mixdog 0.9.50 → 0.9.52

package/src/runtime/memory/lib/pg/process.mjs

@@ -55,6 +55,51 @@ function isTcpPortFree(port) {
 
 const PG_PORT_MIN = 55432
 const PG_PORT_MAX = 55632
+const delay = ms => new Promise(resolve => setTimeout(resolve, ms))
+
+function isPidAlive(pid) {
+  if (!Number.isInteger(pid) || pid <= 0) return false
+  try {
+    process.kill(pid, 0)
+    return true
+  } catch (err) {
+    return err?.code === 'EPERM'
+  }
+}
+
+function readPostmasterInfo(pgdataDir) {
+  try {
+    const lines = readFileSync(join(pgdataDir, 'postmaster.pid'), 'utf8').split('\n')
+    const pid = parseInt(lines[0], 10)
+    const port = parseInt(lines[3], 10)
+    return {
+      pid: Number.isInteger(pid) && pid > 0 ? pid : null,
+      port: Number.isInteger(port) && port > 0 ? port : null,
+    }
+  } catch {
+    return { pid: null, port: null }
+  }
+}
+
+function pgIsReady(runtimeDir, env, port) {
+  const probe = spawnSync(pgBin(runtimeDir, 'pg_isready'), ['-h', '127.0.0.1', '-p', String(port)], {
+    env, stdio: 'pipe', timeout: 3_000, windowsHide: true,
+  })
+  return probe.status === 0
+}
+
+async function awaitExistingPostmaster({ runtimeDir, pgdataDir, env, waitMs }) {
+  const deadline = Date.now() + Math.max(0, Number(waitMs) || 0)
+  let info = readPostmasterInfo(pgdataDir)
+  while (info.pid && info.port) {
+    if (pgIsReady(runtimeDir, env, info.port)) return { state: 'ready', ...info }
+    if (!isPidAlive(info.pid)) return { state: 'dead', ...info }
+    if (Date.now() >= deadline) return { state: 'alive-not-ready', ...info }
+    await delay(250)
+    info = readPostmasterInfo(pgdataDir)
+  }
+  return { state: 'missing', ...info }
+}
 
 async function findFreePort(preferred) {
   // I2: clamp out-of-range callers to the valid window.
@@ -135,7 +180,13 @@ export function reconcileConfV2(runtimeDir, pgdataDir) {
 // startPg
 // ---------------------------------------------------------------------------
 
-export async function startPg({ runtimeDir, pgdataDir, port: preferredPort = 55432, logPath }) {
+export async function startPg({
+  runtimeDir,
+  pgdataDir,
+  port: preferredPort = 55432,
+  logPath,
+  existingWaitMs = 15_000,
+}) {
   mkdirSync(pgdataDir, { recursive: true })
 
   if (process.platform === 'darwin') {
@@ -146,41 +197,35 @@ export async function startPg({ runtimeDir, pgdataDir, port: preferredPort = 554
   // the block was just appended (so the attach path can trigger pg_ctl reload).
   // Fresh-init path falls through to confAppend below which already includes v2.
   const v2Applied = ensureConfV2(pgdataDir)
+  const env = libEnv(runtimeDir)
 
