@jami-studio/core 0.92.25 → 0.92.27

package/corpus/core/src/extensions/url-safety.ts

@@ -1,306 +1,363 @@
-const METADATA_HOSTS = [
-  "metadata.google.internal",
-  "metadata.google.internal.",
-];
-
-const DNS_REBIND_SUFFIXES = [
-  ".nip.io",
-  ".sslip.io",
-  ".xip.io",
-  ".localtest.me",
-  ".lvh.me",
-];
-
-function isPrivateIpv4(a: number, b: number, c = 0, d = 0): boolean {
-  if (![a, b, c, d].every((part) => part >= 0 && part <= 255)) return true;
-  if (a === 127) return true;
-  if (a === 10) return true;
-  if (a === 172 && b >= 16 && b <= 31) return true;
-  if (a === 192 && b === 168) return true;
-  if (a === 169 && b === 254) return true;
-  if (a === 0) return true;
-  if (a === 100 && b >= 64 && b <= 127) return true;
-  if (a === 192 && b === 0) return true;
-  if (a === 198 && (b === 18 || b === 19)) return true;
-  if (a === 192 && b === 0 && c === 2) return true;
-  if (a === 198 && b === 51 && c === 100) return true;
-  if (a === 203 && b === 0 && c === 113) return true;
-  if (a >= 224) return true;
-  return false;
-}
-
-function isPrivateIpv4MappedHex(host: string): boolean {
-  const mapped = host.match(/^::ffff:([0-9a-f]{1,4}):([0-9a-f]{1,4})$/i);
-  if (!mapped) return false;
-  const high = Number.parseInt(mapped[1], 16);
-  const low = Number.parseInt(mapped[2], 16);
-  if (high < 0 || high > 0xffff || low < 0 || low > 0xffff) return false;
-  const a = (high >> 8) & 0xff;
-  const b = high & 0xff;
-  const c = (low >> 8) & 0xff;
-  const d = low & 0xff;
-  return isPrivateIpv4(a, b, c, d);
-}
-
-function isPrivateHost(hostname: string): boolean {
-  const host = hostname.toLowerCase().replace(/^\[|\]$/g, "");
-  if (
-    host === "localhost" ||
-    host === "::1" ||
-    host === "::0" ||
-    host === "::"
-  ) {
-    return true;
-  }
-  if (METADATA_HOSTS.includes(host)) return true;
-
-  // IPv6 ULA/link-local/multicast.
-  if (/^f[cd]/.test(host) || /^fe[89ab]/.test(host)) return true;
-  if (/^ff/i.test(host)) return true;
-
-  // IPv4-mapped IPv6. URL parsing may preserve dotted form in some runtimes
-  // or normalize it to hex, e.g. [::ffff:127.0.0.1] -> ::ffff:7f00:1.
-  const v4mappedDotted = host.match(/^::ffff:(\d+\.\d+\.\d+\.\d+)$/);
-  if (v4mappedDotted) {
-    const [a, b, c, d] = v4mappedDotted[1].split(".").map(Number);
-    if (isPrivateIpv4(a, b, c, d)) return true;
-  }
-  if (isPrivateIpv4MappedHex(host)) return true;
-
-  // Dotted IPv4. URL parsing normalizes shorthand/octal/hex IPv4 forms to
-  // dotted decimal before we reach this point.
-  const parts = host.split(".");
-  if (parts.length === 4 && parts.every((p) => /^\d+$/.test(p))) {
-    const [a, b, c, d] = parts.map(Number);
-    if (isPrivateIpv4(a, b, c, d)) return true;
-  }
-
-  // Decimal integer IPv4.
-  if (/^\d+$/.test(host)) {
-    const num = Number(host);
-    if (num >= 0 && num <= 0xffffffff) {
-      const a = (num >>> 24) & 0xff;
-      const b = (num >>> 16) & 0xff;
-      const c = (num >>> 8) & 0xff;
-      const d = num & 0xff;
-      if (isPrivateIpv4(a, b, c, d)) return true;
-    }
-  }
-
-  return false;
-}
-
-export function isBlockedExtensionUrl(url: string): boolean {
-  try {
-    const parsed = new URL(url);
-    if (parsed.protocol !== "http:" && parsed.protocol !== "https:") {
-      return true;
-    }
-    const host = parsed.hostname.toLowerCase();
-    if (isPrivateHost(host)) return true;
-    if (
-      DNS_REBIND_SUFFIXES.some((suffix) => {
-        const bare = suffix.slice(1);
-        return host === bare || host.endsWith(suffix);
-      })
-    ) {
-      return true;
-    }
-  } catch {
-    return true;
-  }
-  return false;
-}
-
-function isIpLiteralHost(hostname: string): boolean {
-  const host = hostname.toLowerCase().replace(/^\[|\]$/g, "");
-  if (host.includes(":")) return true;
-  const parts = host.split(".");
-  return parts.length === 4 && parts.every((p) => /^\d+$/.test(p));
-}
-
-/**
- * Async SSRF guard for environments that can resolve DNS. The synchronous
- * guard catches literals and known rebinding domains; this closes the common
- * "public hostname resolves to a private address" gap before dispatch.
