@asterxsk/kiln 0.3.0 → 0.4.0

package/agent.bak.20260905-190020/extensions/pi-web-access/test/search-providers.test.mjs

@@ -1,274 +0,0 @@
-import assert from "node:assert/strict";
-import { spawnSync } from "node:child_process";
-import { mkdtemp, writeFile } from "node:fs/promises";
-import { tmpdir } from "node:os";
-import { join } from "node:path";
-import { test } from "node:test";
-
-const exaModuleUrl = new URL("../exa.ts", import.meta.url).href;
-const searchModuleUrl = new URL("../gemini-search.ts", import.meta.url).href;
-
-function runChild(script, env) {
-	const childEnv = { ...process.env };
-	for (const key of [
-		"PI_CODING_AGENT_DIR",
-		"XDG_CONFIG_HOME",
-		"EXA_API_KEY",
-		"EXA_BASE_URL",
-	]) {
-		delete childEnv[key];
-	}
-	Object.assign(childEnv, env);
-	return spawnSync(process.execPath, ["--input-type=module"], {
-		input: script,
-		encoding: "utf8",
-		env: childEnv,
-		maxBuffer: 2 * 1024 * 1024,
-	});
-}
-
-test("Exa direct API key ignores full legacy usage counter", async () => {
-	const home = await mkdtemp(join(tmpdir(), "pi-web-access-exa-paid-"));
-	const child = runChild(`
-		const dir = ${JSON.stringify(home)};
-		const { readFileSync, writeFileSync } = await import("node:fs");
-		writeFileSync(dir + "/web-search.json", JSON.stringify({ exaApiKey: "exa-paid-key" }));
-		writeFileSync(dir + "/exa-usage.json", JSON.stringify({ month: new Date().toISOString().slice(0, 7), count: 1000 }));
-
-		let capturedUrl = "";
-		let capturedHeaders = null;
-		let capturedBody = null;
-		globalThis.fetch = async (url, init) => {
-			capturedUrl = String(url);
-			capturedHeaders = init.headers;
-			capturedBody = JSON.parse(init.body);
-			return new Response(JSON.stringify({
-				answer: "Paid Exa answer",
-				citations: [{ title: "Exa Docs", url: "https://exa.ai/docs" }],
-			}), { status: 200, headers: { "content-type": "application/json" } });
-		};
-
-		const { isExaAvailable, searchWithExa } = await import(${JSON.stringify(exaModuleUrl)});
-		const available = isExaAvailable();
-		const result = await searchWithExa("paid exa query");
-		const usage = JSON.parse(readFileSync(dir + "/exa-usage.json", "utf8"));
-		console.log(JSON.stringify({
-			available,
-			capturedUrl,
-			capturedBody,
-			apiKey: capturedHeaders["x-api-key"],
-			integration: capturedHeaders["x-exa-integration"],
-			result,
-			usage,
-		}));
-	`, {
-		HOME: home,
-		USERPROFILE: home,
-		PI_CODING_AGENT_DIR: home,
-	});
-
-	assert.equal(child.status, 0, child.stderr);
-	const output = JSON.parse(child.stdout.trim());
-	assert.equal(output.available, true);
-	assert.equal(output.capturedUrl, "https://api.exa.ai/answer");
-	assert.deepEqual(output.capturedBody, { query: "paid exa query" });
-	assert.equal(output.apiKey, "exa-paid-key");
-	assert.equal(output.integration, "pi-web-access");
-	assert.equal(output.result.answer, "Paid Exa answer");
-	assert.deepEqual(output.result.results, [{ title: "Exa Docs", url: "https://exa.ai/docs", snippet: "" }]);
-	assert.equal(output.usage.count, 1000);
-});
-
-test("Exa command source is lazy, overrides stale env, and rotates per request", async () => {
-	const home = await mkdtemp(join(tmpdir(), "pi-web-access-exa-command-"));
-	const helperPath = join(home, "read-key.mjs");
-	const counterPath = join(home, "counter");
-	await writeFile(helperPath, `import { existsSync, readFileSync, writeFileSync } from "node:fs";\nconst counterPath = process.argv[2];\nconst count = (existsSync(counterPath) ? Number(readFileSync(counterPath, "utf8")) : 0) + 1;\nwriteFileSync(counterPath, String(count));\nprocess.stdout.write("synthetic-exa-" + count);\n`, "utf8");
