@sayknow-cli/coding-agent 0.3.15 → 0.4.0

package/src/tools/output-meta.ts

@@ -15,6 +15,7 @@ import type { ImageContent, TextContent } from "@sayknow-cli/ai";
 import { getDefault, type Settings } from "../config/settings";
 import { formatGroupedDiagnosticMessages } from "../lsp/utils";
 import type { Theme } from "../modes/theme/theme";
+import { sessionArtifactCapability } from "../session/session-manager";
 import { type OutputSummary, type TruncationResult, truncateMiddle, truncateTail } from "../session/streaming-output";
 import { formatBytes, wrapBrackets } from "./render-utils";
 import { renderError } from "./tool-errors";
@@ -103,6 +104,7 @@ export interface TruncationTextOptions {
 	totalLines?: number;
 	totalBytes?: number;
 	maxBytes?: number;
+	artifactId?: string;
 }
 
 /**
@@ -288,6 +290,7 @@ export class OutputMetaBuilder {
 			outputLines,
 			outputBytes,
 			maxBytes: options.maxBytes,
+			artifactId: options.artifactId,
 			shownRange: { start: shownStart, end: shownEnd },
 			nextOffset: options.direction === "head" ? shownEnd + 1 : undefined,
 		};
@@ -593,13 +596,21 @@ export function resolveOutputMaxColumns(s: Settings | undefined): number {
  * is 0, falls back to tail-only truncation. Skips when the tool already
  * saved its own artifact (e.g. bash/python via OutputSink).
  */
+function artifactCapabilityForContext(context: AgentToolContext | undefined) {
+	return sessionArtifactCapability(context?.sessionManager);
+}
+
 async function spillLargeResultToArtifact(
 	result: AgentToolResult,
 	toolName: string,
 	context: AgentToolContext | undefined,
 ): Promise<AgentToolResult> {
-	const sessionManager = context?.sessionManager;
-	if (!sessionManager) return result;
+	if (toolName === "read" && (result.details as { spillEligible?: boolean } | undefined)?.spillEligible !== true) {
+		return result;
+	}
+
+	const artifactCapability = artifactCapabilityForContext(context);
+	if (!artifactCapability) return result;
 	const { threshold, readThreshold, tailBytes, tailLines, headBytes } = getSpillConfig(context?.settings);
 	// `read` manages its own per-range truncation, but the combined multi-range
 	// output has no cap — enforce a read-specific (higher) combined threshold
@@ -625,7 +636,7 @@ async function spillLargeResultToArtifact(
 	if (totalBytes <= effectiveThreshold) return result;
 
 	// Save full output as artifact
-	const artifactId = await sessionManager.saveArtifact(fullText, toolName);
+	const artifactId = await artifactCapability.saveArtifact(fullText, toolName);
 	if (!artifactId) return result;
 
 	// Truncate: middle elision when a head budget is configured, otherwise tail-only.
@@ -702,8 +713,8 @@ async function spillLargeResultToArtifact(
 /**
  * Absolute inline-size backstop enforced after {@link spillLargeResultToArtifact}.
  *
- * The threshold-based spill above has escape hatches: it early-returns for the
- * `read` tool and for results that already carry an `artifactId` (a tool may set
+ * The threshold-based spill above has escape hatches: it skips ineligible `read`
+ * results and results that already carry an `artifactId` (a tool may set
  * partial truncation meta yet still emit oversized inline text). This backstop
  * closes those gaps: when `tools.maxInlineResultBytes` is configured (> 0), any
  * final result whose inline text exceeds the cap is force-saved to an artifact
@@ -735,8 +746,9 @@ async function enforceInlineResultBackstop(
 	// full output so the truncated view keeps a reference to the complete text.
 	const existingMeta: OutputMeta | undefined = result.details?.meta;
 	let artifactId = existingMeta?.truncation?.artifactId;
-	if (!artifactId) {
-		artifactId = (await context?.sessionManager?.saveArtifact(fullText, toolName)) ?? undefined;
+	const artifactCapability = artifactCapabilityForContext(context);
+	if (!artifactId && artifactCapability) {
+		artifactId = (await artifactCapability.saveArtifact(fullText, toolName)) ?? undefined;
 	}
 