   // Pre-check: if postmaster.pid exists and the instance is reachable, attach
   // rather than attempting a second pg_ctl start (which would crash the worker).
   const postmasterPidPath = join(pgdataDir, 'postmaster.pid')
   if (existsSync(postmasterPidPath)) {
-    try {
-      const lines = readFileSync(postmasterPidPath, 'utf8').split('\n')
-      const existingPid  = parseInt(lines[0], 10)
-      // Line 4 (index 3) in postmaster.pid holds the port number.
-      const existingPort = parseInt(lines[3], 10)
-      if (existingPid > 0 && existingPort > 0) {
-        // Liveness must be confirmed by pg_isready (status 0). A bare open TCP
-        // port is insufficient: any unrelated listener that happened to grab
-        // this port would be mistaken for our PG instance, causing a false
-        // attach. pg_isready performs a real PG protocol handshake, so a
-        // non-Postgres listener returns non-zero and we correctly fall through
-        // to normal startup (which reclaims the stale postmaster.pid).
-        const pgIsReady = pgBin(runtimeDir, 'pg_isready')
-        const probe = spawnSync(pgIsReady, ['-h', '127.0.0.1', '-p', String(existingPort)], {
-          env: libEnv(runtimeDir), stdio: 'pipe', timeout: 3_000, windowsHide: true,
-        })
-        const alive = probe.status === 0
-        if (alive) {
-          __mixdogMemoryLog(`[pg-process] attaching to existing PG pid=${existingPid} port=${existingPort}\n`)
-          // Route through the single reconcile entry point so v1 → v2 conf
-          // upgrades land on already-running instances without restart.
-          if (v2Applied) reconcileConfV2(runtimeDir, pgdataDir)
-          return { pid: existingPid, port: existingPort, attached: true }
-        }
-        // Dead instance — fall through to normal startup; pg_ctl will reclaim stale lock.
-      }
-    } catch {}
+    const existing = await awaitExistingPostmaster({
+      runtimeDir, pgdataDir, env, waitMs: existingWaitMs,
+    })
+    if (existing.state === 'ready') {
+      __mixdogMemoryLog(`[pg-process] attaching to existing PG pid=${existing.pid} port=${existing.port}\n`)
+      // Route through the single reconcile entry point so v1 → v2 conf
+      // upgrades land on already-running instances without restart.
+      if (v2Applied) reconcileConfV2(runtimeDir, pgdataDir)
+      return { pid: existing.pid, port: existing.port, attached: true }
+    }
+    if (existing.state === 'alive-not-ready') {
+      // A postmaster in startup/shutdown still owns this pgdata even when it no
+      // longer accepts connections. Starting the same directory on a "free"
+      // alternate port produces the observed endless "another server might be
+      // running" loop and can corrupt lifecycle state. The supervisor may
+      // finish a graceful stop, but this lower layer must never race it.
+      throw new Error(
+        `[pg-process] existing PG pid=${existing.pid} port=${existing.port} is alive but not ready; refusing concurrent start`,
+      )
+    }
+    // Dead instance — fall through to normal startup; pg_ctl reclaims the stale lock.
   }
 
-  const env    = libEnv(runtimeDir)
   const initdb = pgBin(runtimeDir, 'initdb')
   const pgctl  = pgBin(runtimeDir, 'pg_ctl')
 
@@ -248,7 +293,6 @@ export async function startPg({ runtimeDir, pgdataDir, port: preferredPort = 554
 
   __mixdogMemoryLog(`[pg-process] pg_ctl start -D ${pgdataDir} -p ${port}\n`)
 
-  const pgIsReady = pgBin(runtimeDir, 'pg_isready')
   const startArgs = [
     'start',
     '-D', pgdataDir,
@@ -258,8 +302,6 @@ export async function startPg({ runtimeDir, pgdataDir, port: preferredPort = 554
 
   // Poll-sleep is intentionally NOT unref'd: while startPg is awaiting readiness
   // it must keep the process alive even if the event loop would otherwise drain.
-  const sleep = ms => new Promise(res => setTimeout(res, ms))
-
   // Read pid + port from postmaster.pid (line 1 = pid, line 4 = port). Returns
   // null unless the file exists, pid > 0, and its port matches ours.
   function readPostmaster() {
@@ -280,7 +322,7 @@ export async function startPg({ runtimeDir, pgdataDir, port: preferredPort = 554
     for (let i = 0; i < 5; i++) {
       const pm = readPostmaster()
       if (pm) return pm.pid
-      await sleep(100)
+      await delay(100)
     }
     return null
   }
@@ -312,10 +354,7 @@ export async function startPg({ runtimeDir, pgdataDir, port: preferredPort = 554
     const deadline = Date.now() + 30_000
     // eslint-disable-next-line no-constant-condition
     while (true) {
-      const probe = spawnSync(pgIsReady, ['-h', '127.0.0.1', '-p', String(port)], {
-        env, stdio: 'pipe', timeout: 3_000, windowsHide: true,
-      })
-      if (probe.status === 0) {
+      if (pgIsReady(runtimeDir, env, port)) {
         const pid = await confirmPid()
         // pid confirmed with matching port → ready. Otherwise keep polling until
         // the cap (postmaster.pid not yet written or port mismatch).
@@ -324,7 +363,7 @@ export async function startPg({ runtimeDir, pgdataDir, port: preferredPort = 554
       // pg_ctl exited nonzero before PG became reachable — real startup failure.
       if (closed && exitCode !== 0) return { ready: false, exited: true, stdout, stderr }
       if (Date.now() >= deadline) return { ready: false, timeout: true, stdout, stderr }
-      await sleep(250)
+      await delay(250)
     }
   }
 
