@sema-agent/core 5.43.0 → 5.45.0

package/dist/tools/fs/search.js

@@ -1,6 +1,6 @@
 import { delimitUntrusted } from "../../core/untrusted-text.js";
 import { MAX_EXEC_OUTPUT_BYTES } from "../../core/exec-output-tail.js";
-import { hasBinaryExtension, isAbsolutePathForm } from "./safety.js";
+import { hasBinaryExtension, isAbsolutePathForm, isWinFormPath } from "./safety.js";
 const WALK_MAX_FILES = 5000;
 const WALK_MAX_DEPTH = 32;
 const GREP_DEFAULT_CAP = 250;
@@ -35,6 +35,25 @@ const TYPE_GLOBS = {
     css: "*.{css,scss,less}",
 };
 const basename = (p) => p.slice(Math.max(p.lastIndexOf("/"), p.lastIndexOf("\\")) + 1);
+function collapseDotSegments(p) {
+    const win = isWinFormPath(p);
+    const lead = (win ? /^[\\/]*/ : /^\/*/).exec(p)?.[0] ?? "";
+    const sep = win ? "\\" : "/";
+    const parts = p.slice(lead.length).split(win ? /[\\/]+/ : /\/+/);
+    const floor = !win ? 0 : lead.length >= 2 ? 2 : /^[A-Za-z]:$/.test(parts[0] ?? "") ? 1 : 0;
+    const kept = [];
+    for (const part of parts) {
+        if (part === "" || part === ".")
+            continue;
+        if (part === "..") {
+            if (kept.length > floor)
+                kept.pop();
+            continue;
+        }
+        kept.push(part);
+    }
+    return kept.length === 0 ? "" : lead + kept.join(sep);
+}
 const NO_MATCHES = "No matches.";
 const GREP_LINE_CLIP = 500;
 function clipLine(line) {
@@ -759,10 +778,10 @@ function multilineSpans(content, p, captureText = false, deadline = Infinity) {
     }
     return spans;
 }
-export async function jsGrep(env, root, p, signal, guards, deny, denyOut) {
+export async function jsGrepDetailed(env, root, p, signal, guards, deny, denyOut) {
     const analysis = analyzeRedos(p.pattern, p.ignore_case === true);
     if (analysis.risk)
-        return redosRejection(analysis.risk);
+        return { text: redosRejection(analysis.risk) };
     const budgetMs = guards?.budgetMs ?? GREP_FILE_BUDGET_MS;
     const longLineLimit = guards?.longLineLimit ?? GREP_GRAY_LINE_MAX;
     const grayPattern = analysis.quantifiedGroup || analysis.unboundedCount >= 2;
@@ -776,7 +795,7 @@ export async function jsGrep(env, root, p, signal, guards, deny, denyOut) {
         test = compilePattern(p);
     }
     catch (e) {
-        return `Error (grep): invalid regex: ${e instanceof Error ? e.message : String(e)}`;
+        return { text: `Error (grep): invalid regex: ${e instanceof Error ? e.message : String(e)}` };
     }
     const ignore = await buildIgnore(env, root, signal);
     const rootPrefix = root.replace(/[\\/]+$/, "") + (root.includes("\\") ? "\\" : "/");
@@ -816,9 +835,20 @@ export async function jsGrep(env, root, p, signal, guards, deny, denyOut) {
     const cap = p.head_limit === 0 ? Infinity : Math.max(1, Math.floor(p.head_limit ?? GREP_DEFAULT_CAP));
     const mode = p.output_mode ?? "files_with_matches";
     const rel = (abs) => (abs.startsWith(rootPrefix) ? abs.slice(rootPrefix.length) : abs);
+    const startWin = isWinFormPath(start);
+    const startNorm = collapseDotSegments(start);
+    const targetSpell = p.path ? p.path.replace(startWin ? /[\\/]+$/ : /\/+$/, "") : "";
+    const isBoundary = (c) => c === "/" || (startWin && c === "\\");
     const relOut = (abs) => {
-        const r = rel(abs);
-        return p.path || r === abs ? r : `./${r}`;
+        if (!p.path) {
+            const r = rel(abs);
+            return r === abs ? r : `./${r}`;
+        }
+        if (abs === startNorm || abs === start)
+            return targetSpell;
+        if (abs.startsWith(startNorm) && isBoundary(abs[startNorm.length]))
+            return targetSpell + abs.slice(startNorm.length);
+        return rel(abs);
     };
     if (p.glob) {
