Duy /zuey/
ef829c1ab4
fix(bitrix24): resolve PR 8-10 stack findings
...
Resolve the PR #8/#9/#10 stack on current dev, including Bitrix24 install callback hardening, migration renumbering, duplicate-domain fail-closed routing, UI textarea/mobile cleanup, and review hardening.
2026-05-22 20:53:01 +07:00
viettranx
e48ba1df7f
fix(mcp): prevent LLM hallucination of optional tool parameters
...
3-layer defense against GPT-5.4 filling all optional MCP tool params
with fabricated values (e.g. api_key:"optional", proxyUrl:"http://example.com "):
Layer 1 — bridge_tool.go: expand placeholder detection to catch "optional",
"skip", example URLs; type-aware empty string handling (keep for string-typed,
strip for non-string); add propertyType() helper.
Layer 2 — schema_strict.go: OpenAI strict mode transform — optional props
become nullable unions, all props required, additionalProperties:false.
Constrained decoding prevents invalid output. Only enabled for first-party
OpenAI/Codex providers.
Layer 3 — systemprompt_sections.go: concrete WRONG/RIGHT examples in MCP
optional param instruction.
2026-03-31 23:15:59 +07:00
viettranx
09a7823498
feat(providers): add tool schema normalization for MCP tools
...
Port TypeScript schema normalization pipeline to Go. MCP tools with
complex JSON Schemas ($ref, anyOf/oneOf, const, constraints) were
being rejected by OpenAI, Gemini, Codex, and xAI providers.
Pipeline per provider:
- Anthropic: resolve $ref → strip ref keys
- OpenAI/Codex/default: resolve $ref → flatten unions → inject type
- Gemini: resolve $ref → strip nulls → flatten → const→enum → strip 20+ keys
- xAI: resolve $ref → flatten → inject type → strip constraints
Key fixes:
- $ref resolution with circular detection (was: stripped → empty schema)
- anyOf/oneOf flattening into merged objects (was: raw → provider reject)
- type:"object" injection for OpenAI/Codex (was: 400 error)
- Codex now runs normalization (was: zero cleaning)
- Gemini strips 20+ constraint keywords (was: 5)
- xAI constraint keyword stripping (was: no profile)
- Builtin web_search/web_fetch minimum/maximum now stripped for Gemini/xAI
- DB provider type detection via schemaProviderName() for reliable Gemini matching
- Recursion depth guard (maxSchemaDepth=64) prevents DoS from malicious schemas
- Type inference from const values when explicit type is omitted
2026-03-31 17:56:24 +07:00
Duy /zuey/