Require http access permissions

.changeset/old-wolves-boil.md

@@ -0,0 +1,5 @@
+---
+"@plotday/sdk": minor
+---
+
+Changed: BREAKING: Agents are now restricted to the http URLs they request via tools.enableInternet().

sdk/cli/templates/AGENTS.template.md

@@ -59,6 +59,8 @@ constructor(id: string, protected tools: Tools) {
 
 All `tools.get()` calls must occur in the constructor as they are used for dependency analysis.
 
+IMPORTANT: http access is restricted to URLs requested via `tools.enableInternet([url1, url2, ...])` in the constructor. Wildcards are supported. Use `tools.enableInternet(['*'])` if full access is needed.
+
 ### Built-in Tools (Always Available)
 
 For complete API documentation of built-in tools including all methods, types, and detailed examples, see the TypeScript definitions in your installed package at `node_modules/@plotday/sdk/src/tools/*.ts`. Each tool file contains comprehensive JSDoc documentation.

sdk/src/agent.ts

@@ -401,4 +401,44 @@ export interface Tools {
    * @throws When the tool is not found or not properly configured
    */
   get<T extends ITool>(ToolClass: ToolConstructor<T>): T;
+
+  /**
+   * Enables HTTP access to the specified URLs for this agent or tool.
+   *
+   * **IMPORTANT**: This method must be called in the Agent or Tool constructor
+   * to request HTTP access permissions. Without calling this method, all outbound
+   * HTTP requests (fetch, etc.) will be blocked.
+   *
+   * @param urls - Array of URL patterns to allow. Supports wildcards:
+   *   - `*` - Allow access to all URLs
+   *   - `https://*.example.com` - Allow access to all subdomains
+   *   - `https://api.example.com/*` - Allow access to all paths on the domain
+   *   - `https://api.example.com/v1/*` - Allow access to specific path prefix
+   *
+   * @example
+   * ```typescript
+   * class MyAgent extends Agent<MyAgent> {
+   *   constructor(id: string, tools: Tools) {
+   *     super(id, tools);
+   *     // Request HTTP access to specific APIs
+   *     tools.enableInternet([
+   *       'https://api.github.com/*',
+   *       'https://api.openai.com/*'
+   *     ]);
+   *   }
+   * }
+   * ```
+   *
+   * @example
+   * ```typescript
+   * class MyTool extends Tool<MyTool> {
+   *   constructor(id: string, tools: Tools) {
+   *     super(id, tools);
+   *     // Request unrestricted HTTP access
+   *     tools.enableInternet(['*']);
+   *   }
+   * }
+   * ```
+   */
+  enableInternet(urls: string[]): void;
 }