chainlesschain 0.162.149 → 0.162.151

package/src/lib/pqc-manager.js

@@ -178,6 +178,70 @@ export function ensurePQCTables(db) {
   `);
 }
 
+/**
+ * Rehydrate _keys/_migrations from the persisted pqc_keys/pqc_migration_status
+ * tables. The `cc` CLI runs every command in a fresh process, so without this
+ * the Maps start empty and a key generated / migration run in a prior
+ * invocation is invisible (`cc pqc keys` reports "No PQC keys" and `cc pqc
+ * migration-status` is empty even when the rows exist; `cc pqc migrate` counts
+ * sourceKeys off the empty Map and reports "Migrated 0/0" while real keys sit
+ * unmigrated). Call after ensurePQCTables(db). NOTE: this module holds only
+ * public-key inventory metadata — there is no private key or sign/verify path
+ * here — so the impact is inventory visibility + migration accounting, not
+ * crypto verification.
+ */
+export function loadFromDb(db) {
+  if (!db) return 0;
+  _keys.clear();
+  _migrations.clear();
+
+  const keyRows = db.prepare(`SELECT * FROM pqc_keys`).all();
+  for (const row of keyRows) {
+    let metadata = {};
+    try {
+      metadata = row.metadata ? JSON.parse(row.metadata) : {};
+    } catch {
+      metadata = {};
+    }
+    // Derived fields (family/publicKeyBytes/signatureBytes) come from the
+    // algorithm spec, not the DB — reconstruct them exactly as generateKey does.
+    const spec = ALGORITHM_SPECS[row.algorithm] || {};
+    _keys.set(row.id, {
+      id: row.id,
+      algorithm: row.algorithm,
+      family: spec.family ?? null,
+      purpose: row.purpose,
+      publicKey: row.public_key,
+      keySize: row.key_size ?? spec.keySize ?? 0,
+      publicKeyBytes: spec.publicKeyBytes ?? null,
+      signatureBytes: spec.signatureBytes ?? null,
+      hybridMode: !!row.hybrid_mode,
+      classicalAlgorithm: row.classical_algorithm ?? null,
+      status: row.status,
+      metadata,
+      createdAt: row.created_at ?? null,
+    });
+  }
+
+  const migRows = db.prepare(`SELECT * FROM pqc_migration_status`).all();
+  for (const row of migRows) {
+    _migrations.set(row.id, {
+      id: row.id,
+      planName: row.plan_name,
+      sourceAlgorithm: row.source_algorithm,
+      targetAlgorithm: row.target_algorithm,
+      totalKeys: row.total_keys ?? 0,
+      migratedKeys: row.migrated_keys ?? 0,
+      status: row.status,
+      startedAt: row.started_at ?? null,
+      completedAt: row.completed_at ?? null,
+      errorMessage: row.error_message ?? null,
+    });
+  }
+
+  return _keys.size + _migrations.size;
+}
+
 /* ── Key Management ───────────────────────────────────────── */
 
 export function listKeys(filter = {}) {

package/src/lib/reputation-optimizer.js

@@ -509,6 +509,107 @@ export function _resetState() {
   _maxConcurrentOptimizations = DEFAULT_MAX_CONCURRENT_OPTIMIZATIONS;
 }
 
