@hunterzhu/pulse-adapters 0.4.1 → 0.4.2

package/dist/providers/normalize.js

@@ -116,10 +116,31 @@ export function normalizeOpenAIResponse(response, toolNameAliases, provider = 'o
         throw providerResponseError('OpenAI response must contain at least one choice');
     const choice = providerRecord(root.choices[0], 'OpenAI choice');
     const message = providerRecord(choice.message, 'OpenAI message');
-    const toolCalls = choice.finish_reason === 'length' || message.tool_calls === undefined ? [] : normalizeOpenAIToolCalls(message.tool_calls, toolNameAliases);
+    const nativeToolCalls = choice.finish_reason === 'length' || message.tool_calls === undefined ? [] : normalizeOpenAIToolCalls(message.tool_calls, toolNameAliases);
     const refusal = message.refusal == null ? undefined : requiredProviderString(message.refusal, 'OpenAI refusal');
-    const text = providerText(message.content, 'OpenAI message content');
-    const finishReason = normalizeOpenAIFinishReason(choice.finish_reason, refusal, toolCalls.length > 0);
+    let text = providerText(message.content, 'OpenAI message content');
+    let finishReason = normalizeOpenAIFinishReason(choice.finish_reason, refusal, nativeToolCalls.length > 0);
+    let toolCalls = nativeToolCalls;
+    if (provider === 'deepseek' && (finishReason === 'stop' || nativeToolCalls.length > 0)) {
+        const recovered = recoverDeepSeekDsml(text, toolNameAliases, nativeToolCalls.length === 0);
+        text = recovered.text;
+        if (nativeToolCalls.length === 0 && recovered.truncated) {
+            toolCalls = [];
+            finishReason = 'length';
+        }
+        else if (nativeToolCalls.length === 0 && recovered.calls.length > 0) {
+            toolCalls = recovered.calls.map((call, index) => ({ toolCallId: `pulse-tool-${index + 1}`, providerToolCallId: `dsml-${index + 1}`, providerToolName: call.providerToolName, providerToolArguments: call.providerToolArguments, name: call.name, input: call.input }));
+            finishReason = 'tool_calls';
+        }
+    }
+    if (provider === 'deepseek' && nativeToolCalls.length === 0 && finishReason === 'stop' && toolCalls.length === 0) {
+        const jsonCalls = recoverDeepSeekJsonToolCalls(text, toolNameAliases);
+        if (jsonCalls !== undefined) {
+            text = '';
+            toolCalls = jsonCalls.map((call, index) => ({ toolCallId: `pulse-tool-${index + 1}`, providerToolCallId: `json-${index + 1}`, providerToolName: call.providerToolName, providerToolArguments: call.providerToolArguments, name: call.name, input: call.input }));
+            finishReason = 'tool_calls';
+        }
+    }
     const rawUsage = root.usage === undefined ? undefined : providerRecord(root.usage, 'OpenAI usage');
     const promptDetails = rawUsage?.prompt_tokens_details === undefined ? undefined : providerRecord(rawUsage.prompt_tokens_details, 'OpenAI prompt token details');
     const usage = normalizeUsage(rawUsage === undefined ? undefined : { ...rawUsage, cached_tokens: rawUsage.cached_tokens ?? promptDetails?.cached_tokens ?? rawUsage.cache_read_input_tokens, reasoning_tokens: rawUsage.completion_tokens_details?.reasoning_tokens ?? rawUsage.reasoning_tokens }, { input: 'prompt_tokens', output: 'completion_tokens', cached: 'cached_tokens', reasoning: 'reasoning_tokens' }, 'OpenAI');
@@ -127,6 +148,202 @@ export function normalizeOpenAIResponse(response, toolNameAliases, provider = 'o
     const measuredUsage = usage === undefined ? undefined : { ...usage, visibleOutputChars: text.length };
     return { text, ...(parseStructured(text) === undefined ? {} : { structured: parseStructured(text) }), toolCalls, ...(refusal === undefined ? {} : { refusal }), finishReason, ...(measuredUsage === undefined ? {} : { usage: measuredUsage }), ...(provider !== 'deepseek' || reasoningContent === undefined ? {} : { providerContinuation: { provider, reasoningContent } }) };
 }
+/** DeepSeek V4/V4.1 may emit DSML tool markup in content instead of tool_calls. One or more U+FF5C bars are accepted. */
+function recoverDeepSeekDsml(text, toolNameAliases, parseCalls) {
+    const blocks = takeDsmlBlocks(text);
+    if (!blocks.changed)
+        return { text, calls: [], truncated: false };
+    if (blocks.truncated || !parseCalls)