 	// Budget head+tail below the cap, reserving room for the elision marker so the

package/src/tools/path-utils.ts

@@ -2,7 +2,7 @@ import * as fs from "node:fs";
 import * as os from "node:os";
 import * as path from "node:path";
 import * as url from "node:url";
-import { isEnoent } from "@sayknow-cli/utils";
+import { isEnoent } from "@sayknow-cli/utils/fs-error";
 import { InternalUrlRouter } from "../internal-urls";
 import { ToolError } from "./tool-errors";
 
@@ -10,13 +10,9 @@ const UNICODE_SPACES = /[\u00A0\u2000-\u200A\u202F\u205F\u3000]/g;
 const FILE_LINE_RANGE_RE = /^(?:L?\d+(?:[-+]L?\d+|-)?(?:,L?\d+(?:[-+]L?\d+|-)?)*|raw|conflicts)$/i;
 const FILE_LINE_RANGE_ONLY_RE = /^L?\d+(?:[-+]L?\d+|-)?(?:,L?\d+(?:[-+]L?\d+|-)?)*$/i;
 const FILE_RAW_ONLY_RE = /^raw$/i;
-// Permissive selector chunk for internal URLs — accepts well-formed selectors
-// plus common malformed shapes (e.g. `:-N`) so the read tool peels the entire
-// selector chain off before dispatching to a protocol handler.
-const INTERNAL_URL_SELECTOR_PART_RE =
-	/^(?:raw|conflicts|L?\d+(?:[-+]L?\d+|-)?(?:,L?\d+(?:[-+]L?\d+|-)?)*|-\d+(?:[-+]\d+)?)$/i;
-// Schemes whose host grammar is identifier-shaped, so any trailing
-// `:<selector-chunk>` is unambiguously a read-tool selector.
+// Schemes whose authority grammar is identifier-shaped and may therefore carry
+// a read selector immediately after the authority. Colons in a path, query, or
+// fragment remain part of the URL and are never considered selectors.
 const INTERNAL_SCHEMES_WITH_SELECTORS: Record<string, true> = {
 	agent: true,
 	artifact: true,
@@ -148,39 +144,50 @@ export function splitPathAndSel(rawPath: string): { path: string; sel?: string }
 /**
  * Variant of {@link splitPathAndSel} for internal URLs (`scheme://...`).
  *
- * The filesystem-path splitter is intentionally conservative: it refuses to
- * peel a trailing `:<chunk>` unless that chunk matches the strict selector
- * grammar. That rule is right for filesystem paths (a file named `a:1-50` is
- * legal) but wrong for internal URLs, where any trailing `:<chunk>` after the
- * scheme is unambiguously a read-tool selector — even if malformed (e.g.
- * `artifact://3:raw:-100`).
- *
- * This function iteratively peels selector-shaped chunks (well-formed plus
- * common malformed shapes like `:-N`) so the rest of the read tool can pass a
- * clean URL to the protocol handler and surface selector errors via parseSel
- * instead of as misleading "host invalid" errors from the handler.
- *
- * Falls back to the input unchanged when nothing matches.
+ * Artifact authorities are generated identifiers, so their complete tail is
+ * unambiguously a selector and malformed selectors can be rejected before
+ * resolving the artifact. Other resources may legitimately use colons in
+ * their identities, so they only lose strict, recognized selector suffixes.
+ * Skill authorities additionally use the active registry to distinguish a
+ * skill name from its selector without making path-utils depend on skills.
  */
-export function splitInternalUrlSel(rawPath: string): { path: string; sel?: string } {
+export function splitInternalUrlSel(
+	rawPath: string,
+	options: { activeSkillNames?: readonly string[] } = {},
+): { path: string; sel?: string } {
 	const schemeMatch = rawPath.match(INTERNAL_URL_SCHEME_RE);
 	if (!schemeMatch) return { path: rawPath };
-	if (!INTERNAL_SCHEMES_WITH_SELECTORS[schemeMatch[1].toLowerCase()]) return { path: rawPath };
+	const scheme = schemeMatch[1].toLowerCase();
+	if (!INTERNAL_SCHEMES_WITH_SELECTORS[scheme]) return { path: rawPath };
 
