mirror of
https://gitcode.com/JianFeeeee/ModelRouter.git
synced 2026-09-20 00:48:00 +00:00
fix(adapters): sanitize tool-call ids so one bad upstream can't kill every Claude slot
Anthropic requires tool_use.id / tool_result.tool_use_id to match
^[a-zA-Z0-9_-]{1,64}$ and rejects the WHOLE request otherwise with
REQUEST_BODY_INVALID / "Invalid tool use format". OpenAI has no such rule, so
an OpenAI-compatible model can mint an id like "bash:0"
(xinjianya/moonshotai/kimi-k3 does exactly that).
In a fan-out router that id does not stay local: the client stores it in its
history and replays it to every other source. One such id therefore kills
every Claude slot at once — justwoker, tabitoken and 扇贝 are all
Claude-behind-{OpenAI,Anthropic} — and an AUTO request falls through all four
tiers to whatever tolerant model is left. Observed live: 4 consecutive 503
"all N auto providers failed" with tier 1/2/3 each reporting the same 400.
Both directions are sanitized, in both adapters:
- request: tool_calls[].id and tool_call_id, so poisoned history recovers
- response: non-streaming tool_calls[].id and the first streamed fragment,
so a bad id never enters a client session in the first place
safe_tool_id is pure and deterministic, so a call and its result are rewritten
identically within one request. A rewritten id keeps an 8-hex digest of the
original, without which distinct ids could collapse ("a:b" and "a_b") into a
duplicate/unpaired tool_use. Already-legal ids pass through byte-identical, so
well-behaved traffic is unaffected. openai.lua carries its own copy because
Lua adapters have no shared prelude.
Streamed argument fragments carry no id and must stay id-less, otherwise
index-based accumulation on the client breaks; a test pins that.
This commit is contained in:
JianFeeeee
@ -4,6 +4,7 @@ import (
|
||||
"encoding/json"
|
||||
"os"
|
||||
"path/filepath"
|
||||
"regexp"
|
||||
"strings"
|
||||
"sync"
|
||||
"testing"
|
||||
@ -1599,3 +1600,262 @@ func TestTraeTextToolCallRecovery(t *testing.T) {
|
||||
t.Errorf("plain answer finish_reason changed: %s", out)
|
||||
}
|
||||
}
|
||||
|
||||
// TestToolIDSanitize locks the tool-call id sanitizer in both adapters that
|
||||
// talk to Claude upstreams. Anthropic requires tool_use.id /
|
||||
// tool_result.tool_use_id to match ^[a-zA-Z0-9_-]{1,64}$ and rejects the WHOLE
|
||||
// request otherwise (REQUEST_BODY_INVALID / "Invalid tool use format"), while
|
||||
// OpenAI has no such rule — so an OpenAI-compatible model can mint "bash:0"
|
||||
// (observed from moonshotai/kimi-k3) and poison a client's history, killing
|
||||
// every Claude slot on replay. tabitoken/扇贝 are Claude-behind-OpenAI, so
|
||||
// openai.lua needs the same treatment as anthropic.lua.
