@qoniai/qoni 0.4.2 → 0.4.3

package/CHANGELOG.md

@@ -6,6 +6,16 @@ This project follows semantic versioning. Before `1.0.0`, minor versions may
 include SDK API changes, while patch versions are reserved for backward
 compatible fixes.
 
+## 0.4.3 - 2026-09-09
+
+### Fixed
+
+- Treat malformed or empty screenshot data URIs as undecodable instead of
+  emitting invalid screenshot bytes or interrupting `wait()`. Preserve the
+  existing progress/raw fallback with screenshot capture enabled or disabled.
+- Keep valid padded, unpadded, whitespace-containing and URL-safe base64
+  screenshots compatible.
+
 ## 0.4.2 - 2026-09-09
 
 ### Fixed

package/README.md

@@ -161,6 +161,8 @@ console.log(result.output);
 
 `run()` returns a `RunHandle` typed to the product: `qoni.deepResearch.run()` is a `RunHandle<DeepResearchEvent>`, so its events are narrowed to what Deep Research actually emits. `capture: { screenshots: true }` opts into per-step screenshots, decoded to bytes for you. `wait()` drives the run to its terminal state and settles the result (`result.raw` carries cost, step counts, token usage).
 
+Undecodable or empty screenshot data URIs never interrupt `wait()` or invoke `onScreenshot`, regardless of capture settings. They follow the existing progress fallback when a human-readable message is available; `onWireEvent` always retains the original payload, including frames with no progress text.
+
 > **Best practice — match `event.type` against the `QoniEventTypes` constants.**
 > Each product handle is typed to its own event set, so in TypeScript a case
 > for another product's event is a compile error and autocomplete shows only

package/README.zh-CN.md

@@ -154,6 +154,8 @@ console.log(result.output);
 
 `run()` 返回一个 `RunHandle`。核心事件（状态、动作、交互、完成）始终默认推送；`capture: { screenshots: true }` 开启逐步截图，并且 SDK 已经把图片解码成字节。`wait()` 把任务跑到终态，并从权威 run envelope 结算结果（成本、步数、token 用量都在 `result.raw` 上）。
 
+无论是否开启 capture，不可解码或空的截图 data URI 都不会中断 `wait()`，也不会触发 `onScreenshot`。有可读消息时按既有契约降级为 progress；`onWireEvent` 始终保留原始 payload，包括没有 progress 文本的帧。
+
 需要逐步控制时，直接消费事件流，`switch (event.type)` 用 `QoniEventTypes` 常量匹配。每个产品的 handle 按产品分型（`qoni.deepResearch.run()` 出来是 `RunHandle<DeepResearchEvent>`），TS 里写错产品的事件会编译报错、补全只列本产品的。内部细节（supervisor 编排、子 agent 点击/输入、telemetry）统一折叠成 `QoniEventTypes.Progress`；匹配到 `case` 后 `event.data` 就是该类型的固定形状。原始 wire 类型不导出。
 
 ```ts

package/dist/index.cjs

@@ -397,8 +397,14 @@ function decodeDataUri(uri) {
   const match = /^data:([^;,]*)?(;base64)?,(.*)$/s.exec(uri);
   if (!match) return void 0;
   const [, mime, isBase64, body] = match;
-  const bytes = isBase64 ? new Uint8Array(Buffer.from(body, "base64")) : new TextEncoder().encode(decodeURIComponent(body));
-  return { bytes, mime: mime || "application/octet-stream" };
+  const encoded = isBase64 ? body.replace(/\s/g, "") : body;
+  if (isBase64 && (!/^[A-Za-z0-9+/_-]+={0,2}$/.test(encoded) || encoded.length % 4 === 1 || encoded.includes("=") && encoded.length % 4 !== 0)) return void 0;
+  try {
+    const bytes = isBase64 ? new Uint8Array(Buffer.from(encoded, "base64")) : new TextEncoder().encode(decodeURIComponent(encoded));
+    return bytes.length ? { bytes, mime: mime || "application/octet-stream" } : void 0;
+  } catch {
+    return void 0;
+  }
 }
 function asString(value) {
   return typeof value === "string" && value ? value : void 0;