+/**
+ * Rehydrate the in-memory Maps from the persisted reputation_* tables. The CLI
+ * runs each `cc reputation` subcommand in a fresh node process, so
+ * _observations/_runs/_analytics start empty every invocation. Every write
+ * dual-writes (Map + INSERT into reputation_observations/
+ * reputation_optimization_runs/reputation_analytics) but every read
+ * (computeScore/listScores/detectAnomalies/getOptimizationStatus/getAnalytics/
+ * listOptimizationRuns/applyOptimizedParams + the V2 drivers) is Map-only and
+ * nothing SELECTed the tables back — so observed scores read back as 0, `list`/
+ * `runs`/`anomalies` were always empty, and `status`/`complete`/`apply <runId>`
+ * threw "Optimization run not found" for a run that genuinely exists on disk.
+ * Call after ensureReputationTables(db).
+ *
+ * Non-persisted fields default safely: run.history=[] (V1), errorMessage=null.
+ */
+export function loadFromDb(db) {
+  if (!db) return 0;
+  ensureReputationTables(db);
+  _observations.clear();
+  _runs.clear();
+  _analytics.clear();
+
+  for (const r of db
+    .prepare(
+      `SELECT observation_id, did, score, kind, weight, recorded_at
+         FROM reputation_observations ORDER BY recorded_at ASC`,
+    )
+    .all()) {
+    if (!_observations.has(r.did)) _observations.set(r.did, []);
+    _observations.get(r.did).push({
+      observationId: r.observation_id,
+      did: r.did,
+      score: Number(r.score),
+      kind: r.kind,
+      weight: Number(r.weight),
+      recordedAt: Number(r.recorded_at),
+    });
+  }
+
+  for (const r of db
+    .prepare(
+      `SELECT run_id, objective, iterations, param_space, best_params, best_score,
+              status, created_at, completed_at
+         FROM reputation_optimization_runs ORDER BY created_at ASC`,
+    )
+    .all()) {
+    // One corrupt param/params cell must not sink the whole run list.
+    let paramSpace = {};
+    let bestParams = null;
+    try {
+      paramSpace = r.param_space ? JSON.parse(r.param_space) : {};
+    } catch {
+      paramSpace = {};
+    }
+    try {
+      bestParams = r.best_params ? JSON.parse(r.best_params) : null;
+    } catch {
+      bestParams = null;
+    }
+    _runs.set(r.run_id, {
+      runId: r.run_id,
+      objective: r.objective,
+      iterations: Number(r.iterations),
+      paramSpace,
+      bestParams,
+      bestScore: r.best_score == null ? null : Number(r.best_score),
+      errorMessage: null,
+      status: r.status,
+      createdAt: Number(r.created_at),
+      completedAt: r.completed_at == null ? null : Number(r.completed_at),
+      history: [],
+      _seq: ++_seq,
+    });
+  }
+
+  for (const r of db
+    .prepare(
+      `SELECT analytics_id, run_id, reputation_distribution, anomalies, recommendations, created_at
+         FROM reputation_analytics ORDER BY created_at ASC`,
+    )
+    .all()) {
+    const parse = (v, fallback) => {
+      try {
+        return v ? JSON.parse(v) : fallback;
+      } catch {
+        return fallback;
+      }
+    };
+    _analytics.set(r.run_id, {
+      analyticsId: r.analytics_id,
+      runId: r.run_id,
+      reputationDistribution: parse(r.reputation_distribution, {}),
+      anomalies: parse(r.anomalies, []),
+      recommendations: parse(r.recommendations, []),
+      createdAt: Number(r.created_at),
+    });
+  }
+
+  return _observations.size + _runs.size + _analytics.size;
+}
+
 /* ═══════════════════════════════════════════════════════════════
  * V2 (Phase 60) — Frozen enums + async optimization lifecycle +
  * concurrency limiter + patch-merged setRunStatus + stats-v2.