|
||||
func TestToolIDSanitize(t *testing.T) {
|
||||
vm := NewVM(freshAdapterDir(t))
|
||||
if err := vm.Start(); err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
defer vm.Stop()
|
||||
|
||||
legal := regexp.MustCompile(`^[a-zA-Z0-9_-]{1,64}$`)
|
||||
long := strings.Repeat("a", 200)
|
||||
|
||||
body := func(id string) string {
|
||||
b, err := json.Marshal(map[string]interface{}{
|
||||
"model": "x",
|
||||
"messages": []interface{}{
|
||||
map[string]interface{}{"role": "user", "content": "run whoami"},
|
||||
map[string]interface{}{"role": "assistant", "content": "", "tool_calls": []interface{}{
|
||||
map[string]interface{}{"id": id, "type": "function",
|
||||
"function": map[string]interface{}{"name": "bash", "arguments": `{"command":"whoami"}`}},
|
||||
}},
|
||||
map[string]interface{}{"role": "tool", "tool_call_id": id, "content": "root"},
|
||||
},
|
||||
})
|
||||
if err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
return string(b)
|
||||
}
|
||||
|
||||
// ---- anthropic: tool_use.id and tool_result.tool_use_id must agree ----
|
||||
for _, id := range []string{"bash:0", "call_ok_123", long, "toolu~sig1:AB+/=="} {
|
||||
out, err := vm.Transform("anthropic", "transform_request", body(id))
|
||||
if err != nil {
|
||||
t.Fatalf("anthropic transform %q: %v", id, err)
|
||||
}
|
||||
var r struct {
|
||||
Messages []struct {
|
||||
Content []struct {
|
||||
Type string `json:"type"`
|
||||
ID string `json:"id"`
|
||||
ToolUseID string `json:"tool_use_id"`
|
||||
} `json:"content"`
|
||||
} `json:"messages"`
|
||||
}
|
||||
if err := json.Unmarshal([]byte(out), &r); err != nil {
|
||||
t.Fatalf("anthropic unmarshal %q: %v (%s)", id, err, out)
|
||||
}
|
||||
var useID, resID string
|
||||
for _, m := range r.Messages {
|
||||
for _, c := range m.Content {
|
||||
switch c.Type {
|
||||
case "tool_use":
|
||||
useID = c.ID
|
||||
case "tool_result":
|
||||
resID = c.ToolUseID
|
||||
}
|
||||
}
|
||||
}
|
||||
if !legal.MatchString(useID) {
|
||||
t.Errorf("anthropic %q: tool_use.id %q violates Anthropic's id pattern", id, useID)
|
||||
}
|
||||
if useID != resID {
|
||||
t.Errorf("anthropic %q: tool_use.id %q != tool_result.tool_use_id %q (unpaired call)", id, useID, resID)
|
||||
}
|
||||
if legal.MatchString(id) && useID != id {
|
||||
t.Errorf("anthropic %q: already-legal id must pass through untouched, got %q", id, useID)
|
||||
}
|
||||
}
|
||||
|
||||
// ---- openai: same rewrite, and both sites must stay in sync ----
|
||||
for _, id := range []string{"bash:0", "call_ok_123", long} {
|
||||
out, err := vm.Transform("openai", "transform_request", body(id))
|
||||
if err != nil {
|
||||
t.Fatalf("openai transform %q: %v", id, err)
|
||||
}
|
||||
var r struct {
|
||||
Messages []struct {
|
||||
Role string `json:"role"`
|
||||
ToolCalls []struct {
|
||||
ID string `json:"id"`
|
||||
} `json:"tool_calls"`
|
||||
ToolCallID string `json:"tool_call_id"`
|
||||
} `json:"messages"`
|
||||
}
|
||||
if err := json.Unmarshal([]byte(out), &r); err != nil {
|
||||
t.Fatalf("openai unmarshal %q: %v (%s)", id, err, out)
|
||||
}
|
||||
var callID, resID string
|
||||
for _, m := range r.Messages {
|
||||
if len(m.ToolCalls) > 0 {
|
||||
callID = m.ToolCalls[0].ID
|
||||
}
|
||||
if m.Role == "tool" {
|
||||
resID = m.ToolCallID
|
||||
}
|
||||
