@namzu/sdk 62.6.0 → 62.7.0

package/src/sandbox/file-walk.ts

@@ -1,6 +1,5 @@
 import { isAbsolute, join, posix } from 'node:path'
 import braceExpansion from 'brace-expansion'
-import { GLOBSTAR, Minimatch } from 'minimatch'
 import type {
 	SandboxExecOptions,
 	SandboxExecResult,
@@ -10,11 +9,15 @@ import type {
 } from '../types/sandbox/index.js'
 import { subscribeToAbort } from '../utils/abort.js'
 import { FILE_WALK_PROGRAM } from './file-walk-program.js'
+import { compileSegment } from './glob-segment.js'
 import { VCS_NAMES, createIgnoreStack } from './ignore-matcher.js'
 
 /** Entries a walk examines before it stops with what it has: a safety valve, not a budget. */
 export const DEFAULT_MAX_VISITED_ENTRIES = 500_000
 
+const GLOBSTAR = Symbol('globstar')
+type Segment = string | { source: string; flags: string } | typeof GLOBSTAR
+
 interface WalkPlan {
 	root: string
 	prefix: string[]
@@ -62,22 +65,26 @@ function planWalk(root: string, options: SandboxWalkFilesOptions): WalkPlan {
 	// that cap can silently truncate before our extra branch proves incompleteness.
 	const branches = expandBraces(pattern, { max: 257, maxLength: Number.POSITIVE_INFINITY })
 	if (branches.length > 256) throw new RangeError('File walk pattern exceeds 256 brace expansions')
-	const matchers = branches.map((branch) => {
+	const dot = options.includeHidden ?? false
+	const sets = branches.map((branch) => {
 		if (branch.startsWith('/') || /^[a-z]:/i.test(branch) || branch.split('/').includes('..')) {
 			throw new Error('Expanded file walk pattern escapes its root')
 		}
-		return new Minimatch(branch, {
-			nobrace: true,
-			nonegate: true,
-			nocomment: true,
-			dot: options.includeHidden ?? false,
-			platform: 'linux',
-		})
+		return branch
+			.split('/')
+			.filter(
+				(segment, index, all) => segment !== '.' && (segment !== '' || index === all.length - 1),
+			)
+			.reduce<Segment[]>((set, segment) => {
+				if (segment === '**') {
+					if (set[set.length - 1] !== GLOBSTAR) set.push(GLOBSTAR)
+					return set
+				}
+				const { literal, source } = compileSegment(segment, dot)
+				set.push(literal !== null ? literal : { source, flags: 'u' })
+				return set
+			}, [])
 	})
-	const sets = matchers.flatMap((matcher) => matcher.set)
-	if (sets.some((set) => set.some((segment) => segment === '..'))) {
-		throw new Error('Expanded file walk pattern escapes its root')
-	}
 	const patternDepth = Math.max(
 		1,
 		...sets.map((set) => (set.includes(GLOBSTAR) ? Number.POSITIVE_INFINITY : set.length)),
@@ -100,10 +107,24 @@ function planWalk(root: string, options: SandboxWalkFilesOptions): WalkPlan {
 			break
 		prefix.push(segment)
 	}
-	const expressions = matchers.flatMap((matcher) => {
-		const expression = matcher.makeRe()
-		return expression ? [{ source: expression.source, flags: expression.flags }] : []
-	})
+	const hiddenGuard = dot ? '' : '(?!\\.)'
+	const expressions = sets.map((set) => ({
+		source: `^${set
+			.map((segment, index) => {
+				const last = index === set.length - 1
+				if (segment === GLOBSTAR) {
+					const run = `(?:${hiddenGuard}[^/]+/)*`
+					return last ? `${run}${hiddenGuard}[^/]+` : run
+				}
+				const body =
+					typeof segment === 'string'
+						? segment.replace(/[\\^$.*+?()[\]{}|/]/g, '\\$&')
+						: segment.source.slice(1, -1)
+				return last ? `(?:${body})` : `(?:${body})/`
+			})
+			.join('')}$`,
+		flags: 'u',
+	}))
 	return {
 		root,
 		prefix,