package/src/lib/sandbox-egress-proxy.js

@@ -17,7 +17,96 @@
 
 import http from "node:http";
 import net from "node:net";
-import { evaluateNetworkAccess } from "./sandbox-network-policy.js";
+import dns from "node:dns";
+import {
+  evaluateNetworkAccess,
+  isPrivateHost,
+} from "./sandbox-network-policy.js";
+
+/** Promisified `dns.lookup` returning ALL resolved addresses. */
+function defaultLookup(host) {
+  return new Promise((resolve, reject) => {
+    dns.lookup(host, { all: true }, (err, addrs) =>
+      err ? reject(err) : resolve(addrs),
+    );
+  });
+}
+
+/**
+ * DNS-rebinding / SSRF-by-resolution guard. The domain policy is decided by
+ * NAME, but a public-looking name can RESOLVE to a private / metadata IP
+ * (`rebind.evil.com → 127.0.0.1` / `169.254.169.254`) and the name check would
+ * never see it — a classic rebinding bypass (Phase 1 acceptance "DNS 重绑定有
+ * 安全测试"). After a wildcard/permissive allow, resolve the host and reject if
+ * ANY address is private (unless `allowPrivate`). Fail CLOSED on an unresolvable
+ * host. On success, pin the connection to the exact validated address so a
+ * second resolution at connect time can't rebind to a different (private) IP.
+ * A `specific` allow (exact/subdomain name the user vetted) is exempt — the
+ * caller skips this — so intentional internal-name allowlisting still works.
+ * @returns {Promise<{ok:boolean, ip?:string, reason?:string}>}
+ */
+async function guardResolvedTarget(host, policy, lookup) {
+  let addrs;
+  try {
+    addrs = await lookup(host);
+  } catch (e) {
+    return {
+      ok: false,
+      reason: `unresolvable host (fail-closed): ${e.code || e.message}`,
+    };
+  }
+  const list = Array.isArray(addrs) ? addrs : addrs ? [addrs] : [];
+  if (list.length === 0) {
+    return { ok: false, reason: "host resolved to no addresses (fail-closed)" };
+  }
+  for (const a of list) {
+    const ip = typeof a === "string" ? a : a && a.address;
+    if (ip && isPrivateHost(ip) && !policy.allowPrivate) {
+      return {
+        ok: false,
+        reason: `dns-rebinding: ${host} resolves to private ${ip}`,
+      };
+    }
+  }
+  const first = list[0];
+  return { ok: true, ip: typeof first === "string" ? first : first.address };
+}
+
+/**
+ * Parse a CONNECT request target ("host:port") into `{ host, port }`. A naive
+ * `split(":")` mangles IPv6 literals — `[2001:db8::1]:8443` would yield host
+ * `"[2001"` and a NaN port that silently defaults to 443, so even an IP-pinned
+ * tunnel connects to the WRONG port (and, when unpinned, the wrong host). Handle
+ * the bracketed-IPv6, bare-IPv6, and `name[:port]` forms explicitly. Port
+ * defaults to 443 (the CONNECT/HTTPS default).
+ */
+export function parseConnectTarget(target) {
+  const s = String(target == null ? "" : target).trim();
+  const toPort = (v) => {
+    const n = parseInt(v, 10);
+    return Number.isInteger(n) && n > 0 && n <= 65535 ? n : 443;
+  };
+  // Bracketed IPv6: "[::1]" or "[::1]:8443"
+  if (s.startsWith("[")) {
+    const end = s.indexOf("]");
+    if (end > 0) {
+      const host = s.slice(1, end);
+      const rest = s.slice(end + 1); // "" or ":8443"
+      return { host, port: rest.startsWith(":") ? toPort(rest.slice(1)) : 443 };
+    }
+    // malformed bracket — fall through to the generic handling
+  }
+  // Bare IPv6 literal (2+ colons, no brackets) → no port component to split off.
+  if ((s.match(/:/g) || []).length > 1) {
+    return { host: s, port: 443 };
+  }
+  // "name:port" (rsplit on the single colon) or bare "name".
+  const idx = s.lastIndexOf(":");
+  if (idx > 0) {
+    return { host: s.slice(0, idx), port: toPort(s.slice(idx + 1)) };
+  }
+  return { host: s, port: 443 };
+}
 
 /**
  * Build the proxy env vars a child process needs to route through the proxy.
@@ -64,77 +153,124 @@ export function createEgressProxy(policy = {}, opts = {}) {
     return verdict;
   };
 
