@mastra/memory 1.26.1-alpha.4 → 1.26.1-alpha.6

package/CHANGELOG.md

@@ -1,5 +1,26 @@
 # @mastra/memory
 
+## 1.26.1-alpha.6
+
+### Patch Changes
+
+- Updated dependencies [[`2e4624e`](https://github.com/mastra-ai/mastra/commit/2e4624edb6917e61249cb60ee377735e7af7e4a9), [`e6534fa`](https://github.com/mastra-ai/mastra/commit/e6534fab031216f6cb48c4c9907cbfdce9d60bc6), [`7fdcaa6`](https://github.com/mastra-ai/mastra/commit/7fdcaa66105d64290f9b14432a12ec99f39c4d3a), [`5dba2a4`](https://github.com/mastra-ai/mastra/commit/5dba2a41600385751f5aace79878904e1972609d), [`cfd0d9e`](https://github.com/mastra-ai/mastra/commit/cfd0d9ec77ec3c69dd96f79cdb579e03d79f22ce), [`d9d93b2`](https://github.com/mastra-ai/mastra/commit/d9d93b25e4a65ad5fa153fa35be7ed149c8d587f)]:
+  - @mastra/core@1.58.0-alpha.12
+  - @mastra/schema-compat@1.3.6-alpha.3
+
+## 1.26.1-alpha.5
+
+### Patch Changes
+
+- Remove the `image-size` dependency from `@mastra/memory` and measure image dimensions with the already-present `probe-image-size` instead. ([#21120](https://github.com/mastra-ai/mastra/pull/21120))
+
+  Every published version of `image-size` carries unfixed denial-of-service advisories (GHSA-w3rx-r6r6-pgpr / CVE-2025-71330 and GHSA-5p2g-fcmc-qvqq): a malformed image could hang its parse loop and exhaust the heap. The repository is archived, so no fixed release is coming, and the previous pin to `1.2.1` moved between two equally affected releases rather than remediating the flaw. Because image bytes reaching agent memory are untrusted, a crafted 32-byte image was enough to crash the process.
+
+  Dimension detection still covers the formats models accept (PNG, JPEG, WebP, GIF, AVIF, BMP, ICO, PSD, SVG, TIFF). Unrecognized formats now report unknown dimensions, which token counting already handled.
+
+- Updated dependencies [[`b8ce7ec`](https://github.com/mastra-ai/mastra/commit/b8ce7ec96e39343c6c2f36d12d68a9ad816c09f7), [`a3a3624`](https://github.com/mastra-ai/mastra/commit/a3a3624f646b98e409424d8defccbd334da9e8b8), [`6246914`](https://github.com/mastra-ai/mastra/commit/62469146636911f3cbbe0880bd011c6a897a59a7), [`3f73c07`](https://github.com/mastra-ai/mastra/commit/3f73c076727e8c36b4fff7a1b40290fb68957fa8), [`7c1ebb1`](https://github.com/mastra-ai/mastra/commit/7c1ebb15690c4b3f0eabb19077cf8af573311e57), [`32980a3`](https://github.com/mastra-ai/mastra/commit/32980a3e2413d0274ac244d32c37d910edc13f00), [`4bcdfaf`](https://github.com/mastra-ai/mastra/commit/4bcdfaf0eac3199d7cb171b0a19a92c9c341eea4), [`af4636a`](https://github.com/mastra-ai/mastra/commit/af4636a74463275d71c1d13a38f7d2b738f128bf), [`a463cdf`](https://github.com/mastra-ai/mastra/commit/a463cdf1c95c3059e70f0bff27959e8558bb899d), [`0ea6b80`](https://github.com/mastra-ai/mastra/commit/0ea6b8001408ce02b56e8be0536b0fd8cbaf8ad2)]:
+  - @mastra/core@1.58.0-alpha.11
+
 ## 1.26.1-alpha.4
 
 ### Patch Changes

package/dist/docs/SKILL.md

@@ -3,7 +3,7 @@ name: mastra-memory
 description: Documentation for @mastra/memory. Use when working with @mastra/memory APIs, configuration, or implementation.
 metadata:
   package: "@mastra/memory"
-  version: "1.26.1-alpha.4"
+  version: "1.26.1-alpha.6"
 ---
 
