fix(tools): harden the metadata accessors against inherited keys

Review found two real defects in the generated-metadata layer.

`JSON.parse` returns an object with the normal prototype, so a bare bracket
lookup resolved inherited members: `getToolMetadata('constructor')` returned a
*function* typed as `ToolMetadata`, and `getToolOutputsMetadata('toString')`
likewise — silently violating the accessors' documented "undefined if unknown"
contract. Guarded with `Object.hasOwn`, with a parameterised regression test
over `constructor`, `toString`, `valueOf`, `hasOwnProperty` and `__proto__`.

The generator's no-functions scan also gave up past ten levels of nesting. Param
and output schemas nest arbitrarily, so a deeper closure would have been dropped
silently by `JSON.stringify` while generation reported success — shipping an
incomplete schema and defeating the guarantee the scan exists to provide. The
depth cap is gone; a `WeakSet` handles the cycles that exposes.

Author: waleedlatif1

apps/sim/tools/metadata-outputs.ts

@@ -22,7 +22,11 @@ type ToolOutputs = NonNullable<ToolConfig['outputs']>
  */
 const outputs: Record<string, ToolOutputs> = rawOutputs as Record<string, ToolOutputs>
 
-/** Declared outputs for a built-in tool, or `undefined` if it declares none. */
+/**
+ * Declared outputs for a built-in tool, or `undefined` if it declares none.
+ *
+ * `Object.hasOwn` rather than a bare lookup — see `getToolMetadata` for why.
+ */
 export function getToolOutputsMetadata(toolId: string): ToolOutputs | undefined {
-  return outputs[toolId]
+  return Object.hasOwn(outputs, toolId) ? outputs[toolId] : undefined
 }

apps/sim/tools/metadata.test.ts

@@ -32,6 +32,21 @@ describe('generated tool metadata', () => {
     expect(getToolOutputsMetadata('gmail_send')).toBeDefined()
   })
 
+  /**
+   * `JSON.parse` yields an object with the normal prototype, so a bare bracket
+   * lookup returns inherited members — `getToolMetadata('constructor')` handed
+   * back a function typed as tool metadata.
+   */
+  it.each(['constructor', 'toString', 'valueOf', 'hasOwnProperty', '__proto__'])(
+    'treats inherited key %s as an unknown tool',
+    (key) => {
+      expect(getToolMetadata(key)).toBeUndefined()
+      expect(getToolParams(key)).toBeUndefined()
+      expect(getToolOutputsMetadata(key)).toBeUndefined()
+      expect(hasToolMetadata(key)).toBe(false)
+    }
+  )
+
   /**
    * The registry contains a null param entry (`stt_deepgram_v2`), which crashes
    * any consumer that iterates params unguarded. The generator strips those, so

apps/sim/tools/metadata.ts

@@ -43,12 +43,19 @@ export function hasToolMetadata(toolId: string): boolean {
   return Object.hasOwn(metadata, toolId)
 }
 
-/** Serializable metadata for a built-in tool, or `undefined` if unknown. */
+/**
+ * Serializable metadata for a built-in tool, or `undefined` if unknown.
+ *
+ * `Object.hasOwn` rather than a bare lookup: `JSON.parse` yields an object with
+ * the normal prototype, so a tool id colliding with `constructor`, `toString` or
+ * `__proto__` would otherwise return an inherited function typed as tool
+ * metadata.
+ */
 export function getToolMetadata(toolId: string): ToolMetadata | undefined {
-  return metadata[toolId]
+  return Object.hasOwn(metadata, toolId) ? metadata[toolId] : undefined
 }
 
 /** Declared parameters for a built-in tool, or `undefined` if unknown. */
 export function getToolParams(toolId: string): ToolConfig['params'] | undefined {
-  return metadata[toolId]?.params
+  return getToolMetadata(toolId)?.params
 }

scripts/sync-tool-metadata.ts

@@ -52,21 +52,35 @@ const METADATA_FIELDS = ['name', 'description', 'version', 'params', 'oauth'] as
 
 type ToolRecord = Record<string, ToolConfig>
 
-/** Recursively locates any function value, which must never reach the artifacts. */
-function findFunctionPaths(value: unknown, path: string, found: string[], depth = 0): void {
-  if (found.length >= 10 || depth > 10 || value == null) return
+/**
+ * Recursively locates any function value, which must never reach the artifacts.
+ *
+ * Unbounded in depth on purpose: param and output schemas nest arbitrarily, and
+ * a depth cap would let a deeply-nested closure through — `JSON.stringify` drops
+ * it silently, so the artifact would ship an incomplete schema while generation
+ * reported success. `seen` guards the cycles that removing the cap exposes.
+ */
+function findFunctionPaths(
+  value: unknown,
+  path: string,
+  found: string[],
+  seen = new WeakSet<object>()
+): void {
+  if (found.length >= 10 || value == null) return
   if (typeof value === 'function') {
     found.push(path)
     return
   }
+  if (typeof value !== 'object') return
+  if (seen.has(value as object)) return
+  seen.add(value as object)
+
   if (Array.isArray(value)) {
-    value.forEach((item, i) => findFunctionPaths(item, `${path}[${i}]`, found, depth + 1))
+    value.forEach((item, i) => findFunctionPaths(item, `${path}[${i}]`, found, seen))
     return
   }
-  if (typeof value === 'object') {
-    for (const [key, item] of Object.entries(value as object)) {
-      findFunctionPaths(item, `${path}.${key}`, found, depth + 1)
-    }
+  for (const [key, item] of Object.entries(value as object)) {
+    findFunctionPaths(item, `${path}.${key}`, found, seen)
   }
 }