@dynamicagents/plugins 0.16.1 → 0.18.0

package/dist/computer/tools-grep.js

@@ -1,6 +1,7 @@
 import { tool } from "ai";
 import { z } from "zod";
-import { guardPath, WALK_SKIPS } from "./paths.js";
+import { SANDBOX_ROOT } from "../sandbox/header.js";
+import { guardPath, walkSkips } from "./paths.js";
 import { renderGrepMatches } from "./render.js";
 /**
  * Searching file contents, under Think's name so it replaces Think's `grep` —
@@ -31,7 +32,7 @@ export function grepTools(ctx) {
         /**
          * Search, without the container.
          *
-         * The alternative is `bash("grep -rn …")`, and the case for a native one is
+         * The alternative is `exec("grep -rn …")`, and the case for a native one is
          * not that shelling out fails — it is where the search runs. `fs.grep` reads
          * the Durable Object's SQLite, so it answers while the container is being
          * replaced or an install is still running, which is exactly the window the
@@ -51,7 +52,7 @@ export function grepTools(ctx) {
                 "The query is matched literally — set `regex` to interpret it as a regular expression. " +
                 "Pass `include` to limit which files are searched, e.g. '**/*.ts' — without it every file under `path` is read, which is slower and rarely what you meant. " +
                 "A cut result reports the `offset` that continues it. Use `context` to see the lines around a match. " +
-                "Results from `.git` and `node_modules` are left out — search node_modules with bash.",
+                "Results from `.git` and `node_modules` are left out — search node_modules with exec.",
             inputSchema: z.object({
                 query: z.string().describe("Text to find, e.g. 'buildComputerTools'"),
                 path: z
@@ -102,7 +103,12 @@ export function grepTools(ctx) {
                         context: around,
                         limit: DEFAULT_MAX_MATCHES + 1,
                         offset: from,
-                        exclude: WALK_SKIPS.map((segment) => `**/${segment}`)
+                        // The same skips the workspace's own walks hand on, anchored to
+                        // the served root rather than to the target: this tool replaces
+                        // Think's `grep`, so a search of the root that kept the agent's
+                        // own directories would fill a bounded page with them before the
+                        // checkout's matches. See `src/computer/paths.ts`.
+                        exclude: walkSkips(target, SANDBOX_ROOT)
                     });
                     if (matches.length === 0)
                         return `no matches for ${JSON.stringify(query)} in ${target}${include ? ` (${include})` : ""}${from > 0 ? ` past offset ${from}` : ""}`;

package/dist/repo-github/sandbox-egress.d.ts

@@ -39,7 +39,11 @@ export interface GitHubSandboxEgressOptions {
     tokenBinding: string;
     /** Absent: any repository and any work branch the token reaches. */
     push?: GitPushPolicy;
-    /** Intercept `api.github.com` as well, so `gh` works as the deployment's account. */
+    /**
+     * Intercept `api.github.com` as well, so `gh` works as the deployment's
+     * account. Nothing here reads those requests, so GitHub alone bounds them:
+     * `./README.md`, under "Protect the repositories", says how to set that up.
+     */
     api?: boolean;
 }
 /** The egress rule of a sandbox whose processes use GitHub. */

package/dist/repo-github/sandbox-egress.js

@@ -74,9 +74,15 @@ async function githubEgress(call, options) {
         return githubError("no GitHub token is configured for this deployment, so nothing can be done as its account", 401);
     }
     const policy = options.push;
-    const git = new URL(call.request.url).hostname === GIT_HOST
-        ? gitTarget(call.target.pathname)
-        : undefined;
+    const onGitHost = new URL(call.request.url).hostname === GIT_HOST;
+    const git = onGitHost ? gitTarget(call.target.pathname) : undefined;
+    // GitHub serves spellings of a git path that `gitTarget` does not read, and a
+    // push it cannot read is one it cannot hold to the rules below, so what it
+    // does not recognise never gets the token. Git LFS is on such a path: a
+    // sandbox that needs it has to have it recognised first.
+    if (onGitHost && !git) {
+        return githubError(`this sandbox may use ${GIT_HOST} as the deployment's account for git alone, and ${call.target.pathname} is not a path git uses`, 403);
+    }
     let body;
     if (git) {
         if (policy &&

