fix(tools): enforce external request origin

Author: icecrasher321

apps/sim/tools/http/request.ts

@@ -97,6 +97,7 @@ export const requestTool: ToolConfig<RequestParams, RequestResponse> = {
   },
 
   request: {
+    allowSameOrigin: true,
     url: (params: RequestParams) => {
       return processUrl(params.url, params.pathParams, params.params)
     },

apps/sim/tools/http/webhook_request.ts

@@ -42,6 +42,7 @@ export const webhookRequestTool: ToolConfig<WebhookRequestParams, RequestRespons
   },
 
   request: {
+    allowSameOrigin: true,
     url: (params: WebhookRequestParams) => params.url,
 
     method: () => 'POST',

apps/sim/tools/index.test.ts

@@ -193,6 +193,7 @@ const mockRegistryTools: Record<string, any> = {
       retryNonIdempotent: { type: 'boolean' },
     },
     request: {
+      allowSameOrigin: true,
       url: (p: any) => p.url || '/api/test',
       method: (p: any) => p.method || 'GET',
       headers: (p: any) => p.headers || { 'Content-Type': 'application/json' },
@@ -2662,6 +2663,48 @@ describe('Internal Route Trust', () => {
     expect(global.fetch).not.toHaveBeenCalled()
   })
 
+  it('allows the generic HTTP tool to target this Sim instance', async () => {
+    const result = await executeTool('http_request', {
+      url: 'http://localhost:3000/api/v1/workflows/test',
+      method: 'GET',
+    })
+
+    expect(result.success).toBe(true)
+    expect(mockValidateUrlWithDNS).toHaveBeenCalledWith(
+      'http://localhost:3000/api/v1/workflows/test',
+      'toolUrl'
+    )
+  })
+
+  it('rejects an integration request that resolves back to this Sim instance', async () => {
+    const mockTool = {
+      id: 'test_same_origin_integration',
+      name: 'Same Origin Integration',
+      description: 'Regression fixture',
+      version: '1.0.0',
+      params: {},
+      request: {
+        url: () => 'http://localhost:3000/api/tools/test',
+        method: 'GET' as const,
+        headers: () => ({}),
+      },
+    }
+    ;(tools as Record<string, unknown>).test_same_origin_integration = mockTool
+
+    try {
+      const result = await executeTool('test_same_origin_integration', {})
+
+      expect(result.success).toBe(false)
+      expect(result.error).toContain(
+        'External integration tools cannot target this Sim instance; use an internal operation'
+      )
+      expect(mockValidateUrlWithDNS).not.toHaveBeenCalled()
+      expect(mockSecureFetchWithPinnedIP).not.toHaveBeenCalled()
+    } finally {
+      Reflect.deleteProperty(tools, 'test_same_origin_integration')
+    }
+  })
+
   it('transports only active provenance selected for an internal model input', async () => {
     const registry = new ResolvedSecretTraceRegistry([
       {

apps/sim/tools/index.ts

@@ -985,6 +985,8 @@ const BODY_SIZE_LIMIT_ERROR_MESSAGE =
 
 const RESPONSE_SIZE_LIMIT_ERROR_MESSAGE =
   'Tool response size limit exceeded (10MB). The response is too large to keep in workflow data. Reduce the response size or return a file reference instead.'
+const SAME_ORIGIN_EXTERNAL_TOOL_ERROR_MESSAGE =
+  'External integration tools cannot target this Sim instance; use an internal operation'
 
 /**
  * Validates request body size and throws a user-friendly error if exceeded
@@ -2627,8 +2629,13 @@ async function executeToolRequest(
     const requestParams = prepareToolRequest(tool, params, resolvedSecretTraceRegistry)
     const { headers } = requestParams
     const fullUrl = new URL(requestParams.url).toString()
+    const targetsThisSimInstance = isSelfOriginUrl(fullUrl)
 
-    if (isSelfOriginUrl(fullUrl)) {
+    if (targetsThisSimInstance && tool.request.allowSameOrigin !== true) {
+      throw new Error(SAME_ORIGIN_EXTERNAL_TOOL_ERROR_MESSAGE)
+    }
+
+    if (targetsThisSimInstance) {
       const callChain = params._context?.callChain as string[] | undefined
       if (callChain && callChain.length > 0) {
         headers.set(SIM_VIA_HEADER, serializeCallChain(callChain))

apps/sim/tools/types.ts

@@ -184,6 +184,11 @@ export interface ToolConfig<P = any, R = any> {
     method: HttpMethod | ((params: P) => HttpMethod)
     headers: (params: P) => Record<string, string>
     body?: (params: P) => Record<string, any> | string | FormData | undefined
+    /**
+     * Allows the resolved request URL to target this Sim instance. Reserved for generic,
+     * user-directed HTTP capabilities; integration tools must use an in-process operation.
+     */
+    allowSameOrigin?: true
     /** Defines the exact request fields that may become model-visible. */
     modelInput?:
       | {

scripts/check-tool-request-boundary.test.ts

@@ -592,6 +592,46 @@ describe('tool self-hop audit', () => {
     ])
   })
 
