codeep 3.3.2 → 3.3.3

package/dist/config/index.d.ts

@@ -241,9 +241,15 @@ export declare function isKeySyncEnabled(): boolean;
  */
 export declare function keySyncForcedOffByEnv(): boolean;
 /**
- * Clear API key for a specific provider
+ * Clear API key for a specific provider.
+ *
+ * Resolves `true` once the key is gone from secure storage. A keychain that
+ * refuses the delete is swallowed a layer down (keychain.ts logs it at debug),
+ * so the outcome is verified by reading the key back: when it is still there
+ * nothing is changed and this resolves `false` — the caller has to say so
+ * rather than report a logout that left the key on disk.
  */
-export declare function clearApiKey(providerId: string): Promise<void>;
+export declare function clearApiKey(providerId: string): Promise<boolean>;
 export declare function isConfiguredAsync(providerId?: string): Promise<boolean>;
 export declare function isConfigured(providerId?: string): boolean;
 export declare function getCurrentProvider(): {

package/dist/config/index.js

@@ -612,17 +612,25 @@ export function keySyncForcedOffByEnv() {
     return envForcesKeySyncOff();
 }
 /**
- * Clear API key for a specific provider
+ * Clear API key for a specific provider.
+ *
+ * Resolves `true` once the key is gone from secure storage. A keychain that
+ * refuses the delete is swallowed a layer down (keychain.ts logs it at debug),
+ * so the outcome is verified by reading the key back: when it is still there
+ * nothing is changed and this resolves `false` — the caller has to say so
+ * rather than report a logout that left the key on disk.
  */
 export async function clearApiKey(providerId) {
-    // Clear from cache
-    apiKeyCache.delete(providerId);
-    // Clear from secure storage + the non-secret index
+    const store = secureKeyStore();
     try {
-        await secureKeyStore().deleteApiKey(providerId);
+        await store.deleteApiKey(providerId);
     }
-    catch { /* ignore */ }
+    catch { /* verified below */ }
+    if (await store.hasApiKey(providerId))
+        return false;
+    apiKeyCache.delete(providerId);
     removeConfiguredProviderId(providerId);
+    return true;
 }
 export async function isConfiguredAsync(providerId) {
     const key = await loadApiKey(providerId);

package/dist/renderer/commands.js

@@ -1142,27 +1142,39 @@ Format: use headers per category, only include categories where you found issues
                 ctx.app.notify('No providers configured');
                 return;
             }
-            ctx.app.showLogoutPicker(configuredProviders, (result) => {
+            ctx.app.showLogoutPicker(configuredProviders, async (result) => {
                 if (result === null)
                     return;
-                if (result === 'all') {
-                    for (const p of configuredProviders)
-                        void clearApiKey(p.id);
+                const targets = result === 'all' ? configuredProviders : configuredProviders.filter(p => p.id === result);
+                const removed = [];
+                const kept = [];
+                // Awaited one by one: reporting "Logged out" before the keychain
+                // answered is how a refused delete used to pass for a logout.
+                for (const p of targets) {
+                    if (await clearApiKey(p.id))
+                        removed.push(p);
+                    else
+                        kept.push(p.name);
+                }
+                if (kept.length > 0) {
+                    ctx.app.notify(`Could not remove the stored key for ${kept.join(', ')} — still logged in. Delete the "codeep" item from your system keychain, then run /logout again.`);
+                }
+                if (removed.length === 0)
+                    return;
+                if (result === 'all' && kept.length === 0) {
                     ctx.app.notify('Logged out from all providers. Use /login to sign in.');
                 }
                 else {
-                    void clearApiKey(result);
-                    const provider = configuredProviders.find(p => p.id === result);
-                    ctx.app.notify(`Logged out from ${provider?.name || result}`);
-                    if (result === currentProvider.id) {
-                        const remaining = configuredProviders.filter(p => p.id !== result);
-                        if (remaining.length > 0) {
-                            setProvider(remaining[0].id);
-                            ctx.app.notify(`Switched to ${remaining[0].name}`);
-                        }
-                        else {
-                            ctx.app.notify('No providers configured. Use /login to sign in.');
-                        }
+                    ctx.app.notify(`Logged out from ${removed.map(p => p.name).join(', ')}`);
+                }
+                if (removed.some(p => p.id === currentProvider.id)) {
+                    const remaining = configuredProviders.filter(p => !removed.includes(p));
+                    if (remaining.length > 0) {
+                        setProvider(remaining[0].id);
+                        ctx.app.notify(`Switched to ${remaining[0].name}`);
+                    }
+                    else if (result !== 'all') {
+                        ctx.app.notify('No providers configured. Use /login to sign in.');
                     }
                 }
             });

