@sema-agent/core 7.54.1 → 7.55.0

package/dist/tools/web.js

@@ -4,10 +4,11 @@ import { delimitUntrusted, inlineUntrusted } from "../core/untrusted-text.js";
 import { discloseReminderShaped, observeReminderMarkEcho } from "../core/reminder-disclosure.js";
 import { egressThrownText } from "../core/untrusted-egress.js";
 import { isPrivateHost } from "../core/runner/image.js";
+import { HOST_UNREADABLE_SENTENCE, hostOfSpelling, hostOfUrl } from "../core/host-target.js";
 import { DEFAULT_CHARS_PER_TOKEN } from "../internal/harness.js";
 import { binaryMagicFormat } from "./fs/safety.js";
 import { pdfMagicMatches } from "../core/image-admission.js";
-import { toolFace } from "../core/tool-catalog-entries.js";
+import { mountRuleFace, toolFace } from "../core/tool-catalog-entries.js";
 import { thrownText } from "../core/thrown-value.js";
 const MAX_REDIRECTS = 10;
 const MAX_URL_LENGTH = 2048;
@@ -201,25 +202,29 @@ function isPermittedRedirectHop(from, to) {
         return false;
     if (to.port !== from.port)
         return false;
-    if (to.username || to.password)
-        return false;
-    const strip = (h) => h.replace(/^www\./, "");
-    return strip(from.hostname) === strip(to.hostname);
+    const here = hostOfUrl(from.toString());
+    const there = hostOfUrl(to.toString());
+    return "host" in here && "host" in there && here.host === there.host;
+}
+function hopRefusal(url, allowHosts) {
+    if (url.protocol !== "http:" && url.protocol !== "https:")
+        return `redirect to a non-http(s) URL (${url.protocol}) was refused`;
+    const reading = hostOfUrl(url.toString());
+    if ("unreadable" in reading)
+        return `${HOST_UNREADABLE_SENTENCE[reading.unreadable]}; refused`;
+    const allowlisted = allowHosts?.includes(reading.host) ?? false;
+    if (isPrivateHost(reading.host) && !allowlisted)
+        return `host "${reading.host}" is private/internal; refused (SSRF guard)${allowHosts ? " — not in the allowlist" : ""}`;
+    if (allowHosts && !allowlisted)
+        return `host "${reading.host}" is not in the allowlist; refused (redirect target re-checked)`;
+    return undefined;
 }
 async function fetchAllowlisted(doFetch, start, allowHosts, userAgent, signal, onResponse) {
     let current = start;
     for (let hop = 0; hop <= MAX_REDIRECTS; hop++) {
-        if (current.protocol !== "http:" && current.protocol !== "https:") {
-            return { ok: false, error: `redirect to a non-http(s) URL (${current.protocol}) was refused` };
-        }
-        const host = current.hostname;
-        const allowlisted = allowHosts?.includes(host) ?? false;
-        if (isPrivateHost(host) && !allowlisted) {
-            return { ok: false, error: `host "${host}" is private/internal; refused (SSRF guard)${allowHosts ? " — not in the allowlist" : ""}` };
-        }
-        if (allowHosts && !allowlisted) {
-            return { ok: false, error: `host "${host}" is not in the allowlist; refused (redirect target re-checked)` };
-        }
+        const refused = hopRefusal(current, allowHosts);
+        if (refused !== undefined)
+            return { ok: false, error: refused };
         const res = await doFetch(current.toString(), {
             signal,
             redirect: "manual",
@@ -237,16 +242,9 @@ async function fetchAllowlisted(doFetch, start, allowHosts, userAgent, signal, o
             catch {
                 return { ok: false, error: `invalid redirect Location: ${loc}` };
             }
-            if (next.protocol !== "http:" && next.protocol !== "https:") {
-                return { ok: false, error: `redirect to a non-http(s) URL (${next.protocol}) was refused` };
-            }
-            const nextAllowlisted = allowHosts?.includes(next.hostname) ?? false;
-            if (isPrivateHost(next.hostname) && !nextAllowlisted) {
-                return { ok: false, error: `host "${next.hostname}" is private/internal; refused (SSRF guard)${allowHosts ? " — not in the allowlist" : ""}` };
-            }
-            if (allowHosts && !nextAllowlisted) {
-                return { ok: false, error: `host "${next.hostname}" is not in the allowlist; refused (redirect target re-checked)` };
