@zq-silk/yui 2.0.0 → 2.2.0

package/dist/nativeAgent/localSafety.js

@@ -0,0 +1,258 @@
+import { lstatSync, realpathSync, statSync } from 'node:fs';
+import path from 'node:path';
+import { isDeepStrictEqual } from 'node:util';
+import { createCodingTools } from './codingTools.js';
+const object = (value) => value !== null && typeof value === 'object' && Object.getPrototypeOf(value) === Object.prototype;
+function fields(value, allowed) {
+    return object(value) && Object.keys(value).every(key => allowed.includes(key));
+}
+function freeze(value) {
+    if (value && typeof value === 'object') {
+        Object.values(value).forEach(freeze);
+        Object.freeze(value);
+    }
+    return value;
+}
+const invalid = (code, message) => ({ code, message, effect: 'none' });
+function absolute(value) {
+    return typeof value === 'string' && path.isAbsolute(value) && !value.includes('\0')
+        && path.normalize(value) === value;
+}
+/** Reject symlinks in every component, not just the leaf. Controlled filesystems only. */
+function directory(value) {
+    try {
+        if (!absolute(value))
+            throw new Error();
+        let current = path.parse(value).root;
+        for (const component of value.slice(current.length).split(path.sep).filter(Boolean)) {
+            current = path.join(current, component);
+            const stat = lstatSync(current);
+            if (stat.isSymbolicLink() || !stat.isDirectory())
+                throw new Error();
+        }
+        if (!statSync(value).isDirectory() || realpathSync(value) !== value)
+            throw new Error();
+        return value;
+    }
+    catch {
+        throw new Error('An accessible absolute directory without symlink components is required');
+    }
+}
+const inside = (root, cwd) => {
+    const relative = path.relative(root, cwd);
+    return relative !== '..' && !relative.startsWith(`..${path.sep}`) && !path.isAbsolute(relative);
+};
+function directoryIdentity(value) {
+    try {
+        directory(value);
+        const stat = statSync(value);
+        return `${stat.dev}:${stat.ino}`;
+    }
+    catch {
+        throw new Error('Bound directory is unavailable; settle and rebuild the binding');
+    }
+}
+function executableIdentity(value) {
+    try {
+        if (!absolute(value))
+            throw new Error();
+        directory(path.dirname(value));
+        const stat = lstatSync(value);
+        if (!stat.isFile() || !(stat.mode & 0o111) || realpathSync(value) !== value)
+            throw new Error();
+        return `${stat.dev}:${stat.ino}:${stat.size}:${stat.mtimeMs}:${stat.mode}`;
+    }
+    catch {
+        throw new Error('Reviewed executable must be an accessible absolute regular executable without symlinks');
+    }
+}
+function environment(value) {
+    // Deliberately small, complete environment. No HOME, config, proxies, tokens,
+    // interpreter/loader injection or process.env merge. Widen only with a reviewed contract.
+    if (!object(value) || Object.entries(value).some(([key, entry]) => {
+        if (typeof entry !== 'string' || entry.includes('\0') || entry.length > 4096)
+            return true;
+        if (key === 'PATH')
+            return entry.split(path.delimiter).some(part => !absolute(part));
+        if (key === 'LANG' || key === 'LC_ALL')
+            return !/^[A-Za-z0-9_.@-]{1,128}$/.test(entry);
+        if (key === 'TZ')
+            return !/^[A-Za-z0-9_+./-]{1,128}$/.test(entry) || entry.includes('..');
+        return true;
+    }))
+        throw new Error('Command environment permits only deliberate PATH, LANG, LC_ALL and TZ values');
+    return { ...value };
+}
+/** One common factory owns the actual prebound tools and their matching lease.
+ * Use with createToolExecutor, never the Agent's three-argument tools shorthand.
+ * No resources are started during construction/acquisition; commandTool owns its processes.
