@looopy-ai/core 2.1.15 → 2.1.17

package/dist/core/iteration.js

@@ -1,5 +1,7 @@
 import { concat, defer, filter, map, mergeMap, shareReplay } from 'rxjs';
 import { startLLMCallSpan, startLoopIterationSpan } from '../observability/spans';
+import { toolErrorEvent } from '../tools/tool-result-events';
+import { safeValidateToolCall } from '../types/tools';
 import { getSystemPrompts } from '../utils/prompt';
 import { runToolCall } from './tools';
 export const runIteration = (context, config, history) => {
@@ -35,7 +37,35 @@ export const runIteration = (context, config, history) => {
             stream: true,
             sessionId: context.taskId,
         })
-            .pipe(finishLLMCallSpan, map((event) => ({
+            .pipe(finishLLMCallSpan, map((event) => {
+            if (event.kind === 'tool-call') {
+                const validation = safeValidateToolCall({
+                    id: event.toolCallId,
+                    type: 'function',
+                    function: {
+                        name: event.toolName,
+                        arguments: event.arguments,
+                    },
+                });
+                if (!validation.success) {
+                    const errorMessage = `Invalid tool call format: ${(validation.errors || []).map((e) => `${e.path.join('.')}: ${e.message}`).join(', ')}`;
+                    context.logger.error({
+                        toolCallId: event.toolCallId,
+                        toolName: event.toolName,
+                        errors: validation.errors,
+                    }, 'Invalid tool call from LLM - tool name must match ^[a-zA-Z0-9_-]+$');
+                    return toolErrorEvent({
+                        id: event.toolCallId,
+                        type: 'function',
+                        function: {
+                            name: event.toolName,
+                            arguments: event.arguments,
+                        },
+                    }, errorMessage);
+                }
+            }
+            return event;
+        }), map((event) => ({
             contextId: context.contextId,
             taskId: context.taskId,
             path: undefined,

package/dist/core/tools.js

@@ -3,6 +3,7 @@ import { isChildTaskEvent } from '../events/utils';
 import { startToolExecuteSpan } from '../observability/spans';
 import { toolErrorEvent } from '../tools/tool-result-events';
 import { isToolPlugin } from '../types/core';
+import { safeValidateToolCall } from '../types/tools';
 export const runToolCall = (context, toolCall) => {
     const logger = context.logger.child({
         component: 'tool-call',
@@ -10,6 +11,24 @@ export const runToolCall = (context, toolCall) => {
         toolName: toolCall.toolName,
     });
     return defer(async () => {
+        const toolCallInput = {
+            id: toolCall.toolCallId,
+            type: 'function',
+            function: {
+                name: toolCall.toolName,
+                arguments: toolCall.arguments,
+            },
+        };
+        const validation = safeValidateToolCall(toolCallInput);
+        if (!validation.success) {
+            const errorMessage = `Invalid tool call format: ${(validation.errors || []).map((e) => `${e.path.join('.')}: ${e.message}`).join(', ')}`;
+            logger.error({
+                toolCallId: toolCall.toolCallId,
+                toolName: toolCall.toolName,
+                errors: validation.errors,
+            }, 'Invalid tool call from LLM - tool name must match ^[a-zA-Z0-9_-]+$');
+            return of(toolErrorEvent(toolCallInput, errorMessage));
+        }
         const matchingPlugins = await Promise.all(context.plugins.filter(isToolPlugin).map(async (p) => ({
             plugin: p,
             tool: await p.getTool?.(toolCall.toolName),
@@ -29,14 +48,6 @@ export const runToolCall = (context, toolCall) => {
             arguments: toolCall.arguments,
             timestamp: new Date().toISOString(),
         };
-        const toolCallInput = {
-            id: toolCall.toolCallId,
-            type: 'function',
-            function: {
-                name: toolCall.toolName,
-                arguments: toolCall.arguments,
-            },
-        };
         const { tapFinish } = startToolExecuteSpan(context, toolCall);
         const execution$ = defer(() => {
             try {

package/dist/types/tools.d.ts

@@ -41,8 +41,9 @@ export declare function validateToolDefinitions(tools: unknown): ToolDefinition[
 export declare function safeValidateToolDefinitions(tools: unknown): {
     success: boolean;
     data?: ToolDefinition[];
-    errors?: z.ZodIssue[];
+    errors?: z.core.$ZodIssue[];
 };
+export declare const toolFunctionNameRegex: RegExp;
 export declare const ToolCallSchema: z.ZodObject<{
     id: z.ZodString;
     type: z.ZodLiteral<"function">;
@@ -51,3 +52,9 @@ export declare const ToolCallSchema: z.ZodObject<{
         arguments: z.ZodRecord<z.ZodString, z.ZodUnknown>;
     }, z.core.$strip>;
 }, z.core.$strip>;
+export declare function validateToolCall(toolCall: unknown): ToolCall;
+export declare function safeValidateToolCall(toolCall: unknown): {
+    success: boolean;
+    data?: ToolCall;
+    errors?: z.core.$ZodIssue[];
+};

package/dist/types/tools.js

@@ -44,11 +44,24 @@ export function safeValidateToolDefinitions(tools) {
     }
     return { success: false, errors: result.error.issues };
 }
+export const toolFunctionNameRegex = /^[a-zA-Z0-9_-]+$/;
 export const ToolCallSchema = z.object({
     id: z.string(),
     type: z.literal('function'),
     function: z.object({
-        name: z.string(),
+        name: z
+            .string()
+            .regex(toolFunctionNameRegex, 'Tool name must contain only alphanumeric characters, underscores, and hyphens'),
         arguments: z.record(z.string(), z.unknown()),
     }),
 });
+export function validateToolCall(toolCall) {
+    return ToolCallSchema.parse(toolCall);
+}
+export function safeValidateToolCall(toolCall) {
+    const result = ToolCallSchema.safeParse(toolCall);
+    if (result.success) {
+        return { success: true, data: result.data };
+    }
+    return { success: false, errors: result.error.issues };
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@looopy-ai/core",
-  "version": "2.1.15",
+  "version": "2.1.17",
   "description": "RxJS-based AI agent framework",
   "repository": {
     "url": "https://github.com/looopy-ai/lib"