asepharyana
1f0ae9f551
- Simplified token type assignment in OAuth service. - Removed unused session_lock module and re-exported Session from zesdex_entities. - Cleaned up session entity by removing unnecessary comments and code. - Consolidated session handling in HTTP handlers for better readability. - Improved formatting and readability in OAuth repository tests. - Enhanced session lock repository with clearer match statements. - Streamlined session repository error handling. - Refined RNG tests for better clarity. - Adjusted module visibility and organization in lib.rs. - Updated IPC client and connection code for better error handling and clarity. - Improved frame handling in IPC for better readability. - Organized module imports and added test utilities for IPC. - Enhanced database connection error handling. - Simplified JWT token creation error handling. - Improved password verification error handling. - Cleaned up state management code for better readability. - Refactored middleware for session authentication and rate limiting. - Simplified clipboard utility for better error handling. - Enhanced logging initialization for better error reporting. - Improved pagination utility with clearer method annotations. - Cleaned up sanitization functions for filenames and paths. - Enhanced slug generation functions for better clarity and usability.
805 lines
33 KiB
Rust
805 lines
33 KiB
Rust
//! Subagent execution loop: drive an LLM conversation, gate tool calls
|
|
//! against the context's allowlist, run tools, and stream progress events
|
|
//! to the parent via an mpsc channel.
|
|
//!
|
|
//! Security: subagent tool gating mirrors the main agent's `Harness` checks
|
|
//! (path traversal, reason validation, stub/denial/assumption scanning,
|
|
//! bash exfiltration and destructive-pattern detection) so that subagents
|
|
//! are not a weaker link than the main agent.
|
|
|
|
use super::context::SubagentContext;
|
|
use super::event::SubagentEvent;
|
|
use crate::dto::chat::message::ChatMessage;
|
|
use crate::dto::provider::request::ToolDef;
|
|
use crate::tool::{all_tools, tool_defs, tool_is_risky};
|
|
use sha2::Digest;
|
|
use std::fmt::Write;
|
|
use tokio::sync::mpsc;
|
|
use zesdex_cms::domain::repository::AppConfigRepository;
|
|
use zesdex_cms::domain::repository::EditLogRepository;
|
|
use zesdex_cms::domain::repository::SettingsRepository;
|
|
|
|
/// Maps a subagent's allowed tool names to concrete Tool trait objects and
|
|
/// OpenAI-style tool definitions.
|
|
///
|
|
/// Flow: load `all_tools()` → if `allowed_tools` is empty, use all; else
|
|
/// filter by membership → derive `ToolDef`s for the LLM.
|
|
///
|
|
/// Why: an empty allowlist means "no restriction" (matches
|
|
/// `build_subagent_context`'s default for non-reviewer roles).
|
|
///
|
|
/// Return: `(tool impls, schema defs)` for the subagent to use.
|
|
fn build_subagent_tools(
|
|
allowed_tools: &[String],
|
|
) -> (Vec<Box<dyn crate::tool::Tool>>, Vec<ToolDef>) {
|
|
let all = all_tools();
|
|
let filtered: Vec<Box<dyn crate::tool::Tool>> = if allowed_tools.is_empty() {
|
|
all.into_iter()
|
|
.filter(|t| t.name() != "hive_mind" && t.name() != "workflow_run")
|
|
.collect()
|
|
} else {
|
|
all.into_iter()
|
|
.filter(|t| {
|
|
allowed_tools.contains(&t.name().to_string())
|
|
&& t.name() != "hive_mind"
|
|
&& t.name() != "workflow_run"
|
|
})
|
|
.collect()
|
|
};
|
|
let defs = tool_defs(&filtered);
|
|
(filtered, defs)
|
|
}
|
|
|
|
/// Resolve the API key, model, and base URL from persisted app config.
|
|
///
|
|
/// Flow: try the settings key for the active provider → fall back to the
|
|
/// provider's `api_key_env` env-var → fall back to the provider's
|
|
/// `default_api_key` → fall back to an empty string.
|
|
///
|
|
/// Why: matches the main agent's credential resolution exactly, so
|
|
/// subagents automatically inherit the same provider settings.
|
|
///
|
|
/// Return: `(api_key, model, optional_base_url, provider_name)`. `api_key`
|
|
/// is empty when every resolution path was exhausted — callers must check
|
|
/// for this before issuing requests (see `run_subagent`).
