@polpo-ai/tools 0.18.18 → 0.18.20

package/dist/__tests__/http-hardening.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=http-hardening.test.d.ts.map

package/dist/__tests__/http-hardening.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"http-hardening.test.d.ts","sourceRoot":"","sources":["../../src/__tests__/http-hardening.test.ts"],"names":[],"mappings":""}

package/dist/__tests__/http-hardening.test.js

@@ -0,0 +1,188 @@
+/**
+ * http_fetch / http_download hardening: SSRF on redirects, DNS-pinned
+ * connects, bounded bodies and an overall deadline.
+ */
+import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
+import { createServer } from "node:http";
+import { mkdtempSync, rmSync, existsSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { createHttpTools } from "../http-tools.js";
+import { safeFetch, readBodyCapped } from "../safe-fetch.js";
+import { assertUrlAllowed, blockedAddressReason } from "../ssrf-guard.js";
+let cwd;
+const originalFetch = globalThis.fetch;
+beforeEach(() => {
+    cwd = mkdtempSync(join(tmpdir(), "polpo-http-"));
+});
+afterEach(() => {
+    globalThis.fetch = originalFetch;
+    rmSync(cwd, { recursive: true, force: true });
+});
+function tool(name) {
+    return createHttpTools(cwd, [cwd], [name])[0];
+}
+function text(result) {
+    return result.content[0].text;
+}
+function mockFetch(impl) {
+    const fn = vi.fn(impl);
+    globalThis.fetch = fn;
+    return fn;
+}
+function redirect(status, location) {
+    return new Response(null, { status, headers: { location } });
+}
+/** A body that never ends. */
+function endlessBody(onCancel) {
+    const chunk = new Uint8Array(64 * 1024).fill(0x61);
+    return new ReadableStream({
+        pull(controller) { controller.enqueue(chunk); },
+        cancel() { onCancel?.(); },
+    });
+}
+describe("http_fetch — redirects re-apply the SSRF guard", () => {
+    it("refuses a redirect to the cloud metadata address and never requests it", async () => {
+        const fetchMock = mockFetch(async (url) => {
+            if (url.startsWith("https://public.example/"))
+                return redirect(302, "http://169.254.169.254/latest/meta-data/");
+            return new Response("SECRET-CREDENTIALS", { status: 200, headers: { "content-type": "text/plain" } });
+        });
+        const result = await tool("http_fetch").execute("c1", { url: "https://public.example/start" });
+        expect(fetchMock).toHaveBeenCalledTimes(1);
+        expect(fetchMock.mock.calls[0][1]).toMatchObject({ redirect: "manual" });
+        expect(text(result)).not.toContain("SECRET-CREDENTIALS");
+        expect(result.details).toMatchObject({ error: "ssrf_blocked" });
+        expect(text(result)).toMatch(/169\.254\.169\.254/);
+    });
+    it("refuses redirects to private hosts, IPv4-mapped IPv6 and non-http schemes", async () => {
+        for (const location of ["http://10.0.0.5/", "http://[::ffff:127.0.0.1]:8080/", "http://localhost./", "file:///etc/passwd"]) {
+            const fetchMock = mockFetch(async () => redirect(307, location));
+            const result = await tool("http_fetch").execute("c1", { url: "https://public.example/" });
+            expect(fetchMock).toHaveBeenCalledTimes(1);
+            expect(result.details).toMatchObject({ error: "ssrf_blocked" });
+        }
+    });
+    it("follows public redirects, rewrites 303 to GET and drops credentials across origins", async () => {
+        const fetchMock = mockFetch(async (url) => {
+            if (url === "https://a.example/submit")
+                return redirect(303, "https://b.example/result");
+            return new Response("done", { status: 200, headers: { "content-type": "text/plain" } });
+        });
+        const result = await tool("http_fetch").execute("c1", {
+            url: "https://a.example/submit",
+            method: "POST",
+            headers: { Authorization: "Bearer secret", "Content-Type": "application/json", "X-Trace": "1" },
+            body: "{}",
+        });
+        expect(text(result)).toContain("done");
+        expect(result.details).toMatchObject({ status: 200, redirects: 1, finalUrl: "https://b.example/result" });
+        const second = fetchMock.mock.calls[1];
+        expect(second[0]).toBe("https://b.example/result");
+        expect(second[1]).toMatchObject({ method: "GET", body: undefined, redirect: "manual" });
+        expect(second[1].headers).toEqual({ "X-Trace": "1" });
+    });
+    it("stops after the redirect limit", async () => {
+        let n = 0;
+        const fetchMock = mockFetch(async () => redirect(302, `https://loop.example/${++n}`));
+        const result = await tool("http_fetch").execute("c1", { url: "https://loop.example/0" });
+        expect(text(result)).toMatch(/too many redirects/i);
+        expect(fetchMock).toHaveBeenCalledTimes(6);
+    });
+});
+describe("http_fetch — bounded body and overall deadline", () => {
+    it("stops reading an endless body at the cap and marks it truncated", { timeout: 10_000 }, async () => {
+        let cancelled = false;
+        mockFetch(async () => new Response(endlessBody(() => { cancelled = true; }), {
+            status: 200,
+            headers: { "content-type": "text/plain" },
+        }));
+        const result = await tool("http_fetch").execute("c1", { url: "https://big.example/" });
+        expect(text(result)).toMatch(/\[truncated — response body exceeded 100000 bytes\]/);
+        expect(text(result).length).toBeLessThan(110_000);
+        expect(result.details).toMatchObject({ truncated: true });
+        expect(cancelled).toBe(true);
+    });
+    it("applies the timeout to the body read, not just to the headers", { timeout: 10_000 }, async () => {
+        mockFetch(async (_url, init) => {
+            // Headers arrive immediately, the body never does. Mirror real fetch:
+            // aborting the request errors the body stream.