@@ -332,19 +371,19 @@ export async function startPg({ runtimeDir, pgdataDir, port: preferredPort = 554
   if (r.ready) return { pid: r.pid, port }
 
   const errText = r.stderr || r.stdout || ''
-  // "another server might be running" — try status + immediate stop before failing.
+  // A cross-process race can still land after the pre-check. Re-probe and
+  // attach if that winner becomes ready; never immediate-stop an unknown live
+  // postmaster, because synchronous_commit=off makes a crash-stop lossy.
   if (r.exited && errText.includes('another server might be running')) {
     __mixdogMemoryLog(`[pg-process] pg_ctl start: "another server might be running" — probing status\n`)
     const statusR = spawnSync(pgctl, ['status', '-D', pgdataDir], { env, stdio: 'pipe', timeout: 3_000, windowsHide: true })
     __mixdogMemoryLog(`[pg-process] pg_ctl status: ${statusR.stdout?.toString() || statusR.stderr?.toString() || 'no output'}\n`)
-    const stopR = spawnSync(pgctl, ['stop', '-m', 'immediate', '-D', pgdataDir], { env, stdio: 'pipe', timeout: 3_000, windowsHide: true })
-    if (stopR.status === 0) {
-      // Retry start once after clearing the stale instance.
-      const r2 = await startAndWaitReady()
-      if (r2.ready) return { pid: r2.pid, port }
-      __mixdogMemoryLog(`[pg-process] retry start after stop also failed: ${r2.stderr || ''}\n`)
-    } else {
-      __mixdogMemoryLog(`[pg-process] immediate stop failed: ${stopR.stderr?.toString() || ''} — treating as degraded\n`)
+    const existing = await awaitExistingPostmaster({
+      runtimeDir, pgdataDir, env, waitMs: existingWaitMs,
+    })
+    if (existing.state === 'ready') {
+      __mixdogMemoryLog(`[pg-process] attaching to race winner pid=${existing.pid} port=${existing.port}\n`)
+      return { pid: existing.pid, port: existing.port, attached: true }
     }
   }
 
@@ -419,6 +458,11 @@ export async function healthcheckPg({ port, host = '127.0.0.1' }) {
       host, port, user: 'postgres', database: 'postgres', password: '',
       connectionTimeoutMillis: 2000,
     })
+    // A socket can terminate after SELECT 1 resolves but before client.end()
+    // finishes. Raw pg.Client instances have no pool-level error listener, so
+    // keep this transient health probe from turning that narrow race into an
+    // uncaught EventEmitter error.
+    client.on('error', () => {})
     await client.connect()
     await client.query('SELECT 1')
     return true

package/src/runtime/memory/lib/pg/supervisor.mjs

@@ -399,6 +399,18 @@ async function isPostmasterAlive(pid) {
   return isPostgresPid(pid);
 }
 
