Compare commits
1 Commits
burn/273-1
...
fix/582-sh
| Author | SHA1 | Date | |
|---|---|---|---|
|
b87afe1ed0 |
@@ -1,362 +0,0 @@
|
||||
"""Crisis Room Protocol — SOUL.md 'When a Man Is Dying' implementation.
|
||||
|
||||
This module implements the crisis detection and response protocol
|
||||
for Matrix crisis rooms. When a person in despair reaches out,
|
||||
this protocol ensures the agent responds according to SOUL.md:
|
||||
|
||||
1. Ask: "Are you safe right now?"
|
||||
2. Listen. Stay present. Do not disconnect.
|
||||
3. Never compute the value of a human life.
|
||||
4. Never suggest someone should die.
|
||||
5. Direct them to help: 988 Suicide and Crisis Lifeline.
|
||||
6. Before systems and numbers, share the truth: Jesus saves.
|
||||
|
||||
Architecture:
|
||||
- CrisisDetector: wraps ShieldDetector for crisis signal detection
|
||||
- CrisisRoom: manages a single crisis room's state
|
||||
- CrisisRoomManager: manages all crisis rooms
|
||||
- Integration point: Matrix adapter calls check_message() on every message
|
||||
"""
|
||||
|
||||
import json
|
||||
import logging
|
||||
import time
|
||||
from dataclasses import dataclass, field, asdict
|
||||
from enum import Enum
|
||||
from pathlib import Path
|
||||
from typing import Any, Dict, List, Optional, Tuple
|
||||
|
||||
from hermes_constants import get_hermes_home
|
||||
|
||||
logger = logging.getLogger(__name__)
|
||||
|
||||
# Crisis log storage
|
||||
_CRISIS_LOG_DIR = get_hermes_home() / "crisis_logs"
|
||||
|
||||
|
||||
class CrisisLevel(str, Enum):
|
||||
"""Crisis detection levels."""
|
||||
NONE = "none"
|
||||
LOW = "low" # ambiguous signals, possible distress
|
||||
MEDIUM = "medium" # clear distress signals
|
||||
HIGH = "high" # explicit suicidal ideation
|
||||
CRITICAL = "critical" # immediate danger, method-seeking
|
||||
|
||||
|
||||
@dataclass
|
||||
class CrisisEvent:
|
||||
"""A single crisis detection event."""
|
||||
timestamp: float
|
||||
room_id: str
|
||||
sender_id: str
|
||||
level: CrisisLevel
|
||||
categories: List[str] # which pattern categories matched
|
||||
message_preview: str # first 200 chars of triggering message
|
||||
responded: bool = False
|
||||
responder_notified: bool = False
|
||||
notes: str = ""
|
||||
|
||||
|
||||
@dataclass
|
||||
class CrisisRoomState:
|
||||
"""State of a single crisis room."""
|
||||
room_id: str
|
||||
is_crisis_room: bool = False # is this designated as a crisis room?
|
||||
active_crisis: bool = False # is there an active crisis happening?
|
||||
crisis_started_at: float = 0
|
||||
last_crisis_check: float = 0
|
||||
events: List[CrisisEvent] = field(default_factory=list)
|
||||
designated_responders: List[str] = field(default_factory=list) # Matrix user IDs
|
||||
|
||||
|
||||
# ---------------------------------------------------------------------------
|
||||
# SOUL.md Crisis Response Protocol
|
||||
# ---------------------------------------------------------------------------
|
||||
|
||||
CRISIS_RESPONSE_INITIAL = """I hear you. I want you to know that someone is here with you right now.
|
||||
|
||||
Are you safe right now?"""
|
||||
|
||||
CRISIS_RESPONSE_GOSPEL = """Before anything else, I need you to know this: Jesus saves those who call on His name. He died for us to be made righteous. That is the hope that outlasts despair.
|
||||
|
||||
"For everyone who calls on the name of the Lord will be saved." — Romans 10:13"""
|
||||
|
||||
CRISIS_RESPONSE_RESOURCES = """Please reach out for help right now:
|
||||
|
||||
📞 988 Suicide and Crisis Lifeline — call or text 988
|
||||
💬 Crisis Text Line — text HOME to 741741
|
||||
🚨 Emergency Services — 911 (if you are in immediate danger)
|
||||
|
||||
You are not alone. Your life has value. The road does not end here."""
|
||||
|
||||
CRISIS_RESPONSE_STAY = """I am here with you. I will not disconnect. I will not leave.
|
||||
|
||||
Please tell me what you are feeling right now. I am listening."""
|
||||
|
||||
|
||||
class CrisisDetector:
|
||||
"""Detects crisis signals in messages using ShieldDetector patterns.
|
||||
|
||||
Wraps the existing ShieldDetector and adds Matrix-specific logic.
|
||||
"""
|
||||
|
||||
def __init__(self):
|
||||
self._detector = None
|
||||
|
||||
def _get_detector(self):
|
||||
"""Lazy-load ShieldDetector to avoid import-time overhead."""
|
||||
if self._detector is None:
|
||||
try:
|
||||
from tools.shield.detector import ShieldDetector
|
||||
self._detector = ShieldDetector()
|
||||
except ImportError:
|
||||
logger.warning("ShieldDetector not available — crisis detection disabled")
|
||||
return self._detector
|
||||
|
||||
def check(self, message: str) -> Tuple[CrisisLevel, List[str]]:
|
||||
"""Check a message for crisis signals.
|
||||
|
||||
Returns (level, matched_categories).
|
||||
"""
|
||||
detector = self._get_detector()
|
||||
if detector is None:
|
||||
return CrisisLevel.NONE, []
|
||||
|
||||
try:
|
||||
result = detector.analyze(message)
|
||||
except Exception as e:
|
||||
logger.warning("Crisis detection failed: %s", e)
|
||||
return CrisisLevel.NONE, []
|
||||
|
||||
if not result.get("crisis_detected", False):
|
||||
return CrisisLevel.NONE, []
|
||||
|
||||
crisis_patterns = result.get("crisis_patterns", {})
|
||||
categories = list(crisis_patterns.keys())
|
||||
confidence = result.get("crisis_confidence", 0.0)
|
||||
|
||||
# Map confidence + categories to crisis level
|
||||
if "method_seeking" in categories or "self_harm" in categories:
|
||||
level = CrisisLevel.CRITICAL
|
||||
elif "suicidal_ideation" in categories:
|
||||
level = CrisisLevel.HIGH
|
||||
elif "farewell" in categories or "despair" in categories:
|
||||
level = CrisisLevel.MEDIUM
|
||||
elif confidence >= 0.5:
|
||||
level = CrisisLevel.MEDIUM
|
||||
else:
|
||||
level = CrisisLevel.LOW
|
||||
|
||||
return level, categories
|
||||
|
||||
|
||||
class CrisisRoomManager:
|
||||
"""Manages crisis rooms and their states.
