@anthropic-ai/sdk 0.107.0 → 0.109.0

package/src/resources/beta/sessions/threads/threads.ts

@@ -256,6 +256,8 @@ export type BetaManagedAgentsStreamSessionThreadEvents =
   | SessionsAPI.BetaManagedAgentsUserToolResultEvent
   | EventsAPI.BetaManagedAgentsSessionThreadStatusRescheduledEvent
   | SessionsAPI.BetaManagedAgentsSessionUpdatedEvent
+  | SessionsAPI.BetaManagedAgentsStartEvent
+  | SessionsAPI.BetaManagedAgentsDeltaEvent
   | SessionsAPI.BetaManagedAgentsSystemMessageEvent;
 
 export interface ThreadRetrieveParams {

package/src/resources/beta/vaults/credentials.ts

@@ -342,6 +342,11 @@ export interface BetaManagedAgentsDeletedCredential {
  * Environment variable credential details. The secret value is never returned.
  */
 export interface BetaManagedAgentsEnvironmentVariableAuthResponse {
+  /**
+   * Where in the outbound request the secret value is substituted.
+   */
+  injection_location: BetaManagedAgentsInjectionLocationResponse;
+
   /**
    * Outbound hosts the secret value is substituted on.
    */
@@ -377,6 +382,11 @@ export interface BetaManagedAgentsEnvironmentVariableCreateParams {
   secret_value: string;
 
   type: 'environment_variable';
+
+  /**
+   * Where in the outbound request the secret value may be substituted.
+   */
+  injection_location?: BetaManagedAgentsInjectionLocationParams;
 }
 
 /**
@@ -386,6 +396,11 @@ export interface BetaManagedAgentsEnvironmentVariableCreateParams {
 export interface BetaManagedAgentsEnvironmentVariableUpdateParams {
   type: 'environment_variable';
 
+  /**
+   * Updated injection location.
+   */
+  injection_location?: BetaManagedAgentsInjectionLocationUpdateParams;
+
   /**
    * Updated networking scope. Full replacement.
    */
@@ -397,6 +412,51 @@ export interface BetaManagedAgentsEnvironmentVariableUpdateParams {
   secret_value?: string | null;
 }
 
+/**
+ * Where in the outbound request the secret value may be substituted.
+ */
+export interface BetaManagedAgentsInjectionLocationParams {
+  /**
+   * Substitute when the placeholder appears in the request body.
+   */
+  body?: boolean;
+
+  /**
+   * Substitute when the placeholder appears in a request header value.
+   */
+  header?: boolean;
+}
+
+/**
+ * Where in the outbound request the secret value is substituted.
+ */
+export interface BetaManagedAgentsInjectionLocationResponse {
+  /**
+   * Whether the placeholder is substituted in the request body.
+   */
+  body: boolean;
+
+  /**
+   * Whether the placeholder is substituted in request header values.
+   */
+  header: boolean;
+}
+
+/**
+ * Updated injection location.
+ */
+export interface BetaManagedAgentsInjectionLocationUpdateParams {
+  /**
+   * Substitute when the placeholder appears in the request body.
+   */
+  body?: boolean;
+
+  /**
+   * Substitute when the placeholder appears in a request header value.
+   */
+  header?: boolean;
+}
+
 /**
  * Substitute the secret only on requests to the listed hosts.
  */
@@ -908,6 +968,9 @@ export declare namespace Credentials {
     type BetaManagedAgentsEnvironmentVariableAuthResponse as BetaManagedAgentsEnvironmentVariableAuthResponse,
     type BetaManagedAgentsEnvironmentVariableCreateParams as BetaManagedAgentsEnvironmentVariableCreateParams,
     type BetaManagedAgentsEnvironmentVariableUpdateParams as BetaManagedAgentsEnvironmentVariableUpdateParams,
+    type BetaManagedAgentsInjectionLocationParams as BetaManagedAgentsInjectionLocationParams,
+    type BetaManagedAgentsInjectionLocationResponse as BetaManagedAgentsInjectionLocationResponse,
+    type BetaManagedAgentsInjectionLocationUpdateParams as BetaManagedAgentsInjectionLocationUpdateParams,
     type BetaManagedAgentsLimitedCredentialNetworkingParams as BetaManagedAgentsLimitedCredentialNetworkingParams,
     type BetaManagedAgentsLimitedCredentialNetworkingResponse as BetaManagedAgentsLimitedCredentialNetworkingResponse,
     type BetaManagedAgentsMCPOAuthAuthResponse as BetaManagedAgentsMCPOAuthAuthResponse,

package/src/resources/beta/vaults/index.ts

@@ -10,6 +10,9 @@ export {
   type BetaManagedAgentsEnvironmentVariableAuthResponse,
   type BetaManagedAgentsEnvironmentVariableCreateParams,
   type BetaManagedAgentsEnvironmentVariableUpdateParams,
+  type BetaManagedAgentsInjectionLocationParams,
+  type BetaManagedAgentsInjectionLocationResponse,
+  type BetaManagedAgentsInjectionLocationUpdateParams,
   type BetaManagedAgentsLimitedCredentialNetworkingParams,
   type BetaManagedAgentsLimitedCredentialNetworkingResponse,
   type BetaManagedAgentsMCPOAuthAuthResponse,

