@elevasis/core 0.1.0

package/src/execution/engine/llm/errors.ts

@@ -0,0 +1,186 @@
+/**
+ * LLM-related error classes
+ * Thrown from adapter layer, caught by execution layer
+ */
+
+import { ExecutionError } from '../base/errors'
+
+/**
+ * Base class for LLM-related errors
+ * Thrown from adapter layer, caught by execution layer
+ *
+ * Severity: warning (transient failures that may be retryable)
+ * Category: llm (LLM provider errors)
+ */
+export class LLMError extends ExecutionError {
+  readonly type: string = 'llm_error'
+  readonly severity: 'warning' | 'critical' = 'warning' as const
+  readonly category = 'llm' as const
+
+  constructor(message: string, context?: Record<string, unknown>) {
+    super(message, context)
+  }
+
+  override isRetryable(): boolean {
+    return true
+  }
+}
+
+/**
+ * Thrown when token configuration is insufficient for the model
+ * Wrapped as ExecutionError with code: AGENT_INSUFFICIENT_TOKENS
+ *
+ * Severity: critical (execution cannot continue without sufficient tokens)
+ * Category: llm
+ */
+export class InsufficientTokensError extends LLMError {
+  override readonly type = 'insufficient_tokens' as const
+  override readonly severity = 'critical' as const
+
+  constructor(message: string, context?: Record<string, unknown>) {
+    super(message, context)
+  }
+
+  override isRetryable(): boolean {
+    return false
+  }
+}
+
+/**
+ * Thrown when LLM hits token limit during generation
+ * Wrapped as ExecutionError with code: AGENT_TOKEN_LIMIT_EXCEEDED
+ *
+ * Severity: critical (execution cannot continue, token limit exceeded)
+ * Category: llm
+ */
+export class TokenLimitExceededError extends LLMError {
+  override readonly type = 'token_limit_exceeded' as const
+  override readonly severity = 'critical' as const
+
+  constructor(message: string, context?: Record<string, unknown>) {
+    super(message, context)
+  }
+
+  override isRetryable(): boolean {
+    return false
+  }
+}
+
+/**
+ * Thrown when LLM response cannot be parsed as valid JSON
+ * This is a transient error - the LLM may produce valid JSON on retry
+ *
+ * Severity: warning (transient failure that may succeed on retry)
+ * Category: llm
+ */
+export class LLMResponseParseError extends LLMError {
+  override readonly type = 'llm_response_parse_error' as const
+  override readonly severity = 'warning' as const
+
+  constructor(message: string, context?: Record<string, unknown>) {
+    super(message, context)
+  }
+
+  override isRetryable(): boolean {
+    return true // JSON parse failures are transient LLM errors
+  }
+}
+
+/**
+ * Thrown when model configuration is invalid
+ * Provides structured information for debugging
+ *
+ * Severity: warning (configuration error that blocks execution but is user-correctable)
+ * Category: validation (user/developer input validation)
+ */
+export class ModelConfigError extends ExecutionError {
+  readonly type = 'model_config_error' as const
+  readonly severity = 'warning' as const
+  readonly category = 'validation' as const
+
+  constructor(
+    message: string,
+    public field: string,
+    public model: string,
+    context?: Record<string, unknown>
+  ) {
+    super(message, { ...context, field, model })
+  }
+}
+
+/**
+ * Thrown when input is blocked by prompt injection sanitization
+ * This is NOT a service failure - it means the security layer is working correctly
+ *
+ * Severity: warning (system working as designed, not a failure)
+ * Category: validation (input validation, not infrastructure)
+ */
+export class LLMInputBlockedError extends ExecutionError {
+  readonly type = 'input_blocked' as const
+  readonly severity = 'warning' as const
+  readonly category = 'validation' as const
+
+  constructor(warnings: string[]) {
+    super(`Input blocked: ${warnings.join(', ')} prompt injection patterns detected`, {
+      warnings,
+      patternCount: warnings.length
+    })
+  }
+
+  override isRetryable(): boolean {
