@anteros/core 0.0.44 → 0.0.47

package/tests/fixtures/fake-provider.ts

@@ -87,6 +87,25 @@ export function openaiTool(name: string, args: any, id = "call_1"): Response {
     });
 }
 
+/** Several tool calls in one assistant turn — what a model does in parallel. */
+export function openaiToolCalls(calls: Array<{ name: string; args: any; id?: string }>): Response {
+    return Response.json({
+        choices: [{
+            message: {
+                role: "assistant",
+                content: null,
+                tool_calls: calls.map((call, index) => ({
+                    id: call.id ?? `call_${index + 1}`,
+                    type: "function",
+                    function: { name: call.name, arguments: JSON.stringify(call.args) },
+                })),
+            },
+            finish_reason: "tool_calls",
+        }],
+        usage: USAGE,
+    });
+}
+
 export function openaiStream(pieces: string[]): Response {
     const events = pieces.map((text) => JSON.stringify({ choices: [{ delta: { content: text } }] }));
     events.push(JSON.stringify({ choices: [], usage: USAGE }));
@@ -113,6 +132,20 @@ export function anthropicTool(name: string, input: any, id = "toolu_1"): Respons
     });
 }
 
+/** Several `tool_use` blocks in one turn (Anthropic's parallel calls). */
+export function anthropicToolCalls(calls: Array<{ name: string; input: any; id?: string }>): Response {
+    return Response.json({
+        content: calls.map((call, index) => ({
+            type: "tool_use",
+            id: call.id ?? `toolu_${index + 1}`,
+            name: call.name,
+            input: call.input,
+        })),
+        stop_reason: "tool_use",
+        usage: A_USAGE,
+    });
+}
+
 export function anthropicStream(pieces: string[]): Response {
     const events: string[] = [
         JSON.stringify({ type: "message_start", message: { usage: { input_tokens: 9, output_tokens: 0 } } }),

package/tests/fixtures/tool-tenant/ai/agents/report.agent.ts

@@ -0,0 +1,12 @@
+import { define } from "../../../../../index";
+
+/**
+ * Loader fixture for the description rule — `report.tool.ts` beside it exports one
+ * usable tool and one without a description, which the loader must skip.
+ */
+export default define.Agent({
+    id: "report",
+    description: "Reports on charts",
+    instructions: "You build charts.",
+    provider: { model: "test-model", protocol: "openai", apiKey: "fixture-key" },
+});

package/tests/fixtures/tool-tenant/ai/agents/report.tool.ts

@@ -0,0 +1,12 @@
+import { define, v } from "../../../../../index";
+
+export default [
+    define.Tool({
+        id: "chart",
+        description: "Builds a chart for a metric",
+        inputSchema: v.object({ metric: v.string().required() }),
+        execute: async ({ metric }: any) => ({ metric, points: 3 }),
+    }),
+    // Deliberately not a define.Tool with a description: the loader must skip it.
+    { id: "hidden", _isTool_: true, inputSchema: v.object({}), execute: () => null } as any,
+];

package/tests/fixtures/vars-tenant/vars/open.var.ts

@@ -0,0 +1,18 @@
+// Test fixture — a namespace WITHOUT a declared `scope` (the #34 case), whose
+// `all` rule also proves the access rule receives `{ namespace, body }`.
+export default {
+    _isVars_: true,
+    namespace: "open",
+    vars: { token: "s3cret" },
+    api: {
+        access: {
+            all: (ctx: any) => ctx.namespace === "open" && !!ctx.body,
+            set: true,
+            get: true,
+            entries: true,
+            clear: true,
+            del: true,
+        },
+    },
+    replication: { enabled: false },
+};

package/tests/hono.test.ts

@@ -1,5 +1,5 @@
 import { describe, it, expect, beforeEach, afterEach } from "bun:test";
-import { createApp } from "../server/hono";
+import { createApp, collectHeaders, redactUri } from "../server/hono";
 import { cfg } from "../server/config";
 import { AppError } from "../lib/error";
 import { HTTPException } from "hono/http-exception";
@@ -13,6 +13,8 @@ function resetServerConfig() {
         ipRestriction: undefined,
         trustProxy: undefined,
         rateLimit: undefined,
+        security: undefined,
+        files: undefined,
     };
 }
 
