fix(algolia,box,attio): guard body ids, constrain target, attribute a probe claim

- list_indices interpolated user-or-llm page/hitsPerPage raw into the query
  string; the block declared them string while the tool declared number,
  with no coercion between
- .trim() on ids that arrive as JSON numbers threw a TypeError. Box ids are
  numeric strings and '0' is the root folder, which a truthiness guard was
  dropping entirely; a whitespace-only id went out as an empty parent
- get_records fell back to the tool-level indexName whenever a per-request
  value was not a string, silently querying a different index
- attio target is a two-value enum the tool layer left unconstrained, so a
  direct LLM call could address /v2/<anything>
- the Algolia guard's rationale cited an unreproduced live probe alongside
  spec-backed claims; the probe is now quarantined and nothing depends on it

Author: waleedlatif1

apps/sim/blocks/blocks/algolia.ts

@@ -605,6 +605,25 @@ Return ONLY the JSON array.`,
           return defaultValue
         }
 
+        /**
+         * Pagination fields are short-inputs, so they leave the canvas as
+         * strings even though every Algolia tool declares them `type: 'number'`.
+         * Coercing here — in `params`, which runs during execution after
+         * variables resolve — keeps a `<Block.output>` reference intact; the
+         * same call in `tools.config.tool` would run during serialization and
+         * destroy it. A value that is not numeric is passed through untouched
+         * so the tool reports the offending parameter by name.
+         */
+        const toNumber = (value: unknown) => {
+          if (typeof value === 'number') return value
+          if (typeof value !== 'string') return value
+          const parsed = Number(value.trim())
+          return Number.isFinite(parsed) ? parsed : value
+        }
+
+        if (result.page !== undefined) result.page = toNumber(result.page)
+        if (result.hitsPerPage !== undefined) result.hitsPerPage = toNumber(result.hitsPerPage)
+
         if (operation === 'partial_update_record') {
           result.createIfNotExists = toBool(result.createIfNotExists, true)
         }
@@ -636,8 +655,8 @@ Return ONLY the JSON array.`,
     operation: { type: 'string', description: 'Operation to perform' },
     indexName: { type: 'string', description: 'Algolia index name' },
     query: { type: 'string', description: 'Search query' },
-    hitsPerPage: { type: 'string', description: 'Number of hits per page' },
-    page: { type: 'string', description: 'Page number' },
+    hitsPerPage: { type: 'number', description: 'Number of hits per page' },
+    page: { type: 'number', description: 'Page number' },
     filters: { type: 'string', description: 'Algolia filter string' },
     attributesToRetrieve: { type: 'string', description: 'Attributes to retrieve' },
     facets: { type: 'string', description: 'Comma-separated facet attribute names to count' },

apps/sim/tools/algolia/copy_move_index.ts

@@ -1,3 +1,4 @@
+import { algoliaIndexName } from '@/tools/algolia/index-name'
 import type {
   AlgoliaCopyMoveIndexParams,
   AlgoliaCopyMoveIndexResponse,
@@ -66,7 +67,7 @@ export const copyMoveIndexTool: ToolConfig<
     body: (params) => {
       const body: Record<string, unknown> = {
         operation: params.operation,
-        destination: params.destination.trim(),
+        destination: algoliaIndexName(params.destination, 'destination'),
       }
       if (params.scope) {
         const scope = typeof params.scope === 'string' ? JSON.parse(params.scope) : params.scope

apps/sim/tools/algolia/get_records.ts

@@ -1,3 +1,4 @@
+import { algoliaIndexName } from '@/tools/algolia/index-name'
 import type { AlgoliaGetRecordsParams, AlgoliaGetRecordsResponse } from '@/tools/algolia/types'
 import type { ToolConfig } from '@/tools/types'
 
