fix(tools): resolve helper-built self hops

Author: icecrasher321

scripts/check-tool-request-boundary.test.ts

@@ -336,6 +336,37 @@ describe('tool self-hop audit', () => {
     expect(audit.violations[0]?.reason).toBe('same-origin-tool-request')
   })
 
+  it('rejects a helper-returned path concatenated with the Sim origin', () => {
+    const audit = auditToolSelfHops(`
+      import { getBaseUrl } from '@/lib/core/utils/urls'
+      function buildPath() {
+        return '/api/tools/test'
+      }
+      const tool = {
+        id: 'test_tool',
+        request: { url: () => getBaseUrl() + buildPath(), method: 'POST' },
+      }
+    `)
+
+    expect(audit.violations[0]?.reason).toBe('same-origin-tool-request')
+  })
+
+  it('rejects a locally-bound helper path concatenated with the Sim origin', () => {
+    const audit = auditToolSelfHops(`
+      import { getBaseUrl } from '@/lib/core/utils/urls'
+      function buildPath() {
+        const path = '/api/tools/test'
+        return path
+      }
+      const tool = {
+        id: 'test_tool',
+        request: { url: () => getBaseUrl() + buildPath(), method: 'POST' },
+      }
+    `)
+
+    expect(audit.violations[0]?.reason).toBe('same-origin-tool-request')
+  })
+
   it('rejects a same-origin path interpolated with the Sim origin', () => {
     const audit = auditToolSelfHops(`
       import { getBaseUrl } from '@/lib/core/utils/urls'
@@ -348,6 +379,81 @@ describe('tool self-hop audit', () => {
     expect(audit.violations[0]?.reason).toBe('same-origin-tool-request')
   })
 
+  it('rejects a helper-returned path interpolated with the Sim origin', () => {
+    const audit = auditToolSelfHops(`
+      import { getBaseUrl } from '@/lib/core/utils/urls'
+      function buildPath() {
+        return '/api/tools/test'
+      }
+      const tool = {
+        id: 'test_tool',
+        request: { url: () => \`\${getBaseUrl()}\${buildPath()}\`, method: 'POST' },
+      }
+    `)
+
+    expect(audit.violations[0]?.reason).toBe('same-origin-tool-request')
+  })
+
+  it('rejects a helper-returned path resolved against the Sim origin', () => {
+    const audit = auditToolSelfHops(`
+      import { getBaseUrl } from '@/lib/core/utils/urls'
+      function buildPath() {
+        return '/api/tools/test'
+      }
+      const tool = {
+        id: 'test_tool',
+        request: { url: () => new URL(buildPath(), getBaseUrl()).toString(), method: 'POST' },
+      }
+    `)
+
+    expect(audit.violations[0]?.reason).toBe('same-origin-tool-request')
+  })
+
+  it('rejects an internal path resolved against a path-normalized Sim origin', () => {
+    const audit = auditToolSelfHops(`
+      import { getBaseUrl } from '@/lib/core/utils/urls'
+      const baseUrl = getBaseUrl() + '/tool-proxy/'
+      const tool = {
+        id: 'test_tool',
+        request: { url: () => new URL('/api/tools/test', baseUrl).toString(), method: 'POST' },
+      }
+    `)
+
+    expect(audit.violations[0]?.reason).toBe('same-origin-tool-request')
+  })
+
+  it('rejects an internal path resolved against a template-normalized Sim origin', () => {
+    const audit = auditToolSelfHops(`
+      import { getBaseUrl } from '@/lib/core/utils/urls'
+      const baseUrl = \`\${getBaseUrl()}/tool-proxy/\`
+      const tool = {
+        id: 'test_tool',
+        request: { url: () => new URL('/api/tools/test', baseUrl).toString(), method: 'POST' },
+      }
+    `)
+
+    expect(audit.violations[0]?.reason).toBe('same-origin-tool-request')
+  })
+
+  it('rejects an internal path resolved against a helper-normalized Sim origin', () => {
+    const audit = auditToolSelfHops(`
+      import { getBaseUrl } from '@/lib/core/utils/urls'
+      function getNormalizedOrigin() {
+        const origin = \`\${getBaseUrl()}/tool-proxy/\`
+        return origin
+      }
+      const tool = {
+        id: 'test_tool',
+        request: {
+          url: () => new URL('/api/tools/test', getNormalizedOrigin()).toString(),
+          method: 'POST',
+        },
+      }
+    `)
+
+    expect(audit.violations[0]?.reason).toBe('same-origin-tool-request')
+  })
+
   it('rejects a one-argument URL built from the Sim origin', () => {
     const audit = auditToolSelfHops(`
       import { getBaseUrl } from '@/lib/core/utils/urls'
@@ -500,6 +606,57 @@ describe('tool self-hop audit', () => {
     expect(audit.violations).toEqual([])
   })
 
