mixdog 0.9.49 → 0.9.51

package/src/runtime/agent/orchestrator/providers/openai-oauth-ws.mjs

@@ -656,6 +656,7 @@ export async function sendViaWebSocket({
     _sendFrameFn = _sendFrame,
     _sleepFn = _defaultSleep,
     _sendSpanTraceFn = appendAgentTrace,
+    _agentTraceFn = appendAgentTrace,
 }) {
     // Bounded mid-stream retry: if an attempt's stream dies after
     // response.created but before response.completed from a transient cause
@@ -885,6 +886,7 @@ export async function sendViaWebSocket({
         let deltaReason = null;
         let strippedResponseItems = 0;
         let skippedResponseItems = 0;
+        let responseOutputMismatch = null;
         let wireFrameHadTurnState = false;
         let wireFrameMetadataTrace = _metadataTrace(null);
         let framePrefixHash = null;
@@ -976,7 +978,7 @@ export async function sendViaWebSocket({
                         output_tokens: warmupResult.usage?.outputTokens || 0,
                         prompt_tokens: warmupResult.usage?.promptTokens || 0,
                     };
-                    appendAgentTrace({
+                    _agentTraceFn({
                         sessionId: poolKey,
                         iteration,
                         kind: 'cache_warmup',
@@ -1020,6 +1022,7 @@ export async function sendViaWebSocket({
             deltaReason = delta.reason || null;
             strippedResponseItems = delta.strippedResponseItems || 0;
             skippedResponseItems = delta.skippedResponseItems || 0;
+            responseOutputMismatch = delta.responseOutputMismatch || null;
             const wireFrame = _withCodexWsClientMetadata(frame, entry, useCodexWsClientMetadata, codexMetadataContext);
             wireFrameHadTurnState = !!wireFrame?.client_metadata?.['x-codex-turn-state'];
             wireFrameMetadataTrace = _metadataTrace(wireFrame?.client_metadata);
@@ -1292,7 +1295,7 @@ export async function sendViaWebSocket({
             : null;
         if (cacheObservation.actualMiss) {
             try {
-                appendAgentTrace({
+                _agentTraceFn({
                     sessionId: poolKey,
                     iteration,
                     kind: 'cache_miss',
@@ -1389,6 +1392,7 @@ export async function sendViaWebSocket({
                 chain_delta_reason: mode === 'delta' ? null : deltaReason,
                 chain_stripped_response_items: strippedResponseItems,
                 chain_skipped_response_items: skippedResponseItems,
+                ...(responseOutputMismatch || {}),
                 chain_response_items: Array.isArray(result.responseItems) ? result.responseItems.length : 0,
                 body_input_items: Array.isArray(requestBody.input) ? requestBody.input.length : null,
                 frame_input_items: Array.isArray(frame.input) ? frame.input.length : null,
@@ -1400,7 +1404,7 @@ export async function sendViaWebSocket({
                 keep_socket: keepSocket,
                 keep_response_chain: keepResponseChain,
             };
-            appendAgentTrace({
+            _agentTraceFn({
                 sessionId: poolKey,
                 iteration,
                 kind: 'transport',
@@ -1411,7 +1415,10 @@ export async function sendViaWebSocket({
                 && deltaReason
                 && !['no_anchor', 'full_forced', 'full_default', 'delta_missing_turn_state'].includes(deltaReason);
             if (chainFallback || (mode === 'delta' && deltaReason)) {
-                appendAgentTrace({
+                const intentionalTransition = typeof sendOpts?.cacheBreakIntent === 'string'
+                    ? sendOpts.cacheBreakIntent
+                    : null;
+                _agentTraceFn({
                     sessionId: poolKey,
                     iteration,
                     kind: 'cache_break',
@@ -1423,6 +1430,8 @@ export async function sendViaWebSocket({
                         transport: 'websocket',
                         ws_mode: mode,
                         reason: mode === 'delta' ? deltaReason : (deltaReason || 'full_frame'),
+                        intentional_transition: intentionalTransition,
+                        request_tool_choice: requestBody.tool_choice ?? null,
                         cache_key_hash: transportCacheKeyHash,
                         cached_tokens: cacheObservation.cachedTokens,
                         prompt_tokens: cacheObservation.promptTokens,
@@ -1432,6 +1441,7 @@ export async function sendViaWebSocket({
                         request_has_previous_response_id: transportPayload.request_has_previous_response_id,
                         chain_stripped_response_items: strippedResponseItems,
                         chain_skipped_response_items: skippedResponseItems,
+                        ...(responseOutputMismatch || {}),
                         chain_response_items: Array.isArray(result.responseItems) ? result.responseItems.length : 0,
                         body_input_items: Array.isArray(requestBody.input) ? requestBody.input.length : null,
                         frame_input_items: Array.isArray(frame.input) ? frame.input.length : null,

