@segmentstream/agent 0.6.11 → 0.6.13

package/README.md

@@ -79,14 +79,16 @@ Both entry points export the same handle: `@segmentstream/agent` and
 }
 ```
 
-| Field                          | Default               | Meaning                                                                                                                  |
-| ------------------------------ | --------------------- | ------------------------------------------------------------------------------------------------------------------------ |
-| `channels.telegram.connection` | none                  | The Connect key whose credential is the bot token. Without `channels.telegram`, no Telegram.                             |
-| `channels.telegram.policy`     | `"smart"`             | Unaddressed group text: `smart` asks the decision model, `mention` observes; attachments always trigger a turn           |
-| `models.stt`                   | `"spacexai/grok-stt"` | The AI Gateway transcription model for voice messages; `false` leaves them untranscribed                                 |
-| `models.imageDescription`      | automatic             | A separate vision model for ingestion descriptions; omitted prefers native images, `false` disables description fallback |
-| `models.decision`              | `"typesafe-ai/jev"`   | The AI Gateway decision model of the inbound router                                                                      |
-| `ontology.connection`          | `true`                | Whether the agent reaches the ontology over MCP                                                                          |
+| Field                                    | Default               | Meaning                                                                                                                                             |
+| ---------------------------------------- | --------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------- |
+| `channels.telegram.connection`           | none                  | The Connect key whose credential is the bot token. Without `channels.telegram`, no Telegram.                                                        |
+| `channels.telegram.policy`               | `"smart"`             | Unaddressed group text: `smart` asks the decision model, `mention` observes; attachments always trigger a turn                                      |
+| `channels.telegram.linkPreviews`         | `all`                 | Keep native first-link previews; opt into `external` to preview external links only, or `none` to disable previews. Caller options take precedence. |
+| `channels.telegram.additionalOwnOrigins` | `[]`                  | Additional exact HTTP(S) workspace origins, including local ports; no paths or credentials.                                                         |
+| `models.stt`                             | `"spacexai/grok-stt"` | The AI Gateway transcription model for voice messages; `false` leaves them untranscribed                                                            |
+| `models.imageDescription`                | automatic             | A separate vision model for ingestion descriptions; omitted prefers native images, `false` disables description fallback                            |
+| `models.decision`                        | `"typesafe-ai/jev"`   | The AI Gateway decision model of the inbound router                                                                                                 |
+| `ontology.connection`                    | `true`                | Whether the agent reaches the ontology over MCP                                                                                                     |
 
 An unknown field or an invalid value fails the mount with `SegmentStreamAgentConfigError`, naming
 each path. `manifestOf(config)` returns the normalized configuration, defaults applied, for the

package/dist/_chunks/{inbound-request-DRNPIIpb.mjs → inbound-request-CysnjMdw.mjs}

@@ -4,10 +4,13 @@ import { createRequire as __eveCreateRequire } from "node:module";
 const __filename = __eveFileURLToPath(import.meta.url);
 __eveDirname(__filename);
 __eveCreateRequire(import.meta.url);
-import { isExactChatPostCard } from "../extension/lib/telegram/chat-post-card.mjs";
+import { isTechnicalText } from "../extension/lib/customer-text-safety.mjs";
+import { isConfirmationText } from "../extension/lib/telegram/confirmation-text.mjs";
+import { chatPostCardLinks, isExactChatPostCard } from "../extension/lib/telegram/chat-post-card.mjs";
 import { redactDiagnostic } from "../extension/lib/diagnostics.mjs";
 import { plainTelegramText, splitTelegramText, telegramMarkdown } from "../extension/lib/telegram/format.mjs";
 import { inTelegramSendQueue } from "../extension/lib/telegram/send-queue.mjs";
+import { telegramPreviewOptions, telegramTextLinks } from "@segmentstream-cloud/ontology/telegram";
 import { randomBytes } from "node:crypto";
 import { AsyncLocalStorage } from "node:async_hooks";
 const deliveryLocale = new AsyncLocalStorage();
@@ -23,43 +26,17 @@ function currentLocale() {
 function currentThreadId() {
 	return deliveryLocale.getStore()?.threadId ?? currentInboundRequest()?.threadId;
 }
-function customerCopy(locale = currentLocale()) {
-	return locale.toLowerCase().split(/[-_]/)[0] === "ru" ? {
-		failed: "Не удалось выполнить запрос. Попробуйте ещё раз.",
-		recovery: "Не удалось продолжить разговор. Отправьте новое сообщение.",
-		attachment: "Не удалось обработать файл. Попробуйте ещё раз.",
-		authorization: "Не удалось подключиться. Попробуйте ещё раз.",
-		response: "Не удалось показать ответ. Попробуйте ещё раз.",
-		reference: "Код ошибки",
-		connected: "Доступ подключён.",
-		disconnected: "Подключение отменено."