+        return { text: blocks.text, calls: [], truncated: blocks.truncated };
+    const calls = [];
+    for (const inner of blocks.inners) {
+        const parsed = parseDsmlInvokes(inner, toolNameAliases);
+        if (parsed === undefined)
+            return { text: blocks.text, calls: [], truncated: true };
+        calls.push(...parsed);
+    }
+    return { text: blocks.text, calls, truncated: false };
+}
+function takeDsmlBlocks(text) {
+    const inners = [];
+    let cursor = 0;
+    let cleaned = '';
+    let changed = false;
+    while (cursor < text.length) {
+        const open = nextDsmlMatch(DSML_BLOCK_OPEN, text, cursor);
+        if (open === undefined)
+            break;
+        const close = nextDsmlMatch(DSML_BLOCK_CLOSE, text, open.end);
+        const nested = nextDsmlMatch(DSML_BLOCK_OPEN, text, open.end);
+        cleaned += text.slice(cursor, open.start);
+        changed = true;
+        if (close === undefined || (nested !== undefined && nested.start < close.start)) {
+            return { text: cleaned.trim(), inners: [], truncated: true, changed: true };
+        }
+        inners.push(text.slice(open.end, close.start));
+        cursor = close.end;
+    }
+    if (!changed)
+        return { text, inners, truncated: false, changed: false };
+    cleaned += text.slice(cursor);
+    return { text: cleaned.trim(), inners, truncated: false, changed: true };
+}
+function parseDsmlInvokes(inner, toolNameAliases) {
+    const opened = countDsmlTags(DSML_INVOKE_OPEN, inner);
+    if (opened !== countDsmlTags(DSML_INVOKE_CLOSE, inner))
+        return undefined;
+    const calls = [];
+    const invoke = new RegExp(DSML_INVOKE_PATTERN.source, 'g');
+    let match;
+    while ((match = invoke.exec(inner)) !== null) {
+        const providerToolName = requiredProviderString(match[1], 'OpenAI tool name');
+        const parameters = parseDsmlParameters(match[2] ?? '');
+        if (parameters === undefined)
+            return undefined;
+        calls.push({ providerToolName, name: toolNameAliases?.get(providerToolName) ?? providerToolName, input: parameters, providerToolArguments: JSON.stringify(parameters) });
+    }
+    return calls.length === opened ? calls : undefined;
+}
+function parseDsmlParameters(body) {
+    const opened = countDsmlTags(DSML_PARAMETER_OPEN, body);
+    if (opened !== countDsmlTags(DSML_PARAMETER_CLOSE, body))
+        return undefined;
+    const input = {};
+    const parameter = new RegExp(DSML_PARAMETER_PATTERN.source, 'g');
+    let match;
+    while ((match = parameter.exec(body)) !== null) {
+        const name = requiredProviderString(match[1], 'OpenAI tool name');
+        if (match[2] === 'true')
+            input[name] = match[3] ?? '';
+        else {
+            const parsed = parseDsmlJson(match[3] ?? '');
+            if (parsed === undefined)
+                return undefined;
+            input[name] = parsed;
+        }
+    }
+    return Object.keys(input).length === opened ? input : undefined;
+}
+function parseDsmlJson(value) {
+    try {
+        return JSON.parse(value);
+    }
+    catch {
+        return undefined;
+    }
+}
+/** DeepSeek sometimes writes only JSON tool objects instead of tool_calls. Each object needs an explicit tool name; argument-shaped JSON and trailing prose stay text. */
+function recoverDeepSeekJsonToolCalls(text, toolNameAliases) {
+    const leading = takeLeadingJsonValues(text.trim());
+    if (leading === undefined || leading.values.length === 0 || leading.rest.trim().length > 0)
+        return undefined;
+    const objects = leading.values.filter((value) => !isEmptyJsonValue(value));
+    if (objects.length === 0)
+        return undefined;
+    if (objects.length === 1 && objects[0] && typeof objects[0] === 'object' && !Array.isArray(objects[0])) {
+        const batch = objects[0].tool_calls ?? objects[0].toolCalls;
+        if (Array.isArray(batch)) {
+            const calls = batch.map((item) => jsonToolCall(item, toolNameAliases));
+            return calls.every((call) => call !== undefined) && calls.length > 0 ? calls : undefined;
+        }
+    }
+    const calls = objects.map((value) => jsonToolCall(value, toolNameAliases));
+    return calls.every((call) => call !== undefined) ? calls : undefined;
+}
+function isEmptyJsonValue(value) {
+    if (Array.isArray(value))
