6793. 6793///
6794. 6794/// Prose CODE EXAMPLES are deliberately not recognised here any more -- a
6795. 6795/// ```` ```bash ```` fence, `bash -c "..."`, `bash(command=...)` and
6796. 6796/// `write(path=..., content=...)` used to be executed as if the model had
6797. 6797/// asked for them, even when written only to ILLUSTRATE a command rather
6798. 6798/// than invoke it (live: a prose answer's ```bash example ran and created
6799. 6799/// a file the model never asked to create). The envelope path is the one
6800. 6800/// fallback that remains, because unlike a shell fence it is unambiguous:
6801. 6801/// nothing else in ordinary prose looks like `<tool_call>{"name":
6802. 6802/// ...}</tool_call>`, and it is gated further by naming a tool actually
6803. 6803/// loaded this turn.
6804. 6804fn extract_tool_calls(
6805. 6805 response: &mut AssistantMessage,
6806. 6806 loaded: &[Arc<dyn Tool>],
6807. 6807) -> Vec<PendingToolCall> {
6808. 6808 let structured: Vec<PendingToolCall> = response
6809. 6809 .content
6810. 6810 .iter()
6811. 6811 .filter_map(|b| match b {
6812. 6812 ContentBlock::ToolUse { id, name, input } => Some(PendingToolCall {
6813. 6813 id: id.clone(),
6814. 6814 name: name.clone(),
6815. 6815 input: input.clone(),
6816. 6816 }),
6817. 6817 _ => None,
6818. 6818 })
6819. 6819 .collect();
6820. 6820 if !structured.is_empty() {
6821. 6821 return structured;
6822. 6822 }
6823. 6823 let text = response.text_content();
6824. 6824 if text.trim().is_empty() {
6825. 6825 return Vec::new();
6826. 6826 }
6827. 6827 let envelopes = parse_tool_call_envelopes(&text, loaded);
6828. 6828 if envelopes.is_empty() {
6829. 6829 return Vec::new();
6830. 6830 }
6831. 6831 let mut remaining = text;
6832. 6832 for (_, span) in envelopes.iter().rev() {
6833. 6833 remaining.replace_range(span.clone(), "");
6834. 6834 }
6835. 6835 let remaining = remaining.trim().to_string();
6836. 6836 response
6837. 6837 .content
6838. 6838 .retain(|block| !matches!(block, ContentBlock::Text { .. }));
6839. 6839 if !remaining.is_empty() {
6840. 6840 response.content.insert(0, ContentBlock::text(remaining));
6841. 6841 }
6842. 6842 let calls: Vec<PendingToolCall> = envelopes.into_iter().map(|(call, _)| call).collect();
6843. 6843 for call in &calls {
6844. 6844 response.content.push(ContentBlock::ToolUse {
6845. 6845 id: call.id.clone(),
6846. 6846 name: call.name.clone(),
6847. 6847 input: call.input.clone(),
6848. 6848 });
6849. 6849 }
6850. 6850 response.stop_reason = StopReason::ToolUse;
6851. 6851 calls
6852. 6852}
6853. 6853
6854. 6854/// Every recognised envelope in `text` that names a tool loaded this turn,
6855. 6855/// paired with the exact byte span (open tag through close tag) it
6856. 6856/// occupies so the caller can excise just the envelope and keep any
6857. 6857/// surrounding prose.
6858. 6858fn parse_tool_call_envelopes(
6859. 6859 text: &str,
6860. 6860 loaded: &[Arc<dyn Tool>],
6861. 6861) -> Vec<(PendingToolCall, std::ops::Range<usize>)> {
6862. 6862 extract_tool_call_blocks(text)
6863. 6863 .into_iter()
6864. 6864 .filter_map(|(body, span)| {
6865. 6865 let val = serde_json::from_str::<serde_json::Value>(&body).ok()?;
6866. 6866 json_to_tool_call(&val, loaded).map(|call| (call, span))
6867. 6867 })
6868. 6868 .collect()
6869. 6869}
6870. 6870
6871. 6871/// Scans `text` for `<tool_call>...</tool_call>` and fenced blocks tagged
6872. 6872/// exactly `tool_call` or `tool_use`, returning each one's trimmed JSON
6873. 6873/// body alongside the full span it occupies, in the order they appear. A
6874. 6874/// block whose body has neither `"name"` nor `"tool"` is skipped before it
6875. 6875/// ever reaches JSON parsing -- not every fenced block a model writes is a
6876. 6876/// call.
