@google/gemini-cli 0.59.0-preview.0 → 0.60.0-nightly.20260904.g87a9c71d5

package/bundle/{chunk-52JU4ECF.js → chunk-GYIG2U5X.js}

@@ -16728,7 +16728,7 @@ var require_dist2 = __commonJS({
     };
     Object.defineProperty(exports2, "__esModule", { value: true });
     exports2.HttpProxyAgent = void 0;
-    var net2 = __importStar(__require("net"));
+    var net3 = __importStar(__require("net"));
     var tls = __importStar(__require("tls"));
     var debug_1 = __importDefault(require_src());
     var events_1 = __require("events");
@@ -16801,7 +16801,7 @@ var require_dist2 = __commonJS({
           socket = tls.connect(this.connectOpts);
         } else {
           debug2("Creating `net.Socket`: %o", this.connectOpts);
-          socket = net2.connect(this.connectOpts);
+          socket = net3.connect(this.connectOpts);
         }
         await (0, events_1.once)(socket, "connect");
         return socket;
@@ -28153,8 +28153,8 @@ var require_utils = __commonJS({
     var HOST_DELIMS = { "@": "%40", "/": "%2F", "?": "%3F", "#": "%23", ":": "%3A" };
     var HOST_DELIM_RE = /[@/?#:]/g;
     var HOST_DELIM_NO_COLON_RE = /[@/?#]/g;
-    function reescapeHostDelimiters(host, isIP) {
-      const re = isIP ? HOST_DELIM_NO_COLON_RE : HOST_DELIM_RE;
+    function reescapeHostDelimiters(host, isIP2) {
+      const re = isIP2 ? HOST_DELIM_NO_COLON_RE : HOST_DELIM_RE;
       re.lastIndex = 0;
       return host.replace(re, (ch) => HOST_DELIMS[ch]);
     }
@@ -28636,7 +28636,7 @@ var require_fast_uri = __commonJS({
         fragment: void 0
       };
       let malformedAuthorityOrPort = false;
-      let isIP = false;
+      let isIP2 = false;
       if (options.reference === "suffix") {
         if (options.scheme) {
           uri = options.scheme + ":" + uri;
@@ -28666,9 +28666,9 @@ var require_fast_uri = __commonJS({
           if (ipv4result === false) {
             const ipv6result = normalizeIPv6(parsed.host);
             parsed.host = ipv6result.host.toLowerCase();
-            isIP = ipv6result.isIPV6;
+            isIP2 = ipv6result.isIPV6;
           } else {
-            isIP = true;
+            isIP2 = true;
           }
         }
         if (parsed.scheme === void 0 && parsed.userinfo === void 0 && parsed.host === void 0 && parsed.port === void 0 && parsed.query === void 0 && !parsed.path) {
@@ -28685,7 +28685,7 @@ var require_fast_uri = __commonJS({
         }
         const schemeHandler = getSchemeHandler(options.scheme || parsed.scheme);
         if (!options.unicodeSupport && (!schemeHandler || !schemeHandler.unicodeSupport)) {
-          if (parsed.host && (options.domainHost || schemeHandler && schemeHandler.domainHost) && isIP === false && nonSimpleDomain(parsed.host)) {
+          if (parsed.host && (options.domainHost || schemeHandler && schemeHandler.domainHost) && isIP2 === false && nonSimpleDomain(parsed.host)) {
             try {
               parsed.host = URL.domainToASCII(parsed.host.toLowerCase());
             } catch (e2) {
@@ -28699,7 +28699,7 @@ var require_fast_uri = __commonJS({
               parsed.scheme = unescape(parsed.scheme);
             }
             if (parsed.host !== void 0) {
-              parsed.host = reescapeHostDelimiters(unescape(parsed.host), isIP);
+              parsed.host = reescapeHostDelimiters(unescape(parsed.host), isIP2);
             }
           }
           if (parsed.path) {
@@ -58752,7 +58752,7 @@ var require_transport = __commonJS({
     var resolver_1 = require_resolver();
     var subchannel_address_1 = require_subchannel_address();
     var uri_parser_1 = require_uri_parser();
-    var net2 = __require("net");
+    var net3 = __require("net");
     var subchannel_call_1 = require_subchannel_call();
     var call_number_1 = require_call_number();
     var TRACER_NAME2 = "transport";
@@ -59219,7 +59219,7 @@ var require_transport = __commonJS({
               const errorCallback = (error40) => {
                 reject(error40);
               };
-              const socket = net2.connect(address, () => {
+              const socket = net3.connect(address, () => {
                 socket.removeListener("close", closeCallback);
                 socket.removeListener("error", errorCallback);
                 resolve29(socket);
@@ -113721,13 +113721,13 @@ var require_internet = __commonJS({
 var require_dockerSocket = __commonJS({
   "packages/core/node_modules/systeminformation/lib/dockerSocket.js"(exports2, module2) {
     "use strict";
-    var net2 = __require("net");
+    var net3 = __require("net");
     var isWin2 = __require("os").type() === "Windows_NT";
     var socketPath = isWin2 ? "//./pipe/docker_engine" : "/var/run/docker.sock";
     var DockerSocket = class {
       getInfo(callback) {
         try {
