@sema-agent/core 7.27.0 → 7.28.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/CHANGELOG.md +25 -0
- package/dist/agents/builtin-agents.d.ts +6 -15
- package/dist/agents/cascade.d.ts +29 -33
- package/dist/agents/observer.d.ts +18 -20
- package/dist/agents/subagent.d.ts +58 -70
- package/dist/agents/tool-filter.d.ts +10 -12
- package/dist/agents/verify.d.ts +44 -49
- package/dist/brain/input-too-long.d.ts +10 -12
- package/dist/brain/media-degrade.d.ts +4 -5
- package/dist/brain/reasoning.d.ts +10 -12
- package/dist/brain/repetition.d.ts +7 -9
- package/dist/brain/request-params.d.ts +20 -25
- package/dist/brain/route-adjudicator.d.ts +4 -4
- package/dist/brain/route-conformance.d.ts +2 -2
- package/dist/brain/status-sink.d.ts +12 -14
- package/dist/brain/terminal-cause.d.ts +12 -15
- package/dist/brain/timeout.d.ts +17 -19
- package/dist/core/memory-engine/consolidation.d.ts +11 -15
- package/dist/core/memory-engine/engine.d.ts +45 -54
- package/dist/core/memory-engine/tools.d.ts +17 -23
- package/dist/core/permission-rule-model.js +5 -3
- package/dist/shell/lex.d.ts +279 -0
- package/dist/shell/lex.js +1253 -0
- package/dist/tools/fs/bash-program-position.d.ts +2 -4
- package/dist/tools/fs/bash-program-position.js +2 -1
- package/dist/tools/fs/bash-readonly-classifier.d.ts +2 -2
- package/dist/tools/fs/bash-readonly-classifier.js +1 -1
- package/dist/tools/fs/shell-read-check.js +1 -1
- package/dist/tools/fs/shell-read-establish.js +11 -1
- package/dist/tools/fs/shell-read-plan.d.ts +7 -2
- package/dist/tools/fs/shell-read-plan.js +48 -10
- package/package.json +2 -2
- package/wire-changes/core@7.28.0.json +594 -0
- package/dist/tools/fs/bash-lexer.d.ts +0 -152
- package/dist/tools/fs/bash-lexer.js +0 -627
|
@@ -1,152 +0,0 @@
|
|
|
1
|
-
/**
|
|
2
|
-
* The ONE shell lexer of the read faces, in two modes.
|
|
3
|
-
*
|
|
4
|
-
* STRICT is the residual space the classify faces live in: the caller has hard-rejected `< > $ ( ) \` \n \r \\`
|
|
5
|
-
* (or, under the rule lane's tolerate option, passes `<`/`>` through as ordinary text), so the whole of bash's
|
|
6
|
-
* word grammar left to model is quote pairing, the four connectors and whitespace. LENIENT is the space the
|
|
7
|
-
* refused-command whitelist reads — everything the strict gate refused, RECORDED instead of refused: heredoc
|
|
8
|
-
* bodies, substitution bodies, redirections, comments, escapes, line continuations, subshell groups,
|
|
9
|
-
* backgrounding, line breaks.
|
|
10
|
-
*
|
|
11
|
-
* One walker serves both. The lenient-only constructs are branches the strict caller can never reach (their
|
|
12
|
-
* characters are gone before it calls), so for every strict-accepted input the two modes produce the same words
|
|
13
|
-
* and the same connectors — up to the strict mode's own two residuals (a `#` is a word there, and JS whitespace
|
|
14
|
-
* rather than bash's blanks bounds a word); the whitelist stopped being a second parser the day it read this stream.
|
|
15
|
-
*
|
|
16
|
-
* Quoting. A quote character opens a region, the matching one closes it, and a quote of the OTHER kind inside an
|
|
17
|
-
* open region is ordinary text. When a region is still open at the end of the input the pass is re-run with
|
|
18
|
-
* quotes as ordinary characters — the QUOTE-BLIND reading, which yields strictly more words and more segments
|
|
19
|
-
* (the fail-closed direction every consumer here errs in). {@link quoteMask} is the positional projection of the
|
|
20
|
-
* same rule, for the callers that need "is this character quoted" rather than tokens.
|
|
21
|
-
*
|
|
22
|
-
* Line continuations. Bash removes a `\<newline>` pair from its input before it recognises anything — except
|
|
23
|
-
* inside single quotes, inside a comment (the newline ends the comment) and inside a QUOTED here-document body.
|
|
24
|
-
* The walker does the same at the point of reading: every lookahead below reads the next LOGICAL character, past
|
|
25
|
-
* any continuation, so a pair can stand inside a construct's spelling (`$\<newline>(…)` opens a substitution)
|
|
26
|
-
* and never inside the three places bash keeps it.
