NetworkPolicy validates scheme/host and re-validates resolved IPs at dial
time and on redirects (DNS-rebinding defense), with cloud metadata
endpoints always blocked. Redact masks known credential shapes (OpenAI/
Anthropic/GitHub/AWS/Slack/Google keys, PEM blocks, JWTs) in tool output.
WrapUntrusted fences fetched web content against prompt injection, paired
with UntrustedContentInstruction for the system prompt.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Formatting only (struct field alignment, import ordering) across the
files that didn't comply — no semantic changes.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
- agent/loop.go: Record assistant message with ToolCalls before tool results,
and set ToolCallID on tool-result messages so follow-up requests have complete
context (prevents models from losing track of already-attempted tools).
- llm/providers/llamacpp/client.go: Buffer fragmented tool call deltas during
streaming, assemble them into complete calls when finish_reason arrives.
Add ToolCalls, ToolCallID, Name fields to request building.
- llm/providers/openai/client.go: Send ToolCalls, ToolCallID, Name when
building chat requests so messages are wire-format correct.
- llm/types.go: Add ToolCalls field to Message struct for serialization
back into conversation history.
- agent/integration_test.go: Move integration test skip from TestMain to a
per-test skipUnlessIntegration() so it doesn't hide other package tests.
- sandbox & tools: Add edge-case tests (relative traversal, array paths,
non-path strings, zero-value guards, sentinel errors).
