@gajae-code/coding-agent 0.11.5 → 0.11.7

package/src/tools/image-gen.ts

@@ -1,3 +1,6 @@
+import * as http from "node:http";
+import * as https from "node:https";
+import * as net from "node:net";
 import * as os from "node:os";
 import * as path from "node:path";
 import { getAntigravityUserAgent, getEnvApiKey, type Model } from "@gajae-code/ai";
@@ -23,13 +26,16 @@ import packageJson from "../../package.json" with { type: "json" };
 import { isAuthenticated, type ModelRegistry } from "../config/model-registry";
 import type { CustomTool } from "../extensibility/custom-tools/types";
 import imageGenDescription from "../prompts/tools/image-gen.md" with { type: "text" };
+import { isPrivateOrSpecialAddress, validatePublicHttpUrl } from "../web/insane/url-guard";
 import { resolveReadPath } from "./path-utils";
 
 const DEFAULT_MODEL = "gemini-3-pro-image-preview";
-const DEFAULT_OPENROUTER_MODEL = "google/gemini-3-pro-image-preview";
-const DEFAULT_ANTIGRAVITY_MODEL = "gemini-3-pro-image";
 const IMAGE_TIMEOUT = 3 * 60 * 1000; // 3 minutes
 const MAX_IMAGE_SIZE = 35 * 1024 * 1024;
+const MAX_IMAGE_REDIRECTS = 5;
+const MAX_IMAGE_HEADER_SIZE = 16 * 1024;
+const MAX_IMAGE_ERROR_PREVIEW_SIZE = 8 * 1024;
+const IMAGE_REDIRECT_STATUSES = new Set([301, 302, 303, 307, 308]);
 const DEFAULT_OPENAI_BASE_URL = "https://api.openai.com/v1";
 const OPENAI_IMAGE_OUTPUT_FORMAT = "webp";
 const OPENAI_IMAGE_MIME_TYPE = "image/webp";
@@ -327,6 +333,160 @@ function toDataUrl(image: InlineImageData): string {
 	return `data:${image.mimeType};base64,${image.data}`;
 }
 
