affaan-m/ECC · error · ValueError

remote import host resolves to a non-public address: {host}

Error message

remote import host resolves to a non-public address: {host}

What it means

Error "remote import host resolves to a non-public address: {host}" thrown in affaan-m/ECC.

Source

Thrown at skills/continuous-learning-v2/scripts/instinct-cli.py:216

        addr_infos = socket.getaddrinfo(parsed.hostname, parsed.port or 443, type=socket.SOCK_STREAM)
    except socket.gaierror as exc:
        raise ValueError(f"remote import host could not be resolved: {parsed.hostname}") from exc

    for family, _, _, _, sockaddr in addr_infos:
        host = sockaddr[0]
        try:
            ip = ipaddress.ip_address(host)
        except ValueError:
            continue
        if (
            ip.is_private
            or ip.is_loopback
            or ip.is_link_local
            or ip.is_multicast
            or ip.is_reserved
            or ip.is_unspecified
        ):
            raise ValueError(f"remote import host resolves to a non-public address: {host}")

    return urllib.parse.urlunparse(parsed)


def _fetch_import_url(source: str, *, max_bytes: int = 2 * 1024 * 1024) -> str:
    """Fetch a validated remote instinct file with bounded size and timeout."""
    url = _validate_import_url(source)
    req = urllib.request.Request(url, headers={"User-Agent": "ECC-instinct-import/2"})
    with urllib.request.urlopen(req, timeout=15) as response:
        content_type = response.headers.get("Content-Type", "")
        if content_type and not any(
            allowed in content_type.lower()
            for allowed in ("text/", "markdown", "yaml", "json", "octet-stream")
        ):
            raise ValueError(f"unsupported remote content type: {content_type}")
        data = response.read(max_bytes + 1)
    if len(data) > max_bytes:
        raise ValueError(f"remote import exceeds {max_bytes} bytes")

View on GitHub (pinned to 01e15490f0)

Solutions

  1. The import URL resolves to a private, loopback, link-local, multicast, or reserved IP (SSRF guard). Import only from hosts with public addresses.
  2. If you need an internal source, fetch the file through an approved proxy/mirror and import it locally.
  3. Beware DNS rebinding: pin the host or use a vetted mirror rather than bypassing this check.

Example fix

# blocked: https://internal.lan/instinct.md resolves to 10.x
# do instead: scp the file over an approved channel, then import locally

When it happens

Trigger: Thrown at skills/continuous-learning-v2/scripts/instinct-cli.py:216 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of affaan-m/ECC@01e15490f0 (2026-08-13). Data as JSON: /api/errors/68acc49e7db4b369. Report an issue: GitHub.