package/dist/utils/guardedFetch.d.ts

@@ -0,0 +1,29 @@
+/**
+ * `fetch_url`'s transport: curl, with redirects followed here rather than by
+ * curl, so every hop passes the SSRF guard.
+ *
+ * `curl -L` only let us check the URL the model asked for. A public page that
+ * answers `302 Location: http://169.254.169.254/…` (or any LAN/localhost
+ * service) was followed silently and its body handed back to the model —
+ * and `fetch_url` runs without a confirmation prompt. So each hop is resolved,
+ * checked, and the connection pinned to the checked address with `--resolve`,
+ * which also stops a second DNS answer (rebinding) from swapping in a private
+ * address between the check and curl's own lookup.
+ */
+export type CurlRunner = (args: string[]) => Promise<{
+    success: boolean;
+    stdout: string;
+    stderr: string;
+}>;
+export type GuardedFetchResult = {
+    ok: true;
+    body: string;
+    finalUrl: string;
+} | {
+    ok: false;
+    error: string;
+};
+export declare const MAX_FETCH_REDIRECTS = 5;
+/** One budget for the whole chain — per hop, six slow 302s would hold a tool call for minutes. */
+export declare const FETCH_BUDGET_MS = 30000;
+export declare function fetchUrlGuarded(rawUrl: string, runCurl: CurlRunner, maxRedirects?: number): Promise<GuardedFetchResult>;

package/dist/utils/guardedFetch.js

@@ -0,0 +1,67 @@
+/**
+ * `fetch_url`'s transport: curl, with redirects followed here rather than by
+ * curl, so every hop passes the SSRF guard.
+ *
+ * `curl -L` only let us check the URL the model asked for. A public page that
+ * answers `302 Location: http://169.254.169.254/…` (or any LAN/localhost
+ * service) was followed silently and its body handed back to the model —
+ * and `fetch_url` runs without a confirmation prompt. So each hop is resolved,
+ * checked, and the connection pinned to the checked address with `--resolve`,
+ * which also stops a second DNS answer (rebinding) from swapping in a private
+ * address between the check and curl's own lookup.
+ */
+import { resolveFetchTarget } from './ssrfGuard.js';
+export const MAX_FETCH_REDIRECTS = 5;
+/** One budget for the whole chain — per hop, six slow 302s would hold a tool call for minutes. */
+export const FETCH_BUDGET_MS = 30_000;
+// Appended by curl after the body; the LAST occurrence is always curl's own,
+// so a page that happens to contain the marker can't forge a redirect.
+const META_MARKER = '\n__CODEEP_FETCH_META__';
+export async function fetchUrlGuarded(rawUrl, runCurl, maxRedirects = MAX_FETCH_REDIRECTS) {
+    let current = rawUrl;
+    const deadline = Date.now() + FETCH_BUDGET_MS;
+    for (let hop = 0; hop <= maxRedirects; hop++) {
+        const secondsLeft = Math.ceil((deadline - Date.now()) / 1000);
+        if (secondsLeft <= 0)
+            return { ok: false, error: `Timed out after ${FETCH_BUDGET_MS / 1000}s following redirects` };
+        const check = await resolveFetchTarget(current);
+        if (!check.ok) {
+            return { ok: false, error: hop === 0 ? check.reason : `Refused redirect to ${current} — ${check.reason}` };
+        }
+        if (check.unresolved) {
+            // An unpinned request would let curl's own lookup decide the address.
+            return { ok: false, error: `Could not resolve host: ${check.url.hostname}` };
+        }
+        const { url, addresses } = check;
+        const args = [
+            '-s',
+            '--proto', '=http,https',
+            '-m', String(secondsLeft),
+            '-A', 'Codeep/1.0',
+            '--max-filesize', '1000000',
+            '-w', `${META_MARKER}%{http_code} %{redirect_url}`,
+        ];
+        if (addresses?.length) {
+            const port = url.port || (url.protocol === 'https:' ? '443' : '80');
+            const pinned = addresses.map((a) => (a.includes(':') ? `[${a}]` : a)).join(',');
+            args.push('--resolve', `${url.hostname}:${port}:${pinned}`);
+        }
+        args.push(url.href);
+        const res = await runCurl(args);
+        const at = res.stdout.lastIndexOf(META_MARKER);
+        if (!res.success || at === -1) {
+            return { ok: false, error: res.stderr || 'Failed to fetch URL' };
+        }
+        const body = res.stdout.slice(0, at);
+        const meta = res.stdout.slice(at + META_MARKER.length).trim();
+        const space = meta.indexOf(' ');
+        const status = Number(space === -1 ? meta : meta.slice(0, space));
+        const location = space === -1 ? '' : meta.slice(space + 1).trim();
+        if (status >= 300 && status < 400 && location) {
+            current = location;
+            continue;
+        }
+        return { ok: true, body, finalUrl: url.href };
+    }
+    return { ok: false, error: `Too many redirects (more than ${maxRedirects})` };
+}

