sync: update from private repo (402599f)

src/engine/tools/app-docs.ts

@@ -143,6 +143,13 @@ function isBlockedDocsSubpath(relFromDocs: string): boolean {
   });
 }
 
+function sanitizeListedDescription(description: string): string {
+  const referencesInternalDoc = BLOCKED_DOCS_SUBPATHS.some((blocked) =>
+    description.includes(blocked.replace(/\/$/, '')),
+  );
+  return referencesInternalDoc ? '(description omitted: internal reference)' : description;
+}
+
 /**
  * Map a symbolic doc name to a concrete file path under an allow-listed root.
  * Returns null on invalid names, attempted traversal, or blocked internal docs.
@@ -306,7 +313,7 @@ function extractMarkdownDescription(filePath: string): string {
       }
       if (line.startsWith('#')) continue;
       // Use this line as description
-      return line.slice(0, 140);
+      return sanitizeListedDescription(line.slice(0, 140));
     }
   } catch {
     // ignore
@@ -326,7 +333,7 @@ function extractPieceDescription(filePath: string): string {
         .split('\n')
         .map((s) => s.trim())
         .find((s) => s.length > 0);
-      return (first ?? '(no description)').slice(0, 140);
+      return sanitizeListedDescription((first ?? '(no description)').slice(0, 140));
     }
   } catch {
     // ignore

src/engine/tools/shared/ssrf.ts

@@ -1,4 +1,5 @@
 import * as dns from 'dns';
+import { isIP } from 'node:net';
 import { isPrivateOrForbidden } from '../../../net/ssrf-strict.js';
 
 // These delegate to the hardened range check in src/net/ssrf-strict.ts so that
@@ -6,11 +7,13 @@ import { isPrivateOrForbidden } from '../../../net/ssrf-strict.js';
 // loopback, RFC1918, link-local + cloud metadata (169.254/16, fd00:ec2::),
 // CGNAT (100.64/10), 0.0.0.0/8, IPv4-mapped IPv6, NAT64, multicast, reserved.
 export function isPrivateIPv4(ip: string): boolean {
+  if (isIP(ip) !== 4) return false;
   return isPrivateOrForbidden(ip, 4);
 }
 
 export function isPrivateIPv6(ip: string): boolean {
   const normalized = ip.toLowerCase().replace(/^\[|\]$/g, '');
+  if (isIP(normalized) !== 6) return false;
   return isPrivateOrForbidden(normalized, 6);
 }