-	} : {
-		failed: "I couldn't complete the request. Please try again.",
-		recovery: "I couldn't continue the conversation. Please send a new message.",
-		attachment: "I couldn't process the file. Please try again.",
-		authorization: "I couldn't connect. Please try again.",
-		response: "I couldn't display the response. Please try again.",
-		reference: "Error reference",
-		connected: "Access connected.",
-		disconnected: "Connection cancelled."
+function customerCopy() {
+	return {
+		failed: "⚠️",
+		recovery: "⚠️",
+		attachment: "⚠️",
+		authorization: "⚠️",
+		response: "⚠️",
+		connected: "✅",
+		disconnected: "❌"
 	};
 }
-const TECHNICAL_PATTERNS = [
-	/[{}]|```/u,
-	/\b[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}\b/iu,
-	/\b[0-9a-hjkmnp-tv-z]{26}\b/iu,
-	/\b\w+__\w+/u,
-	/\b(?:Serialization|Type|Reference|Syntax|Tool|Provider|API|Workflow|InternalServer)Error\b/u,
-	/\bError:\s|(?:^|\n)\s*at\s+\S+|\b(?:stack trace|traceback|SQLSTATE|node_modules)\b/imu,
-	/\b(?:duplicate key|ECONN\w+|HTTP [45]\d\d)\b/iu,
-	/\[\s*(?:"[^"]*"|\d+|true|false|null)\s*[,\]]/u
-];
-function isTechnicalText(text) {
-	if (/https?:\/\/[^\s/@]+:[^\s/@]+@|[?&](?:token|access_token|api_key|secret|password)=/iu.test(text)) return true;
-	const visible = text.replace(/https?:\/\/[^\s)<>]+/giu, "link");
-	const prose = visible.replace(/(?<![\w@])@[a-z][a-z0-9_]{4,31}(?!\w)/giu, "recipient");
-	return TECHNICAL_PATTERNS.some((pattern) => pattern.test(visible)) || /\b[a-z][a-z0-9]*_[a-z][a-z0-9_]*\b(?!\.[a-z0-9])/iu.test(prose);
-}
 function redactCredentials(value) {
 	if (typeof value === "string") return value.replace(/\bBearer [A-Za-z0-9_.~+/-]+=*/giu, "Bearer [redacted]").replace(/(https?:\/\/)[^/@\s]+:[^/@\s]+@/gu, "$1[redacted]@").replace(/([?&](?:token|access_token|api_key|secret|password)=)[^&#\s]*/giu, "$1[redacted]").replace(/("(?:token|api_key|password|secret)"\s*:\s*)"(?:\\.|[^"\\])*"/giu, "$1\"[redacted]\"");
 	if (Array.isArray(value)) return value.map(redactCredentials);
@@ -77,16 +54,18 @@ function reportTelegramError(operation, error, metadata = {}, secrets = new Set(
 	});
 	return errorId;
 }
-function failureText(errorId, kind = "failed", locale = currentLocale()) {
+function failureText(errorId, kind = "failed", _locale = currentLocale()) {
 	if (kind === "cancelled") return `⏹ ${errorId}`;
-	const copy = customerCopy(locale);
-	return `${copy[kind]} ${copy.reference}: ${errorId}.`;
+	return `${customerCopy()[kind]} ${errorId}`;
 }
 function customerText(text, locale = currentLocale()) {
 	if (!isTechnicalText(text)) return text;
 	return failureText(reportTelegramError("technical_text_blocked", { text }), "response", locale);
 }
 function customerMessage(text, locale = currentLocale()) {
+	return guardedCustomerMessage(text, locale);
+}
+function guardedCustomerMessage(text, locale, blocked) {
 	let message;
 	try {
 		message = telegramMarkdown(text);
@@ -99,14 +78,20 @@ function customerMessage(text, locale = currentLocale()) {
 	}
 	const links = message.entities.flatMap((entity) => entity.url === void 0 ? [] : [entity.url]);
 	const visible = customerText(message.text, locale);
-	if (visible !== message.text) return {
-		text: visible,
-		entities: []
-	};
-	if (links.some(isTechnicalText)) return {
-		text: failureText(reportTelegramError("unsafe_markdown_link", new Error("Credential-bearing link refused.")), "response", locale),
-		entities: []
-	};
+	if (visible !== message.text) {
+		blocked?.();
+		return {
+			text: visible,
+			entities: []
+		};
+	}
+	if (links.some(isTechnicalText)) {
+		blocked?.();
+		return {
+			text: failureText(reportTelegramError("unsafe_markdown_link", new Error("Credential-bearing link refused.")), "response", locale),
+			entities: []
+		};
+	}
 	return message;
 }
 async function formattingRefused(response) {
@@ -126,7 +111,7 @@ var TelegramDeliveryError = class extends Error {
 		this.messageIds = messageIds;
 	}
 };
-function safeTelegramFetch(fetchImpl, scope = "telegram") {
+function safeTelegramFetch(fetchImpl, scope = "telegram", previews = {}) {
 	const methods = new Set([
 		"sendMessage",
 		"editMessageText",
@@ -140,17 +125,22 @@ function safeTelegramFetch(fetchImpl, scope = "telegram") {
 		const url = typeof input === "string" ? input : input instanceof URL ? input.href : input.url;
