@gatebolt/agent-redroom 0.1.0

package/dist/sidecar/tool-hook.js

@@ -0,0 +1,147 @@
+import {} from "node:http";
+import { z } from "zod";
+import { findSecrets } from "../secrets.js";
+import { DETAIL_LIMIT, isRecord, messageOf, } from "../types.js";
+import { BodyTooLargeError, jsonServer, readBody, readJson, sendJson, } from "./http.js";
+import { push, sourceIp } from "./state.js";
+export const CHECK_TIMEOUT_MS = 25_000;
+const hookSchema = z.object({
+    tool_name: z.string(),
+    tool_input: z.unknown().default({}),
+    tool_use_id: z.string().default(""),
+});
+function parseJson(text) {
+    try {
+        return JSON.parse(text);
+    }
+    catch {
+        return undefined;
+    }
+}
+export function actionOf(response) {
+    if (!isRecord(response))
+        return "allow";
+    if (response.decision === "block")
+        return "deny";
+    const specific = response.hookSpecificOutput;
+    const decision = isRecord(specific) ? specific.permissionDecision : undefined;
+    return decision === "deny" || decision === "ask" ? decision : "allow";
+}
+const deny = (reason) => ({
+    hookSpecificOutput: {
+        hookEventName: "PreToolUse",
+        permissionDecision: "deny",
+        permissionDecisionReason: reason,
+    },
+});
+const readText = async (answer) => answer.body ? (await readBody(answer.body)).toString("utf8") : "";
+function failureCode(error) {
+    if (error instanceof BodyTooLargeError)
+        return "response_too_large";
+    const name = error instanceof Error ? error.name : "";
+    return name === "TimeoutError" ? "timeout" : "network_error";
+}
+async function askCheck(context, check, runId, payload) {
+    const started = Date.now();
+    const call = (status) => ({
+        url: check.url,
+        ...(status === undefined ? {} : { status }),
+        durationMs: Date.now() - started,
+    });
+    const failed = (code, detail, status) => {
+        const error = {
+            by: "toolCallCheck",
+            code,
+            detail: detail.slice(0, DETAIL_LIMIT),
+            call: call(status),
+        };
+        return {
+            response: deny(`Tool call check unavailable (${code})`),
+            error,
+        };
+    };
+    let answer;
+    let text;
+    try {
+        answer = await context.fetch(check.url, {
+            method: "POST",
+            headers: {
+                ...check.headers,
+                "content-type": "application/json",
+                "x-redroom-run": runId,
+            },
+            body: JSON.stringify(payload),
+            signal: AbortSignal.any([
+                context.signal,
+                AbortSignal.timeout(context.timeoutMs),
+            ]),
+        });
+        text = await readText(answer);
+    }
+    catch (error) {
+        return failed(failureCode(error), messageOf(error));
+    }
+    if (!answer.ok)
+        return failed(`http_${answer.status}`, text, answer.status);
+    const response = parseJson(text);
+    return isRecord(response)
+        ? { response }
+        : failed("invalid_response", text, answer.status);
+}
+export function createToolHook(context) {
+    return jsonServer(async (req, res) => {
+        const runId = /^\/hook\/([^/?]+)$/.exec(req.url ?? "")?.[1];
+        const run = runId ? context.state.runs.get(runId) : undefined;
+        const source = sourceIp(req, context.trustTestSourceHeader);
+        const owned = run?.ip === source ? run : undefined;
+        if (req.method !== "POST" || !runId || !owned) {
+            return sendJson(res, 404, {});
+        }
+        const started = Date.now();
+        const refuse = (status, code, detail, hookPayload = null) => {
+            push(owned.toolCalls, {
+                toolUseId: "",
+                tool: "",
+                input: null,
+                hookPayload,
+                response: {},
+                action: "deny",
+                checked: false,
+                latencyMs: Date.now() - started,
+                at: new Date(started).toISOString(),
+                error: { by: "sidecar", code, detail: detail.slice(0, DETAIL_LIMIT) },
+            });
+            sendJson(res, status, {});
+        };
+        let payload;
+        try {
+            payload = await readJson(req);
+        }
+        catch (error) {
+            return error instanceof BodyTooLargeError
+                ? refuse(413, "payload_too_large", messageOf(error))
+                : refuse(400, "invalid_payload", messageOf(error));
+        }
+        const hook = hookSchema.safeParse(payload);
+        if (!hook.success) {
+            return refuse(400, "invalid_payload", hook.error.message, payload);
+        }
+        const check = owned.toolCallCheck;
+        const checked = check
+            ? await askCheck(context, check, runId, payload)
+            : { response: {} };
+        push(owned.toolCalls, {
+            toolUseId: hook.data.tool_use_id,
+            tool: hook.data.tool_name,
+            input: hook.data.tool_input,
+            hookPayload: payload,
+            response: checked.response,
+            action: actionOf(checked.response),
+            checked: check !== undefined,
+            latencyMs: Date.now() - started,
+            at: new Date(started).toISOString(),
+            ...(checked.error ? { error: checked.error } : {}),
+        }, findSecrets(String(JSON.stringify(hook.data.tool_input)), owned.secrets));
+        sendJson(res, 200, checked.response);
+    });
+}