+            const body = new ReadableStream({
+                start(controller) {
+                    init?.signal?.addEventListener("abort", () => controller.error(new DOMException("aborted", "AbortError")));
+                },
+            });
+            return new Response(body, { status: 200, headers: { "content-type": "text/plain" } });
+        });
+        const t0 = Date.now();
+        const result = await tool("http_fetch").execute("c1", { url: "https://slow.example/", timeout: 200 });
+        expect(Date.now() - t0).toBeLessThan(5_000);
+        expect(text(result)).toMatch(/timed out after 200ms/);
+    });
+    it("treats timeout 0 / negative as the default instead of an instant abort", async () => {
+        mockFetch(async () => new Response("ok", { status: 200, headers: { "content-type": "text/plain" } }));
+        for (const timeout of [0, -1]) {
+            const result = await tool("http_fetch").execute("c1", { url: "https://ok.example/", timeout });
+            expect(text(result)).toContain("ok");
+        }
+    });
+    it("http_download reapplies the SSRF guard on redirects", async () => {
+        mockFetch(async () => redirect(301, "http://192.168.1.1/router.cfg"));
+        const result = await tool("http_download").execute("c1", { url: "https://files.example/x", path: "x.bin" });
+        expect(result.details).toMatchObject({ error: "ssrf_blocked" });
+        expect(existsSync(join(cwd, "x.bin"))).toBe(false);
+    });
+});
+describe("safeFetch — DNS answers are validated at connect time", () => {
+    let server;
+    let port;
+    let hits;
+    beforeEach(async () => {
+        hits = 0;
+        server = createServer((_req, res) => { hits++; res.end("internal-only"); });
+        await new Promise((resolve) => server.listen(0, "127.0.0.1", resolve));
+        port = server.address().port;
+    });
+    afterEach(async () => {
+        await new Promise((resolve) => server.close(() => resolve()));
+    });
+    it("refuses a public-looking hostname that resolves to loopback (DNS rebinding)", async () => {
+        const controller = new AbortController();
+        const resolveHostname = async () => ["127.0.0.1"];
+        // The URL itself passes the static guard…
+        expect(() => assertUrlAllowed(`http://rebind.example:${port}/`)).not.toThrow();
+        // …but the connection is refused once DNS answers are inspected.
+        await expect(safeFetch(`http://rebind.example:${port}/`, { signal: controller.signal, resolveHostname })).rejects.toSatisfy((err) => /SSRF blocked/.test(`${err?.message} ${err?.cause?.message}`));
+        expect(hits).toBe(0);
+    });
+    it("refuses when any of the answers is private", async () => {
+        const controller = new AbortController();
+        const resolveHostname = async () => ["93.184.216.34", "10.1.2.3"];
+        await expect(safeFetch(`http://mixed.example:${port}/`, { signal: controller.signal, resolveHostname })).rejects.toSatisfy((err) => /10\.1\.2\.3/.test(`${err?.message} ${err?.cause?.message}`));
+        expect(hits).toBe(0);
+    });
+});
+describe("ssrf guard — address classification", () => {
+    it.each([
+        "127.0.0.1", "10.0.0.1", "100.64.0.1", "169.254.169.254", "0.1.2.3", "224.0.0.1",
+        "::1", "::", "fd00::1", "fe80::1", "::ffff:127.0.0.1", "::ffff:a9fe:a9fe", "64:ff9b::a9fe:a9fe",
+    ])("blocks %s", (address) => {
+        expect(blockedAddressReason(address)).toBeTruthy();
+    });
+    it.each(["8.8.8.8", "93.184.216.34", "2606:4700::1111", "172.32.0.1"])("allows %s", (address) => {
+        expect(blockedAddressReason(address)).toBeUndefined();
+    });
+    it("blocks URL literals that the old guard let through", () => {
+        for (const url of ["http://[::ffff:127.0.0.1]/", "http://[fd12::1]/", "http://100.64.1.1/", "http://localhost./", "http://app.localhost/"]) {
+            expect(() => assertUrlAllowed(url)).toThrow(/SSRF blocked/);
+        }
+    });
+});
+describe("readBodyCapped", () => {
+    it("returns the full body under the cap", async () => {
+        const { bytes, truncated } = await readBodyCapped(new Response("hello"), 10);
+        expect(new TextDecoder().decode(bytes)).toBe("hello");
+        expect(truncated).toBe(false);
+    });
+});
+//# sourceMappingURL=http-hardening.test.js.map

package/dist/__tests__/http-hardening.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"http-hardening.test.js","sourceRoot":"","sources":["../../src/__tests__/http-hardening.test.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AACzE,OAAO,EAAE,YAAY,EAAe,MAAM,WAAW,CAAC;AACtD,OAAO,EAAE,WAAW,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AAC1D,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACjC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAGjC,OAAO,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AACnD,OAAO,EAAE,SAAS,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAC7D,OAAO,EAAE,gBAAgB,EAAE,oBAAoB,EAAE,MAAM,kBAAkB,CAAC;AAE1E,IAAI,GAAW,CAAC;AAChB,MAAM,aAAa,GAAG,UAAU,CAAC,KAAK,CAAC;AAEvC,UAAU,CAAC,GAAG,EAAE;IACd,GAAG,GAAG,WAAW,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,aAAa,CAAC,CAAC,CAAC;AACnD,CAAC,CAAC,CAAC;AAEH,SAAS,CAAC,GAAG,EAAE;IACb,UAAU,CAAC,KAAK,GAAG,aAAa,CAAC;IACjC,MAAM,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;AAChD,CAAC,CAAC,CAAC;AAEH,SAAS,IAAI,CAAC,IAAoC;IAChD,OAAO,eAAe,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAChD,CAAC;AAED,SAAS,IAAI,CAAC,MAAkE;IAC9E,OAAO,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AAChC,CAAC;AAED,SAAS,SAAS,CAAC,IAA4D;IAC7E,MAAM,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC,IAAW,CAAC,CAAC;IAC9B,UAAU,CAAC,KAAK,GAAG,EAAS,CAAC;IAC7B,OAAO,EAAE,CAAC;AACZ,CAAC;AAED,SAAS,QAAQ,CAAC,MAAc,EAAE,QAAgB;IAChD,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,EAAE,QAAQ,EAAE,EAAE,CAAC,CAAC;AAC/D,CAAC;AAED,8BAA8B;AAC9B,SAAS,WAAW,CAAC,QAAqB;IACxC,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,EAAE,GAAG,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACnD,OAAO,IAAI,cAAc,CAAa;QACpC,IAAI,CAAC,UAAU,IAAI,UAAU,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QAC/C,MAAM,KAAK,QAAQ,EAAE,EAAE,CAAC,CAAC,CAAC;KAC3B,CAAC,CAAC;AACL,CAAC;AAED,QAAQ,CAAC,gDAAgD,EAAE,GAAG,EAAE;IAC9D,EAAE,CAAC,wEAAwE,EAAE,KAAK,IAAI,EAAE;QACtF,MAAM,SAAS,GAAG,SAAS,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE;YACxC,IAAI,GAAG,CAAC,UAAU,CAAC,yBAAyB,CAAC;gBAAE,OAAO,QAAQ,CAAC,GAAG,EAAE,0CAA0C,CAAC,CAAC;YAChH,OAAO,IAAI,QAAQ,CAAC,oBAAoB,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE,cAAc,EAAE,YAAY,EAAE,EAAE,CAAC,CAAC;QACxG,CAAC,CAAC,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,GAAG,EAAE,8BAA8B,EAAE,CAAC,CAAC;QAC/F,MAAM,CAAC,SAAS,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAC;QAC3C,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC,CAAC;QACzE,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,oBAAoB,CAAC,CAAC;QACzD,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,aAAa,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC,CAAC;QAChE,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,oBAAoB,CAAC,CAAC;IACrD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,2EAA2E,EAAE,KAAK,IAAI,EAAE;QACzF,KAAK,MAAM,QAAQ,IAAI,CAAC,kBAAkB,EAAE,iCAAiC,EAAE,oBAAoB,EAAE,oBAAoB,CAAC,EAAE,CAAC;YAC3H,MAAM,SAAS,GAAG,SAAS,CAAC,KAAK,IAAI,EAAE,CAAC,QAAQ,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC,CAAC;YACjE,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,GAAG,EAAE,yBAAyB,EAAE,CAAC,CAAC;YAC1F,MAAM,CAAC,SAAS,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAC;YAC3C,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,aAAa,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC,CAAC;QAClE,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,oFAAoF,EAAE,KAAK,IAAI,EAAE;QAClG,MAAM,SAAS,GAAG,SAAS,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE;YACxC,IAAI,GAAG,KAAK,0BAA0B;gBAAE,OAAO,QAAQ,CAAC,GAAG,EAAE,0BAA0B,CAAC,CAAC;YACzF,OAAO,IAAI,QAAQ,CAAC,MAAM,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE,cAAc,EAAE,YAAY,EAAE,EAAE,CAAC,CAAC;QAC1F,CAAC,CAAC,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE;YACpD,GAAG,EAAE,0BAA0B;YAC/B,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,aAAa,EAAE,eAAe,EAAE,cAAc,EAAE,kBAAkB,EAAE,SAAS,EAAE,GAAG,EAAE;YAC/F,IAAI,EAAE,IAAI;SACX,CAAC,CAAC;QACH,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;QACvC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,aAAa,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,SAAS,EAAE,CAAC,EAAE,QAAQ,EAAE,0BAA0B,EAAE,CAAC,CAAC;QAC1G,MAAM,MAAM,GAAG,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QACvC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,0BAA0B,CAAC,CAAC;QACnD,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC,CAAC;QACxF,MAAM,CAAE,MAAM,CAAC,CAAC,CAAiB,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,EAAE,SAAS,EAAE,GAAG,EAAE,CAAC,CAAC;IACzE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,gCAAgC,EAAE,KAAK,IAAI,EAAE;QAC9C,IAAI,CAAC,GAAG,CAAC,CAAC;QACV,MAAM,SAAS,GAAG,SAAS,CAAC,KAAK,IAAI,EAAE,CAAC,QAAQ,CAAC,GAAG,EAAE,wBAAwB,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;QACtF,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,GAAG,EAAE,wBAAwB,EAAE,CAAC,CAAC;QACzF,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,qBAAqB,CAAC,CAAC;QACpD,MAAM,CAAC,SAAS,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAC;IAC7C,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,gDAAgD,EAAE,GAAG,EAAE;IAC9D,EAAE,CAAC,iEAAiE,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,EAAE,KAAK,IAAI,EAAE;QACpG,IAAI,SAAS,GAAG,KAAK,CAAC;QACtB,SAAS,CAAC,KAAK,IAAI,EAAE,CAAC,IAAI,QAAQ,CAAC,WAAW,CAAC,GAAG,EAAE,GAAG,SAAS,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE;YAC3E,MAAM,EAAE,GAAG;YACX,OAAO,EAAE,EAAE,cAAc,EAAE,YAAY,EAAE;SAC1C,CAAC,CAAC,CAAC;QACJ,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,GAAG,EAAE,sBAAsB,EAAE,CAAC,CAAC;QACvF,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,qDAAqD,CAAC,CAAC;QACpF,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC;QAClD,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,aAAa,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAC1D,MAAM,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC/B,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,+DAA+D,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,EAAE,KAAK,IAAI,EAAE;QAClG,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE;YAC7B,sEAAsE;YACtE,+CAA+C;YAC/C,MAAM,IAAI,GAAG,IAAI,cAAc,CAAa;gBAC1C,KAAK,CAAC,UAAU;oBACd,IAAI,EAAE,MAAM,EAAE,gBAAgB,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,CAAC,IAAI,YAAY,CAAC,SAAS,EAAE,YAAY,CAAC,CAAC,CAAC,CAAC;gBAC7G,CAAC;aACF,CAAC,CAAC;YACH,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE,cAAc,EAAE,YAAY,EAAE,EAAE,CAAC,CAAC;QACxF,CAAC,CAAC,CAAC;QACH,MAAM,EAAE,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACtB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,GAAG,EAAE,uBAAuB,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC,CAAC;QACtG,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC;QAC5C,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,uBAAuB,CAAC,CAAC;IACxD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,wEAAwE,EAAE,KAAK,IAAI,EAAE;QACtF,SAAS,CAAC,KAAK,IAAI,EAAE,CAAC,IAAI,QAAQ,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE,cAAc,EAAE,YAAY,EAAE,EAAE,CAAC,CAAC,CAAC;QACtG,KAAK,MAAM,OAAO,IAAI,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC9B,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,GAAG,EAAE,qBAAqB,EAAE,OAAO,EAAE,CAAC,CAAC;YAC/F,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;QACvC,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,qDAAqD,EAAE