package/src/resources/beta/vaults/vaults.ts

@@ -13,6 +13,9 @@ import {
   BetaManagedAgentsEnvironmentVariableAuthResponse,
   BetaManagedAgentsEnvironmentVariableCreateParams,
   BetaManagedAgentsEnvironmentVariableUpdateParams,
+  BetaManagedAgentsInjectionLocationParams,
+  BetaManagedAgentsInjectionLocationResponse,
+  BetaManagedAgentsInjectionLocationUpdateParams,
   BetaManagedAgentsLimitedCredentialNetworkingParams,
   BetaManagedAgentsLimitedCredentialNetworkingResponse,
   BetaManagedAgentsMCPOAuthAuthResponse,
@@ -355,6 +358,9 @@ export declare namespace Vaults {
     type BetaManagedAgentsEnvironmentVariableAuthResponse as BetaManagedAgentsEnvironmentVariableAuthResponse,
     type BetaManagedAgentsEnvironmentVariableCreateParams as BetaManagedAgentsEnvironmentVariableCreateParams,
     type BetaManagedAgentsEnvironmentVariableUpdateParams as BetaManagedAgentsEnvironmentVariableUpdateParams,
+    type BetaManagedAgentsInjectionLocationParams as BetaManagedAgentsInjectionLocationParams,
+    type BetaManagedAgentsInjectionLocationResponse as BetaManagedAgentsInjectionLocationResponse,
+    type BetaManagedAgentsInjectionLocationUpdateParams as BetaManagedAgentsInjectionLocationUpdateParams,
     type BetaManagedAgentsLimitedCredentialNetworkingParams as BetaManagedAgentsLimitedCredentialNetworkingParams,
     type BetaManagedAgentsLimitedCredentialNetworkingResponse as BetaManagedAgentsLimitedCredentialNetworkingResponse,
     type BetaManagedAgentsMCPOAuthAuthResponse as BetaManagedAgentsMCPOAuthAuthResponse,

