@sema-agent/core 7.41.2 → 7.42.1

package/dist/tools/fs/image-admission.d.ts

@@ -0,0 +1,51 @@
+/**
+ * The ONE admission an image's bytes pass before they reach the model as an `ImageContent` block —
+ * whether a file supplied them (the Read tool's image lane) or a caller did (`TaskSpec.images`' inline
+ * arm). Four steps, in this order:
+ *
+ *   ① the claimed type is one the content API accepts (png / jpeg / gif / webp — the four
+ *      {@link imageMagicMatches} can verify);
+ *   ② the raw bytes are within the read cap (5 MiB without a downsampler, 64 MiB with one);
+ *   ③ the bytes carry the claimed type's signature — an empty / text / mis-named "png" would
+ *      otherwise become a malformed block that 400s the NEXT whole provider request;
+ *   ④ optional downsample (when a downsampler is supplied; a processing failure keeps the original
+ *      bytes, CC's catch → createImageResponse(original)), then the provider's hard limit, which is on the
+ *      BASE64 length, not raw bytes.
+ *
+ * The answer is structured; each carrier words its own refusal (the Read tool speaks to the model, the
+ * task door to the caller). The block it admits is built from the bytes it checked — never from a
+ * caller's string it did not decode.
+ */
+import type { ImageContent } from "../../internal/llm.js";
+import { type ImageDimensions, type ImageDownsampler } from "../../core/mcp.js";
+/** The image types the content API accepts — the only ones a signature check can verify. */
+export declare const ADMITTED_IMAGE_MIME_TYPES: readonly ["image/png", "image/jpeg", "image/gif", "image/webp"];
+/** The raw-byte read cap for an image, with or without a downsampler. */
+export declare function imageReadCap(downsampler: ImageDownsampler | undefined): number;
+export type ImageAdmission = {
+    ok: true;
+    block: ImageContent;
+    /** The raw byte count of the bytes checked (before any downsample). */
+    originalSize: number;
+    /** Measured by the downsampler; absent without one (never fabricated). */
+    dimensions?: ImageDimensions;
+    /** True when the downsampler actually changed the pixel size. */
+    resized: boolean;
+} | {
+    ok: false;
+    reason: "mime_unsupported" | "magic_mismatch";
+    rawBytes: number;
+} | {
+    ok: false;
+    reason: "raw_too_large";
+    rawBytes: number;
+    cap: number;
+}
+/** `base64` is the encoding that failed the limit (the caller words the refusal from its length). */
+ | {
+    ok: false;
+    reason: "base64_too_large";
+    rawBytes: number;
+    base64: string;
+};
+export declare function admitImageBytes(bytes: Uint8Array, claimedMime: string, downsampler: ImageDownsampler | undefined): Promise<ImageAdmission>;

package/dist/tools/fs/image-admission.js

@@ -0,0 +1,36 @@
+import { MCP_IMAGE_MAX_BASE64 } from "../../core/mcp.js";
+import { imageMagicMatches } from "./safety.js";
+import { MAX_IMAGE_READ_BYTES, MAX_IMAGE_DOWNSAMPLE_INPUT_BYTES } from "./fs-shared.js";
+export const ADMITTED_IMAGE_MIME_TYPES = Object.freeze(["image/png", "image/jpeg", "image/gif", "image/webp"]);
+export function imageReadCap(downsampler) {
+    return downsampler ? MAX_IMAGE_DOWNSAMPLE_INPUT_BYTES : MAX_IMAGE_READ_BYTES;
+}
+export async function admitImageBytes(bytes, claimedMime, downsampler) {
+    const rawBytes = bytes.byteLength;
+    if (!ADMITTED_IMAGE_MIME_TYPES.includes(claimedMime))
+        return { ok: false, reason: "mime_unsupported", rawBytes };
+    const cap = imageReadCap(downsampler);
+    if (rawBytes > cap)
+        return { ok: false, reason: "raw_too_large", rawBytes, cap };
+    if (!imageMagicMatches(bytes, claimedMime))
+        return { ok: false, reason: "magic_mismatch", rawBytes };
+    let base64;
+    let mimeType = claimedMime;
+    let dimensions;
+    if (downsampler) {
+        const out = await downsampler(Buffer.from(bytes), claimedMime).catch(() => undefined);
+        if (out) {
+            base64 = out.base64;
+            mimeType = out.mimeType;
+            dimensions = out.dimensions;
+        }
+    }
+    base64 ??= Buffer.from(bytes).toString("base64");
+    if (base64.length > MCP_IMAGE_MAX_BASE64)
+        return { ok: false, reason: "base64_too_large", rawBytes, base64 };
+    const resized = dimensions !== undefined &&
+        dimensions.displayWidth > 0 &&
+        dimensions.displayHeight > 0 &&
+        (dimensions.originalWidth !== dimensions.displayWidth || dimensions.originalHeight !== dimensions.displayHeight);
+    return { ok: true, block: { type: "image", data: base64, mimeType }, originalSize: rawBytes, ...(dimensions !== undefined ? { dimensions } : {}), resized };
+}