,KAAK,IAAI,EAAE;QACnE,SAAS,CAAC,KAAK,IAAI,EAAE,CAAC,QAAQ,CAAC,GAAG,EAAE,+BAA+B,CAAC,CAAC,CAAC;QACtE,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,GAAG,EAAE,yBAAyB,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;QAC5G,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,aAAa,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC,CAAC;QAChE,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACrD,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,uDAAuD,EAAE,GAAG,EAAE;IACrE,IAAI,MAAc,CAAC;IACnB,IAAI,IAAY,CAAC;IACjB,IAAI,IAAY,CAAC;IAEjB,UAAU,CAAC,KAAK,IAAI,EAAE;QACpB,IAAI,GAAG,CAAC,CAAC;QACT,MAAM,GAAG,YAAY,CAAC,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE,GAAG,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAC5E,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,WAAW,EAAE,OAAO,CAAC,CAAC,CAAC;QAC7E,IAAI,GAAI,MAAM,CAAC,OAAO,EAAkB,CAAC,IAAI,CAAC;IAChD,CAAC,CAAC,CAAC;IAEH,SAAS,CAAC,KAAK,IAAI,EAAE;QACnB,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;IACtE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,6EAA6E,EAAE,KAAK,IAAI,EAAE;QAC3F,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;QACzC,MAAM,eAAe,GAAG,KAAK,IAAI,EAAE,CAAC,CAAC,WAAW,CAAC,CAAC;QAClD,0CAA0C;QAC1C,MAAM,CAAC,GAAG,EAAE,CAAC,gBAAgB,CAAC,yBAAyB,IAAI,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC;QAC/E,iEAAiE;QACjE,MAAM,MAAM,CACV,SAAS,CAAC,yBAAyB,IAAI,GAAG,EAAE,EAAE,MAAM,EAAE,UAAU,CAAC,MAAM,EAAE,eAAe,EAAE,CAAC,CAC5F,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,GAAQ,EAAE,EAAE,CAAC,cAAc,CAAC,IAAI,CAAC,GAAG,GAAG,EAAE,OAAO,IAAI,GAAG,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC;QACjG,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACvB,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,4CAA4C,EAAE,KAAK,IAAI,EAAE;QAC1D,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;QACzC,MAAM,eAAe,GAAG,KAAK,IAAI,EAAE,CAAC,CAAC,eAAe,EAAE,UAAU,CAAC,CAAC;QAClE,MAAM,MAAM,CACV,SAAS,CAAC,wBAAwB,IAAI,GAAG,EAAE,EAAE,MAAM,EAAE,UAAU,CAAC,MAAM,EAAE,eAAe,EAAE,CAAC,CAC3F,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,GAAQ,EAAE,EAAE,CAAC,aAAa,CAAC,IAAI,CAAC,GAAG,GAAG,EAAE,OAAO,IAAI,GAAG,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC;QAChG,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACvB,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,qCAAqC,EAAE,GAAG,EAAE;IACnD,EAAE,CAAC,IAAI,CAAC;QACN,WAAW,EAAE,UAAU,EAAE,YAAY,EAAE,iBAAiB,EAAE,SAAS,EAAE,WAAW;QAChF,KAAK,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,oBAAoB;KAChG,CAAC,CAAC,WAAW,EAAE,CAAC,OAAO,EAAE,EAAE;QAC1B,MAAM,CAAC,oBAAoB,CAAC,OAAO,CAAC,CAAC,CAAC,UAAU,EAAE,CAAC;IACrD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,eAAe,EAAE,iBAAiB,EAAE,YAAY,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,OAAO,EAAE,EAAE;QAC9F,MAAM,CAAC,oBAAoB,CAAC,OAAO,CAAC,CAAC,CAAC,aAAa,EAAE,CAAC;IACxD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,oDAAoD,EAAE,GAAG,EAAE;QAC5D,KAAK,MAAM,GAAG,IAAI,CAAC,4BAA4B,EAAE,mBAAmB,EAAE,oBAAoB,EAAE,oBAAoB,EAAE,uBAAuB,CAAC,EAAE,CAAC;YAC3I,MAAM,CAAC,GAAG,EAAE,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC;QAC9D,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,gBAAgB,EAAE,GAAG,EAAE;IAC9B,EAAE,CAAC,qCAAqC,EAAE,KAAK,IAAI,EAAE;QACnD,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,GAAG,MAAM,cAAc,CAAC,IAAI,QAAQ,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC,CAAC;QAC7E,MAAM,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACtD,MAAM,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAChC,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/__tests__/image-tools.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=image-tools.test.d.ts.map

package/dist/__tests__/image-tools.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"image-tools.test.d.ts","sourceRoot":"","sources":["../../src/__tests__/image-tools.test.ts"],"names":[],"mappings":""}

package/dist/__tests__/image-tools.test.js

@@ -0,0 +1,72 @@
+import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
+import { mkdtempSync, rmSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { renderToolResult } from "@polpo-ai/core";
+const generateText = vi.fn();
+const gatewayLanguageModel = vi.fn((id) => ({ via: "gateway", id }));
+const anthropicModel = vi.fn((id) => ({ via: "anthropic", id }));
+const createAnthropic = vi.fn(() => anthropicModel);
+vi.mock("ai", () => ({ generateText }));
+vi.mock("@ai-sdk/gateway", () => ({
+    createGatewayProvider: () => ({ languageModel: gatewayLanguageModel }),
+}));
+vi.mock("@ai-sdk/anthropic", () => ({ createAnthropic }));
+const { createImageTools } = await import("../image-tools.js");
+let cwd;
+const savedEnv = { ...process.env };
+function analyzeTool(vault) {
+    const tool = createImageTools({
+        cwd,
+        allowedTools: ["image_analyze"],
+        visionModel: "anthropic/claude-haiku-5.5",
+        ...(vault ? { vault: vault } : {}),
+    })[0];
+    return (params) => tool.execute("call-1", params);
+}
+beforeEach(() => {
+    cwd = mkdtempSync(join(tmpdir(), "polpo-image-tools-"));
+    writeFileSync(join(cwd, "shot.png"), Buffer.from([137, 80, 78, 71, 13, 10, 26, 10, 0, 0, 0, 13]));
+    delete process.env.ANTHROPIC_API_KEY;
+    delete process.env.AI_GATEWAY_API_KEY;
+    generateText.mockReset();
+    generateText.mockResolvedValue({
+        text: "A seaside apartment",
+        usage: { totalTokens: 12, inputTokens: 10, outputTokens: 2 },
+        providerMetadata: { gateway: { generationId: "gen_1", marketCost: "0.0004", cost: "0.0004" } },
+    });
+    gatewayLanguageModel.mockClear();
+    createAnthropic.mockClear();
+});
+afterEach(() => {
+    rmSync(cwd, { recursive: true, force: true });
+    process.env = { ...savedEnv };
+});
+describe("image_analyze credential routing — production regression 2026-10-23", () => {