6877. 6877fn extract_tool_call_blocks(text: &str) -> Vec<(String, std::ops::Range<usize>)> {
6878. 6878 let mut blocks = Vec::new();
6879. 6879 for tag in ["<tool_call>", "```tool_call", "```tool_use"] {
6880. 6880 let mut cursor = 0;
6881. 6881 while let Some(start_idx) = text[cursor..].find(tag) {
6882. 6882 let open_start = cursor + start_idx;
6883. 6883 let body_start = open_start + tag.len();
6884. 6884 let close_tag = if tag.starts_with('<') {
6885. 6885 "</tool_call>"
6886. 6886 } else {
6887. 6887 "```"
6888. 6888 };
6889. 6889 let Some(end_idx) = text[body_start..].find(close_tag) else {
6890. 6890 break;
6891. 6891 };
6892. 6892 let body_end = body_start + end_idx;
6893. 6893 let close_end = body_end + close_tag.len();
6894. 6894 let body = text[body_start..body_end].trim().to_string();
6895. 6895 if body.contains("\"name\"") || body.contains("\"tool\"") {
6896. 6896 blocks.push((body, open_start..close_end));
6897. 6897 }
6898. 6898 cursor = close_end;
6899. 6899 }
6900. 6900 }
6901. 6901 blocks.sort_by_key(|(_, span)| span.start);
6902. 6902 blocks
6903. 6903}
6904. 6904
6905. 6905/// Builds a call from an envelope's parsed JSON body: `name` (or `tool`)
6906. 6906/// must name a tool loaded this turn, or the envelope is ignored --
6907. 6907/// otherwise this fallback could invoke anything a model happened to spell
6908. 6908/// out. `arguments`/`input`/`parameters`, when present, must be a JSON
6909. 6909/// object; absent defaults to `{}`, still a valid, argument-less call.
6910. 6910fn json_to_tool_call(val: &serde_json::Value, loaded: &[Arc<dyn Tool>]) -> Option<PendingToolCall> {
6911. 6911 let name = val
6912. 6912 .get("name")
6913. 6913 .or_else(|| val.get("tool"))
6914. 6914 .and_then(|v| v.as_str())?;
6915. 6915 if !loaded.iter().any(|tool| tool.name() == name) {
6916. 6916 return None;
6917. 6917 }
6918. 6918 let input = match val
6919. 6919 .get("arguments")
6920. 6920 .or_else(|| val.get("input"))
6921. 6921 .or_else(|| val.get("parameters"))
6922. 6922 {
6923. 6923 Some(value) if value.is_object() => value.clone(),
6924. 6924 Some(_) => return None,
6925. 6925 None => serde_json::json!({}),
6926. 6926 };
6927. 6927 Some(PendingToolCall {
6928. 6928 id: format!("call_txt_{:08x}", rand_jitter(u64::MAX)),
6929. 6929 name: name.to_string(),
6930. 6930 input,
6931. 6931 })
6932. 6932}
6933. 6933
6934. 6934fn backoff_delay(attempt: u32, retry_after_secs: Option<u64>, base_ms: u64) -> std::time::Duration {
6935. 6935 if let Some(secs) = retry_after_secs {
6936. 6936 return std::time::Duration::from_secs(secs.max(1));
6937. 6937 }
6938. 6938 let exp = base_ms.saturating_mul(1u64 << (attempt - 1).min(6));
6939. 6939 let jitter = rand_jitter(exp);
6940. 6940 std::time::Duration::from_millis((exp / 2).max(1).saturating_add(jitter).min(30_000))
6941. 6941}
6942. 6942
6943. 6943fn rand_jitter(ms: u64) -> u64 {
6944. 6944 use std::sync::atomic::{AtomicU64, Ordering};
6945. 6945 static STATE: AtomicU64 = AtomicU64::new(0);
6946. 6946 let x = STATE
6947. 6947 .fetch_add(0x9E3779B97F4A7C15, Ordering::Relaxed)
6948. 6948 .wrapping_add(0x9E3779B97F4A7C15);
6949. 6949 (x >> 33) % ms.max(2)
6950. 6950}
6951. 6951
6952. 6952/// Extracts the `StreamEvent` back out of a failed `try_send`'s returned
6953. 6953/// `AgentEvent` -- every event the stream-forwarding loop sends is
6954. 6954/// `AgentEvent::Stream`, but `TrySendError`'s payload is generic over the
6955. 6955/// channel's whole message type. `None` is unreachable in practice (this is
6956. 6956/// only ever called on a value this module itself just wrapped) but is
6957. 6957/// handled as a silent no-op rather than assumed, since asserting it would
6958. 6958/// mean panicking on a channel error.
6959. 6959fn into_stream_event(event: AgentEvent) -> Option<StreamEvent> {
6960. 6960 match event {
6961. 6961 AgentEvent::Stream(ev) => Some(ev),
6962. 6962 _ => None,
6963. 6963 }
6964. 6964}
6965. 6965
6966. 6966/// Drains `pending` into `events` oldest-first without blocking (§6 below).
6967. 6967/// Returns `true` once the listener is confirmed gone (`Closed`); a
6968. 6968/// still-full channel (`Full`) just leaves the rest queued for the next
6969. 6969/// call -- backpressure is not the same as nobody listening.
