@junando/worker 0.11.1 → 0.12.1

package/dist/{node-BzYEGMG1.cjs → node-BYAxz9X-.cjs}

@@ -1,5 +1,5 @@
 const require_rolldown_runtime = require('./rolldown-runtime-CfAboj1T.cjs');
-const require_sdk = require('./sdk-BD78kZ4E.cjs');
+const require_sdk = require('./sdk-a89HQ1X4.cjs');
 let node_crypto = require("node:crypto");
 node_crypto = require_rolldown_runtime.__toESM(node_crypto, 1);
 let node_fs = require("node:fs");
@@ -16,7 +16,7 @@ let node_readline = require("node:readline");
 node_readline = require_rolldown_runtime.__toESM(node_readline, 1);
 let node_stream_promises = require("node:stream/promises");
 
-//#region ../../node_modules/.pnpm/@anthropic-ai+sdk@0.102.0_zod@4.4.3/node_modules/@anthropic-ai/sdk/lib/transform-json-schema.mjs
+//#region ../../node_modules/.pnpm/@anthropic-ai+sdk@0.112.3_zod@4.4.3/node_modules/@anthropic-ai/sdk/lib/transform-json-schema.mjs
 const SUPPORTED_STRING_FORMATS = new Set([
 	"date-time",
 	"time",
@@ -111,7 +111,7 @@ function _transformJSONSchema(jsonSchema) {
 }
 
 //#endregion
-//#region ../../node_modules/.pnpm/@anthropic-ai+sdk@0.102.0_zod@4.4.3/node_modules/@anthropic-ai/sdk/helpers/beta/json-schema.mjs
+//#region ../../node_modules/.pnpm/@anthropic-ai+sdk@0.112.3_zod@4.4.3/node_modules/@anthropic-ai/sdk/helpers/beta/json-schema.mjs
 /**
 * Creates a Tool with a provided JSON schema that can be passed
 * to the `.toolRunner()` method. The schema is used to automatically validate
@@ -159,7 +159,7 @@ function betaJSONSchemaOutputFormat(jsonSchema, options) {
 }
 
 //#endregion
-//#region ../../node_modules/.pnpm/@anthropic-ai+sdk@0.102.0_zod@4.4.3/node_modules/@anthropic-ai/sdk/tools/agent-toolset/fs-util.mjs
+//#region ../../node_modules/.pnpm/@anthropic-ai+sdk@0.112.3_zod@4.4.3/node_modules/@anthropic-ai/sdk/tools/agent-toolset/fs-util.mjs
 /**
 * Shared, Node-only filesystem helpers for the agent toolset's file tools:
 * path confinement (symlink-aware), an atomic write, and language-independent
@@ -188,6 +188,7 @@ async function realpathOrSelf(p) {
 async function canonicalize(abs) {
 	const tail = [];
 	let prefix = abs;
+	let hops = 0;
 	for (;;) {
 		let real;
 		try {
@@ -198,6 +199,9 @@ async function canonicalize(abs) {
 				isLink = (await node_fs_promises.lstat(prefix)).isSymbolicLink();
 			} catch {}
 			if (isLink) {
+				if (++hops > 40) {
+					throw new require_sdk.ToolError(`path ${JSON.stringify(abs)} has too many levels of symbolic links`);
+				}
 				prefix = node_path.resolve(node_path.dirname(prefix), await node_fs_promises.readlink(prefix));
 				continue;
 			}
@@ -213,9 +217,10 @@ async function canonicalize(abs) {
 /**
 * Resolve `p` and confine it to `root`.
 *
-* Unless `allowOutside` is set, absolute inputs are rejected and the
-* **canonical** path is returned — every symlink in `p` (including the leaf,
-* even a dangling one) is resolved before the confinement check, and the
+* Absolute and relative inputs go through the same canonicalise-then-contain
+* check — an absolute path that lands inside `root` is permitted, only paths
+* that resolve *outside* are rejected. Every symlink in `p` (including the
+* leaf, even a dangling one) is resolved before the confinement check, and the
 * resolved path is what the caller then operates on, so a symlink inside `root`
 * that points outside it can neither pass the check nor be followed afterwards.
 *
@@ -226,18 +231,11 @@ async function canonicalize(abs) {
 */
 async function confineToRoot(root, p, opts) {
 	const allowOutside = opts?.allowOutside ?? false;
-	if (node_path.isAbsolute(p)) {
-		if (!allowOutside) {
-			throw new require_sdk.ToolError(`absolute path ${JSON.stringify(p)} not permitted`);
-		}
-		return node_path.resolve(p);
-	}
 	const realRoot = await realpathOrSelf(node_path.resolve(root));
 	const abs = node_path.resolve(realRoot, p);
 	if (allowOutside) return abs;
 	const real = await canonicalize(abs);
-	const rootSep = realRoot.endsWith(node_path.sep) ? realRoot : realRoot + node_path.sep;
-	if (real !== realRoot && !real.startsWith(rootSep)) {
+	if (real !== realRoot && !real.startsWith(realRoot + node_path.sep)) {
 		throw new require_sdk.ToolError(`path ${JSON.stringify(p)} escapes workdir`);
 	}
 	return real;
@@ -288,7 +286,7 @@ function fsErrorMessage(err, file) {
 }
 