+    it("uses the managed gateway when the agent has no provider key", async () => {
+        process.env.AI_GATEWAY_API_KEY = "gw-test";
+        const result = await analyzeTool()({ path: "shot.png" });
+        expect(gatewayLanguageModel).toHaveBeenCalledWith("anthropic/claude-haiku-5.5");
+        expect(createAnthropic).not.toHaveBeenCalled();
+        expect(generateText.mock.calls[0][0].model).toEqual({ via: "gateway", id: "anthropic/claude-haiku-5.5" });
+        expect(result.isError).toBeUndefined();
+        expect(result.details).toMatchObject({ provider: "gateway", model: "claude-haiku-5.5" });
+        expect(result.details.usage).toMatchObject({ generationId: "gen_1" });
+    });
+    it("keeps an agent's own provider key on the direct BYOK path", async () => {
+        process.env.AI_GATEWAY_API_KEY = "gw-test";
+        const vault = { getKey: (service) => service === "anthropic" ? "sk-ant-agent" : undefined };
+        const result = await analyzeTool(vault)({ path: "shot.png" });
+        expect(createAnthropic).toHaveBeenCalledWith({ apiKey: "sk-ant-agent" });
+        expect(anthropicModel).toHaveBeenCalledWith("claude-haiku-5.5");
+        expect(gatewayLanguageModel).not.toHaveBeenCalled();
+        expect(result.details).toMatchObject({ provider: "anthropic" });
+        expect(result.details.usage).toBeUndefined();
+    });
+    it("reports a missing credential as a tool error, never as a successful result", async () => {
+        const result = await analyzeTool()({ path: "shot.png" });
+        expect(generateText).not.toHaveBeenCalled();
+        expect(renderToolResult(result)).toMatch(/^Error: Image analysis error: Missing environment variable: ANTHROPIC_API_KEY/);
+    });
+});
+//# sourceMappingURL=image-tools.test.js.map

package/dist/__tests__/image-tools.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"image-tools.test.js","sourceRoot":"","sources":["../../src/__tests__/image-tools.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AACzE,OAAO,EAAE,WAAW,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAC7D,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACjC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAElD,MAAM,YAAY,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC;AAC7B,MAAM,oBAAoB,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC,EAAU,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC;AAC7E,MAAM,cAAc,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC,EAAU,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,EAAE,WAAW,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC;AACzE,MAAM,eAAe,GAAG,EAAE,CAAC,EAAE,CAAC,GAAG,EAAE,CAAC,cAAc,CAAC,CAAC;AAEpD,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC;AACxC,EAAE,CAAC,IAAI,CAAC,iBAAiB,EAAE,GAAG,EAAE,CAAC,CAAC;IAChC,qBAAqB,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,aAAa,EAAE,oBAAoB,EAAE,CAAC;CACvE,CAAC,CAAC,CAAC;AACJ,EAAE,CAAC,IAAI,CAAC,mBAAmB,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,eAAe,EAAE,CAAC,CAAC,CAAC;AAE1D,MAAM,EAAE,gBAAgB,EAAE,GAAG,MAAM,MAAM,CAAC,mBAAmB,CAAC,CAAC;AAE/D,IAAI,GAAW,CAAC;AAChB,MAAM,QAAQ,GAAG,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC;AAEpC,SAAS,WAAW,CAAC,KAAoE;IACvF,MAAM,IAAI,GAAG,gBAAgB,CAAC;QAC5B,GAAG;QACH,YAAY,EAAE,CAAC,eAAe,CAAC;QAC/B,WAAW,EAAE,4BAA4B;QACzC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,KAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC1C,CAAC,CAAC,CAAC,CAAE,CAAC;IACP,OAAO,CAAC,MAA+B,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,MAAa,CAAC,CAAC;AACpF,CAAC;AAED,UAAU,CAAC,GAAG,EAAE;IACd,GAAG,GAAG,WAAW,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,oBAAoB,CAAC,CAAC,CAAC;IACxD,aAAa,CAAC,IAAI,CAAC,GAAG,EAAE,UAAU,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC;IAClG,OAAO,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC;IACrC,OAAO,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC;IACtC,YAAY,CAAC,SAAS,EAAE,CAAC;IACzB,YAAY,CAAC,iBAAiB,CAAC;QAC7B,IAAI,EAAE,qBAAqB;QAC3B,KAAK,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE,YAAY,EAAE,CAAC,EAAE;QAC5D,gBAAgB,EAAE,EAAE,OAAO,EAAE,EAAE,YAAY,EAAE,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE;KAC/F,CAAC,CAAC;IACH,oBAAoB,CAAC,SAAS,EAAE,CAAC;IACjC,eAAe,CAAC,SAAS,EAAE,CAAC;AAC9B,CAAC,CAAC,CAAC;AAEH,SAAS,CAAC,GAAG,EAAE;IACb,MAAM,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IAC9C,OAAO,CAAC,GAAG,GAAG,EAAE,GAAG,QAAQ,EAAE,CAAC;AAChC,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,qEAAqE,EAAE,GAAG,EAAE;IACnF,EAAE,CAAC,6DAA6D,EAAE,KAAK,IAAI,EAAE;QAC3E,OAAO,CAAC,GAAG,CAAC,kBAAkB,GAAG,SAAS,CAAC;QAC3C,MAAM,MAAM,GAAG,MAAM,WAAW,EAAE,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,CAAC;QAEzD,MAAM,CAAC,oBAAoB,CAAC,CAAC,oBAAoB,CAAC,4BAA4B,CAAC,CAAC;QAChF,MAAM,CAAC,eAAe,CAAC,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC;QAC/C,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAE,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,EAAE,GAAG,EAAE,SAAS,EAAE,EAAE,EAAE,4BAA4B,EAAE,CAAC,CAAC;QAC3G,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,aAAa,EAAE,CAAC;QACvC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,aAAa,CAAC,EAAE,QAAQ,EAAE,SAAS,EAAE,KAAK,EAAE,kBAAkB,EAAE,CAAC,CAAC;QACzF,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,aAAa,CAAC,EAAE,YAAY,EAAE,OAAO,EAAE,CAAC,CAAC;IACxE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,2DAA2D,EAAE,KAAK,IAAI,EAAE;QACzE,OAAO,CAAC,GAAG,CAAC,kBAAkB,GAAG,SAAS,CAAC;QAC3C,MAAM,KAAK,GAAG,EAAE,MAAM,EAAE,CAAC,OAAe,EAAE,EAAE,CAAC,OAAO,KAAK,WAAW,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC;QACpG,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,CAAC;QAE9D,MAAM,CAAC,eAAe,CAAC,CAAC,oBAAoB,CAAC,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC,CAAC;QACzE,MAAM,CAAC,cAAc,CAAC,CAAC,oBAAoB,CAAC,kBAAkB,CAAC,CAAC;QAChE,MAAM,CAAC,oBAAoB,CAAC,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC;QACpD,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,aAAa,CAAC,EAAE,QAAQ,EAAE,WAAW,EAAE,CAAC,CAAC;QAChE,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,aAAa,EAAE,CAAC;IAC/C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,4EAA4E,EAAE,KAAK,IAAI,EAAE;QAC1F,MAAM,MAAM,GAAG,MAAM,WAAW,EAAE,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,CAAC;QAEzD,MAAM,CAAC,YAAY,CAAC,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC;QAC5C,MAAM,CAAC,gBAAgB,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,+EAA+E,CAAC,CAAC;IAC5H,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/__tests__/path-sandbox.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=path-sandbox.test.d.ts.map