package/dist/utils/shell.js

@@ -4,7 +4,8 @@
 import { spawnSync, spawn } from 'child_process';
 import { resolve, relative, isAbsolute } from 'path';
 import { existsSync } from 'fs';
-import { assertFetchUrlAllowed } from './ssrfGuard.js';
+import { isIP } from 'net';
+import { assertFetchUrlAllowed, isBlockedIp } from './ssrfGuard.js';
 // Dangerous command patterns that should never be executed
 const BLOCKED_COMMANDS = new Set([
     'sudo',
@@ -116,37 +117,159 @@ function hasInlineEval(command, args) {
 // routes through assertFetchUrlAllowed; without this list the same model-
 // controlled URL could just be passed to curl instead.
 const URL_CARRYING_COMMANDS = new Set(['curl', 'wget', 'http', 'https']);
+// curl options that consume the next argument as their value — generated
+// from `curl --help all` (every entry with a <value>), plus the proxy flags
+// whose value is shown without brackets. Knowing them is what lets a bare
+// number be read as a host: `curl 2130706433:8080` connects to 127.0.0.1,
+// while the `30` in `curl -m 30 …` is a timeout.
+const CURL_VALUE_OPTIONS = new Set(('--abstract-unix-socket --alt-svc --aws-sigv4 --cacert --capath --cert --cert-type --ciphers --config ' +
+    '--connect-timeout --connect-to --continue-at --cookie --cookie-jar --create-file-mode --crlfile --curves ' +
+    '--data --data-ascii --data-binary --data-raw --data-urlencode --delegation --dns-interface --dns-ipv4-addr ' +
+    '--dns-ipv6-addr --dns-servers --doh-url --dump-header --egd-file --engine --etag-compare --etag-save ' +
+    '--expect100-timeout --form --form-string --ftp-account --ftp-alternative-to-user --ftp-method --ftp-port ' +
+    '--ftp-ssl-ccc-mode --happy-eyeballs-timeout-ms --haproxy-clientip --header --hostpubmd5 --hostpubsha256 ' +
+    '--hsts --interface --ipfs-gateway --json --keepalive-time --key --key-type --krb --libcurl --limit-rate ' +
+    '--local-port --login-options --mail-auth --mail-from --mail-rcpt --max-filesize --max-redirs --max-time ' +
+    '--netrc-file --noproxy --oauth2-bearer --output --output-dir --parallel-max --pass --pinnedpubkey --proto ' +
+    '--proto-default --proto-redir --proxy-cacert --proxy-capath --proxy-cert --proxy-cert-type --proxy-ciphers ' +
+    '--proxy-crlfile --proxy-header --proxy-key --proxy-key-type --proxy-pass --proxy-pinnedpubkey ' +
+    '--proxy-service-name --proxy-tls13-ciphers --proxy-tlsauthtype --proxy-tlspassword --proxy-tlsuser ' +
+    '--proxy-user --proxy1.0 --pubkey --quote --random-file --range --rate --referer --request --request-target ' +
+    '--resolve --retry --retry-delay --retry-max-time --sasl-authzid --service-name --socks4 --socks4a --socks5 ' +
+    '--socks5-gssapi-service --socks5-hostname --speed-limit --speed-time --stderr --telnet-option --tftp-blksize ' +
+    '--time-cond --tls-max --tls13-ciphers --tlsauthtype --tlspassword --tlsuser --trace --trace-ascii ' +
+    '--trace-config --unix-socket --upload-file --url --url-query --user --user-agent --variable --write-out ' +
+    '--proxy --preproxy').split(' '));
+const CURL_VALUE_SHORT = new Set('ACDEFHKPQTUXYbcdemortuwxyz'.split(''));
+// wget spells most values `--opt=value`; these are the ones commonly split.
+const WGET_VALUE_OPTIONS = new Set(['-O', '-o', '-a', '-t', '-T', '-w', '-e', '-P', '-U', '-Q', '-l', '-A', '-R', '-D', '-X', '-I', '-i', '-B',
+    '--output-document', '--output-file', '--tries', '--timeout', '--wait', '--execute', '--directory-prefix',
+    '--user-agent', '--header', '--user', '--password', '--input-file', '--base', '--limit-rate', '--max-redirect']);
+/** True when `arg` (an option) makes the NEXT argument its value. */
+function optionTakesNextArg(command, arg) {
+    if (arg.includes('='))
+        return false;
+    if (command === 'curl') {
+        if (arg.startsWith('--'))
+            return CURL_VALUE_OPTIONS.has(arg);
+        // Short cluster: `-sm 30` — only the last letter may take the next arg;
+        // an earlier value-taking letter swallows the rest of the cluster (`-m30`).
+        for (let i = 1; i < arg.length; i++) {
+            if (CURL_VALUE_SHORT.has(arg[i]))
+                return i === arg.length - 1;
+        }
+        return false;
+    }
+    if (command === 'wget')
+        return WGET_VALUE_OPTIONS.has(arg);
+    return false;
+}
+const PORT_PATH = String.raw `(:\d+)?([\/?#].*)?`;
+// Scheme-less host forms the tools accept: localhost, dotted/bracketed IP
+// literals, named hosts, and the numeric spellings libc resolves —
+// `2130706433`, `0x7f000001`, `017700000001`, `0` are all 127.0.0.1/0.0.0.0.
+const SCHEMELESS_HOST = new RegExp('^(' + [
+    `localhost${PORT_PATH}`,
+    String.raw `\[[0-9a-f:.%]+\]` + PORT_PATH,
+    String.raw `(0x[0-9a-f]+|\d+)(\.(0x[0-9a-f]+|\d+)){0,3}` + PORT_PATH,
+    String.raw `[a-z0-9-]+(\.[a-z0-9-]+)+` + PORT_PATH,
+    String.raw `[a-z0-9-]+:\d+([\/?#].*)?`,
+].join('|') + ')$', 'i');
 // Heuristic: extract URL-looking arguments. curl/wget accept URLs with or
 // without a scheme (curl example.com works), and URLs may also ride in
-// option values (`--url=…`, `-d @url`, header values like
-// `Host: internal.corp`). We normalize scheme-less hosts so the guard sees
-// what curl will actually connect to.
-function extractUrlCandidates(args) {
+// option values (`--url …`). Scheme-less hosts are normalized so the guard
+// sees what the tool will actually connect to; option values are skipped so
+// a timeout or a data payload isn't mistaken for a host.
+function extractUrlCandidates(command, args) {
     const urls = [];
-    for (const arg of args) {
