@stratusagent/core 0.11.8 → 0.11.10

package/dist/index.js

@@ -354,7 +354,16 @@ export const UNTRUSTED_TOOL_RESULT_NOTE = 'This result was written by a party th
  * transcripts, where a changed byte is a cache miss.
  */
 export const renderToolResultContent = (result) => {
-    const output = result.ok ? result.output : { error: result.error ?? 'Tool failed' };
+    // A failure keeps what the tool returned with it. A shell command that
+    // exits 1 carries its stdout, stderr, and exit code, and without them the
+    // model cannot tell a failing test from a typo from a missing program, so
+    // it guesses or asks. A failure with no output renders exactly as before,
+    // so most persisted transcripts replay byte-identical.
+    const output = result.ok
+        ? result.output
+        : result.output === null || result.output === undefined
+            ? { error: result.error ?? 'Tool failed' }
+            : { error: result.error ?? 'Tool failed', output: result.output };
     return JSON.stringify(result.trust === 'external'
         ? { untrusted: true, untrustedNote: UNTRUSTED_TOOL_RESULT_NOTE, output }
         : output);
@@ -412,8 +421,8 @@ export const originOf = (rawUrl) => {
  * as written, so every comparison of an origin in this codebase is of the
  * same thing.
  */
-const originForSession = (tool, session) => {
-    const reported = tool.originFor?.(session);
+const originForSession = (tool, session, input) => {
+    const reported = tool.originFor?.(session, input);
     return reported === undefined ? undefined : originOf(reported);
 };
 /**
@@ -1498,6 +1507,9 @@ const CONVERSATION_KINDS = ['direct', 'group', 'private', 'public'];
 // vouched for, but still typed, so anything that is not plainly a name is
 // dropped rather than quoted.
 const CONVERSATION_WITH_PATTERN = /^[\p{L}\p{M}\p{N}][\p{L}\p{M}\p{N} .'\u2019-]{0,63}$/u;
+// A platform-assigned id, never a word anyone typed: Slack's are capitals
+// and digits. Anything else is dropped rather than quoted.
+const CONVERSATION_ID_PATTERN = /^[A-Z0-9]{6,32}$/;
 /**
  * The room a turn's metadata describes, keeping only what is safe to put
  * in front of the model, or undefined when it describes none.
@@ -1507,7 +1519,7 @@ export const conversationContextFrom = (metadata) => {
     if (typeof raw !== 'object' || raw === null || Array.isArray(raw)) {
         return undefined;
     }
-    const { kind, members, with: withWhom, thread, shared } = raw;
+    const { kind, members, with: withWhom, thread, shared, id } = raw;
     if (typeof kind !== 'string' || !CONVERSATION_KINDS.includes(kind)) {
         return undefined;
     }
@@ -1517,6 +1529,7 @@ export const conversationContextFrom = (metadata) => {
         ...(kind === 'direct' && typeof withWhom === 'string' && CONVERSATION_WITH_PATTERN.test(withWhom.trim()) ? { with: withWhom.trim() } : {}),
         ...(thread === true ? { thread: true } : {}),
         ...(kind !== 'direct' && shared === true ? { shared: true } : {}),
+        ...(kind !== 'direct' && typeof id === 'string' && CONVERSATION_ID_PATTERN.test(id) ? { id } : {}),
     };
 };
 /**
@@ -1895,6 +1908,11 @@ export const UNADDRESSED_TURN_NOTE = 'Nobody said that to you, and nobody is wai
  * the runtime speaking for one call, and a transcript that kept it would
  * read to every later turn as something the person said.
  */
+/**
+ * What a harness runtime is told when auto-continue grants it a fresh
+ * budget. The runtime speaking, never saved to the kernel's transcript.
+ */
+export const CONTINUE_NOTE = 'You ran out of steps for this stretch and have been given more. Carry on with the work from where you left off; do not start over or repeat what is done.';
 export const TURN_LIMIT_NOTE = 'You have used every step this message allows, so you cannot call any more tools on it. Reply now, in words: say what you did, what you found, and what is left. If the work is unfinished, end by saying that replying "continue" picks it up from here.';
 /** The wrap-up note as a message, for the request's window only. */
 const turnLimitNoteFor = (session) => ({
@@ -2869,6 +2887,7 @@ export const renderChannelSection = (session, conversation) => {
  */
 const describeRoom = (room, channel) => {
     const count = room.members !== undefined ? room.members.toLocaleString('en-US') : undefined;
+    const idNote = room.id !== undefined ? ` Its ${channel} id is ${room.id}.` : '';
     const inThread = room.thread === true ? ' You are replying in a thread there, which everyone who can read the channel can open.' : '';
     const outside = room.shared === true
         ? ' It is shared with people outside this workspace, through Slack Connect or another workspace of the organization, and they read it too.'
