@probelabs/probe 0.6.0-rc169 → 0.6.0-rc171

package/build/agent/ProbeAgent.js

@@ -13,11 +13,11 @@ import { randomUUID } from 'crypto';
 import { EventEmitter } from 'events';
 import { existsSync } from 'fs';
 import { readFile, stat } from 'fs/promises';
-import { resolve, isAbsolute, dirname } from 'path';
+import { resolve, isAbsolute, dirname, basename, normalize, sep } from 'path';
 import { TokenCounter } from './tokenCounter.js';
 import { InMemoryStorageAdapter } from './storage/InMemoryStorageAdapter.js';
 import { HookManager, HOOK_TYPES } from './hooks/HookManager.js';
-import { SUPPORTED_IMAGE_EXTENSIONS, IMAGE_MIME_TYPES } from './imageConfig.js';
+import { SUPPORTED_IMAGE_EXTENSIONS, IMAGE_MIME_TYPES, isFormatSupportedByProvider } from './imageConfig.js';
 import {
   createTools,
   searchToolDefinition,
@@ -475,6 +475,21 @@ export class ProbeAgent {
             throw new Error('Image path is required');
           }
 
+          // Validate extension before attempting to load
+          // Use basename to prevent path traversal attacks (e.g., 'malicious.jpg/../../../etc/passwd')
+          const filename = basename(imagePath);
+          const extension = filename.toLowerCase().split('.').pop();
+
+          // Always validate extension is in allowed list (defense-in-depth)
+          if (!extension || !SUPPORTED_IMAGE_EXTENSIONS.includes(extension)) {
+            throw new Error(`Invalid or unsupported image extension: ${extension}. Supported formats: ${SUPPORTED_IMAGE_EXTENSIONS.join(', ')}`);
+          }
+
+          // Check provider-specific format restrictions (e.g., SVG not supported by Google Gemini)
+          if (this.apiType && !isFormatSupportedByProvider(extension, this.apiType)) {
+            throw new Error(`Image format '${extension}' is not supported by the current AI provider (${this.apiType}). Try using a different image format like PNG or JPEG.`);
+          }
+
           // Load the image using the existing loadImageIfValid method
           const loaded = await this.loadImageIfValid(imagePath);
 
@@ -1262,20 +1277,28 @@ export class ProbeAgent {
       }
 
       // Security validation: check if path is within any allowed directory
+      // Use normalize() after resolve() to handle path traversal attempts (e.g., '/allowed/../etc/passwd')
       const allowedDirs = this.allowedFolders && this.allowedFolders.length > 0 ? this.allowedFolders : [process.cwd()];
-      
+
       let absolutePath;
       let isPathAllowed = false;
-      
+
       // If absolute path, check if it's within any allowed directory
       if (isAbsolute(imagePath)) {
-        absolutePath = imagePath;
-        isPathAllowed = allowedDirs.some(dir => absolutePath.startsWith(resolve(dir)));
+        // Normalize to resolve any '..' sequences
+        absolutePath = normalize(resolve(imagePath));
+        isPathAllowed = allowedDirs.some(dir => {
+          const normalizedDir = normalize(resolve(dir));
+          // Ensure the path is within the allowed directory (add separator to prevent prefix attacks)
+          return absolutePath === normalizedDir || absolutePath.startsWith(normalizedDir + sep);
+        });
       } else {
         // For relative paths, try resolving against each allowed directory
         for (const dir of allowedDirs) {
-          const resolvedPath = resolve(dir, imagePath);
-          if (resolvedPath.startsWith(resolve(dir))) {
+          const normalizedDir = normalize(resolve(dir));
+          const resolvedPath = normalize(resolve(dir, imagePath));
+          // Ensure the resolved path is within the allowed directory
+          if (resolvedPath === normalizedDir || resolvedPath.startsWith(normalizedDir + sep)) {
             absolutePath = resolvedPath;
             isPathAllowed = true;
             break;
@@ -1319,6 +1342,10 @@ export class ProbeAgent {
         return false;
       }
 
+      // Note: Provider-specific format validation (e.g., SVG not supported by Google Gemini)
+      // is handled by the readImage tool which provides explicit error messages.
+      // loadImageIfValid is a lower-level method that only checks general format support.
+
       // Determine MIME type (from shared config)
       const mimeType = IMAGE_MIME_TYPES[extension];
 
