@semalt-ai/code 1.8.5 → 1.19.0

package/test/extract-tool-calls.test.js

@@ -0,0 +1,315 @@
+'use strict';
+
+// Characterization tests for extractToolCalls + its helpers (Task 1.1).
+// These lock in CURRENT behavior — including quirks — so later refactors
+// (Task 1.4 tool registry) cannot silently change parsing. Source is treated
+// as the spec: where behavior is surprising, the test documents it rather than
+// asserting what "should" happen.
+
+const { test } = require('node:test');
+const assert = require('node:assert');
+
+const {
+  extractToolCalls,
+  mapInvokeToCall,
+  repairMinimaxMalformedXml,
+} = require('../lib/tools');
+const fx = require('./fixtures/tool-calls');
+
+// ---------------------------------------------------------------------------
+// One case per inline-content tag (value is the tag body, trimmed/unwrapped).
+// ---------------------------------------------------------------------------
+
+const INLINE_TAG_CASES = [
+  { name: 'shell',        text: '<shell>ls -la</shell>',              expected: [['shell', 'ls -la']] },
+  { name: 'exec',         text: '<exec>npm test</exec>',             expected: [['shell', 'npm test']] },
+  { name: 'run_command',  text: '<run_command>make</run_command>',  expected: [['shell', 'make']] },
+  { name: 'run',          text: '<run>go build</run>',              expected: [['shell', 'go build']] },
+  // Task W.7: the read tuple gained start_line/end_line/show_line_numbers; absent
+  // range → null, show_line_numbers → false (parity with the native rail).
+  { name: 'read_file',    text: '<read_file>a.txt</read_file>',     expected: [['read', 'a.txt', null, null, false]] },
+  { name: 'list_dir',     text: '<list_dir>src</list_dir>',         expected: [['list_dir', 'src']] },
+  { name: 'search_files', text: '<search_files>*.js</search_files>', expected: [['search_files', '*.js', '.']] },
+  { name: 'delete_file',  text: '<delete_file>x.tmp</delete_file>', expected: [['delete_file', 'x.tmp']] },
+  { name: 'make_dir',     text: '<make_dir>build</make_dir>',       expected: [['make_dir', 'build']] },
+  { name: 'remove_dir',   text: '<remove_dir>build</remove_dir>',   expected: [['remove_dir', 'build']] },
+  { name: 'get_env',      text: '<get_env>PATH</get_env>',          expected: [['get_env', 'PATH']] },
+  { name: 'download',     text: '<download>http://x/f.zip</download>', expected: [['download', 'http://x/f.zip']] },
+  { name: 'file_stat',    text: '<file_stat>a.txt</file_stat>',     expected: [['file_stat', 'a.txt']] },
+  { name: 'http_get inline', text: '<http_get>http://x/api</http_get>', expected: [['http_get', 'http://x/api', {}]] },
+];
+
+for (const c of INLINE_TAG_CASES) {
+  test(`inline tag: ${c.name}`, () => {
+    assert.deepStrictEqual(extractToolCalls(c.text), c.expected);
+  });
+}
+
+// ---------------------------------------------------------------------------
+// One case per attribute-form tag. Each is asserted in BOTH quote styles to
+// cover the _matchDual single/double-quote compilation.
