Validate an agent URL before it reaches a protocol transport.
The private/metadata decision delegates to classifyProbeUrl so agent
URLs and discovery probes share one policy: loopback allowed (a dev loop
already requires on-host access to abuse), RFC-1918/link-local/ULA refused
unless the operator sets ADCP_ALLOW_INTERNAL_PROBES=1, cloud metadata
refused even then. Deliberately NOT keyed on NODE_ENV — a staging image
running NODE_ENV=test must not inherit a looser SSRF posture than
production.
SCOPE: this is a synchronous check on the URL's literal scheme and hostname.
It does NOT resolve DNS, so it cannot stop a public hostname that resolves —
or rebinds — to a private address. That gap is the same TOCTOU one tracked
for classifyProbeUrl; DNS-level defense requires resolving and pinning at
connect time, as ssrfSafeFetch and createPinAndBindFetch do.
Validate an agent URL before it reaches a protocol transport.
The private/metadata decision delegates to classifyProbeUrl so agent URLs and discovery probes share one policy: loopback allowed (a dev loop already requires on-host access to abuse), RFC-1918/link-local/ULA refused unless the operator sets
ADCP_ALLOW_INTERNAL_PROBES=1, cloud metadata refused even then. Deliberately NOT keyed onNODE_ENV— a staging image runningNODE_ENV=testmust not inherit a looser SSRF posture than production.SCOPE: this is a synchronous check on the URL's literal scheme and hostname. It does NOT resolve DNS, so it cannot stop a public hostname that resolves — or rebinds — to a private address. That gap is the same TOCTOU one tracked for
classifyProbeUrl; DNS-level defense requires resolving and pinning at connect time, asssrfSafeFetchandcreatePinAndBindFetchdo.