[M3gA-Mind]

Summary

web_fetch built its reqwest client directly and never called NetGate::prepare_client. That is the hook a host uses to apply its process-wide proxy and client settings. http_request and curl both call it ("tool.http_request", "tool.curl"), so web_fetch was the only network tool that ignored the host's proxy and connected directly.

web_fetch now passes its builder through self.gate.prepare_client("tool.web_fetch", builder) before pinning the vetted addresses, in the same order as http_request.

Related issue

None.

API or behavior changes

Behavior change: web_fetch now uses the host's proxy. Whatever a host's prepare_client applies (proxy, TLS settings) now applies to web_fetch as well. A host that sets a user proxy will see web_fetch traffic go through it, as http_request and curl traffic already does. The public API is unchanged.

Validation

Commands actually run, with their outcome:

• cargo fmt --all -- --check: rustfmt --edition 2024 on the touched files only.
• N/A: cargo clippy --all-targets --all-features -- -D warnings was left to CI.
• N/A: cargo build --all-targets --all-features was left to CI.
• N/A: cargo test --all-features was left to CI. Only the new test ran locally:
  • web_fetch_builds_its_client_through_prepare_client before the fix failed (left: [] right: ["tool.web_fetch"]); after the fix it passed.

Tests

• The test TestNetGate now records the service name of each prepare_client call (prepared()).
• New network/web_fetch_proxy_tests.rs::web_fetch_builds_its_client_through_prepare_client fetches from a local server and asserts that the gate saw exactly one prepare_client("tool.web_fetch"). It is a new file because web_fetch_tests.rs is already over the 750-line layout cap.

Documentation

Not needed: NetGate::prepare_client already documents the hook, and this makes web_fetch use it.

Checklist

• The change is focused on one logical change
• No new #[allow(...)], #[ignore], or relaxed lints
• No secrets, tokens, or .env contents in the diff or the description

[tinysweeper]

Tiny Sweeper review

Reviewed head: 0ddc7b73ae2519130f6ec3a93a25c28d9a0a911a

Verdict: Ready for maintainer review · Priority: none
Coverage: Reviewed 3 of 3 files.
Pull request purpose (title): fix(web_fetch): buil…

Diagnostics and supporting details

Full summary

Pull request purpose (title): fix(web_fetch): build the client through the host's prepare_client. Tiny Sweeper completed its review; deterministic results follow.

Review snapshot

Change surface	Files	Review signal	Count
Production	1	Active findings	0
Tests	2	Noted findings	0
Documentation	0	Resolved findings	0
Configuration	0	Pending checks/questions	0

Completeness: Complete
Test assessment: No supported feature-to-test mapping was available; this does not mean tests are absent or passed.

What changed

`web_fetch` splits its client construction into a builder followed by `self.gate.prepare_client("tool.web_fetch", builder)`, then continues with `redirect(Policy::none())` applied before the hook and `resolve_to_addrs` after it, allowing the host's proxy settings to apply while still connecting only to vetted addresses. `TestNetGate` gains a `prepared` field and `prepared()` accessor, and its `NetGate::prepare_client` implementation now records the service name instead of ignoring it. A new test module `web_fetch_proxy_tests.rs` is wired into `web_fetch.rs` under `cfg(test)` and contains one test that serves a local HTTP response and asserts a non-error result plus `gate.prepared() == ["tool.web_fetch"]`.

Features

• Modified — web_fetch client construction routed through NetGate::prepare_client: `web_fetch` traffic now picks up whatever the host's `prepare_client` applies — notably process-wide proxy configuration — matching `http_request` and `curl`; the public API is unchanged. (crates/tinytools-std/src/network/web_fetch.rs impl WebFetchTool {)
• Added — TestNetGate records prepare_client service names: Test support can now observe which service names the gate prepared clients for, enabling assertions on the hook invocation. (crates/tinytools-std/src/network/test_support.rs pub struct TestNetGate {, crates/tinytools-std/src/network/test_support.rs impl TestNetGate {, crates/tinytools-std/src/network/test_support.rs impl NetGate for TestNetGate {)

Tests

No supported feature-to-test mapping was produced. Test execution is not inferred.

Findings

No active actionable findings.

Before merge

None.

Agent review details

critique

• Conclusion: Success
• Scope reviewed: all assigned evidence
• Lane summary: Reviewed 3 files; 0 findings. _The code index is behind this pull request (indexed at `28ea0933b938`), so retrieved context may be out of date._

security

• Conclusion: Success
• Scope reviewed: all assigned evidence
• Lane summary: Reviewed 3 files; 0 findings. _The code index is behind this pull request (indexed at `28ea0933b938`), so retrieved context may be out of date._

tests

• Conclusion: Success
• Scope reviewed: all assigned evidence
• Lane summary: The diff adds proxy support to web_fetch by routing its client builder through the host's `prepare_client`, plus a test that drives a full fetch against a local server and asserts both that the request succeeds and that the gate recorded the `tool.web_fetch` service name — a real behavioural assertion that would fail if the hook were dropped or misnamed. The TestNetGate extension is test-only support, named per the repository's `<module>_<topic>_tests.rs` convention and free of unwrap-in-library-path issues. One nit: the new test file enables `clippy::unwrap_used` yet never calls `unwrap`; that is not a reportable defect. _The code index is behind this pull request (indexed at `28ea0933b938`), so retrieved context may be out of date._

commits

• Conclusion: Success
• Scope reviewed: all assigned evidence
• Positive: The commits lane reported no sensitive content in committed files.
• Lane summary: No sensitive content in committed files. _The code index is behind this pull request (indexed at `28ea0933b938`), so retrieved context may be out of date._

description

• Conclusion: Success
• Scope reviewed: all assigned evidence
• Positive: The description lane confirmed the body accurately describes the behaviour change and its validation status, with no defects found.
• Lane summary: The change does what the description says: `web_fetch` now routes its client builder through `NetGate::prepare_client("tool.web_fetch", …)` before pinning the vetted addresses, matching `http_request` and `curl`, and the new test plus the `TestNetGate::prepared()` recorder cover it. The body accurately states the behaviour change and its validation status; no defects found. _The code index is behind this pull request (indexed at `28ea0933b938`), so retrieved context may be out of date._

Evidence and run details

• Models: ladder/vectors-oai3, deepseek-v4.1-flash
• Spend: $0.000766
• Tokens: 274833 input · 4582 output · 47616 cached · 228 embedding
• Updated: 2026-10-22T23:03:12Z

Head	State	Pass summary
0ddc7b73ae25	ready for maintainer review	0 active finding(s), 0 resolved finding(s) (at 2026-10-22T23:03:12Z)

[coderabbitai]

Important

• 🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

⚙️ Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: Organization UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: be8fe22d-915e-445f-9267-82e4fdfcde6e

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

_{Comment @coderabbitai help to get the list of available commands.}

[tinysweeper]

tinysweeper found nothing blocking. Approving.

Diagnostics

Total spend: $0.0008