@openlines/opl-pi-sht 0.2.7 → 0.2.9

package/extensions/opl-guardian/index.ts

@@ -8,8 +8,6 @@ import {
   type SessionBeforeSwitchEvent,
   type ToolCallEvent,
 } from "@earendil-works/pi-coding-agent";
-import { DynamicBorder } from "@earendil-works/pi-coding-agent";
-import { Container, SelectList, Spacer, Text, type SelectItem } from "@earendil-works/pi-tui";
 import { appendFile, chmod, mkdir, stat } from "node:fs/promises";
 import { join } from "node:path";
 
@@ -22,6 +20,12 @@ import {
 import { getProtectedPathBlock, hasPendingUserWork } from "./policies.js";
 
 const LOG_PATH = join("err", "guardian.jsonl");
+const RED = "\u001b[31m";
+const RESET_FOREGROUND = "\u001b[39m";
+
+function red(text: string): string {
+  return `${RED}${text}${RESET_FOREGROUND}`;
+}
 
 export async function appendIncident(cwd: string, incident: GuardianIncident): Promise<void> {
   const directory = join(cwd, "err");
@@ -50,9 +54,14 @@ function diagnostic(removed: number, logError?: unknown): string {
 }
 
 function appendDiagnostic(message: AssistantMessage, text: string, invalidOnly: boolean): AssistantMessage {
+  // For a mixed response (valid tool calls remain), prepend the notice rather than
+  // appending a trailing text block after toolCall blocks: providers such as Anthropic
+  // require each tool_use to be followed by a tool_result, so a trailing text block does
+  // not round-trip through the wire format. Text-before-tool-calls is the standard
+  // assistant shape. convertToLlm passes assistant messages through as-is.
   const content = invalidOnly
     ? [{ type: "text" as const, text: `${text} No tool was executed; send another prompt to continue.` }]
-    : [...message.content, { type: "text" as const, text }];
+    : [{ type: "text" as const, text }, ...message.content];
   return { ...message, content, stopReason: invalidOnly ? "stop" : "toolUse" };
 }
 
@@ -80,6 +89,14 @@ export async function guardMessageEnd(
 
 export function createToolCallHandler(config: GuardianConfig) {
   return async (event: ToolCallEvent, ctx: ExtensionContext) => {
+    // Defense in depth: createMessageEndHandler already drops malformed tool calls
+    // (blank id or name) before they reach execution, but block any that still get
+    // here anyway (e.g. a replay path or a provider that streamed them directly).
+    // Optional chaining tolerates a *missing* id/name, not just a blank string.
+    if (!event.toolCallId?.trim() || !event.toolName?.trim()) {
+      return { block: true, reason: "[opl-guardian] Blocked a malformed tool call with a blank id or name." };
+    }
+
     let toolPath: string | undefined;
     if (isToolCallEventType("read", event)) toolPath = event.input.path;
     else if (isToolCallEventType("write", event)) toolPath = event.input.path;
@@ -92,7 +109,7 @@ export function createToolCallHandler(config: GuardianConfig) {
         const reason = blocked.unresolved
           ? `[opl-guardian] Cannot safely resolve path "${blocked.path}"; ${blocked.operation} denied by protected-path policy.`
           : `[opl-guardian] Path "${blocked.path}" is protected (${blocked.operation} denied).`;
-        if (ctx.hasUI) ctx.ui.notify(reason, "warning");
+        if (ctx.hasUI) ctx.ui.notify(red(reason), "warning");
         return { block: true, reason };
       }
     }
@@ -106,10 +123,14 @@ export function createToolCallHandler(config: GuardianConfig) {
     }
 
     const command = event.input.command;
+    const preview = command.replace(/\s+/g, " ").trim();
+    // Fail closed: order "No" first so an accidental confirmation (or a replayed
+    // input event hitting a freshly-focused dialog) denies instead of approves.
+    // Only an explicit "Yes" selection approves the command.
+    const options = ["No", "Yes"];
     if (ctx.mode === "rpc") {
-      const preview = command.replace(/\s+/g, " ").trim();
       try {
-        const choice = await ctx.ui.select(`Dangerous command: ${preview.slice(0, 256)}\nAllow?`, ["Yes", "No"]);
+        const choice = await ctx.ui.select(red(`Dangerous command:\n\n${preview.slice(0, 256)}\n\nAllow?`), options);
         if (choice === "Yes") return undefined;
       } catch {
         // A failed RPC dialog is not approval.
@@ -117,55 +138,10 @@ export function createToolCallHandler(config: GuardianConfig) {
       return { block: true, reason: "[opl-guardian] Command blocked; confirmation was declined or unavailable." };
     }
 
