@namzu/sdk 62.6.1 → 62.8.0

package/dist/runtime/query/executor.js

@@ -27,6 +27,7 @@ import { compressShellOutput } from '../../utils/shell-compress.js';
 import { parseStructuredResultJson } from '../../utils/structured-result-json.js';
 import { ensureScratchpadDirectory } from '../../utils/temp.js';
 import { bindOwner } from '../jobs/registry.js';
+import { analyzeLaunches, changedSinceRead, readLaunchedScripts, } from './auto-review/script-evidence.js';
 import { stillRunningResult } from './detached-calls.js';
 import { formatFailedToolOutput, hookNote, isUnregistered, prepareDirectCall, runPreToolHook, unknownToolMessage, } from './executor/tool-call-admission.js';
 import { describeVisibleFileEvidence, visibleFileEvidence, } from './file-evidence-context.js';
@@ -213,15 +214,37 @@ export const DECLINED_NOTE_MAX_CHARS = 4_000;
  * for administrator rights is named as that; everything else is a plain block.
  * Read from the call's own argument, never from the refusal's wording.
  */
-function refusalFacts(toolName, input) {
+function refusalFacts(toolName, input, reason) {
     const command = input && typeof input === 'object' ? input.command : undefined;
     const elevated = typeof command === 'string' && /(^|[\s;&|(])(sudo|doas)\b/.test(command);
     return {
         kind: 'failure',
         reason: elevated ? 'needs_administrator' : 'blocked',
         subject: toolName,
+        ...(refusalNote(reason) ? { note: refusalNote(reason) } : {}),
     };
 }
+const REFUSAL_NOTE_MAX = 200;
+/**
+ * The refusal's own reason as one line for the person's view: the first
+ * non-empty line, the leading "Blocked:" label dropped, first letter up, bounded. The policy
+ * wrote it; nothing here reads the model's text.
+ */
+function refusalNote(reason) {
+    const line = reason
+        ?.split(/\r?\n/)
+        .map((part) => part.trim())
+        .find(Boolean);
+    if (!line)
+        return undefined;
+    const plain = line.replace(/^Blocked(?: by [^:]{1,60})?:\s*/i, '').trim();
+    if (!plain)
+        return undefined;
+    const sentence = `${plain.charAt(0).toUpperCase()}${plain.slice(1)}`;
+    return sentence.length > REFUSAL_NOTE_MAX
+        ? `${sentence.slice(0, REFUSAL_NOTE_MAX - 1)}…`
+        : sentence;
+}
 export function deniedToolOutput(toolName, reason) {
     return `Error: Tool "${toolName}" was not executed. ${reason}`;
 }
@@ -252,6 +275,9 @@ export class ToolExecutor {
     toolCallBudget;
     preparedBatches = new WeakSet();
     preparedBashDirectories = new WeakMap();
+    /** Script files a classifier read for a call, by call id, to be checked again when it runs. */
+    reviewedScripts = new Map();
+    startedAt = Date.now();
     /** Ephemeral proof of actual execution; restored messages do not acquire it. */
     recordedObservations = new Map();
     /** Set per turn by the orchestrator; see {@link setStepAllowedTools}. */
@@ -463,6 +489,44 @@ export class ToolExecutor {
     fileEvidenceEntries(messages) {
         return visibleFileEvidence(messages, this.fileReadTracker, this.config.workingDirectory, this.sandboxed);
     }
+    /**
+     * The script files a shell line launches that the agent wrote or that
+     * appeared during the session, read now for the auto-mode classifier.
+     * Remembers what was read for `callId`, so the file can be checked again
+     * just before the call runs.
+     */
+    async launchedScripts(callId, line, dialect) {
+        if (this.sandboxed) {
+            // A sandbox's files are not on this host's disk. Say so rather than
+            // letting a launch inside one look like a launch of nothing.
