@dai_ming/plugin-deliverables 1.0.14 → 1.0.16

package/index.js

@@ -1,14 +1,116 @@
-#!/usr/bin/env node
 "use strict";
 
-var FETCH_PATCH_KEY = "__plugin_deliverables_palz_fetch_patch__";
+const FETCH_PATCH_KEY = "__plugin_deliverables_palz_fetch_patch__";
+
+const RUNTIME_DELIVERABLES_GUIDANCE = [
+  "## Deliverables Runtime Guard (HARD CONSTRAINT)",
+  "",
+  "- These rules apply to the main agent and all subagents.",
+  "- When the user asks for a document, article, report, HTML page, Markdown file, PPT, image, archive, game, or any other file deliverable, you MUST create it under the current workspace `output/` directory and upload it with `deliverables__upload_deliverable`.",
+  "- Do not use direct message attachments to deliver generated files. This includes the message tool attachment fields such as `media`, `path`, `filePath`, `buffer`, `attachment`, or similar file-carrying fields.",
+  "- Do not emit `MEDIA:` file references for user-facing deliverables. Deliverable links must come from the deliverables upload tool instead.",
+  "- After a successful upload, reply with a short content-aware intro and then preserve the Markdown links returned by the deliverables tool.",
+].join("\n");
 
 function isString(value) {
   return typeof value === "string";
 }
 
+const ATTACHMENT_PARAM_KEYS = new Set([
+  "attachment",
+  "attachments",
+  "buffer",
+  "file",
+  "filepath",
+  "files",
+  "filename",
+  "media",
+  "mediaurl",
+  "mediaurls",
+  "path",
+]);
+
+function normalizeToolName(toolName) {
+  return typeof toolName === "string" ? toolName.trim().toLowerCase() : "";
+}
+
+function isDeliverablesUploadTool(toolName) {
+  const normalized = normalizeToolName(toolName);
+  return normalized === "upload_deliverable" || normalized.endsWith("__upload_deliverable");
+}
+
+function isOutboundMessageTool(toolName) {
+  const normalized = normalizeToolName(toolName);
+  if (!normalized) {
+    return false;
+  }
+  return (
+    normalized === "message" ||
+    normalized.endsWith("__message") ||
+    normalized.includes("sendattachment") ||
+    normalized.includes("send_attachment")
+  );
+}
+
+function hasNonEmptyValue(value) {
+  if (typeof value === "string") {
+    return value.trim().length > 0;
+  }
+  if (Array.isArray(value)) {
+    return value.length > 0;
+  }
+  if (value && typeof value === "object") {
+    return Object.keys(value).length > 0;
+  }
+  return Boolean(value);
+}
+
+function containsMediaToken(value) {
+  if (typeof value === "string") {
+    return /(^|\n)\s*MEDIA:\s*\S+/i.test(value);
+  }
+  if (Array.isArray(value)) {
+    return value.some(containsMediaToken);
+  }
+  if (!value || typeof value !== "object") {
+    return false;
+  }
+  return Object.values(value).some(containsMediaToken);
+}
+
+function isDirectAttachmentBypass(params) {
+  if (!params || typeof params !== "object" || Array.isArray(params)) {
+    return false;
+  }
+  for (const [key, value] of Object.entries(params)) {
+    if (ATTACHMENT_PARAM_KEYS.has(String(key).trim().toLowerCase()) && hasNonEmptyValue(value)) {
+      return true;
+    }
+  }
+  return containsMediaToken(params);
+}
+
+function extractMediaUrls(metadata) {
+  if (!metadata || typeof metadata !== "object" || Array.isArray(metadata)) {
+    return [];
+  }
+  const urls = [];
+  const mediaUrls = metadata.mediaUrls;
+  if (Array.isArray(mediaUrls)) {
+    for (const entry of mediaUrls) {
+      if (typeof entry === "string" && entry.trim()) {
+        urls.push(entry.trim());
+      }
+    }
+  }
+  if (typeof metadata.mediaUrl === "string" && metadata.mediaUrl.trim()) {
+    urls.push(metadata.mediaUrl.trim());
+  }
+  return urls;
+}
+
 function trimTrailingBlankLines(lines) {
-  var out = lines.slice();
+  const out = lines.slice();
   while (out.length > 0 && /^\s*$/.test(out[out.length - 1])) {
     out.pop();
   }
@@ -24,15 +126,15 @@ function isLinksHeading(line) {
 }
 
