@gaunt-sloth/core 2.0.0-alpha.34 → 2.0.0-alpha.36

package/dist/utils/untrustedText.d.ts

@@ -36,14 +36,34 @@ export declare const QUOTED_COMMAND_FENCE_END = "[END QUOTED COMMAND TEXT]";
 export declare const QUOTED_COMMAND_MAX_CHARS = 2000;
 /** Appended when {@link QUOTED_COMMAND_MAX_CHARS} actually clipped the quoted command. */
 export declare const QUOTED_COMMAND_TRUNCATION_MARKER = "\u2026 [truncated]";
+/**
+ * [[EXT-46]] — the fence the ACP server quotes a prompt's non-text content blocks inside, emitted by
+ * `@gaunt-sloth/agent`'s `modules/acp/acpAgentApp.ts`.
+ *
+ * An ACP client attaches content blocks to a prompt, and the ones that are not the user's own typed
+ * text carry values the user did not author: a resource link's `name`, `uri` and `description` come
+ * from the editor, the filesystem or an MCP server, and a block's `type` is an arbitrary client
+ * string by the v2 schema. The agent has to tell the model that something was attached — dropping it
+ * silently is worse — so those values are quoted into the same message as the user's words, which is
+ * the situation this module exists for.
+ */
+export declare const ACP_ATTACHMENT_FENCE_BEGIN = "[BEGIN CLIENT-PROVIDED ATTACHMENT]";
+export declare const ACP_ATTACHMENT_FENCE_END = "[END CLIENT-PROVIDED ATTACHMENT]";
+/**
+ * How much of one attachment FIELD is quoted. These are metadata (a file name, a URI, a one-line
+ * description), not documents, so this is generous rather than a limit anything real should reach.
+ */
+export declare const ACP_ATTACHMENT_FIELD_MAX_CHARS = 1000;
+/** Appended when {@link ACP_ATTACHMENT_FIELD_MAX_CHARS} actually clipped a field. */
+export declare const ACP_ATTACHMENT_TRUNCATION_MARKER = "\u2026 [truncated]";
 /**
  * Neutralize every structural delimiter this codebase emits, inside UNTRUSTED text.
  *
  * The text is fully attacker-influenceable, so it may forge:
- *   - either fence's tokens (`[BEGIN|END MCP SERVER-PROVIDED CONTEXT]`,
- *     `[BEGIN|END QUOTED COMMAND TEXT]`) — the bracket run is collapsed so they can no longer be
- *     read as the real delimiter, while staying legible to a reader who wants to see what was
- *     attempted; and
+ *   - any fence's tokens (`[BEGIN|END MCP SERVER-PROVIDED CONTEXT]`,
+ *     `[BEGIN|END QUOTED COMMAND TEXT]`, `[BEGIN|END CLIENT-PROVIDED ATTACHMENT]`) — the bracket run
+ *     is collapsed so they can no longer be read as the real delimiter, while staying legible to a
+ *     reader who wants to see what was attempted; and
  *   - a per-server label line `--- Server: …` (EXT-32) — the leading `---` run is broken so it
  *     cannot masquerade as one of ours.
  *