-    const items: SelectItem[] = [
-      { value: "yes", label: "Yes" },
-      { value: "no", label: "No" },
-    ];
-    const choice = await ctx.ui.custom<string | null>((tui, theme, keybindings, done) => {
-      const border = new DynamicBorder((text: string) => theme.fg("border", text));
-      const label = new Text(theme.fg("text", "Dangerous command detected:"), 1, 0);
-      const preview = command.replace(/\s+/g, " ").trim();
-      const commandText = new Text(theme.fg("error", preview.length > 256 ? `${preview.slice(0, 256)}…` : preview), 1, 0);
-      const question = new Text(theme.fg("text", "Allow this command?"), 1, 0);
-      const selectList = new SelectList(items, Math.min(items.length, 10), {
-        selectedPrefix: (text) => theme.fg("accent", text),
-        selectedText: (text) => theme.fg("accent", text),
-        description: (text) => theme.fg("muted", text),
-        scrollInfo: (text) => theme.fg("dim", text),
-        noMatch: (text) => theme.fg("warning", text),
-      });
-      selectList.onSelect = (item) => done(item.value);
-      selectList.onCancel = () => done(null);
-
-      const container = new Container();
-      container.addChild(border);
-      container.addChild(new Spacer());
-      container.addChild(label);
-      container.addChild(commandText);
-      container.addChild(new Spacer());
-      container.addChild(question);
-      container.addChild(selectList);
-      container.addChild(new Spacer());
-      container.addChild(new Text(theme.fg("dim", "↑↓ navigate  enter select  esc cancel"), 1, 0));
-      container.addChild(border);
-
-      return {
-        render(width: number) { return container.render(width); },
-        invalidate() { container.invalidate(); },
-        handleInput(data: string) {
-          if (keybindings.matches(data, "app.tools.expand")) {
-            ctx.ui.setToolsExpanded(!ctx.ui.getToolsExpanded());
-            return;
-          }
-          selectList.handleInput(data);
-          tui.requestRender();
-        },
-      };
-    });
-
-    if (choice === "yes") return undefined;
+    const choice = await ctx.ui.select(red(`Dangerous command:\n\n${preview.slice(0, 256)}\n\nAllow?`), options);
+    if (choice === "Yes") return undefined;
     const reason = "[opl-guardian] Command blocked by user because it matches a dangerous pattern.";
-    ctx.ui.notify(reason, "warning");
+    ctx.ui.notify(red(reason), "warning");
     return { block: true, reason };
   };
 }
@@ -181,7 +157,7 @@ export function createMessageEndHandler(config: GuardianConfig) {
       sessionId: ctx.sessionManager.getSessionId(),
     });
     if (!guarded) return undefined;
-    ctx.ui?.notify(guarded.diagnostic, "warning");
+    ctx.ui?.notify(red(guarded.diagnostic), "warning");
     return { message: guarded.message };
   };
 }
@@ -202,7 +178,7 @@ export function createSessionBeforeSwitchHandler(config: GuardianConfig) {
     }
 
     if (!ctx.hasUI) return config.confirmDestructive.blockWithoutUI ? { cancel: true } : undefined;
-    return await ctx.ui.confirm(title, message) ? undefined : { cancel: true };
+    return await ctx.ui.confirm(red(title), red(message)) ? undefined : { cancel: true };
   };
 }
 
@@ -211,8 +187,8 @@ export function createSessionBeforeForkHandler(config: GuardianConfig) {
     if (!config.confirmDestructive.forkSession) return undefined;
     if (!ctx.hasUI) return config.confirmDestructive.blockWithoutUI ? { cancel: true } : undefined;
     const confirmed = await ctx.ui.confirm(
-      `Fork from entry ${event.entryId.slice(0, 8)}?`,
-      "Create a new session branch from this point?",
+      red(`Fork from entry ${event.entryId.slice(0, 8)}?`),
+      red("Create a new session branch from this point?"),
     );
     return confirmed ? undefined : { cancel: true };
   };
@@ -222,7 +198,7 @@ export default function (pi: ExtensionAPI) {
   const { config, warnings } = loadGuardianConfig();
   pi.on("session_start", async (_event, ctx) => {
     if (warnings.length && ctx.hasUI) {
-      ctx.ui.notify(`[opl-guardian] Configuration warning(s):\n${warnings.join("\n")}`, "warning");
+      ctx.ui.notify(red(`[opl-guardian] Configuration warning(s):\n${warnings.join("\n")}`), "warning");
     }
   });
 

package/extensions/opl-modes/README.md

@@ -9,7 +9,7 @@ Unified mode manager for Pi. It provides normal, read-only chat, read-only plann
 - `/plan` toggles plan mode, creates or loads a named plan, or accepts `/plan off`.
 - `/execute` selects or executes an existing plan; `/execute <name>` runs a named plan.
 - `--chat` and `--plan` start Pi in the corresponding read-only mode.
-- The configured cycle shortcut rotates through enabled visible modes. Execute mode is excluded from cycling because it requires an active plan. The default `shift+tab` is also Pi's built-in `app.thinking.cycle`, so both fire on one press; rebind either action in `~/.pi/agent/keybindings.json` (or pick another `shortcuts.cycleMode`) if you want them separate.
+- The configured cycle shortcut rotates through enabled visible modes. Execute mode is excluded from cycling because it requires an active plan. The default `ctrl+alt+m` does not collide with any built-in Pi keybinding; set `shortcuts.cycleMode` to rebind.
 