+// ---------------------------------------------------------------------------
+
+const ATTR_TAG_CASES = [
+  { name: 'read_file path',   tmpl: (q) => `<read_file path=${q}a.txt${q}/>`,                          expected: [['read', 'a.txt', null, null, false]] },
+  { name: 'write_file',       tmpl: (q) => `<write_file path=${q}a.txt${q}>hi</write_file>`,           expected: [['write', 'a.txt', 'hi']] },
+  { name: 'create_file→write', tmpl: (q) => `<create_file path=${q}a.txt${q}>hi</create_file>`,        expected: [['write', 'a.txt', 'hi']] },
+  { name: 'append_file',      tmpl: (q) => `<append_file path=${q}a.txt${q}>more</append_file>`,       expected: [['append', 'a.txt', 'more']] },
+  { name: 'search_files attr', tmpl: (q) => `<search_files pattern=${q}*.ts${q} dir=${q}src${q}/>`,    expected: [['search_files', '*.ts', 'src']] },
+  { name: 'set_env',          tmpl: (q) => `<set_env name=${q}FOO${q} value=${q}bar${q}/>`,            expected: [['set_env', 'FOO', 'bar']] },
+  { name: 'move_file',        tmpl: (q) => `<move_file src=${q}a${q} dst=${q}b${q}/>`,                 expected: [['move_file', 'a', 'b']] },
+  { name: 'copy_file',        tmpl: (q) => `<copy_file src=${q}a${q} dst=${q}b${q}/>`,                 expected: [['copy_file', 'a', 'b']] },
+  { name: 'edit_file',        tmpl: (q) => `<edit_file path=${q}a.js${q} line=${q}42${q}>x = 1</edit_file>`, expected: [['edit_file', 'a.js', 42, 'x = 1']] },
+  { name: 'search_in_file',   tmpl: (q) => `<search_in_file path=${q}a.js${q}>TODO</search_in_file>`,  expected: [['search_in_file', 'a.js', 'TODO']] },
+  { name: 'replace_in_file',  tmpl: (q) => `<replace_in_file path=${q}a.js${q} search=${q}old${q} replace=${q}new${q}>g</replace_in_file>`, expected: [['replace_in_file', 'a.js', 'old', 'new', 'g']] },
+  { name: 'upload',           tmpl: (q) => `<upload path=${q}a.bin${q}>QUJD</upload>`,                 expected: [['upload', 'a.bin', 'QUJD']] },
+  { name: 'http_get attr',    tmpl: (q) => `<http_get url=${q}http://x/api${q}/>`,                     expected: [['http_get', 'http://x/api', {}]] },
+  { name: 'ask_user',         tmpl: (q) => `<ask_user question=${q}Which lang?${q}/>`,                 expected: [['ask_user', 'Which lang?']] },
+  { name: 'store_memory',     tmpl: (q) => `<store_memory key=${q}lang${q}>TypeScript</store_memory>`, expected: [['store_memory', 'lang', 'TypeScript']] },
+  { name: 'recall_memory',    tmpl: (q) => `<recall_memory key=${q}lang${q}/>`,                        expected: [['recall_memory', 'lang']] },
+];
+
+for (const c of ATTR_TAG_CASES) {
+  test(`attr tag (double quotes): ${c.name}`, () => {
+    assert.deepStrictEqual(extractToolCalls(c.tmpl('"')), c.expected);
+  });
+  test(`attr tag (single quotes): ${c.name}`, () => {
+    assert.deepStrictEqual(extractToolCalls(c.tmpl("'")), c.expected);
+  });
+}
+
+// Zero-argument self-closing tags.
+test('zero-arg tag: list_memories', () => {
+  assert.deepStrictEqual(extractToolCalls('<list_memories/>'), [['list_memories']]);
+  assert.deepStrictEqual(extractToolCalls('<list_memories></list_memories>'), [['list_memories']]);
+});
+test('zero-arg tag: system_info', () => {
+  assert.deepStrictEqual(extractToolCalls('<system_info/>'), [['system_info']]);
+  assert.deepStrictEqual(extractToolCalls('<system_info></system_info>'), [['system_info']]);
+});
+
+// ---------------------------------------------------------------------------
+// Native / wrapper formats and the JSON path.