 //#endregion
-//#region ../../node_modules/.pnpm/@anthropic-ai+sdk@0.102.0_zod@4.4.3/node_modules/@anthropic-ai/sdk/tools/agent-toolset/skills.mjs
+//#region ../../node_modules/.pnpm/@anthropic-ai+sdk@0.112.3_zod@4.4.3/node_modules/@anthropic-ai/sdk/tools/agent-toolset/skills.mjs
 /**
 * Node-only skill plumbing for the agent toolset: downloading a session
 * agent's skills into the workdir and extracting the archives. Kept in its own
@@ -526,7 +524,7 @@ async function readHead(file, n) {
 }
 
 //#endregion
-//#region ../../node_modules/.pnpm/@anthropic-ai+sdk@0.102.0_zod@4.4.3/node_modules/@anthropic-ai/sdk/tools/agent-toolset/node.mjs
+//#region ../../node_modules/.pnpm/@anthropic-ai+sdk@0.112.3_zod@4.4.3/node_modules/@anthropic-ai/sdk/tools/agent-toolset/node.mjs
 /**
 * Node implementation of the `agent_toolset_20260401` tools — `bash`, `read`,
 * `write`, `edit`, `glob`, `grep` — plus the workdir/skills
@@ -606,12 +604,14 @@ function betaAgentToolset20260401(ctx) {
 	];
 }
 /**
-* Resolve `p` relative to `ctx.workdir`. Unless `unrestrictedPaths` is set,
-* absolute inputs are rejected and the **canonical** path is returned — every
-* symlink in `p` (including the leaf, even a dangling one) is resolved before
-* the workdir check, and the resolved path is what the tool then operates on, so
-* a symlink inside the workdir that points outside it can neither pass the check
-* nor be followed afterwards. See the trust model on {@link AgentToolContext}.
+* Resolve `p` against `ctx.workdir`. Absolute and relative inputs go through
+* the same canonicalise-then-contain check — an absolute path that lands inside
+* the workdir is permitted, only paths that resolve *outside* are rejected.
+* Every symlink in `p` (including the leaf, even a dangling one) is resolved
+* before the workdir check, and the resolved path is what the tool then operates
+* on, so a symlink inside the workdir that points outside it can neither pass
+* the check nor be followed afterwards. See the trust model on
+* {@link AgentToolContext}.
 *
 * Residual TOCTOU: a component could still be swapped for a symlink between this
 * call and the eventual `fs` operation. Closing that fully needs per-component
@@ -990,6 +990,7 @@ function betaGlobTool(ctx) {
 			if (!ctx.unrestrictedPaths && pat.split(/[\\/]/).includes("..")) {
 				throw new require_sdk.ToolError("glob: \"..\" is not permitted in the pattern");
 			}
+			const realRoot = ctx.unrestrictedPaths ? root : await node_fs_promises.realpath(root).catch(() => root);
 			const matches = [];
 			try {
 				for await (const entry of fsGlob(pat, {
@@ -999,7 +1000,15 @@ function betaGlobTool(ctx) {
 				})) {
 					if (!entry.isFile()) continue;
 					const full = node_path.join(entry.parentPath, entry.name);
-					if (!ctx.unrestrictedPaths && !isWithin(root, full)) continue;
+					if (!ctx.unrestrictedPaths) {
+						let real;
+						try {
+							real = await node_fs_promises.realpath(full);
+						} catch {
+							continue;
+						}
+						if (!isWithin(realRoot, real)) continue;
+					}
 					let mtime = 0;
 					try {
 						mtime = (await node_fs_promises.stat(full)).mtimeMs;