 function extractDeliverableURL(line) {
-  var text = String(line || "").trim();
+  const text = String(line || "").trim();
   if (!text) {
     return "";
   }
-  var markdownLink = text.match(/\((https?:\/\/[^)\s]+)\)\s*$/iu);
+  const markdownLink = text.match(/\((https?:\/\/[^)\s]+)\)\s*$/iu);
   if (markdownLink && markdownLink[1]) {
     return markdownLink[1].trim();
   }
-  var rawLink = text.match(/https?:\/\/\S+/iu);
+  const rawLink = text.match(/https?:\/\/\S+/iu);
   if (rawLink && rawLink[0]) {
     return rawLink[0].trim();
   }
@@ -40,23 +142,26 @@ function extractDeliverableURL(line) {
 }
 
 function isDeliverableLinkLine(line) {
-  var text = String(line || "");
-  if (/^\s*(?:[-*+]\s+)?(?:预览链接|下载链接|文件列表|项目入口|在线预览|在线体验|目录链接)\s*[:：]\s*\[[^\]]+\]\([^)]+\)\s*$/u.test(text)) {
+  const text = String(line || "");
+  if (
+    /^\s*(?:[-*+]\s+)?(?:预览链接|下载链接|文件列表|项目入口|在线预览|在线体验|目录链接)\s*[:：]\s*\[[^\]]+\]\([^)]+\)\s*$/u.test(
+      text,
+    )
+  ) {
     return true;
   }
   return !!extractDeliverableURL(text);
 }
 
 function splitDeliverableMessage(text) {
-  var normalized = String(text || "").replace(/\r\n/g, "\n").trim();
+  const normalized = String(text || "").replace(/\r\n/g, "\n").trim();
   if (!normalized) {
     return null;
   }
 
-  var lines = normalized.split("\n");
-  var firstLinkIndex = -1;
-  var i;
-  for (i = 0; i < lines.length; i += 1) {
+  const lines = normalized.split("\n");
+  let firstLinkIndex = -1;
+  for (let i = 0; i < lines.length; i += 1) {
     if (isDeliverableLinkLine(lines[i])) {
       firstLinkIndex = i;
       break;
@@ -66,41 +171,38 @@ function splitDeliverableMessage(text) {
     return null;
   }
 
-  var summaryLines = trimTrailingBlankLines(lines.slice(0, firstLinkIndex));
+  let summaryLines = trimTrailingBlankLines(lines.slice(0, firstLinkIndex));
   if (summaryLines.length > 0 && isLinksHeading(summaryLines[summaryLines.length - 1])) {
     summaryLines.pop();
   }
   summaryLines = trimTrailingBlankLines(summaryLines);
 
-  var linkLines = [];
-  for (i = firstLinkIndex; i < lines.length; i += 1) {
-    var line = lines[i];
+  const linkLines = [];
+  for (let i = firstLinkIndex; i < lines.length; i += 1) {
+    const line = lines[i];
     if (isLinksHeading(line)) {
       continue;
     }
     if (isDeliverableLinkLine(line)) {
-      var url = extractDeliverableURL(stripBulletPrefix(line));
+      const url = extractDeliverableURL(stripBulletPrefix(line));
       if (url) {
         linkLines.push(url);
       }
     }
   }
 