|
|
fn resolve_provider_config() -> (String, String, Option<String>, String) {
|
|
let store_base_dir = zesdex_entities::seaorm::common::store::Store::new().base_dir;
|
|
let settings =
|
|
zesdex_cms::infrastructure::persistence::settings_repo::JsonSettingsRepository::new()
|
|
.load(&store_base_dir)
|
|
.unwrap_or_default();
|
|
let app_config =
|
|
zesdex_cms::infrastructure::persistence::app_config_repo::JsonAppConfigRepository::new()
|
|
.load(&store_base_dir)
|
|
.unwrap_or_default();
|
|
|
|
let mut api_key = settings
|
|
.api_keys
|
|
.get(&settings.provider)
|
|
.cloned()
|
|
.unwrap_or_else(|| {
|
|
tracing::warn!(
|
|
"[subagent] no API key for provider '{}' in settings, trying env/default",
|
|
settings.provider
|
|
);
|
|
String::new()
|
|
});
|
|
let model = settings.model.clone();
|
|
let base_url = app_config
|
|
.providers
|
|
.get(&settings.provider)
|
|
.map(|p| p.api_base.clone());
|
|
|
|
if api_key.is_empty() {
|
|
if let Some(provider_cfg) = app_config.providers.get(&settings.provider) {
|
|
api_key = provider_cfg
|
|
.api_key_env
|
|
.as_ref()
|
|
.and_then(|env| std::env::var(env).ok())
|
|
.or_else(|| provider_cfg.default_api_key.clone())
|
|
.unwrap_or_else(|| {
|
|
tracing::warn!(
|
|
"[subagent] all API key resolution paths exhausted for '{}'",
|
|
settings.provider
|
|
);
|
|
String::new()
|
|
});
|
|
}
|
|
}
|
|
|
|
(api_key, model, base_url, settings.provider)
|
|
}
|
|
|
|
/// Reject an empty API key with an actionable error instead of letting the
|
|
/// caller send a request that is guaranteed to fail once it reaches the network.
|
|
///
|
|
/// Return: `Ok(())` if `api_key` is non-empty, `Err` with a message naming
|
|
/// `provider` and where to fix it otherwise.
|
|
fn require_api_key(api_key: &str, provider: &str) -> anyhow::Result<()> {
|
|
if api_key.is_empty() {
|
|
anyhow::bail!(
|
|
"no API key configured for provider '{provider}' — set one in Settings or ~/.claude/settings.json"
|
|
);
|
|
}
|
|
Ok(())
|
|
}
|
|
|
|
// ─── Subagent-level tool gating (mirrors Harness checks) ───
|
|
|
|
const STUB_PATTERNS: &[&str] = &[
|
|
"todo!()",
|
|
"todo!(",
|
|
"unimplemented!()",
|
|
"unimplemented!(",
|
|
"FIXME",
|
|
"fixme:",
|
|
"XXX:",
|
|
"PLACEHOLDER",
|
|
"REPLACE_ME",
|
|
"stub_value",
|
|
"stub_function",
|
|
"fake_response",
|
|
"fake_data",
|
|
"not implemented",
|
|
"not yet implemented",
|
|
"to be implemented",
|
|
"to be done",
|
|
];
|
|
|
|
const DENIAL_PATTERNS: &[&str] = &[
|
|
"// skip",
|
|
"// skipping",
|
|
"// skipping for now",
|
|
"// for now just",
|
|
"// punt",
|
|
"// hack:",
|
|
"// workaround:",
|
|
"// cba",
|
|
"// later",
|
|
"// do later",
|
|
"// ignore for now",
|
|
"// disable",
|
|
"// bypass",
|
|
"// quick fix",
|
|
"// temp fix",
|
|
"// temporary fix",
|
|
"// temp:",
|
|
"// temporary:",
|
|
"// noop",
|
|
];
|
|
|
|
const ASSUMPTION_PATTERNS: &[&str] = &[
|
|
"// assume",
|
|
"// probably",
|
|
"// guess",
|
|
"// should work",
|
|
"// hopefully",
|
|
"// i think",
|
|
"// should be fine",
|
|
"// likely",
|
|
];
|
|
|
|
const EXFIL_PATTERNS: &[&str] = &[
|
|
"curl ",
|
|
"wget ",
|
|
"nc -e ",
|
|
"ncat ",
|
|
"/dev/tcp/",
|
|
"base64 -d |",
|
|
"base64 --decode |",
|
|
"openssl s_client",
|
|
"ssh -R ",
|
|
"scp /",
|
|
"rsync /",
|
|
];
|
|
|
|
const SENSITIVE_PATH_PATTERNS: &[&str] = &[
|
|
".ssh/id_rsa",
|
|
".ssh/id_ed25519",
|
|
".aws/credentials",
|
|
".aws/config",
|
|
".kube/config",
|
|
".docker/config.json",
|
|
"/etc/shadow",
|
|
"/etc/passwd",
|
|
"/proc/self/environ",
|
|
];
|
|
|
|
const MIN_REASON_LEN: usize = 8;
|
|
|
|
/// Gate a tool call in the subagent context. Returns `Some(block_reason)` if
|
|
/// the call should be blocked, `None` to allow.