@@ -2504,7 +2531,7 @@ When troubleshooting:
                       maxIterations,
                       parentSessionId: this.sessionId,  // Pass parent session ID for tracking
                       path: this.searchPath,            // Inherit search path
-                      provider: this.provider,          // Inherit AI provider
+                      provider: this.apiType,           // Inherit AI provider (string identifier)
                       model: this.model,                // Inherit model
                       debug: this.debug,
                       tracer: this.tracer
@@ -2513,7 +2540,7 @@ When troubleshooting:
                     if (this.debug) {
                       console.log(`[DEBUG] Executing delegate tool at iteration ${currentIteration}/${maxIterations}`);
                       console.log(`[DEBUG] Parent session: ${this.sessionId}`);
-                      console.log(`[DEBUG] Inherited config: path=${this.searchPath}, provider=${this.provider}, model=${this.model}`);
+                      console.log(`[DEBUG] Inherited config: path=${this.searchPath}, provider=${this.apiType}, model=${this.model}`);
                       console.log(`[DEBUG] Delegate task: ${toolParams.task?.substring(0, 100)}...`);
                     }
                     
@@ -2597,10 +2624,10 @@ When troubleshooting:
                   content: toolResultMessage
                 });
 
-                // Process tool result for image references
-                if (toolResultContent) {
-                  await this.processImageReferences(toolResultContent);
-                }
+                // NOTE: Automatic image processing removed (GitHub issue #305)
+                // Images are now only loaded when the AI explicitly calls the readImage tool
+                // This prevents: 1) implicit behavior that users don't expect
+                //                2) crashes with unsupported MIME types (e.g., SVG on Gemini)
 
                 if (this.debug) {
                   console.log(`[DEBUG] Tool ${toolName} executed successfully. Result length: ${typeof toolResult === 'string' ? toolResult.length : JSON.stringify(toolResult).length}`);

package/build/agent/imageConfig.js

@@ -21,6 +21,12 @@ export const IMAGE_MIME_TYPES = {
   'svg': 'image/svg+xml'
 };
 
+// Provider-specific unsupported image formats
+// These providers do not support certain MIME types and will crash if they receive them
+export const PROVIDER_UNSUPPORTED_FORMATS = {
+  'google': ['svg'],  // Google Gemini doesn't support image/svg+xml
+};
+
 /**
  * Generate a regex pattern string for matching image file extensions
  * @param {string[]} extensions - Array of extensions (without dots)
@@ -38,3 +44,54 @@ export function getExtensionPattern(extensions = SUPPORTED_IMAGE_EXTENSIONS) {
 export function getMimeType(extension) {
   return IMAGE_MIME_TYPES[extension.toLowerCase()];
 }
+
+/**
+ * Check if an image extension is supported by a specific provider
+ * @param {string} extension - File extension (without dot)
+ * @param {string} provider - Provider name (e.g., 'google', 'anthropic', 'openai')
+ * @returns {boolean} True if the format is supported by the provider
+ */
+export function isFormatSupportedByProvider(extension, provider) {
+  // Validate extension parameter - must be a non-empty string without path separators
+  if (!extension || typeof extension !== 'string') {
+    return false;
+  }
+  // Sanitize: reject extensions containing path traversal characters
+  if (extension.includes('/') || extension.includes('\\') || extension.includes('..')) {
+    return false;
+  }
+
+  const ext = extension.toLowerCase();
+
+  // First check if it's a generally supported format
+  if (!SUPPORTED_IMAGE_EXTENSIONS.includes(ext)) {
+    return false;
+  }
+
+  // Handle null/undefined provider gracefully (treat as no restrictions)
+  if (!provider || typeof provider !== 'string') {
+    return true;
+  }
+
+  // Check provider-specific restrictions
+  const unsupportedFormats = PROVIDER_UNSUPPORTED_FORMATS[provider];
+  if (unsupportedFormats && unsupportedFormats.includes(ext)) {
+    return false;
+  }
+
+  return true;
+}
+
+/**
+ * Get supported image extensions for a specific provider
+ * @param {string} provider - Provider name (e.g., 'google', 'anthropic', 'openai')
+ * @returns {string[]} Array of supported extensions for this provider
+ */
+export function getSupportedExtensionsForProvider(provider) {
+  // Handle null/undefined/non-string provider gracefully (return all extensions)
+  if (!provider || typeof provider !== 'string') {
+    return [...SUPPORTED_IMAGE_EXTENSIONS];
+  }
+  const unsupportedFormats = PROVIDER_UNSUPPORTED_FORMATS[provider] || [];
+  return SUPPORTED_IMAGE_EXTENSIONS.filter(ext => !unsupportedFormats.includes(ext));
+}

package/build/agent/index.js

@@ -1998,7 +1998,27 @@ var init_HookManager = __esm({
 });
 