 ## When to use

package/dist/docs/assets/SOURCE_MAP.json

@@ -1,5 +1,5 @@
 {
-  "version": "1.26.1-alpha.4",
+  "version": "1.26.1-alpha.6",
   "package": "@mastra/memory",
   "exports": {},
   "modules": {

package/dist/docs/references/docs-agents-agent-approval.md

@@ -90,6 +90,20 @@ for await (const chunk of stream.fullStream) {
 }
 ```
 
+#### Explaining a decline
+
+`declineToolCall()`, `declineToolCallGenerate()`, and `declineNetworkToolCall()` accept an optional `reason`. The reason is returned to the model in place of the tool result, so the model can adjust instead of retrying blindly. It's also stored on the tool call's `approval` metadata, so it's still there when the conversation is recalled.
+
+```typescript
+const declined = await agent.declineToolCall({
+  runId: stream.runId,
+  toolCallId,
+  reason: 'Reading other users PII is not allowed, ask the user for their own email instead',
+})
+```
+
+Without a `reason`, the model receives the default message `Tool call was not approved by the user`.
+
 #### Conditional approval with a function
 
 Instead of a boolean, `requireToolApproval` accepts a function that decides per tool call. It receives the `toolName`, the `args` the model passed, the `requestContext`, and the `workspace`. Return `true` to require approval for that call, or `false` to allow it. This lets you gate approval at runtime, for example, only for tools whose name matches a pattern:

package/dist/docs/references/docs-capabilities-subagents.md

@@ -113,7 +113,7 @@ The `context` object includes:
 
 ### Request context at the delegation boundary
 
-Each delegation receives a request context whose entries are shallowly copied from the parent run, excluding run-scoped identity keys. Setting or deleting entries during the subagent run does not affect the parent's context. Set entries on `context.requestContext` in `onDelegationStart` to pass values to the delegated run:
+Each delegation receives a request context whose entries are shallowly copied from the parent run, excluding run-scoped identity keys. Setting or deleting entries during the subagent run doesn't affect the parent's context. Set entries on `context.requestContext` in `onDelegationStart` to pass values to the delegated run:
 
 ```typescript
 const stream = await parentAgent.stream('Research AI trends', {
@@ -134,6 +134,9 @@ Called after a delegation finishes. Use it to inspect results or provide feedbac
 
 - `context.bail()`: Stop the parent agent's loop immediately
 - Return `{ feedback: '...' }`: Add feedback that gets saved to the parent agent's memory and is visible to subsequent iterations
+- Return `{ resultText: '...' }`: Replace the tool result text the parent model sees for this delegation, within the current run
+
+Use `resultText` when the subagent's own result would mislead the parent immediately. For example, a subagent that stops on a tool-calls step returns empty text, which the parent model reads as a successful but empty delegation. Unlike `feedback`, which only reaches the model on the next turn, `resultText` changes what the parent reasons on right away.
 
 ```typescript
 const stream = await parentAgent.stream('Research AI trends', {

package/dist/docs/references/docs-long-running-agents-goals.md

@@ -4,7 +4,7 @@
 
 **Added in:** `@mastra/core@1.42.0`
 
-> **Beta:** The Goals feature is in beta stage and subject to breaking changes in minor versions until it graduates from its beta status.
+> **Beta:** Breaking changes may occur without a major version bump until the API is stable.
 
 A goal is a durable, thread-scoped objective: a standing instruction the agent keeps working toward across loop iterations until a judge model decides it's satisfied or a run budget is exhausted.
 

package/dist/docs/references/docs-memory-message-history.md

@@ -6,7 +6,7 @@ Message history is the most basic and important form of memory. It gives the LLM
 
 You can also retrieve message history to display past conversations in your UI.
 
-> **Info:** Each message belongs to a thread (the conversation) and a resource (the user or entity it's associated with). See [Threads and resources](#threads-and-resources) for more detail.
+> **Note:** Each message belongs to a thread (the conversation) and a resource (the user or entity it's associated with). See [Threads and resources](#threads-and-resources) for more detail.
 
 > **Warning:** When you use memory with a client application, send **only the new message** from the client instead of the full conversation history.
 >
@@ -113,7 +113,7 @@ await agent.stream('Hello', {
 })
 ```
 
-> **Info:** Threads and messages are created automatically when you call `agent.generate()` or `agent.stream()`, but you can also create them manually with [`createThread()`](https://mastra.ai/reference/memory/createThread) and [`saveMessages()`](https://mastra.ai/reference/memory/memory-class).
+> **Note:** Threads and messages are created automatically when you call `agent.generate()` or `agent.stream()`, but you can also create them manually with [`createThread()`](https://mastra.ai/reference/memory/createThread) and [`saveMessages()`](https://mastra.ai/reference/memory/memory-class).
 
