egress: stop screening WebSocket egress (hostname-only check over-promised the control)

[patchstackdave]

What

Removes the WebSocket egress wrapper. Outbound SSRF screening now covers fetch + node:http/https only (node path pinned, fetch resolve-and-screen).

Why

The WebSocket constructor is synchronous, so the only screen possible inline is a textual hostname match — it can't perform the DNS-resolution check the fetch and node:http paths do (a hostname that resolves to an internal address would pass a textual check). Bringing WebSocket to parity would require a connection-pinning dispatcher, but:

• the server-side, attacker-controlled-WebSocket URL sink is rare (real attacker-URL SSRF sinks — webhook senders, URL unfurlers, image proxies, OIDC discovery — live on fetch/node:http), and
• a partial, hostname-only guard over-promises the SSRF control relative to what the other transports guarantee.

So rather than keep a half-guard (or ship a runtime-dependent dispatcher for a rare sink), we remove it and screen only the transports we can screen properly. Docs updated to match (no transport claimed that isn't screened).

Tests

The former WebSocket test (which asserted a literal internal host was blocked) is replaced by one that pins the decision — it asserts the guard leaves the global WebSocket unwrapped — so a half-guard can't be reintroduced silently. Full suite green (647 passing), typecheck clean.

[coderbuds]

Intentionally removes WebSocket screening to avoid misleading partial security guarantees

🎯 Quality: 100% Elite · 📦 Size: Small

📈 This month: Your 49th PR — above team average · Averaging Elite

_{See how your team is trending →}

[patchstackdave]

/review

[patchstackdave]

/review