@livx.cc/agentx 0.99.27 → 0.99.29

package/dist/{mcp-DiAiMiG5.d.ts → mcp-Cnq0pS95.d.ts}

@@ -1,4 +1,4 @@
-import { A as AgentTool } from './tools-CJAPSBhS.js';
+import { A as AgentTool } from './tools-BZVppx-6.js';
 
 /**
  * MCP bridge — adapt a Model Context Protocol tool list into the agent's AgentTool[],

package/dist/mcp.client.d.ts

@@ -1,5 +1,5 @@
-import { e as McpToolSearchOptions, f as McpToolSpec } from './mcp-DiAiMiG5.js';
-import { A as AgentTool } from './tools-CJAPSBhS.js';
+import { e as McpToolSearchOptions, f as McpToolSpec } from './mcp-Cnq0pS95.js';
+import { A as AgentTool } from './tools-BZVppx-6.js';
 import '@livx.cc/wcli/core';
 
 /** A JSON-RPC 2.0 transport: request (awaits a result), notify (fire-and-forget), close. */

package/dist/{tools-CJAPSBhS.d.ts → tools-BZVppx-6.d.ts}

@@ -36,6 +36,103 @@ interface Message {
 declare function contentText(content: MessageContent | undefined): string;
 /** Build an image content part from a data-URI or http(s) URL. */
 declare function imagePart(url: string): ContentPart;
+/** Stub left when an inline data-URI image is elided from the stored transcript (RAM + disk). */
+declare const IMAGE_ELIDE_STUB = "[image elided \u2014 re-attach @path or /paste to view again]";
+/** True when content carries an inline base64 image (the heavy case — http(s) URLs are tiny). */
+declare function messageHasInlineImage(content: MessageContent | undefined): boolean;
+/** Byte-weight for context budgeting — counts base64 payloads, not the `[image]` display placeholder. */
+declare function contentBytes(content: MessageContent | undefined): number;
+/** Replace inline data-URI image parts with a text stub; http(s) URLs, image REFS and plain text
+ *  unchanged — a ref is ~60 bytes and stays re-expandable, so there is nothing to reclaim. */
+declare function elideInlineImages(content: MessageContent, stub?: string): MessageContent;
+/** Replace EVERY heavy image part — inline base64 AND refs — with the stub. This is the destructive
+ *  form used by the `/compact` elision ladder: a ref is cheap on disk but weighs its whole file on the
+ *  wire while it's inside the send window, so it must be shave-able or the ladder falls through to
+ *  shredding (then dropping) the user's own text. `elideInlineImages` stays the non-destructive form. */
+declare function elideImages(content: MessageContent, stub?: string): MessageContent;
+/**
+ * A persist-safe REFERENCE to an image FILE. Stored in the transcript (and the session JSON) instead
+ * of the megabytes of base64 — `expandImagesForSend` turns it back into a data-URI in the OUTGOING
+ * request only, so neither the heap nor the disk ever holds historical payloads.
+ *
+ * SECURITY: a ref is a CAPABILITY, not a path. The URL carries an unguessable token; the real path
+ * lives only in this in-process registry, and only HOST code that already did the jail/permission
+ * check can mint one (`mintImageRef`, used by the CLI's @image attach and the image `Read` tool).
+ * Tool results are MODEL-CONTROLLED text (bash prints whatever it likes) — parsing a path out of them
+ * could never be the authorization. An unknown/evicted token is simply not a ref: it degrades to the
+ * elision stub, never a file read. That also covers a resumed session in a fresh process.
+ * Shape stays inside `image_url.url` so old readers/serializers need no schema change:
+ *   `agentx-image:<mime>;<token>;<path>`
+ * The trailing path is INERT BOOKKEEPING — `parseImageRef` never reads it, so it can't authorize
+ * anything. It exists only so `remintImageRefs` can re-grant the capability on session load, after
+ * re-checking the path against an allowed root (see there).
+ */
+declare const IMAGE_REF_SCHEME = "agentx-image:";
+interface ImageRef {
+    mime: string;
+    /** Absolute on-disk path. Never derived from model output — only from a mint-time capability. */
+    path: string;
+    /** base64 wire weight, stat'ed AT MINT TIME (so an overwritten-in-place path can never go stale). */
+    bytes: number;
+}
+/**
+ * Mint an image-ref URL for an ALREADY-AUTHORIZED absolute path. Host-only: call this after the
+ * jail/permission check, never on a path that came out of model output.
+ */
+declare function mintImageRef(path: string, mime: string): string;
+/** Test/host hook: forget every minted ref (simulates a fresh process / resumed session). */
