robotrock 1.3.3 → 1.3.4

package/dist/eve/agent/index.d.ts

@@ -7,13 +7,14 @@ import { TaskPriority } from '../../schemas/index.js';
 import { HookDefinition } from 'eve/hooks';
 export { AgentAdminApi, createAgentAdminApi, createBoundAgentAdminClient, requireBoundAgentAdminClient } from '../../agent-admin.js';
 export { ROBOTROCK_PLATFORM_USER_CONTEXT_PUBLIC_KEY_URL } from '@robotrock/core/eve/platform-user-context-public-key';
-export { R as ROBOTROCK_READY_HOOK_SLUG } from '../../index-DePyAbTI.js';
+export { R as ROBOTROCK_READY_HOOK_SLUG } from '../../index-Blq0XoAr.js';
 export { ROBOTROCK_USER_CONTEXT_AUDIENCE, ROBOTROCK_USER_CONTEXT_ISSUER } from '@robotrock/core/eve/user-context-jwt';
 import '@robotrock/core';
 import 'zod';
 import '../../chat-correlation-BsHD-tOQ.js';
 import '@robotrock/core/schemas';
 import '../../tool-reply-guidance-C3qrT1In.js';
+import '../../tool-ui-hint-CMpug5sC.js';
 
 /** Header carrying the dashboard user-context JWT on proxied Eve requests. */
 declare const ROBOTROCK_USER_CONTEXT_HEADER = "x-robotrock-user-token";

package/dist/eve/agent/index.js

@@ -118,6 +118,158 @@ function verifyRobotRockPlatformUserContextJwt(args) {
 // ../core/src/eve/platform-user-context-public-key.ts
 var ROBOTROCK_PLATFORM_USER_CONTEXT_PUBLIC_KEY_URL = "https://app.robotrock.io/.well-known/robotrock-user-context-public-key";
 
