@sema-agent/core 1.451.0 → 2.0.0

package/dist/stores/file/shared-ledger.js

@@ -0,0 +1,94 @@
+import { AppendLog, atomicWriteFile, canonicalStoreKey, ensureDir, readJsonlRecords } from "./fs-atomic.js";
+export class LedgerCore {
+    key;
+    paths;
+    model;
+    table;
+    rows = new Map();
+    refs = 1;
+    locks = new Map();
+    events = 0;
+    handle;
+    constructor(key, paths, model, table) {
+        this.key = key;
+        this.paths = paths;
+        this.model = model;
+        this.table = table;
+    }
+    bootstrap() {
+        for (const row of readJsonlRecords(this.paths.snapshotPath))
+            this.rows.set(this.model.keyOf(row), row);
+        const events = readJsonlRecords(this.paths.ledgerPath);
+        this.events = events.length;
+        for (const ev of events)
+            this.model.apply(this.rows, ev);
+        this.handle = new AppendLog(this.paths.ledgerPath);
+    }
+    withLock(key, fn) {
+        const prev = this.locks.get(key) ?? Promise.resolve();
+        const run = prev.then(() => fn(), () => fn());
+        const tail = run.then(() => { }, () => { });
+        this.locks.set(key, tail);
+        void tail.then(() => {
+            if (this.locks.get(key) === tail)
+                this.locks.delete(key);
+        });
+        return run;
+    }
+    commit(ev, fsync, compactEvery) {
+        this.log.append(ev, fsync);
+        this.model.apply(this.rows, ev);
+        this.events++;
+        if (this.events >= compactEvery) {
+            try {
+                this.compact();
+            }
+            catch {
+            }
+        }
+    }
+    compact() {
+        const lines = [...this.rows.values()].map((r) => JSON.stringify(r)).join("\n");
+        atomicWriteFile(this.paths.tmpDir, this.paths.snapshotPath, lines.length ? `${lines}\n` : "");
+        this.log.closeForSwap();
+        atomicWriteFile(this.paths.tmpDir, this.paths.ledgerPath, "");
+        this.events = 0;
+    }
+    release() {
+        this.refs -= 1;
+        if (this.refs > 0)
+            return;
+        if (this.table.get(this.key) === this)
+            this.table.delete(this.key);
+        this.handle?.close();
+    }
+    get pendingEvents() {
+        return this.events;
+    }
+    get log() {
+        if (this.handle === undefined)
+            throw new Error("file ledger: used before bootstrap");
+        return this.handle;
+    }
+}
+export class SharedLedgerTable {
+    model;
+    live = new Map();
+    constructor(model) {
+        this.model = model;
+    }
+    acquire(paths) {
+        ensureDir(paths.dir);
+        ensureDir(paths.tmpDir);
+        const key = canonicalStoreKey(paths.dir);
+        const existing = this.live.get(key);
+        if (existing !== undefined) {
+            existing.refs += 1;
+            return existing;
+        }
+        const core = new LedgerCore(key, paths, this.model, this.live);
+        this.live.set(key, core);
+        core.bootstrap();
+        return core;
+    }
+}

package/dist/stores/file/workflow-run-store.d.ts

@@ -5,24 +5,12 @@ export interface FileWorkflowRunStoreOptions {
     compactEvery?: number;
 }
 export declare class FileWorkflowRunStore implements WorkflowRunStore {
-    private readonly dir;
-    private readonly tmpDir;
-    private readonly ledgerPath;
-    private readonly snapshotPath;
     private readonly fsyncEnabled;
     private readonly compactEvery;
-    private readonly shared;
+    private readonly ledger;
     private closed;
-    private readonly canonicalDir;
     private get runs();
-    private get locks();
-    private get ledgerEvents();
-    private set ledgerEvents(value);
-    private get log();
-    private set log(value);
     constructor(root: string, opts?: FileWorkflowRunStoreOptions);
-    private replay;
-    private applyEvent;
     private withLock;
     private commit;
     put(id: string, run: WorkflowRun): Promise<void>;
@@ -39,7 +27,6 @@ export declare class FileWorkflowRunStore implements WorkflowRunStore {
         maxAgeMs?: number;
         keep?: number;
     }): Promise<number>;
-    private compact;
     compactNow(): void;
     get size(): number;
     close(): void;

