964ab58 fix(web): harden exploration policy · zut

M packages/agent/build.go +4 -2


@@ -1266,8 +1266,10 @@ func buildToolRegistry(args Args, cwd string, sandbox *tools.Sandbox, lspEnabled
1266	1266		if orchestratorExplorationToolsAllowed(args) {
1267	1267		reg["read"] = all["read"]
1268	1268		reg["grep"] = all["grep"]
1269		-	for name, tool := range tools.NewWebTools() {
1270		-	reg[name] = tool
	1269	+	if args.PermissionSet == nil {
	1270	+	for name, tool := range tools.NewWebTools() {
	1271	+	reg[name] = tool
	1272	+	}
1271	1273		}
1272	1274		}
1273	1275		return reg

 	if orchestratorExplorationToolsAllowed(args) {
 		reg["read"] = all["read"]
 		reg["grep"] = all["grep"]
-		for name, tool := range tools.NewWebTools() {
+		if args.PermissionSet == nil {
-			reg[name] = tool
+			for name, tool := range tools.NewWebTools() {
+				reg[name] = tool
+			}
 		}
 	}
 	return reg

M packages/agent/build_orchestrator_test.go +14 -2


@@ -12,30 +12,42 @@ func TestOrchestratorAlwaysReceivesResearchTools(t *testing.T) {
12	12		name string
13	13		args Args
14	14		wantResearch bool
	15	+	wantWeb bool
15	16		wantWriteTool bool
16	17		}{
17	18		{
18	19		name: "requested allowlist",
19	20		args: Args{Orchestrate: true, ToolsSet: true, Tools: []string{"subagent_spawn"}},
20	21		wantResearch: true,
	22	+	wantWeb: true,
21	23		wantWriteTool: false,
22	24		},
23	25		{
24	26		name: "web search policy disabled",
25	27		args: Args{Orchestrate: true, WebSearchPolicy: subagents.WebSearchDeny},
26	28		wantResearch: true,
	29	+	wantWeb: true,
	30	+	wantWriteTool: true,
	31	+	},
	32	+	{
	33	+	name: "permission ceiling",
	34	+	args: Args{Orchestrate: true, PermissionSet: &tools.PermissionSet{}},
	35	+	wantResearch: true,
	36	+	wantWeb: false,
27	37		wantWriteTool: true,
28	38		},
29	39		{
30	40		name: "tools disabled",
31	41		args: Args{Orchestrate: true, NoTools: true, ToolsSet: true, Tools: []string{"write"}},
32	42		wantResearch: false,
	43	+	wantWeb: false,
33	44		wantWriteTool: false,
34	45		},
35	46		{
36	47		name: "normal session",
37	48		args: Args{ToolsSet: true, Tools: []string{"write"}},
38	49		wantResearch: false,
	50	+	wantWeb: false,
39	51		wantWriteTool: true,
40	52		},
41	53		} {

@@ -54,8 +66,8 @@ func TestOrchestratorAlwaysReceivesResearchTools(t *testing.T) {
54	66		}
55	67		for _, name := range tools.WebCapabilityNames {
56	68		_, gotWebTool := registry[name]
57		-	if gotWebTool != tc.wantResearch {
58		-	t.Fatalf("%s present = %v, want research tool present = %v", name, gotWebTool, tc.wantResearch)
	69	+	if gotWebTool != tc.wantWeb {
	70	+	t.Fatalf("%s present = %v, want web tool present = %v", name, gotWebTool, tc.wantWeb)
59	71		}
60	72		}
61	73		_, gotWrite := registry["write"]