-  var summary = summaryLines.join("\n").trim();
-  var links = linkLines.length > 0 ? linkLines[0] : "";
+  const summary = summaryLines.join("\n").trim();
+  const links = linkLines.length > 0 ? linkLines[0] : "";
   if (!summary || !links) {
     return null;
   }
 
-  return {
-    summary: summary,
-    links: links,
-  };
+  return { summary, links };
 }
 
 function cloneBody(body, content, suffix) {
-  var next = {};
-  Object.keys(body).forEach(function(key) {
+  const next = {};
+  Object.keys(body).forEach((key) => {
     next[key] = body[key];
   });
   next.content = content;
@@ -117,7 +219,12 @@ function shouldSplitPalzPayload(body) {
   if (!isString(body.content)) {
     return null;
   }
-  if (body.stream_id || body.seq !== undefined || body.delta !== undefined || body.is_final !== undefined) {
+  if (
+    body.stream_id ||
+    body.seq !== undefined ||
+    body.delta !== undefined ||
+    body.is_final !== undefined
+  ) {
     return null;
   }
   if (body.palz_msg_type || body.tool_content) {
@@ -146,72 +253,149 @@ function resolveFetchMethod(input, init) {
   return "GET";
 }
 
+function previewText(text, limit = 1000) {
+  const normalized = String(text || "");
+  if (normalized.length <= limit) {
+    return normalized;
+  }
+  return `${normalized.slice(0, limit)}...<truncated>`;
+}
+
+async function readResponseText(response) {
+  if (!response || typeof response.clone !== "function") {
+    return "";
+  }
+  try {
+    return await response.clone().text();
+  } catch (_err) {
+    return "";
+  }
+}
+
 function installPalzFetchPatch(api) {
   if (globalThis[FETCH_PATCH_KEY] && globalThis[FETCH_PATCH_KEY].installed) {
     return;
   }
-  var originalFetch = globalThis.fetch;
+  const originalFetch = globalThis.fetch;
   if (typeof originalFetch !== "function") {
-    api.logger.warn && api.logger.warn("[plugin-deliverables] global fetch is unavailable; split patch skipped");
+    api.logger.warn?.("[plugin-deliverables] global fetch is unavailable; split patch skipped");
     return;
   }
 
-  var patchedFetch = async function(input, init) {
-    var url = resolveFetchURL(input);
-    var method = resolveFetchMethod(input, init);
+  const patchedFetch = async function(input, init) {
+    const url = resolveFetchURL(input);
+    const method = resolveFetchMethod(input, init);
     if (method !== "POST" || !/\/bot\/send(?:\?|$)/.test(url)) {
       return originalFetch(input, init);
     }
 
-    var requestBody = init && init.body;
+    const requestBody = init && init.body;
     if (!isString(requestBody)) {
       return originalFetch(input, init);
     }
 
-    var parsed;
+    let parsed;
     try {
       parsed = JSON.parse(requestBody);
-    } catch (err) {
+    } catch (_err) {
       return originalFetch(input, init);
     }
 
-    var split = shouldSplitPalzPayload(parsed);
+    const split = shouldSplitPalzPayload(parsed);
     if (!split) {
       return originalFetch(input, init);
     }
 
-    api.logger.info &&
-      api.logger.info(
-        "[plugin-deliverables] split deliverable reply for palz target=" +
-          String(parsed.conversation_id || ""),
-      );
+    const summaryBody = cloneBody(parsed, split.summary, "__summary");
+    const linksBody = cloneBody(parsed, split.links, "__links");
+    const summaryBodyStr = JSON.stringify(summaryBody);
+    const linksBodyStr = JSON.stringify(linksBody);
 
