@sema-agent/core 1.452.0 → 2.0.0

package/dist/stores/file/workflow-run-store.js

@@ -1,95 +1,40 @@
 import { join } from "node:path";
 import { WorkflowRunStoreError, isTerminalWorkflowStatus, summarizeWorkflowRun, } from "../../core/workflow-run-store.js";
-import { canonicalStoreKey, AppendLog, atomicWriteFile, ensureDir, readJsonlRecords } from "./fs-atomic.js";
-const sharedRunDirs = new Map();
+import { SharedLedgerTable } from "./shared-ledger.js";
+const runLedgers = new SharedLedgerTable({
+    keyOf: (run) => run.id,
+    apply: (runs, ev) => {
+        if (ev.t === "delete") {
+            runs.delete(ev.id);
+            return;
+        }
+        runs.set(ev.id, ev.run);
+    },
+});
 export class FileWorkflowRunStore {
-    dir;
-    tmpDir;
-    ledgerPath;
-    snapshotPath;
     fsyncEnabled;
     compactEvery;
-    shared;
+    ledger;
     closed = false;
-    canonicalDir;
     get runs() {
-        return this.shared.runs;
-    }
-    get locks() {
-        return this.shared.locks;
-    }
-    get ledgerEvents() {
-        return this.shared.ledgerEvents;
-    }
-    set ledgerEvents(v) {
-        this.shared.ledgerEvents = v;
-    }
-    get log() {
-        return this.shared.log;
-    }
-    set log(v) {
-        this.shared.log = v;
+        return this.ledger.rows;
     }
     constructor(root, opts = {}) {
-        this.dir = join(root, "workflow-runs");
-        this.tmpDir = join(root, "tmp");
-        this.ledgerPath = join(this.dir, "runs.jsonl");
-        this.snapshotPath = join(this.dir, "runs.snapshot.jsonl");
         this.fsyncEnabled = opts.fsync !== false;
         this.compactEvery = opts.compactEvery ?? 1000;
-        ensureDir(this.dir);
-        ensureDir(this.tmpDir);
-        const canonical = canonicalStoreKey(this.dir);
-        this.canonicalDir = canonical;
-        const existing = sharedRunDirs.get(canonical);
-        if (existing !== undefined) {
-            existing.refs += 1;
-            this.shared = existing;
-            return;
-        }
-        this.shared = { runs: new Map(), locks: new Map(), ledgerEvents: 0, log: undefined, refs: 1 };
-        sharedRunDirs.set(canonical, this.shared);
-        this.replay();
-        this.log = new AppendLog(this.ledgerPath);
-    }
-    replay() {
-        for (const snap of readJsonlRecords(this.snapshotPath)) {
-            this.runs.set(snap.id, snap);
-        }
-        const events = readJsonlRecords(this.ledgerPath);
-        this.ledgerEvents = events.length;
-        for (const ev of events)
-            this.applyEvent(ev);
-    }
-    applyEvent(ev) {
-        if (ev.t === "delete") {
-            this.runs.delete(ev.id);
-            return;
-        }
-        this.runs.set(ev.id, ev.run);
+        const dir = join(root, "workflow-runs");
+        this.ledger = runLedgers.acquire({
+            dir,
+            tmpDir: join(root, "tmp"),
+            ledgerPath: join(dir, "runs.jsonl"),
+            snapshotPath: join(dir, "runs.snapshot.jsonl"),
+        });
     }
     withLock(id, fn) {
-        const prev = this.locks.get(id) ?? Promise.resolve();
-        const run = prev.then(() => fn(), () => fn());
-        const tail = run.then(() => { }, () => { });
-        this.locks.set(id, tail);
-        void tail.then(() => {
-            if (this.locks.get(id) === tail)
-                this.locks.delete(id);
-        });
-        return run;
+        return this.ledger.withLock(id, fn);
     }
     commit(ev, fsync) {
-        this.log.append(ev, fsync);
-        this.applyEvent(ev);
-        this.ledgerEvents++;
-        if (this.ledgerEvents >= this.compactEvery) {
-            try {
-                this.compact();
-            }
-            catch {
-            }
-        }
+        this.ledger.commit(ev, fsync, this.compactEvery);
     }
     async put(id, run) {
         return this.withLock(id, () => {
@@ -161,15 +106,8 @@ export class FileWorkflowRunStore {
         }
         return n;
     }
-    compact() {
-        const lines = [...this.runs.values()].map((r) => JSON.stringify(r)).join("\n");
-        atomicWriteFile(this.tmpDir, this.snapshotPath, lines.length ? `${lines}\n` : "");
-        this.log.closeForSwap();
-        atomicWriteFile(this.tmpDir, this.ledgerPath, "");
-        this.ledgerEvents = 0;
-    }
     compactNow() {
-        this.compact();
+        this.ledger.compact();
     }
     get size() {
         return this.runs.size;
@@ -178,13 +116,6 @@ export class FileWorkflowRunStore {
         if (this.closed)
             return;
         this.closed = true;
-        const st = sharedRunDirs.get(this.canonicalDir);
-        if (st !== undefined && st === this.shared) {
-            st.refs -= 1;
-            if (st.refs > 0)
-                return;
-            sharedRunDirs.delete(this.canonicalDir);
-        }
-        this.log.close();
+        this.ledger.release();
     }
 }