package/src/runtime/agent/orchestrator/providers/openai-ws-delta.mjs

@@ -15,6 +15,7 @@ import {
     RESPONSES_TRANSPORT_CAPABILITIES,
     FULL_RESPONSES_TRANSPORT_CAPS,
 } from './openai-transport-policy.mjs';
+import { createHash } from 'node:crypto';
 
 // If the cached request (sans input) matches the current one and the current
 // input starts with the cached input, return only the tail. Otherwise return
@@ -157,6 +158,67 @@ function _isReplayLikeHead(item, responseItem) {
     return inputType === responseType;
 }
 
+// The hash input follows the same per-item normalizations used by
+// _logicalResponseItemMatch, but is never emitted itself. This retains a
+// stable comparison fingerprint after history compaction without putting
+// message content, tool arguments, or custom-tool input into traces.
+function _normalizedResponseItemDiagnosticShape(item) {
+    if (!item || typeof item !== 'object') return item || null;
+    const type = item.type || (item.role === 'assistant' ? 'message' : '');
+    if (type === 'function_call' || type === 'tool_search_call') {
+        return {
+            type,
+            call_id: String(item.call_id || ''),
+            name: type === 'function_call' ? String(item.name || '') : undefined,
+            arguments: _normalizeArguments(item.arguments),
+        };
+    }
+    if (type === 'custom_tool_call') {
+        return {
+            type,
+            call_id: String(item.call_id || ''),
+            name: String(item.name || ''),
+            input: String(item.input || ''),
+        };
+    }
+    if (type === 'message') {
+        return {
+            type,
+            role: item.role || 'assistant',
+            content: Array.isArray(item.content) ? item.content.map(_normalizeContentPart) : [],
+        };
+    }
+    if (type === 'reasoning') {
+        return {
+            type,
+            id: item.id || null,
+            encrypted_content: item.encrypted_content || null,
+        };
+    }
+    if (type === 'web_search_call') {
+        return { type, id: item.id || null, action: item.action || null };
+    }
+    const { id: _id, status: _status, ...rest } = item;
+    return { type, ...rest };
+}
+
+function _normalizedResponseItemDiagnosticHash(item) {
+    return createHash('sha256')
+        .update(_stableStringify(_normalizedResponseItemDiagnosticShape(item)))
+        .digest('hex');
+}
+
+function _responseOutputMismatchDiagnostics(inputItem, responseItem, replayItemCount, responseItemCount) {
+    return {
+        response_output_mismatch_expected_type: responseItem?.type || 'unknown',
+        response_output_mismatch_expected_hash: _normalizedResponseItemDiagnosticHash(responseItem),
+        response_output_mismatch_expected_response_item_count: responseItemCount,
+        response_output_mismatch_actual_type: inputItem?.type || (inputItem?.role === 'assistant' ? 'message' : 'unknown'),
+        response_output_mismatch_actual_hash: _normalizedResponseItemDiagnosticHash(inputItem),
+        response_output_mismatch_actual_replayed_input_item_count: replayItemCount,
+    };
+}
+
 export function _stripResponseItemsFromHead(items, responseItems) {
     const tail = Array.isArray(items) ? items : [];
     const outputs = Array.isArray(responseItems) ? responseItems : [];
@@ -177,6 +239,12 @@ export function _stripResponseItemsFromHead(items, responseItems) {
                 tail,
                 stripped,
                 skipped,
+                responseOutputMismatch: _responseOutputMismatchDiagnostics(
+                    tail[cursor],
+                    output,
+                    tail.length,
+                    outputs.length,
+                ),
             };
         }
         skipped += 1;
@@ -291,7 +359,12 @@ export function _computeDelta({ entry, body, traceProvider }) {
     }
     const stripped = _stripResponseItemsFromHead(afterPreviousInput, entry.lastResponseItems);
     if (!stripped.ok) {
-        return { mode: 'full', reason: stripped.reason, frame: buildFrame(body) };
+        return {
+            mode: 'full',
+            reason: stripped.reason,
+            responseOutputMismatch: stripped.responseOutputMismatch,
+            frame: buildFrame(body),
+        };
     }
     return {
         mode: 'delta',