+// ../core/src/utils/decode-html-entities.ts
+function decodeHtmlEntities(value) {
+  return value.replace(/&amp;/g, "&").replace(/&lt;/g, "<").replace(/&gt;/g, ">").replace(/&quot;/g, '"').replace(/&#039;/g, "'").replace(/&apos;/g, "'").replace(/&#(\d+);/g, (_, code) => String.fromCharCode(Number(code))).replace(
+    /&#x([0-9a-f]+);/gi,
+    (_, code) => String.fromCharCode(parseInt(code, 16))
+  );
+}
+
+// ../core/src/utils/safe-url.ts
+var BLOCKED_HOSTNAMES = /* @__PURE__ */ new Set([
+  "localhost",
+  "metadata.google.internal",
+  "metadata.goog"
+]);
+function normalizeHostname(hostname) {
+  return hostname.toLowerCase().replace(/^\[|\]$/g, "");
+}
+function isBlockedIpv4(host) {
+  const match = /^(\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})$/.exec(host);
+  if (!match) {
+    return false;
+  }
+  const octets = match.slice(1, 5).map((part) => Number(part));
+  if (octets.some((octet) => Number.isNaN(octet) || octet < 0 || octet > 255)) {
+    return true;
+  }
+  const [a, b, _c, _d] = octets;
+  if (a === void 0 || b === void 0) {
+    return true;
+  }
+  if (a === 127 || a === 0) return true;
+  if (a === 10) return true;
+  if (a === 169 && b === 254) return true;
+  if (a === 192 && b === 168) return true;
+  if (a === 172 && b >= 16 && b <= 31) return true;
+  if (a === 100 && b >= 64 && b <= 127) return true;
+  return false;
+}
+function ipv4FromNumericHost(host) {
+  if (/^\d+$/.test(host)) {
+    const num = Number(host);
+    if (!Number.isFinite(num) || num < 0 || num > 4294967295) {
+      return null;
+    }
+    const a = num >>> 24 & 255;
+    const b = num >>> 16 & 255;
+    const c = num >>> 8 & 255;
+    const d = num & 255;
+    return `${a}.${b}.${c}.${d}`;
+  }
+  const hexMatch = /^0x([0-9a-f]{1,8})$/i.exec(host);
+  if (hexMatch) {
+    const num = Number.parseInt(hexMatch[1], 16);
+    if (!Number.isFinite(num) || num < 0 || num > 4294967295) {
+      return null;
+    }
+    const a = num >>> 24 & 255;
+    const b = num >>> 16 & 255;
+    const c = num >>> 8 & 255;
+    const d = num & 255;
+    return `${a}.${b}.${c}.${d}`;
+  }
+  return null;
+}
+function isBlockedIpv4Mapped(host) {
+  const mappedDotted = /^::ffff:(\d{1,3}(?:\.\d{1,3}){3})$/i.exec(host);
+  if (mappedDotted) {
+    return isBlockedIpv4(mappedDotted[1]);
+  }
+  const mappedHex = /^::ffff:([0-9a-f]{1,4}):([0-9a-f]{1,4})$/i.exec(host);
+  if (mappedHex) {
+    const high = Number.parseInt(mappedHex[1], 16);
+    const low = Number.parseInt(mappedHex[2], 16);
+    if (Number.isFinite(high) && Number.isFinite(low)) {
+      const a = high >> 8 & 255;
+      const b = high & 255;
+      const c = low >> 8 & 255;
+      const d = low & 255;
+      return isBlockedIpv4(`${a}.${b}.${c}.${d}`);
+    }
+  }
+  return false;
+}
+function isBlockedIpv6(host) {
+  if (host === "::1" || host === "0:0:0:0:0:0:0:1") {
+    return true;
+  }
+  if (host.startsWith("fc") || host.startsWith("fd")) {
+    return true;
+  }
+  if (host.startsWith("fe80:")) {
+    return true;
+  }
+  if (isBlockedIpv4Mapped(host)) {
+    return true;
+  }
+  return false;
+}
+function isBlockedHostname(hostname) {
+  const host = normalizeHostname(hostname);
+  if (!host) {
+    return true;
+  }
+  if (BLOCKED_HOSTNAMES.has(host)) {
+    return true;
+  }
+  if (host.endsWith(".localhost") || host.endsWith(".local")) {
+    return true;
+  }
+  const numericIpv4 = ipv4FromNumericHost(host);
+  if (numericIpv4 && isBlockedIpv4(numericIpv4)) {
+    return true;
+  }
+  return isBlockedIpv4(host) || isBlockedIpv6(host);
+}
+function isLoopbackHandlerUrl(urlString) {
+  let url;
+  try {
+    url = new URL(urlString);
+  } catch {
+    return false;
+  }
+  if (url.protocol !== "http:" && url.protocol !== "https:") {
+    return false;
+  }
+  if (url.username || url.password) {
+    return false;
+  }
+  const host = url.hostname.toLowerCase();
+  return host === "localhost" || host === "127.0.0.1" || host === "::1" || host === "[::1]" || host.endsWith(".localhost");
+}
+function isAllowedHandlerUrl(urlString) {
+  return isPublicHttpUrl(urlString) || isLoopbackHandlerUrl(urlString);
+}
+function isPublicHttpUrl(urlString) {
+  let url;
+  try {
+    url = new URL(urlString);