6970. 6970fn drain_pending_stream_events(
6971. 6971 pending: &mut VecDeque<StreamEvent>,
6972. 6972 events: &mpsc::Sender<AgentEvent>,
6973. 6973) -> bool {
6974. 6974 while let Some(event) = pending.pop_front() {
6975. 6975 match events.try_send(AgentEvent::Stream(event)) {
6976. 6976 Ok(()) => {}
6977. 6977 Err(mpsc::error::TrySendError::Full(sent)) => {
6978. 6978 if let Some(event) = into_stream_event(sent) {
6979. 6979 pending.push_front(event);
6980. 6980 }
6981. 6981 return false;
6982. 6982 }
6983. 6983 Err(mpsc::error::TrySendError::Closed(_)) => return true,
6984. 6984 }
6985. 6985 }
6986. 6986 false
6987. 6987}
6988. 6988
6989. 6989/// Queues one stream event for forwarding, merging it into the last still-
6990. 6990/// pending event when `StreamEvent::try_merge` allows it, so a slow
6991. 6991/// listener's backlog stays one entry per in-progress block instead of
6992. 6992/// growing one entry per delta (docs/design/68-context-engine.md §6:
6993. 6993/// lossless streaming -- coalesce under backpressure, never drop).
6994. 6994fn queue_stream_event(pending: &mut VecDeque<StreamEvent>, event: StreamEvent) {
6995. 6995 match pending.back_mut() {
6996. 6996 Some(last) => {
6997. 6997 if let Some(event) = last.try_merge(event) {
6998. 6998 pending.push_back(event);
6999. 6999 }
7000. 7000 }
7001. 7001 None => pending.push_back(event),
7002. 7002 }
7003. 7003}
7004. 7004
7005. 7005#[cfg(test)]
7006. 7006mod tool_recovery_tests {
7007. 7007 use super::{freshness_retrieval_hint, tool_recovery_hint};
7008. 7008
7009. 7009 #[test]
7010. 7010 fn freshness_repair_names_only_admitted_generic_retrieval_routes() {
7011. 7011 let offered = vec![
7012. 7012 vak_llm::ToolDefinition::new("mcp", "broker", serde_json::json!({})),
7013. 7013 vak_llm::ToolDefinition::new("browse", "browse", serde_json::json!({})),
7014. 7014 vak_llm::ToolDefinition::new("emit_metric_card", "card", serde_json::json!({})),
7015. 7015 ];
7016. 7016 let hint = freshness_retrieval_hint(&offered);
7017. 7017 assert!(
7018. 7018 hint.contains("mcp (list a configured server's tools"),
7019. 7019 "{hint}"
7020. 7020 );
7021. 7021 assert!(hint.contains("browse"), "{hint}");
7022. 7022 assert!(!hint.contains("webfetch"), "{hint}");
7023. 7023 assert!(!hint.contains("emit_metric_card"), "{hint}");
7024. 7024 }
7025. 7025
7026. 7026 #[test]
7027. 7027 fn current_fact_search_page_fetch_is_identified_by_url_shape() {
7028. 7028 use super::is_search_results_fetch;
7029. 7029 assert!(is_search_results_fetch(&serde_json::json!({
7030. 7030 "url": "https://www.google.com/search?q=weather+in+Mumbai"
7031. 7031 })));
7032. 7032 assert!(is_search_results_fetch(&serde_json::json!({
7033. 7033 "url": "https://example.org/site/search?query=weather"
7034. 7034 })));
7035. 7035 assert!(!is_search_results_fetch(&serde_json::json!({
7036. 7036 "url": "https://weather.example.org/mumbai"
7037. 7037 })));
7038. 7038 assert!(!is_search_results_fetch(&serde_json::json!({
7039. 7039 "url": "https://example.org/search?category=weather"
7040. 7040 })));
7041. 7041 }
7042. 7042
7043. 7043 #[test]
7044. 7044 fn repairable_failures_get_a_model_recovery_contract() {
7045. 7045 assert!(
7046. 7046 tool_recovery_hint(r#"{"type":"unknown_capability","name":"tavily_search"}"#).is_some()
7047. 7047 );
7048. 7048 assert!(tool_recovery_hint("mcp protocol error: invalid arguments").is_some());
7049. 7049 }
7050. 7050
7051. 7051 #[test]
7052. 7052 fn authorization_and_user_control_failures_never_get_retry_advice() {
7053. 7053 assert!(tool_recovery_hint("capability denied by channel policy").is_none());
7054. 7054 assert!(tool_recovery_hint("cancelled").is_none());
7055. 7055 assert!(tool_recovery_hint("429 rate limit").is_none());
7056. 7056 }
7057. 7057
7058. 7058 #[test]
7059. 7059 fn test_normalize_tool_call_aliases() {
