@gajae-code/coding-agent 0.18.12 → 0.19.0

package/src/tools/recipe/runner.ts

@@ -1,3 +1,4 @@
+import { escapePromptMetadata } from "../../session/messages";
 import { ToolError } from "../tool-errors";
 
 export interface RunnerTask {
@@ -197,23 +198,33 @@ function findAmbiguityExample(runners: DetectedRunner[]): { runner: string; task
 	return firstRunner && firstTask ? { runner: firstRunner.id, task: firstTask.name } : undefined;
 }
 
+function escapeRecipePromptText(value: string | undefined): string | undefined {
+	return value === undefined ? undefined : escapePromptMetadata(value);
+}
+
 export function buildPromptModel(runners: DetectedRunner[]): RecipePromptModel {
 	const ambiguityExample = findAmbiguityExample(runners);
 	return {
 		hasMultipleRunners: runners.length > 1,
-		ambiguityExampleRunner: ambiguityExample?.runner,
-		ambiguityExampleTask: ambiguityExample?.task,
+		ambiguityExampleRunner: escapeRecipePromptText(ambiguityExample?.runner),
+		ambiguityExampleTask: escapeRecipePromptText(ambiguityExample?.task),
 		runners: runners.map(runner => ({
-			id: runner.id,
-			label: runner.label,
-			commandPrefix: runner.commandPrefix,
-			tasks: runner.tasks.slice(0, PROMPT_TASK_LIMIT).map(task => ({
-				name: task.name,
-				paramSig: task.parameters.length > 0 ? task.parameters.join(" ") : undefined,
-				command: buildCommand(task.commandPrefix ?? runner.commandPrefix, task.commandName ?? task.name, ""),
-				doc: task.doc,
-				cwd: task.cwd,
-			})),
+			id: escapePromptMetadata(runner.id),
+			label: escapePromptMetadata(runner.label),
+			commandPrefix: escapePromptMetadata(runner.commandPrefix),
+			// recipe.md is compiled with noEscape. Cap the list first, then encode the
+			// kept repository fields so a script key or path cannot close <instruction> or <runner>.
+			tasks: runner.tasks.slice(0, PROMPT_TASK_LIMIT).map(task => {
+				const paramSig = task.parameters.length > 0 ? task.parameters.join(" ") : undefined;
+				const command = buildCommand(task.commandPrefix ?? runner.commandPrefix, task.commandName ?? task.name, "");
+				return {
+					name: escapePromptMetadata(task.name),
+					paramSig: escapeRecipePromptText(paramSig),
+					command: escapePromptMetadata(command),
+					doc: escapeRecipePromptText(task.doc),
+					cwd: escapeRecipePromptText(task.cwd),
+				};
+			}),
 		})),
 	};
 }

package/src/tools/render-utils.ts

@@ -10,7 +10,7 @@ import * as path from "node:path";
 import type { ToolCallContext } from "@gajae-code/agent-core";
 import type { Component, Ellipsis } from "@gajae-code/tui";
 import { replaceTabs, truncateToWidth } from "@gajae-code/tui";
-import { pluralize } from "@gajae-code/utils";
+import { pluralize, sanitizeText } from "@gajae-code/utils";
 import { settings } from "../config/settings";
 import type { Theme } from "../modes/theme/theme";
 import { Hasher } from "../tui/utils";
@@ -175,7 +175,7 @@ export function formatMeta(meta: string[], theme: Theme): string {
 }
 
 export function formatErrorMessage(message: string | undefined, theme: Theme): string {
-	const clean = (message ?? "").replace(/^Error:\s*/, "").trim();
+	const clean = sanitizeText((message ?? "").replace(/^Error:\s*/, "").trim());
 	return `${theme.styledSymbol("status.error", "error")} ${theme.fg("error", `Error: ${clean || "Unknown error"}`)}`;
 }
 