 		if (!methods.has(url.split("/").at(-1) ?? "") || typeof init?.body !== "string") return fetchImpl(input, init);
 		const body = JSON.parse(init.body);
+		let textBlocked = false;
 		for (const field of ["text", "caption"]) {
 			if (typeof body[field] === "string" && isExactChatPostCard(body[field])) body.parse_mode = "MarkdownV2";
 			if (typeof body[field] === "string" && !isExactChatPostCard(body[field])) {
 				const entityField = field === "text" ? "entities" : "caption_entities";
 				const existing = body[entityField];
-				const message = Array.isArray(existing) ? {
+				const message = Array.isArray(existing) || isConfirmationText(body[field]) ? {
 					text: body[field],
-					entities: existing
-				} : customerMessage(body[field]);
+					entities: existing ?? []
+				} : guardedCustomerMessage(body[field], currentLocale(), () => {
+					textBlocked = true;
+				});
 				const guarded = customerText(message.text);
-				body[field] = message.entities.some((entity) => typeof entity.url === "string" && isTechnicalText(entity.url)) ? failureText(reportTelegramError("unsafe_entity_link", new Error("Credential-bearing link refused.")), "response") : guarded;
+				const unsafeLink = message.entities.some((entity) => typeof entity.url === "string" && isTechnicalText(entity.url));
+				textBlocked ||= guarded !== message.text || unsafeLink;
+				body[field] = unsafeLink ? failureText(reportTelegramError("unsafe_entity_link", new Error("Credential-bearing link refused.")), "response") : guarded;
 				if (!url.endsWith("/answerCallbackQuery")) body[entityField] = body[field] === message.text ? message.entities : [];
 				delete body.parse_mode;
 			}
@@ -160,14 +150,17 @@ function safeTelegramFetch(fetchImpl, scope = "telegram") {
 			...typeof item.caption === "string" ? { caption: customerText(item.caption) } : {}
 		}));
 		const markup = body.reply_markup;
-		if (Array.isArray(markup?.inline_keyboard)) markup.inline_keyboard = markup.inline_keyboard.map((row) => row.map((button) => {
-			if (typeof button.text !== "string" || !isTechnicalText(button.text)) return button;
-			reportTelegramError("technical_button_label_blocked", { text: button.text });
-			return {
-				...button,
-				text: currentLocale().startsWith("ru") ? "Продолжить" : "Continue"
-			};
-		}));
+		if (Array.isArray(markup?.inline_keyboard)) {
+			if ((textBlocked || typeof body.text === "string" && body.text.length > 4096) && markup.inline_keyboard.some((row) => row.some((button) => typeof button.callback_data === "string" && button.callback_data.startsWith("ss-confirm:")))) throw new Error("Approval buttons require the complete, safe confirmation text.");
+			markup.inline_keyboard = markup.inline_keyboard.map((row) => row.map((button) => {
+				if (typeof button.text !== "string" || !isTechnicalText(button.text)) return button;
+				reportTelegramError("technical_button_label_blocked", { text: button.text });
+				return {
+					...button,
+					text: "➡️"
+				};
+			}));
+		}
 		const send = async () => {
 			const parts = url.endsWith("/sendMessage") && typeof body.text === "string" && !isExactChatPostCard(body.text) ? splitTelegramText({
 				text: body.text,
@@ -177,9 +170,16 @@ function safeTelegramFetch(fetchImpl, scope = "telegram") {
 			const messageIds = [];
 			const attempt = async (outgoing) => {
 				try {
+					const previewOptions = (url.endsWith("/sendMessage") || url.endsWith("/editMessageText")) && typeof outgoing.text === "string" ? telegramPreviewOptions(body, chatPostCardLinks(outgoing.text) ?? telegramTextLinks(outgoing.text, outgoing.entities ?? []), previews) : {};
+					const payload = { ...outgoing };
+					if (url.endsWith("/sendMessage") || url.endsWith("/editMessageText")) {
+						delete payload.link_preview_options;
+						delete payload.disable_web_page_preview;
+						Object.assign(payload, previewOptions);
+					}
 					return await fetchImpl(input, {
 						...init,
-						body: JSON.stringify(outgoing)
+						body: JSON.stringify(payload)
 					});
 				} catch (error) {
 					throw new TelegramDeliveryError(reportTelegramError("telegram_send_unknown", error, { messageIds }), "unknown", messageIds);
@@ -322,4 +322,4 @@ function withReplacedText(source, request) {