 You can use this history in two ways:
 

package/dist/docs/references/reference-file-based-agents-memory.md

@@ -2,6 +2,8 @@
 
 # Memory
 
+> **Beta:** Breaking changes may occur without a major version bump until the API is stable.
+
 A file-based agent gets [memory](https://mastra.ai/docs/memory/overview) from a `memory.ts` file that default-exports a [`Memory`](https://mastra.ai/reference/memory/memory-class) instance. Use this page for the file-based convention; use the memory docs for message history, semantic recall, storage, and processors.
 
 Without `memory.ts` or `config.memory`, the agent has no memory by default. Each `generate()` or `stream()` call starts without remembered conversation state unless you pass the prior context yourself.

package/dist/index.cjs

@@ -1,5 +1,5 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
-const require_src = require("./src-kjoZv97r.cjs");
+const require_src = require("./src-B2WSEEmS.cjs");
 let _mastra_core_processors = require("@mastra/core/processors");
 exports.Extractor = require_src.Extractor;
 exports.Memory = require_src.Memory;

package/dist/index.js

@@ -1,2 +1,2 @@
-import { C as WorkingMemoryExtractor, R as Extractor, S as deepMergeWorkingMemory, T as summarizeConversation, a as extractWorkingMemoryContent, c as WORKING_MEMORY_STATE_ID, d as getObservationsAsOf, i as WorkingMemory, l as WORKING_MEMORY_STATE_PROCESSOR_ID, n as MessageHistory, o as extractWorkingMemoryTags, r as SemanticRecall, s as removeWorkingMemoryTags, t as Memory, u as WorkingMemoryStateProcessor, w as SUMMARIZE_THREAD_DEFAULTS, x as ModelByInputTokens } from "./src-hv0DMVM-.js";
+import { C as WorkingMemoryExtractor, R as Extractor, S as deepMergeWorkingMemory, T as summarizeConversation, a as extractWorkingMemoryContent, c as WORKING_MEMORY_STATE_ID, d as getObservationsAsOf, i as WorkingMemory, l as WORKING_MEMORY_STATE_PROCESSOR_ID, n as MessageHistory, o as extractWorkingMemoryTags, r as SemanticRecall, s as removeWorkingMemoryTags, t as Memory, u as WorkingMemoryStateProcessor, w as SUMMARIZE_THREAD_DEFAULTS, x as ModelByInputTokens } from "./src-B_n15_Xg.js";
 export { Extractor, Memory, MessageHistory, ModelByInputTokens, SUMMARIZE_THREAD_DEFAULTS, SemanticRecall, WORKING_MEMORY_STATE_ID, WORKING_MEMORY_STATE_PROCESSOR_ID, WorkingMemory, WorkingMemoryExtractor, WorkingMemoryStateProcessor, deepMergeWorkingMemory, extractWorkingMemoryContent, extractWorkingMemoryTags, getObservationsAsOf, removeWorkingMemoryTags, summarizeConversation };

package/dist/processors/index.cjs

@@ -1,5 +1,5 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
-const require_src = require("../src-kjoZv97r.cjs");
+const require_src = require("../src-B2WSEEmS.cjs");
 exports.Extractor = require_src.Extractor;
 exports.ModelByInputTokens = require_src.ModelByInputTokens;
 exports.OBSERVATIONAL_MEMORY_DEFAULTS = require_src.OBSERVATIONAL_MEMORY_DEFAULTS;