+  it('allows a helper-returned API-shaped path resolved against an external origin', () => {
+    const audit = auditToolSelfHops(`
+      function buildPath() {
+        return '/api/messages'
+      }
+      const tool = {
+        id: 'test_tool',
+        request: {
+          url: () => new URL(buildPath(), 'https://provider.example.com').toString(),
+          method: 'POST',
+        },
+      }
+    `)
+
+    expect(audit.violations).toEqual([])
+  })
+
+  it('does not treat hostname mutation as Sim-origin normalization', () => {
+    const audit = auditToolSelfHops(`
+      import { getBaseUrl } from '@/lib/core/utils/urls'
+      const providerOrigin = getBaseUrl() + '.provider.example.com'
+      const tool = {
+        id: 'test_tool',
+        request: {
+          url: () => new URL('/api/messages', providerOrigin).toString(),
+          method: 'POST',
+        },
+      }
+    `)
+
+    expect(audit.violations).toEqual([])
+  })
+
+  it('does not treat a dynamic hostname suffix as Sim-origin normalization', () => {
+    const audit = auditToolSelfHops(`
+      import { getBaseUrl } from '@/lib/core/utils/urls'
+      const tool = {
+        id: 'test_tool',
+        request: {
+          url: (params) => new URL(
+            '/api/messages',
+            \`\${getBaseUrl()}\${params.providerDomain}\`
+          ).toString(),
+          method: 'POST',
+        },
+      }
+    `)
+
+    expect(audit.violations).toEqual([])
+  })
+
   it('allows an API-shaped path interpolated with an external provider origin', () => {
     const audit = auditRequest(
       `url: (params) => \`${PARAMS_HOST_TEMPLATE}/api/messages\`, method: 'POST'`

scripts/check-tool-request-boundary.ts

@@ -230,6 +230,23 @@ function resolveScopedArgument(
   return { expression: current, resolver }
 }
 
+function collectFunctionLocalBindings(fn: SyntaxNode, locals: Map<string, SyntaxNode>): void {
+  const visit = (node: SyntaxNode) => {
+    if (node !== fn && FUNCTION_NODE_TYPES.has(node.type)) return
+    if (
+      node.type === 'VariableDeclarator' &&
+      isSyntaxNode(node.id) &&
+      node.id.type === 'Identifier' &&
+      typeof node.id.name === 'string' &&
+      isSyntaxNode(node.init)
+    ) {
+      locals.set(node.id.name, node.init)
+    }
+    for (const child of getChildNodes(node)) visit(child)
+  }
+  visit(fn)
+}
+
 function isInternalPathExpression(
   expression: SyntaxNode,
   resolver: SelfHopResolver,
@@ -251,6 +268,31 @@ function isInternalPathExpression(
     return isInternalPathExpression(binding.expression, binding.resolver, nextSeen)
   }
 
+  if (current.type === 'CallExpression' || current.type === 'OptionalCallExpression') {
+    if (!isSyntaxNode(current.callee)) return false
+    const callee = unwrapExpression(current.callee)
+    if (callee.type === 'Identifier' && typeof callee.name === 'string') {
+      const key = `${resolver.file}:path-call:${callee.name}`
+      if (seen.has(key)) return false
+      const binding = resolveScopedIdentifier(callee.name, resolver)
+      if (binding && FUNCTION_NODE_TYPES.has(unwrapExpression(binding.expression).type)) {
+        const nextSeen = new Set(seen)
+        nextSeen.add(key)
+        const argumentsList = Array.isArray(current.arguments)
+          ? current.arguments
+              .filter(isSyntaxNode)
+              .map((argument) => resolveScopedArgument(argument, resolver))
+          : []
+        return functionReturnsInternalPath(
+          binding.expression,
+          binding.resolver,
+          argumentsList,
+          nextSeen
+        )
+      }
+    }
+  }
+
   if (current.type === 'ConditionalExpression') {
     return (
       (isSyntaxNode(current.consequent) &&
@@ -275,6 +317,59 @@ function isInternalPathExpression(
   return false
 }
 