package/dist/sandbox/header.d.ts

@@ -48,3 +48,16 @@ export declare function readRunHeader(text: string): {
 };
 /** Whether `path` is `root` or inside it, with no `..` escaping it. */
 export declare function isUnder(path: string, root: string): boolean;
+/**
+ * `path` with its dot segments and repeated separators resolved, or `undefined`
+ * for one that is not absolute or that climbs above `/`.
+ *
+ * Shared with the tools rather than kept here, because anything comparing a
+ * path against this root has to compare what the path *means*: `/workspace/.`
+ * and `/workspace/repo/..` are both this root, and a comparison that read them
+ * literally would answer no to a path the sandbox itself answers yes to.
+ *
+ * A `..` with nothing left to pop is refused rather than clamped at `/`: a
+ * clamp would turn an attempt to climb out into a valid root path.
+ */
+export declare function normalizeAbsolute(path: string): string | undefined;

package/dist/sandbox/header.js

@@ -75,20 +75,35 @@ function assertRunHeader(value) {
 }
 /** Whether `path` is `root` or inside it, with no `..` escaping it. */
 export function isUnder(path, root) {
+    const normal = normalizeAbsolute(path);
+    return (normal !== undefined && (normal === root || normal.startsWith(`${root}/`)));
+}
+/**
+ * `path` with its dot segments and repeated separators resolved, or `undefined`
+ * for one that is not absolute or that climbs above `/`.
+ *
+ * Shared with the tools rather than kept here, because anything comparing a
+ * path against this root has to compare what the path *means*: `/workspace/.`
+ * and `/workspace/repo/..` are both this root, and a comparison that read them
+ * literally would answer no to a path the sandbox itself answers yes to.
+ *
+ * A `..` with nothing left to pop is refused rather than clamped at `/`: a
+ * clamp would turn an attempt to climb out into a valid root path.
+ */
+export function normalizeAbsolute(path) {
     if (!path.startsWith("/"))
-        return false;
+        return undefined;
     const parts = [];
     for (const part of path.split("/")) {
         if (part === "" || part === ".")
             continue;
         if (part === "..") {
             if (parts.length === 0)
-                return false;
+                return undefined;
             parts.pop();
             continue;
         }
         parts.push(part);
     }
-    const normal = `/${parts.join("/")}`;
-    return normal === root || normal.startsWith(`${root}/`);
+    return `/${parts.join("/")}`;
 }

package/dist/sandbox/install-plan.d.ts

@@ -36,7 +36,7 @@ export interface InstallProbe {
  * Where the install has got to, as the host reports it and the tools read it.
  *
  * Declared here rather than in the host because both sides depend on it and
- * neither owns the other: the Durable Object runs the job, and `bash` refuses
+ * neither owns the other: the Durable Object runs the job, and the shell tool refuses
  * to run against a tree that is still being built. A shape they agreed on
  * informally would drift, and the drift would show up as a shell command running
  * halfway through an `npm ci`.

package/dist/sandbox/install-plan.js

@@ -26,6 +26,7 @@
  * absent. So: an explicit override wins, then the repository's own
  * `packageManager` pin, then lockfiles in the order the plan lists them.
  */
+import { sha256Hex } from "@dynamicagents/core";
 /**
  * A sensible starting table, meant to be copied into a host and edited.
  *
@@ -304,8 +305,5 @@ async function digestFiles(fs, dir, names, prefix) {
     }
     if (!found)
         return null;
-    const digest = await crypto.subtle.digest("SHA-256", new TextEncoder().encode(input));
-    return [...new Uint8Array(digest)]
-        .map((b) => b.toString(16).padStart(2, "0"))
-        .join("");
+    return await sha256Hex(input);
 }

package/dist/sandbox/object.d.ts

@@ -96,6 +96,7 @@ export declare abstract class SandboxObjectBase<Env extends object = Cloudflare.
         type: string;
         size: number;
         modifiedAt: number;
+        mode: number;
     } | null>;
     readDir(path: string): Promise<{
         name: string;

