b60439152b
- harness/es.py: append-only event store + проекции (образец — кооп-портал) - harness/levels.py: уровни 1с/1м/1ч/1д, контекст ∝ масштабу - harness/scheduler.py: уровневые потоки, идемпотентные тики, absorbed-стабы - harness/isolated_runner.py + _llm_worker.py: LLM-тик в сабпроцессе (глобальный asyncio-рантайм Strands не переживает 2+ create_harness) - cli.py: init/task/tasks/status/events + requeue (написан самим минутным агентом) - 9router: отдельный ключ sk-simbiot, модель auto (glm-5.3 первым)
37 lines
1.3 KiB
Python
37 lines
1.3 KiB
Python
"""Minimal XML escaping for folding untrusted text into an XML-shaped block.
|
|
|
|
Memory entries and other injected content are frequently user-derived, so interpolating them
|
|
raw into ``<entry>…</entry>`` both breaks the block structurally (a stray ``</entry>`` or
|
|
``"``) and opens a stored-prompt-injection surface. These helpers are deliberately tiny —
|
|
enough to keep a ``<memory>`` block well-formed, not a general-purpose serializer.
|
|
"""
|
|
|
|
from __future__ import annotations
|
|
|
|
|
|
def _escape_xml_text(value: str) -> str:
|
|
"""Escape text content for placement between XML tags.
|
|
|
|
Escapes ``&`` first (so later replacements are not double-escaped), then ``<`` and ``>``.
|
|
|
|
Args:
|
|
value: The raw text to escape.
|
|
|
|
Returns:
|
|
The escaped text, safe to place in element content.
|
|
"""
|
|
return value.replace("&", "&").replace("<", "<").replace(">", ">")
|
|
|
|
|
|
def _escape_xml_attr(value: str) -> str:
|
|
"""Escape a value for placement inside a double-quoted XML attribute.
|
|
|
|
Applies the :func:`_escape_xml_text` rules plus ``"`` and ``'``.
|
|
|
|
Args:
|
|
value: The raw attribute value to escape.
|
|
|
|
Returns:
|
|
The escaped value, safe to place inside a quoted attribute.
|
|
"""
|
|
return _escape_xml_text(value).replace('"', """).replace("'", "'")
|