@looopy-ai/core 2.1.14 → 2.1.16

package/dist/core/tools.js

@@ -3,6 +3,7 @@ import { isChildTaskEvent } from '../events/utils';
 import { startToolExecuteSpan } from '../observability/spans';
 import { toolErrorEvent } from '../tools/tool-result-events';
 import { isToolPlugin } from '../types/core';
+import { safeValidateToolCall } from '../types/tools';
 export const runToolCall = (context, toolCall) => {
     const logger = context.logger.child({
         component: 'tool-call',
@@ -10,6 +11,24 @@ export const runToolCall = (context, toolCall) => {
         toolName: toolCall.toolName,
     });
     return defer(async () => {
+        const toolCallInput = {
+            id: toolCall.toolCallId,
+            type: 'function',
+            function: {
+                name: toolCall.toolName,
+                arguments: toolCall.arguments,
+            },
+        };
+        const validation = safeValidateToolCall(toolCallInput);
+        if (!validation.success) {
+            const errorMessage = `Invalid tool call format: ${(validation.errors || []).map((e) => `${e.path.join('.')}: ${e.message}`).join(', ')}`;
+            logger.error({
+                toolCallId: toolCall.toolCallId,
+                toolName: toolCall.toolName,
+                errors: validation.errors,
+            }, 'Invalid tool call from LLM - tool name must match ^[a-zA-Z0-9_-]+$');
+            return of(toolErrorEvent(toolCallInput, errorMessage));
+        }
         const matchingPlugins = await Promise.all(context.plugins.filter(isToolPlugin).map(async (p) => ({
             plugin: p,
             tool: await p.getTool?.(toolCall.toolName),
@@ -29,14 +48,6 @@ export const runToolCall = (context, toolCall) => {
             arguments: toolCall.arguments,
             timestamp: new Date().toISOString(),
         };
-        const toolCallInput = {
-            id: toolCall.toolCallId,
-            type: 'function',
-            function: {
-                name: toolCall.toolName,
-                arguments: toolCall.arguments,
-            },
-        };
         const { tapFinish } = startToolExecuteSpan(context, toolCall);
         const execution$ = defer(() => {
             try {

package/dist/tools/agent-tool-provider.d.ts

@@ -13,10 +13,9 @@ export declare const cardSchema: z.ZodObject<{
         description: z.ZodOptional<z.ZodString>;
     }, z.core.$strip>>>;
     auth: z.ZodOptional<z.ZodObject<{
-        issuer: z.ZodString;
-        audience: z.ZodString;
+        token_endpoint: z.ZodString;
         scopes: z.ZodArray<z.ZodString>;
-    }, z.core.$strip>>;
+    }, z.core.$loose>>;
 }, z.core.$strip>;
 export type AgentCard = z.infer<typeof cardSchema>;
 export declare class AgentToolProvider<AuthContext> implements Plugin<AuthContext> {

package/dist/tools/agent-tool-provider.js

@@ -17,10 +17,10 @@ export const cardSchema = z.object({
         .optional(),
     auth: z
         .object({
-        issuer: z.string(),
-        audience: z.string(),
+        token_endpoint: z.string(),
         scopes: z.array(z.string()),
     })
+        .loose()
         .optional(),
 });
 const safeName = (name) => name.replace(/[^a-zA-Z0-9-]+/g, '-').toLowerCase();

package/dist/types/tools.d.ts

@@ -51,3 +51,9 @@ export declare const ToolCallSchema: z.ZodObject<{
         arguments: z.ZodRecord<z.ZodString, z.ZodUnknown>;
     }, z.core.$strip>;
 }, z.core.$strip>;
+export declare function validateToolCall(toolCall: unknown): ToolCall;
+export declare function safeValidateToolCall(toolCall: unknown): {
+    success: boolean;
+    data?: ToolCall;
+    errors?: z.ZodIssue[];
+};

package/dist/types/tools.js

@@ -48,7 +48,19 @@ export const ToolCallSchema = z.object({
     id: z.string(),
     type: z.literal('function'),
     function: z.object({
-        name: z.string(),
+        name: z
+            .string()
+            .regex(/^[a-zA-Z0-9_-]+$/, 'Tool name must contain only alphanumeric characters, underscores, and hyphens'),
         arguments: z.record(z.string(), z.unknown()),
     }),
 });
+export function validateToolCall(toolCall) {
+    return ToolCallSchema.parse(toolCall);
+}
+export function safeValidateToolCall(toolCall) {
+    const result = ToolCallSchema.safeParse(toolCall);
+    if (result.success) {
+        return { success: true, data: result.data };
+    }
+    return { success: false, errors: result.error.issues };
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@looopy-ai/core",
-  "version": "2.1.14",
+  "version": "2.1.16",
   "description": "RxJS-based AI agent framework",
   "repository": {
     "url": "https://github.com/looopy-ai/lib"