+ */
+export function createLocalToolBinding(options) {
+    if (!fields(options, ['root', 'cwd', 'allowWrite', 'allowCommand', 'text', 'search', 'command', 'redact'])
+        || [options.allowWrite, options.allowCommand].some(v => v !== undefined && typeof v !== 'boolean')
+        || (options.text !== undefined && !fields(options.text, ['maxBytes']))
+        || (options.search !== undefined && !fields(options.search, ['maxEntries', 'maxResults', 'maxOutputBytes', 'maxFileBytes', 'maxTotalBytes', 'maxDepth']))) {
+        throw new Error('Invalid local tool configuration');
+    }
+    const root = directory(options.root);
+    const cwd = directory(options.cwd);
+    if (!inside(root, cwd))
+        throw new Error('cwd must be within the explicit root directory');
+    const rootIdentity = directoryIdentity(root);
+    const cwdIdentity = directoryIdentity(cwd);
+    const allowWrite = options.allowWrite === true;
+    const allowCommand = options.allowCommand === true;
+    if (options.redact !== undefined && (!Array.isArray(options.redact) || options.redact.length > 128
+        || options.redact.some(v => typeof v !== 'string' || !v.length || v.length > 4096))) {
+        throw new Error('Invalid known-secret redaction configuration');
+    }
+    const secrets = [...(options.redact ?? [])].sort((a, b) => b.length - a.length);
+    const secretPattern = secrets.length
+        ? new RegExp(secrets.map(secret => secret.replace(/[.*+?^${}()|[\]\\]/g, '\\$&')).join('|'), 'g') : undefined;
+    const scrub = (text) => secretPattern ? text.replace(secretPattern, '[REDACTED]') : text;
+    const scrubJson = (text) => {
+        const visit = (value) => typeof value === 'string' ? scrub(value)
+            : Array.isArray(value) ? value.map(visit)
+                : value && typeof value === 'object'
+                    ? Object.fromEntries(Object.entries(value).map(([k, v]) => [k, k === 'sha256' ? v : visit(v)])) : value;
+        try {
+            return JSON.stringify(visit(JSON.parse(text)));
+        }
+        catch {
+            return scrub(text);
+        }
+    };
+    const specs = [];
+    let commandOptions;
+    if (options.command !== undefined) {
+        if (!fields(options.command, ['env', 'specs', 'timeoutMs', 'maxOutputBytes', 'killGraceMs'])
+            || !Array.isArray(options.command.specs) || options.command.specs.length > 128) {
+            throw new Error('Invalid reviewed command configuration');
+        }
+        const env = environment(options.command.env);
+        for (const spec of options.command.specs) {
+            if (!fields(spec, ['executable', 'argv', 'effect']) || !absolute(spec.executable)
+                || !Array.isArray(spec.argv) || spec.argv.length > 256
+                || spec.argv.some((v) => typeof v !== 'string' || v.includes('\0'))
+                || !['read', 'write'].includes(spec.effect)
+                || Buffer.byteLength(JSON.stringify(spec)) > 16 * 1024) {
+                throw new Error('Invalid exact reviewed command specification');
+            }
+            if (specs.some(entry => entry.spec.executable === spec.executable
+                && JSON.stringify(entry.spec.argv) === JSON.stringify(spec.argv))) {
+                throw new Error('Duplicate reviewed command specification');
+            }
+            specs.push({ spec: freeze({ ...spec, argv: [...spec.argv] }), identity: executableIdentity(spec.executable) });
+        }
+        commandOptions = { env, timeoutMs: options.command.timeoutMs,
+            maxOutputBytes: options.command.maxOutputBytes, killGraceMs: options.command.killGraceMs };
+    }
+    if (allowCommand && !commandOptions)
+        throw new Error('Explicit command environment and specifications are required');
+    // Validate command budgets even when disabled; do not silently ignore invalid configuration.
