@dudousxd/nestjs-agent-core 0.10.0 → 0.12.0

package/dist/index.cjs

@@ -49,6 +49,8 @@ __export(index_exports, {
   DEFAULT_TOOL_TRANSIENT_RETRY_BACKOFF_MS: () => DEFAULT_TOOL_TRANSIENT_RETRY_BACKOFF_MS,
   DefaultRolesPolicy: () => DefaultRolesPolicy,
   QuotaExceededError: () => QuotaExceededError,
+  THREAD_DETAIL_CONTENT_CHARS: () => THREAD_DETAIL_CONTENT_CHARS,
+  ToolDisabledError: () => ToolDisabledError,
   ToolForbiddenError: () => ToolForbiddenError,
   ToolInputInvalidError: () => ToolInputInvalidError,
   ToolNotFoundError: () => ToolNotFoundError,
@@ -58,12 +60,16 @@ __export(index_exports, {
   bucketByModel: () => bucketByModel,
   bucketByThread: () => bucketByThread,
   bucketUsageTrend: () => bucketUsageTrend,
+  canActorUseTool: () => canActorUseTool,
   dayBoundsUtc: () => dayBoundsUtc,
   encodeStreamEvent: () => encodeStreamEvent,
   estimateCost: () => estimateCost,
   filterToolsByAllowList: () => filterToolsByAllowList,
+  filterToolsByCanUse: () => filterToolsByCanUse,
+  filterToolsByEnabled: () => filterToolsByEnabled,
   filterToolsByRole: () => filterToolsByRole,
   invokeWithTransientRetry: () => invokeWithTransientRetry,
+  isToolEnabled: () => isToolEnabled,
   isTransientToolError: () => isTransientToolError,
   publishAgentDelegated: () => publishAgentDelegated,
   publishAgentMessage: () => publishAgentMessage,
@@ -75,10 +81,12 @@ __export(index_exports, {
   publishAgentToolCall: () => publishAgentToolCall,
   publishAgentToolRetry: () => publishAgentToolRetry,
   resolveToolTransientRetryNumbers: () => resolveToolTransientRetryNumbers,
+  rollupThreadUsage: () => rollupThreadUsage,
   runAgentLoop: () => runAgentLoop,
   seedModelPrices: () => seedModelPrices,
   traceLlmTurn: () => traceLlmTurn,
   traceToolExecution: () => traceToolExecution,
+  truncateDetailContent: () => truncateDetailContent,
   withToolTimeout: () => withToolTimeout
 });
 module.exports = __toCommonJS(index_exports);
@@ -134,6 +142,22 @@ async function seedModelPrices(store, prices) {
 }
 __name(seedModelPrices, "seedModelPrices");
 
+// src/spi/governance-queries.ts
+var THREAD_DETAIL_CONTENT_CHARS = 2e3;
+function truncateDetailContent(content) {
+  if (content.length <= THREAD_DETAIL_CONTENT_CHARS) {
+    return {
+      content,
+      truncated: false
+    };
+  }
+  return {
+    content: content.slice(0, THREAD_DETAIL_CONTENT_CHARS),
+    truncated: true
+  };
+}
+__name(truncateDetailContent, "truncateDetailContent");
+
 // src/governance/compute.ts
 function estimateCost(usage, price) {
   if (price === void 0) {
@@ -239,6 +263,24 @@ function bucketByThread(rows, prices, threads, options) {
   return result.slice(0, options.limit);
 }
 __name(bucketByThread, "bucketByThread");
+function rollupThreadUsage(rows, prices) {
+  const rollup = {
+    requests: 0,
+    inputTokens: 0,
+    outputTokens: 0,
+    totalTokens: 0,
+    costUsd: 0
+  };
+  for (const row of rows) {
+    rollup.requests += 1;
+    rollup.inputTokens += row.inputTokens;
+    rollup.outputTokens += row.outputTokens;
+    rollup.totalTokens += row.inputTokens + row.outputTokens;
+    rollup.costUsd += rowCost(row, prices);
+  }
+  return rollup;
+}
+__name(rollupThreadUsage, "rollupThreadUsage");
 function bucketUsageTrend(rows, prices) {
   const byDay = /* @__PURE__ */ new Map();
   for (const row of rows) {
@@ -271,6 +313,34 @@ function dayBoundsUtc(range) {
 __name(dayBoundsUtc, "dayBoundsUtc");
 
