specrails-desktop 2.11.7 → 2.11.8

package/server/dist/browser-playwright.js

@@ -8,16 +8,110 @@
 // Screencast uses CDP (`Page.startScreencast`) since Playwright exposes no
 // screencast API; input + screenshot + DOM use Playwright's high-level page API.
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.isNavigableUrl = isNavigableUrl;
+exports.normalizeUrl = normalizeUrl;
+exports.chromiumLaunchArgs = chromiumLaunchArgs;
 exports.createPlaywrightLauncher = createPlaywrightLauncher;
 const chromium_resolver_1 = require("./chromium-resolver");
 const browser_network_1 = require("./browser-network");
+/**
+ * Centralized SSRF / scheme guard for EVERY navigation path (WS `navigate`, REST
+ * `navigate`, REST create `initialUrl`). Returns true only for an `http`/`https`
+ * URL whose host is NOT a private / loopback / link-local address. `about:blank`
+ * is always allowed (the harmless empty page). Everything else — `file://`,
+ * `data:`, `chrome://`, link-local `169.254.0.0/16`, loopback `127.0.0.0/8` /
+ * `::1`, RFC1918 `10/8` / `172.16/12` / `192.168/16` — is rejected.
+ *
+ * This is intentionally conservative: a host that fails to parse, or a literal
+ * IP in a blocked range, is rejected. DNS-name hosts that *resolve* to a private
+ * IP are out of scope here (we don't resolve at navigate time); the loopback
+ * server bind + token-gated upgrade are the primary control — this is the
+ * defense-in-depth scheme + literal-IP block called out in BUG-BROWSER-01.
+ */
+function isNavigableUrl(raw) {
+    const trimmed = (raw ?? '').trim();
+    if (!trimmed)
+        return false;
+    if (trimmed === 'about:blank')
+        return true;
+    let u;
+    try {
+        u = new URL(trimmed);
+    }
+    catch {
+        return false;
+    }
+    if (u.protocol !== 'http:' && u.protocol !== 'https:')
+        return false;
+    const host = u.hostname.toLowerCase().replace(/^\[/, '').replace(/\]$/, '');
+    if (isBlockedHost(host))
+        return false;
+    return true;
+}
+/** True when a literal host string is a loopback / private / link-local address. */
+function isBlockedHost(host) {
+    if (!host)
+        return true;
+    if (host === 'localhost' || host.endsWith('.localhost'))
+        return true;
+    // IPv6 loopback + IPv4-mapped/embedded forms.
+    if (host === '::1' || host === '::' || host === '0:0:0:0:0:0:0:1')
+        return true;
+    // IPv6 unique-local (fc00::/7) and link-local (fe80::/10).
+    if (/^f[cd][0-9a-f]{2}:/i.test(host))
+        return true;
+    if (/^fe[89ab][0-9a-f]:/i.test(host))
+        return true;
+    // IPv4-mapped IPv6 (::ffff:a.b.c.d) — fall through to the IPv4 check on the tail.
+    // The WHATWG URL parser also normalises the dotted tail into hex
+    // (`::ffff:7f00:1`), so decode that hextet form back to dotted quads too.
+    const mappedDotted = host.match(/^::ffff:(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})$/i);
+    const mappedHex = host.match(/^::ffff:([0-9a-f]{1,4}):([0-9a-f]{1,4})$/i);
+    let ipv4 = host;
+    if (mappedDotted) {
+        ipv4 = mappedDotted[1];
+    }
+    else if (mappedHex) {
+        const hi = parseInt(mappedHex[1], 16);
+        const lo = parseInt(mappedHex[2], 16);
+        ipv4 = `${(hi >> 8) & 0xff}.${hi & 0xff}.${(lo >> 8) & 0xff}.${lo & 0xff}`;
+    }
+    const m = ipv4.match(/^(\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})$/);
+    if (m) {
+        const [a, b] = [Number(m[1]), Number(m[2])];
+        if (a === 127)
+            return true; // 127.0.0.0/8 loopback
+        if (a === 10)
+            return true; // 10.0.0.0/8
+        if (a === 169 && b === 254)
+            return true; // 169.254.0.0/16 link-local
+        if (a === 172 && b >= 16 && b <= 31)
+            return true; // 172.16.0.0/12
+        if (a === 192 && b === 168)
+            return true; // 192.168.0.0/16
+        if (a === 0)
+            return true; // 0.0.0.0/8 "this host"
+    }
+    return false;
+}
+/**
+ * Normalize a user-supplied address into a safe, navigable URL. A bare host
+ * (`example.com`) is upgraded to `https://`. The result is then validated by
+ * `isNavigableUrl`; anything that fails the SSRF/scheme guard collapses to
+ * `about:blank` so a blocked navigation never reaches Chromium.