|
|
27
|
-
*/
|
|
28
|
-
export type LexMode = "strict" | "lenient";
|
|
29
|
-
export interface LexOptions {
|
|
30
|
-
readonly mode: LexMode;
|
|
31
|
-
/** `"split"` (default): the connectors bound segments. `"text"`: a single segment is being tokenized and an
|
|
32
|
-
* unquoted connector character is a word character — what a caller handing over one already-split segment
|
|
33
|
-
* expects. */
|
|
34
|
-
readonly connectors?: "split" | "text";
|
|
35
|
-
}
|
|
36
|
-
/** An argv word in BOTH spellings. `raw` is what the SHELL sees (quotes, escapes and substitution text
|
|
37
|
-
* retained) — the only spelling in which "is this metacharacter quoted?" is still answerable; `folded` is what
|
|
38
|
-
* the PROGRAM receives after quote removal, with every substitution replaced by {@link SUBSTITUTION_PLACEHOLDER}
|
|
39
|
-
* and a literal leading tilde spelled `./~…` (see {@link literalTildeSpelling}). */
|
|
40
|
-
export interface LexedWord {
|
|
41
|
-
readonly kind: "word";
|
|
42
|
-
readonly raw: string;
|
|
43
|
-
readonly folded: string;
|
|
44
|
-
}
|
|
45
|
-
/** A redirection and the word it takes. A descriptor duplication (`>&2`, `<&0`, `>&-`, `>&1-`) takes none. */
|
|
46
|
-
export interface LexedRedirect {
|
|
47
|
-
readonly kind: "redirect";
|
|
48
|
-
readonly op: "<" | ">" | ">>" | "<<<" | "&>" | "&>>" | ">&" | "<&";
|
|
49
|
-
readonly target?: LexedWord;
|
|
50
|
-
}
|
|
51
|
-
/** A here-document: the body is DATA the program reads on stdin, never command text. `quoted` records whether
|
|
52
|
-
* the delimiter word carried a quote or an escape, which is bash's rule for "the body does not expand". */
|
|
53
|
-
export interface LexedHeredoc {
|
|
54
|
-
readonly kind: "heredoc";
|
|
55
|
-
readonly delimiter: string;
|
|
56
|
-
readonly quoted: boolean;
|
|
57
|
-
readonly body: string;
|
|
58
|
-
}
|
|
59
|
-
/** A subshell parenthesis, standing alone: structure, not a word. */
|
|
60
|
-
export interface LexedGroup {
|
|
61
|
-
readonly kind: "group";
|
|
62
|
-
readonly op: "(" | ")";
|
|
63
|
-
}
|
|
64
|
-
export type LexedToken = LexedWord | LexedRedirect | LexedHeredoc | LexedGroup;
|
|
65
|
-
/** The connector bash ran a segment through — `"start"` for the first one. A closed set, because the read
|
|
66
|
-
* boundary distinguishes all four: `&&` is the only one under which the previous segment is known to have
|
|
67
|
-
* exited ZERO, `||` is the only one under which the previous segment may have been SKIPPED ENTIRELY, `|`
|
|
68
|
-
* puts the segment in a subshell whose directory changes never reach the parent, and `;` is plain sequence. */
|
|
69
|
-
export type ShellSegmentConnector = "start" | ";" | "&&" | "||" | "|";
|
|
70
|
-
/** The lenient mode's two extra boundaries: a backgrounding `&` and a line break. */
|
|
71
|
-
export type LenientConnector = ShellSegmentConnector | "&" | "\n";
|
|
72
|
-
export interface LexedSegment {
|
|
73
|
-
/** The segment's text exactly as written (surrounding whitespace included) — what a caller that wants the
|
|
74
|
-
* string rather than the tokens reads. Here-document bodies are not part of any segment's text. */
|
|
75
|
-
readonly text: string;
|
|
76
|
-
readonly connector: LenientConnector;
|
|
77
|
-
readonly tokens: readonly LexedToken[];
|
|
78
|
-
/** The bodies of the substitutions found in THIS segment (its words and its redirection targets), in order. */
|
|
79
|
-
readonly substitutions: readonly string[];
|
|
80
|
-
}
|
|
81
|
-
export interface LexedCommand {
|
|
82
|
-
readonly segments: readonly LexedSegment[];
|
|
83
|
-
/** Every substitution body of the command, in order (the per-segment lists concatenated). */
|
|
84
|
-
readonly substitutions: readonly string[];
|
|
85
|
-
}
|
|
86
|
-
/** One segment's argv words in both spellings, index-aligned by construction (folding is strictly per word — it
|
|
87
|
-
* never splits or joins). The one shape every downstream arm of the classifier reads. */
|
|
88
|
-
export interface SegmentTokens {
|
|
89
|
-
readonly folded: readonly string[];
|
|
90
|
-
readonly raw: readonly string[];
|
|
91
|
-
}
|
|
92
|
-
/** What a substitution leaves in a word's FOLDED spelling: a marker no argv word can spell, so a consumer that
|
|
93
|
-
* judges words sees "this word carries text the shell computes" rather than the computing text itself. */
|
|
94
|
-
export declare const SUBSTITUTION_PLACEHOLDER = " subst";
|
|
95
|
-
export type QuoteOpen = '"' | "'" | undefined;
|
|
96
|
-
/**
|
|
97
|
-
* Does the `$` at `at` OPEN a quote form (`$'…'` / `$"…"`)? ONE question, asked by every walker that has to
|
|
98
|
-
* answer it — the word scan here and the expansion scan in the classifier — because a `$` one of them reads
|
|
99
|
-
* as escaped and the other as bare yields two different words for the same text, and the judge then compares
|
|
100
|
-
* the wrong one. Escaped means an ODD run of backslashes in front of it: `\$'y'` is a literal `$`, while
|
|
101
|
-
* `x\\$'y'` is a literal backslash followed by a real ANSI-C quote (both read off /bin/bash). Counting the
|
|
102
|
-
* run is what a one-character peek behind cannot do.
