mirror of
https://github.com/nearai/ironclaw.git
synced 2026-09-02 23:56:24 +08:00
c835fe99d3
* fix(ci): make tests resilient to sandboxed/offline environments Tests failed in CI because DNS resolution is unavailable in the sandbox, the process runs as root, and an HTTP proxy intercepts outbound traffic. Core fix: add `dns_probe_available()` to `config::helpers` — a cached, 2-second-timeout probe that detects whether external DNS works. When DNS is unavailable, `validate_base_url_with_policy()` skips the IP resolution/SSRF check while still enforcing syntactic URL validation. Additional fixes: - webhook_server: bind non-local IP (192.0.2.1) instead of privileged port 1, which succeeds as root - tunnel/custom: use closed localhost port instead of TEST-NET-1 IP that the proxy intercepts - mcp/auth: use IP literal instead of hostname requiring DNS - wasm/http_security: add .no_proxy() so pinned resolution test works behind egress proxy - wasm/runtime: remove `enabled = true` from cache TOML config, which was removed as a valid field in Wasmtime 43 https://claude.ai/code/session_01PUK8B5x6dKTG3bxWeSWdaH * fix(deny): add RUSTSEC-2026-0097 ignore, remove stale wasmtime advisories The rand 0.8.5 unsoundness advisory requires the `log` feature which is not enabled on our dep. Wasmtime 43 patches the 4 previously-ignored advisories so those ignores are removed. https://claude.ai/code/session_01LR9WsjkTuMNA6xkGS4TgMt * fix(security): use time-limited DNS probe cache and resolve target hostname Replace OnceLock-based permanent DNS probe cache with a Mutex-guarded cache that expires after 5 minutes, preventing transient DNS unavailability at startup from permanently disabling SSRF validation. Additionally, try resolving the actual target hostname before falling back to the generic probe. This avoids false negatives in firewalled environments where the generic probe target (previously dns.google) may be blocked but the actual target is reachable. Addresses review feedback from serrrfirat on PR #2257. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * style: apply cargo fmt and fix clippy collapsible_if after rebase on staging https://claude.ai/code/session_01T4ysh3bVb44UustMmJcQgQ --------- Co-authored-by: Claude <noreply@anthropic.com>