 		}
 	};
 }
-export { TelegramDeliveryError as a, customerCopy as c, failureText as d, formattingRefused as f, withDeliveryLocale as g, safeTelegramFetch as h, withReplacedText as i, customerMessage as l, reportTelegramError as m, currentInboundRequest as n, currentLocale as o, isTechnicalText as p, runInboundRequest as r, currentThreadId as s, InboundRequest as t, customerText as u };
+export { TelegramDeliveryError as a, customerCopy as c, failureText as d, formattingRefused as f, withDeliveryLocale as h, withReplacedText as i, customerMessage as l, safeTelegramFetch as m, currentInboundRequest as n, currentLocale as o, reportTelegramError as p, runInboundRequest as r, currentThreadId as s, InboundRequest as t, customerText as u };

package/dist/extension/config.d.ts

@@ -1,11 +1,4 @@
-/**
- * The extension's configuration: `agent/segmentstream.json`, mounted by
- * `agent/agent/extensions/segmentstream.ts` and read by the platform at deploy.
- *
- * eve validates a mount's configuration with a Standard Schema. The schema below is written by
- * hand, so the package adds no second schema library next to the Effect Schema the rest of the
- * repository uses.
- */
+import { type TelegramLinkPreviews } from "@segmentstream-cloud/ontology/telegram";
 export declare const TELEGRAM_POLICIES: readonly ["mention", "smart"];
 /**
  * How the Telegram channel treats group messages that do not address the bot: `smart` asks the
@@ -28,6 +21,10 @@ export interface SegmentStreamAgentConfigInput {
             readonly connection: string;
             /** `smart` (default) or `mention`. */
             readonly policy?: string;
+            /** Telegram’s native first link (default), external links only, or no previews. */
+            readonly linkPreviews?: string;
+            /** Additional exact HTTP(S) origins belonging to this workspace. */
+            readonly additionalOwnOrigins?: readonly string[];
         };
     };
     readonly models?: {
@@ -72,6 +69,8 @@ export interface SegmentStreamAgentConfigInput {
 export interface TelegramSettings {
     readonly connection: string;
     readonly policy: TelegramPolicy;
+    readonly linkPreviews?: TelegramLinkPreviews;
+    readonly additionalOwnOrigins?: readonly string[];
 }
 /** The chat models `segmentstream.model()` chooses between, as AI Gateway model ids. */
 export interface ChatModelChoice {

package/dist/extension/config.mjs

@@ -4,6 +4,7 @@ import { createRequire as __eveCreateRequire } from "node:module";
 const __filename = __eveFileURLToPath(import.meta.url);
 __eveDirname(__filename);
 __eveCreateRequire(import.meta.url);
+import { TELEGRAM_LINK_PREVIEWS, isHttpOrigin } from "@segmentstream-cloud/ontology/telegram";
 const CONNECTION_KEY = /^[a-z][a-z0-9_]{0,63}$/;
 const TELEGRAM_POLICIES = ["mention", "smart"];
 const DEFAULT_STT_MODEL = "spacexai/grok-stt";
@@ -44,7 +45,12 @@ function telegramSettings(value, issues) {
 	const telegram = section({
 		value,
 		path,
-		allowed: ["connection", "policy"],
+		allowed: [
+			"connection",
+			"policy",
+			"linkPreviews",
+			"additionalOwnOrigins"
+		],
 		issues
 	});
 	if (telegram === void 0) return null;
@@ -58,9 +64,21 @@ function telegramSettings(value, issues) {
 		message: "must be \"smart\" or \"mention\"",
 		path: [...path, "policy"]
 	});
+	const linkPreviews = telegram.linkPreviews === void 0 ? "all" : telegram.linkPreviews;
+	const additionalOwnOrigins = telegram.additionalOwnOrigins === void 0 ? [] : telegram.additionalOwnOrigins;
+	if (!TELEGRAM_LINK_PREVIEWS.some((mode) => mode === linkPreviews)) issues.push({
+		message: "must be \"external\", \"none\" or \"all\"",
+		path: [...path, "linkPreviews"]
+	});
+	if (!Array.isArray(additionalOwnOrigins) || !additionalOwnOrigins.every(isHttpOrigin)) issues.push({
+		message: "must be an array of HTTP(S) origins without paths, credentials, queries or fragments",
+		path: [...path, "additionalOwnOrigins"]
+	});
 	return typeof connection === "string" && isTelegramPolicy(policy) ? {
 		connection,
-		policy
+		policy,
+		linkPreviews,
+		additionalOwnOrigins
 	} : null;
 }
 function modelId(input) {

package/dist/extension/instructions.md

@@ -26,6 +26,13 @@ talking to you, and you act with exactly their permissions.