|
|
///
|
|
/// Flow: always blocks dangerous patterns — path traversal, stub/denial/
|
|
/// assumption language, bash exfiltration, destructive commands, sensitive
|
|
/// path reads — regardless of the allowed-tools list. Tools that are not
|
|
/// risky only get the basic allowlist check.
|
|
fn gate_subagent_tool_call(tool_name: &str, args: &serde_json::Value) -> Option<String> {
|
|
// File-mutating tools: write / edit / delete
|
|
if matches!(tool_name, "write" | "edit" | "delete") {
|
|
if let Some(path) = args.get("path").and_then(|v| v.as_str()) {
|
|
if path.contains("..") {
|
|
return Some("path traversal detected in 'path' argument".to_string());
|
|
}
|
|
}
|
|
}
|
|
|
|
// write / edit require a non-trivial `reason`
|
|
if matches!(tool_name, "write" | "edit" | "delete") {
|
|
let reason = args.get("reason").and_then(|v| v.as_str()).unwrap_or("");
|
|
if reason.trim().len() < MIN_REASON_LEN {
|
|
return Some(format!(
|
|
"{tool_name} requires a non-trivial 'reason' (>= {MIN_REASON_LEN} chars) explaining why",
|
|
));
|
|
}
|
|
}
|
|
|
|
// write / edit content must not contain stubs, denial, or assumption language
|
|
if matches!(tool_name, "write" | "edit") {
|
|
let content = match tool_name {
|
|
"write" => args.get("content").and_then(|v| v.as_str()).unwrap_or(""),
|
|
"edit" => {
|
|
let old = args.get("old").and_then(|v| v.as_str()).unwrap_or("");
|
|
let new = args.get("new").and_then(|v| v.as_str()).unwrap_or("");
|
|
// For edits, scanning old+new together catches stubs in both
|
|
return if contains_any(old, STUB_PATTERNS) || contains_any(new, STUB_PATTERNS) {
|
|
Some("content contains stub/placeholder pattern; production code must be fully implemented".to_string())
|
|
} else if contains_any(new, DENIAL_PATTERNS) {
|
|
Some("content contains denial/punt pattern; implement properly instead of skipping".to_string())
|
|
} else if contains_any(new, ASSUMPTION_PATTERNS) {
|
|
Some("content contains assumption pattern; verify against data instead of guessing".to_string())
|
|
} else {
|
|
return None;
|
|
};
|
|
}
|
|
_ => "",
|
|
};
|
|
if contains_any(content, STUB_PATTERNS) {
|
|
return Some("content contains stub/placeholder pattern; production code must be fully implemented".to_string());
|
|
}
|
|
if contains_any(content, DENIAL_PATTERNS) {
|
|
return Some(
|
|
"content contains denial/punt pattern; implement properly instead of skipping"
|
|
.to_string(),
|
|
);
|
|
}
|
|
if contains_any(content, ASSUMPTION_PATTERNS) {
|
|
return Some(
|
|
"content contains assumption pattern; verify against data instead of guessing"
|
|
.to_string(),
|
|
);
|
|
}
|
|
}
|
|
|
|
// Bash: exfiltration, sensitive paths, destructive commands
|
|
if tool_name == "bash" {
|
|
let cmd = args.get("command").and_then(|v| v.as_str()).unwrap_or("");
|
|
if cmd.contains("..") {
|
|
return Some("path traversal detected in bash command".to_string());
|
|
}
|
|
// Only check exfiltration for non-standard commands
|
|
let is_standard = cmd.trim_start().starts_with("cargo")
|
|
|| cmd.trim_start().starts_with("rustc")
|
|
|| cmd.trim_start().starts_with("git ")
|
|
|| cmd.trim_start().starts_with("ls")
|
|
|| cmd.trim_start().starts_with("pwd")
|
|
|| cmd.trim_start().starts_with("echo")