+  it('rejects same-origin opt-in on an integration tool', () => {
+    const audit = auditToolSelfHops(`
+      const tool = {
+        id: 'test_tool',
+        request: {
+          allowSameOrigin: true,
+          url: (params) => params.url,
+          method: 'POST',
+          headers: () => ({}),
+        },
+      }
+    `)
+
+    expect(audit.violations).toEqual([
+      expect.objectContaining({
+        toolId: 'test_tool',
+        reason: 'unapproved-same-origin-policy',
+      }),
+    ])
+  })
+
+  it.each(['http_request', 'webhook_request'])(
+    'allows the intentional same-origin policy on %s',
+    (toolId) => {
+      const audit = auditToolSelfHops(`
+        const tool = {
+          id: '${toolId}',
+          request: {
+            allowSameOrigin: true,
+            url: (params) => params.url,
+            method: 'POST',
+            headers: () => ({}),
+          },
+        }
+      `)
+
+      expect(audit.violations).toEqual([])
+    }
+  )
+
   it('rejects request.internal even when the URL comes only from a spread', () => {
     const audit = auditToolSelfHops(`
       const externalRequest = { url: 'https://api.example.com/v1/items' }

scripts/check-tool-request-boundary.ts

@@ -3,7 +3,8 @@
  * Enforces the two tool execution boundaries: external ToolConfig requests are materialized only
  * by request-transport.ts, while same-process work uses registered InternalToolConfig operations.
  * Tool definitions may not point back to Sim API routes or revive the retired request.internal
- * escape hatch.
+ * escape hatch. Dynamic provider origins remain supported because the executor rejects their
+ * resolved URL when it targets Sim; only the two generic user-directed HTTP tools may opt out.
  */
 import { existsSync, readdirSync, readFileSync, statSync } from 'node:fs'
 import { dirname, extname, join, relative, resolve } from 'node:path'
@@ -28,6 +29,7 @@ const FUNCTION_NODE_TYPES = new Set([
   'ObjectMethod',
 ])
 const URL_VALUE_WRAPPER_CALLS = new Set(['String', 'encodeURI', 'encodeURIComponent'])
+const APPROVED_SAME_ORIGIN_TOOL_IDS = new Set(['http_request', 'webhook_request'])
 
 interface Violation {
   file: string
@@ -39,7 +41,11 @@ export interface ToolSelfHopViolation {
   file: string
   line: number
   toolId?: string
-  reason: 'same-origin-tool-request' | 'legacy-internal-policy' | 'unresolved-request-policy'
+  reason:
+    | 'same-origin-tool-request'
+    | 'legacy-internal-policy'
+    | 'unresolved-request-policy'
+    | 'unapproved-same-origin-policy'
 }
 
 export interface ToolSelfHopAudit {
@@ -1619,8 +1625,16 @@ export function auditToolSelfHops(source: string, file = 'source.ts'): ToolSelfH
           for (const request of requests.requests) {
             const urlProperties = getResolvedObjectProperties(request, 'url')
             const internalProperties = getResolvedObjectProperties(request, 'internal')
+            const allowSameOriginProperties = getResolvedObjectProperties(
+              request,
+              'allowSameOrigin'
+            )
             let hasLegacyInternalPolicy = false
-            if (!urlProperties.complete || !internalProperties.complete) {
+            if (
+              !urlProperties.complete ||
+              !internalProperties.complete ||
+              !allowSameOriginProperties.complete
+            ) {
               reportUnresolved(requestProperty.loc?.start.line ?? 1)
             }
             for (const resolvedInternal of internalProperties.properties) {
@@ -1635,6 +1649,28 @@ export function auditToolSelfHops(source: string, file = 'source.ts'): ToolSelfH
                 reason: 'legacy-internal-policy',
               })
             }
+            for (const resolvedPolicy of allowSameOriginProperties.properties) {
+              if (!resolvedPolicy) continue
+              const policyProperty = resolvedPolicy.property
+              const policyValue =
+                policyProperty.type === 'ObjectProperty' && isSyntaxNode(policyProperty.value)
+                  ? unwrapExpression(policyProperty.value)
+                  : undefined
+              if (!policyValue || policyValue.type !== 'BooleanLiteral') {
+                reportUnresolved(
+                  policyProperty.loc?.start.line ?? requestProperty.loc?.start.line ?? 1
+                )
+                continue
+              }
+              if (policyValue.value === true && !APPROVED_SAME_ORIGIN_TOOL_IDS.has(toolId)) {
+                violations.push({
+                  file,
+                  line: policyProperty.loc?.start.line ?? requestProperty.loc?.start.line ?? 1,
+                  toolId,
+                  reason: 'unapproved-same-origin-policy',
+                })
+              }
+            }
             for (const resolvedUrl of urlProperties.properties) {
               if (!resolvedUrl) continue
               const { property: urlProperty, request: urlRequest } = resolvedUrl