+    const all = createCodingTools({
+        root, text: options.text, search: options.search, command: commandOptions,
+    });
+    const description = freeze({
+        root, cwd, allowWrite, allowCommand,
+        envKeys: Object.keys(commandOptions?.env ?? {}).sort(), commandCount: specs.length,
+    });
+    // Object member order is not part of the public ToolInvocation contract.
+    // Project its required identity fields; compare JSON values without sorting
+    // arrays or weakening parameter/definition equality.
+    const invocationValue = ({ identity, call, definition }) => [
+        identity.sessionId, identity.turnId, identity.step, identity.toolCallId, identity.name,
+        call.id, call.name, call.arguments, definition,
+    ];
+    const active = new WeakMap();
+    const matchingLease = (lease, invocation) => isDeepStrictEqual(active.get(lease), invocationValue(invocation));
+    const selected = all.filter(tool => (allowWrite || !['write', 'edit'].includes(tool.definition.name))
+        && (allowCommand || tool.definition.name !== 'command'));
+    const definitions = new Map(selected.map(tool => [tool.definition.name,
+        freeze(structuredClone(tool.definition))]));
+    const fresh = () => directoryIdentity(root) === rootIdentity && directoryIdentity(cwd) === cwdIdentity;
+    const validate = (tool, args) => {
+        const bad = tool.validate(args);
+        if (bad)
+            return bad;
+        if (tool.definition.name !== 'command')
+            return null;
+        const input = args;
+        const match = specs.find(({ spec }) => spec.executable === input.command && input.cwd === cwd
+            && JSON.stringify(spec.argv) === JSON.stringify(input.argv));
+        if (!match || (match.spec.effect === 'write' && !allowWrite)) {
+            return invalid('command_not_authorized', 'Command requires an exact reviewed executable/argv/cwd and permitted effect');
+        }
+        try {
+            if (executableIdentity(match.spec.executable) !== match.identity)
+                throw new Error();
+        }
+        catch {
+            return invalid('binding_changed', 'Reviewed executable changed; settle and rebuild the binding');
+        }
+        return null;
+    };
+    const validInvocation = (invocation) => {
+        const name = invocation.call.name;
+        return invocation.identity.name === name && invocation.identity.toolCallId === invocation.call.id
+            && definitions.has(name) && isDeepStrictEqual(invocation.definition, definitions.get(name));
+    };
+    const tools = selected.map(tool => {
+        const definition = definitions.get(tool.definition.name);
+        return Object.freeze({
+            definition,
+            validate: (args) => validate(tool, args),
+            async execute(args, identity, signal, lease) {
+                // Guard here too: a permissive foreign permission, copied value, expired
+                // lease or the three-argument shorthand cannot bypass the actual tool.
+                const invocation = { identity: { ...identity, name: definition.name },
+                    call: { id: identity.toolCallId, name: definition.name, arguments: args }, definition };
+                if (!lease || !matchingLease(lease, invocation)) {
+                    return { ok: false, error: invalid('binding_mismatch', 'A matching live invocation lease is required') };
+                }
+                try {
+                    if (!fresh())
+                        throw new Error();
+                }
+                catch {
+                    return { ok: false, error: invalid('binding_changed', 'Workspace changed; settle and rebuild the binding') };
+                }
+                const bad = validate(tool, args);
+                if (bad)
+                    return { ok: false, error: bad };
+                const outcome = await tool.execute(args, identity, signal);
+                return outcome.ok ? { ok: true, content: scrubJson(outcome.content) }
+                    : { ok: false, error: { ...outcome.error, message: scrubJson(outcome.error.message) } };
+            },
+        });
+    });
+    return Object.freeze({
+        binding: description, tools: Object.freeze(tools),
+        environment: Object.freeze({
+            async acquire(invocation, signal) {
+                if (signal.aborted || !validInvocation(invocation) || !fresh()) {