package/dist/utils/untrustedText.js

@@ -36,14 +36,34 @@ export const QUOTED_COMMAND_FENCE_END = '[END QUOTED COMMAND TEXT]';
 export const QUOTED_COMMAND_MAX_CHARS = 2000;
 /** Appended when {@link QUOTED_COMMAND_MAX_CHARS} actually clipped the quoted command. */
 export const QUOTED_COMMAND_TRUNCATION_MARKER = '… [truncated]';
+/**
+ * [[EXT-46]] — the fence the ACP server quotes a prompt's non-text content blocks inside, emitted by
+ * `@gaunt-sloth/agent`'s `modules/acp/acpAgentApp.ts`.
+ *
+ * An ACP client attaches content blocks to a prompt, and the ones that are not the user's own typed
+ * text carry values the user did not author: a resource link's `name`, `uri` and `description` come
+ * from the editor, the filesystem or an MCP server, and a block's `type` is an arbitrary client
+ * string by the v2 schema. The agent has to tell the model that something was attached — dropping it
+ * silently is worse — so those values are quoted into the same message as the user's words, which is
+ * the situation this module exists for.
+ */
+export const ACP_ATTACHMENT_FENCE_BEGIN = '[BEGIN CLIENT-PROVIDED ATTACHMENT]';
+export const ACP_ATTACHMENT_FENCE_END = '[END CLIENT-PROVIDED ATTACHMENT]';
+/**
+ * How much of one attachment FIELD is quoted. These are metadata (a file name, a URI, a one-line
+ * description), not documents, so this is generous rather than a limit anything real should reach.
+ */
+export const ACP_ATTACHMENT_FIELD_MAX_CHARS = 1000;
+/** Appended when {@link ACP_ATTACHMENT_FIELD_MAX_CHARS} actually clipped a field. */
+export const ACP_ATTACHMENT_TRUNCATION_MARKER = '… [truncated]';
 /**
  * Neutralize every structural delimiter this codebase emits, inside UNTRUSTED text.
  *
  * The text is fully attacker-influenceable, so it may forge:
- *   - either fence's tokens (`[BEGIN|END MCP SERVER-PROVIDED CONTEXT]`,
- *     `[BEGIN|END QUOTED COMMAND TEXT]`) — the bracket run is collapsed so they can no longer be
- *     read as the real delimiter, while staying legible to a reader who wants to see what was
- *     attempted; and
+ *   - any fence's tokens (`[BEGIN|END MCP SERVER-PROVIDED CONTEXT]`,
+ *     `[BEGIN|END QUOTED COMMAND TEXT]`, `[BEGIN|END CLIENT-PROVIDED ATTACHMENT]`) — the bracket run
+ *     is collapsed so they can no longer be read as the real delimiter, while staying legible to a
+ *     reader who wants to see what was attempted; and
  *   - a per-server label line `--- Server: …` (EXT-32) — the leading `---` run is broken so it
  *     cannot masquerade as one of ours.
  *
@@ -58,6 +78,7 @@ export function defangUntrustedDelimiters(text) {
     return text
         .replace(/\[\s*(BEGIN|END)\s+MCP\s+SERVER-PROVIDED\s+CONTEXT\s*\]/gi, (_m, kw) => `(server text: ${kw.toUpperCase()} MCP SERVER-PROVIDED CONTEXT)`)
         .replace(/\[\s*(BEGIN|END)\s+QUOTED\s+COMMAND\s+TEXT\s*\]/gi, (_m, kw) => `(quoted text: ${kw.toUpperCase()} QUOTED COMMAND TEXT)`)
+        .replace(/\[\s*(BEGIN|END)\s+CLIENT-PROVIDED\s+ATTACHMENT\s*\]/gi, (_m, kw) => `(client text: ${kw.toUpperCase()} CLIENT-PROVIDED ATTACHMENT)`)
         .replace(/-{3,}(\s*Server\s*:)/gi, '- - -$1');
 }
 /**