-        if (arg.startsWith('-')) {
-            // Option values: --url=x, --output=y are paths not URLs, but
-            // --header="Host: x" can smuggle a host. Keep it simple: only check
-            // --url= style options that plausibly carry a URL.
-            const m = arg.match(/^--url=(.+)$/i);
-            if (m)
-                urls.push(m[1]);
+    for (let i = 0; i < args.length; i++) {
+        const arg = args[i];
+        if (arg.startsWith('-') && arg.length > 1) {
+            const eq = arg.match(/^--url=(.+)$/i);
+            if (eq) {
+                urls.push(eq[1]);
+                continue;
+            }
+            if (optionTakesNextArg(command, arg)) {
+                if (arg === '--url' && args[i + 1])
+                    urls.push(args[i + 1]);
+                i++; // the value is not a positional URL
+            }
             continue;
         }
         if (/^https?:\/\//i.test(arg)) {
             urls.push(arg);
         }
-        else if (
-        // scheme-less host forms curl accepts: literal IPs (with optional
-        // port/path), 'localhost', and named hosts (example.com, internal.corp).
-        // Anything else (plain filenames, package names) is left alone.
-        /^(localhost([\/?#].*)?|\d{1,3}(\.\d{1,3}){3}(:\d+)?([\/?#].*)?|[a-z0-9-]+(\.[a-z0-9-]+)+(:\d+)?([\/?#].*)?)$/i.test(arg)) {
-            // scheme-less host or host/path — what curl will connect to
+        else if ((command === 'http' || command === 'https') && /^:\d*([\/?#].*)?$/.test(arg)) {
+            // httpie shorthand: `http :3000/api` is localhost:3000
+            urls.push(`http://localhost${arg}`);
+        }
+        else if (SCHEMELESS_HOST.test(arg)) {
             urls.push(`http://${arg}`);
         }
     }
     return urls;
 }
+// curl options that change WHERE the connection goes without changing the
+// URL the guard looks at: `--resolve example.com:80:127.0.0.1 http://example.com`
+// passes a URL-only check and then talks to loopback. Each one is judged by
+// the address it actually points curl at.
+const CURL_TARGET_FLAGS = new Set(['--resolve', '--connect-to', '--unix-socket', '--abstract-unix-socket', '-x', '--proxy', '--preproxy', '--socks4', '--socks4a', '--socks5', '--socks5-hostname']);
+function curlTargetOverrides(args) {
+    const out = [];
+    for (let i = 0; i < args.length; i++) {
+        const arg = args[i];
+        const eq = arg.indexOf('=');
+        if (arg.startsWith('--') && eq !== -1 && CURL_TARGET_FLAGS.has(arg.slice(0, eq))) {
+            out.push({ flag: arg.slice(0, eq), value: arg.slice(eq + 1) });
+        }
+        else if (CURL_TARGET_FLAGS.has(arg)) {
+            out.push({ flag: arg, value: args[i + 1] ?? '' });
+            i++;
+        }
+        else if (/^-x./.test(arg)) {
+            out.push({ flag: '-x', value: arg.slice(2) });
+        }
+    }
+    return out;
+}
+async function curlTargetOverrideProblem(args) {
+    for (const { flag, value } of curlTargetOverrides(args)) {
+        if (flag === '--unix-socket' || flag === '--abstract-unix-socket') {
+            return `${flag} is not allowed — it bypasses the network address check`;
+        }
+        if (flag === '--resolve') {
+            // [+]host:port:addr[,addr]… — every address must be public.
+            const addrs = value.replace(/^\+/, '').split(':').slice(2).join(':');
+            for (const addr of addrs.split(',')) {
+                if (!addr || isBlockedIp(addr))
+                    return `--resolve points at a private/internal address (${addr || 'empty'})`;
+                if (!isIP(addr.replace(/^\[|\]$/g, '')))
+                    return `--resolve needs a numeric address (got ${addr})`;
+            }
+            continue;
+        }
+        let target;
+        if (flag === '--connect-to') {
+            // HOST1:PORT1:HOST2:PORT2 — an empty HOST2 keeps the URL's host.
+            const m = value.match(/^(\[[^\]]*\]|[^:]*):[^:]*:(\[[^\]]*\]|[^:]*)(?::.*)?$/);
+            if (!m)
+                return `--connect-to value not understood: ${value}`;
+            if (!m[2])
+                continue;
+            target = `http://${m[2]}/`;
+        }
+        else {
+            // Proxy flags: judge the proxy host. Any scheme is rewritten to http so
+            // the guard parses the host the same way for socks5:// and friends.
+            target = /^[a-z][a-z0-9+.-]*:\/\//i.test(value) ? value.replace(/^[a-z][a-z0-9+.-]*:/i, 'http:') : `http://${value}`;
+        }
+        const blocked = await assertFetchUrlAllowed(target);
+        if (blocked)
+            return `${flag} ${blocked}`;
+    }
+    return null;
+}
 // Exec-escapes: whitelisted utilities that can run ARBITRARY other commands
 // as part of their arguments, silently bypassing the whitelist above.
 //   find . -exec <anything> \;        → runs <anything>
@@ -316,7 +439,12 @@ export async function validateCommandAsync(command, args, options) {
     if (!sync.valid)
         return sync;
     if (URL_CARRYING_COMMANDS.has(command)) {
-        for (const url of extractUrlCandidates(args)) {
+        if (command === 'curl') {
+            const problem = await curlTargetOverrideProblem(args);
+            if (problem)
+                return { valid: false, reason: `Blocked curl option: ${problem}` };
+        }
+        for (const url of extractUrlCandidates(command, args)) {
             const blocked = await assertFetchUrlAllowed(url);
             if (blocked) {
                 return { valid: false, reason: `Blocked URL in ${command} arguments: ${blocked}` };

