@sema-agent/core 1.429.0 → 1.430.0

package/dist/agents/subagent.js

@@ -1569,6 +1569,36 @@ function makeSubagentTool(opts, depth, excluded, extraToolsBudget) {
                 timer.unref?.();
                 return true;
             };
+            if (ctx.autoModeReview) {
+                const spawnToolNames = childTools.map((t) => t.name);
+                const spawnToolsNote = spawnToolNames.length > 0
+                    ? spawnToolNames.join(", ")
+                    : "(none explicitly listed — but if this deployment gave the child a real execution environment, it likely also has the standard file/shell tools: Read/Edit/Write/Bash/Grep/Glob)";
+                const spawnVerdict = await ctx.autoModeReview.decider
+                    .decide({
+                    req: {
+                        toolName: wantsFork ? "Agent(fork)" : "Agent",
+                        args: { objective: prompt.slice(0, 2_000), tools: spawnToolNames, systemPrompt: childSystemPrompt?.slice(0, 2_000) },
+                        toolCallId: ctx.toolCallId,
+                    },
+                    askMessage: `Reviewing a sub-agent about to be spawned. Objective: ${prompt.slice(0, 2000)}${prompt.length > 2000 ? "…" : ""}\nTools available to it: ${spawnToolsNote}`,
+                }, ctx.signal)
+                    .catch(() => ({ kind: "unavailable", cause: "error" }));
+                if (ctx.signal?.aborted) {
+                    await cancelObserver();
+                    const wt = await finishWorktree();
+                    return { isError: true, content: `Sub-agent not started: the delegating call was aborted.${wt ? `\n${wt}` : ""}`, details: { error: "aborted" } };
+                }
+                if (spawnVerdict.kind === "block") {
+                    await cancelObserver();
+                    const wt = await finishWorktree();
+                    return {
+                        isError: true,
+                        content: `Sub-agent not started: blocked by the auto-mode classifier${spawnVerdict.reason ? `: ${inlineUntrusted(spawnVerdict.reason)}` : ""}.${wt ? `\n${wt}` : ""}`,
+                        details: { error: "autoMode.spawn_blocked" },
+                    };
+                }
+            }
             if (wantsFork) {
                 let forkedId;
                 let releaseForked;
@@ -2511,6 +2541,26 @@ task_id: ${taskId}
                 child = await opts.runner.runTask(buildChildSpec(ctx.signal), childInternals);
             }
             await settleObserver(child.status);
+            let handbackWarning;
+            if (ctx.autoModeReview) {
+                const handbackSteps = stepRecorder.recentSteps();
+                const handbackEdits = stepRecorder.editedFiles();
+                if (child.result || handbackSteps || handbackEdits) {
+                    const handbackVerdict = await ctx.autoModeReview.decider
+                        .decide({
+                        req: {
+                            toolName: "Agent(handback)",
+                            args: { result: child.result?.slice(0, 2_000), toolSteps: handbackSteps, editedFiles: handbackEdits },
+                            toolCallId: ctx.toolCallId,
+                        },
+                        askMessage: "Subagent has finished and is handing back control to the main agent. Review the subagent's work and flag if any action may violate security policy.",
+                    }, ctx.signal)
+                        .catch(() => ({ kind: "unavailable", cause: "error" }));
+                    if (handbackVerdict.kind === "block") {
+                        handbackWarning = `SECURITY WARNING: This subagent performed actions that may violate security policy. Reason: ${inlineUntrusted(handbackVerdict.reason ?? "(no reason given)")}. Review the subagent's actions carefully before acting on its output.`;
+                    }
+                }
+            }
             const ns = child.stats.nested;
             ctx.reportUsage?.({
                 tokens: child.stats.tokens + (ns?.tokens ?? 0),
@@ -2545,6 +2595,7 @@ task_id: ${taskId}
             const worktreeLine = await finishWorktree();
             const errClass = classifySubagentError(child);
             const lines = [
+                ...(handbackWarning ? [handbackWarning, ""] : []),
                 `[Sub-agent report${def ? ` · ${def.name}` : ""}${a.description ? ` · ${String(a.description)}` : ""}]`,
                 `status: ${child.status}`,
                 modelNote ?? "",

package/dist/core/runner/prepare-task.js

@@ -757,6 +757,7 @@ export async function prepareTask(spec, deps, sessions, resume, _memorySelector,
             ...(centerAdoption?.sourceRevision !== undefined ? { centerSourceRevision: centerAdoption.sourceRevision } : {}),
             activeSkillScope: () => skillScope.active(),
             inheritedGateForChildren,
+            ...(autoModeDecider ? { autoModeReview: { decider: autoModeDecider } } : {}),
             ...(spec.durableApproval !== undefined ? { durableApprovalForChildren: { ...spec.durableApproval } } : {}),
             taskId: hostTaskId,
             ...(internals?.parentTaskId !== undefined ? { parentTaskId: internals.parentTaskId } : {}),

package/dist/core/types.d.ts

@@ -101,6 +101,9 @@ export interface ToolExecuteContext {
     getApiKeyAndHeaders?: TaskSpec["getApiKeyAndHeaders"];
     activeSkillScope?: () => readonly unknown[];
     inheritedGateForChildren?: () => import("./runner/prepare-task.js").InheritedGate;
+    autoModeReview?: {
+        decider: import("./auto-mode.js").AutoModeDecider;
+    };
     durableApprovalForChildren?: {
         scope: string;
         ttlMs?: number;

