4 Commits

Include renames

Author	SHA1	Message	Date
dev_agentandClaude Opus 5.5	e7dbcf3d2c	Add SSRF-safe recipe fetcher ... internal/recipes.Fetcher fetches https:// URLs only. Its DialContext resolves the host once, refuses unless every answer is public (loopback, RFC 1918, link-local, CGNAT 100.64/10, multicast, unspecified, reserved, IPv6 ULA/link-local/multicast and IPv4-mapped or -embedding forms are blocked) and dials the address it checked, so a rebinding DNS answer cannot swap in a private IP. Keep-alives and environment proxies are off, so every request and redirect hop dials and checks afresh. At most 3 redirects, each re-checked for scheme and address; bodies over 2 MB are an error rather than truncated; 10 s for the whole fetch; a descriptive User-Agent; requests to one host at least 1 s apart; 2xx pages cached by URL for an hour. Tests use a stub resolver and httptest TLS servers. Maestro task: f4414e41-bd99-498d-a613-a90053963249 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-05 11:51:49 -04:00
dev_agent	72fa311de9	Feature 09: AI harness and skills framework (#62) ... Co-authored-by: dev_agent <dev_agent@cubecraftlabs.com>	2026-10-05 11:18:53 -04:00
dev_agent	5833a73541	Feature 03 task 5: Trusted proxy handling for forwarded headers (#23) ... Co-authored-by: dev_agent <dev_agent@cubecraftlabs.com> Co-committed-by: dev_agent <dev_agent@cubecraftlabs.com>	2026-10-03 11:05:33 -04:00
dev_agent	9f4537d0cb	Feature 01 task 6: AGENTS.md, CLAUDE.md, README and architecture docs (#7) ... Co-authored-by: dev_agent <dev_agent@cubecraftlabs.com> Co-committed-by: dev_agent <dev_agent@cubecraftlabs.com>	2026-10-03 00:26:15 -04:00