@underactive/pi-topping-web-tools 0.2.4 → 0.2.5

package/CHANGELOG.md

@@ -2,6 +2,18 @@
 
 ## [Unreleased]
 
+## [0.2.5] - 2026-09-30
+
+### Changed
+
+- Tested against pi 0.99.2. No break: the 0.99.1 to 0.99.2 extension API is additive only (`ToolNamespace.instructions`), and `pi-tui` and `pi-agent-core` declarations are unchanged.
+- Bumped the pinned `@earendil-works/pi-ai`, `@earendil-works/pi-coding-agent`, and `@earendil-works/pi-tui` devDependencies from 0.99.1 to 0.99.2.
+
+### Fixed
+
+- Bounded tool result and status previews. A result that is one long logical line — minified JSON, raw HTML from `get_content` — rendered as a single unbounded logical line and word-wrapped into ~1250 screen lines. An expanded preview now keeps 10 logical lines of 200 characters, and a collapsed result whose `details` cannot be rendered is clipped to 200 characters.
+- `fetch_markdown`, `pdf_extract`, `web_browser`: attacker-controlled header fields are clipped to 200 characters before display. A hostile server could previously send a multi-megabyte HTTP reason phrase, and a page could carry a huge `<title>`; either one filled the screen from the collapsed one-line summary.
+
 ## [0.2.4] - 2026-09-29
 
 ### Added

package/README.md

@@ -54,6 +54,13 @@ Start with `fetch_markdown` for efficient static content; use `web_browser` when
 | `pdf_extract` | Extract the text layer from a remote or local PDF, with page markers |
 | `web_browser` | Headless Chromium automation — navigate, click, type, screenshot, evaluate, logs, cookies |
 
+All three tools are `direct`-exposure and pi activates those on registration (`defaultActive` defaults to true), so nothing needs to be enabled.
+
+### Enabling and disabling tools
+
+- To hide a tool for a session, name it in `--exclude-tools` (or start with `--no-tools` and re-add what you want with `--tools`).
+- To change the startup set in your `settings.json`, use `defaultTools`. Bare names **replace** pi's defaults, so write `"+fetch_markdown"` to add a tool without dropping `read`, `bash`, `edit`, and `write`. On pi 0.99.2+, `/reload` activates tools **newly added** to `defaultTools` without a restart. The reverse does not follow: a tool **removed** from `defaultTools` stays active until you restart, and a tool you turned off during the session stays off. `--tools`, `--no-tools`, and `--no-builtin-tools` still override the setting, on reload as well.
+
 ## `fetch_markdown`
 
 Complements pi's built-in search-backed `web_fetch` with a lightweight, keyless fetch path for public documentation, READMEs, and articles:

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@underactive/pi-topping-web-tools",
-	"version": "0.2.4",
+	"version": "0.2.5",
 	"description": "Pi extensions for the web: fetch_markdown (URL to markdown, cached, keyless), pdf_extract (PDF text extraction) and web_browser (headless Playwright automation), sharing a preapproved-host allowlist.",
 	"keywords": ["pi-package", "pi-extension"],
 	"license": "MIT",
@@ -53,9 +53,9 @@
 		"typebox": "*"
 	},
 	"devDependencies": {
-		"@earendil-works/pi-ai": "0.99.1",
-		"@earendil-works/pi-coding-agent": "0.99.1",
-		"@earendil-works/pi-tui": "0.99.1",
+		"@earendil-works/pi-ai": "0.99.2",
+		"@earendil-works/pi-coding-agent": "0.99.2",
+		"@earendil-works/pi-tui": "0.99.2",
 		"@types/node": "^24.0.0",
 		"@types/turndown": "^5.0.5",
 		"typebox": "^1.3.3",

package/src/fetch-markdown.ts

@@ -12,6 +12,7 @@ import { combineSignals } from "./abort-utils.ts";
 import { getBrowserHeaders } from "./browser-headers.ts";
 import { isPreapprovedHost, permissionKey } from "./permissions.ts";
 import { requestHostPermission } from "./permission-prompt.ts";
+import { clipField, resultPreview, resultText } from "./render-preview.ts";
 import { MAX_URL_LENGTH, isLocalOrPrivateHost, upgradeHttpToHttps } from "./web-browser/permissions.ts";
 
 const MAX_HTTP_CONTENT_LENGTH = 25 * 1024 * 1024;
@@ -557,12 +558,12 @@ To complete your request, I need to fetch content from the redirected URL. Pleas
 		}
 
 		if (!details || typeof details.bytes !== "number") {
-			const content = result.content[0];
-			return new Text(content?.type === "text" ? content.text : "", 0, 0);
+			return new Text(clipField(resultText(result.content)), 0, 0);
 		}
 