@@ -138,6 +140,45 @@ describe("client IP resolution", () => {
 
 // ─── Health ──────────────────────────────────────────────────────────────
 
+describe("Cross-Origin-Resource-Policy", () => {
+    it("keeps API responses same-origin but lets served files be embedded", async () => {
+        const { url, server } = await bootAppWith((app) => {
+            app.get("/api/v1/files/photos/size/pic.png", () => new Response("image"));
+        });
+
+        const api = await fetch(`${url}/health`);
+        expect(api.headers.get("Cross-Origin-Resource-Policy")).toBe("same-origin");
+
+        // Files are meant to be embedded by another origin (an `<img>` in the front).
+        const file = await fetch(`${url}/api/v1/files/photos/size/pic.png`);
+        expect(file.headers.get("Cross-Origin-Resource-Policy")).toBe("cross-origin");
+
+        server.stop(true);
+    });
+
+    it("honours server.security.crossOriginResourcePolicy", async () => {
+        cfg.server = { ...cfg.server, security: { crossOriginResourcePolicy: "cross-origin" } };
+        const { url, server } = await bootAppWith(() => {});
+
+        const res = await fetch(`${url}/health`);
+        expect(res.headers.get("Cross-Origin-Resource-Policy")).toBe("cross-origin");
+
+        server.stop(true);
+    });
+
+    it("honours server.files.crossOriginResourcePolicy", async () => {
+        cfg.server = { ...cfg.server, files: { crossOriginResourcePolicy: "same-origin" } };
+        const { url, server } = await bootAppWith((app) => {
+            app.get("/api/v1/files/photos/size/pic.png", () => new Response("image"));
+        });
+
+        const res = await fetch(`${url}/api/v1/files/photos/size/pic.png`);
+        expect(res.headers.get("Cross-Origin-Resource-Policy")).toBe("same-origin");
+
+        server.stop(true);
+    });
+});
+
 describe("GET /health", () => {
     it("returns metrics + client ip", async () => {
         const { url, server } = await bootAppWith(() => {});
@@ -212,3 +253,42 @@ describe("rate limiting (in-memory)", () => {
         server.stop(true);
     });
 });
+
+describe("access log sanitisation (#39)", () => {
+    it("removes sensitive headers", () => {
+        const headers = collectHeaders(new Headers({
+            authorization: "Bearer secret",
+            cookie: "sid=secret",
+            "x-api-key": "key-secret",
+            "x-team": "core",
+        }));
+        expect(headers["authorization"]).toBeUndefined();
+        expect(headers["cookie"]).toBeUndefined();
+        expect(headers["x-api-key"]).toBeUndefined();
+        expect(headers["x-team"]).toEqual(["core"]);
+    });
+
+    it("redacts sensitive query parameters", () => {
+        expect(redactUri("/api/v1/collections/users/find?token=secret&page=2"))
+            .toBe("/api/v1/collections/users/find?token=%5Bredacted%5D&page=2");
+        expect(redactUri("/health")).toBe("/health");
+        expect(redactUri("/x?query=hello")).toBe("/x?query=hello");
+    });
+});
+
+describe("body limit (#51)", () => {
+    it("rejects a request body over the 16MB default", async () => {
+        const { url, server } = await bootAppWith((app) => {
+            app.post("/echo", async (c) => c.json({ ok: true }));
+        });
+
+        const res = await fetch(`${url}/echo`, {
+            method: "POST",
+            headers: { "Content-Type": "application/json" },
+            body: "x".repeat(17 * 1024 * 1024),
+        });
+        expect(res.status).toBe(413);
+
+        server.stop(true);
+    });
+});

