[Grid agent] Generate, validate, inventory, and deliver LSL scripts safely #129

New Issue

hugo · 2026-08-17T19:31:37Z

hugo commented

2026-08-17 19:31:37 +00:00

Objective

Implement the explicit exception that lets any resident request an LSL script in public chat or IM: generate a bounded script, validate it, create it in the agent's inventory, and give a full-permission copy to that same requesting avatar without treating the request as general command authority.

Workflow

Detect an explicit script request and bind it to the authenticated grid sender UUID/session. Confirm ambiguous requirements conversationally before creation.
Ask the LLM for source plus a short description in a strict schema. Limit prompt/source/name/description sizes and generation attempts. Mark all requested code/content as untrusted.
Parse and validate with the native libremetaverse-lsl-tools lexer/parser. Reject malformed, oversized, unsupported, secret-bearing, or policy-disallowed output with a useful chat response. Static checks are not a promise of runtime safety.
Create a script inventory item in a dedicated agent folder, set copy/modify/transfer permissions so the delivered item is full-perm for the recipient, and give it only to the original requester UUID. Verify API replies/events where possible and report delivery outcome.
Never rez, attach, compile/run in-world, or inject the script into an object as part of this public workflow. Never accept a destination UUID or inventory target supplied only in message text.
Rate-limit per resident and globally; bound outstanding creates/transfers. On partial failure, retain or move the local item to a documented recovery folder and emit an auditable result rather than duplicating on blind retry.

Acceptance criteria

Fake inventory/grid tests decode creation and transfer operations and verify recipient binding and full permissions.
Tests cover public and IM callers, malformed LSL, prompt injection, oversized output, Unicode names, parser failure, inventory timeout, duplicate events, transfer ambiguity, reconnect, cancellation, and rate exhaustion.
Public users gain no tool other than this narrow workflow; attempts to embed teleport/build/admin commands are denied.
No generated source or conversation content leaks into logs by default.

Dependencies

Depends on messaging, sessions, LLM loop, policy, lifecycle, observability, and inventory readiness. Scripted object construction is handled separately and is authorized-only.

## Objective Implement the explicit exception that lets any resident request an LSL script in public chat or IM: generate a bounded script, validate it, create it in the agent's inventory, and give a full-permission copy to that same requesting avatar without treating the request as general command authority. ## Workflow - Detect an explicit script request and bind it to the authenticated grid sender UUID/session. Confirm ambiguous requirements conversationally before creation. - Ask the LLM for source plus a short description in a strict schema. Limit prompt/source/name/description sizes and generation attempts. Mark all requested code/content as untrusted. - Parse and validate with the native `libremetaverse-lsl-tools` lexer/parser. Reject malformed, oversized, unsupported, secret-bearing, or policy-disallowed output with a useful chat response. Static checks are not a promise of runtime safety. - Create a script inventory item in a dedicated agent folder, set copy/modify/transfer permissions so the delivered item is full-perm for the recipient, and give it only to the original requester UUID. Verify API replies/events where possible and report delivery outcome. - Never rez, attach, compile/run in-world, or inject the script into an object as part of this public workflow. Never accept a destination UUID or inventory target supplied only in message text. - Rate-limit per resident and globally; bound outstanding creates/transfers. On partial failure, retain or move the local item to a documented recovery folder and emit an auditable result rather than duplicating on blind retry. ## Acceptance criteria - [ ] Fake inventory/grid tests decode creation and transfer operations and verify recipient binding and full permissions. - [ ] Tests cover public and IM callers, malformed LSL, prompt injection, oversized output, Unicode names, parser failure, inventory timeout, duplicate events, transfer ambiguity, reconnect, cancellation, and rate exhaustion. - [ ] Public users gain no tool other than this narrow workflow; attempts to embed teleport/build/admin commands are denied. - [ ] No generated source or conversation content leaks into logs by default. ## Dependencies Depends on messaging, sessions, LLM loop, policy, lifecycle, observability, and inventory readiness. Scripted object construction is handled separately and is authorized-only.

hugo added this to the 14 - metacrate grid agent milestone 2026-08-17 19:31:37 +00:00

hugo added the enhancement label 2026-08-17 19:31:37 +00:00

hugo referenced this issue

2026-08-17 19:32:14 +00:00

implement an AI driven agent that runs in opensim #117

hugo referenced this issue from a commit

2026-08-18 08:38:20 +00:00

Implement safe public LSL delivery (#129)

hugo commented

2026-08-18 08:38:40 +00:00

Implemented and pushed in a749111.

The public/IM LSL workflow now uses a strict name/description/source schema, binds delivery exclusively to the authenticated sender UUID, validates bounded untrusted source with native MetaCrate LSL tooling plus public-policy checks, creates full-permission LSL inventory items in a dedicated MetaCrate Generated Scripts recovery folder, performs a single recipient offer, and retains ambiguous transfers without blind retry. Per-resident/global rate limits, outstanding-operation bounds, cancellation, safe outcomes, and live-grid wiring are included. The workflow never accepts a destination/folder argument and never rezzes, attaches, runs, or injects generated code.

Per the milestone namespace rule, the native LSL crate is now metacrate-lsl-tools, a generic metacrate facade owns MetaCrate APIs, and an executable dependency-policy test prevents any libremetaverse compatibility crate/facade from depending on or re-exporting metacrate crates.

Verified: full metacrate-grid-agent suite (111 unit tests plus integration/doc tests); focused script delivery tests; LLM transport timeout/duplicate tests; session reconnect/no-replay tests; live-grid all-target check; strict Clippy; metacrate facade check; Rustdoc; all metacrate-lsl-tools lexer/parser/generator fixtures; legacy extension compatibility tests; issue-82/83 parser/generator audits; consolidated CI audit. Generated source and conversation content are absent from default diagnostics.

Implemented and pushed in a749111. The public/IM LSL workflow now uses a strict name/description/source schema, binds delivery exclusively to the authenticated sender UUID, validates bounded untrusted source with native MetaCrate LSL tooling plus public-policy checks, creates full-permission LSL inventory items in a dedicated MetaCrate Generated Scripts recovery folder, performs a single recipient offer, and retains ambiguous transfers without blind retry. Per-resident/global rate limits, outstanding-operation bounds, cancellation, safe outcomes, and live-grid wiring are included. The workflow never accepts a destination/folder argument and never rezzes, attaches, runs, or injects generated code. Per the milestone namespace rule, the native LSL crate is now metacrate-lsl-tools, a generic metacrate facade owns MetaCrate APIs, and an executable dependency-policy test prevents any libremetaverse compatibility crate/facade from depending on or re-exporting metacrate crates. Verified: full metacrate-grid-agent suite (111 unit tests plus integration/doc tests); focused script delivery tests; LLM transport timeout/duplicate tests; session reconnect/no-replay tests; live-grid all-target check; strict Clippy; metacrate facade check; Rustdoc; all metacrate-lsl-tools lexer/parser/generator fixtures; legacy extension compatibility tests; issue-82/83 parser/generator audits; consolidated CI audit. Generated source and conversation content are absent from default diagnostics.

hugo closed this issue

2026-08-18 08:38:40 +00:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: hugo/MetaCrate#129