package/src/sandbox/glob-segment.ts

@@ -0,0 +1,309 @@
+/**
+ * Compiles one path segment of a glob (no `/` in it) to the regular expression
+ * the file walk tests names with, in the same dialect the sandbox guest runs.
+ * It covers `*`, `?`, `[...]` classes (with `!`/`^` negation, ranges and POSIX
+ * classes), the five extglob forms and `\` escapes. A segment with no magic in
+ * it comes back as the plain name to compare against.
+ */
+
+// Written for the `u` flag, which every compiled expression carries.
+const POSIX_CLASSES: ReadonlyMap<string, string> = new Map(
+	Object.entries({
+		alnum: '\\p{L}\\p{Nl}\\p{Nd}',
+		alpha: '\\p{L}\\p{Nl}',
+		ascii: '\\x00-\\x7f',
+		blank: '\\p{Zs}\\t',
+		cntrl: '\\p{Cc}',
+		digit: '\\p{Nd}',
+		graph: '\\x21-\\x7e',
+		lower: '\\p{Ll}',
+		print: '\\x20-\\x7e',
+		punct: '\\p{P}\\p{S}',
+		space: '\\s',
+		upper: '\\p{Lu}',
+		word: '\\p{L}\\p{Nl}\\p{Nd}_',
+		xdigit: '0-9a-fA-F',
+	}),
+)
+
+export interface CompiledSegment {
+	/** Set when the segment has no magic: the exact name it matches. */
+	literal: string | null
+	/** Source of an expression anchored with `^` and `$`, for a segment with magic. */
+	source: string
+}
+
+/**
+ * The longest segment, in UTF-16 code units, that `compileSegment` accepts. A
+ * file name is at most 255 bytes on the file systems Namzu runs on, so a
+ * pattern for one name beyond four times that is never legitimate, while
+ * compiling a segment costs time in proportion to the square of its length.
+ */
+export const MAX_GLOB_SEGMENT_LENGTH = 1024
+
+/** How much of an over-long pattern an error message shows, in code points. */
+const PREVIEW_LENGTH = 60
+
+/** The first `PREVIEW_LENGTH` code points of `text`, never cutting a surrogate pair. */
+const preview = (text: string) =>
+	Array.from(text.slice(0, PREVIEW_LENGTH * 2))
+		.slice(0, PREVIEW_LENGTH)
+		.join('')
+
+/**
+ * Raised for a segment that repeats a group (`*( )` or `+( )`) which could match
+ * the same text more than one way. Such a group backtracks exponentially on a
+ * name that nearly matches, and glob patterns come from untrusted input.
+ */
+export class GlobTooComplexError extends Error {
+	readonly segment: string
+	constructor(segment: string, reason: 'ambiguous' | 'stretch' | 'length' = 'ambiguous') {
+		super(
+			reason === 'length'
+				? `The pattern '${preview(segment)}...' is too long (${segment.length} characters; at most ${MAX_GLOB_SEGMENT_LENGTH} between slashes); shorten it or split it across folders.`
+				: reason === 'stretch'
+					? `The pattern '${segment}' has more than three wildcards that can stretch; split it across folders or use fewer *.`
+					: `The pattern '${segment}' repeats a group that can match the same text more than one way; use ** or {a,b} instead.`,
+		)
+		this.name = 'GlobTooComplexError'
+		// An over-long pattern is not kept whole: the error may be logged.
+		this.segment = reason === 'length' ? preview(segment) : segment
+	}
+}
+
+const escapeRegex = (text: string) => text.replace(/[\\^$.*+?()[\]{}|/]/g, '\\$&')
+const escapeInClass = (text: string) => text.replace(/[\\^\]\[/-]/g, '\\$&')
+
+interface Parsed {
+	source: string
+	literal: string
+	magic: boolean
+	/** Unbounded runs: each `*` (consecutive ones collapsed), `*( )` and `+( )`. */
+	runs: number
+}
+
+/** Index of the `)` closing the group opened just before `from`, or -1. */
+function closeGroup(text: string, from: number): number {
+	let depth = 1
+	for (let index = from; index < text.length; index += 1) {
+		const ch = text[index]