+async function waitForPostmasterReady({ pid, port, healthcheckPg, timeoutMs = 30_000 }) {
+  const deadline = Date.now() + Math.max(0, Number(timeoutMs) || 0);
+  while (isPidAlive(pid)) {
+    try {
+      if (await healthcheckPg({ port })) return 'ready';
+    } catch {}
+    if (Date.now() >= deadline) return 'alive-not-ready';
+    await new Promise(resolve => setTimeout(resolve, 250));
+  }
+  return 'dead';
+}
+
 // ── Internal: spawn a fresh PG instance ─────────────────────────────────────
 
 async function _startFresh(dataDir, pgdata, port, runtimeDir) {
@@ -473,7 +485,7 @@ async function tryReusePgInstance({ pgdata, runtimeDir, healthcheckPg, source =
 // ── Internal: full ensure logic (runs exclusively via _ensureInFlight) ────────
 
 async function _doEnsure(dataDir) {
-  const { healthcheckPg, stopPg } = await _getPgProc();
+  const { healthcheckPg } = await _getPgProc();
   const pgdata = join(dataDir, 'pgdata');
 
   // Resolve runtimeDir via runtime-fetcher (cache-hits immediately when already downloaded).
@@ -563,22 +575,47 @@ async function _doEnsure(dataDir) {
       __mixdogMemoryLog(
         `[supervisor-pg] pg_port=${existingPort} recorded but healthcheck failed — recovering\n`,
       );
-      const pmPid = readPostmasterPid(pgdata);
-      if (pmPid && await isPostmasterAlive(pmPid)) {
-        // postmaster alive but unhealthy: attempt graceful stop first
-        __mixdogMemoryLog(`[supervisor-pg] postmaster PID ${pmPid} alive — attempting graceful stopPg\n`);
-        try { await stopPg({ runtimeDir, pgdataDir: pgdata }); } catch (e) {
-          __mixdogMemoryLog(`[supervisor-pg] graceful stopPg failed: ${e?.message} — continuing to fresh start\n`);
-        }
-      } else if (pmPid) {
-        // postmaster dead: remove stale postmaster.pid so initdb/start is not blocked
-        __mixdogMemoryLog(`[supervisor-pg] postmaster PID ${pmPid} dead — removing stale postmaster.pid\n`);
-        try { unlinkSync(join(pgdata, 'postmaster.pid')); } catch {}
-      }
       // Clear stale pg fields before restart
       patchActiveInstance({ pg_port: null, pg_started_at: null, pg_pgdata: null }, { timeoutMs: 1000, background: true });
     }
 
+    // postmaster.pid is the authoritative pgdata owner even when the discovery
+    // advert is absent/stale. The old path checked it only inside the
+    // `existingPort` branch, then allocated 55433 and tried to start the SAME
+    // pgdata while a recovering/rejecting server still owned 55432. Give crash
+    // recovery a bounded chance to finish and attach if it does. Never issue a
+    // stop from an ensure path: an alive postmaster owns the data directory,
+    // and interrupting recovery can turn a transient outage into a restart loop.
+    const pm = readPostmasterInfo(pgdata);
+    if (pm.pid && pm.port && await isPostmasterAlive(pm.pid)) {
+      __mixdogMemoryLog(`[supervisor-pg] postmaster PID ${pm.pid} alive but not ready — awaiting recovery\n`);
+      const state = await waitForPostmasterReady({
+        pid: pm.pid,
+        port: pm.port,
+        healthcheckPg,
+      });
+      if (state === 'ready') {
+        __mixdogMemoryLog(`[supervisor-pg] attaching to recovered PG pid=${pm.pid} port=${pm.port}\n`);
+        _live = { port: pm.port, pgdata, runtimeDir, proc: null };
+        patchActiveInstance({
+          pg_port: pm.port,
+          pg_started_at: ai?.pg_started_at ?? Date.now(),
+          pg_pgdata: pgdata,
+          pg_runtime_dir: runtimeDir,
+        }, { timeoutMs: 1000, background: true });
+        return { host: '127.0.0.1', port: pm.port, runtimeDir, pgdataDir: pgdata };
+      }
+      if (state === 'alive-not-ready') {
+        throw new Error(
+          `[supervisor-pg] existing postmaster PID ${pm.pid} remains alive but unhealthy; refusing concurrent start`,
+        );
+      }
+    }
+    if (pm.pid) {
+      __mixdogMemoryLog(`[supervisor-pg] postmaster PID ${pm.pid} dead — removing stale postmaster.pid\n`);
+      try { unlinkSync(join(pgdata, 'postmaster.pid')); } catch {}
+    }
+
     // ── Allocate a fresh port and spawn ───────────────────────────────────
     const port = await allocatePort();
     return await _startFresh(dataDir, pgdata, port, runtimeDir);

