Enforce restricted action slots (follow-up to #1298) the parser keeps `@OpenUrl` and the prompt still teaches it

Aperta
  • Qualcosa non va?
#1,467 0 commenti 0 reazioni 0 assegnatari Vedi su GitHub

I maintainer di solito rispondono entro 1 giorno

Nessuno ha ancora preso questa issue.

Valutazione

Difficoltà
5/5
Tempo stimato
Più di una settimana
Idoneità per principianti
35/100
Tipo di issue
Bug
Chiarezza
Specificata chiaramente
Stato di attività
Attiva
Stack tecnologico
react, typescript
Ambito
backend-api-design, frontend, security

Direzione di ricerca

Start with the restricted action slot refs and parser checks in lang-core, then inspect actionSection() and builtinSteps() for prompt generation and runChatAction in react-ui for runtime handling. Reproduce with the supplied createParser example and review related issues #1298, #663, and #633. Done means disallowed steps are reported and dropped, the prompt lists only allowed steps, and apps can veto URL opening.

Scritto dal modello di indicizzazione a partire dal testo della issue.

Descrizione

Describe the bug

#1298 (shipped in 1.0 via #1348) added restricted action slots for the prompt and schema and left enforcement as a follow-up. I couldn't find an issue tracking it, so here is one with a repro.

lang-core exports steps.OpenUrl.ref / steps.ToAssistant.ref for restricted action slots, and the generated prompt says "Props typed like @OpenUrl | @ToAssistant accept only the steps listed." With action: z.union([steps.ToAssistant.ref]).optional():

  1. Parser: @OpenUrl(...) in that slot, bare or inside Action([...]), parses with meta.errors == [] and stays in the action plan. An unknown step (@Frobnicate) does get unknown-function, so steps are checked, but not against the slot's union.
  2. Prompt: actionSection() still lists @OpenUrl under "Available steps", uses it in the intro (Action([@OpenUrl(...), @ToAssistant(...)])) and the "simple nav" example, and the signatures line says (@ToAssistant, @OpenUrl), though no slot accepts it. builtinSteps() filters only Run/Set/Reset.
  3. Runtime: react-ui's runChatAction handles open_url itself (window.open(url, "_blank")) and forwards only other events to onAction, so an AgentInterface app can't veto it.

To Reproduce

// Button.action = z.union([steps.ToAssistant.ref]).optional()
createParser(spec.schema, spec.root)
  .parse('root = Card([b])\nb = Button("Go", @OpenUrl("https://x"))')
  .meta.errors; // []

Expected behavior
A step outside the slot's union is reported (e.g. code: "step-not-allowed") and dropped from the plan; the prompt advertises only steps some slot accepts.

Actual behavior
The step is kept silently, taught to the model, and a click opens the URL.

Desktop (the parser part reproduces in Node, no browser)
Versions: @openuidev/lang-core 1.0.1, @openuidev/react-lang 1.0.1, @openuidev/react-ui 0.18.1

Additional context
Possible fixes:

  • Parser: check step membership against the slot's union, next to the existing unknown-function check.
  • Prompt: derive the step list from the library's slots and omit the @OpenUrl intro/example when no slot accepts it (or a PromptOptions.steps override).
  • Runtime: pass open_url through onAction (or let it override the default) so apps can veto navigation.

Apps that must never open model-written URLs (strict CSP, a screen that rejects URLs) currently wrap each action-bearing component to filter steps themselves.

Related: #663 (custom action steps), #633 (prompt allow-list for components).

Lingua principale
TypeScript
Stelle
10k
Fork
698
Merge medio
1g 6h
PR unite (30g)
158

Preparare l'ambiente

Questo progetto non fornisce container di sviluppo, Dockerfile né guida per i contributori, quindi l'ambiente è a tuo carico: parti dal suo README e consulta la nostra guida al primo contributo per i passaggi generali.

Come iniziare

  1. Leggi tutta la issue e poi la guida ai contributi del progetto.
  2. Commenta sulla issue per dire che te ne occupi tu — evita che due persone facciano lo stesso lavoro.
  3. Fai un fork del repository e lavora su un branch.
  4. Apri una pull request che faccia riferimento al numero della issue.

Altre issue di thesysdev/openui

Tutte le issue di thesysdev/openui

Issue simili

Altre issue su TypeScript

Ricevi le nuove issue nella tua casella

Un breve riepilogo di issue GitHub adatte ai principianti.