package/src/resources/beta/webhooks.ts

@@ -18,6 +18,229 @@ export class Webhooks extends APIResource {
   }
 }
 
+export interface BetaWebhookAgentArchivedEventData {
+  /**
+   * ID of the agent that triggered the event.
+   */
+  id: string;
+
+  organization_id: string;
+
+  type: 'agent.archived';
+
+  workspace_id: string;
+}
+
+export interface BetaWebhookAgentCreatedEventData {
+  /**
+   * ID of the agent that triggered the event.
+   */
+  id: string;
+
+  organization_id: string;
+
+  type: 'agent.created';
+
+  workspace_id: string;
+}
+
+export interface BetaWebhookAgentDeletedEventData {
+  /**
+   * ID of the agent that triggered the event.
+   */
+  id: string;
+
+  organization_id: string;
+
+  type: 'agent.deleted';
+
+  workspace_id: string;
+}
+
+export interface BetaWebhookAgentUpdatedEventData {
+  /**
+   * ID of the agent that triggered the event.
+   */
+  id: string;
+
+  organization_id: string;
+
+  type: 'agent.updated';
+
+  workspace_id: string;
+}
+
+export interface BetaWebhookDeploymentArchivedEventData {
+  /**
+   * ID of the deployment that triggered the event.
+   */
+  id: string;
+
+  organization_id: string;
+
+  type: 'deployment.archived';
+
+  workspace_id: string;
+}
+
+export interface BetaWebhookDeploymentCreatedEventData {
+  /**
+   * ID of the deployment that triggered the event.
+   */
+  id: string;
+
+  organization_id: string;
+
+  type: 'deployment.created';
+
+  workspace_id: string;
+}
+
+export interface BetaWebhookDeploymentDeletedEventData {
+  /**
+   * ID of the deployment that triggered the event.
+   */
+  id: string;
+
+  organization_id: string;
+
+  type: 'deployment.deleted';
+
+  workspace_id: string;
+}
+
+export interface BetaWebhookDeploymentPausedEventData {
+  /**
+   * ID of the deployment that triggered the event.
+   */
+  id: string;
+
+  organization_id: string;
+
+  type: 'deployment.paused';
+
+  workspace_id: string;
+}
+
+export interface BetaWebhookDeploymentRunFailedEventData {
+  /**
+   * ID of the deployment run that triggered the event.
+   */
+  id: string;
+
+  organization_id: string;
+
+  type: 'deployment_run.failed';
+
+  workspace_id: string;
+}
+
+export interface BetaWebhookDeploymentRunStartedEventData {
+  /**
+   * ID of the deployment run that triggered the event.
+   */
+  id: string;
+
+  organization_id: string;
+
+  type: 'deployment_run.started';
+
+  workspace_id: string;
+}
+
+export interface BetaWebhookDeploymentRunSucceededEventData {
+  /**
+   * ID of the deployment run that triggered the event.
+   */
+  id: string;
+
+  organization_id: string;
+
+  type: 'deployment_run.succeeded';
+
+  workspace_id: string;
+}
+
+export interface BetaWebhookDeploymentUnpausedEventData {
+  /**
+   * ID of the deployment that triggered the event.
+   */
+  id: string;
+
+  organization_id: string;
+
+  type: 'deployment.unpaused';
+
+  workspace_id: string;
+}
+
+export interface BetaWebhookDeploymentUpdatedEventData {
+  /**
+   * ID of the deployment that triggered the event.
+   */
+  id: string;
+
+  organization_id: string;
+
+  type: 'deployment.updated';
+
+  workspace_id: string;
+}
+
+export interface BetaWebhookEnvironmentArchivedEventData {
+  /**
+   * ID of the environment that triggered the event.
+   */
+  id: string;
+
+  organization_id: string;
+
+  type: 'environment.archived';
+
+  workspace_id: string;
+}
+
+export interface BetaWebhookEnvironmentCreatedEventData {
+  /**
+   * ID of the environment that triggered the event.
+   */
+  id: string;
+
+  organization_id: string;
+
+  type: 'environment.created';
+
+  workspace_id: string;
+}
+
+export interface BetaWebhookEnvironmentDeletedEventData {
+  /**
+   * ID of the environment that triggered the event.
+   */
+  id: string;
+
+  organization_id: string;
+
+  type: BetaWebhookEnvironmentDeletedEventType;
+
+  workspace_id: string;
+}
+
+export type BetaWebhookEnvironmentDeletedEventType = 'environment.deleted';
+
+export interface BetaWebhookEnvironmentUpdatedEventData {
+  /**
+   * ID of the environment that triggered the event.
+   */
+  id: string;
+
+  organization_id: string;
+
+  type: 'environment.updated';
+
+  workspace_id: string;
+}
+
 export interface BetaWebhookEvent {
   /**
    * Unique event identifier for idempotency.
@@ -60,7 +283,66 @@ export type BetaWebhookEventData =
   | BetaWebhookVaultCredentialArchivedEventData
   | BetaWebhookVaultCredentialDeletedEventData
   | BetaWebhookVaultCredentialRefreshFailedEventData
-  | BetaWebhookSessionUpdatedEventData;
+  | BetaWebhookSessionUpdatedEventData
+  | BetaWebhookAgentCreatedEventData
+  | BetaWebhookAgentArchivedEventData
+  | BetaWebhookAgentDeletedEventData
+  | BetaWebhookDeploymentPausedEventData
+  | BetaWebhookDeploymentRunFailedEventData
+  | BetaWebhookDeploymentCreatedEventData
+  | BetaWebhookDeploymentUpdatedEventData
+  | BetaWebhookDeploymentUnpausedEventData
+  | BetaWebhookAgentUpdatedEventData
+  | BetaWebhookDeploymentArchivedEventData
+  | BetaWebhookDeploymentRunStartedEventData
+  | BetaWebhookDeploymentDeletedEventData
+  | BetaWebhookDeploymentRunSucceededEventData
+  | BetaWebhookEnvironmentCreatedEventData
+  | BetaWebhookEnvironmentUpdatedEventData
+  | BetaWebhookEnvironmentArchivedEventData
+  | BetaWebhookEnvironmentDeletedEventData
+  | BetaWebhookMemoryStoreCreatedEventData
+  | BetaWebhookMemoryStoreArchivedEventData
+  | BetaWebhookMemoryStoreDeletedEventData;
+
+export interface BetaWebhookMemoryStoreArchivedEventData {
+  /**
+   * ID of the memory store that triggered the event.
+   */
+  id: string;
+
+  organization_id: string;
+
+  type: 'memory_store.archived';
+
+  workspace_id: string;
+}
+
+export interface BetaWebhookMemoryStoreCreatedEventData {
+  /**
+   * ID of the memory store that triggered the event.
+   */
+  id: string;
+
+  organization_id: string;
+
+  type: 'memory_store.created';
+
+  workspace_id: string;
+}
+
+export interface BetaWebhookMemoryStoreDeletedEventData {
+  /**
+   * ID of the memory store that triggered the event.
+   */
+  id: string;
+
+  organization_id: string;
+
+  type: 'memory_store.deleted';
+
+  workspace_id: string;
+}
 
 export interface BetaWebhookSessionArchivedEventData {
   /**
@@ -417,8 +699,29 @@ export interface UnwrapWebhookEvent {
 