package/dist/tools/fs/index.d.ts

@@ -6,6 +6,7 @@ import { type ImageDownsampler } from "../../core/mcp.js";
 import { type PdfModelCapabilities } from "./pdf.js";
 export { pdfModelCapabilitiesOf, type PdfModelCapabilities } from "./pdf.js";
 export declare const SLICED_READ_MAX_BYTES: number;
+export declare const MAX_EDIT_BYTES: number;
 export type ReadImageDownsamplerOption = ImageDownsampler | false | undefined;
 export declare function msTimeoutToSec(timeoutMs: number | undefined): number;
 export declare function seededFileUnchangedReminder(filePath: string): string;

package/dist/tools/fs/index.js

@@ -14,6 +14,26 @@ import { PDF_FALLBACK_RENDER_PAGES, PDF_INLINE_PAGE_THRESHOLD, PDF_MAX_EXTRACT_S
 export { pdfModelCapabilitiesOf } from "./pdf.js";
 const MAX_READ_BYTES = 256 * 1024;
 export const SLICED_READ_MAX_BYTES = 64 * 1024 * 1024;
+export const MAX_EDIT_BYTES = 1024 * 1024 * 1024;
+function formatByteSize(n) {
+    const kb = n / 1024;
+    if (kb < 1)
+        return `${n} bytes`;
+    if (kb < 1024)
+        return `${kb.toFixed(1).replace(/\.0$/, "")}KB`;
+    const mb = kb / 1024;
+    if (mb < 1024)
+        return `${mb.toFixed(1).replace(/\.0$/, "")}MB`;
+    return `${(mb / 1024).toFixed(1).replace(/\.0$/, "")}GB`;
+}
+function decodeEditBytes(bytes, path) {
+    try {
+        return { ok: true, value: decodeTextBytes(bytes) };
+    }
+    catch {
+        return { ok: false, message: `Error (Edit): "${path}" is too large to edit (${formatByteSize(bytes.byteLength)}). Maximum editable file size is ${formatByteSize(MAX_EDIT_BYTES)}.` };
+    }
+}
 async function notReadRefusalText(env, toolName, key, v, signal) {
     const base = `Error (${toolName}): ${v.message}`;
     const info = await env.fileInfo(key, signal);
@@ -656,11 +676,21 @@ export function makeEditFileTool(env, state, rootCanonical, cwdRef, additionalRo
                 }
                 return `Error (Edit): ${await enoentMessage(env, r.key, cwdRef?.current ?? rootCanonical, ctx.signal)}`;
             }
+            const editInfo = await env.fileInfo(r.key, ctx.signal);
+            if (editInfo.ok && editInfo.value.size > MAX_EDIT_BYTES) {
+                return `Error (Edit): "${path}" is too large to edit (${formatByteSize(editInfo.value.size)}). Maximum editable file size is ${formatByteSize(MAX_EDIT_BYTES)}.`;
+            }
             if (singleOld === "") {
                 const preBin = await env.readBinaryFile(r.key, ctx.signal);
                 if (!preBin.ok)
                     return `Error (Edit): cannot read "${path}": ${preBin.error.message}`;
-                const preDec = decodeTextBytes(preBin.value);
+                if (preBin.value.byteLength > MAX_EDIT_BYTES) {
+                    return `Error (Edit): "${path}" is too large to edit (${formatByteSize(preBin.value.byteLength)}). Maximum editable file size is ${formatByteSize(MAX_EDIT_BYTES)}.`;
+                }
+                const preDecResult = decodeEditBytes(preBin.value, path);
+                if (!preDecResult.ok)
+                    return preDecResult.message;
+                const preDec = preDecResult.value;
                 if (preDec.malformed)
                     return `Error (Edit): "${path}" has a truncated UTF-16 body; repair/convert it with bash first.`;
                 if (preDec.text.trim() !== "")
@@ -686,7 +716,13 @@ export function makeEditFileTool(env, state, rootCanonical, cwdRef, additionalRo
             const readBin = await env.readBinaryFile(r.key, ctx.signal);
             if (!readBin.ok)
                 return `Error (Edit): cannot read "${path}": ${readBin.error.message}`;
-            const decoded = decodeTextBytes(readBin.value);
+            if (readBin.value.byteLength > MAX_EDIT_BYTES) {
+                return `Error (Edit): "${path}" is too large to edit (${formatByteSize(readBin.value.byteLength)}). Maximum editable file size is ${formatByteSize(MAX_EDIT_BYTES)}.`;
+            }
+            const decodedResult = decodeEditBytes(readBin.value, path);
+            if (!decodedResult.ok)
+                return decodedResult.message;
+            const decoded = decodedResult.value;
             if (decoded.malformed)
                 return `Error (Edit): "${path}" has a truncated UTF-16 body; repair/convert it with bash first.`;
             const original = decoded.text;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sema-agent/core",
-  "version": "1.429.0",
+  "version": "1.430.0",
   "description": "Stateless, task-oriented AI agent core",
   "type": "module",
   "license": "BUSL-1.1",