@sema-agent/core 1.428.0 → 1.430.0

package/dist/agents/subagent-steps.d.ts

@@ -18,6 +18,8 @@ export declare class SubagentStepRecorder {
     private readonly pending;
     private readonly edits;
     private action;
+    private actionTool;
+    private actionTarget;
     constructor(parentToolCallId?: string);
     lockTo(taskId: string): void;
     private resetRecorded;
@@ -26,5 +28,9 @@ export declare class SubagentStepRecorder {
     recentSteps(): SubagentStep[] | undefined;
     editedFiles(): SubagentEditedFile[] | undefined;
     currentAction(): string | undefined;
+    currentActionStructured(): {
+        toolName: string;
+        target?: string;
+    } | undefined;
 }
 export declare function stepsFromMessages(messages: readonly unknown[], lastN: number): SubagentStep[];

package/dist/agents/subagent-steps.js

@@ -58,6 +58,8 @@ export class SubagentStepRecorder {
     pending = new Map();
     edits = new Map();
     action;
+    actionTool;
+    actionTarget;
     constructor(parentToolCallId) {
         this.parentToolCallId = parentToolCallId;
     }
@@ -72,6 +74,8 @@ export class SubagentStepRecorder {
         this.pending.clear();
         this.edits.clear();
         this.action = undefined;
+        this.actionTool = undefined;
+        this.actionTarget = undefined;
     }
     inScope(e) {
         const { sourceTaskId: src, parentToolCallId: ptc } = e;
@@ -94,6 +98,8 @@ export class SubagentStepRecorder {
                 const target = extractTarget(e.args);
                 this.pending.set(e.toolCallId, { tool, target, ...(editTargetPath(e.toolName, e.args) ? { edit: editTargetPath(e.toolName, e.args) } : {}) });
                 this.action = target ? `${tool} ${target}`.slice(0, FIELD_MAX + tool.length + 1) : tool;
+                this.actionTool = tool;
+                this.actionTarget = target || undefined;
             }
             else if (e.type === "tool_end") {
                 if (!this.inScope(e))
@@ -128,6 +134,9 @@ export class SubagentStepRecorder {
     currentAction() {
         return this.action;
     }
+    currentActionStructured() {
+        return this.actionTool === undefined ? undefined : { toolName: this.actionTool, ...(this.actionTarget !== undefined ? { target: this.actionTarget } : {}) };
+    }
 }
 export function stepsFromMessages(messages, lastN) {
     const results = new Map();