 	const schemeEnd = schemeMatch[0].length;
-	let path = rawPath;
-	const chunks: string[] = [];
-	while (true) {
-		const colon = path.lastIndexOf(":");
-		// Stop before crossing into the scheme separator `://`.
-		if (colon < schemeEnd) break;
-		const tail = path.slice(colon + 1);
-		if (!INTERNAL_URL_SELECTOR_PART_RE.test(tail)) break;
-		chunks.unshift(tail);
-		path = path.slice(0, colon);
+	const authorityTerminator = rawPath.slice(schemeEnd).search(/[/?#]/);
+	if (authorityTerminator !== -1) return { path: rawPath };
+	const authority = rawPath.slice(schemeEnd);
+	const firstColon = authority.indexOf(":");
+	if (firstColon === -1) return { path: rawPath };
+
+	if (scheme === "artifact") {
+		return { path: rawPath.slice(0, schemeEnd + firstColon), sel: authority.slice(firstColon + 1) };
+	}
+
+	if (scheme === "skill") {
+		const activeSkillNames = options.activeSkillNames ?? [];
+		if (activeSkillNames.includes(authority)) return { path: rawPath };
+		const skillName = activeSkillNames
+			.filter(name => authority.startsWith(`${name}:`))
+			.sort((a, b) => b.length - a.length)[0];
+		if (skillName) {
+			return {
+				path: `${rawPath.slice(0, schemeEnd)}${skillName}`,
+				sel: authority.slice(skillName.length + 1),
+			};
+		}
 	}
-	if (chunks.length === 0) return { path: rawPath };
-	return { path, sel: chunks.join(":") };
+
+	const strict = splitPathAndSel(authority);
+	if (strict.sel === undefined) return { path: rawPath };
+	return { path: `${rawPath.slice(0, schemeEnd)}${strict.path}`, sel: strict.sel };
 }
 
 function assertNotInternalUrl(expanded: string, original: string): void {

package/src/tools/plan-mode-guard.ts

@@ -11,6 +11,7 @@ function resolveRawPath(session: ToolSession, targetPath: string): string {
 	if (normalized.startsWith(LOCAL_SCHEME_PREFIX)) {
 		return resolveLocalUrlToPath(normalized, {
 			getArtifactsDir: session.getArtifactsDir,
+			isManagedDestination: session.isManagedSessionDestination,
 			getSessionId: session.getSessionId,
 		});
 	}

