chainlesschain 0.162.161 → 0.162.163

package/src/lib/interaction-adapter.js

@@ -14,6 +14,7 @@ import {
   LEGACY_TO_UNIFIED_TYPE,
 } from "../runtime/runtime-events.js";
 import { createAbortError } from "./abort-utils.js";
+import { verifyApprovalBinding } from "./agent-authority.js";
 import { createEnvelope } from "@chainlesschain/session-core";
 
 // Phase 5: parallel service-envelope emission. Map WS agent-handler event
@@ -167,12 +168,21 @@ export class WebSocketInteractionAdapter extends InteractionAdapter {
         reject,
         timeoutId,
         kind: options.kind || null,
+        // Approval binding (authority §"权限来源"): when a permission gate raises
+        // this request WITH a binding (tool_call_id + args + policy digest), an
+        // *approve* answer must echo the SAME binding or it is a stale / mis-
+        // routed / argument-tampered verdict and is rejected in _resolvePending.
+        // null (the default for plain questions) → no binding check, unchanged.
+        binding: options.binding || null,
       });
 
       this._sendWs({
         ...message,
         sessionId: this.sessionId,
         requestId,
+        // Ride the binding out so the remote UI/bridge can echo it back on the
+        // answer (only present when the caller supplied one).
+        ...(options.binding ? { binding: options.binding } : {}),
       });
     });
   }
@@ -210,8 +220,8 @@ export class WebSocketInteractionAdapter extends InteractionAdapter {
    * Called by ws-server when a session-answer message arrives.
    * Resolves the corresponding pending promise.
    */
-  resolveAnswer(requestId, answer) {
-    this._resolvePending(requestId, answer, "question");
+  resolveAnswer(requestId, answer, binding = null) {
+    this._resolvePending(requestId, answer, "question", binding);
   }
 
   async requestHostTool(toolName, args = {}, extra = {}) {
@@ -321,7 +331,12 @@ export class WebSocketInteractionAdapter extends InteractionAdapter {
     }
   }
 
-  _resolvePending(requestId, payload, expectedKind = null) {
+  _resolvePending(
+    requestId,
+    payload,
+    expectedKind = null,
+    incomingBinding = null,
+  ) {
     const pending = this._pending.get(requestId);
     if (!pending) {
       return;
@@ -337,11 +352,26 @@ export class WebSocketInteractionAdapter extends InteractionAdapter {
       return;
     }
 
+    // Approval-binding guard (authority §"权限来源"): if this request was raised
+    // with a binding AND the answer echoes a binding that does NOT match, the
+    // verdict is for a different / argument-tampered call — settle as a DENY
+    // (fail closed) instead of the approve it claims to be, mirroring the local
+    // headless approval gate. Backward-compatible: no request binding, or an
+    // answer with no echoed binding, resolves exactly as before.
+    let effective = payload;
+    if (
+      pending.binding &&
+      incomingBinding &&
+      !verifyApprovalBinding(pending.binding, incomingBinding)
+    ) {
+      effective = false;
+    }
+
     this._pending.delete(requestId);
     if (pending.timeoutId) {
       clearTimeout(pending.timeoutId);
     }
-    pending.resolve(payload);
+    pending.resolve(effective);
   }
 }
 

package/src/lib/json-schema-output.js

@@ -7,16 +7,36 @@
  * `deps.writeOut` capture seam — the runner itself is untouched: each attempt
  * runs with output captured, the validated JSON is the only thing printed.
  *
- * Validator subset (enough for tool/script contracts, not full draft-2020):
- * type (object/array/string/number/integer/boolean/null), properties,
- * required, items, enum, const, additionalProperties:false. Zero deps.
+ * Constrained validation delegates to the richer Draft-2020-12-subset validator
+ * in [[json-schema-validate.js]] (type, properties, required, items/prefixItems,
+ * enum/const, additionalProperties, min/max, pattern, format, allOf/anyOf/oneOf/
+ * not, if/then/else, local $ref) so retries get precise coded/pointered errors —
+ * the model is told exactly WHICH JSON Pointer failed and WHY. The legacy
+ * `validateAgainstSchema` (loose `$.a.b` strings) stays exported for callers.
  */
 
 import fsDefault from "fs";
+import {
+  validate,
+  validateSchema,
+  buildStructuredResultEvent,
+  computeSchemaDigest,
+} from "./json-schema-validate.js";
 
 export const MAX_ATTEMPTS = 3;
 export const _deps = { fs: fsDefault };
 