-	await writeFile(join(home, "web-search.json"), JSON.stringify({
-		exaApiKey: `!${JSON.stringify(process.execPath)} ${JSON.stringify(helperPath)} ${JSON.stringify(counterPath)}`,
-	}) + "\n", "utf8");
-
-	const child = runChild(`
-		import { existsSync } from "node:fs";
-		const keys = [];
-		globalThis.fetch = async (_url, init) => {
-			keys.push(init.headers["x-api-key"]);
-			return new Response(JSON.stringify({ answer: "ok", citations: [] }), {
-				status: 200,
-				headers: { "content-type": "application/json" },
-			});
-		};
-		const { hasExaApiKey, searchWithExa } = await import(${JSON.stringify(exaModuleUrl)});
-		const available = hasExaApiKey();
-		const lazy = !existsSync(${JSON.stringify(counterPath)});
-		await searchWithExa("first");
-		await searchWithExa("second");
-		console.log(JSON.stringify({ available, lazy, keys }));
-	`, {
-		HOME: home,
-		USERPROFILE: home,
-		PI_CODING_AGENT_DIR: home,
-		EXA_API_KEY: "stale-exa-environment-value",
-	});
-
-	assert.equal(child.status, 0, child.stderr);
-	assert.deepEqual(JSON.parse(child.stdout.trim()), {
-		available: true,
-		lazy: true,
-		keys: ["synthetic-exa-1", "synthetic-exa-2"],
-	});
-});
-
-test("failed Exa command source is redacted and fails closed", async () => {
-	const home = await mkdtemp(join(tmpdir(), "pi-web-access-exa-command-failure-"));
-	const commandPath = join(home, "fail-key.mjs");
-	await writeFile(commandPath, `process.stderr.write("SYNTHETIC_SECRET_MUST_NOT_ESCAPE\\n");\nprocess.exit(9);\n`, "utf8");
-	await writeFile(join(home, "web-search.json"), JSON.stringify({
-		exaApiKey: `!${JSON.stringify(process.execPath)} ${JSON.stringify(commandPath)}`,
-	}) + "\n", "utf8");
-
-	const child = runChild(`
-		let fetchCalls = 0;
-		globalThis.fetch = async () => { fetchCalls += 1; throw new Error("unexpected fetch"); };
-		const { search } = await import(${JSON.stringify(searchModuleUrl)});
-		let message = "";
-		try {
-			await search("must fail closed");
-		} catch (error) {
-			message = error.message;
-		}
-		console.log(JSON.stringify({ fetchCalls, message }));
-	`, {
-		HOME: home,
-		USERPROFILE: home,
-		PI_CODING_AGENT_DIR: home,
-		EXA_API_KEY: "stale-exa-environment-value",
-	});
-
-	assert.equal(child.status, 0, child.stderr);
-	const output = JSON.parse(child.stdout.trim());
-	assert.equal(output.fetchCalls, 0);
-	assert.match(output.message, /^Exa credential resolution failed: command-failed$/);
-	assert.equal(output.message.includes("SYNTHETIC_SECRET_MUST_NOT_ESCAPE"), false);
-	assert.equal(output.message.includes(commandPath), false);
-});
-
-test("Exa provider errors redact the resolved credential", async () => {
-	const home = await mkdtemp(join(tmpdir(), "pi-web-access-exa-redaction-"));
-	const secret = "SYNTHETIC_EXA_SECRET_MUST_NOT_ESCAPE";
-	const child = runChild(`
-		globalThis.fetch = async () => new Response(${JSON.stringify("provider echoed SYNTHETIC_EXA_SECRET_MUST_NOT_ESCAPE")}, { status: 400 });
-		const { searchWithExa } = await import(${JSON.stringify(exaModuleUrl)});
-		let message = "";
-		try { await searchWithExa("redaction test"); }
-		catch (error) { message = error.message; }
-		console.log(JSON.stringify({ message }));
-	`, {
-		HOME: home,
-		USERPROFILE: home,
-		PI_CODING_AGENT_DIR: home,
-		EXA_API_KEY: secret,
-	});
-	assert.equal(child.status, 0, child.stderr);
-	const { message } = JSON.parse(child.stdout.trim());
-	assert.equal(message.includes(secret), false);
-	assert.equal(message.includes("[redacted]"), true);