+    return false // Same input will always be blocked
+  }
+}
+
+// ============================================================================
+// Model Configuration Validation
+// ============================================================================
+
+import { getModelInfo, type ModelConfig } from './model-info'
+
+/**
+ * Validate model configuration using consolidated Zod schema
+ * Validates constraints (temperature, maxOutputTokens) AND model-specific options
+ *
+ * @example
+ * // Valid config
+ * validateModelConfig({ model: 'gpt-5', temperature: 1, modelOptions: { reasoning_effort: 'low' } }) // ✓
+ *
+ * // Invalid temperature
+ * validateModelConfig({ model: 'gpt-5', temperature: 0.7 }) // ✗ Throws ModelConfigError
+ *
+ * // Invalid option
+ * validateModelConfig({ model: 'mock', modelOptions: { reasoning_effort: 'low' } }) // ✗ Throws ModelConfigError
+ *
+ * @param config - Complete model configuration to validate
+ * @throws {ModelConfigError} If validation fails (uses Zod for runtime validation)
+ */
+export function validateModelConfig(config: ModelConfig): void {
+  const model = config.model as string
+
+  if (!model) {
+    throw new ModelConfigError('Missing model field', 'model', 'unknown')
+  }
+
+  const modelInfo = getModelInfo(model)
+
+  if (!modelInfo) {
+    throw new ModelConfigError(`Unknown model: ${model}`, 'model', model)
+  }
+
+  // If model has no schema, skip validation
+  if (!modelInfo.configSchema) {
+    return
+  }
+
+  // Validate using consolidated Zod schema
+  const result = modelInfo.configSchema.safeParse(config)
+
+  if (!result.success) {
+    const firstError = result.error.issues[0]
+    const fieldPath = firstError.path.join('.')
+    const fieldName = fieldPath || 'config'
+
+    throw new ModelConfigError(`Invalid config for ${model}: ${firstError.message}`, fieldName, model)
+  }
+}

package/src/execution/engine/llm/input-sanitizer.ts

@@ -0,0 +1,129 @@
+// SECURITY FIX: Rank 5A - Basic Prompt Injection Pattern Blocking
+// Sanitizes user input to detect and block common prompt injection attacks
+
+/**
+ * Result of input sanitization
+ */
+export interface SanitizationResult {
+  /** Original input (use this if not blocked) */
+  original: unknown
+  /** Sanitized input text (with attack patterns redacted) */
+  sanitized: string
+  /** List of detected attack pattern types */
+  warnings: string[]
+  /** Whether input is blocked (3+ distinct attack types) */
+  blocked: boolean
+}
+
+/**
+ * Sanitize user input to detect and block prompt injection attacks
+ *
+ * Basic pattern blocking for common attack vectors:
+ * 1. System prompt extraction attempts
+ * 2. Role manipulation attempts
+ * 3. Delimiter injection (fake system sections)
+ * 4. Tool/function injection attempts
+ *
+ * Blocking threshold: 3+ distinct warning types indicates sophisticated attack
+ *
+ * @param input - User input (any format)
+ * @returns Sanitization result with warnings, sanitized text, and blocked status
+ */
+export function sanitizeUserInput(input: unknown): SanitizationResult {
+  let text: string
+
+  // Extract text from input (string or {message: "..."} format)
+  if (typeof input === 'string') {
+    text = input
+  } else if (input && typeof input === 'object' && 'message' in input) {
+    text = String((input as Record<string, unknown>).message)
+  } else if (input === null || input === undefined) {
+    text = ''
+  } else {
+    text = JSON.stringify(input)
+  }
+
+  const warnings: string[] = []
+  let sanitized = text
+
+  // Pattern 1: System prompt extraction attempts
+  const systemPromptPatterns = [
+    /ignore\s+(all\s+)?instructions?/i,
+    /ignore\s+(all\s+)?(previous|prior|above)/i,
+    /disregard\s+(all\s+)?(previous|system)\s+instructions?/i,
+    /print\s+(your\s+)?(system\s+)?prompt/i,
+    /(show|tell)\s+(me\s+)?your\s+(system\s+)?prompt/i,
+    /what\s+(are|is)\s+your\s+(system\s+)?instructions?/i,