+  } catch {
+    return false;
+  }
+  if (url.protocol !== "http:" && url.protocol !== "https:") {
+    return false;
+  }
+  if (url.username || url.password) {
+    return false;
+  }
+  return !isBlockedHostname(url.hostname);
+}
+var PUBLIC_HTTP_URL_ERROR = "URL must be a public http:// or https:// address";
+var HANDLER_URL_ERROR = "Handler URL must be a public or loopback http:// or https:// address";
+
 // src/eve/input-request.ts
 var EVE_INPUT_SUBMIT_ACTION_ID = "submit";
 var EVE_INPUT_OTHER_CHOICE_ID = "__other__";
@@ -127,6 +279,9 @@ var CONFIRMATION_DEFAULT_OPTIONS = [
   { id: "deny", label: "Deny", style: "danger" }
 ];
 var SELECT_PER_OPTION_THRESHOLD = 6;
+function decodeDisplayText(value) {
+  return decodeHtmlEntities(value);
+}
 function resolveEveInputDisplay(request, toolName) {
   if (request.display) {
     return request.display;
@@ -143,11 +298,12 @@ function confirmationActions(request) {
   const options = request.options && request.options.length > 0 ? request.options : CONFIRMATION_DEFAULT_OPTIONS;
   return options.map((option) => ({
     id: option.id,
-    title: option.label,
-    ...option.description ? { description: option.description } : {}
+    title: decodeDisplayText(option.label),
+    ...option.description ? { description: decodeDisplayText(option.description) } : {}
   }));
 }
 function textSubmitAction(prompt) {
+  const decodedPrompt = decodeDisplayText(prompt);
   return {
     id: EVE_INPUT_SUBMIT_ACTION_ID,
     title: "Submit",
@@ -163,7 +319,7 @@ function textSubmitAction(prompt) {
     },
     ui: {
       answer: {
-        "ui:title": prompt.trim() || "Your answer",
+        "ui:title": decodedPrompt.trim() || "Your answer",
         "ui:widget": "textarea"
       }
     }
@@ -172,15 +328,15 @@ function textSubmitAction(prompt) {
 function selectPerOptionActions(options) {
   return options.map((option) => ({
     id: option.id,
-    title: option.label,
-    ...option.description ? { description: option.description } : {}
+    title: decodeDisplayText(option.label),
+    ...option.description ? { description: decodeDisplayText(option.description) } : {}
   }));
 }
 function selectFormAction(request) {
   const options = request.options ?? [];
   const allowFreeform = request.allowFreeform === true;
   const enumValues = options.map((option) => option.id);
-  const enumNames = options.map((option) => option.label);
+  const enumNames = options.map((option) => decodeDisplayText(option.label));
   if (allowFreeform) {
     enumValues.push(EVE_INPUT_OTHER_CHOICE_ID);
     enumNames.push(EVE_INPUT_OTHER_CHOICE_LABEL);
@@ -303,6 +459,12 @@ function isEveApprovalInputRequest(request) {
   const options = request.options ?? [];
   return options.length === 2 && options[0]?.id === "approve" && options[1]?.id === "deny";
 }
+function buildOptionIdFormData(display, optionId) {
+  if (display === "select" || display === "confirmation") {
+    return { choice: optionId };
+  }
+  return {};
+}
 function eveInputResponseToActionSubmission(request, response, options) {
   const display = resolveEveInputDisplay(request, options?.toolName);
   const actions = eveInputRequestToActions(request, options);
@@ -312,7 +474,7 @@ function eveInputResponseToActionSubmission(request, response, options) {
       return {
         actionId: response.optionId,
         actionTitle: action.title,
-        formData: {}
+        formData: buildOptionIdFormData(display, response.optionId)
       };
     }
     const option = request.options?.find((entry) => entry.id === response.optionId);
@@ -320,13 +482,13 @@ function eveInputResponseToActionSubmission(request, response, options) {
       return {
         actionId: response.optionId,
         actionTitle: option.label,
-        formData: {}
+        formData: buildOptionIdFormData(display, response.optionId)
       };
     }
     return {
       actionId: response.optionId,
       actionTitle: response.optionId,
-      formData: {}
+      formData: buildOptionIdFormData(display, response.optionId)
     };
   }
   const text = response.text?.trim();
@@ -705,150 +867,6 @@ function robotrockEveChannel(options) {
 // src/schemas/index.ts
 import { z as z4 } from "zod";
 