+        return value.length === 0;
+    return value !== null && typeof value === 'object' && Object.keys(value).length === 0;
+}
+function jsonToolCall(value, toolNameAliases) {
+    if (!value || typeof value !== 'object' || Array.isArray(value))
+        return undefined;
+    const record = value;
+    const named = typeof record.tool === 'string' && record.tool.length > 0 ? record.tool : typeof record.name === 'string' && record.name.length > 0 ? record.name : undefined;
+    const providerToolName = named;
+    if (providerToolName === undefined)
+        return undefined;
+    const raw = record.arguments ?? record.input ?? record.parameters;
+    const input = raw && typeof raw === 'object' && !Array.isArray(raw) ? { ...raw } : { ...record };
+    if (raw === undefined) {
+        delete input.tool;
+        delete input.name;
+    }
+    return { providerToolName, name: toolNameAliases?.get(providerToolName) ?? providerToolName, input, providerToolArguments: JSON.stringify(input) };
+}
+function takeLeadingJsonValues(text) {
+    if (!text.startsWith('{') && !text.startsWith('['))
+        return undefined;
+    const values = [];
+    let cursor = 0;
+    while (cursor < text.length) {
+        while (cursor < text.length && /\s/.test(text[cursor]))
+            cursor++;
+        if (cursor >= text.length)
+            break;
+        if (text[cursor] !== '{' && text[cursor] !== '[')
+            break;
+        const end = jsonValueEnd(text, cursor);
+        if (end === undefined)
+            return undefined;
+        try {
+            values.push(JSON.parse(text.slice(cursor, end)));
+        }
+        catch {
+            return undefined;
+        }
+        cursor = end;
+    }
+    return values.length > 0 ? { values, rest: text.slice(cursor) } : undefined;
+}
+function jsonValueEnd(text, start) {
+    const opening = text[start];
+    if (opening !== '{' && opening !== '[')
+        return undefined;
+    const stack = [];
+    let inString = false;
+    let escaped = false;
+    for (let index = start; index < text.length; index++) {
+        const char = text[index];
+        if (inString) {
+            if (escaped)
+                escaped = false;
+            else if (char === '\\')
+                escaped = true;
+            else if (char === '"')
+                inString = false;
+            continue;
+        }
+        if (char === '"') {
+            inString = true;
+            continue;
+        }
+        if (char === '{' || char === '[')
+            stack.push(char === '{' ? '}' : ']');
+        else if (char === '}' || char === ']') {
+            if (stack.pop() !== char)
+                return undefined;
+            if (stack.length === 0)
+                return index + 1;
+        }
+    }
+    return undefined;
+}
+function countDsmlTags(pattern, value) {
+    return value.match(new RegExp(pattern.source, 'g'))?.length ?? 0;
+}
+function nextDsmlMatch(pattern, value, from) {
+    const match = new RegExp(pattern.source, 'g').exec(value.slice(from));
+    return match === null ? undefined : { start: from + match.index, end: from + match.index + match[0].length };
+}
+const DSML_BLOCK_OPEN = /<\uFF5C+DSML\uFF5C+\s*(?:tool_calls|calls)>/;
+const DSML_BLOCK_CLOSE = /<\/\uFF5C+DSML\uFF5C+\s*(?:tool_calls|calls)>/;
+const DSML_INVOKE_OPEN = /<\uFF5C+DSML\uFF5C+\s*invoke\b/;
+const DSML_INVOKE_CLOSE = /<\/\uFF5C+DSML\uFF5C+\s*invoke>/;
+const DSML_INVOKE_PATTERN = /<\uFF5C+DSML\uFF5C+\s*invoke\s+name="([^"]+)"\s*\/?>([\s\S]*?)<\/\uFF5C+DSML\uFF5C+\s*invoke>/;
+const DSML_PARAMETER_OPEN = /<\uFF5C+DSML\uFF5C+\s*parameter\b/;
+const DSML_PARAMETER_CLOSE = /<\/\uFF5C+DSML\uFF5C+\s*parameter>/;
+const DSML_PARAMETER_PATTERN = /<\uFF5C+DSML\uFF5C+\s*parameter\s+name="([^"]+)"\s+string="(true|false)"\s*>([\s\S]*?)<\/\uFF5C+DSML\uFF5C+\s*parameter>/;
 export function normalizeAnthropicResponse(response) {
     const root = providerRecord(response, 'Anthropic response');
     if (!Array.isArray(root.content))

package/dist/tools/filesystem.js

@@ -31,8 +31,14 @@ export class FilesystemTool {
         this.root = root;
         this.lockTimeoutMs = lockTimeoutMs;
     }
-    safe(path) { const target = resolve(this.root, path); if (isAbsolute(path) || relative(resolve(this.root), target).startsWith('..'))