+// ---------------------------------------------------------------------------
+
+test('native: minimax:tool_call wrapper → write call', () => {
+  assert.deepStrictEqual(extractToolCalls(fx.MINIMAX_WRAPPER), [['write', 'a.json', '{"k":1}']]);
+});
+
+test('native: qwen:tool_call wrapper', () => {
+  const text = fx.MINIMAX_WRAPPER.replace(/minimax:/g, 'qwen:');
+  assert.deepStrictEqual(extractToolCalls(text), [['write', 'a.json', '{"k":1}']]);
+});
+
+test('native: Qwen3 <function=…> XML', () => {
+  assert.deepStrictEqual(extractToolCalls(fx.QWEN3_XML), [['write', 'a.css', 'body{}']]);
+});
+
+test('native: JSON <tool_call> block', () => {
+  assert.deepStrictEqual(extractToolCalls(fx.JSON_TOOL_CALL), [['read', 'README.md', null, null, false]]);
+});
+
+test('native: <function_call> JSON with `parameters` key', () => {
+  const text = '<function_call>{"name":"make_dir","parameters":{"path":"build"}}</function_call>';
+  assert.deepStrictEqual(extractToolCalls(text), [['make_dir', 'build']]);
+});
+
+test('native: JSON array of tool calls', () => {
+  const text = '<tool_call>[{"name":"read_file","arguments":{"path":"a"}},{"name":"read_file","arguments":{"path":"b"}}]</tool_call>';
+  assert.deepStrictEqual(extractToolCalls(text), [['read', 'a', null, null, false], ['read', 'b', null, null, false]]);
+});
+
+test('native: <tool_call> wrapping <invoke>', () => {
+  const text = '<tool_call>\n<invoke name="delete_file">\n<parameter name="path">x.tmp</parameter>\n</invoke>\n</tool_call>';
+  assert.deepStrictEqual(extractToolCalls(text), [['delete_file', 'x.tmp']]);
+});
+
+test('native: JSON with stringified arguments is re-parsed', () => {
+  const text = '<tool_call>{"name":"read_file","arguments":"{\\"path\\":\\"a.txt\\"}"}</tool_call>';
+  assert.deepStrictEqual(extractToolCalls(text), [['read', 'a.txt', null, null, false]]);
+});
+
+test('native: JSON embedded in surrounding prose (brace-walker recovery)', () => {
+  const text = '<tool_call>Here you go: {"name":"make_dir","arguments":{"path":"d"}} done</tool_call>';
+  assert.deepStrictEqual(extractToolCalls(text), [['make_dir', 'd']]);
+});
+
+test('fenced shell block: each non-comment line becomes a shell call', () => {
+  assert.deepStrictEqual(extractToolCalls(fx.SHELL_FENCE), [['shell', 'echo hi'], ['shell', 'ls -la']]);
+});
+
+// ---------------------------------------------------------------------------
+// Multiple calls, ordering, nesting, equivalence.
+// ---------------------------------------------------------------------------
+
+test('multiple tool calls in one message', () => {
+  const calls = extractToolCalls(fx.MULTI_TAG_MESSAGE);
+  assert.deepStrictEqual(calls.sort(), [
+    ['read', 'src/index.js', null, null, false],
+    ['shell', 'npm test'],
+    ['write', 'out.txt', 'hello\nworld'],
+  ].sort());
+});
+
+test('QUIRK: parse order is by format group, not document order', () => {
+  // The wrapper/native pass runs before the inline-XML pass, so a wrapper that
+  // appears AFTER an inline tag in the text still lands first in the result.
+  const text = '<read_file>first.txt</read_file>\n' + fx.MINIMAX_WRAPPER;
+  assert.deepStrictEqual(extractToolCalls(text), [
+    ['write', 'a.json', '{"k":1}'], // minimax wrapper — parsed first
+    ['read', 'first.txt', null, null, false], // inline read — parsed later
+  ]);
+});
+
+test('nested XML-ish content inside write_file is preserved verbatim', () => {
+  const text = '<write_file path="page.html"><div>hi</div></write_file>';
+  assert.deepStrictEqual(extractToolCalls(text), [['write', 'page.html', '<div>hi</div>']]);
+});
+
+test('QUIRK: attribute-form content is NOT trimmed (unlike inline tags)', () => {
+  const text = '<write_file path="a.txt">\n  spaced  \n</write_file>';
+  assert.deepStrictEqual(extractToolCalls(text), [['write', 'a.txt', '\n  spaced  \n']]);
+});
+
+test('inline-tag body IS trimmed and unwrapped from a nested pseudo-tag', () => {
+  assert.deepStrictEqual(extractToolCalls('<list_dir>  src/  </list_dir>'), [['list_dir', 'src/']]);
+  assert.deepStrictEqual(extractToolCalls('<list_dir><path>/tmp/foo</path></list_dir>'), [['list_dir', '/tmp/foo']]);
+});
+
+test('native and inline paths produce equivalent structured calls for write_file', () => {
+  const viaInline = extractToolCalls('<write_file path="a.json">{"k":1}</write_file>');
+  const viaNative = extractToolCalls(fx.MINIMAX_WRAPPER);
+  assert.deepStrictEqual(viaInline, viaNative);
+});
+
+// ---------------------------------------------------------------------------
+// Malformed / partial input — current behavior is "emit nothing", not throw.