@@ -2881,13 +2900,13 @@ const describeRoom = (room, channel) => {
                 + 'Only the two of you can read it, so you are talking to one person.';
         case 'group':
             return `this is a group direct message in ${channel}${count !== undefined ? ` with ${count} members, you included` : ''}. `
-                + `Only they can read it.${outside}${inThread} ${forEveryone}`;
+                + `Only they can read it.${idNote}${outside}${inThread} ${forEveryone}`;
         case 'private':
             return `this is a private ${channel} channel${count !== undefined ? ` with ${count} members, you included` : ''}. `
-                + `Only its members can read it.${outside}${inThread} ${forEveryone}`;
+                + `Only its members can read it.${idNote}${outside}${inThread} ${forEveryone}`;
         case 'public':
             return `this is a public ${channel} channel${count !== undefined ? ` with ${count} members` : ''}. `
-                + `Anyone in the workspace can find it and read it, now or later, not only the people talking.${outside}${inThread} ${forEveryone}`;
+                + `Anyone in the workspace can find it and read it, now or later, not only the people talking.${idNote}${outside}${inThread} ${forEveryone}`;
     }
 };
 // A provider or model name as the prompt may carry it. A model name can
@@ -3353,6 +3372,87 @@ const throwIfAborted = (signal) => {
  * task checks in rather than where it dies, and 40 is enough for real
  * multi-step work while still bounding what a runaway loop can spend.
  */
+/**
+ * What is wrong with a call's input against the shape its tool declared,
+ * or undefined when nothing the check reads is wrong.
+ *
+ * Deliberately shallow: required keys, the declared JSON types, `enum`,
+ * and `additionalProperties: false`, applied to nested objects too. It
+ * exists so a call the tool would reject anyway is answered with the reason
+ * before anyone is asked to approve it, not to replace a tool's own checks,
+ * which still run. A schema keyword it doesn't read is not a failure.
+ */
+/** JSON equality, member order aside, the way JSON Schema compares `enum` values. */
+const sameJson = (left, right, depth = 0) => {
+    if (left === right) {
+        return true;
+    }
+    // Past any depth a real enum has, too deep to compare safely: unknown is
+    // not wrong, so it counts as a match and the tool's own checks decide.
+    if (depth > 64) {
+        return true;
+    }
+    if (left === null || right === null || typeof left !== 'object' || typeof right !== 'object') {
+        return false;
+    }
+    if (Array.isArray(left) || Array.isArray(right)) {
+        return Array.isArray(left) && Array.isArray(right) && left.length === right.length && left.every((item, index) => sameJson(item, right[index], depth + 1));
+    }
+    const leftKeys = Object.keys(left).filter((key) => left[key] !== undefined);
+    const rightKeys = Object.keys(right).filter((key) => right[key] !== undefined);
+    return leftKeys.length === rightKeys.length && leftKeys.every((key) => sameJson(left[key], right[key], depth + 1));
+};
+export const inputProblem = (schema, input, where = 'input', depth = 0) => {
+    if (schema === undefined || depth > 4) {
+        return undefined;
+    }
+    const declared = schema.type;
+    const types = Array.isArray(declared) ? declared.filter((type) => typeof type === 'string') : typeof declared === 'string' ? [declared] : [];
+    if (types.length > 0) {
+        const actual = input === null ? 'null'
+            : Array.isArray(input) ? 'array'
+                : typeof input === 'number' ? (Number.isInteger(input) ? 'integer' : 'number')
+                    : typeof input;
+        const fits = types.some((type) => type === actual || (type === 'number' && actual === 'integer'));
+        if (!fits) {
+            return `${where} should be ${types.join(' or ')}, not ${actual}`;
+        }
+    }
+    if (Array.isArray(schema.enum) && !schema.enum.some((option) => sameJson(option, input))) {
+        return `${where} should be one of ${schema.enum.map((option) => JSON.stringify(option)).join(', ')}`;
+    }
+    if (input === null || typeof input !== 'object' || Array.isArray(input)) {
+        return undefined;
+    }
+    const properties = schema.properties !== null && typeof schema.properties === 'object' && !Array.isArray(schema.properties)
+        ? schema.properties
+        : {};
+    for (const key of Array.isArray(schema.required) ? schema.required : []) {
+        if (typeof key === 'string' && input[key] === undefined) {
+            return `${where} is missing "${key}"`;
+        }
+    }
+    // With `patternProperties` a key may be declared by a pattern, and running
+    // a pattern a schema supplied is a regex engine on untrusted input. Not
+    // this check's job: extra keys are only judged when no pattern exists.
