@sema-agent/core 1.429.0 → 1.431.0

package/dist/agents/subagent.js

@@ -1569,6 +1569,36 @@ function makeSubagentTool(opts, depth, excluded, extraToolsBudget) {
                 timer.unref?.();
                 return true;
             };
+            if (ctx.autoModeReview) {
+                const spawnToolNames = childTools.map((t) => t.name);
+                const spawnToolsNote = spawnToolNames.length > 0
+                    ? spawnToolNames.join(", ")
+                    : "(none explicitly listed — but if this deployment gave the child a real execution environment, it likely also has the standard file/shell tools: Read/Edit/Write/Bash/Grep/Glob)";
+                const spawnVerdict = await ctx.autoModeReview.decider
+                    .decide({
+                    req: {
+                        toolName: wantsFork ? "Agent(fork)" : "Agent",
+                        args: { objective: prompt.slice(0, 2_000), tools: spawnToolNames, systemPrompt: childSystemPrompt?.slice(0, 2_000) },
+                        toolCallId: ctx.toolCallId,
+                    },
+                    askMessage: `Reviewing a sub-agent about to be spawned. Objective: ${prompt.slice(0, 2000)}${prompt.length > 2000 ? "…" : ""}\nTools available to it: ${spawnToolsNote}`,
+                }, ctx.signal)
+                    .catch(() => ({ kind: "unavailable", cause: "error" }));
+                if (ctx.signal?.aborted) {
+                    await cancelObserver();
+                    const wt = await finishWorktree();
+                    return { isError: true, content: `Sub-agent not started: the delegating call was aborted.${wt ? `\n${wt}` : ""}`, details: { error: "aborted" } };
+                }
+                if (spawnVerdict.kind === "block") {
+                    await cancelObserver();
+                    const wt = await finishWorktree();
+                    return {
+                        isError: true,
+                        content: `Sub-agent not started: blocked by the auto-mode classifier${spawnVerdict.reason ? `: ${inlineUntrusted(spawnVerdict.reason)}` : ""}.${wt ? `\n${wt}` : ""}`,
+                        details: { error: "autoMode.spawn_blocked" },
+                    };
+                }
+            }
             if (wantsFork) {
                 let forkedId;
                 let releaseForked;
@@ -2511,6 +2541,26 @@ task_id: ${taskId}
                 child = await opts.runner.runTask(buildChildSpec(ctx.signal), childInternals);
             }
             await settleObserver(child.status);
+            let handbackWarning;
+            if (ctx.autoModeReview) {
+                const handbackSteps = stepRecorder.recentSteps();
+                const handbackEdits = stepRecorder.editedFiles();
+                if (child.result || handbackSteps || handbackEdits) {
+                    const handbackVerdict = await ctx.autoModeReview.decider
+                        .decide({
+                        req: {
+                            toolName: "Agent(handback)",
+                            args: { result: child.result?.slice(0, 2_000), toolSteps: handbackSteps, editedFiles: handbackEdits },
+                            toolCallId: ctx.toolCallId,
+                        },
+                        askMessage: "Subagent has finished and is handing back control to the main agent. Review the subagent's work and flag if any action may violate security policy.",
+                    }, ctx.signal)
+                        .catch(() => ({ kind: "unavailable", cause: "error" }));
+                    if (handbackVerdict.kind === "block") {
+                        handbackWarning = `SECURITY WARNING: This subagent performed actions that may violate security policy. Reason: ${inlineUntrusted(handbackVerdict.reason ?? "(no reason given)")}. Review the subagent's actions carefully before acting on its output.`;
+                    }
+                }
+            }
             const ns = child.stats.nested;
             ctx.reportUsage?.({
                 tokens: child.stats.tokens + (ns?.tokens ?? 0),
@@ -2545,6 +2595,7 @@ task_id: ${taskId}
             const worktreeLine = await finishWorktree();
             const errClass = classifySubagentError(child);
             const lines = [
+                ...(handbackWarning ? [handbackWarning, ""] : []),
                 `[Sub-agent report${def ? ` · ${def.name}` : ""}${a.description ? ` · ${String(a.description)}` : ""}]`,
                 `status: ${child.status}`,
                 modelNote ?? "",

package/dist/core/runner/prepare-task.js

@@ -757,6 +757,7 @@ export async function prepareTask(spec, deps, sessions, resume, _memorySelector,
             ...(centerAdoption?.sourceRevision !== undefined ? { centerSourceRevision: centerAdoption.sourceRevision } : {}),
             activeSkillScope: () => skillScope.active(),
             inheritedGateForChildren,
+            ...(autoModeDecider ? { autoModeReview: { decider: autoModeDecider } } : {}),
             ...(spec.durableApproval !== undefined ? { durableApprovalForChildren: { ...spec.durableApproval } } : {}),
             taskId: hostTaskId,
             ...(internals?.parentTaskId !== undefined ? { parentTaskId: internals.parentTaskId } : {}),