 Plans are Markdown files under `.pi/plans/` with the `plan-` filename prefix. A plan name must contain at least one letter or digit, so `/plan .` or `/plan --` is rejected instead of producing an untitled `plan-.md`. Loading a plan appends a TUI-only card (via `registerEntryRenderer`) so the plan text never enters the model context; the execute-mode system prompt is the single model-facing copy of the plan. `plan_complete` is available in execute mode and in any mode that sets `allowPlanComplete`. On completion, the plan file is deleted when `cleanup.cleanupOnComplete` is enabled. If execution ends without `plan_complete`, execute mode is exited automatically at Pi's `agent_before_settle` boundary (added in Pi 0.87.0) — but only when the run settled as `completed`: an aborted (ESC) or errored run keeps execute mode active so the plan can be resumed. On Pi < 0.87.0 this auto-exit is unavailable because the boundary is never emitted; `plan_complete` still exits the mode on any version.
 
@@ -17,7 +17,7 @@ Plans are Markdown files under `.pi/plans/` with the `plan-` filename prefix. A
 
 ### Mode behavior
 
-Chat and plan modes replace the active tools with configurable read-only tool lists and restrict Bash to safe inspection patterns. The allowlist is checked **per shell segment**, not just at the start of the command line: `&&`, `||`, a lone `&` (backgrounding), `|`, `;`, newlines, `$(...)`, backticks, and `<(`/`>(` each begin a segment, and every segment must match a safe pattern. Segment scanning is quote-aware, so `grep "a|b"` is one command, but a `$(...)` or backtick payload still runs inside double quotes and is split out and checked, so `echo "$(node -e ...)"` cannot hide behind the quoted argument. `cat f && node -e '...'`, `ls; python -c '...'`, and `cat x & rm -rf /` are blocked because their second segment is not safe-listed. Destructive patterns are still checked even when a command matches a safe pattern. The allowlist covers read-only inspection and text filters only: `awk`, `sed`, `xargs`, `perl`, `python`, and `env` are deliberately absent because they can write files, exec programs from their arguments, or dump API keys. Valid user-provided safe and destructive pattern arrays replace the built-in lists, rather than extending them. An explicit empty per-mode array replaces that policy with none; a malformed non-empty per-mode array is ignored and inherits the existing policy.
+Chat and plan modes replace the active tools with configurable read-only tool lists and restrict Bash to safe inspection patterns. The allowlist is checked **per shell segment**, not just at the start of the command line: `&&`, `||`, a lone `&` (backgrounding), `|`, `;`, newlines, `$(...)`, backticks, and `<(`/`>(` each begin a segment, and every segment must match a safe pattern. Segment scanning is quote-aware, so `grep "a|b"` is one command, but a `$(...)` or backtick payload still runs inside double quotes and is split out and checked, so `echo "$(node -e ...)"` cannot hide behind the quoted argument. `cat f && node -e '...'`, `ls; python -c '...'`, and `cat x & rm -rf /` are blocked because their second segment is not safe-listed. Destructive patterns are still checked even when a command matches a safe pattern. The allowlist covers read-only inspection and text filters only: `awk`, `sed`, `xargs`, `perl`, `python`, and `env` are deliberately absent because they can write files, exec programs from their arguments, or dump API keys. Valid user-provided safe and destructive pattern arrays replace the built-in lists, rather than extending them. An explicit empty per-mode array replaces that policy with none; a malformed non-empty per-mode array is ignored and inherits the existing policy. The top-level `bashPatterns.safePatterns`/`destructivePatterns` behave differently: an empty top-level array falls back to the built-in list (it cannot opt out), so opt a mode out with a per-mode `safePatterns: []` or `destructivePatterns: []` instead.
 
