@deepstrike/wasm 0.2.42 → 0.2.44

package/dist/harness/index.d.ts

@@ -7,6 +7,12 @@ export interface AttemptRequest {
     sessionId?: string;
     goal: string;
     criteria?: Criterion[];
+    /**
+     * Multimodal inputs (images / audio) attached to the task. Forwarded to every attempt
+     * unconditionally; the runner seeds them per session idempotently, so fresh-session carries
+     * re-seed while same-session carries do not double.
+     */
+    attachments?: import("../types.js").ContentPart[];
     extensions?: Record<string, unknown>;
     inheritEvents?: Array<{
         seq: number;

package/dist/harness/index.js

@@ -14,6 +14,7 @@ export class RuntimeAttemptBody {
             sessionId: context.sessionId,
             goal: context.goal,
             criteria: (context.criteria ?? []).map(criterion => criterion.text),
+            ...(context.attachments?.length ? { attachments: context.attachments } : {}),
             extensions: context.extensions,
             ...(context.attempt === 1 && context.inheritEvents
                 ? { inheritEvents: context.inheritEvents }

package/dist/runtime/kernel-step.js

@@ -18,7 +18,6 @@ export function restoreKernelRuntime(runtime, snapshot) {
     }, 1);
     kernelWireStates.set(runtime, { operationId, nextEventSequence });
 }
-let nextOperationSequence = 1;
 const kernelWireStates = new WeakMap();
 function tryParseJson(s) {
     try {
@@ -267,7 +266,10 @@ function mapKernelAction(raw) {
 function stepInput(runtime, event) {
     let state = kernelWireStates.get(runtime);
     if (!state) {
-        state = { operationId: `wasm-operation-${nextOperationSequence++}`, nextEventSequence: 1 };
+        // Globally unique, never a process-local counter: durable session logs key the kernel
+        // genesis/transaction chains by (sessionId, operationId) and outlive this isolate, so a
+        // counter that restarts at 1 collides with a prior chain on the same session.
+        state = { operationId: `wasm-operation-${crypto.randomUUID()}`, nextEventSequence: 1 };
         kernelWireStates.set(runtime, state);
     }
     const correlatedEvent = event.kind === "cancel_operation"

package/dist/runtime/large-result-spool.d.ts

@@ -43,14 +43,15 @@ export declare class LargeResultSpool {
     private writeToDriver;
     private generatePreview;
     processToolResult(result: ToolResult): Promise<SpooledToolResult>;
-    persistOutput(callId: string, content: string): Promise<string>;
+    private callKey;
+    persistOutput(sessionId: string, callId: string, content: string): Promise<string>;
     readSpooledResult(spoolRef: string): Promise<string>;
     /**
      * O7: locate a spooled output by the tool call's id (the `read_result` meta-tool only knows
      * `call_id`, not the content-hashed key `persistOutput` chose). Scans the driver's key list for
-     * the `.spool/${callId}-*.txt` naming convention; returns `undefined` if nothing was ever
+     * the hashed session-scoped call-key prefix; returns `undefined` if nothing was ever
      * spooled for that call.
      */
-    findByCallId(callId: string): Promise<string | undefined>;
+    findByCallId(sessionId: string, callId: string): Promise<string | undefined>;
     cleanup(maxAgeMs?: number): Promise<number>;
 }

package/dist/runtime/large-result-spool.js

@@ -92,9 +92,16 @@ omitted: ${omitted} chars
             wasSpooled: true,
         };
     }
-    async persistOutput(callId, content) {
+    callKey(sessionId, callId) {
+        // Session-scoped and hashed: the driver's key space is shared across sessions and outlives
+        // runs, while vendor call ids can be index-style ("call_0") and repeat — an unscoped key
+        // lets read_result in one session fetch another session's spooled output. Hashing also keeps
+        // untrusted call-id characters out of driver keys (parity with Node/Python).
+        return simpleHash(`${sessionId}\u0000${callId}`);
+    }
+    async persistOutput(sessionId, callId, content) {
         const hash = simpleHash(content);
-        const key = `.spool/${callId}-${hash.slice(0, 16)}.txt`;
+        const key = `.spool/${this.callKey(sessionId, callId)}-${hash.slice(0, 16)}.txt`;
         let promise = this.activeWrites.get(key);
         if (!promise) {
             promise = (async () => {
@@ -116,10 +123,10 @@ omitted: ${omitted} chars
     /**
      * O7: locate a spooled output by the tool call's id (the `read_result` meta-tool only knows
      * `call_id`, not the content-hashed key `persistOutput` chose). Scans the driver's key list for
-     * the `.spool/${callId}-*.txt` naming convention; returns `undefined` if nothing was ever
+     * the hashed session-scoped call-key prefix; returns `undefined` if nothing was ever
      * spooled for that call.
      */
-    async findByCallId(callId) {
+    async findByCallId(sessionId, callId) {
         let keys;
         try {
             keys = await this.driver.list();
@@ -127,7 +134,7 @@ omitted: ${omitted} chars
         catch {
             return undefined;
         }
-        const prefix = `.spool/${callId}-`;
+        const prefix = `.spool/${this.callKey(sessionId, callId)}-`;
         const match = keys.find(k => k.startsWith(prefix) && k.endsWith('.txt'));
         if (!match)
             return undefined;

