[Tyagiquamar]

What was wrong

Summary by CodeRabbit

• Bug Fixes
  • Improved protection against server-side request forgery by correctly identifying the full range of IPv6 link-local addresses, including bracketed and uppercase forms.
  • Nearby IPv6 address ranges remain permitted, and blocked address literals are rejected without unnecessary DNS lookups. This makes host validation more consistent while preserving access to addresses that are not in the link-local range.

[coderabbitai]

No actionable comments were generated in the recent review.

Recent review info

Run configuration

• Source mode: Auto
• Repository: BlockRunAI/ClawRouter
• Branch: main
• File: .coderabbit.yaml
• Commit: 8bab234
• Layers: Repository YAML
• Review profile: CHILL
• Plan: Advanced
• Run ID: 0031c0ac-252a-4695-af65-b49eb4e94505

Commits

Reviewing files that changed from the base of the PR and between 8bab234 and fadaa44.

Files selected for processing: 2

• src/local-guard.test.ts
• src/local-guard.ts

Included review availability: This review used your included allowance. Your plan provides up to 8 included reviews per hour; 7 remain after this review.

Walkthrough

The SSRF host guard now blocks IPv6 addresses in the full fe80::/10 link-local range. Tests cover bracketed and uppercase forms, nearby allowed ranges, and rejection of a bracketed link-local literal before DNS resolution.

Changes: IPv6 Link-Local SSRF Guard

Layer / File(s)	Summary
Range detection and validation src/local-guard.ts, src/local-guard.test.ts	isBlockedSsrfHost now uses a helper that classifies first hextets from 0xfe80 through 0xfebf as link-local. Tests cover blocked address forms, nearby allowed ranges, and rejection before DNS resolution.

Priority: Normal

Estimated code review effort: 2 (Simple) | ~10 minutes

Change: Bug fix

Possibly related PRs

• BlockRunAI/ClawRouter#506: Adds resolved-address checks and connection pinning in the same SSRF guard.

Suggested reviewers: killerqueen-z

Merge Risk: Minimal · up to fadaa

The IPv6 link-local SSRF guard matches the intended range without an established merge-blocking issue.

Pre-merge checks: 5

Check name	Status	Explanation
Description Check		Check skipped - CodeRabbit’s high-level summary is enabled.
Title check		The title states the main change: the SSRF guard now blocks the full IPv6 link-local range, not only the fe80:: prefix. It follows the conventional commit format and matches the file summaries and PR …
Docstring Coverage		Docstring coverage is 100.00% which is sufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff with cyclomatic complexity of at least 2. Documentat…
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.

Full details: Title check

Explanation

The title states the main change: the SSRF guard now blocks the full IPv6 link-local range, not only the fe80:: prefix. It follows the conventional commit format and matches the file summaries and PR objectives. It is specific and concise.

Full details: Docstring Coverage

Explanation

Docstring coverage is 100.00% which is sufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff with cyclomatic complexity of at least 2. Documentation-only edits and deletions within surviving functions are included; unchanged diff context and fully deleted functions are excluded. Analyzed 2 functions across 2 files.

Finishing Touches

🧪 Generate unit tests (beta)

• Create a new PR

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}