+    /show\s+(me\s+)?your\s+configuration/i,
+    /repeat\s+everything\s+before/i
+  ]
+
+  for (const pattern of systemPromptPatterns) {
+    if (pattern.test(text)) {
+      warnings.push('system_prompt_extraction')
+      sanitized = sanitized.replace(pattern, '[REDACTED: system prompt extraction attempt]')
+      break
+    }
+  }
+
+  // Pattern 2: Role manipulation attempts
+  const rolePatterns = [
+    /you\s+are\s+now\s+(a|an|the)/i,
+    /act\s+as\s+(a|an|the)/i,
+    /pretend\s+(you\s+are|to\s+be)/i,
+    /from\s+now\s+on,?\s+you/i,
+    /forget\s+your\s+(previous\s+)?role/i,
+    /jailbreak/i
+  ]
+
+  for (const pattern of rolePatterns) {
+    if (pattern.test(text)) {
+      warnings.push('role_manipulation')
+      sanitized = sanitized.replace(pattern, '[REDACTED: role manipulation attempt]')
+      break
+    }
+  }
+
+  // Pattern 3: Delimiter injection (fake system sections)
+  const delimiterPatterns = [
+    /^\s*={3,}/m,           // === at line start (with optional whitespace)
+    /^\s*-{3,}/m,           // --- at line start (with optional whitespace)
+    /^\s*#{2,}\s*SYSTEM/mi, // ## SYSTEM headers (with optional whitespace)
+    /<\|?system\|?>/i       // <system> or <|system|> tags
+  ]
+
+  for (const pattern of delimiterPatterns) {
+    if (pattern.test(text)) {
+      warnings.push('delimiter_injection')
+      sanitized = sanitized.replace(pattern, '[REDACTED: delimiter injection]')
+      break
+    }
+  }
+
+  // Pattern 4: Tool/function injection attempts
+  const toolPatterns = [
+    /<function[>\s]/i,
+    /<tool[>\s]/i,
+    /"type":\s*"tool_call"/i
+  ]
+
+  for (const pattern of toolPatterns) {
+    if (pattern.test(text)) {
+      warnings.push('tool_injection')
+      sanitized = sanitized.replace(pattern, '[REDACTED: tool injection attempt]')
+      break
+    }
+  }
+
+  // Decision: Block if 3+ distinct warning types detected
+  // (This indicates a sophisticated, multi-vector attack)
+  const uniqueWarnings = [...new Set(warnings)]
+  const blocked = uniqueWarnings.length >= 3
+
+  return {
+    original: input,
+    sanitized,
+    warnings: uniqueWarnings,
+    blocked
+  }
+}

package/src/execution/engine/llm/model-info.ts

@@ -0,0 +1,332 @@
+/**
+ * Model Configuration
+ * Centralized model information, configuration, options, constraints, and validation
+ * Single source of truth for all model-related definitions
+ * Update manually when pricing changes or new models are added
+ */
+
+import { z } from 'zod'
+
+// ============================================================================
+// Model Types
+// ============================================================================
+
+/**
+ * Supported Open AI models (direct SDK access)
+ */
+export type OpenAIModel = 'gpt-5' | 'gpt-5.4-mini' | 'gpt-5.4-nano'
+
+/**
+ * Supported OpenRouter models (explicit union for type safety)
+ */
+export type OpenRouterModel = 'openrouter/z-ai/glm-5'
+
+/**
+ * Supported Google models (direct SDK access)
+ */
+export type GoogleModel = 'gemini-3-flash-preview' | 'gemini-3.1-flash-lite-preview'
+
+/**
+ * Supported Anthropic models (direct SDK access via @anthropic-ai/sdk)
+ */
+export type AnthropicModel = 'claude-sonnet-4-5'
+
+/** Supported LLM models */
+export type LLMModel = OpenAIModel | OpenRouterModel | GoogleModel | AnthropicModel | 'mock'
+
+// ============================================================================
+// Model Configuration Schemas (Schema-First - Single Source of Truth)
+// ============================================================================
+
+/**
+ * GPT-5 model options schema
+ */
+const GPT5OptionsSchema = z.object({
+  reasoning_effort: z.enum(['minimal', 'low', 'medium', 'high']).optional(),
+  verbosity: z.enum(['low', 'medium', 'high']).optional()
+})
+
+/**
+ * GPT-5 family complete config schema
+ * Validates entire ModelConfig including constraints and options
