Description

createAnthropicVertexStreamFnForModel derives a baseURL from model.baseUrl and passes it directly into the Anthropic Vertex SDK constructor.

• Input: model.baseUrl (comes from model configuration; ModelDefinitionConfig supports baseUrl?: string)
• Transformation: resolveAnthropicVertexSdkBaseUrl() accepts arbitrary strings; on parse failure it returns the raw trimmed value
• Sink: new deps.AnthropicVertex({ ..., baseURL }) causes the SDK to send the full request payload (prompts/messages/metadata) to that URL

If an attacker can influence model.baseUrl (e.g., per-tenant/provider config, plugin-supplied models, or any user-editable model registry), they can:

• Perform SSRF to internal services by pointing baseUrl at internal hosts/IPs
• Exfiltrate sensitive prompts/attachments/metadata to an attacker-controlled endpoint
• Potentially leverage any credentials/headers the SDK attaches for Vertex auth in outbound requests

Vulnerable code:

const client = new deps.AnthropicVertex({
  region,
  ...(baseURL ? { baseURL } : {}),
  ...(projectId ? { projectId } : {}),
});
...
resolveAnthropicVertexSdkBaseUrl(model.baseUrl)

Recommendation

Treat model.baseUrl as untrusted and enforce an SSRF-safe policy before passing it to the SDK.

Minimum hardening:

• Require https: (and optionally http: only for localhost/dev builds)
• Block localhost/private IP ranges and special hostnames (e.g., metadata.google.internal)
• Prefer an allowlist of expected Vertex hosts (e.g., *.aiplatform.googleapis.com) and explicitly allow only known proxy domains

Example (conceptual):

import { isBlockedHostnameOrIp } from "../../src/infra/net/ssrf.js";

function validateVertexBaseUrl(raw?: string): string | undefined {
  if (!raw?.trim()) return undefined;
  const url = new URL(raw);
  if (url.protocol !== "https:") throw new Error("Vertex baseUrl must be https");
  if (isBlockedHostnameOrIp(url.hostname)) throw new Error("Blocked baseUrl host");
  ​// optional allowlist
  if (!url.hostname.endsWith("aiplatform.googleapis.com") && url.hostname !== "proxy.example.com") {
    throw new Error("Unapproved baseUrl host");
  }
  return url.toString().replace(/\/+$/, "");
}

const baseURL = validateVertexBaseUrl(model.baseUrl);
const client = new AnthropicVertex({ region, ...(baseURL ? { baseURL } : {}) });

If possible, route SDK HTTP through the project’s existing fetchWithSsrFGuard/pinned-dispatcher infrastructure so all outbound requests share the same SSRF protections.

Description

createPersistCronSessionEntry now clones the entire in-memory SessionEntry via globalThis.structuredClone() to create an isolated per-run snapshot. This can crash the cron process with a DataCloneError if the session entry contains non-structured-cloneable values.

Why this is plausible in this codebase:

• SessionEntry.skillsSnapshot is typed to include resolvedSkills?: Skill[].
• Skill objects (and related runtime contexts) commonly include functions/methods and other non-cloneable properties.
• persistCronSkillsSnapshotIfChanged writes skillsSnapshot into cronSession.sessionEntry, so the persisted entry can include resolvedSkills.
• When createPersistCronSessionEntry runs, it clones the whole entry before persisting; any non-cloneable value will throw and can prevent the session store from being updated, potentially causing a persistent crash loop for cron runs.

Vulnerable code:

function cloneSessionEntry(entry: MutableCronSessionEntry): MutableCronSessionEntry {
  return globalThis.structuredClone(entry);
}
...
const runSessionEntry = cloneSessionEntry(params.cronSession.sessionEntry);

Recommendation

Avoid cloning the full in-memory SessionEntry with structuredClone when it may contain runtime-only, non-serializable/non-cloneable fields (notably skillsSnapshot.resolvedSkills). Instead, persist a serialization-safe snapshot.

Options:

1. Strip runtime-only fields before cloning/persisting:

function toPersistableSessionEntry(entry: SessionEntry): SessionEntry {
  const next = { ...entry };
  if (next.skillsSnapshot?.resolvedSkills) {
    next.skillsSnapshot = { ...next.skillsSnapshot, resolvedSkills: undefined };
  }
  return next;
}

const runSessionEntry = toPersistableSessionEntry(params.cronSession.sessionEntry);

2. Or, if the store is JSON-based, clone via JSON round-trip (and handle errors):

const runSessionEntry = JSON.parse(JSON.stringify(params.cronSession.sessionEntry)) as SessionEntry;

Additionally, consider wrapping cloning in try/catch and falling back to a safer snapshot to prevent cron crash loops.