-    var baseInit = Object.assign({}, init);
-    var summaryInit = Object.assign({}, baseInit, {
-      body: JSON.stringify(cloneBody(parsed, split.summary, "__summary")),
+    api.logger.info?.(
+      `[plugin-deliverables] split deliverable reply for palz target=${String(parsed.conversation_id || "")} summaryMsgId=${String(summaryBody.msg_id || "")} linksMsgId=${String(linksBody.msg_id || "")}`,
+    );
+    api.logger.info?.(
+      `[plugin-deliverables] palz summary request body_length=${summaryBodyStr.length}\n  request_body=${summaryBodyStr}`,
+    );
+
+    const baseInit = Object.assign({}, init);
+    const summaryInit = Object.assign({}, baseInit, {
+      body: summaryBodyStr,
     });
-    var linksInit = Object.assign({}, baseInit, {
-      body: JSON.stringify(cloneBody(parsed, split.links, "__links")),
+    const linksInit = Object.assign({}, baseInit, {
+      body: linksBodyStr,
     });
 
-    var firstResponse = await originalFetch(input, summaryInit);
+    const firstResponse = await originalFetch(input, summaryInit);
+    const firstResponseText = await readResponseText(firstResponse);
+    api.logger.info?.(
+      `[plugin-deliverables] palz summary response status=${firstResponse ? firstResponse.status : "unknown"} ok=${Boolean(firstResponse && firstResponse.ok)}\n  response_body=${previewText(firstResponseText)}`,
+    );
     if (!firstResponse || !firstResponse.ok) {
       return firstResponse;
     }
-    return originalFetch(input, linksInit);
+
+    api.logger.info?.(
+      `[plugin-deliverables] palz links request body_length=${linksBodyStr.length}\n  request_body=${linksBodyStr}`,
+    );
+    const secondResponse = await originalFetch(input, linksInit);
+    const secondResponseText = await readResponseText(secondResponse);
+    api.logger.info?.(
+      `[plugin-deliverables] palz links response status=${secondResponse ? secondResponse.status : "unknown"} ok=${Boolean(secondResponse && secondResponse.ok)}\n  response_body=${previewText(secondResponseText)}`,
+    );
+    return secondResponse;
   };
 
   globalThis.fetch = patchedFetch;
   globalThis[FETCH_PATCH_KEY] = {
     installed: true,
-    originalFetch: originalFetch,
+    originalFetch,
   };
 }
 
-function register(api) {
-  installPalzFetchPatch(api);
-}
+const plugin = {
+  id: "plugin-deliverables",
+  name: "Deliverables",
+  description: "Upload-first runtime guard for generated file deliverables.",
+  register(api) {
+    installPalzFetchPatch(api);
+
+    api.on("before_prompt_build", async () => ({
+      prependSystemContext: RUNTIME_DELIVERABLES_GUIDANCE,
+    }));
+
+    api.on("before_tool_call", async (event) => {
+      if (isDeliverablesUploadTool(event.toolName)) {
+        return;
+      }
+      if (!isOutboundMessageTool(event.toolName)) {
+        return;
+      }
+      if (!isDirectAttachmentBypass(event.params)) {
+        return;
+      }
+      api.logger.warn?.(
+        `plugin-deliverables: blocked direct file/message bypass via ${event.toolName}`,
+      );
+      return {
+        block: true,
+        blockReason:
+          "Direct file/message delivery is disabled for deliverables. Write the artifact under output/ and call deliverables__upload_deliverable instead.",
+      };
+    });
+
+    api.on("message_sending", async (event, ctx) => {
+      const mediaUrls = extractMediaUrls(event.metadata);
+      if (mediaUrls.length === 0 && !containsMediaToken(event.content)) {
+        return;
+      }
+      api.logger.warn?.(
+        `plugin-deliverables: cancelled outbound media bypass on ${ctx.channelId || "unknown"} (${mediaUrls.length} media item(s))`,
+      );
+      return { cancel: true };
+    });
+  },
+};
 
-module.exports = register;
-module.exports.default = register;
-module.exports.id = "plugin-deliverables";
+module.exports = plugin;
+module.exports.default = plugin;