(".local") || sanitized.endsWith(".internal")) {
-      callback(
-        new PrivateIpError(`Access to internal host ${sanitized} is blocked`),
-        null
-      );
-      return;
-    }
-    if (net2.isIP(sanitized) && isAddressPrivate(sanitized)) {
-      callback(
-        new PrivateIpError(`Access to private IP ${sanitized} is blocked`),
-        null
-      );
-      return;
-    }
-    defaultConnector(opts, callback);
-  };
-}
-function createSafeAgent(options) {
-  const buildConnectorFn = getBuildConnector();
-  if (!buildConnectorFn) {
-    throw new Error(
-      "Security initialization failed: undici.buildConnector is not available."
-    );
-  }
-  const connect = createSafeConnector();
-  return new undici.Agent({
-    headersTimeout: options?.headersTimeout ?? defaultHeadersTimeout,
-    bodyTimeout: options?.bodyTimeout ?? defaultBodyTimeout,
-    connect
-  });
-}
-var defaultSafeAgent = createSafeAgent();
-undici.setGlobalDispatcher(
-  new undici.Agent({
+(0, import_undici2.setGlobalDispatcher)(
+  new import_undici2.Agent({
     headersTimeout: defaultHeadersTimeout,
     bodyTimeout: defaultBodyTimeout
   })
@@ -326449,15 +326343,11 @@ function updateGlobalFetchTimeouts(timeoutMs) {
     );
   }
   defaultHeadersTimeout = timeoutMs;
-  defaultSafeAgent = createSafeAgent({
-    headersTimeout: defaultHeadersTimeout,
-    bodyTimeout: defaultBodyTimeout
-  });
   if (currentProxy) {
     setGlobalProxy(currentProxy);
   } else {
-    undici.setGlobalDispatcher(
-      new undici.Agent({
+    (0, import_undici2.setGlobalDispatcher)(
+      new import_undici2.Agent({
         headersTimeout: defaultHeadersTimeout,
         bodyTimeout: defaultBodyTimeout
       })
@@ -326471,6 +326361,14 @@ function isLoopbackHost(hostname3) {
   const sanitized = sanitizeHostname(hostname3);
   return sanitized === "localhost" || sanitized === "127.0.0.1" || sanitized === "::1";
 }
+function isPrivateIp(url3) {
+  try {
+    const hostname3 = new URL5(url3).hostname;
+    return isAddressPrivate(hostname3);
+  } catch {
+    return false;
+  }
+}
 var IANA_BENCHMARK_RANGE = import_ipaddr.default.parseCIDR("198.18.0.0/15");
 function isBenchmarkAddress(addr2) {
   const [rangeAddr, rangeMask] = IANA_BENCHMARK_RANGE;
@@ -326478,7 +326376,7 @@ function isBenchmarkAddress(addr2) {
 }
 function isAddressPrivate(address) {
   const sanitized = sanitizeHostname(address);
-  if (sanitized === "localhost" || sanitized.endsWith(".localhost") || sanitized.endsWith(".local") || sanitized.endsWith(".internal")) {
+  if (sanitized === "localhost") {
     return true;
   }
   try {
@@ -326498,53 +326396,27 @@ function isAddressPrivate(address) {
   }
 }
 async function isPrivateIpAsync(url3) {
-  let parsedUrl;
   try {
-    parsedUrl = new URL5(url3);
-  } catch (error40) {
-    if (error40 instanceof TypeError) {
+    const parsedUrl = new URL5(url3);
+    const hostname3 = parsedUrl.hostname;
+    if (isLoopbackHost(hostname3)) {
       return false;
     }
-    throw error40;
-  }
-  const hostname3 = sanitizeHostname(parsedUrl.hostname);
-  if (hostname3 === "localhost" || hostname3.endsWith(".localhost") || hostname3.endsWith(".local") || hostname3.endsWith(".internal")) {
-    return true;
-  }
-  if (net2.isIP(hostname3)) {
-    return isAddressPrivate(hostname3);
-  }
-  try {
     const addresses = await lookup(hostname3, { all: true });
-    if (!addresses || addresses.length === 0) {
-      return true;
-    }
     return addresses.some((addr2) => isAddressPrivate(addr2.address));
   } catch (error40) {
+    if (error40 instanceof TypeError) {
+      return false;
+    }
     throw new Error("Failed to verify if URL resolves to private IP", {
       cause: error40
     });
   }
 }
-async function isPrivateIp(url3) {