+function functionReturnsInternalPath(
+  fn: SyntaxNode,
+  resolver: SelfHopResolver,
+  argumentsList: readonly ScopedExpression[],
+  seen: ReadonlySet<string>
+): boolean {
+  const current = unwrapExpression(fn)
+  if (!FUNCTION_NODE_TYPES.has(current.type)) return false
+  const locals = new Map(resolver.locals)
+  const scopedLocals = new Map(resolver.scopedLocals)
+  const parameters = Array.isArray(current.params) ? current.params : []
+  for (const [index, parameter] of parameters.entries()) {
+    if (
+      isSyntaxNode(parameter) &&
+      parameter.type === 'Identifier' &&
+      typeof parameter.name === 'string' &&
+      argumentsList[index]
+    ) {
+      const argument = argumentsList[index]
+      scopedLocals.set(parameter.name, argument)
+      if (argument.resolver === resolver) locals.set(parameter.name, argument.expression)
+    }
+  }
+  collectFunctionLocalBindings(current, locals)
+  const localResolver = { ...resolver, locals, scopedLocals }
+  if (current.type === 'ArrowFunctionExpression' && isSyntaxNode(current.body)) {
+    const body = unwrapExpression(current.body)
+    if (body.type !== 'BlockStatement') {
+      return isInternalPathExpression(body, localResolver, new Set(seen))
+    }
+  }
+  let found = false
+  const visit = (node: SyntaxNode) => {
+    if (found || (node !== current && FUNCTION_NODE_TYPES.has(node.type))) return
+    if (
+      node.type === 'ReturnStatement' &&
+      isSyntaxNode(node.argument) &&
+      isInternalPathExpression(node.argument, localResolver, new Set(seen))
+    ) {
+      found = true
+      return
+    }
+    for (const child of getChildNodes(node)) visit(child)
+  }
+  visit(current)
+  return found
+}
+
+function isOriginPreservingStaticSuffix(expression: SyntaxNode): boolean {
+  const suffix = getStaticString(expression)
+  return suffix !== undefined && (suffix === '' || /^[/?#]/.test(suffix))
+}
+
 function isSimOriginExpression(
   expression: SyntaxNode,
   resolver: SelfHopResolver,
@@ -321,6 +416,34 @@ function isSimOriginExpression(
       }
     }
   }
+  if (
+    current.type === 'BinaryExpression' &&
+    current.operator === '+' &&
+    isSyntaxNode(current.left) &&
+    isSyntaxNode(current.right)
+  ) {
+    return (
+      isSimOriginExpression(current.left, resolver, new Set(seen)) &&
+      isOriginPreservingStaticSuffix(current.right)
+    )
+  }
+  if (
+    current.type === 'TemplateLiteral' &&
+    Array.isArray(current.expressions) &&
+    Array.isArray(current.quasis) &&
+    current.expressions.length > 0 &&
+    current.quasis.length === current.expressions.length + 1 &&
+    current.expressions.every(isSyntaxNode) &&
+    current.quasis.every(isSyntaxNode) &&
+    getTemplateQuasiValue(current.quasis[0]) === '' &&
+    isSimOriginExpression(current.expressions[0], resolver, new Set(seen))
+  ) {
+    const suffix = getTemplateQuasiValue(current.quasis[1])
+    return (
+      suffix !== undefined &&
+      (suffix === '' ? current.expressions.length === 1 : /^[/?#]/.test(suffix))
+    )
+  }
   if (current.type === 'ConditionalExpression') {
     return (
       (isSyntaxNode(current.consequent) &&
@@ -362,6 +485,7 @@ function functionReturnsSimOrigin(
       if (argument.resolver === resolver) locals.set(parameter.name, argument.expression)
     }
   }
+  collectFunctionLocalBindings(current, locals)
   const localResolver = { ...resolver, locals, scopedLocals }
   if (current.type === 'ArrowFunctionExpression' && isSyntaxNode(current.body)) {
     const body = unwrapExpression(current.body)
@@ -744,22 +868,7 @@ function functionContainsInternalRoute(
   }
   const localResolver: SelfHopResolver = { ...resolver, locals, scopedLocals }
 
-  const collectLocals = (node: SyntaxNode) => {
-    if (node !== current && FUNCTION_NODE_TYPES.has(node.type)) {
-      return
-    }
-    if (
-      node.type === 'VariableDeclarator' &&
-      isSyntaxNode(node.id) &&
-      node.id.type === 'Identifier' &&
-      typeof node.id.name === 'string' &&
-      isSyntaxNode(node.init)
-    ) {
-      locals.set(node.id.name, node.init)
-    }
-    for (const child of getChildNodes(node)) collectLocals(child)
-  }
-  collectLocals(current)
+  collectFunctionLocalBindings(current, locals)
 
   if (current.type === 'ArrowFunctionExpression' && isSyntaxNode(current.body)) {
     const body = unwrapExpression(current.body)