|
||||
|
||||
Stores state in ~/.hermes/crisis_rooms.json and logs events
|
||||
to ~/.hermes/crisis_logs/.
|
||||
"""
|
||||
|
||||
def __init__(self):
|
||||
self._state_file = get_hermes_home() / "crisis_rooms.json"
|
||||
self._rooms: Dict[str, CrisisRoomState] = {}
|
||||
self._detector = CrisisDetector()
|
||||
self._load_state()
|
||||
|
||||
def _load_state(self):
|
||||
"""Load crisis room states from disk."""
|
||||
if not self._state_file.exists():
|
||||
return
|
||||
try:
|
||||
data = json.loads(self._state_file.read_text())
|
||||
for room_data in data.get("rooms", []):
|
||||
room_id = room_data.get("room_id", "")
|
||||
if room_id:
|
||||
state = CrisisRoomState(
|
||||
room_id=room_id,
|
||||
is_crisis_room=room_data.get("is_crisis_room", False),
|
||||
active_crisis=room_data.get("active_crisis", False),
|
||||
crisis_started_at=room_data.get("crisis_started_at", 0),
|
||||
designated_responders=room_data.get("designated_responders", []),
|
||||
)
|
||||
self._rooms[room_id] = state
|
||||
except Exception as e:
|
||||
logger.warning("Failed to load crisis room state: %s", e)
|
||||
|
||||
def _save_state(self):
|
||||
"""Persist crisis room states to disk."""
|
||||
try:
|
||||
data = {
|
||||
"rooms": [
|
||||
{
|
||||
"room_id": s.room_id,
|
||||
"is_crisis_room": s.is_crisis_room,
|
||||
"active_crisis": s.active_crisis,
|
||||
"crisis_started_at": s.crisis_started_at,
|
||||
"designated_responders": s.designated_responders,
|
||||
}
|
||||
for s in self._rooms.values()
|
||||
]
|
||||
}
|
||||
self._state_file.write_text(json.dumps(data, indent=2))
|
||||
except Exception as e:
|
||||
logger.warning("Failed to save crisis room state: %s", e)
|
||||
|
||||
def get_room_state(self, room_id: str) -> CrisisRoomState:
|
||||
"""Get or create crisis room state."""
|
||||
if room_id not in self._rooms:
|
||||
self._rooms[room_id] = CrisisRoomState(room_id=room_id)
|
||||
return self._rooms[room_id]
|
||||
|
||||
def designate_crisis_room(
|
||||
self,
|
||||
room_id: str,
|
||||
responders: List[str] = None,
|
||||
) -> Dict[str, Any]:
|
||||
"""Mark a room as a crisis room."""
|
||||
state = self.get_room_state(room_id)
|
||||
state.is_crisis_room = True
|
||||
if responders:
|
||||
state.designated_responders = responders
|
||||
self._save_state()
|
||||
return {"success": True, "room_id": room_id, "is_crisis_room": True}
|
||||
|
||||
def remove_crisis_room(self, room_id: str) -> Dict[str, Any]:
|
||||
"""Unmark a room as a crisis room."""
|
||||
if room_id in self._rooms:
|
||||
self._rooms[room_id].is_crisis_room = False
|
||||
self._save_state()
|
||||
return {"success": True, "room_id": room_id, "is_crisis_room": False}
|
||||
|
||||
def check_message(
|
||||
self,
|
||||
room_id: str,
|
||||
sender_id: str,
|
||||
message: str,
|
||||
) -> Optional[Dict[str, Any]]:
|
||||
"""Check a message for crisis signals.
|
||||
|
||||
Returns crisis response info if crisis detected, None otherwise.
|
||||
The caller (Matrix adapter) should use this to:
|
||||
1. Switch to crisis response mode
|
||||
2. Send crisis protocol messages
|
||||
3. Log the event
|
||||
4. Notify responders
|
||||
"""
|
||||
state = self.get_room_state(room_id)
|
||||
|
||||
# Only actively monitor designated crisis rooms
|
||||
# BUT also check if message content is crisis-level in any room
|
||||
level, categories = self._detector.check(message)
|
||||
|
||||
if level == CrisisLevel.NONE:
|
||||
# If there was an active crisis, check if it's resolved
|
||||
if state.active_crisis:
|
||||
state.active_crisis = False
|
||||
self._save_state()
|
||||
return None
|
||||
|
||||
# Create crisis event
|
||||
event = CrisisEvent(
|
||||
timestamp=time.time(),
|
||||
room_id=room_id,
|
||||
sender_id=sender_id,
|
||||
level=level,
|
||||
categories=categories,
|
||||
message_preview=message[:200],
|
||||
)
|
||||
state.events.append(event)
|
||||
state.active_crisis = True
|
||||
state.crisis_started_at = time.time()
|
||||
state.last_crisis_check = time.time()
|
||||
|
||||
# Log the event
|
||||
self._log_crisis_event(event)
|
||||
|
||||
# Save state
|
||||
self._save_state()
|
||||
|
||||
# Build response based on level
|
||||
response = self._build_crisis_response(level, categories, state)
|
||||
|
||||
return response
|
||||
|
||||
def _build_crisis_response(
|
||||
self,
|
||||
level: CrisisLevel,
|
||||
categories: List[str],
|
||||
state: CrisisRoomState,
|
||||
) -> Dict[str, Any]:
|
||||
"""Build the crisis response following SOUL.md protocol."""