- */
-export async function isBlockedExtensionUrlWithDns(
-  url: string,
-): Promise<boolean> {
-  if (isBlockedExtensionUrl(url)) return true;
-
-  let hostname: string;
-  try {
-    hostname = new URL(url).hostname.toLowerCase();
-  } catch {
-    return true;
-  }
-  if (!hostname || isIpLiteralHost(hostname)) return false;
-
-  try {
-    const { lookup } = await import("node:dns/promises");
-    const records = await lookup(hostname, { all: true, verbatim: true });
-    return records.some((record) => isPrivateHost(record.address));
-  } catch {
-    // Some edge runtimes do not expose DNS lookup. Keep the deterministic
-    // parser-based protections instead of failing every outbound request.
-    return false;
-  }
-}
-
-/**
- * Build an undici Dispatcher whose connect-time DNS lookup runs through a
- * private-IP guard. This closes the TOCTOU gap where:
- *   1. We resolve hostname → public IP and pass.
- *   2. Between that lookup and the actual connect, DNS rebinding flips the
- *      record to a private IP.
- *   3. fetch() resolves again and connects to the private IP.
- *
- * With a custom dispatcher, the same lookup that produces the IP also gates
- * the connect: if the IP is in the private set, the connect throws.
- *
- * Returns `null` if undici / node:dns are not available (e.g. some edge
- * runtimes); the caller should fall back to the regular `fetch` path —
- * `isBlockedExtensionUrlWithDns` will still have caught most rebinding cases.
- */
-export async function createSsrfSafeDispatcher(): Promise<unknown | null> {
-  // Keep the optional undici import opaque to Vite/Rolldown. A static
-  // `import("undici")` makes browser builds try to resolve and bundle undici
-  // even though this dispatcher is only useful in Node server runtimes.
-  let undici: any;
-  let dnsModule: any;
-  try {
-    const runtimeImport = new Function(
-      "specifier",
-      "return import(specifier)",
-    ) as (specifier: string) => Promise<any>;
-    undici = await runtimeImport("undici");
-    dnsModule = await import("node:dns");
-  } catch {
-    return null;
-  }
-
-  const { Agent } = undici;
-  const { lookup } = dnsModule;
-  if (!Agent || !lookup) return null;
-
-  return new Agent({
-    connect: {
-      // Override DNS lookup at connect time so the IP we hand to undici's
-      // socket is the one we authorized. Reject any record in the private
-      // set BEFORE the TCP handshake.
-      lookup: (
-        hostname: string,
-        options: any,
-        callback: (
-          err: NodeJS.ErrnoException | null,
-          address?: string | { address: string; family: number }[],
-          family?: number,
-        ) => void,
-      ) => {
-        lookup(
-          hostname,
-          { all: true, verbatim: true },
-          (err: NodeJS.ErrnoException | null, addresses: any) => {
-            if (err) return callback(err);
-            const list: { address: string; family: number }[] = Array.isArray(
-              addresses,
-            )
-              ? addresses
-              : [{ address: addresses, family: 4 }];
-            for (const record of list) {
-              if (isPrivateHost(record.address)) {
-                const e = new Error(
-                  `Connect blocked: ${hostname} resolved to private address ${record.address}`,
-                ) as NodeJS.ErrnoException;
-                e.code = "EAI_BLOCKED";
-                return callback(e);
-              }
-            }
-            // Mirror Node's lookup behavior: when `all` is true, return the
-            // array; otherwise the first entry. undici's connect honors
-            // `options.all`.
-            if (options && options.all) {
-              return callback(null, list as any);
-            }
-            const first = list[0];
-            return callback(null, first.address, first.family);
-          },
-        );
-      },
-    },
-  });
-}
-
-/**
- * SSRF-safe `fetch` for any server-side request to a user/agent-supplied URL.
