@tonyclaw/agent-inspector 3.1.19 → 3.1.21

package/src/lib/safeFetch.ts

@@ -1,5 +1,8 @@
 import { lookup } from "node:dns/promises";
+import { request as requestHttp } from "node:http";
+import { request as requestHttps } from "node:https";
 import { isIP } from "node:net";
+import type { IncomingMessage, RequestOptions } from "node:http";
 import { evaluateUpstreamUrl, isInternalHost, type SsrfGuardOptions } from "./ssrfGuard";
 
 export type ResolvedAddress = {
@@ -11,11 +14,18 @@ export type HostResolver = (hostname: string) => Promise<readonly ResolvedAddres
 
 export type SafeFetchOptions = SsrfGuardOptions & {
   resolver?: HostResolver;
+  deadlineMs?: number;
+  responseBytes?: number;
+  pinDns?: boolean;
 };
 
 export type SafeFetchResult =
   | { ok: true; response: Response }
-  | { ok: false; kind: "network-policy" | "redirect"; reason: string };
+  | {
+      ok: false;
+      kind: "network-policy" | "redirect" | "resource-limit" | "timeout";
+      reason: string;
+    };
 
 async function defaultResolver(hostname: string): Promise<readonly ResolvedAddress[]> {
   return lookup(hostname, { all: true, verbatim: true });
@@ -35,12 +45,28 @@ export async function evaluateResolvedUpstreamUrl(
   rawUrl: string,
   options: SafeFetchOptions = {},
 ): Promise<{ allow: true } | { allow: false; reason: string }> {
+  const decision = await evaluateResolvedUpstreamUrlForFetch(rawUrl, options);
+  return decision.allow ? { allow: true } : { allow: false, reason: decision.reason };
+}
+
+type ResolvedUpstreamUrlDecision =
+  | { allow: true; hostname: string; addresses: readonly ResolvedAddress[] }
+  | { allow: false; reason: string };
+
+async function evaluateResolvedUpstreamUrlForFetch(
+  rawUrl: string,
+  options: SafeFetchOptions,
+): Promise<ResolvedUpstreamUrlDecision> {
   const initial = evaluateUpstreamUrl(rawUrl, options);
-  if (!initial.allow || options.bypass === true) return initial;
+  if (!initial.allow) return initial;
 
   const parsed = new URL(rawUrl);
   const hostname = parsed.hostname.replace(/^\[|]$/g, "");
-  if (isIP(hostname) !== 0 || hostname.toLowerCase() === "localhost") return initial;
+  if (options.bypass === true) return { allow: true, hostname, addresses: [] };
+
+  const ipFamily = isIP(hostname);
+  if (ipFamily !== 0)
+    return { allow: true, hostname, addresses: [{ address: hostname, family: ipFamily }] };
 
   let addresses: readonly ResolvedAddress[];
   try {
@@ -65,36 +91,418 @@ export async function evaluateResolvedUpstreamUrl(
     };
   }
 
-  return { allow: true };
+  return { allow: true, hostname, addresses };
 }
 
 function isRedirectStatus(status: number): boolean {
   return status >= 300 && status < 400;
 }
 