-});
-
-test("keyless Exa search sends filters to the advanced MCP tool as parameters", async () => {
-	const home = await mkdtemp(join(tmpdir(), "pi-web-access-exa-mcp-advanced-"));
-	const child = runChild(`
-		let captured = null;
-		globalThis.fetch = async (url, init) => {
-			captured = { url: String(url), body: JSON.parse(init.body) };
-			return new Response(JSON.stringify({
-				jsonrpc: "2.0",
-				id: 1,
-				result: { content: [{ type: "text", text: JSON.stringify({ results: [{
-					title: "Advanced result",
-					url: "https://docs.example.com/advanced",
-					text: "full page text",
-					highlights: ["relevant highlight"],
-				}] }) }] },
-			}), { status: 200 });
-		};
-
-		const { searchWithExa } = await import(${JSON.stringify(exaModuleUrl)});
-		const result = await searchWithExa("semantic query", {
-			numResults: 3,
-			recencyFilter: "week",
-			domainFilter: ["docs.example.com", "-spam.example.net"],
-			includeContent: true,
-		});
-		console.log(JSON.stringify({ captured, result }));
-	`, {
-		HOME: home,
-		USERPROFILE: home,
-		PI_CODING_AGENT_DIR: home,
-	});
-
-	assert.equal(child.status, 0, child.stderr);
-	const { captured, result } = JSON.parse(child.stdout.trim());
-	assert.equal(captured.url, "https://mcp.exa.ai/mcp?tools=web_search_advanced_exa");
-	assert.equal(captured.body.params.name, "web_search_advanced_exa");
-
-	const { startPublishedDate, ...args } = captured.body.params.arguments;
-	assert.ok(startPublishedDate);
-	assert.deepEqual(args, {
-		query: "semantic query",
-		type: "auto",
-		numResults: 3,
-		includeDomains: ["docs.example.com"],
-		excludeDomains: ["spam.example.net"],
-		enableHighlights: true,
-		textMaxCharacters: 50000,
-	});
-
-	assert.deepEqual(result.results, [{ title: "Advanced result", url: "https://docs.example.com/advanced", snippet: "" }]);
-	assert.match(result.answer, /relevant highlight/);
-	assert.deepEqual(result.inlineContent, [{
-		url: "https://docs.example.com/advanced",
-		title: "Advanced result",
-		content: "full page text",
-		error: null,
-	}]);
-});
-
-test("keyless Exa search falls back to the default MCP tool when the advanced tool is missing", async () => {
-	const home = await mkdtemp(join(tmpdir(), "pi-web-access-exa-mcp-fallback-"));
-	const child = runChild(`
-		const tools = [];
-		globalThis.fetch = async (url, init) => {
-			const target = String(url);
-			tools.push(JSON.parse(init.body).params.name);
-			if (target.includes("web_search_advanced_exa")) {
-				return new Response(JSON.stringify({
-					jsonrpc: "2.0",
-					id: 1,
-					error: { code: -32602, message: "Tool web_search_advanced_exa not found" },
-				}), { status: 200 });
-			}
-			return new Response(JSON.stringify({
-				jsonrpc: "2.0",
-				id: 1,
-				result: { content: [{
-					type: "text",
-					text: "Title: Basic result\\nURL: https://example.com/basic\\nText: basic text\\n---",
-				}] },
-			}), { status: 200 });
-		};
-
-		const { searchWithExa } = await import(${JSON.stringify(exaModuleUrl)});
-		const result = await searchWithExa("fallback query", { domainFilter: ["example.com"] });
-		console.log(JSON.stringify({ tools, result }));
-	`, {
-		HOME: home,
-		USERPROFILE: home,
-		PI_CODING_AGENT_DIR: home,
-	});
-
-	assert.equal(child.status, 0, child.stderr);
-	const { tools, result } = JSON.parse(child.stdout.trim());
-	assert.deepEqual(tools, ["web_search_advanced_exa", "web_search_exa"]);
-	assert.deepEqual(result.results, [{ title: "Basic result", url: "https://example.com/basic", snippet: "" }]);
-});