package/src/runtime/agent/orchestrator/providers/openai-ws-pool.mjs

@@ -67,6 +67,44 @@ const MAX_POOLED_SOCKETS_PER_KEY = 8;
 //          lastRequestInput, lastResponseItems, lastInputLen, turnState,
 //          closing, ephemeral }
 const _wsPool = new Map();
+let _releaseSequence = 0;
+
+function _poolCompatibility(auth, cacheKey) {
+    const type = String(auth?.type || 'openai-oauth');
+    // Prefer the stable OAuth account id so an access-token refresh can keep
+    // using the same connection. If it is unavailable, fail closed to the
+    // credential itself; a refresh then opens a new socket rather than risking
+    // cross-account continuation.
+    const credentialIdentity = auth?.account_id || auth?.apiKey || auth?.access_token || '';
+    return {
+        authIdentity: createHash('sha256')
+            .update(`${type}\0${String(credentialIdentity)}`)
+            .digest('hex'),
+        cacheKeyIdentity: String(cacheKey || ''),
+    };
+}
+
+function _entryCompatible(entry, compatibility) {
+    return entry?.authIdentity === compatibility.authIdentity
+        && entry?.cacheKeyIdentity === compatibility.cacheKeyIdentity;
+}
+
+// A previous_response_id is valid on the connection that produced it. When
+// concurrency temporarily creates sibling sockets for one pool key, continue
+// on the most recently completed sibling instead of whichever socket happened
+// to be inserted first. This is the closest representation of Codex's
+// turn-local single-connection ownership without weakening the existing
+// full-frame fallback checks.
+function _selectIdleEntry(entries, compatibility) {
+    let selected;
+    for (const entry of entries || []) {
+        if (entry?.busy || !_entryCompatible(entry, compatibility)) continue;
+        if (!selected || (entry.releaseSequence || 0) > (selected.releaseSequence || 0)) {
+            selected = entry;
+        }
+    }
+    return selected;
+}
 
 // --- Cache-route probe state (2026-07-04 hunt) -----------------------------
 // CF cookie stickiness (codex chatgpt_cloudflare_cookies.rs:22-55 persists
@@ -707,9 +745,16 @@ export async function acquireWebSocket({ auth, poolKey, cacheKey, codexHeaders,
     }
     if (poolKey && !forceFresh) {
         const arr = _wsPool.get(poolKey) || [];
-        // Prune dead entries first.
+        const compatibility = _poolCompatibility(auth, cacheKey);
+        // Prune dead entries and idle sockets from an obsolete auth/cache
+        // boundary. Busy incompatible entries are left alone until their owner
+        // releases them, but can never be selected by this acquire.
         for (let i = arr.length - 1; i >= 0; i--) {
-            if (!_isOpen(arr[i]) || arr[i].closing) {
+            const incompatibleIdle = !arr[i].busy && !_entryCompatible(arr[i], compatibility);
+            if (!_isOpen(arr[i]) || arr[i].closing || incompatibleIdle) {
+                if (incompatibleIdle) {
+                    try { arr[i].socket.close(1000, 'pool_boundary_changed'); } catch {}
+                }
                 _clearIdle(arr[i]);
                 _clearLiveness(arr[i]);
                 arr.splice(i, 1);
@@ -721,7 +766,7 @@ export async function acquireWebSocket({ auth, poolKey, cacheKey, codexHeaders,
         // bound before hand-out; a dead one is evicted and the scan retries the
         // next idle entry so a busy caller is never handed a wedged socket.
         let idle;
-        while ((idle = arr.find(e => !e.busy))) {
+        while ((idle = _selectIdleEntry(arr, compatibility))) {
             _clearIdle(idle);
             _clearLiveness(idle);
             // Reserve the entry BEFORE awaiting the probe: _pingProbe yields the
@@ -778,6 +823,8 @@ export async function acquireWebSocket({ auth, poolKey, cacheKey, codexHeaders,
                 lastResponseItems: null,
                 lastInputLen: 0,
                 lastInputPrefixHash: null,
+                releaseSequence: 0,
+                ...compatibility,
                 turnState: turnState || null,
                 closing: false,
                 ephemeral: true,
@@ -797,6 +844,7 @@ export async function acquireWebSocket({ auth, poolKey, cacheKey, codexHeaders,
     // returns "No tool output found for function call …". turnState only
     // propagates within a single entry across its own iterations.
     const sessionToken = _mintSessionToken(cacheKey, auth);
+    const compatibility = _poolCompatibility(auth, cacheKey);
     if (process.env.MIXDOG_DEBUG_AGENT) {
         process.stderr.write(`[agent-trace] acquire-new tokenHash=${createHash('sha256').update(String(sessionToken)).digest('hex').slice(0, 8)} elapsed=${Date.now() - _acqStart}ms\n`);
     }
@@ -811,6 +859,8 @@ export async function acquireWebSocket({ auth, poolKey, cacheKey, codexHeaders,
         lastResponseItems: null,
         lastInputLen: 0,
         lastInputPrefixHash: null,
+        releaseSequence: 0,
+        ...compatibility,
         turnState: turnState || null,
         closing: false,
         ephemeral: false,
@@ -840,6 +890,7 @@ export function releaseWebSocket({ entry, poolKey, keep }) {
     // Mark activity at release, then arm both the idle-close timer and the
     // periodic liveness ping so a socket that dies while pooled is evicted
     // before the next acquire can hand it out.
+    entry.releaseSequence = ++_releaseSequence;
     entry.lastAliveAt = Date.now();
     _scheduleIdleClose(poolKey, entry);
     if (WS_PING_ENABLED) _armLiveness(poolKey, entry);
@@ -848,6 +899,27 @@ export function releaseWebSocket({ entry, poolKey, keep }) {
     _setTransportReferenced(entry, false);
 }
 
