chainlesschain 0.162.123 → 0.162.124

package/src/lib/mcp-oauth.js

@@ -62,6 +62,43 @@ export function randomState(bytes = 16) {
   return base64url(_deps.randomBytes(bytes));
 }
 
+/**
+ * Is `hostname` a loopback address? Plain http is tolerated only for these (a
+ * self-hosted MCP server on the dev box). Handles the bracketed IPv6 form that
+ * `new URL().hostname` yields (e.g. "[::1]") and the whole 127.0.0.0/8 range.
+ */
+export function isLoopbackHost(hostname) {
+  const h = String(hostname || "")
+    .replace(/^\[|\]$/g, "")
+    .toLowerCase();
+  if (h === "localhost") return true;
+  if (h === "::1") return true;
+  return /^127\.\d{1,3}\.\d{1,3}\.\d{1,3}$/.test(h);
+}
+
+/**
+ * Require an OAuth endpoint to be HTTPS (or plain http on loopback for local
+ * dev). Authorization codes, PKCE verifiers, client secrets, and bearer/refresh
+ * tokens flow through these endpoints, so a discovered (or stored) endpoint that
+ * downgrades to cleartext http on a remote host must be refused rather than
+ * leaking secrets over the wire (RFC 6749 §3.1.2.1 / RFC 8252). Returns the
+ * endpoint unchanged when allowed; throws otherwise.
+ */
+export function assertSecureEndpoint(endpoint, label = "endpoint") {
+  let u;
+  try {
+    u = new URL(endpoint);
+  } catch {
+    throw new Error(`OAuth ${label} is not a valid URL: ${endpoint}`);
+  }
+  if (u.protocol === "https:") return endpoint;
+  if (u.protocol === "http:" && isLoopbackHost(u.hostname)) return endpoint;
+  throw new Error(
+    `refusing to use insecure OAuth ${label} (${endpoint}); ` +
+      `HTTPS is required for non-loopback endpoints`,
+  );
+}
+
 /** Minimal HTML-escape for values reflected into the callback page. */
 function escapeHtml(s) {
   return String(s).replace(
@@ -209,6 +246,7 @@ export async function registerClient(
       "server has no registration_endpoint and no --client-id was given",
     );
   }
+  assertSecureEndpoint(metadata.registration_endpoint, "registration_endpoint");
   const reg = await fetchJson(metadata.registration_endpoint, {
     method: "POST",
     headers: { "content-type": "application/json" },
@@ -230,6 +268,10 @@ export function buildAuthorizeUrl(
   metadata,
   { clientId, redirectUri, scope, codeChallenge, state, resource },
 ) {
+  assertSecureEndpoint(
+    metadata.authorization_endpoint,
+    "authorization_endpoint",
+  );
   const u = new URL(metadata.authorization_endpoint);
   u.searchParams.set("response_type", "code");
   u.searchParams.set("client_id", clientId);
@@ -261,6 +303,7 @@ export async function exchangeCodeForToken(
   });
   if (clientSecret) body.set("client_secret", clientSecret);
   if (resource) body.set("resource", resource);
+  assertSecureEndpoint(metadata.token_endpoint, "token_endpoint");
   const tok = await fetchJson(metadata.token_endpoint, {
     method: "POST",
     headers: { "content-type": "application/x-www-form-urlencoded" },
@@ -287,6 +330,7 @@ export async function refreshAccessToken(
   });
   if (clientSecret) body.set("client_secret", clientSecret);
   if (resource) body.set("resource", resource);
+  assertSecureEndpoint(metadata.token_endpoint, "token_endpoint");
   const tok = await fetchJson(metadata.token_endpoint, {
     method: "POST",
     headers: { "content-type": "application/x-www-form-urlencoded" },
@@ -372,26 +416,126 @@ function _writeStoreSecure(file, store) {
   }
 }
 
