🌐 Web query:

Does effect's FetchHttpClient or undici support pinning a resolved IP address (custom DNS lookup) per request to prevent DNS rebinding?

💡 Result:

Yes, it is possible to pin a resolved IP address in undici to prevent DNS rebinding [1][2][3]. While Effect's FetchHttpClient layer is designed for environments like Bun, browsers, or the global Node.js fetch [4], the underlying undici library (used by Node.js or when using NodeHttpClient) provides the necessary control via its Agent configuration [5][6]. To pin an IP address and close the DNS-rebinding time-of-check to time-of-use (TOCTOU) gap, you must provide a custom lookup function within the connect options of an undici Agent [1][7][3]. This hook allows you to perform your own DNS resolution (or use dns.lookup), validate the IP address (e.g., against a blocklist of private/internal ranges), and then return that validated IP so the socket connects directly to it, bypassing any further resolution [1][8]. Example implementation: import { Agent } from 'undici'; import dns from 'node:dns'; // Create a custom Agent with a pinned DNS lookup const safeAgent = new Agent({ connect: { lookup: (hostname, options, callback) => { // 1. Perform custom resolution dns.lookup(hostname, options, (err, address, family) => { if (err) return callback(err, address, family); // 2. Validate address (e.g., check for private IP ranges) if (isUnsafe(address)) { return callback(new Error('SSRF blocked'), address, family); } // 3. Return the validated, pinned address callback(null, address, family); }); }, }, }); // Use the agent for your request // const client = new Client(origin, { dispatcher: safeAgent }); // or // await fetch(url, { dispatcher: safeAgent }); Note that if you are using Effect, you should ensure you are utilizing the undici-compatible HTTP client (e.g., NodeHttpClient.layerUndici) rather than the generic FetchHttpClient layer, as the latter might rely on the global fetch environment where dispatcher injection may be restricted or have different compatibility characteristics [9][4][3]. Using undici directly allows you to control the socket-level connection details required for robust SSRF defense [1][7].

Citations:

• 1: https://uniauth.id/blog/dns-rebinding-safe-http-client
• 2: https://github.com/jeswr/guarded-fetch
• 3: 1111philo/plato@19929a1
• 4: https://gist.github.com/schickling/86e507a891932996066114db9e84e21b
• 5: https://github.com/nodejs/undici/blob/main/docs/docs/api/Client.md
• 6: Feature request: allow a custom dns lookup function to be supplied nodejs/undici#421
• 7: harden fetch_url against DNS rebinding (TOCTOU) yoloyash/overtchat#1
• 8: driftstackdev/driftstack-api@b1dd945
• 9: FetchHttpClient: OTLP protobuf exporter fails with "invalid content-length header" against undici 8 Effect-TS/effect-smol#2186

🏁 Script executed:

#!/bin/bash
set -euo pipefail

# Inspect the target file and nearby redirect/URL validation logic.
sed -n '1,320p' packages/opencode/src/tool/webfetch.ts

# Find the HTTP client implementation and any undici/custom-dispatcher usage.
rg -n "FetchHttpClient|NodeHttpClient|undici|dispatcher|lookup|assertPublicUrl|redirect" packages/opencode/src -S

Repository: CreatorGhost/TheCode

Length of output: 24147

🏁 Script executed:

#!/bin/bash
set -euo pipefail

# Map the relevant module shapes before reading specific slices.
ast-grep outline packages/opencode/src/tool/webfetch.ts --view expanded || true
ast-grep outline packages/opencode/src -g '*.ts' --view expanded | head -n 200 || true

Repository: CreatorGhost/TheCode

Length of output: 1171

🏁 Script executed:

#!/bin/bash
set -euo pipefail

# Probe whether a concrete dispatcher/lookup hook is available in the codebase.
rg -n "new Agent|lookup:|custom.*lookup|setGlobalDispatcher|Agent\(" packages/opencode/src -S

Repository: CreatorGhost/TheCode

Length of output: 1874

🏁 Script executed:

#!/bin/bash
set -euo pipefail

# Check whether the package uses Effect's FetchHttpClient or NodeHttpClient elsewhere.
rg -n "FetchHttpClient|NodeHttpClient|layerUndici|HttpClient" packages/opencode/src packages/opencode -g '*.ts' -S

Repository: CreatorGhost/TheCode

Length of output: 50376

🏁 Script executed:

#!/bin/bash
set -euo pipefail

# Read package dependency info if available to infer runtime/fetch backend.
cat package.json 2>/dev/null || true
find packages/opencode -maxdepth 2 -name package.json -print -exec sed -n '1,220p' {} \;

Repository: CreatorGhost/TheCode

Length of output: 11129

🌐 Web query:

Effect unstable/http FetchHttpClient.RequestInit dispatcher custom lookup undici pin IP

💡 Result:

To pin an IP address or use a custom DNS lookup in Node.js using Undici, you must provide a custom lookup function within the connect options of a dispatcher (such as Client, Pool, or Agent) [1][2]. The standard approach involves creating an instance of a dispatcher with a connect configuration that overrides the default DNS lookup behavior [2]. Example using Undici Client: import { Client } from 'undici'; import dns from 'node:dns'; const client = new Client('https://example.com', { connect: { lookup: (hostname, options, callback) => { // Pin to a specific IP address callback(null, [{ address: '1.2.3.4', family: 4 }]); } } }); In the context of the Effect framework (e.g., @effect/platform/FetchHttpClient), you can provide a custom dispatcher by configuring the underlying HTTP client [3]. Because FetchHttpClient relies on Undici for its implementation, you can instantiate an Agent or Client with the custom connect options shown above and pass it to your fetch requests or provide it via the Effect layer [1][3]. Note that the dispatcher option in fetch or RequestInit is used to override the default global dispatcher [4]. Ensure that when you use a custom dispatcher, it is configured correctly to handle the requirements of your specific application [5]. The lookup function signature follows the standard Node.js dns.lookup callback pattern [6][7].

Citations:

• 1: Feature request: allow a custom dns lookup function to be supplied nodejs/undici#421
• 2: https://github.com/nodejs/undici/blob/main/docs/docs/api/Client.md
• 3: https://foldkit.dev/core/commands
• 4: override request dispatcher from init nodejs/undici#2928
• 5: https://github.com/nodejs/undici/blob/main/docs/docs/api/Agent.md
• 6: https://undici.nodejs.org/api/Dispatcher
• 7: https://undici-docs.vramana.dev/docs/next/api/Dispatcher

🌐 Web query:

Bun fetch dispatcher lookup undici custom Agent DNS rebinding

💡 Result:

In Bun, using a custom Undici Agent to control DNS resolution—a common technique to prevent DNS rebinding—has historically faced compatibility issues because Bun's native fetch did not always fully respect custom dispatchers or their connect functions [1][2]. However, as of August 2025, Bun has implemented support for custom connect functions within the dispatcher option for fetch [3]. This improvement ensures that when you provide an Undici Agent (configured with a custom connect lookup) to the fetch dispatcher option, Bun correctly utilizes that logic to resolve hostnames [3]. To implement a DNS-rebinding-safe client in Bun, you can follow this pattern: 1. Perform your own DNS lookup for the target hostname [4]. 2. Validate the resolved IP address against your security policy (e.g., ensuring it is not a private or loopback address) [4]. 3. Create an Undici Agent with a custom connect.lookup function that returns your pre-validated IP address [4]. 4. Pass this Agent as the dispatcher option to your fetch request [4]. Example implementation: import { Agent } from "undici"; import dns from "dns/promises"; // 1. Resolve and validate IP manually const { address } = await dns.lookup("example.com"); // 2. Define custom dispatcher const dispatcher = new Agent({ connect: { lookup: (_hostname, _options, cb) => { // Force the agent to use the validated IP cb(null, address, 4); }, }, }); // 3. Use in fetch const response = await fetch("https://example.com", { dispatcher }); While Bun continues to improve its Undici compatibility to support libraries like fetch-socks or custom agents [5][2], always verify your specific Bun version if you encounter unexpected behavior, as some features were implemented recently as part of maintaining ecosystem compatibility [3][5].