+ */
 function normalizeUrl(raw) {
-    const trimmed = raw.trim();
+    const trimmed = (raw ?? '').trim();
     if (!trimmed)
         return 'about:blank';
-    if (/^[a-z][a-z0-9+.-]*:\/\//i.test(trimmed) || trimmed.startsWith('about:'))
-        return trimmed;
-    return `https://${trimmed}`;
+    let candidate;
+    if (/^[a-z][a-z0-9+.-]*:\/\//i.test(trimmed) || trimmed.startsWith('about:')) {
+        candidate = trimmed;
+    }
+    else {
+        candidate = `https://${trimmed}`;
+    }
+    return isNavigableUrl(candidate) ? candidate : 'about:blank';
 }
 class PlaywrightPageHandle {
     page;
@@ -863,6 +957,19 @@ class PlaywrightContextHandle {
         catch { /* ignore */ }
     }
 }
+/**
+ * Chromium launch args. The renderer SANDBOX is kept ENABLED on macOS/Windows
+ * (it works there and is the primary mitigation for navigating untrusted pages —
+ * BUG-BROWSER-04). `--no-sandbox` is only added on Linux, where the namespace
+ * sandbox frequently fails to initialise inside a packaged/headless app and would
+ * otherwise refuse to launch. We never disable the sandbox where it functions.
+ */
+function chromiumLaunchArgs() {
+    const args = ['--disable-dev-shm-usage', '--disable-gpu'];
+    if (process.platform === 'linux')
+        args.unshift('--no-sandbox');
+    return args;
+}
 /**
  * Build the real Playwright-backed launcher. Lazy-imports playwright so the
  * dependency is only loaded when the feature is actually used.
@@ -881,7 +988,7 @@ function createPlaywrightLauncher() {
             headless: true,
             executablePath,
             viewport: opts.viewport,
-            args: ['--no-sandbox', '--disable-dev-shm-usage', '--disable-gpu'],
+            args: chromiumLaunchArgs(),
         });
         return new PlaywrightContextHandle(context);
     };

package/server/dist/chat-manager.js

@@ -65,6 +65,11 @@ class ChatManager {
     /** Persistent-stdin Explore transport (big bet #3, flag-gated default OFF).
      *  Holds long-lived claude children that survive between turns. */
     _stdinSessions = new explore_stdin_session_1.ExploreStdinSessions();
+    /** Fire-and-forget auxiliary CLI children (e.g. `_autoTitle`) that are NOT
+     *  keyed by conversation in `_activeProcesses`. Tracked so `shutdown()` can
+     *  tree-kill any in-flight one instead of orphaning it (BUG-CHAT-02). Each
+     *  entry self-removes on its own `'close'`. */
+    _auxProcesses = new Set();
     _cwd;
     _projectName;
     _adapter;
@@ -1243,6 +1248,18 @@ class ChatManager {
         }
         // Persistent-stdin children outlive individual turns — tear them down too.
         this._stdinSessions.killAll();
+        // Fire-and-forget auxiliary children (auto-title) are not keyed by
+        // conversation; tree-kill any in-flight one so it isn't orphaned on
+        // shutdown / project removal (BUG-CHAT-02).
+        for (const child of this._auxProcesses) {
+            if (child?.pid) {
+                try {
+                    (0, tree_kill_1.default)(child.pid, 'SIGTERM');
+                }
+                catch { /* best-effort */ }
+            }
+        }
+        this._auxProcesses.clear();
         for (const id of this._exploreLifecycle.keys()) {
             this._clearIdleTimer(id);
         }
@@ -1273,6 +1290,9 @@ class ChatManager {
                 stdio: ['ignore', 'pipe', 'pipe'],
                 cwd: this._cwd,
             });
+            // Track this fire-and-forget child so shutdown() can tree-kill it
+            // instead of orphaning it (BUG-CHAT-02). Self-removed on 'close'.
