activeclaw 2026.2.12 → 2026.2.13

package/dist/{fetch-CqZP8jwB.js → fetch-DmiOpALK.js}

@@ -1,4 +1,5 @@
-import { C as resolvePinnedHostnameWithPolicy, S as resolvePinnedHostname, b as closeDispatcher, l as detectMime, u as extensionForMime, x as createPinnedDispatcher } from "./routes-82Ywfho6.js";
+import { c as logWarn } from "./exec-YIosokWE.js";
+import { S as resolvePinnedHostnameWithPolicy, b as closeDispatcher, l as detectMime, u as extensionForMime, x as createPinnedDispatcher, y as SsrFBlockedError } from "./routes-CmOI1hIH.js";
 import path from "node:path";
 
 //#region src/infra/net/fetch-guard.ts
@@ -62,10 +63,10 @@ async function fetchWithSsrFGuard(params) {
 		}
 		let dispatcher = null;
 		try {
-			const pinned = Boolean(params.policy?.allowPrivateNetwork || params.policy?.allowedHostnames?.length) ? await resolvePinnedHostnameWithPolicy(parsedUrl.hostname, {
+			const pinned = await resolvePinnedHostnameWithPolicy(parsedUrl.hostname, {
 				lookupFn: params.lookupFn,
 				policy: params.policy
-			}) : await resolvePinnedHostname(parsedUrl.hostname, params.lookupFn);
+			});
 			if (params.pinDns !== false) dispatcher = createPinnedDispatcher(pinned);
 			const init = {
 				...params.init ? { ...params.init } : {},
@@ -102,6 +103,7 @@ async function fetchWithSsrFGuard(params) {
 				release: async () => release(dispatcher)
 			};
 		} catch (err) {
+			if (err instanceof SsrFBlockedError) logWarn(`security: blocked URL fetch (${params.auditContext ?? "url-fetch"}) target=${parsedUrl.origin}${parsedUrl.pathname} reason=${err.message}`);
 			await release(dispatcher);
 			throw err;
 		}

package/dist/{fetch-timeout-B2KlHXi3.js → fetch-timeout-BEtUjM1S.js}

@@ -1,4 +1,5 @@
-import { a as closeDispatcher, c as resolvePinnedHostnameWithPolicy, h as extensionForMime, m as detectMime, o as createPinnedDispatcher, s as resolvePinnedHostname } from "./routes-BqxA3ZYr.js";
+import { c as logWarn } from "./exec-B8lXct-k.js";
+import { Bt as createPinnedDispatcher, Cn as detectMime, Rt as SsrFBlockedError, Vt as resolvePinnedHostnameWithPolicy, wn as extensionForMime, zt as closeDispatcher } from "./pi-embedded-helpers-WDwx99UA.js";
 import path from "node:path";
 
 //#region src/infra/net/fetch-guard.ts
@@ -62,10 +63,10 @@ async function fetchWithSsrFGuard(params) {
 		}
 		let dispatcher = null;
 		try {
-			const pinned = Boolean(params.policy?.allowPrivateNetwork || params.policy?.allowedHostnames?.length) ? await resolvePinnedHostnameWithPolicy(parsedUrl.hostname, {
+			const pinned = await resolvePinnedHostnameWithPolicy(parsedUrl.hostname, {
 				lookupFn: params.lookupFn,
 				policy: params.policy
-			}) : await resolvePinnedHostname(parsedUrl.hostname, params.lookupFn);
+			});
 			if (params.pinDns !== false) dispatcher = createPinnedDispatcher(pinned);
 			const init = {
 				...params.init ? { ...params.init } : {},
@@ -102,6 +103,7 @@ async function fetchWithSsrFGuard(params) {
 				release: async () => release(dispatcher)
 			};
 		} catch (err) {
+			if (err instanceof SsrFBlockedError) logWarn(`security: blocked URL fetch (${params.auditContext ?? "url-fetch"}) target=${parsedUrl.origin}${parsedUrl.pathname} reason=${err.message}`);
 			await release(dispatcher);
 			throw err;
 		}