-            }
+            const nextRefused = hopRefusal(next, allowHosts);
+            if (nextRefused !== undefined)
+                return { ok: false, error: nextRefused };
             if (!isPermittedRedirectHop(current, next)) {
                 return { ok: false, redirect: { originalUrl: current.toString(), redirectUrl: next.toString(), statusCode: res.status } };
             }
@@ -261,10 +259,12 @@ export function webFetchToolSpec(config = {}) {
     const maxBytes = resolveWebMaxBytes(config.maxBytes);
     const fetchTimeoutMs = resolveWebTimeoutMs(config.timeoutMs, "WebFetch timeoutMs", DEFAULT_FETCH_TIMEOUT_MS);
     const doFetch = config.fetchImpl ?? globalThis.fetch;
+    const allowHosts = config.allowHosts?.map((entry) => hostOfSpelling(entry) ?? entry);
     const canSummarize = config.summarize !== undefined;
     return {
         name: "WebFetch",
         ...toolFace("web-fetch"),
+        ruleFace: mountRuleFace("web-fetch"),
         description: (canSummarize
             ? "Fetches a URL, converts the page to markdown, and answers `prompt` against it with a sub-model.\n"
             : "Fetches a URL, converts the page to markdown, and returns the markdown. This deployment has no " +
@@ -288,19 +288,21 @@ export function webFetchToolSpec(config = {}) {
             if (url.length > MAX_URL_LENGTH) {
                 return failure(`Error (WebFetch): URL is ${url.length} characters — the limit is ${MAX_URL_LENGTH}.`);
             }
-            let parsed;
-            try {
-                parsed = new URL(url);
-            }
-            catch {
+            const subject = hostOfUrl(url);
+            if ("unreadable" in subject && (subject.unreadable === "not_text" || subject.unreadable === "not_url")) {
                 return failure(`Error (WebFetch): "${url}" is not a valid URL.`);
             }
+            const parsed = new URL(url);
             urlForDetails = parsed.toString();
-            if (parsed.protocol !== "http:" && parsed.protocol !== "https:") {
-                return failure(`Error (WebFetch): only http(s) URLs are allowed (got ${parsed.protocol}).`);
-            }
-            if (parsed.username || parsed.password) {
-                return failure("Error (WebFetch): URLs with embedded credentials (user:pass@host) are refused.");
+            if ("unreadable" in subject) {
+                switch (subject.unreadable) {
+                    case "not_http":
+                        return failure(`Error (WebFetch): only http(s) URLs are allowed (got ${parsed.protocol}).`);
+                    case "credentials":
+                        return failure("Error (WebFetch): URLs with embedded credentials (user:pass@host) are refused.");
+                    default:
+                        return failure(`Error (WebFetch): the URL's host does not read back as one host ("${parsed.hostname.slice(0, 120)}") — write the host with no trailing dots.`);
+                }
             }
             if (!doFetch)
                 return failure("Error (WebFetch): no fetch implementation available in this environment.");
@@ -320,7 +322,7 @@ export function webFetchToolSpec(config = {}) {
             let bodyCut;
             let stoppedAtLimit = false;
             try {
-                const fr = await fetchAllowlisted(doFetch, parsed, config.allowHosts, config.userAgent ?? DEFAULT_WEBFETCH_USER_AGENT, ac.signal, (status, statusText) => {
+                const fr = await fetchAllowlisted(doFetch, parsed, allowHosts, config.userAgent ?? DEFAULT_WEBFETCH_USER_AGENT, ac.signal, (status, statusText) => {
                     connectedMeta = { status, statusText };
                 });
                 if (!fr.ok) {
@@ -845,6 +847,7 @@ export function createWebSearchTool(config) {
     return {
         name: "WebSearch",
         ...toolFace("web-search"),
+        ruleFace: mountRuleFace("web-search"),
         description: "Search the web. Returns result blocks with titles and URLs.\n" +
             "\n" +
             `- The current month is ${currentMonthYear} — use this when searching for recent information.\n` +