 // src/agent/imageConfig.js
-var SUPPORTED_IMAGE_EXTENSIONS, IMAGE_MIME_TYPES;
+function isFormatSupportedByProvider(extension, provider) {
+  if (!extension || typeof extension !== "string") {
+    return false;
+  }
+  if (extension.includes("/") || extension.includes("\\") || extension.includes("..")) {
+    return false;
+  }
+  const ext2 = extension.toLowerCase();
+  if (!SUPPORTED_IMAGE_EXTENSIONS.includes(ext2)) {
+    return false;
+  }
+  if (!provider || typeof provider !== "string") {
+    return true;
+  }
+  const unsupportedFormats = PROVIDER_UNSUPPORTED_FORMATS[provider];
+  if (unsupportedFormats && unsupportedFormats.includes(ext2)) {
+    return false;
+  }
+  return true;
+}
+var SUPPORTED_IMAGE_EXTENSIONS, IMAGE_MIME_TYPES, PROVIDER_UNSUPPORTED_FORMATS;
 var init_imageConfig = __esm({
   "src/agent/imageConfig.js"() {
     "use strict";
@@ -2011,6 +2031,10 @@ var init_imageConfig = __esm({
       "bmp": "image/bmp",
       "svg": "image/svg+xml"
     };
+    PROVIDER_UNSUPPORTED_FORMATS = {
+      "google": ["svg"]
+      // Google Gemini doesn't support image/svg+xml
+    };
   }
 });
 