+// ---------------------------------------------------------------------------
+
+const MALFORMED_CASES = [
+  { name: 'unclosed write_file', text: '<write_file path="a.txt">no closing tag' },
+  { name: 'attr tag missing required path', text: '<write_file>orphan body</write_file>' },
+  { name: 'invoke missing required param', text: '<minimax:tool_call><invoke name="write_file"></invoke></minimax:tool_call>' },
+  { name: 'unknown tool name in wrapper', text: '<minimax:tool_call><invoke name="not_a_tool"><parameter name="x">1</parameter></invoke></minimax:tool_call>' },
+  { name: 'empty tool_call JSON block', text: '<tool_call></tool_call>' },
+  { name: 'invalid JSON in tool_call', text: '<tool_call>{not json at all}</tool_call>' },
+  { name: 'plain prose, no tags', text: 'Just a normal explanation with no tool calls.' },
+];
+
+for (const c of MALFORMED_CASES) {
+  test(`malformed/partial yields no calls: ${c.name}`, () => {
+    assert.deepStrictEqual(extractToolCalls(c.text), []);
+  });
+}
+
+test('a malformed tag does not prevent a valid sibling from parsing', () => {
+  const text = '<write_file path="ok.txt">good</write_file>\n<write_file>broken</write_file>';
+  assert.deepStrictEqual(extractToolCalls(text), [['write', 'ok.txt', 'good']]);
+});
+
+// ---------------------------------------------------------------------------
+// options.repairMalformedXml
+// ---------------------------------------------------------------------------
+
+test('repairMalformedXml option recovers stripped-bracket MiniMax output', () => {
+  const broken = [
+    '<minimax:tool_call>',
+    'invoke name="make_dir">',
+    'parameter name="path">build</parameter>',
+    'invoke>',
+    '</minimax:tool_call>',
+  ].join('\n');
+  assert.deepStrictEqual(extractToolCalls(broken), [], 'without repair: nothing parses');
+  assert.deepStrictEqual(
+    extractToolCalls(broken, { repairMalformedXml: true }),
+    [['make_dir', 'build']],
+  );
+});
+
+// ---------------------------------------------------------------------------
+// mapInvokeToCall — direct unit coverage of the name→call mapping + guards.
+// ---------------------------------------------------------------------------
+
+test('mapInvokeToCall: name is case-insensitive', () => {
+  assert.deepStrictEqual(mapInvokeToCall('WRITE_FILE', { path: 'a', content: 'b' }), ['write', 'a', 'b']);
+});
+
+test('mapInvokeToCall: missing required param returns null', () => {
+  assert.strictEqual(mapInvokeToCall('write_file', { content: 'no path' }), null);
+  assert.strictEqual(mapInvokeToCall('move_file', { src: 'a' }), null);
+});
+
+test('mapInvokeToCall: defaults — list_dir/search_files fall back', () => {
+  assert.deepStrictEqual(mapInvokeToCall('list_dir', {}), ['list_dir', '.']);
+  assert.deepStrictEqual(mapInvokeToCall('search_files', {}), ['search_files', '*', '.']);
+});
+
+test('mapInvokeToCall: exec/shell map to shell', () => {
+  assert.deepStrictEqual(mapInvokeToCall('exec', { command: 'ls' }), ['shell', 'ls']);
+  assert.deepStrictEqual(mapInvokeToCall('shell', { command: 'ls' }), ['shell', 'ls']);
+});
+
+test('mapInvokeToCall: unknown tool returns null', () => {
+  assert.strictEqual(mapInvokeToCall('frobnicate', { x: 1 }), null);
+});
+
+// Every name→call mapping, driven directly (the wrapper paths only reach a
+// subset of these by name, so cover the rest here).
