@pugi/cli 0.1.0-beta.12 → 0.1.0-beta.14

package/dist/tools/multi-edit.js

@@ -0,0 +1,361 @@
+/**
+ * multi_edit tool — β7 (2026-05-26).
+ *
+ * Dispatches an ordered batch of file edits as a single transaction. Each
+ * edit is one Layer A (oldString -> newString) operation against one
+ * workspace file. Either every edit lands, or none do — failures roll
+ * the workspace back to the pre-dispatch state using the same journal +
+ * snapshot machinery the β1b Pl8 transactional layer uses for the
+ * marker-driven dispatcher.
+ *
+ * Why multi_edit when `edit` already exists:
+ *
+ *   The single-shot `edit` tool is the right primitive for one mutation;
+ *   the model uses it dozens of times in a typical session. A coordinated
+ *   refactor (rename across 8 files, add an import to 12 modules, peel a
+ *   helper into 5 callers) is currently 8/12/5 separate `edit` calls.
+ *   Each call is its own audit + permission check + atomic write, which
+ *   is the right shape for the audit story but means the model can leave
+ *   the workspace half-mutated when one of the calls fails partway. The
+ *   model also pays the round-trip latency once per call.
+ *
+ *   `multi_edit` collapses the 8/12/5 calls into one tool dispatch with
+ *   transactional semantics: snapshot every target file, attempt every
+ *   edit against an in-memory buffer, then commit the writes only after
+ *   all in-memory edits succeed. A failure rolls back via journal +
+ *   in-memory snapshot — same code path as the dispatcher.
+ *
+ * Security: every target file routes through the same `applySecurityGate`
+ * chokepoint Layer A/B/C inherit. A path that escapes the workspace,
+ * points at a protected basename (`.env`, `*.pem`, ...), or symlinks
+ * outside the tree is refused BEFORE any read.
+ *
+ * Concurrency: marked `concurrencySafe: false` in the tool registry. The
+ * model MUST NOT issue another `multi_edit` (or any write tool) in
+ * parallel with one in flight; the journal serialises one dispatch per
+ * session.
+ *
+ * Output cap: a 50-edit batch is the soft ceiling. Beyond that the tool
+ * refuses with `too_many_edits` — the operator can split the refactor.
+ * Empirically a coordinated refactor that needs 50+ atomic edits should
+ * be a per-file Layer C rewrite instead.
+ *
+ * Brand voice: ASCII only, no emoji, no banned words.
+ */
+import { existsSync, readFileSync, renameSync, unlinkSync, writeFileSync } from 'node:fs';
+import { applySecurityGate } from '../core/edits/security-gate.js';
+import { appendEntry, snapshotForDispatch, } from '../core/edits/journal.js';
+import { rollbackDispatch } from '../core/edits/dispatch.js';
+import { gateOnCancellation, OperatorAbortedError } from './file-tools.js';
+import { recordFileMutation, recordToolCall, recordToolResult } from '../core/session.js';
+/** Soft cap on per-dispatch edit count. See module docstring. */
+const MULTI_EDIT_MAX = 50;
+/**
+ * Apply a batch of file edits transactionally. Returns a structured
+ * result; never throws on operator-attributable failure (security,
+ * missing file, no_match) — only on infrastructure error (filesystem
+ * permission denied mid-write after the snapshot, etc.).
+ */
+export function multiEdit(ctx, edits, opts = {}) {
+    const toolCallId = recordToolCall(ctx.session, 'multi_edit', `${edits.length} edits across ${new Set(edits.map((e) => e.file)).size} files`);
+    try {
+        gateOnCancellation(ctx, 'multi_edit');
+    }
+    catch (error) {
+        if (error instanceof OperatorAbortedError) {
+            recordToolResult(ctx.session, toolCallId, 'cancelled', error.message);
+            throw error;
+        }
+        throw error;
+    }
+    if (edits.length === 0) {
+        const result = {
+            ok: false,
+            filesChanged: [],
+            editsApplied: 0,
+            reason: 'empty_batch',
+            detail: 'multi_edit received zero edits',
+            perEdit: [],
+        };
+        recordToolResult(ctx.session, toolCallId, 'error', 'empty_batch');
+        return result;
+    }
+    if (edits.length > MULTI_EDIT_MAX) {
+        const result = {
+            ok: false,
+            filesChanged: [],
+            editsApplied: 0,
+            reason: 'too_many_edits',
+            detail: `multi_edit batch of ${edits.length} exceeds cap ${MULTI_EDIT_MAX}; split the refactor`,
+            perEdit: [],
+        };
+        recordToolResult(ctx.session, toolCallId, 'error', 'too_many_edits');
+        return result;
+    }
+    // SECURITY GATE pass over every distinct file BEFORE any read.