 // src/tool-filters.ts
+async function isToolEnabled(spec, handler) {
+  const declared = typeof spec.enabled === "function" ? await spec.enabled() : spec.enabled ?? true;
+  if (!declared) {
+    return false;
+  }
+  return handler?.isEnabled === void 0 ? true : await handler.isEnabled();
+}
+__name(isToolEnabled, "isToolEnabled");
+async function filterToolsByEnabled(entries) {
+  const checked = await Promise.all(entries.map(async (entry) => ({
+    entry,
+    enabled: await isToolEnabled(entry.spec, entry.handler)
+  })));
+  return checked.filter((row) => row.enabled).map((row) => row.entry);
+}
+__name(filterToolsByEnabled, "filterToolsByEnabled");
+async function canActorUseTool(actor, handler) {
+  return handler?.canUse === void 0 ? true : await handler.canUse(actor);
+}
+__name(canActorUseTool, "canActorUseTool");
+async function filterToolsByCanUse(entries, actor) {
+  const checked = await Promise.all(entries.map(async (entry) => ({
+    entry,
+    allowed: await canActorUseTool(actor, entry.handler)
+  })));
+  return checked.filter((row) => row.allowed).map((row) => row.entry);
+}
+__name(filterToolsByCanUse, "filterToolsByCanUse");
 async function filterToolsByRole(tools, actor, policy) {
   const checked = await Promise.all(tools.map(async (tool) => ({
     tool,
@@ -321,6 +391,16 @@ var ToolForbiddenError = class extends Error {
     this.name = "ToolForbiddenError";
   }
 };
+var ToolDisabledError = class extends Error {
+  static {
+    __name(this, "ToolDisabledError");
+  }
+  toolName;
+  constructor(toolName) {
+    super(`Tool "${toolName}" is disabled in this deployment`), this.toolName = toolName;
+    this.name = "ToolDisabledError";
+  }
+};
 var ToolNotFoundError = class extends Error {
   static {
     __name(this, "ToolNotFoundError");
@@ -364,10 +444,21 @@ var ToolRegistry = class {
       ...this.entries.values()
     ].map((entry) => entry.spec);
   }
-  /** The tools to offer the model for this actor+agent, after the two filter layers. */
+  /**
+  * The tools to offer the model for this actor+agent, after the four filter layers: what this
+  * deployment has enabled, what this actor's role allows, what each tool's own `canUse` allows
+  * this actor, and finally what this agent pinned.
+  *
+  * Every layer only ever removes tools, so no arrangement of them can widen what a turn reaches.
+  */
   async definitionsFor(actor, policy, allowedTools) {
-    const roleScoped = await filterToolsByRole(this.allSpecs(), actor, policy);
-    const allowScoped = filterToolsByAllowList(roleScoped, allowedTools);
+    const live = await filterToolsByEnabled([
+      ...this.entries.values()
+    ]);
+    const allowedByRole = new Set((await filterToolsByRole(live.map((entry) => entry.spec), actor, policy)).map((spec) => spec.name));
+    const roleScoped = live.filter((entry) => allowedByRole.has(entry.spec.name));
+    const actorScoped = await filterToolsByCanUse(roleScoped, actor);
+    const allowScoped = filterToolsByAllowList(actorScoped.map((entry) => entry.spec), allowedTools);
     return allowScoped.map((spec) => ({
       name: spec.name,
       kind: spec.kind,
@@ -375,15 +466,25 @@ var ToolRegistry = class {
       inputSchema: spec.inputSchema
     }));
   }
-  /** Run a tool. Re-checks the role (defense-in-depth) and re-parses the input via Zod. */
+  /**
+  * Run a tool. Re-checks that the tool is enabled and that the role allows it (defense-in-depth —
+  * a call can reach here from a replayed durable step or an approval granted before the flag
+  * moved, neither of which went through `definitionsFor` again) and re-parses the input via Zod.
+  */
   async invoke(name, input, ctx, policy) {
     const entry = this.entries.get(name);
     if (entry === void 0) {
       throw new ToolNotFoundError(name);
     }
+    if (!await isToolEnabled(entry.spec, entry.handler)) {
+      throw new ToolDisabledError(name);
+    }
     if (!await policy.can(ctx.actor, entry.spec)) {
       throw new ToolForbiddenError(name);
     }
+    if (!await canActorUseTool(ctx.actor, entry.handler)) {
+      throw new ToolForbiddenError(name);
+    }
     const validation = await entry.spec.inputSchema["~standard"].validate(input);
     if (validation.issues !== void 0) {
       throw new ToolInputInvalidError(name, validation.issues);
@@ -1261,6 +1362,8 @@ __name(runAgentLoop, "runAgentLoop");
   DEFAULT_TOOL_TRANSIENT_RETRY_BACKOFF_MS,
   DefaultRolesPolicy,
   QuotaExceededError,
+  THREAD_DETAIL_CONTENT_CHARS,
+  ToolDisabledError,
   ToolForbiddenError,
   ToolInputInvalidError,
   ToolNotFoundError,
@@ -1270,12 +1373,16 @@ __name(runAgentLoop, "runAgentLoop");
   bucketByModel,
   bucketByThread,
   bucketUsageTrend,
+  canActorUseTool,
   dayBoundsUtc,
   encodeStreamEvent,
   estimateCost,
   filterToolsByAllowList,
+  filterToolsByCanUse,
+  filterToolsByEnabled,
   filterToolsByRole,
   invokeWithTransientRetry,
+  isToolEnabled,
   isTransientToolError,
   publishAgentDelegated,
   publishAgentMessage,
@@ -1287,10 +1394,12 @@ __name(runAgentLoop, "runAgentLoop");
   publishAgentToolCall,
   publishAgentToolRetry,
   resolveToolTransientRetryNumbers,
+  rollupThreadUsage,
   runAgentLoop,
   seedModelPrices,
   traceLlmTurn,
   traceToolExecution,
+  truncateDetailContent,
   withToolTimeout
 });
 //# sourceMappingURL=index.cjs.map