-          let socket = net2.createConnection({ path: socketPath });
+          let socket = net3.createConnection({ path: socketPath });
           let alldata = "";
           let data;
           socket.on("connect", () => {
@@ -113757,7 +113757,7 @@ var require_dockerSocket = __commonJS({
       }
       listImages(all2, callback) {
         try {
-          let socket = net2.createConnection({ path: socketPath });
+          let socket = net3.createConnection({ path: socketPath });
           let alldata = "";
           let data;
           socket.on("connect", () => {
@@ -113789,7 +113789,7 @@ var require_dockerSocket = __commonJS({
         id = id || "";
         if (id) {
           try {
-            let socket = net2.createConnection({ path: socketPath });
+            let socket = net3.createConnection({ path: socketPath });
             let alldata = "";
             let data;
             socket.on("connect", () => {
@@ -113822,7 +113822,7 @@ var require_dockerSocket = __commonJS({
       }
       listContainers(all2, callback) {
         try {
-          let socket = net2.createConnection({ path: socketPath });
+          let socket = net3.createConnection({ path: socketPath });
           let alldata = "";
           let data;
           socket.on("connect", () => {
@@ -113854,7 +113854,7 @@ var require_dockerSocket = __commonJS({
         id = id || "";
         if (id) {
           try {
-            let socket = net2.createConnection({ path: socketPath });
+            let socket = net3.createConnection({ path: socketPath });
             let alldata = "";
             let data;
             socket.on("connect", () => {
@@ -113889,7 +113889,7 @@ var require_dockerSocket = __commonJS({
         id = id || "";
         if (id) {
           try {
-            let socket = net2.createConnection({ path: socketPath });
+            let socket = net3.createConnection({ path: socketPath });
             let alldata = "";
             let data;
             socket.on("connect", () => {
@@ -113924,7 +113924,7 @@ var require_dockerSocket = __commonJS({
         id = id || "";
         if (id) {
           try {
-            let socket = net2.createConnection({ path: socketPath });
+            let socket = net3.createConnection({ path: socketPath });
             let alldata = "";
             let data;
             socket.on("connect", () => {
@@ -113957,7 +113957,7 @@ var require_dockerSocket = __commonJS({
       }
       listVolumes(callback) {
         try {
-          let socket = net2.createConnection({ path: socketPath });
+          let socket = net3.createConnection({ path: socketPath });
           let alldata = "";
           let data;
           socket.on("connect", () => {
@@ -210580,7 +210580,7 @@ var require_util20 = __commonJS({
     var { kDestroyed, kBodyUsed, kListeners, kBody } = require_symbols();
     var { IncomingMessage } = __require("node:http");
     var stream2 = __require("node:stream");
-    var net2 = __require("node:net");
+    var net3 = __require("node:net");
     var { Blob: Blob2 } = __require("node:buffer");
     var nodeUtil = __require("node:util");
     var { stringify: stringify3 } = __require("node:querystring");
@@ -210726,7 +210726,7 @@ var require_util20 = __commonJS({
       }
       assert3(typeof host === "string");
       const servername = getHostname(host);
-      if (net2.isIP(servername)) {
+      if (net3.isIP(servername)) {
         return "";
       }
       return servername;
@@ -212038,7 +212038,7 @@ var require_dispatcher_base = __commonJS({
 var require_connect = __commonJS({
   "packages/core/node_modules/undici/lib/core/connect.js"(exports2, module2) {
     "use strict";
-    var net2 = __require("node:net");
+    var net3 = __require("node:net");
     var assert3 = __require("node:assert");
     var util4 = require_util20();
     var { InvalidArgumentError } = require_errors6();
@@ -212092,7 +212092,7 @@ var require_connect = __commonJS({
         }
       };
     }
-    function buildConnector({ allowH2, maxCachedSessions, socketPath, timeout, session: customSession, ...opts }) {
+    function buildConnector2({ allowH2, maxCachedSessions, socketPath, timeout, session: customSession, ...opts }) {
       if (maxCachedSessions != null && (!Number.isInteger(maxCachedSessions) || maxCachedSessions < 0)) {
         throw new InvalidArgumentError("maxCachedSessions must be a positive integer or zero");
       }
@@ -212130,7 +212130,7 @@ var require_connect = __commonJS({
         } else {
           assert3(!httpSocket, "httpSocket can only be sent on TLS update");
           port = port || 80;
-          socket = net2.connect({
+          socket = net3.connect({
             highWaterMark: 64 * 1024,
             // Same as nodejs fs streams.