+declare function clearImageRefs(): void;
+/** Build an image REFERENCE part for an authorized path. */
+declare function imageRefPart(path: string, mime: string): ContentPart;
+/** Resolve an image-ref URL through the registry; null when it isn't one, or the token is unknown
+ *  (forged by the model, evicted, or from a previous process). NEVER trusts the URL's own text. */
+declare function parseImageRef(url: string | undefined): ImageRef | null;
+/**
+ * Session LOAD: re-grant the capability for stored image parts whose token died with the previous
+ * process, so a resumed session's recent screenshot is visible again (parity with the pre-ref
+ * behaviour, where `elideStaleImages` kept the last inline image).
+ *
+ * A session file is WRITABLE BY THE MODEL (it can Write/Edit it, and the user may hand-edit it), so a
+ * stored path is untrusted input — its provenance proves nothing. The ROOT CHECK is what makes this
+ * safe: only a path whose REALPATH (symlinks resolved) sits inside one of `roots` is re-minted.
+ * Anything else is left unresolvable and degrades to the elision stub, with a warn.
+ *
+ * Only image PARTS in user/assistant content are considered. Tool-result strings stay inert forever —
+ * those are the model's own stdout and must never mint anything.
+ * Pure view: returns a new array only when something changed.
+ */
+declare function remintImageRefs(messages: Message[], roots: string[]): Message[];
+/** True when content carries an image REF part (weightless on disk, expanded at send time). The
+ *  CLAIM is enough: an unresolvable ref (resumed session / evicted token) still counts as image-bearing
+ *  so the send path turns it into the stub instead of shipping the unresolvable scheme to the provider. */
+declare function messageHasImageRef(content: MessageContent | undefined): boolean;
+/** Any image at all — inline base64 (legacy sessions) or a ref. Drives `keepRecent` windows. */
+declare function messageHasImage(content: MessageContent | undefined): boolean;
+/** `Read` on an image persists this instead of the base64; expanded to `{dataUrl}` at send time.
+ *  `path` must already have passed the filesystem's jail check (see `mintImageRef`). */
+declare function imageRefResult(path: string, mime: string): string;
+/** The registered ref behind a tool message's `{"imageRef":…}` JSON body, if that's what it is.
+ *  A model-forged body parses fine but resolves to null — the token isn't in the registry. */
+declare function toolImageRef(content: MessageContent | undefined): ImageRef | null;
+/** Elide inline images from all but the most-recent `keepRecent` image-bearing messages (mutates copies). */
+declare function elideStaleImages(messages: Message[], keepRecent?: number): Message[];
+/**
+ * SEND-PATH expansion: image REFS become real data-URIs only in the outgoing request, and only for the
+ * most-recent `keepRecent` messages of EACH kind (user attachment / tool image Read) — older ones (refs
+ * AND legacy inline base64) collapse to the elision stub. Pure view: the caller's messages are never mutated.
+ * A missing/unreadable file (or an unregistered ref) degrades to the same stub and is LOGGED — never throws.
+ */
+declare function expandImagesForSend(messages: Message[], keepRecent?: number, stub?: string): Message[];
+/**
+ * Byte-weight of a transcript AS IT WILL GO ON THE WIRE — refs inside the keep window weigh their
+ * file's base64 size, everything stale weighs the stub — WITHOUT materializing a single byte of
+ * base64. This is the honest number for `/context` and the CLI footer, where the old behaviour made
+ * every historical screenshot immortal and produced false "90% full" warnings.
+ */
+declare function sendBytes(messages: Message[], keepRecent?: number, stub?: string): number;
+/** `sendBytes` split per message — same window, same weights. Lets a budgeter drop/shave message-by-
+ *  message without re-deriving the window (and without charging a stale ref its file weight). */
+declare function sendBytesPer(messages: Message[], keepRecent?: number, stub?: string): number[];
 interface Tool {
     type: 'function';
     function: {
@@ -317,4 +414,4 @@ declare function toolRegistry(): Record<string, AgentTool>;
 /** Resolve a list of tool names against the registry (unknown names throw). */
 declare function toolsByName(names: string[]): AgentTool[];
 