package/dist/tools/fs/bash-readonly-classifier.d.ts

@@ -0,0 +1,8 @@
+export declare const BASH_READONLY_DEFAULT_ALLOW: readonly string[];
+export declare function parseLeadingCommandName(command: string): {
+    name: string;
+} | {
+    reject: string;
+};
+export declare function coarseReadonlyCheck(command: string, allow: ReadonlySet<string>): string | undefined;
+export declare function classifyCompoundReadonly(command: string, allow: ReadonlySet<string>): string | undefined;

package/dist/tools/fs/bash-readonly-classifier.js

@@ -0,0 +1,166 @@
+import { isBlockedDevicePath, normalizeAbsPathLexically } from "./safety.js";
+export const BASH_READONLY_DEFAULT_ALLOW = [
+    "ls", "cat", "head", "tail", "wc", "pwd", "echo", "whoami", "uname",
+    "grep", "cut", "tr", "basename", "dirname", "stat", "du", "df", "which",
+];
+const SHELL_OPERATORS = /[;&|<>$()`\n\r\\]/;
+export function parseLeadingCommandName(command) {
+    const trimmed = command.trim();
+    if (!trimmed)
+        return { reject: "empty command" };
+    if (SHELL_OPERATORS.test(trimmed)) {
+        return {
+            reject: "shell operators (pipes, redirects, ;, &&, command substitution, subshells, variable expansion) are not allowed — run a single simple command",
+        };
+    }
+    const first = trimmed.split(/\s+/)[0];
+    if (first.includes("/"))
+        return { reject: "the command must be a bare name resolved via PATH (no path prefix)" };
+    if (first.includes("="))
+        return { reject: "leading environment-variable assignments are not allowed" };
+    if (/["'{}*?[\]~]/.test(first))
+        return { reject: "the command name must be a bare token (no quotes, braces, globs, or ~)" };
+    return { name: first };
+}
+export function coarseReadonlyCheck(command, allow) {
+    const parsed = parseLeadingCommandName(command);
+    if ("reject" in parsed)
+        return parsed.reject;
+    if (!allow.has(parsed.name))
+        return `command "${parsed.name}" is not in the read-only allowlist`;
+    return undefined;
+}
+const SHELL_SEGMENT_HARD_REJECT = /[<>$()`\n\r\\]/;
+export function classifyCompoundReadonly(command, allow) {
+    const trimmed = command.trim();
+    if (!trimmed)
+        return "empty command";
+    if (SHELL_SEGMENT_HARD_REJECT.test(trimmed)) {
+        return "redirection, command/variable substitution, subshells, escapes, and line breaks are not allowed";
+    }
+    const source = trimmed.endsWith(";") ? trimmed.slice(0, -1) : trimmed;
+    const segments = [];
+    const pipeFed = [false];
+    let cur = "";
+    for (let i = 0; i < source.length; i++) {
+        const c = source[i];
+        if (c === "&") {
+            if (source[i + 1] === "&") {
+                segments.push(cur);
+                cur = "";
+                pipeFed.push(false);
+                i++;
+            }
+            else
+                return "`&` backgrounding is not allowed — a backgrounded process outlives the command";
+        }
+        else if (c === "|") {
+            if (source[i + 1] === "|") {
+                segments.push(cur);
+                cur = "";
+                pipeFed.push(false);
+                i++;
+            }
+            else {
+                segments.push(cur);
+                cur = "";
+                pipeFed.push(true);
+            }
+        }
+        else if (c === ";") {
+            segments.push(cur);
+            cur = "";
+            pipeFed.push(false);
+        }
+        else
+            cur += c;
+    }
+    segments.push(cur);
+    for (const segment of segments) {
+        const reason = coarseReadonlyCheck(segment, allow);
+        if (reason !== undefined)
+            return reason;
+    }
+    const HEAD_AUTO_ALLOW_MAX = 1_000_000;
+    const headBoundIsSmall = (name, toks) => {
+        if (name !== "head")
+            return false;
+        let byteBound = false;
+        for (let k = 1; k < toks.length; k++) {
+            const t = toks[k];
+            if (!t.startsWith("-") || t === "-")
+                continue;
+            const inline = /^-[A-Za-z]*c(\d+)$/.exec(t) ?? /^--bytes=(\d+)$/.exec(t);
+            if (inline) {
+                if (Number(inline[1]) > HEAD_AUTO_ALLOW_MAX)
+                    return false;
+                byteBound = true;
+                continue;
+            }
+            if (/^-[A-Za-z]*c$/.test(t) || t === "--bytes") {
+                const v = toks[k + 1];
+                if (v === undefined || !/^\d+$/.test(v) || Number(v) > HEAD_AUTO_ALLOW_MAX)
+                    return false;
+                byteBound = true;
+                k++;
+                continue;
+            }
+            return false;
+        }
+        return byteBound;
+    };
+    const STDIN_FILE_FLOOR = { cat: 1, grep: 2, head: 1, tail: 1, wc: 1, cut: 1, tr: Infinity };
+    for (let si = 0; si < segments.length; si++) {
+        const toks = segments[si].trim().split(/\s+/).filter((t) => t.length > 0);
+        if (toks.length === 0)
+            continue;
+        const name = toks[0];
+        const nonOption = toks.slice(1).filter((t) => !t.startsWith("-"));
+        if (!(pipeFed[si] ?? false)) {
+            const floor = STDIN_FILE_FLOOR[name];
+            const restArgs = toks.slice(1);
+            const grepPatternSuppliedByFlag = name === "grep" && restArgs.some((t) => t === "-e" || t.startsWith("-e") || t === "-f" || t.startsWith("--regexp") || t.startsWith("--file"));
+            let sawNonFlagOperand = false;
+            let hasStdinDash = false;
+            if (name !== "tr") {
+                for (let k = 0; k < restArgs.length; k++) {
+                    const t = restArgs[k];
+                    if (name === "cut" && (t === "-d" || t === "--delimiter")) {
+                        k++;
+                        continue;
+                    }
+                    if (name === "grep" && (t === "-f-" || t === "--file=-")) {
+                        hasStdinDash = true;
+                        break;
+                    }
+                    if (t.startsWith("-") && t !== "-")
+                        continue;
+                    const isGrepPatternPosition = name === "grep" && !grepPatternSuppliedByFlag && !sawNonFlagOperand;
+                    sawNonFlagOperand = true;
+                    if (isGrepPatternPosition)
+                        continue;
+                    if (t === "-") {
+                        hasStdinDash = true;
+                        break;
+                    }
+                }
+            }
+            if (floor !== undefined && hasStdinDash) {
+                return `"${name}" reads stdin via an explicit "-" argument and would block until the tool timeout — not auto-allowed`;
+            }
+            if (floor !== undefined && nonOption.length < floor) {
+                return `"${name}" with no file argument reads stdin and would block until the tool timeout — not auto-allowed`;
+            }
+        }
+        if (name === "tail" && toks.slice(1).some((t) => t === "--follow" || t.startsWith("--follow=") || /^[-+][^\s]*[fF]/.test(t))) {
+            return "`tail` in follow mode never terminates — not auto-allowed";
+        }
+        const GENERATOR_DEVICES = new Set(["/dev/zero", "/dev/random", "/dev/urandom", "/dev/full"]);
+        const deviceArgs = toks.slice(1).filter((t) => !t.startsWith("-")).map(normalizeAbsPathLexically).filter(isBlockedDevicePath);
+        const rescuedByHead = headBoundIsSmall(name, toks) && deviceArgs.every((d) => GENERATOR_DEVICES.has(d));
+        if (!rescuedByHead && deviceArgs.length > 0) {
+            return "an unbounded device source (/dev/zero, /dev/stdin, /proc/<pid>/fd/0, …) would block the pipeline until the tool timeout — not auto-allowed";
+        }
+    }
+    return undefined;
+}