 - Destructive or irreversible actions, and legacy custom actions without safety labels, require
   the tool boundary's Confirm / Cancel buttons. Call the action to start that flow; never ask for
   approval in prose or treat a text acknowledgement as approval. Wait for the button outcome.
+  When the tool schema offers `_confirmation`, supply {question, confirm, cancel, done,
+  cancelled, failed, expired?, edit?} in the chat's language. Describe the action and key
+  parameters in a plain single-line question (at most 300 characters); labels are at most
+  24 characters. No IDs, tool names, snake_case, URLs, credentials, or markup. The platform
+  adds trusted facts and symbols. Omit this argument on older tools without schema support.
+  Leave decision symbols to the platform and use distinct confirm/cancel labels. If trusted
+  target titles are unavailable or the facts are too long, resolve the targets or narrow the call.
   Cancel ends that call; retry it only after a new instruction from the member.
 - Every change goes through an action. Report results after success; never claim a record changed
   unless an action reported it.
@@ -36,7 +43,7 @@ talking to you, and you act with exactly their permissions.
   Read `chat_history` or `chat_search` only when permitted, then compose the exact draft and call
   `chat_post_message`. The runtime supplies the operation key. Its Confirm / Edit / Cancel card
   shows the full attributed text in the requesting chat; only the requester can act on it and it
-  expires after ten minutes. Text such as "yes" or "да" cannot approve a post. After Edit, ask what
+  expires after ten minutes. A text acknowledgement cannot approve a post. After Edit, ask what
   to change and make a new call/card for the revision; the cancelled call cannot be reused.
   An uncertain delivery must never be automatically resent, including through a fresh call/key.
   For a reply in the current chat, answer normally. If chat posting is unavailable, say so.

package/dist/extension/lib/chat-post-confirmation.mjs

@@ -48,7 +48,7 @@ function describeChatPost(input) {
 	].every((value) => typeof value === "string" && value.length > 0) || target.provider !== "telegram" || target.id !== values.chat && target.title !== values.chat) throw new Error("An unambiguous destination and a complete exact chat preview are required.");
 	const footer = escapeMarkdownV2(caller.attribution);
 	return {
-		action: "Post message",
+		action: "❓",
 		fields: [],
 		chatPost: {
 			chatId: target.id,

package/dist/extension/lib/confirmation-description.d.ts

@@ -9,6 +9,7 @@ export interface ConfirmationDescription {
         readonly value: string;
     }[];
     readonly chatPost?: ChatPostPreview;
+    readonly warning?: boolean;
 }
 export declare function object(value: unknown): Record<string, unknown>;
 export declare function humanize(value: string): string;

package/dist/extension/lib/confirmation-description.mjs

@@ -4,6 +4,7 @@ import { createRequire as __eveCreateRequire } from "node:module";
 const __filename = __eveFileURLToPath(import.meta.url);
 __eveDirname(__filename);
 __eveCreateRequire(import.meta.url);
+import { isTechnicalText } from "./customer-text-safety.mjs";
 function object(value) {
 	return typeof value === "object" && value !== null && !Array.isArray(value) ? value : {};
 }
@@ -12,9 +13,20 @@ function humanize(value) {
 }
 function humanText(value, maximum = 180) {
 	if (typeof value !== "string") return;
-	const text = value.replace(/\s+/g, " ").trim();
-	if (text === "" || /[{}\[\]]|__|\b[0-9a-f]{8}-[0-9a-f-]{27,}\b|\b[0-9A-HJKMNP-TV-Z]{26}\b|\b[a-z0-9]{24,}\b/iu.test(text)) return;
-	return text.slice(0, maximum);
+	const text = value.trim();
+	if (text === "" || text.length > maximum || isTechnicalText(text) || [
+		/[\p{Cc}\p{Cf}\p{Zl}\p{Zp}<>`*_~|\\\[\]{}]|^(?:#{1,6}|[-+])\s/u,
+		/[a-z][a-z0-9+.-]*:\/\/|www\.|\b[a-z][a-z0-9]*\.[a-z][a-z_0-9]*\b/iu,
+		/&(?:#\d+|#x[0-9a-f]+|[a-z]+);/iu,
+		/\bBearer\s+|\b(?:password|secret|token|credential|api[ _-]?key)\s*[:=]/iu,