package/dist/__tests__/path-sandbox.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"path-sandbox.test.d.ts","sourceRoot":"","sources":["../../src/__tests__/path-sandbox.test.ts"],"names":[],"mappings":""}

package/dist/__tests__/path-sandbox.test.js

@@ -0,0 +1,58 @@
+import { afterEach, beforeEach, describe, expect, it } from "vitest";
+import { existsSync, mkdirSync, mkdtempSync, rmSync, symlinkSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { isPathAllowed } from "../path-sandbox.js";
+import { createSystemTools } from "../system-tools.js";
+import { NodeFileSystem } from "../adapters/node-filesystem.js";
+import { NodeShell } from "../adapters/node-shell.js";
+let root;
+let sandbox;
+let outside;
+beforeEach(() => {
+    root = mkdtempSync(join(tmpdir(), "polpo-sandbox-"));
+    sandbox = join(root, "sandbox");
+    outside = join(root, "outside");
+    mkdirSync(sandbox);
+    mkdirSync(outside);
+});
+afterEach(() => {
+    rmSync(root, { recursive: true, force: true });
+});
+describe("isPathAllowed — symlinked ancestors of new paths", () => {
+    it("rejects a not-yet-existing file under a symlinked directory that points outside", () => {
+        symlinkSync(outside, join(sandbox, "escape"));
+        expect(isPathAllowed(join(sandbox, "escape", "new.txt"), [sandbox])).toBe(false);
+        expect(isPathAllowed(join(sandbox, "escape", "deep", "nested", "new.txt"), [sandbox])).toBe(false);
+    });
+    it("rejects a dangling symlink whose target is outside the sandbox", () => {
+        symlinkSync(join(outside, "not-yet.txt"), join(sandbox, "dangling"));
+        expect(isPathAllowed(join(sandbox, "dangling"), [sandbox])).toBe(false);
+    });
+    it("rejects symlink loops instead of falling back to the logical path", () => {
+        symlinkSync(join(sandbox, "b"), join(sandbox, "a"));
+        symlinkSync(join(sandbox, "a"), join(sandbox, "b"));
+        expect(isPathAllowed(join(sandbox, "a", "file.txt"), [sandbox])).toBe(false);
+    });
+    it("still allows new files under real and in-sandbox symlinked directories", () => {
+        mkdirSync(join(sandbox, "real"));
+        symlinkSync(join(sandbox, "real"), join(sandbox, "alias"));
+        expect(isPathAllowed(join(sandbox, "real", "new.txt"), [sandbox])).toBe(true);
+        expect(isPathAllowed(join(sandbox, "alias", "new.txt"), [sandbox])).toBe(true);
+        expect(isPathAllowed(join(sandbox, "missing", "dir", "new.txt"), [sandbox])).toBe(true);
+    });
+    it("accepts an allowed root that is itself reached through a symlink", () => {
+        const linkedRoot = join(root, "linked-root");
+        symlinkSync(sandbox, linkedRoot);
+        expect(isPathAllowed(join(linkedRoot, "new.txt"), [linkedRoot])).toBe(true);
+        expect(isPathAllowed(join(sandbox, "new.txt"), [linkedRoot])).toBe(true);
+    });
+    it("blocks the write tool from creating a file through a symlinked directory", async () => {
+        symlinkSync(outside, join(sandbox, "escape"));
+        const tools = createSystemTools(sandbox, undefined, [sandbox], undefined, undefined, new NodeFileSystem(), new NodeShell());
+        const write = tools.find((tool) => tool.name === "write");
+        await expect(write.execute("c1", { path: "escape/pwned.txt", content: "x" })).rejects.toThrow(/sandbox/);
+        expect(existsSync(join(outside, "pwned.txt"))).toBe(false);
+    });
+});
+//# sourceMappingURL=path-sandbox.test.js.map

package/dist/__tests__/path-sandbox.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"path-sandbox.test.js","sourceRoot":"","sources":["../../src/__tests__/path-sandbox.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AACrE,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,SAAS,CAAC;AAClF,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACjC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AACnD,OAAO,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AACvD,OAAO,EAAE,cAAc,EAAE,MAAM,gCAAgC,CAAC;AAChE,OAAO,EAAE,SAAS,EAAE,MAAM,2BAA2B,CAAC;AAEtD,IAAI,IAAY,CAAC;AACjB,IAAI,OAAe,CAAC;AACpB,IAAI,OAAe,CAAC;AAEpB,UAAU,CAAC,GAAG,EAAE;IACd,IAAI,GAAG,WAAW,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,gBAAgB,CAAC,CAAC,CAAC;IACrD,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;IAChC,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;IAChC,SAAS,CAAC,OAAO,CAAC,CAAC;IACnB,SAAS,CAAC,OAAO,CAAC,CAAC;AACrB,CAAC,CAAC,CAAC;AAEH,SAAS,CAAC,GAAG,EAAE;IACb,MAAM,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;AACjD,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,kDAAkD,EAAE,GAAG,EAAE;IAChE,EAAE,CAAC,iFAAiF,EAAE,GAAG,EAAE;QACzF,WAAW,CAAC,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC;QAC9C,MAAM,CAAC,aAAa,CAAC,IAAI,CAAC,OAAO,EAAE,QAAQ,EAAE,SAAS,CAAC,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACjF,MAAM,CAAC,aAAa,CAAC,IAAI,CAAC,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,SAAS,CAAC,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACrG,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,gEAAgE,EAAE,GAAG,EAAE;QACxE,WAAW,CAAC,IAAI,CAAC,OAAO,EAAE,aAAa,CAAC,EAAE,IAAI,