@dexto/tools-builtins 1.16.6 → 1.17.0

package/dist/implementations/delegate-to-url-tool.cjs

@@ -21,8 +21,11 @@ __export(delegate_to_url_tool_exports, {
   createDelegateToUrlTool: () => createDelegateToUrlTool
 });
 module.exports = __toCommonJS(delegate_to_url_tool_exports);
+var import_node_util = require("node:util");
 var import_zod = require("zod");
 var import_errors = require("@dexto/core/errors");
+var import_core = require("@dexto/core");
+var import_undici = require("undici");
 var import_tools = require("@dexto/core/tools");
 const DelegateToUrlInputSchema = import_zod.z.object({
   url: import_zod.z.string().url().describe(
@@ -36,14 +39,58 @@ const DelegateToUrlInputSchema = import_zod.z.object({
   ),
   timeout: import_zod.z.number().optional().default(3e4).describe("Request timeout in milliseconds (default: 30000)")
 }).strict();
+const MAX_RESPONSE_BYTES = 5 * 1024 * 1024;
+function assertDelegationUrl(rawUrl) {
+  const invalid = (reason) => new import_errors.DextoRuntimeError(
+    "DELEGATION_INVALID_URL",
+    import_errors.ErrorScope.TOOLS,
+    import_errors.ErrorType.USER,
+    `Invalid agent URL: ${reason}`
+  );
+  const parsed = new URL(rawUrl);
+  if (parsed.protocol !== "http:" && parsed.protocol !== "https:") {
+    throw invalid("only http and https are supported");
+  }
+  if (parsed.username || parsed.password) {
+    throw invalid("credentials in the URL are not allowed");
+  }
+  if (rawUrl.includes("?") || rawUrl.includes("#")) {
+    throw invalid("the URL must not contain a query or fragment");
+  }
+  if ((0, import_core.isMetadataHost)(parsed.hostname)) {
+    throw invalid("link-local and metadata addresses are not allowed");
+  }
+}
+async function readJsonWithLimit(response) {
+  const reader = response.body?.getReader();
+  if (!reader) {
+    return JSON.parse(await response.text());
+  }
+  const decoder = new import_node_util.TextDecoder();
+  let total = 0;
+  let text = "";
+  while (true) {
+    const { done, value } = await reader.read();
+    if (done) break;
+    total += value.length;
+    if (total > MAX_RESPONSE_BYTES) {
+      await reader.cancel();
+      throw new Error(`Response exceeded ${MAX_RESPONSE_BYTES} byte limit`);
+    }
+    text += decoder.decode(value, { stream: true });
+  }
+  return JSON.parse(text + decoder.decode());
+}
 function isPlainObject(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 class SimpleA2AClient {
   url;
   timeout;
-  constructor(url, timeout = 3e4) {
+  dispatcher;
+  constructor(url, dispatcher, timeout = 3e4) {
     this.url = url.replace(/\/$/, "");
+    this.dispatcher = dispatcher;
     this.timeout = timeout;
   }
   async sendMessage(message, sessionId) {
@@ -79,22 +126,25 @@ class SimpleA2AClient {
       const controller = new AbortController();
       const timeoutId = setTimeout(() => controller.abort(), this.timeout);
       try {
-        const response = await fetch(endpoint, {
+        const requestInit = {
           method: "POST",
           headers: {
             "Content-Type": "application/json",
             "User-Agent": "@dexto/core"
           },
           body: JSON.stringify(rpcRequest),
-          signal: controller.signal
-        });
+          redirect: "error",
+          signal: controller.signal,
+          dispatcher: this.dispatcher
+        };
+        const response = await fetch(endpoint, requestInit);
         if (!response.ok) {
           lastError = new Error(
             `HTTP ${response.status}: ${response.statusText} (tried ${endpoint})`
           );
           continue;
         }
-        const data = await response.json();
+        const data = await readJsonWithLimit(response);
         if (isPlainObject(data) && "error" in data && data.error) {
           const errorMessage = isPlainObject(data.error) && typeof data.error.message === "string" ? data.error.message : "Unknown error";
           throw new Error(`Agent returned error: ${errorMessage}`);
@@ -145,7 +195,10 @@ class SimpleA2AClient {
     return `${Date.now()}-${Math.random().toString(36).substring(2, 11)}`;
   }
 }
-function createDelegateToUrlTool() {
+function createDelegateToUrlTool(options = {}) {
+  const dispatcher = new import_undici.Agent({
+    connect: { lookup: (0, import_core.createMetadataCheckedLookup)(options.resolveHost) }
+  });
   return (0, import_tools.defineTool)({
     id: "delegate_to_url",
     description: 'Delegate a task to another A2A-compliant agent at a specific URL. Supports STATEFUL multi-turn conversations via sessionId parameter. USAGE: (1) First delegation: provide url + message. Tool returns a response AND a sessionId. (2) Follow-up: use the SAME sessionId to continue the conversation with that agent. The agent remembers previous context. EXAMPLE: First call {url: "http://agent:3001", message: "Analyze data X"} returns {sessionId: "xyz", response: "..."}. Second call {url: "http://agent:3001", message: "What was the top insight?", sessionId: "xyz"}. The agent will remember the first analysis and can answer specifically.',
@@ -159,8 +212,9 @@ function createDelegateToUrlTool() {
     },
     async execute(input, _context) {
       const { url, message, sessionId, timeout } = input;
+      assertDelegationUrl(url);
       try {
-        const client = new SimpleA2AClient(url, timeout);
+        const client = new SimpleA2AClient(url, dispatcher, timeout);
         const effectiveSessionId = sessionId || `delegation-${Date.now()}-${Math.random().toString(36).substring(2, 9)}`;
         const response = await client.sendMessage(message, effectiveSessionId);
         return {

