@jsonstudio/llms 0.6.795 → 0.6.938

package/dist/servertool/handlers/apply-patch-guard.js

@@ -0,0 +1,269 @@
+import { registerServerToolHandler } from '../registry.js';
+import { cloneJson } from '../server-side-tools.js';
+import { validateToolCall } from '../../tools/tool-registry.js';
+import { buildEntryAwareFollowupPayload, extractCapturedChatSeed } from './followup-request-builder.js';
+const FLOW_ID = 'apply_patch_guard';
+const handler = async (ctx) => {
+    const toolCall = ctx.toolCall;
+    if (!toolCall) {
+        return null;
+    }
+    if (!ctx.options.reenterPipeline) {
+        return null;
+    }
+    const rawArgs = typeof toolCall.arguments === 'string' ? toolCall.arguments : '';
+    const validation = validateToolCall('apply_patch', rawArgs);
+    if (validation?.ok) {
+        return null;
+    }
+    const reason = typeof validation?.reason === 'string' && validation.reason.trim()
+        ? validation.reason.trim()
+        : 'unknown';
+    const snippet = rawArgs && rawArgs.trim().length
+        ? rawArgs.trim().slice(0, 200).replace(/\s+/g, ' ')
+        : '';
+    const isExecCommandShape = extractLikelyExecCommandShape(rawArgs);
+    // For obviously wrong shapes (e.g. exec_command-like payload passed into apply_patch),
+    // do NOT attempt a followup "recovery" loop. Return a plain assistant message instead.
+    if (isExecCommandShape && (reason === 'missing_changes' || reason === 'missing_payload' || reason === 'invalid_json')) {
+        const patched = injectApplyPatchHardFailureMessage(ctx.base, toolCall, {
+            reason,
+            snippet,
+            rawArgs
+        });
+        return {
+            chatResponse: patched,
+            execution: { flowId: FLOW_ID }
+        };
+    }
+    const patched = injectApplyPatchRejectedToolResult(ctx.base, toolCall, {
+        reason,
+        snippet,
+        rawArgs
+    });
+    const followupPayload = buildToolFollowupPayload(ctx.adapterContext, patched, ctx.options.entryEndpoint || ctx.adapterContext?.entryEndpoint || '/v1/chat/completions');
+    if (!followupPayload) {
+        // Fail-closed: if we cannot perform reenter, do not intercept.
+        // (This should be rare because HubPipeline always provides capturedChatRequest.)
+        return null;
+    }
+    return {
+        chatResponse: patched,
+        execution: {
+            flowId: FLOW_ID,
+            followup: {
+                requestIdSuffix: ':apply_patch_guard_followup',
+                payload: followupPayload
+            }
+        }
+    };
+};
+registerServerToolHandler('apply_patch', handler);
+function injectApplyPatchHardFailureMessage(base, toolCall, options) {
+    const cloned = cloneJson(base);
+    const choices = Array.isArray(cloned.choices)
+        ? cloned.choices
+        : [];
+    if (!choices.length) {
+        return cloned;
+    }
+    const first = choices[0];
+    if (!first || typeof first !== 'object' || Array.isArray(first)) {
+        return cloned;
+    }
+    const message = first.message;
+    if (!message || typeof message !== 'object' || Array.isArray(message)) {
+        return cloned;
+    }
+    // Replace tool-call response with a plain assistant message.
+    const guidance = buildApplyPatchGuidance(options.rawArgs);
+    const text = `[apply_patch rejected] reason=${options.reason}` +
+        (options.snippet ? ` args=${options.snippet}` : '') +
+        `\n\n${guidance}`;
+    message.content = text;
+    if (Object.prototype.hasOwnProperty.call(message, 'tool_calls')) {
+        delete message.tool_calls;
+    }
+    if (typeof first.finish_reason === 'string' && first.finish_reason === 'tool_calls') {
+        first.finish_reason = 'stop';
+    }
+    // Remove tool_outputs to avoid confusing clients that don't implement tool loops.
+    if (Object.prototype.hasOwnProperty.call(cloned, 'tool_outputs')) {
+        delete cloned.tool_outputs;
+    }
+    return cloned;
+}
+function injectApplyPatchRejectedToolResult(base, toolCall, options) {
+    const cloned = cloneJson(base);
+    const existingOutputs = Array.isArray(cloned.tool_outputs)
+        ? cloned.tool_outputs
+        : [];
+    const payload = {
+        ok: false,
+        tool: 'apply_patch',
+        reason: options.reason,
+        ...(options.snippet ? { argsSnippet: options.snippet } : {}),
+        guidance: buildApplyPatchGuidance(options.rawArgs)
+    };
+    cloned.tool_outputs = [
+        ...existingOutputs,
+        {
+            tool_call_id: toolCall.id,
+            name: 'apply_patch',
+            content: JSON.stringify(payload)
+        }
+    ];
+    return cloned;
+}
+function buildApplyPatchGuidance(rawArgs) {
+    const base = 'apply_patch 参数预检失败。请改用统一 diff（*** Begin Patch ... *** End Patch），' +
+        '或使用结构化 JSON：{ file, changes:[{ file, kind, target/anchor, lines/newText, ... }] }。';
+    const schemaHint = extractLikelyExecCommandShape(rawArgs);
+    if (schemaHint) {
+        return (base +
+            '\n\n' +
+            '你传入的参数看起来像 exec_command（例如包含 "command"/"cmd" 字段），但工具名是 apply_patch。\n' +
+            'apply_patch 必须提供非空的 "changes" 数组；如果你需要执行命令请改用 exec_command（注意：禁止通过 shell 写文件）。');
+    }
+    // User-requested hint (directory deletion is not supported via delete_file).
