@aria-cli/tools 1.0.9 → 1.0.11

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@aria-cli/tools",
-  "version": "1.0.9",
+  "version": "1.0.11",
   "type": "module",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
@@ -31,12 +31,12 @@
     "vscode-languageserver-protocol": "^3.17.5",
     "zod": "^4.3.6",
     "zod-to-json-schema": "^3.25.1",
+    "@aria-cli/fastripgrep": "1.0.11",
     "@aria-cli/search": "0.1.0",
-    "@aria-cli/types": "1.0.9",
-    "@aria-cli/fastripgrep": "1.0.9"
+    "@aria-cli/types": "1.0.11"
   },
   "optionalDependencies": {
-    "@aria-cli/cli": "1.0.9"
+    "@aria-cli/cli": "1.0.11"
   },
   "devDependencies": {
     "@types/jsdom": "^28.0.0",
@@ -44,8 +44,12 @@
     "@types/turndown": "^5.0.6",
     "typescript": "^5.9.3",
     "vitest": "^4.0.18",
-    "@aria-cli/memoria": "1.0.9"
+    "@aria-cli/memoria": "1.0.11"
   },
+  "files": [
+    "dist/",
+    "dist-cjs/"
+  ],
   "scripts": {
     "dev": "tsc --watch",
     "test": "vitest run --config vitest.config.ts",

package/src/__tests__/web-fetch-download.test.ts

@@ -1,433 +0,0 @@
-/**
- * @aria/tools - Web fetch tool tests
- *
- * Tests for executeWebFetch executor.
- * Covers URL validation, SSRF protection, format parsing, and size limits.
- * All external calls (fetch, dns) are mocked -- no real network traffic.
- */
-
-import * as dns from "node:dns";
-import { describe, it, expect, beforeEach, afterEach, vi } from "vitest";
-import type { ToolContext } from "../types.js";
-import { executeWebFetch } from "../executors/web.js";
-import { fetchCache } from "../cache/web-cache.js";
-
-vi.mock("node:dns", () => ({
-  promises: {
-    lookup: vi.fn(),
-  },
-}));
-
-const createContext = (overrides: Partial<ToolContext> = {}): ToolContext => ({
-  workingDir: "/tmp/test",
-  env: {},
-  confirm: async () => true,
-  ...overrides,
-});
-
-/** Helper to create a mock Response with a readable body stream. */
-function mockResponse(body: string | Uint8Array, init?: ResponseInit): Response {
-  return new Response(body, init);
-}
-
-/**
- * Creates a chunked ReadableStream that yields data in small pieces,
- * useful for testing streaming size limits without Content-Length.
- */
-function chunkedResponse(chunks: Uint8Array[], init?: ResponseInit): Response {
-  const stream = new ReadableStream<Uint8Array>({
-    start(controller) {
-      for (const chunk of chunks) {
-        controller.enqueue(chunk);
-      }
-      controller.close();
-    },
-  });
-  return new Response(stream, init);
-}
-
-// ============================================================================
-// executeWebFetch
-// ============================================================================
-
-describe("executeWebFetch", () => {
-  let originalFetch: typeof global.fetch;
-
-  beforeEach(() => {
-    originalFetch = global.fetch;
-    fetchCache.clear();
-    // Default: resolve to public IP
-    vi.mocked(dns.promises.lookup).mockResolvedValue({
-      address: "93.184.216.34",
-      family: 4,
-    });
-  });
-
-  afterEach(() => {
-    global.fetch = originalFetch;
-    vi.restoreAllMocks();
-  });
-
-  // ---------- URL validation ----------
-
-  it("rejects invalid URL format", async () => {
-    const ctx = createContext();
-    const result = await executeWebFetch({ url: "not-a-url" }, ctx);
-
-    expect(result.success).toBe(false);
-    expect(result.message).toContain("Invalid URL");
-  });
-
-  it("rejects non-HTTP protocols", async () => {
-    const ctx = createContext();
-    const result = await executeWebFetch({ url: "ftp://files.example.com/data" }, ctx);
-
-    expect(result.success).toBe(false);