@@ -49,7 +50,9 @@ export const getRecordsTool: ToolConfig<AlgoliaGetRecordsParams, AlgoliaGetRecor
       const requests = (parsed as Record<string, unknown>[]).map((req) => ({
         ...req,
         indexName:
-          typeof req.indexName === 'string' ? req.indexName.trim() : params.indexName.trim(),
+          req.indexName === undefined || req.indexName === null
+            ? algoliaIndexName(params.indexName, 'indexName')
+            : algoliaIndexName(req.indexName, 'indexName'),
       }))
       return { requests }
     },

apps/sim/tools/algolia/index-name.ts

@@ -0,0 +1,38 @@
+/**
+ * Normalization for an Algolia index name that a tool puts into a request
+ * **body** rather than into the URL path.
+ *
+ * The path-zone sites run through `@/tools/url-path`, whose guards already
+ * stringify a numeric value before encoding it. That module's contract is
+ * path-specific — rejecting dot segments and separators — and a body field
+ * needs neither, so the coercion lives here instead of widening the path
+ * module's public surface.
+ *
+ * An index named `2024` is ordinary, and a `visibility: 'user-or-llm'` slot
+ * filled with `2024` arrives as a JSON number, where a bare `.trim()` is an
+ * unhandled `TypeError: x.trim is not a function`. `null` and `undefined` are
+ * rejected before coercion so a missing parameter is reported rather than sent
+ * as an index literally named `"undefined"`.
+ */
+
+/**
+ * Coerces a required Algolia index name to a trimmed string.
+ *
+ * @param value - The raw index name, typically LLM- or user-supplied.
+ * @param paramName - The parameter name, used to name the offender in errors.
+ * @returns The index name as a trimmed string.
+ * @throws If the value is nullish or trims to empty.
+ */
+export function algoliaIndexName(value: unknown, paramName: string): string {
+  if (value === null || value === undefined) {
+    throw new Error(`${paramName} is required`)
+  }
+
+  const trimmed = String(value).trim()
+
+  if (!trimmed) {
+    throw new Error(`${paramName} is required`)
+  }
+
+  return trimmed
+}

apps/sim/tools/algolia/list_indices.ts

@@ -1,6 +1,28 @@
 import type { AlgoliaListIndicesParams, AlgoliaListIndicesResponse } from '@/tools/algolia/types'
 import type { ToolConfig } from '@/tools/types'
 
+/**
+ * Coerces a pagination parameter to the non-negative integer Algolia declares.
+ *
+ * The parameter is `visibility: 'user-or-llm'` and the Algolia block still
+ * forwards it as a short-input string, so `'0&hitsPerPage=1000'` is a value the
+ * builder genuinely receives. `URLSearchParams` alone would percent-encode the
+ * `&` and stop the smuggling, but it would also send that whole string as the
+ * value of `page`; rejecting a value that is not a number reports the bad input
+ * instead of asking Algolia to reject it. A numeric string (`'0'`, `'100'`) is
+ * the normal UI path and passes through unchanged.
+ */
+function paginationValue(value: string | number, paramName: string): string {
+  const raw = typeof value === 'number' ? value : String(value).trim()
+  const parsed = raw === '' ? Number.NaN : Number(raw)
+
+  if (!Number.isInteger(parsed) || parsed < 0) {
+    throw new Error(`${paramName} must be a non-negative integer`)
+  }
+
+  return String(parsed)
+}
+
 export const listIndicesTool: ToolConfig<AlgoliaListIndicesParams, AlgoliaListIndicesResponse> = {
   id: 'algolia_list_indices',
   name: 'Algolia List Indices',
@@ -38,10 +60,15 @@ export const listIndicesTool: ToolConfig<AlgoliaListIndicesParams, AlgoliaListIn
     method: 'GET',
     url: (params) => {
       const base = `https://${params.applicationId}-dsn.algolia.net/1/indexes`
-      const queryParams: string[] = []
-      if (params.page !== undefined) queryParams.push(`page=${params.page}`)
-      if (params.hitsPerPage !== undefined) queryParams.push(`hitsPerPage=${params.hitsPerPage}`)
-      return queryParams.length > 0 ? `${base}?${queryParams.join('&')}` : base
+      const queryParams = new URLSearchParams()
+      if (params.page !== undefined) {
+        queryParams.set('page', paginationValue(params.page, 'page'))
+      }
+      if (params.hitsPerPage !== undefined) {
+        queryParams.set('hitsPerPage', paginationValue(params.hitsPerPage, 'hitsPerPage'))
+      }
+      const query = queryParams.toString()
+      return query ? `${base}?${query}` : base
     },
     headers: (params) => ({
       'x-algolia-application-id': params.applicationId,