package/src/tools/search.ts

@@ -19,6 +19,7 @@ import {
 	openArchive,
 	parseArchivePathCandidates,
 } from "./archive-reader";
+import { wrapUntrustedContent } from "./fetch";
 import { createFileRecorder, formatResultPath } from "./file-recorder";
 import { formatGroupedFiles } from "./grouped-file-output";
 import { formatMatchLine } from "./match-line-format";
@@ -552,7 +553,7 @@ export class SearchTool implements AgentTool<typeof searchSchema, SearchToolDeta
 						missingPaths: missingPaths.length > 0 ? missingPaths : undefined,
 					};
 					const text = warningNote ? `No matches found\n${warningNote}` : "No matches found";
-					const noMatchResult = toolResult(details).text(text).done();
+					const noMatchResult = toolResult(details).text(wrapUntrustedContent(text)).done();
 					await cleanupArchiveScratch();
 					throwIfSearchCancelled();
 					return noMatchResult;
@@ -676,7 +677,7 @@ export class SearchTool implements AgentTool<typeof searchSchema, SearchToolDeta
 				if (truncation.truncated) details.truncation = truncation;
 				if (linesTruncated) details.linesTruncated = true;
 				const resultBuilder = toolResult(details)
-					.text(output)
+					.text(wrapUntrustedContent(output))
 					.limits({ columnMax: linesTruncated ? DEFAULT_MAX_COLUMN : undefined });
 				if (truncation.truncated) {
 					resultBuilder.truncation(truncation, { direction: "head" });

package/src/tools/ssh.ts

@@ -5,18 +5,35 @@ import { prompt } from "@gajae-code/utils";
 import * as z from "zod/v4";
 import type { SSHHost } from "../capability/ssh";
 import { sshCapability } from "../capability/ssh";
+import { getDefault, type Settings } from "../config/settings";
 import { loadCapability } from "../discovery";
 import type { RenderResultOptions } from "../extensibility/custom-tools/types";
 import type { Theme } from "../modes/theme/theme";
 import sshDescriptionBase from "../prompts/tools/ssh.md" with { type: "text" };
-import { DEFAULT_MAX_BYTES, streamTailUpdates, TailBuffer } from "../session/streaming-output";
+import type { SessionArtifactPublication } from "../session/session-manager";
+import {
+	DEFAULT_MAX_BYTES,
+	streamTailUpdates,
+	TailBuffer,
+	type TerminalArtifactPublisher,
+	type TruncationResult,
+	truncateMiddle,
+	truncateMiddleWindows,
+	truncateTail,
+} from "../session/streaming-output";
 import type { SSHHostInfo } from "../ssh/connection-manager";
 import { ensureHostInfo, getHostInfoForHost } from "../ssh/connection-manager";
-import { executeSSH } from "../ssh/ssh-executor";
+import { executeSSH, type SSHResult } from "../ssh/ssh-executor";
 import { renderStatusLine } from "../tui";
 import { CachedOutputBlock } from "../tui/output-block";
 import type { ToolSession } from ".";
-import { formatStyledTruncationWarning, type OutputMeta, stripOutputNotice } from "./output-meta";
+import { wrapUntrustedContent } from "./fetch";
+import {
+	formatArtifactReference,
+	formatStyledTruncationWarning,
+	type OutputMeta,
+	stripOutputNotice,
+} from "./output-meta";
 import { ToolError } from "./tool-errors";
 import { toolResult } from "./tool-result";
 import { clampTimeout } from "./tool-timeouts";
@@ -89,6 +106,181 @@ function quoteCmdPath(value: string): string {
 	return `"${escaped}"`;
 }
 
