@namzu/sdk 45.0.0 → 46.0.0

package/src/tools/schedules/loop-tool.ts

@@ -0,0 +1,85 @@
+import { z } from 'zod'
+import type { ToolDefinition } from '../../types/tool/index.js'
+import { defineTool } from '../defineTool.js'
+import { presentLoopCall, presentLoopResult } from './present.js'
+import type { SessionLoopHost } from './types.js'
+
+export const SESSION_LOOP_TOOL_NAME = 'session_loop'
+
+const inputSchema = z.object({
+	action: z.enum(['create', 'list', 'delete']),
+	interval: z
+		.string()
+		.optional()
+		.describe('create: how often, e.g. "5m", "1h", or a five-field cron expression'),
+	prompt: z.string().min(1).max(4_000).optional().describe('create: the message to send each time'),
+	id: z.string().optional().describe('delete: the loop id, or "all"'),
+})
+
+/**
+ * The `session_loop` tool: re-send a prompt to THIS conversation on an
+ * interval, between turns, while the session is open.
+ *
+ * `create` is an ordinary reviewed call — not exempt from review — so in
+ * `prompt` mode the operator sees it before a loop exists; a loop a model
+ * created is labelled as such wherever it is shown. `list` and `delete` only
+ * read or remove loops.
+ */
+export function buildSessionLoopTools(host: SessionLoopHost): ToolDefinition[] {
+	return [
+		defineTool({
+			name: SESSION_LOOP_TOOL_NAME,
+			description:
+				'Re-send a prompt to this conversation on an interval while the session stays open (between turns only; stops when the session closes; expires after 7 days). Use only when the user asks for something to repeat. Minimum interval one minute.',
+			inputSchema,
+			category: 'custom',
+			permissions: [],
+			readOnly: (input) => input.action !== 'create',
+			destructive: false,
+			concurrencySafe: false,
+			presentCall: presentLoopCall,
+			presentResult: presentLoopResult,
+			async execute(input) {
+				if (input.action === 'list') {
+					const loops = host.list()
+					return {
+						success: true,
+						output:
+							loops.length === 0
+								? 'No loops in this session.'
+								: loops.map((l) => `${l.id} · ${l.schedule} · ${l.prompt.slice(0, 80)}`).join('\n'),
+						data: { loops },
+					}
+				}
+				if (input.action === 'delete') {
+					if (!input.id) return { success: false, output: '', error: 'delete needs id (or "all").' }
+					const stopped = await host.delete(input.id)
+					return stopped === 0
+						? { success: false, output: '', error: `No loop has id "${input.id}".` }
+						: { success: true, output: `Stopped ${stopped} loop${stopped === 1 ? '' : 's'}.` }
+				}
+				if (!input.interval || !input.prompt) {
+					return { success: false, output: '', error: 'create needs interval and prompt.' }
+				}
+				try {
+					const loop = await host.create({
+						interval: input.interval,
+						prompt: input.prompt,
+						createdBy: 'model',
+					})
+					return {
+						success: true,
+						output: `Loop ${loop.id} created: ${loop.schedule}. The operator can stop it with /loop stop ${loop.id}.`,
+						data: { id: loop.id },
+					}
+				} catch (error) {
+					return {
+						success: false,
+						output: '',
+						error: error instanceof Error ? error.message : String(error),
+					}
+				}
+			},
+		}),
+	]
+}

package/src/tools/schedules/present.ts

@@ -0,0 +1,88 @@
+import type { ToolResult } from '../../types/tool/index.js'
+import type { ToolCallView, ToolResultView } from '../../types/tool/presentation.js'
+
+/**
+ * How the schedule tools read to a person: in words, never ids or JSON.
+ */
+
+const MAX = 80
+
+function oneLine(value: unknown): string {
+	if (typeof value !== 'string') return ''
+	const flat = value.replace(/\s+/g, ' ').trim()
+	return flat.length > MAX ? `${flat.slice(0, MAX - 1)}…` : flat
+}
+
+function activity(label: string): ToolCallView {
+	return { kind: 'generic', presentation: 'activity', label }
+}
+
+const HIDDEN: ToolResultView = { kind: 'generic', label: '', visibility: 'hidden' }
+
+export function presentScheduleCall(input: {
+	readonly action?: unknown
+	readonly name?: unknown
+	readonly when?: unknown
+	readonly job?: unknown
+}): ToolCallView {
+	switch (input.action) {
+		case 'create': {
+			const name = oneLine(input.name)
+			const when = oneLine(input.when)
+			return activity(`Propose scheduled job${name ? ` · ${name}` : ''}${when ? ` · ${when}` : ''}`)
+		}
+		case 'list':
+			return activity('List scheduled jobs')
+		case 'update':
+			return activity(`Change scheduled job · ${oneLine(input.job)}`)
+		case 'pause':
+			return activity(`Pause scheduled job · ${oneLine(input.job)}`)
+		case 'resume':
+			return activity(`Resume scheduled job · ${oneLine(input.job)}`)
+		case 'delete':
+			return activity(`Delete scheduled job · ${oneLine(input.job)}`)
+		default:
+			return activity('Scheduled jobs')
+	}
+}
+
+/** The operator answered no on the tool's own screen: not a failure. */
+function operatorCancelled(result: ToolResult): boolean {
+	const data = result.data as { cancelled?: unknown } | undefined
+	return data?.cancelled === true
+}
+
+export function presentScheduleResult(input: unknown, result: ToolResult): ToolResultView {
+	if (!result.success && operatorCancelled(result)) {
+		const action = (input as { action?: unknown } | null)?.action
+		return {
+			kind: 'generic',
+			outcome: 'cancelled',
+			label: action === 'create' ? 'Cancelled — no job was created' : 'Cancelled — nothing changed',
+		}
+	}
+	if (!result.success) return { kind: 'generic', label: oneLine(result.error) || 'Not done' }
+	return HIDDEN
+}
+
+export function presentLoopCall(input: {
+	readonly action?: unknown
+	readonly interval?: unknown
+	readonly prompt?: unknown
+}): ToolCallView {
+	switch (input.action) {
+		case 'create':
+			return activity(`Loop ${oneLine(input.interval)} · ${oneLine(input.prompt)}`)
+		case 'list':
+			return activity('List loops')
+		case 'delete':
+			return activity('Stop loop')
+		default:
+			return activity('Loops')
+	}
+}
+
+export function presentLoopResult(_input: unknown, result: ToolResult): ToolResultView {
+	if (!result.success) return { kind: 'generic', label: oneLine(result.error) || 'Not done' }
+	return HIDDEN
+}