 		let text = theme.fg("success", `Received ${formatSize(details.bytes)}`);
-		text += theme.fg("muted", ` (${details.code} ${details.codeText})`);
+		// The HTTP reason phrase is attacker-controlled, so bound it like the body.
+		text += theme.fg("muted", ` (${details.code} ${clipField(details.codeText)})`);
 		if (details.cached) {
 			text += theme.fg("dim", " cached");
 		}
@@ -571,15 +572,12 @@ To complete your request, I need to fetch content from the redirected URL. Pleas
 		}
 
 		if (expanded) {
-			const content = result.content[0];
-			if (content?.type === "text") {
-				const lines = content.text.split("\n", 16);
-				for (const line of lines.slice(0, 15)) {
-					text += `\n${theme.fg("dim", line)}`;
-				}
-				if (lines.length > 15) {
-					text += `\n${theme.fg("muted", "… (truncated)")}`;
-				}
+			const preview = resultPreview(resultText(result.content));
+			for (const line of preview.lines) {
+				text += `\n${theme.fg("dim", line)}`;
+			}
+			if (preview.truncated) {
+				text += `\n${theme.fg("muted", "… (truncated)")}`;
 			}
 		}
 

package/src/pdf-extract.ts

@@ -11,6 +11,7 @@ import { extractText, getDocumentProxy } from "unpdf";
 import { combineSignals } from "./abort-utils.ts";
 import { isPreapprovedHost, permissionKey } from "./permissions.ts";
 import { requestHostPermission } from "./permission-prompt.ts";
+import { clipField, resultPreview, resultText } from "./render-preview.ts";
 import { getWithPermittedRedirects, isPermittedRedirect, sliceContent, validateURL } from "./fetch-markdown.ts";
 import { upgradeHttpToHttps } from "./web-browser/permissions.ts";
 
@@ -409,8 +410,7 @@ Usage notes:
 		}
 
 		if (!details || typeof details.pageCount !== "number") {
-			const content = result.content[0];
-			return new Text(content?.type === "text" ? content.text : "", 0, 0);
+			return new Text(clipField(resultText(result.content)), 0, 0);
 		}
 
 		let text = theme.fg("success", `Extracted ${details.pageCount} of ${details.totalPages} page(s)`);
@@ -423,15 +423,12 @@ Usage notes:
 		}
 
 		if (expanded) {
-			const content = result.content[0];
-			if (content?.type === "text") {
-				const lines = content.text.split("\n", 16);
-				for (const line of lines.slice(0, 15)) {
-					text += `\n${theme.fg("dim", line)}`;
-				}
-				if (lines.length > 15) {
-					text += `\n${theme.fg("muted", "… (truncated)")}`;
-				}
+			const preview = resultPreview(resultText(result.content));
+			for (const line of preview.lines) {
+				text += `\n${theme.fg("dim", line)}`;
+			}
+			if (preview.truncated) {
+				text += `\n${theme.fg("muted", "… (truncated)")}`;
 			}
 		}
 

package/src/render-preview.ts

@@ -0,0 +1,61 @@
+/**
+ * Bounded previews for tool results in the TUI.
+ *
+ * pi 0.99.2 fixed long single-line results filling the screen for bash, codemode,
+ * and MCP tool output, but that fix lives in the host's own renderers. Extension
+ * tools that supply a custom `renderResult` render whatever they return, so the
+ * same bound has to be applied here. Header fields need the same bound: an HTTP
+ * reason phrase and a page `<title>` are attacker-controlled and can be megabytes.
+ *
+ * Bounds are expressed in characters rather than visual lines because pi's `Text`
+ * word-wraps (and hard-breaks unspaced tokens) on render. That keeps the work
+ * independent of the terminal, but rendered height still scales as
+ * `characters / width`; the worst case here is about 43 lines at 80 columns and 76
+ * at 40, versus the ~1250 lines a 100K-character result produced before.
+ */
+
+import type { ImageContent, TextContent } from "@earendil-works/pi-ai";
+
+/** Logical lines shown in an expanded preview. */
+export const MAX_PREVIEW_LINES = 10;
+
+/** Characters kept per logical line in an expanded preview. */
+export const MAX_PREVIEW_LINE_CHARS = 200;
+
+/** Characters kept from a single unbounded field: a header value, status field, or collapsed body. */
+export const MAX_FIELD_CHARS = 200;
+
+export interface ResultPreview {
+	/** Logical lines to display, each already clipped to {@link MAX_PREVIEW_LINE_CHARS}. */
+	lines: string[];
+	/** Whether logical lines were dropped by the {@link MAX_PREVIEW_LINES} cap. */
+	truncated: boolean;
+}
+
+/** Concatenate a tool result's text blocks; empty when the result carries only images. */
+export function resultText(content: readonly (TextContent | ImageContent)[]): string {
+	return content
+		.filter((block): block is TextContent => block.type === "text")
+		.map((block) => block.text)
+		.join("\n");
+}
+
+/** Clip one attacker-controlled field to {@link MAX_FIELD_CHARS}, marking the cut with an ellipsis. */
+export function clipField(text: string): string {
+	return text.length > MAX_FIELD_CHARS ? `${text.slice(0, MAX_FIELD_CHARS)}…` : text;
+}
+
+/**
+ * Preview for an expanded tool result: at most {@link MAX_PREVIEW_LINES} logical lines,
+ * each clipped so one long line cannot fill the screen. A line long enough to hit the
+ * character cap loses its tail in the preview; the full text stays in the transcript.
+ */
+export function resultPreview(text: string): ResultPreview {
+	// The limit argument keeps the split bounded on a large body: one extra element is
+	// enough to detect that more lines existed.
+	const all = text.split("\n", MAX_PREVIEW_LINES + 1);
+	return {
+		lines: all.slice(0, MAX_PREVIEW_LINES).map((line) => clipField(line)),
+		truncated: all.length > MAX_PREVIEW_LINES,
+	};
+}

