fix: support pinned attachment lookup arrays

control-plane/src/input-attachment.ts

@@ -1,6 +1,6 @@
 import { lookup as dnsLookup } from 'node:dns/promises';
 import { request as httpsRequest } from 'node:https';
-import { isIP } from 'node:net';
+import { isIP, type LookupFunction } from 'node:net';
 import { basename } from 'node:path';
 import { sha256Bytes } from './crypto.js';
 import { diagnosticDurationMs } from './diagnostics.js';
@@ -207,6 +207,18 @@ export async function resolveAgentBusAttachmentAddresses(
   return addresses;
 }
 
+export function createPinnedAttachmentLookup(
+  address: { address: string; family: number }
+): LookupFunction {
+  return (_hostname, options, callback) => {
+    if (options.all) {
+      callback(null, [address]);
+      return;
+    }
+    callback(null, address.address, address.family);
+  };
+}
+
 async function downloadPinnedHttps(
   url: URL,
   address: { address: string; family: number },
@@ -217,9 +229,7 @@ async function downloadPinnedHttps(
       method: 'GET',
       headers: { Accept: 'application/vnd.ms-excel, application/vnd.openxmlformats-officedocument.spreadsheetml.sheet, application/octet-stream' },
       timeout: DOWNLOAD_TIMEOUT_MS,
-      lookup: ((_hostname: string, _options: unknown, callback: (error: NodeJS.ErrnoException | null, address: string, family: number) => void) => {
-        callback(null, address.address, address.family);
-      }) as never
+      lookup: createPinnedAttachmentLookup(address)
     }, (response) => {
       const statusCode = Number(response.statusCode || 0);
       const location = Array.isArray(response.headers.location) ? response.headers.location[0] : response.headers.location;

control-plane/test/input-attachment.test.ts

@@ -4,6 +4,7 @@ import test from 'node:test';
 import { sha256Bytes } from '../src/crypto.js';
 import {
   InputAttachmentError,
+  createPinnedAttachmentLookup,
   decodeInlineInputAttachment,
   downloadAgentBusInputAttachment,
   parseAgentBusInputAttachment,
@@ -90,6 +91,35 @@ test('AgentBus attachment DNS accepts internal names and private literal address
   assert.ok(localhost.every((entry) => entry.family === 4 || entry.family === 6));
 });
 
+test('AgentBus attachment DNS pinning follows the Node lookup callback shape', async () => {
+  const address = { address: '10.0.0.8', family: 4 };
+  const lookup = createPinnedAttachmentLookup(address);
+  await new Promise<void>((resolve, reject) => {
+    lookup('internal.example', { all: true }, (error, addresses, family) => {
+      try {
+        assert.ifError(error);
+        assert.deepEqual(addresses, [address]);
+        assert.equal(family, undefined);
+        resolve();
+      } catch (assertionError) {
+        reject(assertionError);
+      }
+    });
+  });
+  await new Promise<void>((resolve, reject) => {
+    lookup('internal.example', { all: false }, (error, resolvedAddress, family) => {
+      try {
+        assert.ifError(error);
+        assert.equal(resolvedAddress, address.address);
+        assert.equal(family, address.family);
+        resolve();
+      } catch (assertionError) {
+        reject(assertionError);
+      }
+    });
+  });
+});
+
 test('AgentBus attachment diagnostics expose stages and codes without URL data', async () => {
   const events: Array<{ event: string; metadata: Record<string, unknown> }> = [];
   await assert.rejects(