+		if (ch === '\\') index += 1
+		else if (ch === '[') {
+			const end = classEnd(text, index)
+			if (end > 0) index = end
+		} else if (ch === '(') depth += 1
+		else if (ch === ')' && --depth === 0) return index
+	}
+	return -1
+}
+
+/** Index of the `]` closing the class opened at `start`, or -1 when it never closes. */
+function classEnd(text: string, start: number): number {
+	let index = start + 1
+	if (text[index] === '!' || text[index] === '^') index += 1
+	if (text[index] === ']') index += 1
+	for (; index < text.length; index += 1) {
+		const ch = text[index]
+		if (ch === '\\') index += 1
+		else if (ch === '[' && text[index + 1] === ':') {
+			const end = text.indexOf(':]', index + 2)
+			if (end > 0 && POSIX_CLASSES.has(text.slice(index + 2, end))) index = end + 1
+		} else if (ch === ']') return index
+	}
+	return -1
+}
+
+function splitAlternatives(body: string): string[] {
+	const parts: string[] = []
+	let depth = 0
+	let current = ''
+	for (let index = 0; index < body.length; index += 1) {
+		const ch = body[index] as string
+		if (ch === '\\') {
+			current += ch + (body[index + 1] ?? '')
+			index += 1
+			continue
+		}
+		if (ch === '[') {
+			const end = classEnd(body, index)
+			if (end > 0) {
+				current += body.slice(index, end + 1)
+				index = end
+				continue
+			}
+		}
+		if (ch === '(') depth += 1
+		if (ch === ')') depth -= 1
+		if (ch === '|' && depth === 0) {
+			parts.push(current)
+			current = ''
+		} else current += ch
+	}
+	parts.push(current)
+	return parts
+}
+
+function classSource(body: string): string {
+	let index = 0
+	let negate = false
+	if (body[0] === '!' || body[0] === '^') {
+		negate = true
+		index = 1
+	}
+	let out = ''
+	for (; index < body.length; index += 1) {
+		const ch = body[index] as string
+		if (ch === '[' && body[index + 1] === ':') {
+			const end = body.indexOf(':]', index + 2)
+			const name = end > 0 ? body.slice(index + 2, end) : ''
+			const members = POSIX_CLASSES.get(name)
+			if (members !== undefined) {
+				out += members
+				index = end + 1
+				continue
+			}
+		}
+		if (ch === '\\' && index + 1 < body.length) {
+			index += 1
+			out += escapeInClass(body[index] as string)
+		} else if (ch === '-' && out !== '' && index + 1 < body.length) out += '-'
+		else out += escapeInClass(ch)
+	}
+	const source = `[${negate ? '^' : ''}${out}]`
+	try {
+		new RegExp(source, 'u')
+	} catch {
+		// An out-of-order range such as `[z-a]` matches no name rather than failing the walk.
+		return '(?!)'
+	}
+	return source
+}
+
+/** `guard`, when set, is put before each alternative of a group at the very start that does not itself spell out a leading `.`. */
+function parse(text: string, guard = ''): Parsed {
+	let source = ''
+	let literal = ''
+	let magic = false
+	let runs = 0
+	for (let index = 0; index < text.length; index += 1) {
+		const ch = text[index] as string
+		const next = text[index + 1]
+		if (ch === '\\') {
+			if (next === undefined) {
+				source += '\\\\'
+				literal += '\\'
+			} else {
+				source += escapeRegex(next)
+				literal += next
+				index += 1
+			}
+		} else if (ch === '*' && next !== '(') {
+			while (text[index + 1] === '*') index += 1
+			source += '[^/]*?'
+			runs += 1
+			magic = true
+		} else if (ch === '?' && next !== '(') {
+			source += '[^/]'
+			magic = true
+		} else if (ch === '[') {
+			const end = classEnd(text, index)
+			if (end < 0) {
+				source += '\\['
+				literal += '['
+			} else {
+				source += classSource(text.slice(index + 1, end))
+				magic = true
+				index = end
+			}