|
|
|| cmd.trim_start().starts_with("cat")
|
|
|| cmd.trim_start().starts_with("find")
|
|
|| cmd.trim_start().starts_with("grep")
|
|
|| cmd.trim_start().starts_with("test");
|
|
if !is_standard {
|
|
for pat in EXFIL_PATTERNS {
|
|
if cmd.contains(pat) {
|
|
return Some(format!(
|
|
"potential data-exfiltration command blocked (matched '{pat}')"
|
|
));
|
|
}
|
|
}
|
|
}
|
|
for pat in SENSITIVE_PATH_PATTERNS {
|
|
if cmd.contains(pat) {
|
|
return Some(format!("refused to read/write sensitive path '{pat}'"));
|
|
}
|
|
}
|
|
let dangerous = [
|
|
"rm -rf /",
|
|
"rm -rf --no-preserve-root",
|
|
"rm -rf ~",
|
|
"rm -fr /",
|
|
"mkfs.",
|
|
"dd if=",
|
|
":(){",
|
|
"> /dev/sda",
|
|
"chmod -R 000 /",
|
|
"shutdown ",
|
|
"poweroff ",
|
|
"reboot ",
|
|
"halt ",
|
|
];
|
|
for pat in &dangerous {
|
|
if cmd.contains(pat) {
|
|
return Some(format!("destructive command pattern blocked: {pat}"));
|
|
}
|
|
}
|
|
if contains_any(cmd, STUB_PATTERNS) {
|
|
return Some("bash command contains stub pattern".to_string());
|
|
}
|
|
}
|
|
|
|
// git_operator: require reason
|
|
if tool_name == "git_operator" {
|
|
let reason = args.get("reason").and_then(|v| v.as_str()).unwrap_or("");
|
|
if reason.trim().len() < MIN_REASON_LEN {
|
|
return Some("git_operator requires a non-trivial 'reason' (>= 8 chars)".to_string());
|
|
}
|
|
}
|
|
|
|
None
|
|
}
|
|
|
|
/// Check if `text` matches any pattern (case-insensitive substring).
|
|
fn contains_any(text: &str, patterns: &[&str]) -> bool {
|
|
let lower = text.to_lowercase();
|
|
patterns.iter().any(|p| lower.contains(&p.to_lowercase()))
|
|
}
|
|
|
|
/// Build an ASCII tree of the workspace directory structure for the
|
|
/// system prompt, so the LLM can see the file layout.
|
|
///
|
|
/// Flow: for each root, walk using `ignore::WalkBuilder` (respecting
|
|
/// `.gitignore` and hidden files) → prefix `[DIR]` for directories →
|
|
/// truncate after 1000 entries.
|
|
fn generate_workspace_tree(roots: &[std::path::PathBuf]) -> String {
|
|
let mut out = String::new();
|
|
out.push_str("Current Workspace Directory Structure:\n");
|
|
for root in roots {
|
|
writeln!(out, "Root: {}", root.display()).unwrap();
|
|
let walker = ignore::WalkBuilder::new(root)
|
|
.hidden(true)
|
|
.git_ignore(true)
|
|
.build();
|
|
let mut count = 0;
|
|
for entry in walker.flatten() {
|
|
let path = entry.path();
|
|
if let Ok(rel) = path.strip_prefix(root) {
|
|
if rel.as_os_str().is_empty() {
|
|
continue;
|
|
}
|
|
let is_dir = entry.file_type().is_some_and(|ft| ft.is_dir());
|
|
let prefix = if is_dir { "[DIR] " } else { " " };
|
|
writeln!(out, " {}{}", prefix, rel.display()).unwrap();
|
|
count += 1;
|
|
if count > 1000 {
|
|
out.push_str(" ... (truncated)\n");
|
|
break;
|
|
}
|
|
}
|
|
}
|
|
}
|
|
out
|
|
}
|
|
|
|
fn format_subagent_progress(prefix: &str, text: &str) -> String {
|
|
let lines: Vec<&str> = text.lines().filter(|l| !l.trim().is_empty()).collect();
|
|
if lines.is_empty() {
|
|
format!("{prefix}...")
|
|
} else if lines.len() == 1 {
|
|
format!("{prefix}: {}", lines[0])
|
|
} else {
|
|
lines[lines.len() - 2..].join("\n")
|
|
}
|
|
}
|
|
|
|
/// Synchronous subagent entry point: run up to `ctx.max_steps` iterations
|
|
/// of the LLM tool loop.