 		name          string
 		args          Args
 		wantResearch  bool
+		wantWeb       bool
 		wantWriteTool bool
 	}{
 		{
 			name:          "requested allowlist",
 			args:          Args{Orchestrate: true, ToolsSet: true, Tools: []string{"subagent_spawn"}},
 			wantResearch:  true,
+			wantWeb:       true,
 			wantWriteTool: false,
 		},
 		{
 			name:          "web search policy disabled",
 			args:          Args{Orchestrate: true, WebSearchPolicy: subagents.WebSearchDeny},
 			wantResearch:  true,
+			wantWeb:       true,
+			wantWriteTool: true,
+		},
+		{
+			name:          "permission ceiling",
+			args:          Args{Orchestrate: true, PermissionSet: &tools.PermissionSet{}},
+			wantResearch:  true,
+			wantWeb:       false,
 			wantWriteTool: true,
 		},
 		{
 			name:          "tools disabled",
 			args:          Args{Orchestrate: true, NoTools: true, ToolsSet: true, Tools: []string{"write"}},
 			wantResearch:  false,
+			wantWeb:       false,
 			wantWriteTool: false,
 		},
 		{
 			name:          "normal session",
 			args:          Args{ToolsSet: true, Tools: []string{"write"}},
 			wantResearch:  false,
+			wantWeb:       false,
 			wantWriteTool: true,
 		},
 	} {
 			}
 			for _, name := range tools.WebCapabilityNames {
 				_, gotWebTool := registry[name]
-				if gotWebTool != tc.wantResearch {
+				if gotWebTool != tc.wantWeb {
-					t.Fatalf("%s present = %v, want research tool present = %v", name, gotWebTool, tc.wantResearch)
+					t.Fatalf("%s present = %v, want web tool present = %v", name, gotWebTool, tc.wantWeb)
 				}
 			}
 			_, gotWrite := registry["write"]

M packages/agent/subagent_runtime.go +7 -5


@@ -366,14 +366,14 @@ func (rt *subagentRuntime) buildResidentChildSpec(_ context.Context, request too
366	366		}
367	367
368	368		func expandWebCapabilityTools(selected, catalogue []string, permitted func(string) bool) []string {
369		-	hasSearch := false
	369	+	hasWebTool := false
370	370		for _, name := range selected {
371		-	if name == "web_search" {
372		-	hasSearch = true
	371	+	if tools.IsWebCapabilityName(name) {
	372	+	hasWebTool = true
373	373		break
374	374		}
375	375		}
376		-	if !hasSearch {
	376	+	if !hasWebTool {
377	377		return selected
378	378		}
379	379		available := make(map[string]struct{}, len(catalogue))

@@ -382,7 +382,9 @@ func expandWebCapabilityTools(selected, catalogue []string, permitted func(strin
382	382		available[name] = struct{}{}
383	383		}
384	384		for _, name := range selected {
385		-	selectedSet[name] = struct{}{}
	385	+	if permitted == nil \|\| permitted(name) {
	386	+	selectedSet[name] = struct{}{}
	387	+	}
386	388		}
387	389		for _, name := range tools.WebCapabilityNames {
388	390		if _, ok := available[name]; ok && (permitted == nil \|\| permitted(name)) {

 }
 func expandWebCapabilityTools(selected, catalogue []string, permitted func(string) bool) []string {
-	hasSearch := false
+	hasWebTool := false
 	for _, name := range selected {
-		if name == "web_search" {
+		if tools.IsWebCapabilityName(name) {
-			hasSearch = true
+			hasWebTool = true
 			break
 		}
 	}
-	if !hasSearch {
+	if !hasWebTool {
 		return selected
 	}
 	available := make(map[string]struct{}, len(catalogue))
 		available[name] = struct{}{}
 	}
 	for _, name := range selected {
-		selectedSet[name] = struct{}{}
+		if permitted == nil || permitted(name) {
+			selectedSet[name] = struct{}{}
+		}
 	}
 	for _, name := range tools.WebCapabilityNames {
 		if _, ok := available[name]; ok && (permitted == nil || permitted(name)) {

M packages/agent/subagent_runtime_test.go +25 -0


@@ -25,6 +25,31 @@ func TestExpandWebCapabilityTools(t *testing.T) {
25	25		}
26	26		}
27	27
	28	+	func TestExpandWebCapabilityToolsPreservesPolicyAndNonWebSelections(t *testing.T) {
	29	+	catalogue := append([]string{"read"}, tools.WebCapabilityNames...)
	30	+	partial := expandWebCapabilityTools([]string{"web_open"}, catalogue, func(string) bool { return true })
	31	+	for _, name := range tools.WebCapabilityNames {
	32	+	found := false
	33	+	for _, candidate := range partial {
	34	+	if candidate == name {
	35	+	found = true
	36	+	break
	37	+	}
	38	+	}
	39	+	if !found {
	40	+	t.Fatalf("partial web selection did not expand: %v", partial)
	41	+	}
	42	+	}
	43	+	denied := expandWebCapabilityTools([]string{"read", "web_search"}, catalogue, func(name string) bool { return name == "read" })
	44	+	if len(denied) != 1 \|\| denied[0] != "read" {
	45	+	t.Fatalf("denied web capability = %v, want [read]", denied)
	46	+	}
	47	+	nonWeb := expandWebCapabilityTools([]string{"read"}, catalogue, func(string) bool { return true })
	48	+	if len(nonWeb) != 1 \|\| nonWeb[0] != "read" {
	49	+	t.Fatalf("non-web selection changed to %v", nonWeb)
	50	+	}
	51	+	}
	52	+
28	53		func TestResidentChildSpecSnapshotsCurrentProviderTransportSettings(t *testing.T) {
29	54		runtime := newSubagentRuntime(subagentRuntimeConfig{
30	55		Args: Args{}, Root: t.TempDir(), RepoRoot: t.TempDir(),