package/dist/utils/untrustedText.js.map

@@ -1 +1 @@
-{"version":3,"file":"untrustedText.js","sourceRoot":"","sources":["../../src/utils/untrustedText.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,8FAA8F;AAC9F,MAAM,CAAC,MAAM,eAAe,GAAG,qCAAqC,CAAC;AACrE,MAAM,CAAC,MAAM,aAAa,GAAG,mCAAmC,CAAC;AAEjE;;;;;GAKG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAG,6BAA6B,CAAC;AACxE,MAAM,CAAC,MAAM,wBAAwB,GAAG,2BAA2B,CAAC;AAEpE,kGAAkG;AAClG,MAAM,CAAC,MAAM,wBAAwB,GAAG,IAAI,CAAC;AAE7C,0FAA0F;AAC1F,MAAM,CAAC,MAAM,gCAAgC,GAAG,eAAe,CAAC;AAEhE;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,UAAU,yBAAyB,CAAC,IAAY;IACpD,OAAO,IAAI;SACR,OAAO,CACN,2DAA2D,EAC3D,CAAC,EAAE,EAAE,EAAU,EAAE,EAAE,CAAC,iBAAiB,EAAE,CAAC,WAAW,EAAE,+BAA+B,CACrF;SACA,OAAO,CACN,mDAAmD,EACnD,CAAC,EAAE,EAAE,EAAU,EAAE,EAAE,CAAC,iBAAiB,EAAE,CAAC,WAAW,EAAE,uBAAuB,CAC7E;SACA,OAAO,CAAC,wBAAwB,EAAE,SAAS,CAAC,CAAC;AAClD,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,gBAAgB,CAAC,IAAY,EAAE,QAAgB,EAAE,MAAc;IAC7E,IAAI,IAAI,CAAC,MAAM,IAAI,QAAQ;QAAE,OAAO,IAAI,CAAC;IACzC,IAAI,GAAG,GAAG,QAAQ,CAAC;IACnB,MAAM,IAAI,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC;IACtC,IAAI,IAAI,IAAI,MAAM,IAAI,IAAI,IAAI,MAAM;QAAE,GAAG,IAAI,CAAC,CAAC,CAAC,+BAA+B;IAC/E,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,OAAO,EAAE,KAAK,MAAM,EAAE,CAAC;AACtD,CAAC"}
+{"version":3,"file":"untrustedText.js","sourceRoot":"","sources":["../../src/utils/untrustedText.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,8FAA8F;AAC9F,MAAM,CAAC,MAAM,eAAe,GAAG,qCAAqC,CAAC;AACrE,MAAM,CAAC,MAAM,aAAa,GAAG,mCAAmC,CAAC;AAEjE;;;;;GAKG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAG,6BAA6B,CAAC;AACxE,MAAM,CAAC,MAAM,wBAAwB,GAAG,2BAA2B,CAAC;AAEpE,kGAAkG;AAClG,MAAM,CAAC,MAAM,wBAAwB,GAAG,IAAI,CAAC;AAE7C,0FAA0F;AAC1F,MAAM,CAAC,MAAM,gCAAgC,GAAG,eAAe,CAAC;AAEhE;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAG,oCAAoC,CAAC;AAC/E,MAAM,CAAC,MAAM,wBAAwB,GAAG,kCAAkC,CAAC;AAE3E;;;GAGG;AACH,MAAM,CAAC,MAAM,8BAA8B,GAAG,IAAI,CAAC;AAEnD,qFAAqF;AACrF,MAAM,CAAC,MAAM,gCAAgC,GAAG,eAAe,CAAC;AAEhE;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,UAAU,yBAAyB,CAAC,IAAY;IACpD,OAAO,IAAI;SACR,OAAO,CACN,2DAA2D,EAC3D,CAAC,EAAE,EAAE,EAAU,EAAE,EAAE,CAAC,iBAAiB,EAAE,CAAC,WAAW,EAAE,+BAA+B,CACrF;SACA,OAAO,CACN,mDAAmD,EACnD,CAAC,EAAE,EAAE,EAAU,EAAE,EAAE,CAAC,iBAAiB,EAAE,CAAC,WAAW,EAAE,uBAAuB,CAC7E;SACA,OAAO,CACN,wDAAwD,EACxD,CAAC,EAAE,EAAE,EAAU,EAAE,EAAE,CAAC,iBAAiB,EAAE,CAAC,WAAW,EAAE,8BAA8B,CACpF;SACA,OAAO,CAAC,wBAAwB,EAAE,SAAS,CAAC,CAAC;AAClD,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,gBAAgB,CAAC,IAAY,EAAE,QAAgB,EAAE,MAAc;IAC7E,IAAI,IAAI,CAAC,MAAM,IAAI,QAAQ;QAAE,OAAO,IAAI,CAAC;IACzC,IAAI,GAAG,GAAG,QAAQ,CAAC;IACnB,MAAM,IAAI,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC;IACtC,IAAI,IAAI,IAAI,MAAM,IAAI,IAAI,IAAI,MAAM;QAAE,GAAG,IAAI,CAAC,CAAC,CAAC,+BAA+B;IAC/E,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,OAAO,EAAE,KAAK,MAAM,EAAE,CAAC;AACtD,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@gaunt-sloth/core",
-  "version": "2.0.0-alpha.34",
+  "version": "2.0.0-alpha.36",
   "description": "Core utilities and types for Gaunt Sloth",
   "license": "MIT",
   "author": "Andrew Kondratev",
@@ -30,11 +30,11 @@
     "#src/*.js": "./dist/*.js"
   },
   "dependencies": {
-    "@langchain/core": "^1.2.3",
-    "@langchain/langgraph": "^1.4.8",
+    "@langchain/core": "^1.2.5",
+    "@langchain/langgraph": "^1.4.9",
     "jiti": "^2.7.0",
     "jsonc-parser": "^3.3.1",
-    "langchain": "^1.5.4",
+    "langchain": "^1.5.5",
     "string-width": "^8.2.2",
     "zod": "^4.4.3"
   },

package/schema/gsloth-config.schema.json

@@ -36,7 +36,6 @@
         "backend": {
           "type": "string",
           "enum": [
-            "deep",
             "lean"
           ]
         }