@stigmer/runner 3.0.1

package/dist/activities/execute-deep-agent/__test-utils__/v3-event-fixtures.js

@@ -0,0 +1,182 @@
+/**
+ * V3 protocol event factories for normalizer and status builder tests.
+ *
+ * Shapes are derived from real recordings in /tmp/stigmer-v3-provider/
+ * captured during Phase 1 validation with Claude claude-sonnet-4-6.
+ */
+let seqCounter = 0;
+export function resetSeq() { seqCounter = 0; }
+function nextSeq() { return seqCounter++; }
+// ── Core Factory ──────────────────────────────────────────────────
+export function makeProtocolEvent(method, data, opts) {
+    return {
+        type: "event",
+        seq: opts?.seq ?? nextSeq(),
+        method,
+        params: {
+            namespace: opts?.namespace ?? [],
+            timestamp: opts?.timestamp ?? Date.now(),
+            node: opts?.node,
+            data,
+        },
+    };
+}
+// ── Lifecycle ─────────────────────────────────────────────────────
+export function makeLifecycleRunning(graphName = "root") {
+    return makeProtocolEvent("lifecycle", { event: "running", graph_name: graphName });
+}
+export function makeLifecycleStarted(graphName, ns) {
+    return makeProtocolEvent("lifecycle", { event: "started", graph_name: graphName }, { namespace: ns });
+}
+export function makeLifecycleCompleted(graphName, ns) {
+    return makeProtocolEvent("lifecycle", { event: "completed", graph_name: graphName }, { namespace: ns });
+}
+// ── Messages: message-start / message-finish ──────────────────────
+export function makeMessageStart(runId, opts) {
+    return makeProtocolEvent("messages", {
+        event: "message-start",
+        id: opts?.messageId ?? `msg_${runId}`,
+        usage: opts?.usage,
+        run_id: runId,
+    }, { namespace: opts?.namespace, node: opts?.node ?? "model_request" });
+}
+export function makeMessageFinish(runId, opts) {
+    return makeProtocolEvent("messages", {
+        event: "message-finish",
+        reason: opts?.reason ?? "end_turn",
+        usage: opts?.usage,
+        metadata: opts?.metadata,
+        responseMetadata: opts?.metadata,
+        run_id: runId,
+    }, { namespace: opts?.namespace, node: opts?.node ?? "model_request" });
+}
+// ── Messages: content-block-start/delta/finish ────────────────────
+export function makeContentBlockStartText(runId, index = 0, opts) {
+    return makeProtocolEvent("messages", {
+        event: "content-block-start",
+        index,
+        content: { type: "text", text: "" },
+        run_id: runId,
+    }, { namespace: opts?.namespace, node: "model_request" });
+}
+export function makeTextDelta(runId, text, opts) {
+    return makeProtocolEvent("messages", {
+        event: "content-block-delta",
+        index: opts?.index ?? 0,
+        delta: { type: "text-delta", text },
+        run_id: runId,
+    }, { namespace: opts?.namespace, node: "model_request" });
+}
+export function makeReasoningDelta(runId, text, opts) {
+    return makeProtocolEvent("messages", {
+        event: "content-block-delta",
+        index: opts?.index ?? 0,
+        delta: { type: "reasoning-delta", reasoning: text },