package/dist/core/types.d.ts

@@ -101,6 +101,9 @@ export interface ToolExecuteContext {
     getApiKeyAndHeaders?: TaskSpec["getApiKeyAndHeaders"];
     activeSkillScope?: () => readonly unknown[];
     inheritedGateForChildren?: () => import("./runner/prepare-task.js").InheritedGate;
+    autoModeReview?: {
+        decider: import("./auto-mode.js").AutoModeDecider;
+    };
     durableApprovalForChildren?: {
         scope: string;
         ttlMs?: number;

package/dist/index.d.ts

@@ -65,7 +65,7 @@ export type { ExecStep, ExecStepResult, ExecGateResult, ExecGateOptions } from "
 export { sanitizeUntrustedText, delimitUntrusted, inlineUntrusted } from "./core/untrusted-text.js";
 export { deriveInvariants, checkInvariants } from "./core/property-harness.js";
 export type { InvariantKind, FunctionContract, Invariant, InvariantViolation, CheckResult, } from "./core/property-harness.js";
-export { HAND_TOOL_EFFECTS, bashReversibilityProbe, BASH_READONLY_DEFAULT_ALLOW, parseLeadingCommandName, classifyCompoundReadonly } from "./tools/fs/index.js";
+export { HAND_TOOL_EFFECTS, bashReversibilityProbe, BASH_READONLY_DEFAULT_ALLOW, parseLeadingCommandName, classifyCompoundReadonly, MAX_EDIT_BYTES } from "./tools/fs/index.js";
 export { InMemoryToolResultStore, OFFLOAD_TOOL_NAME, DEFAULT_TOOL_RESULT_THRESHOLD_CHARS, type ToolResultStore, type ToolResultSlice, } from "./core/tool-result-store.js";
 export { InMemoryCheckpointStore, CheckpointError, mintCheckpointToken, checkpointVersionOf, CURRENT_CHECKPOINT_VERSION, MAX_SUPPORTED_CHECKPOINT_VERSION, RESOURCE_CHECKPOINT_VERSION, WALLTIME_CHECKPOINT_VERSION, debitLedger, remainingBudgetMicroUsd, remainingWalltimeMs, winnerFromOutcome, validatePendingSteer, riskSeverity, buildRiskDescriptor, summarizeCheckpoint, type RiskDescriptor, type CheckpointStore, type CheckpointSummary, type Checkpoint, type CheckpointToken, type CheckpointGate, type CheckpointState, type SerializedCheckpointState, type CheckpointFaultMode, type PendingAction, type ResumeOutcome, type ResolvedOutcome, type ReopenReason, type ResolveExpectation, type SafetyAxis, type ResourceLedger, type ResourceLimitReason, } from "./core/checkpoint-store.js";
 export { InMemoryFileSnapshotStore, DEFAULT_SNAPSHOT_BOUNDS } from "./core/file-snapshot-store.js";

package/dist/index.js

@@ -56,7 +56,7 @@ export { addWorktree, pruneWorktrees, WORKTREE_PARENT } from "./core/git-worktre
 export { runExecGate } from "./core/exec-gate.js";
 export { sanitizeUntrustedText, delimitUntrusted, inlineUntrusted } from "./core/untrusted-text.js";
 export { deriveInvariants, checkInvariants } from "./core/property-harness.js";
-export { HAND_TOOL_EFFECTS, bashReversibilityProbe, BASH_READONLY_DEFAULT_ALLOW, parseLeadingCommandName, classifyCompoundReadonly } from "./tools/fs/index.js";
+export { HAND_TOOL_EFFECTS, bashReversibilityProbe, BASH_READONLY_DEFAULT_ALLOW, parseLeadingCommandName, classifyCompoundReadonly, MAX_EDIT_BYTES } from "./tools/fs/index.js";
 export { InMemoryToolResultStore, OFFLOAD_TOOL_NAME, DEFAULT_TOOL_RESULT_THRESHOLD_CHARS, } from "./core/tool-result-store.js";
 export { InMemoryCheckpointStore, CheckpointError, mintCheckpointToken, checkpointVersionOf, CURRENT_CHECKPOINT_VERSION, MAX_SUPPORTED_CHECKPOINT_VERSION, RESOURCE_CHECKPOINT_VERSION, WALLTIME_CHECKPOINT_VERSION, debitLedger, remainingBudgetMicroUsd, remainingWalltimeMs, winnerFromOutcome, validatePendingSteer, riskSeverity, buildRiskDescriptor, summarizeCheckpoint, } from "./core/checkpoint-store.js";
 export { InMemoryFileSnapshotStore, DEFAULT_SNAPSHOT_BOUNDS } from "./core/file-snapshot-store.js";