+const MAP_CASES = [
+  ['read_file',      { path: 'a' },                                 ['read', 'a', null, null, false]],
+  ['append_file',    { path: 'a', content: 'c' },                   ['append', 'a', 'c']],
+  ['append_file',    { path: 'a' },                                 ['append', 'a', '']],
+  ['delete_file',    { path: 'a' },                                 ['delete_file', 'a']],
+  ['make_dir',       { path: 'a' },                                 ['make_dir', 'a']],
+  ['remove_dir',     { path: 'a' },                                 ['remove_dir', 'a']],
+  ['copy_file',      { src: 'a', dst: 'b' },                        ['copy_file', 'a', 'b']],
+  ['file_stat',      { path: 'a' },                                 ['file_stat', 'a']],
+  ['search_in_file', { path: 'a', pattern: 'p' },                   ['search_in_file', 'a', 'p']],
+  ['replace_in_file', { path: 'a', search: 'o', replace: 'n' },     ['replace_in_file', 'a', 'o', 'n', '']],
+  ['replace_in_file', { path: 'a', search: 'o', replace: 'n', flags: 'g' }, ['replace_in_file', 'a', 'o', 'n', 'g']],
+  ['get_env',        { name: 'X' },                                 ['get_env', 'X']],
+  ['set_env',        { name: 'X', value: 'v' },                     ['set_env', 'X', 'v']],
+  ['set_env',        { name: 'X' },                                 ['set_env', 'X', '']],
+  ['download',       { url: 'http://x' },                           ['download', 'http://x']],
+  ['upload',         { path: 'a', content: 'b64' },                 ['upload', 'a', 'b64']],
+  ['http_get',       { url: 'http://x' },                           ['http_get', 'http://x', {}]],
+  ['ask_user',       { question: 'q?' },                            ['ask_user', 'q?']],
+  ['store_memory',   { key: 'k', value: 'v' },                      ['store_memory', 'k', 'v']],
+  ['recall_memory',  { key: 'k' },                                  ['recall_memory', 'k']],
+  ['list_memories',  {},                                            ['list_memories']],
+  ['system_info',    {},                                            ['system_info']],
+];
+for (const [name, params, expected] of MAP_CASES) {
+  test(`mapInvokeToCall: ${name}(${JSON.stringify(params)})`, () => {
+    assert.deepStrictEqual(mapInvokeToCall(name, params), expected);
+  });
+}
+
+test('mapInvokeToCall: more missing-required-param guards return null', () => {
+  assert.strictEqual(mapInvokeToCall('read_file', {}), null);
+  assert.strictEqual(mapInvokeToCall('copy_file', { src: 'a' }), null);
+  assert.strictEqual(mapInvokeToCall('search_in_file', { path: 'a' }), null);
+  assert.strictEqual(mapInvokeToCall('get_env', {}), null);
+  assert.strictEqual(mapInvokeToCall('ask_user', {}), null);
+});
+
+test('mapInvokeToCall: edit_file coerces line to int', () => {
+  assert.deepStrictEqual(mapInvokeToCall('edit_file', { path: 'a', line: '7', content: 'x' }), ['edit_file', 'a', 7, 'x']);
+});
+
+// ---------------------------------------------------------------------------
+// repairMinimaxMalformedXml — direct unit coverage.
+// ---------------------------------------------------------------------------
+
+test('repairMinimaxMalformedXml: only rewrites line-start tokens', () => {
+  const input = 'invoke name="x">\nparameter name="y">v</parameter>\ninvoke>';
+  const out = repairMinimaxMalformedXml(input);
+  assert.match(out, /<invoke name="x">/);
+  assert.match(out, /<parameter name="y">/);
+  assert.match(out, /<\/invoke>/);
+});
+
+test('repairMinimaxMalformedXml: non-string input is returned unchanged', () => {
+  assert.strictEqual(repairMinimaxMalformedXml(null), null);
+  assert.strictEqual(repairMinimaxMalformedXml(''), '');
+});

package/test/fetch-url-validation.test.js

@@ -0,0 +1,219 @@
+'use strict';
+
+// Fix — http_get / download must turn ANY malformed URL (or unsupported scheme,
+// empty/whitespace, non-string) into a clean tool error, never an uncaught
+// throw out of the executor.