+    const patterned = schema.patternProperties !== undefined && schema.patternProperties !== null;
+    if (schema.additionalProperties === false && !patterned) {
+        const unknown = Object.keys(input).find((key) => !(key in properties));
+        if (unknown !== undefined) {
+            return `${where} has "${unknown}", which this tool does not take (it takes ${Object.keys(properties).map((key) => `"${key}"`).join(', ') || 'nothing'})`;
+        }
+    }
+    for (const [key, value] of Object.entries(input)) {
+        const property = properties[key];
+        if (value !== undefined && property !== null && typeof property === 'object' && !Array.isArray(property)) {
+            const problem = inputProblem(property, value, `${where}.${key}`, depth + 1);
+            if (problem) {
+                return problem;
+            }
+        }
+    }
+    return undefined;
+};
 export const DEFAULT_MAX_TURNS = 40;
 export class AgentRunner {
     bus;
@@ -3400,11 +3500,23 @@ export class AgentRunner {
         // and kept out of the persisted metadata, where a later reader would
         // take the first sender's label for every turn that follows.
         const { [SENDER_TRUST_METADATA_KEY]: _sender, ...persisted } = input.metadata ?? {};
-        const senderTrust = senderTrustOf(input.metadata);
+        const earlier = input.earlier ?? [];
+        // Everyone whose words open the transcript, not only the one who
+        // asked: see `RunInput.earlier`.
+        const senderTrust = earlier.reduce((lowest, entry) => leastTrusted(lowest, senderTrustOf(entry.metadata)), senderTrustOf(input.metadata));
+        const createdAt = new Date().toISOString();
+        const heard = earlier.map((entry, index) => ({
+            id: `${input.sessionId}:user:${index + 1}`,
+            role: 'user',
+            content: entry.message,
+            createdAt,
+            overheard: true,
+            observed: true,
+        }));
         // The first stored turn is held to the window like every later one:
         // a one-shot session is a row too.
         const opening = {
-            id: `${input.sessionId}:user:1`,
+            id: `${input.sessionId}:user:${heard.length + 1}`,
             role: 'user',
             content: input.userMessage,
             createdAt: new Date().toISOString(),
@@ -3418,7 +3530,7 @@ export class AgentRunner {
             id: input.sessionId,
             agent: input.agent,
             status: 'running',
-            messages: [opening],
+            messages: [...heard, opening],
             // Labelled from the first write, whatever the dispatching surface
             // put in `metadata` under this key: the label is the runner's to
             // write, and a fresh session starts at the top of the lattice lowered
@@ -3828,18 +3940,32 @@ export class AgentRunner {
                     ? { toolName: results[0].toolName, times: failureRun }
                     : undefined;
             };
+            // Where this message wraps up: `maxTurns`, raised by another
+            // `maxTurns` each time auto-continue grants one.
+            let ceiling = this.maxTurns;
+            let continued = 0;
             for (let turn = resumeFrom?.turn ?? 1;; turn += 1) {
                 throwIfAborted(signal);
+                // Out of budget and still working — the last response called a
+                // tool — so with auto-continue on it gets another allowance rather
+                // than a wrap-up. A loop, because a recovered turn can start
+                // several allowances in. Never for a turn stuck on a failure, past
+                // the cap, or with somebody's message waiting behind it.
+                while (turn > ceiling && stuck === undefined && this.mayContinue(session.id, continued)) {
+                    ceiling += this.maxTurns;
+                    continued += 1;
+                    await this.bus.emit({ type: 'session.continued', sessionId: session.id, continuation: continued, turns: this.maxTurns });
+                }
                 // One turn past the ceiling, and only one: the wrap-up, which may
-                // not call a tool, so a turn that reaches `maxTurns + 2` is a
+                // not call a tool, so a turn that reaches `ceiling + 2` is a
                 // provider that ignored `toolChoice` and was already failed below.
