feat: sync full-stack Docker runtime and UI

backend/tests/test_web_search.py

@@ -1,5 +1,6 @@
 import asyncio
 import importlib
+import socket
 import os
 import sys
 import threading
@@ -44,12 +45,26 @@ def _payload():
     }
 
 
-def test_is_blocked_public_url():
+def test_is_blocked_public_url(monkeypatch):
+    def fake_getaddrinfo(host, port, type=0, flags=0):  # noqa: ARG001
+        del host, flags
+        return [(socket.AF_INET, socket.SOCK_STREAM, 6, "", ("93.184.216.34", port, 0, 0))]
+
+    monkeypatch.setattr(job_handlers.socket, "getaddrinfo", fake_getaddrinfo)
     assert job_handlers._is_blocked_public_url("http://127.0.0.1/test") is True
     assert job_handlers._is_blocked_public_url("file:///tmp/test") is True
     assert job_handlers._is_blocked_public_url("https://example.com/docs") is False
 
 
+def test_is_blocked_public_url_resolves_private_hostname(monkeypatch):
+    def fake_getaddrinfo(host, port, type=0, flags=0):  # noqa: ARG001
+        del host, flags
+        return [(socket.AF_INET, socket.SOCK_STREAM, 6, "", ("127.0.0.1", port, 0, 0))]
+
+    monkeypatch.setattr(job_handlers.socket, "getaddrinfo", fake_getaddrinfo)
+    assert job_handlers._is_blocked_public_url("https://private.example.com/docs") is True
+
+
 def test_web_search_route_returns_done(monkeypatch):
     async def fake_call_ollama(prompt, system_prompt=None, tag="", **kwargs):  # noqa: ARG001
         if tag.endswith("-webq"):