package/dist/processors/index.js

@@ -1,2 +1,2 @@
-import { A as extractCurrentTask, B as OBSERVATION_CONTEXT_INSTRUCTIONS, C as WorkingMemoryExtractor, D as OBSERVER_SYSTEM_PROMPT, E as TokenCounter, F as injectAnchorIds, H as OBSERVATION_CONTINUATION_HINT, I as parseAnchorId, L as stripEphemeralAnchorIds, M as hasCurrentTaskSection, N as optimizeObservationsForContext, O as buildObserverPrompt, P as parseObserverOutput, R as Extractor, T as summarizeConversation, V as OBSERVATION_CONTEXT_PROMPT, _ as reconcileObservationGroupsFromReflection, b as wrapInObservationGroup, d as getObservationsAsOf, f as ObservationalMemoryProcessor, g as parseObservationGroups, h as deriveObservationGroupProvenance, j as formatMessagesForObserver, k as buildObserverSystemPrompt, m as combineObservationGroupRanges, p as ObservationalMemory, v as renderObservationGroupsForReflection, x as ModelByInputTokens, y as stripObservationGroups, z as OBSERVATIONAL_MEMORY_DEFAULTS } from "../src-hv0DMVM-.js";
+import { A as extractCurrentTask, B as OBSERVATION_CONTEXT_INSTRUCTIONS, C as WorkingMemoryExtractor, D as OBSERVER_SYSTEM_PROMPT, E as TokenCounter, F as injectAnchorIds, H as OBSERVATION_CONTINUATION_HINT, I as parseAnchorId, L as stripEphemeralAnchorIds, M as hasCurrentTaskSection, N as optimizeObservationsForContext, O as buildObserverPrompt, P as parseObserverOutput, R as Extractor, T as summarizeConversation, V as OBSERVATION_CONTEXT_PROMPT, _ as reconcileObservationGroupsFromReflection, b as wrapInObservationGroup, d as getObservationsAsOf, f as ObservationalMemoryProcessor, g as parseObservationGroups, h as deriveObservationGroupProvenance, j as formatMessagesForObserver, k as buildObserverSystemPrompt, m as combineObservationGroupRanges, p as ObservationalMemory, v as renderObservationGroupsForReflection, x as ModelByInputTokens, y as stripObservationGroups, z as OBSERVATIONAL_MEMORY_DEFAULTS } from "../src-B_n15_Xg.js";
 export { Extractor, ModelByInputTokens, OBSERVATIONAL_MEMORY_DEFAULTS, OBSERVATION_CONTEXT_INSTRUCTIONS, OBSERVATION_CONTEXT_PROMPT, OBSERVATION_CONTINUATION_HINT, OBSERVER_SYSTEM_PROMPT, ObservationalMemory, ObservationalMemoryProcessor, TokenCounter, WorkingMemoryExtractor, buildObserverPrompt, buildObserverSystemPrompt, combineObservationGroupRanges, deriveObservationGroupProvenance, extractCurrentTask, formatMessagesForObserver, getObservationsAsOf, hasCurrentTaskSection, injectAnchorIds, optimizeObservationsForContext, parseAnchorId, parseObservationGroups, parseObserverOutput, reconcileObservationGroupsFromReflection, renderObservationGroupsForReflection, stripEphemeralAnchorIds, stripObservationGroups, summarizeConversation, wrapInObservationGroup };

package/dist/processors/observational-memory/measure-image-buffer.d.ts

@@ -0,0 +1,23 @@
+/**
+ * Synchronous image dimension lookup for in-memory image buffers.
+ *
+ * Uses `probe-image-size`'s sync parsers rather than `image-size`, which has unfixed
+ * denial-of-service advisories (GHSA-w3rx-r6r6-pgpr / CVE-2025-71330 and
+ * GHSA-5p2g-fcmc-qvqq) affecting every published version, on an archived repository
+ * with no fixed release coming. A malformed 32-byte ICNS buffer was enough to hang the
+ * parse loop and exhaust the heap, and image bytes reaching agent memory are untrusted.
+ *
+ * `probe-image-size` covers the formats models actually accept (PNG, JPEG, WebP, GIF,
+ * AVIF, BMP, ICO, PSD, SVG, TIFF). Anything else returns `undefined`, which callers
+ * already handle as "dimensions unknown".
+ */
+/**
+ * Read the pixel dimensions of an image buffer.
+ *
+ * @returns The dimensions, or `undefined` if the buffer isn't a recognized image.
+ */
+export declare function measureImageBuffer(buffer: Uint8Array): {
+    width: number;
+    height: number;
+} | undefined;
+//# sourceMappingURL=measure-image-buffer.d.ts.map