+		} else if ('?*+@!'.includes(ch) && next === '(') {
+			const end = closeGroup(text, index + 2)
+			if (end < 0) {
+				source += escapeRegex(ch)
+				literal += ch
+				continue
+			}
+			const parts = splitAlternatives(text.slice(index + 2, end)).map((a) => ({
+				a,
+				parsed: parse(a),
+			}))
+			// A repeated group is linear only when each repetition can be read one way:
+			// plain literal alternatives, none a prefix of another (and none empty).
+			if (ch === '*' || ch === '+') {
+				const literals = parts.map((part) => part.parsed.literal)
+				// A lone class is one character wide, so each repetition has one reading.
+				const lone = parts.length === 1 && isOneClass(parts[0]?.a ?? '')
+				const plain = lone || parts.every((part) => !part.parsed.magic)
+				const prefixFree =
+					lone ||
+					literals.every(
+						(one, i) =>
+							one !== '' && literals.every((other, j) => i === j || !other.startsWith(one)),
+					)
+				if (!plain || !prefixFree) throw new GlobTooComplexError(text)
+			}
+			const alternatives = parts.map(
+				({ a, parsed }) => (index === 0 && !startsWithDot(a) ? guard : '') + parsed.source,
+			)
+			const group = `(?:${alternatives.join('|')})`
+			runs +=
+				parts.reduce((sum, part) => sum + part.parsed.runs, 0) + (ch === '*' || ch === '+' ? 1 : 0)
+			magic = true
+			if (ch === '!') {
+				const tail = parse(text.slice(end + 1))
+				const rest = tail.source
+				source += `(?:(?!${group}${rest}$)[^/]*?)${rest}`
+				return { source, literal, magic, runs: runs + 1 + tail.runs }
+			}
+			source += ch === '@' ? group : `${group}${ch === '?' ? '?' : ch === '*' ? '*' : '+'}`
+			index = end
+		} else {
+			source += escapeRegex(ch)
+			literal += ch
+		}
+	}
+	return { source, literal, magic, runs }
+}
+
+/** Whether the text is exactly one closed `[...]` class. */
+function isOneClass(text: string): boolean {
+	return text.startsWith('[') && classEnd(text, 0) === text.length - 1
+}
+
+/** Whether every name this segment can match begins with a literal `.` the pattern spells out. */
+function startsWithDot(text: string): boolean {
+	if (text.startsWith('.') || text.startsWith('\\.')) return true
+	if (text.startsWith('[')) {
+		const end = classEnd(text, 0)
+		return end > 0 && text.slice(1, end) === '.'
+	}
+	return false
+}
+
+/** Whether the segment is a single `?(`, `*(`, `@(` or `+(` group, whose alternatives carry the leading-dot guard themselves. */
+function isOneGroup(text: string): boolean {
+	return (
+		'?*@+'.includes(text[0] ?? '') && text[1] === '(' && closeGroup(text, 2) === text.length - 1
+	)
+}
+
+/**
+ * `dot` lets a wildcard match a name that starts with `.`; without it only a
+ * segment that itself begins with a literal `.` can.
+ */
+export function compileSegment(segment: string, dot: boolean): CompiledSegment {
+	if (segment.length > MAX_GLOB_SEGMENT_LENGTH) throw new GlobTooComplexError(segment, 'length')
+	const guard = dot ? '' : '(?!\\.)'
+	let parsed: Parsed
+	try {
+		parsed = parse(segment, guard)
+	} catch (error) {
+		throw error instanceof GlobTooComplexError
+			? new GlobTooComplexError(segment, 'ambiguous')
+			: error
+	}
+	if (parsed.runs > 3) throw new GlobTooComplexError(segment, 'stretch')
+	if (!parsed.magic) return { literal: parsed.literal, source: `^${parsed.source}$` }
+	const grouped = (segment.startsWith('@(') || segment.startsWith('+(')) && !dot
+	const lead = grouped || dot || startsWithDot(segment) || isOneGroup(segment) ? '' : guard
+	return { literal: null, source: `^${lead}(?:${parsed.source})$` }
+}