+            this._auxProcesses.add(child);
             let titleText = '';
             const reader = (0, readline_1.createInterface)({ input: child.stdout, crlfDelay: Infinity });
             reader.on('line', (line) => {
@@ -1286,6 +1306,7 @@ class ChatManager {
                 }
             });
             child.on('close', (code) => {
+                this._auxProcesses.delete(child);
                 if (code === 0 && titleText) {
                     (0, db_1.updateConversation)(this._db, conversationId, { title: titleText });
                     this._broadcast({

package/server/dist/code-explorer-router.js

@@ -276,11 +276,19 @@ function listAllEntries(projectPath) {
 function listTouchedEntries(projectPath, rowsByPath) {
     const seen = new Set();
     const out = [];
+    // Drop gitignored files too — mirroring listAllEntries — so a gitignored
+    // AI-touched file (e.g. config.local.json, a custom build dir) whose name is
+    // not deny-listed never surfaces its path / ticket-attribution / mtime. One
+    // batched git check-ignore over the not-already-denied touched files.
+    const candidateFiles = [...rowsByPath.keys()].filter((p) => !isDeniedRelPath(p));
+    const ignored = gitIgnoredSet(projectPath, candidateFiles);
     for (const filePath of rowsByPath.keys()) {
         // Keep touched-by-ai consistent with the `all` tree (and never surface
         // secrets like .env that an AI job happened to touch).
         if (isDeniedRelPath(filePath))
             continue;
+        if (ignored.has(filePath))
+            continue;
         const parts = filePath.split('/').filter(Boolean);
         for (let i = 1; i < parts.length; i += 1) {
             const dirRel = parts.slice(0, i).join('/');
@@ -796,7 +804,20 @@ function createCodeExplorerRouter(deps) {
             res.status(400).json({ error: 'path traversal not allowed' });
             return;
         }
-        const diff = (0, file_provenance_1.getProvenanceDiff)(deps.db, deps.projectId, jobId, normalizeRel(relPath));
+        // Mirror every sibling content endpoint (/file, /summary, /provenance):
+        // a stored patch for an added file contains the FULL file contents, so a
+        // denied/gitignored secret (.env, *.pem, id_rsa, gitignored creds) that an
+        // AI job happened to touch must never be served verbatim through /diff.
+        if (isDeniedRelPath(relPath)) {
+            res.status(403).json({ error: 'path is excluded by the code-explorer deny-list' });
+            return;
+        }
+        const rel = normalizeRel(relPath);
+        if (isGitIgnored(deps.projectPath, rel)) {
+            res.status(403).json({ error: 'path is gitignored' });
+            return;
+        }
+        const diff = (0, file_provenance_1.getProvenanceDiff)(deps.db, deps.projectId, jobId, rel);
         if (!diff) {
             res.status(404).json({ error: 'diff not available' });
             return;

package/server/dist/contract-refine-runner.js

@@ -10,6 +10,9 @@
  *
  * See openspec/changes/explore-spec-contract-refine.
  */
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.prepareContractRefineSpawn = prepareContractRefineSpawn;
 exports.readRefineChildOutput = readRefineChildOutput;
@@ -18,6 +21,7 @@ exports.runContractRefine = runContractRefine;
 exports.runContractRefineForQuick = runContractRefineForQuick;
 const node_crypto_1 = require("node:crypto");
 const node_readline_1 = require("node:readline");
+const tree_kill_1 = __importDefault(require("tree-kill"));
 const cli_prompt_1 = require("./util/cli-prompt");
 const spawn_lifecycle_1 = require("./spawn-lifecycle");
 const registry_1 = require("./providers/registry");
@@ -39,6 +43,24 @@ function resolveContractTicketsPath(projectPath) {
     const exec = (0, workspace_resolution_1.resolveProjectExecution)({ path: projectPath });
     return exec.relocated ? exec.ticketsPath : (0, ticket_store_1.resolveTicketStoragePath)(projectPath);
 }
+/**
+ * BUG-PARSER-04: a result event can carry `is_error: true` (with an exit code
+ * of 0) when the turn was truncated — most commonly `subtype: 'error_max_turns'`
+ * where the model never got to emit the contract block. Previously this fell
+ * through to the parser and surfaced as `malformed` (a misleading reason that
+ * implies the model produced bad output, when really the run was cut short).