+            const analysis = analyzeLaunches(line, dialect);
+            const named = analysis.launches.map((l) => l.path);
+            return named.length === 0 && analysis.unresolved.length === 0
+                ? []
+                : [
+                    {
+                        path: named[0] ?? '(launch form not resolved)',
+                        origin: 'unknown',
+                        state: 'unreadable',
+                        note: 'the command runs in a sandbox whose files are not read for this review, so what the script does is not known',
+                    },
+                ];
+        }
+        const evidence = await readLaunchedScripts(line, dialect, {
+            cwd: effectiveBashWorkingDirectory(this.config.sessionId, this.config.workingDirectory, {
+                sandboxed: false,
+            }),
+            startedAt: this.fileReadTracker.startedAt ?? this.startedAt,
+            ...(this.fileReadTracker.authoredFingerprint
+                ? { authoredFingerprint: (key) => this.fileReadTracker.authoredFingerprint?.(key) }
+                : {}),
+        });
+        if (evidence.watch.length > 0)
+            this.reviewedScripts.set(callId, evidence.watch);
+        else
+            this.reviewedScripts.delete(callId);
+        return evidence.scripts;
+    }
     /** The whole of the evidence as one text, from the same ledger. No filesystem I/O. */
     describeFileEvidence(messages) {
         return describeVisibleFileEvidence(messages, this.fileReadTracker, this.config.workingDirectory, this.sandboxed);
@@ -655,12 +719,13 @@ export class ToolExecutor {
         const earlierPaths = [];
         for (const toolCall of response.message.toolCalls ?? []) {
             const prepared = await prepareDirectCall(this.admissionHost(), toolCall, !hostModifiedCallIds?.has(toolCall.id));
-            const call = await this.refusedBeforeReview(prepared, earlierPaths);
+            const beforeReview = await this.refusedBeforeReview(prepared, earlierPaths);
             const path = inputPathOf(prepared);
             if (path !== undefined)
                 earlierPaths.push(path);
+            this.admitScratchpad(beforeReview);
+            const call = await this.refusedOutsideRoot(beforeReview);
             calls.set(toolCall.id, call);
-            this.admitScratchpad(call);
             const escalation = await this.escalationOrUnfinished(call);
             if (escalation)
                 escalations.set(toolCall.id, escalation);
@@ -670,6 +735,52 @@ export class ToolExecutor {
         this.config.abortSignal.throwIfAborted();
         return this.publishPreparedBatch(calls, escalations, scratchpadWrites);
     }
+    /**
+     * A file tool's path outside the roots, refused with the host's own words
+     * (`QueryParams.outsideRootRefusal`) instead of the tool's generic one.
+     *
+     * It takes the place of the call like any refusal found while preparing it,
+     * so it holds in every permission mode and reaches no reviewer. Only a turn
+     * that refuses (`outsideRootAccess: 'refuse'`) and has no sandbox is looked
+     * at, and only a tool that declares `pathArgument`. The exemptions are the
+     * review's: the scratch folder is a root, and so is this session's retained
+     * output for `read`.
+     */
+    async refusedOutsideRoot(call) {
+        const note = this.config.outsideRootRefusal;
+        if (call.kind !== 'ready' || note === undefined)
+            return call;
+        if (this.config.outsideRootAccess !== 'refuse' || this.sandboxed)
+            return call;
+        const tool = this.config.tools.get(call.toolName);
+        if (tool?.pathArgument === undefined)
+            return call;
+        if (call.input === null || typeof call.input !== 'object')
+            return call;
+        const value = call.input[tool.pathArgument];
+        if (typeof value !== 'string')
+            return call;
+        try {
+            const retained = tool.name === 'read' && (await resolveRetainedOutput(this.outputDirectory(), value));
+            if (retained)
+                return call;
+            const outside = await pathOutsideRoots(this.rootsNow(), value);
+            if (outside === undefined)
+                return call;
+            return {
+                kind: 'synthetic',
+                toolCall: call.toolCall,
+                toolName: call.toolName,
+                input: call.input,
+                message: formatFailedToolOutput(undefined, `${outside} is outside the working directory. ${note}`),
+                isError: true,
+            };
+        }
+        catch {
+            this.config.abortSignal.throwIfAborted();
+            return call;
+        }
+    }
     /**
      * A ready call the tool already knows cannot run, answered now instead of
      * after a reviewer has been asked about it (`ToolDefinition.refuseBeforeReview`).
@@ -879,9 +990,10 @@ export class ToolExecutor {
         const earlierPaths = [];
         for (const toolCall of response.message.toolCalls ?? []) {
             if (changedCallIds.has(toolCall.id)) {
-                const call = await this.refusedBeforeReview(await prepareDirectCall(this.admissionHost(), toolCall, false), earlierPaths);
+                const beforeReview = await this.refusedBeforeReview(await prepareDirectCall(this.admissionHost(), toolCall, false), earlierPaths);
+                this.admitScratchpad(beforeReview);
+                const call = await this.refusedOutsideRoot(beforeReview);
                 calls.set(toolCall.id, call);
-                this.admitScratchpad(call);
                 const escalation = await this.escalationOrUnfinished(call);
                 if (escalation)
                     escalations.set(toolCall.id, escalation);
@@ -1123,7 +1235,18 @@ export class ToolExecutor {
                     let outcome;
                     started.add(toolCall.id);
                     try {
-                        outcome = await this.executeSingle(toolCall, ctx, recordObservation, () => progress.close(), preparedCall);
+                        const reviewedScripts = this.reviewedScripts.get(toolCall.id);
+                        this.reviewedScripts.delete(toolCall.id);
+                        const moved = reviewedScripts === undefined ? undefined : await changedSinceRead(reviewedScripts);
+                        outcome =
+                            moved !== undefined
+                                ? {
+                                    toolCallId: toolCall.id,
+                                    toolName: toolCall.function.name,
+                                    output: `Error: ${moved} changed after the safety check read it, so the command was not run. Run it again and it will be checked against the new text.`,
+                                    isError: true,
+                                }
+                                : await this.executeSingle(toolCall, ctx, recordObservation, () => progress.close(), preparedCall);
                     }
                     catch (error) {
                         // A call already answered with the placeholder has no batch
@@ -1312,6 +1435,7 @@ export class ToolExecutor {
                         failure ??= { error };
                     }
                     finally {
+                        this.reviewedScripts.delete(unit.toolCall.id);
                         settledUnit();
                         inFlight.delete(unit);
                         pump();
@@ -1611,7 +1735,7 @@ export class ToolExecutor {
             toolName: name,
             toolUseId: nestedId,
             output: rawOutput,
-            maxChars: this.config.maxToolOutputChars ?? DEFAULT_MAX_TOOL_OUTPUT_CHARS,
+            maxChars: this.toolOutputCap(this.config.tools.get(name), false),
             retainedPreviewChars: this.config.retainedToolPreviewChars,
             spillDir: this.outputDirectory(),
             recoveryRoutes: this.recoveryRoutes(),
@@ -2040,10 +2164,7 @@ export class ToolExecutor {
                 ];
             }
         }
-        // A tool that bounds its own output is exempt from the DEFAULT per-result
-        // cap only; a host that set the cap explicitly still gets it.