- *
- * Applies the same protections the extension proxy uses, so every call site
- * that fetches an untrusted URL gets them without re-implementing the loop:
- *   1. Pre-flight DNS-aware private-address check (isBlockedExtensionUrlWithDns)
- *      on the initial URL and on every redirect hop.
- *   2. A connect-time dispatcher that re-checks the resolved IP at TCP-connect
- *      time (closes the DNS-rebinding TOCTOU) when undici is available.
- *   3. Manual redirect handling — a public URL cannot 30x-redirect into the
- *      private network because each hop is re-validated before it is followed.
- *
- * Throws an Error whose message starts with "SSRF blocked:" when a target
- * (initial or via redirect) resolves to a private/internal address, or when the
- * redirect limit is exceeded. Otherwise returns the final Response.
- *
- * `httpsOnly` extends the per-hop validation to the URL scheme: redirects are
- * followed only to `https:` targets, so an HTTPS-only caller cannot be
- * downgraded to plain HTTP by a 30x from the (untrusted) origin.
- */
-export async function ssrfSafeFetch(
-  url: string,
-  init: RequestInit = {},
-  options: { maxRedirects?: number; httpsOnly?: boolean } = {},
-): Promise<Response> {
-  const maxRedirects = options.maxRedirects ?? 3;
-  const dispatcher = (await createSsrfSafeDispatcher()) ?? undefined;
-
-  let currentUrl = url;
-  for (let hop = 0; hop <= maxRedirects; hop++) {
-    if (options.httpsOnly && new URL(currentUrl).protocol !== "https:") {
-      throw new Error(
-        `SSRF blocked: refusing to fetch non-HTTPS address (${currentUrl})`,
-      );
-    }
-    if (await isBlockedExtensionUrlWithDns(currentUrl)) {
-      throw new Error(
-        `SSRF blocked: refusing to fetch private/internal address (${currentUrl})`,
-      );
-    }
-    const fetchOpts: RequestInit & { dispatcher?: unknown } = {
-      ...init,
-      redirect: "manual",
-    };
-    if (dispatcher) fetchOpts.dispatcher = dispatcher;
-
-    const response = await fetch(currentUrl, fetchOpts);
-    if (response.status >= 300 && response.status < 400) {
-      const location = response.headers.get("location");
-      if (!location) return response;
-      // Drain the redirect body so the hop's connection is released instead
-      // of being held until GC.
-      await response.body?.cancel().catch(() => {});
-      currentUrl = new URL(location, currentUrl).href;
-      continue;
-    }
-    return response;
-  }
-  throw new Error(
-    `SSRF blocked: too many redirects (>${maxRedirects}) while fetching ${url}`,
-  );
-}
-
-// ─────────────────────────────────────────────────────────────────────────────
-// Legacy aliases — predate the Tools → Extensions rename. Templates import
-// these via the legacy `@agent-native/core/tools/url-safety` subpath; keep
-// the names exported so they keep resolving until every consumer updates.
-// ─────────────────────────────────────────────────────────────────────────────
-
-export { isBlockedExtensionUrl as isBlockedToolUrl };
-export { isBlockedExtensionUrlWithDns as isBlockedToolUrlWithDns };
-export { ssrfSafeFetch as ssrfSafeToolFetch };
+const METADATA_HOSTS = [
+  "metadata.google.internal",
+  "metadata.google.internal.",
+];
+
+const DNS_REBIND_SUFFIXES = [
+  ".nip.io",
+  ".sslip.io",
+  ".xip.io",
+  ".localtest.me",
+  ".lvh.me",
+];
+
+function isPrivateIpv4(a: number, b: number, c = 0, d = 0): boolean {
+  if (![a, b, c, d].every((part) => part >= 0 && part <= 255)) return true;
+  if (a === 127) return true;
+  if (a === 10) return true;
+  if (a === 172 && b >= 16 && b <= 31) return true;
+  if (a === 192 && b === 168) return true;
+  if (a === 169 && b === 254) return true;
+  if (a === 0) return true;
+  if (a === 100 && b >= 64 && b <= 127) return true;
+  if (a === 192 && b === 0) return true;
+  if (a === 198 && (b === 18 || b === 19)) return true;
+  if (a === 192 && b === 0 && c === 2) return true;
+  if (a === 198 && b === 51 && c === 100) return true;
+  if (a === 203 && b === 0 && c === 113) return true;
+  if (a >= 224) return true;
+  return false;
+}
+
+function isPrivateIpv4MappedHex(host: string): boolean {
+  const mapped = host.match(/^::ffff:([0-9a-f]{1,4}):([0-9a-f]{1,4})$/i);
+  if (!mapped) return false;
+  const high = Number.parseInt(mapped[1], 16);
+  const low = Number.parseInt(mapped[2], 16);
+  if (high < 0 || high > 0xffff || low < 0 || low > 0xffff) return false;
+  const a = (high >> 8) & 0xff;
+  const b = high & 0xff;
+  const c = (low >> 8) & 0xff;
+  const d = low & 0xff;
+  return isPrivateIpv4(a, b, c, d);
+}
+
+function isPrivateHost(hostname: string): boolean {
+  const host = hostname.toLowerCase().replace(/^\[|\]$/g, "");
+  if (
+    host === "localhost" ||
+    host === "::1" ||
+    host === "::0" ||
+    host === "::"
+  ) {
+    return true;
+  }
+  if (METADATA_HOSTS.includes(host)) return true;
+
+  // IPv6 ULA/link-local/multicast.