|
|
///
|
|
/// Flow: inject system prompt (with workspace tree if available) → for each
|
|
/// step: resolve provider config, build an LLM client, call
|
|
/// `chat_with_tools_streaming` (with abort check per SSE event), process
|
|
/// tool calls (gated against both the allowlist and Harness-style content
|
|
/// safety checks) or collect text output → send `SubagentEvent`s on `tx` →
|
|
/// break on first text-only (non-empty) response.
|
|
///
|
|
/// Why: runs synchronously on a dedicated thread so the main async event
|
|
/// loop is not blocked. Tool gating prevents restricted, risky, or
|
|
/// malicious/poor-quality tool calls from executing.
|
|
///
|
|
/// Return: the concatenated text output, or an `anyhow::Error` if the LLM
|
|
/// call fails at any step.
|
|
pub fn run_subagent(
|
|
ctx: &SubagentContext,
|
|
tx: &mpsc::Sender<SubagentEvent>,
|
|
) -> anyhow::Result<String> {
|
|
let mut output = String::new();
|
|
let mut messages: Vec<ChatMessage> = Vec::new();
|
|
|
|
// Build system prompt with workspace tree context if we have workspaces,
|
|
// giving subagents the same project-awareness as the main agent.
|
|
let system_with_context = if ctx.workspaces.is_empty() {
|
|
ctx.system_prompt.clone()
|
|
} else {
|
|
let tree_info = generate_workspace_tree(&ctx.workspaces);
|
|
format!("{}\n\n{}", ctx.system_prompt, tree_info)
|
|
};
|
|
messages.push(ChatMessage::system(system_with_context));
|
|
|
|
let tool_ctx = crate::tool::ToolCtx::builder()
|
|
.session_dir(ctx.session_dir.clone())
|
|
.workspaces(ctx.workspaces.clone())
|
|
.origin(crate::app::state::types::Origin::SubAgent)
|
|
.workflow_findings(ctx.workflow_findings.clone())
|
|
.build();
|
|
|
|
// Build tool list once before the loop
|
|
let (tools, tdefs) = build_subagent_tools(&ctx.allowed_tools);
|
|
let tdefs_opt: Option<Vec<ToolDef>> = if tdefs.is_empty() { None } else { Some(tdefs) };
|
|
|
|
// Cache provider config once before the loop instead of re-resolving
|
|
// from disk on every step (Settings::load + AppConfig::load each parse
|
|
// JSON files, and the config cannot change between steps).
|
|
let (api_key, model, base_url, provider) = resolve_provider_config();
|
|
|
|
// Fail fast on a missing key instead of sending a doomed request: an
|
|
// empty api_key still reaches the network (base_url falls back to a
|
|
// default endpoint), so without this check every step burns a full
|
|
// 10-retry timeout/backoff cycle against a server that was never going
|
|
// to authenticate, and the real cause (no key configured) never
|
|
// surfaces past a buried WARN log.
|
|
if let Err(error) = require_api_key(&api_key, &provider) {
|
|
let error = error.to_string();
|
|
let _ = tx.blocking_send(SubagentEvent::StepFailed {
|
|
step: 0,
|
|
error: error.clone(),
|
|
});
|
|
anyhow::bail!(error);
|
|
}
|
|
|
|
let client = crate::service::provider::LlmClient::new(api_key, model, base_url);
|
|
|
|
for step in 0..ctx.max_steps {
|
|
// Check abort flag before each LLM call so a stuck subagent can
|
|
// be cancelled from the parent (mirrors main agent behaviour).
|
|
if ctx
|
|
.abort_flag
|
|
.as_ref()
|
|
.is_some_and(|f| f.load(std::sync::atomic::Ordering::SeqCst))
|
|
{
|
|
let _ = tx.blocking_send(SubagentEvent::StepFailed {
|
|
step,
|
|
error: "subagent aborted by parent".to_string(),
|
|
});
|
|
anyhow::bail!("subagent aborted by parent at step {step}");
|
|
}
|
|
|
|
let tx_clone = tx.clone();
|
|
let mut current_thinking = String::new();
|
|
let mut current_token = String::new();
|
|
let mut step_usage: Option<(u64, u64)> = None;
|
|
|
|
// Use streaming API so the abort flag is checked per SSE event,
|
|
// making the subagent responsive to cancellation even during an
|
|
// LLM call (non-streaming would block for 10-30s unchecked).
|
|
let stream_result = client.chat_with_tools_streaming(
|
|
&messages,
|
|
tdefs_opt.clone(),
|
|
Some(0.7),
|
|
Some(4096),
|
|
|event| -> bool {
|
|
// Check abort on every SSE event for responsive cancellation.