package/dist/implementations/delegate-to-url-tool.d.ts

@@ -6,11 +6,15 @@ declare const DelegateToUrlInputSchema: z.ZodObject<{
     sessionId: z.ZodOptional<z.ZodString>;
     timeout: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
 }, z.core.$strict>;
+/** Resolves a host name to all of its addresses. Defaults to a DNS lookup; tests inject one. */
+type HostResolver = (hostname: string) => Promise<string[]>;
 /**
  * Create the `delegate_to_url` tool.
  *
  * Delegates a message/task to another A2A-compliant agent URL via JSON-RPC and returns its response.
  */
-export declare function createDelegateToUrlTool(): Tool<typeof DelegateToUrlInputSchema>;
+export declare function createDelegateToUrlTool(options?: {
+    resolveHost?: HostResolver;
+}): Tool<typeof DelegateToUrlInputSchema>;
 export {};
 //# sourceMappingURL=delegate-to-url-tool.d.ts.map

package/dist/implementations/delegate-to-url-tool.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"delegate-to-url-tool.d.ts","sourceRoot":"","sources":["../../src/implementations/delegate-to-url-tool.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,KAAK,EAAE,IAAI,EAAwB,MAAM,mBAAmB,CAAC;AASpE,QAAA,MAAM,wBAAwB;;;;;kBA0BjB,CAAC;AAsJd;;;;GAIG;AACH,wBAAgB,uBAAuB,IAAI,IAAI,CAAC,OAAO,wBAAwB,CAAC,CAgD/E"}
+{"version":3,"file":"delegate-to-url-tool.d.ts","sourceRoot":"","sources":["../../src/implementations/delegate-to-url-tool.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,KAAK,EAAE,IAAI,EAAwB,MAAM,mBAAmB,CAAC;AAWpE,QAAA,MAAM,wBAAwB;;;;;kBA0BjB,CAAC;AAed,gGAAgG;AAChG,KAAK,YAAY,GAAG,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;AAmM5D;;;;GAIG;AACH,wBAAgB,uBAAuB,CACnC,OAAO,GAAE;IAAE,WAAW,CAAC,EAAE,YAAY,CAAA;CAAO,GAC7C,IAAI,CAAC,OAAO,wBAAwB,CAAC,CAuDvC"}