package/tests/jwt-tenant.test.ts

@@ -0,0 +1,165 @@
+import { describe, it, expect, beforeAll, afterAll } from "bun:test";
+import { createApp } from "../server/hono";
+import { formatConfig, cfg } from "../server/config";
+import { syncTenants } from "../database/tenant";
+import { useRest } from "../database/rest";
+import { jwt } from "../utils/func";
+
+/**
+ * #35 — a JWT is bound to its tenant: the login action signs a `tenant` claim,
+ * and a token only opens the routes of that tenant.
+ */
+
+const TA = "jwt-tenant-a";
+const TB = "jwt-tenant-b";
+const DB_A = "mongodb://localhost:27017/_JWT_TENANT_A";
+const DB_B = "mongodb://localhost:27017/_JWT_TENANT_B";
+const SECRET = "jwt-tenant-test-secret";
+
+let server: any;
+let url = "";
+let restA: InstanceType<typeof useRest>;
+let restB: InstanceType<typeof useRest>;
+
+function collectionFor(tenant: string) {
+    return {
+        _tenant_: tenant,
+        slug: "users",
+        fields: [{ name: "email", type: "string" }],
+        api: {
+            access: { "*": true },
+            auth: {
+                enabled: true,
+                onLogin: async ({ payload, jwt: signer, cookies }: any) => {
+                    const token = await signer.sign({ sub: payload.email });
+                    cookies.set("session", token);
+                    return { token, data: { email: payload.email } };
+                },
+                onLogout: async ({ cookies }: any) => {
+                    cookies.delete("session", { domain: ".example.com" });
+                },
+            },
+        },
+    };
+}
+
+async function login(tenant: string, email = "u@test"): Promise<{ status: number; token?: string }> {
+    const res = await fetch(`${url}/api/${tenant}/collections/users/login`, {
+        method: "POST",
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify({ payload: { email } }),
+    });
+    const body: any = await res.json();
+    return { status: res.status, token: body.token };
+}
+
+const withToken = (path: string, token?: string, method = "GET") =>
+    fetch(`${url}${path}`, { method, headers: token ? { Authorization: `Bearer ${token}` } : {} });
+
+beforeAll(async () => {
+    formatConfig({
+        server: { port: 4000, jwt: { secret: SECRET } },
+        tenants: [
+            { id: TA, dir: "src", database: { uri: DB_A } },
+            { id: TB, dir: "src", database: { uri: DB_B } },
+        ],
+    });
+    await syncTenants();
+    (cfg as any).collections = [collectionFor(TA), collectionFor(TB)];
+    restA = new useRest({ internal: false, tenant_id: TA });
+    restB = new useRest({ internal: false, tenant_id: TB });
+    const app = createApp();
+    server = Bun.serve({ port: 0, fetch: app.fetch });
+    url = server.url.href.replace(/\/$/, "");
+});
+
+afterAll(async () => {
+    try { await restA.db.dropDatabase(); } catch {}
+    try { await restB.db.dropDatabase(); } catch {}
+    try { server.stop(true); } catch {}
+    delete (cfg.server.jwt as any)?.requireTenantClaim;
+});
+
+describe("JWT — tenant claim (#35)", () => {
+    it("signs the tenant into the token", async () => {
+        const { status, token } = await login(TA);
+        expect(status).toBe(200);
+        expect(token).toBeString();
+
+        const verified = await jwt.verify(token!);
+        expect(verified.error).toBeNull();
+        expect(verified.value?.tenant).toBe(TA);
+    });
+
+    it("refuses a token on another tenant's collection API", async () => {
+        const token = (await login(TA)).token!;
+        const same = await withToken(`/api/${TA}/collections/users/find`, token, "POST");
+        expect(same.status).toBe(200);
+
+        const other = await withToken(`/api/${TB}/collections/users/find`, token, "POST");
+        expect(other.status).toBe(401);
+        expect(((await other.json()) as any).code).toBe("TENANT_MISMATCH");
+    });
+
+    it("refuses a token on another tenant's public config", async () => {
+        const token = (await login(TA)).token!;
+        expect((await withToken(`/_dnax/config/${TA}`, token)).status).toBe(200);
+
+        const other = await withToken(`/_dnax/config/${TB}`, token);
+        expect(other.status).toBe(401);
+        expect(((await other.json()) as any).code).toBe("TENANT_MISMATCH");
+    });
+
+    it("can require a tenant claim (legacy tokens rejected)", async () => {
+        cfg.server = { ...cfg.server, jwt: { ...cfg.server.jwt, requireTenantClaim: true } };
+
+        const legacy = await jwt.sign({ sub: "legacy" });
+        const rejected = await withToken(`/_dnax/config/${TA}`, legacy);
+        expect(rejected.status).toBe(401);
+        expect(((await rejected.json()) as any).code).toBe("TENANT_CLAIM_REQUIRED");
+
+        const withClaim = await jwt.sign({ sub: "new", tenant: TA });
+        expect((await withToken(`/_dnax/config/${TA}`, withClaim)).status).toBe(200);
+    });
+});
+
+describe("cookies — safe defaults and matching deletion (#48)", () => {
+    const cookiesOf = (res: Response): string => {
+        const list = typeof (res.headers as any).getSetCookie === "function"
+            ? (res.headers as any).getSetCookie()
+            : [res.headers.get("set-cookie")];
+        return (list as (string | null)[]).filter(Boolean).join("; ");
+    };
+
+    it("sets HttpOnly / SameSite=Lax / Path=/ by default", async () => {
+        const res = await fetch(`${url}/api/${TA}/collections/users/login`, {
+            method: "POST",
+            headers: { "Content-Type": "application/json" },
+            body: JSON.stringify({ payload: { email: "cookie@test" } }),
+        });
+        expect(res.status).toBe(200);
+        const cookie = cookiesOf(res);
+        expect(cookie).toContain("HttpOnly");
+        expect(cookie).toContain("SameSite=Lax");
+        expect(cookie).toContain("Path=/");
+    });
+
+    it("deletes the cookie with the same domain", async () => {
+        const login = await fetch(`${url}/api/${TA}/collections/users/login`, {
+            method: "POST",
+            headers: { "Content-Type": "application/json" },
+            body: JSON.stringify({ payload: { email: "cookie@test" } }),
+        });
+        const token = ((await login.json()) as any).token;
+
+        const res = await fetch(`${url}/api/${TA}/collections/users/logout`, {
+            method: "POST",
+            headers: { "Content-Type": "application/json", Authorization: `Bearer ${token}` },
+            body: JSON.stringify({ payload: {} }),
+        });
+        expect(res.status).toBe(200);
+        const cookie = cookiesOf(res);
+        expect(cookie).toContain("Domain=.example.com");
+        expect(cookie.toLowerCase()).toContain("max-age=0");
+    });
+});