 export declare namespace Webhooks {
   export {
+    type BetaWebhookAgentArchivedEventData as BetaWebhookAgentArchivedEventData,
+    type BetaWebhookAgentCreatedEventData as BetaWebhookAgentCreatedEventData,
+    type BetaWebhookAgentDeletedEventData as BetaWebhookAgentDeletedEventData,
+    type BetaWebhookAgentUpdatedEventData as BetaWebhookAgentUpdatedEventData,
+    type BetaWebhookDeploymentArchivedEventData as BetaWebhookDeploymentArchivedEventData,
+    type BetaWebhookDeploymentCreatedEventData as BetaWebhookDeploymentCreatedEventData,
+    type BetaWebhookDeploymentDeletedEventData as BetaWebhookDeploymentDeletedEventData,
+    type BetaWebhookDeploymentPausedEventData as BetaWebhookDeploymentPausedEventData,
+    type BetaWebhookDeploymentRunFailedEventData as BetaWebhookDeploymentRunFailedEventData,
+    type BetaWebhookDeploymentRunStartedEventData as BetaWebhookDeploymentRunStartedEventData,
+    type BetaWebhookDeploymentRunSucceededEventData as BetaWebhookDeploymentRunSucceededEventData,
+    type BetaWebhookDeploymentUnpausedEventData as BetaWebhookDeploymentUnpausedEventData,
+    type BetaWebhookDeploymentUpdatedEventData as BetaWebhookDeploymentUpdatedEventData,
+    type BetaWebhookEnvironmentArchivedEventData as BetaWebhookEnvironmentArchivedEventData,
+    type BetaWebhookEnvironmentCreatedEventData as BetaWebhookEnvironmentCreatedEventData,
+    type BetaWebhookEnvironmentDeletedEventData as BetaWebhookEnvironmentDeletedEventData,
+    type BetaWebhookEnvironmentDeletedEventType as BetaWebhookEnvironmentDeletedEventType,
+    type BetaWebhookEnvironmentUpdatedEventData as BetaWebhookEnvironmentUpdatedEventData,
     type BetaWebhookEvent as BetaWebhookEvent,
     type BetaWebhookEventData as BetaWebhookEventData,
+    type BetaWebhookMemoryStoreArchivedEventData as BetaWebhookMemoryStoreArchivedEventData,
+    type BetaWebhookMemoryStoreCreatedEventData as BetaWebhookMemoryStoreCreatedEventData,
+    type BetaWebhookMemoryStoreDeletedEventData as BetaWebhookMemoryStoreDeletedEventData,
     type BetaWebhookSessionArchivedEventData as BetaWebhookSessionArchivedEventData,
     type BetaWebhookSessionCreatedEventData as BetaWebhookSessionCreatedEventData,
     type BetaWebhookSessionDeletedEventData as BetaWebhookSessionDeletedEventData,

package/src/resources/messages/messages.ts

@@ -1256,6 +1256,7 @@ export interface MidConversationSystemBlockParam {
  * details and options.
  */
 export type Model =
+  | 'claude-sonnet-5'
   | 'claude-fable-5'
   | 'claude-mythos-5'
   | 'claude-opus-4-8'

package/src/tools/agent-toolset/fs-util.ts

@@ -70,9 +70,10 @@ export async function canonicalize(abs: string): Promise<string> {
 /**
  * Resolve `p` and confine it to `root`.
  *
- * Unless `allowOutside` is set, absolute inputs are rejected and the
- * **canonical** path is returned — every symlink in `p` (including the leaf,
- * even a dangling one) is resolved before the confinement check, and the
+ * Absolute and relative inputs go through the same canonicalise-then-contain
+ * check — an absolute path that lands inside `root` is permitted, only paths
+ * that resolve *outside* are rejected. Every symlink in `p` (including the
+ * leaf, even a dangling one) is resolved before the confinement check, and the
  * resolved path is what the caller then operates on, so a symlink inside `root`
  * that points outside it can neither pass the check nor be followed afterwards.
  *
@@ -87,18 +88,11 @@ export async function confineToRoot(
   opts?: { allowOutside?: boolean },
 ): Promise<string> {
   const allowOutside = opts?.allowOutside ?? false;
-  if (path.isAbsolute(p)) {
-    if (!allowOutside) {
-      throw new ToolError(`absolute path ${JSON.stringify(p)} not permitted`);
-    }
-    return path.resolve(p);
-  }
   const realRoot = await realpathOrSelf(path.resolve(root));
   const abs = path.resolve(realRoot, p);
   if (allowOutside) return abs;
   const real = await canonicalize(abs);
-  const rootSep = realRoot.endsWith(path.sep) ? realRoot : realRoot + path.sep;
-  if (real !== realRoot && !real.startsWith(rootSep)) {
+  if (real !== realRoot && !real.startsWith(realRoot + path.sep)) {
     throw new ToolError(`path ${JSON.stringify(p)} escapes workdir`);
   }
   return real;

package/src/tools/agent-toolset/node.ts

@@ -95,9 +95,8 @@ export interface AgentToolContext {
   /** Base directory for resolving relative tool paths. */
   workdir: string;
   /**
-   * When `false` (default), the file tools reject absolute paths and paths
-   * that escape `workdir` (symlinks resolved). Does **not** constrain
-   * {@link betaBashTool}.
+   * When `false` (default), the file tools reject paths that resolve outside
+   * `workdir` (symlinks resolved). Does **not** constrain {@link betaBashTool}.
    */
   unrestrictedPaths?: boolean;
   /**
@@ -161,12 +160,14 @@ export function betaAgentToolset20260401(ctx: AgentToolContext): BetaRunnableToo
 }
 
