hanoman 0.9.3 → 0.9.4

package/dist/build-info.json

@@ -1,5 +1,5 @@
 {
-  "version": "0.9.3",
-  "sha": "ff65a479",
-  "builtAt": "2026-09-23T04:16:27.982Z"
+  "version": "0.9.4",
+  "sha": "7af321cc",
+  "builtAt": "2026-09-23T06:02:12.160Z"
 }

package/dist/server.js

@@ -16544,9 +16544,10 @@ var init_ssrf = __esm({
 });
 
 // src/services/safe-outbound-request.ts
-import { lookup as dnsLookup2 } from "node:dns/promises";
+import { resolve4 as resolve42, resolve6 as resolve62 } from "node:dns/promises";
 import { request as httpRequest } from "node:http";
 import { request as httpsRequest } from "node:https";
+import { isIP } from "node:net";
 import { createGunzip } from "node:zlib";
 async function pinnedRequest(input) {
   return new Promise((resolve24, reject2) => {
@@ -16613,10 +16614,26 @@ async function pinnedRequest(input) {
     req.end();
   });
 }
+function withLookupTimeout(p3, ms) {
+  return new Promise((resolve24, reject2) => {
+    const timer10 = setTimeout(() => reject2(Object.assign(new Error("outbound timeout"), { name: "AbortError" })), ms);
+    timer10.unref?.();
+    p3.then((v) => {
+      clearTimeout(timer10);
+      resolve24(v);
+    }, (e) => {
+      clearTimeout(timer10);
+      reject2(e);
+    });
+  });
+}
 async function safeRequest(options2, deps = {}) {
   if (options2.url.protocol !== "http:" && options2.url.protocol !== "https:") throw new Error("outbound scheme ditolak");
   if (options2.url.username || options2.url.password) throw new Error("outbound credential URL ditolak");
-  const addresses = await (deps.lookupAll ?? defaultLookup2)(options2.url.hostname);
+  const addresses = await withLookupTimeout(
+    (deps.lookupAll ?? defaultLookup2)(options2.url.hostname),
+    options2.connectMs
+  );
   if (!addresses.length) throw new Error("DNS tak mengembalikan alamat");
   if (!options2.allowPrivate) {
     const blocked = addresses.find((row) => isBlockedAddress(row.address));
@@ -16630,7 +16647,15 @@ var init_safe_outbound_request = __esm({
   "src/services/safe-outbound-request.ts"() {
     "use strict";
     init_ssrf();
-    defaultLookup2 = async (host2) => (await dnsLookup2(host2, { all: true })).map((row) => ({ address: row.address, family: row.family }));
+    defaultLookup2 = async (host2) => {
+      const literal = isIP(host2);
+      if (literal) return [{ address: host2, family: literal }];
+      const [v4, v6] = await Promise.allSettled([resolve42(host2), resolve62(host2)]);
+      const out4 = [];
+      if (v4.status === "fulfilled") out4.push(...v4.value.map((address) => ({ address, family: 4 })));
+      if (v6.status === "fulfilled") out4.push(...v6.value.map((address) => ({ address, family: 6 })));
+      return out4;
+    };
   }
 });
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "hanoman",
-  "version": "0.9.3",
+  "version": "0.9.4",
   "description": "Orchestrator + dashboard workflow docs-driven untuk sesi Claude Code / Codex",
   "type": "module",
   "repository": {