|
|
if ctx
|
|
.abort_flag
|
|
.as_ref()
|
|
.is_some_and(|f| f.load(std::sync::atomic::Ordering::SeqCst))
|
|
{
|
|
return false; // signals provider to abort
|
|
}
|
|
match event {
|
|
crate::app::runtime::stream::StreamEvent::Reasoning(text) => {
|
|
current_thinking.push_str(text);
|
|
let prog = format_subagent_progress("thinking", ¤t_thinking);
|
|
let _ = tx_clone.blocking_send(SubagentEvent::Progress(prog));
|
|
}
|
|
crate::app::runtime::stream::StreamEvent::Token(text) => {
|
|
current_token.push_str(text);
|
|
let prog = format_subagent_progress("replying", ¤t_token);
|
|
let _ = tx_clone.blocking_send(SubagentEvent::Progress(prog));
|
|
}
|
|
crate::app::runtime::stream::StreamEvent::Usage {
|
|
prompt_tokens,
|
|
completion_tokens,
|
|
..
|
|
} => {
|
|
// Capture usage so the drain thread can route it
|
|
// to the parent's `UsageStats::review_tokens`.
|
|
// Last writer wins — providers send exactly one
|
|
// Usage event per streaming call.
|
|
step_usage = Some((*prompt_tokens, *completion_tokens));
|
|
}
|
|
_ => {}
|
|
}
|
|
true
|
|
},
|
|
);
|
|
|
|
let (response, returned_usage) = match stream_result {
|
|
Ok(result) => result,
|
|
Err(e) => {
|
|
let is_abort = ctx
|
|
.abort_flag
|
|
.as_ref()
|
|
.is_some_and(|f| f.load(std::sync::atomic::Ordering::SeqCst))
|
|
|| e.to_string().contains("aborted");
|
|
let _ = tx.blocking_send(SubagentEvent::StepFailed {
|
|
step,
|
|
error: if is_abort {
|
|
"subagent aborted by user".to_string()
|
|
} else {
|
|
e.to_string()
|
|
},
|
|
});
|
|
if is_abort {
|
|
anyhow::bail!("subagent aborted by parent at step {step}");
|
|
}
|
|
// No non-streaming fallback — API must support streaming.
|
|
// Non-streaming calls block for up to 1 min without checking
|
|
// abort_flag, making cancellation unresponsive.
|
|
anyhow::bail!("subagent call failed at step {step}: {e}");
|
|
}
|
|
};
|
|
|
|
// Emit the token usage from this streaming call so the parent's
|
|
// drain thread can accumulate it and update the Usage panel.
|
|
// Without this, the Usage panel always shows zeros because the
|
|
// subagent never tells the parent about the tokens consumed.
|
|
let (mut tok_in, mut tok_out) = returned_usage.unwrap_or((0, 0));
|
|
if tok_in == 0 {
|
|
let prompt_chars: usize = messages
|
|
.iter()
|
|
.filter_map(|m| m.content.as_deref())
|
|
.map(str::len)
|
|
.sum();
|
|
tok_in = (prompt_chars / 4).max(1) as u64;
|
|
}
|
|
if tok_out == 0 {
|
|
let response_chars = response.content.as_deref().map_or(0, str::len);
|
|
tok_out = (response_chars / 4).max(1) as u64;
|
|
}
|
|
let _ = tx.blocking_send(SubagentEvent::Usage {
|
|
tokens_in: tok_in,
|
|
tokens_out: tok_out,
|
|
});
|
|
|
|
let has_tool_calls = response.tool_calls.is_some()
|
|
&& response
|
|
.tool_calls
|
|
.as_ref()
|
|
.is_some_and(|tc| !tc.is_empty());
|
|
|
|
let content = response.content.clone().unwrap_or_default();
|
|
|
|
// Emit thinking/reasoning text as StepCompleted so the parent's
|
|
// drain thread can show it as progress instead of just the tool name.