+    // A single rejected file aborts the whole batch — the transactional
+    // contract requires we never partial-mutate.
+    const uniqueFiles = Array.from(new Set(edits.map((e) => e.file)));
+    const resolvedByFile = new Map();
+    for (const f of uniqueFiles) {
+        const gate = applySecurityGate(f, { cwd: ctx.root, toolName: 'layer-c' });
+        if (!gate.ok) {
+            const result = {
+                ok: false,
+                filesChanged: [],
+                editsApplied: 0,
+                reason: gate.reason,
+                detail: `${f}: ${gate.detail}`,
+                perEdit: edits.map((e, i) => ({
+                    index: i,
+                    file: e.file,
+                    ok: false,
+                    reason: gate.reason,
+                    detail: e.file === f ? gate.detail : 'batch aborted by sibling security failure',
+                })),
+            };
+            recordToolResult(ctx.session, toolCallId, 'error', `${gate.reason}: ${f}`);
+            return result;
+        }
+        resolvedByFile.set(f, gate.absPath);
+    }
+    // Snapshot existing files BEFORE any in-memory edit so a partial-write
+    // rollback is deterministic. The snapshot also captures sha256 of each
+    // pre-existing file so post-failure restore can verify the in-memory
+    // buffer still matches.
+    const snapshot = snapshotForDispatch(ctx.root, uniqueFiles);
+    const preContent = new Map();
+    for (const entry of snapshot) {
+        if (!entry.existed)
+            continue;
+        const abs = resolvedByFile.get(entry.path);
+        if (!abs)
+            continue;
+        try {
+            preContent.set(entry.path, readFileSync(abs));
+        }
+        catch {
+            // Best-effort. A read failure here will surface again when the
+            // per-edit phase tries to read the same file — let that path
+            // produce the operator-facing error.
+        }
+    }
+    // In-memory edit phase. For each edit we work on the latest version
+    // of the file (so two edits against the same file stack). Failure
+    // here is the common case — `no_match`, `ambiguous_match`, missing
+    // file — and aborts the whole batch.
+    const bodyByFile = new Map();
+    const perEdit = [];
+    for (let i = 0; i < edits.length; i += 1) {
+        const edit = edits[i];
+        const abs = resolvedByFile.get(edit.file);
+        if (!abs) {
+            // Should be unreachable — every distinct file went through the
+            // gate above. Belt + braces.
+            perEdit.push({ index: i, file: edit.file, ok: false, reason: 'write_error', detail: 'no resolved path' });
+            const result = {
+                ok: false,
+                filesChanged: [],
+                editsApplied: 0,
+                reason: 'write_error',
+                detail: `${edit.file}: no resolved path`,
+                perEdit,
+            };
+            recordToolResult(ctx.session, toolCallId, 'error', 'write_error');
+            return result;
+        }
+        let body = bodyByFile.get(edit.file);
+        if (body === undefined) {
+            if (!existsSync(abs)) {
+                const detail = `file does not exist: ${edit.file}`;
+                perEdit.push({ index: i, file: edit.file, ok: false, reason: 'file_missing', detail });
+                const result = {
+                    ok: false,
+                    filesChanged: [],
+                    editsApplied: 0,
+                    reason: 'file_missing',
+                    detail,
+                    perEdit,
+                };
+                recordToolResult(ctx.session, toolCallId, 'error', 'file_missing');
+                return result;
+            }
+            try {
+                body = readFileSync(abs, 'utf8');
+            }
+            catch (error) {
+                const detail = error instanceof Error ? error.message : String(error);
+                perEdit.push({ index: i, file: edit.file, ok: false, reason: 'write_error', detail });
+                const result = {
+                    ok: false,
+                    filesChanged: [],
+                    editsApplied: 0,
+                    reason: 'write_error',
+                    detail: `${edit.file}: ${detail}`,
+                    perEdit,
+                };
+                recordToolResult(ctx.session, toolCallId, 'error', 'write_error');
+                return result;
+            }
+        }
+        if (edit.oldString === edit.newString) {
+            perEdit.push({
+                index: i,
+                file: edit.file,
+                ok: false,
+                reason: 'identical_replacement',
+                detail: 'oldString and newString are identical',
+            });
+            const result = {
+                ok: false,
+                filesChanged: [],
+                editsApplied: 0,
+                reason: 'identical_replacement',
+                detail: `edit ${i} (${edit.file}): oldString and newString are identical`,
+                perEdit,
+            };
+            recordToolResult(ctx.session, toolCallId, 'error', 'identical_replacement');
+            return result;