 The shared destructive base blocks file mutation primitives (`rm`, `rmdir`, `mv`, `cp`, `mkdir`, `touch`, `chmod`, `chown`, `tee`, `dd`, `shred`, `truncate`), `find -delete`/`-exec`/`-execdir`/`--exec-batch` and find's file-writing predicates (`-fprint`, `-fprint0`, `-fprintf`, `-fls`), any `--output` file (`sort --output`, `git log/diff/show --output`), `sort -o`/`tree -o` in any argument position, `fd -x`/`-X` (and clusters like `-Hx`), `rg --pre`, `jq`'s environment access (`jq -n env`, `$ENV`), `npm`/`yarn`/`pip` install and update forms including `npm audit fix`, state-changing `git` subcommands (including `branch -d`/`-D`/`-m`/`-M`/`-c`/`-C`/`--delete`/`--unset-upstream` and the writing `git remote` subcommands), `sudo`/`su`, `kill`/`pkill`, shell spawns, editors, `uniq`'s output operand (`uniq -c in.txt out.txt`; flags are not operands, so `uniq -c sorted.txt` stays a read), and every redirect that names a file - while descriptor duplication (`2>&1`, `>&2`, `>&-`) and a redirect whose target is exactly `/dev/null` are not writes and stay allowed (`> /dev/null/../tmp/x` is a write, so a path that merely starts with that prefix is blocked). `env` and `printenv` are not safe-listed, since they could dump provider API keys into the model context. Program-name entries are anchored to command position and matched per segment, so a read-only command that merely *mentions* a dangerous word in an argument (`du -sh`, `find . -name '*.sh'`, `ls cp/`, `cat mv.sh`, `git log --grep=rm`, `grep -rn 'touch' src`) stays allowed, and descriptor duplication (`2>&1`, `>&2`, `>&-`) is not mistaken for a file write. Every destructive pattern is tested against the command and each of its segments, with and without quotes/backslashes stripped, so `r"m"` and `-del"ete"` cannot dodge the list. That blocklist split deliberately ignores quotes, so an operator inside a quoted string (`echo "a > b"`) is over-blocked rather than trusted. This is still a heuristic backstop, not a process-isolation boundary: `npx` and any command whose *name* comes from an expansion are outside what a pattern list can catch.
 

package/extensions/opl-questionnaire/README.md

@@ -12,7 +12,7 @@ Adds a model-callable interactive questionnaire for discrete choices, preference
 
 - Renders one question as a compact option list and multiple questions as tabs with a final Submit tab.
 - Questions require an `id`, prompt, options, and optional label or free-text `allowOther` response.
-- Rejects duplicate IDs and questions that cannot be answered; returns `(no response)` for an empty custom answer.
+- Rejects duplicate IDs, blank IDs, and questions that cannot be answered; returns `(no response)` for an empty custom answer.
 - Returns structured answers containing question ID, selected value and label, custom-text flag, and option index where applicable.
 - Blocks submission until every multi-question prompt has an answer.
 - Returns a clear error in headless sessions so the model can use plain-text questions instead.

package/extensions/opl-questionnaire/index.ts

@@ -27,16 +27,41 @@ import {
 	type RenderOption,
 } from "./types.js";
 
-function errorResult(
+/** Build an error tool result. Marked as an error (not a cancellation) so the
+ *  result card renders the message instead of mislabeling it "Cancelled". */
+export function errorResult(
 	message: string,
-	questions: Question[] = [],
-): { content: { type: "text"; text: string }[]; details: QuestionnaireResult } {
+): { content: { type: "text"; text: string }[]; isError: true; details: QuestionnaireResult } {
 	return {
 		content: [{ type: "text", text: message }],
-		details: { questions, answers: [], cancelled: true },
+		isError: true,
+		details: { questions: [], answers: [], cancelled: false },
 	};
 }
 
+/** Validate the question list. Returns the first error message, or null when valid.
+ *  Blank ids are rejected (answers are keyed by id and "" would produce an empty key),
+ *  as are duplicate ids and questions with nothing selectable. */
+export function validateQuestions(questions: Question[]): string | null {
+	const seenIds = new Set<string>();
+	for (const q of questions) {
+		if (q.id.trim() === "") {
+			return "Error: Question id must be a non-empty string";
+		}
+		if (seenIds.has(q.id)) {
+			return `Error: Duplicate question id "${q.id}" — question ids must be unique`;
+		}
+		seenIds.add(q.id);
+	}
+	for (const q of questions) {
+		const allowOther = q.allowOther !== false;
+		if (q.options.length === 0 && !allowOther) {
+			return `Error: Question "${q.id}" has no options and allowOther is false — nothing is selectable`;
+		}
+	}
+	return null;
+}
+
 export default function questionnaire(pi: ExtensionAPI) {
 	pi.registerTool({
 		name: "questionnaire",
@@ -58,23 +83,9 @@ export default function questionnaire(pi: ExtensionAPI) {
 				return errorResult("Error: No questions provided");
 			}
 
-			// Reject duplicate ids — answers are keyed by id and would silently collide.
-			const seenIds = new Set<string>();
-			for (const q of params.questions) {
-				if (seenIds.has(q.id)) {
-					return errorResult(`Error: Duplicate question id "${q.id}" — question ids must be unique`);
-				}
-				seenIds.add(q.id);
-			}
-
-			// Reject unselectable questions (no options and no free-text fallback).
-			for (const q of params.questions) {
-				const allowOther = q.allowOther !== false;
-				if (q.options.length === 0 && !allowOther) {
-					return errorResult(
-						`Error: Question "${q.id}" has no options and allowOther is false — nothing is selectable`,
-					);
-				}
+			const validationError = validateQuestions(params.questions);
+			if (validationError) {
+				return errorResult(validationError);
 			}
 
