prescient 0.8.0 → 0.8.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: e272a00a9f7baaee44c4ad7b9827da6c1e5b930a98228e8d58718474d3090214
-  data.tar.gz: a7ac75b948c326d0829db56e0ab297561d178fa4643a6a4bbd5b4dc11cff150b
+  metadata.gz: 30a90de63f88d65265581ced8533203fefc05704a2eee3b604d0c74fc4d64097
+  data.tar.gz: f443e5b20bc11142852e4073772db5d4550263de114fc54d735159d3cb47a2cb
 SHA512:
-  metadata.gz: 1e4ff77f5dd524e7bc3217b4f8fc1b8045f43d188b751f81dc2964dcf2d15dbfd3ed58efe8598ba40bd875e19a3597de1308e32c066466713b06af8e79fea55a
-  data.tar.gz: 3f5f8e5f78bc8db0566102f686ce1b66e752f9f81faba9dae09adfa49883aaa67c621b108b9a60cb573d695cae4874567e2ebf1c69b90a3971a6686f0316c288
+  metadata.gz: 7ba7c44dd34039b89c57bd1ca8c4aae70a8800681460be5c676e66b02936c4bb77934e49be358e0903f109c8521014f467c906f69df9043bfa1762fb5612b08c
+  data.tar.gz: e021453fb08fd1908380248fae250b2b06ee42a5c67e6cb9cb1976fa78a35768dbfd8b80abd2baaaafd3e12e7e4354378ae3ce6fd4020dcde77a99204b9cb394

data/CHANGELOG.md

@@ -2,6 +2,17 @@
 
 ## Unreleased
 
+## [0.8.1] - 2025-09-10
+
+### Fixed
+
+- Fixed the Agent audit-log load path to avoid a circular-require warning while
+  preserving lazy loading of the optional Agent implementation.
+- Replaced the Agent parser's polynomial-time fenced-JSON regular expression
+  with a linear scanner to prevent ReDoS behavior on untrusted provider output.
+- Added Agent parser regression coverage for nested objects, escaped string
+  values, malformed fences, and repeated unterminated action prefixes.
+
 ## [0.8.0] - 2025-08-31
 
 ### Added

data/INTEGRATION_GUIDE.md

@@ -11,7 +11,7 @@ and [examples guide](examples/README.md).
 
 ```ruby
 # Add to your Gemfile
-gem 'prescient', '~> 0.8.0'
+gem 'prescient', '~> 0.8.1'
 ```
 
 ### 2. Replace Existing AI Service

data/lib/prescient/agent/parser.rb

@@ -4,8 +4,12 @@
 module Prescient::Agent
   # Extracts and validates one tool action from provider text.
   class Parser
-    # @return [Regexp] Fenced JSON action matcher
-    ACTION_PATTERN = /```json\s*(\{.*?\})\s*```/m
+    # @return [String] Opening fenced JSON marker
+    JSON_FENCE = "```json".b.freeze
+    # @return [String] Closing fenced JSON marker
+    CLOSING_FENCE = "```".b.freeze
+    # @return [Array<Integer>] JSON whitespace byte values
+    WHITESPACE_BYTES = [9, 10, 11, 12, 13, 32].freeze
 
     # Parse one optional action from provider output.
     # @param text [String] Provider response text
@@ -23,11 +27,11 @@ module Prescient::Agent
     # @param text [String] Provider response text
     # @return [Hash, nil] Parsed action or nil for a final response
     def parse(text)
-      match = text.to_s.match(ACTION_PATTERN)
-      return nil unless match
-      raise MalformedActionError, "agent action exceeds configured size limit" if match[1].bytesize > @max_bytes
+      action_json = extract_action_json(text.to_s)
+      return nil unless action_json
+      raise MalformedActionError, "agent action exceeds configured size limit" if action_json.bytesize > @max_bytes
 
-      payload = JSON.parse(match[1])
+      payload = JSON.parse(action_json)
       validate_payload(payload)
       { name: payload.fetch("action").to_sym, arguments: payload.fetch("args") }
     rescue JSON::ParserError => e
@@ -36,6 +40,84 @@ module Prescient::Agent
 
     private
 
+    def extract_action_json(text)
+      source = text.b
+      cursor = 0
+
+      while (fence_start = source.index(JSON_FENCE, cursor))
+        content_start = skip_whitespace(source, fence_start + JSON_FENCE.bytesize)
+        unless source.getbyte(content_start) == 123
+          cursor = content_start
+          next
+        end
+
+        action_json, next_cursor = scan_json_object(source, content_start)
+        return action_json if action_json
+
+        cursor = next_cursor
+      end
+
+      nil
+    end
+
+    def scan_json_object(source, start)
+      depth = 0
+      escaped = false
+      in_string = false
+      index = start
+
+      while index < source.bytesize
+        byte = source.getbyte(index)
+        if in_string
+          in_string, escaped = string_state(byte, escaped)
+        elsif fence_at?(source, index)
+          return [nil, index]
+        else
+          in_string = byte == 34
+          depth = depth_after(byte, depth)
+          return completed_action(source, start, index) if byte == 125 && depth.zero?
+        end
+        index += 1
+      end
+
+      [nil, source.bytesize]
+    end
+
+    def string_state(byte, escaped)
+      return [true, false] if escaped
+      return [true, true] if byte == 92
+      return [false, false] if byte == 34
+
+      [true, false]
+    end
+
+    def fence_at?(source, index)
+      byte = source.getbyte(index)
+      byte == 96 && source.byteslice(index, JSON_FENCE.bytesize) == JSON_FENCE
+    end
+
+    def depth_after(byte, depth)
+      case byte
+      when 123 then depth + 1
+      when 125 then depth - 1
+      else depth
+      end
+    end
+
+    def completed_action(source, start, index)
+      closing_start = skip_whitespace(source, index + 1)
+      return [nil, closing_start] unless source.byteslice(closing_start, CLOSING_FENCE.bytesize) == CLOSING_FENCE
+
+      length = index + 1 - start
+      [source.byteslice(start, length).force_encoding(Encoding::UTF_8), index + 1]
+    end
+
+    def skip_whitespace(source, start)
+      index = start
+      index += 1 while index < source.bytesize && WHITESPACE_BYTES.include?(source.getbyte(index))
+      index
+    end
+
     def validate_payload(payload)
       unless payload.is_a?(Hash) && payload.keys.sort == %w[action args]
         raise MalformedActionError, "agent action must contain only action and args"

data/lib/prescient/agent.rb

@@ -5,11 +5,11 @@ require "json"
 module Prescient
   # Optional bounded agent orchestration over Prescient Core.
   module Agent
+    autoload :AuditLog, "prescient/agent/audit_log"
   end
 end
 
 require_relative "agent/configuration"
-require_relative "agent/audit_log"
 require_relative "agent/errors"
 require_relative "agent/error_serializer"
 require_relative "agent/schema_validator"

data/lib/prescient/version.rb

@@ -2,5 +2,5 @@
 
 module Prescient
   # Current Prescient gem version.
-  VERSION = "0.8.0"
+  VERSION = "0.8.1"
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: prescient
 version: !ruby/object:Gem::Version
-  version: 0.8.0
+  version: 0.8.1
 platform: ruby
 authors:
 - Ken C. Demanawa