package/dist/stores/file/workflow-run-store.js

@@ -1,95 +1,40 @@
 import { join } from "node:path";
 import { WorkflowRunStoreError, isTerminalWorkflowStatus, summarizeWorkflowRun, } from "../../core/workflow-run-store.js";
-import { canonicalStoreKey, AppendLog, atomicWriteFile, ensureDir, readJsonlRecords } from "./fs-atomic.js";
-const sharedRunDirs = new Map();
+import { SharedLedgerTable } from "./shared-ledger.js";
+const runLedgers = new SharedLedgerTable({
+    keyOf: (run) => run.id,
+    apply: (runs, ev) => {
+        if (ev.t === "delete") {
+            runs.delete(ev.id);
+            return;
+        }
+        runs.set(ev.id, ev.run);
+    },
+});
 export class FileWorkflowRunStore {
-    dir;
-    tmpDir;
-    ledgerPath;
-    snapshotPath;
     fsyncEnabled;
     compactEvery;
-    shared;
+    ledger;
     closed = false;
-    canonicalDir;
     get runs() {
-        return this.shared.runs;
-    }
-    get locks() {
-        return this.shared.locks;
-    }
-    get ledgerEvents() {
-        return this.shared.ledgerEvents;
-    }
-    set ledgerEvents(v) {
-        this.shared.ledgerEvents = v;
-    }
-    get log() {
-        return this.shared.log;
-    }
-    set log(v) {
-        this.shared.log = v;
+        return this.ledger.rows;
     }
     constructor(root, opts = {}) {
-        this.dir = join(root, "workflow-runs");
-        this.tmpDir = join(root, "tmp");
-        this.ledgerPath = join(this.dir, "runs.jsonl");
-        this.snapshotPath = join(this.dir, "runs.snapshot.jsonl");
         this.fsyncEnabled = opts.fsync !== false;
         this.compactEvery = opts.compactEvery ?? 1000;
-        ensureDir(this.dir);
-        ensureDir(this.tmpDir);
-        const canonical = canonicalStoreKey(this.dir);
-        this.canonicalDir = canonical;
-        const existing = sharedRunDirs.get(canonical);
-        if (existing !== undefined) {
-            existing.refs += 1;
-            this.shared = existing;
-            return;
-        }
-        this.shared = { runs: new Map(), locks: new Map(), ledgerEvents: 0, log: undefined, refs: 1 };
-        sharedRunDirs.set(canonical, this.shared);
-        this.replay();
-        this.log = new AppendLog(this.ledgerPath);
-    }
-    replay() {
-        for (const snap of readJsonlRecords(this.snapshotPath)) {
-            this.runs.set(snap.id, snap);
-        }
-        const events = readJsonlRecords(this.ledgerPath);
-        this.ledgerEvents = events.length;
-        for (const ev of events)
-            this.applyEvent(ev);
-    }
-    applyEvent(ev) {
-        if (ev.t === "delete") {
-            this.runs.delete(ev.id);
-            return;
-        }
-        this.runs.set(ev.id, ev.run);
+        const dir = join(root, "workflow-runs");
+        this.ledger = runLedgers.acquire({
+            dir,
+            tmpDir: join(root, "tmp"),
+            ledgerPath: join(dir, "runs.jsonl"),
+            snapshotPath: join(dir, "runs.snapshot.jsonl"),
+        });
     }
     withLock(id, fn) {
-        const prev = this.locks.get(id) ?? Promise.resolve();
-        const run = prev.then(() => fn(), () => fn());
-        const tail = run.then(() => { }, () => { });
-        this.locks.set(id, tail);
-        void tail.then(() => {
-            if (this.locks.get(id) === tail)
-                this.locks.delete(id);
-        });
-        return run;
+        return this.ledger.withLock(id, fn);
     }
     commit(ev, fsync) {
-        this.log.append(ev, fsync);
-        this.applyEvent(ev);
-        this.ledgerEvents++;
-        if (this.ledgerEvents >= this.compactEvery) {
-            try {
-                this.compact();
-            }
-            catch {
-            }
-        }
+        this.ledger.commit(ev, fsync, this.compactEvery);
     }
     async put(id, run) {
         return this.withLock(id, () => {
@@ -161,15 +106,8 @@ export class FileWorkflowRunStore {
         }
         return n;
     }
-    compact() {
-        const lines = [...this.runs.values()].map((r) => JSON.stringify(r)).join("\n");
-        atomicWriteFile(this.tmpDir, this.snapshotPath, lines.length ? `${lines}\n` : "");
-        this.log.closeForSwap();
-        atomicWriteFile(this.tmpDir, this.ledgerPath, "");
-        this.ledgerEvents = 0;
-    }
     compactNow() {
-        this.compact();
+        this.ledger.compact();
     }
     get size() {
         return this.runs.size;
@@ -178,13 +116,6 @@ export class FileWorkflowRunStore {
         if (this.closed)
             return;
         this.closed = true;
-        const st = sharedRunDirs.get(this.canonicalDir);
-        if (st !== undefined && st === this.shared) {
-            st.refs -= 1;
-            if (st.refs > 0)
-                return;
-            sharedRunDirs.delete(this.canonicalDir);
-        }
-        this.log.close();
+        this.ledger.release();
     }
 }

