solrouter 0.4.5 → 0.6.1

package/src/wire.js

@@ -1,6 +1,8 @@
 // wire.js — read and rewrite the two request shapes the proxy accepts:
-// OpenAI /v1/chat/completions and Anthropic /v1/messages. We only touch the
-// text the user wrote; system prompts, roles and every other field pass through.
+// OpenAI /v1/chat/completions and Anthropic /v1/messages. We mask every field
+// that can carry the user's data — message text, tool-call inputs, tool results,
+// and tool-definition descriptions — and pass structural fields (names, ids,
+// types, schema keywords) through untouched so function-calling still resolves.
 //
 // Kept separate from routing so the two API dialects live in one place.
 
@@ -12,7 +14,16 @@ export function dialect(body, path = "") {
   return "openai"; // default; chat/completions is the common case
 }
 
-/** Pull the concatenated user-authored text out of a request body. */
+/** Collect every string leaf in an arbitrary JSON value (for tool payloads). */
+function stringsOf(v, out = []) {
+  if (typeof v === "string") out.push(v);
+  else if (Array.isArray(v)) for (const x of v) stringsOf(x, out);
+  else if (v && typeof v === "object") for (const k of Object.keys(v)) stringsOf(v[k], out);
+  return out;
+}
+
+/** Pull the concatenated user-authored text out of a request body — including tool
+ *  inputs and results, so the private leg's prompt is complete, not just message text. */
 export function extractText(body, kind) {
   const parts = [];
   const pushContent = c => {
@@ -20,28 +31,116 @@ export function extractText(body, kind) {
     else if (Array.isArray(c)) for (const seg of c) {
       if (typeof seg === "string") parts.push(seg);
       else if (seg?.type === "text" && typeof seg.text === "string") parts.push(seg.text);
+      else if (seg?.type === "tool_use" && seg.input) parts.push(...stringsOf(seg.input));
+      else if (seg?.type === "tool_result") parts.push(...stringsOf(seg.content));
+      else if (seg?.type === "document") {
+        if (typeof seg.title === "string") parts.push(seg.title);
+        if (typeof seg.context === "string") parts.push(seg.context);
+        const src = seg.source;
+        if (src?.type === "text" && typeof src.data === "string") parts.push(src.data);
+        else if (src?.type === "content") pushContent(src.content);
+      }
     }
   };
   if (kind === "anthropic") {
     if (typeof body?.system === "string") parts.push(body.system);
     else if (Array.isArray(body?.system)) pushContent(body.system);
   }
-  for (const m of body?.messages || []) pushContent(m?.content);
+  for (const m of body?.messages || []) {
+    pushContent(m?.content);
+    if (Array.isArray(m?.tool_calls)) for (const tc of m.tool_calls)
+      if (tc?.function?.arguments != null) parts.push(...stringsOf(tc.function.arguments));
+    if (m?.function_call?.arguments != null) parts.push(...stringsOf(m.function_call.arguments));
+  }
   return parts.join("\n");
 }
 