+function withAbortSignal<T>(operation: Promise<T>, signal: AbortSignal | undefined): Promise<T> {
+	if (!signal) return operation;
+	if (signal.aborted) return Promise.reject(signal.reason);
+	const deferred = Promise.withResolvers<T>();
+	const abort = () => deferred.reject(signal.reason);
+	signal.addEventListener("abort", abort, { once: true });
+	operation.then(deferred.resolve, deferred.reject).finally(() => signal.removeEventListener("abort", abort));
+	return deferred.promise;
+}
+
+function normalizePeerAddress(address: string): string {
+	const normalized = address.toLowerCase();
+	return normalized.startsWith("::ffff:") ? normalized.slice(7) : normalized;
+}
+
+function normalizeUrlHostname(hostname: string): string {
+	return hostname.startsWith("[") && hostname.endsWith("]") ? hostname.slice(1, -1) : hostname;
+}
+
+function responseHeaderByteLength(response: http.IncomingMessage): number {
+	let bytes = Buffer.byteLength(
+		`HTTP/${response.httpVersion} ${response.statusCode ?? ""}${response.statusMessage ? ` ${response.statusMessage}` : ""}\r\n`,
+	);
+	for (let index = 0; index < response.rawHeaders.length; index += 2) {
+		bytes += Buffer.byteLength(`${response.rawHeaders[index] ?? ""}: ${response.rawHeaders[index + 1] ?? ""}\r\n`);
+	}
+	return bytes + Buffer.byteLength("\r\n");
+}
+
+async function validateImageUrl(rawUrl: string, signal: AbortSignal | undefined) {
+	return withAbortSignal(validatePublicHttpUrl(rawUrl), signal);
+}
+
+function openImageResponse(
+	url: URL,
+	addresses: string[],
+	signal: AbortSignal | undefined,
+): Promise<http.IncomingMessage> {
+	const hostname = normalizeUrlHostname(url.hostname);
+	const approved = addresses.map(address => ({ address, family: net.isIP(address) }));
+	const approvedPeers = new Set(approved.map(record => normalizePeerAddress(record.address)));
+	const lookup: net.LookupFunction = (requestedHostname, options, callback) => {
+		const requestedFamily = options.family === "IPv4" ? 4 : options.family === "IPv6" ? 6 : (options.family ?? 0);
+		const matching = approved.filter(record => requestedFamily === 0 || record.family === requestedFamily);
+		if (normalizeUrlHostname(requestedHostname) !== hostname || matching.length === 0) {
+			const error = Object.assign(new Error("No approved address for image host"), { code: "ENOTFOUND" });
+			callback(error, options.all ? [] : "", 0);
+			return;
+		}
+		if (options.all) callback(null, matching);
+		else callback(null, matching[0].address, matching[0].family);
+	};
+	const deferred = Promise.withResolvers<http.IncomingMessage>();
+	const options: https.RequestOptions = {
+		protocol: url.protocol,
+		hostname,
+		port: url.port || undefined,
+		path: `${url.pathname}${url.search}`,
+		method: "GET",
+		headers: { Accept: "image/*", "Accept-Encoding": "identity", Connection: "close", Host: url.host },
+		agent: false,
+		insecureHTTPParser: false,
+		lookup,
+		maxHeaderSize: MAX_IMAGE_HEADER_SIZE,
+		signal,
+		...(url.protocol === "https:"
+			? { rejectUnauthorized: true, servername: net.isIP(hostname) === 0 ? hostname : undefined }
+			: {}),
+	};
+	const requestFn = url.protocol === "https:" ? https.request : http.request;
+	const request = requestFn(options, response => {
+		if (responseHeaderByteLength(response) > MAX_IMAGE_HEADER_SIZE) {
+			response.destroy();
+			deferred.reject(new Error("Image response headers exceed the maximum size of 16 KiB"));
+			return;
+		}
+		const peer = response.socket.remoteAddress;
+		if (peer && (isPrivateOrSpecialAddress(peer) || !approvedPeers.has(normalizePeerAddress(peer)))) {
+			response.destroy();
+			deferred.reject(new Error("Refusing image response from an unapproved connected peer"));
+			return;
+		}
+		deferred.resolve(response);
+	});
+	request.once("error", deferred.reject);
+	const abort = () => {
+		request.destroy(signal?.reason);
+		deferred.reject(signal?.reason);
+	};
+	if (signal?.aborted) abort();
+	else signal?.addEventListener("abort", abort, { once: true });
+	request.once("close", () => signal?.removeEventListener("abort", abort));
+	request.end();
+	return deferred.promise;
+}
+
+function validateImageResponseFraming(response: http.IncomingMessage): void {
+	const rawContentLengths: string[] = [];
+	let hasTransferEncoding = false;
+	for (let index = 0; index < response.rawHeaders.length; index += 2) {
+		const name = response.rawHeaders[index]?.toLowerCase();
+		if (name === "content-length") rawContentLengths.push(response.rawHeaders[index + 1] ?? "");
+		if (name === "transfer-encoding") hasTransferEncoding = true;
+	}
+	if (rawContentLengths.length > 1 || (rawContentLengths.length > 0 && hasTransferEncoding)) {
+		response.destroy();
+		throw new Error("Image response has ambiguous framing");
+	}
+	const contentLength = response.headers["content-length"];
+	if (contentLength === undefined) return;
+	const declaredBytes = typeof contentLength === "string" && /^\d+$/.test(contentLength) ? Number(contentLength) : NaN;
+	if (!Number.isSafeInteger(declaredBytes)) {
+		response.destroy();
+		throw new Error("Image response has an invalid Content-Length");
+	}
+	if (declaredBytes > MAX_IMAGE_SIZE) {
+		response.destroy();
+		throw new Error("Image response exceeds the maximum size of 35 MiB");
+	}
+}
+
+async function readImageResponse(
+	response: http.IncomingMessage,
+	maxBytes: number,
+	signal: AbortSignal | undefined,
+): Promise<Buffer> {
+	const abort = () => response.destroy(signal?.reason);
+	if (signal?.aborted) {
+		abort();
+		throw signal.reason;
+	}
+	signal?.addEventListener("abort", abort, { once: true });
+	const chunks: Buffer[] = [];
+	let receivedBytes = 0;
+	try {
+		for await (const chunk of response) {
+			const bytes = Buffer.from(chunk);
+			receivedBytes += bytes.byteLength;
+			if (receivedBytes > maxBytes) {
+				response.destroy();
+				throw new Error(
+					maxBytes === MAX_IMAGE_SIZE
+						? "Image response exceeds the maximum size of 35 MiB"
+						: "Image download error response exceeded the preview limit",
+				);
+			}
+			chunks.push(bytes);
+		}
+		return Buffer.concat(chunks, receivedBytes);
+	} finally {
+		signal?.removeEventListener("abort", abort);
+	}
+}
+
 async function loadImageFromUrl(imageUrl: string, signal?: AbortSignal): Promise<InlineImageData> {
 	if (imageUrl.startsWith("data:")) {
 		const normalized = normalizeDataUrl(imageUrl.trim());
@@ -339,17 +499,40 @@ async function loadImageFromUrl(imageUrl: string, signal?: AbortSignal): Promise
 		return { data: normalized.data, mimeType: normalized.mimeType };
 	}
 