package/dist/tools/fs/bash-readonly-classifier.d.ts

@@ -0,0 +1,8 @@
+export declare const BASH_READONLY_DEFAULT_ALLOW: readonly string[];
+export declare function parseLeadingCommandName(command: string): {
+    name: string;
+} | {
+    reject: string;
+};
+export declare function coarseReadonlyCheck(command: string, allow: ReadonlySet<string>): string | undefined;
+export declare function classifyCompoundReadonly(command: string, allow: ReadonlySet<string>): string | undefined;

package/dist/tools/fs/bash-readonly-classifier.js

@@ -0,0 +1,166 @@
+import { isBlockedDevicePath, normalizeAbsPathLexically } from "./safety.js";
+export const BASH_READONLY_DEFAULT_ALLOW = [
+    "ls", "cat", "head", "tail", "wc", "pwd", "echo", "whoami", "uname",
+    "grep", "cut", "tr", "basename", "dirname", "stat", "du", "df", "which",
+];
+const SHELL_OPERATORS = /[;&|<>$()`\n\r\\]/;
+export function parseLeadingCommandName(command) {
+    const trimmed = command.trim();
+    if (!trimmed)
+        return { reject: "empty command" };
+    if (SHELL_OPERATORS.test(trimmed)) {
+        return {
+            reject: "shell operators (pipes, redirects, ;, &&, command substitution, subshells, variable expansion) are not allowed — run a single simple command",
+        };
+    }
+    const first = trimmed.split(/\s+/)[0];
+    if (first.includes("/"))
+        return { reject: "the command must be a bare name resolved via PATH (no path prefix)" };
+    if (first.includes("="))
+        return { reject: "leading environment-variable assignments are not allowed" };
+    if (/["'{}*?[\]~]/.test(first))
+        return { reject: "the command name must be a bare token (no quotes, braces, globs, or ~)" };
+    return { name: first };
+}
+export function coarseReadonlyCheck(command, allow) {
+    const parsed = parseLeadingCommandName(command);
+    if ("reject" in parsed)
+        return parsed.reject;
+    if (!allow.has(parsed.name))
+        return `command "${parsed.name}" is not in the read-only allowlist`;
+    return undefined;
+}
+const SHELL_SEGMENT_HARD_REJECT = /[<>$()`\n\r\\]/;
+export function classifyCompoundReadonly(command, allow) {
+    const trimmed = command.trim();
+    if (!trimmed)
+        return "empty command";
+    if (SHELL_SEGMENT_HARD_REJECT.test(trimmed)) {
+        return "redirection, command/variable substitution, subshells, escapes, and line breaks are not allowed";
+    }
+    const source = trimmed.endsWith(";") ? trimmed.slice(0, -1) : trimmed;
+    const segments = [];
+    const pipeFed = [false];
+    let cur = "";
+    for (let i = 0; i < source.length; i++) {
+        const c = source[i];
+        if (c === "&") {
+            if (source[i + 1] === "&") {
+                segments.push(cur);
+                cur = "";
+                pipeFed.push(false);
+                i++;
+            }
+            else
+                return "`&` backgrounding is not allowed — a backgrounded process outlives the command";
+        }
+        else if (c === "|") {
+            if (source[i + 1] === "|") {
+                segments.push(cur);
+                cur = "";
+                pipeFed.push(false);
+                i++;
+            }
+            else {
+                segments.push(cur);
+                cur = "";
+                pipeFed.push(true);
+            }
+        }
+        else if (c === ";") {
+            segments.push(cur);
+            cur = "";
+            pipeFed.push(false);
+        }
+        else
+            cur += c;
+    }
+    segments.push(cur);
+    for (const segment of segments) {
+        const reason = coarseReadonlyCheck(segment, allow);
+        if (reason !== undefined)
+            return reason;
+    }
+    const HEAD_AUTO_ALLOW_MAX = 1_000_000;
+    const headBoundIsSmall = (name, toks) => {
+        if (name !== "head")
+            return false;
+        let byteBound = false;