@@ -25,6 +25,31 @@ func TestExpandWebCapabilityTools(t *testing.T) {
25	}	25		}
26	}	26		}
27		27
		28	+	func TestExpandWebCapabilityToolsPreservesPolicyAndNonWebSelections(t *testing.T) {
		29	+	catalogue := append([]string{"read"}, tools.WebCapabilityNames...)
		30	+	partial := expandWebCapabilityTools([]string{"web_open"}, catalogue, func(string) bool { return true })
		31	+	for _, name := range tools.WebCapabilityNames {
		32	+	found := false
		33	+	for _, candidate := range partial {
		34	+	if candidate == name {
		35	+	found = true
		36	+	break
		37	+	}
		38	+	}
		39	+	if !found {
		40	+	t.Fatalf("partial web selection did not expand: %v", partial)
		41	+	}
		42	+	}
		43	+	denied := expandWebCapabilityTools([]string{"read", "web_search"}, catalogue, func(name string) bool { return name == "read" })
		44	+	if len(denied) != 1 \|\| denied[0] != "read" {
		45	+	t.Fatalf("denied web capability = %v, want [read]", denied)
		46	+	}
		47	+	nonWeb := expandWebCapabilityTools([]string{"read"}, catalogue, func(string) bool { return true })
		48	+	if len(nonWeb) != 1 \|\| nonWeb[0] != "read" {
		49	+	t.Fatalf("non-web selection changed to %v", nonWeb)
		50	+	}
		51	+	}
		52	+
28	func TestResidentChildSpecSnapshotsCurrentProviderTransportSettings(t *testing.T) {	53		func TestResidentChildSpecSnapshotsCurrentProviderTransportSettings(t *testing.T) {
29	runtime := newSubagentRuntime(subagentRuntimeConfig{	54		runtime := newSubagentRuntime(subagentRuntimeConfig{
30	Args: Args{}, Root: t.TempDir(), RepoRoot: t.TempDir(),	55		Args: Args{}, Root: t.TempDir(), RepoRoot: t.TempDir(),

M packages/agent/tools/web_page.go +3 -3


@@ -153,6 +153,9 @@ func (s BrowsingStore) add(doc webDocument, generation uint64, checkGeneration
153	153		for _, link := range doc.links {
154	154		doc.size += len(link.label) + len(link.url)
155	155		}
	156	+	if doc.size > webPageMaxStoreBytes {
	157	+	return ""
	158	+	}
156	159		for len(s.docs) >= webPageMaxDocuments \|\| (len(s.docs) > 0 && s.used+uint64(doc.size) > webPageMaxStoreBytes) {
157	160		var victim *webDocument
158	161		for _, candidate := range s.docs {

@@ -166,9 +169,6 @@ func (s BrowsingStore) add(doc webDocument, generation uint64, checkGeneration
166	169		delete(s.docs, victim.id)
167	170		s.used -= uint64(victim.size)
168	171		}
169		-	if doc.size > webPageMaxStoreBytes {
170		-	return ""
171		-	}
172	172		s.next++
173	173		doc.id = fmt.Sprintf("web-%d", s.next)
174	174		doc.touched = s.next

 	for _, link := range doc.links {
 		doc.size += len(link.label) + len(link.url)
 	}
+	if doc.size > webPageMaxStoreBytes {
+		return ""
+	}
 	for len(s.docs) >= webPageMaxDocuments || (len(s.docs) > 0 && s.used+uint64(doc.size) > webPageMaxStoreBytes) {
 		var victim *webDocument
 		for _, candidate := range s.docs {
 		delete(s.docs, victim.id)
 		s.used -= uint64(victim.size)
 	}
-	if doc.size > webPageMaxStoreBytes {
-		return ""
-	}
 	s.next++
 	doc.id = fmt.Sprintf("web-%d", s.next)
 	doc.touched = s.next

