Documentation
¶
Overview ¶
Package toolinvoke holds shared tool-invocation preflight checks used by both the autonomous runtime tool loop and the workflow NodeTool path so approval, input validation, side-effect retry, and security resource shape cannot drift between the two stacks.
Index ¶
- func AutoRetrySafe(tool core.Tool) bool
- func DenialWithoutGate(tool core.Tool, gateConfigured, approved bool) string
- func DenialWithoutGateWithEvaluator(ctx context.Context, tool core.Tool, gateConfigured, approved bool, ...) string
- func EvaluatePauseRequired(ctx context.Context, tool core.Tool, evaluator core.ToolApprovalEvaluator, ...) (bool, error)
- func SecurityResource(toolName string, tool core.Tool, extra map[string]string) security.Resource
- func ValidateInput(enabled bool, tool core.Tool, input json.RawMessage) error
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func AutoRetrySafe ¶
AutoRetrySafe reports whether a tool may be automatically re-executed after a classified transient failure. write/external/dangerous tools are never auto-retried: a failed attempt may already have committed its side effect.
func DenialWithoutGate ¶
DenialWithoutGate returns a non-empty reason when the tool must be denied (rather than paused). When gateConfigured is true and the policy is pause-required, this returns "" so the caller can pause for human approval. Callers that already obtained human approval should pass approved=true.
func DenialWithoutGateWithEvaluator ¶
func DenialWithoutGateWithEvaluator(ctx context.Context, tool core.Tool, gateConfigured, approved bool, evaluator core.ToolApprovalEvaluator, runID string, call llm.ToolCall) string
DenialWithoutGateWithEvaluator extends DenialWithoutGate with dynamic pause evaluation for tools whose static policy is ApprovalNever.
func EvaluatePauseRequired ¶
func EvaluatePauseRequired(ctx context.Context, tool core.Tool, evaluator core.ToolApprovalEvaluator, runID string, call llm.ToolCall) (bool, error)
EvaluatePauseRequired reports whether a tool call should pause for human approval when a human gate is configured. Static scenario policies are checked first; when they do not require a pause, an optional evaluator may still require one (for example dynamic MCP invoke targets).
func SecurityResource ¶
SecurityResource builds the security.Resource used for tool.invoke authorization. extra metadata (agent, node_id, ...) is copied in.
func ValidateInput ¶
ValidateInput enforces the tool's InputSchema when validation is enabled.
Types ¶
This section is empty.
Source Files