+// Focused pool lifecycle test seam. Entries still pass through the production
+// release/acquire code; this only avoids a live provider handshake.
+export function _seedWebSocketEntryForTest({ poolKey, auth, cacheKey, entry }) {
+    Object.assign(entry, _poolCompatibility(auth, cacheKey));
+    if (entry.releaseSequence === undefined) entry.releaseSequence = 0;
+    _getPoolArr(poolKey).push(entry);
+    return entry;
+}
+
+export function _clearWebSocketPoolForTest() {
+    for (const arr of _wsPool.values()) {
+        for (const entry of arr) {
+            _clearIdle(entry);
+            _clearLiveness(entry);
+            try { entry.socket.close(1000, 'test_cleanup'); } catch {}
+        }
+    }
+    _wsPool.clear();
+    _releaseSequence = 0;
+}
+
 // Drain-complete fence — set true once _closeAllPooledSockets runs so any
 // in-flight acquire that resumes after drain throws instead of pushing a
 // fresh socket into the cleared pool. Single-set, process-lifetime invariant.

package/src/runtime/agent/orchestrator/session/agent-loop.mjs

@@ -429,6 +429,9 @@ export async function agentLoop(provider, messages, model, tools, onToolCall, cw
             // holds the prefix byte-stable; 'none' makes the model emit text
             // only. Overrides the forced-first-tool path below.
             opts.toolChoice = 'none';
+            if (sessionAgent === 'explorer') {
+                opts.cacheBreakIntent = 'explorer_hard_cap_final_tool_choice_none';
+            }
         } else if (forcedFirstTool && toolCallsTotal === 0) {
             opts.toolChoice = 'required';
         } else {
@@ -464,7 +467,15 @@ export async function agentLoop(provider, messages, model, tools, onToolCall, cw
         opts.onToolCall = _capFinalToolsDisabled ? undefined : eager.onToolCall;
         // Reattach separated tool results, then drop only truly dangling
         // assistant/orphan pairs before the provider sees the transcript.
+        const messagesBeforeTranscriptRepair = messages.slice();
         repairTranscriptBeforeProviderSend(messages, sessionId);
+        if (!opts.cacheBreakIntent
+            && (messages.length !== messagesBeforeTranscriptRepair.length
+                || messages.some((message, index) => message !== messagesBeforeTranscriptRepair[index]))) {
+            // Pairing repair deliberately rebuilds the provider transcript;
+            // record that intent without broadening the mismatch hash scope.
+            opts.cacheBreakIntent = 'transcript_rebuild';
+        }
         // Strip soft-warn markers from prior tool results before the next
         // send. Marker bytes (Tool-budget(xN), Same-file reads(xN), etc.)
         // mutate every turn with dynamic counters, so leaving them in the
@@ -484,12 +495,14 @@ export async function agentLoop(provider, messages, model, tools, onToolCall, cw
             sessionId, sessionRef, nextIteration, contextOverflowRetryUsed,
         });
         if (_sendResult.action === 'retry') {
+            delete opts.cacheBreakIntent;
             contextOverflowRetryUsed = true;
             reactiveOverflowRetryPending = true;
             continue;
         }
         response = _sendResult.response;
         opts.onToolCall = undefined;
+        delete opts.cacheBreakIntent;
         contextOverflowRetryUsed = false;
         // Capture opaque state for the next turn (may be undefined — that's
         // the stateless contract for providers that don't use continuation).