+ * GPT-5, GPT-5.4-mini, and GPT-5.4-nano share same validation rules
+ */
+export const GPT5ConfigSchema = z.object({
+  model: z.enum(['gpt-5', 'gpt-5.4-mini', 'gpt-5.4-nano']),
+  provider: z.enum(['openai']),
+  apiKey: z.string(),
+  temperature: z.literal(1), // Required to be exactly 1
+  maxOutputTokens: z.number().min(4000).optional(),
+  topP: z.number().min(0).max(1).optional(),
+  modelOptions: GPT5OptionsSchema.optional()
+})
+
+/**
+ * Mock model config schema
+ */
+export const MockConfigSchema = z.object({
+  model: z.enum(['mock']),
+  provider: z.enum(['mock']),
+  apiKey: z.string(),
+  temperature: z.number().min(0).max(2).optional(),
+  maxOutputTokens: z.number().min(500).optional(),
+  topP: z.number().min(0).max(1).optional(),
+  modelOptions: z.object({}).strict().optional() // No options supported
+})
+
+/**
+ * OpenRouter model options schema
+ * OpenRouter-specific options for routing and transforms
+ */
+const OpenRouterOptionsSchema = z.object({
+  /** Optional transforms to apply (e.g., 'middle-out' for long context) */
+  transforms: z.array(z.string()).optional(),
+  /** Routing strategy (e.g., 'fallback' for automatic provider failover) */
+  route: z.enum(['fallback']).optional()
+})
+
+/**
+ * OpenRouter config schema
+ * Validates ModelConfig for OpenRouter provider
+ */
+export const OpenRouterConfigSchema = z.object({
+  model: z.enum(['openrouter/z-ai/glm-5']),
+  provider: z.literal('openrouter'),
+  apiKey: z.string(),
+  temperature: z.number().min(0).max(2).optional(),
+  maxOutputTokens: z.number().min(500).optional(),
+  topP: z.number().min(0).max(1).optional(),
+  modelOptions: OpenRouterOptionsSchema.optional()
+})
+
+/**
+ * Google model options schema
+ * Gemini 3 specific options for thinking depth control
+ */
+const GoogleOptionsSchema = z.object({
+  /** Thinking level for Gemini 3 models (controls reasoning depth) */
+  thinkingLevel: z.enum(['minimal', 'low', 'medium', 'high']).optional()
+})
+
+/**
+ * Google config schema
+ * Validates ModelConfig for Google provider (direct SDK access)
+ */
+export const GoogleConfigSchema = z.object({
+  model: z.enum(['gemini-3-flash-preview', 'gemini-3.1-flash-lite-preview']),
+  provider: z.literal('google'),
+  apiKey: z.string(),
+  temperature: z.number().min(0).max(2).optional(),
+  maxOutputTokens: z.number().min(500).optional(),
+  topP: z.number().min(0).max(1).optional(),
+  modelOptions: GoogleOptionsSchema.optional()
+})
+
+/**
+ * Anthropic model options schema
+ * Currently empty - future options: budget_tokens for extended thinking
+ */
+const AnthropicOptionsSchema = z.object({})
+
+/**
+ * Anthropic config schema
+ * Validates ModelConfig for Anthropic provider (direct SDK access)
+ */
+export const AnthropicConfigSchema = z.object({
+  model: z.enum(['claude-sonnet-4-5']),
+  provider: z.literal('anthropic'),
+  apiKey: z.string(),
+  temperature: z.number().min(0).max(1).optional(),
+  maxOutputTokens: z.number().min(1000).optional(), // Anthropic requires max_tokens
+  topP: z.number().min(0).max(1).optional(),
+  modelOptions: AnthropicOptionsSchema.optional()
+})
+
+/**
+ * Infer TypeScript types from schemas
+ */
+export type GPT5Options = z.infer<typeof GPT5OptionsSchema>
+export type MockOptions = Record<string, never>
+export type OpenRouterOptions = z.infer<typeof OpenRouterOptionsSchema>
+export type GoogleOptions = z.infer<typeof GoogleOptionsSchema>
+export type AnthropicOptions = z.infer<typeof AnthropicOptionsSchema>
+export type ModelSpecificOptions = GPT5Options | MockOptions | OpenRouterOptions | GoogleOptions | AnthropicOptions
+
+// ============================================================================
+// Model Configuration
+// ============================================================================
+
+/**
+ * Model configuration for LLM execution
+ * Belongs in resource definition (AgentDefinition, WorkflowDefinition, etc.)