 			// Normalize questions with defaults
@@ -424,6 +435,10 @@ export default function questionnaire(pi: ExtensionAPI) {
 		},
 
 		renderResult(result, _options, theme, _context) {
+			if (result.isError) {
+				const text = result.content[0];
+				return new Text(theme.fg("error", text?.type === "text" ? text.text : ""), 0, 0);
+			}
 			const details = result.details as QuestionnaireResult | undefined;
 			if (!details) {
 				const text = result.content[0];

package/extensions/opl-webaccess/README.md

@@ -5,8 +5,8 @@ Provides configurable web search and readable URL/PDF retrieval with session-bac
 ## Commands, flags, and shortcuts
 
 - Tools: `web_search`, `fetch_content`, and `get_search_content`.
-- `web_search` accepts `query` or parallel `queries`.
-- `fetch_content` accepts `url` or `urls` with at most three requests in flight.
+- `web_search` accepts `query` or parallel `queries` (at most 10 per call).
+- `fetch_content` accepts `url` or `urls` (at most 20 per call) with at most three requests in flight.
 - `get_search_content` uses a prior `responseId`, with `queryIndex`, `urlIndex`, or exact `url` selection. It returns one bounded page; pass `offset` to continue a truncated retrieval.
 - No slash commands or shortcuts.
 
@@ -14,8 +14,8 @@ Provides configurable web search and readable URL/PDF retrieval with session-bac
 
 - Searches through `gemini`, `tavily`, `ddgs`, `searxng`, or `exa`; multiple queries run concurrently and results include citations where available.
 - Extracts HTML with Readability and Markdown conversion, falls back to full-document Turndown conversion, passes PDF responses to the PDF extractor, and returns plain text, Markdown, and JSON directly.
-- Restricts `fetch_content` to http/https, caps each response at 10 MB, and applies a 30s timeout; Gemini keys are sent via the `x-goog-api-key` header rather than the query string.
-- Caps initial tool output at a configurable length (default 30,000 characters), then keeps it for retrieval for one hour or until the session ends.
+- Restricts `fetch_content` to http/https and blocks private-range, link-local, and reserved hosts by default, re-checks every redirect hop, and always blocks cloud-metadata endpoints (SSRF guard). Loopback (`localhost`/`127.0.0.0/8`/`::1`) is allowed by default for local development; set `allowPrivateNetwork: true` to reach private ranges. Caps each response at 10 MB and applies a 30s timeout; Gemini keys are sent via the `x-goog-api-key` header rather than the query string.
+- Caps initial tool output at a configurable length (default 30,000 characters), then keeps it for retrieval for one hour (expiry is enforced on read, not just on write) or until the session ends.
 - Pages `get_search_content` results (default 30,000 characters per page) with `offset` continuation, so a model never loads the whole stored body in one call.
 - Honors abort signals and returns provider, HTTP, and per-result failures through the tool boundary rather than throwing.
 
