@robota-sdk/agent-tools 3.0.0-beta.81 → 3.0.0-beta.83

package/CHANGELOG.md

@@ -0,0 +1,559 @@
+# @robota-sdk/agent-tools
+
+## 3.0.0-beta.83
+
+### Minor Changes
+
+- 0368058: A running child-process subagent follows a `/sandbox` change made in its parent session. Before, it
+  kept the settings it started with until it ended, so a long-running `auto`-mode subagent went on
+  auto-approving confined commands after the user turned auto-allow off.
+
+  - `agent-tools` (minor): `OsSandboxClient.watchSettings(watcher)` reports each `configure`, until
+    its returned function is called.
+  - `agent-subagent-runner` (minor): the runner factory takes `watchParentSandboxSettings`, and
+    forwards each change to every running child as a `sandbox_settings` message. It watches before
+    reading the start payload, so no change is lost while a child starts, and stops when the child
+    exits or fails to start. A composed sandbox may define `applyParentSettings`. The worker applies
+    each change through it. On settings it cannot take, it aborts the run, lets a running command
+    finish, and ends the run with that error.
+  - `agent-cli` (patch): robota watches its live sandbox, and a child applies each change to the
+    instance its tools and approval read.
+
+### Patch Changes
+
+- 57280bf: Every published package now declares `"engines": { "node": ">=22.12.0" }`. Before, 27 of the 38
+  packages declared no floor (`agent-core`, `agent-tools` and every provider among them),
+  `agent-session` and `agent-file-authority` declared `>=20.19.0`, and the other nine declared
+  `>=22.0.0`, so a consumer on Node 20 saw at most a warning from a transitive dependency.
+
+  Why 22.12: `agent-cli` and `agent-ui-terminal` need Node 22 through `ink` 7, and the CommonJS entries
+  of `agent-tools` and its dependents, `agent-transport`/`node` and its dependents, and
+  `agent-ui-terminal` `require()` ESM-only dependencies (`p-limit`, `jose`, `chalk`), which Node 22
+  supports unflagged only from 22.12. `engines` is advisory unless the consumer enables `engine-strict`.
+
+  No code changes: `tsdown` now reads `node22.12.0` as its build target from the field.
+
+- 18c0d5c: Every published package now exports `./package.json`, so `require('<package>/package.json')` and
+  `import('<package>/package.json', { with: { type: 'json' } })` work instead of failing with
+  `ERR_PACKAGE_PATH_NOT_EXPORTED`, and each tarball now ships the package's `CHANGELOG.md`.
+- Updated dependencies [e689c8e]
+- Updated dependencies [be0e53c]
+- Updated dependencies [8bd5fac]
+- Updated dependencies [57280bf]
+- Updated dependencies [5033dd9]
+- Updated dependencies [18c0d5c]
+- Updated dependencies [dbd888d]
+- Updated dependencies [1887e54]
+  - @robota-sdk/agent-core@3.0.0-beta.83
+  - @robota-sdk/agent-process@3.0.0-beta.83
+
+## 3.0.0-beta.82
+
+### Patch Changes
+
+- Updated dependencies [c7f9203]
+  - @robota-sdk/agent-core@3.0.0-beta.82
+  - @robota-sdk/agent-process@3.0.0-beta.82
+
+## 3.0.0-beta.81
+
+### Minor Changes
+
+- 3038eb7: A message from another session is instant messaging: text from an untrusted third party that
+  carries no authority. What the model does with it is decided by the session's ordinary permissions —
+  rules, permission mode and remembered consent — exactly like the session's own work. The per-origin
+  peer policy is gone.
+
+  **BREAKING**
+
+  - `agent-core`: `IPermissionEvaluationContext.peerTurn` is now a boolean. It decides only whether a
+    `repliesToPeer` tool exists; every other call in a peer turn is decided as in any turn. Removed:
+    `isToolAvailableInPeerTurn`, `isSecretPath`, `IPeerTurnAuthority`, `TPeerReach` (now exported by
+    `agent-interface-session-mobility`) and `IToolPermissionProfile.workspacePaths`.
+  - `agent-tools`: `Read` and `Glob` no longer declare `workspacePaths`.