-	const response = await fetch(imageUrl, { signal });
-	if (!response.ok) {
-		const rawText = await response.text();
-		throw new Error(`Image download failed (${response.status}): ${rawText}`);
-	}
-	const contentType = response.headers.get("content-type")?.split(";")[0];
-	if (!contentType?.startsWith("image/")) {
-		throw new Error(`Unsupported image type from URL: ${imageUrl}`);
+	let currentUrl = imageUrl;
+	for (let redirectCount = 0; ; redirectCount++) {
+		const guard = await validateImageUrl(currentUrl, signal);
+		if (!guard.ok) {
+			throw new Error(`Refusing image URL: target URL is not public HTTP(S): ${guard.reason}`);
+		}
+		const response = await openImageResponse(guard.url, guard.addresses, signal);
+		const status = response.statusCode ?? 0;
+		if (IMAGE_REDIRECT_STATUSES.has(status)) {
+			if (redirectCount >= MAX_IMAGE_REDIRECTS) {
+				response.destroy();
+				throw new Error("Too many redirects downloading image");
+			}
+			const location = response.headers.location;
+			response.destroy();
+			if (!location) throw new Error("Image redirect is missing a Location header");
+			currentUrl = new URL(location, guard.url).toString();
+			continue;
+		}
+		validateImageResponseFraming(response);
+		if (status < 200 || status >= 300) {
+			const preview = (await readImageResponse(response, MAX_IMAGE_ERROR_PREVIEW_SIZE, signal)).toString("utf8");
+			throw new Error(`Image download failed (${status}): ${preview}`);
+		}
+		const rawContentType = response.headers["content-type"];
+		const contentType =
+			typeof rawContentType === "string" ? rawContentType.split(";", 1)[0]?.trim().toLowerCase() : undefined;
+		if (!contentType?.startsWith("image/")) {
+			response.destroy();
+			throw new Error("Image response is missing a supported image Content-Type");
+		}
+		const buffer = await readImageResponse(response, MAX_IMAGE_SIZE, signal);
+		return { data: buffer.toBase64(), mimeType: contentType };
 	}
-	const buffer = await response.bytes();
-	return { data: buffer.toBase64(), mimeType: contentType };
 }
 
 function collectOpenRouterResponseText(message: OpenRouterMessage | undefined): string | undefined {
@@ -399,6 +582,49 @@ export function setPreferredImageProvider(provider: ImageProvider | "auto"): voi
 	preferredImageProvider = provider;
 }
 
+/** Provider → default image model mapping for auto-binding */
+export const IMAGE_PROVIDER_DEFAULTS: Record<string, string> = {
+	openai: "gpt-image-2",
+	"openai-codex": "gpt-image-2",
+	antigravity: "gemini-3-pro-image",
+	gemini: "gemini-3-pro-image-preview",
+	openrouter: "google/gemini-3-pro-image-preview",
+};
+
+/** Resolved image generation configuration from settings */
+export interface ImageProviderConfig {
+	provider: ImageProvider | "auto" | "custom";
+	model: string | null;
+	customUrl?: string;
+	customKey?: string;
+	customKeyEnv?: string;
+}
+
+/** Module-level configured image model state (set from settings at session init) */
+let configuredImageConfig: ImageProviderConfig | null = null;
+
+/** Set the configured image provider + model from settings */
+export function setConfiguredImageModel(config: ImageProviderConfig | null): void {
+	configuredImageConfig = config;
+	// Keep preferredImageProvider in sync for backward compat
+	if (config && config.provider !== "auto" && config.provider !== "custom") {
+		preferredImageProvider = config.provider;
+	} else if (!config || config.provider === "auto") {
+		preferredImageProvider = "auto";
+	}
+}
+
+/** Get the current configured image model (for UI display) */
+export function getConfiguredImageModel(): ImageProviderConfig | null {
+	return configuredImageConfig;
+}
+
+/** Resolve the effective image model for a configured provider */
+export function resolveImageModel(provider: string, modelOverride: string | null): string {
+	if (modelOverride) return modelOverride;
+	return IMAGE_PROVIDER_DEFAULTS[provider] ?? DEFAULT_MODEL;
+}
+
 interface ParsedAntigravityCredentials {
 	accessToken: string;
 	projectId?: string;
@@ -420,6 +646,22 @@ function parseAntigravityCredentials(raw: string): ParsedAntigravityCredentials
 	return rawToken.length > 0 ? { accessToken: rawToken } : null;
 }
 