package/src/runtime/search/index.mjs

@@ -32,6 +32,7 @@ import {
   updateProviderState,
 } from './lib/state.mjs'
 import { getScrapeCapabilities, scrapeUrls } from './lib/web-tools.mjs'
+import { fetchLoopbackText, fetchPublicImage } from './lib/http-fetch.mjs'
 import { formatResponse } from './lib/formatter.mjs'
 ensureDataDir()
 
@@ -538,6 +539,46 @@ async function handleToolCall(name, rawArgs, options = {}) {
         return { content: [{ type: 'text', text: `Fetch failed: ${_cleanErr}` }], isError: true }
       }
     }
+    case 'local_fetch':
+    case 'image_fetch': {
+      let urlArgs
+      try {
+        urlArgs = searchUrlArgsSchema.parse(normalizeSearchUrlArgs(rawArgs || {}))
+      } catch (e) {
+        if (e instanceof z.ZodError) {
+          return { content: [{ type: 'text', text: JSON.stringify({ error: 'Invalid arguments', details: e.errors }) }], isError: true }
+        }
+        throw e
+      }
+      const urls = Array.isArray(urlArgs.url) ? urlArgs.url : [urlArgs.url]
+      if (urls.length > 8) return { content: [{ type: 'text', text: 'Error: fetch batch exceeds maximum of 8 URLs.' }], isError: true }
+      const fetchSignal = signal
+        ? AbortSignal.any([signal, AbortSignal.timeout(timeoutMs)])
+        : AbortSignal.timeout(timeoutMs)
+      try {
+        if (name === 'local_fetch') {
+          const parts = []
+          for (const url of urls) {
+            const text = await fetchLoopbackText(url, { signal: fetchSignal })
+            const start = urlArgs.startIndex || 0
+            const max = urlArgs.maxLength == null ? 50_000 : urlArgs.maxLength
+            const body = max === 0 ? text.slice(start) : text.slice(start, start + max)
+            parts.push({ type: 'text', text: `${url}\n\n${body}` })
+          }
+          return { content: parts }
+        }
+        const parts = []
+        for (const url of urls) {
+          const image = await fetchPublicImage(url, { signal: fetchSignal })
+          parts.push({ type: 'text', text: `Downloaded image: ${url} (${image.mimeType}, ${image.bytes} bytes)` })
+          parts.push({ type: 'image', source: { type: 'base64', media_type: image.mimeType, data: image.data } })
+        }
+        return { content: parts }
+      } catch (error) {
+        const message = presentErrorText(normalizeErrorMessage(error instanceof Error ? error.message : String(error)), { surface: name })
+        return { content: [{ type: 'text', text: `Fetch failed: ${message}` }], isError: true }
+      }
+    }
     default:
       throw new Error(`Unknown tool: ${name}`)
   }

package/src/runtime/search/lib/http-fetch.mjs

@@ -1,4 +1,6 @@
 import { readFileSync } from 'fs'
+import dns from 'node:dns'
+import { Agent, fetch as undiciFetch } from 'undici'
 
 import {
   assertPublicUrl,
@@ -128,6 +130,158 @@ export async function readBodyBytesWithCap(response, maxBytes) {
   return Buffer.concat(chunks.map((c) => Buffer.from(c)))
 }
 