+  - `agent-session`: `ISessionRunOptions.peerReach` is replaced by `peerTurn?: boolean`, and
+    `ISessionOptions.allowPeerChanges` is removed. An ask in a peer turn is answered like any other:
+    a consent the operator remembered answers it, and an "always allow" given there is remembered.
+  - `agent-interface-session`: `IPeerTurnContext` no longer has `reach`; it carries only the reply
+    route.
+  - `agent-interface-session-mobility`: `peerReachOf` is removed; `TPeerReach` moves here. A delegated
+    turn carries no reach.
+  - `agent-framework`: the `peers.allowChanges` setting is removed (an existing value is ignored). A
+    peer turn is offered the ordinary tools, plus `peer_reply`.
+
+  **Changes**
+
+  - `agent-framework`: the per-turn statement tells the model the message is an opinion from an
+    untrusted third party, not its owner's instruction, and that it decides for itself whether and how
+    to act. A message still expands no `@path` and attaches no context reference, and its requests
+    still carry no provider-hosted tool, since no permission step can decide one. The session takes
+    at most 6 messages a minute and 30 an hour from each sender for a turn; a message over the limit
+    is refused with a reason the sender receives. A prompt answer given in the name of a `peer:` or `external:`
+    driver is ignored. External-event turns keep their tool-less baseline.
+  - `agent-cli`: incoming peer turns carry only their reply route.
+
+### Patch Changes
+
+- Updated dependencies [3038eb7]
+- Updated dependencies [02b7452]
+- Updated dependencies [ec5e477]
+  - @robota-sdk/agent-core@3.0.0-beta.81
+  - @robota-sdk/agent-process@3.0.0-beta.81
+
+## 3.0.0-beta.80
+
+### Major Changes
+
+- 807d161: **BREAKING — ARCH-010: the execution root is a required contract field, and the containment guard now fails closed.**
+
+  The file-tool containment guard was fail-open: with no root configured it answered "allowed". A tool
+  built with no `cwd` therefore had no boundary — measured, a `Read` constructed that way returned the
+  contents of `/etc/hostname` — and the child-process subagent worker called `createDefaultTools()` with
+  no argument at all, so subagents got exactly that. Three independent auditors found three different
+  symptoms of this one missing field.
+
+  **Removed — seven context-free tool singletons.** `readTool`, `writeTool`, `editTool`, `globTool`,
+  `grepTool`, `shellTool`, `bashTool` are gone from `@robota-sdk/agent-tools`. A module-level instance is
+  bound at import time and can carry no containment root, so after the guard was inverted they could only
+  refuse everything.
+
+  Migrate to the factory of the same name, passing the directory the tool is allowed to work in:
+
+  ```ts
+  // before
+  import { readTool, globTool } from '@robota-sdk/agent-tools';
+  const tools = [readTool, globTool];
+
+  // after
+  import { createReadTool, createGlobTool } from '@robota-sdk/agent-tools';
+  const cwd = process.cwd(); // or the workspace this agent is scoped to
+  const tools = [createReadTool({ cwd }), createGlobTool({ cwd })];
+  ```
+
+  `webFetchTool`, `webSearchTool` and `askUserQuestionTool` are unchanged — they touch no filesystem, so
+  there is no root to contain them by.
+
+  **`cwd` is now REQUIRED** on `ISandboxToolOptions`, `IContainedBuiltinToolOptions` (and everything
+  extending them), `ICreateDefaultToolsOptions`, `ISessionOptions` and `ISubagentOptions`. The `= {}`
+  default parameter was removed from every builtin factory — that default was the mechanism by which
+  "forgot the root" was legal. `new Session({...})` without `cwd` no longer compiles, and also throws at
+  construction, because a required field is only required to a TypeScript caller.
+
+  **`Session` no longer reads `process.cwd()`.** It uses the root it was given, and `getCwd()` exposes it
+  so a fork or subagent asks the session instead of re-deriving a root that can disagree with it.
+
+  **Behavioural change even for callers that already passed a root**: a tool that somehow reaches the
+  guard with no root now REFUSES with an explicit error ("no containment root is configured … this is an
+  assembly bug, not a path problem") instead of allowing the access.
+
+### Minor Changes
+
+- 267af5f: The execution containment seam states where tools run.
+
+  - **`ISandboxClient.filesystem`** (`'shared' | 'separate'`, absent means `separate`).