-export { type AgentTool as A, type ChatLike as C, type HostBridge as H, type Message as M, type Role as R, SandboxJobRegistry as S, type TodoItem as T, type UserQuestion as U, type ChatOptions as a, type ChatResponse as b, type ContentPart as c, type HostEvent as d, type MessageContent as e, type StreamChunk as f, type Tool as g, type ToolCall as h, type ToolContext as i, bashTool as j, contentText as k, defaultTools as l, editTool as m, exitSessionTool as n, imagePart as o, makeContext as p, makeJobTools as q, readTool as r, todoWriteTool as s, toWireTools as t, toolRegistry as u, toolsByName as v };
+export { type AgentTool as A, makeJobTools as B, type ChatLike as C, messageHasImage as D, messageHasImageRef as E, messageHasInlineImage as F, mintImageRef as G, type HostBridge as H, IMAGE_ELIDE_STUB as I, parseImageRef as J, readTool as K, remintImageRefs as L, type Message as M, sendBytes as N, sendBytesPer as O, toWireTools as P, todoWriteTool as Q, type Role as R, SandboxJobRegistry as S, type TodoItem as T, type UserQuestion as U, toolImageRef as V, toolRegistry as W, toolsByName as X, type ChatOptions as a, type ChatResponse as b, type ContentPart as c, type HostEvent as d, IMAGE_REF_SCHEME as e, type ImageRef as f, type MessageContent as g, type StreamChunk as h, type Tool as i, type ToolCall as j, type ToolContext as k, bashTool as l, clearImageRefs as m, contentBytes as n, contentText as o, defaultTools as p, editTool as q, elideImages as r, elideInlineImages as s, elideStaleImages as t, exitSessionTool as u, expandImagesForSend as v, imagePart as w, imageRefPart as x, imageRefResult as y, makeContext as z };

package/dist/tools.shell.d.ts

@@ -1,4 +1,4 @@
-import { A as AgentTool } from './tools-CJAPSBhS.js';
+import { A as AgentTool } from './tools-BZVppx-6.js';
 import '@livx.cc/wcli/core';
 
 /**

package/dist/tools.shell.js

@@ -1,6 +1,18 @@
 // src/tools.ts
 import { CommandExecutor, registerHeadlessCommands } from "@livx.cc/wcli/core";
 
+// src/llm.ts
+import { readFileSync, statSync, realpathSync } from "fs";
+import { resolve, sep } from "path";
+import { randomBytes } from "crypto";
+
+// src/logging.ts
+import { log } from "libx.js/src/modules/log";
+var forComponent = (name) => log.forComponent(name);
+
+// src/llm.ts
+var log2 = forComponent("llm");
+
 // src/redact.ts
 var REDACTED = "\u2039redacted\u203A";
 var SECRET_PAIR = /((?:^|[\s,{[])(?:export\s+)?["']?[\w.\-]*(?:KEY|TOKEN|SECRET|PASSWORD|PASSWD|CREDENTIAL|PRIVATE_KEY|ACCESS_?KEY|AUTH(?:_?TOKEN)?|BEARER)[\w.\-]*["']?\s*[:=]\s*)(["']?)([^\s"',{}\]]+)/gi;
@@ -10,12 +22,8 @@ function redactSecrets(text) {
   return text.replace(SECRET_PAIR, (_m, head, quote, _val) => `${head}${quote}${REDACTED}`).replace(SECRET_TOKEN, REDACTED);
 }
 