}
|
||||
if !legal.MatchString(callID) {
|
||||
t.Errorf("openai %q: tool_calls[0].id %q still illegal for Claude-behind-OpenAI upstreams", id, callID)
|
||||
}
|
||||
if callID != resID {
|
||||
t.Errorf("openai %q: tool_calls id %q != tool_call_id %q (unpaired call)", id, callID, resID)
|
||||
}
|
||||
if legal.MatchString(id) && callID != id {
|
||||
t.Errorf("openai %q: already-legal id must pass through untouched, got %q", id, callID)
|
||||
}
|
||||
}
|
||||
|
||||
// ---- distinct dirty ids must NOT collapse into one (digest suffix) ----
|
||||
seen := map[string]string{}
|
||||
for _, id := range []string{"a:b", "a_b", "a-b", "a b", "a/b"} {
|
||||
out, err := vm.Transform("anthropic", "transform_request", body(id))
|
||||
if err != nil {
|
||||
t.Fatalf("collision probe %q: %v", id, err)
|
||||
}
|
||||
var r struct {
|
||||
Messages []struct {
|
||||
Content []struct {
|
||||
Type string `json:"type"`
|
||||
ID string `json:"id"`
|
||||
} `json:"content"`
|
||||
} `json:"messages"`
|
||||
}
|
||||
if err := json.Unmarshal([]byte(out), &r); err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
got := ""
|
||||
for _, m := range r.Messages {
|
||||
for _, c := range m.Content {
|
||||
if c.Type == "tool_use" {
|
||||
got = c.ID
|
||||
}
|
||||
}
|
||||
}
|
||||
if prev, dup := seen[got]; dup {
|
||||
t.Errorf("ids %q and %q both map to %q — a collision makes a duplicate tool_use", prev, id, got)
|
||||
}
|
||||
seen[got] = id
|
||||
}
|
||||
|
||||
// ---- determinism: same input, same output ----
|
||||
a, _ := vm.Transform("anthropic", "transform_request", body("bash:0"))
|
||||
b, _ := vm.Transform("anthropic", "transform_request", body("bash:0"))
|
||||
if a != b {
|
||||
t.Errorf("sanitizer is not deterministic:\n%s\n%s", a, b)
|
||||
}
|
||||
}
|
||||
|
||||
// TestToolIDSanitizeResponse locks the OUTBOUND half of the sanitizer. The
|
||||
// request-side rewrite alone is not enough: an id minted by a permissive
|
||||
// OpenAI-compatible upstream (moonshotai/kimi-k3 returns "bash:0") is handed to
|
||||
// the client, stored in its history, and replayed forever after. Sanitizing on
|
||||
// the way out means a poisoned id never enters a client session in the first
|
||||
// place — both for non-streaming responses and for the first fragment of a
|
||||
// streamed tool call (later argument fragments carry no id).
|
||||
func TestToolIDSanitizeResponse(t *testing.T) {
|
||||
vm := NewVM(freshAdapterDir(t))
|
||||
if err := vm.Start(); err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
defer vm.Stop()
|
||||
|
||||
legal := regexp.MustCompile(`^[a-zA-Z0-9_-]{1,64}$`)
|
||||
|
||||
// ---- openai non-streaming ----
|
||||
resp := `{"choices":[{"message":{"role":"assistant","content":null,"tool_calls":[
|
||||
{"id":"bash:0","type":"function","function":{"name":"bash","arguments":"{\"command\":\"whoami\"}"}}]},
|
||||
"finish_reason":"tool_calls"}]}`
|
||||
out, err := vm.Transform("openai", "transform_response", resp)
|
||||
if err != nil {
|
||||
t.Fatalf("openai transform_response: %v", err)
|
||||
}
|
||||
var r struct {
|
||||
ToolCalls []struct {
|
||||
ID string `json:"id"`
|
||||
} `json:"tool_calls"`
|
||||
}
|
||||
if err := json.Unmarshal([]byte(out), &r); err != nil {
|
||||
t.Fatalf("unmarshal: %v (%s)", err, out)
|
||||
}
|
||||