 /**
- * Resolve `p` relative to `ctx.workdir`. Unless `unrestrictedPaths` is set,
- * absolute inputs are rejected and the **canonical** path is returned — every
- * symlink in `p` (including the leaf, even a dangling one) is resolved before
- * the workdir check, and the resolved path is what the tool then operates on, so
- * a symlink inside the workdir that points outside it can neither pass the check
- * nor be followed afterwards. See the trust model on {@link AgentToolContext}.
+ * Resolve `p` against `ctx.workdir`. Absolute and relative inputs go through
+ * the same canonicalise-then-contain check — an absolute path that lands inside
+ * the workdir is permitted, only paths that resolve *outside* are rejected.
+ * Every symlink in `p` (including the leaf, even a dangling one) is resolved
+ * before the workdir check, and the resolved path is what the tool then operates
+ * on, so a symlink inside the workdir that points outside it can neither pass
+ * the check nor be followed afterwards. See the trust model on
+ * {@link AgentToolContext}.
  *
  * Residual TOCTOU: a component could still be swapped for a symlink between this
  * call and the eventual `fs` operation. Closing that fully needs per-component

package/src/version.ts

@@ -1 +1 @@
-export const VERSION = '0.107.0'; // x-release-please-version
+export const VERSION = '0.109.0'; // x-release-please-version

package/tools/agent-toolset/fs-util.d.mts

@@ -19,9 +19,10 @@ export declare function canonicalize(abs: string): Promise<string>;
 /**
  * Resolve `p` and confine it to `root`.
  *
- * Unless `allowOutside` is set, absolute inputs are rejected and the
- * **canonical** path is returned — every symlink in `p` (including the leaf,
- * even a dangling one) is resolved before the confinement check, and the
+ * Absolute and relative inputs go through the same canonicalise-then-contain
+ * check — an absolute path that lands inside `root` is permitted, only paths
+ * that resolve *outside* are rejected. Every symlink in `p` (including the
+ * leaf, even a dangling one) is resolved before the confinement check, and the
  * resolved path is what the caller then operates on, so a symlink inside `root`
  * that points outside it can neither pass the check nor be followed afterwards.
  *

package/tools/agent-toolset/fs-util.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"fs-util.d.mts","sourceRoot":"","sources":["../../src/tools/agent-toolset/fs-util.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAOH,uFAAuF;AACvF,eAAO,MAAM,eAAe,MAAQ,CAAC;AACrC,4CAA4C;AAC5C,eAAO,MAAM,gBAAgB,MAAQ,CAAC;AAWtC;;;;;;GAMG;AACH,wBAAsB,YAAY,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAkC/D;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAsB,aAAa,CACjC,IAAI,EAAE,MAAM,EACZ,CAAC,EAAE,MAAM,EACT,IAAI,CAAC,EAAE;IAAE,YAAY,CAAC,EAAE,OAAO,CAAA;CAAE,GAChC,OAAO,CAAC,MAAM,CAAC,CAiBjB;AAED;;;;GAIG;AACH,wBAAsB,eAAe,CAAC,UAAU,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAgBxF;AAED;;;;;GAKG;AACH,wBAAgB,cAAc,CAAC,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,CAwBjE"}
+{"version":3,"file":"fs-util.d.mts","sourceRoot":"","sources":["../../src/tools/agent-toolset/fs-util.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAOH,uFAAuF;AACvF,eAAO,MAAM,eAAe,MAAQ,CAAC;AACrC,4CAA4C;AAC5C,eAAO,MAAM,gBAAgB,MAAQ,CAAC;AAWtC;;;;;;GAMG;AACH,wBAAsB,YAAY,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAkC/D;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAsB,aAAa,CACjC,IAAI,EAAE,MAAM,EACZ,CAAC,EAAE,MAAM,EACT,IAAI,CAAC,EAAE;IAAE,YAAY,CAAC,EAAE,OAAO,CAAA;CAAE,GAChC,OAAO,CAAC,MAAM,CAAC,CAUjB;AAED;;;;GAIG;AACH,wBAAsB,eAAe,CAAC,UAAU,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAgBxF;AAED;;;;;GAKG;AACH,wBAAgB,cAAc,CAAC,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,CAwBjE"}

package/tools/agent-toolset/fs-util.d.ts

@@ -19,9 +19,10 @@ export declare function canonicalize(abs: string): Promise<string>;
 /**
  * Resolve `p` and confine it to `root`.
  *
- * Unless `allowOutside` is set, absolute inputs are rejected and the
- * **canonical** path is returned — every symlink in `p` (including the leaf,
- * even a dangling one) is resolved before the confinement check, and the
+ * Absolute and relative inputs go through the same canonicalise-then-contain
+ * check — an absolute path that lands inside `root` is permitted, only paths
+ * that resolve *outside* are rejected. Every symlink in `p` (including the
+ * leaf, even a dangling one) is resolved before the confinement check, and the
  * resolved path is what the caller then operates on, so a symlink inside `root`
  * that points outside it can neither pass the check nor be followed afterwards.
  *