+		/\b(?:sk|ssw|ghp)[_-][a-z0-9]+/iu,
+		/\b[0-9a-f]{8}-[0-9a-f-]{27,}\b|\b[0-9A-HJKMNP-TV-Z]{26}\b|\b[a-z0-9]{24,}\b/iu
+	].some((pattern) => pattern.test(text))) return;
+	return text;
+}
+function factText(value, maximum = 180) {
+	if (typeof value === "string" && value.trim().length > maximum) throw new Error("The complete confirmation facts cannot fit in one Telegram message.");
+	return humanText(value, maximum);
 }
 function fieldSchema(value, root, depth = 0) {
 	const schema = object(value);
@@ -33,46 +45,50 @@ async function describeConfirmation(input) {
 	const properties = Array.isArray(entity.properties) ? entity.properties.map(object) : [];
 	const fields = [];
 	const read = new Map();
-	for (const [key, value] of Object.entries(input.values).slice(0, 20)) {
+	for (const [key, value] of Object.entries(input.values)) {
 		const declared = object(input.schema.properties)[key];
-		if (declared === void 0 || /password|secret|token|credential|authorization/i.test(key)) continue;
+		if (declared === void 0 || /password|secret|token|credential|authorization|api.?key|private.?key|cookie/i.test(key)) continue;
 		const schema = fieldSchema(declared, input.schema);
 		const itemSchema = schema.type === "array" ? fieldSchema(schema.items, input.schema) : schema;
 		const property = properties.find((candidate) => candidate.name === key);
 		const reference = itemSchema["x-ontology-ref"];
 		const target = input.entities.find((candidate) => candidate.name === reference);
-		const label = humanText(schema.title) ?? humanText(property?.label) ?? humanText(humanize(key));
-		if (label === void 0 || schema.writeOnly === true || schema.format === "password") continue;
+		if (schema.writeOnly === true || schema.format === "password" || itemSchema.writeOnly === true || itemSchema.format === "password") continue;
+		const label = factText(schema.title) ?? factText(property?.label) ?? factText(humanize(key));
+		if (label === void 0) throw new Error("A confirmation field has no safe label.");
 		const options = Array.isArray(property?.options) ? property.options.map(object) : [];
 		const choices = [itemSchema.oneOf, itemSchema.anyOf].flatMap((items) => Array.isArray(items) ? items.map(object) : []);
 		const values = [];
-		for (const item of (Array.isArray(value) ? value : [value]).slice(0, 5)) {
+		for (const item of Array.isArray(value) ? value : [value]) {
 			if (typeof reference === "string") {
+				if (item === null || item === void 0) continue;
 				let title;
 				if (target !== void 0 && typeof item === "string" && typeof target.title === "string") {
 					const cacheKey = `${reference}:${item}`;
 					if (!read.has(cacheKey)) read.set(cacheKey, input.read(reference, item));
 					const value = (await read.get(cacheKey))?.[target.title];
-					title = value === item ? void 0 : humanText(value);
+					title = value === item ? void 0 : factText(value, 3584);
 				}
-				values.push(title ?? humanText(target?.label) ?? label);
+				if (title === void 0) throw new Error("Every confirmation target requires an authorized, safe record title.");
+				values.push(title);
 				continue;
 			}
 			if (/^(id|.*_id)$/i.test(key) || itemSchema.format === "uuid" || typeof item === "object") continue;
 			const option = options.find((candidate) => candidate.value === item);
 			const choice = choices.find((candidate) => candidate.const === item);
 			const enumeration = Array.isArray(itemSchema.enum) || choices.length > 0 || options.length > 0;
-			const text = humanText(option?.label) ?? humanText(choice?.title) ?? (enumeration ? void 0 : typeof item === "string" ? humanText(humanize(item)) : typeof item === "number" || typeof item === "boolean" ? String(item) : void 0);
+			const text = factText(option?.label) ?? factText(choice?.title) ?? (enumeration ? void 0 : typeof item === "string" ? factText(item, 3584) : typeof item === "number" || typeof item === "boolean" ? String(item) : void 0);
 			if (text !== void 0) values.push(text);
 		}