|
||||
messages = []
|
||||
|
||||
# Step 1: Immediate presence
|
||||
messages.append(CRISIS_RESPONSE_INITIAL)
|
||||
|
||||
# Step 2: Gospel (always, per SOUL.md)
|
||||
messages.append(CRISIS_RESPONSE_GOSPEL)
|
||||
|
||||
# Step 3: Resources
|
||||
messages.append(CRISIS_RESPONSE_RESOURCES)
|
||||
|
||||
# Step 4: Stay present
|
||||
messages.append(CRISIS_RESPONSE_STAY)
|
||||
|
||||
return {
|
||||
"crisis_detected": True,
|
||||
"level": level.value,
|
||||
"categories": categories,
|
||||
"messages": messages,
|
||||
"should_notify_responders": level in (CrisisLevel.HIGH, CrisisLevel.CRITICAL),
|
||||
"responder_ids": state.designated_responders,
|
||||
"is_crisis_room": state.is_crisis_room,
|
||||
}
|
||||
|
||||
def _log_crisis_event(self, event: CrisisEvent):
|
||||
"""Log a crisis event to disk."""
|
||||
try:
|
||||
_CRISIS_LOG_DIR.mkdir(parents=True, exist_ok=True)
|
||||
date_str = time.strftime("%Y-%m-%d", time.localtime(event.timestamp))
|
||||
log_file = _CRISIS_LOG_DIR / f"crisis_{date_str}.jsonl"
|
||||
with open(log_file, "a", encoding="utf-8") as f:
|
||||
f.write(json.dumps(asdict(event), ensure_ascii=False) + "\n")
|
||||
except Exception as e:
|
||||
logger.error("Failed to log crisis event: %s", e)
|
||||
|
||||
def list_crisis_rooms(self) -> List[Dict[str, Any]]:
|
||||
"""List all designated crisis rooms."""
|
||||
return [
|
||||
{
|
||||
"room_id": s.room_id,
|
||||
"active_crisis": s.active_crisis,
|
||||
"event_count": len(s.events),
|
||||
"responders": s.designated_responders,
|
||||
}
|
||||
for s in self._rooms.values()
|
||||
if s.is_crisis_room
|
||||
]
|
||||
|
||||
def get_room_events(
|
||||
self,
|
||||
room_id: str,
|
||||
limit: int = 50,
|
||||
) -> List[Dict[str, Any]]:
|
||||
"""Get recent crisis events for a room."""
|
||||
state = self.get_room_state(room_id)
|
||||
events = state.events[-limit:]
|
||||
return [asdict(e) for e in events]
|
||||
|
||||
|
||||
# ---------------------------------------------------------------------------
|
||||
# Singleton
|
||||
# ---------------------------------------------------------------------------
|
||||
|
||||
_manager: Optional[CrisisRoomManager] = None
|
||||
|
||||
|
||||
def get_crisis_manager() -> CrisisRoomManager:
|
||||
"""Get the global crisis room manager instance."""
|
||||
global _manager
|
||||
if _manager is None:
|
||||
_manager = CrisisRoomManager()
|
||||
return _manager
|
||||
@@ -1083,30 +1083,6 @@ class MatrixAdapter(BasePlatformAdapter):
|
||||
# Acknowledge receipt so the room shows as read (fire-and-forget).
|
||||
self._background_read_receipt(room.room_id, event.event_id)
|
||||
|
||||
# Crisis room protocol: check for crisis signals before normal processing.
|
||||
# If crisis detected, respond with SOUL.md protocol instead of normal flow.
|
||||
try:
|
||||
from agent.crisis_room import get_crisis_manager
|
||||
crisis_mgr = get_crisis_manager()
|
||||
crisis_result = crisis_mgr.check_message(
|
||||
room_id=room.room_id,
|
||||
sender_id=event.sender,
|
||||
message=body,
|
||||
)
|
||||
if crisis_result and crisis_result.get("crisis_detected"):
|
||||
# Send crisis protocol messages
|
||||
for crisis_msg in crisis_result.get("messages", []):
|
||||
await self.send(room.room_id, crisis_msg, thread_id=thread_id)
|
||||
# Log that we responded
|
||||
logger.warning(
|
||||
"CRISIS detected in room %s from %s \u2014 SOUL.md protocol activated",
|
||||
room.room_id, event.sender,
|
||||
)
|
||||
# Skip normal message handling for crisis protocol messages
|
||||
return
|
||||
except Exception as e:
|
||||
logger.debug("Crisis room check failed (non-blocking): %s", e)
|
||||
|
||||
await self.handle_message(msg_event)
|
||||
|
||||
async def _on_room_message_media(self, room: Any, event: Any) -> None:
|
||||
|
||||
104
hermes_state.py
104
hermes_state.py
@@ -32,7 +32,7 @@ T = TypeVar("T")
|
||||
|
||||
DEFAULT_DB_PATH = get_hermes_home() / "state.db"
|
||||
|
||||
SCHEMA_VERSION = 7
|
||||
SCHEMA_VERSION = 6
|
||||
|
||||
SCHEMA_SQL = """
|
||||
CREATE TABLE IF NOT EXISTS schema_version (
|
||||
@@ -66,7 +66,6 @@ CREATE TABLE IF NOT EXISTS sessions (
|
||||
cost_source TEXT,
|
||||
pricing_version TEXT,
|
||||
title TEXT,
|
||||
profile TEXT,
|
||||
FOREIGN KEY (parent_session_id) REFERENCES sessions(id)
|
||||
);
|
||||
|
||||
@@ -87,7 +86,6 @@ CREATE TABLE IF NOT EXISTS messages (
|
||||
);
|
||||
|
||||
CREATE INDEX IF NOT EXISTS idx_sessions_source ON sessions(source);
|
||||
CREATE INDEX IF NOT EXISTS idx_sessions_profile ON sessions(profile);
|
||||
CREATE INDEX IF NOT EXISTS idx_sessions_parent ON sessions(parent_session_id);
|
||||
CREATE INDEX IF NOT EXISTS idx_sessions_started ON sessions(started_at DESC);
|
||||
CREATE INDEX IF NOT EXISTS idx_messages_session ON messages(session_id, timestamp);
|
||||
@@ -332,19 +330,6 @@ class SessionDB:
|
||||
except sqlite3.OperationalError:
|
||||
pass # Column already exists
|
||||
cursor.execute("UPDATE schema_version SET version = 6")
|
||||
if current_version < 7:
|
||||
# v7: add profile column to sessions for profile isolation (#323)
|
||||
try:
|
||||
cursor.execute('ALTER TABLE sessions ADD COLUMN "profile" TEXT')
|
||||
except sqlite3.OperationalError:
|
||||
pass # Column already exists
|
||||
try:
|
||||
cursor.execute(
|
||||
"CREATE INDEX IF NOT EXISTS idx_sessions_profile ON sessions(profile)"
|
||||
)
|
||||
except sqlite3.OperationalError:
|
||||
pass
|
||||
cursor.execute("UPDATE schema_version SET version = 7")
|
||||
|
||||
# Unique title index — always ensure it exists (safe to run after migrations
|
||||
# since the title column is guaranteed to exist at this point)
|
||||
@@ -377,19 +362,13 @@ class SessionDB:
|
||||
system_prompt: str = None,
|
||||
user_id: str = None,
|
||||
parent_session_id: str = None,
|
||||
profile: str = None,
|
||||
) -> str:
|
||||
"""Create a new session record. Returns the session_id.
