@datagusto/cli 0.0.0-stage → 0.2.0

package/vendor/kiro/dist/extractors.js

@@ -0,0 +1,201 @@
+// ---------------------------------------------------------------------------
+// Datagusto Safety Plugin - Pure extraction & hashing helpers
+// ---------------------------------------------------------------------------
+import { createHash } from "node:crypto";
+import { BUILTIN_TOOLS } from "./builtin-tools.generated.js";
+// -- Tool definition extraction ---------------------------------------------
+const EMPTY_OBJECT_SCHEMA = {
+    type: "object",
+    properties: {},
+};
+/**
+ * Build DatagustoTool[] from the bundled Claude Code built-in tool catalog
+ * (see builtin-tools.generated.ts). Unlike OpenClaw, none of Claude Code's
+ * hook payloads expose the active tool catalog, so we register this fixed
+ * snapshot at the start of each session rather than extracting it per-turn.
+ * Output schemas are not exposed by Claude Code either and stay as the
+ * empty-object placeholder.
+ */
+export function buildBuiltinToolDefinitions() {
+    return BUILTIN_TOOLS.map((t) => ({
+        name: t.id,
+        description: t.description,
+        input_schema: t.inputSchema,
+        output_schema: { ...EMPTY_OBJECT_SCHEMA },
+    }));
+}
+// -- User instruction extraction --------------------------------------------
+/**
+ * Returns true if the prompt is a Claude Code slash command (e.g. "/compact",
+ * "/code-review") or bash-mode shortcut (e.g. "!ls") that should not be sent
+ * to alignment. This replaces OpenClaw's `stripChannelMetadata` /
+ * `isOpenClawCommand` pair: Claude Code's `UserPromptSubmit` payload already
+ * hands over the raw, unwrapped prompt text (no channel metadata header to
+ * strip), so the only filtering needed is for command-mode input.
+ */
+export function isClaudeCodeCommand(prompt) {
+    const trimmed = prompt.trim();
+    return /^\/\w+/.test(trimmed) || trimmed.startsWith("!");
+}
+// -- Stable hashing ---------------------------------------------------------
+/**
+ * Recursively sort object keys so that `JSON.stringify` produces
+ * a deterministic string regardless of insertion order.
+ */
+function stableStringify(value) {
+    if (value === null || value === undefined)
+        return JSON.stringify(value);
+    if (Array.isArray(value)) {
+        return "[" + value.map(stableStringify).join(",") + "]";
+    }
+    if (typeof value === "object") {
+        const obj = value;
+        const keys = Object.keys(obj).sort();
+        return ("{" +
+            keys
+                .map((k) => JSON.stringify(k) + ":" + stableStringify(obj[k]))
+                .join(",") +
+            "}");
+    }
+    return JSON.stringify(value);
+}
+/**
+ * SHA-256 hash of a payload using stable (key-sorted) JSON serialization.
+ */
+export function hashPayload(payload) {
+    const data = stableStringify(payload);
+    return createHash("sha256").update(data, "utf8").digest("hex");
+}
+// -- Tool result serialization ----------------------------------------------
+/**
+ * Normalize a Claude Code `tool_response` into a plain JSON-safe value
+ * suitable for the validate API's `output` field. Unlike OpenClaw's
+ * LangChain-style ToolMessage result, Claude Code's `tool_response` is
+ * already a plain string or JSON-shaped object, so this only guards
+ * against values that don't round-trip through JSON.
+ */
+export function serializeToolResult(result) {
+    if (result == null || typeof result === "string")
+        return result;
+    try {
+        return JSON.parse(JSON.stringify(result));
+    }
+    catch {
+        return String(result);
+    }
+}
+// -- Block reason / phase extraction ------------------------------------------
+// Datagusto returns triggered_guardrails / metadata at the top level of the
+// validate response (see backend/app/api/v1/endpoints/safety.py). Older or
+// alternate shapes nested them under evaluation_result, so we read both.
+function getTriggeredGuardrails(data) {
+    return data.triggered_guardrails ?? data.evaluation_result?.triggered_guardrails ?? [];
+}
+/**
+ * Extract a human-readable block reason from a ValidateResponse.