+ * Detect the truncation/error markers and short-circuit to `model_error`.
+ */
+function isResultErrorEvent(resultEvent) {
+    if (!resultEvent)
+        return false;
+    if (resultEvent.is_error === true)
+        return true;
+    const subtype = typeof resultEvent.subtype === 'string' ? resultEvent.subtype : '';
+    // `error_max_turns` is the canonical truncation subtype; treat any
+    // `error_*` subtype as a model-side error rather than malformed output.
+    return subtype === 'error_max_turns' || subtype.startsWith('error_');
+}
 function normalizeClaudeCodeModel(model) {
     if (!model || typeof model !== 'string')
         return 'sonnet';
@@ -96,12 +118,32 @@ function prepareContractRefineSpawn(deps, conversation) {
     const args = buildRefineArgs(conversation.model ?? 'sonnet', systemPrompt, conversation.session_id ?? '');
     return { args, cwd, systemPrompt, env };
 }
+/** Grace before SIGKILL-escalating a child that swallowed SIGTERM. */
+const REFINE_SIGKILL_GRACE_MS = 2_000;
+function escalateKill(pid, kill) {
+    if (typeof pid !== 'number')
+        return null;
+    try {
+        kill(pid, 'SIGTERM', () => { });
+    }
+    catch { /* already gone */ }
+    const escalation = setTimeout(() => {
+        try {
+            kill(pid, 'SIGKILL', () => { });
+        }
+        catch { /* already gone */ }
+    }, REFINE_SIGKILL_GRACE_MS);
+    // Don't let the escalation timer keep the event loop alive.
+    if (typeof escalation.unref === 'function')
+        escalation.unref();
+    return escalation;
+}
 /**
  * Test-friendly inner runner: takes a child-like object and returns the parsed
  * outcome (text + result event + close code). Does NOT touch the DB or the
  * file system — the caller wires those.
  */
-function readRefineChildOutput(child, timeoutMs) {
+function readRefineChildOutput(child, timeoutMs, kill = tree_kill_1.default) {
     return new Promise((resolve) => {
         let fullText = '';
         let resultEvent = null;
@@ -120,6 +162,7 @@ function readRefineChildOutput(child, timeoutMs) {
                     stderrBuf = stderrBuf.slice(-8192);
             });
         }
+        let killEscalation = null;
         const reader = (0, node_readline_1.createInterface)({ input: child.stdout, crlfDelay: Infinity });
         reader.on('line', (line) => {
             let parsed = null;
@@ -146,10 +189,9 @@ function readRefineChildOutput(child, timeoutMs) {
         });
         const timer = setTimeout(() => {
             timedOut = true;
-            try {
-                child.kill('SIGTERM');
-            }
-            catch { /* best effort */ }
+            // BUG-PARSER-01: treeKill the whole subtree (SIGTERM) and SIGKILL-escalate
+            // after a grace window so a signal-swallowing CLI tree is force-killed.
+            killEscalation = escalateKill(child.pid, kill);
             if (!settled) {
                 settled = true;
                 resolve({ fullText, resultEvent, code: null, timedOut: true });
@@ -157,6 +199,12 @@ function readRefineChildOutput(child, timeoutMs) {
         }, timeoutMs);
         child.on('close', (code) => {
             clearTimeout(timer);
+            // The child exited (possibly because SIGTERM was honoured) — cancel the
+            // pending SIGKILL escalation.
+            if (killEscalation) {
+                clearTimeout(killEscalation);
+                killEscalation = null;
+            }
             if (settled)
                 return;
             settled = true;
@@ -167,6 +215,10 @@ function readRefineChildOutput(child, timeoutMs) {
         });
         child.on('error', (err) => {
             clearTimeout(timer);
+            if (killEscalation) {
+                clearTimeout(killEscalation);
+                killEscalation = null;
+            }
             console.log(`[contract-refine-runner] child error: ${err.message}; stderr=${JSON.stringify(stderrBuf.slice(-2000))}`);
             if (settled)
                 return;
@@ -344,6 +396,21 @@ async function runContractRefine(deps, conversationId, ticketId) {
         });
         return { ok: false, reason: result.resultEvent ? 'model_error' : 'crashed', ticketId, conversationId };
     }
+    // BUG-PARSER-04: exit-0 but the result event flags an error / max-turns
+    // truncation — classify as model_error, not malformed.