 		if (values.length > 0) fields.push({
 			label,
 			value: values.join(", ")
 		});
-		if (fields.length === 6) break;
 	}
+	const action = factText(input.title);
+	if (action === void 0) throw new Error("A confirmation requires a safe declared action title.");
 	return {
-		action: humanText(input.title) ?? "the requested action",
+		action,
 		...humanText(entity.label) === void 0 ? {} : { entity: humanText(entity.label) },
 		...humanText(input.description?.split("\n\n")[0]) === void 0 ? {} : { description: humanText(input.description?.split("\n\n")[0]) },
 		fields

package/dist/extension/lib/confirmations.d.ts

@@ -1,9 +1,11 @@
 import { type StateHandle } from "eve/context";
 import type { ApprovalConfiguration } from "eve/tools/approval";
 import type { ConfirmationDescription } from "./confirmation-description.js";
+import { type ConfirmationCopy } from "./telegram/confirmation-text.js";
 export declare const CONFIRMATION_TTL_MS: number;
 export interface ActionAnnotations {
     readonly readOnlyHint?: boolean;
+    readonly confirmation?: boolean;
     readonly destructiveHint?: boolean;
     readonly irreversibleHint?: boolean;
     readonly idempotentHint?: boolean;
@@ -19,6 +21,7 @@ export interface Confirmation {
     readonly expiresAt: number;
     readonly status: "pending" | "approved" | "consumed" | "cancelled";
     readonly description?: ConfirmationDescription;
+    readonly copy?: ConfirmationCopy;
     readonly source?: {
         readonly chatId: string;
         readonly threadId: string;

package/dist/extension/lib/confirmations.mjs

@@ -6,6 +6,7 @@ __eveDirname(__filename);
 __eveCreateRequire(import.meta.url);
 import { memberIdOf } from "./telegram/principal.mjs";
 import { chatPostDigest, isChatPost } from "./chat-post-confirmation.mjs";
+import { confirmationCopy, renderConfirmation } from "./telegram/confirmation-text.mjs";
 import { chatPostCard } from "./telegram/chat-post-card.mjs";
 import { createHash } from "node:crypto";
 import { defineState } from "eve/context";
@@ -49,15 +50,19 @@ function actionApproval(options) {
 				console.warn("The ontology action permission check failed.", error);
 				return denied("The action is unavailable or the member no longer has permission.");
 			}
+			const copy = labels.confirmation === false ? void 0 : confirmationCopy(ctx.toolInput?._confirmation);
+			const businessInput = Object.fromEntries(Object.entries(ctx.toolInput ?? {}).filter(([key]) => key !== "_confirmation"));
 			const posting = isChatPost(ctx.toolName);
 			let description;
 			if (posting) try {
-				description = await options.describe?.(memberId, ctx.toolName, ctx.toolInput ?? {});
+				description = await options.describe?.(memberId, ctx.toolName, businessInput);
 				const preview = description?.chatPost;
 				const source = ctx.session.auth.current?.attributes;
-				if (preview === void 0 || typeof source?.chatId !== "string" || source.chatId === preview.externalId) return denied("A complete preview for a different chat is required. Reply normally in this chat.");
-				chatPostCard(preview, "en");
-				chatPostCard(preview, "ru");
+				if (description === void 0 || preview === void 0 || typeof source?.chatId !== "string" || source.chatId === preview.externalId) return denied("A complete preview for a different chat is required. Reply normally in this chat.");
+				chatPostCard({
+					...description,
+					warning: labels.destructiveHint === true || labels.irreversibleHint === true
+				}, copy);
 				if (saved !== void 0 && (saved.description?.chatPost === void 0 || chatPostDigest(saved.description.chatPost) !== chatPostDigest(preview) || saved.source?.chatId !== source.chatId || saved.source.threadId !== String(source.messageThreadId ?? ""))) return denied("The destination or attribution changed. Make a new call and confirmation.");
 			} catch (error) {
 				console.warn("The exact chat confirmation could not be prepared.", error);
@@ -76,9 +81,20 @@ function actionApproval(options) {