package/dist/runtime/runner.js

@@ -158,6 +158,12 @@ export class RuntimeRunner {
     async *run(req) {
         const prior = req.inheritEvents ?? await this.opts.sessionLog.read(req.sessionId);
         const midRun = isMidRun(prior);
+        // Idempotent per session: an earlier run's `run_started` already carries these attachments
+        // (same-session retry attempt), so replay reconstructs them — recording and seeding again
+        // would double them in history. Deduping at the append keeps live and replay in agreement.
+        const attachments = req.attachments?.length && !attachmentsAlreadySeeded(prior, req.attachments)
+            ? req.attachments
+            : undefined;
         if (!midRun) {
             await this.opts.sessionLog.append(req.sessionId, {
                 kind: "run_started",
@@ -166,10 +172,10 @@ export class RuntimeRunner {
                 criteria: req.criteria ?? [],
                 agent_id: this.opts.agentId,
                 system_prompt: this.opts.systemPrompt,
-                ...(req.attachments?.length ? { attachments: req.attachments } : {}),
+                ...(attachments ? { attachments } : {}),
             });
         }
-        yield* this.execute(req.sessionId, req.goal, req.criteria ?? [], req.extensions, prior.length > 0 ? prior : undefined, midRun, req.attachments);
+        yield* this.execute(req.sessionId, req.goal, req.criteria ?? [], req.extensions, prior.length > 0 ? prior : undefined, midRun, attachments);
     }
     async *wake(sessionId, extensions) {
         const events = await this.opts.sessionLog.read(sessionId);
@@ -352,7 +358,7 @@ export class RuntimeRunner {
         let full;
         if (full === undefined && this.opts.resultSpool) {
             try {
-                full = await this.opts.resultSpool.findByCallId(callId);
+                full = await this.opts.resultSpool.findByCallId(sessionId, callId);
             }
             catch {
                 full = undefined;
@@ -801,7 +807,7 @@ export class RuntimeRunner {
                     let spoolRef;
                     let error;
                     try {
-                        spoolRef = await spool.persistOutput(action.callId, action.output);
+                        spoolRef = await spool.persistOutput(sessionId, action.callId, action.output);
                     }
                     catch (cause) {
                         error = formatToolError(cause);
@@ -2143,6 +2149,15 @@ function signalToKernelEvent(delivery) {
         },
     };
 }
+/**
+ * True when an earlier run in this session already seeded the same attachments. Replay
+ * reconstructs the attachment message from that run's `run_started`, so recording and
+ * live-seeding them again (a same-session retry attempt) would double them in history.
+ */
+function attachmentsAlreadySeeded(prior, attachments) {
+    const wanted = JSON.stringify(attachments);
+    return prior.some(({ event }) => event.kind === "run_started" && JSON.stringify(event.attachments ?? []) === wanted);
+}
 /** Convert SDK ContentParts (camelCase mediaType) to kernel serde shape (media_type). */
 function attachmentsToKernelMessage(parts) {
     const content = parts.map(p => {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@deepstrike/wasm",
-  "version": "0.2.42",
+  "version": "0.2.44",
   "description": "DeepStrike WASM SDK — browser, Cloudflare Workers, Deno Deploy",
   "type": "module",
   "main": "dist/index.js",
@@ -10,12 +10,12 @@
     "README.md"
   ],
   "scripts": {
-    "build:wasm": "wasm-pack build ../../crates/deepstrike-wasm --target bundler --out-dir ../../wasm/pkg",
+    "build:wasm": "wasm-pack build ../crates/deepstrike-wasm --target bundler --out-dir ../../wasm/pkg",
     "build": "tsc",
     "test": "node --experimental-vm-modules node_modules/.bin/jest"
   },
   "dependencies": {
-    "@deepstrike/wasm-kernel": "0.2.42"
+    "@deepstrike/wasm-kernel": "0.2.44"
   },
   "devDependencies": {
     "@types/jest": "^30.0.0",