Treat model output as untrusted input

import html
from urllib.parse import urlparse

ALLOWED_LINK_HOSTS = {"help.example.com", "docs.example.com"}

def safe_text(model_output: str) -> str:
    # The browser will show this as text. It will never run it.
    return html.escape(model_output)

def safe_link(url: str) -> str | None:
    parsed = urlparse(url)
    if parsed.scheme != "https":
        return None
    if parsed.hostname not in ALLOWED_LINK_HOSTS:
        return None
    return url

from jsonschema import validate, ValidationError

REFUND_SCHEMA = {
    "type": "object",
    "properties": {
        "order_id": {"type": "string", "pattern": "^ORD-[0-9]{6}$"},
        "amount":   {"type": "number", "minimum": 1, "maximum": 500},
        "reason":   {"type": "string", "maxLength": 200},
    },
    "required": ["order_id", "amount"],
    "additionalProperties": False,
}

def check_refund_args(args: dict) -> dict:
    try:
        validate(instance=args, schema=REFUND_SCHEMA)
    except ValidationError as e:
        raise ValueError(f"rejected tool call: {e.message}")
    # The schema checks shape. Ownership is checked next, in code:
    # does this order belong to the logged-in user?
    return args