-  const server = http.createServer((req, res) => {
-    // A forward-proxy request carries the absolute URL in the request line.
-    const verdict = decide(req.url, "http");
-    if (!verdict.allowed) {
-      res.writeHead(403, { "content-type": "text/plain" });
-      res.end(`egress blocked: ${verdict.host} — ${verdict.reason}\n`);
-      return;
+  const lookup = opts.lookup || defaultLookup;
+  const rebindGuard = opts.checkDnsRebinding !== false; // on by default
+
+  // Second gate: after a NAME-based allow, re-check the RESOLVED address for
+  // DNS rebinding (unless the allow was `specific` — a name the user vetted —
+  // or the guard is disabled). Returns the verdict to ACT on plus `ip`, the
+  // exact address to pin the connection to (null → connect by the original
+  // name). When the resolved IP is private the name-based allow is overturned:
+  // fix the counters and re-notify observers with the block reason.
+  const guard = async (verdict, kind) => {
+    if (!verdict.allowed || verdict.specific || !rebindGuard) {
+      return { verdict, ip: null };
     }
-    let u;
+    const res = await guardResolvedTarget(verdict.host, policy, lookup);
+    if (res.ok) return { verdict, ip: res.ip };
+    state.allowed -= 1;
+    state.blocked += 1;
+    const blocked = { allowed: false, host: verdict.host, reason: res.reason };
+    if (typeof opts.onDecision === "function") {
+      try {
+        opts.onDecision({ kind, target: verdict.host, ...blocked });
+      } catch {
+        /* observation is best-effort */
+      }
+    }
+    return { verdict: blocked, ip: null };
+  };
+
+  const server = http.createServer(async (req, res) => {
     try {
-      u = new URL(req.url);
+      // A forward-proxy request carries the absolute URL in the request line.
+      const { verdict, ip } = await guard(decide(req.url, "http"), "http");
+      if (!verdict.allowed) {
+        res.writeHead(403, { "content-type": "text/plain" });
+        res.end(`egress blocked: ${verdict.host} — ${verdict.reason}\n`);
+        return;
+      }
+      let u;
+      try {
+        u = new URL(req.url);
+      } catch {
+        res.writeHead(400, { "content-type": "text/plain" });
+        res.end("bad request target\n");
+        return;
+      }
+      const upstream = http.request(
+        {
+          hostname: ip || u.hostname, // pin to the validated IP when re-checked
+          port: u.port || 80,
+          path: `${u.pathname}${u.search}`,
+          method: req.method,
+          headers: req.headers, // preserves the original Host header
+        },
+        (upRes) => {
+          res.writeHead(upRes.statusCode || 502, upRes.headers);
+          upRes.pipe(res);
+        },
+      );
+      upstream.on("error", () => {
+        if (!res.headersSent)
+          res.writeHead(502, { "content-type": "text/plain" });
+        res.end("upstream error\n");
+      });
+      req.pipe(upstream);
     } catch {
-      res.writeHead(400, { "content-type": "text/plain" });
-      res.end("bad request target\n");
-      return;
-    }
-    const upstream = http.request(
-      {
-        hostname: u.hostname,
-        port: u.port || 80,
-        path: `${u.pathname}${u.search}`,
-        method: req.method,
-        headers: req.headers,
-      },
-      (upRes) => {
-        res.writeHead(upRes.statusCode || 502, upRes.headers);
-        upRes.pipe(res);
-      },
-    );
-    upstream.on("error", () => {
       if (!res.headersSent)
         res.writeHead(502, { "content-type": "text/plain" });
-      res.end("upstream error\n");
-    });
-    req.pipe(upstream);
+      res.end("proxy error\n");
+    }
   });
 