-  try {
-    return await isPrivateIpAsync(url3);
-  } catch {
-    return true;
-  }
-}
-async function validateUrlDestination(url3) {
-  try {
-    const isPrivate = await isPrivateIp(url3);
-    return !isPrivate;
-  } catch {
-    return false;
-  }
-}
 function createSafeProxyAgent(proxyUrl) {
   const trimmedProxy = proxyUrl.trim();
   const noProxy = (process.env["NO_PROXY"] ?? process.env["no_proxy"] ?? "")?.trim();
-  return new undici.EnvHttpProxyAgent({
+  return new import_undici2.EnvHttpProxyAgent({
     httpProxy: trimmedProxy,
     httpsProxy: trimmedProxy,
     noProxy,
@@ -326553,11 +326425,6 @@ function createSafeProxyAgent(proxyUrl) {
   });
 }
 async function fetchWithTimeout(url3, timeout, options) {
-  if (await isPrivateIp(url3)) {
-    throw new PrivateIpError(
-      `Access to blocked or private host ${url3} is not allowed.`
-    );
-  }
   const controller = new AbortController();
   const timeoutId = setTimeout(() => controller.abort(), timeout);
   if (options?.signal) {
@@ -326570,14 +326437,10 @@ async function fetchWithTimeout(url3, timeout, options) {
     }
   }
   try {
-    const fetchOptions = {
+    const response = await fetch(url3, {
       ...options,
       signal: controller.signal
-    };
-    if (!fetchOptions.dispatcher) {
-      fetchOptions.dispatcher = currentProxy ? createSafeProxyAgent(currentProxy) : defaultSafeAgent;
-    }
-    const response = await fetch(url3, fetchOptions);
+    });
     return response;
   } catch (error40) {
     if (isAbortError(error40)) {
@@ -326586,14 +326449,6 @@ async function fetchWithTimeout(url3, timeout, options) {
       }
       throw new FetchError(`Request timed out after ${timeout}ms`, "ETIMEDOUT");
     }
-    if (error40 instanceof PrivateIpError) {
-      throw error40;
-    }
-    if (error40 && typeof error40 === "object" && "cause" in error40) {
-      if (error40.cause instanceof PrivateIpError) {
-        throw error40.cause;
-      }
-    }
     throw new FetchError(getErrorMessage(error40), void 0, { cause: error40 });
   } finally {
     clearTimeout(timeoutId);
@@ -326603,8 +326458,8 @@ function setGlobalProxy(proxy2) {
   const trimmedProxy = proxy2.trim();
   currentProxy = trimmedProxy;
   const noProxy = (process.env["NO_PROXY"] ?? process.env["no_proxy"] ?? "")?.trim();
-  undici.setGlobalDispatcher(
-    new undici.EnvHttpProxyAgent({
+  (0, import_undici2.setGlobalDispatcher)(
+    new import_undici2.EnvHttpProxyAgent({
       httpProxy: trimmedProxy,
       httpsProxy: trimmedProxy,
       noProxy,
@@ -331676,21 +331531,21 @@ var WebFetchToolInvocation = class extends BaseToolInvocation {
       )
     );
   }
-  async isBlockedHost(urlStr) {
+  isBlockedHost(urlStr) {
     try {
       const url3 = new URL(urlStr);
       const hostname3 = url3.hostname.toLowerCase();
-      if (hostname3 === "localhost" || hostname3 === "127.0.0.1" || hostname3.endsWith(".localhost") || hostname3.endsWith(".local") || hostname3.endsWith(".internal")) {
+      if (hostname3 === "localhost" || hostname3 === "127.0.0.1") {
         return true;
       }
-      return await isPrivateIp(urlStr);
+      return isPrivateIp(urlStr);
     } catch {
       return true;
     }
   }
   async executeFallbackForUrl(urlStr, signal) {
     const url3 = convertGithubUrlToRaw(urlStr);
-    if (await this.isBlockedHost(url3)) {
+    if (this.isBlockedHost(url3)) {
       debugLogger.warn(`[WebFetchTool] Blocked access to host: ${url3}`);
       throw new Error(
         `Access to blocked or private host ${url3} is not allowed.`
@@ -331746,12 +331601,12 @@ var WebFetchToolInvocation = class extends BaseToolInvocation {
     }
     return textContent2;
   }
-  async filterAndValidateUrls(urls) {
+  filterAndValidateUrls(urls) {
