fix(web_fetch): the protocol gate never accepted a URL — the colon bug

URL.protocol carries a trailing colon ("https:", WHATWG); the colon-less
comparison (a direct port from the py harness, where urlparse().scheme
has none) rejected EVERY valid URL ever fetched — the tool never fetched
a page in its life. Owner-reported via OpenRouter logs: 8 valid URLs in,
8 'invalid URL' results out.

The new pin stubs globalThis.fetch so the happy path runs hermetically —
a valid https URL must REACH the fetch stage (and ftp:// still rejected).

dist rebuilt (desktop:dist) — bundle verified: "http:"!==t.protocol
This commit is contained in:
amosblomqvist
2026-10-07 22:08:29 +03:00
parent 34f498b128
commit d450689a8b
2 changed files with 34 additions and 1 deletions
+6 -1
View File
@@ -160,7 +160,12 @@ export function createWebTools(search: () => SearchProvider | null): Record<stri
execute: serverExecute("web_fetch", webFetchInput, async ({ url }): Promise<string> => {
try {
const parsed = new URL(url);
if (parsed.protocol !== "http" && parsed.protocol !== "https") throw new Error("Only http(s) URLs are supported");
// URL.protocol carries a TRAILING COLON ("https:", WHATWG) — the
// colon-less comparison born from the py-harness port (urlparse's
// scheme has NO colon) rejected every valid URL ever fetched
// (owner-reported via OpenRouter logs, 2026-10-07).
if (parsed.protocol !== "http:" && parsed.protocol !== "https:")
throw new Error("Only http(s) URLs are supported");
} catch {
return `web_fetch failed: invalid URL "${url}"`;
}