boxcars 0.2.3 → 0.2.4

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: ea9c5df0584f588d618c22fc44f8bba2638c0946ba32cea8487429ad6df694f5
-  data.tar.gz: a7cd6609da5d63c1b41763fc7c6e8b4e1c8df41992fd133d0bf359b28d50dd0c
+  metadata.gz: 6a9d94c026cf616e590d293d4ef2b0c655ddc6e3ae40115b36ebbfbbee1cb9a4
+  data.tar.gz: 549a877fdf1b329f402f3a159420bc6599677bcd40f2776c8bea57fade099b14
 SHA512:
-  metadata.gz: aac8bd34e6ddca629d26ff0cb892e46de30e1f20db188b56477422e5526e03c80a22e1b06ab7d8263e8db067db6ec1966f34450ab63e98cea3e857aa7eb27286
-  data.tar.gz: 10ce3be58a020a5de80c27fdf46cbd7811afc45ac28e0712479b113eb6a34ca6a2f7043711659bb4b0a152e0981ded5a8f76fe0704f1a89751b3c8ec0a843ea8
+  metadata.gz: '082a569848bf46276dadf9e2461e1bded9e107a2ba344fed06382c98548aa78b5012c63cdeeb27f394783b25bb6dea6d6bd10382d1f0113b8de548a366ca2b4e'
+  data.tar.gz: 25452562685c57ba7ded3de67a4c27f7d15e9373f5370f061d75d9d4f32e4e1836e9ea6947bfef19d7a32fe6c130d4f816fe5d9529ea1db5f38f7b0bb2837ccb

data/Gemfile.lock

@@ -1,7 +1,7 @@
 PATH
   remote: .
   specs:
-    boxcars (0.2.3)
+    boxcars (0.2.4)
       google_search_results (~> 2.2)
       ruby-openai (~> 3.0)
 

data/README.md

@@ -11,7 +11,7 @@
   <a href="https://github.com/BoxcarsAI/boxcars/blob/main/LICENSE.txt"><img src="https://img.shields.io/badge/license-MIT-informational" alt="License"></a>
 </p>
 
-Boxcars is a gem that enables you to create new systems with AI composability, using various concepts such as OpenAI, Search, SQL, Rails Active Record and more. This can even be extended with your concepts as well.(including your concepts).
+Boxcars is a gem that enables you to create new systems with AI composability, using various concepts such as OpenAI, Search, SQL, Rails Active Record and more. This can even be extended with your concepts as well (including your concepts).
 
 This gem was inspired by the popular Python library Langchain. However, we wanted to give it a Ruby spin and make it more user-friendly for beginners to get started.
 
@@ -23,6 +23,11 @@ All of these concepts are in a module named Boxcars:
 - Prompt - used by an Engine to generate text results. Most of the Boxcars have built-in prompts, so you only need to worry about these if you are extending the system.
 - Engine - an entity that generates text from a Prompt. OpenAI's LLM text generator is the default Engine if no other is specified.
 
+## Security
+Currently, our system is designed for individuals who already possess administrative privileges for their project. It is likely possible to manipulate the system's prompts to carry out malicious actions, but if you already have administrative access, you can perform such actions without requiring boxcars in the first place.
+
+*Note:* We are actively seeking ways to improve our system's ability to identify and prevent any nefarious attempts from occurring. If you have any suggestions or recommendations, please feel free to share them with us by either finding an existing issue or creating a new one and providing us with your feedback.
+
 ## Installation
 
 Add this line to your application's Gemfile:
@@ -66,10 +71,10 @@ Produces:
 ```text
 > Entering Calculator#run
 what is pi to the forth power divided by 22.1?
-RubyREPL: puts(Math::PI**4 / 22.1)
+RubyREPL: puts (Math::PI**4)/22.1
 Answer: 4.407651178009159
 
-4.407651178009159
+{"status":"ok","answer":"4.407651178009159","explanation":"Answer: 4.407651178009159","code":"puts (Math::PI**4)/22.1"}
 < Exiting Calculator#run
 4.407651178009159
 ```
@@ -94,27 +99,34 @@ Here is what we have so far, but please put up a PR with your new ideas.
 # run a Train for a calculator, and search using default Engine
 boxcars = [Boxcars::Calculator.new, Boxcars::Serp.new]
 train = Boxcars.train.new(boxcars: boxcars)
-puts train.run "What is pi times the square root of the average temperature in Austin TX in January?"
+train.run "What is pi times the square root of the average temperature in Austin TX in January?"
 ```
 Produces:
 ```text
 > Entering Zero Shot#run
 What is pi times the square root of the average temperature in Austin TX in January?
+Thought: We need to find the average temperature in Austin TX in January and then multiply it by pi and the square root of that value. We can use a search engine to find the average temperature and a calculator to perform the multiplication. 
 Question: Average temperature in Austin TX in January
 Answer: increase from 62°F to 64°F
-#Observation: increase from 62°F to 64°F
+Observation: increase from 62°F to 64°F
+Thought: The average temperature in Austin TX in January is around 63°F.
 > Entering Calculator#run
-64°F x pi
-RubyREPL: puts (64 * Math::PI).round(2)
-Answer: 201.06
+pi * sqrt(63)
+RubyREPL: puts(Math::PI * Math.sqrt(63))
+Answer: 24.935618646198247
 