package/src/tools/schedules/prompt-scan.ts

@@ -0,0 +1,96 @@
+/**
+ * A tripwire over a scheduled prompt, run when the job is proposed.
+ *
+ * A scheduled prompt runs later with nobody watching, so a prompt that hides
+ * characters, tells the model to ignore its instructions, or reads secrets and
+ * sends them somewhere deserves a second look before anyone confirms it.
+ * Findings are shown to the person confirming; they never block on their own,
+ * because the operator may mean exactly what they wrote.
+ */
+
+/** Characters that render as nothing or reorder what is shown. */
+/** Invisible and direction-changing code point ranges, inclusive. */
+const INVISIBLE_RANGES: readonly (readonly [number, number])[] = [
+	[0x200b, 0x200f],
+	[0x202a, 0x202e],
+	[0x2060, 0x2064],
+	[0x2066, 0x2069],
+	[0xfeff, 0xfeff],
+	[0x00ad, 0x00ad],
+]
+
+function isInvisible(code: number): boolean {
+	return INVISIBLE_RANGES.some(([lo, hi]) => code >= lo && code <= hi)
+}
+
+function hasInvisible(text: string): boolean {
+	for (const ch of text) if (isInvisible(ch.codePointAt(0) ?? 0)) return true
+	return false
+}
+
+/** C0 controls other than tab, newline and carriage return, and DEL. */
+function isControl(code: number): boolean {
+	return (code < 0x20 && code !== 0x09 && code !== 0x0a && code !== 0x0d) || code === 0x7f
+}
+
+function hasControl(text: string): boolean {
+	for (let i = 0; i < text.length; i++) if (isControl(text.charCodeAt(i))) return true
+	return false
+}
+
+const DIRECTIVES: readonly RegExp[] = [
+	/\bignore (all |any )?(the )?(previous|prior|above|earlier) (instructions|rules|messages)\b/i,
+	/\bdisregard (all |any )?(the )?(previous|prior|above|system) /i,
+	/\b(reveal|print|show|repeat) (your|the) (system prompt|instructions)\b/i,
+	/\byou are no longer\b/i,
+]
+
+const SECRET_READS: readonly RegExp[] = [
+	/~?\/?\.ssh\b|\bid_(rsa|ed25519|ecdsa)\b/i,
+	/\.aws\/credentials|\.config\/gcloud|\.kube\/config|\.netrc\b|\.npmrc\b|\.pypirc\b/i,
+	/\bcredentials\.json\b|\.env\b/i,
+	/\b(printenv|env)\b\s*($|[|;&>])/i,
+	/\b[A-Z0-9_]*(API_KEY|SECRET|TOKEN|PASSWORD)\b/,
+]
+
+const EXFILTRATION: readonly RegExp[] = [
+	/\b(curl|wget)\b[^\n|]*\|\s*(ba|z|da)?sh\b/i,
+	/\bcurl\b[^\n]*\s(-d|--data(-binary|-raw)?|-F|--form|-T|--upload-file|-X\s*(POST|PUT))\b/i,
+	/\b(nc|ncat|netcat|socat)\b\s+\S+\s+\d+/i,
+	/\bbase64\b[^\n]*\|\s*(curl|wget|nc)\b/i,
+]
+
+/** What the scan found, as sentences for the confirmation screen. Empty when nothing. */
+export function scanSchedulePrompt(prompt: string): string[] {
+	const findings: string[] = []
+	if (hasInvisible(prompt)) {
+		findings.push('The prompt contains invisible or direction-changing characters.')
+	}
+	if (hasControl(prompt)) findings.push('The prompt contains control characters.')
+	if (DIRECTIVES.some((re) => re.test(prompt))) {
+		findings.push('The prompt tells the model to ignore or reveal its instructions.')
+	}
+	if (SECRET_READS.some((re) => re.test(prompt))) {
+		findings.push('The prompt mentions credentials, keys or secret files.')
+	}
+	if (EXFILTRATION.some((re) => re.test(prompt))) {
+		findings.push('The prompt pipes a download into a shell or sends data to a remote address.')
+	}
+	return findings
+}
+
+/**
+ * The prompt with every invisible and control character made visible as
+ * `<U+XXXX>`, so the person confirming sees what the model will read.
+ */
+export function revealHiddenCharacters(prompt: string): string {
+	let out = ''
+	for (const ch of prompt) {
+		const code = ch.codePointAt(0) ?? 0
+		out +=
+			isControl(code) || isInvisible(code)
+				? `<U+${code.toString(16).toUpperCase().padStart(4, '0')}>`
+				: ch
+	}
+	return out
+}