package/agent.bak.20260905-190020/extensions/pi-web-access/test/source-check.test.mjs

@@ -1,179 +0,0 @@
-import assert from "node:assert/strict";
-import { test } from "node:test";
-
-import initializeExtension from "../index.ts";
-import {
-  assessClaim,
-  buildResearchArtifact,
-  buildPassages,
-  getResearchArtifact,
-  hashContent,
-  storeResearchArtifact,
-} from "../source-check.ts";
-import { clearResults } from "../storage.ts";
-
-const result = (url, snippet, rank = 1) => ({ url, title: "Example", snippet, rank });
-
-test("source-check creates a real SHA-256 hash and exact whitespace offsets", () => {
-  const content = "Intro.\n\nThe API\t supports streaming responses.\nTail.";
-  const passages = buildPassages(
-    [{ rank: 1, url: "https://docs.example.com/api", title: "API", snippet: "API supports streaming responses.", quality: "official_docs" }],
-    [{ url: "https://docs.example.com/api", title: "API", content, error: null }],
-  );
-  const pagePassage = passages.find((passage) => passage.extraction_span);
-  assert.ok(pagePassage);
-  assert.equal(pagePassage.text, "The API\t supports streaming responses.");
-  assert.equal(content.slice(pagePassage.extraction_span.start, pagePassage.extraction_span.end), pagePassage.text);
-  assert.equal(hashContent("abc"), "sha256:ba7816bf8f01cfea414140de5dae2223b00361a396177a9cb410ff61f20015ad");
-});
-
-test("fetched content supplies exact passages when the provider snippet is empty", () => {
-  const content = "The API supports streaming responses. Other details follow.";
-  const artifact = buildResearchArtifact({
-    query: "API supports streaming responses",
-    results: [result("https://docs.example.com/api", "")],
-    fetched: [{ url: "https://docs.example.com/api", title: "API", content, error: null }],
-  });
-  assert.deepEqual(artifact.passages.map((passage) => passage.text), ["The API supports streaming responses."]);
-  assert.deepEqual(artifact.passages[0].extraction_span, { start: 0, end: 37 });
-});
-
-test("artifact assembly handles omitted domain filters and failed fetches", () => {
-  const artifact = buildResearchArtifact({
-    query: "API claim",
-    results: [result("https://example.com/a", "The API is confirmed.")],
-    fetched: [{ url: "https://example.com/a", title: "Example", content: "", error: "blocked" }],
-  });
-  assert.equal(artifact.filters.domain_include.length, 0);
-  assert.equal(artifact.sources[0].fetched, false);
-  assert.equal(artifact.sources[0].fetch_error, "blocked");
-  assert.equal(artifact.sources[0].content_hash, undefined);
-  assert.equal(typeof artifact.sources[0].fetch_timestamp, "number");
-});
-
-test("claim assessment references passage IDs and stores a non-empty artifact ID", () => {
-  clearResults();
-  const artifact = buildResearchArtifact({
-    query: "API claim",
-    results: [result("https://example.com/a", "According to the API documentation, the API is confirmed.")],
-  });
-  const assessed = { ...artifact, claims: [assessClaim("API documentation is confirmed", artifact.passages)] };
-  storeResearchArtifact(assessed);
-  assert.ok(assessed.id);
-  assert.deepEqual(getResearchArtifact(assessed.id), assessed);
-  assert.deepEqual(assessed.claims[0].supporting_passages, ["p-1-0"]);
-});
-
-test("claim assessment ignores polarity substrings, negated markers, and discourse words", () => {
-  const claim = "API supports streaming responses";
-  const passage = (passage_id, text) => ({ passage_id, source_url: "https://example.com/api", source_rank: 1, text });
-  for (const [passage_id, text] of [
