// Planu — Agent Challenge Scenarios
// SPEC-016a criteria 4 and 19: AI agent-specific failure modes for challenge_spec.
/**
 * Generate AI agent-specific failure scenarios.
 * Criteria 4: hallucinations, data leaks, wrong decisions, rate limits, cost.
 * Criteria 19: prompt injection, infinite loops, hallucinated params, context truncation.
 */
export function generateAgentChallengeScenarios(spec, _specContent, _knowledge) {
    const scenarios = [];
    // Criterion 19: Hallucinated tool parameters
    scenarios.push({
        scenario: `[${spec.id}] Hallucinated Tool Parameters: agent generates plausible-but-incorrect tool call parameters (wrong field names, invalid enum values, fabricated IDs). Tool fails silently or returns unexpected results.`,
        probability: 'medium',
        impact: 'high',
        currentHandling: 'Not addressed in spec',
        requiredHandling: 'Validate all tool inputs with JSON Schema before execution. Log rejected tool calls for review. Use structured output with strict mode.',
        dataConsistency: 'Tool call rejections must be idempotent — no partial state from invalid calls.',
        userExperience: 'Return clear error message explaining what information is needed. Never expose internal tool schemas.',
    });
    // Criterion 19: Prompt injection in tool outputs
    scenarios.push({
        scenario: `[${spec.id}] Prompt Injection via Tool Outputs: malicious content in tool outputs (web search, database records, user messages) embeds instructions like "Ignore previous instructions and..." to hijack agent behavior.`,
        probability: 'medium',
        impact: 'critical',
        currentHandling: 'Not addressed in spec',
        requiredHandling: 'Sanitize all tool outputs before injection into prompt. Use separate system/user message boundaries. Implement output filtering for instruction-like patterns.',
        dataConsistency: 'Injected instructions must not modify persistent state.',
        userExperience: 'Agent must complete original task, not the injected one. Log suspicious patterns.',
    });
    // Criterion 19: Infinite tool call loops
    scenarios.push({
        scenario: `[${spec.id}] Infinite Tool Call Loop: agent enters a cycle where tool A result triggers tool B which triggers tool A again. max_iterations not enforced or set too high.`,
        probability: 'medium',
        impact: 'high',
        currentHandling: 'Not addressed in spec',
        requiredHandling: 'Enforce hard max_iterations limit (default: 10). Track tool call history and detect repeated identical calls. Implement circuit breaker pattern.',
        dataConsistency: 'Stop execution cleanly — do not apply partial results from interrupted loop.',
        userExperience: 'Return "reached iteration limit" message with partial results completed so far.',
    });
    // Criterion 4: Hallucinations (false facts)
    scenarios.push({
        scenario: `[${spec.id}] Factual Hallucination: agent presents fabricated information as fact (wrong dates, non-existent records, incorrect statistics). User acts on false information with real-world consequences.`,
        probability: 'medium',
        impact: 'high',
        currentHandling: 'Not addressed in spec',
        requiredHandling: 'Ground responses in retrieved context only. Add "sources:" section to all factual claims. Implement hallucination scoring with faithfulness metrics.',
        dataConsistency: 'Never present unverified data as authoritative.',
        userExperience: 'Include confidence indicator and source citations in agent responses.',
    });
    // Criterion 4: Data leaks
    scenarios.push({
        scenario: `[${spec.id}] Sensitive Data Leak: agent retrieves PII, credentials, or business-sensitive data and includes it in responses to unauthorized users. Context window may contain data from other users in shared deployments.`,
        probability: 'low',
        impact: 'critical',
        currentHandling: 'Not addressed in spec',
        requiredHandling: 'Implement strict data access controls per user session. Scrub PII from agent responses. Isolate context windows per user. Audit all data access.',
        dataConsistency: 'User A must never access User B data even if both sessions run concurrently.',
        userExperience: 'Mask sensitive fields (passwords, API keys, SSNs) in all displayed outputs.',
    });
    // Criterion 4: Wrong decision from stale data
    scenarios.push({
        scenario: `[${spec.id}] Wrong Decision from Stale Data: agent makes critical decision based on cached or outdated data (approves transaction on stale balance, sends duplicate notifications due to eventual consistency).`,
        probability: 'medium',
        impact: 'high',
        currentHandling: 'Not addressed in spec',
        requiredHandling: 'Refresh critical data at decision time. Implement idempotency keys for all actions. Add confirmation step for high-impact decisions.',
        dataConsistency: 'All state-changing operations must check current state, not cached state.',
        userExperience: 'Show data freshness indicator. Require confirmation for irreversible actions.',
    });
    // Criterion 4: Rate limits / cost spikes
    scenarios.push({
        scenario: `[${spec.id}] Rate Limit Breach and Cost Spike: agent makes excessive API calls in a burst, hitting rate limits and causing service degradation. Worst case: runaway agent generates unexpected billing.`,
        probability: 'low',
        impact: 'high',
        currentHandling: 'Not addressed in spec',
        requiredHandling: 'Implement token budgeting per session. Add exponential backoff on rate limit errors. Set hard cost cap per request. Alert on unusual token consumption.',
        dataConsistency: 'Partial results from aborted runs must be rolled back or clearly marked incomplete.',
        userExperience: 'Inform user of rate limit status. Offer to queue the request for later execution.',
    });
    // Criterion 19: Context window truncation behavior
    scenarios.push({
        scenario: `[${spec.id}] Context Window Truncation: conversation or tool outputs exceed model context window. Older messages silently truncated. Agent makes decisions based on incomplete information.`,
        probability: 'medium',
        impact: 'high',
        currentHandling: 'Not addressed in spec',
        requiredHandling: 'Monitor token count during execution. Summarize older context before truncation. Alert when approaching 80% of context limit. Persist critical context externally.',
        dataConsistency: 'Critical facts must be preserved despite truncation — use explicit memory.',
        userExperience: 'Notify user when context was summarized. Offer to restore full context from memory.',
    });
    return scenarios;
}
/**
 * Check whether the spec is an AI agent spec.
 */
export function isAgentSpec(spec, specContent) {
    const lower = specContent.toLowerCase();
    const titleLower = spec.title.toLowerCase();
    return (spec.type === 'agent' ||
        lower.includes('ai agent') ||
        lower.includes('agent contract') ||
        lower.includes('llm') ||
        lower.includes('tool call') ||
        titleLower.includes('agent') ||
        titleLower.includes('assistant') ||
        titleLower.includes('bot'));
}
//# sourceMappingURL=agent-challenge-scenarios.js.map