Inapps/web/client/src/app/project/[id]/_components/right-panel/chat-tab/chat-messages/message-content/tool-call-simple.tsxaround lines 198 to 209, the const params13 declared inside theCLONE_WEBSITE_TOOL_NAME case is leaking into other switch cases; wrap the casebody in its own block so the declaration is scoped locally (i.e., add an opening{ immediately after the case label and a closing } before the case'sreturn/break), keep the existing try/catch/returns unchanged, and ensure noextra fall-through occurs.

In apps/web/client/src/components/tools/handlers/web.ts around lines 74-76 (andalso at line 89), the asset directory is not branch-scoped and paths areconstructed unsafely; update baseDir to be branch-scoped (e.g. include asanitized/validated branchId segment such as public/cloned-assets/<branchId>/)and replace raw string concatenation with safe path construction (use path.joinor equivalent) to prevent path traversal and collisions; ensure any pathsegments are properly quoted/escaped when used in shell or file APIs andvalidate/sanitize branchId to allow only safe characters.

In apps/web/client/src/components/tools/handlers/web.ts around lines 91-105, thecode currently interpolates untrusted asset.url into a shell command (riskingcommand injection and SSRF), forces a .png extension, and stores a file systempath instead of a public web path; to fix, stop invoking curl via shellinterpolation and instead fetch assets using a safe HTTP client or spawn asubprocess with arguments (no shell), validate and allow only safe schemes(http/https) and disallow internal/loopback IPs/hostnames to mitigate SSRF,determine the correct extension from the response Content-Type or the URL path(and apply an allowlist if needed), ensure filenames are sanitized anddeduplicated (e.g., append a short hash of the URL), write to the filesystemunder the public dir, then set fileLocation to the web-accessible path bystripping the leading public/ prefix.

-import { CLONE_WEBSITE_DESIGN_PROMPT } from '@onlook/ai/src/prompt/clone';-import { DesignSchema } from '@onlook/models/tools';+import { CLONE_WEBSITE_DESIGN_PROMPT } from '@onlook/ai';+import { DesignSchema } from '@onlook/models';

#!/bin/bash# Check if these exports are available from the package rootsrg -n"export.*CLONE_WEBSITE_DESIGN_PROMPT" packages/ai/src/index.ts packages/ai/index.tsrg -n"export.*DesignSchema" packages/models/src/index.ts packages/models/index.ts

#!/usr/bin/env bashset -eecho"Root directories:"ls -1.echo -e"\nApps directory (apps/*):"ls -1 appsecho -e"\nPackages directory (packages/*):"ls -1 packages||echo"No packages directory at root"echo -e"\nSearching for @onlook/ai in package.json:"rg -n'"name"\s*:\s*"@onlook/ai"' -g"*/package.json"echo -e"\nSearching for @onlook/models in package.json:"rg -n'"name"\s*:\s*"@onlook/models"' -g"*/package.json"AI_PKG_DIR=$(dirname"$(rg -l'"name"\s*:\s*"@onlook/ai"' -g"*/package.json"| head -n1)")MODELS_PKG_DIR=$(dirname"$(rg -l'"name"\s*:\s*"@onlook/models"' -g"*/package.json"| head -n1)")echo -e"\nAI package directory:$AI_PKG_DIR"echo"Models package directory:$MODELS_PKG_DIR"echo -e"\nListing index files in AI package:"find"$AI_PKG_DIR" -type f\( -name"index.ts" -o -name"src/index.ts"\)echo -e"\nListing index files in Models package:"find"$MODELS_PKG_DIR" -type f\( -name"index.ts" -o -name"src/index.ts"\)echo -e"\nSearching for export of CLONE_WEBSITE_DESIGN_PROMPT in AI index file(s):"rg -n"export.*CLONE_WEBSITE_DESIGN_PROMPT"$(find"$AI_PKG_DIR" -type f\( -name"index.ts" -o -name"src/index.ts"\))echo -e"\nSearching for export of DesignSchema in Models index file(s):"rg -n"export.*DesignSchema"$(find"$MODELS_PKG_DIR" -type f\( -name"index.ts" -o -name"src/index.ts"\))

#!/usr/bin/env bashset -eecho"=== packages/ai/package.json ==="cat packages/ai/package.jsonecho -e"\n=== packages/models/package.json ==="cat packages/models/package.jsonecho -e"\n=== files under packages/ai/src/prompt ==="if [-d packages/ai/src/prompt ];then  find packages/ai/src/prompt -type felseecho"No packages/ai/src/prompt directory"fiecho -e"\n=== definition of CLONE_WEBSITE_DESIGN_PROMPT in ai package ==="rg -n"CLONE_WEBSITE_DESIGN_PROMPT" -g"packages/ai/**"||trueecho -e"\n=== packages/ai/src/index.ts (first 200 lines) ==="if [-f packages/ai/src/index.ts ];then  sed -n'1,200p' packages/ai/src/index.tselseecho"packages/ai/src/index.ts not found"fiecho -e"\n=== packages/ai/index.ts (first 200 lines) ==="if [-f packages/ai/index.ts ];then  sed -n'1,200p' packages/ai/index.tselseecho"packages/ai/index.ts not found"fiecho -e"\n=== files under packages/models/src/tools ==="if [-d packages/models/src/tools ];then  find packages/models/src/tools -type felseecho"No packages/models/src/tools directory"fiecho -e"\n=== definition of DesignSchema in models package ==="rg -n"DesignSchema" -g"packages/models/**"||trueecho -e"\n=== packages/models/src/index.ts (first 200 lines) ==="if [-f packages/models/src/index.ts ];then  sed -n'1,200p' packages/models/src/index.tselseecho"packages/models/src/index.ts not found"fiecho -e"\n=== packages/models/index.ts (first 200 lines) ==="if [-f packages/models/index.ts ];then  sed -n'1,200p' packages/models/index.tselseecho"packages/models/index.ts not found"fi

In apps/web/client/src/server/api/routers/code.ts around lines 11-12 the fileuses deep imports ('@onlook/ai/src/prompt/clone' and '@onlook/models/tools');change these to use the package root exports (e.g., importCLONE_WEBSITE_DESIGN_PROMPT from '@onlook/ai' and DesignSchema from'@onlook/models') so consumers rely on the package export surface instead ofinternal paths, and update any named vs default import shape to match thepackage root exports.

In apps/web/client/src/server/api/routers/code.ts around lines 170 to 181, thetwo scrapeUrl calls hardcode waitFor: 2000 which is brittle; make the Firecrawltimeout configurable and robust by accepting an optional timeout (e.g.,timeoutMs) from the request input or reading a service-level config/env value,validate and clamp it to a safe min/max, and pass that value into both scrapeUrlcalls; if no timeout provided fall back to a sensible default (e.g., 2000), andconsider supporting an adaptive strategy (e.g., retry with a larger timeout oruse a networkIdle option if available) so slow pages are handled withoutindefinite waits.

In apps/web/client/src/server/api/routers/code.ts around lines 187 to 240, theimage extraction block should validate and filter candidates before adding them:only accept http(s) absolute URLs (reject data:, mailto:, #"json" data-turbo="false" action="/onlook-dev/onlook/pull/2820/review_comment/2336094356" accept-charset="UTF-8" method="post">