+  if (/^f[cd]/.test(host) || /^fe[89ab]/.test(host)) return true;
+  if (/^ff/i.test(host)) return true;
+
+  // IPv4-mapped IPv6. URL parsing may preserve dotted form in some runtimes
+  // or normalize it to hex, e.g. [::ffff:127.0.0.1] -> ::ffff:7f00:1.
+  const v4mappedDotted = host.match(/^::ffff:(\d+\.\d+\.\d+\.\d+)$/);
+  if (v4mappedDotted) {
+    const [a, b, c, d] = v4mappedDotted[1].split(".").map(Number);
+    if (isPrivateIpv4(a, b, c, d)) return true;
+  }
+  if (isPrivateIpv4MappedHex(host)) return true;
+
+  // Dotted IPv4. URL parsing normalizes shorthand/octal/hex IPv4 forms to
+  // dotted decimal before we reach this point.
+  const parts = host.split(".");
+  if (parts.length === 4 && parts.every((p) => /^\d+$/.test(p))) {
+    const [a, b, c, d] = parts.map(Number);
+    if (isPrivateIpv4(a, b, c, d)) return true;
+  }
+
+  // Decimal integer IPv4.
+  if (/^\d+$/.test(host)) {
+    const num = Number(host);
+    if (num >= 0 && num <= 0xffffffff) {
+      const a = (num >>> 24) & 0xff;
+      const b = (num >>> 16) & 0xff;
+      const c = (num >>> 8) & 0xff;
+      const d = num & 0xff;
+      if (isPrivateIpv4(a, b, c, d)) return true;
+    }
+  }
+
+  return false;
+}
+
+export function isBlockedExtensionUrl(url: string): boolean {
+  try {
+    const parsed = new URL(url);
+    if (parsed.protocol !== "http:" && parsed.protocol !== "https:") {
+      return true;
+    }
+    const host = parsed.hostname.toLowerCase();
+    if (isPrivateHost(host)) return true;
+    if (
+      DNS_REBIND_SUFFIXES.some((suffix) => {
+        const bare = suffix.slice(1);
+        return host === bare || host.endsWith(suffix);
+      })
+    ) {
+      return true;
+    }
+  } catch {
+    return true;
+  }
+  return false;
+}
+
+function isIpLiteralHost(hostname: string): boolean {
+  const host = hostname.toLowerCase().replace(/^\[|\]$/g, "");
+  if (host.includes(":")) return true;
+  const parts = host.split(".");
+  return parts.length === 4 && parts.every((p) => /^\d+$/.test(p));
+}
+
+/**
+ * Async SSRF guard for environments that can resolve DNS. The synchronous
+ * guard catches literals and known rebinding domains; this closes the common
+ * "public hostname resolves to a private address" gap before dispatch.
+ */
+export async function isBlockedExtensionUrlWithDns(
+  url: string,
+): Promise<boolean> {
+  if (isBlockedExtensionUrl(url)) return true;
+
+  let hostname: string;
+  try {
+    hostname = new URL(url).hostname.toLowerCase();
+  } catch {
+    return true;
+  }
+  if (!hostname || isIpLiteralHost(hostname)) return false;
+
+  try {
+    const { lookup } = await import("node:dns/promises");
+    const records = await lookup(hostname, { all: true, verbatim: true });
+    return records.some((record) => isPrivateHost(record.address));
+  } catch {
+    // Some edge runtimes do not expose DNS lookup. Keep the deterministic
+    // parser-based protections instead of failing every outbound request.