+        for (let k = 1; k < toks.length; k++) {
+            const t = toks[k];
+            if (!t.startsWith("-") || t === "-")
+                continue;
+            const inline = /^-[A-Za-z]*c(\d+)$/.exec(t) ?? /^--bytes=(\d+)$/.exec(t);
+            if (inline) {
+                if (Number(inline[1]) > HEAD_AUTO_ALLOW_MAX)
+                    return false;
+                byteBound = true;
+                continue;
+            }
+            if (/^-[A-Za-z]*c$/.test(t) || t === "--bytes") {
+                const v = toks[k + 1];
+                if (v === undefined || !/^\d+$/.test(v) || Number(v) > HEAD_AUTO_ALLOW_MAX)
+                    return false;
+                byteBound = true;
+                k++;
+                continue;
+            }
+            return false;
+        }
+        return byteBound;
+    };
+    const STDIN_FILE_FLOOR = { cat: 1, grep: 2, head: 1, tail: 1, wc: 1, cut: 1, tr: Infinity };
+    for (let si = 0; si < segments.length; si++) {
+        const toks = segments[si].trim().split(/\s+/).filter((t) => t.length > 0);
+        if (toks.length === 0)
+            continue;
+        const name = toks[0];
+        const nonOption = toks.slice(1).filter((t) => !t.startsWith("-"));
+        if (!(pipeFed[si] ?? false)) {
+            const floor = STDIN_FILE_FLOOR[name];
+            const restArgs = toks.slice(1);
+            const grepPatternSuppliedByFlag = name === "grep" && restArgs.some((t) => t === "-e" || t.startsWith("-e") || t === "-f" || t.startsWith("--regexp") || t.startsWith("--file"));
+            let sawNonFlagOperand = false;
+            let hasStdinDash = false;
+            if (name !== "tr") {
+                for (let k = 0; k < restArgs.length; k++) {
+                    const t = restArgs[k];
+                    if (name === "cut" && (t === "-d" || t === "--delimiter")) {
+                        k++;
+                        continue;
+                    }
+                    if (name === "grep" && (t === "-f-" || t === "--file=-")) {
+                        hasStdinDash = true;
+                        break;
+                    }
+                    if (t.startsWith("-") && t !== "-")
+                        continue;
+                    const isGrepPatternPosition = name === "grep" && !grepPatternSuppliedByFlag && !sawNonFlagOperand;
+                    sawNonFlagOperand = true;
+                    if (isGrepPatternPosition)
+                        continue;
+                    if (t === "-") {
+                        hasStdinDash = true;
+                        break;
+                    }
+                }
+            }
+            if (floor !== undefined && hasStdinDash) {
+                return `"${name}" reads stdin via an explicit "-" argument and would block until the tool timeout — not auto-allowed`;
+            }
+            if (floor !== undefined && nonOption.length < floor) {
+                return `"${name}" with no file argument reads stdin and would block until the tool timeout — not auto-allowed`;
+            }
+        }
+        if (name === "tail" && toks.slice(1).some((t) => t === "--follow" || t.startsWith("--follow=") || /^[-+][^\s]*[fF]/.test(t))) {
+            return "`tail` in follow mode never terminates — not auto-allowed";
+        }
+        const GENERATOR_DEVICES = new Set(["/dev/zero", "/dev/random", "/dev/urandom", "/dev/full"]);
+        const deviceArgs = toks.slice(1).filter((t) => !t.startsWith("-")).map(normalizeAbsPathLexically).filter(isBlockedDevicePath);
+        const rescuedByHead = headBoundIsSmall(name, toks) && deviceArgs.every((d) => GENERATOR_DEVICES.has(d));
+        if (!rescuedByHead && deviceArgs.length > 0) {
+            return "an unbounded device source (/dev/zero, /dev/stdin, /proc/<pid>/fd/0, …) would block the pipeline until the tool timeout — not auto-allowed";
+        }
+    }
+    return undefined;
+}

