Skip to content

fix(clawnch): target www canonical host so the backend is reachable (v0.17.3) - #42

Merged
clawnchdev merged 1 commit into
mainfrom
fix/clawnch-www-allowlist
Jun 3, 2026
Merged

fix(clawnch): target www canonical host so the backend is reachable (v0.17.3)#42
clawnchdev merged 1 commit into
mainfrom
fix/clawnch-www-allowlist

Conversation

@clawnchdev

Copy link
Copy Markdown
Owner

Problem

The Clawnch apex clawn.ch 307-redirects to the www.clawn.ch canonical host. But:

  • www.clawn.ch was not on _DEFAULT_ALLOWLIST (only the apex was), and
  • the HTTP client doesn't follow cross-host redirects (by design — otherwise an allowlisted host could redirect to a non-allowlisted one and bypass the allowlist).

Net effect: every Clawnch API call failed — agent registration, token deploys, and leaderboard / my_launches reads — with either a 307 or a NetworkAllowlistError.

Fix

  • lib/http.py: add www.clawn.ch to _DEFAULT_ALLOWLIST alongside the apex.
  • services/clawnch.py: default base URL → https://www.clawn.ch (canonical, no redirect). CLAWNCH_BASE_URL still overrides for staging/local.

Redirect-following stays off (allowlist integrity). No user config change needed.

Verification

  • 4577 passed, 8 skipped; 100% coverage (16,249 stmts, 0 missing); ruff clean; plugin.yaml byte-identical.
  • Added tests: www.clawn.ch allowlisted, and clawnch default base == https://www.clawn.ch.

…v0.17.3)

The apex clawn.ch 307-redirects to www.clawn.ch, but www.clawn.ch wasn't
allowlisted and the HTTP client doesn't follow cross-host redirects (by design
— following them would let an allowlisted host bypass the allowlist). Net
effect: every Clawnch API call (agent registration, deploys, leaderboard /
my_launches) failed with a 307 or NetworkAllowlistError.

* lib/http.py: add www.clawn.ch to _DEFAULT_ALLOWLIST alongside the apex.
* services/clawnch.py: default base URL -> https://www.clawn.ch (canonical, no
  redirect). CLAWNCH_BASE_URL still overrides.

Verification: 4577 passed, 8 skipped; 100% coverage (16,249 stmts, 0 missing);
ruff check + format clean; plugin.yaml byte-identical.
@clawnchdev
clawnchdev merged commit 4b4ea54 into main Jun 3, 2026
4 checks passed
@clawnchdev
clawnchdev deleted the fix/clawnch-www-allowlist branch June 3, 2026 01:54
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant