mixdog 0.9.49 → 0.9.51

package/scripts/verify-release-assets-test.mjs

@@ -1,6 +1,6 @@
 import assert from 'node:assert/strict';
 import { createHash } from 'node:crypto';
-import { mkdtemp, readFile, rm, writeFile } from 'node:fs/promises';
+import { mkdtemp, rm, writeFile } from 'node:fs/promises';
 import { tmpdir } from 'node:os';
 import { join } from 'node:path';
 import test from 'node:test';
@@ -59,303 +59,6 @@ function graphFixture() {
   };
 }
 
-function yamlScalar(value) {
-  const trimmed = value.trim();
-  if (trimmed.startsWith("'") && trimmed.endsWith("'")) {
-    return trimmed.slice(1, -1).replaceAll("''", "'");
-  }
-  if (trimmed.startsWith('"') && trimmed.endsWith('"')) {
-    return JSON.parse(trimmed);
-  }
-  return trimmed.replace(/\s+#.*$/, '').trim();
-}
-
-function yamlBlockEnd(lines, start, indent) {
-  for (let index = start + 1; index < lines.length; index += 1) {
-    const text = lines[index];
-    if (/^\s*(?:#.*)?$/.test(text)) continue;
-    if (text.match(/^\s*/)[0].length <= indent) return index;
-  }
-  return lines.length;
-}
-
-function yamlMappingEntry(text, indent) {
-  if (text.match(/^\s*/)[0].length !== indent) return undefined;
-  const match = text.slice(indent).match(/^("(?:\\.|[^"])*"|'(?:''|[^'])*'|[A-Za-z0-9_-]+):\s*(.*)$/);
-  if (!match) return undefined;
-  return { key: yamlScalar(match[1]), rawValue: match[2] };
-}
-
-function yamlChildren(lines, start, end, parentIndent) {
-  let childIndent;
-  const children = [];
-  for (let index = start + 1; index < end; index += 1) {
-    const text = lines[index];
-    if (/^\s*(?:#.*)?$/.test(text)) continue;
-    const indent = text.match(/^\s*/)[0].length;
-    if (indent <= parentIndent) break;
-    childIndent ??= indent;
-    if (indent !== childIndent) continue;
-    const entry = yamlMappingEntry(text, indent);
-    if (entry) children.push({
-      ...entry,
-      index,
-      indent,
-      end: yamlBlockEnd(lines, index, indent),
-    });
-  }
-  return children;
-}
-
-function yamlEnvironment(lines, parent) {
-  const env = {};
-  for (const entry of yamlChildren(lines, parent.index, parent.end, parent.indent)) {
-    env[entry.key] = yamlScalar(entry.rawValue);
-  }
-  return env;
-}
-
-function yamlSteps(lines, parent) {
-  const itemIndexes = [];
-  let itemIndent;
-  for (let index = parent.index + 1; index < parent.end; index += 1) {
-    const match = lines[index].match(/^(\s*)-\s+(.*)$/);
-    if (!match || /^\s*(?:#.*)?$/.test(lines[index])) continue;
-    const indent = match[1].length;
-    if (itemIndent === undefined) itemIndent = indent;
-    if (indent === itemIndent) itemIndexes.push(index);
-  }
-
-  return itemIndexes.map((start, position) => {
-    const end = itemIndexes[position + 1] ?? parent.end;
-    const fieldIndent = itemIndent + 2;
-    const fields = { env: {} };
-    for (let index = start; index < end; index += 1) {
-      const source = index === start
-        ? lines[index].replace(/^\s*-\s+/, '')
-        : lines[index].slice(fieldIndent);
-      if (index !== start && lines[index].match(/^\s*/)[0].length !== fieldIndent) continue;
-      const field = source.match(/^(name|run|uses|env):\s*(.*)$/);
-      if (!field) continue;
-      const [, key, rawValue] = field;
-      if (key === 'env' && /^(?:#.*)?$/.test(rawValue)) {
-        fields.env = yamlEnvironment(lines, {
-          index,
-          indent: fieldIndent,
-          end: yamlBlockEnd(lines, index, fieldIndent),
-        });
-      } else if (key === 'run' && /^[|>][-+0-9]*\s*(?:#.*)?$/.test(rawValue)) {
-        const commands = [];
-        for (let blockIndex = index + 1; blockIndex < end; blockIndex += 1) {
-          const blockLine = lines[blockIndex];
-          if (blockLine.trim() === '' || /^\s*#/.test(blockLine)) continue;
-          if (blockLine.match(/^\s*/)[0].length <= fieldIndent) break;
-          commands.push(blockLine.trim());
-        }
-        fields.run = commands.join('\n');
-      } else {
-        fields[key] = yamlScalar(rawValue);
-      }
-    }
-    return fields;
-  });
-}
-
-function parseWorkflowSubset(workflow) {
-  const lines = workflow.replaceAll('\r\n', '\n').split('\n');
-  const roots = lines
-    .map((line, index) => ({ line, index }))
-    .filter(({ line }) => yamlMappingEntry(line, 0)?.key === 'jobs');
-  assert.equal(roots.length, 1, 'workflow must define exactly one jobs mapping');
-  const jobsBlock = {
-    index: roots[0].index,
-    indent: 0,
-    end: yamlBlockEnd(lines, roots[0].index, 0),
-  };
-  const jobs = yamlChildren(lines, jobsBlock.index, jobsBlock.end, jobsBlock.indent).map((entry) => {
-    const children = yamlChildren(lines, entry.index, entry.end, entry.indent);
-    const envEntry = children.find((child) => child.key === 'env');
-    const stepsEntry = children.find((child) => child.key === 'steps');
-    const strategyEntry = children.find((child) => child.key === 'strategy');
-    const matrixEntry = strategyEntry
-      ? yamlChildren(lines, strategyEntry.index, strategyEntry.end, strategyEntry.indent)
-        .find((child) => child.key === 'matrix')
-      : undefined;
-    const matrixLines = matrixEntry
-      ? lines.slice(matrixEntry.index + 1, matrixEntry.end)
-        .filter((line) => !/^\s*(?:#.*)?$/.test(line))
-        .map((line) => line.trim())
-      : [];
-    const includeEntry = matrixEntry
-      ? yamlChildren(lines, matrixEntry.index, matrixEntry.end, matrixEntry.indent)
-        .find((child) => child.key === 'include')
-      : undefined;
-    const matrixInclude = includeEntry
-      ? lines.slice(includeEntry.index + 1, includeEntry.end)
-        .filter((line) => /^\s*-\s+/.test(line) && !/^\s*-\s*#/.test(line))
-        .map((line) => line.replace(/^\s*-\s+/, '').trim())
-      : [];
-    return {
-      name: entry.key,
-      env: envEntry ? yamlEnvironment(lines, envEntry) : {},
-      matrix: matrixEntry ? { lines: matrixLines, include: matrixInclude } : undefined,
-      steps: stepsEntry ? yamlSteps(lines, stepsEntry) : [],
-    };
-  });
-  return { jobs };
-}
-
-function workflowJob(workflow, name) {
-  const matches = parseWorkflowSubset(workflow).jobs.filter((job) => job.name === name);
-  assert.equal(matches.length, 1, `workflow must define exactly one jobs.${name}`);
-  return matches[0];
-}
-
-function namedStep(job, name) {
-  const matches = job.steps.filter((step) => step.name === name);
-  assert.equal(matches.length, 1, `jobs.${job.name} must contain exactly one "${name}" step`);
-  return matches[0];
-}
-
-function extractReleaseSteps(workflow) {
-  return workflowJob(workflow, 'release').steps;
-}
-
-function runLines(step) {
-  return step.run?.split('\n') ?? [];
-}
-
-function assertRunLine(step, line, message) {
-  assert.ok(runLines(step).includes(line), message);
-}
-
-function matrixRowsWithKey(matrix, key) {
-  return matrix.include.filter((row) => {
-    const fields = row.match(/^\{(.*)\}$/)?.[1] ?? row;
-    return new RegExp(`(?:^|,)\\s*${key}\\s*:`).test(fields);
-  });
-}
-
-function effectiveStepEnv(job, step, key) {
-  if (Object.hasOwn(step.env, key)) return step.env[key];
-  return job.env[key];
-}
-
-function cargoBuildCommands(step) {
-  return runLines(step).filter((line) => /\bcargo\s+build(?:\s|$)/.test(line));
-}
-
-function assertRepeatedCommand(commands, expected, count, message) {
-  assert.equal(commands.length, count, message);
-  for (const command of commands) {
-    assert.equal(command, expected, message);
-  }
-}
-
-function assertProvenanceDigestLinkage(step) {
-  for (const line of [
-    'FIRST=$(sha256 "_asset/$ASSET")',
-    'SECOND=$(sha256 "$BIN")',
-    'cmp "_asset/$ASSET" "$BIN"',
-    'test "$FIRST" = "$SECOND"',
-    'ASSET_DIGEST=$FIRST \\',
-    'assetDigest: process.env.ASSET_DIGEST,',
-  ]) {
-    assertRunLine(step, line, `reproducibility step must preserve digest/provenance linkage: ${line}`);
-  }
-}
-
-function assertMatrixRustflags(job) {
-  assert.ok(job.matrix, 'jobs.build must define a strategy matrix');
-  assert.ok(job.matrix.include.length > 0, 'jobs.build matrix must define include rows');
-  assert.equal(
-    matrixRowsWithKey(job.matrix, 'rustflags').length,
-    job.matrix.include.length,
-    'every jobs.build matrix include row must define rustflags',
-  );
-  assert.equal(
-    job.env.RUSTFLAGS,
-    '${{ matrix.rustflags }}',
-    'jobs.build must set RUSTFLAGS from matrix.rustflags',
-  );
-}
-
-function assertProtocolStep(job) {
-  const protocol = namedStep(job, 'Test protocol');
-  assert.equal(
-    protocol.env.RUSTFLAGS,
-    '',
-    'protocol tests must explicitly clear RUSTFLAGS for loadable host proc-macro dylibs',
-  );
-  assertRunLine(
-    protocol,
-    'cargo test --locked --manifest-path native/mixdog-graph/Cargo.toml',
-    'Test protocol step must own the locked graph protocol test command',
-  );
-}
-
-function assertReproducibilityStep(job) {
-  const reproducibility = namedStep(job, 'Build twice and compare');
-  assert.equal(
-    effectiveStepEnv(job, reproducibility, 'RUSTFLAGS'),
-    '${{ matrix.rustflags }}',
-    'reproducibility builds must preserve matrix RUSTFLAGS',
-  );
-  assertRepeatedCommand(
-    cargoBuildCommands(reproducibility),
-    'cargo build --locked --release --target "${{ matrix.target }}" --manifest-path native/mixdog-graph/Cargo.toml',
-    2,
-    'Build twice and compare must own exactly two targeted locked release cargo build commands',
-  );
-  assertProvenanceDigestLinkage(reproducibility);
-}
-
-function assertGraphReleaseRustflagsContract(workflow) {
-  const build = workflowJob(workflow, 'build');
-  assertMatrixRustflags(build);
-  assertProtocolStep(build);
-  assertReproducibilityStep(build);
-}
-
-function assertReleaseWorkflowOrdering(workflow) {
-  const steps = extractReleaseSteps(workflow);
-  const required = [
-    ['Verify bundled release assets', 'node scripts/verify-release-assets.mjs'],
-    ['Install', 'npm ci'],
-    ['Execute code graph from a clean cache', 'npm run test:code-graph-clean-cache'],
-    ['Focused release regressions', 'npm run test:release-focused'],
-    ['Smoke', 'npm run smoke'],
-    ['Publish', 'npm publish --provenance --access public'],
-  ];
-  const indexes = {};
-  for (const [name, command] of required) {
-    const matches = steps
-      .map((step, index) => ({ step, index }))
-      .filter(({ step }) => step.name === name);
-    assert.equal(matches.length, 1, `release workflow must contain exactly one "${name}" step`);
-    assert.ok(
-      matches[0].step.run?.split('\n').includes(command),
-      `"${name}" step must run ${command}`,
-    );
-    indexes[name] = matches[0].index;
-  }
-
-  const asset = indexes['Verify bundled release assets'];
-  const install = indexes.Install;
-  const cleanCache = indexes['Execute code graph from a clean cache'];
-  const focused = indexes['Focused release regressions'];
-  const smoke = indexes.Smoke;
-  const publish = indexes.Publish;
-  assert.ok(asset < install, 'release asset blocker must run before Install');
-  assert.ok(asset < cleanCache, 'release asset blocker must run before clean-cache graph execution');
-  assert.ok(install < cleanCache, 'Install must run before clean-cache graph execution');
-  assert.ok(cleanCache < focused, 'clean-cache graph execution must run before Focused release regressions');
-  assert.ok(focused < smoke, 'Focused release regressions must run before Smoke');
-  assert.ok(smoke < publish, 'Smoke must run before Publish');
-  assert.ok(asset < publish, 'release asset blocker must run before Publish');
-  assert.ok(cleanCache < publish, 'clean-cache graph execution must run before Publish');
-}
-
 test('accepts independent strict patch, runtime, app, and graph versions', () => {
   assert.equal(validatePatchManifest(patchFixture(), `[package]\nversion = "${VERSION}"\n`).version, VERSION);
   assert.equal(validateRuntimeManifest(runtimeFixture()).release_tag, 'runtime-v1.2.3');
@@ -534,6 +237,13 @@ test('cancels immediately when a stream exceeds its declared size below the abso
 
 test('full guard reads deterministic fixtures and downloads every declared asset', async () => {
   const dir = await mkdtemp(join(tmpdir(), 'mixdog-release-assets-'));
+  const patch = patchFixture();
+  const runtime = runtimeFixture();
+  const graph = graphFixture();
+  const expectedUrls = new Set(
+    [...Object.values(patch.assets), ...Object.values(runtime.assets), ...Object.values(graph.assets)]
+      .map(({ url }) => url),
+  );
   const paths = {
     patchManifestPath: join(dir, 'patch.json'),
     cargoPath: join(dir, 'Cargo.toml'),
@@ -542,21 +252,23 @@ test('full guard reads deterministic fixtures and downloads every declared asset
     packagePath: join(dir, 'package.json'),
   };
   await Promise.all([
-    writeFile(paths.patchManifestPath, JSON.stringify(patchFixture())),
+    writeFile(paths.patchManifestPath, JSON.stringify(patch)),
     writeFile(paths.cargoPath, `[package]\nversion = "${VERSION}"\n`),
-    writeFile(paths.runtimeManifestPath, JSON.stringify(runtimeFixture())),
-    writeFile(paths.graphManifestPath, JSON.stringify(graphFixture())),
+    writeFile(paths.runtimeManifestPath, JSON.stringify(runtime)),
+    writeFile(paths.graphManifestPath, JSON.stringify(graph)),
     writeFile(paths.packagePath, JSON.stringify({ version: APP_VERSION })),
   ]);
   let downloads = 0;
+  const requestedUrls = [];
   try {
     await verifyReleaseAssets({
       ...paths,
       downloadOptions: {
         attempts: 1,
         timeoutMs: 1000,
-        fetchImpl: async () => {
+        fetchImpl: async (url) => {
           downloads += 1;
+          requestedUrls.push(url);
           return new Response(bytes);
         },
       },
@@ -565,83 +277,5 @@ test('full guard reads deterministic fixtures and downloads every declared asset
     await rm(dir, { recursive: true, force: true });
   }
   assert.equal(downloads, 15);
-});
-
-test('release workflow orders the asset and clean-cache blockers before consumers', async () => {
-  const workflow = await readFile(new URL('../.github/workflows/release.yml', import.meta.url), 'utf8');
-  assertReleaseWorkflowOrdering(workflow);
-
-  const quotedNames = workflow
-    .replace('- name: Install', '- name: "Install"')
-    .replace('- name: Smoke', "- name: 'Smoke'");
-  assertReleaseWorkflowOrdering(quotedNames);
-
-  const wrongStep = workflow
-    .replace('run: npm run smoke', 'run: echo smoke')
-    .replace('run: npm run test:release-focused', 'run: npm run test:release-focused\n      # npm run smoke');
-  assert.throws(() => assertReleaseWorkflowOrdering(wrongStep), /"Smoke" step must run npm run smoke/);
-
-  const otherJob = workflow
-    .replace('run: npm run smoke', 'run: echo smoke')
-    .replace(
-      '\n  release:',
-      '\n  decoy:\n    steps:\n      - name: Smoke\n        run: npm run smoke\n  release:',
-    );
-  assert.throws(() => assertReleaseWorkflowOrdering(otherJob), /"Smoke" step must run npm run smoke/);
-});
-
-test('graph release clears test RUSTFLAGS but keeps targeted reproducibility builds', async () => {
-  const workflow = await readFile(new URL('../.github/workflows/graph-release.yml', import.meta.url), 'utf8');
-  assertGraphReleaseRustflagsContract(workflow);
-
-  const quotedNames = workflow
-    .replace('- name: Test protocol', '- name: "Test protocol"')
-    .replace('- name: Build twice and compare', "- name: 'Build twice and compare'");
-  assertGraphReleaseRustflagsContract(quotedNames);
-
-  assert.throws(
-    () => assertGraphReleaseRustflagsContract(workflow.replace('          RUSTFLAGS: ""', '          RUSTFLAGS: "-C unsafe-for-host"')),
-    /protocol tests must explicitly clear RUSTFLAGS/,
-  );
-  assert.throws(
-    () => assertGraphReleaseRustflagsContract(workflow.replace('--release --target', '--release')),
-    /exactly two targeted locked release cargo build commands/,
-  );
-
-  const renamedBuild = workflow
-    .replace('\n  build:\n', '\n  renamed-build:\n')
-    .replace(
-      '\n  gate:',
-      '\n  decoy-build:\n    env:\n      RUSTFLAGS: ${{ matrix.rustflags }}\n'
-        + '    steps:\n      - name: Test protocol\n'
-        + '        run: cargo test --locked --manifest-path native/mixdog-graph/Cargo.toml\n  gate:',
-    );
-  assert.throws(
-    () => assertGraphReleaseRustflagsContract(renamedBuild),
-    /exactly one jobs\.build/,
-  );
-
-  const commentedBuild = workflow.replace(
-    '          cargo build --locked --release --target "${{ matrix.target }}" --manifest-path native/mixdog-graph/Cargo.toml',
-    '          # cargo build --locked --release --target "${{ matrix.target }}" --manifest-path native/mixdog-graph/Cargo.toml',
-  );
-  assert.throws(
-    () => assertGraphReleaseRustflagsContract(commentedBuild),
-    /exactly two targeted locked release cargo build commands/,
-  );
-
-  const commandInWrongStep = workflow
-    .replace(
-      '        run: cargo test --locked --manifest-path native/mixdog-graph/Cargo.toml',
-      '        run: echo protocol command moved',
-    )
-    .replace(
-      '          test "$(git rev-parse HEAD)" = "${{ needs.gate.outputs.source_sha }}"',
-      '          cargo test --locked --manifest-path native/mixdog-graph/Cargo.toml\n'
-        + '          test "$(git rev-parse HEAD)" = "${{ needs.gate.outputs.source_sha }}"',
-    );
-  assert.throws(
-    () => assertGraphReleaseRustflagsContract(commandInWrongStep),
-    /Test protocol step must own/,
-  );
+  assert.deepEqual(new Set(requestedUrls), expectedUrls);
 });

package/scripts/web-fetch-routing-test.mjs

@@ -0,0 +1,158 @@
+#!/usr/bin/env node
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import http from 'node:http';
+import {
+  isLoopbackHttpUrl,
+  preDispatchDenyForSession,
+} from '../src/runtime/agent/orchestrator/session/loop/pre-dispatch-deny.mjs';
+import { executeTool } from '../src/runtime/agent/orchestrator/session/loop/tool-exec.mjs';
+import {
+  getInternalTools,
+  setInternalToolsProvider,
+} from '../src/runtime/agent/orchestrator/internal-tools.mjs';
+import { previewSessionTools } from '../src/runtime/agent/orchestrator/session/manager/tool-resolution.mjs';
+import { TOOL_DEFS as SEARCH_TOOL_DEFS } from '../src/runtime/search/tool-defs.mjs';
+import { dispatchSearchRuntimeTool } from '../src/session-runtime/runtime-core.mjs';
+import {
+  fetchLoopbackText,
+  fetchPublicImage,
+} from '../src/runtime/search/lib/http-fetch.mjs';
+
+test('pre-dispatch keeps hook-facing web_fetch name unchanged', () => {
+  const local = { name: 'web_fetch', arguments: { url: 'http://127.0.0.1:4321/status' } };
+  const image = { name: 'web_fetch', arguments: { url: 'https://cdn.example.com/a.png?x=1' } };
+  const document = { name: 'web_fetch', arguments: { url: 'https://example.com/docs' } };
+  assert.equal(preDispatchDenyForSession({}, local), null);
+  assert.equal(preDispatchDenyForSession({}, image), null);
+  assert.equal(preDispatchDenyForSession({}, document), null);
+  assert.equal(local.name, 'web_fetch');
+  assert.equal(image.name, 'web_fetch');
+  assert.equal(document.name, 'web_fetch');
+  assert.equal(isLoopbackHttpUrl('http://localhost:80/'), true);
+  assert.equal(isLoopbackHttpUrl('http://192.168.1.2/'), false);
+});
+
+test('hidden routed tools remain dispatchable but absent from every model schema', () => {
+  setInternalToolsProvider({
+    tools: SEARCH_TOOL_DEFS,
+    executor: async () => '',
+  });
+  const registered = getInternalTools().map((tool) => tool.name);
+  assert.equal(registered.includes('local_fetch'), true);
+  assert.equal(registered.includes('image_fetch'), true);
+  for (const spec of ['full', 'mcp', 'readonly', ['tools:mcp']]) {
+    const visible = previewSessionTools(spec, []).map((tool) => tool.name);
+    assert.equal(visible.includes('local_fetch'), false, `local_fetch leaked for ${JSON.stringify(spec)}`);
+    assert.equal(visible.includes('image_fetch'), false, `image_fetch leaked for ${JSON.stringify(spec)}`);
+    assert.equal(visible.includes('web_fetch'), true, `web_fetch missing for ${JSON.stringify(spec)}`);
+  }
+});
+
+test('hook sees public name before routed dispatch and can change routing inputs', async () => {
+  const observed = [];
+  setInternalToolsProvider({
+    tools: SEARCH_TOOL_DEFS,
+    executor: async (name, args) => {
+      observed.push({ stage: 'dispatch', name, args });
+      return { content: [{ type: 'text', text: name }] };
+    },
+  });
+  const result = await executeTool(
+    'web_fetch',
+    { url: 'https://example.com/document' },
+    process.cwd(),
+    'routing-order-test',
+    {
+      beforeToolHook: async ({ name, args }) => {
+        observed.push({ stage: 'hook', name, args });
+        return { action: 'modify', args: { url: 'http://127.0.0.1:4321/status' } };
+      },
+    },
+    { toolCallId: 'routing-order-call' },
+  );
+  assert.equal(result, 'local_fetch');
+  assert.deepEqual(observed.map(({ stage, name }) => ({ stage, name })), [
+    { stage: 'hook', name: 'web_fetch' },
+    { stage: 'dispatch', name: 'local_fetch' },
+  ]);
+});
+
+test('cancellation signal propagates across executeTool and runtime search dispatch', async () => {
+  const received = [];
+  setInternalToolsProvider({
+    tools: SEARCH_TOOL_DEFS,
+    executor: (name, args, callerCtx) => dispatchSearchRuntimeTool(name, args, callerCtx, {
+      getSearchModule: async () => ({
+        handleToolCall: async (_name, _args, options) => {
+          received.push({ name: _name, signal: options.signal });
+          await new Promise((resolve, reject) => {
+            if (options.signal.aborted) reject(options.signal.reason);
+            else options.signal.addEventListener('abort', () => reject(options.signal.reason), { once: true });
+          });
+        },
+      }),
+      getCurrentCwd: () => process.cwd(),
+      getSession: () => null,
+      notifyFnForSession: () => null,
+      runNativeWebSearch: async () => null,
+    }),
+  });
+  for (const [index, testCase] of [
+    { url: 'https://example.com/document', expectedName: 'web_fetch' },
+    { url: 'http://127.0.0.1:4321/status', expectedName: 'local_fetch' },
+  ].entries()) {
+    const controller = new AbortController();
+    const running = executeTool(
+      'web_fetch',
+      { url: testCase.url },
+      process.cwd(),
+      `cancel-test-${index}`,
+      {},
+      { toolCallId: `cancel-call-${index}`, signal: controller.signal },
+    );
+    controller.abort(new Error(`cancelled-by-test-${index}`));
+    await assert.rejects(running, new RegExp(`cancelled-by-test-${index}`));
+    assert.equal(received[index].name, testCase.expectedName);
+    assert.equal(received[index].signal, controller.signal);
+  }
+});
+
+test('local_fetch reads loopback and rejects redirect escape', async (t) => {
+  const server = http.createServer((req, res) => {
+    if (req.url === '/escape') {
+      res.writeHead(302, { location: 'http://169.254.169.254/latest/meta-data/' });
+      res.end();
+      return;
+    }
+    res.writeHead(200, { 'content-type': 'text/plain' });
+    res.end('local-ok');
+  });
+  await new Promise((resolve) => server.listen(0, '127.0.0.1', resolve));
+  t.after(() => server.close());
+  const { port } = server.address();
+  assert.equal(await fetchLoopbackText(`http://127.0.0.1:${port}/ok`), 'local-ok');
+  await assert.rejects(fetchLoopbackText(`http://127.0.0.1:${port}/escape`), /non-loopback/);
+  await assert.rejects(fetchLoopbackText('http://10.0.0.1/'), /non-loopback/);
+});
+
+test('public image fetch is bounded, media-shaped, and blocks private redirect targets', async () => {
+  const png = Buffer.from('89504e470d0a1a0a', 'hex');
+  const okFetch = async () => new Response(png, {
+    status: 200,
+    headers: { 'content-type': 'image/png', 'content-length': String(png.length) },
+  });
+  const image = await fetchPublicImage('https://images.example.com/a.png', { fetchImpl: okFetch });
+  assert.deepEqual(image, { mimeType: 'image/png', data: png.toString('base64'), bytes: png.length });
+
+  let calls = 0;
+  const redirectFetch = async () => {
+    calls++;
+    return new Response(null, { status: 302, headers: { location: 'http://169.254.169.254/latest/meta-data/' } });
+  };
+  await assert.rejects(
+    fetchPublicImage('https://images.example.com/a.png', { fetchImpl: redirectFetch }),
+    /private address/,
+  );
+  assert.equal(calls, 1);
+});

package/src/runtime/agent/orchestrator/agent-trace-format.mjs

@@ -247,6 +247,7 @@ export function parseGrepCoverage(resultText, toolName, toolArgs, resultKind) {
 function classifyToolFailure(resultText, toolName) {
     const raw = String(resultText ?? '');
     const text = raw.toLowerCase();
+    if (isExpectedToolCancellation(raw)) return 'expected-cancellation';
     // Shell renderers put the machine-readable status on the leading line.
     // Only inspect that marker: command text and stderr frequently contain
     // words such as "timeout" or "aborted" and must not rewrite a real exit
@@ -273,11 +274,22 @@ function classifyToolFailure(resultText, toolName) {
     return 'runtime/failure';
 }
 
+function isExpectedToolCancellation(resultText) {
+    const leading = String(resultText ?? '').split(/\r?\n/)
+        .map((line) => line.trim())
+        .find((line) => line && !line.startsWith('⚠️ '))
+        ?.replace(/^Error:\s*/i, '') || '';
+    return /^Session\s+"[^"]+"\s+closed:\s*(?:aborted|closed)\s+during call\b/i.test(leading);
+}
+
 function traceAgentToolFailure({ sessionId, iteration, toolName, toolKind, toolMs, toolArgs, agent, model, cwd, resultText, resultKind = 'error' }) {
     if (process.env.MIXDOG_AGENT_TRACE_DISABLE === '1') return;
     if (!_resolveToolFailurePath()) return;
     try {
         const cleanText = _redactLogText(String(resultText ?? ''));
+        // A session close is deliberate orchestration, not a tool failure.
+        // traceAgentTool still records the error/category on the normal trace.
+        if (isExpectedToolCancellation(cleanText)) return;
         const row = {
             ts: Date.now(),
             session_id: normalizeSessionId(sessionId),

package/src/runtime/agent/orchestrator/internal-tools.mjs

@@ -69,6 +69,8 @@ function _normalize(result) {
         });
     }
     if (result && typeof result === 'object' && Array.isArray(result.content)) {
+        const hasStructuredMedia = result.content.some((part) => part && typeof part === 'object' && part.type !== 'text');
+        if (hasStructuredMedia && result.isError !== true) return result;
         const text = result.content
             .map((c) => (c?.type === 'text' ? c.text || '' : JSON.stringify(c)))
             .join('\n');