+/** Bounded synchronous sleep (the store lock is held only for a few file ops). */
+function _sleepSyncMs(ms) {
+  try {
+    Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, ms);
+  } catch {
+    const end = Date.now() + ms;
+    while (Date.now() < end) {
+      /* spin — Atomics.wait unavailable (should not happen on modern Node) */
+    }
+  }
+}
+
+/**
+ * Run `fn` while holding a cross-process advisory lock on the token store.
+ *
+ * saveStoredToken / deleteStoredToken are read-modify-write (load → mutate →
+ * write). Two concurrent `cc mcp login` PROCESSES for different servers would
+ * each load the old store and the second writer would clobber the first's new
+ * entry (lost update) — the atomic temp+rename only prevents a torn file, not a
+ * lost update. An O_EXCL lockfile makes the whole RMW mutually exclusive across
+ * processes, so each writer re-reads the latest store inside the lock.
+ *
+ * Robustness: a stale lock (holder crashed) older than STALE_MS is stolen; if
+ * the lock can't be acquired within MAX_WAIT_MS we proceed anyway (degrading to
+ * the pre-lock last-writer-wins rather than failing the login). When the
+ * injected fs lacks the lock primitives (test fs / exotic fs) we run `fn`
+ * directly — single-process correctness is unchanged, only cross-process mutual
+ * exclusion is lost. Lock timing uses the wall clock (not the `now` test seam).
+ */
+function withStoreLock(file, fn) {
+  const fs = _deps.fs;
+  if (
+    typeof fs.openSync !== "function" ||
+    typeof fs.closeSync !== "function" ||
+    typeof fs.unlinkSync !== "function"
+  ) {
+    return fn(); // no lock primitives → run unlocked (back-compat)
+  }
+  const STALE_MS = 10_000;
+  const MAX_WAIT_MS = 5_000;
+  const lockPath = `${file}.lock`;
+  try {
+    fs.mkdirSync(pathDefault.dirname(file), { recursive: true, mode: 0o700 });
+  } catch {
+    /* dir may already exist — openSync below reports any real problem */
+  }
+  const start = Date.now();
+  let fd = null;
+  for (;;) {
+    try {
+      fd = fs.openSync(lockPath, "wx"); // O_CREAT|O_EXCL — fails if held
+      break;
+    } catch (err) {
+      if (!err || err.code !== "EEXIST") {
+        // Unexpected (e.g. ENOENT/EACCES): don't fail the login over the lock —
+        // proceed unlocked, same as a missing-primitives fs.
+        return fn();
+      }
+      let stale = false;
+      try {
+        const st = fs.statSync(lockPath);
+        const mtime = st.mtimeMs != null ? st.mtimeMs : 0;
+        stale = Date.now() - mtime > STALE_MS;
+      } catch {
+        /* lock vanished between open and stat → retry immediately */
+      }
+      if (stale) {
+        try {
+          fs.unlinkSync(lockPath); // steal a lock from a crashed holder
+        } catch {
+          /* someone else stole it first — retry */
+        }
+        continue;
+      }
+      if (Date.now() - start > MAX_WAIT_MS) break; // give up waiting; proceed
+      _sleepSyncMs(50);
+    }
+  }
+  try {
+    return fn();
+  } finally {
+    if (fd !== null) {
+      try {
+        fs.closeSync(fd);
+      } catch {
+        /* ignore */
+      }
+      try {
+        fs.unlinkSync(lockPath);
+      } catch {
+        /* ignore — a stale-steal by another process may have removed it */
+      }
+    }
+  }
+}
+
 export function saveStoredToken(serverUrl, record) {
   const file = tokenStorePath();
-  const store = loadTokenStore();
-  store[serverKey(serverUrl)] = { server: serverKey(serverUrl), ...record };
-  _writeStoreSecure(file, store);
-  return store[serverKey(serverUrl)];
+  return withStoreLock(file, () => {
+    const store = loadTokenStore(); // re-read inside the lock (latest state)
+    store[serverKey(serverUrl)] = { server: serverKey(serverUrl), ...record };
+    _writeStoreSecure(file, store);
+    return store[serverKey(serverUrl)];
+  });
 }
 
 export function deleteStoredToken(serverUrl) {
   const file = tokenStorePath();
-  const store = loadTokenStore();
-  const key = serverKey(serverUrl);
-  if (!(key in store)) return false;
-  delete store[key];
-  try {
-    _writeStoreSecure(file, store);
-  } catch {
-    /* best-effort */
-  }
-  return true;
+  return withStoreLock(file, () => {
+    const store = loadTokenStore(); // re-read inside the lock (latest state)
+    const key = serverKey(serverUrl);
+    if (!(key in store)) return false;
+    delete store[key];
+    try {
+      _writeStoreSecure(file, store);
+    } catch {
+      /* best-effort */
+    }
+    return true;
+  });
 }
 
 /** True when a record's access token is missing or within `skewMs` of expiry. */
@@ -440,12 +584,25 @@ function defaultOpenBrowser(url) {
   }
 }
 
