@dai_ming/plugin-deliverables 1.0.14 → 1.0.15

package/index.js

@@ -1,217 +1,149 @@
-#!/usr/bin/env node
 "use strict";
 
-var FETCH_PATCH_KEY = "__plugin_deliverables_palz_fetch_patch__";
-
-function isString(value) {
-  return typeof value === "string";
-}
-
-function trimTrailingBlankLines(lines) {
-  var out = lines.slice();
-  while (out.length > 0 && /^\s*$/.test(out[out.length - 1])) {
-    out.pop();
-  }
-  return out;
+const RUNTIME_DELIVERABLES_GUIDANCE = [
+  "## Deliverables Runtime Guard (HARD CONSTRAINT)",
+  "",
+  "- These rules apply to the main agent and all subagents.",
+  "- When the user asks for a document, article, report, HTML page, Markdown file, PPT, image, archive, game, or any other file deliverable, you MUST create it under the current workspace `output/` directory and upload it with `deliverables__upload_deliverable`.",
+  "- Do not use direct message attachments to deliver generated files. This includes the message tool attachment fields such as `media`, `path`, `filePath`, `buffer`, `attachment`, or similar file-carrying fields.",
+  "- Do not emit `MEDIA:` file references for user-facing deliverables. Deliverable links must come from the deliverables upload tool instead.",
+  "- After a successful upload, reply with a short content-aware intro and then preserve the Markdown links returned by the deliverables tool.",
+].join("\n");
+
+const ATTACHMENT_PARAM_KEYS = new Set([
+  "attachment",
+  "attachments",
+  "buffer",
+  "file",
+  "filepath",
+  "files",
+  "filename",
+  "media",
+  "mediaurl",
+  "mediaurls",
+  "path",
+]);
+
+function normalizeToolName(toolName) {
+  return typeof toolName === "string" ? toolName.trim().toLowerCase() : "";
 }
 
-function stripBulletPrefix(line) {
-  return String(line || "").replace(/^\s*[-*+]\s+/, "");
+function isDeliverablesUploadTool(toolName) {
+  const normalized = normalizeToolName(toolName);
+  return normalized === "upload_deliverable" || normalized.endsWith("__upload_deliverable");
 }
 
-function isLinksHeading(line) {
-  return /^\s*#{1,6}\s*访问链接\s*$/u.test(String(line || ""));
+function isOutboundMessageTool(toolName) {
+  const normalized = normalizeToolName(toolName);
+  if (!normalized) {
+    return false;
+  }
+  return (
+    normalized === "message" ||
+    normalized.endsWith("__message") ||
+    normalized.includes("sendattachment") ||
+    normalized.includes("send_attachment")
+  );
 }
 
-function extractDeliverableURL(line) {
-  var text = String(line || "").trim();
-  if (!text) {
-    return "";
-  }
-  var markdownLink = text.match(/\((https?:\/\/[^)\s]+)\)\s*$/iu);
-  if (markdownLink && markdownLink[1]) {
-    return markdownLink[1].trim();
+function hasNonEmptyValue(value) {
+  if (typeof value === "string") {
+    return value.trim().length > 0;
   }
-  var rawLink = text.match(/https?:\/\/\S+/iu);
-  if (rawLink && rawLink[0]) {
-    return rawLink[0].trim();
+  if (Array.isArray(value)) {
+    return value.length > 0;
   }
-  return "";
-}
-
-function isDeliverableLinkLine(line) {
-  var text = String(line || "");
-  if (/^\s*(?:[-*+]\s+)?(?:预览链接|下载链接|文件列表|项目入口|在线预览|在线体验|目录链接)\s*[:：]\s*\[[^\]]+\]\([^)]+\)\s*$/u.test(text)) {
-    return true;
+  if (value && typeof value === "object") {
+    return Object.keys(value).length > 0;
   }
-  return !!extractDeliverableURL(text);
+  return Boolean(value);
 }
 