+    if (isResultErrorEvent(result.resultEvent)) {
+        const r = result.resultEvent;
+        console.log(`[contract-refine-runner] result error event subtype=${r.subtype ?? '-'} is_error=${r.is_error ?? '-'}`);
+        recordSafely(deps, conversationId, ticketId, conversation.model, startedAt, finishedAt, 'failed', result.resultEvent);
+        deps.broadcast({
+            type: 'explore.contract_refine_failed',
+            projectId: deps.projectId,
+            ticketId,
+            reason: 'model_error',
+            timestamp: finishedAt,
+        });
+        return { ok: false, reason: 'model_error', ticketId, conversationId };
+    }
     const parse = (0, explore_contract_refine_1.parseContractLayerBlock)(result.fullText);
     console.log(`[contract-refine-runner] parse ok=${parse.ok} reason=${!parse.ok ? parse.reason : '-'} firstChars=${JSON.stringify(result.fullText.slice(0, 200))}`);
     if (!parse.ok) {
@@ -487,6 +554,21 @@ async function runContractRefineForQuick(deps, ticketId, generatedTitle, generat
         });
         return { ok: false, reason: result.resultEvent ? 'model_error' : 'crashed', ticketId, conversationId: '' };
     }
+    // BUG-PARSER-04: exit-0 but the result event flags an error / max-turns
+    // truncation — classify as model_error, not malformed.
+    if (isResultErrorEvent(result.resultEvent)) {
+        const r = result.resultEvent;
+        console.log(`[contract-refine-runner] quick result error event subtype=${r.subtype ?? '-'} is_error=${r.is_error ?? '-'}`);
+        recordSafelyQuick(deps, ticketId, model, startedAt, finishedAt, 'failed', result.resultEvent);
+        deps.broadcast({
+            type: 'explore.contract_refine_failed',
+            projectId: deps.projectId,
+            ticketId,
+            reason: 'model_error',
+            timestamp: finishedAt,
+        });
+        return { ok: false, reason: 'model_error', ticketId, conversationId: '' };
+    }
     const parse = (0, explore_contract_refine_1.parseContractLayerBlock)(result.fullText);
     if (!parse.ok) {
         const reason = parse.reason === 'parser-error' ? 'parser_error' : 'malformed';

package/server/dist/desktop-db.js

@@ -74,12 +74,20 @@ function migrateLegacyDbFile(dbPath) {
     const legacyPath = path_1.default.join(path_1.default.dirname(dbPath), 'hub.sqlite'); // legacy (pre-rebrand) filename
     try {
         if (fs_1.default.existsSync(legacyPath) && !fs_1.default.existsSync(dbPath)) {
-            fs_1.default.renameSync(legacyPath, dbPath);
+            // BUG-SQLITE-05: rename the -wal/-shm sidecars BEFORE the main DB file.
+            // SQLite matches a WAL to its database by base filename; if the main file
+            // is renamed first, a crash in the (sub-ms) window between renames leaves
+            // `desktop.sqlite` with no adjacent WAL -> un-checkpointed commits in the
+            // orphaned `hub.sqlite-wal` are silently discarded on next open. Moving the
+            // sidecars first means an interrupted migration leaves the WAL/SHM still
+            // matched to the legacy main file (the new file does not exist yet, so the
+            // guard above re-runs the whole migration on the next launch).
             for (const suffix of ['-wal', '-shm']) {
                 if (fs_1.default.existsSync(legacyPath + suffix)) {
                     fs_1.default.renameSync(legacyPath + suffix, dbPath + suffix);
                 }
             }
+            fs_1.default.renameSync(legacyPath, dbPath);
         }
     }
     catch (err) {

package/server/dist/desktop-router.js

@@ -9,6 +9,7 @@ const crypto_1 = require("crypto");
 const path_1 = __importDefault(require("path"));
 const fs_1 = __importDefault(require("fs"));
 const net_1 = __importDefault(require("net"));
+const dns_1 = __importDefault(require("dns"));
 const desktop_db_1 = require("./desktop-db");
 const webhook_manager_1 = require("./webhook-manager");
 const core_update_manager_1 = require("./core-update-manager");
@@ -129,14 +130,74 @@ function isPrivateIpv4(addr) {
         (a === 192 && b === 168) ||
         (a === 100 && b >= 64 && b <= 127); // 100.64.0.0/10 CGNAT
 }
+// BUG-WEBHOOK-01: alternate IPv4 encodings (decimal `2130706433`, octal
+// `0177.0.0.1`, hex `0x7f.0.0.1` or a single `0x7f000001`) all resolve to the
+// same address as `127.0.0.1` but evade the dotted-quad-only `isPrivateIpv4`.