@@ -33,7 +33,7 @@ Copy [`configs/opl-webaccess.json.sample`](../../configs/opl-webaccess.json.samp
 }
 ```
 
-Provider fields include `apiKeyEnv`, `apiUrl`, `baseUrl`, `model`, `maxResults`, `instanceUrl`, `categories`, `safeSearch`, `searchType`, and `includeSummary`. API keys are read only from named environment variables. Missing or invalid config falls back to Gemini defaults; an unknown provider returns an error.
+Provider fields include `apiKeyEnv`, `apiUrl`, `baseUrl`, `model`, `maxResults`, `instanceUrl`, `categories`, `safeSearch`, `searchType`, and `includeSummary`. API keys are read only from named environment variables. Malformed config falls back to Gemini defaults - a non-object config, a non-string `provider`, a non-object `providers` map, or non-positive cap values (`maxContentChars`/`maxRetrievalChars`) are all treated as unset; an unknown provider returns an error.
 
 Optional top-level caps control how much content reaches the model:
 
@@ -41,6 +41,9 @@ Optional top-level caps control how much content reaches the model:
 |---|---|---|
 | `maxContentChars` | `30000` | Cap on the initial `web_search`/`fetch_content` body. |
 | `maxRetrievalChars` | `30000` | Cap on one `get_search_content` page. Pass `offset` to continue. |
+| `maxSearchQueries` | `10` | Cap on how many queries one `web_search` call runs. Excess queries are skipped and reported. |
+| `maxFetchUrls` | `20` | Cap on how many URLs one `fetch_content` call fetches. Excess URLs are skipped and reported. |
+| `allowPrivateNetwork` | `false` | Allow `fetch_content` to reach private/link-local ranges (loopback is always allowed; cloud metadata is always blocked). Provider API endpoints (e.g. `ddgs.apiUrl`, `searxng.instanceUrl`) are excluded from this guard. |
 
 Install extraction dependencies before use:
 

package/extensions/opl-webaccess/config.ts

@@ -22,16 +22,36 @@ export interface WebAccessConfig {
   maxContentChars?: number;
   /** Cap on one get_search_content retrieval page (chars). */
   maxRetrievalChars?: number;
+  /** Cap on the number of queries a single web_search call may run. */
+  maxSearchQueries?: number;
+  /** Cap on the number of URLs a single fetch_content call may fetch. */
+  maxFetchUrls?: number;
+  /** Allow fetch_content to reach private/link-local ranges (loopback is always
+   *  allowed; cloud metadata is always blocked). Default false. */
+  allowPrivateNetwork?: boolean;
 }
 
 export const DEFAULT_MAX_CONTENT_CHARS = 30_000;
 export const DEFAULT_MAX_RETRIEVAL_CHARS = 30_000;
+export const DEFAULT_MAX_SEARCH_QUERIES = 10;
+export const DEFAULT_MAX_FETCH_URLS = 20;
 
-/** Resolve configurable content caps, falling back to defaults. */
-export function resolveCaps(cfg: Pick<WebAccessConfig, "maxContentChars" | "maxRetrievalChars">) {
+/** Coerce an unknown value into a positive integer, else the fallback. */
+function positiveInt(value: unknown, fallback: number): number {
+  return typeof value === "number" && Number.isFinite(value) && value > 0 ? value : fallback;
+}
+
+/** Resolve configurable caps, falling back to defaults when a cap is missing or not
+ *  a positive finite number (a string/negative/zero cap would otherwise make
+ *  truncate/slice produce empty, inverted, or unbounded output). */
+export function resolveCaps(
+  cfg: Pick<WebAccessConfig, "maxContentChars" | "maxRetrievalChars" | "maxSearchQueries" | "maxFetchUrls">,
+) {
   return {
-    maxContentChars: cfg.maxContentChars ?? DEFAULT_MAX_CONTENT_CHARS,
-    maxRetrievalChars: cfg.maxRetrievalChars ?? DEFAULT_MAX_RETRIEVAL_CHARS,
+    maxContentChars: positiveInt(cfg.maxContentChars, DEFAULT_MAX_CONTENT_CHARS),
+    maxRetrievalChars: positiveInt(cfg.maxRetrievalChars, DEFAULT_MAX_RETRIEVAL_CHARS),
+    maxSearchQueries: positiveInt(cfg.maxSearchQueries, DEFAULT_MAX_SEARCH_QUERIES),
+    maxFetchUrls: positiveInt(cfg.maxFetchUrls, DEFAULT_MAX_FETCH_URLS),
   };
 }
 
@@ -50,12 +70,43 @@ const DEFAULT_CONFIG: WebAccessConfig = {
 
 export function loadConfig(): WebAccessConfig {
   if (!existsSync(CONFIG_PATH)) return DEFAULT_CONFIG;
+  let parsed: unknown;
   try {
-    return JSON.parse(readFileSync(CONFIG_PATH, "utf-8")) as WebAccessConfig;
+    parsed = JSON.parse(readFileSync(CONFIG_PATH, "utf-8"));
   } catch {
     console.error(`[opl-webaccess] failed to parse ${CONFIG_PATH}, using defaults`);
     return DEFAULT_CONFIG;
   }
+  return normalizeConfig(parsed);
+}
+
+/** Validate a parsed config so malformed fields fall back to defaults instead of
+ *  silently misbehaving downstream (a non-object config, a non-string provider, or
+ *  a non-object providers map are all treated as unset). Cap values are validated
+ *  in resolveCaps. */
+function normalizeConfig(parsed: unknown): WebAccessConfig {
+  if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) {
+    console.error("[opl-webaccess] config is not a JSON object, using defaults");
+    return DEFAULT_CONFIG;
+  }
+  const record = parsed as Record<string, unknown>;
