@dexto/tools-builtins 1.15.0 → 1.16.0

package/dist/implementations/http-request-tool.cjs

@@ -52,6 +52,7 @@ function safeJsonParse(text) {
 }
 const BLOCKED_HOSTNAMES = /* @__PURE__ */ new Set(["localhost"]);
 const MAX_RESPONSE_BYTES = 5 * 1024 * 1024;
+const MAX_REDIRECTS = 20;
 const SAFE_DISPATCHER = createSafeDispatcher();
 function isPrivateIpv4(ip) {
   const parts = ip.split(".").map((part) => Number(part));
@@ -82,20 +83,26 @@ function isPrivateIpv4(ip) {
   return false;
 }
 function isPrivateIpv6(ip) {
-  const normalized = ip.toLowerCase();
+  const normalized = new URL(`http://[${ip.split("%")[0]}]/`).hostname.slice(1, -1);
   if (normalized === "::" || normalized === "::1") return true;
-  if (normalized.startsWith("fe80:")) return true;
+  if (normalized.startsWith("64:ff9b:1:")) return true;
+  if (/^fe[89ab][0-9a-f]:/.test(normalized)) return true;
   if (normalized.startsWith("fc") || normalized.startsWith("fd")) return true;
   if (normalized.startsWith("::ffff:")) {
-    const ipv4Part = normalized.slice("::ffff:".length);
-    return isPrivateIpv4(ipv4Part);
+    const parts = normalized.slice("::ffff:".length).split(":");
+    if (parts.length === 2) {
+      const high = Number.parseInt(parts[0] ?? "", 16);
+      const low = Number.parseInt(parts[1] ?? "", 16);
+      return isPrivateIpv4(`${high >> 8}.${high & 255}.${low >> 8}.${low & 255}`);
+    }
   }
   return false;
 }
 function isPrivateAddress(ip) {
-  const version = (0, import_node_net.isIP)(ip);
-  if (version === 4) return isPrivateIpv4(ip);
-  if (version === 6) return isPrivateIpv6(ip);
+  const address = ip.startsWith("[") && ip.endsWith("]") ? ip.slice(1, -1) : ip;
+  const version = (0, import_node_net.isIP)(address);
+  if (version === 4) return isPrivateIpv4(address);
+  if (version === 6) return isPrivateIpv6(address);
   return false;
 }
 function createSafeLookup(config) {
@@ -331,7 +338,39 @@ function createHttpRequestTool() {
         if (requestBody !== void 0) {
           requestInit.body = requestBody;
         }
-        const response = await fetch(requestUrl.toString(), requestInit);
+        requestInit.redirect = "manual";
+        let currentUrl = requestUrl;
+        let response;
+        for (let redirects = 0; ; redirects++) {
+          await assertSafeUrl(currentUrl);
+          response = await fetch(currentUrl.toString(), requestInit);
+          const location = response.headers.get("location");
+          if (![301, 302, 303, 307, 308].includes(response.status) || !location) break;
+          await response.body?.cancel();
+          if (redirects >= MAX_REDIRECTS) {
+            throw new import_errors.DextoRuntimeError(
+              "HTTP_REQUEST_TOO_MANY_REDIRECTS",
+              import_errors.ErrorScope.TOOLS,
+              import_errors.ErrorType.THIRD_PARTY,
+              `HTTP request exceeded ${MAX_REDIRECTS} redirects`
+            );
+          }
+          const nextUrl = new URL(location, currentUrl);
+          if (nextUrl.origin !== currentUrl.origin) {
+            for (const key of Object.keys(requestHeaders)) {
+              delete requestHeaders[key];
+            }
+          }
+          if (response.status === 303 || (response.status === 301 || response.status === 302) && requestInit.method === "POST") {
+            requestInit.method = "GET";
+            delete requestInit.body;
+            for (const key of Object.keys(requestHeaders)) {
+              if (["content-type", "content-length"].includes(key.toLowerCase()))
+                delete requestHeaders[key];
+            }
+          }
+          currentUrl = nextUrl;
+        }
         const responseText = await readResponseTextWithLimit(response);
         const contentType = response.headers.get("content-type");
         const json = isJsonContentType(contentType) ? safeJsonParse(responseText) : void 0;