package/tests/logger.test.ts

@@ -29,7 +29,7 @@ describe("logger", () => {
         logger.warn("careful", { code: "X" });
         logger.error("boom");
         await flush();
-        const lines = readLogLines("basic/anteros.log");
+        const lines = readLogLines("basic/app.log");
         expect(lines.length).toBe(4);
         const hello = lines.find((l) => l.msg === "hello")!;
         expect(hello.level).toBe("info");
@@ -47,7 +47,7 @@ describe("logger", () => {
         logger.warn("shown-warn");
         logger.error("shown-error");
         await flush();
-        const lines = readLogLines("filter/anteros.log");
+        const lines = readLogLines("filter/app.log");
         expect(lines.some((l) => l.msg === "hidden-info")).toBe(false);
         expect(lines.some((l) => l.msg === "hidden-debug")).toBe(false);
         expect(lines.some((l) => l.msg === "shown-warn")).toBe(true);
@@ -69,15 +69,15 @@ describe("logger", () => {
         logger.configure({ dir, file: true, console: false, maxSize: 200, maxFiles: 3 });
         for (let i = 0; i < 20; i++) logger.info(`line ${i} with some padding ${'x'.repeat(30)}`);
         await flush();
-        const rotated = fs.readdirSync(dir).filter((f) => f !== "anteros.log");
+        const rotated = fs.readdirSync(dir).filter((f) => f !== "app.log");
         // Dated naming: anteros-YYYY-MM-DD-N.log
-        const dated = /^anteros-\d{4}-\d{2}-\d{2}-\d+\.log$/;
+        const dated = /^\d{4}-\d{2}-\d{2}-\d+\.log$/;
         expect(rotated.length).toBeGreaterThan(0);
         expect(rotated.every((f) => dated.test(f))).toBe(true);
         // maxFiles: 3 → never more than 3 rotated files kept
         expect(rotated.length).toBeLessThanOrEqual(3);
         // the live file is never removed
-        expect(fs.existsSync(path.join(dir, "anteros.log"))).toBe(true);
+        expect(fs.existsSync(path.join(dir, "app.log"))).toBe(true);
     });
 