+                    throw new Error('Local binding unavailable or declaration mismatched');
+                }
+                const lease = Object.freeze({ ...description });
+                active.set(lease, freeze(structuredClone(invocationValue(invocation))));
+                return { value: lease, async release() { active.delete(lease); } };
+            },
+        }),
+        permission: Object.freeze({
+            async check(invocation, lease, signal) {
+                try {
+                    if (signal.aborted || !validInvocation(invocation) || !matchingLease(lease, invocation)
+                        || !fresh())
+                        throw new Error();
+                    const tool = selected.find(tool => tool.definition.name === invocation.call.name);
+                    if (validate(tool, invocation.call.arguments))
+                        throw new Error();
+                    return { allowed: true };
+                }
+                catch {
+                    return { allowed: false, reason: 'Local binding or reviewed capability does not match this invocation' };
+                }
+            },
+        }),
+    });
+}

package/dist/nativeAgent/mockProvider.js

@@ -0,0 +1,43 @@
+/** A deliberately small read/write mock, not a semantic planner. */
+export function createMockProvider(options) {
+    const { toolCallProbability: p, random = Math.random, readPath = 'input.txt', writePath = 'output.txt' } = options;
+    if (!Number.isFinite(p) || p < 0 || p > 1)
+        throw new Error('toolCallProbability must be in [0, 1]');
+    const latestRead = (request) => {
+        for (const m of [...request.messages].reverse()) {
+            if (m.role === 'tool' && m.name === 'read' && m.outcome.ok) {
+                try {
+                    const data = JSON.parse(m.outcome.content);
+                    if (data && typeof data === 'object' && 'text' in data && typeof data.text === 'string')
+                        return data.text;
+                }
+                catch { /* Other read implementations need not use the text-tools payload. */ }
+            }
+        }
+        return undefined;
+    };
+    return {
+        async complete(request, signal) {
+            signal.throwIfAborted();
+            const u = random();
+            if (!Number.isFinite(u) || u < 0 || u >= 1)
+                throw new Error('random must return a number in [0, 1)');
+            if (u >= p) {
+                const outcomes = request.messages.filter(m => m.role === 'tool');
+                const success = outcomes.filter(m => m.role === 'tool' && m.outcome.ok).length;
+                return { kind: 'final', content: `Observed ${success} successful and ${outcomes.length - success} failed tool results.` };
+            }
+            const content = latestRead(request);
+            const write = request.step % 2 === 0 && content !== undefined;
+            const used = new Set(request.messages.flatMap(m => m.role === 'assistant' ? m.toolCalls.map(c => c.id) : []));
+            let suffix = 1;
+            while (used.has(`mock-${suffix}`))
+                suffix++;
+            const call = { id: `mock-${suffix}`, name: write ? 'write' : 'read',
+                arguments: write ? { path: writePath, content } : { path: readPath } };
+            if (!request.tools.some(t => t.name === call.name))
+                throw new Error(`Mock requires the ${call.name} tool`);
+            return { kind: 'tool_calls', content: '', calls: [call] };
+        },
+    };
+}

package/dist/nativeAgent/model/anthropicMessages.js

@@ -0,0 +1,204 @@
+import { ModelGatewayError, object, parse, protocol } from './errors.js';
+import { argumentsObject, bounded, counts, id, index, jsonBody, result, sseFrames, text } from './wire.js';
+const usageKeys = { input_tokens: 'inputTokens', output_tokens: 'outputTokens',
+    cache_read_input_tokens: 'cachedInputTokens', cache_creation_input_tokens: 'cacheWriteInputTokens' };
+function classify(status, body) {
+    if (status === 401 || status === 403)
+        return 'authentication';
+    const root = body && typeof body === 'object' ? body : {};
+    const e = root.error && typeof root.error === 'object' ? root.error : {};
+    if (e.type === 'authentication_error' || e.type === 'permission_error')
+        return 'authentication';
+    // No documented Messages quota discriminator: do not guess from message text.