package/src/store/session-log/index.ts

@@ -61,6 +61,13 @@ export {
 	withMessageId,
 } from './fold.js'
 export { type TornTailRepair, repairRecordDraft } from './heal.js'
+export {
+	foldChildOutcomes,
+	foldTurnOutcomes,
+	parseTurnOutcome,
+	readOutcomeProgress,
+	readTurnOutcome,
+} from './turn-outcome.js'
 export {
 	type ReleaseHeldSessionLeasesOptions,
 	type ReleaseHeldSessionLeasesResult,

package/src/store/session-log/turn-outcome.ts

@@ -0,0 +1,84 @@
+import type { CheckpointId, SessionId, TurnId } from '../../types/ids/index.js'
+import { type TurnOutcome, TurnOutcomeSchema } from '../../types/session/outcome.js'
+import type { SessionRecord } from '../../types/session/records.js'
+import type { SessionLog } from './core.js'
+
+/**
+ * Reading the turn's outcome record back out of the session log.
+ *
+ * It lives in three records of its own (`turn_outcome_recorded`,
+ * `child_outcome_recorded`, `outcome_progress_written`), each flagged
+ * `ignorable`, and never in a field of an older record: a release that
+ * validates `turn_completed`, `child_session_ended` or the checkpoint strictly
+ * reads a log that has them and loses only the outcome. The fold of messages
+ * does not look at them. A body that does not parse as a `TurnOutcome` reads
+ * as no outcome, never as a guess.
+ */
+
+/** `value` as a {@link TurnOutcome}, or `undefined` when it is not one. */
+export function parseTurnOutcome(value: unknown): TurnOutcome | undefined {
+	const parsed = TurnOutcomeSchema.safeParse(value)
+	return parsed.success ? parsed.data : undefined
+}
+
+/**
+ * The outcome of each turn that recorded one, from records in log order. A
+ * turn that recorded none is absent, so a caller never reads `unchanged` into
+ * a turn nobody measured.
+ */
+export function foldTurnOutcomes(records: Iterable<SessionRecord>): Map<TurnId, TurnOutcome> {
+	const outcomes = new Map<TurnId, TurnOutcome>()
+	for (const record of records) {
+		if (record.type !== 'turn_outcome_recorded') continue
+		const outcome = parseTurnOutcome(record.outcome)
+		if (outcome) outcomes.set(record.turnId, outcome)
+		else outcomes.delete(record.turnId)
+	}
+	return outcomes
+}
+
+/** The outcome `turnId` recorded, or `undefined`. */
+export async function readTurnOutcome(
+	log: SessionLog,
+	turnId: TurnId,
+): Promise<TurnOutcome | undefined> {
+	let found: TurnOutcome | undefined
+	for await (const { record } of log.read({ mode: 'tolerant' })) {
+		if (record.type !== 'turn_outcome_recorded' || record.turnId !== turnId) continue
+		found = parseTurnOutcome(record.outcome)
+	}
+	return found
+}
+
+/**
+ * The outcome a child's settled turn recorded in the parent's log, by child
+ * session id. A child with no record is absent.
+ */
+export function foldChildOutcomes(records: Iterable<SessionRecord>): Map<SessionId, TurnOutcome> {
+	const outcomes = new Map<SessionId, TurnOutcome>()
+	for (const record of records) {
+		if (record.type !== 'child_outcome_recorded') continue
+		const outcome = parseTurnOutcome(record.outcome)
+		if (outcome) outcomes.set(record.childSessionId, outcome)
+		else outcomes.delete(record.childSessionId)
+	}
+	return outcomes
+}
+
+/**
+ * What the outcome record had gathered when `checkpointId` was written, or
+ * `undefined` when no progress record names it (a checkpoint written before
+ * the record existed, or by a release that does not write it).
+ */
+export async function readOutcomeProgress(
+	log: SessionLog,
+	checkpointId: CheckpointId,
+): Promise<Readonly<Record<string, unknown>> | undefined> {
+	let found: Readonly<Record<string, unknown>> | undefined
+	for await (const { record } of log.read({ mode: 'tolerant' })) {
+		if (record.type === 'outcome_progress_written' && record.checkpointId === checkpointId) {
+			found = record.progress
+		}
+	}
+	return found
+}

package/src/tools/builtins/bash.ts

@@ -537,7 +537,7 @@ export const SANDBOX_ESCAPE_NOT_APPROVED =
 	'dangerously_disable_sandbox was not approved for this call, so the command did not run. Leaving the sandbox needs the user to confirm it each time, and this turn either cannot ask or does not allow it. Run the command inside the sandbox, or tell the user what it needs and let them run it.'
 