7060. 7060 use super::{PendingToolCall, normalize_tool_call};
7061. 7061
7062. 7062 // Read file alias normalization
7063. 7063 let read_call = PendingToolCall {
7064. 7064 id: "call_3".into(),
7065. 7065 name: "read_file".into(),
7066. 7066 input: serde_json::json!({
7067. 7067 "file_path": "src/main.rs"
7068. 7068 }),
7069. 7069 };
7070. 7070 let normalized_read = normalize_tool_call(read_call);
7071. 7071 assert_eq!(normalized_read.name, "read");
7072. 7072 assert_eq!(
7073. 7073 normalized_read.input.get("path").and_then(|v| v.as_str()),
7074. 7074 Some("src/main.rs")
7075. 7075 );
7076. 7076 }
7077. 7077
7078. 7078 #[test]
7079. 7079 fn mcp_missing_action_is_recovered_from_shape() {
7080. 7080 use super::{PendingToolCall, normalize_mcp_call};
7081. 7081 let index = std::collections::HashMap::<String, String>::new();
7082. 7082 let call = normalize_mcp_call(
7083. 7083 PendingToolCall {
7084. 7084 id: "1".into(),
7085. 7085 name: "mcp".into(),
7086. 7086 input: serde_json::json!({"server":"weather","tool":"forecast"}),
7087. 7087 },
7088. 7088 &index,
7089. 7089 );
7090. 7090 assert_eq!(
7091. 7091 call.input.get("action").and_then(|v| v.as_str()),
7092. 7092 Some("call")
7093. 7093 );
7094. 7094 let list = normalize_mcp_call(
7095. 7095 PendingToolCall {
7096. 7096 id: "2".into(),
7097. 7097 name: "mcp".into(),
7098. 7098 input: serde_json::json!({}),
7099. 7099 },
7100. 7100 &index,
7101. 7101 );
7102. 7102 assert_eq!(
7103. 7103 list.input.get("action").and_then(|v| v.as_str()),
7104. 7104 Some("list")
7105. 7105 );
7106. 7106 let repair = normalize_mcp_call(
7107. 7107 PendingToolCall {
7108. 7108 id: "3".into(),
7109. 7109 name: "mcp".into(),
7110. 7110 input: serde_json::json!({"action":"call","tool":"forecast"}),
7111. 7111 },
7112. 7112 &index,
7113. 7113 );
7114. 7114 assert_eq!(
7115. 7115 repair.input.get("action").and_then(|v| v.as_str()),
7116. 7116 Some("list")
7117. 7117 );
7118. 7118 }
7119. 7119
7120. 7120 #[test]
7121. 7121 fn one_redundant_provider_wrapper_is_removed_only_when_inner_schema_is_valid() {
7122. 7122 use super::unwrapped_schema_input;
7123. 7123 let schema = serde_json::json!({
7124. 7124 "type": "object",
7125. 7125 "properties": {
7126. 7126 "semantic_type": {"type": "string", "enum": ["weather"]},
7127. 7127 "payload": {"type": "object"}
7128. 7128 },
7129. 7129 "required": ["semantic_type", "payload"],
7130. 7130 "additionalProperties": false
7131. 7131 });
7132. 7132 let canonical = serde_json::json!({
7133. 7133 "semantic_type": "weather",
7134. 7134 "payload": {"temperature": "28.5°C"}
7135. 7135 });
7136. 7136 assert_eq!(
7137. 7137 unwrapped_schema_input(
7138. 7138 &schema,
7139. 7139 &serde_json::json!({"metric_card": canonical.clone()})
7140. 7140 ),
7141. 7141 Some(canonical.clone())
7142. 7142 );
7143. 7143 assert_eq!(unwrapped_schema_input(&schema, &canonical), None);
7144. 7144 assert_eq!(
7145. 7145 unwrapped_schema_input(
7146. 7146 &schema,
7147. 7147 &serde_json::json!({"metric_card": {"payload": {}}})
7148. 7148 ),
7149. 7149 None
7150. 7150 );
7151. 7151 assert_eq!(
7152. 7152 unwrapped_schema_input(
7153. 7153 &schema,
7154. 7154 &serde_json::json!({"metric_card": canonical, "extra": true})
7155. 7155 ),
7156. 7156 None
7157. 7157 );
7158. 7158 }
7159. 7159}
7160. 7160
7161. 7161#[cfg(test)]
7162. 7162mod auto_approve_tests {
7163. 7163 #![allow(clippy::unwrap_used, clippy::expect_used, clippy::panic)]
7164. 7164 use super::auto_approve;
7165. 7165 use super::{ApprovalMode, Mode};
7166. 7166 use vak_permission::AskSource;
7167. 7167
7168. 7168 fn ws() -> tempfile::TempDir {
7169. 7169 tempfile::tempdir().unwrap()
7170. 7170 }
7171. 7171
7172. 7172 #[test]
7173. 7173 fn rule_and_circuit_breaker_sources_never_auto_approve() {
7174. 7174 let cwd = ws();
