Reduce blocking of event loop when parsing large ip lists

[timokoessler]

No description provided.

[aikido-pr-checks]

Summary by Aikido

⚠️ Security Issues: 1	Quality Issues: 0	Resolved Issues: 0

⚡ Enhancements

• Added asynchronous IP parsing and summarization with periodic event-loop yielding
• Updated service configuration to asynchronously build large blocked and monitored lists

🔧 Refactors

• Refactored network summarization into reusable incremental processing steps

^{More info}

[aikido-pr-checks]

🟡 Medium - Async IP list refreshes temporarily keep the old access policy active

The refresh path now awaits three independently asynchronous matcher builds and publishes each list separately. IPMatcher.createAsync() deliberately yields back to the event loop while parsing large lists, so requests handled during a refresh still consult the previous allowlist/blocklist snapshot and can observe a mix of old and new policy. An IP that has just been removed from allowedIPAddresses therefore remains able to access the service until the rebuild completes, and overlapping refreshes can also let a late older build overwrite newer policy.

Show fix

Build the blocked, allowed, and monitored IP matchers into a new immutable snapshot and swap that snapshot into ServiceConfig only once all of them are ready. Tie each async rebuild to a monotonically increasing generation or configUpdatedAt value so a late completion cannot overwrite a newer refresh.

_{Reply to ignore this finding.
More info}

[codecov]

Codecov Report

❌ Patch coverage is 98.26087% with 2 lines in your changes missing coverage. Please review.

Files with missing lines	Patch %	Lines
library/agent/ServiceConfig.ts	94.28%	2 Missing ⚠️

📢 Thoughts on this report? Let us know!