Repository navigation
Conversation
utcp-http 1.1.15: at call time a resolved URL may be loopback only when the
template literally names a loopback host, so a `{host}` placeholder filled
with 127.0.0.1 is refused before any request leaves; a remote manual or
OpenAPI spec may not route the OAuth2 token POST at loopback either; server
variables resolve to their defaults; the converter judges the spec by its
final post-redirect URL.
utcp-websocket 1.2.1: the upgrade never follows a redirect, and a manual
discovered from a remote origin may not point tool calls or a token URL at
loopback.
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
- the remote-manual and converter loopback rules also classify templates
whose port is a placeholder (``http://localhost:{port}/x``), which do not
parse as URLs yet name loopback literally
- an explicit ``base_url`` override lifts the OpenAPI token-URL rule, as it
lifts the server-URL rule
- a failed WebSocket discovery closes the socket and session it opened
- README: name the override that actually exists
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
A socket already in the pool may be carrying another registration's or a tool call's traffic, so the cleanup added for failed discoveries is scoped to connections the discovery itself opened. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
…arse error Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
…back-via-placeholders-and-token-url http/websocket: a host chosen after registration can never be loopback
![cubic-dev-ai[bot]](https://avatars.githubusercontent.com/in/1082092?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
All reported issues were addressed across 15 files
Reply with feedback, questions, or to request a fix.
View guided diff | Turn on auto-fix | Re-trigger cubic
Two gaps in the cleanup added for failed discoveries: a peer that closed (or sent an error frame) before any manual arrived left the ``try`` block without raising and skipped the cleanup; and the cleanup judged ownership by a pre-await snapshot alone. The no-manual case now raises inside the ``try``, and the cleanup closes the pooled socket only if this discovery opened it and it is still the one in the pool. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Parity with typescript-utcp #60; the behaviour was already correct here. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Release: utcp-http 1.1.15 and utcp-websocket 1.2.1 (#116).
Loopback hardening: a host chosen after registration can never be loopback (call-time rule), remote manuals and specs may not route the OAuth2 token POST at loopback, OpenAPI server variables resolve to their defaults, the WebSocket upgrade never follows a redirect, and WebSocket discovery applies the remote-loopback manual rule.
🤖 Generated with Claude Code