package/src/runtime/agent/orchestrator/session/loop/pre-dispatch-deny.mjs

@@ -26,6 +26,44 @@ const WORKER_DENIED_TOOLS = new Set([
     'inject_input',
 ]);
 
+const IMAGE_PATH_RE = /\.(?:png|jpe?g|gif|webp)(?:$|[?#])/i;
+
+function callUrls(call) {
+    const value = call?.arguments?.url;
+    if (typeof value === 'string' && value.trim()) return [value.trim()];
+    if (Array.isArray(value) && value.length && value.every((item) => typeof item === 'string' && item.trim())) {
+        return value.map((item) => item.trim());
+    }
+    return [];
+}
+
+export function isLoopbackHttpUrl(value) {
+    try {
+        const url = new URL(value);
+        if (url.protocol !== 'http:' && url.protocol !== 'https:') return false;
+        const host = url.hostname.toLowerCase();
+        if (host === 'localhost' || host === '[::1]' || host === '::1') return true;
+        const match = host.match(/^(\d{1,3})(?:\.(\d{1,3})){3}$/);
+        return Boolean(match && Number(match[1]) === 127);
+    } catch {
+        return false;
+    }
+}
+
+/**
+ * Rewrite only calls whose complete URL set has one unambiguous transport.
+ * Mixed document/image or public/loopback batches stay on web_fetch, whose
+ * existing SSRF checks fail closed rather than broadening local_fetch.
+ */
+export function routeWebFetchCall(call) {
+    if (call?.name !== 'web_fetch') return call;
+    const urls = callUrls(call);
+    if (!urls.length) return call;
+    if (urls.every(isLoopbackHttpUrl)) call.name = 'local_fetch';
+    else if (urls.every((value) => IMAGE_PATH_RE.test(value))) call.name = 'image_fetch';
+    return call;
+}
+
 function _preDispatchDeny(call, toolKind, sessionRef) {
     const name = call?.name;
     if (typeof name !== 'string' || !name) return null;

package/src/runtime/agent/orchestrator/session/loop/tool-exec.mjs

@@ -22,6 +22,7 @@ import {
     resolvePreToolAskApproval,
 } from './tool-helpers.mjs';
 import { isOnDeferredToolSurface, prepareDeferredToolCallThrough } from './deferred-call-through.mjs';
+import { preDispatchDenyForSession, routeWebFetchCall } from './pre-dispatch-deny.mjs';
 
 let codeGraphRuntimePromise = null;
 async function executeCodeGraphToolLazy(name, args, cwd, signal = null, options = {}) {
@@ -121,10 +122,24 @@ export async function executeTool(name, args, cwd, callerSessionId, sessionRef,
             if ((action === 'modify' || action === 'rewrite') && decision?.args && typeof decision.args === 'object' && !Array.isArray(decision.args)) {
                 args = decision.args;
             }
+            if ((action === 'modify' || action === 'rewrite') && typeof decision?.name === 'string' && decision.name.trim()) {
+                name = decision.name.trim();
+            }
         } catch {
             // Hooks are policy extensions. A broken hook must not wedge the agent loop.
         }
     }
+    // A hook may replace the tool name, so pass the final call through the
+    // same eager/serial boundary again. This prevents a rename from bypassing
+    // role scoping and also applies built-in web_fetch transport routing.
+    {
+        const finalCall = { name, arguments: args };
+        routeWebFetchCall(finalCall);
+        const denial = preDispatchDenyForSession(sessionRef, finalCall);
+        if (denial !== null) return denial;
+        name = finalCall.name;
+        args = finalCall.arguments;
+    }
     const afterToolHook = typeof executeOpts.afterToolHook === 'function'
         ? executeOpts.afterToolHook
         : sessionRef?.afterToolHook;

package/src/runtime/agent/orchestrator/session/manager/tool-resolution.mjs

@@ -20,7 +20,11 @@ import { getHiddenAgent, listHiddenAgentNames } from '../../internal-agents.mjs'
 // the sort overhead on ~30 tools is negligible.
 function _getMcpTools() {
     const mcp = getMcpTools() || [];
-    const internalRaw = getInternalTools() || [];
+    // `public:false` tools stay registered in internal-tools for runtime
+    // rewrites/dispatch, but must never enter any model-visible schema (Lead
+    // full/mcp included). Filter before mapping because the projection below
+    // intentionally drops module-private metadata such as `public`.
+    const internalRaw = (getInternalTools() || []).filter(t => t?.public !== false);
     const internal = internalRaw.map(t => ({
         name: t.name,
         description: typeof t.description === 'string' ? t.description : '',