-    ["p-yesterday", "Yesterday, the API documentation discussed streaming responses."],
-    ["p-unverified", "The API is unverified; documentation discusses streaming responses."],
-    ["p-however", "However, the API supports streaming responses."],
-  ]) {
-    const assessment = assessClaim(claim, [passage(passage_id, text)]);
-    assert.equal(assessment.status, "unclear", text);
-    assert.deepEqual(assessment.supporting_passages, [], text);
-    assert.deepEqual(assessment.contradicting_passages, [], text);
-  }
-});
-
-function registerSourceCheck() {
-  const tools = [];
-  const entries = [];
-  initializeExtension({
-    registerTool(tool) { tools.push(tool); },
-    registerCommand() {},
-    registerShortcut() {},
-    on() {},
-    appendEntry(type, data) { entries.push({ type, data }); },
-  });
-  return { tool: tools.find((candidate) => candidate.name === "source_check"), entries };
-}
-
-test("source_check executes a successful Exa provider response with runtime context", async () => {
-  const previousFetch = globalThis.fetch;
-  const previousKey = process.env.EXA_API_KEY;
-  process.env.EXA_API_KEY = "source-check-test-key";
-  globalThis.fetch = async (url) => {
-    assert.equal(String(url), "https://api.exa.ai/answer");
-    return new Response(JSON.stringify({
-      answer: "The API supports streaming responses.",
-      citations: [{ title: "API docs", url: "https://docs.example.com/api" }],
-    }), { status: 200 });
-  };
-  try {
-    const { tool, entries } = registerSourceCheck();
-    const response = await tool.execute("call", { claim: "API supports streaming responses" }, undefined, undefined, { modelRegistry: {} });
-    assert.equal(response.details.sourceCount, 1);
-    assert.equal(response.details.passageCount, 0);
-    assert.equal(entries[0].type, "web-search-results");
-  } finally {
-    globalThis.fetch = previousFetch;
-    if (previousKey === undefined) delete process.env.EXA_API_KEY;
-    else process.env.EXA_API_KEY = previousKey;
-  }
-});
-
-test("source_check stops on cancellation instead of continuing queries", async () => {
-  const previousFetch = globalThis.fetch;
-  const previousKey = process.env.EXA_API_KEY;
-  let calls = 0;
-  const controller = new AbortController();
-  process.env.EXA_API_KEY = "source-check-test-key";
-  globalThis.fetch = async () => {
-    calls++;
-    controller.abort();
-    throw new Error("AbortError: canceled");
-  };
-  try {
-    const { tool } = registerSourceCheck();
-    const response = await tool.execute("call", { claim: "cancel this", queries: ["first", "second"] }, controller.signal, undefined, { modelRegistry: {} });
-    assert.equal(calls, 1);
-    assert.equal(response.details.sourceCount, 0);
-  } finally {
-    globalThis.fetch = previousFetch;
-    if (previousKey === undefined) delete process.env.EXA_API_KEY;
-    else process.env.EXA_API_KEY = previousKey;
-  }
-});
-
-test("source_check retains a rejected page fetch in the artifact", async () => {
-  const previousFetch = globalThis.fetch;
-  const previousKey = process.env.EXA_API_KEY;
-  process.env.EXA_API_KEY = "source-check-test-key";
-  globalThis.fetch = async (url) => {
-    if (String(url) === "https://api.exa.ai/answer") {
-      return new Response(JSON.stringify({
-        answer: "The API docs are available.",
-        citations: [{ title: "API docs", url: "https://example.com/api" }],
-      }), { status: 200 });
-    }
-    throw new Error("fetch rejected");
-  };
-  try {
-    const { tool } = registerSourceCheck();