     it("handles circular / non-JSON meta safely", async () => {
@@ -87,9 +87,9 @@ describe("logger", () => {
         logger.info("circular meta", circular);
         logger.info("bigint meta", { n: 123n });
         await flush();
-        const lines = readLogLines("safe/anteros.log");
+        const lines = readLogLines("safe/app.log");
         expect(lines.some((l) => l.msg === "circular meta")).toBe(true);
-        const raw = fs.readFileSync(path.join(DIR, "safe", "anteros.log"), "utf-8");
+        const raw = fs.readFileSync(path.join(DIR, "safe", "app.log"), "utf-8");
         expect(raw).toContain("[Circular]");
         expect(lines.find((l) => l.msg === "bigint meta")!.n).toBe("123");
     });
@@ -98,7 +98,7 @@ describe("logger", () => {
         logger.configure({ dir: path.join(DIR, "ts"), file: true, console: false });
         logger.info("custom ts", { ts: 123.5, customField: 1 });
         await flush();
-        const lines = readLogLines("ts/anteros.log");
+        const lines = readLogLines("ts/app.log");
         expect(lines[0]!.ts).toBe(123.5);
         expect(lines[0]!.customField).toBe(1);
         expect(lines[0]!.msg).toBe("custom ts");
@@ -115,7 +115,7 @@ describe("logger", () => {
         await flush();
         console.log = orig;
 
-        const lines = readLogLines("fileonly/anteros.log");
+        const lines = readLogLines("fileonly/app.log");
         expect(lines.some((l) => l.msg === "Server started")).toBe(true);
         expect(lines.some((l) => l.msg === "visible info")).toBe(true);
         expect(out.some((l) => l.includes("visible info"))).toBe(true);
@@ -134,7 +134,7 @@ describe("logger", () => {
         await flush();
         console.log = orig;
 
-        const lines = readLogLines("filelevel/anteros.log");
+        const lines = readLogLines("filelevel/app.log");
         expect(lines.find((l) => l.msg === "default level")!.level).toBe("info");
         expect(lines.find((l) => l.msg === "explicit warn")!.level).toBe("warn");
         expect(lines.find((l) => l.msg === "explicit warn")!.b).toBe(2);
@@ -145,3 +145,55 @@ describe("logger", () => {
         expect(out.some((l) => l.includes("explicit error"))).toBe(false);
     });
 });
+
+describe("calendar rotation", () => {
+    it("archives the previous period and keeps only maxFiles archives (monthly)", async () => {
+        const dir = path.join(DIR, "monthly");
+        fs.mkdirSync(dir, { recursive: true });
+        const live = path.join(dir, "app.log");
+        fs.writeFileSync(live, '{"msg":"old month"}\n');
+        const old = new Date("2026-01-15T12:00:00Z");
+        fs.utimesSync(live, old, old);
+
+        // Older archives that must be pruned
+        for (let m = 1; m <= 12; m++) {
+            fs.writeFileSync(path.join(dir, `2025-${String(m).padStart(2, "0")}.log`), "x");
+        }
+
+        logger.configure({ dir, file: true, console: false, rotate: "monthly", maxFiles: 10 });
+        logger.info("new month");
+        await flush();
+
+        const files = fs.readdirSync(dir);
+        expect(files).toContain("app.log");
+        expect(files).toContain("2026-01.log"); // archived under the file's own period
+        expect(files.some((file) => file.includes("anteros"))).toBe(false);
+
+        const archives = files.filter((file) => /^\d{4}-\d{2}\.log$/.test(file));
+        expect(archives.length).toBeLessThanOrEqual(10);
+
+        // The live file only contains the new period
+        const liveLines = fs.readFileSync(live, "utf-8").trim().split("\n").filter(Boolean);
+        expect(liveLines.length).toBe(1);
+        expect(JSON.parse(liveLines[0]!).msg).toBe("new month");
+    });
+
+    it("uses the daily period for the archive name", async () => {
+        const dir = path.join(DIR, "daily");
+        fs.mkdirSync(dir, { recursive: true });
+        const live = path.join(dir, "app.log");
+        fs.writeFileSync(live, '{"msg":"old day"}\n');
+        const yesterday = new Date(Date.now() - 86_400_000);
+        fs.utimesSync(live, yesterday, yesterday);
+
+        logger.configure({ dir, file: true, console: false, rotate: "daily", maxFiles: 3 });
+        logger.info("new day");
+        await flush();
+
+        const expected = `${yesterday.getFullYear()}-${String(yesterday.getMonth() + 1).padStart(2, "0")}-${String(yesterday.getDate()).padStart(2, "0")}.log`;
+        const files = fs.readdirSync(dir);
+        expect(files).toContain(expected);
+        expect(files).toContain("app.log");
+        expect(files.every((file) => file.endsWith(".log"))).toBe(true);
+    });
+});