package/dist/implementations/delegate-to-url-tool.js

@@ -1,5 +1,8 @@
+import { TextDecoder } from "node:util";
 import { z } from "zod";
 import { DextoRuntimeError, ErrorScope, ErrorType } from "@dexto/core/errors";
+import { createMetadataCheckedLookup, isMetadataHost } from "@dexto/core";
+import { Agent } from "undici";
 import {
   TOOL_ACTIVITY,
   createLocalToolCallHeader,
@@ -18,14 +21,58 @@ const DelegateToUrlInputSchema = z.object({
   ),
   timeout: z.number().optional().default(3e4).describe("Request timeout in milliseconds (default: 30000)")
 }).strict();
+const MAX_RESPONSE_BYTES = 5 * 1024 * 1024;
+function assertDelegationUrl(rawUrl) {
+  const invalid = (reason) => new DextoRuntimeError(
+    "DELEGATION_INVALID_URL",
+    ErrorScope.TOOLS,
+    ErrorType.USER,
+    `Invalid agent URL: ${reason}`
+  );
+  const parsed = new URL(rawUrl);
+  if (parsed.protocol !== "http:" && parsed.protocol !== "https:") {
+    throw invalid("only http and https are supported");
+  }
+  if (parsed.username || parsed.password) {
+    throw invalid("credentials in the URL are not allowed");
+  }
+  if (rawUrl.includes("?") || rawUrl.includes("#")) {
+    throw invalid("the URL must not contain a query or fragment");
+  }
+  if (isMetadataHost(parsed.hostname)) {
+    throw invalid("link-local and metadata addresses are not allowed");
+  }
+}
+async function readJsonWithLimit(response) {
+  const reader = response.body?.getReader();
+  if (!reader) {
+    return JSON.parse(await response.text());
+  }
+  const decoder = new TextDecoder();
+  let total = 0;
+  let text = "";
+  while (true) {
+    const { done, value } = await reader.read();
+    if (done) break;
+    total += value.length;
+    if (total > MAX_RESPONSE_BYTES) {
+      await reader.cancel();
+      throw new Error(`Response exceeded ${MAX_RESPONSE_BYTES} byte limit`);
+    }
+    text += decoder.decode(value, { stream: true });
+  }
+  return JSON.parse(text + decoder.decode());
+}
 function isPlainObject(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 class SimpleA2AClient {
   url;
   timeout;
-  constructor(url, timeout = 3e4) {
+  dispatcher;
+  constructor(url, dispatcher, timeout = 3e4) {
     this.url = url.replace(/\/$/, "");
+    this.dispatcher = dispatcher;
     this.timeout = timeout;
   }
   async sendMessage(message, sessionId) {
@@ -61,22 +108,25 @@ class SimpleA2AClient {
       const controller = new AbortController();
       const timeoutId = setTimeout(() => controller.abort(), this.timeout);
       try {
-        const response = await fetch(endpoint, {
+        const requestInit = {
           method: "POST",
           headers: {
             "Content-Type": "application/json",
             "User-Agent": "@dexto/core"
           },
           body: JSON.stringify(rpcRequest),
-          signal: controller.signal
-        });
+          redirect: "error",
+          signal: controller.signal,
+          dispatcher: this.dispatcher
+        };
+        const response = await fetch(endpoint, requestInit);
         if (!response.ok) {
           lastError = new Error(
             `HTTP ${response.status}: ${response.statusText} (tried ${endpoint})`
           );
           continue;
         }
-        const data = await response.json();
+        const data = await readJsonWithLimit(response);
         if (isPlainObject(data) && "error" in data && data.error) {
           const errorMessage = isPlainObject(data.error) && typeof data.error.message === "string" ? data.error.message : "Unknown error";
           throw new Error(`Agent returned error: ${errorMessage}`);
@@ -127,7 +177,10 @@ class SimpleA2AClient {
     return `${Date.now()}-${Math.random().toString(36).substring(2, 11)}`;
   }
 }
-function createDelegateToUrlTool() {
+function createDelegateToUrlTool(options = {}) {
+  const dispatcher = new Agent({
+    connect: { lookup: createMetadataCheckedLookup(options.resolveHost) }
+  });
   return defineTool({
     id: "delegate_to_url",
     description: 'Delegate a task to another A2A-compliant agent at a specific URL. Supports STATEFUL multi-turn conversations via sessionId parameter. USAGE: (1) First delegation: provide url + message. Tool returns a response AND a sessionId. (2) Follow-up: use the SAME sessionId to continue the conversation with that agent. The agent remembers previous context. EXAMPLE: First call {url: "http://agent:3001", message: "Analyze data X"} returns {sessionId: "xyz", response: "..."}. Second call {url: "http://agent:3001", message: "What was the top insight?", sessionId: "xyz"}. The agent will remember the first analysis and can answer specifically.',
@@ -141,8 +194,9 @@ function createDelegateToUrlTool() {
     },
     async execute(input, _context) {
       const { url, message, sessionId, timeout } = input;
+      assertDelegationUrl(url);
       try {
-        const client = new SimpleA2AClient(url, timeout);
+        const client = new SimpleA2AClient(url, dispatcher, timeout);
         const effectiveSessionId = sessionId || `delegation-${Date.now()}-${Math.random().toString(36).substring(2, 9)}`;
         const response = await client.sendMessage(message, effectiveSessionId);
         return {