-    const response = await tool.execute("call", { claim: "API docs", fetchContent: true }, undefined, undefined, { modelRegistry: {} });
-    assert.equal(response.details.sourceCount, 1);
-    assert.match(response.details.artifact.sources[0].fetch_error, /^fetch rejected/);
-  } finally {
-    globalThis.fetch = previousFetch;
-    if (previousKey === undefined) delete process.env.EXA_API_KEY;
-    else process.env.EXA_API_KEY = previousKey;
-  }
-});
-
-test("registered source_check validates the claim at runtime", async () => {
-  const tools = [];
-  initializeExtension({
-    registerTool(tool) { tools.push(tool); },
-    registerCommand() {},
-    registerShortcut() {},
-    on() {},
-  });
-  const tool = tools.find((candidate) => candidate.name === "source_check");
-  assert.ok(tool);
-  const response = await tool.execute("call", { claim: "   " });
-  assert.equal(response.details.error, "Missing claim");
-});

package/agent.bak.20260905-190020/extensions/pi-web-access/test/ssrf-allow-ranges-config.test.mjs

@@ -1,205 +0,0 @@
-import assert from "node:assert/strict";
-import { spawnSync } from "node:child_process";
-import { mkdir, mkdtemp, writeFile } from "node:fs/promises";
-import { tmpdir } from "node:os";
-import { join } from "node:path";
-import { test } from "node:test";
-
-const extractUrl = new URL("../extract.ts", import.meta.url).href;
-
-// `loadSsrfAllowRanges` reads the config path captured at module load, so each
-// case runs in a child process with PI_CODING_AGENT_DIR pointed at a temp dir.
-function runLoad(env) {
-	const childEnv = { ...process.env };
-	delete childEnv.PI_CODING_AGENT_DIR;
-	delete childEnv.XDG_CONFIG_HOME;
-	for (const [key, value] of Object.entries(env)) {
-		if (value === undefined) delete childEnv[key];
-		else childEnv[key] = value;
-	}
-	const script = `
-		const { loadSsrfAllowRanges } = await import(${JSON.stringify(extractUrl)});
-		try {
-			console.log(JSON.stringify({ ok: true, ranges: loadSsrfAllowRanges() }));
-		} catch (err) {
-			console.log(JSON.stringify({ ok: false, error: err instanceof Error ? err.message : String(err) }));
-		}
-	`;
-	const child = spawnSync(process.execPath, ["--input-type=module"], {
-		input: script,
-		encoding: "utf8",
-		env: childEnv,
-	});
-	assert.equal(child.status, 0, child.stderr);
-	return JSON.parse(child.stdout);
-}
-
-function runLoadConfig(env) {
-	const childEnv = { ...process.env };
-	delete childEnv.PI_CODING_AGENT_DIR;
-	delete childEnv.XDG_CONFIG_HOME;
-	for (const [key, value] of Object.entries(env)) {
-		if (value === undefined) delete childEnv[key];
-		else childEnv[key] = value;
-	}
-	const script = `
-		const { loadSsrfConfig } = await import(${JSON.stringify(extractUrl)});
-		try {
-			console.log(JSON.stringify({ ok: true, config: loadSsrfConfig() }));
-		} catch (err) {
-			console.log(JSON.stringify({ ok: false, error: err instanceof Error ? err.message : String(err) }));
-		}
-	`;
-	const child = spawnSync(process.execPath, ["--input-type=module"], {
-		input: script,
-		encoding: "utf8",
-		env: childEnv,
-	});
-	assert.equal(child.status, 0, child.stderr);
-	return JSON.parse(child.stdout);
-}
-
-async function makeConfigDir(prefix) {
-	const root = await mkdtemp(join(tmpdir(), prefix));
-	const agentDir = join(root, "agent-dir");
-	await mkdir(agentDir, { recursive: true });
-	return { root, agentDir, configPath: join(agentDir, "web-search.json") };
-}
-
-function envFor(root, agentDir) {
-	return {
-		PI_CODING_AGENT_DIR: agentDir,
-		HOME: join(root, "home"),
-		USERPROFILE: join(root, "home"),
-	};
-}
-