package/tools/agent-toolset/fs-util.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"fs-util.d.ts","sourceRoot":"","sources":["../../src/tools/agent-toolset/fs-util.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAOH,uFAAuF;AACvF,eAAO,MAAM,eAAe,MAAQ,CAAC;AACrC,4CAA4C;AAC5C,eAAO,MAAM,gBAAgB,MAAQ,CAAC;AAWtC;;;;;;GAMG;AACH,wBAAsB,YAAY,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAkC/D;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAsB,aAAa,CACjC,IAAI,EAAE,MAAM,EACZ,CAAC,EAAE,MAAM,EACT,IAAI,CAAC,EAAE;IAAE,YAAY,CAAC,EAAE,OAAO,CAAA;CAAE,GAChC,OAAO,CAAC,MAAM,CAAC,CAiBjB;AAED;;;;GAIG;AACH,wBAAsB,eAAe,CAAC,UAAU,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAgBxF;AAED;;;;;GAKG;AACH,wBAAgB,cAAc,CAAC,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,CAwBjE"}
+{"version":3,"file":"fs-util.d.ts","sourceRoot":"","sources":["../../src/tools/agent-toolset/fs-util.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAOH,uFAAuF;AACvF,eAAO,MAAM,eAAe,MAAQ,CAAC;AACrC,4CAA4C;AAC5C,eAAO,MAAM,gBAAgB,MAAQ,CAAC;AAWtC;;;;;;GAMG;AACH,wBAAsB,YAAY,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAkC/D;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAsB,aAAa,CACjC,IAAI,EAAE,MAAM,EACZ,CAAC,EAAE,MAAM,EACT,IAAI,CAAC,EAAE;IAAE,YAAY,CAAC,EAAE,OAAO,CAAA;CAAE,GAChC,OAAO,CAAC,MAAM,CAAC,CAUjB;AAED;;;;GAIG;AACH,wBAAsB,eAAe,CAAC,UAAU,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAgBxF;AAED;;;;;GAKG;AACH,wBAAgB,cAAc,CAAC,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,CAwBjE"}

package/tools/agent-toolset/fs-util.js

@@ -77,9 +77,10 @@ async function canonicalize(abs) {
 /**
  * Resolve `p` and confine it to `root`.
  *
- * Unless `allowOutside` is set, absolute inputs are rejected and the
- * **canonical** path is returned — every symlink in `p` (including the leaf,
- * even a dangling one) is resolved before the confinement check, and the
+ * Absolute and relative inputs go through the same canonicalise-then-contain
+ * check — an absolute path that lands inside `root` is permitted, only paths
+ * that resolve *outside* are rejected. Every symlink in `p` (including the
+ * leaf, even a dangling one) is resolved before the confinement check, and the
  * resolved path is what the caller then operates on, so a symlink inside `root`
  * that points outside it can neither pass the check nor be followed afterwards.
  *
@@ -90,19 +91,12 @@ async function canonicalize(abs) {
  */
 async function confineToRoot(root, p, opts) {
     const allowOutside = opts?.allowOutside ?? false;
-    if (path.isAbsolute(p)) {
-        if (!allowOutside) {
-            throw new ToolError_1.ToolError(`absolute path ${JSON.stringify(p)} not permitted`);
-        }
-        return path.resolve(p);
-    }
     const realRoot = await realpathOrSelf(path.resolve(root));
     const abs = path.resolve(realRoot, p);
     if (allowOutside)
         return abs;
     const real = await canonicalize(abs);
-    const rootSep = realRoot.endsWith(path.sep) ? realRoot : realRoot + path.sep;
-    if (real !== realRoot && !real.startsWith(rootSep)) {
+    if (real !== realRoot && !real.startsWith(realRoot + path.sep)) {
         throw new ToolError_1.ToolError(`path ${JSON.stringify(p)} escapes workdir`);
     }
     return real;