7175. 7175 for source in [AskSource::Rule, AskSource::CircuitBreaker] {
7176. 7176 assert!(
7177. 7177 !auto_approve(
7178. 7178 ApprovalMode::AutoApprove,
7179. 7179 source,
7180. 7180 "bash",
7181. 7181 &serde_json::json!({"command": "ls"}),
7182. 7182 Mode::WorkspaceWrite,
7183. 7183 true,
7184. 7184 cwd.path(),
7185. 7185 ),
7186. 7186 "AutoApprove must not override {source:?}"
7187. 7187 );
7188. 7188 }
7189. 7189 }
7190. 7190
7191. 7191 #[test]
7192. 7192 fn auto_approve_mode_accepts_everything_safe_and_unsafe() {
7193. 7193 let cwd = ws();
7194. 7194 let json = serde_json::json!({"command": "rm -rf /"});
7195. 7195 assert!(auto_approve(
7196. 7196 ApprovalMode::AutoApprove,
7197. 7197 AskSource::ModeDefault,
7198. 7198 "bash",
7199. 7199 &json,
7200. 7200 Mode::WorkspaceWrite,
7201. 7201 true,
7202. 7202 cwd.path(),
7203. 7203 ));
7204. 7204 }
7205. 7205
7206. 7206 #[test]
7207. 7207 fn approve_safe_auto_approves_sandboxed_bash() {
7208. 7208 // The security contract: bash in a restricted mode with a sandbox
7209. 7209 // is "safe" because the sandbox confines it — so ApproveSafe trusts it.
7210. 7210 let cwd = ws();
7211. 7211 assert!(
7212. 7212 auto_approve(
7213. 7213 ApprovalMode::ApproveSafe,
7214. 7214 AskSource::ModeDefault,
7215. 7215 "bash",
7216. 7216 &serde_json::json!({"command": "cargo test"}),
7217. 7217 Mode::WorkspaceWrite,
7218. 7218 true,
7219. 7219 cwd.path(),
7220. 7220 ),
7221. 7221 "sandboxed bash in WorkspaceWrite should be auto-approved under ApproveSafe"
7222. 7222 );
7223. 7223 assert!(
7224. 7224 auto_approve(
7225. 7225 ApprovalMode::ApproveSafe,
7226. 7226 AskSource::ModeDefault,
7227. 7227 "bash",
7228. 7228 &serde_json::json!({"command": "cargo test"}),
7229. 7229 Mode::ReadOnly,
7230. 7230 true,
7231. 7231 cwd.path(),
7232. 7232 ),
7233. 7233 "sandboxed bash in ReadOnly should be auto-approved under ApproveSafe"
7234. 7234 );
7235. 7235 }
7236. 7236
7237. 7237 #[test]
7238. 7238 fn approve_safe_does_not_auto_approve_unsandboxed_bash() {
7239. 7239 // No sandbox => FullAccess-equivalent reach => never auto-approved.
7240. 7240 // This is the guardrail that stops ApproveSafe from silently
7241. 7241 // granting host-shell access.
7242. 7242 let cwd = ws();
7243. 7243 assert!(
7244. 7244 !auto_approve(
7245. 7245 ApprovalMode::ApproveSafe,
7246. 7246 AskSource::ModeDefault,
7247. 7247 "bash",
7248. 7248 &serde_json::json!({"command": "rm -rf /"}),
7249. 7249 Mode::WorkspaceWrite,
7250. 7250 false,
7251. 7251 cwd.path(),
7252. 7252 ),
7253. 7253 "un-sandboxed bash must not be auto-approved"
7254. 7254 );
7255. 7255 assert!(
7256. 7256 !auto_approve(
7257. 7257 ApprovalMode::ApproveSafe,
7258. 7258 AskSource::ModeDefault,
7259. 7259 "bash",
7260. 7260 &serde_json::json!({"command": "ls"}),
7261. 7261 Mode::FullAccess,
7262. 7262 true,
7263. 7263 cwd.path(),
7264. 7264 ),
7265. 7265 "bash under FullAccess must not be auto-approved even with a sandbox"
7266. 7266 );
7267. 7267 }
7268. 7268
7269. 7269 #[test]
7270. 7270 fn approve_safe_auto_approves_read_tools() {
7271. 7271 let cwd = ws();
7272. 7272 for tool in ["read", "glob", "grep", "ls", "search"] {
7273. 7273 assert!(
7274. 7274 auto_approve(
7275. 7275 ApprovalMode::ApproveSafe,
7276. 7276 AskSource::ModeDefault,
7277. 7277 tool,
7278. 7278 &serde_json::json!({}),
7279. 7279 Mode::WorkspaceWrite,
7280. 7280 false,
7281. 7281 cwd.path(),
7282. 7282 ),
7283. 7283 "{tool} should be auto-approved under ApproveSafe"
7284. 7284 );
7285. 7285 }
7286. 7286 }
7287. 7287
7288. 7288 #[test]
7289. 7289 fn approve_safe_approves_workspace_write_only_when_in_workspace() {
7290. 7290 let cwd = ws();
7291. 7291 // Use a relative path so the workspace-rooting check resolves
7292. 7292 // against cwd without symlink-interpolation ambiguity on macOS
7293. 7293 // (/var → /private/var).
