@axlsdk/studio 0.21.1 → 0.22.1

package/dist/cli.cjs

@@ -118,6 +118,19 @@ function redactStreamEvent(event, redact) {
   if (!redact) return event;
   return (0, import_axl.redactHistoricalEvent)(event);
 }
+function sanitizeRichInputFailure(event) {
+  const message = "Playground media input failed";
+  if (event.type === "ask_end" && !event.outcome.ok) {
+    return { ...event, outcome: { ok: false, error: message } };
+  }
+  if (event.type === "agent_call_end" && event.data.error !== void 0) {
+    return { ...event, data: { ...event.data, error: message } };
+  }
+  if (event.type === "error") {
+    return { ...event, data: { ...event.data, message } };
+  }
+  return event;
+}
 function redactEvalItem(item) {
   const scrubbed = {
     ...item,
@@ -836,11 +849,11 @@ function reduceCost(acc, event) {
     byWorkflow2[event.workflow] = { ...prev, executions: prev.executions + 1 };
     return { ...acc, byWorkflow: byWorkflow2 };
   }
-  if (event.cost == null && !event.tokens) return acc;
+  const unpricedLeaf = (0, import_axl2.isUnpricedLeaf)(event);
+  if (event.cost == null && !event.tokens && !unpricedLeaf) return acc;
   const cost = (0, import_axl2.eventCostContribution)(event);
   if (event.type === "ask_end") return acc;
   const tokens = event.tokens ?? {};
-  const unpricedLeaf = (0, import_axl2.isUnpricedLeaf)(event);
   const totalTokens = event.type === "agent_call_end" ? {
     input: acc.totalTokens.input + finite(tokens.input),
     output: acc.totalTokens.output + finite(tokens.output),
@@ -1353,6 +1366,24 @@ var executions_default = createExecutionRoutes();
 
 // src/server/routes/sessions.ts
 var import_hono4 = require("hono");
+function describeStudioInput(content) {
+  if (typeof content === "string") return void 0;
+  return {
+    parts: content.map((part) => {
+      if (part.type === "text") return { type: "text", characters: part.text.length };
+      const { source } = part;
+      const bytes = source.type === "bytes" ? source.data.byteLength : source.type === "base64" ? Math.floor(source.data.length * 3 / 4) - (source.data.endsWith("==") ? 2 : source.data.endsWith("=") ? 1 : 0) : void 0;
+      return {
+        type: "image",
+        source: source.type,
+        ...source.mediaType ? { mediaType: source.mediaType } : {},
+        ...bytes !== void 0 ? { bytes } : {}
+        // URLs, provider-file references, and labels are intentionally not
+        // included: this is a Studio-safe descriptor, not a replay payload.
+      };
+    })
+  };
+}
 function createSessionRoutes(connMgr) {
   const app5 = new import_hono4.Hono();
   app5.get("/sessions", async (c) => {
@@ -1375,11 +1406,17 @@ function createSessionRoutes(connMgr) {
     const id = c.req.param("id");
     const history = await store.getSession(id);
     const handoffHistory = await store.getSessionMeta(id, "handoffHistory");
+    const redact = runtime.isRedactEnabled();
+    const studioHistory = history.map((message) => {
+      const input = describeStudioInput(message.content);
+      if (input) return { ...message, content: input };
+      return redact ? redactSessionHistory([message], true)[0] : message;
+    });
     return c.json({
       ok: true,
       data: {
         id,
-        history: redactSessionHistory(history, runtime.isRedactEnabled()),
+        history: studioHistory,
         // HandoffRecord has no content fields (source/target/mode/
         // timestamp/duration) — nothing to scrub.
