@duckmind/dm-windows-x64 0.61.4 → 0.61.9

package/extensions/dm-subagents/src/runs/shared/capability-ceiling.js

@@ -0,0 +1,175 @@
+import { Buffer } from "node:buffer";
+export const SUBAGENT_CAPABILITY_CEILING_VERSION = 1;
+export const SUBAGENT_CAPABILITY_CEILING_REGISTRY_KEY = "dm-subagents.capability-ceiling.v1";
+export const SUBAGENT_CAPABILITY_CEILING_ENV = "DM_SUBAGENT_CAPABILITY_CEILING_V1";
+function registry() {
+  const key = Symbol.for(SUBAGENT_CAPABILITY_CEILING_REGISTRY_KEY);
+  const store = globalThis;
+  const existing = store[key];
+  if (existing instanceof Map)
+    return existing;
+  const created = new Map;
+  store[key] = created;
+  return created;
+}
+function validateText(value, field) {
+  if (typeof value !== "string" || !value.trim() || /[\u0000-\u001f\u007f]/u.test(value) || Buffer.byteLength(value.trim(), "utf8") > 256) {
+    throw new Error(`Invalid capability ceiling ${field}; expected a non-empty string without control characters (max 256 UTF-8 bytes).`);
+  }
+  return value.trim();
+}
+function normalizeCeiling(ceiling) {
+  if (!ceiling || typeof ceiling !== "object" || Array.isArray(ceiling))
+    throw new Error("Invalid capability ceiling; expected an object.");
+  const hasAllowedTools = Object.hasOwn(ceiling, "allowedTools");
+  const hasAllowedAgents = Object.hasOwn(ceiling, "allowedAgents");
+  const hasDenyExtensions = Object.hasOwn(ceiling, "denyExtensions");
+  if (!hasAllowedTools && !hasAllowedAgents && !hasDenyExtensions)
+    throw new Error("Invalid capability ceiling; expected allowedTools, allowedAgents, or denyExtensions.");
+  if (hasDenyExtensions && typeof ceiling.denyExtensions !== "boolean")
+    throw new Error("Invalid capability ceiling denyExtensions; expected a boolean.");
+  const normalizeList = (field, pattern) => {
+    if (!Object.hasOwn(ceiling, field))
+      return;
+    const values = ceiling[field];
+    if (!Array.isArray(values))
+      throw new Error(`Invalid capability ceiling ${field}; expected an array.`);
+    if (values.length > 256)
+      throw new Error(`Invalid capability ceiling ${field}; expected at most 256 names.`);
+    return [...new Set(values.map((entry) => {
+      const name = validateText(entry, `${field} entry`);
+      if (!pattern.test(name))
+        throw new Error(`Invalid capability ceiling ${field} entry '${name}'.`);
+      if (Buffer.byteLength(name, "utf8") > 128)
+        throw new Error(`Invalid capability ceiling ${field} entry '${name}'; max 128 UTF-8 bytes.`);
+      return name;
+    }))].sort();
+  };
+  const allowedTools = normalizeList("allowedTools", /^[A-Za-z0-9_.:-]+$/u);
+  const allowedAgents = normalizeList("allowedAgents", /^[A-Za-z0-9_.:-]+$/u);
+  return {
+    version: SUBAGENT_CAPABILITY_CEILING_VERSION,
+    ...allowedTools !== undefined ? { allowedTools } : {},
+    ...allowedAgents !== undefined ? { allowedAgents } : {},
+    denyExtensions: ceiling.denyExtensions === true,
+    sources: []
+  };
+}
+export function parseSubagentCapabilityCeiling(value, field = "capability ceiling") {
+  if (!value || typeof value !== "object" || Array.isArray(value))
+    throw new Error(`Invalid ${field}; expected an object.`);
+  const record = value;
+  if (record.version !== SUBAGENT_CAPABILITY_CEILING_VERSION)
+    throw new Error(`Invalid ${field} version.`);
+  const normalized = normalizeCeiling(record);
+  const sources = record.sources;
+  if (!Array.isArray(sources) || sources.some((source) => typeof source !== "string"))
+    throw new Error(`Invalid ${field} sources; expected an array of strings.`);
+  normalized.sources = [...new Set(sources.map((source) => validateText(source, `${field} source`)))].sort();
+  return normalized;
+}
+export function registerSubagentCapabilityCeiling(options) {
+  const sessionId = validateText(options.sessionId, "sessionId");
+  const source = validateText(options.source, "source");
+  let normalized = normalizeCeiling(options.ceiling);
+  const token = Symbol(source);
+  const store = registry();
+  let session = store.get(sessionId);
+  if (!session) {
+    session = new Map;
+    store.set(sessionId, session);
+  }
+  const setRegistration = () => {
+    normalized = normalizeCeiling(normalized);
+    normalized.sources = [source];
+    session.set(token, { source, ceiling: normalized });
+  };
+  setRegistration();
+  let disposed = false;
+  return {
+    update(ceiling) {
+      if (disposed)
+        throw new Error("Cannot update a disposed capability ceiling handle.");
+      normalized = normalizeCeiling(ceiling);
+      normalized.sources = [source];
+      session.set(token, { source, ceiling: normalized });
+    },
+    dispose() {
+      if (disposed)
+        return;
+      disposed = true;
+      session.delete(token);
+      if (session.size === 0)
+        store.delete(sessionId);
+    }
+  };
+}
+export function intersectSubagentCapabilityCeilings(...ceilings) {
+  const active = ceilings.filter((ceiling) => ceiling !== undefined);
+  if (active.length === 0)
+    return;
+  const intersectLists = (field) => {
+    const definedLists = active.filter((ceiling) => ceiling[field] !== undefined).map((ceiling) => new Set(ceiling[field]));
+    if (definedLists.length === 0)
+      return;
+    return [...definedLists[0]].filter((entry) => definedLists.every((list) => list.has(entry))).sort();
+  };
+  const allowedTools = intersectLists("allowedTools");
+  const allowedAgents = intersectLists("allowedAgents");
+  return {
+    version: SUBAGENT_CAPABILITY_CEILING_VERSION,
+    ...allowedTools !== undefined ? { allowedTools } : {},
+    ...allowedAgents !== undefined ? { allowedAgents } : {},
+    denyExtensions: active.some((ceiling) => ceiling.denyExtensions),
+    sources: [...new Set(active.flatMap((ceiling) => ceiling.sources))].sort()
+  };
+}
+export function resolveSubagentCapabilityCeiling(sessionId, inherited) {
+  const active = [];
+  if (sessionId) {
+    const registrations = registry().get(sessionId);
+    if (registrations)
+      active.push(...Array.from(registrations.values(), ({ ceiling }) => ceiling));
+  }
+  return intersectSubagentCapabilityCeilings(inherited, ...active);
+}
+export function resolveCurrentSubagentCapabilityCeiling(sessionId) {
+  return resolveSubagentCapabilityCeiling(sessionId, decodeSubagentCapabilityCeiling(process.env[SUBAGENT_CAPABILITY_CEILING_ENV]));
+}
+export function isAgentAllowedByCapabilityCeiling(agentName, ceiling) {
+  return ceiling?.allowedAgents === undefined || ceiling.allowedAgents.includes(agentName);
+}
+export function capabilityCeilingAgentRestrictionMessage(agentName, ceiling) {
+  if (isAgentAllowedByCapabilityCeiling(agentName, ceiling))
+    return;
+  const sources = ceiling?.sources.length ? ceiling.sources.join(", ") : "unknown source";
+  const allowed = ceiling?.allowedAgents?.length ? ceiling.allowedAgents.join(", ") : "(none)";
+  return `Capability ceiling from ${sources} does not allow agent '${agentName}'. Allowed agents: ${allowed}.`;
+}
+export function assertAgentAllowedByCapabilityCeiling(agentName, ceiling) {
+  const message = capabilityCeilingAgentRestrictionMessage(agentName, ceiling);
+  if (message)
+    throw new Error(message);
+}
+export function capabilityCeilingAgentRestrictionSources(ceiling) {
+  return ceiling?.allowedAgents === undefined ? undefined : [...ceiling.sources];
+}
+export function encodeSubagentCapabilityCeiling(ceiling) {
+  if (!ceiling)
+    return;
+  return Buffer.from(JSON.stringify(ceiling), "utf8").toString("base64url");
+}
+export function decodeSubagentCapabilityCeiling(value) {
+  if (value === undefined || value === "")
+    return;
+  let parsed;
+  try {
+    parsed = JSON.parse(Buffer.from(value, "base64url").toString("utf8"));
+  } catch (error) {
+    throw new Error(`Invalid inherited capability ceiling: ${error instanceof Error ? error.message : String(error)}`);
+  }
+  if (!parsed || typeof parsed !== "object" || Array.isArray(parsed) || parsed.version !== SUBAGENT_CAPABILITY_CEILING_VERSION) {
+    throw new Error("Invalid inherited capability ceiling version.");
+  }
+  return parseSubagentCapabilityCeiling(parsed, "inherited capability ceiling");
+}