+    return status === 429 && e.type === 'rate_limit_error' ? 'rate_limit' : 'http';
+}
+function failure(root) {
+    const code = classify(429, root);
+    throw new ModelGatewayError(code === 'http' ? 'incomplete' : code);
+}
+function blockValue(value) {
+    const b = object(value);
+    if (b.type === 'text') {
+        if (Object.keys(b).some(k => !['type', 'text', 'citations'].includes(k))
+            || (b.citations != null && (!Array.isArray(b.citations) || b.citations.length)))
+            return protocol();
+        return { content: bounded(text(b.text)) };
+    }
+    if (b.type !== 'tool_use' || Object.keys(b).some(k => !['type', 'id', 'name', 'input', 'caller', 'toolset_name'].includes(k))
+        || (b.caller != null && object(b.caller).type !== 'direct') || b.toolset_name != null)
+        return protocol();
+    return { content: '', call: { id: id(b.id), name: id(b.name), arguments: argumentsObject(object(b.input)) } };
+}
+function finish(root) {
+    if (root.type === 'error' || root.error != null)
+        failure(root);
+    if (root.stop_reason !== 'end_turn' && root.stop_reason !== 'tool_use')
+        throw new ModelGatewayError('incomplete');
+    if (root.type !== 'message' || root.role !== 'assistant' || !Array.isArray(root.content)
+        || !root.content.length || root.stop_sequence != null || root.container != null || root.stop_details != null)
+        return protocol();
+    id(root.id);
+    const calls = [];
+    let content = '';
+    for (const raw of root.content) {
+        const value = blockValue(raw);
+        content = bounded(content + value.content);
+        if (value.call)
+            calls.push(value.call);
+    }
+    if ((root.stop_reason === 'tool_use') !== (calls.length > 0))
+        return protocol();
+    return result(content, calls);
+}
+export function createAnthropicMessagesAdapter() {
+    return {
+        protocol: 'anthropic-messages',
+        encode(request, model, stream, options) {
+            if (options?.maxOutputTokens === undefined)
+                throw new ModelGatewayError('request', 'none');
+            const system = [], messages = [];
+            let leading = true, lastWasTool = false;
+            for (const m of request.messages) {
+                if (m.role === 'system') {
+                    if (!leading)
+                        throw new ModelGatewayError('request', 'none');
+                    system.push({ type: 'text', text: m.content });
+                    continue;
+                }
+                leading = false;
+                if (m.role === 'tool') {
+                    const block = { type: 'tool_result', tool_use_id: m.toolCallId,
+                        content: JSON.stringify(m.outcome), is_error: !m.outcome.ok };
+                    if (lastWasTool)
+                        messages[messages.length - 1].content.push(block);
+                    else
+                        messages.push({ role: 'user', content: [block] });
+                    lastWasTool = true;
+                }
+                else {
+                    lastWasTool = false;
+                    const content = m.content ? [{ type: 'text', text: m.content }] : [];
+                    if (m.role === 'assistant')
+                        for (const c of m.toolCalls) {
+                            content.push({ type: 'tool_use', id: c.id, name: c.name, input: c.arguments });
+                        }
+                    if (!content.length)
+                        throw new ModelGatewayError('request', 'none');
+                    messages.push({ role: m.role, content });
+                }
+            }
+            if (!messages.length || messages[0].role !== 'user' || messages[messages.length - 1].role === 'assistant') {
+                // Assistant prefill is a different semantic contract, not ordinary caller history.