-    expect(result.message).toContain("protocol");
-  });
-
-  it("rejects file:// protocol", async () => {
-    const ctx = createContext();
-    const result = await executeWebFetch({ url: "file:///etc/passwd" }, ctx);
-
-    expect(result.success).toBe(false);
-    expect(result.message).toContain("protocol");
-  });
-
-  // ---------- SSRF protection ----------
-
-  it("rejects hostname resolving to loopback (127.0.0.1)", async () => {
-    vi.mocked(dns.promises.lookup).mockResolvedValue({
-      address: "127.0.0.1",
-      family: 4,
-    });
-
-    const ctx = createContext();
-    const result = await executeWebFetch({ url: "https://evil.example.com" }, ctx);
-
-    expect(result.success).toBe(false);
-    expect(result.message).toContain("private network");
-    expect(result.message).toContain("127.0.0.1");
-  });
-
-  it("rejects hostname resolving to AWS metadata (169.254.169.254)", async () => {
-    vi.mocked(dns.promises.lookup).mockResolvedValue({
-      address: "169.254.169.254",
-      family: 4,
-    });
-
-    const ctx = createContext();
-    const result = await executeWebFetch({ url: "https://metadata.example.com" }, ctx);
-
-    expect(result.success).toBe(false);
-    expect(result.message).toContain("private network");
-    expect(result.message).toContain("169.254.169.254");
-  });
-
-  it("rejects hostname resolving to 10.x private range", async () => {
-    vi.mocked(dns.promises.lookup).mockResolvedValue({
-      address: "10.0.0.1",
-      family: 4,
-    });
-
-    const ctx = createContext();
-    const result = await executeWebFetch({ url: "https://internal.corp" }, ctx);
-
-    expect(result.success).toBe(false);
-    expect(result.message).toContain("private network");
-  });
-
-  it("rejects hostname resolving to 192.168.x private range", async () => {
-    vi.mocked(dns.promises.lookup).mockResolvedValue({
-      address: "192.168.1.1",
-      family: 4,
-    });
-
-    const ctx = createContext();
-    const result = await executeWebFetch({ url: "https://router.local" }, ctx);
-
-    expect(result.success).toBe(false);
-    expect(result.message).toContain("private network");
-  });
-
-  it("rejects hostname resolving to IPv6 loopback (::1)", async () => {
-    vi.mocked(dns.promises.lookup).mockResolvedValue({
-      address: "::1",
-      family: 6,
-    });
-
-    const ctx = createContext();
-    const result = await executeWebFetch({ url: "https://ipv6-loop.example.com" }, ctx);
-
-    expect(result.success).toBe(false);
-    expect(result.message).toContain("private network");
-  });
-
-  it("allows hostname resolving to public IP (8.8.8.8)", async () => {
-    vi.mocked(dns.promises.lookup).mockResolvedValue({
-      address: "8.8.8.8",
-      family: 4,
-    });
-
-    vi.stubGlobal(
-      "fetch",
-      vi.fn().mockResolvedValue(mockResponse("public content", { status: 200 })),
-    );
-
-    const ctx = createContext();
-    const result = await executeWebFetch({ url: "https://safe.example.com" }, ctx);
-
-    expect(result.success).toBe(true);
-  });
-
-  it("returns error when DNS lookup fails", async () => {
-    vi.mocked(dns.promises.lookup).mockRejectedValue(
-      new Error("getaddrinfo ENOTFOUND nope.invalid"),
-    );
-
-    const ctx = createContext();
-    const result = await executeWebFetch({ url: "https://nope.invalid" }, ctx);
-
-    expect(result.success).toBe(false);
-    expect(result.message).toContain("DNS resolution failed");
-  });
-
-  // ---------- Format parsing ----------
-
-  it("returns text content wrapped with security boundaries by default", async () => {
-    vi.stubGlobal(
-      "fetch",
-      vi.fn().mockResolvedValue(