package/dist/utils/ssrfGuard.d.ts

@@ -3,16 +3,39 @@
  * touching surfaces.
  *
  * Used by:
- *   - toolExecution.ts  → the `fetch_url` tool
+ *   - toolExecution.ts  → the `fetch_url` tool (every redirect hop, pinned)
  *   - shell.ts          → curl/wget/http(s) arguments in execute_command
+ *   - webFetch.ts       → redirect hops of a user's `@web` mention
  *
- * The URLs in both cases originate from model output / page content
+ * The URLs in the agent cases originate from model output / page content
  * (untrusted, prompt-injectable), so the agent must not be able to reach
  * internal services or the cloud metadata endpoint (169.254.169.254).
  * NOTE: this deliberately does NOT apply to user-configured provider base
  * URLs (Ollama localhost, custom vLLM/Tailscale endpoints) — those are
  * trusted config and never routed through agent tools.
  */
+/**
+ * Whether an IP literal points somewhere the agent must not reach. Brackets
+ * are accepted (`[::1]`); anything that isn't an IP literal returns false —
+ * hostnames are resolved by `resolveFetchTarget`, not judged by spelling.
+ */
 export declare function isBlockedIp(ip: string): boolean;
+export type FetchTargetCheck = {
+    ok: true;
+    url: URL;
+    /** Every checked address, to pin the connection to, so a second DNS
+     *  answer can't swap in a private one (rebinding). All of them, not
+     *  the first: a dual-stack host whose AAAA sorts first would otherwise
+     *  be unreachable on a machine without a working IPv6 route. Undefined
+     *  for IP literals — nothing to resolve — and when DNS failed. */
+    addresses?: string[];
+    /** True when the host was a name that did not resolve. */
+    unresolved?: boolean;
+} | {
+    ok: false;
+    reason: string;
+};
+/** Validate a URL and resolve its host, returning the verified address. */
+export declare function resolveFetchTarget(rawUrl: string): Promise<FetchTargetCheck>;
 /** Returns an error string if the URL must not be fetched, else null. */
 export declare function assertFetchUrlAllowed(rawUrl: string): Promise<string | null>;