package/dist/tools/fs/encoding.d.ts

@@ -13,3 +13,8 @@ export declare function detectFileEncoding(bytes: Uint8Array): DetectedFileEncod
 export declare function decodeTextBytes(bytes: Uint8Array): DecodedTextFile;
 export declare function encodeTextForFile(text: string, encoding: DetectedFileEncoding, endings: DetectedLineEndings | "preserve"): string | Uint8Array;
 export declare function normalizeEditText(s: string): string;
+export declare function splitLeadingBom(text: string): {
+    hadBom: boolean;
+    text: string;
+};
+export declare function normalizeFileText(s: string): string;

package/dist/tools/fs/encoding.js

@@ -41,3 +41,9 @@ export function encodeTextForFile(text, encoding, endings) {
 export function normalizeEditText(s) {
     return s.replaceAll("\r\n", "\n");
 }
+export function splitLeadingBom(text) {
+    return text.charCodeAt(0) === 0xfeff ? { hadBom: true, text: text.slice(1) } : { hadBom: false, text };
+}
+export function normalizeFileText(s) {
+    return normalizeEditText(splitLeadingBom(s).text);
+}

package/dist/tools/fs/fs-bash.d.ts

@@ -0,0 +1,31 @@
+import type { AgentTool, ExecutionEnv } from "../../internal/harness-types.js";
+import { type TaskRegistry } from "../../core/task-registry.js";
+import { type CwdRef } from "./fs-shared.js";
+export declare function bashReversibilityProbe(allow?: readonly string[]): (args: unknown) => {
+    reversible: boolean;
+};
+export interface ExecClampOption {
+    deadlineMs: () => number | undefined;
+    onClamp?: (requestedSec: number, clampedSec: number) => void;
+    registerKillHandle?: (toolCallId: string, handle: {
+        pid: number;
+        kill: () => void;
+    }) => () => void;
+}
+export declare function bashExitOneInterpretation(command: string): string | undefined;
+export declare function canAutoBackground(command: string): boolean;
+export declare function createBashTool(env: ExecutionEnv, rootCanonical: string, coAuthor?: string | false, cwdRef?: CwdRef, taskOpts?: {
+    taskRegistry?: TaskRegistry;
+    taskOwner?: string;
+    taskScope?: string;
+    sessionId?: string;
+    onTaskNotification?: (n: import("../../core/task-notification.js").TaskNotificationPayload, opts?: {
+        priority?: "now" | "next" | "later";
+    }) => void;
+    detachHub?: import("../../core/tool-detach.js").ToolDetachHub;
+    execClamp?: ExecClampOption;
+    autoBackgroundOnTimeout?: boolean;
+}): AgentTool;
+export declare function createBashReadonlyTool(env: ExecutionEnv, rootCanonical: string, allow: ReadonlySet<string>, execClamp?: ExecClampOption): AgentTool;
+export declare function createEnvTaskOutputTool(env: ExecutionEnv): AgentTool;
+export declare function createEnvTaskStopTool(env: ExecutionEnv, registry?: TaskRegistry): AgentTool;