package/dist/agents/subagent.js

@@ -1569,6 +1569,36 @@ function makeSubagentTool(opts, depth, excluded, extraToolsBudget) {
                 timer.unref?.();
                 return true;
             };
+            if (ctx.autoModeReview) {
+                const spawnToolNames = childTools.map((t) => t.name);
+                const spawnToolsNote = spawnToolNames.length > 0
+                    ? spawnToolNames.join(", ")
+                    : "(none explicitly listed — but if this deployment gave the child a real execution environment, it likely also has the standard file/shell tools: Read/Edit/Write/Bash/Grep/Glob)";
+                const spawnVerdict = await ctx.autoModeReview.decider
+                    .decide({
+                    req: {
+                        toolName: wantsFork ? "Agent(fork)" : "Agent",
+                        args: { objective: prompt.slice(0, 2_000), tools: spawnToolNames, systemPrompt: childSystemPrompt?.slice(0, 2_000) },
+                        toolCallId: ctx.toolCallId,
+                    },
+                    askMessage: `Reviewing a sub-agent about to be spawned. Objective: ${prompt.slice(0, 2000)}${prompt.length > 2000 ? "…" : ""}\nTools available to it: ${spawnToolsNote}`,
+                }, ctx.signal)
+                    .catch(() => ({ kind: "unavailable", cause: "error" }));
+                if (ctx.signal?.aborted) {
+                    await cancelObserver();
+                    const wt = await finishWorktree();
+                    return { isError: true, content: `Sub-agent not started: the delegating call was aborted.${wt ? `\n${wt}` : ""}`, details: { error: "aborted" } };
+                }
+                if (spawnVerdict.kind === "block") {
+                    await cancelObserver();
+                    const wt = await finishWorktree();
+                    return {
+                        isError: true,
+                        content: `Sub-agent not started: blocked by the auto-mode classifier${spawnVerdict.reason ? `: ${inlineUntrusted(spawnVerdict.reason)}` : ""}.${wt ? `\n${wt}` : ""}`,
+                        details: { error: "autoMode.spawn_blocked" },
+                    };
+                }
+            }
             if (wantsFork) {
                 let forkedId;
                 let releaseForked;
@@ -1686,6 +1716,7 @@ function makeSubagentTool(opts, depth, excluded, extraToolsBudget) {
                                 }
                                 if (e.type === "task_progress") {
                                     const currentAction = stepRecorder.currentAction();
+                                    const currentTool = stepRecorder.currentActionStructured();
                                     sinkEmit({
                                         kind: "tick",
                                         taskId,
@@ -1696,6 +1727,7 @@ function makeSubagentTool(opts, depth, excluded, extraToolsBudget) {
                                         agentType: spawnAgentType,
                                         ...(e.name !== undefined ? { name: e.name } : {}),
                                         ...(currentAction !== undefined ? { currentAction } : {}),
+                                        ...(currentTool !== undefined ? { currentTool } : {}),
                                         usage: e.usage,
                                     });
                                 }
@@ -2078,6 +2110,7 @@ task_id: ${taskId}
                             }
                             if (e.type === "task_progress") {
                                 const currentAction = stepRecorder.currentAction();
+                                const currentTool = stepRecorder.currentActionStructured();
                                 sinkEmit({
                                     kind: "tick",
                                     taskId,
@@ -2088,6 +2121,7 @@ task_id: ${taskId}
                                     agentType: spawnAgentType,
                                     ...(e.name !== undefined ? { name: e.name } : {}),
                                     ...(currentAction !== undefined ? { currentAction } : {}),
+                                    ...(currentTool !== undefined ? { currentTool } : {}),
                                     usage: e.usage,
                                 });
                             }
@@ -2507,6 +2541,26 @@ task_id: ${taskId}
                 child = await opts.runner.runTask(buildChildSpec(ctx.signal), childInternals);
             }
             await settleObserver(child.status);
+            let handbackWarning;
+            if (ctx.autoModeReview) {
+                const handbackSteps = stepRecorder.recentSteps();
+                const handbackEdits = stepRecorder.editedFiles();
+                if (child.result || handbackSteps || handbackEdits) {
+                    const handbackVerdict = await ctx.autoModeReview.decider
+                        .decide({
+                        req: {
+                            toolName: "Agent(handback)",
+                            args: { result: child.result?.slice(0, 2_000), toolSteps: handbackSteps, editedFiles: handbackEdits },
+                            toolCallId: ctx.toolCallId,
+                        },
+                        askMessage: "Subagent has finished and is handing back control to the main agent. Review the subagent's work and flag if any action may violate security policy.",
+                    }, ctx.signal)
+                        .catch(() => ({ kind: "unavailable", cause: "error" }));
+                    if (handbackVerdict.kind === "block") {
+                        handbackWarning = `SECURITY WARNING: This subagent performed actions that may violate security policy. Reason: ${inlineUntrusted(handbackVerdict.reason ?? "(no reason given)")}. Review the subagent's actions carefully before acting on its output.`;
+                    }
+                }
+            }
             const ns = child.stats.nested;
             ctx.reportUsage?.({
                 tokens: child.stats.tokens + (ns?.tokens ?? 0),
@@ -2541,6 +2595,7 @@ task_id: ${taskId}
             const worktreeLine = await finishWorktree();
             const errClass = classifySubagentError(child);
             const lines = [
+                ...(handbackWarning ? [handbackWarning, ""] : []),
                 `[Sub-agent report${def ? ` · ${def.name}` : ""}${a.description ? ` · ${String(a.description)}` : ""}]`,
                 `status: ${child.status}`,
                 modelNote ?? "",

package/dist/core/runner/prepare-task.js

@@ -757,6 +757,7 @@ export async function prepareTask(spec, deps, sessions, resume, _memorySelector,
             ...(centerAdoption?.sourceRevision !== undefined ? { centerSourceRevision: centerAdoption.sourceRevision } : {}),
             activeSkillScope: () => skillScope.active(),
             inheritedGateForChildren,
+            ...(autoModeDecider ? { autoModeReview: { decider: autoModeDecider } } : {}),
             ...(spec.durableApproval !== undefined ? { durableApprovalForChildren: { ...spec.durableApproval } } : {}),
             taskId: hostTaskId,
             ...(internals?.parentTaskId !== undefined ? { parentTaskId: internals.parentTaskId } : {}),

package/dist/core/types.d.ts

@@ -101,6 +101,9 @@ export interface ToolExecuteContext {
     getApiKeyAndHeaders?: TaskSpec["getApiKeyAndHeaders"];
     activeSkillScope?: () => readonly unknown[];
     inheritedGateForChildren?: () => import("./runner/prepare-task.js").InheritedGate;
+    autoModeReview?: {
+        decider: import("./auto-mode.js").AutoModeDecider;
+    };
     durableApprovalForChildren?: {
         scope: string;
         ttlMs?: number;
@@ -646,6 +649,10 @@ export interface BackgroundChildEvent {
     progressParentTaskId?: string;
     name?: string;
     currentAction?: string;
+    currentTool?: {
+        toolName: string;
+        target?: string;
+    };
     sessionId?: string;
     transcriptId?: string;
     recentSteps?: import("../agents/subagent-steps.js").SubagentStep[];

