Fix Cloudflare Worker remote media conversion

[Olmo Maldonado (ibolmo)]

Context

Remote media normalization runs inside the Cloudflare Worker proxy for multimodal provider requests. The previous hostname validation/fetch path depended on Node DNS lookup plus the Node HTTP transport; remote Worker testing showed public media URLs can fail through that transport even though the same URLs work through Worker-native fetch.

Description

• Resolve media hostnames with Resolver.resolve4() / resolve6() instead of dns.promises.lookup().
• Keep rejecting unsafe literal IPs and hostnames that resolve to private/reserved addresses before fetching.
• Use Worker-native fetch for Cloudflare Workers while preserving the DNS-pinned Node http/https transport for Node runtimes.
• Add focused provider util coverage for the Worker fetch path and private-resolution rejection.
• Add pnpm run test:cloudflare-worker plus a gated CI job that runs a remote Wrangler Worker media conversion check when TEST_CLOUDFLARE_API_TOKEN and TEST_CLOUDFLARE_ACCOUNT_ID secrets are available.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
ai-proxy	Ready	Preview, Comment	Jun 2, 2026 10:17pm

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 5db75087ee

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "Codex (@codex) review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "Codex (@codex) address that feedback".

[chatgpt-codex-connector]

Pin the checked address before Worker fetches

When running in Cloudflare Workers, this returns the original hostname after resolveHostnameAddresses() has validated a public address, and fetchValidatedMediaUrl() then calls native fetch(url.toString()), which performs a separate DNS resolution. For an attacker-controlled media hostname that returns a public IP during validation and then a private/link-local IP for the subsequent fetch, this reopens the SSRF case that the Node path avoids by connecting to addresses[0].

Useful? React with 👍 / 👎.

[Olmo Maldonado (ibolmo)]

we can't really fix this. this requires other node modules that are not in cloudflare. what this is complaining about is:

validate...()
<-- in between these two someone could change the url to poitn to something else
fetch();

because we're movign away from the ai proxy "soon" i think it's acceptable to avoid redirect pinning for cloudflare for now.

[Alex Z (CLowbrow)]

Please fix codex p1