7294. 7294 assert!(
7295. 7295 auto_approve(
7296. 7296 ApprovalMode::ApproveSafe,
7297. 7297 AskSource::ModeDefault,
7298. 7298 "write",
7299. 7299 &serde_json::json!({"path": "notes.txt", "content": "x"}),
7300. 7300 Mode::WorkspaceWrite,
7301. 7301 false,
7302. 7302 cwd.path(),
7303. 7303 ),
7304. 7304 "writing inside the workspace should be auto-approved"
7305. 7305 );
7306. 7306 let outside = std::env::temp_dir().join("vak-outside.txt");
7307. 7307 assert!(
7308. 7308 !auto_approve(
7309. 7309 ApprovalMode::ApproveSafe,
7310. 7310 AskSource::ModeDefault,
7311. 7311 "write",
7312. 7312 &serde_json::json!({"path": outside.to_string_lossy(), "content": "x"}),
7313. 7313 Mode::WorkspaceWrite,
7314. 7314 false,
7315. 7315 cwd.path(),
7316. 7316 ),
7317. 7317 "writing outside the workspace must not be auto-approved"
7318. 7318 );
7319. 7319 }
7320. 7320
7321. 7321 #[test]
7322. 7322 fn approve_safe_denies_non_mode_default_sources() {
7323. 7323 let cwd = ws();
7324. 7324 // Scope source is auto-approved for workspace-scoped writes.
7325. 7325 assert!(auto_approve(
7326. 7326 ApprovalMode::ApproveSafe,
7327. 7327 AskSource::Scope,
7328. 7328 "write",
7329. 7329 &serde_json::json!({"path": "ok.txt", "content": "x"}),
7330. 7330 Mode::WorkspaceWrite,
7331. 7331 false,
7332. 7332 cwd.path(),
7333. 7333 ));
7334. 7334 }
7335. 7335
7336. 7336 #[test]
7337. 7337 fn ask_mode_never_auto_approves_anything() {
7338. 7338 let cwd = ws();
7339. 7339 assert!(!auto_approve(
7340. 7340 ApprovalMode::Ask,
7341. 7341 AskSource::ModeDefault,
7342. 7342 "read",
7343. 7343 &serde_json::json!({}),
7344. 7344 Mode::WorkspaceWrite,
7345. 7345 true,
7346. 7346 cwd.path(),
7347. 7347 ));
7348. 7348 }
7349. 7349
7350. 7350 #[test]
7351. 7351 fn bash_without_command_arg_still_approved_when_sandboxed() {
7352. 7352 // auto_approve for bash keys only on (sandboxed && not FullAccess),
7353. 7353 // not on the presence of a command arg — the command arg is
7354. 7354 // validated separately by authorize(). This documents that boundary.
7355. 7355 let cwd = ws();
7356. 7356 assert!(
7357. 7357 !auto_approve(
7358. 7358 ApprovalMode::ApproveSafe,
7359. 7359 AskSource::ModeDefault,
7360. 7360 "bash",
7361. 7361 &serde_json::json!({}),
7362. 7362 Mode::WorkspaceWrite,
7363. 7363 false,
7364. 7364 cwd.path(),
7365. 7365 ),
7366. 7366 "un-sandboxed bash without command arg must not be auto-approved"
7367. 7367 );
7368. 7368 assert!(
7369. 7369 auto_approve(
7370. 7370 ApprovalMode::ApproveSafe,
7371. 7371 AskSource::ModeDefault,
7372. 7372 "bash",
7373. 7373 &serde_json::json!({}),
7374. 7374 Mode::WorkspaceWrite,
7375. 7375 true,
7376. 7376 cwd.path(),
7377. 7377 ),
7378. 7378 "sandboxed bash is auto-approved by the sand-boxing contract"
7379. 7379 );
7380. 7380 }
7381. 7381}
7382. 7382
7383. 7383#[cfg(test)]
7384. 7384#[allow(clippy::unwrap_used, clippy::expect_used, clippy::panic)]
7385. 7385mod tool_call_envelope_tests {
7386. 7386 use super::{ContentBlock, PendingToolCall, extract_tool_calls};
7387. 7387 use vak_llm::types::{AssistantMessage, StopReason, Usage};
7388. 7388 use vak_tools::{Tool, ToolContext, ToolOutput};
7389. 7389
7390. 7390 struct FakeTool(&'static str);
7391. 7391
7392. 7392 #[async_trait::async_trait]
7393. 7393 impl Tool for FakeTool {
7394. 7394 fn name(&self) -> &str {
7395. 7395 self.0
7396. 7396 }
7397. 7397 fn description(&self) -> &str {
7398. 7398 "fake"
7399. 7399 }
7400. 7400 fn schema(&self) -> serde_json::Value {
7401. 7401 serde_json::json!({"type": "object"})
7402. 7402 }
7403. 7403 async fn execute(&self, _args: &serde_json::Value, _ctx: &ToolContext) -> ToolOutput {