package/dist/implementations/http-request-tool.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"http-request-tool.d.ts","sourceRoot":"","sources":["../../src/implementations/http-request-tool.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,KAAK,EAAE,IAAI,EAAwB,MAAM,mBAAmB,CAAC;AAQpE,OAAO,EAAE,QAAQ,IAAI,GAAG,EAAE,KAAK,aAAa,EAAE,KAAK,aAAa,EAAE,MAAM,UAAU,CAAC;AAKnF,QAAA,MAAM,sBAAsB;;;;;;;;;;;;;kBA2Bf,CAAC;AA8Bd,KAAK,cAAc,GACb,CAAC,CAAC,GAAG,EAAE,MAAM,CAAC,cAAc,GAAG,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,KAAK,IAAI,CAAC,GAC9E,CAAC,CAAC,GAAG,EAAE,MAAM,CAAC,cAAc,GAAG,IAAI,EAAE,SAAS,EAAE,aAAa,EAAE,KAAK,IAAI,CAAC,CAAC;AAoDhF,wBAAgB,gBAAgB,CAAC,MAAM,CAAC,EAAE;IACtC,SAAS,CAAC,EAAE,OAAO,GAAG,CAAC,MAAM,CAAC;CACjC,GAAG,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,aAAa,EAAE,QAAQ,EAAE,cAAc,KAAK,IAAI,CAyI/E;AA2FD;;GAEG;AACH,wBAAgB,qBAAqB,IAAI,IAAI,CAAC,OAAO,sBAAsB,CAAC,CAwG3E"}
+{"version":3,"file":"http-request-tool.d.ts","sourceRoot":"","sources":["../../src/implementations/http-request-tool.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,KAAK,EAAE,IAAI,EAAwB,MAAM,mBAAmB,CAAC;AAQpE,OAAO,EAAE,QAAQ,IAAI,GAAG,EAAE,KAAK,aAAa,EAAE,KAAK,aAAa,EAAE,MAAM,UAAU,CAAC;AAKnF,QAAA,MAAM,sBAAsB;;;;;;;;;;;;;kBA2Bf,CAAC;AA+Bd,KAAK,cAAc,GACb,CAAC,CAAC,GAAG,EAAE,MAAM,CAAC,cAAc,GAAG,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,KAAK,IAAI,CAAC,GAC9E,CAAC,CAAC,GAAG,EAAE,MAAM,CAAC,cAAc,GAAG,IAAI,EAAE,SAAS,EAAE,aAAa,EAAE,KAAK,IAAI,CAAC,CAAC;AA4DhF,wBAAgB,gBAAgB,CAAC,MAAM,CAAC,EAAE;IACtC,SAAS,CAAC,EAAE,OAAO,GAAG,CAAC,MAAM,CAAC;CACjC,GAAG,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,aAAa,EAAE,QAAQ,EAAE,cAAc,KAAK,IAAI,CAyI/E;AA2FD;;GAEG;AACH,wBAAgB,qBAAqB,IAAI,IAAI,CAAC,OAAO,sBAAsB,CAAC,CA4I3E"}