+function formatByteLimit(limit: number): string {
+  return `${String(limit)} bytes`;
+}
+
+function parseContentLength(value: string | null): number | null {
+  if (value === null) return null;
+  const parsed = Number(value);
+  if (!Number.isSafeInteger(parsed) || parsed < 0) return null;
+  return parsed;
+}
+
+function isPinnedDnsEnabled(options: SafeFetchOptions): boolean {
+  const disabledForTest =
+    typeof process !== "undefined" &&
+    process.env["NODE_ENV"] === "test" &&
+    process.env["AGENT_INSPECTOR_DISABLE_DNS_PINNING_FOR_TESTS"] === "1";
+  if (disabledForTest) return false;
+  return options.pinDns !== false && options.bypass !== true;
+}
+
+function choosePinnedAddress(addresses: readonly ResolvedAddress[]): ResolvedAddress | null {
+  return addresses[0] ?? null;
+}
+
+function hostHeaderValue(parsed: URL): string {
+  return parsed.port.length === 0 ? parsed.host : `${parsed.hostname}:${parsed.port}`;
+}
+
+function headersToRecord(headers: HeadersInit | undefined, parsed: URL): Record<string, string> {
+  const normalized = new Headers(headers);
+  if (!normalized.has("host")) {
+    normalized.set("host", hostHeaderValue(parsed));
+  }
+  const result: Record<string, string> = {};
+  normalized.forEach((value, key) => {
+    result[key] = value;
+  });
+  return result;
+}
+
+async function requestBodyToUint8Array(
+  body: BodyInit | null | undefined,
+): Promise<
+  { ok: true; body: Uint8Array | null; contentType: string | null } | { ok: false; reason: string }
+> {
+  if (body === undefined || body === null) return { ok: true, body: null, contentType: null };
+  if (typeof body === "string") {
+    return { ok: true, body: new TextEncoder().encode(body), contentType: null };
+  }
+  if (body instanceof URLSearchParams) {
+    return {
+      ok: true,
+      body: new TextEncoder().encode(body.toString()),
+      contentType: "application/x-www-form-urlencoded;charset=UTF-8",
+    };
+  }
+  if (body instanceof Uint8Array) return { ok: true, body, contentType: null };
+  if (body instanceof ArrayBuffer) {
+    return { ok: true, body: new Uint8Array(body), contentType: null };
+  }
+  if (body instanceof Blob) {
+    return { ok: true, body: new Uint8Array(await body.arrayBuffer()), contentType: body.type };
+  }
+  return {
+    ok: false,
+    reason: "Pinned upstream fetch only supports buffered request bodies",
+  };
+}
+
+function pinnedLookup(
+  pinnedAddress: ResolvedAddress,
+): (
+  hostname: string,
+  options: { all?: boolean },
+  callback: (error: Error | null, address: string | ResolvedAddress[], family?: number) => void,
+) => void {
+  return (_hostname, options, callback) => {
+    if (options.all === true) {
+      callback(null, [pinnedAddress]);
+      return;
+    }
+    callback(null, pinnedAddress.address, pinnedAddress.family);
+  };
+}
+
+function requestOptionsForPinnedFetch(
+  parsed: URL,
+  init: RequestInit,
+  pinnedAddress: ResolvedAddress,
+  contentType: string | null,
+): RequestOptions {
+  const headers = headersToRecord(init.headers, parsed);
+  if (contentType !== null && !new Headers(headers).has("content-type")) {
+    headers["content-type"] = contentType;
+  }
+
+  return {
+    protocol: parsed.protocol,
+    hostname: parsed.hostname,
+    port: parsed.port,
+    path: `${parsed.pathname}${parsed.search}`,
+    method: init.method ?? "GET",
+    headers,
+    lookup: pinnedLookup(pinnedAddress),
+  };
+}
+
+function streamFromIncomingMessage(
+  incoming: IncomingMessage,
+  maxBytes: number | undefined,
+): ReadableStream<Uint8Array> {
+  let seenBytes = 0;
+  return new ReadableStream<Uint8Array>({
+    start(controller) {
+      incoming.on("data", (chunk: Uint8Array) => {
+        seenBytes += chunk.byteLength;
+        if (maxBytes !== undefined && seenBytes > maxBytes) {
+          incoming.destroy(
+            new Error(
+              `Upstream response exceeded configured limit of ${formatByteLimit(maxBytes)}`,
+            ),
+          );
+          controller.error(
+            new Error(
+              `Upstream response exceeded configured limit of ${formatByteLimit(maxBytes)}`,
+            ),
+          );
+          return;
+        }
+        controller.enqueue(chunk);
+      });
+      incoming.on("end", () => {
+        controller.close();
+      });
+      incoming.on("error", (error) => {
+        controller.error(error);
+      });
+    },
+    cancel() {
+      incoming.destroy();
+    },
+  });
+}
+
+async function cancelBody(response: Response): Promise<void> {
+  if (response.body === null) return;
+  await response.body.cancel().catch(() => undefined);
+}
+
+function responseWithByteLimit(response: Response, maxBytes: number): Response {
+  if (response.body === null) return response;
+
+  let seenBytes = 0;
+  const reader = response.body.getReader();
+  const body = new ReadableStream<Uint8Array>({
+    async pull(controller) {
+      const chunk = await reader.read();
+      if (chunk.done) {
+        controller.close();
+        return;
+      }
+
+      seenBytes += chunk.value.byteLength;
+      if (seenBytes > maxBytes) {
+        void reader.cancel().catch(() => undefined);
+        controller.error(
