From a7ba8cc553426050f93bfe7829abdcc70756d895 Mon Sep 17 00:00:00 2001
From: Nick Taylor <nick@nickyt.co>
Date: Fri, 13 Feb 2026 23:51:38 -0500
Subject: [PATCH] fix: use unsigned right shift for subnet mask calculation

Co-authored-by: greptile-apps[bot] <165735046+greptile-apps[bot]@users.noreply.github.com>
---
 src/gateway/net.ts | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/gateway/net.ts b/src/gateway/net.ts
index f79d9998a49..977102eb766 100644
--- a/src/gateway/net.ts
+++ b/src/gateway/net.ts
@@ -180,7 +180,7 @@ function ipMatchesCIDR(ip: string, cidr: string): boolean {
     (subnetParts[0] << 24) | (subnetParts[1] << 16) | (subnetParts[2] << 8) | subnetParts[3];
 
   // Create mask and compare
-  const mask = prefixLen === 0 ? 0 : 0xffffffff << (32 - prefixLen);
+  const mask = prefixLen === 0 ? 0 : (-1 >>> (32 - prefixLen)) << (32 - prefixLen);
   return (ipInt & mask) === (subnetInt & mask);
 }