Aakash BakhleandGitHub
9c68eed676
Captain custom tools configured with API key authentication now send the configured key in the requested HTTP header. Existing tools begin working without needing to be recreated or reconfigured, while credentials remain protected across redirects. ## How to reproduce 1. Create a Captain custom tool using API Key authentication. 2. Configure `X-API-Key` as the header name and save the tool. 3. Invoke the tool and inspect the incoming request. 4. Before this change, the API key header is absent; after this change, the configured endpoint receives it. ## What changed The UI persists API key authentication as `name` and `key`, but the request builder also required an unused `location: header` property. The request builder now treats API key authentication as header-based, matching the only mode exposed by the UI. Custom authentication headers are also registered as sensitive with `SafeFetch`. They are retained for the configured endpoint and same-origin redirects, but stripped when a redirect crosses origins to prevent credential leakage. Factory, request, and redirect specs cover the real UI payload and both public and private-network fetch paths.
58 lines
1.9 KiB
Ruby
58 lines
1.9 KiB
Ruby
require 'agents'
|
|
|
|
class Captain::Tools::HttpTool < Agents::Tool
|
|
def initialize(assistant, custom_tool)
|
|
@assistant = assistant
|
|
@custom_tool = custom_tool
|
|
super()
|
|
end
|
|
|
|
def active?
|
|
@custom_tool.enabled?
|
|
end
|
|
|
|
def perform(tool_context, **params)
|
|
url = @custom_tool.build_request_url(params)
|
|
body = @custom_tool.build_request_body(params)
|
|
|
|
response_body = execute_http_request(url, body, tool_context)
|
|
@custom_tool.format_response(response_body)
|
|
rescue StandardError => e
|
|
Rails.logger.error("HttpTool execution error for #{@custom_tool.slug}: #{e.class} - #{e.message}")
|
|
'An error occurred while executing the request'
|
|
end
|
|
|
|
private
|
|
|
|
# Limit response size to prevent memory exhaustion and match LLM token limits
|
|
# 1MB of text ≈ 250K tokens, which exceeds most LLM context windows
|
|
MAX_RESPONSE_SIZE = 1.megabyte
|
|
|
|
# Route through SafeFetch so custom tool requests share the app's centralized HTTP
|
|
# fetching (resolution, timeouts, response size limits, and redirect handling).
|
|
def execute_http_request(url, body, tool_context)
|
|
json_body = body if @custom_tool.http_method == 'POST'
|
|
auth_headers = @custom_tool.build_auth_headers
|
|
|
|
response_body = +''
|
|
SafeFetch.fetch(
|
|
url,
|
|
method: @custom_tool.http_method == 'POST' ? :post : :get,
|
|
body: json_body,
|
|
headers: request_headers(tool_context, json_body, auth_headers),
|
|
sensitive_headers: auth_headers.keys,
|
|
http_basic_authentication: @custom_tool.build_basic_auth_credentials,
|
|
max_bytes: MAX_RESPONSE_SIZE,
|
|
validate_content_type: false
|
|
) { |result| response_body = result.tempfile.read }
|
|
response_body
|
|
end
|
|
|
|
def request_headers(tool_context, json_body, auth_headers)
|
|
headers = auth_headers.dup
|
|
headers.merge!(@custom_tool.build_metadata_headers(tool_context&.state || {}))
|
|
headers['Content-Type'] = 'application/json' if json_body.present?
|
|
headers
|
|
end
|
|
end
|