* fix(agents): use fetchWithSsrFGuard in minimax-vlm.ts instead of raw fetch
Replace raw fetch() with fetchWithSsrFGuard + withTrustedEnvProxyGuardedFetchMode
in minimaxUnderstandImage, aligning with all other agent network transport
paths (provider-transport-fetch, mcp-http-fetch, web-guarded-fetch, tools-manager).
This adds SSRF protection, redirect safety, debug capture, and proper
dispatcher lifecycle management. The ensureGlobalUndiciEnvProxyDispatcher
call is removed since guarded fetch handles proxy routing in trusted env-proxy
mode.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* fix(agents): preserve configured MiniMax origins in guarded-fetch migration
* fix(agents): resolve lint and type-suppression regressions in MiniMax VLM guarded-fetch tests
Replace as-any casts in vi.mock vi.importActual calls with generic type
parameters, and replace the opts:any parameter in the fetch-guard bridge
with an inline type. Add SSRF policy assertions covering default hosts,
custom public hosts, and explicitly-authorized loopback origins.
* fix(minimax-vlm): thread allowPrivateNetwork into guarded-fetch policy
Honor the explicit provider request private-network opt-out in the MiniMax
VLM guarded-fetch path. When an operator sets
models.providers.<id>.request.allowPrivateNetwork: false, skip the origin
exception for non-default hosts so the explicit denial is authoritative.
Also fix an invalid Vitest fn generic (two-parameter form -> function
signature) that caused check-test-types to fail.
* fix(agents): use canonical provider SSRF policy for MiniMax VLM
* fix(media): harden MiniMax VLM transport
Co-authored-by: Peter Lee <li.xialong@xydigit.com>
---------
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Co-authored-by: Peter Steinberger <steipete@gmail.com>
Co-authored-by: Peter Steinberger <peter@steipete.me>
9a7d615dfc