package/dist/{fetch-timeout-ohY5QmsW.js → fetch-timeout-DEoXG_SF.js}

@@ -1,4 +1,5 @@
-import { Bt as resolvePinnedHostname, Rt as closeDispatcher, Vt as resolvePinnedHostnameWithPolicy, bn as extensionForMime, yn as detectMime, zt as createPinnedDispatcher } from "./pi-embedded-helpers-CfXnSIFx.js";
+import { c as logWarn } from "./exec-CJFFoM7H.js";
+import { Bt as resolvePinnedHostnameWithPolicy, Lt as SsrFBlockedError, Rt as closeDispatcher, Sn as extensionForMime, xn as detectMime, zt as createPinnedDispatcher } from "./pi-embedded-helpers-CUzTc1v6.js";
 import path from "node:path";
 
 //#region src/infra/net/fetch-guard.ts
@@ -62,10 +63,10 @@ async function fetchWithSsrFGuard(params) {
 		}
 		let dispatcher = null;
 		try {
-			const pinned = Boolean(params.policy?.allowPrivateNetwork || params.policy?.allowedHostnames?.length) ? await resolvePinnedHostnameWithPolicy(parsedUrl.hostname, {
+			const pinned = await resolvePinnedHostnameWithPolicy(parsedUrl.hostname, {
 				lookupFn: params.lookupFn,
 				policy: params.policy
-			}) : await resolvePinnedHostname(parsedUrl.hostname, params.lookupFn);
+			});
 			if (params.pinDns !== false) dispatcher = createPinnedDispatcher(pinned);
 			const init = {
 				...params.init ? { ...params.init } : {},
@@ -102,6 +103,7 @@ async function fetchWithSsrFGuard(params) {
 				release: async () => release(dispatcher)
 			};
 		} catch (err) {
+			if (err instanceof SsrFBlockedError) logWarn(`security: blocked URL fetch (${params.auditContext ?? "url-fetch"}) target=${parsedUrl.origin}${parsedUrl.pathname} reason=${err.message}`);
 			await release(dispatcher);
 			throw err;
 		}

package/dist/{fetch-timeout-4UKsdtE1.js → fetch-timeout-DTK9vxex.js}

@@ -1,4 +1,5 @@
-import { Bt as createPinnedDispatcher, Ht as resolvePinnedHostnameWithPolicy, Sn as extensionForMime, Vt as resolvePinnedHostname, xn as detectMime, zt as closeDispatcher } from "./pi-embedded-helpers-Bri9tk9g.js";
+import { c as logWarn } from "./exec-CACT5OAW.js";
+import { a as closeDispatcher, i as SsrFBlockedError, m as extensionForMime, o as createPinnedDispatcher, p as detectMime, s as resolvePinnedHostnameWithPolicy } from "./routes-DewK5tq2.js";
 import path from "node:path";
 
 //#region src/infra/net/fetch-guard.ts
@@ -62,10 +63,10 @@ async function fetchWithSsrFGuard(params) {
 		}
 		let dispatcher = null;
 		try {
-			const pinned = Boolean(params.policy?.allowPrivateNetwork || params.policy?.allowedHostnames?.length) ? await resolvePinnedHostnameWithPolicy(parsedUrl.hostname, {
+			const pinned = await resolvePinnedHostnameWithPolicy(parsedUrl.hostname, {
 				lookupFn: params.lookupFn,
 				policy: params.policy
-			}) : await resolvePinnedHostname(parsedUrl.hostname, params.lookupFn);
+			});
 			if (params.pinDns !== false) dispatcher = createPinnedDispatcher(pinned);
 			const init = {
 				...params.init ? { ...params.init } : {},
@@ -102,6 +103,7 @@ async function fetchWithSsrFGuard(params) {
 				release: async () => release(dispatcher)
 			};
 		} catch (err) {
+			if (err instanceof SsrFBlockedError) logWarn(`security: blocked URL fetch (${params.auditContext ?? "url-fetch"}) target=${parsedUrl.origin}${parsedUrl.pathname} reason=${err.message}`);
 			await release(dispatcher);
 			throw err;
 		}