   // HTTPS (and any TLS) goes through CONNECT — tunnel only allowed hosts.
-  server.on("connect", (req, clientSocket, head) => {
-    const verdict = decide(req.url, "connect"); // req.url = "host:port"
-    if (!verdict.allowed) {
-      clientSocket.write(
-        "HTTP/1.1 403 Forbidden\r\n" +
-          "Content-Type: text/plain\r\n\r\n" +
-          `egress blocked: ${verdict.host} — ${verdict.reason}\n`,
-      );
-      clientSocket.end();
-      return;
-    }
-    const [host, portStr] = req.url.split(":");
-    const port = parseInt(portStr, 10) || 443;
-    const upstream = net.connect(port, host, () => {
-      clientSocket.write("HTTP/1.1 200 Connection Established\r\n\r\n");
-      if (head && head.length) upstream.write(head);
-      upstream.pipe(clientSocket);
-      clientSocket.pipe(upstream);
-    });
-    upstream.on("error", () => {
-      try {
+  server.on("connect", async (req, clientSocket, head) => {
+    try {
+      const { verdict, ip } = await guard(
+        decide(req.url, "connect"),
+        "connect",
+      ); // req.url = "host:port"
+      if (!verdict.allowed) {
+        clientSocket.write(
+          "HTTP/1.1 403 Forbidden\r\n" +
+            "Content-Type: text/plain\r\n\r\n" +
+            `egress blocked: ${verdict.host} — ${verdict.reason}\n`,
+        );
         clientSocket.end();
-      } catch {
-        /* already closed */
+        return;
       }
-    });
-    clientSocket.on("error", () => {
+      // Parse host:port properly (IPv6 literals break a naive split).
+      const { host, port } = parseConnectTarget(req.url);
+      // Connect to the pinned validated IP so a rebind at connect time can't
+      // swap in a private address between our check and the socket.
+      const upstream = net.connect(port, ip || host, () => {
+        clientSocket.write("HTTP/1.1 200 Connection Established\r\n\r\n");
+        if (head && head.length) upstream.write(head);
+        upstream.pipe(clientSocket);
+        clientSocket.pipe(upstream);
+      });
+      upstream.on("error", () => {
+        try {
+          clientSocket.end();
+        } catch {
+          /* already closed */
+        }
+      });
+      clientSocket.on("error", () => {
+        try {
+          upstream.destroy();
+        } catch {
+          /* already gone */
+        }
+      });
+    } catch {
       try {
-        upstream.destroy();
+        clientSocket.end();
       } catch {
-        /* already gone */
+        /* already closed */
       }
-    });
+    }
   });
 