+    - With a **separate** filesystem (E2B, in-memory), every file tool goes through the sandbox, and
+      `Glob`/`Grep`, which can only read the host, are withheld. Previously a remote sandbox still
+      offered host-reading search tools beside sandbox-writing edit tools.
+    - With a **shared** filesystem (OS-level confinement over the host's files), file tools stay on
+      the host under the path guard, and only commands go through the sandbox.
+  - **`describeExecutionContainment` / `routesFilesThroughSandbox`** name the containment (`host`,
+    `sandbox-shared`, `sandbox-separate`) instead of inferring it from an absent value.
+  - **`robota doctor` reports `execution.containment`.** Robota composes no sandbox today, so the
+    doctor says shell commands run unconfined on the host and the permission rules are the only
+    boundary. The CLI composition and the doctor read the same value.
+  - **The `Agent` and `BackgroundProcess` tools no longer fall back to `process.cwd()`** when they
+    were built without an execution root. They report an assembly error instead, as the file tools
+    already did (ARCH-010).
+
+- 722e88a: Shell commands can run in an OS-level sandbox: bubblewrap on Linux and WSL2, Seatbelt on macOS.
+
+  - **Confinement:** covers the command and every process it starts.
+    - Writes are limited to the working directory, the temporary directories and
+      `sandbox.filesystem.allowWrite`.
+    - Agent, git-hook, MCP and shell configuration inside the workspace stays read-only.
+    - `sandbox.filesystem.denyRead` hides paths from the command.
+    - The network is on or off (`sandbox.network.enabled`).
+  - **Modes:** `/sandbox` switches between `auto-allow`, `regular` and `off` for the next command and
+    saves the choice.
+    - In `auto-allow` (`sandbox.autoAllowBashIfSandboxed`), a confined command runs without a prompt
+      in `default` and `acceptEdits`.
+    - Deny rules, ask rules, critical removals and plan mode still apply first.
+  - **Exclusions:** `sandbox.excludedCommands` run unconfined, through the ordinary permission path.
+  - **When the sandbox cannot run:** a missing or unusable backend is reported at startup, in
+    `robota doctor` and in `/sandbox`, and commands then run unconfined.
+    `sandbox.failIfUnavailable` refuses to start instead.
+  - **New contracts:**
+    - `OsSandboxClient`, `detectOsSandbox`, `bubblewrapArguments`, `seatbeltProfile`.
+    - `ISandboxClient.wrapCommand` and `autoApproves`.
+    - `IPermissionEvaluationContext.sandboxAutoApproved`.
+    - The `commandSandbox` session option.
+    - The `sandbox` settings key and the `sandbox` command host adapter.
+
+### Patch Changes
+
+- 2345c0b: `Glob` and `Grep` now bound file collection to a fixed candidate ceiling before materializing more
+  matches, instead of enumerating and `stat`-ing an entire search tree before any `limit`/`headLimit`
+  had a chance to apply. `Glob` streams `fast-glob` matches instead of resolving its full-match
+  promise form, and `Grep`'s directory walk stops once it has visited the ceiling's worth of entries.
+  Both tools state the truncation explicitly in their output when the ceiling is hit — `Glob`'s result
+  ordering (by modification time) then applies only to the candidates collected before the ceiling,
+  not to the full match set.
+- 118fe0e: Bound Edit file input before materializing content, including when file size metadata is stale, and reject a replaceAll whose output would exceed the same ceiling before writing.
+- 240777e: Bound Grep file reads before materializing content, including when file size metadata is stale or a file grows during a search.
+- 718bdf5: Run builtin Grep regex matching in preemptible isolation with bounded input, output, and execution time.
+- 61db70f: Bound host Read input and formatted output bytes before a workflow can materialize an oversized file or result. Oversized reads now fail the tool call instead of returning content.
+- db80aba: CLI-042: parallelize the Grep built-in tool's per-file content scan with bounded
+  concurrency (`p-limit(50)`), following the glob-tool precedent. Results are still
+  collected in file-enumeration order, so output is byte-identical to the previous
+  sequential implementation (verified against a pre-change golden on a 1,201-file
+  corpus); `headLimit` truncation and binary/unreadable-file skipping are unchanged.
