@namzu/sdk 60.0.0 → 60.2.0

package/dist/runtime/query/executor.js

@@ -1,5 +1,5 @@
 import { createHash } from 'node:crypto';
-import { join, resolve } from 'node:path';
+import { isAbsolute, join, resolve } from 'node:path';
 import { unknownProgramInLine } from '../../authorization/program.js';
 import { compileSkillGrant } from '../../authorization/skill-grant.js';
 import { extractFromToolCall, extractFromToolResult } from '../../compaction/extractor.js';
@@ -15,7 +15,7 @@ import { fingerprintContent } from '../../tools/builtins/content-fingerprint.js'
 import { sandboxShellSpawn, withoutBashStartup } from '../../tools/command-shell.js';
 import { isAlwaysDestructive } from '../../tools/defineTool.js';
 import { createFileReadTracker } from '../../tools/file-read-tracker.js';
-import { pathOutsideRoots, toolRoots } from '../../tools/paths.js';
+import { pathOutsideRoots, resolveWithinAnyReal, toolRoots } from '../../tools/paths.js';
 import { resolveRetainedOutput } from '../../tools/retained-output.js';
 import { createToolMessage, } from '../../types/message/index.js';
 import { abortReasonText } from '../../utils/abort.js';
@@ -25,6 +25,7 @@ import { toErrorMessage } from '../../utils/error.js';
 import { generateToolCallId } from '../../utils/id.js';
 import { compressShellOutput } from '../../utils/shell-compress.js';
 import { parseStructuredResultJson } from '../../utils/structured-result-json.js';
+import { ensureScratchpadDirectory } from '../../utils/temp.js';
 import { bindOwner } from '../jobs/registry.js';
 import { stillRunningResult } from './detached-calls.js';
 import { formatFailedToolOutput, hookNote, isUnregistered, prepareDirectCall, runPreToolHook, unknownToolMessage, } from './executor/tool-call-admission.js';
@@ -316,6 +317,71 @@ export class ToolExecutor {
         await this.sandboxGate?.();
     }
     /** True once the turn has a sandbox, or is certain to get one before a tool runs. */
+    /** The scratch folder, once a call has named it and it has been made and checked. */
+    scratchpadReady;
+    /** The tools' roots now: the turn's, plus the scratch folder once it is ready. */
+    rootsNow() {
+        return toolRoots({
+            workingDirectory: this.config.workingDirectory,
+            additionalDirectories: this.additionalDirectoriesNow(),
+        });
+    }
+    additionalDirectoriesNow() {
+        if (this.scratchpadReady === undefined)
+            return this.config.additionalDirectories;
+        return [...(this.config.additionalDirectories ?? []), this.scratchpadReady];
+    }
+    /**
+     * Make the session's scratch folder a root when a call names it. Lazy: a
+     * session that never uses it leaves nothing on disk. The folder must be
+     * inside the private temporary root with no link on the way; otherwise it
+     * stays outside the roots and a path in it is asked about like any other.
+     */
+    admitScratchpad(call) {
+        const directory = this.config.scratchpadDirectory;
+        if (directory === undefined || this.scratchpadReady !== undefined || this.sandboxed)
+            return;
+        if (call.kind === 'synthetic')
+            return;
+        let named = false;
+        try {
+            named = JSON.stringify(call.input)?.includes(JSON.stringify(directory).slice(1, -1)) === true;
+        }
+        catch {
+            // An input that cannot be serialised names nothing.
+        }
+        if (!named)
+            return;
+        try {
+            this.scratchpadReady = ensureScratchpadDirectory(directory);
+        }
+        catch (error) {
+            this.log.warn('The session scratch folder could not be made, so it stays outside the roots', {
+                'exception.message': error instanceof Error ? error.message : String(error),
+            });
+        }
+    }
+    /** Whether `call` writes a file inside the ready scratch folder and nothing else about it is notable. */
+    async writesScratchpad(call, escalation) {
+        const root = this.scratchpadReady;
+        if (root === undefined || escalation !== undefined || call.kind === 'synthetic')
+            return false;
+        if (call.toolName !== 'write' && call.toolName !== 'edit')
+            return false;
+        const tool = this.config.tools.get(call.toolName);
+        if (!tool?.pathArgument || call.input === null || typeof call.input !== 'object')
+            return false;
+        const value = call.input[tool.pathArgument];
+        if (typeof value !== 'string' || !isAbsolute(value))
+            return false;
+        try {
+            await resolveWithinAnyReal([root], value);
+            return true;
+        }
+        catch {
+            return false;
+        }
+    }
     get sandboxed() {
         return this.config.sandbox !== undefined || this.sandboxGate !== undefined;
     }
@@ -585,6 +651,7 @@ export class ToolExecutor {
             await this.awaitSandbox();
         const calls = new Map();
         const escalations = new Map();
+        const scratchpadWrites = new Set();
         const earlierPaths = [];
         for (const toolCall of response.message.toolCalls ?? []) {
             const prepared = await prepareDirectCall(this.admissionHost(), toolCall, !hostModifiedCallIds?.has(toolCall.id));
@@ -593,12 +660,15 @@ export class ToolExecutor {
             if (path !== undefined)
                 earlierPaths.push(path);
             calls.set(toolCall.id, call);
+            this.admitScratchpad(call);
             const escalation = await this.escalationOrUnfinished(call);
             if (escalation)
                 escalations.set(toolCall.id, escalation);
+            if (await this.writesScratchpad(call, escalation))
+                scratchpadWrites.add(toolCall.id);
         }
         this.config.abortSignal.throwIfAborted();
-        return this.publishPreparedBatch(calls, escalations);
+        return this.publishPreparedBatch(calls, escalations, scratchpadWrites);
     }
     /**
      * A ready call the tool already knows cannot run, answered now instead of
@@ -703,7 +773,7 @@ export class ToolExecutor {
                 // This session's own retained output is not "outside": it is where the
                 // result that was cut told the model to look.