-function splitDeliverableMessage(text) {
-  var normalized = String(text || "").replace(/\r\n/g, "\n").trim();
-  if (!normalized) {
-    return null;
-  }
-
-  var lines = normalized.split("\n");
-  var firstLinkIndex = -1;
-  var i;
-  for (i = 0; i < lines.length; i += 1) {
-    if (isDeliverableLinkLine(lines[i])) {
-      firstLinkIndex = i;
-      break;
-    }
-  }
-  if (firstLinkIndex < 0) {
-    return null;
-  }
-
-  var summaryLines = trimTrailingBlankLines(lines.slice(0, firstLinkIndex));
-  if (summaryLines.length > 0 && isLinksHeading(summaryLines[summaryLines.length - 1])) {
-    summaryLines.pop();
+function containsMediaToken(value) {
+  if (typeof value === "string") {
+    return /(^|\n)\s*MEDIA:\s*\S+/i.test(value);
   }
-  summaryLines = trimTrailingBlankLines(summaryLines);
-
-  var linkLines = [];
-  for (i = firstLinkIndex; i < lines.length; i += 1) {
-    var line = lines[i];
-    if (isLinksHeading(line)) {
-      continue;
-    }
-    if (isDeliverableLinkLine(line)) {
-      var url = extractDeliverableURL(stripBulletPrefix(line));
-      if (url) {
-        linkLines.push(url);
-      }
-    }
-  }
-
-  var summary = summaryLines.join("\n").trim();
-  var links = linkLines.length > 0 ? linkLines[0] : "";
-  if (!summary || !links) {
-    return null;
+  if (Array.isArray(value)) {
+    return value.some(containsMediaToken);
   }
-
-  return {
-    summary: summary,
-    links: links,
-  };
-}
-
-function cloneBody(body, content, suffix) {
-  var next = {};
-  Object.keys(body).forEach(function(key) {
-    next[key] = body[key];
-  });
-  next.content = content;
-  if (isString(body.msg_id) && body.msg_id.trim()) {
-    next.msg_id = body.msg_id + suffix;
+  if (!value || typeof value !== "object") {
+    return false;
   }
-  return next;
+  return Object.values(value).some(containsMediaToken);
 }
 
-function shouldSplitPalzPayload(body) {
-  if (!body || typeof body !== "object" || Array.isArray(body)) {
-    return null;
-  }
-  if (!isString(body.content)) {
-    return null;
+function isDirectAttachmentBypass(params) {
+  if (!params || typeof params !== "object" || Array.isArray(params)) {
+    return false;
   }
-  if (body.stream_id || body.seq !== undefined || body.delta !== undefined || body.is_final !== undefined) {
-    return null;
-  }
-  if (body.palz_msg_type || body.tool_content) {
-    return null;
+  for (const [key, value] of Object.entries(params)) {
+    if (ATTACHMENT_PARAM_KEYS.has(String(key).trim().toLowerCase()) && hasNonEmptyValue(value)) {
+      return true;
+    }
   }
-  return splitDeliverableMessage(body.content);
+  return containsMediaToken(params);
 }
 
-function resolveFetchURL(input) {
-  if (isString(input)) {
-    return input;
-  }
-  if (input && isString(input.url)) {
-    return input.url;
+function extractMediaUrls(metadata) {
+  if (!metadata || typeof metadata !== "object" || Array.isArray(metadata)) {
+    return [];
   }
-  return "";
-}
-
-function resolveFetchMethod(input, init) {
-  if (init && isString(init.method) && init.method.trim()) {
-    return init.method.trim().toUpperCase();
+  const urls = [];
+  const mediaUrls = metadata.mediaUrls;
+  if (Array.isArray(mediaUrls)) {
+    for (const entry of mediaUrls) {
+      if (typeof entry === "string" && entry.trim()) {
+        urls.push(entry.trim());
+      }
+    }
   }
-  if (input && !isString(input) && isString(input.method) && input.method.trim()) {
-    return input.method.trim().toUpperCase();
+  if (typeof metadata.mediaUrl === "string" && metadata.mediaUrl.trim()) {
+    urls.push(metadata.mediaUrl.trim());
   }
-  return "GET";
+  return urls;
 }
 