-test("loadSsrfConfig defaults trustEnvProxy to false", async () => {
-	const { root, agentDir, configPath } = await makeConfigDir("pi-ssrf-proxy-default-");
-	await writeFile(configPath, JSON.stringify({ ssrf: { allowRanges: ["198.18.0.0/15"] } }), "utf8");
-
-	const result = runLoadConfig(envFor(root, agentDir));
-	assert.equal(result.ok, true, result.error);
-	assert.deepEqual(result.config, { allowRanges: ["198.18.0.0/15"], trustEnvProxy: false });
-});
-
-test("loadFetchContentDomainPolicy reads normalized allow and deny hostnames", async () => {
-	const { root, agentDir, configPath } = await makeConfigDir("pi-domain-policy-valid-");
-	await writeFile(configPath, JSON.stringify({ fetchContent: { domainPolicy: { allow: [" Example.COM. "], deny: ["blocked.example.com"] } } }), "utf8");
-
-	const childEnv = envFor(root, agentDir);
-	const child = spawnSync(process.execPath, ["--input-type=module"], {
-		input: `
-			const { loadFetchContentDomainPolicy } = await import(${JSON.stringify(extractUrl.replace("/extract.ts", "/ssrf-protection.ts"))});
-			console.log(JSON.stringify(loadFetchContentDomainPolicy()));
-		`,
-		encoding: "utf8",
-		env: childEnv,
-	});
-	assert.equal(child.status, 0, child.stderr);
-	assert.deepEqual(JSON.parse(child.stdout), { allow: ["example.com"], deny: ["blocked.example.com"] });
-});
-
-test("loadFetchContentDomainPolicy rejects malformed policy values", async () => {
-	for (const domainPolicy of [
-		{ allow: "example.com" },
-		{ deny: ["*.example.com"] },
-		{ allow: ["example.com", 42] },
-	]) {
-		const { root, agentDir, configPath } = await makeConfigDir("pi-domain-policy-invalid-");
-		await writeFile(configPath, JSON.stringify({ fetchContent: { domainPolicy } }), "utf8");
-		const childEnv = envFor(root, agentDir);
-		const child = spawnSync(process.execPath, ["--input-type=module"], {
-			input: `
-				const { loadFetchContentDomainPolicy } = await import(${JSON.stringify(extractUrl.replace("/extract.ts", "/ssrf-protection.ts"))});
-				try { loadFetchContentDomainPolicy(); console.log(JSON.stringify({ ok: true })); }
-				catch (err) { console.log(JSON.stringify({ ok: false, error: err.message })); }
-			`,
-			encoding: "utf8",
-			env: childEnv,
-		});
-		assert.equal(child.status, 0, child.stderr);
-		const result = JSON.parse(child.stdout);
-		assert.equal(result.ok, false, JSON.stringify(domainPolicy));
-		assert.match(result.error, /fetchContent\.domainPolicy\.(allow|deny)/);
-	}
-});
-
-test("loadSsrfConfig accepts an explicit trustEnvProxy opt-in", async () => {
-	const { root, agentDir, configPath } = await makeConfigDir("pi-ssrf-proxy-enabled-");
-	await writeFile(configPath, JSON.stringify({ ssrf: { trustEnvProxy: true } }), "utf8");
-
-	const result = runLoadConfig(envFor(root, agentDir));
-	assert.equal(result.ok, true, result.error);
-	assert.deepEqual(result.config, { allowRanges: [], trustEnvProxy: true });
-});
-
-test("loadSsrfConfig rejects a non-boolean trustEnvProxy value", async () => {
-	const { root, agentDir, configPath } = await makeConfigDir("pi-ssrf-proxy-invalid-");
-	await writeFile(configPath, JSON.stringify({ ssrf: { trustEnvProxy: "yes" } }), "utf8");
-
-	const result = runLoadConfig(envFor(root, agentDir));
-	assert.equal(result.ok, false);
-	assert.match(result.error, /ssrf\.trustEnvProxy in .* must be a boolean/);
-});
-
-test("loadSsrfAllowRanges throws when ssrf.allowRanges is not an array", async () => {
-	// Regression: a mistyped non-array value (bare string, object, number) must
-	// fail loudly instead of being silently ignored as "no exemptions".