package/dist/utils/ssrfGuard.js

@@ -3,10 +3,11 @@
  * touching surfaces.
  *
  * Used by:
- *   - toolExecution.ts  → the `fetch_url` tool
+ *   - toolExecution.ts  → the `fetch_url` tool (every redirect hop, pinned)
  *   - shell.ts          → curl/wget/http(s) arguments in execute_command
+ *   - webFetch.ts       → redirect hops of a user's `@web` mention
  *
- * The URLs in both cases originate from model output / page content
+ * The URLs in the agent cases originate from model output / page content
  * (untrusted, prompt-injectable), so the agent must not be able to reach
  * internal services or the cloud metadata endpoint (169.254.169.254).
  * NOTE: this deliberately does NOT apply to user-configured provider base
@@ -14,70 +15,147 @@
  * trusted config and never routed through agent tools.
  */
 import { lookup as dnsLookup } from 'dns/promises';
-export function isBlockedIp(ip) {
-    const s = ip.trim().toLowerCase();
-    if (s.includes(':')) {
-        // IPv6
-        if (s === '::1' || s === '::')
-            return true; // loopback / unspecified
-        if (s.startsWith('fe80') || s.startsWith('fc') || s.startsWith('fd'))
-            return true; // link-local / ULA
-        const mapped = s.match(/::ffff:(\d+\.\d+\.\d+\.\d+)$/); // IPv4-mapped
-        if (mapped)
-            return isBlockedIp(mapped[1]);
-        return false;
+import { isIP } from 'net';
+/** Strict dotted-quad → 4 octets, or null. */
+function parseIPv4(s) {
+    if (!/^\d{1,3}(\.\d{1,3}){3}$/.test(s))
+        return null;
+    const octets = s.split('.').map(Number);
+    return octets.every((n) => n <= 255) ? octets : null;
+}
+/**
+ * IPv6 literal → 16 bytes, or null. Handles `::` compression, a trailing
+ * dotted quad (`::ffff:1.2.3.4`) and a zone id (`fe80::1%en0`).
+ *
+ * Classifying bytes rather than the string is the point: the WHATWG URL
+ * parser rewrites `[::ffff:127.0.0.1]` to `[::ffff:7f00:1]`, so a guard that
+ * pattern-matches the dotted spelling never sees the address it has to block.
+ */
+function parseIPv6(input) {
+    let s = input.toLowerCase();
+    const zone = s.indexOf('%');
+    if (zone !== -1)
+        s = s.slice(0, zone);
+    if (isIP(s) !== 6)
+        return null;
+    let tail = null;
+    const lastColon = s.lastIndexOf(':');
+    if (s.slice(lastColon + 1).includes('.')) {
+        tail = parseIPv4(s.slice(lastColon + 1));
+        if (!tail)
+            return null;
+        s = s.slice(0, lastColon + 1) + '0:0'; // two placeholder groups
+    }
+    let groups;
+    if (s.includes('::')) {
+        const [left, right] = s.split('::');
+        const l = left ? left.split(':') : [];
+        const r = right ? right.split(':') : [];
+        groups = [...l, ...Array(8 - l.length - r.length).fill('0'), ...r];
+    }
+    else {
+        groups = s.split(':');
+    }
+    if (groups.length !== 8)
+        return null;
+    const bytes = groups.flatMap((g) => {
+        const v = parseInt(g, 16);
+        return [v >> 8, v & 0xff];
+    });
+    if (tail)
+        bytes.splice(12, 4, ...tail);
+    return bytes;
+}
+function isBlockedIPv4([a, b, c]) {
+    return a === 0 // 0.0.0.0/8 "this network"
+        || a === 10 // RFC1918
+        || a === 127 // loopback
+        || (a === 100 && b >= 64 && b <= 127) // 100.64.0.0/10 CGNAT — Tailscale lives here
+        || (a === 169 && b === 254) // link-local incl. metadata 169.254.169.254
+        || (a === 172 && b >= 16 && b <= 31) // RFC1918
+        || (a === 192 && b === 0 && c === 0) // 192.0.0.0/24 IETF protocol assignments
+        || (a === 192 && b === 168) // RFC1918
+        || (a === 198 && (b === 18 || b === 19)) // 198.18.0.0/15 benchmarking
+        || a >= 224; // multicast, reserved, broadcast
+}
+function isBlockedIPv6(b) {
+    const zeroUpTo = (n) => b.slice(0, n).every((x) => x === 0);
+    // Forms that carry an IPv4 address — judge the embedded address.
+    if (zeroUpTo(10) && b[10] === 0xff && b[11] === 0xff)
+        return isBlockedIPv4(b.slice(12)); // ::ffff:0:0/96 mapped
+    if (zeroUpTo(12))
+        return isBlockedIPv4(b.slice(12)); // ::/96 compatible — also covers :: and ::1
+    if (b[0] === 0x00 && b[1] === 0x64 && b[2] === 0xff && b[3] === 0x9b) {
+        if (b.slice(4, 12).every((x) => x === 0))
+            return isBlockedIPv4(b.slice(12)); // 64:ff9b::/96 NAT64
+        if (b[4] === 0x00 && b[5] === 0x01)
+            return true; // 64:ff9b:1::/48 local-use NAT64
     }
-    const parts = s.split('.').map(Number);
-    if (parts.length !== 4 || parts.some((n) => Number.isNaN(n) || n < 0 || n > 255))
-        return false;
-    const [a, b] = parts;
-    if (a === 127)
-        return true; // loopback
-    if (a === 10)
-        return true; // RFC1918
-    if (a === 172 && b >= 16 && b <= 31)
-        return true; // RFC1918
-    if (a === 192 && b === 168)
-        return true; // RFC1918
-    if (a === 169 && b === 254)
-        return true; // link-local incl. metadata 169.254.169.254
-    if (a === 0)
-        return true; // 0.0.0.0/8
+    if (b[0] === 0x20 && b[1] === 0x02)
+        return isBlockedIPv4(b.slice(2, 6)); // 2002::/16 6to4
+    if ((b[0] & 0xfe) === 0xfc)
+        return true; // fc00::/7 unique local
+    if (b[0] === 0xfe && (b[1] & 0xc0) === 0x80)
+        return true; // fe80::/10 link-local
+    if (b[0] === 0xfe && (b[1] & 0xc0) === 0xc0)
+        return true; // fec0::/10 site-local (deprecated)
+    if (b[0] === 0xff)
+        return true; // ff00::/8 multicast
     return false;
 }
-/** Returns an error string if the URL must not be fetched, else null. */
-export async function assertFetchUrlAllowed(rawUrl) {
+/**
+ * Whether an IP literal points somewhere the agent must not reach. Brackets
+ * are accepted (`[::1]`); anything that isn't an IP literal returns false —
+ * hostnames are resolved by `resolveFetchTarget`, not judged by spelling.
+ */
+export function isBlockedIp(ip) {
+    const s = ip.trim().replace(/^\[|\]$/g, '');
+    const v4 = parseIPv4(s);
+    if (v4)
+        return isBlockedIPv4(v4);
+    const v6 = parseIPv6(s);
+    return v6 ? isBlockedIPv6(v6) : false;
+}
+/** Validate a URL and resolve its host, returning the verified address. */
+export async function resolveFetchTarget(rawUrl) {
     let u;
     try {
         u = new URL(rawUrl);
     }
     catch {
-        return 'Invalid URL format';
+        return { ok: false, reason: 'Invalid URL format' };
     }
     if (u.protocol !== 'http:' && u.protocol !== 'https:') {
-        return `Blocked: only http/https URLs can be fetched (got "${u.protocol}")`;
+        return { ok: false, reason: `Blocked: only http/https URLs can be fetched (got "${u.protocol}")` };
     }
     const host = u.hostname.replace(/^\[|\]$/g, ''); // strip IPv6 brackets
     if (host === 'localhost' || host.endsWith('.localhost')) {
-        return 'Blocked: localhost is not fetchable by the agent';
+        return { ok: false, reason: 'Blocked: localhost is not fetchable by the agent' };
     }
-    if (/^[0-9.]+$/.test(host) || host.includes(':')) {
-        // Literal IP — check directly.
+    if (isIP(host)) {
         if (isBlockedIp(host))
-            return `Blocked: ${host} is a private/loopback/link-local address`;
-        return null;
+            return { ok: false, reason: `Blocked: ${host} is a private/loopback/link-local address` };
+        return { ok: true, url: u };
     }
     // Resolve and check every address (catches internal hostnames + single-record rebinding).
+    let addrs;
     try {
-        const addrs = await dnsLookup(host, { all: true });
-        for (const a of addrs) {
-            if (isBlockedIp(a.address)) {
-                return `Blocked: ${host} resolves to a private/internal address (${a.address})`;
-            }
-        }
+        addrs = await dnsLookup(host, { all: true });
     }
     catch {
-        // DNS failure — let curl attempt and fail naturally; not an SSRF risk.
+        // DNS failure — not an SSRF risk by itself; callers decide whether an
+        // unpinned request is acceptable.
+        return { ok: true, url: u, unresolved: true };
+    }
+    for (const a of addrs) {
+        if (isBlockedIp(a.address)) {
+            return { ok: false, reason: `Blocked: ${host} resolves to a private/internal address (${a.address})` };
+        }
     }
-    return null;
+    return { ok: true, url: u, addresses: addrs.map((a) => a.address) };
+}
+/** Returns an error string if the URL must not be fetched, else null. */
+export async function assertFetchUrlAllowed(rawUrl) {
+    const check = await resolveFetchTarget(rawUrl);
+    return check.ok ? null : check.reason;
 }