package/extensions/dm-subagents/src/runs/shared/child-identity.js

@@ -0,0 +1,32 @@
+export function asyncStatusChildIdentity(step, index) {
+  return step.workflowKey ?? step.runId ?? `step:${index}`;
+}
+export function asyncStatusChildIdentityCandidates(step, index) {
+  return [...new Set([step.workflowKey, step.runId, `step:${index}`].filter((value) => typeof value === "string" && value.length > 0))];
+}
+export function resolveAsyncStatusChild(status, childId, options = {}) {
+  const matches = [];
+  for (const [index, step] of (status.steps ?? []).entries()) {
+    if (asyncStatusChildIdentityCandidates(step, index).includes(childId)) {
+      matches.push({ index, step, id: asyncStatusChildIdentity(step, index) });
+    }
+    if (options.includeNested) {
+      const findNested = (children) => {
+        for (const nested of children ?? []) {
+          if (nested.id === childId)
+            matches.push({ index, step, id: nested.id, nested });
+          findNested(nested.children);
+        }
+      };
+      findNested(step.children);
+    }
+  }
+  if (matches.length === 1)
+    return { ok: true, child: matches[0] };
+  if (matches.length > 1)
+    return { ok: false, code: "ambiguous", message: `Child '${childId}' is ambiguous under async run '${status.runId}'.` };
+  return { ok: false, code: "not_found", message: `Child '${childId}' was not found under async run '${status.runId}'.` };
+}
+export function isStoppableAsyncStatusStep(step) {
+  return step.status === "pending" || step.status === "running";
+}