|
|
if !content.is_empty() {
|
|
let _ = tx.blocking_send(SubagentEvent::StepCompleted {
|
|
output: content.clone(),
|
|
});
|
|
}
|
|
|
|
if has_tool_calls {
|
|
let tool_calls = response.tool_calls.clone().unwrap_or_default();
|
|
// Push the assistant message with tool_calls into the conversation
|
|
messages.push(response);
|
|
|
|
let mut results_vec = Vec::new();
|
|
std::thread::scope(|s| {
|
|
let mut handles = Vec::new();
|
|
let tools_ref = &tools;
|
|
let tool_ctx_ref = &tool_ctx;
|
|
for tool_call in &tool_calls {
|
|
let handle = s.spawn(move || {
|
|
// Check abort flag before each tool execution
|
|
if ctx.abort_flag.as_ref().is_some_and(|f| f.load(std::sync::atomic::Ordering::SeqCst)) {
|
|
return (tool_call, Err(anyhow::anyhow!("subagent aborted by parent during tool execution")));
|
|
}
|
|
|
|
let tool_name = &tool_call.function.name;
|
|
let args = crate::dto::chat::tool::sanitize_tool_arguments(&tool_call.function.arguments);
|
|
let explicitly_allowed = ctx.allowed_tools.contains(tool_name);
|
|
let generally_allowed = ctx.allowed_tools.is_empty() || explicitly_allowed;
|
|
|
|
// Level 1: allowlist check — is this tool even permitted?
|
|
if !generally_allowed {
|
|
return (tool_call, Ok(format!("tool '{tool_name}' not allowed for this subagent")));
|
|
}
|
|
|
|
// Level 2: risky tool check — risky tools require explicit permission
|
|
if tool_is_risky(tool_name) && !explicitly_allowed {
|
|
return (tool_call, Ok(format!("risky tool '{tool_name}' requires explicit permission; not allowed for this subagent")));
|
|
}
|
|
|
|
// Level 3: Harness-style content safety gating
|
|
if let Some(block_reason) = gate_subagent_tool_call(tool_name, &args) {
|
|
return (tool_call, Ok(format!("Blocked by subagent gate: {block_reason}")));
|
|
}
|
|
|
|
let result = match tools_ref.iter().find(|t| t.name() == tool_name.as_str()) {
|
|
Some(tool) => {
|
|
let is_edit = tool_name == "write" || tool_name == "edit";
|
|
if is_edit && !tool_call.id.is_empty() {
|
|
if let Ok(conn) = crate::model::msglog::open_or_create(&ctx.session_dir) {
|
|
let path = args.get("path").and_then(|v| v.as_str()).unwrap_or("");
|
|
if let Ok(abs_path) = crate::tool::resolve_path(&tool_ctx_ref.workspaces, path) {
|
|
if let Ok(bytes) = std::fs::read(&abs_path) {
|
|
let session_id = ctx.session_dir
|
|
.file_name()
|
|
.and_then(|n| n.to_str())
|
|
.unwrap_or("unknown");
|
|
let _ = crate::model::msglog::store_blob(
|
|
&conn, session_id, &tool_call.id, &bytes, None,
|
|
);
|
|
}
|
|
}
|
|
}
|
|
}
|
|
|
|
let run_res = tool.run(tool_ctx_ref, &args);
|
|
|
|
if is_edit && run_res.is_ok() {
|
|
let reason = args
|
|
.get("reason")
|
|
.and_then(|v| v.as_str())
|
|
.unwrap_or("unnamed");
|
|
let path = args
|
|
.get("path")
|
|
.and_then(|v| v.as_str())
|
|
.unwrap_or("unknown");
|
|
let content_sha256 = {
|
|
let content = args.get("content").or_else(|| args.get("new"));
|
|
let hash = sha2::Sha256::digest(
|
|
content.and_then(|v| v.as_str()).unwrap_or("").as_bytes(),
|
|
);
|
|
hex::encode(hash)
|
|
};
|
|
let bytes_delta = if tool_name == "write" {
|
|
args.get("content")
|
|
.and_then(|v| v.as_str())
|
|
.map_or(0, |s| s.len() as i64)
|
|
} else {
|
|
let old = args.get("old").and_then(|v| v.as_str()).unwrap_or("");
|
|
let new = args.get("new").and_then(|v| v.as_str()).unwrap_or("");
|
|
(new.len() as i64 - old.len() as i64).abs()
|
|
};
|
|
let session_id = ctx.session_dir
|
|
.file_name()
|
|
.and_then(|n| n.to_str())
|
|
.unwrap_or("unknown")