             ...options,
@@ -212162,7 +212162,7 @@ var require_connect = __commonJS({
         return socket;
       };
     }
-    module2.exports = buildConnector;
+    module2.exports = buildConnector2;
   }
 });
 
@@ -217276,7 +217276,7 @@ var require_client2 = __commonJS({
   "packages/core/node_modules/undici/lib/dispatcher/client.js"(exports2, module2) {
     "use strict";
     var assert3 = __require("node:assert");
-    var net2 = __require("node:net");
+    var net3 = __require("node:net");
     var http3 = __require("node:http");
     var util4 = require_util20();
     var { ClientStats } = require_stats();
@@ -217288,7 +217288,7 @@ var require_client2 = __commonJS({
       InformationalError,
       ClientDestroyedError
     } = require_errors6();
-    var buildConnector = require_connect();
+    var buildConnector2 = require_connect();
     var {
       kUrl,
       kServerName,
@@ -217423,7 +217423,7 @@ var require_client2 = __commonJS({
         if (maxRequestsPerClient != null && (!Number.isInteger(maxRequestsPerClient) || maxRequestsPerClient < 0)) {
           throw new InvalidArgumentError("maxRequestsPerClient must be a positive number");
         }
-        if (localAddress != null && (typeof localAddress !== "string" || net2.isIP(localAddress) === 0)) {
+        if (localAddress != null && (typeof localAddress !== "string" || net3.isIP(localAddress) === 0)) {
           throw new InvalidArgumentError("localAddress must be valid string IP address");
         }
         if (maxResponseSize != null && (!Number.isInteger(maxResponseSize) || maxResponseSize < -1)) {
@@ -217440,7 +217440,7 @@ var require_client2 = __commonJS({
         }
         super();
         if (typeof connect2 !== "function") {
-          connect2 = buildConnector({
+          connect2 = buildConnector2({
             ...tls,
             maxCachedSessions,
             allowH2,
@@ -217578,7 +217578,7 @@ var require_client2 = __commonJS({
         const idx = hostname3.indexOf("]");
         assert3(idx !== -1);
         const ip = hostname3.substring(1, idx);
-        assert3(net2.isIPv6(ip));
+        assert3(net3.isIPv6(ip));
         hostname3 = ip;
       }
       client[kConnecting] = true;
@@ -218013,7 +218013,7 @@ var require_pool2 = __commonJS({
     } = require_errors6();
     var util4 = require_util20();
     var { kUrl } = require_symbols();
-    var buildConnector = require_connect();
+    var buildConnector2 = require_connect();
     var kOptions = Symbol("options");
     var kConnections = Symbol("connections");
     var kFactory = Symbol("factory");
@@ -218046,7 +218046,7 @@ var require_pool2 = __commonJS({
         }
         super();
         if (typeof connect !== "function") {
-          connect = buildConnector({
+          connect = buildConnector2({
             ...tls,
             maxCachedSessions,
             allowH2,
@@ -218361,7 +218361,7 @@ var require_proxy_agent = __commonJS({
     var Pool = require_pool2();
     var DispatcherBase = require_dispatcher_base();
     var { InvalidArgumentError, RequestAbortedError, SecureProxyConnectionError } = require_errors6();
-    var buildConnector = require_connect();
+    var buildConnector2 = require_connect();
     var Client3 = require_client2();
     var kAgent = Symbol("proxy agent");
     var kClient = Symbol("proxy client");
@@ -218459,8 +218459,8 @@ var require_proxy_agent = __commonJS({
           }
           return new Client3(origin2, options);
         } : void 0;
-        const connect = buildConnector({ ...opts.proxyTls });
-        this[kConnectEndpoint] = buildConnector({ ...opts.requestTls });
+        const connect = buildConnector2({ ...opts.proxyTls });
+        this[kConnectEndpoint] = buildConnector2({ ...opts.requestTls });
         this[kClient] = clientFactory(url3, { connect, factory });
         this[kTunnelProxy] = proxyTunnel;
         this[kAgent] = new Agent2({
@@ -221841,7 +221841,7 @@ var require_dump = __commonJS({
 var require_dns = __commonJS({
   "packages/core/node_modules/undici/lib/interceptor/dns.js"(exports2, module2) {
     "use strict";
-    var { isIP } = __require("node:net");
+    var { isIP: isIP2 } = __require("node:net");
     var { lookup: lookup3 } = __require("node:dns");
     var DecoratorHandler = require_decorator_handler();
     var { InvalidArgumentError, InformationalError } = require_errors6();