package/dist/implementations/http-request-tool.js

@@ -33,6 +33,7 @@ function safeJsonParse(text) {
 }
 const BLOCKED_HOSTNAMES = /* @__PURE__ */ new Set(["localhost"]);
 const MAX_RESPONSE_BYTES = 5 * 1024 * 1024;
+const MAX_REDIRECTS = 20;
 const SAFE_DISPATCHER = createSafeDispatcher();
 function isPrivateIpv4(ip) {
   const parts = ip.split(".").map((part) => Number(part));
@@ -63,20 +64,26 @@ function isPrivateIpv4(ip) {
   return false;
 }
 function isPrivateIpv6(ip) {
-  const normalized = ip.toLowerCase();
+  const normalized = new URL(`http://[${ip.split("%")[0]}]/`).hostname.slice(1, -1);
   if (normalized === "::" || normalized === "::1") return true;
-  if (normalized.startsWith("fe80:")) return true;
+  if (normalized.startsWith("64:ff9b:1:")) return true;
+  if (/^fe[89ab][0-9a-f]:/.test(normalized)) return true;
   if (normalized.startsWith("fc") || normalized.startsWith("fd")) return true;
   if (normalized.startsWith("::ffff:")) {
-    const ipv4Part = normalized.slice("::ffff:".length);
-    return isPrivateIpv4(ipv4Part);
+    const parts = normalized.slice("::ffff:".length).split(":");
+    if (parts.length === 2) {
+      const high = Number.parseInt(parts[0] ?? "", 16);
+      const low = Number.parseInt(parts[1] ?? "", 16);
+      return isPrivateIpv4(`${high >> 8}.${high & 255}.${low >> 8}.${low & 255}`);
+    }
   }
   return false;
 }
 function isPrivateAddress(ip) {
-  const version = isIP(ip);
-  if (version === 4) return isPrivateIpv4(ip);
-  if (version === 6) return isPrivateIpv6(ip);
+  const address = ip.startsWith("[") && ip.endsWith("]") ? ip.slice(1, -1) : ip;
+  const version = isIP(address);
+  if (version === 4) return isPrivateIpv4(address);
+  if (version === 6) return isPrivateIpv6(address);
   return false;
 }
 function createSafeLookup(config) {
@@ -312,7 +319,39 @@ function createHttpRequestTool() {
         if (requestBody !== void 0) {
           requestInit.body = requestBody;
         }
-        const response = await fetch(requestUrl.toString(), requestInit);
+        requestInit.redirect = "manual";
+        let currentUrl = requestUrl;
+        let response;
+        for (let redirects = 0; ; redirects++) {
+          await assertSafeUrl(currentUrl);
+          response = await fetch(currentUrl.toString(), requestInit);
+          const location = response.headers.get("location");
+          if (![301, 302, 303, 307, 308].includes(response.status) || !location) break;
+          await response.body?.cancel();
+          if (redirects >= MAX_REDIRECTS) {
+            throw new DextoRuntimeError(
+              "HTTP_REQUEST_TOO_MANY_REDIRECTS",
+              ErrorScope.TOOLS,
+              ErrorType.THIRD_PARTY,
+              `HTTP request exceeded ${MAX_REDIRECTS} redirects`
+            );
+          }
+          const nextUrl = new URL(location, currentUrl);
+          if (nextUrl.origin !== currentUrl.origin) {
+            for (const key of Object.keys(requestHeaders)) {
+              delete requestHeaders[key];
+            }
+          }
+          if (response.status === 303 || (response.status === 301 || response.status === 302) && requestInit.method === "POST") {
+            requestInit.method = "GET";
+            delete requestInit.body;
+            for (const key of Object.keys(requestHeaders)) {
+              if (["content-type", "content-length"].includes(key.toLowerCase()))
+                delete requestHeaders[key];
+            }
+          }
+          currentUrl = nextUrl;
+        }
         const responseText = await readResponseTextWithLimit(response);
         const contentType = response.headers.get("content-type");
         const json = isJsonContentType(contentType) ? safeJsonParse(responseText) : void 0;