   return {

package/src/lib/sandbox-fs-policy.js

@@ -0,0 +1,112 @@
+/**
+ * Sandbox filesystem path policy (Phase 1) — decide whether a Shell subprocess
+ * (or the agent's own file tools) may read/write a given path under
+ * `sandbox.filesystem.{allowRead,denyRead,allowWrite,denyWrite}` (here the
+ * legacy `{read, write, denied}` shape). OS-level ENFORCEMENT is platform
+ * specific (bubblewrap `--bind`/`--ro-bind`/`--tmpfs`, seatbelt), but the POLICY
+ * DECISION is pure, shared, and must get the tricky cases right — the twin of
+ * `sandbox-network-policy.js`. The prior check used raw `filePath.startsWith()`,
+ * which let three attacks through:
+ *
+ *   - PATH TRAVERSAL: `/tmp/../etc/passwd` starts with an allowed `/tmp` but
+ *     resolves OUTSIDE it. We `path.resolve` first so `..` is collapsed.
+ *   - BOUNDARY CONFUSION: `/tmpfoo` starts with `/tmp` yet is a different tree.
+ *     We compare with `path.relative` (a real path boundary), not a substring.
+ *   - SYMLINK ESCAPE: an allowed dir containing a symlink to `/etc` would read
+ *     `/etc`. We resolve symlinks (of the longest existing ancestor) before the
+ *     boundary check, and resolve the policy roots the same way so they stay
+ *     comparable.
+ *
+ * Default-DENY: a path must match an allow root for the requested mode and must
+ * not fall under any deny root. This mirrors the previous behaviour (an empty
+ * allow list denied everything) while fixing the bypasses.
+ */
+
+import fs from "node:fs";
+import path from "node:path";
+
+/** Real path of `abs`, resolving symlinks of the LONGEST EXISTING ancestor and
+ * re-appending the non-existent tail — so a symlinked existing parent is caught
+ * even when the leaf (e.g. a not-yet-created write target) does not exist. */
+function resolveReal(abs, realpath) {
+  let cur = abs;
+  const tail = [];
+  // Bounded by the path depth; each iteration strips one segment.
+  for (;;) {
+    try {
+      const real = realpath(cur);
+      return tail.length ? path.join(real, ...tail.reverse()) : real;
+    } catch {
+      const parent = path.dirname(cur);
+      if (parent === cur) return abs; // hit the root, nothing on this path exists
+      tail.push(path.basename(cur));
+      cur = parent;
+    }
+  }
+}
+
+/** Is `target` the same as, or nested inside, `root`? Uses a real path boundary
+ * (via `path.relative`) so `/tmpfoo` is NOT inside `/tmp` and `..` can't sneak
+ * out. Cross-platform (handles Windows drive letters + separators). */
+export function isWithinRoot(root, target) {
+  if (!root) return false;
+  const rel = path.relative(root, target);
+  return rel === "" || (!rel.startsWith("..") && !path.isAbsolute(rel));
+}
+
+function normalizeRoot(root, cwd, realpath) {
+  return resolveReal(path.resolve(cwd, String(root)), realpath);
+}
+
+/**
+ * Evaluate filesystem access for a target path under a policy.
+ *
+ * @param {string} target  a path (relative resolves against `cwd`)
+ * @param {object} opts
+ * @param {"read"|"write"} [opts.mode="read"]
+ * @param {{read?:string[], write?:string[], denied?:string[]}} [opts.policy]
+ * @param {string} [opts.cwd]        base for relative targets/roots
+ * @param {(p:string)=>string} [opts.realpath]  injectable for tests
+ * @returns {{allowed:boolean, path:string|null, reason:string}}
+ */
+export function evaluatePathAccess(target, opts = {}) {
+  const {
+    mode = "read",
+    policy = {},
+    cwd = process.cwd(),
+    realpath = fs.realpathSync,
+  } = opts;
+
+  if (target == null || String(target).trim() === "") {
+    return { allowed: false, path: null, reason: "empty path" };
+  }
+  if (mode !== "read" && mode !== "write") {
+    return { allowed: false, path: null, reason: `unknown mode "${mode}"` };
+  }
+
+  const abs = path.resolve(cwd, String(target)); // collapses `..`
+  const real = resolveReal(abs, realpath); // resolves symlink escapes
+
+  const denied = policy.denied || [];
+  for (const d of denied) {
+    if (isWithinRoot(normalizeRoot(d, cwd, realpath), real)) {
+      return { allowed: false, path: real, reason: `denied by ${d}` };
+    }
+  }
+
+  const allowList = (mode === "read" ? policy.read : policy.write) || [];
+  for (const a of allowList) {
+    if (isWithinRoot(normalizeRoot(a, cwd, realpath), real)) {
+      return { allowed: true, path: real, reason: `within ${a}` };
+    }
+  }
+
+  // Default-deny: not under any allowed root for this mode.
+  return {
+    allowed: false,
+    path: real,
+    reason: allowList.length
+      ? `outside all allowed ${mode} roots`
+      : `no allowed ${mode} roots`,
+  };
+}

package/src/lib/sandbox-network-policy.js

@@ -33,6 +33,13 @@ export function extractHost(target) {
   }
   // Strip IPv6 brackets ("[::1]" → "::1") — the documented SSRF gotcha.
   if (s.startsWith("[") && s.endsWith("]")) s = s.slice(1, -1);
+  // Strip the trailing DNS root dot. "localhost." / "example.com." resolve to
+  // the exact same host as the dot-less form, but the extra dot defeats BOTH
+  // the deny/allow matcher (host !== "example.com") AND the loopback/private
+  // guard ("localhost." !== "localhost") — a one-character SSRF / deny-list
+  // bypass. (Node's URL already normalizes a trailing dot away for IPv4 literals
+  // but NOT for named hosts, so we must do it here.)
+  s = s.replace(/\.+$/, "");
   return s.toLowerCase() || null;
 }
 
