Add collapse/deferral/command_output helpers and tinytools-std (from OpenHuman)

Cargo.toml

@@ -14,7 +14,7 @@ exclude = ["worktrees"]
 # true`, so the version the release workflow bumps is written in exactly one
 # place and every crate moves together.
 [workspace.package]
-version = "0.4.1"
+version = "0.5.0"
 edition = "2024"
 rust-version = "1.88"
 license = "GPL-3.0-only"

crates/tinytools-agent/Cargo.toml

@@ -14,7 +14,7 @@ readme = "README.md"
 regex = { workspace = true }
 serde = { workspace = true }
 serde_json = { workspace = true }
-tinytools = { path = "../tinytools", version = "0.4.1" }
+tinytools = { path = "../tinytools", version = "0.5.0" }
 tracing = { workspace = true, optional = true }
 
 [features]

crates/tinytools-jev/Cargo.toml

@@ -12,7 +12,7 @@ readme = "README.md"
 
 [dependencies]
 async-trait = { workspace = true }
-tinytools = { path = "../tinytools", version = "0.4.1" }
+tinytools = { path = "../tinytools", version = "0.5.0" }
 tracing = { workspace = true, optional = true }
 
 [dev-dependencies]

crates/tinytools-std/Cargo.toml

@@ -13,10 +13,15 @@ publish = false
 [dependencies]
 anyhow = { workspace = true }
 async-trait = { workspace = true }
+# Structured diagnostics for DNS validation and SSRF refusals.
 log = "0.4"
+# Async path locks must remain non-blocking while callers hold them across I/O.
 parking_lot = "0.12"
+# Safe effective-credential executable checks for Unix PATH candidates.
+rustix = { version = "1", default-features = false, features = ["fs"] }
 serde_json = { workspace = true }
-tinytools = { path = "../tinytools", version = "0.4.1" }
+tinytools = { path = "../tinytools", version = "0.5.0" }
+# `spawn_blocking` keeps synchronous system DNS resolution off async executor threads.
 tokio = { version = "1", default-features = false, features = ["rt", "sync"] }
 tracing = { workspace = true }
 

crates/tinytools-std/README.md

@@ -4,8 +4,8 @@ Host-independent building blocks for agent tools, extracted from OpenHuman.
 
 | Module | What it is |
 | --- | --- |
-| `file_state` | Process-wide read/write stamps so parallel agents detect stale or partial reads before overwriting a file. The host decides whether the guard is on (`init_global(enabled)`). |
-| `url_guard` | URL validation with SSRF checks; DNS validation returns addresses callers must pin for the connection. |
+| `file_state` | Process-wide read/write stamps so parallel agents detect stale or partial reads before overwriting a file. The host decides whether the guard is on (`init_global(enabled)`); read tools pass `record_read` an `Instant` captured before their I/O. |
+| `url_guard` | URL validation with SSRF checks for outbound network tools. `validate_url_with_dns_check` returns a `ValidatedUrl` whose vetted `addrs` the caller must pin its HTTP client to (e.g. `reqwest`'s `resolve_to_addrs`); re-resolving the hostname reopens DNS rebinding. |
 | `detect_tools` | `find_on_path` and the read-only `detect_tools` tool. |
 
 No enforcement of host policy lives here; the crate only supplies mechanisms.

crates/tinytools-std/src/detect_tools/mod.rs

@@ -34,50 +34,76 @@ impl Default for DetectToolsTool {
     }
 }
 
+/// Fallback executable extensions when Windows has no `PATHEXT` set.
+const DEFAULT_PATHEXT: &str = ".EXE;.CMD;.BAT";
+
 /// Locate `name` on `$PATH`, honoring `PATHEXT` on Windows. Returns the first
 /// matching executable path, or `None` if not found.
 #[must_use]
 pub fn find_on_path(name: &str) -> Option<PathBuf> {
     let path = std::env::var_os("PATH")?;
-    let exts: Vec<String> = {
-        #[cfg(windows)]
-        {
-            std::env::var("PATHEXT")
-                .unwrap_or_else(|_| ".EXE;.CMD;.BAT".to_string())
-                .split(';')
-                .map(std::string::ToString::to_string)
-                .collect()
-        }
-        #[cfg(not(windows))]
-        {
-            vec![String::new()]
-        }
-    };
+    let pathext = cfg!(windows)
+        .then(|| std::env::var("PATHEXT").unwrap_or_else(|_| DEFAULT_PATHEXT.to_string()));
+    let file_names = candidate_file_names(name, pathext.as_deref());
     for dir in std::env::split_paths(&path) {
-        for ext in &exts {
-            let candidate = dir.join(format!("{name}{ext}"));
-            if candidate.is_file() {
-                // On Unix a plain `is_file()` can match a non-executable file and
-                // falsely report the tool as available; require the exec bit.
-                #[cfg(unix)]
-                {
-                    use std::os::unix::fs::PermissionsExt;
-                    let is_exec = std::fs::metadata(&candidate)
-                        .is_ok_and(|m| m.permissions().mode() & 0o111 != 0);
-                    if is_exec {
-                        return Some(candidate);
-                    }
-                }
-                #[cfg(not(unix))]
-                {
-                    return Some(candidate);
-                }
+        for file_name in &file_names {
+            let candidate = dir.join(file_name);
+            if is_executable_file(&candidate) {
+                return Some(candidate);
             }
         }
     }
     None
 }
 
+/// Whether `path` names a regular file the current process can execute.
+fn is_executable_file(path: &std::path::Path) -> bool {
+    if !path.is_file() {
+        return false;
+    }
+    // On Unix, checking mode bits alone ignores the current process's
+    // effective credentials and supplementary groups.
+    #[cfg(unix)]
+    {
+        rustix::fs::accessat(
+            rustix::fs::CWD,
+            path.as_os_str().as_encoded_bytes(),
+            rustix::fs::Access::EXEC_OK,
+            rustix::fs::AtFlags::EACCESS,
+        )
+        .is_ok()
+    }
+    #[cfg(not(unix))]
+    {
+        true
+    }
+}
+
+/// The file names to probe in each `PATH` directory for `name`.
+///
+/// `pathext` is the Windows `PATHEXT` list (`;`-separated), or `None` on
+/// platforms that run a bare file name. A name that already ends in one of
+/// those extensions (compared case-insensitively, as Windows does) is probed
+/// unchanged; any other name is probed once per extension.
+fn candidate_file_names(name: &str, pathext: Option<&str>) -> Vec<String> {
+    let extensions: Vec<&str> = pathext
+        .into_iter()
+        .flat_map(|list| list.split(';'))
+        .filter(|ext| !ext.is_empty())
+        .collect();
+    let lower_name = name.to_ascii_lowercase();
+    let has_extension = extensions
+        .iter()
+        .any(|ext| lower_name.ends_with(&ext.to_ascii_lowercase()));
+    if extensions.is_empty() || has_extension {
+        return vec![name.to_string()];
+    }
+    extensions
+        .iter()
+        .map(|ext| format!("{name}{ext}"))
+        .collect()
+}
+
 #[async_trait]
 impl Tool for DetectToolsTool {
     fn name(&self) -> &'static str {