+function createCustomImageModel(baseUrl: string, id: string): Model<"openai-responses"> {
+	return {
+		id,
+		name: id,
+		api: "openai-responses",
+		provider: "openai",
+		baseUrl: baseUrl.replace(/\/+$/, ""),
+		reasoning: false,
+		input: ["text"],
+		output: ["text", "image"],
+		cost: { input: 0, output: 0, cacheRead: 0, cacheWrite: 0 },
+		contextWindow: 128_000,
+		maxTokens: 16_384,
+	};
+}
+
 async function findAntigravityCredentials(
 	modelRegistry: ModelRegistry,
 	sessionId?: string,
@@ -467,7 +709,44 @@ async function findImageApiKey(
 	activeModel?: Model,
 	sessionId?: string,
 ): Promise<ImageApiKey | null> {
-	// If a specific provider is preferred, try it first.
+	// Config-driven routing: if an explicit provider+model is configured, use it.
+	if (configuredImageConfig && configuredImageConfig.provider !== "auto") {
+		const config = configuredImageConfig;
+		if (config.provider === "custom") {
+			const baseUrl = config.customUrl?.trim();
+			const apiKey = config.customKey ?? (config.customKeyEnv ? Bun.env[config.customKeyEnv] : undefined);
+			if (baseUrl && apiKey) {
+				return {
+					provider: "openai",
+					apiKey,
+					model: createCustomImageModel(baseUrl, config.model ?? IMAGE_PROVIDER_DEFAULTS.openai),
+				};
+			}
+			return null;
+		}
+		// For configured providers, resolve credentials through the existing paths.
+		if (config.provider === "openai" || config.provider === "openai-codex") {
+			const openAI = await findOpenAIHostedImageCredentials(modelRegistry, activeModel, sessionId);
+			if (openAI) return openAI;
+			return null;
+		}
+		if (config.provider === "antigravity") {
+			if (!modelRegistry) return null;
+			return await findAntigravityCredentials(modelRegistry, sessionId);
+		}
+		if (config.provider === "gemini") {
+			const geminiKey = getEnvApiKey("google");
+			if (geminiKey) return { provider: "gemini", apiKey: geminiKey };
+			const googleKey = $env.GOOGLE_API_KEY;
+			return googleKey ? { provider: "gemini", apiKey: googleKey } : null;
+		}
+		if (config.provider === "openrouter") {
+			const openRouterKey = getEnvApiKey("openrouter");
+			return openRouterKey ? { provider: "openrouter", apiKey: openRouterKey } : null;
+		}
+	}
+
+	// If a specific provider is preferred (legacy path), try it first.
 	if (preferredImageProvider === "openai") {
 		const openAI = await findOpenAIHostedImageCredentials(modelRegistry, activeModel, sessionId);
 		if (openAI) return openAI;
@@ -945,13 +1224,15 @@ export const imageGenTool: CustomTool<typeof imageGenSchema, ImageGenToolDetails
 