+const FENCE_OPEN = "<untrusted-content>\n";
+const FENCE_CLOSE = "\n</untrusted-content>";
+const UNTRUSTED_FENCE_OVERHEAD = Buffer.byteLength(`${FENCE_OPEN}${FENCE_CLOSE}`, "utf-8");
+const INLINE_MARKER_RESERVE = 256;
+/** `</untrusted-content>` grows when `wrapUntrustedContent` escapes it. */
+const CLOSER_RAW_BYTES = "</untrusted-content>".length;
+const CLOSER_ESCAPED_BYTES = "&lt;/untrusted-content&gt;".length;
+
+type OutputBudgetPath = "tools.maxInlineResultBytes" | "tools.artifactHeadBytes" | "tools.artifactTailLines";
+
+function settingNumber(settings: Settings | undefined, path: OutputBudgetPath): number {
+	return settings?.get(path) ?? getDefault(path);
+}
+
+type RemoteFrame = {
+	text: string;
+	truncation?: TruncationResult;
+	direction?: "head" | "tail" | "middle";
+	/** True only after the full remote text is already stored. */
+	shrunk: boolean;
+	visibleLines: number;
+	visibleBytes: number;
+};
+
+function inlineCapBytes(settings: Settings | undefined): number {
+	return settingNumber(settings, "tools.maxInlineResultBytes") * 1024;
+}
+
+function exceedsInlineCap(output: string, settings: Settings | undefined): boolean {
+	const cap = inlineCapBytes(settings);
+	if (cap <= 0) return false;
+	// Measure the escaped frame. A raw-size check misses closer expansion.
+	return Buffer.byteLength(wrapUntrustedContent(output), "utf-8") > cap;
+}
+
+function frameFullRemoteOutput(output: string): RemoteFrame {
+	return { text: wrapUntrustedContent(output), shrunk: false, visibleLines: 0, visibleBytes: 0 };
+}
+
+/**
+ * Cut to the inline window, then frame that excerpt. Call only when the full
+ * remote text is already stored, so a tail cut cannot drop the opening fence
+ * or the only copy of the output.
+ */
+function frameShrunkRemoteOutput(output: string, settings: Settings | undefined): RemoteFrame {
+	const cap = inlineCapBytes(settings);
+	const escapedRoom = Math.max(1, cap - UNTRUSTED_FENCE_OVERHEAD - INLINE_MARKER_RESERVE);
+	// Budget in remote-output bytes so framing and closer escaping cannot distort
+	// the source coordinates reported by truncation metadata.
+	let budget = Math.max(1, Math.floor((escapedRoom * CLOSER_RAW_BYTES) / CLOSER_ESCAPED_BYTES));
+	const headBytes = settingNumber(settings, "tools.artifactHeadBytes") * 1024;
+	const tailLines = settingNumber(settings, "tools.artifactTailLines");
+	const headBudget = Math.max(
+		1,
+		Math.floor((Math.min(headBytes, escapedRoom / 2) * CLOSER_RAW_BYTES) / CLOSER_ESCAPED_BYTES),
+	);
+	const cutRemoteOutput = (maxBytes: number) => {
+		if (headBytes > 0) {
+			const options = {
+				maxBytes,
+				maxLines: tailLines * 2,
+				maxHeadBytes: Math.min(headBudget, Math.floor(maxBytes / 2)),
+				maxHeadLines: tailLines,
+			};
+			return {
+				truncation: truncateMiddle(output, options),
+				windows: truncateMiddleWindows(output, options),
+			};
+		}
+		const options = { maxBytes, maxLines: tailLines };
+		return {
+			truncation: truncateTail(output, options),
+			windows: truncateMiddleWindows(output, { ...options, maxHeadBytes: 0, maxHeadLines: 0 }),
+		};
+	};
+	let { truncation, windows } = cutRemoteOutput(budget);
+	let excerpt = truncation.truncated ? truncation.content : output;
+	let text = wrapUntrustedContent(excerpt);
+	let textBytes = Buffer.byteLength(text, "utf-8");
+	while (textBytes > cap && budget > 1) {
+		const scaledBudget = Math.floor((budget * cap) / textBytes);
+		budget = Math.max(1, Math.min(budget - 1, scaledBudget));
+		({ truncation, windows } = cutRemoteOutput(budget));