|
|
103
|
-
*/
|
|
104
|
-
export declare function dollarOpensQuote(text: string, at: number): boolean;
|
|
105
|
-
/** The `'` that CLOSES the ANSI-C quote opened at `open`, or `undefined` when none does. `\'` does not close
|
|
106
|
-
* one — the single place a quote region honours a backslash, and a pairing walk blind to it reads the real
|
|
107
|
-
* closing quote as an OPENING one and everything after as quoted, which hides an expansion the shell performs. */
|
|
108
|
-
export declare function ansiCQuoteClose(source: string, open: number): number | undefined;
|
|
109
|
-
/**
|
|
110
|
-
* Which QUOTE holds each character of `s`, by the same pairing rule the lexer walks with, and the boolean view
|
|
111
|
-
* of it. The pairing quote characters themselves belong to the region they bound — they are not operators
|
|
112
|
-
* either way — so `openedBy` names that region's quote character at their own index too.
|
|
113
|
-
*
|
|
114
|
-
* `quoted` is a VIEW of `openedBy`, minted in the same step: a consumer asking only "is this inside quotes"
|
|
115
|
-
* reads it, one asking WHICH quote (single quotes suppress every expansion, double quotes suppress neither `$`
|
|
116
|
-
* nor the backtick) reads `openedBy`, and the two cannot drift.
|
|
117
|
-
*
|
|
118
|
-
* `balanced` is false when a region is still open at the end of the string. Callers must then NOT use the mask:
|
|
119
|
-
* an unterminated quote is a string bash itself cannot parse, and every consumer falls back to the quote-BLIND
|
|
120
|
-
* reading, which is the stricter one.
|
|
121
|
-
*
|
|
122
|
-
* EXACTNESS. This models bash only for the residual character space the strict faces operate in, where backslash
|
|
123
|
-
* escapes and subshells are rejected outright — there `'` and `"` pairing is the whole of quoting, so a region
|
|
124
|
-
* computed here is exactly a region bash quotes. A caller deciding about `$` or a backtick on this mask owes
|
|
125
|
-
* the argument in `bash-readonly-classifier.ts`. It is NOT a general shell quoting parser.
|
|
126
|
-
*/
|
|
127
|
-
export declare function quoteMask(s: string): {
|
|
128
|
-
openedBy: readonly QuoteOpen[];
|
|
129
|
-
quoted: readonly boolean[];
|
|
130
|
-
balanced: boolean;
|
|
131
|
-
};
|
|
132
|
-
/** The ONE spelling of a LITERAL leading tilde — `./~…`, the relative path it is — for every position bash does not
|
|
133
|
-
* expand it in (a quoted tilde-prefix, an option payload); a word without a leading tilde is returned as is. */
|
|
134
|
-
export declare function literalTildeSpelling(word: string): string;
|
|
135
|
-
/** The argv-word projection of a segment: redirections, here-documents and groups are not words the program
|
|
136
|
-
* receives (bash removes them before exec). */
|
|
137
|
-
export declare function wordsOf(segment: LexedSegment): SegmentTokens;
|
|
138
|
-
/** The substitution bodies of an UNQUOTED here-document body: `$(…)` and backticks are live there, quotes are
|
|
139
|
-
* ordinary characters, a backslash protects the next character. `undefined` when a substitution never closes. */
|
|
140
|
-
export declare function substitutionsInHeredocBody(body: string): string[] | undefined;
|
|
141
|
-
/**
|
|
142
|
-
* Lex a command. The honoured pass is authoritative when every quote closes; otherwise the quote-blind pass is
|
|
143
|
-
* the answer — the fail-closed fallback every face here has always taken for a string bash itself cannot parse.
|
|
144
|
-
* In STRICT mode that fallback is two-level, as the faces have always read it: the segments are split blind, and
|
|
145
|
-
* each segment's words are then read on their own balance (`echo "a b"; echo '` keeps `a b` one word in the first
|
|
146
|
-
* segment). The lenient face reads an unbalanced command blind throughout. `{ reject }` names a construct the
|
|
147
|
-
* lenient mode cannot read (an unterminated substitution or here-document, an operator with no operand, a
|
|
148
|
-
* substitution this lexer cannot delimit) or, in strict mode, a backgrounding `&`.
|
|
149
|
-
*/
|
|
150
|
-
export declare function lexShellText(source: string, opts: LexOptions): LexedCommand | {
|
|
151
|
-
reject: string;
|
|
152
|
-
};
|