package/tests/messages.test.ts

@@ -1,23 +1,17 @@
-import { describe, it, expect, afterAll } from "bun:test";
+import { describe, it, expect } from "bun:test";
 import { normalizeMessages } from "../lib/messages";
 import { MAX_FILE_BYTES } from "../lib/attachment";
 
-/** A tiny local file server — the `file: { url }` path downloads through `fetch`. */
-const servers: Array<ReturnType<typeof Bun.serve>> = [];
-function serve(body: Uint8Array | string, contentType = "application/pdf") {
-    const server = Bun.serve({
-        port: 0,
-        hostname: "127.0.0.1",
-        fetch: () => new Response(body as any, { headers: { "Content-Type": contentType } }),
-    });
-    servers.push(server);
-    return `http://127.0.0.1:${server.port}/report.pdf`;
+/**
+ * Remote files (`file: { url }`) are fetched server-side: only **public HTTPS**
+ * targets are accepted (issue #30). `fetch` is stubbed — no network in the suite.
+ */
+function stubFetch(handler: (url: string) => Response | Promise<Response>): () => void {
+    const original = globalThis.fetch;
+    globalThis.fetch = (async (input: any) => handler(String(input))) as unknown as typeof fetch;
+    return () => { globalThis.fetch = original; };
 }
 
-afterAll(() => {
-    for (const server of servers) server.stop(true);
-});
-
 const first = async (input: any) => (await normalizeMessages(input))[0] as any;
 
 describe("normalizeMessages — the shapes it accepts", () => {
@@ -74,18 +68,73 @@ describe("normalizeMessages — content parts", () => {
         expect(message).toEqual({ role: "system", content: "a\nb" });
     });
 
-    it("downloads a remote file and inlines it as base64", async () => {
-        const url = serve("%PDF-1.7 payload");
-        const [message] = await normalizeMessages([
-            { role: "user", content: [{ type: "file", url, name: "invoice.pdf" }] },
-        ] as any);
+    it("downloads a public HTTPS file and inlines it as base64", async () => {
+        const restore = stubFetch(() => new Response("%PDF-1.7 payload", {
+            headers: { "Content-Type": "application/pdf" },
+        }));
+        try {
+            const [message] = await normalizeMessages([
+                { role: "user", content: [{ type: "file", url: "https://8.8.8.8/report.pdf", name: "invoice.pdf" }] },
+            ] as any);
+
+            const part: any = (message as any).content[0];
+            expect(part.type).toBe("file");
+            expect(part.name).toBe("invoice.pdf");
+            // The URL is gone — the payload travels as base64, which every provider takes
+            expect(part.url).toBeUndefined();
+            expect(Buffer.from(part.data, "base64").toString()).toBe("%PDF-1.7 payload");
+        } finally {
+            restore();
+        }
+    });
 