+		excerpt = truncation.truncated ? truncation.content : output;
+		text = wrapUntrustedContent(excerpt);
+		textBytes = Buffer.byteLength(text, "utf-8");
+	}
+	if (text === wrapUntrustedContent(output)) return frameFullRemoteOutput(output);
+	if (windows.kind === "full") return frameFullRemoteOutput(output);
+	const direction = windows.kind === "middle" ? "middle" : windows.kind === "head-only" ? "head" : "tail";
+	return {
+		text,
+		truncation,
+		direction,
+		shrunk: true,
+		visibleLines: (windows.head?.lines ?? 0) + (windows.tail?.lines ?? 0),
+		visibleBytes: (windows.head?.bytes ?? 0) + (windows.tail?.bytes ?? 0),
+	};
+}
+
+/** Store the full remote text. Never write an already-shortened excerpt.
+ * The command has already finished, so a rejected reservation must not discard it.
+ */
+async function storeFullRemoteOutput(
+	session: ToolSession,
+	output: string,
+	artifactPublication: SessionArtifactPublication | undefined,
+): Promise<string | undefined> {
+	let allocated: { id?: string; path?: string } | undefined;
+	try {
+		allocated = await session.allocateOutputArtifact?.("ssh");
+	} catch {
+		allocated = undefined;
+	}
+	if (allocated?.path && allocated.id) {
+		try {
+			await Bun.write(allocated.path, output);
+			return allocated.id;
+		} catch {
+			// Fall through to the session-owned publisher when a writable path failed.
+		}
+	}
+	if (!artifactPublication) return undefined;
+	try {
+		return await artifactPublication(output, "ssh");
+	} catch {
+		return undefined;
+	}
+}
+
+function createSshArtifactPublisher(
+	artifactPublication: SessionArtifactPublication | undefined,
+): TerminalArtifactPublisher | undefined {
+	if (!artifactPublication) return undefined;
+	return async (content, info) => {
+		try {
+			const artifactId = await artifactPublication(content, "ssh");
+			if (!artifactId) return { status: "unavailable" };
+			return info.omittedBytes > 0
+				? { status: "published", artifactId, omittedBytes: info.omittedBytes }
+				: { status: "published", artifactId };
+		} catch (error) {
+			return { status: "failed", diagnostic: error instanceof Error ? error.message : String(error) };
+		}
+	};
+}
+
+function hasCompleteRemoteOutput(result: SSHResult, output: string): boolean {
+	return (
+		!result.truncated &&
+		result.outputBytes === result.totalBytes &&
+		Buffer.byteLength(output, "utf-8") === result.outputBytes
+	);
+}
+
+function incompleteOutputNotice(result: SSHResult, artifactId: string | undefined): string | undefined {
+	const retainedWindowIncomplete = result.truncated || result.outputBytes < result.totalBytes;
+	if (!retainedWindowIncomplete) return undefined;
+
+	const artifactIncomplete =
+		(result.artifactTruncatedBytes ?? 0) > 0 || result.artifactFailureDiagnostic !== undefined;
+	const completeArtifactAvailable = artifactId !== undefined && !artifactIncomplete;
+	if (completeArtifactAvailable) return undefined;
+
+	const notes = [`SSH output is incomplete: retained ${result.outputBytes} of ${result.totalBytes} bytes`];
+	notes.push("no complete output artifact is available");
+	if ((result.artifactTruncatedBytes ?? 0) > 0) {
+		notes.push(`artifact storage omitted at least ${result.artifactTruncatedBytes} bytes`);
+	}
+	if (result.artifactFailureDiagnostic) {
+		notes.push(`Artifact storage failed: ${result.artifactFailureDiagnostic}`);
+	}
+	return notes.join("; ");
+}
+
 function buildRemoteCommand(command: string, cwd: string | undefined, info: SSHHostInfo): string {
 	if (!cwd) return command;
 
