security(#304): SSRF denylist for fetch sidecar and CardDAV

[nolanmak]

Closes #304.

Adds an SSRF denylist to server-side fetches.

• New sidecars/fetch/src/ssrf.ts: assertUrlAllowed (scheme check + dns.lookup({all}) + IPv4/IPv6 private-range classifier) and safeFetch (manual-redirect loop re-validating each hop, redirect cap 10). Blocks loopback, link-local, RFC1918, unique-local, 0.0.0.0, CGNAT, IPv4-mapped IPv6, and cloud metadata (169.254.169.254), plus all non-http(s) schemes incl. file://. Wired into layers/http.ts, layers/render.ts (Playwright context.route per-hop re-validation + final-URL check), and fetcher.ts (up-front gate).
• carddav.rs: absolute <href>s are followed only when their host matches the configured CardDAV host (userinfo stripped to prevent user@host spoofing); others skipped. +2 unit tests.

Public URLs and normal same-host CardDAV behavior preserved.

Verification: fetch sidecar npm install + npx tsc --noEmit exit 0; cargo check -p augmentagent-channel-contacts clean.

Honest caveat: the Playwright render layer gates document-type requests; a DNS-rebind between the route check and the browser's own socket connect is a theoretical residual only a lower-level resolver hook could fully close.

🤖 swarm-authored, human-review-required (draft).

[coderabbitai]

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: 751c4798-9591-4199-8f1c-16901307b40d

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch sec/304-ssrf-denylist

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}