agent

Overview ¶

agent demonstrates a minimal seed-based agent that speaks JSON-RPC over stdin/stdout. It is intentionally simple — a real implementation would need security controls, rate limiting, input validation, and more.

provider provides a minimal OpenAI-compatible HTTP provider.

REAL IMPLEMENTATION NOTES:

• Validate endpoints against a whitelist or require HTTPS (no file:// gopher://)
• Redact API keys in error messages and logs
• Implement proper token estimation (not char-count / 4)
• Support streaming via ChatStream() with Server-Sent Events parsing
• Handle retry on 429/5xx with exponential backoff
• Enforce per-request token budgets to avoid runaway API costs
• Add request/response logging for auditing

tools provides a minimal tool executor with a small set of example tools.

This is an EXAMPLE only. A real implementation would need:

• Path traversal prevention (reject ../ or absolute paths escaping the workspace)
• File size limits (cap reads and writes to prevent memory exhaustion)
• File type allowlisting (prevent writing executables, symlinks, or device files)
• Shell command sandboxing (restrict allowed commands, deny network access, limit resources)
• Argument sanitization (reject null bytes, extremely long strings, etc.)
• Rate limiting and quota enforcement per user/session
• Audit logging of all tool invocations
• Circuit breakers to prevent cascading failures