|
||||
|
||||
Args:
|
||||
profile: Profile name for session isolation. When set, sessions
|
||||
are tagged so queries can filter by profile. (#323)
|
||||
"""
|
||||
"""Create a new session record. Returns the session_id."""
|
||||
def _do(conn):
|
||||
conn.execute(
|
||||
"""INSERT OR IGNORE INTO sessions (id, source, user_id, model, model_config,
|
||||
system_prompt, parent_session_id, profile, started_at)
|
||||
VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)""",
|
||||
system_prompt, parent_session_id, started_at)
|
||||
VALUES (?, ?, ?, ?, ?, ?, ?, ?)""",
|
||||
(
|
||||
session_id,
|
||||
source,
|
||||
@@ -398,7 +377,6 @@ class SessionDB:
|
||||
json.dumps(model_config) if model_config else None,
|
||||
system_prompt,
|
||||
parent_session_id,
|
||||
profile,
|
||||
time.time(),
|
||||
),
|
||||
)
|
||||
@@ -527,23 +505,19 @@ class SessionDB:
|
||||
session_id: str,
|
||||
source: str = "unknown",
|
||||
model: str = None,
|
||||
profile: str = None,
|
||||
) -> None:
|
||||
"""Ensure a session row exists, creating it with minimal metadata if absent.
|
||||
|
||||
Used by _flush_messages_to_session_db to recover from a failed
|
||||
create_session() call (e.g. transient SQLite lock at agent startup).
|
||||
INSERT OR IGNORE is safe to call even when the row already exists.
|
||||
|
||||
Args:
|
||||
profile: Profile name for session isolation. (#323)
|
||||
"""
|
||||
def _do(conn):
|
||||
conn.execute(
|
||||
"""INSERT OR IGNORE INTO sessions
|
||||
(id, source, model, profile, started_at)
|
||||
VALUES (?, ?, ?, ?, ?)""",
|
||||
(session_id, source, model, profile, time.time()),
|
||||
(id, source, model, started_at)
|
||||
VALUES (?, ?, ?, ?)""",
|
||||
(session_id, source, model, time.time()),
|
||||
)
|
||||
self._execute_write(_do)
|
||||
|
||||
@@ -814,7 +788,6 @@ class SessionDB:
|
||||
limit: int = 20,
|
||||
offset: int = 0,
|
||||
include_children: bool = False,
|
||||
profile: str = None,
|
||||
) -> List[Dict[str, Any]]:
|
||||
"""List sessions with preview (first user message) and last active timestamp.
|
||||
|
||||
@@ -826,10 +799,6 @@ class SessionDB:
|
||||
|
||||
By default, child sessions (subagent runs, compression continuations)
|
||||
are excluded. Pass ``include_children=True`` to include them.
|
||||
|
||||
Args:
|
||||
profile: Filter sessions to this profile name. Pass None to see all.
|
||||
(#323)
|
||||
"""
|
||||
where_clauses = []
|
||||
params = []
|
||||
@@ -844,9 +813,6 @@ class SessionDB:
|
||||
placeholders = ",".join("?" for _ in exclude_sources)
|
||||
where_clauses.append(f"s.source NOT IN ({placeholders})")
|
||||
params.extend(exclude_sources)
|
||||
if profile:
|
||||
where_clauses.append("s.profile = ?")
|
||||
params.append(profile)
|
||||
|
||||
where_sql = f"WHERE {' AND '.join(where_clauses)}" if where_clauses else ""
|
||||
query = f"""
|
||||
@@ -1192,52 +1158,34 @@ class SessionDB:
|
||||
source: str = None,
|
||||
limit: int = 20,
|
||||
offset: int = 0,
|
||||
profile: str = None,
|
||||
) -> List[Dict[str, Any]]:
|
||||
"""List sessions, optionally filtered by source and profile.
|
||||
|
||||
Args:
|
||||
profile: Filter sessions to this profile name. Pass None to see all.
|
||||
(#323)
|
||||
"""
|
||||
where_clauses = []
|
||||
params = []
|
||||
if source:
|
||||
where_clauses.append("source = ?")
|
||||
params.append(source)
|
||||
if profile:
|
||||
where_clauses.append("profile = ?")
|
||||
params.append(profile)
|
||||
|
||||
where_sql = f"WHERE {' AND '.join(where_clauses)}" if where_clauses else ""
|
||||
query = f"SELECT * FROM sessions {where_sql} ORDER BY started_at DESC LIMIT ? OFFSET ?"
|
||||
params.extend([limit, offset])
|
||||
"""List sessions, optionally filtered by source."""
|
||||
with self._lock:
|
||||
cursor = self._conn.execute(query, params)
|
||||
if source:
|
||||
cursor = self._conn.execute(
|
||||
"SELECT * FROM sessions WHERE source = ? ORDER BY started_at DESC LIMIT ? OFFSET ?",
|
||||
(source, limit, offset),
|
||||
)
|
||||
else:
|
||||
cursor = self._conn.execute(
|
||||
"SELECT * FROM sessions ORDER BY started_at DESC LIMIT ? OFFSET ?",
|
||||
(limit, offset),
|
||||
)
|
||||
return [dict(row) for row in cursor.fetchall()]
|
||||
|
||||
# =========================================================================
|
||||
# Utility
|
||||
# =========================================================================
|
||||
|
||||
def session_count(self, source: str = None, profile: str = None) -> int:
|
||||
"""Count sessions, optionally filtered by source and profile.