-/** Wait for the OAuth redirect on a localhost callback server; resolve {code,state}. */
+/**
+ * Wait for the OAuth redirect on a localhost callback server; resolve
+ * {code,state}.
+ *
+ * When `expectedState` is given, a SUCCESS callback (`code`) is only accepted if
+ * its `state` matches: the callback port is fixed and guessable, so a duplicate
+ * browser request, a probe, or a drive-by request from a malicious local page
+ * must not abort the real login or inject a forged code — those are answered
+ * politely but the server keeps waiting for the genuine redirect (until the
+ * backstop timeout). A provider `error` is always terminal (so denying consent
+ * fails fast even if the provider omits state on error). With no `expectedState`
+ * the legacy contract is preserved (first `/callback` hit is terminal).
+ */
 export function waitForCallback({
   port,
   host = "127.0.0.1",
   path = "/callback",
   timeout = 300_000,
+  expectedState = null,
 }) {
   return new Promise((resolve, reject) => {
     const server = _deps.createServer((req, res) => {
@@ -465,13 +622,41 @@ export function waitForCallback({
       const code = u.searchParams.get("code");
       const state = u.searchParams.get("state");
       const error = u.searchParams.get("error");
-      res.writeHead(200, { "content-type": "text/html; charset=utf-8" });
-      res.end(renderCallbackPage(error));
+
+      // Provider error (e.g. user denied) — always terminal so we fail fast.
+      if (error) {
+        res.writeHead(200, { "content-type": "text/html; charset=utf-8" });
+        res.end(renderCallbackPage(error));
+        server.close();
+        clearTimeout(timer);
+        reject(new Error(`authorization error: ${error}`));
+        return;
+      }
+
+      const stateOk = expectedState == null || state === expectedState;
+      if (code && stateOk) {
+        res.writeHead(200, { "content-type": "text/html; charset=utf-8" });
+        res.end(renderCallbackPage(null));
+        server.close();
+        clearTimeout(timer);
+        resolve({ code, state });
+        return;
+      }
+
+      // A mismatched/forged/duplicate request to our fixed port must not abort
+      // the real login — answer it but keep listening for the genuine redirect.
+      if (expectedState != null) {
+        res.writeHead(400, { "content-type": "text/html; charset=utf-8" });
+        res.end(renderCallbackPage("state mismatch"));
+        return;
+      }
+
+      // Legacy contract (no expectedState): a /callback hit with no code ends it.
+      res.writeHead(400, { "content-type": "text/html; charset=utf-8" });
+      res.end(renderCallbackPage("missing code"));
       server.close();
       clearTimeout(timer);
-      if (error) reject(new Error(`authorization error: ${error}`));
-      else if (!code) reject(new Error("no authorization code in callback"));
-      else resolve({ code, state });
+      reject(new Error("no authorization code in callback"));
     });
     const timer = setTimeout(() => {
       server.close();
@@ -540,6 +725,9 @@ export async function authorizeInteractive(serverUrl, opts = {}) {
     host,
     path: redirectPath,
     timeout,
+    // Ignore callbacks that don't carry the state we issued (forged / drive-by /
+    // duplicate hits to the fixed localhost port) instead of aborting the login.
+    expectedState: state,
   });
   const opened = _deps.openBrowser(authorizeUrl);
   writeOut(

package/src/lib/mcp-serve.js

@@ -17,7 +17,7 @@
 import http from "http";
 import fsDefault from "fs";
 import pathDefault from "path";
-import { randomBytes } from "crypto";
+import { randomBytes, timingSafeEqual } from "crypto";
 
 export const MAX_READ_BYTES = 200 * 1024;
 export const MAX_LIST_ENTRIES = 500;
@@ -29,14 +29,65 @@ export const _deps = { fs: fsDefault, path: pathDefault };
 
