- Let an inherited proxy on an unregistered host:port (e.g. localhost:7890)
through the connect-time resolver; registered host:port pairs stay checked.
- Accept underscores inside host labels so Docker service names such as
my_ollama can be approved.
- Refuse IPv4-compatible and site-local IPv6 for official providers and
judge NAT64/6to4/compatible forms by the IPv4 address they carry.
- Fix approved destinations when routes are registered instead of on the
first request.
- Static outbound check: exact path matching, import-alias and
TCPConnector detection, policy factory wiring, raw HTTP client imports,
no nosec for policy rules, fail closed on unparseable files.
- Settings: restore the model controls when the base URL is empty.
The analyze, chat, verify-key and model-list routes sent server-side
requests to a caller-supplied base URL guarded only by a pre-flight
denylist. Callers could choose arbitrary hosts and paths, reach shared
address space and metadata ranges, drive local LLM write APIs, and use
DNS rebinding to deliver server-held keys to loopback services.
Requests now select an entry of an immutable destination registry built
at startup from the built-in provider catalog, local Ollama/LM Studio,
and operator environment variables (DOCTOR_LLM_ALLOWED_BASE_URLS and the
existing base URL variables). Outbound URLs are built from the approved
entry, resolved addresses are checked at connect time inside the shared
connector, redirects are never followed or treated as success, and error
responses no longer reflect upstream bodies or network details. The UI
shows localized operator guidance, a static rule enforces disabled
redirects and policy-managed sessions, and .comfyignore keeps tests and
tooling out of the published archive.
Pass the concrete tab pane through activation hooks and release late async renders after manager destruction. Keep Chat island activation, unmount, and vanilla status updates bound to their owning container.
rays