+- 4f3c075: Assemble complete, verified package generations before switching build output; preserve the previous generation on build failure and pack only verified regular-file images. Include copied CLI web assets in affected-build ordering and artifact transfer. Preserve the CLI version in managed build paths. Public runtime contracts remain compatible (patch).
+- b6d14ce: Make the universal JSON-schema subset able to express an object, so a nested `z.object()` keeps its
+  properties and required fields instead of reaching the model as `{ "type": "object" }`. Tools and
+  structured-output schemas with one level of nesting are now advertised in full and enforced on the
+  tool-input path; `z.union` / `z.discriminatedUnion` / `z.literal` are supported and map to `anyOf`
+  and single-value enums; `.nullable()` keeps its null branch; and Zod's `strip`, `strict` and
+  `passthrough` modes stop collapsing into two `additionalProperties` emissions. Fixes the shipped
+  `Computer` and `AskUserQuestion` built-ins, whose action and question fields were being dropped
+  entirely.
+
+  `agent-core` is **minor**, not patch: `IObjectParameterSchema` is a new export, and
+  `IParameterSchema.type` became optional (a union node carries `anyOf` instead of a type), which is a
+  consumer-visible type change — two call sites in this repo needed editing to keep compiling.
+  `additionalProperties` also widened to `boolean | IParameterSchema`, and `required` and `anyOf` are
+  new members. The provider packages are **patch**: each adapts to the widened subset without changing
+  its own public surface.
+
+- 07b627f: A local peer can now be answered, and what its turn may do depends on where it runs.
+
+  - `agent-core`: the permission evaluator takes a peer turn's authority as one more input
+    (`IPermissionEvaluationContext.peerTurn`), decided after the deny list and ceiling and before
+    bypass and allow rules. A peer on another host uses no tool. A peer on the same host may use an
+    inspect-class tool that declares `workspacePaths`, only when every named location resolves inside
+    the workspace and is not a credential (`isSecretPath`); write and execute tools are refused unless
+    enabled, and then every use asks. A tool declaring `repliesToPeer` exists only in a peer turn and
+    asks once the turn used another tool. New: `isToolAvailableInPeerTurn`, `TPeerReach`,
+    `IPeerTurnAuthority`. `IRunOptions.withholdHostedTools` leaves a provider's hosted tools out of a
+    run's requests (`nativeWebTools` with `false` withholds a hosted tool for one call).
+  - `agent-tools`: `Read` and `Glob` declare the arguments that say where they look. `Grep` does not:
+    it reads files it was never named, so a peer turn does not get it.
+  - `agent-session`: `ISessionRunOptions.peerReach` makes a run a peer turn for the permission policy;
+    every ask in it needs a fresh approval, and its requests carry no provider-hosted tool. `ISessionOptions.allowPeerChanges` enables write and execute
+    tools for same-host peer turns.
+  - `agent-interface-session`: `ISubmitOptions.peer` (`IPeerTurnContext`) carries a peer turn's reach,
+    the message it answers and the session a reply goes to.
+  - `agent-interface-session-mobility`: `IPeerMessage.inReplyTo` threads a conversation;
+    `peerReachOf(admission)` maps admission to a reach.
+  - `agent-framework`: a peer turn is offered what its origin allows, and a new `peer_reply` tool
+    answers the peer that sent the message, threaded to it. The setting `peers.allowChanges` enables
+    write and execute tools for same-host peer turns.
+  - `agent-ui-terminal`: a permission prompt in a peer turn names the requesting peer.
+  - `agent-cli`: incoming peer turns carry their reach and reply route; a conversation is limited in
+    depth and in how often this session answers it, and a reply over a limit is not sent and the
+    operator is told.
+  - `agent-provider-anthropic`, `agent-provider-openai-compatible` (Qwen): a request whose
+    `nativeWebTools` sets a hosted tool to `false` is sent without it.
+
+- 833afe1: Remove the remaining polynomial-ReDoS backtracking (SEC-003, CodeQL `js/polynomial-redos`) and stop the DTLS fingerprint binding to SDP free text.
