mirror of
https://github.com/pewdiepie-archdaemon/odysseus.git
synced 2026-07-09 12:07:18 +00:00
botinate
9076be3add
Review follow-up on #3681 (thanks @RaresKeY): 1. P1: execute_tool_block() checked disabled_tools / the turn ToolPolicy only against the incoming block name, then the bare-email branch qualified it to mcp__email__<name> and called the MCP manager. Plan mode and the MCP settings toggle write the QUALIFIED name into the denylist, so a bare fence like ```list_emails``` sailed past a mcp__email__list_emails entry. Both gates now match on both spellings (bare <-> mcp__email__-qualified), in either direction. 2. P2: the relaxed fence regex accepted arbitrary same-line text after a recognized tag, which made ordinary Markdown info strings executable: ```python title="example.py" ran as a python tool call. Same-line content now only counts as tool input when it starts with { or [ (JSON args); anything else leaves the fence as display text, and strip_tool_blocks mirrors that (the fence stays visible). Tests: disabled-tools alias regression (qualified entry blocks bare name and vice versa, never reaching the MCP manager), ToolPolicy alias regression, python/bash title="..." non-execution + display retention, and inline JSON-array args still parsing. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
100 lines
4.1 KiB
Python
100 lines
4.1 KiB
Python
"""PR #3681 — fenced tool calls with inline args, and the fence-tag boundary.
|
|
|
|
Local fenced-block models (Ollama etc.) emit calls like ```list_email_accounts {}
|
|
with the args on the same line as the tag; the parser must execute those. The
|
|
relaxed tag pattern must NOT prefix-match longer fence tags: ```python3 is a
|
|
language hint, not a "python" tool call with content "3\n...".
|
|
"""
|
|
import sys
|
|
from unittest.mock import MagicMock
|
|
|
|
for mod in ['src.agent_tools', 'src.tool_parsing', 'src.tool_schemas', 'src.tool_execution']:
|
|
sys.modules.pop(mod, None)
|
|
for mod in [
|
|
'sqlalchemy', 'sqlalchemy.orm', 'sqlalchemy.ext', 'sqlalchemy.ext.declarative',
|
|
'sqlalchemy.ext.hybrid', 'sqlalchemy.sql', 'sqlalchemy.sql.expression',
|
|
'src.database', 'core.models', 'core.database', 'core.auth'
|
|
]:
|
|
if mod not in sys.modules:
|
|
sys.modules[mod] = MagicMock()
|
|
|
|
import src.agent_tools # noqa: E402, F401
|
|
from src.tool_parsing import parse_tool_blocks, strip_tool_blocks # noqa: E402
|
|
|
|
|
|
def test_inline_args_on_tag_line_parse():
|
|
# The original bug: ```list_email_accounts {} (args on the tag line)
|
|
# never matched because the regex required a newline right after the tag.
|
|
blocks = parse_tool_blocks('```list_email_accounts {}\n```')
|
|
assert [(b.tool_type, b.content) for b in blocks] == [("list_email_accounts", "{}")]
|
|
|
|
|
|
def test_inline_json_args_parse_for_email_tools():
|
|
blocks = parse_tool_blocks('```list_emails {"max_results": 5}\n```')
|
|
assert [(b.tool_type, b.content) for b in blocks] == [("list_emails", '{"max_results": 5}')]
|
|
|
|
|
|
def test_next_line_content_still_parses():
|
|
# No regression for the classic shape: tag, newline, content.
|
|
blocks = parse_tool_blocks('```manage_memory\nadd\nsome text\n```')
|
|
assert [(b.tool_type, b.content) for b in blocks] == [("manage_memory", "add\nsome text")]
|
|
|
|
|
|
def test_plain_bash_fence_still_parses():
|
|
blocks = parse_tool_blocks('```bash\necho hello\n```')
|
|
assert [(b.tool_type, b.content) for b in blocks] == [("bash", "echo hello")]
|
|
|
|
|
|
def test_python3_language_hint_is_not_a_python_tool_call():
|
|
# ```python3 must not prefix-match the "python" fence tag — without the
|
|
# (?![\w-]) boundary it parsed as tool "python" with content "3\nprint(...)"
|
|
# and executed as code.
|
|
blocks = parse_tool_blocks('```python3\nprint("hi")\n```')
|
|
assert blocks == [], blocks
|
|
|
|
|
|
def test_hyphenated_tag_is_not_a_tool_call():
|
|
blocks = parse_tool_blocks('```bash-session\n$ ls\n```')
|
|
assert blocks == [], blocks
|
|
|
|
|
|
def test_markdown_info_string_is_not_executable_python():
|
|
# ```python title="example.py" is Markdown fence metadata, not tool args.
|
|
# Same-line content other than JSON args ({...}/[...]) must not execute —
|
|
# otherwise a fence the model meant to display runs as code.
|
|
blocks = parse_tool_blocks('```python title="example.py"\nprint("hi")\n```')
|
|
assert blocks == [], blocks
|
|
|
|
|
|
def test_markdown_info_string_is_not_executable_bash():
|
|
blocks = parse_tool_blocks('```bash title="setup"\necho hi\n```')
|
|
assert blocks == [], blocks
|
|
|
|
|
|
def test_inline_json_array_args_still_parse():
|
|
# The narrowed same-line rule must keep accepting JSON args: { or [.
|
|
blocks = parse_tool_blocks('```bulk_email {"action": "archive", "uids": [1, 2]}\n```')
|
|
assert [(b.tool_type, b.content) for b in blocks] == [
|
|
("bulk_email", '{"action": "archive", "uids": [1, 2]}')
|
|
]
|
|
|
|
|
|
def test_inline_args_fence_is_stripped_from_display():
|
|
# strip must mirror parse: an executed inline-args fence must not leak
|
|
# into the displayed text.
|
|
text = 'Checking now.\n```list_email_accounts {}\n```\nDone.'
|
|
assert strip_tool_blocks(text) == 'Checking now.\n\nDone.'
|
|
|
|
|
|
def test_python3_fence_is_left_intact_in_display():
|
|
# ...and a fence that did NOT parse as a tool call must stay visible.
|
|
text = 'Example:\n```python3\nprint("hi")\n```'
|
|
assert strip_tool_blocks(text) == text
|
|
|
|
|
|
def test_markdown_info_string_fence_is_left_intact_in_display():
|
|
# strip must mirror parse for info-string fences too: not executed,
|
|
# so not stripped from the displayed text.
|
|
text = 'Example:\n```python title="example.py"\nprint("hi")\n```'
|
|
assert strip_tool_blocks(text) == text
|