@@ -53,6 +60,24 @@ function anyMatch(host, patterns) {
   return (patterns || []).some((p) => matchesDomain(host, p));
 }
 
+/**
+ * If `h` is an IPv4-mapped IPv6 address, return the embedded IPv4 in dotted
+ * form; else null. Handles both the dotted tail ("::ffff:127.0.0.1", how a user
+ * might type it) and the compressed-hex tail ("::ffff:7f00:1", how Node's URL
+ * parser serializes it). The hex tail is two 16-bit groups = the 32-bit IPv4.
+ */
+function mappedIpv4Tail(h) {
+  const dotted = h.match(/^::ffff:(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})$/i);
+  if (dotted) return dotted[1];
+  const hex = h.match(/^::ffff:([0-9a-f]{1,4}):([0-9a-f]{1,4})$/i);
+  if (hex) {
+    const high = parseInt(hex[1], 16);
+    const low = parseInt(hex[2], 16);
+    return `${(high >> 8) & 0xff}.${high & 0xff}.${(low >> 8) & 0xff}.${low & 0xff}`;
+  }
+  return null;
+}
+
 /** Private / loopback / link-local / cloud-metadata target? (SSRF guard) */
 export function isPrivateHost(host) {
   if (!host) return false;
@@ -63,10 +88,14 @@ export function isPrivateHost(host) {
   // IPv6 loopback / unique-local / link-local.
   if (h === "::1" || h === "::") return true;
   if (/^f[cd][0-9a-f]{2}:/i.test(h)) return true; // fc00::/7 unique-local
-  if (/^fe80:/i.test(h)) return true; // link-local
-  // IPv4-mapped IPv6 (::ffff:127.0.0.1) — check the tail.
-  const mapped = h.match(/^::ffff:(\d+\.\d+\.\d+\.\d+)$/i);
-  const ipv4 = mapped ? mapped[1] : h;
+  if (/^fe[89ab][0-9a-f]:/i.test(h)) return true; // fe80::/10 link-local (fe80–febf)
+  // IPv4-mapped IPv6 — check the embedded IPv4 tail. Node's WHATWG URL parser
+  // serializes "[::ffff:127.0.0.1]" as COMPRESSED HEX ("::ffff:7f00:1"), never
+  // dotted-decimal, so we must decode BOTH forms or the guard is dead code for
+  // any URL/bracketed input (loopback, private ranges, AND 169.254.169.254 all
+  // sail through — confirmed SSRF bypass). Bare non-URL hosts may still arrive
+  // dotted, so keep that form too.
+  const ipv4 = mappedIpv4Tail(h) || h;
   const m = ipv4.match(/^(\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})$/);
   if (m) {
     const [a, b] = [Number(m[1]), Number(m[2])];
@@ -107,7 +136,17 @@ export function evaluateNetworkAccess(target, policy = {}) {
     allowed.filter((p) => String(p).trim() !== "*"),
   );
   if (explicitNonStar) {
-    return { allowed: true, host, reason: "matched allowedDomains" };
+    // `specific: true` marks a host the user vetted by exact/subdomain name (not
+    // a bare `*`). The egress proxy trusts these even when they resolve to a
+    // private IP (intentional internal/dev allowlisting) and so SKIPS the
+    // DNS-rebinding re-check for them — whereas `*`/permissive allows still get
+    // their resolved IP checked.
+    return {
+      allowed: true,
+      host,
+      reason: "matched allowedDomains",
+      specific: true,
+    };
   }
   // 3) Private / loopback / metadata targets are blocked unless allowed above.
   if (isPrivateHost(host) && !policy.allowPrivate) {