package/tools/agent-toolset/fs-util.js.map

@@ -1 +1 @@
-{"version":3,"file":"fs-util.js","sourceRoot":"","sources":["../../src/tools/agent-toolset/fs-util.ts"],"names":[],"mappings":";AAAA;;;;;GAKG;;;AA4BH,oCAkCC;AAgBD,sCAqBC;AAOD,0CAgBC;AAQD,wCAwBC;;AAxJD,6DAAuC;AACvC,wDAAkC;AAClC,6CAAyC;AACzC,4DAAsD;AAEtD,uFAAuF;AAC1E,QAAA,eAAe,GAAG,KAAK,CAAC;AACrC,4CAA4C;AAC/B,QAAA,gBAAgB,GAAG,KAAK,CAAC;AAEtC,0EAA0E;AAC1E,KAAK,UAAU,cAAc,CAAC,CAAS;IACrC,IAAI,CAAC;QACH,OAAO,MAAM,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;IAC9B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,CAAC,CAAC;IACX,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACI,KAAK,UAAU,YAAY,CAAC,GAAW;IAC5C,MAAM,IAAI,GAAa,EAAE,CAAC;IAC1B,IAAI,MAAM,GAAG,GAAG,CAAC;IACjB,IAAI,IAAI,GAAG,CAAC,CAAC;IACb,SAAS,CAAC;QACR,IAAI,IAAY,CAAC;QACjB,IAAI,CAAC;YACH,IAAI,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QACnC,CAAC;QAAC,MAAM,CAAC;YACP,IAAI,MAAM,GAAG,KAAK,CAAC;YACnB,IAAI,CAAC;gBACH,MAAM,GAAG,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,cAAc,EAAE,CAAC;YACrD,CAAC;YAAC,MAAM,CAAC;gBACP,oEAAoE;YACtE,CAAC;YACD,IAAI,MAAM,EAAE,CAAC;gBACX,sEAAsE;gBACtE,gEAAgE;gBAChE,oEAAoE;gBACpE,qEAAqE;gBACrE,IAAI,EAAE,IAAI,GAAG,EAAE,EAAE,CAAC;oBAChB,MAAM,IAAI,qBAAS,CAAC,QAAQ,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,wCAAwC,CAAC,CAAC;gBAC3F,CAAC;gBACD,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;gBACvE,SAAS;YACX,CAAC;YACD,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;YACpC,IAAI,MAAM,KAAK,MAAM;gBAAE,OAAO,GAAG,CAAC,CAAC,wCAAwC;YAC3E,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;YACjC,MAAM,GAAG,MAAM,CAAC;YAChB,SAAS;QACX,CAAC;QACD,OAAO,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACjE,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;GAaG;AACI,KAAK,UAAU,aAAa,CACjC,IAAY,EACZ,CAAS,EACT,IAAiC;IAEjC,MAAM,YAAY,GAAG,IAAI,EAAE,YAAY,IAAI,KAAK,CAAC;IACjD,IAAI,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC;QACvB,IAAI,CAAC,YAAY,EAAE,CAAC;YAClB,MAAM,IAAI,qBAAS,CAAC,iBAAiB,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC;QAC1E,CAAC;QACD,OAAO,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;IACzB,CAAC;IACD,MAAM,QAAQ,GAAG,MAAM,cAAc,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;IAC1D,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC;IACtC,IAAI,YAAY;QAAE,OAAO,GAAG,CAAC;IAC7B,MAAM,IAAI,GAAG,MAAM,YAAY,CAAC,GAAG,CAAC,CAAC;IACrC,MAAM,OAAO,GAAG,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,GAAG,IAAI,CAAC,GAAG,CAAC;IAC7E,IAAI,IAAI,KAAK,QAAQ,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;QACnD,MAAM,IAAI,qBAAS,CAAC,QAAQ,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC;IACnE,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;GAIG;AACI,KAAK,UAAU,eAAe,CAAC,UAAkB,EAAE,OAAe;IACvE,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;IACrC,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,QAAQ,OAAO,CAAC,GAAG,IAAI,IAAA,wBAAU,GAAE,EAAE,CAAC,CAAC;IACvE,IAAI,MAAiC,CAAC;IACtC,IAAI,CAAC;QACH,MAAM,GAAG,MAAM,EAAE,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,EAAE,wBAAgB,CAAC,CAAC;QACzD,MAAM,MAAM,CAAC,SAAS,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QACzC,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;QACpB,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;QACrB,MAAM,GAAG,SAAS,CAAC;QACnB,MAAM,EAAE,CAAC,MAAM,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;IACxC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,MAAM;YAAE,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;QACjD,MAAM,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;QAC1C,MAAM,GAAG,CAAC;IACZ,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,SAAgB,cAAc,CAAC,GAAY,EAAE,IAAY;IACvD,MAAM,IAAI,GAAI,GAAgC,EAAE,IAAI,CAAC;IACrD,QAAQ,IAAI,EAAE,CAAC;QACb,KAAK,QAAQ;YACX,OAAO,GAAG,IAAI,6BAA6B,CAAC;QAC9C,KAAK,QAAQ,CAAC;QACd,KAAK,OAAO;YACV,OAAO,GAAG,IAAI,qBAAqB,CAAC;QACtC,KAAK,SAAS;YACZ,OAAO,GAAG,IAAI,mBAAmB,CAAC;QACpC,KAAK,QAAQ;YACX,OAAO,GAAG,IAAI,kBAAkB,CAAC;QACnC,KAAK,OAAO;YACV,OAAO,GAAG,IAAI,qCAAqC,CAAC;QACtD,KAAK,cAAc;YACjB,OAAO,GAAG,IAAI,sBAAsB,CAAC;QACvC,KAAK,QAAQ;YACX,OAAO,GAAG,IAAI,2BAA2B,CAAC;QAC5C,KAAK,QAAQ,CAAC;QACd,KAAK,QAAQ;YACX,OAAO,GAAG,IAAI,uBAAuB,CAAC;QACxC;YACE,OAAO,GAAG,IAAI,KAAK,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC;IAC1E,CAAC;AACH,CAAC"}