package/dist/tools/fs/fs-bash.d.ts

@@ -0,0 +1,31 @@
+import type { AgentTool, ExecutionEnv } from "../../internal/harness-types.js";
+import { type TaskRegistry } from "../../core/task-registry.js";
+import { type CwdRef } from "./fs-shared.js";
+export declare function bashReversibilityProbe(allow?: readonly string[]): (args: unknown) => {
+    reversible: boolean;
+};
+export interface ExecClampOption {
+    deadlineMs: () => number | undefined;
+    onClamp?: (requestedSec: number, clampedSec: number) => void;
+    registerKillHandle?: (toolCallId: string, handle: {
+        pid: number;
+        kill: () => void;
+    }) => () => void;
+}
+export declare function bashExitOneInterpretation(command: string): string | undefined;
+export declare function canAutoBackground(command: string): boolean;
+export declare function createBashTool(env: ExecutionEnv, rootCanonical: string, coAuthor?: string | false, cwdRef?: CwdRef, taskOpts?: {
+    taskRegistry?: TaskRegistry;
+    taskOwner?: string;
+    taskScope?: string;
+    sessionId?: string;
+    onTaskNotification?: (n: import("../../core/task-notification.js").TaskNotificationPayload, opts?: {
+        priority?: "now" | "next" | "later";
+    }) => void;
+    detachHub?: import("../../core/tool-detach.js").ToolDetachHub;
+    execClamp?: ExecClampOption;
+    autoBackgroundOnTimeout?: boolean;
+}): AgentTool;
+export declare function createBashReadonlyTool(env: ExecutionEnv, rootCanonical: string, allow: ReadonlySet<string>, execClamp?: ExecClampOption): AgentTool;
+export declare function createEnvTaskOutputTool(env: ExecutionEnv): AgentTool;
+export declare function createEnvTaskStopTool(env: ExecutionEnv, registry?: TaskRegistry): AgentTool;