-function installPalzFetchPatch(api) {
-  if (globalThis[FETCH_PATCH_KEY] && globalThis[FETCH_PATCH_KEY].installed) {
-    return;
-  }
-  var originalFetch = globalThis.fetch;
-  if (typeof originalFetch !== "function") {
-    api.logger.warn && api.logger.warn("[plugin-deliverables] global fetch is unavailable; split patch skipped");
-    return;
-  }
-
-  var patchedFetch = async function(input, init) {
-    var url = resolveFetchURL(input);
-    var method = resolveFetchMethod(input, init);
-    if (method !== "POST" || !/\/bot\/send(?:\?|$)/.test(url)) {
-      return originalFetch(input, init);
-    }
-
-    var requestBody = init && init.body;
-    if (!isString(requestBody)) {
-      return originalFetch(input, init);
-    }
-
-    var parsed;
-    try {
-      parsed = JSON.parse(requestBody);
-    } catch (err) {
-      return originalFetch(input, init);
-    }
-
-    var split = shouldSplitPalzPayload(parsed);
-    if (!split) {
-      return originalFetch(input, init);
-    }
-
-    api.logger.info &&
-      api.logger.info(
-        "[plugin-deliverables] split deliverable reply for palz target=" +
-          String(parsed.conversation_id || ""),
+const plugin = {
+  id: "plugin-deliverables",
+  name: "Deliverables",
+  description: "Upload-first runtime guard for generated file deliverables.",
+  register(api) {
+    api.on("before_prompt_build", async () => ({
+      prependSystemContext: RUNTIME_DELIVERABLES_GUIDANCE,
+    }));
+
+    api.on("before_tool_call", async (event) => {
+      if (isDeliverablesUploadTool(event.toolName)) {
+        return;
+      }
+      if (!isOutboundMessageTool(event.toolName)) {
+        return;
+      }
+      if (!isDirectAttachmentBypass(event.params)) {
+        return;
+      }
+      api.logger.warn?.(
+        `plugin-deliverables: blocked direct file/message bypass via ${event.toolName}`,
       );
-
-    var baseInit = Object.assign({}, init);
-    var summaryInit = Object.assign({}, baseInit, {
-      body: JSON.stringify(cloneBody(parsed, split.summary, "__summary")),
-    });
-    var linksInit = Object.assign({}, baseInit, {
-      body: JSON.stringify(cloneBody(parsed, split.links, "__links")),
+      return {
+        block: true,
+        blockReason:
+          "Direct file/message delivery is disabled for deliverables. Write the artifact under output/ and call deliverables__upload_deliverable instead.",
+      };
     });
 
-    var firstResponse = await originalFetch(input, summaryInit);
-    if (!firstResponse || !firstResponse.ok) {
-      return firstResponse;
-    }
-    return originalFetch(input, linksInit);
-  };
-
-  globalThis.fetch = patchedFetch;
-  globalThis[FETCH_PATCH_KEY] = {
-    installed: true,
-    originalFetch: originalFetch,
-  };
-}
-
-function register(api) {
-  installPalzFetchPatch(api);
-}
+    api.on("message_sending", async (event, ctx) => {
+      const mediaUrls = extractMediaUrls(event.metadata);
+      if (mediaUrls.length === 0 && !containsMediaToken(event.content)) {
+        return;
+      }
+      api.logger.warn?.(
+        `plugin-deliverables: cancelled outbound media bypass on ${ctx.channelId || "unknown"} (${mediaUrls.length} media item(s))`,
+      );
+      return { cancel: true };
+    });
+  },
+};
 
-module.exports = register;
-module.exports.default = register;
-module.exports.id = "plugin-deliverables";
+module.exports = plugin;
+module.exports.default = plugin;