package/dist/sandbox/object.js

@@ -1,5 +1,6 @@
 import { DurableObject } from "cloudflare:workers";
 import { ContainerHarness, containerAgent } from "agents/harness/container";
+import { sha256Hex } from "@dynamicagents/core";
 import { installScheduler, namedDeadline } from "@dynamicagents/core/alarm";
 import { DirectoryBackup, Files } from "@cloudflare/sandbox";
 import { asAgent, AGENT_GID, AGENT_UID, shellQuote } from "./agent-exec.js";
@@ -380,7 +381,11 @@ export class SandboxObjectBase extends DurableObject {
                 return {
                     type: stat.type,
                     size: Number(stat.size),
-                    modifiedAt: stat.modifiedAt.getTime()
+                    modifiedAt: stat.modifiedAt.getTime(),
+                    // Reported because the file tools' own contract asks for one, and
+                    // the container knows it. Nothing can set it back: the sandbox's
+                    // write takes no mode.
+                    mode: stat.mode
                 };
             }
             catch (err) {
@@ -1105,14 +1110,16 @@ function markOf(dir) {
 function installMarkOf(dir) {
     return `${INSTALL_MARKS}/${encodeURIComponent(dir)}`;
 }
-/** `env`, in key order, as a digest a fingerprint can carry. */
+/**
+ * `env`, in key order, as a digest a fingerprint can carry.
+ *
+ * The width is load-bearing: this goes into an install mark stored on the
+ * container's disk, so changing it makes every tree already marked look
+ * uninstalled and costs each one an install it does not need.
+ */
 async function digestEnv(env) {
     const sorted = Object.entries(env ?? {}).sort(([a], [b]) => a < b ? -1 : a > b ? 1 : 0);
-    const bytes = await crypto.subtle.digest("SHA-256", new TextEncoder().encode(JSON.stringify(sorted)));
-    return [...new Uint8Array(bytes)]
-        .map((b) => b.toString(16).padStart(2, "0"))
-        .join("")
-        .slice(0, 16);
+    return (await sha256Hex(JSON.stringify(sorted))).slice(0, 16);
 }
 function isNotFound(err) {
     return (typeof err === "object" &&
@@ -1129,11 +1136,12 @@ function isAbort(err) {
 function sleep(ms) {
     return new Promise((resolve) => setTimeout(resolve, ms));
 }
+/**
+ * `value`, as the digest a poll returns beside a message.
+ *
+ * Nothing stores it: a poll composes it again for every message it answers
+ * with, so the width has only to tell two messages apart.
+ */
 async function digest(value) {
-    const bytes = new TextEncoder().encode(JSON.stringify(value));
-    const hash = await crypto.subtle.digest("SHA-256", bytes);
-    return [...new Uint8Array(hash)]
-        .slice(0, 12)
-        .map((byte) => byte.toString(16).padStart(2, "0"))
-        .join("");
+    return (await sha256Hex(JSON.stringify(value))).slice(0, 24);
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@dynamicagents/plugins",
-  "version": "0.16.1",
+  "version": "0.18.0",
   "description": "Optional, composable capabilities for a Dynamic Agent: browser rendering, a Linux container, git and pull requests on GitHub, a scratchpad, and Claude Code sessions. One subpath per plugin, so a bundle grows only with what it imports.",
   "keywords": [
     "ai-agents",
@@ -75,7 +75,7 @@
     "test": "vitest run",
     "test:watch": "vitest",
     "verify:exports": "node scripts/verify-exports.mjs",
-    "verify:references": "node scripts/verify-references.mjs",
+    "verify:references": "da-verify-references",
     "verify:peer-ranges": "node scripts/verify-peer-ranges.mjs",
     "probe:claude-code": "npm run build && node scripts/probe-claude-code.mjs",
     "probe:github-mcp": "node scripts/probe-github-mcp.mjs",
@@ -84,11 +84,13 @@
     "prepare": "husky || true && npm run build"
   },
   "peerDependencies": {
+    "@cloudflare/computer": "^0.8.0",
     "@cloudflare/sandbox": "^1.0.1",
-    "@cloudflare/think": ">=0.20.2 <0.21.0",
-    "@dynamicagents/core": ">=0.16.0 <0.17.0",
-    "agents": ">=0.28.0 <0.29.0",
+    "@cloudflare/think": ">=0.23.0 <0.24.0",
+    "@dynamicagents/core": ">=0.18.0 <0.19.0",
+    "agents": ">=0.33.0 <0.34.0",
     "ai": "^7.0.88",
+    "just-bash": "^3.0.1",
     "zod": "^4.4.3"
   },
   "peerDependenciesMeta": {
@@ -97,15 +99,17 @@
     }
   },
   "devDependencies": {
+    "@cloudflare/computer": "^0.8.0",
     "@cloudflare/sandbox": "^1.0.1",
-    "@cloudflare/think": "^0.20.2",
+    "@cloudflare/think": "^0.23.0",
     "@cloudflare/vitest-plugin": "^1.4.4",
-    "@dynamicagents/core": "^0.16.0",
+    "@dynamicagents/core": "^0.18.0",
     "@types/node": "^26.5.1",
-    "agents": "^0.28.0",
+    "agents": "^0.33.0",
     "ai": "^7.0.101",
     "eslint": "^10.10.0",
     "husky": "^9.1.7",
+    "just-bash": "^3.0.1",
     "prettier": "^3.9.6",
     "semver": "^7.8.5",
     "typescript": "^6.0.3",