package/dist/utils/toolExecution.js

@@ -21,7 +21,7 @@ import { isMcpToolName, callSessionTool, isVirtualMcpToolName, callSessionVirtua
 // shared with shell.ts for curl/wget URL checks. Re-exported here so the
 // existing tests that import it from toolExecution keep working.
 export { isBlockedIp, assertFetchUrlAllowed } from './ssrfGuard.js';
-import { assertFetchUrlAllowed } from './ssrfGuard.js';
+import { fetchUrlGuarded } from './guardedFetch.js';
 const debug = (...args) => {
     if (process.env.CODEEP_DEBUG === '1') {
         logger.debug(args.map(String).join(' '));
@@ -554,19 +554,14 @@ async function dispatchTool(tool, parameters, projectRoot, fs, toolCall) {
                 const url = parameters.url;
                 if (!url)
                     return { success: false, output: '', error: 'Missing required parameter: url', tool, parameters };
-                const blockedReason = await assertFetchUrlAllowed(url);
-                if (blockedReason)
-                    return { success: false, output: '', error: blockedReason, tool, parameters };
-                // Restrict to http/https on the initial request AND redirects, and cap
-                // redirect hops — defends against protocol-smuggling and limits
-                // redirect-based SSRF reach (initial host is already IP-checked above).
-                const result = await executeCommandAsync('curl', ['-s', '-L', '--proto', '=http,https', '--proto-redir', '=http,https', '--max-redirs', '5', '-m', '30', '-A', 'Codeep/1.0', '--max-filesize', '1000000', url], {
+                // Every redirect hop is SSRF-checked and pinned — see guardedFetch.ts.
+                const result = await fetchUrlGuarded(url, (args) => executeCommandAsync('curl', args, {
                     cwd: projectRoot,
                     projectRoot,
                     timeout: 35000,
-                });
-                if (result.success) {
-                    let content = result.stdout;
+                }));
+                if (result.ok) {
+                    let content = result.body;
                     if (content.includes('<html') || content.includes('<!DOCTYPE')) {
                         content = htmlToText(content);
                     }
@@ -574,7 +569,7 @@ async function dispatchTool(tool, parameters, projectRoot, fs, toolCall) {
                         content = content.substring(0, 10000) + '\n\n... (truncated)';
                     return { success: true, output: content, tool, parameters };
                 }
-                return { success: false, output: '', error: result.stderr || 'Failed to fetch URL', tool, parameters };
+                return { success: false, output: '', error: result.error, tool, parameters };
             }
             // === Z.AI MCP Tools ===
             case 'web_search': {