+// Canonicalize any whole-number / non-dotted-decimal form to a dotted quad so
+// the private-range check sees the real address. Returns null when the input is
+// not an unambiguous IPv4 literal (e.g. a real DNS name) so callers fall back to
+// DNS resolution.
+function canonicalizeIpv4Literal(host) {
+    const u32ToDotted = (n) => `${(n >>> 24) & 0xff}.${(n >>> 16) & 0xff}.${(n >>> 8) & 0xff}.${n & 0xff}`;
+    // Single integer form (decimal / 0x-hex / 0-octal): https://2130706433/
+    if (/^(0x[0-9a-f]+|0[0-7]*|[1-9][0-9]*)$/.test(host)) {
+        let n;
+        if (host.startsWith('0x'))
+            n = Number.parseInt(host.slice(2), 16);
+        else if (host.startsWith('0') && host !== '0')
+            n = Number.parseInt(host, 8);
+        else
+            n = Number.parseInt(host, 10);
+        if (!Number.isFinite(n) || n < 0 || n > 0xffffffff)
+            return null;
+        return u32ToDotted(n >>> 0);
+    }
+    // Dotted form where one or more octets are octal/hex: 0177.0.0.1 / 0x7f.0.0.1
+    if (/^[0-9a-fx.]+$/.test(host) && host.includes('.')) {
+        const segs = host.split('.');
+        if (segs.length !== 4)
+            return null;
+        const nums = [];
+        for (const seg of segs) {
+            if (seg === '')
+                return null;
+            let v;
+            if (/^0x[0-9a-f]+$/.test(seg))
+                v = Number.parseInt(seg.slice(2), 16);
+            else if (/^0[0-7]+$/.test(seg))
+                v = Number.parseInt(seg, 8);
+            else if (/^[0-9]+$/.test(seg))
+                v = Number.parseInt(seg, 10);
+            else
+                return null;
+            if (!Number.isFinite(v) || v < 0 || v > 255)
+                return null;
+            nums.push(v);
+        }
+        return nums.join('.');
+    }
+    return null;
+}
 function isPrivateIp(hostname) {
     // Strip IPv6 brackets that URL.hostname can include (else net.isIP returns 0
     // and an IPv6 literal would slip through as "not an IP").
     let host = hostname.toLowerCase().replace(/^\[|\]$/g, '');
-    // IPv4-mapped IPv6 (`::ffff:169.254.169.254`) → check the embedded v4.
-    const mapped = /^::ffff:(\d+\.\d+\.\d+\.\d+)$/.exec(host);
-    if (mapped)
-        return isPrivateIpv4(mapped[1]);
+    // IPv4-mapped IPv6 — both the dotted-decimal embedding (`::ffff:127.0.0.1`)
+    // and the hex embedding (`::ffff:7f00:1`) must be unwrapped to their v4 form.
+    const mappedDotted = /^::ffff:(\d+\.\d+\.\d+\.\d+)$/.exec(host);
+    if (mappedDotted)
+        return isPrivateIpv4(mappedDotted[1]);
+    const mappedHex = /^::ffff:([0-9a-f]{1,4}):([0-9a-f]{1,4})$/.exec(host);
+    if (mappedHex) {
+        const hi = Number.parseInt(mappedHex[1], 16);
+        const lo = Number.parseInt(mappedHex[2], 16);
+        const v4 = `${(hi >> 8) & 0xff}.${hi & 0xff}.${(lo >> 8) & 0xff}.${lo & 0xff}`;
+        return isPrivateIpv4(v4);
+    }
+    // Alternate IPv4 encodings (decimal / octal / hex) → canonicalize then check.