-	for (const allowRanges of ["198.18.0.0/15", { "198.18.0.0/15": true }, 42]) {
-		const { root, agentDir, configPath } = await makeConfigDir("pi-ssrf-nonarray-");
-		await writeFile(configPath, JSON.stringify({ ssrf: { allowRanges } }), "utf8");
-
-		const result = runLoad(envFor(root, agentDir));
-		assert.equal(result.ok, false, `expected throw for ${JSON.stringify(allowRanges)}`);
-		assert.match(result.error, /ssrf\.allowRanges in .* must be an array of CIDR strings/);
-	}
-});
-
-test("loadSsrfAllowRanges throws when an ssrf.allowRanges entry is not a string", async () => {
-	const { root, agentDir, configPath } = await makeConfigDir("pi-ssrf-entry-type-");
-	await writeFile(configPath, JSON.stringify({ ssrf: { allowRanges: ["198.18.0.0/15", 123] } }), "utf8");
-
-	const result = runLoad(envFor(root, agentDir));
-	assert.equal(result.ok, false);
-	assert.match(result.error, /ssrf\.allowRanges in .* must contain only CIDR strings; entry 2 is number/);
-});
-
-test("loadSsrfAllowRanges returns trimmed, non-empty CIDR strings for a valid array", async () => {
-	const { root, agentDir, configPath } = await makeConfigDir("pi-ssrf-valid-");
-	await writeFile(
-		configPath,
-		JSON.stringify({ ssrf: { allowRanges: ["198.18.0.0/15", "  fd00::/8  ", "", "   "] } }),
-		"utf8",
-	);
-
-	const result = runLoad(envFor(root, agentDir));
-	assert.equal(result.ok, true, result.error);
-	assert.deepEqual(result.ranges, ["198.18.0.0/15", "fd00::/8"]);
-});
-
-test("loadSsrfAllowRanges returns [] when the config file is missing", async () => {
-	const { root, agentDir } = await makeConfigDir("pi-ssrf-missing-");
-	// Intentionally do not write web-search.json.
-	const result = runLoad(envFor(root, agentDir));
-	assert.equal(result.ok, true, result.error);
-	assert.deepEqual(result.ranges, []);
-});
-
-test("loadSsrfAllowRanges returns [] when ssrf.allowRanges is unset", async () => {
-	const { root, agentDir, configPath } = await makeConfigDir("pi-ssrf-unset-");
-	await writeFile(configPath, JSON.stringify({ perplexityApiKey: "pplx-x" }), "utf8");
-
-	const result = runLoad(envFor(root, agentDir));
-	assert.equal(result.ok, true, result.error);
-	assert.deepEqual(result.ranges, []);
-});
-
-test("loadSsrfAllowRanges reports malformed config JSON", async () => {
-	const { root, agentDir, configPath } = await makeConfigDir("pi-ssrf-badjson-");
-	await writeFile(configPath, "{ not valid json", "utf8");
-
-	const result = runLoad(envFor(root, agentDir));
-	assert.equal(result.ok, false);
-	assert.match(result.error, /Failed to parse .*web-search\.json/);
-});