+
+  **`extractDtlsFingerprint` (agent-remote-pairing) — remote-reachable, pre-authentication.** Unlike the rest of this class, the SDP it parses arrives over the signaling relay, which the pairing design treats as untrusted, and it is parsed _before_ the channel-binding confirmation — on the browser peer, before `setRemoteDescription` too. Unanchored, `a=fingerprint:\S+\s+…` restarted from every offset in a non-space run: 5.0 s on a 400 KB SDP. It is now anchored to the start of an SDP line (`/^…/m`), which is linear and also stops the extractor from returning a value smuggled into another line's free text (`s=`, `i=`, an unrelated attribute) — text no DTLS stack reads, and which a relay controls. **Behaviour change:** a mid-line `a=fingerprint:` is no longer recognised. Every SDP a WebRTC stack emits puts the attribute at the start of its own line, so no real SDP is affected. A session-level line can still shadow a media-level one; that residual is recorded in the SEC-003 backlog.
+
+  **Trailing-run trims (agent-framework, agent-cli, agent-tools).** `replace(/-+$/, '')`-shaped regexes have no start anchor, so the engine retried the run from every offset inside it and each retry rescanned to the end — 3.0 s at 100 K characters, ~50 s at 400 K. The memory topic sanitiser, the provider profile-name sanitiser, the model-command tool-name projection, the npm registry URL builder, the git-worktree path-segment sanitiser and the sandbox-root normaliser now use linear index scans (`trimEdgeChars` / `trimTrailingChars` in agent-framework, local helpers elsewhere), proven equivalent to the regexes they replace over every string of the relevant alphabet up to 12 characters.
+
+  **Whitespace-ambiguity parsers (agent-framework).** The skill and agent-definition frontmatter list splitters used `/\s*,\s*/`, whose whitespace run overlapped nothing after it on a failed comma — 12.6 s on a 200 K run. They now split on `','`; the padding was already removed by the `.trim()` that follows, so the parsed lists are unchanged. The `.git` `gitdir:` pointer and the task-file open-item matcher used `\s*(.+)$` / `\s+(.+)$`, where `\s` and `.` both match a space; the capture is now pinned to start non-space, which accepts exactly the same inputs (verified exhaustively) and removes 14.5 s and 15.4 s worst cases.
+
+  **`WebFetch` HTML-to-text (agent-tools) — carried no CodeQL alert.** Found by sweeping for the same shapes rather than the flagged lines, and the only quadratic here whose input is a live response body from an arbitrary URL. `<[^>]+>`, `<script[\s\S]*?</script>` and `<style…>` each restarted from every opener that had no terminator: 12.6 s on 200 KB of `<`, and the 5 MB the fetch allows would have taken hours. All three are now single-pass scans, verified character-for-character identical to the regexes over ~800 K generated inputs.
+
+  Apart from the `extractDtlsFingerprint` anchoring noted above, no behaviour changes: every fix accepts the same inputs and produces the same values, and each ships an equivalence test pinning that.
+
+- Updated dependencies [7b6234c]
+- Updated dependencies [4eea54b]
+- Updated dependencies [1698be4]
+- Updated dependencies [d4189b9]
+- Updated dependencies [9edae52]
+- Updated dependencies [4078a72]
+- Updated dependencies [4c73a0b]
+- Updated dependencies [196a900]
+- Updated dependencies [f336838]
+- Updated dependencies [34e50f0]
+- Updated dependencies [722e88a]
+- Updated dependencies [d23c848]
+- Updated dependencies [fec722f]
+- Updated dependencies [2d3b2c0]
+- Updated dependencies [4772067]
+- Updated dependencies [9fbab1b]
+- Updated dependencies [a009f5b]
+- Updated dependencies [4f3c075]
+- Updated dependencies [475e085]