package/dist/implementations/http-request-tool.test.cjs

@@ -47,4 +47,81 @@ var import_http_request_tool = require("./http-request-tool.js");
       code: "HTTP_REQUEST_UNSAFE_TARGET"
     });
   });
+  import_vitest.it.each([
+    "[::1]",
+    "[0:0:0:0:0:0:0:1]",
+    "[::ffff:127.0.0.1]",
+    "[::ffff:10.0.0.1]",
+    "[64:ff9b:1::a00:1]"
+  ])("blocks private IPv6 literal %s before fetching", async (host) => {
+    const fetchSpy = import_vitest.vi.spyOn(globalThis, "fetch");
+    try {
+      await (0, import_vitest.expect)(
+        (0, import_http_request_tool.createHttpRequestTool)().execute(
+          { url: `http://${host}/`, method: "GET", timeoutMs: 1e3 },
+          {}
+        )
+      ).rejects.toMatchObject({ code: "HTTP_REQUEST_UNSAFE_TARGET" });
+      (0, import_vitest.expect)(fetchSpy).not.toHaveBeenCalled();
+    } finally {
+      fetchSpy.mockRestore();
+    }
+  });
+  (0, import_vitest.it)("blocks a redirect to a private literal before the next request", async () => {
+    const fetchSpy = import_vitest.vi.spyOn(globalThis, "fetch").mockResolvedValue(
+      new Response(null, { status: 302, headers: { location: "http://[::1]/secret" } })
+    );
+    try {
+      await (0, import_vitest.expect)(
+        (0, import_http_request_tool.createHttpRequestTool)().execute(
+          { url: "https://example.com/", method: "GET", timeoutMs: 1e3 },
+          {}
+        )
+      ).rejects.toMatchObject({ code: "HTTP_REQUEST_UNSAFE_TARGET" });
+      (0, import_vitest.expect)(fetchSpy).toHaveBeenCalledTimes(1);
+      (0, import_vitest.expect)(fetchSpy.mock.calls[0]?.[1]).toMatchObject({ redirect: "manual" });
+    } finally {
+      fetchSpy.mockRestore();
+    }
+  });
+  (0, import_vitest.it)("follows relative redirects and limits redirect loops", async () => {
+    const fetchSpy = import_vitest.vi.spyOn(globalThis, "fetch").mockImplementation(
+      async () => new Response(null, { status: 302, headers: { location: "/next" } })
+    );
+    try {
+      await (0, import_vitest.expect)(
+        (0, import_http_request_tool.createHttpRequestTool)().execute(
+          { url: "https://example.com/", method: "GET", timeoutMs: 1e3 },
+          {}
+        )
+      ).rejects.toMatchObject({ code: "HTTP_REQUEST_TOO_MANY_REDIRECTS" });
+      (0, import_vitest.expect)(fetchSpy).toHaveBeenCalledTimes(21);
+      (0, import_vitest.expect)(fetchSpy.mock.calls[1]?.[0]).toBe("https://example.com/next");
+    } finally {
+      fetchSpy.mockRestore();
+    }
+  });
+  (0, import_vitest.it)("drops credentials when following a cross-origin redirect", async () => {
+    const fetchSpy = import_vitest.vi.spyOn(globalThis, "fetch").mockResolvedValueOnce(
+      new Response(null, { status: 302, headers: { location: "https://other.example/" } })
+    ).mockResolvedValueOnce(new Response("ok"));
+    try {
+      await (0, import_http_request_tool.createHttpRequestTool)().execute(
+        {
+          url: "https://example.com/",
+          method: "GET",
+          headers: {
+            Authorization: "secret",
+            Cookie: "session=value",
+            "X-API-Key": "secret"
+          },
+          timeoutMs: 1e3
+        },
+        {}
+      );
+      (0, import_vitest.expect)(fetchSpy.mock.calls[1]?.[1]?.headers).toEqual({});
+    } finally {
+      fetchSpy.mockRestore();
+    }
+  });
 });