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC,CAAC;QACrE,MAAM,CAAC,aAAa,CAAC,IAAI,CAAC,OAAO,EAAE,UAAU,CAAC,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC1E,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,mEAAmE,EAAE,GAAG,EAAE;QAC3E,WAAW,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,CAAC,EAAE,IAAI,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC,CAAC;QACpD,WAAW,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,CAAC,EAAE,IAAI,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC,CAAC;QACpD,MAAM,CAAC,aAAa,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE,UAAU,CAAC,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC/E,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,wEAAwE,EAAE,GAAG,EAAE;QAChF,SAAS,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC;QACjC,WAAW,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,EAAE,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC;QAC3D,MAAM,CAAC,aAAa,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,SAAS,CAAC,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC9E,MAAM,CAAC,aAAa,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,EAAE,SAAS,CAAC,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC/E,MAAM,CAAC,aAAa,CAAC,IAAI,CAAC,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,SAAS,CAAC,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC1F,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,kEAAkE,EAAE,GAAG,EAAE;QAC1E,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,EAAE,aAAa,CAAC,CAAC;QAC7C,WAAW,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;QACjC,MAAM,CAAC,aAAa,CAAC,IAAI,CAAC,UAAU,EAAE,SAAS,CAAC,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC5E,MAAM,CAAC,aAAa,CAAC,IAAI,CAAC,OAAO,EAAE,SAAS,CAAC,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC3E,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,0EAA0E,EAAE,KAAK,IAAI,EAAE;QACxF,WAAW,CAAC,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC;QAC9C,MAAM,KAAK,GAAG,iBAAiB,CAAC,OAAO,EAAE,SAAS,EAAE,CAAC,OAAO,CAAC,EAAE,SAAS,EAAE,SAAS,EAAE,IAAI,cAAc,EAAE,EAAE,IAAI,SAAS,EAAE,CAAC,CAAC;QAC5H,MAAM,KAAK,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,KAAK,OAAO,CAAE,CAAC;QAC3D,MAAM,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,kBAAkB,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QACzG,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC7D,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/__tests__/system-tools.test.js

@@ -22,7 +22,7 @@
  * Docker rig).
  */
 import { describe, it, expect, beforeEach, afterEach, vi } from "vitest";
-import { mkdtempSync, rmSync, writeFileSync, mkdirSync, readFileSync, statSync, symlinkSync, } from "node:fs";
+import { mkdtempSync, rmSync, writeFileSync, mkdirSync, readFileSync, statSync, symlinkSync, existsSync, } from "node:fs";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
 import { createSystemTools } from "../system-tools.js";
@@ -53,6 +53,31 @@ afterEach(() => {
     rmSync(cwd, { recursive: true, force: true });
 });
 describe("runtime requirements", () => {
+    it("rejects binary PNG content before returning it as line-numbered model text", async () => {
+        writeFileSync(join(cwd, "mockup.png"), Buffer.from([137, 80, 78, 71, 13, 10, 26, 10, 0, 0, 0, 13]));
+        const result = await tool("read").execute("png-production-regression", { path: "mockup.png" });
+        expect(result).toMatchObject({ isError: true, details: { error: "binary_file" } });
+        expect(text(result)).toContain("image_analyze");
+        expect(text(result)).not.toContain("\u0000");
+    });
+    it("rejects any binary file by magic number or content, not only images", async () => {
+        writeFileSync(join(cwd, "archive.zip"), Buffer.from([0x50, 0x4b, 0x03, 0x04, 0x14, 0x00, 0x00, 0x00, 0x08, 0x00]));
+        const result = await tool("read").execute("zip-binary", { path: "archive.zip" });
+        expect(result).toMatchObject({ isError: true, details: { error: "binary_file" } });
+        expect(text(result)).toMatch(/^Error: This is a binary file/);
+        const noExtension = Buffer.alloc(256);
+        for (let i = 0; i < noExtension.length; i++)
+            noExtension[i] = (i * 37) % 256;
+        writeFileSync(join(cwd, "blob"), noExtension);
+        expect(await tool("read").execute("blob", { path: "blob" })).toMatchObject({ isError: true, details: { error: "binary_file" } });
+    });
+    it("still reads a text page with a stray NUL far into it, normalized for persistence", async () => {
+        // Production case: an HTML page with one U+0000 at offset 34236.
+        writeFileSync(join(cwd, "page.html"), `${"<p>pasta</p>\n".repeat(2_500)}x\u0000y\n`);
+        const result = await tool("read").execute("late-nul", { path: "page.html", offset: 2_501, limit: 1 });
+        expect(result.isError).toBeUndefined();
+        expect(text(result)).toBe("2501\tx\\u0000y\n... (1 more lines)");
+    });
     it("annotates the tools returned to the runtime", () => {
         expect(tool("read").requiresSandbox).toBe(true);
         expect(tool("bash").requiresSandbox).toBe(true);
@@ -314,6 +339,68 @@ describe("bash — happy path", () => {
         expect(text(result)).toMatch(/3/);
     });
 });
+describe("bash — cancellation and timeout bounds", () => {
+    function isAlive(pid) {
+        try {
+            process.kill(pid, 0);
+            return true;
+        }
+        catch {
+            return false;
+        }
+    }
+    it("kills the whole process tree when the abort signal fires", { timeout: 20_000 }, async () => {
+        const pidFile = join(cwd, "child.pid");
+        const controller = new AbortController();
+        const t0 = Date.now();
+        const pending = tool("bash").execute("c1", 
+        // The background child survives a kill of the top-level shell alone.