+                throw new ModelGatewayError('request', 'none');
+            }
+            return { model, stream, max_tokens: options.maxOutputTokens, messages,
+                ...(system.length ? { system } : {}),
+                ...(request.tools.length ? { tools: request.tools.map(t => ({
+                        name: t.name, description: t.description, input_schema: t.inputSchema,
+                    })) } : {}) };
+        },
+        classify,
+        async decode(body, streaming, emit) {
+            if (!streaming) {
+                const root = await jsonBody(body), usage = counts(root.usage, usageKeys);
+                if (usage)
+                    emit({ type: 'usage', usage });
+                return { response: finish(root), ...(usage ? { usage } : {}) };
+            }
+            let root, usage;
+            let deltaPhase = false;
+            const blocks = new Map();
+            const updateUsage = (value) => {
+                const next = counts(value, usageKeys);
+                if (!next)
+                    return;
+                for (const key of Object.keys(next)) {
+                    if (usage?.[key] !== undefined && next[key] < usage[key])
+                        return protocol();
+                }
+                usage = { ...usage, ...next };
+                emit({ type: 'usage', usage });
+            };
+            for await (const frame of sseFrames(body)) {
+                const e = object(parse(frame.data)), type = text(e.type);
+                if (frame.event !== type)
+                    return protocol();
+                if (type === 'ping')
+                    continue;
+                if (type === 'error')
+                    failure(e);
+                if (type === 'message_start') {
+                    if (root)
+                        return protocol();
+                    root = object(e.message);
+                    if (root.type !== 'message' || root.role !== 'assistant' || root.stop_reason != null
+                        || root.stop_sequence != null || root.container != null || root.stop_details != null
+                        || !Array.isArray(root.content) || root.content.length)
+                        return protocol();
+                    id(root.id);
+                    updateUsage(root.usage);
+                    continue;
+                }
+                if (!root)
+                    return protocol();
+                if (type === 'content_block_start') {
+                    const i = index(e.index), value = object(e.content_block);
+                    if (deltaPhase || i !== blocks.size)
+                        return protocol();
+                    blockValue(value);
+                    if (value.type === 'tool_use')
+                        emit({ type: 'tool_delta', index: i, id: id(value.id), name: id(value.name) });
+                    blocks.set(i, { value, arguments: '', done: false });
+                }
+                else if (type === 'content_block_delta' || type === 'content_block_stop') {
+                    const i = index(e.index), block = blocks.get(i);
+                    if (deltaPhase || !block || block.done)
+                        return protocol();
+                    if (type === 'content_block_stop') {
+                        if (block.value.type === 'tool_use' && block.arguments) {
+                            block.value = { ...block.value, input: argumentsObject(block.arguments) };
+                        }
+                        blockValue(block.value);
+                        block.done = true;
+                    }
+                    else {
+                        const d = object(e.delta);
+                        if (d.type === 'text_delta' && block.value.type === 'text') {
+                            const piece = text(d.text);
+                            block.value = { ...block.value, text: bounded(text(block.value.text) + piece) };
+                            emit({ type: 'text_delta', text: piece });
+                        }
+                        else if (d.type === 'input_json_delta' && block.value.type === 'tool_use') {
+                            if (Object.keys(object(block.value.input)).length)
+                                return protocol();
+                            const piece = text(d.partial_json);
+                            block.arguments = bounded(block.arguments + piece, 64 * 1024);
+                            emit({ type: 'tool_delta', index: i, arguments: piece });
+                        }
+                        else
+                            return protocol();
+                    }
+                }
+                else if (type === 'message_delta') {
+                    if (!blocks.size || [...blocks.values()].some(b => !b.done) || root.stop_reason != null)
+                        return protocol();
+                    deltaPhase = true;
+                    const d = object(e.delta);
+                    if (d.container != null || d.stop_details != null || d.stop_sequence != null)
+                        return protocol();
+                    root = { ...root, stop_reason: d.stop_reason, stop_sequence: d.stop_sequence };
+                    updateUsage(e.usage);
+                }
+                else if (type === 'message_stop') {
+                    if (!deltaPhase || !blocks.size || [...blocks.values()].some(b => !b.done))
+                        return protocol();
+                    return { response: finish({ ...root, content: [...blocks.values()].map(b => b.value) }),
+                        ...(usage ? { usage } : {}) };
+                }
+                else
+                    return protocol();
+            }
+            throw new ModelGatewayError('incomplete');
+        },
+    };
+}