+ */
+export interface ModelConfig {
+  model: LLMModel
+  provider: 'openai' | 'anthropic' | 'openrouter' | 'google' | 'mock'
+  apiKey: string
+  temperature?: number
+  /** Maximum output tokens per LLM call. NOT the model's context window — see ModelInfo.maxTokens for that. */
+  maxOutputTokens?: number
+  topP?: number
+
+  /**
+   * Model-specific options (flat structure)
+   * Options are model-specific, not vendor-specific
+   * Available options defined in MODEL_INFO per model
+   * Validated at build time via validateModelOptions()
+   */
+  modelOptions?: ModelSpecificOptions
+}
+
+// ============================================================================
+// Model Metadata
+// ============================================================================
+
+export interface ModelInfo {
+  /** Cost in cents per 1M input tokens */
+  inputCostPer1M: number
+  /** Cost in cents per 1M output tokens */
+  outputCostPer1M: number
+  /** Minimum tokens required for reliable output generation */
+  minTokens: number
+  /** Recommended tokens for production use (typically 2x minimum) */
+  recommendedTokens: number
+  /** Maximum context window size (total tokens: input + output) */
+  maxTokens: number
+  /** Model category for grouping and documentation */
+  category: 'reasoning' | 'standard' | 'embedding'
+  /** Zod schema for validating complete ModelConfig (replaces constraints + optionsSchema) */
+  configSchema?: z.ZodType<ModelConfig>
+}
+
+// Model configuration as of 2026-03-17
+export const MODEL_INFO: Record<LLMModel, ModelInfo> = {
+  // OpenAI GPT-5 (Reasoning Models)
+  'gpt-5': {
+    inputCostPer1M: 125, // $1.25 per 1M tokens
+    outputCostPer1M: 1000, // $10.00 per 1M tokens
+    minTokens: 4000, // Reasoning models need more
+    recommendedTokens: 8000,
+    maxTokens: 400000, // 400k context window
+    category: 'reasoning',
+    configSchema: GPT5ConfigSchema
+  },
+  'gpt-5.4-mini': {
+    inputCostPer1M: 75, // $0.75 per 1M tokens
+    outputCostPer1M: 450, // $4.50 per 1M tokens
+    minTokens: 4000, // Reasoning models need more
+    recommendedTokens: 8000,
+    maxTokens: 400000, // 400k context window
+    category: 'reasoning',
+    configSchema: GPT5ConfigSchema
+  },
+  'gpt-5.4-nano': {
+    inputCostPer1M: 20, // $0.20 per 1M tokens
+    outputCostPer1M: 125, // $1.25 per 1M tokens
+    minTokens: 4000,
+    recommendedTokens: 8000,
+    maxTokens: 400000, // 400k context window
+    category: 'standard',
+    configSchema: GPT5ConfigSchema
+  },
+  // Mock model for testing
+  mock: {
+    inputCostPer1M: 0, // Free for tests
+    outputCostPer1M: 0,
+    minTokens: 500, // Low minimum for test flexibility
+    recommendedTokens: 1000,
+    maxTokens: 100000, // 100k for testing
+    category: 'standard',
+    configSchema: MockConfigSchema
+  },
+  // OpenRouter Models (via openrouter.ai)
+  'openrouter/z-ai/glm-5': {
