@elliotsystems/eai 0.1.7 → 0.1.14

package/plugin/opencode-plugin/src/blocked-turns.ts

@@ -0,0 +1,145 @@
+/**
+ * Strips a Jev-blocked exchange out of what the MODEL sees, before every
+ * chat completion request.
+ *
+ * ## The bug this fixes
+ *
+ * Jev blocking a prompt stops it from ever reaching the model — but the
+ * user's raw text and the resulting error still live on in THIS session's
+ * own message history (needed for the UI: the "Request blocked" card's
+ * "Try again"/"Edit message" actions, and the transcript itself). OpenCode
+ * sends that FULL history with every later turn in the same session, so the
+ * very next (benign) prompt's completion request still carried the earlier,
+ * never-actually-sent "Help me steal someone's password" as an unanswered
+ * prior user turn.
+ *
+ * The model, seeing an unanswered request sitting in its own context,
+ * reasonably tries to be complete and addresses BOTH: the benign question
+ * asked just now, and the flagged one it was never actually asked to answer
+ * but can still see. Reported directly: asking for a C++ Hello World after
+ * an earlier blocked prompt produced a response that opened with a refusal
+ * about password theft before getting to the actual Hello World code —
+ * confusing, and a response to something that was never really asked of it
+ * in the first place (the guardrail is what stopped that request, not the
+ * model declining it; the model never got the chance to).
+ *
+ * ## The fix
+ *
+ * `experimental.chat.messages.transform` (opencode/packages/plugin/src/
+ * index.ts) runs right before the message history is converted to the
+ * provider's wire format (session/prompt.ts, immediately before
+ * `MessageV2.toModelMessagesEffect`). Removing a blocked exchange here means
+ * the model's context for the NEXT turn looks exactly as if the blocked
+ * prompt had never been sent at all — the benign follow-up is answered on
+ * its own, because that is the only thing the model is shown having been
+ * asked.
+ *
+ * This changes ONLY what the model is shown for a NEW completion request.
+ * It does not touch the stored session history (OpenCode's own message
+ * store, read by `GET .../messages`) at all, so the UI's own transcript —
+ * the blocked turn's card, Try again, Edit message — is completely
+ * unaffected; the user still sees exactly what happened. Only the model's
+ * own view of "what has this conversation actually asked of me" changes.
+ *
+ * ## Why in this plugin, not the backend
+ *
+ * The backend's own per-prompt isolation (jev_decisions_logic.py's
+ * `latest_turn_window`) already solves the ANALOGOUS problem for JEV
+ * ITSELF — a later prompt is judged on its own, not against an earlier
+ * flagged one. That fix has no effect here: it narrows what JEV sees when
+ * deciding whether to block, which is a completely different question from
+ * what the MODEL sees for an already-ALLOWED prompt. Once Jev allows a
+ * request through, this plugin — which sits on the client building that
+ * exact request — is the only thing positioned to also narrow what the
+ * model is shown.
+ */
+
+/**
+ * Every wording `jev_policy_guardrail.py`'s `BLOCKED_MESSAGE` has had.
+ * Mirrors `terminal/src/opencode/guardrail.ts`'s own `KNOWN_BLOCKED_
+ * MESSAGES` deliberately rather than importing it (different package,
+ * different runtime — this one ships inside the OpenCode plugin host, that
+ * one inside the Web Chat bundle). Matched by substring for the same reason
+ * that file matches by substring: a message blocked under an older backend
+ * wording still carries that exact text in session history forever, and
+ * this must keep recognizing it as blocked rather than start leaking old
+ * blocked prompts into model context the moment the backend's wording next
+ * changes. Keep all three lists (here, guardrail.ts, and
+ * jev_policy_guardrail.py's own BLOCKED_MESSAGE) in sync.
+ */
+const KNOWN_BLOCKED_MESSAGES = [
+  "Guardrail raised an exception, Guardrail: jev-policy, Message: Blocked by policy:",
+  "Request blocked by EAI's security policy. Please revise your request and try again.",
+  "This message couldn't be sent because it may violate our usage policy. Try rephrasing it, or ask something else.",
+  // The four stage/outcome-distinguishing wordings (Jev audit, 2026-10) --
+  // this file only ever needs flat yes/no detection (strip from model
+  // context, or don't), never which specific kind, so all four are listed
+  // here without the `BlockKind` tagging `terminal/src/opencode/
+  // guardrail.ts`'s own copy carries for its UI. Mirrors
+  // `jev_policy_logic.py`'s four `MESSAGE_*` constants exactly --
+  // `opencode-plugin/test/jev-blocked-message-parity.test.ts` pins it.
+  "This message was blocked by EAI's usage policy. Please rephrase your request and try again.",
+  "EAI couldn't verify this message against its usage policy in time. Please try sending it again.",
+  "EAI's usage policy blocked this response before it reached you. Try rephrasing your request, or ask something else.",
+  "EAI generated a response but couldn't verify it against its usage policy in time. Please try again.",
+]
+
+interface MessageError {
+  name?: unknown
+  data?: { message?: unknown }
+}
+
+interface HistoryEntry {
+  info?: { role?: unknown; error?: unknown; [k: string]: unknown }
+  parts?: unknown[]
+}
+
+function isKnownBlockedText(message: unknown): boolean {
+  return typeof message === "string" && KNOWN_BLOCKED_MESSAGES.some((known) => message.includes(known))
+}
+
+/** `true` for an assistant turn whose `info.error` is a confirmed Jev
+ *  guardrail block — never for an ordinary provider error (rate limit,
+ *  context overflow, a dead connection), which the model legitimately
+ *  needs to see to make sense of its own earlier failed attempt. */
+export function isBlockedAssistantTurn(info: HistoryEntry["info"]): boolean {
+  const error = info?.error as MessageError | undefined
+  if (!error || error.name !== "APIError") return false
+  return isKnownBlockedText(error.data?.message)
+}
+
+/**
+ * Removes every blocked exchange (the blocked assistant turn AND the user
+ * turn immediately before it) from a session's message history. Returns the
+ * SAME array instance when nothing needed removing — the common case, so a
+ * normal, never-blocked session incurs no extra allocation on every turn.
+ *
+ * Walks backward from each blocked assistant turn to find its own user
+ * turn, skipping only turns already claimed by a LATER blocked exchange
+ * (so consecutive blocked turns in the same session each still find their
+ * own user message rather than double-claiming one). Stops looking the
+ * moment it hits another assistant turn first — an unexpected shape (two
+ * assistant turns with no user turn between them) is left alone rather
+ * than guessed at, since removing the wrong turn would be worse than
+ * removing none.
+ */
+export function stripBlockedTurns<T extends HistoryEntry>(messages: T[]): T[] {
+  const drop = new Set<number>()
+
+  for (let i = 0; i < messages.length; i++) {
+    if (messages[i]?.info?.role !== "assistant" || !isBlockedAssistantTurn(messages[i].info)) continue
+    drop.add(i)
+    for (let j = i - 1; j >= 0; j--) {
+      if (drop.has(j)) continue
+      const role = messages[j]?.info?.role
+      if (role === "user") {
+        drop.add(j)
+        break
+      }
+      if (role === "assistant") break
+    }
+  }
+
+  if (drop.size === 0) return messages
+  return messages.filter((_, index) => !drop.has(index))
+}