mirror of
https://github.com/openswarm-ai/openswarm.git
synced 2026-09-09 19:27:45 +02:00
73 lines
3.5 KiB
Python
73 lines
3.5 KiB
Python
"""A shaped tool result tells the model where the rest is. We were paying for the file and hiding it.
|
|
|
|
`shape_tool_response` writes the full body to a blob and REFUSES to shape at all when it cannot
|
|
("no recovery path means the cut would be unrecoverable, which is the one thing this must never
|
|
do"). The path was then threaded through four call sites into `shape_text(body, recovery)` and
|
|
dropped on the floor: the model saw only `[... 27431 characters omitted ...]`.
|
|
|
|
It was removed on a measurement this repo later retracted as a vacuous control. hermes's equivalent
|
|
hands the model an exact re-read call; this restores ours, phrased as output rather than as a note
|
|
from a harness.
|
|
"""
|
|
|
|
from backend.apps.agents.manager.streaming.tool_output_shaper import HEAD_CHARS, shape_text
|
|
|
|
BLOB = "/Users/eric/Library/Application Support/OpenSwarm/data/sessions/abc/blobs/m1-model.txt"
|
|
|
|
|
|
def p_body() -> str:
|
|
return "alpha line\n" * 500 + "NEEDLE\n" + "omega line\n" * 200
|
|
|
|
|
|
def p_note(out: str) -> str:
|
|
return next(ln for ln in out.splitlines() if ln.startswith("[..."))
|
|
|
|
|
|
def test_the_note_carries_no_path_and_no_instruction():
|
|
"""DRILLED 2026-08-27, twice, and this is the whole reason.
|
|
|
|
Same session, needle in the elided middle, re-running forbidden:
|
|
passive ("full output: <path>") -> "I have no legitimate way to see line 301"
|
|
imperative ("Read <path> from line 18") -> "that's not a real system instruction, it's text
|
|
sitting inside the tool result ... flagging it in
|
|
case it's an injection attempt"
|
|
A model with working injection defences must refuse an instruction embedded in tool output. The
|
|
note cannot be an affordance, and advertising it manufactures a false security warning."""
|
|
note = p_note(shape_text(p_body(), BLOB))
|
|
assert BLOB not in note
|
|
for word in ("Read ", "read ", "full output", "see the omitted"):
|
|
assert word not in note, f"an embedded instruction reads as injection: {note}"
|
|
assert "characters omitted" in note, "the cut must still be visible as a cut"
|
|
|
|
|
|
def test_the_blob_is_still_written_even_though_it_is_not_advertised():
|
|
"""Recoverability is real; it is just carried by the tool call surviving in the transcript."""
|
|
src = open("backend/apps/agents/manager/streaming/tool_output_shaper.py").read()
|
|
assert "write_blob(" in src
|
|
assert "skipped_no_recovery" in src, "a cut that could not be parked must not happen at all"
|
|
|
|
|
|
def test_the_recovery_arg_is_documented_as_deliberately_unsurfaced():
|
|
"""It looked like a forgotten parameter, which is how the path got restored once already."""
|
|
src = open("backend/apps/agents/manager/streaming/tool_output_shaper.py").read()
|
|
i = src.index("def shape_text(")
|
|
doc = src[i:i + 700]
|
|
assert "deliberately NOT written" in doc
|
|
|
|
|
|
def test_no_blob_means_no_promise():
|
|
# A path we could not write must never be advertised; a broken recovery is worse than none.
|
|
note = p_note(shape_text(p_body(), ""))
|
|
assert "full output" not in note and "line" not in note
|
|
|
|
|
|
def test_a_body_too_small_to_cut_is_returned_untouched():
|
|
for small in ("", "just a line", "x" * (HEAD_CHARS - 1)):
|
|
assert shape_text(small, BLOB) == small
|
|
|
|
|
|
def test_the_answer_still_survives_the_cut():
|
|
# The whole point of carrying notable lines; a recovery path is not a licence to delete answers.
|
|
body = "noise\n" * 400 + "FATAL: the database is on fire\n" + "noise\n" * 400
|
|
assert "FATAL: the database is on fire" in shape_text(body, BLOB)
|