@@ -222140,7 +222140,7 @@ var require_dns = __commonJS({
       return (dispatch) => {
         return function dnsInterceptor(origDispatchOpts, handler) {
           const origin = origDispatchOpts.origin.constructor === URL ? origDispatchOpts.origin : new URL(origDispatchOpts.origin);
-          if (isIP(origin.hostname) !== 0) {
+          if (isIP2(origin.hostname) !== 0) {
             return dispatch(origDispatchOpts, handler);
           }
           instance2.runLookup(origin, origDispatchOpts, (err2, newOrigin) => {
@@ -230250,7 +230250,7 @@ var require_undici = __commonJS({
     var util4 = require_util20();
     var { InvalidArgumentError } = errors;
     var api = require_api2();
-    var buildConnector = require_connect();
+    var buildConnector2 = require_connect();
     var MockClient = require_mock_client();
     var { MockCallHistory, MockCallHistoryLog } = require_mock_call_history();
     var MockAgent = require_mock_agent();
@@ -230286,7 +230286,7 @@ var require_undici = __commonJS({
     };
     var SqliteCacheStore = require_sqlite_cache_store();
     module2.exports.cacheStores.SqliteCacheStore = SqliteCacheStore;
-    module2.exports.buildConnector = buildConnector;
+    module2.exports.buildConnector = buildConnector2;
     module2.exports.errors = errors;
     module2.exports.util = {
       parseHeaders: util4.parseHeaders,
@@ -282634,8 +282634,8 @@ function isValidToolName(name3, options = {}) {
 }
 
 // packages/core/dist/src/generated/git-commit.js
-var GIT_COMMIT_INFO = "0bd1d4397";
-var CLI_VERSION = "0.59.0-preview.0";
+var GIT_COMMIT_INFO = "87a9c71d5";
+var CLI_VERSION = "0.60.0-nightly.20260901.g0bd1d4397";
 
 // packages/core/dist/src/ide/detect-ide.js
 var IDE_DEFINITIONS = {
@@ -305929,7 +305929,7 @@ function getVersion() {
   }
   versionPromise = (async () => {
     const pkgJson = await getPackageJson(__dirname4);
-    return "0.59.0-preview.0";
+    return "0.60.0-nightly.20260904.g87a9c71d5";
   })();
   return versionPromise;
 }
@@ -324200,9 +324200,10 @@ var ShellTool = class _ShellTool extends BaseDeclarativeTool {
 };
 
 // packages/core/dist/src/utils/fetch.js
-var import_undici2 = __toESM(require_undici(), 1);
+var undici = __toESM(require_undici(), 1);
 var import_ipaddr = __toESM(require_ipaddr(), 1);
 import { URL as URL5 } from "node:url";
+import * as net2 from "node:net";
 import { lookup } from "node:dns/promises";
 var FetchError = class extends Error {
   code;
@@ -324221,7 +324222,93 @@ var PrivateIpError = class extends Error {
 var defaultHeadersTimeout = 6e4;
 var defaultBodyTimeout = 3e5;
 var currentProxy = void 0;
-(0, import_undici2.setGlobalDispatcher)(new import_undici2.Agent({
+function getBuildConnector() {
+  try {
+    const fn = undici.buildConnector;
+    return typeof fn === "function" ? fn : void 0;
+  } catch {
+    return void 0;
+  }
+}
+function safeLookup(hostname3, options, callback) {
+  const sanitized = sanitizeHostname(hostname3);
+  if (sanitized === "localhost" || sanitized.endsWith(".localhost") || sanitized.endsWith(".local") || sanitized.endsWith(".internal")) {
+    callback(new PrivateIpError(`Access to internal host ${sanitized} is blocked`), "");
+    return;
+  }
+  if (net2.isIP(sanitized)) {
+    if (isAddressPrivate(sanitized)) {
+      callback(new PrivateIpError(`Access to private IP ${sanitized} is blocked`), "");
+      return;
+    }
+    if (options?.all) {
+      callback(null, [{ address: sanitized, family: net2.isIP(sanitized) }]);
+    } else {
+      callback(null, sanitized, net2.isIP(sanitized));
+    }
+    return;
+  }
+  lookup(sanitized, { all: true }).then((addresses) => {
+    if (!addresses || addresses.length === 0) {
+      callback(new Error(`getaddrinfo ENOTFOUND ${sanitized}`), "");
+      return;
+    }
+    for (const addr2 of addresses) {
+      if (isAddressPrivate(addr2.address)) {
+        callback(new PrivateIpError(`Access to private IP ${addr2.address} (resolved from ${sanitized}) is blocked`), "");
+        return;
+      }
+    }
+    if (options?.all) {
+      callback(null, addresses);
+    } else {
+      const family = options?.family;
+      const match2 = family ? addresses.find((a2) => a2.family === family) || addresses[0] : addresses[0];
+      callback(null, match2.address, match2.family);
+    }
+  }).catch((err2) => {