+        run_id: runId,
+    }, { namespace: opts?.namespace, node: "model_request" });
+}
+export function makeToolCallArgDelta(runId, callId, args, opts) {
+    return makeProtocolEvent("messages", {
+        event: "content-block-delta",
+        index: opts?.index ?? 0,
+        delta: {
+            type: "block-delta",
+            fields: { type: "tool_call_chunk", id: callId, args },
+        },
+        run_id: runId,
+    }, { namespace: opts?.namespace, node: "model_request" });
+}
+export function makeContentBlockFinish(runId, index = 0, opts) {
+    return makeProtocolEvent("messages", {
+        event: "content-block-finish",
+        index,
+        content: opts?.content ?? { type: "text", text: "" },
+        run_id: runId,
+    }, { namespace: opts?.namespace, node: "model_request" });
+}
+// ── Messages: usage / provider ────────────────────────────────────
+export function makeUsageEvent(runId, usage, opts) {
+    return makeProtocolEvent("messages", {
+        event: "usage",
+        usage,
+        run_id: runId,
+    }, { namespace: opts?.namespace, node: "model_request" });
+}
+export function makeProviderEvent(runId, provider, model, opts) {
+    return makeProtocolEvent("messages", {
+        event: "provider",
+        provider,
+        name: "message_start",
+        payload: { model, id: `msg_${runId}` },
+        run_id: runId,
+    }, { namespace: opts?.namespace, node: "model_request" });
+}
+// ── Tools ─────────────────────────────────────────────────────────
+export function makeToolStarted(callId, toolName, input = "{}", opts) {
+    return makeProtocolEvent("tools", {
+        event: "tool-started",
+        tool_call_id: callId,
+        tool_name: toolName,
+        input,
+    }, { namespace: opts?.namespace ?? [`tools:${callId}`] });
+}
+export function makeToolFinished(callId, output = "ok", opts) {
+    const wrappedOutput = typeof output === "string"
+        ? {
+            lc: 1, type: "constructor",
+            id: ["langchain_core", "messages", "ToolMessage"],
+            kwargs: { status: "success", content: output, tool_call_id: callId, name: "tool" },
+        }
+        : output;
+    return makeProtocolEvent("tools", {
+        event: "tool-finished",
+        tool_call_id: callId,
+        output: wrappedOutput,
+    }, { namespace: opts?.namespace ?? [`tools:${callId}`] });
+}
+export function makeToolError(callId, message, opts) {
+    return makeProtocolEvent("tools", {
+        event: "tool-error",
+        tool_call_id: callId,
+        message,
+    }, { namespace: opts?.namespace ?? [`tools:${callId}`] });
+}
+export function makeToolOutputDelta(callId, delta, opts) {
+    return makeProtocolEvent("tools", {
+        event: "tool-output-delta",
+        tool_call_id: callId,
+        delta,
+    }, { namespace: opts?.namespace ?? [`tools:${callId}`] });
+}
+// ── Ignored channels (for normalizer completeness tests) ──────────
+export function makeCheckpointEvent() {
+    return makeProtocolEvent("checkpoints", {
+        id: "ckpt_001",
+        parent_id: "ckpt_000",