     const uniqueUrls = [...new Set(urls.map(normalizeUrl))];
     const toFetch = [];
     const skipped = [];
     for (const url3 of uniqueUrls) {
-      if (await this.isBlockedHost(url3)) {
+      if (this.isBlockedHost(url3)) {
         debugLogger.warn(
           `[WebFetchTool] Skipped private or local host: ${url3}`
         );
@@ -331967,7 +331822,7 @@ ${aggregatedContent}
       };
     }
     url3 = convertGithubUrlToRaw(url3);
-    if (await this.isBlockedHost(url3)) {
+    if (this.isBlockedHost(url3)) {
       const errorMessage = `Access to blocked or private host ${url3} is not allowed.`;
       debugLogger.warn(
         `[WebFetchTool] Blocked experimental fetch to host: ${url3}`
@@ -332101,7 +331956,7 @@ Response: ${rawResponseText}`;
     }
     const userPrompt = this.params.prompt;
     const { validUrls } = parsePrompt(userPrompt);
-    const { toFetch, skipped } = await this.filterAndValidateUrls(validUrls);
+    const { toFetch, skipped } = this.filterAndValidateUrls(validUrls);
     if (toFetch.length === 0 && skipped.length > 0) {
       const errorMessage = `All requested URLs were skipped: ${skipped.join(", ")}`;
       debugLogger.error(`[WebFetchTool] ${errorMessage}`);
@@ -341933,7 +341788,7 @@ var A2AAuthProviderFactory = class _A2AAuthProviderFactory {
         return provider;
       }
       case "oauth2": {
-        const { OAuth2AuthProvider } = await import("./oauth2-provider-JRSE3A7L.js");
+        const { OAuth2AuthProvider } = await import("./oauth2-provider-JV5L5XL4.js");
         const provider = new OAuth2AuthProvider(
           authConfig,
           options.agentName ?? "unknown",
@@ -371642,7 +371497,7 @@ var SSEClientTransport = class {
 };
 
 // packages/core/src/tools/mcp-client.ts
-var import_undici2 = __toESM(require_undici(), 1);
+var import_undici3 = __toESM(require_undici(), 1);
 var import_shell_quote7 = __toESM(require_shell_quote(), 1);
 
 // packages/core/src/mcp/google-auth-provider.ts
@@ -374425,7 +374280,7 @@ async function connectToMcpServer(clientVersion, mcpServerName, mcpServerConfig,
 }
 function createUrlTransport(mcpServerName, mcpServerConfig, transportOptions) {
   const noProxy = process.env["NO_PROXY"] || process.env["no_proxy"];
-  const agent = new import_undici2.EnvHttpProxyAgent({ noProxy });
+  const agent = new import_undici3.EnvHttpProxyAgent({ noProxy });
   const baseFetch = transportOptions.fetch ?? globalThis.fetch;
   const httpOptions = {
     ...transportOptions,
@@ -382717,7 +382572,7 @@ function v43(options, buf, offset) {
 var v4_default3 = v43;
 
 // packages/core/src/agents/a2a-client-manager.ts
-var import_undici3 = __toESM(require_undici(), 1);
+var import_undici4 = __toESM(require_undici(), 1);
 var A2A_TIMEOUT = 18e5;
 var A2AClientManager = class {
   constructor(config2) {
@@ -382728,12 +382583,12 @@ var A2AClientManager = class {
       bodyTimeout: A2A_TIMEOUT
     };
     if (proxyUrl) {
-      this.a2aDispatcher = new import_undici3.ProxyAgent({
+      this.a2aDispatcher = new import_undici4.ProxyAgent({
         uri: proxyUrl,
         ...agentOptions
       });
     } else {
-      this.a2aDispatcher = new import_undici3.Agent(agentOptions);
+      this.a2aDispatcher = new import_undici4.Agent(agentOptions);
     }
     this.a2aFetch = (input, init2) => fetch(input, { ...init2, dispatcher: this.a2aDispatcher });
   }
@@ -403768,16 +403623,12 @@ export {
   ShellTool,
   FetchError,
   PrivateIpError,
-  safeLookup,
-  createSafeConnector,
-  createSafeAgent,
   updateGlobalFetchTimeouts,
   sanitizeHostname,
   isLoopbackHost,
+  isPrivateIp,
   isAddressPrivate,
   isPrivateIpAsync,
-  isPrivateIp,
-  validateUrlDestination,
   createSafeProxyAgent,
   fetchWithTimeout,
   setGlobalProxy,