 /** Resolve `rel` inside `root`; throws on escape (.. traversal, abs paths out). */
 export function confine(root, rel, deps = _deps) {
-  const abs = deps.path.resolve(root, rel || ".");
-  const normRoot = deps.path.resolve(root);
-  if (abs !== normRoot && !abs.startsWith(normRoot + deps.path.sep)) {
+  const { path } = deps;
+  const fs = deps.fs;
+  const normRoot = path.resolve(root);
+  const abs = path.resolve(normRoot, rel || ".");
+  // Fast string guard: blocks `..` traversal and absolute-path escapes.
+  if (abs !== normRoot && !abs.startsWith(normRoot + path.sep)) {
     throw new Error(`path escapes serve root: ${rel}`);
   }
+  // Symlink guard: path.resolve does NOT follow symlinks, so a symlink INSIDE
+  // root pointing OUTSIDE would pass the string check yet the fs op (read/write/
+  // list) would escape the serve boundary — e.g. reading ~/.ssh through a
+  // workspace symlink, defeating a `--read-only` exposure. Resolve the real path
+  // of the deepest EXISTING ancestor (a not-yet-created file can't be a symlink)
+  // and re-check containment against the real root.
+  if (fs && typeof fs.realpathSync === "function") {
+    let realRoot;
+    try {
+      realRoot = fs.realpathSync(normRoot);
+    } catch {
+      return abs; // root itself unresolvable → the string guard is all we have
+    }
+    let probe = abs;
+    for (;;) {
+      let real;
+      try {
+        real = fs.realpathSync(probe);
+      } catch {
+        const parent = path.dirname(probe);
+        if (parent === probe) break; // reached fs root, nothing existed
+        probe = parent;
+        continue;
+      }
+      if (real !== realRoot && !real.startsWith(realRoot + path.sep)) {
+        throw new Error(`path escapes serve root (symlink): ${rel}`);
+      }
+      break;
+    }
+  }
   return abs;
 }
 
+/**
+ * Constant-time check of an `Authorization: Bearer <token>` header against the
+ * expected token. A plain `!==` leaks timing that could let a caller recover the
+ * token byte-by-byte; hash-length differs are rejected up front (the token is a
+ * fixed-length random value, so its length is not secret), then `timingSafeEqual`
+ * compares the bytes. Mirrors the ws-server's token check.
+ */
+export function bearerMatches(authHeader, token) {
+  const prefix = "Bearer ";
+  if (typeof authHeader !== "string" || !authHeader.startsWith(prefix)) {
+    return false;
+  }
+  const a = Buffer.from(authHeader.slice(prefix.length), "utf-8");
+  const b = Buffer.from(String(token), "utf-8");
+  if (a.length !== b.length) return false;
+  return timingSafeEqual(a, b);
+}
+
 function ok(text) {
   return { content: [{ type: "text", text: String(text) }] };
 }
@@ -194,8 +245,7 @@ export function startMcpServe(opts = {}) {
       return send(405, rpcError(null, -32600, "POST only"));
     }
     if (token) {
-      const auth = req.headers.authorization || "";
-      if (auth !== `Bearer ${token}`) {
+      if (!bearerMatches(req.headers.authorization, token)) {
         return send(401, rpcError(null, -32001, "unauthorized"));
       }
     }

package/src/lib/orchestrator.js

@@ -27,6 +27,7 @@ import crypto from "crypto";
 import { AgentRouter } from "./agent-router.js";
 import { NotificationManager } from "./notifiers/index.js";
 import { createChatFn } from "./cowork-adapter.js";
+import { firstBalancedJson } from "./json-schema-output.js";
 
 /* ---------- _deps injection (Vitest CJS mock pattern) ---------- */
 export const _deps = { execSync };
@@ -403,8 +404,9 @@ export class Orchestrator extends EventEmitter {
 
 /** Extract the first JSON array from an LLM response string. */
 function _extractJson(text) {
-  const match = text.match(/\[[\s\S]*\]/);
-  return match ? match[0] : "[]";
+  // Balanced extraction stops at the first complete array, so trailing prose
+  // (or a second array) no longer over-captures into an unparseable string.
+  return firstBalancedJson(text, "[") || "[]";
 }
 
 /** Parse error lines from CI output (test failures, lint errors). */

package/src/lib/process-manager.js

@@ -58,6 +58,17 @@ export function startApp(options = {}) {
   return child.pid;
 }
 
+/**
+ * Parse a PID-file's contents into a valid positive integer, or null.
+ * A corrupt / empty / partially-written file must not yield NaN — that NaN
+ * would otherwise flow into `taskkill /PID NaN` or `process.kill(NaN, …)`,
+ * which silently fails to act on the real process.
+ */
+export function parsePid(content) {
+  const pid = parseInt(String(content).trim(), 10);
+  return Number.isInteger(pid) && pid > 0 ? pid : null;
+}
+
 export function stopApp() {
   const pidFile = getPidFilePath();
 
@@ -66,7 +77,16 @@ export function stopApp() {
     return false;
   }
 
-  const pid = parseInt(readFileSync(pidFile, "utf-8").trim(), 10);
+  const pid = parsePid(readFileSync(pidFile, "utf-8"));
+  if (pid === null) {
+    logger.warn("PID file is empty or corrupt; removing it.");
+    try {
+      unlinkSync(pidFile);
+    } catch {
+      /* best-effort */
+    }
+    return false;
+  }
 
   try {
     if (isWindows()) {
@@ -90,7 +110,15 @@ export function isAppRunning() {
     return false;
   }
 
