fix(security): P0-5 SSRF-safe webfetch — resolve-validate-pin transport, robots + streaming - #104

Merged

shoom1 merged 7 commits into

fix/p05-webfetch-ssrf

Jul 12, 2026

Commits on Jul 12, 2026

feat(webfetch): resolve-all + is_global SSRF validator core (P0-5)
shoom1
committed
3d819ac
feat(webfetch): PinnedTransport (resolve-validate-pin) (P0-5)
shoom1
committed
ddc7404
feat(webfetch): pinned transport + streamed body cap in fetcher; drop post-fetch recheck (P0-5)
shoom1
committed
02d29cf
test(webfetch): restore same-host-redirect robots coverage (Task 3 review)
shoom1
committed
ca6b3fb
feat(webfetch): fetch robots.txt through the pinned transport, capped body (P0-5)
shoom1
committed
f14926d
feat(webfetch): get_or_create_fetcher builds + shares the pinned transport (P0-5)
shoom1
committed
96ba271
fix(webfetch): shared PinnedTransport survives per-call client close; test hygiene (P0-5 review)
shoom1
committed
767bfe8