+          new Error(`Upstream response exceeded configured limit of ${formatByteLimit(maxBytes)}`),
+        );
+        return;
+      }
+
+      controller.enqueue(chunk.value);
+    },
+    cancel(reason) {
+      return reader.cancel(reason);
+    },
+  });
+
+  return new Response(body, {
+    status: response.status,
+    statusText: response.statusText,
+    headers: response.headers,
+  });
+}
+
+function shouldUseBudgetedSignal(init: RequestInit, deadlineMs: number | undefined): boolean {
+  return deadlineMs !== undefined || init.signal !== undefined;
+}
+
+async function pinnedNodeFetch(
+  rawUrl: string,
+  init: RequestInit,
+  options: SafeFetchOptions,
+  decision: Extract<ResolvedUpstreamUrlDecision, { allow: true }>,
+): Promise<SafeFetchResult> {
+  const parsed = new URL(rawUrl);
+  const pinnedAddress = choosePinnedAddress(decision.addresses);
+  if (pinnedAddress === null) {
+    return {
+      ok: false,
+      kind: "network-policy",
+      reason: `Could not pin a resolved upstream address for "${decision.hostname}"`,
+    };
+  }
+
+  const encodedBody = await requestBodyToUint8Array(init.body);
+  if (!encodedBody.ok) {
+    return { ok: false, kind: "resource-limit", reason: encodedBody.reason };
+  }
+
+  return await new Promise<SafeFetchResult>((resolve, reject) => {
+    const linkedSignal = init.signal ?? undefined;
+    const transport = parsed.protocol === "https:" ? requestHttps : requestHttp;
+    const requestOptions = requestOptionsForPinnedFetch(
+      parsed,
+      init,
+      pinnedAddress,
+      encodedBody.contentType,
+    );
+    const request = transport(requestOptions, (incoming) => {
+      const status = incoming.statusCode ?? 0;
+      if (isRedirectStatus(status)) {
+        incoming.resume();
+        const location = incoming.headers.location;
+        resolve({
+          ok: false,
+          kind: "redirect",
+          reason:
+            location === undefined
+              ? `Upstream returned blocked redirect HTTP ${String(status)}`
+              : `Upstream redirect to "${location}" is blocked; configure the final API URL directly`,
+        });
+        return;
+      }
+
+      const maxBytes = options.responseBytes;
+      const headers = new Headers();
+      for (const [key, value] of Object.entries(incoming.headers)) {
+        if (Array.isArray(value)) {
+          headers.set(key, value.join(", "));
+          continue;
+        }
+        if (value !== undefined) headers.set(key, value);
+      }
+
+      if (maxBytes !== undefined) {
+        const declaredBytes = parseContentLength(headers.get("content-length"));
+        if (declaredBytes !== null && declaredBytes > maxBytes) {
+          incoming.destroy();
+          resolve({
+            ok: false,
+            kind: "resource-limit",
+            reason: `Upstream declared ${String(declaredBytes)} response bytes, exceeding configured limit of ${formatByteLimit(maxBytes)}`,
+          });
+          return;
+        }
+      }
+
+      resolve({
+        ok: true,
+        response: new Response(streamFromIncomingMessage(incoming, maxBytes), {
+          status,
+          statusText: incoming.statusMessage,
+          headers,
+        }),
+      });
+    });
+
+    let timedOut = false;
+    let timeout: ReturnType<typeof setTimeout> | undefined;
+    const finishAbort = (): void => {
+      request.destroy(new DOMException("Safe fetch aborted", "AbortError"));
+    };
+
+    if (linkedSignal !== undefined) {
+      if (linkedSignal.aborted) {
+        finishAbort();
+      } else {
+        linkedSignal.addEventListener("abort", finishAbort, { once: true });
+      }
+    }
+
+    if (options.deadlineMs !== undefined) {
+      timeout = setTimeout(() => {
+        timedOut = true;
+        request.destroy(new DOMException("Safe fetch deadline exceeded", "TimeoutError"));
+      }, options.deadlineMs);
+    }
+
+    request.on("error", (error) => {
+      if (timeout !== undefined) clearTimeout(timeout);
+      if (linkedSignal !== undefined) {
+        linkedSignal.removeEventListener("abort", finishAbort);
+      }
+      if (timedOut) {
+        resolve({
+          ok: false,
+          kind: "timeout",
+          reason: `Upstream request exceeded configured deadline of ${String(options.deadlineMs)} ms`,
+        });
+        return;
+      }
+      reject(error);
+    });
+
+    request.on("close", () => {
+      if (timeout !== undefined) clearTimeout(timeout);
+      if (linkedSignal !== undefined) {
+        linkedSignal.removeEventListener("abort", finishAbort);
+      }
+    });
+
+    if (encodedBody.body !== null) request.write(encodedBody.body);
+    request.end();
+  });
+}
+
 export async function safeFetch(
   rawUrl: string,
   init: RequestInit = {},
   options: SafeFetchOptions = {},
 ): Promise<SafeFetchResult> {
-  const decision = await evaluateResolvedUpstreamUrl(rawUrl, options);
-  if (!decision.allow) {
-    return { ok: false, kind: "network-policy", reason: decision.reason };
+  const resolvedDecision = await evaluateResolvedUpstreamUrlForFetch(rawUrl, options);
+  if (!resolvedDecision.allow) {
+    return { ok: false, kind: "network-policy", reason: resolvedDecision.reason };
   }
 