                 const retained = tool.name === 'read' && (await resolveRetainedOutput(this.outputDirectory(), value));
-                const outside = retained ? undefined : await pathOutsideRoots(toolRoots(this.config), value);
+                const outside = retained ? undefined : await pathOutsideRoots(this.rootsNow(), value);
                 if (outside !== undefined)
                     outsidePaths = [outside];
             }
@@ -745,7 +815,7 @@ export class ToolExecutor {
      * file tools' own does.
      */
     async pathEscalationsOf(tool, input, sandboxed, shellCwd) {
-        const roots = toolRoots(this.config);
+        const roots = this.rootsNow();
         const protectedPaths = [];
         let outsidePaths = [];
         let removal;
@@ -804,16 +874,22 @@ export class ToolExecutor {
         }
         const calls = new Map(previous.calls);
         const escalations = new Map(previous.escalations);
+        const scratchpadWrites = new Set(previous.scratchpadWrites);
         const earlierPaths = [];
         for (const toolCall of response.message.toolCalls ?? []) {
             if (changedCallIds.has(toolCall.id)) {
                 const call = await this.refusedBeforeReview(await prepareDirectCall(this.admissionHost(), toolCall, false), earlierPaths);
                 calls.set(toolCall.id, call);
+                this.admitScratchpad(call);
                 const escalation = await this.escalationOrUnfinished(call);
                 if (escalation)
                     escalations.set(toolCall.id, escalation);
                 else
                     escalations.delete(toolCall.id);
+                if (await this.writesScratchpad(call, escalation))
+                    scratchpadWrites.add(toolCall.id);
+                else
+                    scratchpadWrites.delete(toolCall.id);
             }
             const prepared = calls.get(toolCall.id);
             const path = prepared ? inputPathOf(prepared) : undefined;
@@ -821,9 +897,9 @@ export class ToolExecutor {
                 earlierPaths.push(path);
         }
         this.config.abortSignal.throwIfAborted();
-        return this.publishPreparedBatch(calls, escalations);
+        return this.publishPreparedBatch(calls, escalations, scratchpadWrites);
     }
-    publishPreparedBatch(calls, escalations) {
+    publishPreparedBatch(calls, escalations, scratchpadWrites) {
         const reviewCalls = [...calls.values()]
             .filter((call) => call.kind !== 'synthetic')
             .map((call) => {
@@ -835,12 +911,14 @@ export class ToolExecutor {
                 input: call.input,
                 ...(escalation ? { escalation } : {}),
                 ...(hookPermission ? { hookPermission } : {}),
+                ...(scratchpadWrites.has(call.toolCall.id) ? { scratchpadWrite: true } : {}),
             };
         });
         const batch = Object.freeze({
             reviewCalls: Object.freeze(reviewCalls),
             calls: new Map(calls),
             escalations: new Map(escalations),
+            scratchpadWrites: new Set(scratchpadWrites),
         });
         this.preparedBatches.add(batch);
         return batch;
@@ -1409,6 +1487,7 @@ export class ToolExecutor {
         catch {
             needsApproval = true;
         }
+        this.admitScratchpad(preparedCall);
         const nestedEscalation = await this.escalationOrUnfinished(preparedCall);
         if (nestedEscalation || needsApproval || (gateResult && gateResult.decision !== 'allow')) {
             const reason = nestedEscalation
@@ -1617,8 +1696,8 @@ export class ToolExecutor {
             sessionId: this.config.sessionId,
             turnId: this.config.turnId,
             workingDirectory: this.config.workingDirectory,
-            ...(this.config.additionalDirectories?.length
-                ? { additionalDirectories: this.config.additionalDirectories }
+            ...(this.additionalDirectoriesNow()?.length
+                ? { additionalDirectories: this.additionalDirectoriesNow() }
                 : {}),
             ...(this.config.authorizationGate
                 ? {