         handoffHistory: handoffHistory ?? []
@@ -15949,6 +15986,54 @@ function date4(params) {
 // ../../node_modules/.pnpm/zod@4.3.6/node_modules/zod/v4/classic/external.js
 config(en_default());
 
+// src/playground-image.ts
+var PLAYGROUND_IMAGE_MAX_BYTES = 5 * 1024 * 1024;
+var PLAYGROUND_IMAGE_MAX_BASE64_CHARACTERS = Math.ceil(PLAYGROUND_IMAGE_MAX_BYTES / 3) * 4;
+var PLAYGROUND_IMAGE_REQUEST_MAX_BYTES = PLAYGROUND_IMAGE_MAX_BASE64_CHARACTERS + 16 * 1024;
+var PLAYGROUND_IMAGE_MEDIA_TYPES = [
+  "image/png",
+  "image/jpeg",
+  "image/webp",
+  "image/gif"
+];
+function isPlaygroundImageMediaType(value) {
+  return typeof value === "string" && PLAYGROUND_IMAGE_MEDIA_TYPES.includes(value);
+}
+function base64ByteLength(value) {
+  if (value.length === 0 || value.length % 4 !== 0 || !/^[A-Za-z0-9+/]*={0,2}$/.test(value)) {
+    return void 0;
+  }
+  const padding = value.endsWith("==") ? 2 : value.endsWith("=") ? 1 : 0;
+  return value.length / 4 * 3 - padding;
+}
+function decodedPrefix(value, length) {
+  try {
+    const prefix = value.slice(0, Math.ceil(length / 3) * 4);
+    const decoded = atob(prefix);
+    return Uint8Array.from(decoded, (character) => character.charCodeAt(0));
+  } catch {
+    return void 0;
+  }
+}
+function hasMatchingImageSignature(mediaType, data) {
+  const bytes = decodedPrefix(data, 12);
+  if (!bytes) return false;
+  const startsWith = (...prefix) => prefix.every((byte, index) => bytes[index] === byte);
+  switch (mediaType) {
+    case "image/png":
+      return startsWith(137, 80, 78, 71, 13, 10, 26, 10);
+    case "image/jpeg":
+      return startsWith(255, 216, 255);
+    case "image/gif":
+      return startsWith(71, 73, 70, 56) && (bytes[4] === 55 || bytes[4] === 57) && bytes[5] === 97;
+    case "image/webp":
+      return startsWith(82, 73, 70, 70) && startsWithAt(bytes, 8, 87, 69, 66, 80);
+  }
+}
+function startsWithAt(bytes, offset, ...prefix) {
+  return prefix.every((byte, index) => bytes[offset + index] === byte);
+}
+
 // src/server/routes/playground.ts
 var DEMO_SCHEMA_BY_AGENT = {
   "streaming-structured-agent": external_exports.object({
@@ -15958,11 +16043,74 @@ var DEMO_SCHEMA_BY_AGENT = {
     confidence: external_exports.number().min(0).max(1)
   })
 };
+var PlaygroundBodyTooLargeError = class extends Error {
+};
+async function readPlaygroundBody(request) {
+  const contentLength = request.headers.get("content-length");
+  if (contentLength !== null) {
+    const bytes = Number(contentLength);
+    if (!Number.isSafeInteger(bytes) || bytes < 0 || bytes > PLAYGROUND_IMAGE_REQUEST_MAX_BYTES) {
+      throw new PlaygroundBodyTooLargeError();
+    }
+  }
+  if (!request.body) throw new SyntaxError("missing body");
+  const reader = request.body.getReader();
+  const chunks = [];
+  let total = 0;
+  try {
+    while (true) {
+      const next = await reader.read();
+      if (next.done) break;
+      total += next.value.byteLength;
+      if (total > PLAYGROUND_IMAGE_REQUEST_MAX_BYTES) {
+        await reader.cancel();
+        throw new PlaygroundBodyTooLargeError();
+      }
+      chunks.push(next.value);
+    }
+  } finally {
+    reader.releaseLock();
+  }
+  const body = new Uint8Array(total);
+  let offset = 0;
+  for (const chunk of chunks) {
+    body.set(chunk, offset);
+    offset += chunk.byteLength;
+  }
+  return JSON.parse(new TextDecoder().decode(body));
+}
 function createPlaygroundRoutes(connMgr) {
   const app5 = new import_hono11.Hono();
   app5.post("/playground/chat", async (c) => {
     const runtime = c.get("runtime");
-    const body = await c.req.json();
+    let parsedBody;
+    try {
+      parsedBody = await readPlaygroundBody(c.req.raw);
+    } catch (error48) {
+      if (error48 instanceof PlaygroundBodyTooLargeError) {
+        return c.json(
+          {
+            ok: false,
+            error: { code: "REQUEST_TOO_LARGE", message: "playground image request is too large" }
+          },
+          413
+        );
+      }
+      return c.json(
+        { ok: false, error: { code: "INVALID_INPUT", message: "request body must be valid JSON" } },
+        400
+      );
+    }
+    if (!parsedBody || typeof parsedBody !== "object" || Array.isArray(parsedBody)) {
+      return c.json(
+        {
+          ok: false,
+          error: { code: "INVALID_INPUT", message: "request body must be a JSON object" }
+        },
+        400
+      );
+    }
+    const body = parsedBody;
     if (!body.message || typeof body.message !== "string" || !body.message.trim()) {
       return c.json(
         {
@@ -15975,6 +16123,58 @@ function createPlaygroundRoutes(connMgr) {
         400
       );
     }
+    const message = body.message;
+    let image;
+    if (body.image !== void 0) {
+      const candidate = body.image;
