🪢 fix: Action Domain Encoding Collision for HTTPS URLs

[danny-avila]

Summary

Fixed a base64 key collision in domainParser where all https:// (and http://) domains produced the same 10-character truncated key (aHR0cHM6Ly) due to the protocol prefix dominating the ENCODED_DOMAIN_LENGTH-truncated base64 output. This caused tool name collisions for agents and assistants with multiple actions pointing to different domains. Added full backward-compatibility support for actions stored before this fix.

• Fixed domainParser to strip the protocol prefix before base64-encoding, so the key is derived from the hostname rather than the full URL.
• Added legacyDomainEncode to reproduce the old (broken) encoding, used exclusively for backward-compatible matching of actions stored before this fix.
• Updated loadActionToolsForExecution to register both new and legacy normalized domain keys in normalizedToDomain, with legacyNormalized stored in processedActionSets to avoid redundant recomputation in the per-tool fallback path.
• Updated getActionToolDefinitions to match stored tool names against both new and legacy encodings; pre-normalized actionToolNames into a Set<string> before the loop, replacing O(signatures × tools) .some() + .replace() with O(1) .has() lookups.
• Fixed processRequiredActions (assistants execution path) — it previously built domainMap with new-encoding keys only, silently dropping all tool calls for assistants with legacy-encoded tools stored in OpenAI. Replaced with domainLookupMap carrying both encodings; function name is now extracted via matchedKey rather than the canonical domain.
• Fixed loadAgentTools definitionsOnly=false path with the same domainLookupMap + matchedKey pattern.
• Fixed pre-existing bug in processRequiredActions where the !actionSets.length guard re-triggered on every missing-tool iteration after the array was reassigned to a plain object. Replaced with a null-initialized actionSetsData variable and a null-check.
• Fixed agent and assistant save routes to filter tools matching both new and legacy domain encodings, preventing stale tool entries when an action's encoding changes on update.
• Fixed agent and assistant delete routes to use the domain stored verbatim in the actions array rather than re-encoding it through domainParser, which was producing incorrect keys and leaving orphaned tool entries.
• Made legacyDomainEncode synchronous — it contains no I/O or async operations.
• Hoisted domainSeparatorRegex to module level in ToolService.js.
• Renamed the domain variable to encodedDomain in both action route save handlers to separate the raw URL from the encoded key.
• Renamed shouldRemoveTool to shouldRemoveAgentTool / shouldRemoveAssistantTool to make the distinct data-shape guards explicit.
• Renamed normalizedToDomain to domainLookupMap in the two functions where map keys are raw encoded domains rather than normalized ones.
• Removed stripProtocol from ActionService exports; it is an internal helper whose behavior is fully covered by the domainParser protocol-stripping tests.
• Updated validateAndUpdateTool to match actions where metadata.domain carries an https:// prefix against tool names carrying only the bare hostname.
• Rewrote ActionService.spec.js with 50 tests covering: domainParser encode/decode round-trips, protocol stripping, unicode hostnames, legacyDomainEncode synchronicity and collision behavior, validateAndUpdateTool matching logic, backward-compatible tool name matching at both definition and execution phases, save-route cleanup of old and new encodings, delete-route domain extraction, and the multi-action collision scenario.

Change Type

• Bug fix (non-breaking change which fixes an issue)

Testing

The collision fix and backward-compatibility layer are covered by the rewritten unit test suite in api/server/services/ActionService.spec.js (50 tests). The following scenarios are explicitly exercised:

• Two https:// actions on the same agent previously produced identical tool names; they now produce distinct keys.
• A legacy-encoded tool name (e.g., getPeople---aHR0cHM6Ly) resolves correctly to the right action and function name via the domainLookupMap/matchedKey pattern.
• A new-encoded tool name resolves correctly through the same path.
• Save routes remove tools matching both the new and legacy encoding of the updated domain.
• Delete routes extract the domain verbatim from the stored actions array without re-encoding it.
• domainParser with https:// input and bare-hostname input produce identical output.
• Unicode hostnames encode, decode, and round-trip correctly.

Test Configuration: Run from the api workspace:

cd api && npx jest ActionService.spec

Checklist

• My code adheres to this project's style guidelines
• I have performed a self-review of my own code
• I have commented in any complex areas of my code
• My changes do not introduce new warnings
• I have written tests demonstrating that my changes are effective or that my feature works
• Local unit tests pass with my changes

[Copilot]

Pull request overview

This PR updates how Action “domains” are encoded into tool names to prevent collisions (notably those caused by base64 prefixes when encoding full https://... URLs), while adding backward-compatibility so previously-saved agent/assistant tool names continue to match.

Changes:

• Update domainParser() to encode based on protocol-stripped inputs and introduce legacyDomainEncode() for compatibility with previously stored tool names.
• Extend tool-definition matching and execution-time tool resolution to recognize both new and legacy encoded domain variants.
• Update agent/assistant action routes to remove/replace tools using both new and legacy encodings during action updates.

Reviewed changes

Copilot reviewed 5 out of 5 changed files in this pull request and generated 5 comments.

Show a summary per file

File	Description
api/server/services/ToolService.js	Adds legacy-aware matching for action tool definitions and execution-time tool loading.
api/server/services/ActionService.js	Implements protocol-stripping encoding changes and adds legacyDomainEncode() / stripProtocol().
api/server/services/ActionService.spec.js	Expands tests around new/legacy encoding behavior and matching logic.
api/server/routes/assistants/actions.js	Removes old tools using both new and legacy encoded domain names on action upsert.
api/server/routes/agents/actions.js	Same as assistants route, but for agent actions tool string lists.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

You can also share your feedback on Copilot code review. Take the survey.