GET /api/url-preview: OG metadata fetch with 5s timeout, 256KB cap, text/html check, TTL cache, SSRF guards enforced at dial time (loopback/private/link-local/multicast/reserved/CGNAT rejected per hop, anti DNS-rebind; AS_URL_PREVIEW_ALLOW_PRIVATE=1 for local testing only, default fail-closed; sanitized error cards, never internal addresses).
fs_read_file/fs_write_file/fs_list_dir: Hidden tools sandboxed under //; traversal/absolute/backslash/symlink-escape rejected; 1MB/2MB caps; writes register an artifact so workspace files stay panel-visible. ToolDesc.Hidden gates model visibility (runctx.Tools) and /api/tools on runtime.fsTools; registry.Execute re-checks fail-closed. ToolExecCtx gains OwnerID/WorkspaceRoot/SettingBool.
Verification
go test ./... green (fs negative matrix, SSRF negatives, endpoint fail-closed, cache). Rebased onto security-bump/cardflow main; vendored core pinned to 6bdc4f2.
## What
GET /api/url-preview: OG metadata fetch with 5s timeout, 256KB cap, text/html check, TTL cache, SSRF guards enforced at dial time (loopback/private/link-local/multicast/reserved/CGNAT rejected per hop, anti DNS-rebind; AS_URL_PREVIEW_ALLOW_PRIVATE=1 for local testing only, default fail-closed; sanitized error cards, never internal addresses).
fs_read_file/fs_write_file/fs_list_dir: Hidden tools sandboxed under <root>/<owner>/<conversationId>; traversal/absolute/backslash/symlink-escape rejected; 1MB/2MB caps; writes register an artifact so workspace files stay panel-visible. ToolDesc.Hidden gates model visibility (runctx.Tools) and /api/tools on runtime.fsTools; registry.Execute re-checks fail-closed. ToolExecCtx gains OwnerID/WorkspaceRoot/SettingBool.
## Verification
go test ./... green (fs negative matrix, SSRF negatives, endpoint fail-closed, cache). Rebased onto security-bump/cardflow main; vendored core pinned to 6bdc4f2.
Refs: task feature/file-preview-caps; core 6bdc4f2.
Why: the adjudicated preview plan needs server-side OG fetching for link
cards, and the proposal's reserved-capability items call for the fs tool
family to exist behind a default-off gate (implemented, not offered).
Evidence: GET /api/url-preview fetches and parses og:title/description/
site_name/image/favicon with a 5s timeout, 256KB body cap, text/html
content check, TTL cache, and SSRF guards enforced at dial time (loopback
/private/link-local/multicast/reserved/CGNAT rejected per hop, anti DNS-
rebind; AS_URL_PREVIEW_ALLOW_PRIVATE=1 exists for local testing only,
default fail-closed; errors return sanitized cards, never internal
addresses). fs_read_file/fs_write_file/fs_list_dir register as Hidden
tools sandboxed under <root>/<owner>/<conversationId>: traversal,
absolute paths, backslashes, and symlink escape rejected; 1MB/2MB size
caps; writes register an artifact so workspace files stay visible in the
panel. ToolDesc.Hidden gates both model visibility (runctx.Tools) and
/api/tools listing on runtime.fsTools, and registry.Execute re-checks
fail-closed. ToolExecCtx gains OwnerID/WorkspaceRoot/SettingBool.
go test ./... green (fs negative matrix, SSRF negatives, endpoint
fail-closed, cache).
Impact: link previews work end to end once the frontend wires the
fetcher; fs tools are inert until runtime.fsTools is enabled.
Refs: task feature/file-preview-caps; core 4d29301.
weichen
merged commit 028a0ac0ec into main2026-09-30 17:20:25 +00:00
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
What
GET /api/url-preview: OG metadata fetch with 5s timeout, 256KB cap, text/html check, TTL cache, SSRF guards enforced at dial time (loopback/private/link-local/multicast/reserved/CGNAT rejected per hop, anti DNS-rebind; AS_URL_PREVIEW_ALLOW_PRIVATE=1 for local testing only, default fail-closed; sanitized error cards, never internal addresses).
fs_read_file/fs_write_file/fs_list_dir: Hidden tools sandboxed under //; traversal/absolute/backslash/symlink-escape rejected; 1MB/2MB caps; writes register an artifact so workspace files stay panel-visible. ToolDesc.Hidden gates model visibility (runctx.Tools) and /api/tools on runtime.fsTools; registry.Execute re-checks fail-closed. ToolExecCtx gains OwnerID/WorkspaceRoot/SettingBool.
Verification
go test ./... green (fs negative matrix, SSRF negatives, endpoint fail-closed, cache). Rebased onto security-bump/cardflow main; vendored core pinned to 6bdc4f2.
Refs: task feature/file-preview-caps; core 6bdc4f2.