7404. 7404 ToolOutput::ok(String::new())
7405. 7405 }
7406. 7406 }
7407. 7407
7408. 7408 fn loaded() -> Vec<std::sync::Arc<dyn Tool>> {
7409. 7409 vec![
7410. 7410 std::sync::Arc::new(FakeTool("write")),
7411. 7411 std::sync::Arc::new(FakeTool("bash")),
7412. 7412 ]
7413. 7413 }
7414. 7414
7415. 7415 fn text_response(text: &str) -> AssistantMessage {
7416. 7416 AssistantMessage {
7417. 7417 content: vec![ContentBlock::text(text.to_string())],
7418. 7418 stop_reason: StopReason::EndTurn,
7419. 7419 usage: Usage::default(),
7420. 7420 model: "test-model".into(),
7421. 7421 response_id: None,
7422. 7422 }
7423. 7423 }
7424. 7424
7425. 7425 fn assert_no_calls_and_unchanged(text: &str) {
7426. 7426 let mut response = text_response(text);
7427. 7427 let original = response.clone();
7428. 7428 let calls = extract_tool_calls(&mut response, &loaded());
7429. 7429 assert!(calls.is_empty(), "{text:?} must produce no calls");
7430. 7430 assert_eq!(
7431. 7431 response, original,
7432. 7432 "a response with no recognised envelope must be left untouched"
7433. 7433 );
7434. 7434 }
7435. 7435
7436. 7436 /// A fenced shell example is prose, not an instruction: illustrating a
7437. 7437 /// command must never execute it (live: a ```bash example ran and
7438. 7438 /// created a file the model never asked to create).
7439. 7439 #[test]
7440. 7440 fn prose_with_a_bash_fence_produces_no_calls() {
7441. 7441 assert_no_calls_and_unchanged(
7442. 7442 "Here is an example:\n```bash\necho FENCE-EXECUTED > marker.txt\n```\n",
7443. 7443 );
7444. 7444 }
7445. 7445
7446. 7446 /// The ```json fence path is removed entirely: a model narrating JSON
7447. 7447 /// that happens to include a "name" field must not be interpreted as a
7448. 7448 /// tool call.
7449. 7449 #[test]
7450. 7450 fn json_fence_with_a_name_field_produces_no_calls() {
7451. 7451 assert_no_calls_and_unchanged(
7452. 7452 "For reference, the shape is:\n```json\n{\"name\": \"write\", \"arguments\": {\"path\": \"a\", \"content\": \"b\"}}\n```\n",
7453. 7453 );
7454. 7454 }
7455. 7455
7456. 7456 #[test]
7457. 7457 fn bash_dash_c_in_prose_produces_no_calls() {
7458. 7458 assert_no_calls_and_unchanged(r#"You could run bash -c "echo hi" locally."#);
7459. 7459 }
7460. 7460
7461. 7461 #[test]
7462. 7462 fn functional_write_call_in_prose_produces_no_calls() {
7463. 7463 assert_no_calls_and_unchanged(
7464. 7464 r#"The call looks like write(path="a.txt", content="hello")."#,
7465. 7465 );
7466. 7466 }
7467. 7467
7468. 7468 /// An envelope naming a tool that was not loaded this turn is ignored:
7469. 7469 /// the fallback must not invoke anything a model happened to spell out.
7470. 7470 #[test]
7471. 7471 fn envelope_naming_an_unknown_tool_produces_no_call() {
7472. 7472 assert_no_calls_and_unchanged(
7473. 7473 "<tool_call>{\"name\": \"delete_everything\", \"arguments\": {}}</tool_call>",
7474. 7474 );
7475. 7475 }
7476. 7476
7477. 7477 /// An envelope whose `arguments` is present but not a JSON object is
7478. 7478 /// malformed and ignored rather than guessed at.
7479. 7479 #[test]
7480. 7480 fn envelope_with_non_object_arguments_produces_no_call() {
7481. 7481 assert_no_calls_and_unchanged(
7482. 7482 "<tool_call>{\"name\": \"bash\", \"arguments\": \"not an object\"}</tool_call>",
7483. 7483 );
7484. 7484 }
7485. 7485
7486. 7486 /// The XML-style envelope naming a loaded tool produces a ToolUse block
7487. 7487 /// in the rewritten response, with a paired PendingToolCall to dispatch,
7488. 7488 /// and the envelope text is excised while surrounding prose survives.