-  const response = await fetch(rawUrl, { ...init, redirect: "manual" });
-  if (!isRedirectStatus(response.status)) return { ok: true, response };
-
-  if (response.body !== null) {
-    await response.body.cancel().catch(() => undefined);
+  if (isPinnedDnsEnabled(options)) {
+    return await pinnedNodeFetch(rawUrl, init, options, resolvedDecision);
   }
-  const location = response.headers.get("location");
-  return {
-    ok: false,
-    kind: "redirect",
-    reason:
-      location === null
-        ? `Upstream returned blocked redirect HTTP ${String(response.status)}`
-        : `Upstream redirect to "${location}" is blocked; configure the final API URL directly`,
+
+  const deadlineMs = options.deadlineMs;
+  const useBudgetedSignal = shouldUseBudgetedSignal(init, deadlineMs);
+  const controller = useBudgetedSignal ? new AbortController() : undefined;
+  let timedOut = false;
+  let timeout: ReturnType<typeof setTimeout> | undefined;
+  const linkedSignal = init.signal ?? undefined;
+  const forwardAbort = (): void => {
+    controller?.abort(linkedSignal?.reason);
   };
+
+  if (controller !== undefined && linkedSignal !== undefined) {
+    if (linkedSignal.aborted) {
+      forwardAbort();
+    } else {
+      linkedSignal.addEventListener("abort", forwardAbort, { once: true });
+    }
+  }
+
+  if (controller !== undefined && deadlineMs !== undefined) {
+    timeout = setTimeout(() => {
+      timedOut = true;
+      controller.abort(new DOMException("Safe fetch deadline exceeded", "TimeoutError"));
+    }, deadlineMs);
+  }
+
+  try {
+    const response = await fetch(rawUrl, {
+      ...init,
+      redirect: "manual",
+      signal: controller?.signal ?? init.signal,
+    });
+    if (!isRedirectStatus(response.status)) {
+      const maxBytes = options.responseBytes;
+      if (maxBytes === undefined) return { ok: true, response };
+
+      const declaredBytes = parseContentLength(response.headers.get("content-length"));
+      if (declaredBytes !== null && declaredBytes > maxBytes) {
+        await cancelBody(response);
+        return {
+          ok: false,
+          kind: "resource-limit",
+          reason: `Upstream declared ${String(declaredBytes)} response bytes, exceeding configured limit of ${formatByteLimit(maxBytes)}`,
+        };
+      }
+
+      return { ok: true, response: responseWithByteLimit(response, maxBytes) };
+    }
+
+    await cancelBody(response);
+    const location = response.headers.get("location");
+    return {
+      ok: false,
+      kind: "redirect",
+      reason:
+        location === null
+          ? `Upstream returned blocked redirect HTTP ${String(response.status)}`
+          : `Upstream redirect to "${location}" is blocked; configure the final API URL directly`,
+    };
+  } catch (error) {
+    if (timedOut) {
+      return {
+        ok: false,
+        kind: "timeout",
+        reason:
+          deadlineMs === undefined
+            ? "Upstream request exceeded its configured deadline"
+            : `Upstream request exceeded configured deadline of ${String(deadlineMs)} ms`,
+      };
+    }
+    return Promise.reject(error);
+  } finally {
+    if (timeout !== undefined) clearTimeout(timeout);
+    if (controller !== undefined && linkedSignal !== undefined) {
+      linkedSignal.removeEventListener("abort", forwardAbort);
+    }
+  }
 }