@@ -3414,7 +3438,7 @@ async function delegate({
   const sessionId = randomUUID();
   const startTime = Date.now();
   const remainingIterations = Math.max(1, maxIterations - currentIteration);
-  const delegationSpan = tracer ? tracer.createDelegationSpan(sessionId, task) : null;
+  const delegationSpan = typeof tracer?.createDelegationSpan === "function" ? tracer.createDelegationSpan(sessionId, task) : null;
   let timeoutId = null;
   let acquired = false;
   try {
@@ -15373,7 +15397,7 @@ var init_esm4 = __esm({
        *
        * @internal
        */
-      constructor(cwd = process.cwd(), pathImpl, sep3, { nocase, childrenCacheSize = 16 * 1024, fs: fs8 = defaultFS } = {}) {
+      constructor(cwd = process.cwd(), pathImpl, sep4, { nocase, childrenCacheSize = 16 * 1024, fs: fs8 = defaultFS } = {}) {
         this.#fs = fsFromOption(fs8);
         if (cwd instanceof URL || cwd.startsWith("file://")) {
           cwd = fileURLToPath4(cwd);
@@ -15384,7 +15408,7 @@ var init_esm4 = __esm({
         this.#resolveCache = new ResolveCache();
         this.#resolvePosixCache = new ResolveCache();
         this.#children = new ChildrenCache(childrenCacheSize);
-        const split = cwdPath.substring(this.rootPath.length).split(sep3);
+        const split = cwdPath.substring(this.rootPath.length).split(sep4);
         if (split.length === 1 && !split[0]) {
           split.pop();
         }
@@ -36300,7 +36324,7 @@ var init_graph_builder = __esm({
       applyLinkStyles() {
         if (!this.pendingLinkStyles.length || !this.edges.length)
           return;
-        const normalize2 = (s) => {
+        const normalize3 = (s) => {
           const out = {};
           for (const [kRaw, vRaw] of Object.entries(s)) {
             const k = kRaw.trim().toLowerCase();
@@ -36321,7 +36345,7 @@ var init_graph_builder = __esm({
           return out;
         };
         for (const cmd of this.pendingLinkStyles) {
-          const style = normalize2(cmd.props);
+          const style = normalize3(cmd.props);
           for (const idx of cmd.indices) {
             if (idx >= 0 && idx < this.edges.length) {
               const e = this.edges[idx];
@@ -43413,7 +43437,7 @@ var require_bk = __commonJS({
       return xs;
     }
     function buildBlockGraph(g, layering, root2, reverseSep) {
-      var blockGraph = new Graph(), graphLabel = g.graph(), sepFn = sep3(graphLabel.nodesep, graphLabel.edgesep, reverseSep);
+      var blockGraph = new Graph(), graphLabel = g.graph(), sepFn = sep4(graphLabel.nodesep, graphLabel.edgesep, reverseSep);
       _.forEach(layering, function(layer) {
         var u;
         _.forEach(layer, function(v) {
@@ -43503,7 +43527,7 @@ var require_bk = __commonJS({
       alignCoordinates(xss, smallestWidth);
       return balance(xss, g.graph().align);
     }
-    function sep3(nodeSep, edgeSep, reverseSep) {
+    function sep4(nodeSep, edgeSep, reverseSep) {
       return function(g, v, w) {
         var vLabel = g.node(v);
         var wLabel = g.node(w);
@@ -43588,7 +43612,7 @@ var require_layout = __commonJS({
     "use strict";
     var _ = require_lodash2();
     var acyclic = require_acyclic();
-    var normalize2 = require_normalize();
+    var normalize3 = require_normalize();
     var rank = require_rank();
     var normalizeRanks = require_util().normalizeRanks;
     var parentDummyChains = require_parent_dummy_chains();
@@ -43650,7 +43674,7 @@ var require_layout = __commonJS({
         removeEdgeLabelProxies(g);
       });
       time("    normalize.run", function() {
-        normalize2.run(g);
+        normalize3.run(g);
       });
       time("    parentDummyChains", function() {
         parentDummyChains(g);
@@ -43677,7 +43701,7 @@ var require_layout = __commonJS({
         removeBorderNodes(g);
       });
       time("    normalize.undo", function() {
-        normalize2.undo(g);
+        normalize3.undo(g);
       });
       time("    fixupEdgeLabelCoords", function() {
         fixupEdgeLabelCoords(g);
@@ -50048,8 +50072,8 @@ var require_resolve = __commonJS({
       }
       return count;
     }
-    function getFullPath(resolver, id = "", normalize2) {
-      if (normalize2 !== false)
+    function getFullPath(resolver, id = "", normalize3) {
+      if (normalize3 !== false)
         id = normalizeId(id);
       const p = resolver.parse(id);
       return _getFullPath(resolver, p);
@@ -51389,7 +51413,7 @@ var require_fast_uri = __commonJS({
     "use strict";
     var { normalizeIPv6, removeDotSegments, recomposeAuthority, normalizeComponentEncoding, isIPv4, nonSimpleDomain } = require_utils();
     var { SCHEMES, getSchemeHandler } = require_schemes();
-    function normalize2(uri, options) {
+    function normalize3(uri, options) {
       if (typeof uri === "string") {
         uri = /** @type {T} */
         serialize(parse6(uri, options), options);
@@ -51625,7 +51649,7 @@ var require_fast_uri = __commonJS({
     }
     var fastUri = {
       SCHEMES,
-      normalize: normalize2,
+      normalize: normalize3,
       resolve: resolve6,
       resolveComponent,
       equal,
@@ -58993,7 +59017,7 @@ import { randomUUID as randomUUID5 } from "crypto";
 import { EventEmitter as EventEmitter5 } from "events";