-  const pid = parseInt(readFileSync(pidFile, "utf-8").trim(), 10);
+  const pid = parsePid(readFileSync(pidFile, "utf-8"));
+  if (pid === null) {
+    try {
+      unlinkSync(pidFile);
+    } catch {
+      /* best-effort */
+    }
+    return false;
+  }
 
   try {
     process.kill(pid, 0);
@@ -104,7 +132,7 @@ export function isAppRunning() {
 export function getAppPid() {
   const pidFile = getPidFilePath();
   if (!existsSync(pidFile)) return null;
-  return parseInt(readFileSync(pidFile, "utf-8").trim(), 10);
+  return parsePid(readFileSync(pidFile, "utf-8"));
 }
 
 function findExecutable(binDir, extension) {

package/src/lib/repl-completer.js

@@ -32,6 +32,20 @@ export function extractAtPrefix(line) {
   return m ? { prefix: m[2] } : null;
 }
 
+/**
+ * In `!` bash mode (the line starts with `!`), the trailing whitespace-delimited
+ * token completes to a filesystem path (Claude-Code 2.1.193 bash-mode file
+ * autocomplete). Returns `{ prefix }` — the token with any leading `!` stripped
+ * (so `!cat src/fo` → `src/fo`, `!scr` → `scr`) — or null when not in bash mode.
+ */
+export function extractBashPathPrefix(line) {
+  if (!/^\s*!/.test(line || "")) return null;
+  const m = /(\S*)$/.exec(line || "");
+  let tok = m ? m[1] : "";
+  if (tok.startsWith("!")) tok = tok.slice(1); // `!src/fo` → `src/fo`
+  return { prefix: tok };
+}
+
 /** Normalize to forward slashes (what @refs use on every platform). */
 function fwd(p) {
   return String(p).replace(/\\/g, "/");
@@ -183,6 +197,21 @@ export function makeAtCompleter(opts = {}) {
         return [hits, line];
       }
     }
+    // `!` bash-mode file-path completion (Claude-Code 2.1.193 parity): the
+    // trailing token completes to filesystem paths under cwd — a shell command
+    // runs from cwd, so this uses the filesystem candidate set only (not the
+    // editor's open-file list). Checked before @refs so a `@` inside a bash
+    // command (e.g. `!grep @x file`) still completes the trailing path token.
+    const bash = extractBashPathPrefix(line);
+    if (bash) {
+      const fromFs = fileCandidates(bash.prefix, {
+        cwd: getCwd(),
+        deps: opts.deps,
+      });
+      // readline replaces the trailing `prefix` with the chosen path, leaving
+      // the `!` and the rest of the command intact.
+      return [fromFs.slice(0, MAX_CANDIDATES), bash.prefix];
+    }
     const at = extractAtPrefix(line);
     if (!at) return [[], line];
     refreshIde(); // async top-up for the NEXT tab; this one uses the cache

package/src/lib/slot-filler.js

@@ -8,6 +8,7 @@
  */
 
 import { EventEmitter } from "events";
+import { firstBalancedJson } from "./json-schema-output.js";
 
 /**
  * Required slots per intent type — must be filled before execution.
@@ -341,9 +342,9 @@ Keep values concise (single words or short strings).`;
       ]);
 
       const content = response?.message?.content || response?.content || "";
-      const jsonMatch = content.match(/\{[\s\S]*\}/);
-      if (jsonMatch) {
-        const parsed = JSON.parse(jsonMatch[0]);
+      const jsonText = firstBalancedJson(content, "{");
+      if (jsonText) {
+        const parsed = JSON.parse(jsonText);
         // Filter out null values
         const result = {};
         for (const [key, value] of Object.entries(parsed)) {