+    callback(err2 instanceof Error ? err2 : new Error(String(err2)), "");
+  });
+}
+function createSafeConnector(connectorOpts, customDefaultConnector) {
+  const buildConnectorFn = getBuildConnector();
+  const safeConnectorOpts = {
+    ...connectorOpts,
+    lookup: safeLookup
+  };
+  const defaultConnector = customDefaultConnector ?? (buildConnectorFn ? buildConnectorFn(safeConnectorOpts) : void 0);
+  return function safeConnect(opts, callback) {
+    if (!defaultConnector) {
+      callback(new Error("Connector is unavailable"), null);
+      return;
+    }
+    const rawHostname = opts.hostname;
+    const sanitized = sanitizeHostname(rawHostname);
+    if (sanitized === "localhost" || sanitized.endsWith(".localhost") || sanitized.endsWith(".local") || sanitized.endsWith(".internal")) {
+      callback(new PrivateIpError(`Access to internal host ${sanitized} is blocked`), null);
+      return;
+    }
+    if (net2.isIP(sanitized) && isAddressPrivate(sanitized)) {
+      callback(new PrivateIpError(`Access to private IP ${sanitized} is blocked`), null);
+      return;
+    }
+    defaultConnector(opts, callback);
+  };
+}
+function createSafeAgent(options) {
+  const buildConnectorFn = getBuildConnector();
+  if (!buildConnectorFn) {
+    throw new Error("Security initialization failed: undici.buildConnector is not available.");
+  }
+  const connect = createSafeConnector();
+  return new undici.Agent({
+    headersTimeout: options?.headersTimeout ?? defaultHeadersTimeout,
+    bodyTimeout: options?.bodyTimeout ?? defaultBodyTimeout,
+    connect
+  });
+}
+var defaultSafeAgent = createSafeAgent();
+undici.setGlobalDispatcher(new undici.Agent({
   headersTimeout: defaultHeadersTimeout,
   bodyTimeout: defaultBodyTimeout
 }));
@@ -324230,10 +324317,14 @@ function updateGlobalFetchTimeouts(timeoutMs) {
     throw new RangeError(`Invalid timeout value: ${timeoutMs}. Must be a positive finite number.`);
   }
   defaultHeadersTimeout = timeoutMs;
+  defaultSafeAgent = createSafeAgent({
+    headersTimeout: defaultHeadersTimeout,
+    bodyTimeout: defaultBodyTimeout
+  });
   if (currentProxy) {
     setGlobalProxy(currentProxy);
   } else {
-    (0, import_undici2.setGlobalDispatcher)(new import_undici2.Agent({
+    undici.setGlobalDispatcher(new undici.Agent({
       headersTimeout: defaultHeadersTimeout,
       bodyTimeout: defaultBodyTimeout
     }));
@@ -324246,14 +324337,6 @@ function isLoopbackHost(hostname3) {
   const sanitized = sanitizeHostname(hostname3);
   return sanitized === "localhost" || sanitized === "127.0.0.1" || sanitized === "::1";
 }
-function isPrivateIp(url3) {
-  try {
-    const hostname3 = new URL5(url3).hostname;
-    return isAddressPrivate(hostname3);
-  } catch {
-    return false;
-  }
-}
 var IANA_BENCHMARK_RANGE = import_ipaddr.default.parseCIDR("198.18.0.0/15");
 function isBenchmarkAddress(addr2) {
   const [rangeAddr, rangeMask] = IANA_BENCHMARK_RANGE;
@@ -324261,7 +324344,7 @@ function isBenchmarkAddress(addr2) {
 }
 function isAddressPrivate(address) {
   const sanitized = sanitizeHostname(address);
-  if (sanitized === "localhost") {
+  if (sanitized === "localhost" || sanitized.endsWith(".localhost") || sanitized.endsWith(".local") || sanitized.endsWith(".internal")) {
     return true;
   }
   try {
@@ -324281,27 +324364,53 @@ function isAddressPrivate(address) {
   }
 }
 async function isPrivateIpAsync(url3) {
+  let parsedUrl;
   try {
-    const parsedUrl = new URL5(url3);
-    const hostname3 = parsedUrl.hostname;
-    if (isLoopbackHost(hostname3)) {
+    parsedUrl = new URL5(url3);
+  } catch (error40) {
+    if (error40 instanceof TypeError) {
       return false;
     }
+    throw error40;
+  }
+  const hostname3 = sanitizeHostname(parsedUrl.hostname);
+  if (hostname3 === "localhost" || hostname3.endsWith(".localhost") || hostname3.endsWith(".local") || hostname3.endsWith(".internal")) {
+    return true;
+  }
+  if (net2.isIP(hostname3)) {
+    return isAddressPrivate(hostname3);
+  }
+  try {
     const addresses = await lookup(hostname3, { all: true });
+    if (!addresses || addresses.length === 0) {
+      return true;
+    }
     return addresses.some((addr2) => isAddressPrivate(addr2.address));
   } catch (error40) {
-    if (error40 instanceof TypeError) {
-      return false;
-    }
     throw new Error("Failed to verify if URL resolves to private IP", {