package/dist/utils/webFetch.js

@@ -20,6 +20,7 @@
  * The fetcher is async, so `expandWebMentions` is async — unlike the
  * sync `expandMentions` for files. Callers await it.
  */
+import { assertFetchUrlAllowed, isBlockedIp } from './ssrfGuard.js';
 /** Max bytes of text we'll inline from a fetched page (32 KB). */
 export const MAX_WEB_BYTES = 32 * 1024;
 /** Fetch timeout — don't hang the chat on a slow server. */
@@ -175,24 +176,16 @@ export function webCacheStats() {
  * endpoint), and `.internal`-style names.
  *
  * A user typing `@web http://localhost:3000` is a documented, intended use, so
- * this is NOT a blanket block — it's only applied to where a fetch *ended up*
- * after redirects, so a public URL can't bounce us into the private network.
+ * this is NOT a blanket block — it only decides whether redirect hops get
+ * checked, so a public URL can't bounce us into the private network.
  */
 function isPrivateHost(hostname) {
     const h = hostname.toLowerCase().replace(/^\[|\]$/g, '');
     if (h === 'localhost' || h.endsWith('.localhost') || h.endsWith('.internal') || h.endsWith('.local'))
         return true;
-    if (h === '::1' || h.startsWith('fc') || h.startsWith('fd') || h.startsWith('fe80:'))
-        return true;
-    const m = h.match(/^(\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})$/);
-    if (!m)
-        return false;
-    const [a, b] = [Number(m[1]), Number(m[2])];
-    return a === 127 || a === 10 || a === 0
-        || (a === 192 && b === 168)
-        || (a === 172 && b >= 16 && b <= 31)
-        || (a === 169 && b === 254);
+    return isBlockedIp(h);
 }
+const MAX_REDIRECTS = 5;
 /** Hard ceiling on bytes read from the network, before any text decoding. */
 const MAX_WEB_FETCH_BYTES = MAX_WEB_BYTES * 4;
 async function safeFetch(url, fetchImpl) {
@@ -202,6 +195,8 @@ async function safeFetch(url, fetchImpl) {
     // `finally` so a throw can't leak the timer either.
     const timer = setTimeout(() => controller.abort(), FETCH_TIMEOUT_MS);
     try {
+        // Judged like the hops (names resolved, not just spelled), so a LAN host
+        // such as `nas.home` may still redirect within the LAN it lives on.
         const requestedPrivate = (() => {
             try {
                 return isPrivateHost(new URL(url).hostname);
@@ -209,24 +204,40 @@ async function safeFetch(url, fetchImpl) {
             catch {
                 return false;
             }
-        })();
-        const res = await fetchImpl(url, {
-            signal: controller.signal,
-            headers: { 'User-Agent': USER_AGENT, Accept: 'text/html, text/plain, */*' },
-            redirect: 'follow',
-        });
-        if (!res.ok) {
-            return { ok: false, reason: `HTTP ${res.status}` };
-        }
-        // SSRF guard: the user vouched for the host they typed, not for wherever
-        // it redirected us. Refuse a public → private hop (cloud metadata, LAN).
-        if (!requestedPrivate && res.url) {
+        })() || (await assertFetchUrlAllowed(url)) !== null;
+        // Redirects are followed here, not by fetch: the user vouched for the host
+        // they typed, not for wherever it redirects. With `redirect: 'follow'`
+        // only the final URL could be checked, after every hop — private ones
+        // included — had already been requested.
+        let current = url;
+        let res;
+        for (let hop = 0;; hop++) {
+            if (hop > 0 && !requestedPrivate && await assertFetchUrlAllowed(current)) {
+                return { ok: false, reason: 'redirected to a private/internal address — refused' };
+            }
+            res = await fetchImpl(current, {
+                signal: controller.signal,
+                headers: { 'User-Agent': USER_AGENT, Accept: 'text/html, text/plain, */*' },
+                redirect: 'manual',
+            });
+            const location = res.status >= 300 && res.status < 400 ? res.headers.get('location') : null;
+            if (!location)
+                break;
+            if (hop >= MAX_REDIRECTS)
+                return { ok: false, reason: `too many redirects (more than ${MAX_REDIRECTS})` };
             try {
-                if (isPrivateHost(new URL(res.url).hostname)) {
-                    return { ok: false, reason: 'redirected to a private/internal address — refused' };
-                }
+                await res.body?.cancel();
             }
-            catch { /* unparseable res.url — fall through */ }
+            catch { /* nothing to drain */ }
+            try {
+                current = new URL(location, current).href;
+            }
+            catch {
+                return { ok: false, reason: `HTTP ${res.status} with an invalid redirect` };
+            }
+        }
+        if (!res.ok) {
+            return { ok: false, reason: `HTTP ${res.status}` };
         }
         const declared = Number(res.headers.get('content-length') ?? '');
         if (Number.isFinite(declared) && declared > MAX_WEB_FETCH_BYTES) {

package/dist/version.d.ts

@@ -1 +1 @@
-export declare const VERSION = "3.3.2";
+export declare const VERSION = "3.3.3";

package/dist/version.js

@@ -1,4 +1,4 @@
 // AUTO-GENERATED by scripts/gen-version.js — do not edit by hand.
 // Baked from package.json at build time so the bun-compiled binary reports
 // the right version (it has no package.json on disk to read at runtime).
-export const VERSION = '3.3.2';
+export const VERSION = '3.3.3';

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "codeep",
-  "version": "3.3.2",
+  "version": "3.3.3",
   "description": "AI-powered coding assistant built for the terminal. Multiple LLM providers, project-aware context, and a seamless development workflow.",
   "type": "module",
   "main": "dist/index.js",
@@ -43,7 +43,7 @@
     "@napi-rs/keyring": "^1.3.0",
     "clipboardy": "^4.0.0",
     "conf": "^13.1.0",
-    "js-yaml": "^4.3.1",
+    "js-yaml": "^4.3.2",
     "open": "^10.0.0"
   },
   "devDependencies": {