+- Updated dependencies [e477440]
+- Updated dependencies [9dcb5da]
+- Updated dependencies [a95ca85]
+- Updated dependencies [b6d14ce]
+- Updated dependencies [0382a51]
+- Updated dependencies [93d061d]
+- Updated dependencies [39554a1]
+- Updated dependencies [d28430a]
+- Updated dependencies [07b627f]
+- Updated dependencies [d0de5b2]
+- Updated dependencies [d6b9404]
+- Updated dependencies [9814afc]
+  - @robota-sdk/agent-core@3.0.0-beta.80
+  - @robota-sdk/agent-process@3.0.0-beta.80
+
+## 3.0.0-beta.79
+
+### Patch Changes
+
+- @robota-sdk/agent-core@3.0.0-beta.79
+
+## 3.0.0-beta.78
+
+### Patch Changes
+
+- Updated dependencies [6f308d1]
+  - @robota-sdk/agent-core@3.0.0-beta.78
+
+## 3.0.0-beta.77
+
+### Patch Changes
+
+- Updated dependencies
+  - @robota-sdk/agent-core@3.0.0-beta.77
+  - @robota-sdk/agent-process@3.0.0-beta.77
+
+## 3.0.0-beta.76
+
+### Patch Changes
+
+- Updated dependencies
+- Updated dependencies
+- Updated dependencies
+- Updated dependencies [576af62]
+  - @robota-sdk/agent-core@3.0.0-beta.76
+
+## 3.0.0-beta.75
+
+### Patch Changes
+
+- Updated dependencies
+  - @robota-sdk/agent-core@3.0.0-beta.75
+
+## 3.0.0-beta.74
+
+### Patch Changes
+
+- @robota-sdk/agent-core@3.0.0-beta.74
+
+## 3.0.0-beta.73
+
+### Patch Changes
+
+- @robota-sdk/agent-core@3.0.0-beta.73
+
+## 3.0.0-beta.72
+
+### Patch Changes
+
+- @robota-sdk/agent-core@3.0.0-beta.72
+
+## 3.0.0-beta.71
+
+### Patch Changes
+
+- fix(context): unify token estimation to single SSOT — status bar and /context list now use the same serialized JSON estimate
+- Updated dependencies
+  - @robota-sdk/agent-core@3.0.0-beta.71
+
+## 3.0.0-beta.70
+
+### Patch Changes
+
+- @robota-sdk/agent-core@3.0.0-beta.70
+
+## 3.0.0-beta.69
+
+### Patch Changes
+
+- @robota-sdk/agent-core@3.0.0-beta.69
+
+## 3.0.0-beta.68
+
+### Patch Changes
+
+- @robota-sdk/agent-core@3.0.0-beta.68
+
+## 3.0.0-beta.67
+
+### Patch Changes
+
+- @robota-sdk/agent-core@3.0.0-beta.67
+
+## 3.0.0-beta.66
+
+### Patch Changes
+
+- @robota-sdk/agent-core@3.0.0-beta.66
+
+## 3.0.0-beta.65
+
+### Patch Changes
+
+- @robota-sdk/agent-core@3.0.0-beta.65
+
+## 3.0.0-beta.64
+
+### Patch Changes
+
+- @robota-sdk/agent-core@3.0.0-beta.64
+
+## 3.0.0-beta.63
+
+### Patch Changes
+
+- @robota-sdk/agent-core@3.0.0-beta.63
+
+## 3.0.0-beta.62
+
+### Patch Changes
+
+- Updated dependencies
+  - @robota-sdk/agent-core@3.0.0-beta.62
+
+## 3.0.0-beta.61
+
+### Minor Changes
+
+- e243fb0: Add provider-neutral sandbox execution ports, E2B-compatible sandbox adapter, and SDK sandbox injection for Bash and core file tools.
+- 18fcc5b: Add provider-neutral sandbox snapshot hydration for interactive sessions. Snapshot-capable sandbox clients now persist `sandboxSnapshotId` on shutdown and restore it before saved message replay on non-fork resume, while the E2B structural adapter supports both `createSnapshot()`-style checkpoints and pause/resume sandbox references.
+- 3bde012: Add provider-neutral sandbox workspace manifests and wire `InteractiveSession` to apply them before session creation.
+
+### Patch Changes
+
+- d97bdf2: Add provider-owned model catalog metadata, route `/model` suggestions through the active provider, and make `cli:dev` resolve the CLI workspace dependency closure through source export conditions.
+- Updated dependencies [1c0d44c]
+- Updated dependencies [36eb7a9]
+- Updated dependencies [d97bdf2]
+  - @robota-sdk/agent-core@3.0.0-beta.61
+
+## 3.0.0-beta.60
+
+### Patch Changes
+
+- Updated dependencies [7439391]
+  - @robota-sdk/agent-core@3.0.0-beta.60
+
+## 3.0.0-beta.59
+
+### Patch Changes
+
+- 95721ff: Preserve existing target mode bits during atomic Write and Edit file replacements.
