Let the configured integration proxy live on a private network

[michielbdejong]

Refs #1700. Stacked on #1725.

A: a proxy origin on a private network

Before this change, ProxyOrigin::parse exempted only a literal loopback address or localhost. So --integration-proxy-url http://host.docker.internal:8787 was refused: Docker Desktop resolves it to 192.168.65.x and Linux to 172.17.0.1. A LAN proxy such as http://proxy.lan:8787 → 192.168.1.10 was refused too.

New rule (egress::refuse_proxy_address / destination_addresses_with):

• Only for a URL whose origin (scheme, host and port) equals the configured proxy's, the addresses may be loopback, private (RFC 1918), CGNAT (100.64/10), IPv6 ULA (fc00::/7), or IPv4-mapped loopback or private.
• Link-local (169.254.0.0/16, fe80::/10, mapped 169.254.x), unspecified and multicast addresses are still refused, even for the proxy. A literal address of that kind is refused when --integration-proxy-url is parsed at startup.
• A literal address or localhost is connected to without a lookup. Any other name is resolved once per request, every answer must pass, and exactly those addresses are pinned into the reqwest client with resolve_to_addrs. There is no second lookup.
• Credentials in the URL are still refused.
• Every other destination keeps the full checked_addresses checks.
• A minimal Resolve trait (with SystemResolver) is the test seam.

The docs for --integration-proxy-url are updated in config.rs and docs/src/plugins/creating-plugins.md.

B: end-to-end ctx.http → proxy

cargo test -p atomic-server --test it plugin_proxy runs the full path over real sockets:

1. Starts a stub proxy on loopback that records requests.
2. Starts a real server with --integration-proxy-url pointing at the stub.
3. Over HTTP: pins a JS draft as a release (/plugin-release-pin), then commits an active Installation with integrationAppAgent and integrationConnections: {demo: "conn-1"}. Activation mints the node agent, which the test reads back from GET /app-agent.
4. Runs the plugin through POST /plugin-run. The plugin calls ctx.http("atomic-proxy:/demo/items").

The test asserts that:

• the stub got GET /proxy/conn-1/demo/items;
• the request carries a v2 signature from the node agent, which check_auth_signature verifies and which a different method does not;
• the plugin got the stub's body and its ctx.connections;
• atomic-proxy:/other/..., an undeclared platform, is refused before anything connects, so the stub sees exactly one request.

Tests

• cargo test -p atomic-server --lib plugins::: 176 passed, 3 ignored.
• cargo test -p atomic-server --test it plugin_proxy: passes.
• cargo clippy -p atomic-server --all-targets -- -D warnings: clean.

🤖 Generated with Claude Code

[michielbdejong]

Merge-risk triage (2026-09-28). This is a read-only review of this PR's own diff. The rule it applies: nothing that works today may break for existing users or clients, and new behaviour is added alongside the old. The stack is being rebased onto develop as one chain before merging, so line references are against the current stacked base.

Verdict: SAFE

Loosens the SSRF guard to private/CGNAT/ULA addresses, but only for the operator-configured proxy origin. Link-local and metadata addresses stay refused, the name is resolved once, and the checked addresses are pinned. Nothing changes when the option is unset.

🤖 Generated with Claude Code