-        const maxToolOutputChars = this.config.maxToolOutputChars ??
-            (executedDefinition?.selfLimitingOutput === true ? 0 : DEFAULT_MAX_TOOL_OUTPUT_CHARS);
+        const maxToolOutputChars = this.toolOutputCap(executedDefinition, true);
         const sourceOutput = output;
         // This owner-bound channel follows the selected receipt after both result
         // screening and post-tool replacement. ToolResult.data and raw input can
@@ -2246,6 +2367,7 @@ export class ToolExecutor {
                 ? { handoff: result.handoff }
                 : {}),
             ...(revealedTools !== undefined ? { revealedTools } : {}),
+            ...(result.facts !== undefined && !postOverride ? { facts: result.facts } : {}),
         };
     }
     /**
@@ -2683,6 +2805,8 @@ export class ToolExecutor {
      * `executing`, and records a failed activity for the trace.
      */
     async recordDenial(toolCall, reason, preparedCall, declined) {
+        // A call that does not run has no use for what a review read of its scripts.
+        this.reviewedScripts.delete(toolCall.id);
         const toolName = preparedCall?.toolName ?? toolCall.function.name;
         let input = preparedCall?.input ?? {};
         if (!preparedCall) {
@@ -2729,7 +2853,7 @@ export class ToolExecutor {
             ...(declined ? { presentation: this.declinedPresentation(toolName, input, declined) } : {}),
             // A refusal by policy says what kind it was; the person's own No is
             // already carried by the presentation above.
-            ...(declined ? {} : { facts: refusalFacts(toolName, input) }),
+            ...(declined ? {} : { facts: refusalFacts(toolName, input, reason) }),
             isError: true,
         });
         return { toolCallId: toolCall.id, toolName, output, isError: true };
@@ -2816,6 +2940,7 @@ export class ToolExecutor {
             toolName,
             output: outcome.output,
             isError: outcome.kind === 'error',
+            ...(outcome.facts ? { facts: outcome.facts } : {}),
             ...(outcome.inputFailure ? { inputFailure: outcome.inputFailure } : {}),
             ...(outcome.skipped ? { skipped: true } : {}),
         };
@@ -2829,6 +2954,22 @@ export class ToolExecutor {
             ...(call.skipped ? { skipped: true } : {}),
         });
     }
+    /**
+     * The per-result character cap for one tool: the turn's cap, tightened by
+     * the tool's own `maxOutputChars`. A tool that bounds its own output is
+     * exempt from the DEFAULT cap only (`exemptSelfLimiting`); a host that set
+     * the cap explicitly still gets it. 0 means no cap.
+     */
+    toolOutputCap(definition, exemptSelfLimiting) {
+        const turn = this.config.maxToolOutputChars ??
+            (exemptSelfLimiting && definition?.selfLimitingOutput === true
+                ? 0
+                : DEFAULT_MAX_TOOL_OUTPUT_CHARS);
+        const own = definition?.maxOutputChars;
+        if (own === undefined || !Number.isFinite(own) || own <= 0)
+            return turn;
+        return turn > 0 ? Math.min(turn, Math.floor(own)) : Math.floor(own);
+    }
     /**
      * The host preview and model text may differ; each gets its own text
      * budget. Rich bytes are measured separately and withheld whole when
@@ -2858,7 +2999,7 @@ export class ToolExecutor {
                 toolName,
                 toolUseId,
                 output: text,
-                maxChars: this.config.maxToolOutputChars ?? DEFAULT_MAX_TOOL_OUTPUT_CHARS,
+                maxChars: this.toolOutputCap(this.config.tools.get(toolName), false),
                 ...(notice ? { notice } : {}),
                 // A tool may return different host and model text. They must
                 // never compete for the same exclusive spill filename.