package/dist/implementations/http-request-tool.test.js

@@ -46,4 +46,81 @@ describe("http_request tool", () => {
       code: "HTTP_REQUEST_UNSAFE_TARGET"
     });
   });
+  it.each([
+    "[::1]",
+    "[0:0:0:0:0:0:0:1]",
+    "[::ffff:127.0.0.1]",
+    "[::ffff:10.0.0.1]",
+    "[64:ff9b:1::a00:1]"
+  ])("blocks private IPv6 literal %s before fetching", async (host) => {
+    const fetchSpy = vi.spyOn(globalThis, "fetch");
+    try {
+      await expect(
+        createHttpRequestTool().execute(
+          { url: `http://${host}/`, method: "GET", timeoutMs: 1e3 },
+          {}
+        )
+      ).rejects.toMatchObject({ code: "HTTP_REQUEST_UNSAFE_TARGET" });
+      expect(fetchSpy).not.toHaveBeenCalled();
+    } finally {
+      fetchSpy.mockRestore();
+    }
+  });
+  it("blocks a redirect to a private literal before the next request", async () => {
+    const fetchSpy = vi.spyOn(globalThis, "fetch").mockResolvedValue(
+      new Response(null, { status: 302, headers: { location: "http://[::1]/secret" } })
+    );
+    try {
+      await expect(
+        createHttpRequestTool().execute(
+          { url: "https://example.com/", method: "GET", timeoutMs: 1e3 },
+          {}
+        )
+      ).rejects.toMatchObject({ code: "HTTP_REQUEST_UNSAFE_TARGET" });
+      expect(fetchSpy).toHaveBeenCalledTimes(1);
+      expect(fetchSpy.mock.calls[0]?.[1]).toMatchObject({ redirect: "manual" });
+    } finally {
+      fetchSpy.mockRestore();
+    }
+  });
+  it("follows relative redirects and limits redirect loops", async () => {
+    const fetchSpy = vi.spyOn(globalThis, "fetch").mockImplementation(
+      async () => new Response(null, { status: 302, headers: { location: "/next" } })
+    );
+    try {
+      await expect(
+        createHttpRequestTool().execute(
+          { url: "https://example.com/", method: "GET", timeoutMs: 1e3 },
+          {}
+        )
+      ).rejects.toMatchObject({ code: "HTTP_REQUEST_TOO_MANY_REDIRECTS" });
+      expect(fetchSpy).toHaveBeenCalledTimes(21);
+      expect(fetchSpy.mock.calls[1]?.[0]).toBe("https://example.com/next");
+    } finally {
+      fetchSpy.mockRestore();
+    }
+  });
+  it("drops credentials when following a cross-origin redirect", async () => {
+    const fetchSpy = vi.spyOn(globalThis, "fetch").mockResolvedValueOnce(
+      new Response(null, { status: 302, headers: { location: "https://other.example/" } })
+    ).mockResolvedValueOnce(new Response("ok"));
+    try {
+      await createHttpRequestTool().execute(
+        {
+          url: "https://example.com/",
+          method: "GET",
+          headers: {
+            Authorization: "secret",
+            Cookie: "session=value",
+            "X-API-Key": "secret"
+          },
+          timeoutMs: 1e3
+        },
+        {}
+      );
+      expect(fetchSpy.mock.calls[1]?.[1]?.headers).toEqual({});
+    } finally {
+      fetchSpy.mockRestore();
+    }
+  });
 });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@dexto/tools-builtins",
-  "version": "1.15.0",
+  "version": "1.16.0",
   "description": "Built-in tools factory for Dexto agents",
   "type": "module",
   "main": "./dist/index.js",
@@ -19,8 +19,8 @@
   "dependencies": {
     "undici": "^7.30.1",
     "zod": "^4.3.6",
-    "@dexto/agent-config": "1.15.0",
-    "@dexto/core": "1.15.0"
+    "@dexto/agent-config": "1.16.0",
+    "@dexto/core": "1.16.0"
   },
   "devDependencies": {
     "tsup": "^8.0.0",