 			const provider = apiKey.provider;
 			const model =
-				provider === "openai" || provider === "openai-codex"
-					? (apiKey.model?.id ?? "gpt")
-					: provider === "antigravity"
-						? DEFAULT_ANTIGRAVITY_MODEL
-						: provider === "openrouter"
-							? DEFAULT_OPENROUTER_MODEL
-							: DEFAULT_MODEL;
+				configuredImageConfig && configuredImageConfig.provider !== "auto" && configuredImageConfig.model
+					? configuredImageConfig.model
+					: provider === "openai" || provider === "openai-codex"
+						? (apiKey.model?.id ?? resolveImageModel(provider, null))
+						: provider === "antigravity"
+							? resolveImageModel("antigravity", null)
+							: provider === "openrouter"
+								? resolveImageModel("openrouter", null)
+								: resolveImageModel("gemini", null);
 			const resolvedModel = provider === "openrouter" ? resolveOpenRouterModel(model) : model;
 			const cwd = ctx.sessionManager.getCwd();
 

package/src/tools/read.ts

@@ -73,6 +73,7 @@ import {
 } from "./path-utils";
 import { formatBytes, replaceTabs, shortenPath, wrapBrackets } from "./render-utils";
 import {
+	enforceSqliteQueryOnly,
 	executeReadQuery,
 	getRowByKey,
 	getRowByRowId,
@@ -1272,6 +1273,7 @@ export class ReadTool implements AgentTool<typeof readSchema, ReadToolDetails> {
 		let db: Database | null = null;
 		try {
 			db = new Database(resolvedSqlitePath.absolutePath, { readonly: true, strict: true });
+			enforceSqliteQueryOnly(db);
 			db.run("PRAGMA busy_timeout = 3000");
 			throwIfAborted(signal);
 

package/src/tools/skill-discovery.ts

@@ -21,6 +21,13 @@ export type SkillDiscoveryToolInput = z.infer<typeof skillDiscoverySchema>;
 export interface SkillDiscoveryToolDetails {
 	candidates: RuntimeSkillDiscoveryCandidate[];
 	count: number;
+	/**
+	 * Present only when zero candidates were returned AND discovery config gates
+	 * (`skills.enabled` / `skills.enablePiProject` / `skills.enablePiUser`)
+	 * prevented some or all of the requested scope from being searched. Without
+	 * this, a disabled config is indistinguishable from "no skills exist".
+	 */
+	notice?: string;
 }
 
 export class SkillDiscoveryTool implements AgentTool<typeof skillDiscoverySchema, SkillDiscoveryToolDetails> {
@@ -57,17 +64,46 @@ export class SkillDiscoveryTool implements AgentTool<typeof skillDiscoverySchema
 		signal?: AbortSignal,
 	): Promise<AgentToolResult<SkillDiscoveryToolDetails>> {
 		return untilAborted(signal, async () => {
+			const source = input.source ?? "all";
 			const candidates = await discoverRuntimeSkills({
 				cwd: this.#session.cwd,
 				query: input.query,
-				source: input.source ?? "all",
+				source,
 				limit: input.limit,
 				policy: this.#getRuntimeSkillPolicy(),
 			});
+			const details: SkillDiscoveryToolDetails = { candidates, count: candidates.length };
+			if (candidates.length === 0) {
+				const notice = this.#disabledPolicyNotice(source);
+				if (notice) details.notice = notice;
+			}
 			return {
-				content: [{ type: "text", text: JSON.stringify({ candidates, count: candidates.length }, null, 2) }],
-				details: { candidates, count: candidates.length },
+				content: [{ type: "text", text: JSON.stringify(details, null, 2) }],
+				details,
 			};
 		});
 	}
+
+	/**
+	 * Explain an empty result that is caused by disabled discovery config rather
+	 * than by an actually empty skill catalog.
+	 */
+	#disabledPolicyNotice(source: "all" | "project" | "user"): string | undefined {
+		const policy = this.#getRuntimeSkillPolicy();
+		if (policy.enabled !== true) {
+			return "Runtime skill discovery is disabled: `skills.enabled` is false, so no skill directories were searched. Enable it with `gjc config set skills.enabled true` (project and user scopes additionally require `skills.enablePiProject` / `skills.enablePiUser`).";
+		}
+		const skipped: string[] = [];
+		const commands: string[] = [];
+		if ((source === "all" || source === "project") && policy.enablePiProject !== true) {
+			skipped.push("project (`skills.enablePiProject` is false)");
+			commands.push("`gjc config set skills.enablePiProject true`");
+		}
+		if ((source === "all" || source === "user") && policy.enablePiUser !== true) {
+			skipped.push("user (`skills.enablePiUser` is false)");
+			commands.push("`gjc config set skills.enablePiUser true`");
+		}
+		if (skipped.length === 0) return undefined;
+		return `Skill discovery skipped disabled scope(s): ${skipped.join(", ")}. Enable them with ${commands.join(" and ")}.`;
+	}
 }