package/extensions/dm-subagents/src/runs/shared/child-launch-plan.js

@@ -0,0 +1,65 @@
+import * as path from "node:path";
+import { resolveChildCwd } from "../../shared/utils.js";
+import { resolveSingleOutputPath } from "./single-output.js";
+export function normalizeOutputOverride(output) {
+  if (output === false || output === "false")
+    return false;
+  if (output === true || output === "true")
+    return;
+  return typeof output === "string" && output.length > 0 ? output : undefined;
+}
+export function resolveStepBehavior(agentConfig, stepOverrides, chainSkills) {
+  const stepOutput = normalizeOutputOverride(stepOverrides.output);
+  const output = stepOutput !== undefined ? stepOutput : normalizeOutputOverride(agentConfig.output) ?? false;
+  const reads = stepOverrides.reads !== undefined ? stepOverrides.reads : agentConfig.defaultReads ?? false;
+  const progress = stepOverrides.progress !== undefined ? stepOverrides.progress : agentConfig.defaultProgress ?? false;
+  let skills;
+  if (stepOverrides.skills === false) {
+    skills = false;
+  } else if (stepOverrides.skills !== undefined) {
+    skills = [...stepOverrides.skills];
+    if (chainSkills && chainSkills.length > 0) {
+      skills = [...new Set([...skills, ...chainSkills])];
+    }
+  } else {
+    skills = agentConfig.skills ? [...agentConfig.skills] : [];
+    if (chainSkills && chainSkills.length > 0) {
+      skills = [...new Set([...skills, ...chainSkills])];
+    }
+  }
+  const outputMode = stepOverrides.outputMode ?? agentConfig.outputMode ?? "inline";
+  const model = stepOverrides.model ?? agentConfig.model;
+  const fast = stepOverrides.fast ?? agentConfig.fast;
+  return { output, outputMode, reads, progress, skills, model, fast };
+}
+export function resolveTaskTextForFileUpdatePolicy(task, originalTask) {
+  if (!task)
+    return originalTask;
+  return originalTask ? task.replaceAll("{task}", originalTask) : task;
+}
+export function taskDisallowsFileUpdates(task) {
+  if (!task)
+    return false;
+  return /\breview[- ]only\b/i.test(task) || /\bread[- ]only\s+(?:review|audit|inspection|pass)\b/i.test(task) || /\b(?:no|without)\s+(?:file\s+)?edits?\b/i.test(task) || /\b(?:do not|don't|must not)\s+(?:edit|modify|write|touch)\b/i.test(task) || /\bleave\s+files?\s+unchanged\b/i.test(task);
+}
+export function suppressProgressForReadOnlyTask(behavior, task, originalTask) {
+  const policyTask = resolveTaskTextForFileUpdatePolicy(task, originalTask);
+  return behavior.progress && taskDisallowsFileUpdates(policyTask) ? { ...behavior, progress: false } : behavior;
+}
+export function planChildLaunch(input) {
+  const stepCwd = resolveChildCwd(input.runnerCwd, input.stepCwdInput);
+  const instructionCwd = input.behaviorCwd ?? stepCwd;
+  const readExistenceCwd = input.behaviorCwd ? stepCwd : instructionCwd;
+  let behavior = suppressProgressForReadOnlyTask(input.resolvedBehavior ?? resolveStepBehavior(input.agentConfig, input.stepOverrides, input.chainSkills), input.task, input.originalTask);
+  const inheritedRelativeParallelOutput = Boolean(input.parallelOutputNamespace && input.stepOverrides.output === undefined && typeof behavior.output === "string" && !path.isAbsolute(behavior.output));
+  if (inheritedRelativeParallelOutput && input.parallelOutputNamespace?.taskIndex !== undefined) {
+    behavior = {
+      ...behavior,
+      output: path.join(`parallel-${input.parallelOutputNamespace.stepIndex}`, `${input.parallelOutputNamespace.taskIndex}-${input.agentConfig.name}`, behavior.output)
+    };
+  }
+  const namespaceOutputPath = inheritedRelativeParallelOutput && input.parallelOutputNamespace?.taskIndex === undefined;
+  const skillNames = behavior.skills === false ? [] : behavior.skills;
+  const outputPath = resolveSingleOutputPath(behavior.output, input.runtimeCwd, instructionCwd, input.outputBaseDir);
+  return { stepCwd, instructionCwd, readExistenceCwd, behavior, inheritedRelativeParallelOutput, namespaceOutputPath, outputPath, skillNames };
+}