+        step: 1,
+        source: "loop",
+    });
+}
+export function makeTasksEvent() {
+    return makeProtocolEvent("tasks", {
+        id: "task_001",
+        name: "model_request",
+        input: {},
+        triggers: [],
+        interrupts: [],
+    });
+}
+export function makeValuesEvent() {
+    return makeProtocolEvent("values", {
+        messages: [],
+        todos: [],
+        files: {},
+    });
+}
+export function makeUpdatesEvent(node = "model_request") {
+    return makeProtocolEvent("updates", {
+        node,
+        values: {},
+    }, { node });
+}
+//# sourceMappingURL=v3-event-fixtures.js.map

package/dist/activities/execute-deep-agent/__test-utils__/v3-event-fixtures.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"v3-event-fixtures.js","sourceRoot":"","sources":["../../../../src/activities/execute-deep-agent/__test-utils__/v3-event-fixtures.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAIH,IAAI,UAAU,GAAG,CAAC,CAAC;AACnB,MAAM,UAAU,QAAQ,KAAW,UAAU,GAAG,CAAC,CAAC,CAAC,CAAC;AACpD,SAAS,OAAO,KAAa,OAAO,UAAU,EAAE,CAAC,CAAC,CAAC;AAEnD,qEAAqE;AAErE,MAAM,UAAU,iBAAiB,CAC/B,MAAc,EACd,IAAa,EACb,IAKC;IAED,OAAO;QACL,IAAI,EAAE,OAAO;QACb,GAAG,EAAE,IAAI,EAAE,GAAG,IAAI,OAAO,EAAE;QAC3B,MAAM;QACN,MAAM,EAAE;YACN,SAAS,EAAE,IAAI,EAAE,SAAS,IAAI,EAAE;YAChC,SAAS,EAAE,IAAI,EAAE,SAAS,IAAI,IAAI,CAAC,GAAG,EAAE;YACxC,IAAI,EAAE,IAAI,EAAE,IAAI;YAChB,IAAI;SACL;KACF,CAAC;AACJ,CAAC;AAED,qEAAqE;AAErE,MAAM,UAAU,oBAAoB,CAAC,SAAS,GAAG,MAAM;IACrD,OAAO,iBAAiB,CAAC,WAAW,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,UAAU,EAAE,SAAS,EAAE,CAAC,CAAC;AACrF,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,SAAiB,EAAE,EAAa;IACnE,OAAO,iBAAiB,CAAC,WAAW,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,UAAU,EAAE,SAAS,EAAE,EAAE,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC,CAAC;AACxG,CAAC;AAED,MAAM,UAAU,sBAAsB,CAAC,SAAiB,EAAE,EAAa;IACrE,OAAO,iBAAiB,CAAC,WAAW,EAAE,EAAE,KAAK,EAAE,WAAW,EAAE,UAAU,EAAE,SAAS,EAAE,EAAE,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC,CAAC;AAC1G,CAAC;AAED,qEAAqE;AAErE,MAAM,UAAU,gBAAgB,CAC9B,KAAa,EACb,IAAmG;IAEnG,OAAO,iBAAiB,CAAC,UAAU,EAAE;QACnC,KAAK,EAAE,eAAe;QACtB,EAAE,EAAE,IAAI,EAAE,SAAS,IAAI,OAAO,KAAK,EAAE;QACrC,KAAK,EAAE,IAAI,EAAE,KAAK;QAClB,MAAM,EAAE,KAAK;KACd,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,IAAI,eAAe,EAAE,CAAC,CAAC;AAC1E,CAAC;AAED,MAAM,UAAU,iBAAiB,CAC/B,KAAa,EACb,IAMC;IAED,OAAO,iBAAiB,CAAC,UAAU,EAAE;QACnC,KAAK,EAAE,gBAAgB;QACvB,MAAM,EAAE,IAAI,EAAE,MAAM,IAAI,UAAU;QAClC,KAAK,EAAE,IAAI,EAAE,KAAK;QAClB,QAAQ,EAAE,IAAI,EAAE,QAAQ;QACxB,gBAAgB,EAAE,IAAI,EAAE,QAAQ;QAChC,MAAM,EAAE,KAAK;KACd,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,IAAI,eAAe,EAAE,CAAC,CAAC;AAC1E,CAAC;AAED,qEAAqE;AAErE,MAAM,UAAU,yBAAyB,CACvC,KAAa,EACb,KAAK,GAAG,CAAC,EACT,IAA+B;IAE/B,OAAO,iBAAiB,CAAC,UAAU,EAAE;QACnC,KAAK,EAAE,qBAAqB;QAC5B,KAAK;QACL,OAAO,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,EAAE;QACnC,MAAM,EAAE,KAAK;KACd,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,eAAe,EAAE,CAAC,CAAC;AAC5D,CAAC;AAED,MAAM,UAAU,aAAa,CAC3B,KAAa,EACb,IAAY,EACZ,IAA+C;IAE/C,OAAO,iBAAiB,