 import { existsSync as existsSync5 } from "fs";
 import { readFile, stat } from "fs/promises";
-import { resolve as resolve4, isAbsolute as isAbsolute2, dirname as dirname4 } from "path";
+import { resolve as resolve4, isAbsolute as isAbsolute2, dirname as dirname4, basename, normalize as normalize2, sep as sep3 } from "path";
 var MAX_TOOL_ITERATIONS, MAX_HISTORY_MESSAGES, MAX_IMAGE_FILE_SIZE, ProbeAgent;
 var init_ProbeAgent = __esm({
   "src/agent/ProbeAgent.js"() {
@@ -59319,6 +59343,14 @@ var init_ProbeAgent = __esm({
               if (!imagePath) {
                 throw new Error("Image path is required");
               }
+              const filename = basename(imagePath);
+              const extension = filename.toLowerCase().split(".").pop();
+              if (!extension || !SUPPORTED_IMAGE_EXTENSIONS.includes(extension)) {
+                throw new Error(`Invalid or unsupported image extension: ${extension}. Supported formats: ${SUPPORTED_IMAGE_EXTENSIONS.join(", ")}`);
+              }
+              if (this.apiType && !isFormatSupportedByProvider(extension, this.apiType)) {
+                throw new Error(`Image format '${extension}' is not supported by the current AI provider (${this.apiType}). Try using a different image format like PNG or JPEG.`);
+              }
               const loaded = await this.loadImageIfValid(imagePath);
               if (!loaded) {
                 throw new Error(`Failed to load image: ${imagePath}. The file may not exist, be too large, have an unsupported format, or be outside allowed directories.`);
@@ -59937,12 +59969,16 @@ var init_ProbeAgent = __esm({
           let absolutePath;
           let isPathAllowed2 = false;
           if (isAbsolute2(imagePath)) {
-            absolutePath = imagePath;
-            isPathAllowed2 = allowedDirs.some((dir) => absolutePath.startsWith(resolve4(dir)));
+            absolutePath = normalize2(resolve4(imagePath));
+            isPathAllowed2 = allowedDirs.some((dir) => {
+              const normalizedDir = normalize2(resolve4(dir));
+              return absolutePath === normalizedDir || absolutePath.startsWith(normalizedDir + sep3);
+            });
           } else {
             for (const dir of allowedDirs) {
-              const resolvedPath = resolve4(dir, imagePath);
-              if (resolvedPath.startsWith(resolve4(dir))) {
+              const normalizedDir = normalize2(resolve4(dir));
+              const resolvedPath = normalize2(resolve4(dir, imagePath));
+              if (resolvedPath === normalizedDir || resolvedPath.startsWith(normalizedDir + sep3)) {
                 absolutePath = resolvedPath;
                 isPathAllowed2 = true;
                 break;
@@ -60950,8 +60986,8 @@ ${toolResultContent}
                           // Pass parent session ID for tracking
                           path: this.searchPath,
                           // Inherit search path
-                          provider: this.provider,
-                          // Inherit AI provider
+                          provider: this.apiType,
+                          // Inherit AI provider (string identifier)
                           model: this.model,
                           // Inherit model
                           debug: this.debug,
@@ -60960,7 +60996,7 @@ ${toolResultContent}
                         if (this.debug) {
                           console.log(`[DEBUG] Executing delegate tool at iteration ${currentIteration}/${maxIterations}`);
                           console.log(`[DEBUG] Parent session: ${this.sessionId}`);
-                          console.log(`[DEBUG] Inherited config: path=${this.searchPath}, provider=${this.provider}, model=${this.model}`);
+                          console.log(`[DEBUG] Inherited config: path=${this.searchPath}, provider=${this.apiType}, model=${this.model}`);
                           console.log(`[DEBUG] Delegate task: ${toolParams.task?.substring(0, 100)}...`);
                         }
                         if (this.tracer) {
@@ -61027,9 +61063,6 @@ ${toolResultContent}
                       role: "user",
                       content: toolResultMessage
                     });
-                    if (toolResultContent) {
-                      await this.processImageReferences(toolResultContent);
-                    }
                     if (this.debug) {
                       console.log(`[DEBUG] Tool ${toolName} executed successfully. Result length: ${typeof toolResult === "string" ? toolResult.length : JSON.stringify(toolResult).length}`);
                     }

package/build/delegate.js

@@ -200,8 +200,10 @@ export async function delegate({
 	// Calculate remaining iterations for subagent
 	const remainingIterations = Math.max(1, maxIterations - currentIteration);
 
-	// Create delegation span for telemetry if tracer is available
-	const delegationSpan = tracer ? tracer.createDelegationSpan(sessionId, task) : null;
+	// Create delegation span for telemetry if tracer is available and has the method
+	const delegationSpan = typeof tracer?.createDelegationSpan === 'function'
+		? tracer.createDelegationSpan(sessionId, task)
+		: null;
 
 	let timeoutId = null;
 	let acquired = false;