+  const provider =
+    typeof record.provider === "string" && record.provider.trim() !== ""
+      ? record.provider
+      : DEFAULT_CONFIG.provider;
+  const providers =
+    typeof record.providers === "object" && record.providers !== null && !Array.isArray(record.providers)
+      ? (record.providers as Record<string, ProviderConfig>)
+      : DEFAULT_CONFIG.providers;
+  return {
+    provider,
+    providers,
+    maxContentChars: record.maxContentChars as number | undefined,
+    maxRetrievalChars: record.maxRetrievalChars as number | undefined,
+    maxSearchQueries: record.maxSearchQueries as number | undefined,
+    maxFetchUrls: record.maxFetchUrls as number | undefined,
+    allowPrivateNetwork: record.allowPrivateNetwork === true,
+  };
 }
 
 export function getApiKey(cfg: ProviderConfig): string {

package/extensions/opl-webaccess/extract.ts

@@ -2,12 +2,15 @@ import { Readability } from "@mozilla/readability";
 import { parseHTML } from "linkedom";
 import TurndownService from "turndown";
 import { extractPdfBuffer } from "./pdf.js";
-import { errorMessage, isAbortError, isPdfUrl, isPdfContentType, assertHttpUrl } from "./utils.js";
+import { errorMessage, isAbortError, isPdfUrl, isPdfContentType, assertHttpUrl, type HttpUrlOptions } from "./utils.js";
 import type { ExtractedContent } from "./types.js";
 
 const CONCURRENT_LIMIT = 3;
 const MAX_FETCH_BYTES = 10 * 1024 * 1024; // 10 MB response cap
 const FETCH_TIMEOUT_MS = 30_000;
+const MAX_REDIRECTS = 5;
+/** Ceiling on the number of URLs a single fetch_content call may include. */
+export const MAX_FETCH_URLS = 20;
 
 const td = new TurndownService({
   headingStyle: "atx",
@@ -43,31 +46,53 @@ async function readBufferCapped(response: Response, maxBytes: number): Promise<A
 
 export async function fetchAllContent(
   urls: string[],
-  signal?: AbortSignal
+  signal?: AbortSignal,
+  opts: HttpUrlOptions = {},
+  maxUrls: number = MAX_FETCH_URLS,
 ): Promise<ExtractedContent[]> {
+  const bounded = urls.slice(0, maxUrls);
   const results: ExtractedContent[] = [];
-  for (let i = 0; i < urls.length; i += CONCURRENT_LIMIT) {
+  for (let i = 0; i < bounded.length; i += CONCURRENT_LIMIT) {
     if (signal?.aborted) break;
-    const batch = urls.slice(i, i + CONCURRENT_LIMIT);
-    const batchResults = await Promise.all(batch.map((url) => fetchOne(url, signal)));
+    const batch = bounded.slice(i, i + CONCURRENT_LIMIT);
+    const batchResults = await Promise.all(batch.map((url) => fetchOne(url, signal, opts)));
     results.push(...batchResults);
   }
   return results;
 }
 
-async function fetchOne(url: string, signal?: AbortSignal): Promise<ExtractedContent> {
+/**
+ * Fetch with redirects followed manually so each hop is re-validated. The native
+ * `redirect: "follow"` would let a public URL bounce to a private/link-local host
+ * past the `assertHttpUrl` check.
+ */
+async function fetchWithRedirectValidation(
+  url: string,
+  fetchSignal: AbortSignal,
+  opts: HttpUrlOptions
+): Promise<Response> {
+  let current = assertHttpUrl(url, opts);
+  const headers = {
+    "User-Agent": "Mozilla/5.0 (compatible; pi-web-access/1.0)",
+    Accept: "text/html,application/xhtml+xml,application/pdf,*/*",
+  };
+  for (let hop = 0; hop <= MAX_REDIRECTS; hop++) {
+    const response = await fetch(current, { signal: fetchSignal, headers, redirect: "manual" });
+    if (response.status < 300 || response.status >= 400) return response;
+    const location = response.headers.get("location");
+    if (!location) return response; // 3xx without a Location: treat as final
+    await response.body?.cancel().catch(() => {});
+    current = assertHttpUrl(new URL(location, current).href, opts);
+  }
+  throw new Error(`Too many redirects (max ${MAX_REDIRECTS})`);
+}
+
+async function fetchOne(url: string, signal?: AbortSignal, opts: HttpUrlOptions = {}): Promise<ExtractedContent> {
   try {
-    const target = assertHttpUrl(url);
     const fetchSignal = signal
       ? AbortSignal.any([signal, AbortSignal.timeout(FETCH_TIMEOUT_MS)])
       : AbortSignal.timeout(FETCH_TIMEOUT_MS);
-    const response = await fetch(target, {
-      signal: fetchSignal,
-      headers: {
-        "User-Agent": "Mozilla/5.0 (compatible; pi-web-access/1.0)",
-        Accept: "text/html,application/xhtml+xml,application/pdf,*/*",
-      },
-    });
+    const response = await fetchWithRedirectValidation(url, fetchSignal, opts);
 
     if (!response.ok) {
       return { url, title: "", content: "", error: `HTTP ${response.status}: ${url}` };

package/extensions/opl-webaccess/index.ts

@@ -14,7 +14,15 @@ import { loadConfig, resolveCaps } from "./config.js";
 import type { StoredData } from "./types.js";
 
 export default function (pi: ExtensionAPI) {
-  const caps = resolveCaps(loadConfig());
+  const config = loadConfig();
+  const caps = resolveCaps(config);
+  const allowPrivateNetwork = config.allowPrivateNetwork === true;
+