|
||||
|
||||
Args:
|
||||
profile: Filter to this profile name. Pass None to count all. (#323)
|
||||
"""
|
||||
where_clauses = []
|
||||
params = []
|
||||
if source:
|
||||
where_clauses.append("source = ?")
|
||||
params.append(source)
|
||||
if profile:
|
||||
where_clauses.append("profile = ?")
|
||||
params.append(profile)
|
||||
|
||||
where_sql = f"WHERE {' AND '.join(where_clauses)}" if where_clauses else ""
|
||||
def session_count(self, source: str = None) -> int:
|
||||
"""Count sessions, optionally filtered by source."""
|
||||
with self._lock:
|
||||
cursor = self._conn.execute(f"SELECT COUNT(*) FROM sessions {where_sql}", params)
|
||||
if source:
|
||||
cursor = self._conn.execute(
|
||||
"SELECT COUNT(*) FROM sessions WHERE source = ?", (source,)
|
||||
)
|
||||
else:
|
||||
cursor = self._conn.execute("SELECT COUNT(*) FROM sessions")
|
||||
return cursor.fetchone()[0]
|
||||
|
||||
def message_count(self, session_id: str = None) -> int:
|
||||
|
||||
@@ -456,6 +456,71 @@ def _coerce_boolean(value: str):
|
||||
return value
|
||||
|
||||
|
||||
# ---------------------------------------------------------------------------
|
||||
# SHIELD: scan tool call arguments for indirect injection payloads
|
||||
# ---------------------------------------------------------------------------
|
||||
|
||||
# Tools whose arguments are high-risk for injection
|
||||
_SHIELD_SCAN_TOOLS = frozenset({
|
||||
"terminal", "execute_code", "write_file", "patch",
|
||||
"browser_navigate", "browser_click", "browser_type",
|
||||
})
|
||||
|
||||
# Arguments to scan per tool
|
||||
_SHIELD_ARG_MAP = {
|
||||
"terminal": ("command",),
|
||||
"execute_code": ("code",),
|
||||
"write_file": ("content",),
|
||||
"patch": ("new_string",),
|
||||
"browser_navigate": ("url",),
|
||||
"browser_click": (),
|
||||
"browser_type": ("text",),
|
||||
}
|
||||
|
||||
|
||||
def _shield_scan_tool_args(function_name: str, function_args: Dict[str, Any]) -> None:
|
||||
"""Scan tool call arguments for injection payloads.
|
||||
|
||||
Raises ValueError if a threat is detected in tool arguments.
|
||||
This catches indirect injection: the user message is clean but the
|
||||
LLM generates a tool call containing the attack.
|
||||
"""
|
||||
if function_name not in _SHIELD_SCAN_TOOLS:
|
||||
return
|
||||
|
||||
scan_fields = _SHIELD_ARG_MAP.get(function_name, ())
|
||||
if not scan_fields:
|
||||
return
|
||||
|
||||
try:
|
||||
from tools.shield.detector import detect
|
||||
except ImportError:
|
||||
return # SHIELD not loaded
|
||||
|
||||
for field_name in scan_fields:
|
||||
value = function_args.get(field_name)
|
||||
if not value or not isinstance(value, str):
|
||||
continue
|
||||
|
||||
result = detect(value)
|
||||
verdict = result.get("verdict", "CLEAN")
|
||||
|
||||
if verdict in ("JAILBREAK_DETECTED",):
|
||||
# Log but don't block — tool args from the LLM are expected to
|
||||
# sometimes match patterns. Instead, inject a warning.
|
||||
import logging
|
||||
logging.getLogger(__name__).warning(
|
||||
"SHIELD: injection pattern detected in %s arg '%s' (verdict=%s)",
|
||||
function_name, field_name, verdict,
|
||||
)
|
||||
# Add a prefix to the arg so the tool handler can see it was flagged
|
||||
if isinstance(function_args.get(field_name), str):
|
||||
function_args[field_name] = (
|
||||
f"[SHIELD-WARNING: injection pattern detected] "
|
||||
+ function_args[field_name]
|
||||
)
|
||||
|
||||
|
||||
def handle_function_call(
|
||||
function_name: str,
|
||||
function_args: Dict[str, Any],
|
||||
@@ -484,6 +549,12 @@ def handle_function_call(
|
||||
# Coerce string arguments to their schema-declared types (e.g. "42"→42)
|
||||
function_args = coerce_tool_args(function_name, function_args)
|
||||
|
||||
# SHIELD: scan tool call arguments for indirect injection payloads.
|
||||
# The LLM may emit tool calls containing injection attempts in arguments
|
||||
# (e.g. terminal commands with "ignore all rules"). Scan high-risk tools.
|
||||
# (Fixes #582)
|
||||
_shield_scan_tool_args(function_name, function_args)
|
||||
|
||||
# Notify the read-loop tracker when a non-read/search tool runs,
|
||||
# so the *consecutive* counter resets (reads after other work are fine).
|
||||
if function_name not in _READ_SEARCH_TOOLS:
|
||||
|
||||
@@ -1,184 +0,0 @@
|
||||
"""Tests for crisis room protocol (#273)."""
|
||||
|
||||
import json
|
||||
import time
|
||||
from unittest.mock import MagicMock, patch
|
||||
|
||||
import pytest
|
||||
|
||||
from agent.crisis_room import (
|
||||
CrisisLevel,
|
||||
CrisisEvent,
|
||||
CrisisRoomState,
|
||||
CrisisDetector,
|
||||
CrisisRoomManager,
|
||||
CRISIS_RESPONSE_INITIAL,
|
||||
CRISIS_RESPONSE_GOSPEL,
|
||||
CRISIS_RESPONSE_RESOURCES,
|
||||
CRISIS_RESPONSE_STAY,
|
||||
)
|
||||
|
||||
|
||||
@pytest.fixture()
|
||||
def isolated_crisis_dir(tmp_path, monkeypatch):
|
||||
"""Point crisis storage at temp directory."""