package/src/web-browser/index.ts

@@ -31,6 +31,7 @@ import {
 import { buildOriginChecker } from "./egress-policy.ts";
 import { checkUrlPermission, upgradeHttpToHttps, validateURL } from "./permissions.ts";
 import { requestHostPermission } from "../permission-prompt.ts";
+import { clipField, resultPreview, resultText } from "../render-preview.ts";
 import { listGrants } from "../permission-store.ts";
 import { permissionKey } from "../permissions.ts";
 import { isInsideCwd } from "../pdf-extract.ts";
@@ -291,8 +292,8 @@ export default function (pi: ExtensionAPI) {
 			const lines = [
 				"Web Browser:",
 				`  Status: ${info.isOpen ? "open" : "closed"}`,
-				`  URL: ${info.url || "(none)"}`,
-				`  Title: ${info.title?.replace(/[\u0000-\u001f\u007f]/g, " ") || "(none)"}`,
+				`  URL: ${info.url ? clipField(info.url) : "(none)"}`,
+				`  Title: ${info.title ? clipField(info.title.replace(/[\u0000-\u001f\u007f]/g, " ")) : "(none)"}`,
 				`  Tabs open: ${info.tabCount}`,
 				`  Console messages: ${info.consoleCount}`,
 				`  Network issues: ${info.networkCount}`,
@@ -1042,7 +1043,7 @@ export default function (pi: ExtensionAPI) {
 			}
 
 			if (details.error) {
-				return new Text(theme.fg("error", details.error.slice(0, 120)), 0, 0);
+				return new Text(theme.fg("error", clipField(details.error)), 0, 0);
 			}
 
 			const imageBlock = result.content.find((c) => c.type === "image");
@@ -1062,9 +1063,14 @@ export default function (pi: ExtensionAPI) {
 			let text = "";
 			switch (details.action) {
 				case "navigate":
+					// The page title is attacker-controlled, so bound it like the body.
 					text = theme.fg(
 						"success",
-						`Navigated — ${details.title?.replace(/[\u0000-\u001f\u007f]/g, " ") ?? details.url ?? "ok"}`,
+						`Navigated — ${
+							details.title
+								? clipField(details.title.replace(/[\u0000-\u001f\u007f]/g, " "))
+								: clipField(details.url ?? "ok")
+						}`,
 					);
 					break;
 				case "get_content":
@@ -1095,15 +1101,12 @@ export default function (pi: ExtensionAPI) {
 			}
 
 			if (expanded) {
-				const content = result.content.find((c) => c.type === "text");
-				if (content?.type === "text") {
-					const lines = content.text.split("\n", 16);
-					for (const line of lines.slice(0, 15)) {
-						text += `\n${theme.fg("dim", line)}`;
-					}
-					if (lines.length > 15) {
-						text += `\n${theme.fg("muted", "…")}`;
-					}
+				const preview = resultPreview(resultText(result.content));
+				for (const line of preview.lines) {
+					text += `\n${theme.fg("dim", line)}`;
+				}
+				if (preview.truncated) {
+					text += `\n${theme.fg("muted", "…")}`;
 				}
 				if (details.fullOutputPath) {
 					text += `\n${theme.fg("dim", `Full: ${details.fullOutputPath}`)}`;