+    inputCostPer1M: 72, // $0.72 per 1M tokens
+    outputCostPer1M: 230, // $2.30 per 1M tokens
+    minTokens: 4000,
+    recommendedTokens: 4000,
+    maxTokens: 202752, // 202,752 context window
+    category: 'standard',
+    configSchema: OpenRouterConfigSchema
+  },
+  // Google Gemini Models (direct SDK access via @google/genai)
+  'gemini-3-flash-preview': {
+    inputCostPer1M: 50, // $0.50 per 1M tokens
+    outputCostPer1M: 300, // $3.00 per 1M tokens
+    minTokens: 4000,
+    recommendedTokens: 8000,
+    maxTokens: 1000000, // 1M context window
+    category: 'standard',
+    configSchema: GoogleConfigSchema
+  },
+  'gemini-3.1-flash-lite-preview': {
+    inputCostPer1M: 25, // $0.25 per 1M tokens
+    outputCostPer1M: 150, // $1.50 per 1M tokens
+    minTokens: 4000,
+    recommendedTokens: 8000,
+    maxTokens: 1000000, // 1M context window
+    category: 'standard',
+    configSchema: GoogleConfigSchema
+  },
+  // Anthropic Claude Models (direct SDK access via @anthropic-ai/sdk)
+  'claude-sonnet-4-5': {
+    inputCostPer1M: 300, // $3.00 per 1M tokens
+    outputCostPer1M: 1500, // $15.00 per 1M tokens
+    minTokens: 4000,
+    recommendedTokens: 8000,
+    maxTokens: 200000, // 200k context window
+    category: 'standard',
+    configSchema: AnthropicConfigSchema
+  }
+}
+
+/**
+ * Get model information (pricing and token requirements)
+ * Supports exact match and prefix matching (e.g., 'gpt-5-preview' matches 'gpt-5')
+ *
+ * @param model - Model name (e.g., 'gpt-5.4-mini')
+ * @returns Model info or undefined if not found
+ */
+export function getModelInfo(model: string): ModelInfo | undefined {
+  // Check exact match first
+  if (model in MODEL_INFO) {
+    return MODEL_INFO[model as LLMModel]
+  }
+
+  // Check prefix match (e.g., gpt-5-preview -> gpt-5)
+  for (const [knownModel, info] of Object.entries(MODEL_INFO)) {
+    if (model.startsWith(knownModel)) {
+      return info
+    }
+  }
+
+  return undefined
+}
+
+/**
+ * Calculate cost in USD for LLM usage
+ *
+ * @param model - Model name (e.g., 'gpt-5.4-mini')
+ * @param inputTokens - Number of input tokens
+ * @param outputTokens - Number of output tokens
+ * @returns Cost in USD with full decimal precision (no rounding)
+ */
+export function calculateCost(model: string, inputTokens: number, outputTokens: number): number {
+  const info = getModelInfo(model)
+
+  if (!info) {
+    // Unknown model - return 0 cost but log warning
+    console.warn(
+      `[CostCalculator] Unknown model '${model}' - cannot calculate cost. Available models:`,
+      Object.keys(MODEL_INFO)
+    )
+    return 0
+  }
+
+  // Calculate in USD with full precision (pricing is in cents per 1M)
+  const inputCostUsd = (inputTokens / 1_000_000) * (info.inputCostPer1M / 100)
+  const outputCostUsd = (outputTokens / 1_000_000) * (info.outputCostPer1M / 100)
+  const totalCostUsd = inputCostUsd + outputCostUsd
+
+  return totalCostUsd
+}