-        mockResponse("Hello, world!", {
-          status: 200,
-          headers: { "Content-Type": "text/plain" },
-        }),
-      ),
-    );
-
-    const ctx = createContext();
-    const result = await executeWebFetch({ url: "https://example.com/text" }, ctx);
-
-    expect(result.success).toBe(true);
-    const data = result.data as { content: string; status: number };
-    // Text content is now wrapped with external content security boundaries
-    expect(data.content).toContain("Hello, world!");
-    expect(data.content).toContain("EXTERNAL_UNTRUSTED_CONTENT");
-    expect(data.content).toContain("[Source: web_fetch]");
-    expect(data.status).toBe(200);
-  });
-
-  it("returns HTML content wrapped with security boundaries for format=html", async () => {
-    const html = "<html><body><p>Content</p></body></html>";
-    vi.stubGlobal(
-      "fetch",
-      vi.fn().mockResolvedValue(
-        mockResponse(html, {
-          status: 200,
-          headers: { "Content-Type": "text/html" },
-        }),
-      ),
-    );
-
-    const ctx = createContext();
-    const result = await executeWebFetch({ url: "https://example.com/page", format: "html" }, ctx);
-
-    expect(result.success).toBe(true);
-    const data = result.data as { content: string; contentType: string };
-    // HTML content is now wrapped with security boundaries
-    expect(data.content).toContain(html);
-    expect(data.content).toContain("EXTERNAL_UNTRUSTED_CONTENT");
-    expect(data.contentType).toBe("text/html");
-  });
-
-  it("parses JSON content with format=json", async () => {
-    const obj = { name: "aria", version: 1 };
-    vi.stubGlobal(
-      "fetch",
-      vi.fn().mockResolvedValue(
-        mockResponse(JSON.stringify(obj), {
-          status: 200,
-          headers: { "Content-Type": "application/json" },
-        }),
-      ),
-    );
-
-    const ctx = createContext();
-    const result = await executeWebFetch(
-      { url: "https://api.example.com/data", format: "json" },
-      ctx,
-    );
-
-    expect(result.success).toBe(true);
-    const data = result.data as { content: { name: string; version: number } };
-    expect(data.content).toEqual({ name: "aria", version: 1 });
-  });
-
-  it("returns error for invalid JSON with format=json", async () => {
-    vi.stubGlobal(
-      "fetch",
-      vi.fn().mockResolvedValue(mockResponse("not json {{{", { status: 200 })),
-    );
-
-    const ctx = createContext();
-    const result = await executeWebFetch(
-      { url: "https://example.com/bad-json", format: "json" },
-      ctx,
-    );
-
-    expect(result.success).toBe(false);
-    expect(result.message).toContain("parse JSON");
-  });
-
-  // ---------- Size limits ----------
-
-  it("rejects responses exceeding Content-Length limit", async () => {
-    vi.stubGlobal(
-      "fetch",
-      vi.fn().mockResolvedValue(
-        mockResponse("x", {
-          status: 200,
-          headers: { "Content-Length": "999999999" },
-        }),
-      ),
-    );
-
-    const ctx = createContext();
-    const result = await executeWebFetch(
-      { url: "https://example.com/huge", maxSizeBytes: 1024 },
-      ctx,
-    );
-
-    expect(result.success).toBe(false);
-    expect(result.message).toContain("too large");
-  });
-
-  it("rejects chunked responses exceeding streaming size limit", async () => {
-    // Create chunks that exceed a small limit, without Content-Length header
-    const chunk1 = new Uint8Array(600).fill(65); // 'A' * 600
-    const chunk2 = new Uint8Array(600).fill(66); // 'B' * 600
-
-    vi.stubGlobal(
-      "fetch",
-      vi.fn().mockResolvedValue(chunkedResponse([chunk1, chunk2], { status: 200 })),