+const SAFE_IMAGE_MIMES = new Set(['image/png', 'image/jpeg', 'image/gif', 'image/webp'])
+
+function loopbackHost(hostname) {
+  const host = hostname.toLowerCase().replace(/^\[|\]$/g, '')
+  if (host === 'localhost' || host === '::1') return true
+  const match = host.match(/^(\d{1,3})(?:\.(\d{1,3})){3}$/)
+  return Boolean(match && Number(match[1]) === 127)
+}
+
+function abortRace(promise, signal) {
+  if (!signal) return promise
+  if (signal.aborted) return Promise.reject(signal.reason || new Error('local_fetch aborted'))
+  return new Promise((resolve, reject) => {
+    const onAbort = () => reject(signal.reason || new Error('local_fetch aborted'))
+    signal.addEventListener('abort', onAbort, { once: true })
+    promise.then(
+      (value) => { signal.removeEventListener('abort', onAbort); resolve(value) },
+      (error) => { signal.removeEventListener('abort', onAbort); reject(error) },
+    )
+  })
+}
+
+async function pinnedLoopbackFetch(url, options = {}) {
+  const parsed = assertLoopbackUrl(url)
+  const host = parsed.hostname.toLowerCase().replace(/^\[|\]$/g, '')
+  const addresses = host === 'localhost'
+    ? await abortRace(dns.promises.lookup(host, { all: true }), options.signal)
+    : [{ address: host, family: host.includes(':') ? 6 : 4 }]
+  if (!addresses.length || addresses.some((entry) => !loopbackHost(entry.address))) {
+    throw new Error(`Blocked non-loopback local_fetch resolution: ${host}`)
+  }
+  const pinned = addresses[0]
+  const dispatcher = new Agent({
+    connect: {
+      lookup: (_hostname, opts, cb) => opts?.all
+        ? cb(null, [{ address: pinned.address, family: pinned.family }])
+        : cb(null, pinned.address, pinned.family),
+    },
+  })
+  let response
+  try {
+    response = await undiciFetch(url, { ...options, dispatcher })
+  } catch (error) {
+    dispatcher.destroy().catch(() => {})
+    throw error
+  }
+  if (!response.body) {
+    dispatcher.destroy().catch(() => {})
+    return response
+  }
+  const reader = response.body.getReader()
+  let cleaned = false
+  const cleanup = () => {
+    if (cleaned) return
+    cleaned = true
+    dispatcher.destroy().catch(() => {})
+  }
+  const monitored = new ReadableStream({
+    async pull(controller) {
+      try {
+        const { done, value } = await reader.read()
+        if (done) {
+          controller.close()
+          cleanup()
+        } else {
+          controller.enqueue(value)
+        }
+      } catch (error) {
+        controller.error(error)
+        cleanup()
+      }
+    },
+    cancel(reason) {
+      reader.cancel(reason).catch(() => {})
+      cleanup()
+    },
+  })
+  return new Response(monitored, {
+    status: response.status,
+    statusText: response.statusText,
+    headers: response.headers,
+  })
+}
+
+export function assertLoopbackUrl(url) {
+  const parsed = new URL(url)
+  if (parsed.protocol !== 'http:' && parsed.protocol !== 'https:') {
+    throw new Error(`Blocked non-HTTP protocol: ${parsed.protocol}`)
+  }
+  if (parsed.username || parsed.password) throw new Error('Blocked loopback URL with userinfo credentials')
+  if (!loopbackHost(parsed.hostname)) throw new Error(`Blocked non-loopback local_fetch target: ${parsed.hostname}`)
+  return parsed
+}
+
+async function boundedManualFetch(url, { signal, fetchImpl, validateUrl, sameHost = false } = {}) {
+  const original = validateUrl(url)
+  let currentUrl = original.toString()
+  for (let hops = 0; ; hops++) {
+    const current = validateUrl(currentUrl)
+    if (sameHost && current.hostname.toLowerCase() !== original.hostname.toLowerCase()) {
+      throw new Error(`cross-host redirect blocked (redirected_to: ${currentUrl})`)
+    }
+    const response = await fetchImpl(currentUrl, {
+      signal,
+      headers: buildHeaders(),
+      redirect: 'manual',
+    })
+    if (!REDIRECT_STATUSES.has(response.status)) return response
+    try { await response.body?.cancel() } catch {}
+    if (hops >= MAX_REDIRECTS) throw new Error(`Too many redirects (max ${MAX_REDIRECTS})`)
+    const location = response.headers.get('location')
+    if (!location) throw new Error(`Redirect ${response.status} without Location header`)
+    currentUrl = new URL(location, currentUrl).toString()
+  }
+}
+
+export async function fetchLoopbackText(url, { signal, fetchImpl = pinnedLoopbackFetch } = {}) {
+  const response = await boundedManualFetch(url, {
+    signal,
+    fetchImpl,
+    validateUrl: assertLoopbackUrl,
+  })
+  if (!response.ok) {
+    try { await response.body?.cancel() } catch {}
+    throw new Error(`HTTP ${response.status}`)
+  }
+  return readBodyWithCap(response, MAX_BODY_BYTES)
+}
+
+export async function fetchPublicImage(url, { signal, fetchImpl = pinnedFetch } = {}) {
+  const response = await boundedManualFetch(url, {
+    signal,
+    fetchImpl,
+    validateUrl: (value) => {
+      assertPublicUrl(value)
+      return new URL(value)
+    },
+    sameHost: true,
+  })
+  if (!response.ok) {
+    try { await response.body?.cancel() } catch {}
+    throw new Error(`HTTP ${response.status}`)
+  }
+  const mimeType = (response.headers.get('content-type') || '').split(';')[0].trim().toLowerCase()
+  if (!SAFE_IMAGE_MIMES.has(mimeType)) {
+    try { await response.body?.cancel() } catch {}
+    throw new Error(`Blocked unsupported image content-type: ${mimeType || '(missing)'}`)
+  }
+  const bytes = await readBodyBytesWithCap(response, MAX_BODY_BYTES)
+  return { mimeType, data: bytes.toString('base64'), bytes: bytes.byteLength }
+}
+
 const CDP_FORBIDDEN_RESPONSE_HEADERS = new Set([
   'content-length',
   'transfer-encoding',