package/src/lib/stopReason.ts

@@ -1,7 +1,7 @@
-import type { CapturedLog } from "../contracts";
+import type { CapturedLog, StopReason } from "../contracts";
 import { isRecord } from "./unknown";
 
-export type StopReason = "end_turn" | "tool_use" | "stop" | "length" | null;
+export type { StopReason } from "../contracts";
 
 function normalizeAnthropicStopReason(value: string): StopReason {
   switch (value) {
@@ -15,6 +15,67 @@ function normalizeAnthropicStopReason(value: string): StopReason {
   }
 }
 
+function extractStopReasonFromJsonValue(value: unknown): StopReason {
+  if (!isRecord(value)) return null;
+
+  // Anthropic shape: { stop_reason: "end_turn" | "tool_use" | ... }
+  if (typeof value.stop_reason === "string") {
+    return normalizeAnthropicStopReason(value.stop_reason);
+  }
+
+  // Anthropic SSE shape: { type: "message_delta", delta: { stop_reason: "..." } }
+  if (isRecord(value.delta) && typeof value.delta.stop_reason === "string") {
+    return normalizeAnthropicStopReason(value.delta.stop_reason);
+  }
+
+  // OpenAI Chat shape: { choices: [{ finish_reason: "stop" | "length" | ... }] }
+  if (Array.isArray(value.choices)) {
+    for (const choice of value.choices) {
+      if (!isRecord(choice) || typeof choice.finish_reason !== "string") continue;
+      const reason = normalizeOpenAIFinishReason(choice.finish_reason);
+      if (reason !== null) return reason;
+    }
+  }
+
+  // OpenAI Responses shape: { status: "completed", output: [...] }
+  if (Array.isArray(value.output)) {
+    for (const item of value.output) {
+      if (isRecord(item) && item.type === "function_call") {
+        return "tool_use";
+      }
+    }
+    if (value.status === "completed") {
+      return "stop";
+    }
+  }
+
+  if (value.status === "incomplete" && isRecord(value.incomplete_details)) {
+    const reason = value.incomplete_details.reason;
+    if (typeof reason === "string" && isResponsesLengthLimitReason(reason)) {
+      return "length";
+    }
+  }
+
+  return null;
+}
+
+function extractStopReasonFromSseText(text: string): StopReason {
+  let stopReason: StopReason = null;
+  for (const rawLine of text.split("\n")) {
+    const line = rawLine.trim();
+    if (!line.startsWith("data: ")) continue;
+    const data = line.slice(6).trim();
+    if (data === "[DONE]") break;
+    try {
+      const reason = extractStopReasonFromJsonValue(JSON.parse(data));
+      if (reason !== null) stopReason = reason;
+    } catch {
+      // Ignore malformed or non-JSON SSE data lines.
+    }
+  }
+  return stopReason;
+}
+
 function normalizeOpenAIFinishReason(value: string): StopReason {
   switch (value) {
     case "stop":
@@ -45,6 +106,7 @@ function isResponsesLengthLimitReason(value: string): boolean {
  * while the request was classified as OpenAI).
  */
 export function extractStopReason(log: CapturedLog): StopReason {
+  if (log.stopReason !== undefined) return log.stopReason;
   if (log.responseText === null) return null;
 