+    const canon = canonicalizeIpv4Literal(host);
+    if (canon)
+        return isPrivateIpv4(canon);
     const ipVersion = net_1.default.isIP(host);
     if (ipVersion === 0)
         return false;
@@ -146,6 +207,26 @@ function isPrivateIp(hostname) {
     }
     return isPrivateIpv4(host);
 }
+// BUG-WEBHOOK-01 (DNS-rebinding SSRF): `isPrivateIp` only inspects IP literals,
+// so a public DNS name that resolves to a loopback/private/link-local address
+// slips through. Resolve ALL addresses for the host and reject if ANY of them
+// is private. Returns true ⇒ the host is safe to target; false ⇒ blocked.
+// Tolerant of resolution failure: an unresolvable host can't be a confirmed
+// SSRF target, so it is allowed through (delivery will simply fail).
+async function resolvesToPublicOnly(hostname) {
+    const host = hostname.replace(/^\[|\]$/g, '');
+    // Literal IPs are already handled synchronously by isPrivateIp; skip lookup.
+    if (net_1.default.isIP(host) !== 0 || canonicalizeIpv4Literal(host.toLowerCase()))
+        return true;
+    let addrs;
+    try {
+        addrs = await dns_1.default.promises.lookup(host, { all: true, verbatim: true });
+    }
+    catch {
+        return true;
+    }
+    return !addrs.some((a) => isPrivateIp(a.address));
+}
 function validateHttpUrl(raw, opts) {
     let parsed;
     try {
@@ -607,8 +688,24 @@ function createDesktopRouter(registry, broadcast) {
     router.get('/webhooks', (_req, res) => {
         res.json({ webhooks: (0, desktop_db_1.listWebhooks)(registry.desktopDb).map(publicWebhook) });
     });
+    // BUG-WEBHOOK-01: webhook destinations must not resolve to internal hosts.
+    // `validateHttpUrl` blocks IP literals; this adds the DNS-resolution gate so a
+    // public hostname that resolves to a loopback/private/link-local address is
+    // rejected too. Skipped when loopback is explicitly allowed (dev opt-in).
+    async function webhookHostAllowed(normalizedUrl) {
+        if (process.env.SPECRAILS_ALLOW_LOCAL_WEBHOOKS === '1')
+            return true;
+        let hostname;
+        try {
+            hostname = new URL(normalizedUrl).hostname;
+        }
+        catch {
+            return false;
+        }
+        return resolvesToPublicOnly(hostname);
+    }
     // POST /api/webhooks — create a webhook
-    router.post('/webhooks', (req, res) => {
+    router.post('/webhooks', async (req, res) => {
         const { url, secret, events, projectId } = req.body ?? {};
         if (!url || typeof url !== 'string') {
             res.status(400).json({ error: 'url is required' });
@@ -637,6 +734,10 @@ function createDesktopRouter(registry, broadcast) {
             res.status(400).json({ error: 'webhook url must be https and must not target localhost/private IPs' });
             return;
         }
+        if (!(await webhookHostAllowed(normalizedUrl))) {
+            res.status(400).json({ error: 'webhook url must be https and must not target localhost/private IPs' });
+            return;
+        }
         const webhook = (0, desktop_db_1.addWebhook)(registry.desktopDb, {
             id: (0, crypto_1.randomUUID)(),
             projectId: projectId ?? null,
@@ -647,7 +748,7 @@ function createDesktopRouter(registry, broadcast) {
         res.status(201).json({ webhook: publicWebhook(webhook) });
     });
     // PATCH /api/webhooks/:id — update a webhook
-    router.patch('/webhooks/:id', (req, res) => {
+    router.patch('/webhooks/:id', async (req, res) => {
         const existing = (0, desktop_db_1.getWebhook)(registry.desktopDb, req.params.id);
         if (!existing) {
             res.status(404).json({ error: 'Webhook not found' });
@@ -668,6 +769,10 @@ function createDesktopRouter(registry, broadcast) {
                 res.status(400).json({ error: 'webhook url must be https and must not target localhost/private IPs' });
                 return;
             }
+            if (!(await webhookHostAllowed(candidate))) {
+                res.status(400).json({ error: 'webhook url must be https and must not target localhost/private IPs' });
+                return;
+            }
             normalizedUrl = candidate;
         }
         const updated = (0, desktop_db_1.updateWebhook)(registry.desktopDb, req.params.id, {