       cause: error40
     });
   }
 }
+async function isPrivateIp(url3) {
+  try {
+    return await isPrivateIpAsync(url3);
+  } catch {
+    return true;
+  }
+}
+async function validateUrlDestination(url3) {
+  try {
+    const isPrivate = await isPrivateIp(url3);
+    return !isPrivate;
+  } catch {
+    return false;
+  }
+}
 function createSafeProxyAgent(proxyUrl) {
   const trimmedProxy = proxyUrl.trim();
   const noProxy = (process.env["NO_PROXY"] ?? process.env["no_proxy"] ?? "")?.trim();
-  return new import_undici2.EnvHttpProxyAgent({
+  return new undici.EnvHttpProxyAgent({
     httpProxy: trimmedProxy,
     httpsProxy: trimmedProxy,
     noProxy,
@@ -324310,6 +324419,9 @@ function createSafeProxyAgent(proxyUrl) {
   });
 }
 async function fetchWithTimeout(url3, timeout, options) {
+  if (await isPrivateIp(url3)) {
+    throw new PrivateIpError(`Access to blocked or private host ${url3} is not allowed.`);
+  }
   const controller = new AbortController();
   const timeoutId = setTimeout(() => controller.abort(), timeout);
   if (options?.signal) {
@@ -324322,10 +324434,14 @@ async function fetchWithTimeout(url3, timeout, options) {
     }
   }
   try {
-    const response = await fetch(url3, {
+    const fetchOptions = {
       ...options,
       signal: controller.signal
-    });
+    };
+    if (!fetchOptions.dispatcher) {
+      fetchOptions.dispatcher = currentProxy ? createSafeProxyAgent(currentProxy) : defaultSafeAgent;
+    }
+    const response = await fetch(url3, fetchOptions);
     return response;
   } catch (error40) {
     if (isAbortError(error40)) {
@@ -324334,6 +324450,14 @@ async function fetchWithTimeout(url3, timeout, options) {
       }
       throw new FetchError(`Request timed out after ${timeout}ms`, "ETIMEDOUT");
     }
+    if (error40 instanceof PrivateIpError) {
+      throw error40;
+    }
+    if (error40 && typeof error40 === "object" && "cause" in error40) {
+      if (error40.cause instanceof PrivateIpError) {
+        throw error40.cause;
+      }
+    }
     throw new FetchError(getErrorMessage(error40), void 0, { cause: error40 });
   } finally {
     clearTimeout(timeoutId);
@@ -324343,7 +324467,7 @@ function setGlobalProxy(proxy2) {
   const trimmedProxy = proxy2.trim();
   currentProxy = trimmedProxy;
   const noProxy = (process.env["NO_PROXY"] ?? process.env["no_proxy"] ?? "")?.trim();
-  (0, import_undici2.setGlobalDispatcher)(new import_undici2.EnvHttpProxyAgent({
+  undici.setGlobalDispatcher(new undici.EnvHttpProxyAgent({
     httpProxy: trimmedProxy,
     httpsProxy: trimmedProxy,
     noProxy,
@@ -329396,21 +329520,21 @@ var WebFetchToolInvocation = class extends BaseToolInvocation {
     });
     logNetworkRetryAttempt(this.context.config, new NetworkRetryAttemptEvent(attempt, maxAttempts, errorType, delayMs, modelName));
   }
-  isBlockedHost(urlStr) {
+  async isBlockedHost(urlStr) {
     try {
       const url3 = new URL(urlStr);
       const hostname3 = url3.hostname.toLowerCase();
-      if (hostname3 === "localhost" || hostname3 === "127.0.0.1") {
+      if (hostname3 === "localhost" || hostname3 === "127.0.0.1" || hostname3.endsWith(".localhost") || hostname3.endsWith(".local") || hostname3.endsWith(".internal")) {
         return true;
       }
-      return isPrivateIp(urlStr);
+      return await isPrivateIp(urlStr);
     } catch {
       return true;
     }
   }
   async executeFallbackForUrl(urlStr, signal) {
     const url3 = convertGithubUrlToRaw(urlStr);
-    if (this.isBlockedHost(url3)) {
+    if (await this.isBlockedHost(url3)) {
       debugLogger.warn(`[WebFetchTool] Blocked access to host: ${url3}`);
       throw new Error(`Access to blocked or private host ${url3} is not allowed.`);
     }
@@ -329452,12 +329576,12 @@ var WebFetchToolInvocation = class extends BaseToolInvocation {
     }
     return textContent2;
   }
-  filterAndValidateUrls(urls) {
+  async filterAndValidateUrls(urls) {
     const uniqueUrls = [...new Set(urls.map(normalizeUrl))];
     const toFetch = [];
     const skipped = [];
     for (const url3 of uniqueUrls) {
-      if (this.isBlockedHost(url3)) {
+      if (await this.isBlockedHost(url3)) {
         debugLogger.warn(`[WebFetchTool] Skipped private or local host: ${url3}`);
         logWebFetchFallbackAttempt(this.context.config, new WebFetchFallbackAttemptEvent("private_ip_skipped"));