apps/sim/tools/algolia/list_indices_query.test.ts

@@ -0,0 +1,80 @@
+/**
+ * @vitest-environment node
+ *
+ * Guards `algolia_list_indices`' query string against parameter smuggling.
+ *
+ * `page` and `hitsPerPage` are `visibility: 'user-or-llm'`, so prompt injection
+ * controls them. The tool declares them `type: 'number'`, but the Algolia block
+ * declared them `type: 'string'` in `inputs` and its `tools.config.params`
+ * copies values through verbatim, so a string genuinely reaches the URL
+ * builder. Interpolating that string into `page=${value}` lets one parameter
+ * carry a `&`, appending arbitrary further query parameters to a request that
+ * still carries the caller's admin API key.
+ *
+ * Every assertion resolves the built URL through `new URL(...)` and reads
+ * `searchParams`, never `includes()` on the template text: a smuggled
+ * `hitsPerPage` is invisible to a substring check on `page=...` but shows up
+ * as a second, separate key once the URL is actually parsed.
+ */
+import { describe, expect, it } from 'vitest'
+import { listIndicesTool } from '@/tools/algolia/list_indices'
+
+const BASE = { applicationId: 'APPID', apiKey: 'KEY' }
+
+function buildUrl(extra: Record<string, unknown>): URL {
+  const build = listIndicesTool.request.url as (params: Record<string, unknown>) => string
+  return new URL(build({ ...BASE, ...extra }))
+}
+
+describe('algolia_list_indices query construction', () => {
+  it('rejects a page value carrying a smuggled second parameter', () => {
+    expect(() => buildUrl({ page: '0&hitsPerPage=1000' })).toThrow(/page/)
+  })
+
+  it('rejects a hitsPerPage value carrying a smuggled second parameter', () => {
+    expect(() => buildUrl({ hitsPerPage: '1&page=99' })).toThrow(/hitsPerPage/)
+  })
+
+  it('rejects a non-numeric page outright rather than sending it', () => {
+    expect(() => buildUrl({ page: 'abc' })).toThrow(/page/)
+  })
+
+  it('rejects a fractional page rather than silently truncating it', () => {
+    expect(() => buildUrl({ page: '1.5' })).toThrow(/page/)
+  })
+
+  it('rejects an empty string rather than coercing it to page 0', () => {
+    expect(() => buildUrl({ page: '' })).toThrow(/page/)
+    expect(() => buildUrl({ hitsPerPage: '   ' })).toThrow(/hitsPerPage/)
+  })
+
+  it('rejects a negative page', () => {
+    expect(() => buildUrl({ page: -1 })).toThrow(/page/)
+  })
+
+  it('encodes rather than interpolates when a value survives coercion', () => {
+    const url = buildUrl({ page: 2, hitsPerPage: 50 })
+    expect(url.searchParams.get('page')).toBe('2')
+    expect(url.searchParams.get('hitsPerPage')).toBe('50')
+    expect([...url.searchParams.keys()]).toEqual(['page', 'hitsPerPage'])
+  })
+
+  it('accepts the numeric strings the block still forwards from a short-input', () => {
+    const url = buildUrl({ page: '0', hitsPerPage: '100' })
+    expect(url.searchParams.get('page')).toBe('0')
+    expect(url.searchParams.get('hitsPerPage')).toBe('100')
+    expect([...url.searchParams.keys()]).toEqual(['page', 'hitsPerPage'])
+  })
+
+  it('is byte-identical to the pre-fix output for legitimate values', () => {
+    const build = listIndicesTool.request.url as (params: Record<string, unknown>) => string
+    expect(build({ ...BASE })).toBe('https://APPID-dsn.algolia.net/1/indexes')
+    expect(build({ ...BASE, page: 0 })).toBe('https://APPID-dsn.algolia.net/1/indexes?page=0')
+    expect(build({ ...BASE, hitsPerPage: 100 })).toBe(
+      'https://APPID-dsn.algolia.net/1/indexes?hitsPerPage=100'
+    )
+    expect(build({ ...BASE, page: 3, hitsPerPage: 25 })).toBe(
+      'https://APPID-dsn.algolia.net/1/indexes?page=3&hitsPerPage=25'
+    )
+  })
+})