+        }
+        const matches = countOccurrences(body, edit.oldString);
+        if (matches === 0) {
+            const detail = `edit ${i} (${edit.file}): oldString not found`;
+            perEdit.push({ index: i, file: edit.file, ok: false, reason: 'no_match', detail });
+            const result = {
+                ok: false,
+                filesChanged: [],
+                editsApplied: 0,
+                reason: 'no_match',
+                detail,
+                perEdit,
+            };
+            recordToolResult(ctx.session, toolCallId, 'error', 'no_match');
+            return result;
+        }
+        if (matches > 1) {
+            const detail = `edit ${i} (${edit.file}): oldString matches ${matches} times — expand context to make it unique`;
+            perEdit.push({ index: i, file: edit.file, ok: false, reason: 'ambiguous_match', detail });
+            const result = {
+                ok: false,
+                filesChanged: [],
+                editsApplied: 0,
+                reason: 'ambiguous_match',
+                detail,
+                perEdit,
+            };
+            recordToolResult(ctx.session, toolCallId, 'error', 'ambiguous_match');
+            return result;
+        }
+        body = body.replace(edit.oldString, edit.newString);
+        bodyByFile.set(edit.file, body);
+        perEdit.push({ index: i, file: edit.file, ok: true });
+    }
+    if (opts.dryRun) {
+        const result = {
+            ok: true,
+            filesChanged: Array.from(bodyByFile.keys()),
+            editsApplied: edits.length,
+            perEdit,
+        };
+        recordToolResult(ctx.session, toolCallId, 'success', `dry-run ${edits.length} edits ok`);
+        return result;
+    }
+    // Persist the snapshot to the journal BEFORE the first write. A crash
+    // mid-write then has a recoverable trail in `.pugi/sessions/<id>/journal.jsonl`.
+    // Best-effort; a journal write failure does not block the edits (the
+    // in-memory rollback path still covers same-process failures).
+    if (ctx.session.enabled) {
+        appendEntry(ctx.root, ctx.session.id, {
+            ts: Date.now(),
+            taskId: `multi_edit-${toolCallId}`,
+            files: snapshot,
+        });
+    }
+    // Commit phase. Atomic writes one file at a time. A failure rolls
+    // back via the same dispatcher rollback used by the marker layer.
+    const written = [];
+    for (const [file, body] of bodyByFile) {
+        const abs = resolvedByFile.get(file);
+        try {
+            atomicWrite(abs, body);
+            written.push(file);
+        }
+        catch (error) {
+            const detail = error instanceof Error ? error.message : String(error);
+            // Roll back every file we already touched plus restore the
+            // not-yet-touched ones that existed before (defensive — the
+            // rollback function is idempotent on untouched paths).
+            const rollback = rollbackDispatch(ctx.root, snapshot, preContent);
+            if (!rollback.ok) {
+                const result = {
+                    ok: false,
+                    filesChanged: [],
+                    editsApplied: 0,
+                    reason: 'rollback_failed',
+                    detail: `${file}: ${detail}; rollback also failed: ${rollback.detail}`,
+                    perEdit,
+                };
+                recordToolResult(ctx.session, toolCallId, 'error', 'rollback_failed');
+                return result;
+            }
+            const result = {
+                ok: false,
+                filesChanged: [],
+                editsApplied: 0,
+                reason: 'write_error',
+                detail: `${file}: ${detail}`,
+                perEdit,
+            };
+            recordToolResult(ctx.session, toolCallId, 'error', `write_error: ${detail}`);
+            return result;
+        }
+    }
+    for (const file of written) {
+        recordFileMutation(ctx.session, {
+            toolCallId,
+            path: file,
+            operation: 'update',
+        });
+    }
+    recordToolResult(ctx.session, toolCallId, 'success', `applied ${edits.length} edits across ${written.length} files`);
+    return {
+        ok: true,
+        filesChanged: written,
+        editsApplied: edits.length,
+        perEdit,
+    };
+}
+function countOccurrences(haystack, needle) {
+    if (needle.length === 0)
+        return 0;
+    let count = 0;
+    let from = 0;
+    while (true) {
+        const idx = haystack.indexOf(needle, from);
+        if (idx === -1)
+            return count;
+        count += 1;
+        from = idx + needle.length;
+    }
+}
+/** Atomic write helper — mirrors Layer A / Layer D. */
+function atomicWrite(absPath, contents) {
+    const suffix = `${Date.now()}-${Math.random().toString(36).slice(2, 8)}`;
+    const tmp = `${absPath}.pugi-tmp-${suffix}`;
+    try {
+        writeFileSync(tmp, contents, { encoding: 'utf8', mode: 0o600 });
+        renameSync(tmp, absPath);
+    }
+    catch (error) {
+        try {
+            unlinkSync(tmp);
+        }
+        catch {
+            // tmp file may not exist if writeFileSync itself failed.