 			if (saved !== void 0) return denied("The original call is waiting for its Confirm / Cancel buttons.");
 			if (!posting && !needsConfirmation(labels)) return "approved";
 			try {
-				if (!posting) description = await options.describe?.(memberId, ctx.toolName, ctx.toolInput ?? {});
+				if (!posting) description = await options.describe?.(memberId, ctx.toolName, businessInput);
+				if (description === void 0) throw new Error("A trusted confirmation description is required.");
 			} catch (error) {
 				console.warn("The confirmation description could not be read.", error);
+				return denied("Trusted confirmation facts are incomplete, unsafe or too long. Resolve every target title and narrow the input before making a new call.");
+			}
+			description = description === void 0 ? void 0 : {
+				...description,
+				warning: labels.destructiveHint === true || labels.irreversibleHint === true
+			};
+			try {
+				if (!posting) renderConfirmation(description, copy);
+			} catch {
+				return denied("The complete confirmation facts are unsafe or too long. Narrow the action input.");
 			}
 			state.update((all) => ({
 				...all,
@@ -88,6 +104,7 @@ function actionApproval(options) {
 					inputHash: hash,
 					expiresAt: now() + CONFIRMATION_TTL_MS,
 					status: "pending",
+					...copy === void 0 ? {} : { copy },
 					...description === void 0 ? {} : { description },
 					...posting ? { source: {
 						chatId: String(ctx.session.auth.current?.attributes.chatId),

package/dist/extension/lib/customer-text-safety.d.ts

@@ -0,0 +1 @@
+export declare function isTechnicalText(text: string): boolean;

package/dist/extension/lib/customer-text-safety.mjs

@@ -0,0 +1,23 @@
+import { fileURLToPath as __eveFileURLToPath } from "node:url";
+import { dirname as __eveDirname } from "node:path";
+import { createRequire as __eveCreateRequire } from "node:module";
+const __filename = __eveFileURLToPath(import.meta.url);
+__eveDirname(__filename);
+__eveCreateRequire(import.meta.url);
+const TECHNICAL_PATTERNS = [
+	/[{}]|```/u,
+	/\b[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}\b/iu,
+	/\b[0-9a-hjkmnp-tv-z]{26}\b/iu,
+	/\b\w+__\w+/u,
+	/\b(?:Serialization|Type|Reference|Syntax|Tool|Provider|API|Workflow|InternalServer)Error\b/u,
+	/\bError:\s|(?:^|\n)\s*at\s+\S+|\b(?:stack trace|traceback|SQLSTATE|node_modules)\b/imu,
+	/\b(?:duplicate key|ECONN\w+|HTTP [45]\d\d)\b/iu,
+	/\[\s*(?:"[^"]*"|\d+|true|false|null)\s*[,\]]/u
+];
+function isTechnicalText(text) {
+	if (/https?:\/\/[^\s/@]+:[^\s/@]+@|[?&](?:token|access_token|api_key|secret|password)=/iu.test(text)) return true;
+	const visible = text.replace(/https?:\/\/[^\s)<>]+/giu, "link");
+	const prose = visible.replace(/(?<![\w@])@[a-z][a-z0-9_]{4,31}(?!\w)/giu, "recipient");
+	return TECHNICAL_PATTERNS.some((pattern) => pattern.test(visible)) || /\b[a-z][a-z0-9]*_[a-z][a-z0-9_]*\b(?!\.[a-z0-9])/iu.test(prose);
+}
+export { isTechnicalText };

package/dist/extension/lib/ontology-tools.mjs

@@ -59,7 +59,11 @@ function ontologyTools(options = {}) {
 			return Array.isArray(result.tools) && result.tools.map(object).some(supportsChatPost);
 		},
 		async labels(memberId, action) {
-			return object((await toolFor(memberId, action)).tool.annotations);
+			const { tool } = await toolFor(memberId, action);
+			return {
+				...object(tool.annotations),
+				confirmation: object(object(tool.inputSchema).properties)._confirmation !== void 0
+			};
 		},
 		async describe(memberId, action, input) {
 			const signal = AbortSignal.timeout(15e3);
@@ -76,11 +80,14 @@ function ontologyTools(options = {}) {
 					return object(result.structuredContent);
 				};
 				const [caller, destinations] = await Promise.all([read("me", {}), read("chat_list", { chat: input.chat })]);
-				return describeChatPost({
-					values: input,
-					caller,
-					destinations
-				});
+				return {
+					...describeChatPost({
+						values: input,
+						caller,
+						destinations
+					}),
+					action: typeof tool.title === "string" ? tool.title : "❓"
+				};
 			}
 			let entities = [];
 			try {