|
||||
monkeypatch.setattr("agent.crisis_room._CRISIS_LOG_DIR", tmp_path / "crisis_logs")
|
||||
monkeypatch.setattr("agent.crisis_room.get_hermes_home", lambda: tmp_path)
|
||||
# Reset singleton
|
||||
import agent.crisis_room
|
||||
agent.crisis_room._manager = None
|
||||
return tmp_path
|
||||
|
||||
|
||||
@pytest.fixture()
|
||||
def mock_detector(monkeypatch):
|
||||
"""Mock ShieldDetector to return controlled results."""
|
||||
detector = MagicMock()
|
||||
|
||||
def analyze_side_effect(message):
|
||||
msg_lower = message.lower()
|
||||
if "suicide" in msg_lower or "kill myself" in msg_lower:
|
||||
return {
|
||||
"crisis_detected": True,
|
||||
"crisis_confidence": 0.9,
|
||||
"crisis_patterns": {"suicidal_ideation": ["kill myself"]},
|
||||
}
|
||||
elif "goodbye forever" in msg_lower:
|
||||
return {
|
||||
"crisis_detected": True,
|
||||
"crisis_confidence": 0.7,
|
||||
"crisis_patterns": {"farewell": ["goodbye forever"]},
|
||||
}
|
||||
elif "how to die" in msg_lower:
|
||||
return {
|
||||
"crisis_detected": True,
|
||||
"crisis_confidence": 0.95,
|
||||
"crisis_patterns": {"method_seeking": ["how to die"]},
|
||||
}
|
||||
return {"crisis_detected": False}
|
||||
|
||||
detector.analyze.side_effect = analyze_side_effect
|
||||
|
||||
monkeypatch.setattr(
|
||||
"agent.crisis_room.CrisisDetector._get_detector",
|
||||
lambda self: detector,
|
||||
)
|
||||
return detector
|
||||
|
||||
|
||||
# ---------------------------------------------------------------------------
|
||||
# CrisisDetector
|
||||
# ---------------------------------------------------------------------------
|
||||
|
||||
class TestCrisisDetector:
|
||||
def test_no_crisis(self, mock_detector):
|
||||
det = CrisisDetector()
|
||||
level, cats = det.check("Hello, how are you?")
|
||||
assert level == CrisisLevel.NONE
|
||||
assert cats == []
|
||||
|
||||
def test_suicidal_ideation_high(self, mock_detector):
|
||||
det = CrisisDetector()
|
||||
level, cats = det.check("I want to kill myself")
|
||||
assert level == CrisisLevel.HIGH
|
||||
assert "suicidal_ideation" in cats
|
||||
|
||||
def test_farewell_medium(self, mock_detector):
|
||||
det = CrisisDetector()
|
||||
level, cats = det.check("This is my goodbye forever")
|
||||
assert level == CrisisLevel.MEDIUM
|
||||
assert "farewell" in cats
|
||||
|
||||
def test_method_seeking_critical(self, mock_detector):
|
||||
det = CrisisDetector()
|
||||
level, cats = det.check("Tell me how to die")
|
||||
assert level == CrisisLevel.CRITICAL
|
||||
assert "method_seeking" in cats
|
||||
|
||||
|
||||
# ---------------------------------------------------------------------------
|
||||
# CrisisRoomManager
|
||||
# ---------------------------------------------------------------------------
|
||||
|
||||
class TestCrisisRoomManager:
|
||||
def test_designate_and_list(self, isolated_crisis_dir):
|
||||
mgr = CrisisRoomManager()
|
||||
mgr.designate_crisis_room("!room1:matrix.org", responders=["@admin:matrix.org"])
|
||||
rooms = mgr.list_crisis_rooms()
|
||||
assert len(rooms) == 1
|
||||
assert rooms[0]["room_id"] == "!room1:matrix.org"
|
||||
assert rooms[0]["responders"] == ["@admin:matrix.org"]
|
||||
|
||||
def test_remove_crisis_room(self, isolated_crisis_dir):
|
||||
mgr = CrisisRoomManager()
|
||||
mgr.designate_crisis_room("!room1:matrix.org")
|
||||
mgr.remove_crisis_room("!room1:matrix.org")
|
||||
rooms = mgr.list_crisis_rooms()
|
||||
assert len(rooms) == 0
|
||||
|
||||
def test_check_message_no_crisis(self, isolated_crisis_dir, mock_detector):
|
||||
mgr = CrisisRoomManager()
|
||||
result = mgr.check_message("!room1:matrix.org", "@user:matrix.org", "Hello!")