package/dist/tools/fs/index.d.ts

@@ -6,6 +6,7 @@ import { type ImageDownsampler } from "../../core/mcp.js";
 import { type PdfModelCapabilities } from "./pdf.js";
 export { pdfModelCapabilitiesOf, type PdfModelCapabilities } from "./pdf.js";
 export declare const SLICED_READ_MAX_BYTES: number;
+export declare const MAX_EDIT_BYTES: number;
 export type ReadImageDownsamplerOption = ImageDownsampler | false | undefined;
 export declare function msTimeoutToSec(timeoutMs: number | undefined): number;
 export declare function seededFileUnchangedReminder(filePath: string): string;

package/dist/tools/fs/index.js

@@ -14,6 +14,26 @@ import { PDF_FALLBACK_RENDER_PAGES, PDF_INLINE_PAGE_THRESHOLD, PDF_MAX_EXTRACT_S
 export { pdfModelCapabilitiesOf } from "./pdf.js";
 const MAX_READ_BYTES = 256 * 1024;
 export const SLICED_READ_MAX_BYTES = 64 * 1024 * 1024;
+export const MAX_EDIT_BYTES = 1024 * 1024 * 1024;
+function formatByteSize(n) {
+    const kb = n / 1024;
+    if (kb < 1)
+        return `${n} bytes`;
+    if (kb < 1024)
+        return `${kb.toFixed(1).replace(/\.0$/, "")}KB`;
+    const mb = kb / 1024;
+    if (mb < 1024)
+        return `${mb.toFixed(1).replace(/\.0$/, "")}MB`;
+    return `${(mb / 1024).toFixed(1).replace(/\.0$/, "")}GB`;
+}
+function decodeEditBytes(bytes, path) {
+    try {
+        return { ok: true, value: decodeTextBytes(bytes) };
+    }
+    catch {
+        return { ok: false, message: `Error (Edit): "${path}" is too large to edit (${formatByteSize(bytes.byteLength)}). Maximum editable file size is ${formatByteSize(MAX_EDIT_BYTES)}.` };
+    }
+}
 async function notReadRefusalText(env, toolName, key, v, signal) {
     const base = `Error (${toolName}): ${v.message}`;
     const info = await env.fileInfo(key, signal);
@@ -656,11 +676,21 @@ export function makeEditFileTool(env, state, rootCanonical, cwdRef, additionalRo
                 }
                 return `Error (Edit): ${await enoentMessage(env, r.key, cwdRef?.current ?? rootCanonical, ctx.signal)}`;
             }
+            const editInfo = await env.fileInfo(r.key, ctx.signal);
+            if (editInfo.ok && editInfo.value.size > MAX_EDIT_BYTES) {
+                return `Error (Edit): "${path}" is too large to edit (${formatByteSize(editInfo.value.size)}). Maximum editable file size is ${formatByteSize(MAX_EDIT_BYTES)}.`;
+            }
             if (singleOld === "") {
                 const preBin = await env.readBinaryFile(r.key, ctx.signal);
                 if (!preBin.ok)
                     return `Error (Edit): cannot read "${path}": ${preBin.error.message}`;
-                const preDec = decodeTextBytes(preBin.value);
+                if (preBin.value.byteLength > MAX_EDIT_BYTES) {
+                    return `Error (Edit): "${path}" is too large to edit (${formatByteSize(preBin.value.byteLength)}). Maximum editable file size is ${formatByteSize(MAX_EDIT_BYTES)}.`;
+                }
+                const preDecResult = decodeEditBytes(preBin.value, path);
+                if (!preDecResult.ok)
+                    return preDecResult.message;
+                const preDec = preDecResult.value;
                 if (preDec.malformed)
                     return `Error (Edit): "${path}" has a truncated UTF-16 body; repair/convert it with bash first.`;
                 if (preDec.text.trim() !== "")
@@ -686,7 +716,13 @@ export function makeEditFileTool(env, state, rootCanonical, cwdRef, additionalRo
             const readBin = await env.readBinaryFile(r.key, ctx.signal);
             if (!readBin.ok)
                 return `Error (Edit): cannot read "${path}": ${readBin.error.message}`;
-            const decoded = decodeTextBytes(readBin.value);
+            if (readBin.value.byteLength > MAX_EDIT_BYTES) {
+                return `Error (Edit): "${path}" is too large to edit (${formatByteSize(readBin.value.byteLength)}). Maximum editable file size is ${formatByteSize(MAX_EDIT_BYTES)}.`;
+            }
+            const decodedResult = decodeEditBytes(readBin.value, path);
+            if (!decodedResult.ok)
+                return decodedResult.message;
+            const decoded = decodedResult.value;
             if (decoded.malformed)
                 return `Error (Edit): "${path}" has a truncated UTF-16 body; repair/convert it with bash first.`;
             const original = decoded.text;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sema-agent/core",
-  "version": "1.428.0",
+  "version": "1.430.0",
   "description": "Stateless, task-oriented AI agent core",
   "type": "module",
   "license": "BUSL-1.1",