M packages/agent/tools/web_page_test.go +12 -4


@@ -139,9 +139,9 @@ func TestWebPageFetcherRedirectsWithFreshValidation(t *testing.T) {
139	139		}
140	140
141	141		func TestWebPageFetcherPreservesHTTPSHostnameForSNI(t *testing.T) {
142		-	var serverName string
	142	+	var serverName atomic.Value
143	143		server := httptest.NewUnstartedServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
144		-	serverName = r.TLS.ServerName
	144	+	serverName.Store(r.TLS.ServerName)
145	145		w.Header().Set("Content-Type", "text/plain")
146	146		_, _ = w.Write([]byte("secure"))
147	147		}))

@@ -153,8 +153,9 @@ func TestWebPageFetcherPreservesHTTPSHostnameForSNI(t *testing.T) {
153	153		// InsecureSkipVerify.
154	154		fetcher.tlsConfig = &tls.Config{InsecureSkipVerify: true} //nolint:gosec // test-only local certificate
155	155		body, _, _, message := fetcher.fetch(context.Background(), "https://public.test/")
156		-	if message != "" \|\| string(body) != "secure" \|\| serverName != "public.test" {
157		-	t.Fatalf("HTTPS body=%q message=%q SNI=%q", body, message, serverName)
	156	+	got, _ := serverName.Load().(string)
	157	+	if message != "" \|\| string(body) != "secure" \|\| got != "public.test" {
	158	+	t.Fatalf("HTTPS body=%q message=%q SNI=%q", body, message, got)
158	159		}
159	160		}
160	161

@@ -254,7 +255,14 @@ func TestBrowsingStoreConcurrentAccess(t *testing.T) {
254	255
255	256		func TestWebPageStoreGenerationAndSchemaFailures(t *testing.T) {
256	257		store := NewBrowsingStore()
	258	+	retained := store.addSource("http://public.test/")
257	259		generation := store.snapshotGeneration()
	260	+	if id, committed := store.addPage(&webDocument{url: "http://public.test", lines: []string{strings.Repeat("x", webPageMaxStoreBytes+1)}}, generation); id != "" \|\| committed {
	261	+	t.Fatalf("oversized page commit = %q, %v", id, committed)
	262	+	}
	263	+	if _, ok := store.get(retained, false); !ok {
	264	+	t.Fatal("oversized page evicted an existing document")
	265	+	}
258	266		store.Clear()
259	267		if id, committed := store.addPage(&webDocument{url: "http://public.test", lines: []string{"text"}}, generation); id != "" \|\| committed {
260	268		t.Fatalf("stale page commit = %q, %v", id, committed)

 }
 func TestWebPageFetcherPreservesHTTPSHostnameForSNI(t *testing.T) {
-	var serverName string
+	var serverName atomic.Value
 	server := httptest.NewUnstartedServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		serverName = r.TLS.ServerName
+		serverName.Store(r.TLS.ServerName)
 		w.Header().Set("Content-Type", "text/plain")
 		_, _ = w.Write([]byte("secure"))
 	}))
 	// InsecureSkipVerify.
 	fetcher.tlsConfig = &tls.Config{InsecureSkipVerify: true} //nolint:gosec // test-only local certificate
 	body, _, _, message := fetcher.fetch(context.Background(), "https://public.test/")
-	if message != "" || string(body) != "secure" || serverName != "public.test" {
+	got, _ := serverName.Load().(string)
-		t.Fatalf("HTTPS body=%q message=%q SNI=%q", body, message, serverName)
+	if message != "" || string(body) != "secure" || got != "public.test" {
+		t.Fatalf("HTTPS body=%q message=%q SNI=%q", body, message, got)
 	}
 }
 func TestWebPageStoreGenerationAndSchemaFailures(t *testing.T) {
 	store := NewBrowsingStore()
+	retained := store.addSource("http://public.test/")
 	generation := store.snapshotGeneration()
+	if id, committed := store.addPage(&webDocument{url: "http://public.test", lines: []string{strings.Repeat("x", webPageMaxStoreBytes+1)}}, generation); id != "" || committed {
+		t.Fatalf("oversized page commit = %q, %v", id, committed)
+	}
+	if _, ok := store.get(retained, false); !ok {
+		t.Fatal("oversized page evicted an existing document")
+	}
 	store.Clear()
 	if id, committed := store.addPage(&webDocument{url: "http://public.test", lines: []string{"text"}}, generation); id != "" || committed {
 		t.Fatalf("stale page commit = %q, %v", id, committed)