+ *
+ * Priority:
+ *   1. `data.message` (if present)
+ *   2. `actions[].result.message` from "block" actions in triggered guardrails
+ *   3. `actions[].result.warning_message` from "warn" actions
+ *   4. guardrail names as fallback
+ *   5. "policy violation" as last resort
+ */
+export function extractBlockReason(data) {
+    if (data.message)
+        return data.message;
+    const guardrails = getTriggeredGuardrails(data);
+    const triggered = guardrails.filter((g) => g.triggered);
+    // Collect messages from block actions first, then warn actions
+    const blockMessages = [];
+    const warnMessages = [];
+    for (const g of triggered) {
+        for (const action of g.actions ?? []) {
+            if (action.action_type === "block" && action.result?.message) {
+                blockMessages.push(action.result.message);
+            }
+            else if (action.action_type === "warn" && action.result?.warning_message) {
+                warnMessages.push(action.result.warning_message);
+            }
+        }
+    }
+    if (blockMessages.length > 0)
+        return blockMessages.join("; ");
+    if (warnMessages.length > 0)
+        return warnMessages.join("; ");
+    // Fallback to guardrail names
+    const names = triggered
+        .map((g) => g.guardrail_name ?? g.guardrail_id ?? "unknown")
+        .join(", ");
+    if (names)
+        return `triggered: ${names}`;
+    return "policy violation";
+}
+/**
+ * Extract a short "phase" tag (used in log messages and block reasons).
+ *
+ * Prefers `metadata.blocked_by` (set by safety_service for branches like
+ * "uncategorized_tool"), then falls back to the first triggered guardrail's
+ * id / name. Returns undefined if neither is present.
+ */
+export function extractPhase(data) {
+    const blockedBy = data.metadata?.blocked_by;
+    if (typeof blockedBy === "string" && blockedBy)
+        return blockedBy;
+    const triggered = getTriggeredGuardrails(data).filter((g) => g.triggered);
+    if (triggered.length > 0) {
+        return triggered[0].guardrail_id ?? triggered[0].guardrail_name;
+    }
+    return undefined;
+}
+/**
+ * Normalize a /guardrails/evaluate response into the flat ValidateResponseExtended
+ * shape the PreToolUse/PostToolUse handlers already consume.
+ *
+ * The evaluate endpoint nests decisions inside `triggered_guardrails[].actions[]`,
+ * whereas the handlers read top-level `should_proceed` / `severity` /
+ * `injected_instruction`. This maps between them:
+ *   - block action (or warn with allow_proceed=false) → should_proceed=false
+ *   - warn action with allow_proceed=true → should_proceed stays true, surface
+ *     severity + injected_instruction (drives the "ask" on_start / "inject" on_end paths)
+ *   - modify / allow / none → should_proceed=true
+ *
+ * `should_proceed` from the response is authoritative and honored first; the
+ * action walk only enriches severity/instruction and provides a defensive
+ * fallback when actions imply a block the top-level flag didn't reflect.
+ */
+export function normalizeEvaluateResponse(data) {
+    const triggered = getTriggeredGuardrails(data).filter((g) => g.triggered);
+    let hardBlock = false;
+    let severity;
+    let injectedInstruction;
+    for (const g of triggered) {
+        for (const action of g.actions ?? []) {
+            if (action.action_type === "block") {
+                hardBlock = true;
+            }
+            else if (action.action_type === "warn") {
+                const r = action.result ?? {};
+                if (r.allow_proceed === false) {
+                    hardBlock = true;
+                }
+                else {
+                    if (r.warning_message && !injectedInstruction) {
+                        injectedInstruction = r.warning_message;
+                    }
+                    if (r.severity && !severity) {
+                        severity = r.severity;
+                    }
+                }
+            }
+        }
+    }
+    const shouldProceed = data.should_proceed !== false && !hardBlock;
+    return {
+        should_proceed: shouldProceed,
+        reason: extractBlockReason(data),
+        severity,
+        injected_instruction: injectedInstruction,
+    };
+}
+//# sourceMappingURL=extractors.js.map