package/src/tools/sqlite-reader.ts

@@ -272,6 +272,7 @@ const COMMENT_OR_TERMINATOR_ERROR =
 	"SQLite 'where' clause must not contain comments or statement terminators; use '?q=SELECT ...' for raw SQL";
 const FORBIDDEN_KEYWORD_ERROR =
 	"SQLite 'where' clause must not contain LIMIT/OFFSET/UNION/INTERSECT/EXCEPT/ATTACH/DETACH/PRAGMA; use '?q=SELECT ...' for raw SQL";
+const RAW_QUERY_ERROR = "SQLite raw queries must contain exactly one explicit SELECT statement";
 
 /**
  * Scans a `where=` clause character-by-character, tracking single- and double-quoted
@@ -363,6 +364,66 @@ function validateWhereClause(where: string | undefined): string | undefined {
 	return trimmed;
 }
 
+/**
+ * Keep raw reads deliberately narrower than SQLite's full grammar. Comments are
+ * rejected, and a statement terminator is accepted only as the final
+ * non-whitespace character. Quoted semicolons remain ordinary query data.
+ */
+export function validateSqliteReadQuery(sql: string): string {
+	const trimmed = sql.trim();
+	if (!/^SELECT\b/i.test(trimmed)) {
+		throw new ToolError(RAW_QUERY_ERROR);
+	}
+
+	let quoteEnd: "'" | '"' | "`" | "]" | null = null;
+	for (let index = 0; index < trimmed.length; index++) {
+		const char = trimmed[index];
+		const next = trimmed[index + 1];
+		if (char === "\0") {
+			throw new ToolError(RAW_QUERY_ERROR);
+		}
+
+		if (quoteEnd) {
+			if (char === quoteEnd) {
+				if (quoteEnd !== "]" && next === quoteEnd) {
+					index += 1;
+				} else {
+					quoteEnd = null;
+				}
+			}
+			continue;
+		}
+
+		if (char === "'" || char === '"' || char === "`") {
+			quoteEnd = char;
+			continue;
+		}
+		if (char === "[") {
+			quoteEnd = "]";
+			continue;
+		}
+		if ((char === "-" && next === "-") || (char === "/" && next === "*") || (char === "*" && next === "/")) {
+			throw new ToolError(RAW_QUERY_ERROR);
+		}
+		if (char === ";" && trimmed.slice(index + 1).trim().length > 0) {
+			throw new ToolError(RAW_QUERY_ERROR);
+		}
+	}
+
+	if (quoteEnd) {
+		throw new ToolError(RAW_QUERY_ERROR);
+	}
+	return trimmed;
+}
+
+export function enforceSqliteQueryOnly(db: Database): void {
+	db.run("PRAGMA query_only = ON");
+	const enabled = db.prepare<{ query_only: number }, []>("PRAGMA query_only").get()?.query_only;
+	if (enabled !== 1) {
+		throw new ToolError("SQLite read connection could not enable query-only mode");
+	}
+}
+
 function normalizeWriteValue(value: unknown, column: string): SqliteBinding {
 	if (value === null) return null;
 	if (
@@ -444,10 +505,7 @@ export function parseSqliteSelector(subPath: string, queryString: string): Sqlit
 		if (normalizedSubPath || otherKeys.length > 0) {
 			throw new ToolError("SQLite raw queries cannot be combined with table selectors or pagination");
 		}
-		if (!rawQuery.trim()) {
-			throw new ToolError("SQLite query parameter 'q' cannot be empty");
-		}
-		return { kind: "raw", sql: rawQuery };
+		return { kind: "raw", sql: validateSqliteReadQuery(rawQuery) };
 	}
 
 	if (!normalizedSubPath) {
@@ -602,7 +660,7 @@ export function executeReadQuery(
 	sql: string,
 	maxRows: number = MAX_RAW_QUERY_ROWS,
 ): { columns: string[]; rows: Record<string, unknown>[]; truncated: boolean } {
-	const statement = db.prepare<SqliteRow, []>(sql);
+	const statement = db.prepare<SqliteRow, []>(validateSqliteReadQuery(sql));
 	if (statement.paramsCount > 0) {
 		throw new ToolError("SQLite raw queries do not support bound parameters");
 	}