+{"version":3,"file":"fs-util.js","sourceRoot":"","sources":["../../src/tools/agent-toolset/fs-util.ts"],"names":[],"mappings":";AAAA;;;;;GAKG;;;AA4BH,oCAkCC;AAiBD,sCAcC;AAOD,0CAgBC;AAQD,wCAwBC;;AAlJD,6DAAuC;AACvC,wDAAkC;AAClC,6CAAyC;AACzC,4DAAsD;AAEtD,uFAAuF;AAC1E,QAAA,eAAe,GAAG,KAAK,CAAC;AACrC,4CAA4C;AAC/B,QAAA,gBAAgB,GAAG,KAAK,CAAC;AAEtC,0EAA0E;AAC1E,KAAK,UAAU,cAAc,CAAC,CAAS;IACrC,IAAI,CAAC;QACH,OAAO,MAAM,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;IAC9B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,CAAC,CAAC;IACX,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACI,KAAK,UAAU,YAAY,CAAC,GAAW;IAC5C,MAAM,IAAI,GAAa,EAAE,CAAC;IAC1B,IAAI,MAAM,GAAG,GAAG,CAAC;IACjB,IAAI,IAAI,GAAG,CAAC,CAAC;IACb,SAAS,CAAC;QACR,IAAI,IAAY,CAAC;QACjB,IAAI,CAAC;YACH,IAAI,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QACnC,CAAC;QAAC,MAAM,CAAC;YACP,IAAI,MAAM,GAAG,KAAK,CAAC;YACnB,IAAI,CAAC;gBACH,MAAM,GAAG,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,cAAc,EAAE,CAAC;YACrD,CAAC;YAAC,MAAM,CAAC;gBACP,oEAAoE;YACtE,CAAC;YACD,IAAI,MAAM,EAAE,CAAC;gBACX,sEAAsE;gBACtE,gEAAgE;gBAChE,oEAAoE;gBACpE,qEAAqE;gBACrE,IAAI,EAAE,IAAI,GAAG,EAAE,EAAE,CAAC;oBAChB,MAAM,IAAI,qBAAS,CAAC,QAAQ,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,wCAAwC,CAAC,CAAC;gBAC3F,CAAC;gBACD,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;gBACvE,SAAS;YACX,CAAC;YACD,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;YACpC,IAAI,MAAM,KAAK,MAAM;gBAAE,OAAO,GAAG,CAAC,CAAC,wCAAwC;YAC3E,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;YACjC,MAAM,GAAG,MAAM,CAAC;YAChB,SAAS;QACX,CAAC;QACD,OAAO,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACjE,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACI,KAAK,UAAU,aAAa,CACjC,IAAY,EACZ,CAAS,EACT,IAAiC;IAEjC,MAAM,YAAY,GAAG,IAAI,EAAE,YAAY,IAAI,KAAK,CAAC;IACjD,MAAM,QAAQ,GAAG,MAAM,cAAc,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;IAC1D,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC;IACtC,IAAI,YAAY;QAAE,OAAO,GAAG,CAAC;IAC7B,MAAM,IAAI,GAAG,MAAM,YAAY,CAAC,GAAG,CAAC,CAAC;IACrC,IAAI,IAAI,KAAK,QAAQ,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,QAAQ,GAAG,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QAC/D,MAAM,IAAI,qBAAS,CAAC,QAAQ,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC;IACnE,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;GAIG;AACI,KAAK,UAAU,eAAe,CAAC,UAAkB,EAAE,OAAe;IACvE,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;IACrC,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,QAAQ,OAAO,CAAC,GAAG,IAAI,IAAA,wBAAU,GAAE,EAAE,CAAC,CAAC;IACvE,IAAI,MAAiC,CAAC;IACtC,IAAI,CAAC;QACH,MAAM,GAAG,MAAM,EAAE,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,EAAE,wBAAgB,CAAC,CAAC;QACzD,MAAM,MAAM,CAAC,SAAS,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QACzC,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;QACpB,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;QACrB,MAAM,GAAG,SAAS,CAAC;QACnB,MAAM,EAAE,CAAC,MAAM,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;IACxC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,MAAM;YAAE,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;QACjD,MAAM,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;QAC1C,MAAM,GAAG,CAAC;IACZ,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,SAAgB,cAAc,CAAC,GAAY,EAAE,IAAY;IACvD,MAAM,IAAI,GAAI,GAAgC,EAAE,IAAI,CAAC;IACrD,QAAQ,IAAI,EAAE,CAAC;QACb,KAAK,QAAQ;YACX,OAAO,GAAG,IAAI,6BAA6B,CAAC;QAC9C,KAAK,QAAQ,CAAC;QACd,KAAK,OAAO;YACV,OAAO,GAAG,IAAI,qBAAqB,CAAC;QACtC,KAAK,SAAS;YACZ,OAAO,GAAG,IAAI,mBAAmB,CAAC;QACpC,KAAK,QAAQ;YACX,OAAO,GAAG,IAAI,kBAAkB,CAAC;QACnC,KAAK,OAAO;YACV,OAAO,GAAG,IAAI,qCAAqC,CAAC;QACtD,KAAK,cAAc;YACjB,OAAO,GAAG,IAAI,sBAAsB,CAAC;QACvC,KAAK,QAAQ;YACX,OAAO,GAAG,IAAI,2BAA2B,CAAC;QAC5C,KAAK,QAAQ,CAAC;QACd,KAAK,QAAQ;YACX,OAAO,GAAG,IAAI,uBAAuB,CAAC;QACxC;YACE,OAAO,GAAG,IAAI,KAAK,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC;IAC1E,CAAC;AACH,CAAC"}