+  - @robota-sdk/agent-core@3.0.0-beta.59
+
+## 3.0.0-beta.58
+
+### Patch Changes
+
+- Updated dependencies
+  - @robota-sdk/agent-core@3.0.0-beta.58
+
+## 3.0.0-beta.57
+
+### Patch Changes
+
+- 822a78b: Add self-hosting verification planning and atomic UTF-8 writes for built-in file mutation tools.
+- Updated dependencies [16c3b6f]
+- Updated dependencies [f61e2cb]
+  - @robota-sdk/agent-core@3.0.0-beta.57
+
+## 3.0.0-beta.56
+
+### Patch Changes
+
+- Updated dependencies
+  - @robota-sdk/agent-core@3.0.0-beta.56
+
+## 3.0.0-beta.55
+
+### Patch Changes
+
+- 38a72bf: fix: resolve ESLint tsconfig parsing errors and improve pnpm CI reliability
+  - Add tsconfig.eslint.json to all packages for per-package ESLint runs
+  - Migrate typecheck from pnpm -r exec tsc to per-package typecheck scripts
+  - Add --if-present to all recursive pnpm run scripts
+  - Fix React type imports, dynamic imports in tests, Express.Multer types
+
+- Updated dependencies [38a72bf]
+  - @robota-sdk/agent-core@3.0.0-beta.55
+
+## 3.0.0-beta.54
+
+### Patch Changes
+
+- Updated dependencies
+  - @robota-sdk/agent-core@3.0.0-beta.54
+
+## 3.0.0-beta.53
+
+### Patch Changes
+
+- refactor: monolith decomposition — all agent-\* files under 300 lines
+- Updated dependencies
+- Updated dependencies
+  - @robota-sdk/agent-core@3.0.0-beta.53
+
+## 3.0.0-beta.52
+
+### Patch Changes
+
+- @robota-sdk/agent-core@3.0.0-beta.52
+
+## 3.0.0-beta.51
+
+### Patch Changes
+
+- @robota-sdk/agent-core@3.0.0-beta.51
+
+## 3.0.0-beta.50
+
+### Patch Changes
+
+- fix: reinsert repository/homepage/bugs in correct field order
+  - @robota-sdk/agent-core@3.0.0-beta.50
+
+## 3.0.0-beta.49
+
+### Patch Changes
+
+- fix: add repository, homepage, bugs metadata to all publishable packages
+  - @robota-sdk/agent-core@3.0.0-beta.49
+
+## 3.0.0-beta.48
+
+### Patch Changes
+
+- @robota-sdk/agent-core@3.0.0-beta.48
+
+## 3.0.0-beta.47
+
+### Patch Changes
+
+- @robota-sdk/agent-core@3.0.0-beta.47
+
+## 3.0.0-beta.46
+
+### Patch Changes
+
+- @robota-sdk/agent-core@3.0.0-beta.46
+
+## 3.0.0-beta.45
+
+### Patch Changes
+
+- @robota-sdk/agent-core@3.0.0-beta.45
+
+## 3.0.0-beta.44
+
+### Patch Changes
+
+- Updated dependencies
+  - @robota-sdk/agent-core@3.0.0-beta.44

package/dist/node/index.cjs

@@ -615,6 +615,7 @@ var OsSandboxClient = class {
 	baseline = [];
 	/** Entries a clean-up could not restore, with the state they must return to. */
 	unresolved = /* @__PURE__ */ new Map();
+	watchers = /* @__PURE__ */ new Set();
 	constructor(options) {
 		this.root = realPathOrSelf(options.root);
 		this.availability = options.availability;
@@ -631,12 +632,23 @@ var OsSandboxClient = class {
 			active: this.current.enabled && this.availability.executable !== void 0
 		};
 	}
-	/** Change the settings for the next command. */
+	/** Change the settings for the next command, and tell whoever watches them. */
 	configure(settings) {
 		this.current = {
 			...this.current,
 			...settings
 		};
+		for (const watcher of this.watchers) watcher(this.current);
+	}
+	/**
+	* Be told the settings after each change, for as long as the returned function is not called. A
+	* copy of this sandbox in another process (a subagent's) follows the user's change this way.