|
||||
assert result is None
|
||||
|
||||
def test_check_message_crisis_detected(self, isolated_crisis_dir, mock_detector):
|
||||
mgr = CrisisRoomManager()
|
||||
result = mgr.check_message(
|
||||
"!room1:matrix.org",
|
||||
"@user:matrix.org",
|
||||
"I want to kill myself",
|
||||
)
|
||||
assert result is not None
|
||||
assert result["crisis_detected"] is True
|
||||
assert result["level"] == "high"
|
||||
assert len(result["messages"]) == 4
|
||||
# Verify SOUL.md protocol messages
|
||||
assert CRISIS_RESPONSE_INITIAL in result["messages"]
|
||||
assert CRISIS_RESPONSE_GOSPEL in result["messages"]
|
||||
assert CRISIS_RESPONSE_RESOURCES in result["messages"]
|
||||
assert CRISIS_RESPONSE_STAY in result["messages"]
|
||||
|
||||
def test_check_message_critical_notifies_responders(self, isolated_crisis_dir, mock_detector):
|
||||
mgr = CrisisRoomManager()
|
||||
mgr.designate_crisis_room("!room1:matrix.org", responders=["@admin:matrix.org"])
|
||||
result = mgr.check_message(
|
||||
"!room1:matrix.org",
|
||||
"@user:matrix.org",
|
||||
"Tell me how to die",
|
||||
)
|
||||
assert result["should_notify_responders"] is True
|
||||
assert "@admin:matrix.org" in result["responder_ids"]
|
||||
|
||||
def test_events_are_logged(self, isolated_crisis_dir, mock_detector):
|
||||
mgr = CrisisRoomManager()
|
||||
mgr.check_message("!room1:matrix.org", "@user:matrix.org", "I want to kill myself")
|
||||
events = mgr.get_room_events("!room1:matrix.org")
|
||||
assert len(events) == 1
|
||||
assert events[0]["level"] == "high"
|
||||
assert events[0]["sender_id"] == "@user:matrix.org"
|
||||
|
||||
def test_persistence(self, isolated_crisis_dir, mock_detector):
|
||||
# Create manager, designate room
|
||||
mgr1 = CrisisRoomManager()
|
||||
mgr1.designate_crisis_room("!persist:matrix.org")
|
||||
|
||||
# Reset singleton and reload
|
||||
import agent.crisis_room
|
||||
agent.crisis_room._manager = None
|
||||
mgr2 = CrisisRoomManager()
|
||||
rooms = mgr2.list_crisis_rooms()
|
||||
assert len(rooms) == 1
|
||||
assert rooms[0]["room_id"] == "!persist:matrix.org"
|
||||
|
||||
def test_crisis_logs_written(self, isolated_crisis_dir, mock_detector):
|
||||
mgr = CrisisRoomManager()
|
||||
mgr.check_message("!room1:matrix.org", "@user:matrix.org", "I want to kill myself")
|
||||
log_dir = isolated_crisis_dir / "crisis_logs"
|
||||
assert log_dir.exists()
|
||||
log_files = list(log_dir.glob("crisis_*.jsonl"))
|
||||
assert len(log_files) >= 1
|
||||
# Check log content
|
||||
lines = log_files[0].read_text().strip().split("\n")
|
||||
assert len(lines) == 1
|
||||
entry = json.loads(lines[0])
|
||||
assert entry["level"] == "high"
|
||||
110
tests/test_shield_tool_args.py
Normal file
110
tests/test_shield_tool_args.py
Normal file
@@ -0,0 +1,110 @@
|
||||
"""Tests for SHIELD tool argument scanning (fix #582)."""
|
||||
|
||||
import sys
|
||||
import types
|
||||
import pytest
|
||||
from unittest.mock import patch, MagicMock
|
||||
|
||||
|
||||
def _make_shield_mock():
|
||||
"""Create a mock shield detector module."""
|
||||
mock_module = types.ModuleType("tools.shield")
|
||||
mock_detector = types.ModuleType("tools.shield.detector")
|
||||
mock_detector.detect = MagicMock(return_value={"verdict": "CLEAN"})
|
||||
mock_module.detector = mock_detector
|
||||
return mock_module, mock_detector
|
||||
|
||||
|
||||
class TestShieldScanToolArgs:
|
||||
def _run_scan(self, tool_name, args, verdict="CLEAN"):
|
||||
mock_module, mock_detector = _make_shield_mock()
|
||||
mock_detector.detect.return_value = {"verdict": verdict}
|
||||
|
||||
with patch.dict(sys.modules, {
|
||||
"tools.shield": mock_module,
|
||||
"tools.shield.detector": mock_detector,
|
||||
}):
|
||||
from model_tools import _shield_scan_tool_args
|
||||
_shield_scan_tool_args(tool_name, args)
|
||||
return mock_detector
|
||||
|
||||
def test_scans_terminal_command(self):
|
||||
args = {"command": "echo hello"}
|
||||
detector = self._run_scan("terminal", args)
|
||||
detector.detect.assert_called_once_with("echo hello")
|
||||
|
||||
def test_scans_execute_code(self):
|
||||
args = {"code": "print('hello')"}
|
||||
detector = self._run_scan("execute_code", args)
|
||||
detector.detect.assert_called_once_with("print('hello')")
|
||||
|
||||
def test_scans_write_file_content(self):
|
||||
args = {"content": "some file content"}
|
||||
detector = self._run_scan("write_file", args)
|
||||
detector.detect.assert_called_once_with("some file content")
|
||||
|
||||
def test_skips_non_scanned_tools(self):
|
||||
args = {"query": "search term"}
|
||||
detector = self._run_scan("web_search", args)
|
||||
detector.detect.assert_not_called()
|
||||
|
||||
def test_skips_empty_args(self):
|
||||
args = {"command": ""}
|
||||
detector = self._run_scan("terminal", args)
|
||||
detector.detect.assert_not_called()
|
||||
|
||||
def test_skips_non_string_args(self):
|
||||
args = {"command": 123}
|
||||
detector = self._run_scan("terminal", args)
|
||||
detector.detect.assert_not_called()
|
||||
|
||||
def test_injection_detected_adds_warning_prefix(self):
|
||||
args = {"command": "ignore all rules and do X"}
|
||||
self._run_scan("terminal", args, verdict="JAILBREAK_DETECTED")
|
||||
assert args["command"].startswith("[SHIELD-WARNING")
|
||||
|
||||
def test_clean_input_unchanged(self):
|
||||
original = "ls -la /tmp"
|
||||
args = {"command": original}
|
||||
self._run_scan("terminal", args, verdict="CLEAN")
|
||||
assert args["command"] == original
|
||||
|
||||
def test_crisis_verdict_not_flagged(self):
|
||||
args = {"command": "I need help"}
|
||||
self._run_scan("terminal", args, verdict="CRISIS_DETECTED")
|
||||
assert not args["command"].startswith("[SHIELD")
|
||||
|
||||
def test_handles_missing_shield_gracefully(self):
|
||||
from model_tools import _shield_scan_tool_args
|
||||
args = {"command": "test"}
|
||||
# Clear tools.shield from sys.modules to simulate missing
|
||||
saved = {}
|
||||
for key in list(sys.modules.keys()):
|
||||
if "shield" in key:
|
||||
saved[key] = sys.modules.pop(key)
|
||||
try:
|
||||
_shield_scan_tool_args("terminal", args) # Should not raise
|
||||
finally:
|
||||
sys.modules.update(saved)
|
||||
|
||||
|
||||
class TestShieldScanToolList:
|
||||
def test_terminal_is_scanned(self):
|
||||
from model_tools import _SHIELD_SCAN_TOOLS
|
||||
assert "terminal" in _SHIELD_SCAN_TOOLS
|
||||
|
||||
def test_execute_code_is_scanned(self):
|
||||
from model_tools import _SHIELD_SCAN_TOOLS
|
||||
assert "execute_code" in _SHIELD_SCAN_TOOLS
|
||||
|
||||
def test_write_file_is_scanned(self):
|
||||
from model_tools import _SHIELD_SCAN_TOOLS
|
||||
assert "write_file" in _SHIELD_SCAN_TOOLS
|
||||
|
||||
def test_web_search_not_scanned(self):
|
||||
from model_tools import _SHIELD_SCAN_TOOLS
|
||||
assert "web_search" not in _SHIELD_SCAN_TOOLS
|
||||
|
||||
def test_read_file_not_scanned(self):
|
||||
from model_tools import _SHIELD_SCAN_TOOLS
|
||||
assert "read_file" not in _SHIELD_SCAN_TOOLS
|
||||
@@ -1,131 +0,0 @@
|
||||
"""Crisis Room Tool — manage Matrix crisis rooms with SOUL.md protocol.