+      if (!candidate || typeof candidate !== "object" || !isPlaygroundImageMediaType(candidate.mediaType) || typeof candidate.data !== "string") {
+        return c.json(
+          {
+            ok: false,
+            error: { code: "INVALID_IMAGE", message: "image must be a supported base64 image" }
+          },
+          400
+        );
+      }
+      if (candidate.data.length > PLAYGROUND_IMAGE_MAX_BASE64_CHARACTERS) {
+        return c.json(
+          { ok: false, error: { code: "IMAGE_TOO_LARGE", message: "image must be at most 5 MiB" } },
+          400
+        );
+      }
+      const bytes = base64ByteLength(candidate.data);
+      if (bytes === void 0) {
+        return c.json(
+          {
+            ok: false,
+            error: { code: "INVALID_IMAGE", message: "image data must be valid base64" }
+          },
+          400
+        );
+      }
+      if (bytes > PLAYGROUND_IMAGE_MAX_BYTES) {
+        return c.json(
+          {
+            ok: false,
+            error: {
+              code: "IMAGE_TOO_LARGE",
+              message: `image must be at most ${PLAYGROUND_IMAGE_MAX_BYTES / 1024 / 1024} MiB`
+            }
+          },
+          400
+        );
+      }
+      if (!hasMatchingImageSignature(candidate.mediaType, candidate.data)) {
+        return c.json(
+          {
+            ok: false,
+            error: { code: "INVALID_IMAGE", message: "image data does not match its media type" }
+          },
+          400
+        );
+      }
+      image = { mediaType: candidate.mediaType, data: candidate.data };
+    }
     const agents = runtime.getAgents();
     const agent = body.agent ? agents.find((a) => a._name === body.agent) : agents[0];
     if (!agent) {
@@ -15989,14 +16189,18 @@ function createPlaygroundRoutes(connMgr) {
     const sessionId = body.sessionId ?? `playground-${Date.now()}`;
     const store = runtime.getStateStore();
     const history = await store.getSession(sessionId);
-    history.push({ role: "user", content: body.message });
+    const persistedHistory = [...history, { role: "user", content: message }];
     const redactOn = runtime.isRedactEnabled();
     const ctx = runtime.createContext({ sessionHistory: history });
     const executionId = ctx.executionId;
     void ctx.events;
     const traceListener = (event) => {
       if (event.executionId !== executionId) return;
-      connMgr.broadcastWithWildcard(`execution:${executionId}`, redactStreamEvent(event, redactOn));
+      const safeEvent = image ? sanitizeRichInputFailure(event) : event;
+      connMgr.broadcastWithWildcard(
+        `execution:${executionId}`,
+        redactStreamEvent(safeEvent, redactOn)
+      );
     };
     runtime.on("trace", traceListener);
     (async () => {
@@ -16009,10 +16213,17 @@ function createPlaygroundRoutes(connMgr) {
       });
       try {
         const schema = DEMO_SCHEMA_BY_AGENT[agent._name];
-        const result = await ctx.ask(agent, body.message, schema ? { schema } : void 0);
+        const input = image ? [
+          { type: "text", text: message },
+          {
+            type: "image",
+            source: { type: "base64", data: image.data, mediaType: image.mediaType }
+          }
+        ] : message;
+        const result = await ctx.ask(agent, input, schema ? { schema } : void 0);
         const resultText = typeof result === "string" ? result : JSON.stringify(result);
-        history.push({ role: "assistant", content: resultText });
-        await store.saveSession(sessionId, history);
+        persistedHistory.push({ role: "assistant", content: resultText });
+        await store.saveSession(sessionId, persistedHistory);
         const doneEvent = {
           ...terminalFields(),
           type: "done",
@@ -16026,7 +16237,11 @@ function createPlaygroundRoutes(connMgr) {
         const errorEvent = {
           ...terminalFields(),
           type: "error",
-          data: { message: err instanceof Error ? err.message : String(err) }
+          // Media payloads can make providers echo user-controlled content in
+          // errors. The manual terminal event is deliberately fixed and safe.
+          data: {
+            message: image ? "Playground media input failed" : err instanceof Error ? err.message : String(err)
+          }
         };
         connMgr.broadcastWithWildcard(
           `execution:${executionId}`,
@@ -16419,7 +16634,7 @@ Tip: Use .mts for configs with top-level await or in projects without "type": "m
       ].join("\n");
       nodeModule.register(`data:text/javascript,${encodeURIComponent(hookCode)}`);
     } catch {
-      console.warn(`[axl-studio] Warning: --conditions requires Node.js 20.6+`);
+      console.warn(`[axl-studio] Warning: this Node.js runtime does not support --conditions`);
     }
   }
   console.log(`[axl-studio] Loading config from ${configPath}`);