         const globRes = splitGlobParam(p.glob).map((g) => globTokenToRegExp(normalizeGlobToken(g), globIsAnchored(g), true));
@@ -846,7 +876,7 @@ export async function jsGrep(env, root, p, signal, guards, deny, denyOut) {
     let outBytes = 0;
     let outputTruncated = false;
     let rowsBeforeWindow = 0;
-    const pushRow = (row) => {
+    const pushRow = (row, path) => {
         if (outputTruncated)
             return;
         if (rowsBeforeWindow < off) {
@@ -861,7 +891,7 @@ export async function jsGrep(env, root, p, signal, guards, deny, denyOut) {
             return;
         }
         outBytes += size;
-        out.push(row);
+        out.push({ path, text: row });
     };
     const fileMatches = [];
     const counts = [];
@@ -889,6 +919,7 @@ export async function jsGrep(env, root, p, signal, guards, deny, denyOut) {
         const lines = read.value.split("\n");
         if (lines.length > 1 && lines.at(-1) === "")
             lines.pop();
+        const shownPath = relOut(f);
         let fileCount = 0;
         const fileMatchStart = monotonicNow();
         if (p.multiline) {
@@ -902,8 +933,8 @@ export async function jsGrep(env, root, p, signal, guards, deny, denyOut) {
             }
             catch (e) {
                 if (e instanceof GrepBudgetExceeded)
-                    return budgetError(relOut(f), monotonicNow() - fileMatchStart);
-                return `Error (grep): invalid regex: ${e instanceof Error ? e.message : String(e)}`;
+                    return { text: budgetError(shownPath, monotonicNow() - fileMatchStart) };
+                return { text: `Error (grep): invalid regex: ${e instanceof Error ? e.message : String(e)}` };
             }
             fileCount = spans.length;
             if (mode === "content") {
@@ -911,12 +942,12 @@ export async function jsGrep(env, root, p, signal, guards, deny, denyOut) {
                     if (p.only_matching && text !== undefined) {
                         const parts = text.split("\n");
                         for (let k = 0; k < parts.length; k++) {
-                            pushRow(`${relOut(f)}:${s + k}:${clipLine(parts[k])}`);
+                            pushRow(`${shownPath}:${s + k}:${clipLine(parts[k])}`, shownPath);
                         }
                         continue;
                     }
                     for (let j = Math.max(0, s - 1 - ctxB); j <= Math.min(lines.length - 1, eL - 1 + ctxA); j++) {
-                        pushRow(`${relOut(f)}:${j + 1}:${clipLine(lines[j])}`);
+                        pushRow(`${shownPath}:${j + 1}:${clipLine(lines[j])}`, shownPath);
                     }
                 }
             }
@@ -926,7 +957,7 @@ export async function jsGrep(env, root, p, signal, guards, deny, denyOut) {
                 if (grayPattern || (i > 0 && i % GREP_LINE_CHECK_EVERY === 0)) {
                     const elapsed = monotonicNow() - fileMatchStart;
                     if (elapsed >= budgetMs)
-                        return budgetError(relOut(f), elapsed);
+                        return { text: budgetError(shownPath, elapsed) };
                 }
                 if (i > 0 && i % GREP_LINE_CHECK_EVERY === 0) {
                     await yieldEventLoop();
@@ -945,16 +976,16 @@ export async function jsGrep(env, root, p, signal, guards, deny, denyOut) {
                 if (mode === "content") {
                     if (p.only_matching) {
                         for (const part of matchedParts(lines[i], p)) {
-                            pushRow(`${relOut(f)}:${i + 1}:${clipLine(part)}`);
+                            pushRow(`${shownPath}:${i + 1}:${clipLine(part)}`, shownPath);
                         }
                     }
                     else if (ctx > 0) {