@@ -161,6 +353,8 @@ export class SshTool implements AgentTool<typeof sshSchema, SSHToolDetails> {
 		// Clamp to reasonable range: 1s - 3600s (1 hour)
 		const timeoutSec = clampTimeout("ssh", rawTimeout);
 		const timeoutMs = timeoutSec * 1000;
+		const outputSettings = _ctx?.settings ?? this.session.settings;
+		const artifactPublication = this.session.captureArtifactPublication?.();
 
 		const tailBuffer = new TailBuffer(DEFAULT_MAX_BYTES);
 		const { path: artifactPath, id: artifactId } = (await this.session.allocateOutputArtifact?.("ssh")) ?? {};
@@ -172,22 +366,94 @@ export class SshTool implements AgentTool<typeof sshSchema, SSHToolDetails> {
 			compatEnabled: hostInfo.compatEnabled,
 			artifactPath,
 			artifactId,
+			artifactPublisher: createSshArtifactPublisher(artifactPublication),
 			onChunk: streamTailUpdates(tailBuffer, onUpdate),
 		});
 
+		const remote = result.output ?? "";
+		let storedArtifactId = result.artifactId;
+		let framed: RemoteFrame | undefined;
+		if (!remote) {
+			framed = undefined;
+		} else if (!exceedsInlineCap(remote, outputSettings)) {
+			framed = frameFullRemoteOutput(remote);
+		} else {
+			if (!storedArtifactId && hasCompleteRemoteOutput(result, remote)) {
+				storedArtifactId = await storeFullRemoteOutput(this.session, remote, artifactPublication);
+			}
+			framed = storedArtifactId ? frameShrunkRemoteOutput(remote, outputSettings) : frameFullRemoteOutput(remote);
+		}
+		// The artifact id stays in truncation metadata. A line after the closing
+		// fence makes the inline backstop drop the opening fence.
+		const modelText = framed?.text;
+		const storedNote =
+			(framed?.shrunk || result.truncated) && storedArtifactId
+				? `\n\n${formatArtifactReference(storedArtifactId, result.artifactTruncatedBytes)}`
+				: "";
+		const incompleteNote = incompleteOutputNotice(result, storedArtifactId);
+		const artifactFailureNote =
+			result.artifactFailureDiagnostic && !incompleteNote
+				? `SSH streaming artifact storage failed: ${result.artifactFailureDiagnostic}`
+				: undefined;
 		if (result.cancelled) {
-			throw new ToolError(result.output || "Command aborted");
+			const message = [
+				modelText || "Command aborted",
+				storedNote.trim() || undefined,
+				incompleteNote,
+				artifactFailureNote,
+			]
+				.filter((part): part is string => part !== undefined)
+				.join("\n\n");
+			throw new ToolError(message);
 		}
 
-		const outputText = result.output || "(no output)";
+		const outputText = modelText ?? "(no output)";
 		const details: SSHToolDetails = {};
-		const resultBuilder = toolResult(details).text(outputText).truncationFromSummary(result, { direction: "tail" });
+		const resultBuilder = toolResult(details).text(outputText);
+		if (framed?.shrunk && framed.truncation && storedArtifactId) {
+			resultBuilder.truncation(framed.truncation, {
+				direction: framed.direction ?? "tail",
+				artifactId: storedArtifactId,
+			});
+		} else {
+			resultBuilder.truncationFromSummary(result, { direction: "tail" });
+		}
 
 		if (result.exitCode !== 0 && result.exitCode !== undefined) {
-			throw new ToolError(`${outputText}\n\nCommand exited with code ${result.exitCode}`);
+			const message = [
+				outputText,
+				storedNote.trim() || undefined,
+				incompleteNote,
+				artifactFailureNote,
+				`Command exited with code ${result.exitCode}`,
+			]
+				.filter((part): part is string => part !== undefined)
+				.join("\n\n");
+			throw new ToolError(message);
 		}
 