+        }
+        throw error;
+    }
+}
+/** Test-only surface. */
+export const __test__ = { MULTI_EDIT_MAX };
+//# sourceMappingURL=multi-edit.js.map

package/dist/tools/registry.js

@@ -14,6 +14,11 @@ const registry = [
     { name: 'lsp_diagnostics', permission: 'read', risk: 'low', concurrencySafe: true, m1: true },
     { name: 'lsp_hover', permission: 'read', risk: 'low', concurrencySafe: true, m1: true },
     { name: 'lsp_references', permission: 'read', risk: 'low', concurrencySafe: true, m1: true },
+    // β7 L5+T11: multi_edit dispatches an ordered batch of Layer A edits
+    // as a single transaction. Risk = medium (same chokepoints as `edit`).
+    // concurrencySafe = false because the journal serialises one dispatch
+    // per session.
+    { name: 'multi_edit', permission: 'edit', risk: 'medium', concurrencySafe: false, m1: true },
     { name: 'question', permission: 'none', risk: 'low', concurrencySafe: false, m1: true },
     { name: 'read', permission: 'read', risk: 'low', concurrencySafe: true, m1: true },
     { name: 'skill', permission: 'read', risk: 'low', concurrencySafe: true, m1: true },

package/dist/tools/web-fetch.js

@@ -34,7 +34,7 @@
  * Brand voice: brief / dispatch / ship / sentinel only. The
  * brandbook §08 forbidden-word list applies — see CLAUDE.md.
  */
-import { request } from 'undici';
+import { request, Agent } from 'undici';
 import { Readability } from '@mozilla/readability';
 import { parseHTML } from 'linkedom';
 import TurndownService from 'turndown';
@@ -45,6 +45,72 @@ let activeLookup = async (hostname) => await dnsLookup(hostname, { all: true, ve
 export function _setLookupForTests(fn) {
     activeLookup = fn ?? (async (hostname) => await dnsLookup(hostname, { all: true, verbatim: true }));
 }
+/**
+ * β1b #62 — DNS rebinding guard via pinned-address Dispatcher.
+ *
+ * Without this, the SSRF guard's `dns.lookup` and undici's `request()`
+ * connect(2) each issue independent DNS queries. A hostile resolver
+ * can answer "8.8.8.8" the first time (passes the SSRF guard) and
+ * "127.0.0.1" the second time (kernel connects to local metadata).
+ *
+ * Fix: resolve once, validate, then pin the resolved address into a
+ * per-call `Agent` via `connect.lookup`. The connect() path no longer
+ * touches DNS — it uses the IP we already approved.
+ *
+ * Test seam: spec suite uses MockAgent as the global dispatcher; the
+ * MockAgent path does not exercise real connect(), so pinning is both
+ * pointless and would break the MockAgent stub. Specs flip
+ * `_disablePinnedDispatcherForTests(true)` in beforeEach to keep the
+ * MockAgent flow intact while production hits the pinned path.
+ */
+let pinnedDispatcherDisabled = false;
+export function _disablePinnedDispatcherForTests(disabled) {
+    pinnedDispatcherDisabled = disabled;
+}
+/**
+ * Build a per-call undici Agent that always returns the pre-resolved
+ * `address` from its connect.lookup hook. Returns `undefined` when the
+ * test flag disabled pinning — caller then falls back to the global
+ * dispatcher (MockAgent or production default).