         skipped.push(`[Blocked Host] ${url3}`);
@@ -329647,7 +329771,7 @@ ${aggregatedContent}
       };
     }
     url3 = convertGithubUrlToRaw(url3);
-    if (this.isBlockedHost(url3)) {
+    if (await this.isBlockedHost(url3)) {
       const errorMessage = `Access to blocked or private host ${url3} is not allowed.`;
       debugLogger.warn(`[WebFetchTool] Blocked experimental fetch to host: ${url3}`);
       return {
@@ -329761,7 +329885,7 @@ Response: ${rawResponseText}`;
     }
     const userPrompt = this.params.prompt;
     const { validUrls } = parsePrompt(userPrompt);
-    const { toFetch, skipped } = this.filterAndValidateUrls(validUrls);
+    const { toFetch, skipped } = await this.filterAndValidateUrls(validUrls);
     if (toFetch.length === 0 && skipped.length > 0) {
       const errorMessage = `All requested URLs were skipped: ${skipped.join(", ")}`;
       debugLogger.error(`[WebFetchTool] ${errorMessage}`);
@@ -339036,7 +339160,7 @@ var A2AAuthProviderFactory = class _A2AAuthProviderFactory {
         return provider;
       }
       case "oauth2": {
-        const { OAuth2AuthProvider } = await import("./oauth2-provider-2DCMBS2D.js");
+        const { OAuth2AuthProvider } = await import("./oauth2-provider-VY2YQMRH.js");
         const provider = new OAuth2AuthProvider(authConfig, options.agentName ?? "unknown", agentCard, options.agentCardUrl);
         await provider.initialize();
         return provider;
@@ -366225,7 +366349,7 @@ var SSEClientTransport = class {
 };
 
 // packages/core/dist/src/tools/mcp-client.js
-var import_undici3 = __toESM(require_undici(), 1);
+var import_undici2 = __toESM(require_undici(), 1);
 var import_shell_quote7 = __toESM(require_shell_quote(), 1);
 
 // packages/core/dist/src/mcp/google-auth-provider.js
@@ -366698,7 +366822,29 @@ function generatePKCEParams() {
   const state = crypto20.randomBytes(16).toString("base64url");
   return { codeVerifier, codeChallenge, state };
 }
-function startCallbackServer(expectedState, port) {
+function areIssuersEqual(issuerA, issuerB) {
+  if (issuerA === issuerB && !issuerA.includes("@"))
+    return true;
+  const normalize6 = (iss) => {
+    try {
+      const u2 = new URL6(iss);
+      if (u2.username || u2.password) {
+        return null;
+      }
+      const normalizedPath = u2.pathname.replace(/\/+$/, "");
+      return `${u2.protocol}//${u2.host}${normalizedPath}${u2.search}${u2.hash}`;
+    } catch {
+      return iss.replace(/\/+$/, "");
+    }
+  };
+  const normA = normalize6(issuerA);
+  const normB = normalize6(issuerB);
+  if (normA === null || normB === null) {
+    return false;
+  }
+  return normA === normB;
+}
+function startCallbackServer(expectedState, port, expectedIssuer) {
   let portResolve;
   let portReject;
   const portPromise = new Promise((resolve29, reject) => {
@@ -366719,7 +366865,9 @@ function startCallbackServer(expectedState, port) {
         const code = url3.searchParams.get("code");
         const state = url3.searchParams.get("state");
         const error40 = url3.searchParams.get("error");
+        const iss = url3.searchParams.get("iss") || void 0;
         if (error40) {
+          debugLogger.warn(`OAuth callback received error: ${error40}`);
           res.writeHead(HTTP_OK, { "Content-Type": "text/html" });
           res.end(`
               <html>
@@ -366736,17 +366884,56 @@ function startCallbackServer(expectedState, port) {
           return;
         }
         if (!code || !state) {
+          debugLogger.warn("OAuth callback rejected: Missing code or state parameter.");
           res.writeHead(400);
           res.end("Missing code or state parameter");
           return;
         }
         if (state !== expectedState) {
+          debugLogger.error(`OAuth callback state mismatch: received state "${state}", expected "${expectedState}". Possible CSRF attack.`);
           res.writeHead(400);
           res.end("Invalid state parameter");
           server.close();
           reject(new Error("State mismatch - possible CSRF attack"));
           return;
         }
+        if (expectedIssuer) {
+          if (!iss) {
+            debugLogger.error('OAuth callback rejected: Missing required "iss" parameter when an expected issuer is configured. Possible IdP mix-up attack (RFC 9207).');