-    );
-
-    const ctx = createContext();
-    const result = await executeWebFetch(
-      { url: "https://example.com/stream", maxSizeBytes: 1000 },
-      ctx,
-    );
-
-    expect(result.success).toBe(false);
-    expect(result.message).toContain("exceeds maximum size");
-  });
-
-  it("accepts responses within size limit", async () => {
-    const content = "A".repeat(500);
-    vi.stubGlobal("fetch", vi.fn().mockResolvedValue(mockResponse(content, { status: 200 })));
-
-    const ctx = createContext();
-    const result = await executeWebFetch(
-      { url: "https://example.com/small", maxSizeBytes: 1024 },
-      ctx,
-    );
-
-    expect(result.success).toBe(true);
-    const data = result.data as { content: string };
-    // Content is now wrapped with security boundaries
-    expect(data.content).toContain(content);
-  });
-
-  // ---------- Custom headers ----------
-
-  it("passes custom headers to the request", async () => {
-    const mockFetch = vi.fn().mockResolvedValue(mockResponse("ok", { status: 200 }));
-    vi.stubGlobal("fetch", mockFetch);
-
-    const ctx = createContext();
-    await executeWebFetch(
-      {
-        url: "https://example.com/api",
-        headers: { Authorization: "Bearer token123", "X-Custom": "value" },
-      },
-      ctx,
-    );
-
-    expect(mockFetch).toHaveBeenCalledWith(
-      "https://example.com/api",
-      expect.objectContaining({
-        headers: { Authorization: "Bearer token123", "X-Custom": "value" },
-      }),
-    );
-  });
-
-  // ---------- Abort signal ----------
-
-  it("handles context abort signal", async () => {
-    vi.stubGlobal(
-      "fetch",
-      vi.fn().mockImplementation((_url: string, options?: RequestInit) => {
-        return new Promise((_resolve, reject) => {
-          const signal = options?.signal;
-          if (signal) {
-            signal.addEventListener("abort", () => {
-              const err = new Error("The operation was aborted");
-              err.name = "AbortError";
-              reject(err);
-            });
-          }
-        });
-      }),
-    );
-
-    const abortController = new AbortController();
-    const ctx = createContext({ abortSignal: abortController.signal });
-
-    setTimeout(() => abortController.abort(), 10);
-    const result = await executeWebFetch({ url: "https://example.com/slow" }, ctx);
-
-    expect(result.success).toBe(false);
-    expect(result.message).toContain("cancelled");
-  });
-
-  // ---------- HTTP errors ----------
-
-  it("returns error for non-OK HTTP status", async () => {
-    vi.stubGlobal(
-      "fetch",
-      vi.fn().mockResolvedValue(
-        mockResponse("Forbidden", {
-          status: 403,
-          statusText: "Forbidden",
-        }),
-      ),
-    );
-
-    const ctx = createContext();
-    const result = await executeWebFetch({ url: "https://example.com/secret" }, ctx);
-
-    expect(result.success).toBe(false);
-    expect(result.message).toContain("403");
-  });
-
-  it("includes contentType in successful response", async () => {
-    vi.stubGlobal(
-      "fetch",
-      vi.fn().mockResolvedValue(
-        mockResponse("data", {
-          status: 200,
-          headers: { "Content-Type": "text/csv; charset=utf-8" },
-        }),
-      ),
-    );
-
-    const ctx = createContext();
-    const result = await executeWebFetch({ url: "https://example.com/data.csv" }, ctx);
-
-    expect(result.success).toBe(true);
-    const data = result.data as { contentType: string };
-    expect(data.contentType).toBe("text/csv; charset=utf-8");
-  });
-});
-
-// download tool removed in aria-c3x