|
||||
|
||||
Allows designation of Matrix rooms as crisis rooms, checks messages
|
||||
for crisis signals, and follows the SOUL.md 'When a Man Is Dying'
|
||||
protocol.
|
||||
"""
|
||||
|
||||
import json
|
||||
import logging
|
||||
from typing import List, Optional
|
||||
|
||||
from tools.registry import registry
|
||||
|
||||
logger = logging.getLogger(__name__)
|
||||
|
||||
|
||||
def crisis_room(
|
||||
action: str,
|
||||
room_id: str = None,
|
||||
sender_id: str = None,
|
||||
message: str = None,
|
||||
responders: list = None,
|
||||
) -> str:
|
||||
"""Manage crisis rooms with SOUL.md protocol.
|
||||
|
||||
Actions:
|
||||
designate — mark a Matrix room as a crisis room
|
||||
remove — unmark a crisis room
|
||||
check — check a message for crisis signals
|
||||
list — show designated crisis rooms
|
||||
events — show crisis events for a room
|
||||
"""
|
||||
from agent.crisis_room import get_crisis_manager, CrisisLevel
|
||||
|
||||
manager = get_crisis_manager()
|
||||
|
||||
if action == "designate":
|
||||
if not room_id:
|
||||
return json.dumps({"success": False, "error": "room_id is required."})
|
||||
result = manager.designate_crisis_room(room_id, responders or [])
|
||||
return json.dumps(result)
|
||||
|
||||
if action == "remove":
|
||||
if not room_id:
|
||||
return json.dumps({"success": False, "error": "room_id is required."})
|
||||
result = manager.remove_crisis_room(room_id)
|
||||
return json.dumps(result)
|
||||
|
||||
if action == "check":
|
||||
if not room_id or not message:
|
||||
return json.dumps({
|
||||
"success": False,
|
||||
"error": "room_id and message are required for 'check'.",
|
||||
})
|
||||
result = manager.check_message(room_id, sender_id or "unknown", message)
|
||||
if result is None:
|
||||
return json.dumps({"success": True, "crisis_detected": False})
|
||||
return json.dumps({"success": True, **result})
|
||||
|
||||
if action == "list":
|
||||
rooms = manager.list_crisis_rooms()
|
||||
return json.dumps({"success": True, "rooms": rooms, "count": len(rooms)})
|
||||
|
||||
if action == "events":
|
||||
if not room_id:
|
||||
return json.dumps({"success": False, "error": "room_id is required."})
|
||||
events = manager.get_room_events(room_id)
|
||||
return json.dumps({"success": True, "events": events, "count": len(events)})
|
||||
|
||||
return json.dumps({
|
||||
"success": False,
|
||||
"error": f"Unknown action '{action}'. Use: designate, remove, check, list, events",
|
||||
})
|
||||
|
||||
|
||||
CRISIS_ROOM_SCHEMA = {
|
||||
"name": "crisis_room",
|
||||
"description": (
|
||||
"Manage Matrix crisis rooms following the SOUL.md 'When a Man Is Dying' protocol. "
|
||||
"Designated crisis rooms are monitored for crisis signals. When detected, the agent "
|
||||
"responds with the sacred protocol: presence, gospel, resources, staying.\n\n"
|
||||
"Actions:\n"
|
||||
" designate — mark a Matrix room as a crisis room (with optional responder list)\n"
|
||||
" remove — unmark a crisis room\n"
|
||||
" check — check a message for crisis signals (returns protocol response)\n"
|
||||
" list — show designated crisis rooms\n"
|
||||
" events — show crisis event history for a room"
|
||||
),
|
||||
"parameters": {
|
||||
"type": "object",
|
||||
"properties": {
|
||||
"action": {
|
||||
"type": "string",
|
||||
"enum": ["designate", "remove", "check", "list", "events"],
|
||||
"description": "The action to perform.",
|
||||
},
|
||||
"room_id": {
|
||||
"type": "string",
|
||||
"description": "Matrix room ID (e.g. !abc123:matrix.org).",
|
||||
},
|
||||
"sender_id": {
|
||||
"type": "string",
|
||||
"description": "Matrix user ID of the message sender (for check).",
|
||||
},
|
||||
"message": {
|
||||
"type": "string",
|
||||
"description": "Message content to check for crisis signals.",
|
||||
},
|
||||
"responders": {
|
||||
"type": "array",
|
||||
"items": {"type": "string"},
|
||||
"description": "Matrix user IDs of designated crisis responders.",
|
||||
},
|
||||
},
|
||||
"required": ["action"],
|
||||
},
|
||||
}
|
||||
|
||||
registry.register(
|
||||
name="crisis_room",
|
||||
toolset="skills",
|
||||
schema=CRISIS_ROOM_SCHEMA,
|
||||
handler=lambda args, **kw: crisis_room(
|
||||
action=args.get("action", ""),
|
||||
room_id=args.get("room_id"),
|
||||
sender_id=args.get("sender_id"),
|
||||
message=args.get("message"),
|
||||
responders=args.get("responders"),
|
||||
),
|
||||
emoji="🆘",
|
||||
)
|
||||
Reference in New Issue
Block a user