fix(net): harden the loopback transport guard across all HTTP clients

[benw5483]

Summary

Several HTTP clients in this crate allow clear-text http for a local dev / mock server by disabling reqwest's https_only, and they all decided "is this loopback?" with a raw string prefix check (starts_with("http://localhost") / 127.0.0.1 / [::1]). That prefix match is satisfied by attacker-controlled hosts:

• http://localhost.evil.com / http://127.0.0.1.evil.com — lookalike hosts that merely start with the loopback literal;
• http://127.0.0.1@evil.com — a userinfo prefix whose real connection host is evil.com.

Any of these made a client treat a non-loopback host as loopback, disabling https_only and letting credentials be sent in clear text when the caller controls the base URL (--api-url / ACTUAL_API_URL).

The same bypassable check was duplicated across ~6 constructors: the auth client (auth/oauth.rs), the platform API client (api/client.rs, which attaches the login-session bearer to every authenticated call), the model-cache probes (model_cache.rs), and the OpenAI / Anthropic runner clients.

This extracts one hardened helper — net::is_loopback_http_url — and routes every constructor through it. The helper parses the URL, requires the http scheme, rejects any userinfo component, and matches the host exactly against localhost / 127.0.0.1 / ::1. Genuine loopback dev endpoints keep working; every other URL is forced through HTTPS. No divergent copies of the check remain.

Test plan

• New unit tests on the helper assert the bypass URLs are not loopback (the guard stays on) and that real loopback / https endpoints behave correctly; the auth client's integration tests cover its use of the helper.
• cargo test green; cargo fmt --check and cargo clippy -- -D warnings clean.
• A grep confirms no starts_with loopback guard remains — every client routes through the shared helper.
• Reviewer: confirm the accepted loopback set (localhost / 127.0.0.1 / ::1) matches the intended dev endpoints for all of these clients.

---

Generated by the operator's software factory.
• On behalf of: @benw5483

[davidmiuraactualai]

Actual Adversarial Review

Key findings

---

No actionable defects survived validation. The shared predicate parses the URL, rejects userinfo, and accepts only clear-text loopback identities. All six affected constructors call it; their non-loopback paths retain reqwest HTTPS-only transport. This matches ClientBuilder::https_only semantics for the repository-pinned reqwest 0.12 client.

The implementation also meets docs/adr/fd1181e0-c600-46af-94d8-829c8e8b2b12-adopt-comprehensive-unit-testing-strategy-for-ci-cd-pipeline-components.md: src/net.rs has isolated positive loopback and negative lookalike, userinfo, non-HTTP, and malformed-URL tests, while the OAuth client retains integration-level guard tests.

Architecture intent

No architecture-intent decision is needed for this change.

---

Review metadata

Important

All tracked findings are addressed at head b26c7b8854bfd5386e83d6d2ac56fcce7c36e31f. This is the canonical remediation record for the PR.

Compared: upstream main at cfcae4cd84645417e7d8042517a69cbd55d22404 … PR head b26c7b8854bfd5386e83d6d2ac56fcce7c36e31f
CI: Build, Test, Lint, Coverage Enforcement, and CodeQL all succeeded for the exact head; Live E2E was skipped. Review verification: immutable-head static trace confirmed all affected client constructors call the shared guard and preserve HTTPS-only behavior for non-loopback URLs.