Scope private-address default, cleanup exit status, and deterministic tests

Restore CLI document-loader default allowPrivateAddress behavior to keep
non-lookup commands unchanged, while lookup remains explicitly hardened via
lookup-specific option/config wiring.

Make finalizeAndExit return a non-zero status when cleanup fails after a
nominal success path, so shutdown I/O errors are not reported as success.

Update imagerenderer tests to use literal public IP URLs to avoid DNS lookup
dependencies and keep unit tests deterministic.

#608 (comment)
#608 (comment)
#608 (comment)

Co-Authored-By: Codex <codex@openai.com>

Author: dahlia

packages/cli/src/docloader.ts

@@ -30,7 +30,7 @@ export function getDocumentLoaderCachePrefix(
 }
 
 export async function getDocumentLoader(
-  { userAgent, allowPrivateAddress = false }: DocumentLoaderOptions = {},
+  { userAgent, allowPrivateAddress = true }: DocumentLoaderOptions = {},
 ): Promise<DocumentLoader> {
   const cacheKey = `${userAgent ?? ""}:${allowPrivateAddress}`;
   if (documentLoaders[cacheKey]) return documentLoaders[cacheKey];

packages/cli/src/imagerenderer.test.ts

@@ -4,6 +4,9 @@ import path from "node:path";
 import test from "node:test";
 import { downloadImage } from "./imagerenderer.ts";
 
+const TEST_PUBLIC_IMAGE_URL = "https://198.51.100.10/image.png";
+const TEST_PUBLIC_REDIRECT_URL = "https://198.51.100.11/final.png";
+
 test("downloadImage - skips private URL without fetching", async () => {
   let called = false;
   const originalFetch = globalThis.fetch;
@@ -28,7 +31,7 @@ test("downloadImage - writes file for public URL", async () => {
 
   let result: string | null = null;
   try {
-    result = await downloadImage("https://example.com/image.png");
+    result = await downloadImage(TEST_PUBLIC_IMAGE_URL);
     assert.notEqual(result, null);
     const fileStat = await stat(result!);
     assert.equal(fileStat.isFile(), true);
@@ -46,7 +49,7 @@ test("downloadImage - rejects redirect to private URL", async () => {
   globalThis.fetch = ((input: URL | RequestInfo) => {
     calls++;
     const target = typeof input === "string" ? input : input.toString();
-    if (target === "https://example.com/image.png") {
+    if (target === TEST_PUBLIC_IMAGE_URL) {
       return Promise.resolve(
         new Response(null, {
           status: 302,
@@ -58,7 +61,7 @@ test("downloadImage - rejects redirect to private URL", async () => {
   }) as typeof fetch;
 
   try {
-    const result = await downloadImage("https://example.com/image.png");
+    const result = await downloadImage(TEST_PUBLIC_IMAGE_URL);
     assert.equal(result, null);
     assert.equal(calls, 1);
   } finally {
@@ -70,11 +73,11 @@ test("downloadImage - follows validated redirects", async () => {
   const originalFetch = globalThis.fetch;
   globalThis.fetch = ((input: URL | RequestInfo) => {
     const target = typeof input === "string" ? input : input.toString();
-    if (target === "https://example.com/image.png") {
+    if (target === TEST_PUBLIC_IMAGE_URL) {
       return Promise.resolve(
         new Response(null, {
           status: 302,
-          headers: { location: "https://cdn.example.com/final.png" },
+          headers: { location: TEST_PUBLIC_REDIRECT_URL },
         }),
       );
     }
@@ -83,7 +86,7 @@ test("downloadImage - follows validated redirects", async () => {
 
   let result: string | null = null;
   try {
-    result = await downloadImage("https://example.com/image.png");
+    result = await downloadImage(TEST_PUBLIC_IMAGE_URL);
     assert.notEqual(result, null);
     const fileStat = await stat(result!);
     assert.equal(fileStat.isFile(), true);
@@ -100,7 +103,7 @@ test("downloadImage - cancels redirect response body before following", async ()
   const originalFetch = globalThis.fetch;
   globalThis.fetch = ((input: URL | RequestInfo) => {
     const target = typeof input === "string" ? input : input.toString();
-    if (target === "https://example.com/image.png") {
+    if (target === TEST_PUBLIC_IMAGE_URL) {
       const body = new ReadableStream<Uint8Array>({
         cancel() {
           cancelled++;
@@ -109,7 +112,7 @@ test("downloadImage - cancels redirect response body before following", async ()
       return Promise.resolve(
         new Response(body, {
           status: 302,
-          headers: { location: "https://cdn.example.com/final.png" },
+          headers: { location: TEST_PUBLIC_REDIRECT_URL },
         }),
       );
     }
@@ -118,7 +121,7 @@ test("downloadImage - cancels redirect response body before following", async ()
 
   let result: string | null = null;
   try {
-    result = await downloadImage("https://example.com/image.png");
+    result = await downloadImage(TEST_PUBLIC_IMAGE_URL);
     assert.notEqual(result, null);
     assert.equal(cancelled, 1);
   } finally {
@@ -142,7 +145,7 @@ test("downloadImage - cancels redirect body when location is missing", async ()
   }) as typeof fetch;
 
   try {
-    const result = await downloadImage("https://example.com/image.png");
+    const result = await downloadImage(TEST_PUBLIC_IMAGE_URL);
     assert.equal(result, null);
     assert.equal(cancelled, 1);
   } finally {
@@ -163,7 +166,7 @@ test("downloadImage - cancels body for non-ok terminal response", async () => {
   }) as typeof fetch;
 
   try {
-    const result = await downloadImage("https://example.com/image.png");
+    const result = await downloadImage(TEST_PUBLIC_IMAGE_URL);
     assert.equal(result, null);
     assert.equal(cancelled, 1);
   } finally {

packages/cli/src/lookup.ts

@@ -630,24 +630,27 @@ export async function runLookup(
     return outputStream;
   };
   const finalizeAndExit = async (code: number) => {
+    let cleanupFailed = false;
     try {
       await closeWriteStream(outputStream);
     } catch (error) {
+      cleanupFailed = true;
       logger.error("Failed to close output stream during shutdown: {error}", {
         error,
       });
     }
     try {
       await server?.close();
     } catch (error) {
+      cleanupFailed = true;
       logger.error(
         "Failed to close temporary server during shutdown: {error}",
         {
           error,
         },
       );
     }
-    process.exit(code);
+    process.exit(cleanupFailed && code === 0 ? 1 : code);
   };
 
   if (command.authorizedFetch) {