Function guardFetch

packages/core/sdk/src/hosted-http-client.ts:620–741

(
  underlying: typeof globalThis.fetch,
  options: HostedHttpClientOptions,
  sharedResolve?: GuardResolver,
)

  );

const guardFetch = (
  underlying: typeof globalThis.fetch,
  options: HostedHttpClientOptions,
  sharedResolve?: GuardResolver,
): typeof globalThis.fetch => {
  const resolve = sharedResolve ?? makeSharedResolver(options);
  const maxRedirects = Math.max(0, options.maxRedirects ?? 10);
  // SAFETY: narrowed to the one thing a closure cannot express — Bun's fetch
  // type carries a static `preconnect` property, which packages built against
  // @types/bun require. The call signature is checked by the annotations, and
  // the return type is `Promise<Response>` on every path.
  return (async (input, init) => {
    const normalized = normalizeFetchInput(input, init);
    let currentUrl = normalized.url;
    let currentInit = normalized.init;
    const signal = currentInit?.signal ?? undefined;
    // Read once, before the loop rewrites `currentInit` on each hop.
    const redirectMode = currentInit?.redirect ?? "follow";
    for (let redirects = 0; ; redirects++) {
      const guarded = await Effect.runPromiseExit(
        validateOutboundUrl(currentUrl, options, resolve),
        { signal },
      );
      if (Exit.isFailure(guarded)) {
        // Both halves are required. The cause decides that this was an
        // interrupt rather than a guard verdict — an aborted signal alone
        // would bury a real SSRF block under a retryable AbortError. The
        // signal's own state decides that the caller asked for it: an
        // interrupt from anywhere else must not be reported as the caller's
        // abort, which would fabricate a reason that never happened.
        if (signal?.aborted && Cause.hasInterruptsOnly(guarded.cause)) rejectAsAbort(signal);
        return await Effect.runPromise(Effect.failCause(guarded.cause));
      }
      const response = await underlying(currentUrl, withStreamingDuplex(currentInit));
      const isRedirect =
        response.status >= 300 && response.status < 400 && response.headers.has("location");
      // The guard pins the transport to `redirect: "manual"` so it sees every
      // hop, which is a separate question from what the caller asked for.
      // Following anyway would answer a caller who asked to inspect a 3xx with
      // the followed response and no Location header — the OAuth authorize
      // probe reads exactly that header — and would turn a requested rejection
      // into a 200. Neither mode is a security concession: not following is
      // strictly safer than following, so the caller's intent stands.
      if (isRedirect && redirectMode === "error") {
        return await rejectBlocked(
          currentUrl,
          "Redirect received while the caller requested redirect: error",
        );
      }
      if (isRedirect && redirectMode === "manual") return response;
      if (isRedirect && redirects < maxRedirects) {
        // The 3xx is abandoned here. Undici keeps a connection out of the
        // pool until an unread body is consumed or cancelled, so a
        // redirect-heavy integration would leak one connection per hop. A
        // cancel that itself fails — a 3xx declaring Content-Length whose
        // connection dies mid-body rejects with "terminated" — is connection
        // hygiene failing, not the request: the redirect still proceeds.
        const body = response.body;