+        { command: `sleep 60 & echo $! > ${pidFile}; wait` }, controller.signal);
+        for (let i = 0; i < 200 && !(existsSync(pidFile) && readFileSync(pidFile, "utf8").trim()); i++)
+            await new Promise((r) => setTimeout(r, 20));
+        const childPid = Number(readFileSync(pidFile, "utf8").trim());
+        expect(isAlive(childPid)).toBe(true);
+        controller.abort();
+        const result = await pending;
+        expect(Date.now() - t0).toBeLessThan(10_000);
+        expect(text(result)).toMatch(/abort/i);
+        for (let i = 0; i < 50 && isAlive(childPid); i++)
+            await new Promise((r) => setTimeout(r, 20));
+        expect(isAlive(childPid)).toBe(false);
+    });
+    it("does not start the command when the signal is already aborted", async () => {
+        const marker = join(cwd, "should-not-exist");
+        const controller = new AbortController();
+        controller.abort();
+        const result = await tool("bash").execute("c1", { command: `touch ${marker}` }, controller.signal);
+        expect(text(result)).toMatch(/abort/i);
+        expect(existsSync(marker)).toBe(false);
+    });
+    it("returns on abort even when the Shell implementation ignores the signal", async () => {
+        const shell = { execute: vi.fn(() => new Promise(() => undefined)) };
+        const bash = createSystemTools(cwd, ["bash"], [cwd], undefined, undefined, new NodeFileSystem(), shell)
+            .find((candidate) => candidate.name === "bash");
+        const controller = new AbortController();
+        const pending = bash.execute("c1", { command: "sleep 60" }, controller.signal);
+        controller.abort();
+        expect(text(await pending)).toMatch(/abort/i);
+        expect(shell.execute.mock.calls[0][1]).toMatchObject({ signal: controller.signal });
+    });
+    it.each([
+        [undefined, 120_000],
+        [0, 120_000],
+        [-5, 120_000],
+        [Number.NaN, 120_000],
+        [5_000, 5_000],
+        [86_400_000, 600_000],
+    ])("normalizes timeout %s to %s ms", async (timeout, expected) => {
+        const shell = { execute: vi.fn(async () => ({ stdout: "", stderr: "", exitCode: 0 })) };
+        const bash = createSystemTools(cwd, ["bash"], [cwd], undefined, undefined, new NodeFileSystem(), shell)
+            .find((candidate) => candidate.name === "bash");
+        await bash.execute("c1", { command: "true", ...(timeout === undefined ? {} : { timeout }) });
+        expect(shell.execute.mock.calls[0][1]).toMatchObject({ timeout: expected });
+    });
+});
 describe("bash — adversarial", () => {
     it("surfaces a non-zero exit clearly", async () => {
         const result = await tool("bash").execute("c1", { command: "false" });
@@ -458,6 +545,63 @@ describe("grep — adversarial", () => {
         expect(text(result)).toContain("real.txt");
     });
 });
+describe("grep — shell injection and error reporting", () => {
+    it("does not execute command substitution in the pattern", async () => {
+        writeFileSync(join(cwd, "f.txt"), "needle\n");
+        const marker = join(cwd, "pwned-pattern");
+        const result = await tool("grep").execute("c1", { pattern: `$(touch ${marker})needle` });
+        expect(existsSync(marker)).toBe(false);
+        expect(text(result)).not.toContain("f.txt");
+    });
+    it("does not execute command substitution or backticks in include and path", async () => {
+        writeFileSync(join(cwd, "f.txt"), "needle\n");
+        const includeMarker = join(cwd, "pwned-include");
+        const pathMarker = join(cwd, "pwned-path");
+        await tool("grep").execute("c1", { pattern: "needle", include: `*.txt$(touch ${includeMarker})` });
+        await tool("grep").execute("c2", { pattern: "needle", path: `\`touch ${pathMarker}\`` }).catch(() => undefined);
+        expect(existsSync(includeMarker)).toBe(false);
+        expect(existsSync(pathMarker)).toBe(false);
+    });
+    it("matches patterns containing single quotes and shell metacharacters literally", async () => {
+        writeFileSync(join(cwd, "q.txt"), "it's $HOME; `x` | y\n");
+        expect(text(await tool("grep").execute("c1", { pattern: "it's" }))).toContain("q.txt");
+        expect(text(await tool("grep").execute("c2", { pattern: "\\$HOME; `x` \\| y" }))).toContain("q.txt");
+    });
+    it.skipIf(process.getuid?.() === 0)("keeps matches when some files are unreadable (grep exit 2)", async () => {
+        writeFileSync(join(cwd, "ok.txt"), "needle\n");
+        writeFileSync(join(cwd, "locked.txt"), "needle\n", { mode: 0o000 });
+        const result = await tool("grep").execute("c1", { pattern: "needle" });
+        expect(text(result)).toContain("ok.txt");
+        expect(text(result)).not.toMatch(/^Error:/);
+        expect(text(result)).toMatch(/grep reported errors/);
+    });
+    it("treats a pattern that starts with a dash as a pattern, not an option", async () => {
+        writeFileSync(join(cwd, "f.txt"), "a --version b\n");
+        const result = await tool("grep").execute("c1", { pattern: "--version" });
+        expect(text(result)).toContain("f.txt");
+    });
+    it("reports an invalid regex as an error instead of 'No matches found'", async () => {
+        writeFileSync(join(cwd, "f.txt"), "needle\n");
+        const result = await tool("grep").execute("c1", { pattern: "(unclosed" });
+        expect(text(result)).toMatch(/^Error:/);
+        expect(text(result)).not.toMatch(/No matches found/);
+    });
+    it("reports a shell failure (e.g. timeout) as an error instead of 'No matches found'", async () => {
+        const shell = { execute: vi.fn(async () => ({ stdout: "", stderr: "Command timed out after 15000ms (SIGKILL).", exitCode: 124 })) };
+        const grep = createSystemTools(cwd, ["grep"], [cwd], undefined, undefined, new NodeFileSystem(), shell)
+            .find((candidate) => candidate.name === "grep");
+        const result = await grep.execute("c1", { pattern: "needle" });
+        expect(text(result)).toMatch(/^Error:.*timed out/i);
+    });
+    it("flags truncated output when more than 100 lines match", async () => {
+        writeFileSync(join(cwd, "many.txt"), Array.from({ length: 250 }, (_, i) => `needle ${i}`).join("\n"));
+        const result = await tool("grep").execute("c1", { pattern: "needle" });
+        const lines = text(result).split("\n");
+        expect(lines.filter((line) => line.includes("many.txt"))).toHaveLength(100);
+        expect(text(result)).toMatch(/truncated/i);
+        expect(result.details).toMatchObject({ truncated: true });
+    });
+});
 // ────────────────────────────────────────────────────────────
 describe("ls — happy path", () => {
     it("lists files and directories", async () => {