   try {
@@ -53,44 +115,9 @@ export function extractStopReason(log: CapturedLog): StopReason {
     if (typeof json === "string") {
       json = JSON.parse(json);
     }
-    if (!isRecord(json)) return null;
-
-    // Anthropic shape: { stop_reason: "end_turn" | "tool_use" | ... }
-    if (typeof json.stop_reason === "string") {
-      return normalizeAnthropicStopReason(json.stop_reason);
-    }
-
-    // OpenAI Chat shape: { choices: [{ finish_reason: "stop" | "length" | ... }] }
-    if (Array.isArray(json.choices)) {
-      for (const choice of json.choices) {
-        if (!isRecord(choice) || typeof choice.finish_reason !== "string") continue;
-        const reason = normalizeOpenAIFinishReason(choice.finish_reason);
-        if (reason !== null) return reason;
-      }
-    }
-
-    // OpenAI Responses shape: { status: "completed", output: [...] }
-    if (Array.isArray(json.output)) {
-      for (const item of json.output) {
-        if (isRecord(item) && item.type === "function_call") {
-          return "tool_use";
-        }
-      }
-      if (json.status === "completed") {
-        return "stop";
-      }
-    }
-
-    if (json.status === "incomplete" && isRecord(json.incomplete_details)) {
-      const reason = json.incomplete_details.reason;
-      if (typeof reason === "string" && isResponsesLengthLimitReason(reason)) {
-        return "length";
-      }
-    }
-
-    return null;
+    return extractStopReasonFromJsonValue(json);
   } catch {
-    return null;
+    return extractStopReasonFromSseText(log.responseText);
   }
 }
 

package/src/proxy/ecosystemTasks.ts

@@ -14,6 +14,7 @@ import {
   signalProcessTree,
   type CommandSpec,
 } from "./platformCommands";
+import { DEFAULT_RUNTIME_BUDGET_POLICY } from "../lib/resourceLimits";
 
 const MAX_TASKS = 50;
 const OUTPUT_LIMIT = 40_000;
@@ -34,6 +35,12 @@ const activeTasks = new Map<string, ActiveTask>();
 let acceptingTasks = true;
 let shutdownForceTimer: ReturnType<typeof setTimeout> | null = null;
 
+function activeTaskLimit(): number {
+  const configured = Number(process.env["ECOSYSTEM_TASK_ACTIVE_LIMIT"]);
+  if (Number.isSafeInteger(configured) && configured > 0) return configured;
+  return DEFAULT_RUNTIME_BUDGET_POLICY.queues.backgroundWorkers;
+}
+
 function nowIso(): string {
   return new Date().toISOString();
 }
@@ -258,6 +265,7 @@ export function startEcosystemTask(
   action: EcosystemTaskAction,
 ): EcosystemTask | null {
   if (!acceptingTasks) return null;
+  if (activeTasks.size >= activeTaskLimit()) return null;
   if (action === "recipe") return null;
   const definition =
     action === "runner-presets"
@@ -291,6 +299,7 @@ export function startEcosystemTask(
 
 export function startEcosystemRecipeTask(recipeId: string): EcosystemTask | null {
   if (!acceptingTasks) return null;
+  if (activeTasks.size >= activeTaskLimit()) return null;
   const recipe = findEcosystemRecipe(recipeId);
   if (recipe === null) return null;
   if (!recipe.runnable) return null;
@@ -367,6 +376,7 @@ export function _startEcosystemTaskForTests(
   timeoutMs = RECIPE_TIMEOUT_MS,
 ): EcosystemTask | null {
   if (!acceptingTasks) return null;
+  if (activeTasks.size >= activeTaskLimit()) return null;
   const task: EcosystemTask = {
     id: randomUUID(),
     packageId: "test-package",
@@ -393,3 +403,13 @@ export function _resetEcosystemTasksForTests(): void {
   activeTasks.clear();
   acceptingTasks = true;
 }
+
+export function _getEcosystemTaskAdmissionHealthForTests(): {
+  activeTasks: number;
+  activeTaskLimit: number;
+} {
+  return {
+    activeTasks: activeTasks.size,
+    activeTaskLimit: activeTaskLimit(),
+  };
+}