package/dist/implementations/delegate-to-url-tool.test.cjs

@@ -1,4 +1,5 @@
 "use strict";
+var import_node_http = require("node:http");
 var import_vitest = require("vitest");
 var import_delegate_to_url_tool = require("./delegate-to-url-tool.js");
 var import_core = require("@dexto/core");
@@ -19,6 +20,7 @@ function createMockLogger() {
   };
   return logger;
 }
+const publicHost = async () => ["93.184.216.34"];
 function createToolContext(logger) {
   return { logger };
 }
@@ -33,7 +35,7 @@ function createToolContext(logger) {
       throw new Error("boom");
     });
     import_vitest.vi.stubGlobal("fetch", fetchMock);
-    const tool = (0, import_delegate_to_url_tool.createDelegateToUrlTool)();
+    const tool = (0, import_delegate_to_url_tool.createDelegateToUrlTool)({ resolveHost: publicHost });
     const input = tool.inputSchema.parse({
       url: "http://example.com",
       message: "hi",
@@ -55,7 +57,7 @@ function createToolContext(logger) {
       throw abortError;
     });
     import_vitest.vi.stubGlobal("fetch", fetchMock);
-    const tool = (0, import_delegate_to_url_tool.createDelegateToUrlTool)();
+    const tool = (0, import_delegate_to_url_tool.createDelegateToUrlTool)({ resolveHost: publicHost });
     const input = tool.inputSchema.parse({
       url: "http://example.com",
       message: "hi",
@@ -74,3 +76,97 @@ function createToolContext(logger) {
     }
   });
 });
+(0, import_vitest.describe)("delegate_to_url URL checks", () => {
+  (0, import_vitest.afterEach)(() => {
+    import_vitest.vi.unstubAllGlobals();
+  });
+  import_vitest.it.each([
+    "ftp://example.com",
+    "http://user:pass@example.com",
+    "http://127.0.0.1:2375/containers/create?",
+    "http://example.com/#fragment",
+    "http://169.254.169.254",
+    "http://[::ffff:169.254.169.254]",
+    "http://[::ffff:a9fe:a9fe]",
+    "http://169.254.169.254.",
+    "http://metadata.google.internal.",
+    "http://[fe80::1]",
+    "http://[fd00:ec2::254]",
+    "http://100.100.100.200",
+    "http://192.0.0.192",
+    "http://168.63.129.16",
+    "http://[fd20:ce::254]",
+    "http://2852039166"
+  ])("rejects %s without sending a request", async (url) => {
+    const fetchMock = import_vitest.vi.fn();
+    import_vitest.vi.stubGlobal("fetch", fetchMock);
+    const tool = (0, import_delegate_to_url_tool.createDelegateToUrlTool)({ resolveHost: publicHost });
+    const input = tool.inputSchema.parse({ url, message: "hi" });
+    await (0, import_vitest.expect)(
+      tool.execute(input, createToolContext(createMockLogger()))
+    ).rejects.toMatchObject({
+      code: "DELEGATION_INVALID_URL"
+    });
+    (0, import_vitest.expect)(fetchMock).not.toHaveBeenCalled();
+  });
+  (0, import_vitest.it)("still delegates to a local agent and refuses redirects", async () => {