-        const part: any = (message as any).content[0];
-        expect(part.type).toBe("file");
-        expect(part.name).toBe("invoice.pdf");
-        // The URL is gone — the payload travels as base64, which every provider takes
-        expect(part.url).toBeUndefined();
-        expect(Buffer.from(part.data, "base64").toString()).toBe("%PDF-1.7 payload");
+    it("refuses remote files that are not public HTTPS (SSRF)", async () => {
+        const cases = [
+            "http://8.8.8.8/report.pdf",             // plain HTTP
+            "https://127.0.0.1/report.pdf",          // loopback
+            "https://10.0.0.1/report.pdf",           // RFC1918
+            "https://172.16.0.1/report.pdf",         // RFC1918
+            "https://192.168.1.1/report.pdf",        // RFC1918
+            "https://169.254.169.254/latest",        // cloud metadata
+            "https://[::1]/report.pdf",              // IPv6 loopback
+            "https://[fe80::1]/report.pdf",          // IPv6 link-local
+            "https://localhost/report.pdf",          // resolves to loopback
+            "https://user:pass@8.8.8.8/report.pdf",  // credentials in the URL
+        ];
+        for (const url of cases) {
+            const error: any = await normalizeMessages([
+                { role: "user", content: [{ type: "file", url, name: "x.pdf" }] },
+            ] as any).catch((err) => err);
+            expect({ url, code: error.code }).toEqual({ url, code: "AGENT_FILE_INVALID" });
+        }
+    });
+
+    it("refuses a redirect that lands on a private address", async () => {
+        const restore = stubFetch(() => new Response(null, {
+            status: 302,
+            headers: { location: "https://127.0.0.1/secret.pdf" },
+        }));
+        try {
+            const error: any = await normalizeMessages([
+                { role: "user", content: [{ type: "file", url: "https://8.8.8.8/report.pdf", name: "x.pdf" }] },
+            ] as any).catch((err) => err);
+            expect(error.code).toBe("AGENT_FILE_INVALID");
+        } finally {
+            restore();
+        }
+    });
+
+    it("reports an unreachable remote file without echoing the network error", async () => {
+        const restore = stubFetch(() => new Response("nope", { status: 404 }));
+        try {
+            const error: any = await normalizeMessages([
+                { role: "user", content: [{ type: "file", url: "https://8.8.8.8/missing.pdf", name: "x.pdf" }] },
+            ] as any).catch((err) => err);
+            expect(error.code).toBe("AGENT_FILE_NOT_FOUND");
+            expect(error.message).not.toContain("404");
+        } finally {
+            restore();
+        }
     });
 
     it("leaves a remote image as a URL — the provider fetches it", async () => {
@@ -107,12 +156,19 @@ describe("normalizeMessages — content parts", () => {
         }
     });
 
-    it("refuses a file that is too large", async () => {
-        const url = serve(new Uint8Array(MAX_FILE_BYTES + 1));
-        const error: any = await normalizeMessages([
-            { role: "user", content: [{ type: "file", url, name: "huge.pdf" }] },
-        ] as any).catch((err) => err);
-        expect(error.code).toBe("AGENT_FILE_TOO_LARGE");
+    it("refuses a streamed remote file that is too large", async () => {
+        const body = new Uint8Array(MAX_FILE_BYTES + 1);
+        const restore = stubFetch(() => new Response(new ReadableStream({
+            start(controller) { controller.enqueue(body); controller.close(); },
+        })));
+        try {
+            const error: any = await normalizeMessages([
+                { role: "user", content: [{ type: "file", url: "https://8.8.8.8/huge.pdf", name: "huge.pdf" }] },
+            ] as any).catch((err) => err);
+            expect(error.code).toBe("AGENT_FILE_TOO_LARGE");
+        } finally {
+            restore();
+        }
     });
 });