+// ── deep helpers for tool-call payloads ──────────────────────────────────────
+// Tool inputs and results carry the user's data as arbitrary JSON, not text
+// segments — the biggest silent leak in real redactors (SPEC §5.1). Mask every
+// string VALUE, keep object keys and non-string leaves, so structure survives.
+function maskValues(v, fn) {
+  if (typeof v === "string") return fn(v);
+  if (Array.isArray(v)) return v.map(x => maskValues(x, fn));
+  if (v && typeof v === "object") {
+    const o = {};
+    for (const k of Object.keys(v)) o[k] = maskValues(v[k], fn);
+    return o;
+  }
+  return v;
+}
+
+// A tool_result's content is a string or an array of blocks (Anthropic).
+function maskToolResult(content, fn) {
+  if (typeof content === "string") return fn(content);
+  if (Array.isArray(content)) return content.map(b =>
+    typeof b === "string" ? fn(b)
+      : b?.type === "text" && typeof b.text === "string" ? { ...b, text: fn(b.text) } : b);
+  return content;
+}
+
+// Mask only free-text `description` fields in a tool definition, at any depth,
+// leaving names, types and enum values intact so the model still calls the tool.
+function maskDescriptions(v, fn) {
+  if (Array.isArray(v)) return v.map(x => maskDescriptions(x, fn));
+  if (v && typeof v === "object") {
+    const o = {};
+    for (const k of Object.keys(v))
+      o[k] = (k === "description" && typeof v[k] === "string") ? fn(v[k]) : maskDescriptions(v[k], fn);
+    return o;
+  }
+  return v;
+}
+
+// OpenAI tool_calls carry arguments as a JSON STRING. Parse, mask values, re-emit;
+// if it isn't valid JSON, mask the raw string so nothing slips through unmasked.
+function maskArgsJson(s, fn) {
+  if (typeof s !== "string") return s;
+  try { return JSON.stringify(maskValues(JSON.parse(s), fn)); }
+  catch { return fn(s); }
+}
+
 /** Apply a (text -> text) transform to every user-authored string in the body. */
 export function rewriteText(body, kind, fn) {
   const out = structuredClone(body);
   const mapContent = c => {
     if (typeof c === "string") return fn(c);
-    if (Array.isArray(c)) return c.map(seg =>
-      seg?.type === "text" && typeof seg.text === "string" ? { ...seg, text: fn(seg.text) }
-        : typeof seg === "string" ? fn(seg) : seg);
+    if (Array.isArray(c)) return c.map(seg => {
+      if (typeof seg === "string") return fn(seg);
+      if (seg?.type === "text" && typeof seg.text === "string") return { ...seg, text: fn(seg.text) };
+      if (seg?.type === "tool_use" && seg.input && typeof seg.input === "object") return { ...seg, input: maskValues(seg.input, fn) };
+      if (seg?.type === "tool_result") return { ...seg, content: maskToolResult(seg.content, fn) };
+      // Anthropic documents carry user prose in title, context, and the source —
+      // either source.data (type:"text") or nested text blocks (type:"content").
+      // base64/url/file sources are binary, left alone.
+      if (seg?.type === "document") {
+        const d = { ...seg };
+        if (typeof seg.title === "string") d.title = fn(seg.title);
+        if (typeof seg.context === "string") d.context = fn(seg.context);
+        const src = seg.source;
+        if (src?.type === "text" && typeof src.data === "string") d.source = { ...src, data: fn(src.data) };
+        else if (src?.type === "content" && Array.isArray(src.content)) d.source = { ...src, content: mapContent(src.content) };
+        return d;
+      }
+      return seg;
+    });
     return c;
   };
   if (kind === "anthropic" && out.system != null) out.system = mapContent(out.system);
-  if (Array.isArray(out.messages)) out.messages = out.messages.map(m => ({ ...m, content: mapContent(m.content) }));
+  if (Array.isArray(out.messages)) out.messages = out.messages.map(m => {
+    const mm = { ...m, content: mapContent(m.content) };
+    // OpenAI: an assistant turn's tool calls carry user data in .function.arguments
+    if (Array.isArray(m.tool_calls)) mm.tool_calls = m.tool_calls.map(tc =>
+      tc?.function?.arguments != null
+        ? { ...tc, function: { ...tc.function, arguments: maskArgsJson(tc.function.arguments, fn) } }
+        : tc);
+    // Legacy OpenAI: the deprecated single function_call is still honored upstream.
+    if (m.function_call?.arguments != null)
+      mm.function_call = { ...m.function_call, arguments: maskArgsJson(m.function_call.arguments, fn) };
+    return mm;
+  });
+  // Tool DEFINITIONS (both dialects) — mask their prose descriptions.
+  if (Array.isArray(out.tools)) out.tools = out.tools.map(t => maskDescriptions(t, fn));
   return out;
 }
 
@@ -53,14 +152,26 @@ export function extractResponseText(body, kind) {
   return (body?.choices || []).map(c => c?.message?.content || "").join("");
 }
 
-/** Rewrite the assistant's text in a (non-streaming) response body. */
+/** Rewrite the assistant's text in a (non-streaming) response body. Restores tool
+ *  outputs too — the model echoes surrogates into tool_use/tool_calls, and the client
+ *  would otherwise EXECUTE the tool on fake values. Symmetric with rewriteText's masking. */
 export function rewriteResponseText(body, kind, fn) {
   const out = structuredClone(body);
   if (kind === "anthropic") {
-    out.content = (out.content || []).map(b => b?.type === "text" ? { ...b, text: fn(b.text) } : b);
+    out.content = (out.content || []).map(b =>
+      b?.type === "text" ? { ...b, text: fn(b.text) }
+        : b?.type === "tool_use" && b.input && typeof b.input === "object" ? { ...b, input: maskValues(b.input, fn) }
+        : b);
   } else {
-    out.choices = (out.choices || []).map(c =>
-      c?.message ? { ...c, message: { ...c.message, content: fn(c.message.content || "") } } : c);
+    out.choices = (out.choices || []).map(c => {
+      if (!c?.message) return c;
+      const message = { ...c.message, content: fn(c.message.content || "") };
+      if (Array.isArray(c.message.tool_calls)) message.tool_calls = c.message.tool_calls.map(tc =>
+        tc?.function?.arguments != null
+          ? { ...tc, function: { ...tc.function, arguments: maskArgsJson(tc.function.arguments, fn) } }
+          : tc);
+      return { ...c, message };
+    });
   }
   return out;
 }