+ */
+async function buildPinnedDispatcher(hostname) {
+    if (pinnedDispatcherDisabled)
+        return undefined;
+    // Skip pinning when hostname is already a literal IP — there is no
+    // DNS step to race in that case.
+    if (isIPv4(hostname) || isIPv6(hostname))
+        return undefined;
+    let answers;
+    try {
+        answers = await activeLookup(hostname);
+    }
+    catch {
+        // Best-effort — fall through without pinning; the SSRF guard will
+        // emit the canonical DNS-lookup-failed error on the caller's path.
+        return undefined;
+    }
+    const pinned = answers[0];
+    if (!pinned)
+        return undefined;
+    // β1b r1: close the DNS rebinding window the original guard could
+    // not see. `validateHostnameForFetch` already ran one lookup; the
+    // call above is a SECOND lookup whose answer feeds the pin. A
+    // hostile resolver can return a public address to the guard and a
+    // private address here — re-validate the pinned literal before we
+    // hand it to the Agent. Throws so the caller surfaces a security
+    // refusal rather than silently dispatching to the wrong host.
+    const ipCheck = validateIpLiteralForFetch(pinned.address, pinned.family);
+    if (ipCheck !== null) {
+        throw new Error(`ssrf_pinned_address_blocked: ${ipCheck}`);
+    }
+    return new Agent({
+        connect: {
+            lookup: (_h, _opts, cb) => {
+                cb(null, pinned.address, pinned.family);
+            },
+        },
+    });
+}
 const FETCH_TIMEOUT_MS = 10_000;
 const MAX_RESPONSE_BYTES = 5 * 1024 * 1024; // 5 MiB
 const MAX_REDIRECTS = 5;
@@ -231,6 +297,42 @@ function ipv4IsBlocked(ip) {
     }
     return false;
 }
+/**
+ * Validate a single IP literal (v4 or v6) against the SSRF blocklist.
+ * Pure synchronous check — no DNS. Returns `null` on success (safe to
+ * connect), an error string when the address is blocked or not a
+ * recognized IP literal.
+ *
+ * Used by the pinned-dispatcher path (web-fetch + web-search) to
+ * RE-VALIDATE the address actually pinned into `connect.lookup` AFTER
+ * the second DNS round-trip. Without this check the original SSRF
+ * guard's lookup answers can diverge from the lookup answers that
+ * feed the pin (hostile resolver flips public→private between calls);
+ * re-checking the pinned literal closes that window.
+ *
+ * Exported for spec coverage.
+ */
+export function validateIpLiteralForFetch(address, family) {
+    if (!address)
+        return 'empty address';
+    // Trust family hint when present (LookupAddress.family is 4 or 6),
+    // otherwise infer from the string shape.
+    const isV4 = family === 4 || (family === undefined && isIPv4(address));
+    const isV6 = family === 6 || (family === undefined && isIPv6(address));
+    if (isV4) {
+        if (ipv4IsBlocked(address)) {
+            return `IP ${address} is in a blocked range (SSRF guard)`;
+        }
+        return null;
+    }
+    if (isV6) {
+        if (ipv6IsBlocked(address)) {
+            return `IPv6 ${address} is in a blocked range (SSRF guard)`;
+        }
+        return null;
+    }
+    return `address ${address} is not a recognized IPv4/IPv6 literal`;
+}
 /**
  * Resolve `hostname` via dns.lookup and reject if any answer maps to
  * a private/loopback/link-local/CGNAT range. Returns `null` on success
@@ -395,10 +497,34 @@ export async function webFetchTool(input, ctx) {
     let currentUrl = parsedUrl;
     let hops = 0;
     const controller = new AbortController();
+    // β1b #62: per-hop pinned Agent so the post-lookup connect(2) cannot
+    // be redirected to a private IP by a hostile resolver. Built lazily
+    // per hop because each redirect target may resolve to a different
+    // host. `undefined` falls back to the global dispatcher (spec
+    // MockAgent or production default), preserving the existing test
+    // path. The current Agent is closed at end-of-call so we do not leak
+    // open connections.
+    let activeAgent;
+    const closeActiveAgent = async () => {
+        if (activeAgent) {
+            try {
+                await activeAgent.close();
+            }
+            catch {
+                /* ignore — agent already closed */
+            }
+            activeAgent = undefined;
+        }
+    };
     try {
         while (true) {
+            // β1b #62: refresh the pinned Agent for the current hop.