if len(r.ToolCalls) != 1 {
|
||||
t.Fatalf("tool_calls lost: %s", out)
|
||||
}
|
||||
if !legal.MatchString(r.ToolCalls[0].ID) {
|
||||
t.Errorf("non-stream response leaks illegal id %q to the client", r.ToolCalls[0].ID)
|
||||
}
|
||||
nonStreamID := r.ToolCalls[0].ID
|
||||
|
||||
// ---- openai streaming: first fragment carries the id ----
|
||||
chunk := `{"choices":[{"delta":{"tool_calls":[
|
||||
{"index":0,"id":"bash:0","type":"function","function":{"name":"bash","arguments":""}}]},
|
||||
"finish_reason":null}]}`
|
||||
out, err = vm.Transform("openai", "transform_stream_chunk", chunk)
|
||||
if err != nil {
|
||||
t.Fatalf("openai transform_stream_chunk: %v", err)
|
||||
}
|
||||
var c struct {
|
||||
ToolCalls []struct {
|
||||
ID string `json:"id"`
|
||||
} `json:"tool_calls"`
|
||||
}
|
||||
if err := json.Unmarshal([]byte(out), &c); err != nil {
|
||||
t.Fatalf("unmarshal chunk: %v (%s)", err, out)
|
||||
}
|
||||
if len(c.ToolCalls) != 1 {
|
||||
t.Fatalf("stream tool_calls lost: %s", out)
|
||||
}
|
||||
if !legal.MatchString(c.ToolCalls[0].ID) {
|
||||
t.Errorf("stream response leaks illegal id %q to the client", c.ToolCalls[0].ID)
|
||||
}
|
||||
// Streaming and non-streaming must agree, otherwise a client that mixes
|
||||
// modes within one session produces unpaired tool calls.
|
||||
if c.ToolCalls[0].ID != nonStreamID {
|
||||
t.Errorf("stream id %q != non-stream id %q for the same input", c.ToolCalls[0].ID, nonStreamID)
|
||||
}
|
||||
|
||||
// ---- a later argument fragment has no id and must stay id-less ----
|
||||
argChunk := `{"choices":[{"delta":{"tool_calls":[
|
||||
{"index":0,"function":{"arguments":"{\"command\":\"whoami\"}"}}]},"finish_reason":null}]}`
|
||||
out, err = vm.Transform("openai", "transform_stream_chunk", argChunk)
|
||||
if err != nil {
|
||||
t.Fatalf("arg fragment: %v", err)
|
||||
}
|
||||
if strings.Contains(out, `"id"`) {
|
||||
t.Errorf("argument fragment gained an id (breaks index-based accumulation): %s", out)
|
||||
}
|
||||
|
||||
// ---- anthropic response side: tool_use id and stream start ----
|
||||
aResp := `{"content":[{"type":"tool_use","id":"toolu~sig1:AB+/==","name":"bash","input":{"command":"whoami"}}],"stop_reason":"tool_use"}`
|
||||
out, err = vm.Transform("anthropic", "transform_response", aResp)
|
||||
if err != nil {
|
||||
t.Fatalf("anthropic transform_response: %v", err)
|
||||
}
|
||||
if err := json.Unmarshal([]byte(out), &r); err != nil {
|
||||
t.Fatalf("unmarshal anthropic: %v (%s)", err, out)
|
||||
}
|
||||
if len(r.ToolCalls) != 1 || !legal.MatchString(r.ToolCalls[0].ID) {
|
||||
t.Errorf("anthropic response leaks illegal id: %s", out)
|
||||
}
|
||||
|
||||
aChunk := `{"type":"content_block_start","index":0,"content_block":{"type":"tool_use","id":"toolu~sig1:AB+/==","name":"bash"}}`
|
||||
out, err = vm.Transform("anthropic", "transform_stream_chunk", aChunk)
|
||||
if err != nil {
|
||||
t.Fatalf("anthropic stream chunk: %v", err)
|
||||
}
|
||||
if err := json.Unmarshal([]byte(out), &c); err != nil {
|
||||
t.Fatalf("unmarshal anthropic chunk: %v (%s)", err, out)
|
||||
}
|
||||
if len(c.ToolCalls) != 1 || !legal.MatchString(c.ToolCalls[0].ID) {
|
||||
t.Errorf("anthropic stream leaks illegal id: %s", out)
|
||||
}
|
||||
}
|
||||
|
||||
Reference in New Issue
Block a user