-		return resultBuilder.done();
+		const built = resultBuilder.done();
+		const truncation = built.details?.meta?.truncation;
+		if (framed?.shrunk && truncation) {
+			// The cut is a window of an earlier excerpt. Keep the stream totals
+			// and do not present that window's coordinates as the original range.
+			truncation.totalLines = result.totalLines;
+			truncation.totalBytes = result.totalBytes;
+			truncation.outputLines = framed.visibleLines;
+			truncation.outputBytes = framed.visibleBytes;
+			truncation.artifactId = storedArtifactId;
+			truncation.artifactTruncatedBytes = result.artifactTruncatedBytes;
+			truncation.artifactFailureDiagnostic = result.artifactFailureDiagnostic;
+			delete truncation.shownRange;
+			delete truncation.headRange;
+			delete truncation.tailRange;
+			delete truncation.nextOffset;
+			if (framed.direction === "middle") {
+				truncation.elidedLines = Math.max(0, result.totalLines - framed.visibleLines);
+				truncation.elidedBytes = Math.max(0, result.totalBytes - framed.visibleBytes);
+			}
+		}
+		return built;
 	}
 }
 

package/src/tools/subagent.ts

@@ -6,6 +6,7 @@ import { type AsyncJob, AsyncJobManager, jobElapsedMs, type SubagentRecord } fro
 import subagentDescription from "../prompts/tools/subagent.md" with { type: "text" };
 import type { AgentProgress, AgentSource, LocalErrorSummary } from "../task/types";
 import { Ellipsis, truncateToWidth } from "../tui";
+import { wrapUntrustedContent } from "./fetch";
 import type { ToolSession } from "./index";
 import { replaceTabs } from "./render-utils";
 import { ToolError } from "./tool-errors";
@@ -799,7 +800,11 @@ export class SubagentTool implements AgentTool<typeof subagentSchema, SubagentTo
 			}
 			if (snapshot.description) lines.push(`Description: ${snapshot.description}`);
 			if (snapshot.outputRef) lines.push(`Output: ${snapshot.outputRef}`);
-			if (snapshot.setupFailureSummary) lines.push(`Setup failure: ${snapshot.setupFailureSummary}`);
+			// A markdown fence is not a boundary: subagent text can contain ``` and
+			// close it, leaving the rest as raw tool-result text. Frame the data.
+			if (snapshot.setupFailureSummary) {
+				lines.push(wrapUntrustedContent(`Setup failure: ${snapshot.setupFailureSummary}`));
+			}
 			if (snapshot.localErrorSummary) {
 				const local = snapshot.localErrorSummary;
 				lines.push(`Local failure (${local.kind}): ${local.summary}`);
@@ -816,13 +821,14 @@ export class SubagentTool implements AgentTool<typeof subagentSchema, SubagentTo
 					);
 				}
 			}
-			if (snapshot.assignment) lines.push("Assignment:", "```", snapshot.assignment, "```");
+			if (snapshot.assignment) lines.push(wrapUntrustedContent(`Assignment:\n${snapshot.assignment}`));
 			if (snapshot.steerMessage) {
-				lines.push(`Steer (${snapshot.steerState ?? "queued"}):`, "```", snapshot.steerMessage, "```");
+				lines.push(wrapUntrustedContent(`Steer (${snapshot.steerState ?? "queued"}):\n${snapshot.steerMessage}`));
 				lines.push(STEER_QUEUED_GUIDANCE);
 			}
 			if (snapshot.resultPreview) {
-				lines.push(snapshot.errorText ? "Error preview:" : "Result preview:", "```", snapshot.resultPreview, "```");
+				const previewLabel = snapshot.errorText ? "Error preview:" : "Result preview:";
+				lines.push(wrapUntrustedContent(`${previewLabel}\n${snapshot.resultPreview}`));
 				if (snapshot.truncated)
 					lines.push("Preview truncated; use the output ref or explicit ids with `verbosity=full` for more.");
 			}