fix(artifact): preserve localhost listener family

A daemon configured with the localhost hostname may bind only IPv6, so forcing every client request onto IPv4 makes an otherwise supported listener unreachable. Resolve localhost at dial time, reject non-loopback results, and try the validated numeric addresses without exposing the request through a proxy.

Author: wesm

cmd/agentsview/artifact_sync.go

@@ -24,13 +24,65 @@ var runArtifactSyncCLI = artifact.Sync
 
 const daemonArtifactExchangeResponseLimit = 1 << 20
 
-var daemonArtifactExchangeHTTPClient = &http.Client{
-	CheckRedirect: func(
-		*http.Request,
-		[]*http.Request,
-	) error {
-		return http.ErrUseLastResponse
-	},
+var daemonArtifactExchangeHTTPClient = newDaemonArtifactExchangeHTTPClient()
+
+func newDaemonArtifactExchangeHTTPClient() *http.Client {
+	transport := http.DefaultTransport.(*http.Transport).Clone()
+	transport.Proxy = nil
+	dialer := &net.Dialer{}
+	transport.DialContext = func(
+		ctx context.Context,
+		network string,
+		address string,
+	) (net.Conn, error) {
+		return dialLoopbackDaemon(ctx, dialer, network, address)
+	}
+	return &http.Client{
+		Transport: transport,
+		CheckRedirect: func(
+			*http.Request,
+			[]*http.Request,
+		) error {
+			return http.ErrUseLastResponse
+		},
+	}
+}
+
+func dialLoopbackDaemon(
+	ctx context.Context,
+	dialer *net.Dialer,
+	network string,
+	address string,
+) (net.Conn, error) {
+	host, port, err := net.SplitHostPort(address)
+	if err != nil || !strings.EqualFold(host, "localhost") {
+		return dialer.DialContext(ctx, network, address)
+	}
+	addresses, err := net.DefaultResolver.LookupIPAddr(ctx, host)
+	if err != nil {
+		return nil, err
+	}
+	if len(addresses) == 0 {
+		return nil, errors.New("localhost did not resolve to a loopback address")
+	}
+	for _, candidate := range addresses {
+		if !candidate.IP.IsLoopback() {
+			return nil, errors.New("localhost resolved to a non-loopback address")
+		}
+	}
+	var dialErr error
+	for _, candidate := range addresses {
+		connection, candidateErr := dialer.DialContext(
+			ctx,
+			network,
+			net.JoinHostPort(candidate.String(), port),
+		)
+		if candidateErr == nil {
+			return connection, nil
+		}
+		dialErr = errors.Join(dialErr, candidateErr)
+	}
+	return nil, dialErr
 }
 
 func validateArtifactSyncConfig(cfg SyncConfig) error {
@@ -168,16 +220,10 @@ func validatedLoopbackDaemonURL(rawURL string) (string, error) {
 		parsed.Fragment != "" {
 		return "", errors.New("unsafe daemon endpoint")
 	}
-	ip := net.ParseIP(parsed.Hostname())
-	if strings.EqualFold(parsed.Hostname(), "localhost") {
-		host := "127.0.0.1"
-		if parsed.Port() != "" {
-			host = net.JoinHostPort(host, parsed.Port())
-		}
-		parsed.Host = host
-		ip = net.ParseIP("127.0.0.1")
-	}
-	if ip == nil || !ip.IsLoopback() {
+	hostname := parsed.Hostname()
+	ip := net.ParseIP(hostname)
+	if !strings.EqualFold(hostname, "localhost") &&
+		(ip == nil || !ip.IsLoopback()) {
 		return "", errors.New("daemon endpoint is not loopback")
 	}
 	return strings.TrimSuffix(parsed.String(), "/"), nil

cmd/agentsview/artifact_sync_test.go

@@ -7,6 +7,7 @@ import (
 	"errors"
 	"fmt"
 	"io"
+	"net"
 	"net/http"
 	"net/http/httptest"
 	"net/url"
@@ -425,7 +426,41 @@ func TestRunDaemonArtifactExchangeAcceptsLocalhostEndpoint(t *testing.T) {
 	)
 
 	require.NoError(t, err)
-	assert.Equal(t, "127.0.0.1:"+endpoint.Port(), gotHost)
+	assert.Equal(t, "localhost:"+endpoint.Port(), gotHost)
+}
+
+func TestRunDaemonArtifactExchangeConnectsToIPv6LocalhostListener(t *testing.T) {
+	listener, err := net.Listen("tcp6", "[::1]:0")
+	if err != nil {
+		t.Skipf("IPv6 loopback is unavailable: %v", err)
+	}
+	var gotHost string
+	ts := httptest.NewUnstartedServer(http.HandlerFunc(func(
+		w http.ResponseWriter,
+		r *http.Request,
+	) {
+		gotHost = r.Host
+		w.Header().Set("Content-Type", "application/json")
+		_, writeErr := io.WriteString(w, `{}`)
+		require.NoError(t, writeErr)
+	}))
+	ts.Listener = listener
+	ts.Start()
+	t.Cleanup(ts.Close)
+	endpoint, err := url.Parse(ts.URL)
+	require.NoError(t, err)
+	endpoint.Host = "localhost:" + endpoint.Port()
+
+	_, err = runDaemonArtifactExchange(
+		t.Context(),
+		transport{Mode: transportHTTP, URL: endpoint.String()},
+		"",
+		t.TempDir(),
+		false,
+	)
+
+	require.NoError(t, err)
+	assert.Equal(t, "localhost:"+endpoint.Port(), gotHost)
 }
 
 func TestRunLocalAndArtifactFolderSyncStopsAfterLocalFailure(t *testing.T) {