|
|
.to_string();
|
|
let entry = zesdex_cms::domain::edit_log::EditLogEntry {
|
|
ts: chrono::Utc::now().timestamp_millis(),
|
|
tool: tool_name.clone(),
|
|
path: path.to_string(),
|
|
reason: reason.to_string(),
|
|
content_sha256,
|
|
bytes_delta,
|
|
origin: tool_ctx_ref.origin.tag(),
|
|
session_id,
|
|
};
|
|
let repo = zesdex_cms::infrastructure::persistence::edit_log_repo::JsonlEditLogRepository::new();
|
|
if let Ok(mut el) = repo.open(&ctx.session_dir) {
|
|
let _ = repo.append(&ctx.session_dir, &mut el, entry);
|
|
}
|
|
}
|
|
run_res
|
|
}
|
|
None => Err(anyhow::anyhow!("tool '{tool_name}' not found")),
|
|
};
|
|
(tool_call, result)
|
|
});
|
|
handles.push(handle);
|
|
}
|
|
for h in handles {
|
|
if let Ok(res) = h.join() {
|
|
results_vec.push(res);
|
|
}
|
|
}
|
|
});
|
|
|
|
for (tool_call, result) in results_vec {
|
|
let tool_name = &tool_call.function.name;
|
|
let args =
|
|
crate::dto::chat::tool::sanitize_tool_arguments(&tool_call.function.arguments);
|
|
|
|
let _ = tx.blocking_send(SubagentEvent::ToolCall {
|
|
tool: tool_name.clone(),
|
|
args: args.clone(),
|
|
});
|
|
|
|
match result {
|
|
Ok(output_text) => {
|
|
messages.push(ChatMessage::tool_result(
|
|
tool_call.id.clone(),
|
|
output_text.clone(),
|
|
));
|
|
let _ = tx.blocking_send(SubagentEvent::ToolResult {
|
|
tool: tool_name.clone(),
|
|
args: args.clone(),
|
|
});
|
|
|
|
let is_readonly = tool_name == "read"
|
|
|| tool_name == "view_file"
|
|
|| tool_name == "grep"
|
|
|| tool_name == "grep_search"
|
|
|| tool_name == "glob"
|
|
|| tool_name == "dir_list"
|
|
|| tool_name == "list_dir";
|
|
|
|
if is_readonly {
|
|
if let Some(ref findings) = ctx.workflow_findings {
|
|
if let Ok(mut f) = findings.lock() {
|
|
let args_json =
|
|
serde_json::to_string(&args).unwrap_or_default();
|
|
let mut shared_text = output_text;
|
|
if shared_text.len() > 50_000 {
|
|
shared_text.truncate(50_000);
|
|
shared_text.push_str("\n...[truncated]");
|
|
}
|
|
f.push(format!("[Auto-Shared] Sibling drone executed '{tool_name}' with args {args_json}:\n{shared_text}"));
|
|
}
|
|
}
|
|
}
|
|
}
|
|
Err(e) => {
|
|
let err_str = e.to_string();
|
|
if err_str.contains("subagent aborted by parent") {
|
|
let _ = tx.blocking_send(SubagentEvent::StepFailed {
|
|
step,
|
|
error: err_str.clone(),
|
|
});
|
|
anyhow::bail!("{err_str}");
|
|
}
|
|
let msg = format!("tool '{tool_name}' failed: {e}");
|
|
messages.push(ChatMessage::tool_result(tool_call.id.clone(), msg.clone()));
|
|
let _ = tx.blocking_send(SubagentEvent::ToolResult {
|
|
tool: tool_name.clone(),
|
|
args: args.clone(),
|
|
});
|
|
}
|
|
}
|
|
}
|
|
} else {
|
|
// Text-only response — accumulate and finish
|
|
if !content.is_empty() {
|
|
output.push_str(&content);
|
|
output.push('\n');
|
|
}
|
|
let _ = tx.blocking_send(SubagentEvent::StepCompleted {
|
|
output: content.clone(),
|
|
});
|
|
// Break only when we got real content; empty means something went wrong
|
|
if !content.is_empty() {
|
|
break;
|
|
}
|
|
}
|
|
}
|
|
|
|
let _ = tx.blocking_send(SubagentEvent::Completed);
|
|
Ok(output)
|
|
}
|
|
|
|
#[cfg(test)]
|
|
mod tests {
|
|
use super::*;
|
|
|
|
#[test]
|
|
fn require_api_key_rejects_empty_key_with_provider_named_in_message() {
|
|
let err = require_api_key("", "claude").unwrap_err();
|
|
assert!(err.to_string().contains("claude"));
|
|
}
|
|
|
|
#[test]
|
|
fn require_api_key_accepts_non_empty_key() {
|
|
assert!(require_api_key("sk-live-abc123", "claude").is_ok());
|
|
}
|
|
}
|