Citations:

• 1: Bun's built-in fetch does not honor custom HTTPS agent with localAddress option oven-sh/bun#18157
• 2: undici.Agent's connect option goes unused, making fetch-socks not work oven-sh/bun#21492
• 3: fix: Implement custom connect function support in fetch and fix 21492 oven-sh/bun#21533
• 4: https://uniauth.id/blog/dns-rebinding-safe-http-client
• 5: feat(undici): implement Pool, Client, Agent, and stream() oven-sh/bun#27338

🌐 Web query:

"effect/unstable/http" "FetchHttpClient.RequestInit" RequestInit service dispatcher

💡 Result:

In Effect, FetchHttpClient is an implementation of the HttpClient service provided by the @effect/platform package [1][2]. The RequestInit configuration for FetchHttpClient allows you to customize the underlying Fetch API request settings [3][1]. To customize the FetchHttpClient, you provide a configuration object using the FetchHttpClient.RequestInit tag [1][2]. This is typically done by creating a Layer that provides this configuration to the runtime [1][2]. Example usage: import { FetchHttpClient, HttpClient } from "@effect/platform" import { Effect, Layer } from "effect" const CustomFetchLive = FetchHttpClient.layer.pipe( Layer.provide( Layer.succeed(FetchHttpClient.RequestInit, { credentials: "include", cache: "force-cache" // Example of customizing cache behavior [4] }))) const program = Effect.gen(function* { const client = yield* HttpClient.HttpClient const response = yield* client.get("https://jsonplaceholder.typicode.com/posts/1") const json = yield* response.json console.log(json) }).pipe( Effect.scoped, Effect.provide(CustomFetchLive)) Regarding a "service dispatcher," the HttpClient service in Effect functions as an abstraction over HTTP operations [5]. It does not typically use a "dispatcher" by that specific name in its public API; rather, it uses the Effect environment (Context) to provide the implementation (e.g., FetchHttpClient) and uses standard Effect piping and layering for dependency injection [1][2][5]. The HttpClient interface provides methods like get, post, put, and del, which are executed using the provided client implementation [5][6]. If you require custom dispatching or middleware logic, you can use HttpClient.mapRequest, HttpClient.mapRequestEffect, or create custom Layers that wrap or augment the base HttpClient implementation [5][6][7].

Citations:

• 1: https://npmx.dev/package/@effect/platform/v/%5E0.69.2
• 2: https://npmx.dev/package/@effect/platform/v/%5E0.68.0
• 3: https://github.com/Effect-TS/effect/blob/main/packages/platform/README.md
• 4: FetchHttpClient is preventing NextJS from caching responses Effect-TS/effect#4922
• 5: https://effect-ts.github.io/effect/platform/HttpClient.ts.html
• 6: https://github.com/Effect-TS/effect/blob/70ce155c/packages/platform/src/HttpClient.ts
• 7: https://github.com/Effect-TS/effect/blob/4708bb8e/packages/platform/src/HttpClient.ts

🌐 Web query:

site:effect.website FetchHttpClient RequestInit dispatcher undici

💡 Result:

In the context of the Effect ecosystem, particularly within @effect/platform-node, the undici library is utilized as a backend for HTTP requests [1]. When using FetchHttpClient, which serves as an implementation of the HttpClient interface, the underlying communication is handled by undici [1][2]. Regarding the use of dispatcher with FetchHttpClient and RequestInit: 1. Undici Dispatcher: The undici library uses a Dispatcher to manage HTTP requests. When FetchHttpClient is employed, it is typically configured via a layer (e.g., FetchHttpClient.layer or layerUndici) [3][4]. If you need to customize the undici client (such as providing a specific dispatcher), this is generally handled at the layer creation level when configuring the HttpClient service, rather than through individual RequestInit objects [3][2]. 2. RequestInit: The standard RequestInit interface (used by the native fetch API) does not natively support an undici-specific dispatcher property. RequestInit is intended for standard fetch options like method, headers, and body [5]. 3. Implementation Detail: Because FetchHttpClient is an Effect-based abstraction, configuration that requires underlying engine details—like a custom undici.Dispatcher—is managed through Effect's dependency injection system (Layers) [3][2]. You should configure the HttpClient layer with your required undici settings (like a custom Agent or Dispatcher) when providing the layer to your application, ensuring that all requests made through the injected HttpClient utilize the desired configuration [3][2]. If you are encountering issues where a global undici dispatcher is not being picked up or needs to be explicitly defined, verify that your layer configuration in the Effect program correctly injects the HttpClient with the undici client configured to your specifications [6][4].

Citations:

• 1: https://effect.website/blog/this-week-in-effect/2024/03/29/
• 2: https://effect.website/docs/ai/tool-use/
• 3: https://effect.website/blog/releases/effect/38/
• 4: https://effect.website/blog/effect-ai/
• 5: https://effect.website/docs/batching/
• 6: https://effect.website/blog/this-week-in-effect/2024/08/09/