                 // A turn stopped for repeating itself wraps up the same way, early.
-                const wrappingUp = turn > this.maxTurns || stuck !== undefined;
+                const wrappingUp = turn > ceiling || stuck !== undefined;
                 // A recovered call is a tool turn too, so one parked past the
                 // ceiling — `maxTurns` lowered while it waited — is refused as it
                 // was before wrap-up existed, not run on the one call reserved for
                 // saying what happened.
-                if (turn > this.maxTurns + 1 || (wrappingUp && pendingEntry)) {
+                if (turn > ceiling + 1 || (wrappingUp && pendingEntry)) {
                     throw new Error(turnLimitMessage(this.maxTurns));
                 }
                 if (pendingEntry) {
@@ -3957,6 +4083,20 @@ export class AgentRunner {
                             ...(enabledSkills.length > 0 ? { skills: enabledSkills } : {}),
                             ...(runtime !== undefined ? { runtime } : {}),
                             ...(this.streaming ? { onDelta } : {}),
+                            ...(this.options.autoContinue !== undefined
+                                ? {
+                                    // The same grant the loop below makes, for a provider
+                                    // whose loop is its own.
+                                    mayContinue: () => {
+                                        if (!this.mayContinue(session.id, continued)) {
+                                            return false;
+                                        }
+                                        continued += 1;
+                                        void this.bus.emit({ type: 'session.continued', sessionId: session.id, continuation: continued, turns: this.maxTurns });
+                                        return true;
+                                    },
+                                }
+                                : {}),
                             onUsage,
                             ...(signal ? { signal } : {}),
                         });
@@ -4108,6 +4248,15 @@ export class AgentRunner {
             throw error;
         }
     }
+    /** Whether a message out of budget gets another; see `AgentRunnerOptions.autoContinue`. */
+    mayContinue(sessionId, continued) {
+        const autoContinue = this.options.autoContinue;
+        // A budget of nothing renews to nothing, forever: never renewed.
+        if (autoContinue === undefined || this.maxTurns < 1 || (autoContinue !== true && continued >= autoContinue)) {
+            return false;
+        }
+        return this.options.waitingInput?.(sessionId) !== true;
+    }
     /** See `completeAnsweredTurn`; the loop's end and `continueTurn`'s. */
     async completeTurn(finished) {
         return completeAnsweredTurn(finished, this.store, this.bus);
@@ -4330,6 +4479,17 @@ export class AgentRunner {
         if (!tool) {
             return rejected(`Tool not found: ${call.toolName}`);
         }
+        // A malformed call is answered before anyone is asked about it, for the
+        // reason an unknown tool is: approving a call the tool will reject is a
+        // question with no useful answer, and the model needs the reason, not a
+        // human's click, to fix it. Only for calls that would be asked about; a
+        // `safe` tool's own checks answer it as they always have.
+        if (resolveToolRisk(tool) !== 'safe') {
+            const problem = inputProblem(tool.parameters, call.input);
+            if (problem) {
+                return rejected(`Invalid input for ${call.toolName}: ${problem}. Fix the call and try again.`);
+            }
+        }
         // Only a call that can actually be held for a human is checkpointed:
         // a `safe` one is never asked about, and writing a record for it would
         // add a save to every unattended call to describe a wait that does not
@@ -4381,7 +4541,7 @@ export class AgentRunner {
                 ...(signal ? { signal } : {}),
                 ...(options.parkedAt ? { parkedAt: options.parkedAt } : {}),
             });
-            originWhenJudged = originForSession(tool, session);
+            originWhenJudged = originForSession(tool, session, call.input);
         }
         finally {
             // Cleared before anything executes and on every exit — an abort that
@@ -4411,7 +4571,7 @@ export class AgentRunner {
         // `tool.completed` keeps the pairing every consumer reads — the
         // watchdog's phase, the channel's live line. The agent is told plainly,
         // because this is a page that moved rather than a permission it lacks.
-        const originNow = originForSession(tool, session);
+        const originNow = originForSession(tool, session, call.input);
         if (originNow !== originWhenJudged) {
             const result = {
                 callId: call.id,