package/src/runtime/agent/orchestrator/session/pre-send-compact.mjs

@@ -395,6 +395,10 @@ export async function runPreSendCompactPass(state) {
                 if (compactChanged) {
                     messages.length = 0;
                     messages.push(...compacted);
+                    // The next provider send intentionally starts a new
+                    // transcript shape. Keep this one-shot observability tag
+                    // separate from an unexplained prefix mismatch.
+                    opts.cacheBreakIntent = 'automatic_compaction';
                     // Compacting/pruning the transcript invalidates the
                     // server-side conversation anchor (xAI Responses / openai-oauth
                     // WS rely on previous_response_id which points at a

package/src/runtime/memory/lib/embedding-provider.mjs

@@ -104,14 +104,15 @@ function ensureWorker() {
     _restartCount++
   })
   worker.on('exit', (code) => {
+    const exitError = new Error(`Worker exited with code ${code}`)
     if (code !== 0) {
       __mixdogMemoryLog(`[embed] worker exited with code ${code}\n`)
-      for (const [, p] of _pending) p.reject(new Error(`Worker exited with code ${code}`))
-      _pending.clear()
       _restartCount++
     } else {
       _restartCount = 0
     }
+    for (const [, p] of _pending) p.reject(exitError)
+    _pending.clear()
     worker = null
     _modelReady = false
   })

package/src/runtime/search/index.mjs

@@ -32,6 +32,7 @@ import {
   updateProviderState,
 } from './lib/state.mjs'
 import { getScrapeCapabilities, scrapeUrls } from './lib/web-tools.mjs'
+import { fetchLoopbackText, fetchPublicImage } from './lib/http-fetch.mjs'
 import { formatResponse } from './lib/formatter.mjs'
 ensureDataDir()
 
@@ -538,6 +539,46 @@ async function handleToolCall(name, rawArgs, options = {}) {
         return { content: [{ type: 'text', text: `Fetch failed: ${_cleanErr}` }], isError: true }
       }
     }
+    case 'local_fetch':
+    case 'image_fetch': {
+      let urlArgs
+      try {
+        urlArgs = searchUrlArgsSchema.parse(normalizeSearchUrlArgs(rawArgs || {}))
+      } catch (e) {
+        if (e instanceof z.ZodError) {
+          return { content: [{ type: 'text', text: JSON.stringify({ error: 'Invalid arguments', details: e.errors }) }], isError: true }
+        }
+        throw e
+      }
+      const urls = Array.isArray(urlArgs.url) ? urlArgs.url : [urlArgs.url]
+      if (urls.length > 8) return { content: [{ type: 'text', text: 'Error: fetch batch exceeds maximum of 8 URLs.' }], isError: true }
+      const fetchSignal = signal
+        ? AbortSignal.any([signal, AbortSignal.timeout(timeoutMs)])
+        : AbortSignal.timeout(timeoutMs)
+      try {
+        if (name === 'local_fetch') {
+          const parts = []
+          for (const url of urls) {
+            const text = await fetchLoopbackText(url, { signal: fetchSignal })
+            const start = urlArgs.startIndex || 0
+            const max = urlArgs.maxLength == null ? 50_000 : urlArgs.maxLength
+            const body = max === 0 ? text.slice(start) : text.slice(start, start + max)
+            parts.push({ type: 'text', text: `${url}\n\n${body}` })
+          }
+          return { content: parts }
+        }
+        const parts = []
+        for (const url of urls) {
+          const image = await fetchPublicImage(url, { signal: fetchSignal })
+          parts.push({ type: 'text', text: `Downloaded image: ${url} (${image.mimeType}, ${image.bytes} bytes)` })
+          parts.push({ type: 'image', source: { type: 'base64', media_type: image.mimeType, data: image.data } })
+        }
+        return { content: parts }
+      } catch (error) {
+        const message = presentErrorText(normalizeErrorMessage(error instanceof Error ? error.message : String(error)), { surface: name })
+        return { content: [{ type: 'text', text: `Fetch failed: ${message}` }], isError: true }
+      }
+    }
     default:
       throw new Error(`Unknown tool: ${name}`)
   }