                         for (let j = Math.max(0, i - ctxB); j <= Math.min(lines.length - 1, i + ctxA); j++) {
-                            pushRow(`${relOut(f)}:${j + 1}:${clipLine(lines[j])}`);
+                            pushRow(`${shownPath}:${j + 1}:${clipLine(lines[j])}`, shownPath);
                         }
                     }
                     else {
-                        pushRow(`${relOut(f)}:${i + 1}:${clipLine(lines[i])}`);
+                        pushRow(`${shownPath}:${i + 1}:${clipLine(lines[i])}`, shownPath);
                     }
                 }
             }
@@ -968,7 +999,7 @@ export async function jsGrep(env, root, p, signal, guards, deny, denyOut) {
             if (mode === "files_with_matches")
                 fileMatches.push(f);
             else if (mode === "count" && counts.length < collectCap)
-                counts.push(`${relOut(f)}:${fileCount}`);
+                counts.push({ path: shownPath, text: `${shownPath}:${fileCount}` });
         }
     }
     if (scanAborted || skippedUnreadableFiles > 0 || skippedLongLines > 0 || multilineSkippedFiles > 0) {
@@ -988,7 +1019,7 @@ export async function jsGrep(env, root, p, signal, guards, deny, denyOut) {
         }
     }
     const caveat = honestyCaveat + denyNote;
-    const paged = (arr) => (off > 0 ? arr.slice(off, off + cap) : arr);
+    const paged = (arr) => (off > 0 ? arr.slice(off, off + cap) : [...arr]);
     const offNote = off > 0 ? `\n[offset ${off}]` : "";
     if (mode === "files_with_matches") {
         const haveMtimes = fileMatches.length > 0 && fileMatches.every((f) => walked.mtimes.has(f));
@@ -999,26 +1030,37 @@ export async function jsGrep(env, root, p, signal, guards, deny, denyOut) {
                 .map((x) => x.r)
             : fileMatches.map(relOut).sort();
         const body = sortedFileMatches.slice(off, off + cap);
-        return body.length === 0
-            ? NO_MATCHES + offNote + typeNote + caveat
-            : body.join("\n") + (totalFiles > off + cap ? `\n…[capped at ${cap} of ${totalFiles}]` : "") + offNote + typeNote + caveat;
+        const rows = body.map((r) => ({ path: r, text: r }));
+        return {
+            text: body.length === 0
+                ? NO_MATCHES + offNote + typeNote + caveat
+                : body.join("\n") + (totalFiles > off + cap ? `\n…[capped at ${cap} of ${totalFiles}]` : "") + offNote + typeNote + caveat,
+            rows,
+        };
     }
     if (mode === "count") {
         const body = paged(counts);
-        return body.length === 0
-            ? NO_MATCHES + offNote + typeNote + caveat
-            : body.join("\n") + (totalFiles > off + cap ? `\n…[capped at ${cap} of ${totalFiles}]` : "") + offNote + typeNote + caveat;
+        return {
+            text: body.length === 0
+                ? NO_MATCHES + offNote + typeNote + caveat
+                : body.map((r) => r.text).join("\n") + (totalFiles > off + cap ? `\n…[capped at ${cap} of ${totalFiles}]` : "") + offNote + typeNote + caveat,
+            rows: body,
+        };
     }
     const body = out;
     const byteNote = outputTruncated ? `\n…[output truncated at ${outputMaxBytes} bytes — narrow the pattern or set a smaller head_limit]` : "";
     if (body.length === 0)
-        return NO_MATCHES + byteNote + offNote + typeNote + caveat;
+        return { text: NO_MATCHES + byteNote + offNote + typeNote + caveat, rows: [] };
+    const bodyText = body.map((r) => r.text).join("\n");
     if (out.length < cap)
-        return body.join("\n") + byteNote + offNote + typeNote + caveat;
+        return { text: bodyText + byteNote + offNote + typeNote + caveat, rows: body };
     const marker = ctx > 0 || p.multiline || p.only_matching