+    return false;
+  }
+}
+
+/**
+ * Origins the deployment itself declares as its own surfaces. These come from
+ * operator-controlled configuration (env), NOT from user/agent input, so a
+ * fetch to them is a self-call, not an SSRF: cross-app A2A on a workspace
+ * (call-agent) targets sibling apps at the deployment's own base URL, and in
+ * local dev / self-hosted private networks that origin is a loopback or
+ * RFC-1918 address the private-address guard would otherwise block — which
+ * broke every workspace-internal agent call on `wrangler pages dev` and the
+ * dev gateway. Only EXACT origin matches (scheme + host + port) are trusted;
+ * everything else keeps the full SSRF policy (including redirect hops).
+ */
+export function trustedInternalOrigins(): Set<string> {
+  const origins = new Set<string>();
+  const addUrl = (value: unknown) => {
+    if (typeof value !== "string" || !value.trim()) return;
+    try {
+      origins.add(new URL(value).origin);
+    } catch {
+      // Ignore malformed configured URLs — they never matched anything.
+    }
+  };
+  const env = (globalThis as any)?.process?.env ?? {};
+  addUrl(env.APP_URL);
+  addUrl(env.BETTER_AUTH_URL);
+  addUrl(env.WEBHOOK_BASE_URL);
+  addUrl(env.WORKSPACE_GATEWAY_URL);
+  const manifestJson = env.AGENT_NATIVE_WORKSPACE_APPS_JSON;
+  if (typeof manifestJson === "string" && manifestJson.trim()) {
+    try {
+      const apps = JSON.parse(manifestJson);
+      if (Array.isArray(apps)) {
+        for (const app of apps) addUrl(app?.url);
+      }
+    } catch {
+      // Malformed manifest — no trusted origins from it.
+    }
+  }
+  return origins;
+}
+
+/** True when `url`'s origin exactly matches a configured internal origin. */
+export function isTrustedInternalUrl(url: string): boolean {
+  try {
+    return trustedInternalOrigins().has(new URL(url).origin);
+  } catch {
+    return false;
+  }
+}
+
+/**
+ * Build an undici Dispatcher whose connect-time DNS lookup runs through a
+ * private-IP guard. This closes the TOCTOU gap where:
+ *   1. We resolve hostname → public IP and pass.
+ *   2. Between that lookup and the actual connect, DNS rebinding flips the
+ *      record to a private IP.
+ *   3. fetch() resolves again and connects to the private IP.
+ *
+ * With a custom dispatcher, the same lookup that produces the IP also gates
+ * the connect: if the IP is in the private set, the connect throws.
+ *
+ * Returns `null` if undici / node:dns are not available (e.g. some edge
+ * runtimes); the caller should fall back to the regular `fetch` path —
+ * `isBlockedExtensionUrlWithDns` will still have caught most rebinding cases.
+ */
+export async function createSsrfSafeDispatcher(): Promise<unknown | null> {
+  // Keep the optional undici import opaque to Vite/Rolldown. A static
+  // `import("undici")` makes browser builds try to resolve and bundle undici
+  // even though this dispatcher is only useful in Node server runtimes.
+  let undici: any;
+  let dnsModule: any;
+  try {
+    const runtimeImport = new Function(
+      "specifier",
+      "return import(specifier)",
+    ) as (specifier: string) => Promise<any>;
+    undici = await runtimeImport("undici");
+    dnsModule = await import("node:dns");
+  } catch {
+    return null;
+  }
+
+  const { Agent } = undici;
+  const { lookup } = dnsModule;
+  if (!Agent || !lookup) return null;
+
+  return new Agent({
+    connect: {
+      // Override DNS lookup at connect time so the IP we hand to undici's
+      // socket is the one we authorized. Reject any record in the private
+      // set BEFORE the TCP handshake.
+      lookup: (
+        hostname: string,
+        options: any,
+        callback: (
+          err: NodeJS.ErrnoException | null,
+          address?: string | { address: string; family: number }[],
+          family?: number,
+        ) => void,
+      ) => {
+        lookup(
+          hostname,
+          { all: true, verbatim: true },
+          (err: NodeJS.ErrnoException | null, addresses: any) => {
+            if (err) return callback(err);
+            const list: { address: string; family: number }[] = Array.isArray(
+              addresses,
+            )
+              ? addresses
+              : [{ address: addresses, family: 4 }];
+            for (const record of list) {
+              if (isPrivateHost(record.address)) {
+                const e = new Error(
+                  `Connect blocked: ${hostname} resolved to private address ${record.address}`,
+                ) as NodeJS.ErrnoException;
+                e.code = "EAI_BLOCKED";
+                return callback(e);
+              }
+            }
+            // Mirror Node's lookup behavior: when `all` is true, return the
+            // array; otherwise the first entry. undici's connect honors
+            // `options.all`.