+//
+// Root cause: `new URL(...)` — and http.get/https.get's own internal parse —
+// throws SYNCHRONOUSLY before the request starts, OUTSIDE the request-level
+// `.on('error')` handlers that gracefully turn EHOSTUNREACH / DNS / timeout into
+// tool errors. So a model-guessed bad URL (invented domain, non-ASCII host,
+// stray chars) crashed the whole session. These tests pin: bad input → a clean
+// `{ error, error_code }` result, no request made, nothing thrown — paired with
+// a valid URL that still fetches end-to-end (the 5.0a paired-positive lesson).
+//
+// Home-based paths are redirected to a temp dir BEFORE any lib module loads so
+// the secret-file/config guards resolve against the temp config path.
+
+const os = require('node:os');
+const fs = require('node:fs');
+const path = require('node:path');
+
+const TMP_HOME = fs.mkdtempSync(path.join(os.tmpdir(), 'semalt-urlval-home-'));
+const PREV_HOME = process.env.HOME;
+const PREV_USERPROFILE = process.env.USERPROFILE;
+process.env.HOME = TMP_HOME;
+process.env.USERPROFILE = TMP_HOME;
+
+const { test, before, after } = require('node:test');
+const assert = require('node:assert');
+const http = require('node:http');
+
+const ui = require('../lib/ui');
+const { createPermissionManager } = require('../lib/permissions');
+const { createToolExecutor } = require('../lib/tools');
+const { _validateFetchUrl } = require('../lib/tool_registry');
+
+let CWD;
+let PREV_CWD;
+let server;
+let baseUrl;
+// Count every inbound request so we can prove a bad URL makes NO request.
+let requestCount = 0;
+
+function mkExec({ config = {}, pmOpts = {}, webChat } = {}) {
+  const pm = createPermissionManager(ui, pmOpts);
+  const getConfig = () => ({
+    max_file_size_kb: 512,
+    command_timeout_ms: 30000,
+    http_fetch_max_bytes: 262144,
+    download_max_bytes: 1048576,
+    // Default web config: extract only (no summarizer needed) for predictable
+    // assertions on the happy path.
+    web: { summarize: false, summary_model: '', max_content_tokens: 6000 },
+    ...config,
+  });
+  return createToolExecutor(pm, ui, getConfig, { webChat });
+}
+
+const fetchUrl = (exec, url, callOpts = {}) =>
+  exec.agentExecFile('http_get', url, callOpts, { signal: null });
+
+before(async () => {
+  PREV_CWD = process.cwd();
+  CWD = fs.mkdtempSync(path.join(os.tmpdir(), 'semalt-urlval-cwd-'));
+  process.chdir(CWD);
+  server = http.createServer((req, res) => {
+    requestCount += 1;
+    res.writeHead(200, { 'Content-Type': 'text/plain' });
+    res.end('hello body');
+  });
+  await new Promise((r) => server.listen(0, '127.0.0.1', r));
+  baseUrl = `http://127.0.0.1:${server.address().port}`;
+});
+
+after(async () => {
+  await new Promise((r) => server.close(r));
+  process.chdir(PREV_CWD);
+  if (PREV_HOME === undefined) delete process.env.HOME; else process.env.HOME = PREV_HOME;
+  if (PREV_USERPROFILE === undefined) delete process.env.USERPROFILE; else process.env.USERPROFILE = PREV_USERPROFILE;
+});
+
+// ---------------------------------------------------------------------------
+// Pure helper — _validateFetchUrl
+// ---------------------------------------------------------------------------
+
+test('_validateFetchUrl: valid http(s) URLs normalize and pass', () => {
+  assert.strictEqual(_validateFetchUrl('http://example.com').url, 'http://example.com/');
+  assert.strictEqual(_validateFetchUrl('https://example.com/a?b=c').url, 'https://example.com/a?b=c');
+  assert.ok(!_validateFetchUrl('https://example.com').error);