+  // Note shown to the model when the per-call URL/query cap drops some inputs.
+  const skippedNote = (dropped: number, limit: number, singular: string, plural: string) =>
+    dropped > 0
+      ? `\n\n*Note: ${dropped} additional ${dropped === 1 ? singular : plural} beyond the per-call limit of ${limit} ${dropped === 1 ? "was" : "were"} skipped.*`
+      : "";
 
   pi.on("session_start", async (_event, ctx) => {
     restoreFromSession(ctx);
@@ -34,18 +42,27 @@ export default function (pi: ExtensionAPI) {
       ),
     }),
     async execute(_toolCallId, params, signal) {
-      const queryList = params.queries ?? (params.query ? [params.query] : null);
-      if (!queryList?.length) {
+      const rawQueries = params.queries ?? (params.query ? [params.query] : null);
+      if (!rawQueries?.length) {
         return {
           content: [{ type: "text", text: "Error: provide either query or queries." }],
           isError: true,
           details: {} as Record<string, unknown>,
         };
       }
+      const queryList = rawQueries.slice(0, caps.maxSearchQueries);
+      const dropped = rawQueries.length - queryList.length;
 
       let results;
       try {
-        results = await Promise.all(queryList.map((q) => searchWeb(q, signal)));
+        // allSettled so one provider's throw (non-JSON body, missing key) cannot
+        // discard the sibling queries' results.
+        const settled = await Promise.allSettled(queryList.map((q) => searchWeb(q, signal)));
+        results = settled.map((s, i) =>
+          s.status === "fulfilled"
+            ? s.value
+            : { query: queryList[i], answer: "", results: [], error: errorMessage(s.reason) }
+        );
       } catch (err) {
         return {
           content: [{ type: "text", text: `Error: ${errorMessage(err)}` }],
@@ -70,8 +87,9 @@ export default function (pi: ExtensionAPI) {
       });
 
       const body = truncate(sections.join("\n\n---\n\n"), caps.maxContentChars);
+      const note = skippedNote(dropped, caps.maxSearchQueries, "query", "queries");
       return {
-        content: [{ type: "text", text: `${body}\n\n*responseId: ${id}*` }],
+        content: [{ type: "text", text: `${body}${note}\n\n*responseId: ${id}*` }],
         details: { responseId: id, queryCount: results.length },
       };
     },
@@ -101,8 +119,9 @@ export default function (pi: ExtensionAPI) {
       }
 
       let results;
+      const dropped = urlList.length > caps.maxFetchUrls ? urlList.length - caps.maxFetchUrls : 0;
       try {
-        results = await fetchAllContent(urlList, signal);
+        results = await fetchAllContent(urlList, signal, { allowPrivateNetwork }, caps.maxFetchUrls);
       } catch (err) {
         return {
           content: [{ type: "text", text: `Error: ${errorMessage(err)}` }],
@@ -123,8 +142,9 @@ export default function (pi: ExtensionAPI) {
       });
 
       const body = truncate(sections.join("\n\n---\n\n"), caps.maxContentChars);
+      const note = skippedNote(dropped, caps.maxFetchUrls, "URL", "URLs");
       return {
-        content: [{ type: "text", text: `${body}\n\n*responseId: ${id}*` }],
+        content: [{ type: "text", text: `${body}${note}\n\n*responseId: ${id}*` }],
         details: { responseId: id, urlCount: results.length },
       };
     },

package/extensions/opl-webaccess/providers/gemini.ts

@@ -41,7 +41,12 @@ export async function searchGemini(
     return { query, answer: "", results: [], error: errorMessage(err) };
   }
 
-  const data = (await response.json()) as GeminiResponse;
+  let data: GeminiResponse;
+  try {
+    data = (await response.json()) as GeminiResponse;
+  } catch {
+    return { query, answer: "", results: [], error: `Gemini API error: HTTP ${response.status} (non-JSON response)` };
+  }
 
   if (!response.ok) {
     const msg = data.error?.message ?? `HTTP ${response.status}`;

package/extensions/opl-webaccess/providers/tavily.ts

@@ -39,7 +39,12 @@ export async function searchTavily(
     return { query, answer: "", results: [], error: errorMessage(err) };
   }
 
-  const data = (await response.json()) as TavilyResponse;
+  let data: TavilyResponse;
+  try {
+    data = (await response.json()) as TavilyResponse;
+  } catch {
+    return { query, answer: "", results: [], error: `Tavily API error: HTTP ${response.status} (non-JSON response)` };
+  }
 
   if (!response.ok) {
     return { query, answer: "", results: [], error: `Tavily API error: HTTP ${response.status}` };

package/extensions/opl-webaccess/storage.ts

@@ -23,8 +23,14 @@ export function storeResult(id: string, data: StoredData): void {
   evictExpired();
 }
 
-export function getResult(id: string): StoredData | null {
-  return store.get(id) ?? null;
+export function getResult(id: string, now: number = Date.now()): StoredData | null {
+  const data = store.get(id);
+  if (!data) return null;
+  if (now - data.timestamp >= CACHE_TTL_MS) {
+    store.delete(id);
+    return null;
+  }
+  return data;
 }
 
 export function clearStore(): void {