package/dist/tools/worktree.d.ts

@@ -1,10 +1,10 @@
 /**
  * 审计深挖 G4 — the `EnterWorktree` / `ExitWorktree` tool pair: SESSION-level git-worktree
- * isolation (CC 2.1.198 parity). EnterWorktree creates a managed worktree under `.sema-worktrees/`
+ * isolation. EnterWorktree creates a managed worktree under `.sema-worktrees/`
  * (the same {@link WORKTREE_PARENT} the subagent `isolation:"worktree"` lane uses) and REALLY switches
  * the task's working directory into it; ExitWorktree returns to the original directory and cleans up.
  *
- * CC-parity semantics (198 bundle, verbatim-checked):
+ * Semantics:
  *  ① worktrees live in a managed parent dir inside the repo (CC: `.claude/worktrees/`; sema:
  *    `.sema-worktrees/`) — never scattered;
  *  ② baseRef is two-state: `"head"` = the current local HEAD (unpushed commits present), `"fresh"` =
@@ -31,7 +31,7 @@
  * sandbox**. resolveKey's containment anchor stays the ORIGINAL task root — it is deliberately NOT
  * re-anchored/tightened to the worktree dir, so `../../` from inside the worktree can still reach the
  * rest of the repository (which is WITHIN the task root and was reachable before Enter too), while
- * anything outside the task root stays fenced exactly as before. This matches CC 2.1.198 semantics
+ * anything outside the task root stays fenced exactly as before. This matches the reference's semantics
  * (CC worktrees live beside the repo with no containment tightening either); tightening here would buy
  * no security (Bash/`cd` already roam the root) and would break legitimate repo-relative access. The
  * tool description + Enter reply state this honestly so the model never assumes isolation.

package/dist/tools/worktree.js

@@ -2,7 +2,7 @@ import { resolve } from "node:path";
 import { Type } from "typebox";
 import { defineTool, errorResult } from "../core/tools.js";
 import { addWorktree, pruneWorktrees, WORKTREE_PARENT } from "../core/git-worktree-env.js";
-import { toolFace } from "../core/tool-catalog-entries.js";
+import { mountRuleFace, toolFace } from "../core/tool-catalog-entries.js";
 import { thrownText } from "../core/thrown-value.js";
 const ENTER_DESCRIPTION = "Use this tool ONLY when explicitly instructed to work in a worktree — either by the user directly, or by " +
     "project instructions. This tool creates an isolated git worktree and switches the current session into it.\n" +
@@ -113,6 +113,7 @@ export function createWorktreeTools(env, opts) {
     const enter = defineTool({
         name: "EnterWorktree",
         ...toolFace("enter-worktree"),
+        ruleFace: mountRuleFace("enter-worktree"),
         description: ENTER_DESCRIPTION,
         parameters: Type.Object({
             name: Type.Optional(Type.String({
@@ -242,6 +243,7 @@ export function createWorktreeTools(env, opts) {
     const exit = defineTool({
         name: "ExitWorktree",
         ...toolFace("exit-worktree"),
+        ruleFace: mountRuleFace("exit-worktree"),
         description: EXIT_DESCRIPTION,
         parameters: Type.Object({
             keep: Type.Optional(Type.Boolean({

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sema-agent/core",
-  "version": "7.54.1",
+  "version": "7.55.0",
   "description": "Stateless, task-oriented AI agent core",
   "type": "module",
   "license": "BUSL-1.1",