+    const fetchMock = import_vitest.vi.fn(
+      async (_url, _init) => new Response(JSON.stringify({ result: "ok" }), {
+        headers: { "content-type": "application/json" }
+      })
+    );
+    import_vitest.vi.stubGlobal("fetch", fetchMock);
+    const tool = (0, import_delegate_to_url_tool.createDelegateToUrlTool)({ resolveHost: publicHost });
+    const input = tool.inputSchema.parse({ url: "http://localhost:3001", message: "hi" });
+    await tool.execute(input, createToolContext(createMockLogger()));
+    (0, import_vitest.expect)(fetchMock.mock.calls[0]?.[0]).toBe("http://localhost:3001/v1/jsonrpc");
+    (0, import_vitest.expect)(fetchMock.mock.calls[0]?.[1]?.redirect).toBe("error");
+  });
+});
+(0, import_vitest.describe)("delegate_to_url connects through the checked address", () => {
+  let server;
+  let port;
+  let requests;
+  (0, import_vitest.beforeEach)(async () => {
+    requests = 0;
+    server = (0, import_node_http.createServer)((_request, response) => {
+      requests += 1;
+      response.setHeader("content-type", "application/json");
+      response.end(JSON.stringify({ result: "ok" }));
+    });
+    await new Promise((resolve) => server.listen(0, "127.0.0.1", resolve));
+    port = server.address().port;
+  });
+  (0, import_vitest.afterEach)(async () => {
+    await new Promise((resolve) => server.close(() => resolve()));
+  });
+  (0, import_vitest.it)("uses the answer it checked even if the name answers differently afterwards", async () => {
+    let lookups = 0;
+    const tool = (0, import_delegate_to_url_tool.createDelegateToUrlTool)({
+      resolveHost: async () => lookups++ === 0 ? ["127.0.0.1"] : ["169.254.169.254"]
+    });
+    const input = tool.inputSchema.parse({
+      url: `http://rebind.example:${port}`,
+      message: "hi"
+    });
+    const result = await tool.execute(input, createToolContext(createMockLogger()));
+    (0, import_vitest.expect)(result).toMatchObject({ success: true });
+    (0, import_vitest.expect)(requests).toBe(1);
+  });
+  (0, import_vitest.it)("never connects when any answer for the name is a metadata address", async () => {
+    const tool = (0, import_delegate_to_url_tool.createDelegateToUrlTool)({
+      resolveHost: async () => ["127.0.0.1", "::ffff:a9fe:a9fe"]
+    });
+    const input = tool.inputSchema.parse({
+      // `localhost` really resolves to this machine, so without the pinned lookup this request
+      // would reach the server.
+      url: `http://localhost:${port}`,
+      message: "hi",
+      timeout: 5e3
+    });
+    await (0, import_vitest.expect)(
+      tool.execute(input, createToolContext(createMockLogger()))
+    ).rejects.toMatchObject({ code: "DELEGATION_FAILED" });
+    (0, import_vitest.expect)(requests).toBe(0);
+  });
+});