+    // Heuristic: detect delete_file with a directory-like target (trailing slash).
+    const hintTarget = extractDeleteFileTarget(rawArgs);
+    if (!hintTarget) {
+        return base;
+    }
+    return (base +
+        '\n\n' +
+        `- {"changes":[{"kind":"delete_file","target":"${hintTarget}"}]} ❌ 仍会 invalid_file（因为是目录）\n\n` +
+        '如果你真要删目录：请用 exec_command（例如 rm -rf tmp web-container-manager），或者用 apply_patch 逐个删目录下的文件（更安全、可审计）。');
+}
+function extractDeleteFileTarget(rawArgs) {
+    if (!rawArgs || typeof rawArgs !== 'string') {
+        return null;
+    }
+    let parsed;
+    try {
+        parsed = JSON.parse(rawArgs);
+    }
+    catch {
+        return null;
+    }
+    if (!parsed || typeof parsed !== 'object' || Array.isArray(parsed)) {
+        return null;
+    }
+    const record = parsed;
+    const changes = Array.isArray(record.changes) ? record.changes : [];
+    for (const change of changes) {
+        if (!change || typeof change !== 'object' || Array.isArray(change))
+            continue;
+        const c = change;
+        const kind = typeof c.kind === 'string' ? c.kind.trim().toLowerCase() : '';
+        if (kind !== 'delete_file')
+            continue;
+        const target = typeof c.target === 'string' ? c.target.trim() : '';
+        if (!target)
+            continue;
+        if (target.endsWith('/')) {
+            return target;
+        }
+    }
+    return null;
+}
+function extractLikelyExecCommandShape(rawArgs) {
+    if (!rawArgs || typeof rawArgs !== 'string') {
+        return false;
+    }
+    let parsed;
+    try {
+        parsed = JSON.parse(rawArgs);
+    }
+    catch {
+        return false;
+    }
+    if (!parsed || typeof parsed !== 'object' || Array.isArray(parsed)) {
+        return false;
+    }
+    const record = parsed;
+    const command = record.command;
+    const cmd = record.cmd;
+    if (typeof command === 'string' && command.trim()) {
+        return true;
+    }
+    if (typeof cmd === 'string' && cmd.trim()) {
+        return true;
+    }
+    return false;
+}
+function buildToolFollowupPayload(adapterContext, chatResponse, entryEndpoint) {
+    const captured = adapterContext && typeof adapterContext === 'object'
+        ? adapterContext.capturedChatRequest
+        : undefined;
+    const seed = extractCapturedChatSeed(captured);
+    if (!seed) {
+        return null;
+    }
+    const assistantMessage = extractAssistantMessage(chatResponse);
+    if (!assistantMessage) {
+        return null;
+    }
+    const toolMessages = buildToolMessages(chatResponse);
+    if (!toolMessages.length) {
+        return null;
+    }
+    const reconstructed = [...seed.messages, assistantMessage, ...toolMessages];
+    return buildEntryAwareFollowupPayload({
+        entryEndpoint,
+        model: seed.model,
+        messages: reconstructed,
+        ...(seed.tools ? { tools: seed.tools } : {}),
+        ...(seed.parameters ? { parameters: seed.parameters } : {})
+    });
+}
+function extractAssistantMessage(chatResponse) {
+    const choices = Array.isArray(chatResponse.choices)
+        ? chatResponse.choices
+        : [];
+    if (!choices.length)
+        return null;
+    const first = choices[0];
+    if (!first || typeof first !== 'object' || Array.isArray(first))
+        return null;
+    const message = first.message;
+    if (!message || typeof message !== 'object' || Array.isArray(message))
+        return null;
+    return cloneJson(message);
+}
+function buildToolMessages(chatResponse) {
+    const toolOutputs = Array.isArray(chatResponse.tool_outputs)
+        ? chatResponse.tool_outputs
+        : [];
+    const messages = [];
+    for (const entry of toolOutputs) {
+        if (!entry || typeof entry !== 'object' || Array.isArray(entry))
+            continue;
+        const record = entry;
+        const toolCallId = typeof record.tool_call_id === 'string' ? record.tool_call_id : undefined;
+        if (!toolCallId)
+            continue;
+        const name = typeof record.name === 'string' && record.name.trim() ? record.name.trim() : 'apply_patch';
+        const rawContent = record.content;
+        let contentText;
+        if (typeof rawContent === 'string') {
+            contentText = rawContent;
+        }
+        else {
+            try {
+                contentText = JSON.stringify(rawContent ?? {});
+            }
+            catch {
+                contentText = String(rawContent ?? '');
+            }
+        }
+        messages.push({
+            role: 'tool',
+            tool_call_id: toolCallId,
+            name,
+            content: contentText
+        });
+    }
+    return messages;
+}