         ? `\n…[capped at ${cap}; ${totalContent}+ match(es) found, more output omitted]`
         : `\n…[capped at ${cap} of ${totalContent}]`;
-    return body.join("\n") + marker + byteNote + offNote + typeNote + caveat;
+    return { text: bodyText + marker + byteNote + offNote + typeNote + caveat, rows: body };
+}
+export async function jsGrep(env, root, p, signal, guards, deny, denyOut) {
+    return (await jsGrepDetailed(env, root, p, signal, guards, deny, denyOut)).text;
 }
 const rgCache = new WeakMap();
 export function detectRipgrep(env) {
@@ -1124,23 +1166,25 @@ export function rgOutputDenyTripwire(stdout, mode, judge, opts = {}) {
 }
 async function jsGrepDenyTripFallback(env, root, p, signal, trip, deny) {
     const denyOut = {};
-    const text = await jsGrep(env, root, p, signal, undefined, deny, denyOut);
+    const { text, rows } = await jsGrepDetailed(env, root, p, signal, undefined, deny, denyOut);
     const why = trip.reason === "deny-hit" ? "its output involved sensitive-path deny-listed entries the exclusion globs cannot express" : "its output contained a record the line format cannot account for";
     return {
         text: text.startsWith("Error (grep)")
             ? text
             : `${text}\n[note: the ripgrep pass was abandoned (${why}); results are from the fallback scanner, which prunes with the authoritative deny judge]`,
+        ...(rows !== undefined ? { rows } : {}),
         degraded: { fallback: "js-scan", reason: `ripgrep output tripped the deny tripwire (${trip.reason})` },
         ...(denyOut.withheld !== undefined ? { withheld: denyOut.withheld } : {}),
     };
 }
 async function jsGrepFallback(env, root, p, signal, reason, deny) {
     const denyOut = {};
-    const text = await jsGrep(env, root, p, signal, undefined, deny, denyOut);
+    const { text, rows } = await jsGrepDetailed(env, root, p, signal, undefined, deny, denyOut);
     return {
         text: text.startsWith("Error (grep)")
             ? text
             : `${text}\n[note: ripgrep failed (${reason}); results are from a fallback scanner]`,
+        ...(rows !== undefined ? { rows } : {}),
         degraded: { fallback: "js-scan", reason: `ripgrep failed (${reason})` },
         ...(denyOut.withheld !== undefined ? { withheld: denyOut.withheld } : {}),
     };
@@ -1288,8 +1332,8 @@ export async function runGrepDetailed(env, root, p, signal, deny) {
     if (await detectRipgrep(env))
         return rgGrepDetailed(env, root, p, signal, deny);
     const denyOut = {};
-    const text = await jsGrep(env, root, p, signal, undefined, deny, denyOut);
-    return { text, ...(denyOut.withheld !== undefined ? { withheld: denyOut.withheld } : {}) };
+    const { text, rows } = await jsGrepDetailed(env, root, p, signal, undefined, deny, denyOut);
+    return { text, ...(rows !== undefined ? { rows } : {}), ...(denyOut.withheld !== undefined ? { withheld: denyOut.withheld } : {}) };
 }
 export async function runGrep(env, root, p, signal) {
     return (await runGrepDetailed(env, root, p, signal)).text;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sema-agent/core",
-  "version": "5.43.0",
+  "version": "5.45.0",
   "description": "Stateless, task-oriented AI agent core",
   "type": "module",
   "license": "BUSL-1.1",
@@ -65,7 +65,8 @@
     "gate:single-mint": "node scripts/verify-single-mint.mjs",
     "gate:nuia": "node scripts/verify-nuia-baseline.mjs",
     "gate:field-liveness": "node scripts/verify-field-liveness.mjs",
-    "gate:error-surface": "node scripts/verify-error-surface.mjs"
+    "gate:error-surface": "node scripts/verify-error-surface.mjs",
+    "gate:criteria": "node scripts/criteria-lint.mjs"
   },
   "dependencies": {
     "@modelcontextprotocol/sdk": "1.30.0",