* fix(integrations): repair broken endpoints, silent failures, and a path traversal
- qdrant: search_vector returned the /points/query envelope instead of the
points array, so downstream blocks saw an object where an array was declared
- elasticsearch: search/count/create_index silently swallowed malformed JSON —
count fell back to counting the entire index, search to match_all
- serper: only 4 of 6 advertised verticals were mapped; videos and shopping
returned empty (still billed) result sets. Replaced the if/else chain with a
vertical dispatch table that hard-fails on an unknown type
- enrow: find_email flattened the nested info object incorrectly, dropping
firstname/lastname, and advertised a linkedin_url the API never returns
- linkedin: share_post read postId from an empty body; /v2/ugcPosts returns it
in the x-restli-id header
- vercel: edge config endpoints moved to /v1/global-config
- vercel: encode edgeConfigId so a traversing value cannot escape the base path
- sixtyfour: enrich endpoints moved to /people-intelligence and
/company-intelligence
- langsmith: hard-coded API host consolidated to one constant, added missing
non-ok guards, encoded run ids, capped echoed upstream error bodies
- daytona: file upload moved to /files/upload-v2
- memory: PUT persisted a bare object where POST and the declared type both use
an array
Adds 53 tests across the affected tools.
* fix(integrations): close path traversal fleet-wide, stop a credential reaching the wire
Follows up the review round on this branch.
Security:
- The previous encodeURIComponent-only guard was incomplete. '.' and '..' are
unreserved, so they survive encoding and the URL parser then removes them as
dot segments — popping one path segment on a fixed host with the caller's
bearer token still attached, including on DELETE. Adds a shared
safeUrlPathSegment helper that rejects empty, '.', '..', and any residual path
separator, and applies it across every Vercel and Daytona tool that
interpolates an LLM-writable id into a request path
- langsmith: create_run and create_runs_batch spread the whole params object
into the request body, so the LangSmith API key was sent to LangSmith and
stored in the run record. Request bodies are now built from an explicit
allowlist of run-ingest fields, so an unlisted param cannot reach the wire
Correctness:
- langsmith: the run-payload normalizer was not idempotent and ran once in
request.body and again in transformResponse, so a caller who left Run ID blank
got back an id that was never sent. Downstream update_run/create_feedback
wired to it would 404
- langsmith: batch patch entries were normalized as if they were new runs,
minting ids and overwriting start_time/trace_id/dotted_order
- langsmith: the 500-char error cap appended its ellipsis after slicing, so the
advertised bound was actually 503
- serper: scholar and patents mapped a date field neither vertical returns, and
a test asserted it. Their organic response key is now confirmed against
Serper's published per-vertical examples rather than assumed
- serper: an unknown vertical derived from the response URL turned a successful
response into a thrown error; only a user-supplied type now hard-fails
- linkedin: warn when a success status carries no x-restli-id header
Also corrects the Vercel endpoint rationale in the PR description: the old
/v1/edge-config path still routes and is not scheduled for removal, so the move
to /v1/global-config is canonical alignment rather than a break-fix.
Waleed
a42299066d