feat: simplify fetch_url allowlist + add update_connection tool

Part 1 — fetch_url validation simplification
  Now that Connection.allowed_url_hosts exists, it's the ONLY check.
  The old 2-label suffix-overlap rule against yarn_rm_url is gone.

  - Connection.allowed_url_hosts: list[str] = Field(default_factory=list)
    (was list[str] | None = None). Default empty list means the
    connection has no fetch access; the user must explicitly opt in
    via save_connection or update_connection.
  - _validate_url_host drops the yarn_rm_url parameter and the
    _host_suffix_overlap helper. Now: scheme/host/IP checks, then
    empty-reject, then glob match. Reject everything else.
  - fetch_url's error message now points the user at
    Connection.allowed_url_hosts as the fix.
  - The label-by-label glob check from the previous commit is kept
    (SSRF guard: 'ccam*' matches 'ccam50' but NOT 'ccam50.evil.com').

Part 2 — update_connection tool
  PATCH-style update for an existing Connection record. Only the
  fields the caller provides are changed. Same pattern as
  update_pending_job: req.model_dump(exclude_none=True), with
  'name' popped before passing to the store.

  To CLEAR a field (e.g. drop auth_password), use delete_connection
  + save_connection. This is YAGNI; the alternative (model_fields_set
  to distinguish 'omitted' from 'null') adds surface for bugs.

  - ConnectionStore.update(name, **fields): get, model_copy(update=...),
    save. Lock + atomic write. Re-validates the patched record.
  - update_connection tool function: passes fields through to the
    store, logs which fields were changed.
  - UpdateConnectionRequest Pydantic model: 12 mutable fields + name.
  - /update_connection route with operation_id='update_connection'.
  - 9 new unit tests in test_connection_tools.py (PATCH, dict/list
    replace-not-merge, unknown name 404, validation of patched record,
    disk persistence).
  - test_fetch_url.py: existing 21 tests updated; 3 new tests for
    the empty/None/missing allowed_url_hosts cases.
  - test_mcp_routes.py: assert 22 tool routes.
  - README: update_connection row added; fetch_url row updated.

Tests: 386 passed (up from 377, +9 net).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

spark_executor/tools/fetch_url.py

@@ -5,9 +5,10 @@
 
 Generic HTTP GET proxy for the agent. Lets the agent fetch URLs on the
 cluster's network when it cannot reach those hosts directly. Security:
-URL host must share >= 2 labels of suffix with the connection's yarn_rm_url
-host; IP literals and non-HTTP schemes are rejected. Reuses the connection's
-saved auth/SSL config so the agent doesn't need cluster credentials.
+the host is checked against an explicit fnmatch glob allowlist configured
+on the connection (`allowed_url_hosts`). Empty or missing allowlist means
+no URL access; IP literals and non-HTTP schemes are rejected. Reuses the
+connection's saved auth/SSL config so the agent doesn't need cluster credentials.
 """
 import ipaddress
 import fnmatch
@@ -24,19 +25,6 @@ _MAX_BODY_BYTES = 1_000_000  # 1 MB cap on response body
 _REQUEST_TIMEOUT_SECONDS = 30
 
 
-def _host_suffix_overlap(host_a: str, host_b: str, min_labels: int = 2) -> bool:
-    """Return True if host_a and host_b share at least min_labels suffix labels."""
-    labels_a = host_a.lower().split(".")
-    labels_b = host_b.lower().split(".")
-    n = 0
-    i, j = len(labels_a) - 1, len(labels_b) - 1
-    while i >= 0 and j >= 0 and labels_a[i] == labels_b[j]:
-        n += 1
-        i -= 1
-        j -= 1
-    return n >= min_labels
-
-
 def _host_matches_any_glob(host: str, patterns: list[str]) -> bool:
     """True if `host` matches any of the fnmatch glob patterns.
 
@@ -57,14 +45,12 @@ def _host_matches_any_glob(host: str, patterns: list[str]) -> bool:
 
 def _validate_url_host(
     url: str,
-    yarn_rm_url: str | None,
-    allowed_hosts: list[str] | None = None,
+    allowed_hosts: list[str] | None,
 ) -> None:
     """Raise ValueError if the URL is not allowed to be fetched.
 
-    Allowed if EITHER:
-    - URL host matches one of `allowed_hosts` fnmatch globs (if provided)
-    - URL host shares >= 2 labels of suffix with `yarn_rm_url` host
+    Allowed only if the URL host matches one of the fnmatch glob patterns in
+    `allowed_hosts`. An empty or missing allowlist rejects everything.
     """
     parsed = urlparse(url)
     if parsed.scheme not in ("http", "https"):
@@ -85,30 +71,18 @@ def _validate_url_host(
         if "IP literal" in str(e):
             raise
         # not an IP, continue
-    # Glob allowlist — if any pattern matches, host is allowed regardless of suffix
-    if allowed_hosts and _host_matches_any_glob(host, allowed_hosts):
+    if not allowed_hosts:
+        raise ValueError(
+            "allowed_url_hosts is empty — set Connection.allowed_url_hosts to "
+            "allow specific hosts before calling fetch_url (e.g. ['ccam*'] "
+            "for ccam1-ccam99 or ['*.prod.internal'] for a subdomain)."
+        )
+    if _host_matches_any_glob(host, allowed_hosts):
         return
-    if not yarn_rm_url:
-        raise ValueError(
-            f"Connection has no yarn_rm_url set, cannot validate URL host "
-            f"(no allowed_url_hosts match either). Save a Connection with "
-            f"yarn_rm_url or allowed_url_hosts set."
-        )
-    anchor = urlparse(yarn_rm_url).hostname
-    if not anchor:
-        raise ValueError(f"Connection's yarn_rm_url has no host: {yarn_rm_url!r}")
-    if not _host_suffix_overlap(host, anchor, min_labels=2):
-        allowed_hint = (
-            f" Or set allowed_url_hosts=['<glob>'] on the connection to allow "
-            f"this host (e.g. ['ccam*'] for ccam1-ccam99)."
-            if not allowed_hosts
-            else f" (no allowed_url_hosts pattern matched either)"
-        )
-        raise ValueError(
-            f"URL host {host!r} does not share enough suffix with the "
-            f"connection's yarn_rm_url host {anchor!r} (need >= 2 labels of "
-            f"common suffix).{allowed_hint} Reject this fetch to prevent SSRF."
-        )
+    raise ValueError(
+        f"URL host {host!r} is not in Connection.allowed_url_hosts "
+        f"{allowed_hosts!r}. Reject this fetch to prevent SSRF."
+    )
 
 def fetch_url(url: str, connection_name: str) -> FetchUrlResult:
     """Proxy an HTTP GET to url using the auth/SSL settings of connection_name."""
@@ -117,7 +91,7 @@ def fetch_url(url: str, connection_name: str) -> FetchUrlResult:
     if conn is None:
         raise KeyError(f"Connection not found: {connection_name}")
 
-    _validate_url_host(url, conn.yarn_rm_url, conn.allowed_url_hosts)
+    _validate_url_host(url, conn.allowed_url_hosts)
 
     config = YarnClientConfig.from_connection(conn)
     resp = httpx.get(