 const BASH_DESCRIPTION =
-	'Executes a command line using the execution shell disclosed in the system context and returns stdout/stderr output. The working directory persists between calls, but shell state does not. Command timeout is configurable. The `command` parameter is required, so every call carries one. Long file content goes through `write`, not a heredoc, so it cannot hit the output token limit mid-stream.'
+	'Executes a command line using the execution shell disclosed in the system context and returns stdout/stderr output. The working directory persists between calls, but shell state does not. Command timeout is configurable. Read and search with `read`, `grep` and `glob`, not shell loops: a file read through the shell earns no read credit, so its next edit is refused once. Run a check on its own, not piped: its output is already trimmed, and a pipe hides the exit status.'
 
 const BashToolBase = defineTool({
 	name: 'bash',

package/src/tools/builtins/edit-apply.ts

@@ -40,7 +40,7 @@ export type NormalizedEditInput =
 export function normalizeEditInput(
 	input: EditInput,
 ): { success: true; operations: NormalizedEditInput[] } | { success: false; error: string } {
-	if (input.edits !== undefined) {
+	if (input.edits !== undefined && input.edits.length > 0) {
 		return {
 			success: true,
 			operations: input.edits.map((edit) => ({
@@ -197,11 +197,15 @@ function applyOne(
 	if (!content.includes(oldString)) {
 		const resolved = resolveOldString(content, oldString)
 		if (resolved === null) {
+			const near = nearLine(content, oldString)
 			return {
 				success: false,
 				reason: 'text_not_found',
-				error:
-					'old_string/oldStr not found in file. Make sure the string matches exactly, including whitespace and indentation.',
+				error: `old_string/oldStr not found in file. Make sure the string matches exactly, including whitespace and indentation. ${
+					near === undefined
+						? 'Read the lines you mean to change again and copy them as they are.'
+						: `A line that matches its first line apart from spacing is at line ${near}; read around it again and copy it as it is.`
+				}`,
 			}
 		}
 		newString = reconcileNewString(oldString, resolved, newString)
@@ -235,7 +239,7 @@ function applyOne(
 		return {
 			success: false,
 			reason: 'not_unique',
-			error: `old_string/oldStr is not unique — found at lines ${lineNumber} and ${secondLine}. Provide more surrounding context to make it unique, or use replace_all: true.`,
+			error: `old_string/oldStr is not unique — found at lines ${lineNumber} and ${secondLine}. Provide more surrounding context to make it unique, or use replace_all: true. Read around those lines again to choose context that is only in one of them.`,
 		}
 	}
 
@@ -247,6 +251,24 @@ function applyOne(
 	}
 }
 
+const NEAR_LINE_MIN_CHARS = 8
+
+/** The line of `content` that matches the first non-blank line of `needle` apart from spacing, 1-based. */
+function nearLine(content: string, needle: string): number | undefined {
+	const squash = (text: string) => text.replace(/\s+/g, ' ').trim()
+	const first = needle
+		.split('\n')
+		.map(squash)
+		.find((line) => line !== '')
+	// A bare brace or paren is on many lines; naming the first one would point at the wrong place.
+	if (first === undefined || first.length < NEAR_LINE_MIN_CHARS) return undefined
+	const lines = content.split('\n')
+	for (let i = 0; i < lines.length; i++) {
+		if (squash(lines[i] ?? '') === first) return i + 1
+	}
+	return undefined
+}
+
 function applyLineInsert(
 	content: string,
 	input: Extract<NormalizedEditInput, { operation: 'insert' }>,