J3vbandClaude Fable 5 9145f893d1 fix(plugin): restore multi-address fallback in the SSRF-guarded dialer (W2-6) ...

After validating every resolved IP, the guarded dial connected only to
ips[0] — an allowlisted dual-stack or round-robin host whose first record
was down hard-failed despite reachable vetted alternatives. The dial now
tries each vetted address in order (all records still validated before
any dial: one poisoned private record refuses the whole request).

Also removes the redundant rejectPrivateAddrs pre-resolves (initial
request + redirect hop): the guarded dial is the authoritative check and
every path flows through it, so the pre-resolve only cost an extra DNS
round trip while re-opening the rebinding TOCTOU it was meant to close.
Folds the W3-2-adjacent double-resolve cleanup from the plan.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

2026-07-19 08:58:57 +02:00

..

examples/hello

h

2026-04-07 10:13:47 +02:00

errors.go

feat: scaffold Phase B + C (events, telemetry, plugins, Solid.js)

2026-04-06 09:00:47 +00:00

host_commands.go

fix(plugin): make in-place plugin upgrades rebind commands (W2-3)

2026-07-19 08:52:31 +02:00

host_events.go

fix(ci): resolve all golangci-lint and ESLint failures on PR #1132

2026-04-07 10:10:38 +02:00

host_http_test.go

test+feat(phase-bc): pass 4 — test coverage, install endpoint, CHANGELOG

2026-04-06 10:30:18 +00:00

host_http.go

fix(plugin): restore multi-address fallback in the SSRF-guarded dialer (W2-6)

2026-07-19 08:58:57 +02:00

host_storage.go

fix(lint): delete dead ws broadcast cluster; demote phase-header comments

2026-07-18 12:55:22 +02:00

host_ui_test.go

test+feat(phase-bc): pass 4 — test coverage, install endpoint, CHANGELOG

2026-04-06 10:30:18 +00:00

host_ui.go

fix(lint): delete dead ws broadcast cluster; demote phase-header comments

2026-07-18 12:55:22 +02:00

loader_test.go

test+feat(phase-bc): pass 4 — test coverage, install endpoint, CHANGELOG

2026-04-06 10:30:18 +00:00

loader.go

fix(lint): delete dead ws broadcast cluster; demote phase-header comments

2026-07-18 12:55:22 +02:00

manifest_nottoml.go

fix(lint): delete dead ws broadcast cluster; demote phase-header comments

2026-07-18 12:55:22 +02:00

manifest_test.go

test+feat(phase-bc): pass 4 — test coverage, install endpoint, CHANGELOG

2026-04-06 10:30:18 +00:00

manifest_toml.go

feat(phase-bc): TOML plugin manifests + Solid vitest preset

2026-04-06 23:25:16 +02:00

manifest.go

chore(server): delete unfinished Postgres scaffolding

2026-07-19 08:15:58 +02:00

plugin_test.go

test(plugin): lock reinstall command rebinding + hijack refusal (W2-3)

2026-07-19 08:52:31 +02:00

registry.go

fix(plugin): make in-place plugin upgrades rebind commands (W2-3)

2026-07-19 08:52:31 +02:00

sandbox_default.go

fix(lint): delete dead ws broadcast cluster; demote phase-header comments

2026-07-18 12:55:22 +02:00

sandbox_wazero_test.go

test(plugin): lock CPU-budget overrun recovery (W1-1)

2026-07-19 08:21:55 +02:00

sandbox_wazero.go

fix(plugin): re-instantiate wazero module after CPU-budget overrun (W1-1)

2026-07-19 08:21:54 +02:00