7489. 7489 #[test]
7490. 7490 fn xml_envelope_naming_a_loaded_tool_produces_a_tool_use_block() {
7491. 7491 let mut response = text_response(
7492. 7492 "Let me check that for you.\n<tool_call>{\"name\": \"bash\", \"arguments\": {\"command\": \"ls\"}}</tool_call>\nDone.",
7493. 7493 );
7494. 7494 let calls = extract_tool_calls(&mut response, &loaded());
7495. 7495 assert_eq!(calls.len(), 1);
7496. 7496 assert_eq!(calls[0].name, "bash");
7497. 7497 assert_eq!(calls[0].input["command"], "ls");
7498. 7498 assert_eq!(response.stop_reason, StopReason::ToolUse);
7499. 7499 let tool_use_ids: Vec<&str> = response
7500. 7500 .content
7501. 7501 .iter()
7502. 7502 .filter_map(|b| match b {
7503. 7503 ContentBlock::ToolUse { id, name, .. } if name == "bash" => Some(id.as_str()),
7504. 7504 _ => None,
7505. 7505 })
7506. 7506 .collect();
7507. 7507 assert_eq!(tool_use_ids, vec![calls[0].id.as_str()]);
7508. 7508 let remaining_text = response.text_content();
7509. 7509 assert!(remaining_text.contains("Let me check that for you."));
7510. 7510 assert!(remaining_text.contains("Done."));
7511. 7511 assert!(!remaining_text.contains("tool_call"));
7512. 7512 }
7513. 7513
7514. 7514 /// The fenced `tool_call`/`tool_use` envelope, keyed by `tool` +
7515. 7515 /// `input` instead of `name` + `arguments`, is recognised the same way.
7516. 7516 #[test]
7517. 7517 fn fenced_tool_use_envelope_with_tool_and_input_keys_is_recognised() {
7518. 7518 let mut response = text_response(
7519. 7519 "```tool_use\n{\"tool\": \"write\", \"input\": {\"path\": \"a.txt\", \"content\": \"hi\"}}\n```",
7520. 7520 );
7521. 7521 let calls = extract_tool_calls(&mut response, &loaded());
7522. 7522 assert_eq!(calls.len(), 1);
7523. 7523 assert_eq!(calls[0].name, "write");
7524. 7524 assert_eq!(calls[0].input["path"], "a.txt");
7525. 7525 assert_eq!(response.stop_reason, StopReason::ToolUse);
7526. 7526 }
7527. 7527
7528. 7528 /// Missing `arguments`/`input`/`parameters` defaults to an empty
7529. 7529 /// object rather than being rejected as malformed.
7530. 7530 #[test]
7531. 7531 fn envelope_with_no_arguments_key_defaults_to_an_empty_object() {
7532. 7532 let mut response = text_response("<tool_call>{\"name\": \"bash\"}</tool_call>");
7533. 7533 let calls = extract_tool_calls(&mut response, &loaded());
7534. 7534 assert_eq!(calls.len(), 1);
7535. 7535 assert_eq!(calls[0].input, serde_json::json!({}));
7536. 7536 }
7537. 7537
7538. 7538 /// A structured `tool_use` content block always wins over any text
7539. 7539 /// envelope: the fallback is never consulted when the provider already
7540. 7540 /// gave a real tool call.
7541. 7541 #[test]
7542. 7542 fn a_structured_tool_use_block_short_circuits_the_text_fallback() {
7543. 7543 let mut response = AssistantMessage {
7544. 7544 content: vec![ContentBlock::ToolUse {
7545. 7545 id: "real-1".into(),
7546. 7546 name: "bash".into(),
7547. 7547 input: serde_json::json!({"command": "ls"}),
7548. 7548 }],
7549. 7549 stop_reason: StopReason::ToolUse,
7550. 7550 usage: Usage::default(),
7551. 7551 model: "test-model".into(),
7552. 7552 response_id: None,
7553. 7553 };
7554. 7554 let calls = extract_tool_calls(&mut response, &loaded());
7555. 7555 assert_eq!(calls.len(), 1);
7556. 7556 assert_eq!(calls[0].id, "real-1");
7557. 7557 }
7558. 7558
7559. 7559 #[test]
7560. 7560 fn a_pending_tool_call_carries_the_expected_fields() {
7561. 7561 // Sanity check on the struct's shape used throughout this module.
7562. 7562 let call = PendingToolCall {
7563. 7563 id: "x".into(),
7564. 7564 name: "bash".into(),
7565. 7565 input: serde_json::json!({"command": "ls"}),
7566. 7566 };
7567. 7567 assert_eq!(call.name, "bash");
7568. 7568 }
7569. 7569}
7570. 7570