package/dist/tools/fs/search.js

@@ -2,6 +2,7 @@ import { delimitUntrusted } from "../../core/untrusted-text.js";
 import { MAX_EXEC_OUTPUT_BYTES } from "../../core/exec-output-tail.js";
 import { hasBinaryExtension, isAbsoluteForFamily, isWinFormPath, joinForFamily, pathFamilyOf } from "./safety.js";
 import { homeViewsOf } from "./read-deny-home.js";
+import { createEntryDenyJudge } from "./dir-entries.js";
 import { thrownText } from "../../core/thrown-value.js";
 const WALK_MAX_FILES = 5000;
 const WALK_MAX_DEPTH = 32;
@@ -228,14 +229,9 @@ export async function walk(env, root, start, ignore, signal, deny) {
     let aborted = false;
     let denyPruned = 0;
     const denyPatterns = [];
-    const views = deny !== undefined ? homeViewsOf(env, deny, signal) : undefined;
+    const judge = deny !== undefined ? createEntryDenyJudge(env, deny, signal) : undefined;
     const denyHit = async (path, leaf) => {
-        let hit = deny?.matchPath(path);
-        if (!hit && views !== undefined) {
-            const view = await views.of(path, leaf !== undefined ? { leaf } : undefined);
-            if (view !== undefined)
-                hit = deny.matchPath(view);
-        }
+        const hit = judge === undefined ? null : await judge(path, leaf);
         if (!hit)
             return false;
         denyPruned++;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sema-agent/core",
-  "version": "7.41.2",
+  "version": "7.42.1",
   "description": "Stateless, task-oriented AI agent core",
   "type": "module",
   "license": "BUSL-1.1",