package/dist/processors/observational-memory/measure-image-buffer.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"measure-image-buffer.d.ts","sourceRoot":"","sources":["../../../src/processors/observational-memory/measure-image-buffer.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAWH;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,UAAU,GAAG;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GAAG,SAAS,CAmBpG"}

package/dist/{src-kjoZv97r.cjs → src-B2WSEEmS.cjs}

@@ -51,8 +51,8 @@ let tokenx = require("tokenx");
 let crypto$1 = require("crypto");
 let _mastra_core_storage = require("@mastra/core/storage");
 let async_hooks = require("async_hooks");
-let image_size = require("image-size");
-image_size = __toESM$1(image_size, 1);
+let probe_image_size_sync_js = require("probe-image-size/sync.js");
+probe_image_size_sync_js = __toESM$1(probe_image_size_sync_js, 1);
 let _mastra_core_tools = require("@mastra/core/tools");
 let _mastra_core_schema = require("@mastra/core/schema");
 let _mastra_core_error = require("@mastra/core/error");
@@ -17366,6 +17366,42 @@ var ObserverRunner = class {
 	}
 };
 //#endregion
+//#region src/processors/observational-memory/measure-image-buffer.ts
+/**
+* Synchronous image dimension lookup for in-memory image buffers.
+*
+* Uses `probe-image-size`'s sync parsers rather than `image-size`, which has unfixed
+* denial-of-service advisories (GHSA-w3rx-r6r6-pgpr / CVE-2025-71330 and
+* GHSA-5p2g-fcmc-qvqq) affecting every published version, on an archived repository
+* with no fixed release coming. A malformed 32-byte ICNS buffer was enough to hang the
+* parse loop and exhaust the heap, and image bytes reaching agent memory are untrusted.
+*
+* `probe-image-size` covers the formats models actually accept (PNG, JPEG, WebP, GIF,
+* AVIF, BMP, ICO, PSD, SVG, TIFF). Anything else returns `undefined`, which callers
+* already handle as "dimensions unknown".
+*/
+const probeBuffer = probe_image_size_sync_js.default;
+/**
+* Read the pixel dimensions of an image buffer.
+*
+* @returns The dimensions, or `undefined` if the buffer isn't a recognized image.
+*/
+function measureImageBuffer(buffer) {
+	let probed;
+	try {
+		probed = probeBuffer(buffer);
+	} catch {
+		return;
+	}
+	if (!probed) return;
+	const { width, height } = probed;
+	if (typeof width !== "number" || !Number.isFinite(width) || typeof height !== "number" || !Number.isFinite(height)) return;
+	return {
+		width,
+		height
+	};
+}
+//#endregion
 //#region src/processors/observational-memory/token-counter.ts
 const IMAGE_FILE_EXTENSIONS = /* @__PURE__ */ new Set([
 	"png",
@@ -17672,26 +17708,23 @@ function resolveImageDimensions(part) {
 		width,
 		height
 	};
-	try {
-		const measured = (0, image_size.default)(buffer);
-		const measuredWidth = getFiniteNumber(measured.width);
-		const measuredHeight = getFiniteNumber(measured.height);
-		if (!measuredWidth || !measuredHeight) return {
-			width,
-			height
-		};
-		const resolved = {
-			width: width ?? measuredWidth,
-			height: height ?? measuredHeight
-		};
-		persistImageDimensions(part, resolved);
-		return resolved;
-	} catch {
-		return {
-			width,
-			height
-		};
-	}
+	const measured = measureImageBuffer(buffer);
+	if (!measured) return {
+		width,
+		height
+	};
+	const measuredWidth = getFiniteNumber(measured.width);
+	const measuredHeight = getFiniteNumber(measured.height);
+	if (!measuredWidth || !measuredHeight) return {
+		width,
+		height
+	};
+	const resolved = {
+		width: width ?? measuredWidth,
+		height: height ?? measuredHeight
+	};
+	persistImageDimensions(part, resolved);
+	return resolved;
 }
 function getBase64Size(base64) {
 	const sanitized = base64.replace(/\s+/g, "");
@@ -28873,4 +28906,4 @@ Object.defineProperty(exports, "wrapInObservationGroup", {
 	}
 });
 
-//# sourceMappingURL=src-kjoZv97r.cjs.map
+//# sourceMappingURL=src-B2WSEEmS.cjs.map