[rudycelekli]

Problem

Plain HTTP is allowed for loopback so the workspace capability is not sent across a network. The allow-list was only localhost, 127.0.0.1, and ::1. 127.0.0.2 and IPv4-mapped ::ffff:127.0.0.1 are loopback too, but both SDKs rejected them unless the caller marked the network as trusted. The Python client also skipped proxies only for those three names, so another 127/8 address could send the capability through a proxy. http://192.0.2.1, http://[::ffff:192.0.2.1], and http://example.com stay rejected.

Evidence

Before:

Client("http://127.0.0.2:1") -> ValueError: Plain http is only for loopback addresses
Client("http://[::ffff:127.0.0.1]:1") -> ValueError: Plain http is only for loopback addresses

node --test --test-name-pattern "plain http is limited"
not ok
error: 'Use HTTPS for remote services; insecureHttp is only for an explicitly trusted network'

After, those five loopback origins construct successfully, the non-loopback cases above still raise, and node --test test/client.test.js is 8 passed. The Python assertions are in test_the_capability_is_never_sent_over_plain_http_to_another_host and were run against graphicle_sdk.Client directly; that file's module skip still waits on GRAPHICLE_BIN in a checkout that has not built the service.

Made with Cursor

[VikramLex]

Thank you, @rudycelekli. This is merged as it is, and it ships in Graphicle 0.1.6.

We added one change on top. On some Python releases, ipaddress does not count ::ffff:127.0.0.1 as loopback (3.12.3, the default on Ubuntu 24.04, is one of them), so the Python client now unwraps an IPv4-mapped address before it checks. We also added a few tests for other URL forms.

The licences check that failed on this pull request came from two new Rust advisories (tokio and ctutils). The same release fixes them.

Release notes: https://github.com/Graphicle-AI/graphicle/releases/tag/v0.1.6