package/test/export-surface.snapshot.json

@@ -1,7 +1,7 @@
 {
   "_comment": "design/87 L3 — frozen public export surface of src/index.ts (name -> kind). DO NOT edit by hand to silence a red test. A removed/changed entry = a SemVer-BREAKING change; bump MAJOR and update this fixture in the SAME commit (design/87 §4.2 / §5.2). Regenerate via REGEN in test/export-surface.test.ts.",
   "_tierComment": "#435 v1 — machine-readable layering of the public surface: stable = demonstrated by README.md / src/examples; internal = an `Internal`-marked name or a runner/engine deep-subtree declaration (the model seam src/engine/llm is excluded — it is the BYOM contract, not an engine internal); advanced = a supported export the front door does not walk you through. THIS IS AN INITIAL HEURISTIC, derived mechanically and expected to be refined ticket by ticket: no human reviewed these 1700+ entries one by one, and nothing here claims otherwise. Known bias: a short or English-word export name (ok, err, Result, Usage) can match ordinary prose in README.md and land `stable` on a coincidence. Every export MUST carry a tier — a new export with no row fails the gate in export-surface.test.ts.",
-  "count": 2584,
+  "count": 2593,
   "exports": {
     "A2ATaskState": "type",
     "A2ATaskStateReversal": "type",
@@ -20,6 +20,8 @@
     "AGENT_TRANSCRIPT_TOOL_NAME": "variable",
     "AGGREGATE_MEDIA_BUDGET_BYTES": "variable",
     "AGGREGATE_TOOL_RESULT_BUDGET_CHARS": "variable",
+    "ALLOW_ENTRY_INERT_REASONS": "variable",
+    "ALLOW_RULE_MEMBERS": "variable",
     "ANNOUNCEMENTS_FILE": "variable",
     "APPROVAL_CARD_REQUIRED_KEYS": "variable",
     "APPROVER_ATTRIBUTION_MAX_CHARS": "variable",
@@ -90,6 +92,12 @@
     "AgentStateSource": "interface",
     "AgentTranscriptToolOptions": "interface",
     "AggregateBudgetOptions": "interface",
+    "AllowEntryGateSeats": "interface",
+    "AllowEntryHit": "interface",
+    "AllowEntryInertReason": "type",
+    "AllowEntryLane": "interface",
+    "AllowRuleMember": "type",
+    "AllowRuleShadow": "interface",
     "AnthropicBrainConfig": "interface",
     "AppendLog": "class",
     "ApprovalSeatOutcome": "type",
@@ -306,6 +314,7 @@
     "CompactionEffect": "interface",
     "CompactionKind": "type",
     "CompactionWindowSafetyInfo": "interface",
+    "CompiledAllowEntry": "type",
     "CompiledEventPrompt": "interface",
     "CompiledSection": "interface",
     "CompleteSimpleFn": "type",
@@ -1337,7 +1346,6 @@
     "SHELL_READ_FINDING_RANK": "variable",
     "SHELL_READ_SEATS": "variable",
     "SHELL_WRAPPER_TABLE": "variable",
-    "SKILL_ENTRY_INERT_REASONS": "variable",
     "SKILL_GRANT_ORIGINS": "variable",
     "SKILL_TOOL_NAME": "variable",
     "STALE_RUNNING_REAP_ATTRIBUTION": "variable",
@@ -1450,7 +1458,6 @@
     "SideQueryResult": "interface",
     "SideQuerySpec": "interface",
     "SideQueryToolDef": "interface",
-    "SkillEntryInertReason": "type",
     "SkillGateSeats": "interface",
     "SkillGrantHit": "interface",
     "SkillGrantLane": "interface",
@@ -1881,6 +1888,8 @@
     "committedDistilledOf": "function",
     "committedOriginOf": "function",
     "compactableToolNames": "function",
+    "compileAllowEntry": "function",
+    "compileAllowList": "function",
     "compileReadDeny": "function",
     "compileWriteDeny": "function",
     "compileWriteProtection": "function",
@@ -2606,6 +2615,8 @@
     "AGENT_TRANSCRIPT_TOOL_NAME": "advanced",
     "AGGREGATE_MEDIA_BUDGET_BYTES": "advanced",
     "AGGREGATE_TOOL_RESULT_BUDGET_CHARS": "advanced",
+    "ALLOW_ENTRY_INERT_REASONS": "advanced",
+    "ALLOW_RULE_MEMBERS": "advanced",
     "ANNOUNCEMENTS_FILE": "advanced",
     "APPROVAL_CARD_REQUIRED_KEYS": "internal",
     "APPROVER_ATTRIBUTION_MAX_CHARS": "advanced",
@@ -2676,6 +2687,12 @@
     "AgentStateSource": "advanced",
     "AgentTranscriptToolOptions": "advanced",
     "AggregateBudgetOptions": "advanced",
+    "AllowEntryGateSeats": "advanced",
+    "AllowEntryHit": "advanced",
+    "AllowEntryInertReason": "advanced",
+    "AllowEntryLane": "advanced",
+    "AllowRuleMember": "advanced",
+    "AllowRuleShadow": "advanced",
     "AnthropicBrainConfig": "advanced",
     "AppendLog": "advanced",
     "ApprovalSeatOutcome": "advanced",
@@ -2892,6 +2909,7 @@
     "CompactionEffect": "advanced",
     "CompactionKind": "advanced",
     "CompactionWindowSafetyInfo": "advanced",
+    "CompiledAllowEntry": "advanced",
     "CompiledEventPrompt": "advanced",
     "CompiledSection": "advanced",
     "CompleteSimpleFn": "advanced",
@@ -3923,7 +3941,6 @@
     "SHELL_READ_FINDING_RANK": "advanced",
     "SHELL_READ_SEATS": "advanced",
     "SHELL_WRAPPER_TABLE": "advanced",
-    "SKILL_ENTRY_INERT_REASONS": "advanced",
     "SKILL_GRANT_ORIGINS": "advanced",
     "SKILL_TOOL_NAME": "internal",
     "STALE_RUNNING_REAP_ATTRIBUTION": "advanced",
@@ -4036,7 +4053,6 @@
     "SideQueryResult": "advanced",
     "SideQuerySpec": "advanced",
     "SideQueryToolDef": "advanced",
-    "SkillEntryInertReason": "advanced",
     "SkillGateSeats": "advanced",
     "SkillGrantHit": "advanced",
     "SkillGrantLane": "advanced",
@@ -4467,6 +4483,8 @@
     "committedDistilledOf": "stable",
     "committedOriginOf": "stable",
     "compactableToolNames": "advanced",
+    "compileAllowEntry": "advanced",
+    "compileAllowList": "advanced",
     "compileReadDeny": "advanced",
     "compileWriteDeny": "advanced",
     "compileWriteProtection": "advanced",