-// ../core/src/utils/safe-url.ts
-var BLOCKED_HOSTNAMES = /* @__PURE__ */ new Set([
-  "localhost",
-  "metadata.google.internal",
-  "metadata.goog"
-]);
-function normalizeHostname(hostname) {
-  return hostname.toLowerCase().replace(/^\[|\]$/g, "");
-}
-function isBlockedIpv4(host) {
-  const match = /^(\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})$/.exec(host);
-  if (!match) {
-    return false;
-  }
-  const octets = match.slice(1, 5).map((part) => Number(part));
-  if (octets.some((octet) => Number.isNaN(octet) || octet < 0 || octet > 255)) {
-    return true;
-  }
-  const [a, b, _c, _d] = octets;
-  if (a === void 0 || b === void 0) {
-    return true;
-  }
-  if (a === 127 || a === 0) return true;
-  if (a === 10) return true;
-  if (a === 169 && b === 254) return true;
-  if (a === 192 && b === 168) return true;
-  if (a === 172 && b >= 16 && b <= 31) return true;
-  if (a === 100 && b >= 64 && b <= 127) return true;
-  return false;
-}
-function ipv4FromNumericHost(host) {
-  if (/^\d+$/.test(host)) {
-    const num = Number(host);
-    if (!Number.isFinite(num) || num < 0 || num > 4294967295) {
-      return null;
-    }
-    const a = num >>> 24 & 255;
-    const b = num >>> 16 & 255;
-    const c = num >>> 8 & 255;
-    const d = num & 255;
-    return `${a}.${b}.${c}.${d}`;
-  }
-  const hexMatch = /^0x([0-9a-f]{1,8})$/i.exec(host);
-  if (hexMatch) {
-    const num = Number.parseInt(hexMatch[1], 16);
-    if (!Number.isFinite(num) || num < 0 || num > 4294967295) {
-      return null;
-    }
-    const a = num >>> 24 & 255;
-    const b = num >>> 16 & 255;
-    const c = num >>> 8 & 255;
-    const d = num & 255;
-    return `${a}.${b}.${c}.${d}`;
-  }
-  return null;
-}
-function isBlockedIpv4Mapped(host) {
-  const mappedDotted = /^::ffff:(\d{1,3}(?:\.\d{1,3}){3})$/i.exec(host);
-  if (mappedDotted) {
-    return isBlockedIpv4(mappedDotted[1]);
-  }
-  const mappedHex = /^::ffff:([0-9a-f]{1,4}):([0-9a-f]{1,4})$/i.exec(host);
-  if (mappedHex) {
-    const high = Number.parseInt(mappedHex[1], 16);
-    const low = Number.parseInt(mappedHex[2], 16);
-    if (Number.isFinite(high) && Number.isFinite(low)) {
-      const a = high >> 8 & 255;
-      const b = high & 255;
-      const c = low >> 8 & 255;
-      const d = low & 255;
-      return isBlockedIpv4(`${a}.${b}.${c}.${d}`);
-    }
-  }
-  return false;
-}
-function isBlockedIpv6(host) {
-  if (host === "::1" || host === "0:0:0:0:0:0:0:1") {
-    return true;
-  }
-  if (host.startsWith("fc") || host.startsWith("fd")) {
-    return true;
-  }
-  if (host.startsWith("fe80:")) {
-    return true;
-  }
-  if (isBlockedIpv4Mapped(host)) {
-    return true;
-  }
-  return false;
-}
-function isBlockedHostname(hostname) {
-  const host = normalizeHostname(hostname);
-  if (!host) {
-    return true;
-  }
-  if (BLOCKED_HOSTNAMES.has(host)) {
-    return true;
-  }
-  if (host.endsWith(".localhost") || host.endsWith(".local")) {
-    return true;
-  }
-  const numericIpv4 = ipv4FromNumericHost(host);
-  if (numericIpv4 && isBlockedIpv4(numericIpv4)) {
-    return true;
-  }
-  return isBlockedIpv4(host) || isBlockedIpv6(host);
-}
-function isLoopbackHandlerUrl(urlString) {
-  let url;
-  try {
-    url = new URL(urlString);
-  } catch {
-    return false;
-  }
-  if (url.protocol !== "http:" && url.protocol !== "https:") {
-    return false;
-  }
-  if (url.username || url.password) {
-    return false;
-  }
-  const host = url.hostname.toLowerCase();
-  return host === "localhost" || host === "127.0.0.1" || host === "::1" || host === "[::1]" || host.endsWith(".localhost");
-}
-function isAllowedHandlerUrl(urlString) {
-  return isPublicHttpUrl(urlString) || isLoopbackHandlerUrl(urlString);
-}
-function isPublicHttpUrl(urlString) {
-  let url;
-  try {
-    url = new URL(urlString);
-  } catch {
-    return false;
-  }
-  if (url.protocol !== "http:" && url.protocol !== "https:") {
-    return false;
-  }
-  if (url.username || url.password) {
-    return false;
-  }
-  return !isBlockedHostname(url.hostname);
-}
-var PUBLIC_HTTP_URL_ERROR = "URL must be a public http:// or https:// address";
-var HANDLER_URL_ERROR = "Handler URL must be a public or loopback http:// or https:// address";
-
 // ../core/src/schemas/task.ts
 import { z } from "zod";