@anchrd/intel-api 0.9.0 → 0.10.0

package/dist/adapters/json-schema/json-schema.js

@@ -1,31 +1,77 @@
-import Ajv, {} from "ajv";
-// Tool schemas come from remote catalogs and are therefore untrusted: allErrors lets a crafted
-// schema amplify validation work, and Ajv keeps every compiled schema for the life of the isolate.
-const MaxCompiledSchemas = 200;
+import { Validator } from "@cfworker/json-schema";
+import { reportUnexpectedError } from "../../shared/report-unexpected-error/report-unexpected-error.js";
+// ⚠️ This validator must not generate code, and Ajv must never come back. Ajv turns a schema into
+// JavaScript with `new Function`, and workerd answers that with `EvalError: Code generation from
+// strings disallowed for this context` — so `compile` threw for EVERY schema in production, the
+// catch called it a broken schema, and each tool call died with 400 "The cached tool schema is
+// invalid" while nothing was wrong with any schema (#229). Ajv is usable only with schemas
+// precompiled at build time; these arrive from a remote catalog and are unknown until the call.
+// `@cfworker/json-schema` interprets the schema instead, which is what it was written for.
+//
+// ⚠️ The `workerd` test pool does not prove this on its own: it replaces `globalThis.Function` with
+// a proxy onto an unsafe-eval binding, so Ajv compiled happily in every test while failing in every
+// deployment. `json-schema.int.ts` therefore takes that patch away for the length of the test — it
+// is the only thing that turns red when a code-generating validator returns.
+// Tool schemas come from remote catalogs and are therefore untrusted: `ShortCircuit` stops at the
+// first error so a crafted schema cannot amplify the work of one call, and the prepared validators
+// are bounded because each one holds its dereferenced schema for the life of the isolate.
+const MaxPreparedSchemas = 200;
+const ShortCircuit = true;
+const MaxDetailLength = 2_000;
+// A tool schema that names its draft gets that draft: draft-07 ignores keywords sitting beside a
+// `$ref` and the later drafts apply them, so guessing here would validate a foreign catalog against
+// rules its author never wrote. Unnamed means 2020-12, the draft the MCP generators emit when they
+// stay silent.
+const DefaultDraft = "2020-12";
+const DraftsByMetaSchema = [
+    ["draft-04", "4"],
+    ["draft-07", "7"],
+    ["2019-09", "2019-09"],
+    ["2020-12", "2020-12"],
+];
+function draftOf(schema) {
+    const declared = schema.$schema;
+    if (typeof declared !== "string")
+        return DefaultDraft;
+    return DraftsByMetaSchema.find(([marker]) => declared.includes(marker))?.[1] ?? DefaultDraft;
+}
 export function createJsonSchemaValidator() {
-    const ajv = new Ajv({ allErrors: false, strict: false });
-    const compiled = new Map();
+    const prepared = new Map();
     return (schema, value) => {
-        try {
-            const key = JSON.stringify(schema);
-            let validate = compiled.get(key);
-            if (!validate) {
-                if (compiled.size >= MaxCompiledSchemas) {
-                    compiled.clear();
-                    ajv.removeSchema();
-                }
-                validate = ajv.compile(schema);
-                compiled.set(key, validate);
+        const key = JSON.stringify(schema);
+        let validator = prepared.get(key);
+        if (!validator) {
+            try {
+                validator = new Validator(schema, draftOf(schema), ShortCircuit);
+            }
+            catch (error) {
+                // A schema this validator cannot even read is still refused by name — but the caller hears
+                // that it was the schema, not their arguments, and the reason itself goes to the log. The
+                // old wording claimed a broken schema for every failure, which is what hid #229 for weeks.
+                reportUnexpectedError(error);
+                return { valid: false, detail: "The tool schema could not be read; the reason was logged" };
             }
-            if (validate(value))
+            if (prepared.size >= MaxPreparedSchemas)
+                prepared.clear();
+            prepared.set(key, validator);
+        }
+        try {
+            const result = validator.validate(value);
+            if (result.valid)
                 return { valid: true };
-            return {
-                valid: false,
-                detail: ajv.errorsText(validate.errors, { separator: "; " }).slice(0, 2_000),
-            };
+            return { valid: false, detail: describe(result) };
         }
-        catch {
-            return { valid: false, detail: "The cached tool schema is invalid" };
+        catch (error) {
+            // An unresolvable `$ref` only shows up while walking the instance, so this is the same
+            // unreadable schema arriving one step later — and never a statement about the arguments.
+            reportUnexpectedError(error);
+            return { valid: false, detail: "The tool schema could not be read; the reason was logged" };
         }
     };
 }
+function describe(result) {
+    return result.errors
+        .map((unit) => `${unit.instanceLocation}: ${unit.error}`)
+        .join("; ")
+        .slice(0, MaxDetailLength);
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@anchrd/intel-api",
-  "version": "0.9.0",
+  "version": "0.10.0",
   "type": "module",
   "license": "UNLICENSED",
   "repository": {
@@ -44,8 +44,8 @@
   "dependencies": {
     "@anchrd/gate-sdk": "^0.7.0",
     "@anchrd/intel-contract": "^0.7.0",
+    "@cfworker/json-schema": "^4.1.1",
     "@modelcontextprotocol/sdk": "^1.30.0",
-    "ajv": "^8.20.0",
     "fflate": "^0.8.3",
     "hono": "^4.12.32",
     "openid-client": "^6.8.4",