package/src/lib/sub-agent-context.js

@@ -74,6 +74,9 @@ export class SubAgentContext {
     this.inheritedContext = options.inheritedContext || null;
     this.allowedTools = options.allowedTools || null; // null = all
     this.depth = options.depth || 1; // nesting level (parent main loop = 0)
+    // Shared run-wide TOTAL-sub-agent counter (one object across the whole tree)
+    // so this sub-agent's own spawns draw from the same breadth pool.
+    this.subAgentBudget = options.subAgentBudget || null;
     this.cwd = options.cwd || process.cwd();
     this.status = "active";
     this.result = null;
@@ -252,6 +255,9 @@ export class SubAgentContext {
       cwd: this.cwd,
       // Nesting level: lets a nested spawn_sub_agent see — and cap — its depth.
       subAgentDepth: this.depth,
+      // Shared total-sub-agent counter so a nested spawn_sub_agent draws from
+      // (and is bounded by) the run's single breadth pool.
+      subAgentBudget: this.subAgentBudget,
       ...loopOptions,
     };
     if (this.iterationBudget) {

package/src/lib/web-fetch.js

@@ -7,6 +7,7 @@
 
 import http from "http";
 import https from "https";
+import { lookup as dnsLookup } from "dns";
 import { URL } from "url";
 
 const DEFAULT_MAX_BYTES = 2_000_000;
@@ -139,7 +140,46 @@ function stripTags(html) {
   return String(html).replace(/<[^>]+>/g, "");
 }
 
-async function _doRequest(parsed, { maxBytes, timeout, headers }) {
+/**
+ * A `lookup` for http(s).request that resolves the hostname and REJECTS the
+ * connection if any resolved IP is private/loopback/link-local. checkAllowed
+ * only inspects the URL's literal hostname, so a public-looking domain that
+ * DNS-resolves to an internal IP (e.g. 169.254.169.254 cloud metadata) would
+ * otherwise sail through — classic DNS-based SSRF. Because Node connects to the
+ * exact address this returns, it also closes the DNS-rebinding TOCTOU window.
+ * Returns a Node-style lookup fn; `allowPrivateHosts` opts out (same flag as
+ * checkAllowed).
+ */
+export function makeSafeLookup(allowPrivateHosts, deps = _deps) {
+  const lookup = deps.lookup || dnsLookup;
+  return (hostname, options, callback) => {
+    const cb = typeof options === "function" ? options : callback;
+    const opts = typeof options === "function" ? {} : options || {};
+    lookup(hostname, { ...opts, all: true }, (err, addresses) => {
+      if (err) return cb(err);
+      const list = Array.isArray(addresses) ? addresses : [];
+      if (list.length === 0) {
+        return cb(new Error(`could not resolve host: ${hostname}`));
+      }
+      if (!allowPrivateHosts) {
+        for (const a of list) {
+          if (isPrivateHost(a.address)) {
+            return cb(
+              new Error(`private/loopback resolved IP blocked: ${a.address}`),
+            );
+          }
+        }
+      }
+      const chosen = list[0];
+      cb(null, chosen.address, chosen.family);
+    });
+  };
+}
+
+async function _doRequest(
+  parsed,
+  { maxBytes, timeout, headers, allowPrivateHosts },
+) {
   const lib = parsed.protocol === "https:" ? https : http;
   return new Promise((resolve, reject) => {
     const req = lib.request(
@@ -149,6 +189,10 @@ async function _doRequest(parsed, { maxBytes, timeout, headers }) {
         hostname: parsed.hostname,
         port: parsed.port || (parsed.protocol === "https:" ? 443 : 80),
         path: parsed.pathname + parsed.search,
+        // Resolve-and-check: reject the connection if the host resolves to a
+        // private IP (DNS-SSRF + rebinding guard). String-host check is in
+        // checkAllowed; this covers the resolved address.
+        lookup: makeSafeLookup(allowPrivateHosts),
         headers: {
           "User-Agent": "ChainlessChain-Agent/1.0",
           Accept: "*/*",
@@ -210,7 +254,12 @@ export async function webFetch(url, options = {}) {
   let redirects = 0;
   let response;
   while (true) {
-    response = await _doRequest(parsed, { maxBytes, timeout, headers });
+    response = await _doRequest(parsed, {
+      maxBytes,
+      timeout,
+      headers,
+      allowPrivateHosts: config.allowPrivateHosts,
+    });
     if (!response.redirect) break;
     if (++redirects > maxRedirects) {
       return { error: "too many redirects" };
@@ -250,7 +299,9 @@ export async function webFetch(url, options = {}) {
   };
 }
 
-export const _deps = { http, https };
+// `lookup` is injectable so tests can resolve a domain to a private IP without
+// real network; production uses the system resolver.
+export const _deps = { http, https, lookup: dnsLookup };
 
 // ===== V2 Surface: Web Fetch governance overlay (CLI v0.142.0) =====
 export const WFET_TARGET_MATURITY_V2 = Object.freeze({