clawbot
e5b68b2df7
check / check (push) Failing after 4m3s
Adding or editing an http or slack target whose address is private or reserved was refused with no hint that the refusal is deliberate or that it can be lifted. The refusal now adds that such addresses are refused by default and that the server's ALLOWED_EGRESS_CIDRS setting allows named networks, naming the README section "Allowing egress to your own network". Metadata refusals do not get it: link-local and the other unconditional metadata addresses cannot be opened, and Azure's WireServer, which listing does open, serves VM credentials. The delivery package refuses WireServer with its own error and exports the private-or-reserved one as ErrBlockedIP, so the handler can tell them apart. Model: opus-5-5