+/**
+ * Build the terminal `structured_result` stream event for a value against a
+ * schema (P2). Delegates to the richer Draft-2020-12-subset validator so the
+ * event carries a schema digest + coded/pointered errors — never free text.
+ */
+export function buildStructuredResult(schema, value) {
+  return buildStructuredResultEvent({ schema, value });
+}
+
+export { computeSchemaDigest };
+
 /** Validate `value` against the schema subset. Returns error strings ([] = valid). */
 export function validateAgainstSchema(value, schema, path = "$") {
   const errors = [];
@@ -80,6 +100,20 @@ export function validateAgainstSchema(value, schema, path = "$") {
   return errors;
 }
 
+/**
+ * Render the richer validator's coded/pointered error objects as human-readable
+ * `<JSON Pointer>: <message>` strings for the corrective retry prompt and the
+ * final failure report. The empty root pointer is shown as `(root)`.
+ *
+ * @param {Array<{instancePath?:string, message:string}>} errors
+ * @returns {string[]}
+ */
+export function formatSchemaErrors(errors) {
+  return (errors || []).map(
+    (e) => `${e.instancePath || "(root)"}: ${e.message}`,
+  );
+}
+
 /**
  * Return the first *balanced* JSON object/array substring in `text`, honoring
  * string literals so braces inside strings don't throw off the depth count.
@@ -187,19 +221,45 @@ export function loadSchemaFile(fs, schemaFile) {
       "No schema provided: pass --json-schema <file> or a schema object",
     );
   }
+  // Inline JSON support: a value that starts with `{` is treated as a literal
+  // schema object, never a path (a filesystem path can't start with `{`). This
+  // lets `--json-schema '{"type":"object",...}'` work without a temp file.
+  const trimmed = String(schemaFile).trim();
+  const isInline = trimmed.startsWith("{");
   let raw;
-  try {
-    raw = fs.readFileSync(schemaFile, "utf-8");
-  } catch (e) {
-    throw new Error(`Cannot read schema file "${schemaFile}": ${e.message}`);
+  if (isInline) {
+    raw = trimmed;
+  } else {
+    try {
+      raw = fs.readFileSync(schemaFile, "utf-8");
+    } catch (e) {
+      throw new Error(`Cannot read schema file "${schemaFile}": ${e.message}`);
+    }
   }
+  let parsed;
   try {
-    return JSON.parse(raw);
+    parsed = JSON.parse(raw);
   } catch (e) {
     throw new Error(
-      `Invalid JSON in schema file "${schemaFile}": ${e.message}`,
+      isInline
+        ? `Invalid inline JSON schema: ${e.message}`
+        : `Invalid JSON in schema file "${schemaFile}": ${e.message}`,
+    );
+  }
+  // Startup schema meta-validation (P2): reject a malformed schema up front
+  // (bad type value, non-array required, invalid regex, …) instead of silently
+  // mis-validating every reply against a broken contract.
+  const meta = validateSchema(parsed);
+  if (!meta.valid) {
+    const detail = meta.errors
+      .slice(0, 5)
+      .map((e) => `  - ${e.schemaPath || "/"}: ${e.message}`)
+      .join("\n");
+    throw new Error(
+      `Invalid JSON Schema in ${isInline ? "inline schema" : `"${schemaFile}"`}:\n${detail}`,
     );
   }
+  return parsed;
 }
 
 /**
@@ -246,12 +306,15 @@ export async function runJsonSchemaConstrained(cfg = {}) {
     lastRaw = raw;
     const parsed = extractJsonPayload(raw);
     if (parsed.ok) {
-      const errors = validateAgainstSchema(parsed.value, schema);
-      if (errors.length === 0) {
+      // Richer validator: enforces the full supported subset (format assertions,
+      // if/then/else, min/max, pattern, combinators, …) and yields coded/pointered
+      // errors so the retry prompt tells the model exactly which pointer failed.
+      const { valid, errors } = validate(parsed.value, schema);
+      if (valid) {
         writeOut(`${JSON.stringify(parsed.value, null, 2)}\n`);
         return 0;
       }
-      lastErrors = errors;
+      lastErrors = formatSchemaErrors(errors);
     } else {
       lastErrors = [parsed.error];
     }