chore: replace python -m agents.validator with hawk in all agent mode instructions

tests/unit/net_guard.py

@@ -0,0 +1,69 @@
+# retoor <retoor@molodetz.nl>
+
+import ipaddress
+import pytest
+from devplacepy import net_guard
+from devplacepy.net_guard import BlockedAddressError
+from tests.conftest import run_async
+
+
+def test_loopback_is_blocked():
+    assert net_guard.is_blocked_address(ipaddress.ip_address("127.0.0.1"))
+
+
+def test_private_ranges_are_blocked():
+    assert net_guard.is_blocked_address(ipaddress.ip_address("10.0.0.1"))
+    assert net_guard.is_blocked_address(ipaddress.ip_address("192.168.1.1"))
+    assert net_guard.is_blocked_address(ipaddress.ip_address("172.16.0.1"))
+
+
+def test_link_local_and_unspecified_blocked():
+    assert net_guard.is_blocked_address(ipaddress.ip_address("169.254.1.1"))
+    assert net_guard.is_blocked_address(ipaddress.ip_address("0.0.0.0"))
+
+
+def test_public_address_allowed():
+    assert not net_guard.is_blocked_address(ipaddress.ip_address("1.1.1.1"))
+    assert not net_guard.is_blocked_address(ipaddress.ip_address("8.8.8.8"))
+
+
+def test_ipv4_mapped_ipv6_unwrapped_and_blocked():
+    mapped = ipaddress.ip_address("::ffff:127.0.0.1")
+    assert isinstance(net_guard.effective_address(mapped), ipaddress.IPv4Address)
+    assert net_guard.is_blocked_address(mapped)
+
+
+def test_nat64_prefix_unwrapped_to_ipv4():
+    nat64 = ipaddress.ip_address("64:ff9b::7f00:1")
+    resolved = net_guard.effective_address(nat64)
+    assert isinstance(resolved, ipaddress.IPv4Address)
+    assert net_guard.is_blocked_address(nat64)
+
+
+def test_guard_rejects_non_http_scheme():
+    with pytest.raises(BlockedAddressError):
+        run_async(net_guard.guard_public_url("ftp://example.com/x"))
+    with pytest.raises(BlockedAddressError):
+        run_async(net_guard.guard_public_url("file:///etc/passwd"))
+
+
+def test_guard_rejects_missing_host():
+    with pytest.raises(BlockedAddressError):
+        run_async(net_guard.guard_public_url("http://"))
+
+
+def test_guard_rejects_loopback_literal():
+    with pytest.raises(BlockedAddressError):
+        run_async(net_guard.guard_public_url("http://127.0.0.1:8080/admin"))
+
+
+def test_guard_rejects_private_literal():
+    with pytest.raises(BlockedAddressError):
+        run_async(net_guard.guard_public_url("http://10.0.0.5/internal"))
+
+
+def test_guard_allow_private_skips_resolution():
+    host = run_async(
+        net_guard.guard_public_url("http://127.0.0.1:9000/x", allow_private=True)
+    )
+    assert host == "127.0.0.1"