+});
+
+test('_validateFetchUrl: malformed / non-ASCII / stray-char URLs are errors', () => {
+  for (const bad of ['not a url', 'http://', 'ht!tp://x', '文字好意.com', 'http://exa mple.com']) {
+    const r = _validateFetchUrl(bad);
+    assert.ok(r.error, `expected error for ${JSON.stringify(bad)}`);
+    assert.strictEqual(r.error_code, 'ERR_INVALID_URL');
+    assert.ok(!r.url);
+  }
+});
+
+test('_validateFetchUrl: non-http(s) schemes are rejected', () => {
+  for (const bad of ['file:///etc/passwd', 'ftp://x/y', 'javascript:alert(1)', 'data:text/plain,hi']) {
+    const r = _validateFetchUrl(bad);
+    assert.ok(r.error, `expected error for ${JSON.stringify(bad)}`);
+    assert.strictEqual(r.error_code, 'ERR_INVALID_PROTOCOL');
+  }
+});
+
+test('_validateFetchUrl: empty / whitespace / non-string are errors', () => {
+  for (const bad of ['', '   ', null, undefined, 42, {}]) {
+    const r = _validateFetchUrl(bad);
+    assert.ok(r.error, `expected error for ${JSON.stringify(bad)}`);
+    assert.strictEqual(r.error_code, 'ERR_INVALID_URL');
+  }
+});
+
+test('_validateFetchUrl: a relative redirect Location resolves against its base', () => {
+  assert.strictEqual(_validateFetchUrl('/next', 'http://h/a/b').url, 'http://h/next');
+});
+
+// ---------------------------------------------------------------------------
+// http_get executor — bad input never throws, makes no request
+// ---------------------------------------------------------------------------
+
+test('http_get: invalid URL (non-ASCII / stray chars) → tool error, no throw, no request', async () => {
+  const exec = mkExec();
+  const before = requestCount;
+  let r;
+  await assert.doesNotReject(async () => { r = await fetchUrl(exec, 'http://文字 好意.com/x'); });
+  assert.ok(r.error, 'should return an error result');
+  assert.match(r.error, /invalid url/i);
+  assert.strictEqual(r.error_code, 'ERR_INVALID_URL');
+  assert.strictEqual(requestCount, before, 'no request should have been made');
+});
+
+test('http_get: the exact log-style invalid input does not crash', async () => {
+  const exec = mkExec();
+  let r;
+  await assert.doesNotReject(async () => { r = await fetchUrl(exec, '文字好意.com'); });
+  assert.ok(r.error);
+  assert.match(r.error, /invalid url/i);
+});
+
+test('http_get: non-http(s) scheme → clean tool error, no request', async () => {
+  const exec = mkExec();
+  for (const bad of ['file:///etc/passwd', 'ftp://host/x', 'javascript:alert(1)']) {
+    const before = requestCount;
+    const r = await fetchUrl(exec, bad);
+    assert.ok(r.error, `expected error for ${bad}`);
+    assert.match(r.error, /unsupported protocol|invalid url/i);
+    assert.strictEqual(requestCount, before, `no request for ${bad}`);
+  }
+});
+
+test('http_get: empty / whitespace / non-string URL → clean tool error', async () => {
+  const exec = mkExec();
+  for (const bad of ['', '   ', null]) {
+    const r = await fetchUrl(exec, bad);
+    assert.ok(r.error, `expected error for ${JSON.stringify(bad)}`);
+    assert.strictEqual(r.error_code, 'ERR_INVALID_URL');
+  }
+});
+
+test('http_get: error shape matches the network-failure shape ({ error, error_code })', async () => {
+  const exec = mkExec();
+  // A malformed URL (sync) and an unreachable host (async .on(error)) should
+  // both surface the same keys, so the agent handles them identically.
+  const bad = await fetchUrl(exec, 'http://');
+  // 127.0.0.1:1 — refused fast, exercising the async request-error path.