package/src/runtime/search/tool-defs.mjs

@@ -2,6 +2,8 @@ import {
   TOOL_SYNC_EXECUTION_CONTRACT,
 } from '../shared/tool-execution-contract.mjs';
 
+const TOOL_DEFS_PLACEHOLDER = Symbol('web-fetch-schema')
+
 export const TOOL_DEFS = [
   {
     name: 'search',
@@ -54,4 +56,25 @@ export const TOOL_DEFS = [
     },
     annotations: { title: 'Mixdog Web Fetch', readOnlyHint: true, destructiveHint: false, idempotentHint: true, openWorldHint: true },
   },
+  {
+    name: 'local_fetch',
+    title: 'Mixdog Loopback Fetch',
+    public: false,
+    description: 'Runtime-only loopback HTTP(S) fetch target.',
+    inputSchema: TOOL_DEFS_PLACEHOLDER,
+    annotations: { title: 'Mixdog Loopback Fetch', readOnlyHint: true, destructiveHint: false, idempotentHint: true, openWorldHint: false },
+  },
+  {
+    name: 'image_fetch',
+    title: 'Mixdog Image Fetch',
+    public: false,
+    description: 'Runtime-only bounded public image fetch target.',
+    inputSchema: TOOL_DEFS_PLACEHOLDER,
+    annotations: { title: 'Mixdog Image Fetch', readOnlyHint: true, destructiveHint: false, idempotentHint: true, openWorldHint: true },
+  },
 ]
+
+const webFetchSchema = TOOL_DEFS.find((tool) => tool.name === 'web_fetch').inputSchema
+for (const tool of TOOL_DEFS) {
+  if (tool.inputSchema === TOOL_DEFS_PLACEHOLDER) tool.inputSchema = webFetchSchema
+}