package/dist/tools/fs/index.d.ts

@@ -6,6 +6,7 @@ import { type ImageDownsampler } from "../../core/mcp.js";
 import { type PdfModelCapabilities } from "./pdf.js";
 export { pdfModelCapabilitiesOf, type PdfModelCapabilities } from "./pdf.js";
 export declare const SLICED_READ_MAX_BYTES: number;
+export declare const MAX_EDIT_BYTES: number;
 export type ReadImageDownsamplerOption = ImageDownsampler | false | undefined;
 export declare function msTimeoutToSec(timeoutMs: number | undefined): number;
 export declare function seededFileUnchangedReminder(filePath: string): string;

package/dist/tools/fs/index.js

@@ -14,6 +14,26 @@ import { PDF_FALLBACK_RENDER_PAGES, PDF_INLINE_PAGE_THRESHOLD, PDF_MAX_EXTRACT_S
 export { pdfModelCapabilitiesOf } from "./pdf.js";
 const MAX_READ_BYTES = 256 * 1024;
 export const SLICED_READ_MAX_BYTES = 64 * 1024 * 1024;
+export const MAX_EDIT_BYTES = 1024 * 1024 * 1024;
+function formatByteSize(n) {
+    const kb = n / 1024;
+    if (kb < 1)
+        return `${n} bytes`;
+    if (kb < 1024)
+        return `${kb.toFixed(1).replace(/\.0$/, "")}KB`;
+    const mb = kb / 1024;
+    if (mb < 1024)
+        return `${mb.toFixed(1).replace(/\.0$/, "")}MB`;
+    return `${(mb / 1024).toFixed(1).replace(/\.0$/, "")}GB`;
+}
+function decodeEditBytes(bytes, path) {
+    try {
+        return { ok: true, value: decodeTextBytes(bytes) };
+    }
+    catch {
+        return { ok: false, message: `Error (Edit): "${path}" is too large to edit (${formatByteSize(bytes.byteLength)}). Maximum editable file size is ${formatByteSize(MAX_EDIT_BYTES)}.` };
+    }
+}
 async function notReadRefusalText(env, toolName, key, v, signal) {
     const base = `Error (${toolName}): ${v.message}`;
     const info = await env.fileInfo(key, signal);
@@ -656,11 +676,21 @@ export function makeEditFileTool(env, state, rootCanonical, cwdRef, additionalRo
                 }
                 return `Error (Edit): ${await enoentMessage(env, r.key, cwdRef?.current ?? rootCanonical, ctx.signal)}`;
             }
+            const editInfo = await env.fileInfo(r.key, ctx.signal);
+            if (editInfo.ok && editInfo.value.size > MAX_EDIT_BYTES) {
+                return `Error (Edit): "${path}" is too large to edit (${formatByteSize(editInfo.value.size)}). Maximum editable file size is ${formatByteSize(MAX_EDIT_BYTES)}.`;
+            }
             if (singleOld === "") {
                 const preBin = await env.readBinaryFile(r.key, ctx.signal);
                 if (!preBin.ok)
                     return `Error (Edit): cannot read "${path}": ${preBin.error.message}`;
-                const preDec = decodeTextBytes(preBin.value);
+                if (preBin.value.byteLength > MAX_EDIT_BYTES) {
+                    return `Error (Edit): "${path}" is too large to edit (${formatByteSize(preBin.value.byteLength)}). Maximum editable file size is ${formatByteSize(MAX_EDIT_BYTES)}.`;
+                }
+                const preDecResult = decodeEditBytes(preBin.value, path);
+                if (!preDecResult.ok)
+                    return preDecResult.message;
+                const preDec = preDecResult.value;
                 if (preDec.malformed)
                     return `Error (Edit): "${path}" has a truncated UTF-16 body; repair/convert it with bash first.`;
                 if (preDec.text.trim() !== "")
@@ -686,7 +716,13 @@ export function makeEditFileTool(env, state, rootCanonical, cwdRef, additionalRo
             const readBin = await env.readBinaryFile(r.key, ctx.signal);
             if (!readBin.ok)
                 return `Error (Edit): cannot read "${path}": ${readBin.error.message}`;
-            const decoded = decodeTextBytes(readBin.value);
+            if (readBin.value.byteLength > MAX_EDIT_BYTES) {
+                return `Error (Edit): "${path}" is too large to edit (${formatByteSize(readBin.value.byteLength)}). Maximum editable file size is ${formatByteSize(MAX_EDIT_BYTES)}.`;
+            }
+            const decodedResult = decodeEditBytes(readBin.value, path);
+            if (!decodedResult.ok)
+                return decodedResult.message;
+            const decoded = decodedResult.value;
             if (decoded.malformed)
                 return `Error (Edit): "${path}" has a truncated UTF-16 body; repair/convert it with bash first.`;
             const original = decoded.text;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sema-agent/core",
-  "version": "1.429.0",
+  "version": "1.431.0",
   "description": "Stateless, task-oriented AI agent core",
   "type": "module",
   "license": "BUSL-1.1",