apps/sim/tools/algolia/numeric_body_ids.test.ts

@@ -0,0 +1,104 @@
+/**
+ * @vitest-environment node
+ *
+ * Guards the Algolia tools that put an index name into a request **body**
+ * against it arriving as a JSON number.
+ *
+ * The path-zone sites already run through `safeUrlPathSegment`, whose
+ * `toGuardedString` stringifies a number; the body-zone sites kept a bare
+ * `.trim()`. An index literally named `2024` is ordinary, and a
+ * `visibility: 'user-or-llm'` slot filled with `2024` reaches the builder as a
+ * JSON number — `TypeError: x.trim is not a function`, surfaced as a tool crash
+ * rather than a validation error. Sending the string `"undefined"` as an index
+ * name instead of reporting the missing parameter would be no better, so the
+ * nullish case is rejected before coercion.
+ */
+import { describe, expect, it } from 'vitest'
+import { copyMoveIndexTool } from '@/tools/algolia/copy_move_index'
+import { getRecordsTool } from '@/tools/algolia/get_records'
+import { searchTool } from '@/tools/algolia/search'
+import type { ToolConfig } from '@/tools/types'
+
+type AnyTool = ToolConfig<any, any>
+
+const BASE = { applicationId: 'APPID', apiKey: 'KEY' }
+
+function bodyOf(tool: AnyTool, params: Record<string, unknown>): Record<string, any> {
+  const build = tool.request.body as (p: Record<string, unknown>) => Record<string, any>
+  return build({ ...BASE, ...params })
+}
+
+describe('algolia_search indexName coercion', () => {
+  it('accepts a numeric index name emitted as a JSON number', () => {
+    expect(
+      bodyOf(searchTool as AnyTool, { indexName: 2024, query: 'q' }).requests[0].indexName
+    ).toBe('2024')
+  })
+
+  it('still trims a string index name byte-identically', () => {
+    expect(bodyOf(searchTool as AnyTool, { indexName: ' products ', query: 'q' })).toEqual({
+      requests: [{ indexName: 'products', query: 'q' }],
+    })
+  })
+
+  it('reports a missing required index name by name rather than crashing', () => {
+    expect(() => bodyOf(searchTool as AnyTool, { query: 'q' })).toThrow(/indexName/)
+  })
+})
+
+describe('algolia_copy_move_index destination coercion', () => {
+  it('accepts a numeric destination emitted as a JSON number', () => {
+    expect(
+      bodyOf(copyMoveIndexTool as AnyTool, {
+        indexName: 'src',
+        destination: 2025,
+        operation: 'copy',
+      }).destination
+    ).toBe('2025')
+  })
+
+  it('still trims a string destination byte-identically', () => {
+    expect(
+      bodyOf(copyMoveIndexTool as AnyTool, {
+        indexName: 'src',
+        destination: ' dest ',
+        operation: 'move',
+      })
+    ).toEqual({ operation: 'move', destination: 'dest' })
+  })
+
+  it('reports a missing required destination by name rather than crashing', () => {
+    expect(() =>
+      bodyOf(copyMoveIndexTool as AnyTool, { indexName: 'src', operation: 'copy' })
+    ).toThrow(/destination/)
+  })
+})
+
+describe('algolia_get_records indexName coercion', () => {
+  it('accepts a numeric fallback index name emitted as a JSON number', () => {
+    const body = bodyOf(getRecordsTool as AnyTool, {
+      indexName: 2024,
+      requests: [{ objectID: 'a' }],
+    })
+    expect(body.requests).toEqual([{ objectID: 'a', indexName: '2024' }])
+  })
+
+  it('accepts a numeric per-request index name', () => {
+    const body = bodyOf(getRecordsTool as AnyTool, {
+      indexName: 'fallback',
+      requests: [{ objectID: 'a', indexName: 2024 }],
+    })
+    expect(body.requests).toEqual([{ objectID: 'a', indexName: '2024' }])
+  })
+
+  it('still trims string index names byte-identically', () => {
+    const body = bodyOf(getRecordsTool as AnyTool, {
+      indexName: ' fallback ',
+      requests: [{ objectID: 'a' }, { objectID: 'b', indexName: ' own ' }],
+    })
+    expect(body.requests).toEqual([
+      { objectID: 'a', indexName: 'fallback' },
+      { objectID: 'b', indexName: 'own' },
+    ])
+  })
+})