+            res.writeHead(400, { "Content-Type": "text/html" });
+            res.end(`
+                <html>
+                  <body>
+                    <h1>Authentication Failed</h1>
+                    <p>Error: Missing issuer parameter in response.</p>
+                    <p>You can close this window.</p>
+                  </body>
+                </html>
+              `);
+            server.close();
+            reject(new Error('Missing "iss" parameter in authorization response per RFC 9207'));
+            return;
+          }
+          if (!areIssuersEqual(iss, expectedIssuer)) {
+            debugLogger.error("OAuth callback rejected: Issuer mismatch between authorization response and expected authorization server. Possible IdP mix-up attack (RFC 9207).");
+            res.writeHead(400, { "Content-Type": "text/html" });
+            res.end(`
+                <html>
+                  <body>
+                    <h1>Authentication Failed</h1>
+                    <p>Error: Issuer mismatch - possible OAuth mix-up attack.</p>
+                    <p>You can close this window.</p>
+                  </body>
+                </html>
+              `);
+            server.close();
+            reject(new Error("Issuer mismatch in authorization response - possible OAuth mix-up attack"));
+            return;
+          }
+          debugLogger.debug("\u2713 OAuth callback issuer validated successfully.");
+        } else if (iss) {
+          debugLogger.debug('OAuth callback received "iss" parameter (no expected issuer was configured).');
+        }
         res.writeHead(HTTP_OK, { "Content-Type": "text/html" });
         res.end(`
             <html>
@@ -366758,7 +366945,7 @@ function startCallbackServer(expectedState, port) {
             </html>
           `);
         server.close();
-        resolve29({ code, state });
+        resolve29({ code, state, iss });
       } catch (error40) {
         server.close();
         reject(error40);
@@ -367181,7 +367368,8 @@ var MCPOAuthProvider = class {
     }
     const pkceParams = generatePKCEParams();
     const preferredPort = getPortFromUrl(config2.redirectUri);
-    const callbackServer = startCallbackServer(pkceParams.state, preferredPort);
+    debugLogger.debug(`Starting callback server for "${serverName}" (expected issuer: ${config2.issuer || "none"})...`);
+    const callbackServer = startCallbackServer(pkceParams.state, preferredPort, config2.issuer);
     const redirectPort = await callbackServer.port;
     debugLogger.debug(`Callback server listening on port ${redirectPort}`);
     if (!config2.clientId) {
@@ -368506,7 +368694,7 @@ async function connectToMcpServer(clientVersion, mcpServerName, mcpServerConfig,
 }
 function createUrlTransport(mcpServerName, mcpServerConfig, transportOptions) {
   const noProxy = process.env["NO_PROXY"] || process.env["no_proxy"];
-  const agent = new import_undici3.EnvHttpProxyAgent({ noProxy });
+  const agent = new import_undici2.EnvHttpProxyAgent({ noProxy });
   const baseFetch = transportOptions.fetch ?? globalThis.fetch;
   const httpOptions = {
     ...transportOptions,
@@ -376683,7 +376871,7 @@ function v43(options, buf, offset) {
 var v4_default3 = v43;
 
 // packages/core/dist/src/agents/a2a-client-manager.js
-var import_undici4 = __toESM(require_undici(), 1);
+var import_undici3 = __toESM(require_undici(), 1);
 var A2A_TIMEOUT = 18e5;
 var A2AClientManager = class {
   config;
@@ -376700,12 +376888,12 @@ var A2AClientManager = class {
       bodyTimeout: A2A_TIMEOUT
     };
     if (proxyUrl) {
-      this.a2aDispatcher = new import_undici4.ProxyAgent({
+      this.a2aDispatcher = new import_undici3.ProxyAgent({
         uri: proxyUrl,
         ...agentOptions
       });
     } else {
-      this.a2aDispatcher = new import_undici4.Agent(agentOptions);
+      this.a2aDispatcher = new import_undici3.Agent(agentOptions);
     }
     this.a2aFetch = (input, init2) => fetch(input, { ...init2, dispatcher: this.a2aDispatcher });
   }
@@ -396887,12 +397075,16 @@ export {
   ShellTool,
   FetchError,
   PrivateIpError,
+  safeLookup,
+  createSafeConnector,
+  createSafeAgent,
   updateGlobalFetchTimeouts,
   sanitizeHostname,
   isLoopbackHost,
-  isPrivateIp,
   isAddressPrivate,
   isPrivateIpAsync,
+  isPrivateIp,
+  validateUrlDestination,
   createSafeProxyAgent,
   fetchWithTimeout,
   setGlobalProxy,