+  const unreachable = await fetchUrl(exec, 'http://127.0.0.1:1/');
+  for (const r of [bad, unreachable]) {
+    assert.ok('error' in r, 'has error');
+    assert.ok('error_code' in r, 'has error_code');
+    assert.strictEqual(typeof r.error, 'string');
+  }
+});
+
+// ---------------------------------------------------------------------------
+// Paired positive — a valid URL still fetches end-to-end
+// ---------------------------------------------------------------------------
+
+test('http_get: a VALID URL still works end-to-end (paired positive)', async () => {
+  const exec = mkExec();
+  const r = await fetchUrl(exec, `${baseUrl}/page`);
+  assert.ok(!r.error, `valid URL should not error: ${r.error}`);
+  assert.strictEqual(r.status_code, 200);
+  assert.match(r.body, /hello body/);
+});
+
+// ---------------------------------------------------------------------------
+// download executor — bad input never throws, makes no request, no file
+// ---------------------------------------------------------------------------
+
+test('download: invalid URL → tool error, no throw, no request, no file', async () => {
+  const exec = mkExec();
+  const before = requestCount;
+  let r;
+  await assert.doesNotReject(async () => {
+    r = await exec.agentExecFile('download', 'http://bad host/x', 'out.bin');
+  });
+  assert.ok(r.error, 'should return an error result');
+  assert.match(r.error, /invalid url/i);
+  assert.strictEqual(requestCount, before, 'no request should have been made');
+  assert.strictEqual(fs.existsSync(path.join(CWD, 'out.bin')), false, 'no file written');
+});
+
+test('download: non-http(s) scheme → clean tool error', async () => {
+  const exec = mkExec();
+  const r = await exec.agentExecFile('download', 'file:///etc/passwd', 'p.bin');
+  assert.ok(r.error);
+  assert.match(r.error, /unsupported protocol|invalid url/i);
+});
+
+test('download: a VALID URL still downloads (paired positive)', async () => {
+  const exec = mkExec();
+  const r = await exec.agentExecFile('download', `${baseUrl}/file.txt`, 'file.txt');
+  assert.strictEqual(r.status, 'ok');
+  assert.strictEqual(fs.readFileSync(path.join(CWD, 'file.txt'), 'utf8'), 'hello body');
+});

package/test/fixtures/tool-calls.js

@@ -0,0 +1,57 @@
+'use strict';
+
+// Sample model messages for extractToolCalls characterization tests (Task 1.1).
+// These capture the real shapes various model families emit. Kept as a module
+// (not JSON) so multi-line template literals stay readable.
+
+// A single assistant message mixing prose with multiple XML tool tags.
+const MULTI_TAG_MESSAGE = [
+  'Sure, let me do a few things.',
+  '<read_file>src/index.js</read_file>',
+  'Now I will write the result:',
+  '<write_file path="out.txt">hello\nworld</write_file>',
+  'And run the tests:',
+  '<exec>npm test</exec>',
+].join('\n');
+
+// MiniMax-M2 native wrapper round-tripped back into text by chatStream.
+const MINIMAX_WRAPPER = [
+  '<minimax:tool_call>',
+  '<invoke name="write_file">',
+  '<parameter name="path">a.json</parameter>',
+  '<parameter name="content">{"k":1}</parameter>',
+  '</invoke>',
+  '</minimax:tool_call>',
+].join('\n');
+
+// Qwen3-Coder XML format: name on the tag as `=name`, params as `=key`.
+const QWEN3_XML = [
+  '<function=write_file>',
+  '<parameter=path>a.css</parameter>',
+  '<parameter=content>body{}</parameter>',
+  '</function>',
+].join('\n');
+
+// Hermes/Qwen JSON tool-call block.
+const JSON_TOOL_CALL = [
+  '<tool_call>',
+  '{"name": "read_file", "arguments": {"path": "README.md"}}',
+  '</tool_call>',
+].join('\n');
+
+// A fenced shell block (models sometimes emit commands this way).
+const SHELL_FENCE = [
+  '```shell',
+  'echo hi',
+  '# a comment line that must be skipped',
+  'ls -la',
+  '```',
+].join('\n');
+
+module.exports = {
+  MULTI_TAG_MESSAGE,
+  MINIMAX_WRAPPER,
+  QWEN3_XML,
+  JSON_TOOL_CALL,
+  SHELL_FENCE,
+};