test(agent/tools): cover Crawler._invoke runtime path

Address review feedback on #16415: add direct regression tests for the
restored execution path (not just CrawlerParam). Using a mocked crawl
result and stubbed SSRF guard:

- _invoke(query=...) returns the page content and writes it to
  formalized_content.
- an empty query short-circuits without crawling.
- an unsafe URL is rejected ("URL not valid" / _ERROR) before any crawl.

Author: immuhammadfurqan

test/unit_test/agent/component/test_crawler.py

@@ -14,12 +14,26 @@
 #  limitations under the License.
 #
 
+import contextlib
+
 import pytest
 
 # Crawler imports the `crawl4ai` SDK at module load; skip where absent.
 pytest.importorskip("crawl4ai")
 
-from agent.tools.crawler import CrawlerParam  # noqa: E402
+from agent.tools.crawler import Crawler, CrawlerParam  # noqa: E402
+
+
+def _make_tool():
+    # Bypass the canvas-bound __init__ (mirrors test_pubmed_unit.py) and stub the
+    # canvas-touching helpers so we can exercise _invoke's execution path.
+    crawler = Crawler.__new__(Crawler)
+    crawler._param = CrawlerParam()
+    crawler.check_if_canceled = lambda *a, **k: False
+    out = {}
+    crawler.set_output = lambda k, v: out.__setitem__(k, v)
+    crawler.output = lambda k=None: (out.get(k) if k else out)
+    return crawler, out
 
 
 def test_param_instantiates():
@@ -48,3 +62,63 @@ def test_check_rejects_invalid_extract_type():
     param.extract_type = "pdf"
     with pytest.raises(ValueError):
         param.check()
+
+
+def test_invoke_returns_content_and_sets_formalized_content(monkeypatch):
+    # Regression for the restored runtime path: _invoke(query=...) must fetch
+    # the page, return its content, and write it to formalized_content.
+    import common.ssrf_guard as ssrf
+
+    monkeypatch.setattr(ssrf, "assert_url_is_safe", lambda url: ("example.com", "93.184.216.34"))
+    monkeypatch.setattr(ssrf, "pin_dns_global", lambda *a, **k: contextlib.nullcontext())
+
+    crawler, out = _make_tool()
+
+    async def fake_get_web(url):
+        return "PAGE CONTENT for " + url
+
+    crawler.get_web = fake_get_web
+
+    result = crawler._invoke(query="http://example.com")
+
+    assert result == "PAGE CONTENT for http://example.com"
+    assert out["formalized_content"] == "PAGE CONTENT for http://example.com"
+
+
+def test_invoke_empty_query_returns_empty():
+    # Empty query short-circuits without crawling.
+    crawler, out = _make_tool()
+    called = []
+
+    async def fake_get_web(url):
+        called.append(url)
+        return "should not be used"
+
+    crawler.get_web = fake_get_web
+
+    assert crawler._invoke(query="") == ""
+    assert out.get("formalized_content") == ""
+    assert called == []
+
+
+def test_invoke_rejects_unsafe_url(monkeypatch):
+    # An unsafe URL is rejected before any crawl is attempted.
+    import common.ssrf_guard as ssrf
+
+    def _reject(url):
+        raise ValueError("blocked")
+
+    monkeypatch.setattr(ssrf, "assert_url_is_safe", _reject)
+
+    crawler, out = _make_tool()
+    called = []
+
+    async def fake_get_web(url):
+        called.append(url)
+        return "should not be used"
+
+    crawler.get_web = fake_get_web
+
+    assert crawler._invoke(query="http://169.254.169.254/") == "URL not valid"
+    assert out.get("_ERROR") == "URL not valid"
+    assert called == []