-201.06
+{"status":"ok","answer":"24.935618646198247","explanation":"Answer: 24.935618646198247","code":"puts(Math::PI * Math.sqrt(63))"}
 < Exiting Calculator#run
-#Observation: 201.06
-I now know the final answer
-Final Answer: 201.06
+Observation: 24.935618646198247
+The result of pi times the square root of the average temperature in Austin TX in January is approximately 24.94.
+
+Final Answer: 24.94
+
+Next Actions:
+1. What is the average temperature in Austin TX in July?
+2. What is the formula for calculating the area of a circle?
+3. What is the value of pi to 10 decimal places?
 < Exiting Zero Shot#run
-201.06
 ```
 ### More Examples
 See [this](https://github.com/BoxcarsAI/boxcars/blob/main/notebooks/boxcars_examples.ipynb) Jupyter Notebook for more examples.

data/lib/boxcars/boxcar/active_record.rb

@@ -76,7 +76,7 @@ module Boxcars
       ::ActiveRecord::Base.transaction do
         begin
           result = yield
-        rescue ::NameError, ::Error => e
+        rescue SecurityError, ::NameError, ::Error => e
           Boxcars.error("Error while running code: #{e.message[0..60]} ...", :red)
           runtime_exception = e
         end
@@ -93,13 +93,22 @@ module Boxcars
       bad_words = %w[commit drop_constraint drop_constraint! drop_extension drop_extension! drop_foreign_key drop_foreign_key! \
                      drop_index drop_index! drop_join_table drop_join_table! drop_materialized_view drop_materialized_view! \
                      drop_partition drop_partition! drop_schema drop_schema! drop_table drop_table! drop_trigger drop_trigger! \
-                     drop_view drop_view! eval execute reset revoke rollback truncate].freeze
+                     drop_view drop_view! eval instance_eval send system execute reset revoke rollback truncate \
+                     encrypted_password].freeze
       without_strings = code.gsub(/('([^'\\]*(\\.[^'\\]*)*)'|"([^"\\]*(\\.[^"\\]*)*"))/, 'XX')
-      word_list = without_strings.split(/[.,()]/)
+
+      if without_strings.include?("`")
+        Boxcars.info "code included possibly destructive backticks #{code}", :red
+        return false
+      end
+
+      word_list = without_strings.split(/[.,() :]/)
+
+      puts word_list.inspect
 
       bad_words.each do |w|
         if word_list.include?(w)
-          Boxcars.info "code included destructive instruction: #{w} #{code}", :red
+          Boxcars.info "code included possibly destructive instruction: '#{w}' in #{code}", :red
           return false
         end
       end
@@ -176,7 +185,7 @@ module Boxcars
       have_approval = false
       begin
         have_approval = approved?(changes_code, code)
-      rescue NameError, ::Error => e
+      rescue NameError, Error => e
         return Result.new(status: :error, explanation: error_message(e, "ARChanges"), changes_code: changes_code)
       end
 
@@ -185,7 +194,9 @@ module Boxcars
       begin
         output = clean_up_output(run_active_record_code(code))
         Result.new(status: :ok, answer: output, explanation: "Answer: #{output.to_json}", code: code)
-      rescue NameError, ::Error => e
+      rescue SecurityError => e
+        raise e
+      rescue ::StandardError => e
         Result.new(status: :error, answer: nil, explanation: error_message(e, "ARCode"), code: code)
       end
     end

data/lib/boxcars/boxcar/engine_boxcar.rb

@@ -100,7 +100,7 @@ module Boxcars
       end
       Boxcars.error answer.to_json, :red
       { output_key => "Error: #{answer}" }
-    rescue Boxcars::ConfigurationError => e
+    rescue Boxcars::ConfigurationError, Boxcars::SecurityError => e
       raise e
     rescue Boxcars::Error => e
       Boxcars.error e.message, :red

data/lib/boxcars/boxcar/google_search.rb

@@ -49,8 +49,8 @@ module Boxcars
       [:answer_box, :snippet_highlighted_words, 0],
       %i[sports_results game_spotlight],
       %i[knowledge_graph description],
-      [:organic_results, 0, :snippet_highlighted_words, 0],
-      [:organic_results, 0, :snippet]
+      [:organic_results, 0, :snippet],
+      [:organic_results, 0, :snippet_highlighted_words, 0]
     ].freeze
 
     def find_answer(res)

data/lib/boxcars/train/zero_shot.rb

@@ -50,7 +50,7 @@ module Boxcars
         # the thought should be the frist line here if it doesn't start with "Action:"
         thought = engine_output.split(/\n+/).reject(&:empty?).first
         Boxcars.debug("Thought: #{thought}", :yellow)
-        regex = /Action: (?<action>.*)\n+Action Input: (?<action_input>.*)/
+        regex = /Action(?<extra>[\s\d]*): (?<action>.+?)\n+Action Input:(?<action_input>.+)/m
         match = regex.match(engine_output)
 
         # we have an unexpected output from the engine

data/lib/boxcars/train.rb

@@ -196,6 +196,8 @@ module Boxcars
           begin
             observation = boxcar.run(output.boxcar_input)
             return_direct = boxcar.return_direct
+          rescue Boxcars::ConfigurationError, Boxcars::SecurityError => e
+            raise e
           rescue StandardError => e
             Boxcars.error "Error in #{boxcar.name} boxcar#call: #{e}", :red
             observation = "Error - #{e}, correct and try again."

data/lib/boxcars/version.rb

@@ -2,5 +2,5 @@
 
 module Boxcars
   # The current version of the gem.
-  VERSION = "0.2.3"
+  VERSION = "0.2.4"
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: boxcars
 version: !ruby/object:Gem::Version
-  version: 0.2.3
+  version: 0.2.4
 platform: ruby
 authors:
 - Francis Sullivan
@@ -9,7 +9,7 @@ authors:
 autorequire:
 bindir: exe
 cert_chain: []
-date: 2023-03-20 00:00:00.000000000 Z
+date: 2023-03-28 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: debug