-// src/logging.ts
-import { log } from "libx.js/src/modules/log";
-var forComponent = (name) => log.forComponent(name);
-
 // src/tools.web.ts
-var log2 = forComponent("web");
+var log3 = forComponent("web");
 function htmlToText(html) {
   let s = html.replace(/<script[\s\S]*?<\/script>/gi, " ").replace(/<style[\s\S]*?<\/style>/gi, " ").replace(/<title[\s\S]*?<\/title>/gi, " ").replace(/<noscript[\s\S]*?<\/noscript>/gi, " ").replace(/<textarea[\s\S]*?<\/textarea>/gi, " ").replace(/<!--[\s\S]*?-->/g, " ").replace(/<\/(p|div|li|h[1-6]|tr|section|article|header|footer|nav)>/gi, "\n").replace(/<br\s*\/?>/gi, "\n").replace(/<[^>]+>/g, " ");
   s = s.replace(/&nbsp;/g, " ").replace(/&amp;/g, "&").replace(/&lt;/g, "<").replace(/&gt;/g, ">").replace(/&quot;/g, '"').replace(/&#0?39;/g, "'").replace(/&#x27;/gi, "'");
@@ -137,7 +145,7 @@ function makeWebFetchTool(options = {}) {
 
 ${capped}`;
       } catch (e) {
-        log2.debug(`WebFetch ${u} failed`, e);
+        log3.debug(`WebFetch ${u} failed`, e);
         return `Error fetching ${u}: ${e?.name === "AbortError" ? `timed out after ${timeoutMs}ms` : e?.message ?? e}`;
       } finally {
         clearTimeout(timer);
@@ -261,7 +269,7 @@ function makeWebSearchTool(options = {}) {
         if (!res.ok) return `Error: search returned ${res.status} ${res.statusText}`;
         return formatHits(parseDdgHtml(await res.text(), maxResults));
       } catch (e) {
-        log2.debug("WebSearch failed", e);
+        log3.debug("WebSearch failed", e);
         return `Error searching: ${e?.name === "AbortError" ? `timed out after ${timeoutMs}ms` : e?.message ?? e}`;
       } finally {
         clearTimeout(timer);
@@ -278,6 +286,7 @@ function makeWebSearchAnthropicTool(opts = {}) {
 var webSearchAnthropicTool = makeWebSearchAnthropicTool();
 
 // src/tools.ts
+var log4 = forComponent("tools");
 function truncateOutput(s, headLines = 80, tailLines = 20) {
   const lines = s.split("\n");
   if (lines.length <= headLines + tailLines + 1) return s;
@@ -332,7 +341,7 @@ async function findSandboxWrapper(platform = process.platform) {
 }
 
 // src/tools.shell.ts
-var log3 = forComponent("shell");
+var log5 = forComponent("shell");
 var clean = (s) => truncateOutput(redactSecrets(s.replace(/\n+$/, "")));
 var DETACHED = { stdio: ["ignore", "pipe", "pipe"], detached: true };
 function killGroup(proc, signal) {
@@ -490,13 +499,13 @@ function makeRealShellTool(options) {
         }
       };
       try {
-        return await new Promise((resolve) => {
+        return await new Promise((resolve2) => {
           let out = "";
           let settled = false;
           const finish = (s) => {
             if (settled) return;
             settled = true;
-            resolve(s);
+            resolve2(s);
           };
           let proc;
           try {
@@ -519,7 +528,7 @@ function makeRealShellTool(options) {
           proc.stderr?.on("data", collect);
           proc.on("error", (err) => {
             if (err?.name === "AbortError" || ctl.signal.aborted) return finish(reasonFor(timedOut, timeoutMs, clean(out)));
-            log3.debug("shell spawn error", err);
+            log5.debug("shell spawn error", err);
             finish(`[exit 1] ${err?.message ?? err}${out ? "\n" + clean(out) : ""}`);
           });
           proc.on("close", (code) => {