apps/sim/tools/algolia/path_safety.test.ts

@@ -25,11 +25,21 @@
  * `fetch` performs — and compares *segment shape* rather than template text,
  * because `pathname.startsWith(prefix)` stays green after a segment is popped.
  *
- * The vector lists are **per parameter**, because the two path parameters do
- * not share a charset. Algolia validates `indexName` (`/1/indexes/instant%2Fsearch/settings`
- * → `400 indexName is not valid`) but not `objectID`: `foo%2Fbar` and a
- * URL-keyed id both return `404 ObjectID does not exist`, i.e. well-formed but
- * absent, and Algolia's own conformance suite exercises `Batman and Robin`.
+ * The vector lists are **per parameter**, because the two path parameters are
+ * not treated alike. `objectID` is opaque in Algolia's published sources: the
+ * OpenAPI gives it a bare `type: string` with no `pattern` (where `userID` in
+ * the same bundled spec carries `^[a-zA-Z0-9 \-*.]+$`, which excludes `/`), the
+ * official JS client `encodeURIComponent`s it into the segment, and the client
+ * conformance suite round-trips a space on a record id (`Batman and Robin` →
+ * `/1/indexes/cts_e2e_browse/Batman%20and%20Robin`) and a literal slash on the
+ * rules id (`test/with/slash` → `/1/indexes/indexName/rules/test%2Fwith%2Fslash`).
+ * `indexName` is treated as a named resource here — a separator in it means the
+ * caller passed the wrong thing — which is a repository choice, not a
+ * documented Algolia constraint: the spec gives `indexName` a bare
+ * `type: string` too. (A live probe suggested Algolia rejects a slashed
+ * `indexName` with `400 indexName is not valid`; that is unverified and
+ * unreproduced here, and nothing below rests on it.)
+ *
  * A single shared list that contained no `/`-bearing legitimate value is what
  * let a guard rejecting `/` in `objectID` ship green.
  */
@@ -81,9 +91,11 @@ const LEGITIMATE = [
  * Legitimate ids that only an opaque-id parameter accepts. The URL-keyed form
  * is the common site-search pattern; `Batman and Robin` is lifted from
  * Algolia's own client conformance suite (`/1/indexes/cts_e2e_browse/Batman%20and%20Robin`
- * → 200); `a/../../b` and `docs/` are legal ids whose dot and trailing
- * separators must survive as inert `%2F`-joined text rather than be rejected
- * or emitted as real separators.
+ * → 200), which exercises a space rather than a slash — the suite's slash case
+ * is the rules id (`test/with/slash` → `.../rules/test%2Fwith%2Fslash`);
+ * `a/../../b` and `docs/` are legal ids whose dot and trailing separators must
+ * survive as inert `%2F`-joined text rather than be rejected or emitted as real
+ * separators.
  */
 const OPAQUE_LEGITIMATE = [
   'https://example.com/docs/getting-started',

apps/sim/tools/algolia/search.ts

@@ -1,3 +1,4 @@
+import { algoliaIndexName } from '@/tools/algolia/index-name'
 import type { AlgoliaSearchParams, AlgoliaSearchResponse } from '@/tools/algolia/types'
 import type { ToolConfig } from '@/tools/types'
 
@@ -106,7 +107,7 @@ export const searchTool: ToolConfig<AlgoliaSearchParams, AlgoliaSearchResponse>
     }),
     body: (params) => {
       const request: Record<string, unknown> = {
-        indexName: params.indexName.trim(),
+        indexName: algoliaIndexName(params.indexName, 'indexName'),
         query: params.query,
       }
       if (params.hitsPerPage !== undefined) request.hitsPerPage = Number(params.hitsPerPage)