-        throw filesystemError('PATH_OUTSIDE_SANDBOX'); return target; }
+    safe(path) {
+        const root = resolve(this.root);
+        const target = resolve(root, path);
+        const within = relative(root, target);
+        if (within.startsWith('..') || isAbsolute(within))
+            throw filesystemError('PATH_OUTSIDE_SANDBOX');
+        return target;
+    }
     async existing(path) {
         const target = this.safe(path);
         const [root, resolved] = await Promise.all([realpath(this.root), realpath(target)]);
@@ -122,8 +128,11 @@ export class FilesystemTool {
             await handle.close();
         }
     }
-    async list(path = '.', signal) { if (signal?.aborted)
-        throw filesystemError('ABORTED'); return readdir(await this.existing(path)); }
+    async list(path = '.', signal) {
+        if (signal?.aborted)
+            throw filesystemError('ABORTED');
+        return readdir(await this.existing(path));
+    }
     async write(path, content, signal) { if (signal?.aborted)
         throw filesystemError('ABORTED'); await writeFile(await this.writable(path), content, 'utf8'); }
     async move(source, destination, expectedHash, signal) {

package/dist/tools/shell.js

@@ -161,6 +161,12 @@ function shellEnvironment(env) {
     const source = env ?? process.env;
     return Object.fromEntries(Object.entries(source).filter(([key]) => !/(API_KEY|TOKEN|SECRET|PASSWORD|PRIVATE_KEY|AUTHORIZATION|BEARER|CREDENTIAL|COOKIE)/i.test(key) && key !== 'NODE_OPTIONS'));
 }
+function shellLaunchesCommand(command, args) {
+    const base = basename(command).toLowerCase();
+    if (!['sh', 'bash', 'zsh', 'dash', 'fish', 'ksh', 'cmd', 'cmd.exe', 'powershell', 'powershell.exe', 'pwsh', 'pwsh.exe'].includes(base))
+        return false;
+    return args.some((arg) => /^(?:-lc|-c|-command|\/c)$/i.test(arg));
+}
 export function runShell(command, args = [], options = {}) {
     const max = options.maxOutputBytes ?? 256 * 1024;
     if (!Number.isFinite(max) || max < 0)
@@ -169,6 +175,8 @@ export function runShell(command, args = [], options = {}) {
         return Promise.reject(shellError('INVALID_SHELL_TIMEOUT'));
     if (!command || typeof command !== 'string' || !Array.isArray(args) || args.some((arg) => typeof arg !== 'string'))
         return Promise.reject(shellError('INVALID_SHELL_ARGUMENT'));
+    if (/&&|\|\||[|&;<>\n`]|\$\(/.test(command) || shellLaunchesCommand(command, args))
+        return Promise.reject(Object.assign(shellError('SHELL_SYNTAX_UNSUPPORTED'), { message: 'shell.exec does not start a shell. Pass the executable in command and each argument in args. Do not put &&, pipes, redirects, command substitution, or sh -c in command.' }));
     try {
         encodeSandboxCommand(command, args);
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hunterzhu/pulse-adapters",
-  "version": "0.4.1",
+  "version": "0.4.2",
   "license": "PolyForm-Noncommercial-1.0.0",
   "repository": {
     "type": "git",
@@ -18,8 +18,8 @@
   },
   "dependencies": {
     "@anthropic-ai/sandbox-runtime": "0.0.77",
-    "@hunterzhu/pulse-runtime": "0.4.1",
-    "@hunterzhu/pulse-tool-sdk": "0.4.1",
+    "@hunterzhu/pulse-runtime": "0.4.2",
+    "@hunterzhu/pulse-tool-sdk": "0.4.2",
     "exceljs": "4.4.0",
     "pdfjs-dist": "4.10.38"
   }