package/src/utils/pasted-image-path.ts

@@ -143,6 +143,7 @@ function tokenizePastedPathCandidates(
 	text: string,
 	options: DecodePastedPathOptions,
 	maxCandidates: number,
+	requireCompletePayload = false,
 ): TokenizePastedPathsResult {
 	if (text.length > MAX_PASTED_IMAGE_PASTE_CHARACTERS) return { kind: "invalid" };
 	const platform = options.platform ?? process.platform;
@@ -154,7 +155,9 @@ function tokenizePastedPathCandidates(
 
 	const startCandidate = (): TokenizePastedPathsResult | undefined => {
 		if (candidateStarted) return undefined;
-		if (candidates.length >= maxCandidates) return { kind: "too-many", maxCandidates, candidates: [...candidates] };
+		if (!requireCompletePayload && candidates.length >= maxCandidates) {
+			return { kind: "too-many", maxCandidates, candidates: [...candidates] };
+		}
 		candidateStarted = true;
 		return undefined;
 	};
@@ -167,7 +170,9 @@ function tokenizePastedPathCandidates(
 	const finishCandidate = (): TokenizePastedPathsResult | undefined => {
 		if (!candidateStarted) return undefined;
 		if (!candidate) return { kind: "invalid" };
-		if (candidates.length >= maxCandidates) return { kind: "too-many", maxCandidates, candidates: [...candidates] };
+		if (!requireCompletePayload && candidates.length >= maxCandidates) {
+			return { kind: "too-many", maxCandidates, candidates: [...candidates] };
+		}
 		const decoded = decodeListToken(candidate, options, platform);
 		if (decoded === undefined) return { kind: "invalid" };
 		candidates.push(decoded);
@@ -225,6 +230,7 @@ function tokenizePastedPathCandidates(
 	if (state !== "normal") return { kind: "invalid" };
 	const finalResult = finishCandidate();
 	if (finalResult) return finalResult;
+	if (candidates.length > maxCandidates) return { kind: "too-many", maxCandidates, candidates };
 	return candidates.length === 0 ? { kind: "invalid" } : { kind: "candidates", candidates };
 }
 
@@ -257,8 +263,12 @@ function isRecognizedClipboardTempPath(filePath: string, platform: NodeJS.Platfo
 /** Resolve one recognized clipboard-temp image path lexically, before any filesystem access. */
 export function resolvePastedImagePath(text: string, options: ResolvePastedImagePathOptions = {}): string | undefined {
 	const platform = options.platform ?? process.platform;
-	const candidate = decodePastedPathCandidate(text, options);
-	if (!candidate || !IMAGE_FILE_EXTENSION_PATTERN.test(candidate)) return undefined;
+	const terminalNewlinesTrimmed = text.replace(/(?:\r\n|\r|\n)+$/, "");
+	if (/\r|\n/.test(terminalNewlinesTrimmed)) return undefined;
+	const candidates = decodePastedPathCandidates(terminalNewlinesTrimmed, options, 1);
+	if (candidates?.length !== 1) return undefined;
+	const candidate = candidates[0];
+	if (!IMAGE_FILE_EXTENSION_PATTERN.test(candidate)) return undefined;
 	if (platform === "win32" && isRemoteWindowsPath(candidate)) return undefined;
 	const resolved = resolveCandidate(candidate, options, platform);
 	return isRecognizedClipboardTempPath(resolved, platform) ? resolved : undefined;
@@ -274,10 +284,9 @@ export function parsePastedImagePaths(
 	options: ResolvePastedImagePathOptions = {},
 ): PastedImagePathParseResult | undefined {
 	const platform = options.platform ?? process.platform;
-	const tokenized = tokenizePastedPathCandidates(text, options, MAX_PASTED_IMAGE_COUNT);
+	const tokenized = tokenizePastedPathCandidates(text, options, MAX_PASTED_IMAGE_COUNT, true);
 	if (tokenized.kind === "too-many") {
 		if (
-			tokenized.candidates.length !== MAX_PASTED_IMAGE_COUNT ||
 			tokenized.candidates.some(
 				candidate =>
 					!IMAGE_FILE_EXTENSION_PATTERN.test(candidate) ||