+            if (options && options.all) {
+              return callback(null, list as any);
+            }
+            const first = list[0];
+            return callback(null, first.address, first.family);
+          },
+        );
+      },
+    },
+  });
+}
+
+/**
+ * SSRF-safe `fetch` for any server-side request to a user/agent-supplied URL.
+ *
+ * Applies the same protections the extension proxy uses, so every call site
+ * that fetches an untrusted URL gets them without re-implementing the loop:
+ *   1. Pre-flight DNS-aware private-address check (isBlockedExtensionUrlWithDns)
+ *      on the initial URL and on every redirect hop.
+ *   2. A connect-time dispatcher that re-checks the resolved IP at TCP-connect
+ *      time (closes the DNS-rebinding TOCTOU) when undici is available.
+ *   3. Manual redirect handling — a public URL cannot 30x-redirect into the
+ *      private network because each hop is re-validated before it is followed.
+ *
+ * Throws an Error whose message starts with "SSRF blocked:" when a target
+ * (initial or via redirect) resolves to a private/internal address, or when the
+ * redirect limit is exceeded. Otherwise returns the final Response.
+ *
+ * `httpsOnly` extends the per-hop validation to the URL scheme: redirects are
+ * followed only to `https:` targets, so an HTTPS-only caller cannot be
+ * downgraded to plain HTTP by a 30x from the (untrusted) origin.
+ */
+export async function ssrfSafeFetch(
+  url: string,
+  init: RequestInit = {},
+  options: { maxRedirects?: number; httpsOnly?: boolean } = {},
+): Promise<Response> {
+  const maxRedirects = options.maxRedirects ?? 3;
+  const dispatcher = (await createSsrfSafeDispatcher()) ?? undefined;
+
+  let currentUrl = url;
+  for (let hop = 0; hop <= maxRedirects; hop++) {
+    if (options.httpsOnly && new URL(currentUrl).protocol !== "https:") {
+      throw new Error(
+        `SSRF blocked: refusing to fetch non-HTTPS address (${currentUrl})`,
+      );
+    }
+    // The deployment's own configured origins are self-calls (workspace A2A,
+    // self-dispatch), not attacker-controlled targets — skip only the
+    // private-address block for exact origin matches. Each redirect hop is
+    // still re-validated, so a trusted origin cannot 30x into the private
+    // network.
+    const trustedHop = isTrustedInternalUrl(currentUrl);
+    if (!trustedHop && (await isBlockedExtensionUrlWithDns(currentUrl))) {
+      throw new Error(
+        `SSRF blocked: refusing to fetch private/internal address (${currentUrl})`,
+      );
+    }
+    const fetchOpts: RequestInit & { dispatcher?: unknown } = {
+      ...init,
+      redirect: "manual",
+    };
+    // The connect-time guard would also reject a trusted internal origin's
+    // loopback/private IP at the TCP layer — attach it only to untrusted hops.
+    if (dispatcher && !trustedHop) fetchOpts.dispatcher = dispatcher;
+
+    const response = await fetch(currentUrl, fetchOpts);
+    if (response.status >= 300 && response.status < 400) {
+      const location = response.headers.get("location");
+      if (!location) return response;
+      // Drain the redirect body so the hop's connection is released instead
+      // of being held until GC.
+      await response.body?.cancel().catch(() => {});
+      currentUrl = new URL(location, currentUrl).href;
+      continue;
+    }
+    return response;
+  }
+  throw new Error(
+    `SSRF blocked: too many redirects (>${maxRedirects}) while fetching ${url}`,
+  );
+}
+
+// ─────────────────────────────────────────────────────────────────────────────
+// Legacy aliases — predate the Tools → Extensions rename. Templates import
+// these via the legacy `@agent-native/core/tools/url-safety` subpath; keep
+// the names exported so they keep resolving until every consumer updates.
+// ─────────────────────────────────────────────────────────────────────────────
+
+export { isBlockedExtensionUrl as isBlockedToolUrl };
+export { isBlockedExtensionUrlWithDns as isBlockedToolUrlWithDns };
+export { ssrfSafeFetch as ssrfSafeToolFetch };