Greptile Summary

This PR routes Mattermost account probes through the shared fetchWithSsrFGuard helper instead of raw fetch, and threads the allowPrivateNetwork account setting into probe requests. The implementation is clean and correct.

• probe.ts wraps the response-processing logic in a nested try/finally that calls release(), ensuring the guard's dispatcher is always cleaned up on both success and error paths.
• The outer finally correctly clears the probe's own AbortController timer regardless of outcome.
• channel.ts safely forwards account.config.allowPrivateNetwork === true (explicit boolean check) to prevent any truthy non-boolean leaking into the policy.
• Tests are well-structured: they mock fetchWithSsrFGuard at the module level with vi.hoisted, verify release is called on all response paths, and add a focused test for the allowPrivateNetwork → policy forwarding.
• Minor note: the PR description states a CHANGELOG.md entry was added, but the committed diff does not include any CHANGELOG.md change — this is a description inaccuracy with no functional impact.

Confidence Score: 5/5

Safe to merge — the SSRF guard is correctly integrated with proper resource cleanup on all code paths.

All three changed files are correct: release() is called in a finally block, the abort timer is cleaned up in the outer finally, allowPrivateNetwork is forwarded safely, and the tests cover success, error-response, throw, and policy-forwarding paths. The one P2 comment is a minor test-documentation gap that does not affect correctness or security.

No files require special attention.

This is a comment left during a code review.
Path: extensions/mattermost/src/mattermost/probe.test.ts
Line: 114-126

Comment:
**Missing `release` assertion on throw path**

The "returns fetch error when request throws" test uses `mockFetchGuard.mockRejectedValueOnce(...)`, so no `{ response, release }` is returned and no caller-side `release` call is expected — this is correct by design. However, it might be worth adding a negative assertion (`expect(mockRelease).not.toHaveBeenCalled()`) to explicitly document and guard that invariant, similar to how the success-path tests assert `toHaveBeenCalledTimes(1)`. Without it, a future regression that accidentally returns a release handle before throwing could go undetected.

```suggestion
    await expect(probeMattermost("https://mm.example.com", "token")).resolves.toEqual(
      expect.objectContaining({
        ok: false,
        status: null,
        error: "network down",
      }),
    );
    expect(mockRelease).not.toHaveBeenCalled();
```

How can I resolve this? If you propose a fix, please make it concise.

_{Reviews (2): Last reviewed commit: "Mattermost: guard probe fetches" | Re-trigger Greptile}

@codex review

Codex Review: Didn't find any major issues. Already looking forward to the next diff.

@codex review

@greptile review