| 1 | # network.py DOX |
| 2 | |
| 3 | ## Purpose |
| 4 | |
| 5 | - Own the `network.py` helper module. |
| 6 | - This module validates public URLs and fetches remote resources safely. |
| 7 | - Keep this file-level DOX profile synchronized with `network.py` because this directory is intentionally flat. |
| 8 | |
| 9 | ## Ownership |
| 10 | |
| 11 | - `network.py` owns the runtime implementation. |
| 12 | - `network.py.dox.md` owns durable notes about responsibilities, contracts, side effects, and verification for that implementation. |
| 13 | - Classes: |
| 14 | - `HttpFetchResult` (no explicit base class) |
| 15 | - `UnsafeUrlError` (`ValueError`) |
| 16 | - Top-level functions: |
| 17 | - `_build_request_headers() -> dict[str, str]` |
| 18 | - `_normalize_content_type(content_type: str | None) -> str | None` |
| 19 | - `resolve_host_ips(hostname: str) -> tuple[ipaddress._BaseAddress, ...]` |
| 20 | - `validate_public_http_url(url: str) -> tuple[ipaddress._BaseAddress, ...]` |
| 21 | - `fetch_public_http_resource(url: str, max_bytes: int, max_redirects: int=..., timeout: tuple[float, float]=...) -> HttpFetchResult` |
| 22 | - `is_loopback_address(address: str) -> bool`: Check whether *address* resolves to a loopback interface. |
| 23 | - Notable constants/configuration names: `SAFE_HTTP_SCHEMES`, `DEFAULT_FETCH_TIMEOUT`, `DEFAULT_HTTP_USER_AGENT`. |
| 24 | |
| 25 | ## Runtime Contracts |
| 26 | |
| 27 | - Helper modules own reusable framework APIs and must preserve public callers unless all callers, tests, and docs are updated together. |
| 28 | - Update this file whenever public functions, classes, persistence behavior, path/security assumptions, side effects, or cross-module contracts change. |
| 29 | - Observed side-effect areas: network calls, secret handling. |
| 30 | - Imported dependency areas include: `__future__`, `dataclasses`, `ipaddress`, `os`, `requests`, `socket`, `struct`, `urllib.parse`. |
| 31 | |
| 32 | ## Key Concepts |
| 33 | |
| 34 | - Important called helpers/classes observed in the source: `frozenset`, `dataclass`, `strip`, `urlparse`, `parsed.hostname.rstrip.lower`, `resolve_host_ips`, `requests.Session`, `ValueError`, `content_type.split.strip.lower`, `socket.getaddrinfo`, `ipaddress.ip_address`, `seen.add`, `UnsafeUrlError`, `hostname.endswith`, `validate_public_http_url`, `socket.inet_pton`, `_checkers`, `parsed.hostname.rstrip`, `os.getenv`, `content_type.split.strip`. |
| 35 | - Keep request/response, tool, or helper semantics documented here at the same time as source changes. |
| 36 | |
| 37 | ## Work Guidance |
| 38 | |
| 39 | - Preserve public helper APIs used by core code and plugins unless every caller is updated. |
| 40 | - Keep path, auth, secret, persistence, network, and subprocess behavior explicit and bounded. |
| 41 | - Prefer adding cohesive helper functions here only when behavior is reused across modules. |
| 42 | |
| 43 | ## Verification |
| 44 | |
| 45 | - Run targeted tests for changed helper behavior; run security regressions for auth, filesystem, WebSocket, tunnel, upload, or secret-handling helpers. |
| 46 | - Related tests observed by source search: |
| 47 | - `tests/test_oauth_gemini_api.py` |
| 48 | - `tests/test_oauth_github_copilot.py` |
| 49 | - `tests/test_oauth_xai_grok.py` |
| 50 | - `tests/test_plugin_scan_prompt.py` |
| 51 | - `tests/test_tunnel_remote_link.py` |
| 52 | |
| 53 | ## Child DOX Index |
| 54 | |
| 55 | No child DOX files. |