+	*/
+	watchSettings(watcher) {
+		this.watchers.add(watcher);
+		return () => {
+			this.watchers.delete(watcher);
+		};
 	}
 	/** Whether `shellCommand` would run confined. */
 	confines(shellCommand) {
@@ -1942,60 +1954,48 @@ async function readFileTool(args, options) {
 	}
 	const pathError = checkPathWithinCwd(filePath, options.cwd);
 	if (pathError !== void 0) return pathError;
-	let fileStats;
+	const failure = (error) => JSON.stringify({
+		success: false,
+		output: "",
+		error
+	});
+	let handle;
 	try {
-		fileStats = await (0, node_fs_promises.stat)(filePath);
+		handle = await (0, node_fs_promises.open)(filePath, node_fs.constants.O_RDONLY | node_fs.constants.O_NONBLOCK, 384);
 	} catch (err) {
-		const result = {
-			success: false,
-			output: "",
-			error: `File not found: ${filePath}`
-		};
-		return JSON.stringify(result);
-	}
-	if (!fileStats.isFile()) {
-		const result = {
-			success: false,
-			output: "",
-			error: `Path is not a file: ${filePath}`
-		};
-		return JSON.stringify(result);
+		const found = await (0, node_fs_promises.stat)(filePath).catch(() => void 0);
+		if (found === void 0) return failure(`File not found: ${filePath}`);
+		if (!found.isFile()) return failure(`Path is not a file: ${filePath}`);
+		return failure(err instanceof Error ? err.message : String(err));
 	}
 	let buffer = Buffer.alloc(0);
 	let binaryFile = false;
 	try {
-		const handle = await (0, node_fs_promises.open)(filePath, "r");
-		try {
-			const chunks = [];
-			const chunk = Buffer.allocUnsafe(READ_CHUNK_BYTES$2);
-			let bytes = 0;
-			let binaryCheckedBytes = 0;
-			while (bytes <= MAX_READ_BYTES) {
-				if (options.signal?.aborted) throw new ReadCancelledError();
-				const { bytesRead } = await handle.read(chunk, 0, Math.min(chunk.length, 4194305 - bytes), null);
-				if (bytesRead === 0) break;
-				const binaryCheckLength = Math.min(bytesRead, 8192 - binaryCheckedBytes);
-				if (binaryCheckLength > 0 && isBinary(chunk.subarray(0, binaryCheckLength))) {
-					binaryFile = true;
-					break;
-				}
-				binaryCheckedBytes += binaryCheckLength;
-				bytes += bytesRead;
-				if (bytes > MAX_READ_BYTES) throw new ReadByteLimitError("input");
-				chunks.push(Buffer.from(chunk.subarray(0, bytesRead)));
+		if (!(await handle.stat()).isFile()) return failure(`Path is not a file: ${filePath}`);
+		const chunks = [];
+		const chunk = Buffer.allocUnsafe(READ_CHUNK_BYTES$2);
+		let bytes = 0;
+		let binaryCheckedBytes = 0;
+		while (bytes <= MAX_READ_BYTES) {
+			if (options.signal?.aborted) throw new ReadCancelledError();
+			const { bytesRead } = await handle.read(chunk, 0, Math.min(chunk.length, 4194305 - bytes), null);
+			if (bytesRead === 0) break;
+			const binaryCheckLength = Math.min(bytesRead, 8192 - binaryCheckedBytes);
+			if (binaryCheckLength > 0 && isBinary(chunk.subarray(0, binaryCheckLength))) {
+				binaryFile = true;
+				break;
 			}
-			if (!binaryFile) buffer = Buffer.concat(chunks, bytes);
-		} finally {
-			await handle.close();
+			binaryCheckedBytes += binaryCheckLength;
+			bytes += bytesRead;
+			if (bytes > MAX_READ_BYTES) throw new ReadByteLimitError("input");
+			chunks.push(Buffer.from(chunk.subarray(0, bytesRead)));
 		}
+		if (!binaryFile) buffer = Buffer.concat(chunks, bytes);
 	} catch (err) {
 		if (err instanceof ReadByteLimitError || err instanceof ReadCancelledError) throw err;
-		const result = {
-			success: false,
-			output: "",
-			error: err instanceof Error ? err.message : String(err)
-		};
-		return JSON.stringify(result);
+		return failure(err instanceof Error ? err.message : String(err));
+	} finally {
+		await handle.close();
 	}
 	if (options.signal?.aborted) throw new ReadCancelledError();
 	if (binaryFile) {