package/dist/implementations/delegate-to-url-tool.test.js

@@ -1,4 +1,5 @@
-import { afterEach, describe, expect, it, vi } from "vitest";
+import { createServer } from "node:http";
+import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
 import { createDelegateToUrlTool } from "./delegate-to-url-tool.js";
 import { DextoRuntimeError, ErrorScope, ErrorType } from "@dexto/core";
 function createMockLogger() {
@@ -18,6 +19,7 @@ function createMockLogger() {
   };
   return logger;
 }
+const publicHost = async () => ["93.184.216.34"];
 function createToolContext(logger) {
   return { logger };
 }
@@ -32,7 +34,7 @@ describe("delegate_to_url tool", () => {
       throw new Error("boom");
     });
     vi.stubGlobal("fetch", fetchMock);
-    const tool = createDelegateToUrlTool();
+    const tool = createDelegateToUrlTool({ resolveHost: publicHost });
     const input = tool.inputSchema.parse({
       url: "http://example.com",
       message: "hi",
@@ -54,7 +56,7 @@ describe("delegate_to_url tool", () => {
       throw abortError;
     });
     vi.stubGlobal("fetch", fetchMock);
-    const tool = createDelegateToUrlTool();
+    const tool = createDelegateToUrlTool({ resolveHost: publicHost });
     const input = tool.inputSchema.parse({
       url: "http://example.com",
       message: "hi",
@@ -73,3 +75,97 @@ describe("delegate_to_url tool", () => {
     }
   });
 });
+describe("delegate_to_url URL checks", () => {
+  afterEach(() => {
+    vi.unstubAllGlobals();
+  });
+  it.each([
+    "ftp://example.com",
+    "http://user:pass@example.com",
+    "http://127.0.0.1:2375/containers/create?",
+    "http://example.com/#fragment",
+    "http://169.254.169.254",
+    "http://[::ffff:169.254.169.254]",
+    "http://[::ffff:a9fe:a9fe]",
+    "http://169.254.169.254.",
+    "http://metadata.google.internal.",
+    "http://[fe80::1]",
+    "http://[fd00:ec2::254]",
+    "http://100.100.100.200",
+    "http://192.0.0.192",
+    "http://168.63.129.16",
+    "http://[fd20:ce::254]",
+    "http://2852039166"
+  ])("rejects %s without sending a request", async (url) => {
+    const fetchMock = vi.fn();
+    vi.stubGlobal("fetch", fetchMock);
+    const tool = createDelegateToUrlTool({ resolveHost: publicHost });
+    const input = tool.inputSchema.parse({ url, message: "hi" });
+    await expect(
+      tool.execute(input, createToolContext(createMockLogger()))
+    ).rejects.toMatchObject({
+      code: "DELEGATION_INVALID_URL"
+    });
+    expect(fetchMock).not.toHaveBeenCalled();
+  });
+  it("still delegates to a local agent and refuses redirects", async () => {
+    const fetchMock = vi.fn(
+      async (_url, _init) => new Response(JSON.stringify({ result: "ok" }), {
+        headers: { "content-type": "application/json" }
+      })
+    );
+    vi.stubGlobal("fetch", fetchMock);
+    const tool = createDelegateToUrlTool({ resolveHost: publicHost });
+    const input = tool.inputSchema.parse({ url: "http://localhost:3001", message: "hi" });
+    await tool.execute(input, createToolContext(createMockLogger()));
+    expect(fetchMock.mock.calls[0]?.[0]).toBe("http://localhost:3001/v1/jsonrpc");
+    expect(fetchMock.mock.calls[0]?.[1]?.redirect).toBe("error");
+  });
+});
+describe("delegate_to_url connects through the checked address", () => {
+  let server;
+  let port;
+  let requests;
+  beforeEach(async () => {
+    requests = 0;
+    server = createServer((_request, response) => {
+      requests += 1;
+      response.setHeader("content-type", "application/json");
+      response.end(JSON.stringify({ result: "ok" }));
+    });
+    await new Promise((resolve) => server.listen(0, "127.0.0.1", resolve));
+    port = server.address().port;
+  });
+  afterEach(async () => {
+    await new Promise((resolve) => server.close(() => resolve()));
+  });
+  it("uses the answer it checked even if the name answers differently afterwards", async () => {
+    let lookups = 0;
+    const tool = createDelegateToUrlTool({
+      resolveHost: async () => lookups++ === 0 ? ["127.0.0.1"] : ["169.254.169.254"]
+    });
+    const input = tool.inputSchema.parse({
+      url: `http://rebind.example:${port}`,
+      message: "hi"
+    });
+    const result = await tool.execute(input, createToolContext(createMockLogger()));
+    expect(result).toMatchObject({ success: true });
+    expect(requests).toBe(1);
+  });
+  it("never connects when any answer for the name is a metadata address", async () => {
+    const tool = createDelegateToUrlTool({
+      resolveHost: async () => ["127.0.0.1", "::ffff:a9fe:a9fe"]
+    });
+    const input = tool.inputSchema.parse({
+      // `localhost` really resolves to this machine, so without the pinned lookup this request
+      // would reach the server.
+      url: `http://localhost:${port}`,
+      message: "hi",
+      timeout: 5e3
+    });
+    await expect(
+      tool.execute(input, createToolContext(createMockLogger()))
+    ).rejects.toMatchObject({ code: "DELEGATION_FAILED" });
+    expect(requests).toBe(0);
+  });
+});