+            await closeActiveAgent();
+            const hopHost = currentUrl.hostname.replace(/^\[|\]$/g, '');
+            activeAgent = await buildPinnedDispatcher(hopHost);
             response = await request(currentUrl.toString(), {
                 method: 'GET',
+                ...(activeAgent ? { dispatcher: activeAgent } : {}),
                 headers: {
                     'user-agent': USER_AGENT,
                     accept: 'text/html,application/xhtml+xml',
@@ -436,6 +562,7 @@ export async function webFetchTool(input, ctx) {
                             /* socket already closed — nothing to do */
                         }
                     }
+                    await closeActiveAgent();
                     return { ok: false, error: `Exceeded ${MAX_REDIRECTS} redirect hops.` };
                 }
                 // Drain prior body so the socket can be reused.
@@ -445,9 +572,11 @@ export async function webFetchTool(input, ctx) {
                     nextUrl = new URL(locStr, currentUrl);
                 }
                 catch {
+                    await closeActiveAgent();
                     return { ok: false, error: `Invalid redirect target: ${locStr}` };
                 }
                 if (nextUrl.protocol !== 'http:' && nextUrl.protocol !== 'https:') {
+                    await closeActiveAgent();
                     return {
                         ok: false,
                         error: `Refusing redirect to unsupported scheme ${nextUrl.protocol}.`,
@@ -456,6 +585,7 @@ export async function webFetchTool(input, ctx) {
                 const nextHost = nextUrl.hostname.replace(/^\[|\]$/g, '');
                 const guard = await validateHostnameForFetch(nextHost);
                 if (guard) {
+                    await closeActiveAgent();
                     return { ok: false, error: `SSRF refused on redirect: ${guard}` };
                 }
                 currentUrl = nextUrl;
@@ -465,13 +595,23 @@ export async function webFetchTool(input, ctx) {
         }
     }
     catch (error) {
+        await closeActiveAgent();
         const message = error instanceof Error ? error.message : String(error);
+        // β1b r1: the pinned-dispatcher path throws `ssrf_pinned_address_blocked: …`
+        // when the second DNS lookup answered a private IP. Surface that as a
+        // first-class SSRF refusal so callers (and specs) can match on it
+        // without grovelling through `Fetch failed:` prefixes.
+        if (message.startsWith('ssrf_pinned_address_blocked')) {
+            return { ok: false, error: `SSRF refused: ${message}` };
+        }
         return { ok: false, error: `Fetch failed: ${message}` };
     }
     if (!response) {
+        await closeActiveAgent();
         return { ok: false, error: 'No response received.' };
     }
     if (response.statusCode < 200 || response.statusCode >= 300) {
+        await closeActiveAgent();
         return { ok: false, error: `HTTP ${response.statusCode} from ${currentUrl.toString()}` };
     }
     // content-length is advisory — never trust it for the size cap, but
@@ -489,6 +629,7 @@ export async function webFetchTool(input, ctx) {
             catch {
                 /* ignore */
             }
+            await closeActiveAgent();
             return {
                 ok: false,
                 error: `Declared content-length ${n} exceeds ${MAX_RESPONSE_BYTES} byte cap.`,
@@ -499,11 +640,14 @@ export async function webFetchTool(input, ctx) {
     const contentType = Array.isArray(contentTypeRaw) ? contentTypeRaw[0] : contentTypeRaw;
     const mime = typeof contentType === 'string' ? contentType.split(';')[0]?.trim().toLowerCase() ?? '' : '';
     if (!ALLOWED_CONTENT_TYPES.includes(mime)) {
+        await closeActiveAgent();
         return { ok: false, error: `Disallowed content-type ${mime || '(none)'}; only HTML/XHTML/text.` };
     }
     const bodyResult = await readBodyWithCap(response.body, controller);
-    if (!bodyResult.ok)
+    if (!bodyResult.ok) {
+        await closeActiveAgent();
         return bodyResult;
+    }
     const html = bodyResult.buffer.toString('utf8');
     // linkedom is the lightweight DOM Readability needs; jsdom would
     // add ~3 MB to the install footprint for the same surface.
@@ -524,6 +668,7 @@ export async function webFetchTool(input, ctx) {
         `Source: ${safeSource}\n\n` +
         `${scrubbedMarkdown}\n` +
         `</untrusted-content-${nonce}>`;
+    await closeActiveAgent();
     return {
         ok: true,
         url: currentUrl.toString(),