package/src/tools/puppeteer/14_stealth_permissions.txt

@@ -0,0 +1,57 @@
+// Permissions / notification headless tell.
+//
+// Headless Chrome reports `Notification.permission === "denied"` by default and
+// a matching `permissions.query({name:"notifications"})` state, while a real
+// user browser reports `"default"` / `"prompt"`. Detectors such as CreepJS key
+// on this exact mismatch to flag headless. Normalize both to the human default.
+//
+// Technique adapted (reimplemented) from puppeteer-extra-plugin-stealth
+// (navigator.permissions) — see STEALTH-THIRD-PARTY-NOTICES.md.
+
+try {
+	if (typeof Notification !== "undefined" && Notification.permission === "denied") {
+		Object_defineProperty(Notification, "permission", {
+			get() {
+				return "default";
+			},
+			configurable: true,
+		});
+	}
+} catch (e) {}
+
+try {
+	const permissions = navigator.permissions;
+	const originalQuery = permissions && permissions.query;
+	if (originalQuery && typeof PermissionStatus !== "undefined") {
+		permissions.query = new Window_Proxy(originalQuery, {
+			apply(target, ctx, args) {
+				const params = args[0];
+				if (params && params.name === "notifications") {
+					return Promise_resolve(
+						Object_create(PermissionStatus.prototype, {
+							state: {
+								get() {
+									return "prompt";
+								},
+								enumerable: true,
+								configurable: true,
+							},
+							name: {
+								value: "notifications",
+								enumerable: true,
+								configurable: true,
+							},
+							onchange: {
+								value: null,
+								writable: true,
+								enumerable: true,
+								configurable: true,
+							},
+						}),
+					);
+				}
+				return Reflect.apply(target, ctx, args);
+			},
+		});
+	}
+} catch (e) {}

package/src/tools/puppeteer/15_stealth_webrtc.txt

@@ -0,0 +1,60 @@
+// WebRTC IP-leak guard.
+//
+// Even with --force-webrtc-ip-handling-policy, RTCPeerConnection can surface
+// ICE candidates that embed a raw local/public IP literal — a bot/deanon tell
+// that CreepJS and others read. This wrapper strips ONLY candidates that carry
+// a non-mDNS raw IP literal; mDNS ".local" candidates and all other WebRTC
+// behavior (offer/answer, data channels) are left intact so real WebRTC keeps
+// working.
+//
+// Technique adapted (reimplemented) from puppeteer-extra-plugin-stealth
+// (navigator.mediaDevices / webrtc) — see STEALTH-THIRD-PARTY-NOTICES.md.
+
+try {
+	const RTCP = typeof RTCPeerConnection !== "undefined" ? RTCPeerConnection : undefined;
+	if (RTCP && RTCP.prototype) {
+		// A raw IPv4/IPv6 literal that is NOT an mDNS ".local" hostname.
+		const rawIpInCandidate = (candidate) => {
+			if (typeof candidate !== "string" || candidate.length === 0) return false;
+			if (/\.local\b/i.test(candidate)) return false; // mDNS obfuscated — safe
+			const ipv4 = /\b\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\b/;
+			const ipv6 = /\b(?:[0-9a-f]{1,4}:){2,}[0-9a-f]{0,4}\b/i;
+			return ipv4.test(candidate) || ipv6.test(candidate);
+		};
+
+		const origAddEventListener = RTCP.prototype.addEventListener;
+		RTCP.prototype.addEventListener = new Window_Proxy(origAddEventListener, {
+			apply(target, ctx, args) {
+				if (args[0] === "icecandidate" && typeof args[1] === "function") {
+					const userCb = args[1];
+					const wrapped = function (event) {
+						if (event && event.candidate && rawIpInCandidate(event.candidate.candidate)) {
+							return; // drop the raw-IP candidate; keep gathering others
+						}
+						return Reflect.apply(userCb, this, arguments);
+					};
+					return Reflect.apply(target, ctx, [args[0], wrapped, args[2]]);
+				}
+				return Reflect.apply(target, ctx, args);
+			},
+		});
+
+		// Also guard the onicecandidate setter path.
+		const desc = Object_getOwnPropertyDescriptor(RTCP.prototype, "onicecandidate");
+		if (desc && desc.set) {
+			Object_defineProperty(RTCP.prototype, "onicecandidate", {
+				configurable: true,
+				enumerable: desc.enumerable,
+				get: desc.get,
+				set(cb) {
+					if (typeof cb !== "function") return desc.set.call(this, cb);
+					const wrapped = function (event) {
+						if (event && event.candidate && rawIpInCandidate(event.candidate.candidate)) return;
+						return Reflect.apply(cb, this, arguments);
+					};
+					return desc.set.call(this, wrapped);
+				},
+			});
+		}
+	}
+} catch (e) {}