CAAC,UAAU,EAAE;QACnC,KAAK,EAAE,qBAAqB;QAC5B,KAAK,EAAE,IAAI,EAAE,KAAK,IAAI,CAAC;QACvB,KAAK,EAAE,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE;QACnC,MAAM,EAAE,KAAK;KACd,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,eAAe,EAAE,CAAC,CAAC;AAC5D,CAAC;AAED,MAAM,UAAU,kBAAkB,CAChC,KAAa,EACb,IAAY,EACZ,IAA+C;IAE/C,OAAO,iBAAiB,CAAC,UAAU,EAAE;QACnC,KAAK,EAAE,qBAAqB;QAC5B,KAAK,EAAE,IAAI,EAAE,KAAK,IAAI,CAAC;QACvB,KAAK,EAAE,EAAE,IAAI,EAAE,iBAAiB,EAAE,SAAS,EAAE,IAAI,EAAE;QACnD,MAAM,EAAE,KAAK;KACd,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,eAAe,EAAE,CAAC,CAAC;AAC5D,CAAC;AAED,MAAM,UAAU,oBAAoB,CAClC,KAAa,EACb,MAAc,EACd,IAAY,EACZ,IAA+C;IAE/C,OAAO,iBAAiB,CAAC,UAAU,EAAE;QACnC,KAAK,EAAE,qBAAqB;QAC5B,KAAK,EAAE,IAAI,EAAE,KAAK,IAAI,CAAC;QACvB,KAAK,EAAE;YACL,IAAI,EAAE,aAAa;YACnB,MAAM,EAAE,EAAE,IAAI,EAAE,iBAAiB,EAAE,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE;SACtD;QACD,MAAM,EAAE,KAAK;KACd,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,eAAe,EAAE,CAAC,CAAC;AAC5D,CAAC;AAED,MAAM,UAAU,sBAAsB,CACpC,KAAa,EACb,KAAK,GAAG,CAAC,EACT,IAAkD;IAElD,OAAO,iBAAiB,CAAC,UAAU,EAAE;QACnC,KAAK,EAAE,sBAAsB;QAC7B,KAAK;QACL,OAAO,EAAE,IAAI,EAAE,OAAO,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,EAAE;QACpD,MAAM,EAAE,KAAK;KACd,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,eAAe,EAAE,CAAC,CAAC;AAC5D,CAAC;AAED,qEAAqE;AAErE,MAAM,UAAU,cAAc,CAC5B,KAAa,EACb,KAA8B,EAC9B,IAA+B;IAE/B,OAAO,iBAAiB,CAAC,UAAU,EAAE;QACnC,KAAK,EAAE,OAAO;QACd,KAAK;QACL,MAAM,EAAE,KAAK;KACd,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,eAAe,EAAE,CAAC,CAAC;AAC5D,CAAC;AAED,MAAM,UAAU,iBAAiB,CAC/B,KAAa,EACb,QAAgB,EAChB,KAAa,EACb,IAA+B;IAE/B,OAAO,iBAAiB,CAAC,UAAU,EAAE;QACnC,KAAK,EAAE,UAAU;QACjB,QAAQ;QACR,IAAI,EAAE,eAAe;QACrB,OAAO,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,OAAO,KAAK,EAAE,EAAE;QACtC,MAAM,EAAE,KAAK;KACd,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,eAAe,EAAE,CAAC,CAAC;AAC5D,CAAC;AAED,qEAAqE;AAErE,MAAM,UAAU,eAAe,CAC7B,MAAc,EACd,QAAgB,EAChB,QAAiB,IAAI,EACrB,IAA+B;IAE/B,OAAO,iBAAiB,CAAC,OAAO,EAAE;QAChC,KAAK,EAAE,cAAc;QACrB,YAAY,EAAE,MAAM;QACpB,SAAS,EAAE,QAAQ;QACnB,KAAK;KACN,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,SAAS,IAAI,CAAC,SAAS,MAAM,EAAE,CAAC,EAAE,CAAC,CAAC;AAC5D,CAAC;AAED,MAAM,UAAU,gBAAgB,CAC9B,MAAc,EACd,SAAkB,IAAI,EACtB,IAA+B;IAE/B,MAAM,aAAa,GAAG,OAAO,MAAM,KAAK,QAAQ;QAC9C,CAAC,CAAC;YACE,EAAE,EAAE,CAAC,EAAE,IAAI,EAAE,aAAa;YAC1B,EAAE,EAAE,CAAC,gBAAgB,EAAE,UAAU,EAAE,aAAa,CAAC;YACjD,MAAM,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE;SACnF;QACH,CAAC,CAAC,MAAM,CAAC;IAEX,OAAO,iBAAiB,CAAC,OAAO,EAAE;QAChC,KAAK,EAAE,eAAe;QACtB,YAAY,EAAE,MAAM;QACpB,MAAM,EAAE,aAAa;KACtB,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,SAAS,IAAI,CAAC,SAAS,MAAM,EAAE,CAAC,EAAE,CAAC,CAAC;AAC5D,CAAC;AAED,MAAM,UAAU,aAAa,CAC3B,MAAc,EACd,OAAe,EACf,IAA+B;IAE/B,OAAO,iBAAiB,CAAC,OAAO,EAAE;QAChC,KAAK,EAAE,YAAY;QACnB,YAAY,EAAE,MAAM;QACpB,OAAO;KACR,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,SAAS,IAAI,CAAC,SAAS,MAAM,EAAE,CAAC,EAAE,CAAC,CAAC;AAC5D,CAAC;AAED,MAAM,UAAU,mBAAmB,CACjC,MAAc,EACd,KAAa,EACb,IAA+B;IAE/B,OAAO,iBAAiB,CAAC,OAAO,EAAE;QAChC,KAAK,EAAE,mBAAmB;QAC1B,YAAY,EAAE,MAAM;QACpB,KAAK;KACN,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,SAAS,IAAI,CAAC,SAAS,MAAM,EAAE,CAAC,EAAE,CAAC,CAAC;AAC5D,CAAC;AAED,qEAAqE;AAErE,MAAM,UAAU,mBAAmB;IACjC,OAAO,iBAAiB,CAAC,aAAa,EAAE;QACtC,EAAE,EAAE,UAAU;QACd,SAAS,EAAE,UAAU;QACrB,IAAI,EAAE,CAAC;QACP,MAAM,EAAE,MAAM;KACf,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,cAAc;IAC5B,OAAO,iBAAiB,CAAC,OAAO,EAAE;QAChC,EAAE,EAAE,UAAU;QACd,IAAI,EAAE,eAAe;QACrB,KAAK,EAAE,EAAE;QACT,QAAQ,EAAE,EAAE;QACZ,UAAU,EAAE,EAAE;KACf,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,eAAe;IAC7B,OAAO,iBAAiB,CAAC,QAAQ,EAAE;QACjC,QAAQ,EAAE,EAAE;QACZ,KAAK,EAAE,EAAE;QACT,KAAK,EAAE,EAAE;KACV,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,IAAI,GAAG,eAAe;IACrD,OAAO,iBAAiB,CAAC,SAAS,EAAE;QAClC,IAAI;QACJ,MAAM,EAAE,EAAE;KACX,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;AACf,CAAC"}

package/dist/activities/execute-deep-agent/attachment-injector.d.ts

@@ -0,0 +1,67 @@
+/**
+ * Attachment injection for deep agent execution.
+ *
+ * Downloads attachments from artifact storage (cloud) or local filesystem,
+ * validates ZIP archives with security guards, and writes files into the
+ * workspace via the platform mount namespace (.stigmer/inputs/).
+ *
+ * Security model: attachments are untrusted user uploads. All ZIP content
+ * is validated for path traversal, zip bombs, and format integrity before
+ * any extraction occurs.
+ *
+ * Error model: fail-hard. Any attachment failure aborts the entire injection
+ * and propagates a descriptive error. Attachments are explicit user inputs —
+ * running with partial inputs produces silently incorrect results.
+ */
+import type { Attachment } from "@stigmer/protos/ai/stigmer/agentic/agentexecution/v1/spec_pb";
+import type { WorkspaceBackend } from "../../shared/workspace/types.js";
+import type { ArtifactStorage } from "../../shared/artifact-storage.js";
+declare const MAX_ZIP_FILES = 1000;
+declare const MAX_ZIP_EXTRACTED_SIZE: number;
+export { MAX_ZIP_FILES, MAX_ZIP_EXTRACTED_SIZE };
+export interface InjectedFile {
+    readonly filename: string;
+    readonly path: string;
+    readonly sizeBytes: number;
+}
+export interface InjectAttachmentsOptions {
+    readonly backend: WorkspaceBackend;
+    readonly attachments: readonly Attachment[];
+    readonly storage: ArtifactStorage;
+    readonly isLocalMode: boolean;
+}
+export interface ZipEntryInfo {
+    readonly relativePath: string;
+    readonly uncompressedSize: number;
+}
+export declare class AttachmentInjectionError extends Error {
+    readonly attachmentFilename: string;
+    readonly reason: string;
+    constructor(attachmentFilename: string, reason: string);
+}
+export declare class AttachmentValidationError extends Error {
+    readonly attachmentFilename: string;
+    readonly reason: string;
+    constructor(attachmentFilename: string, reason: string);
+}
+/**
+ * Validate a ZIP archive for safe extraction. Returns the manifest of
+ * file entries (directories excluded) if the archive passes all checks.
+ *
+ * Security checks enforced:
+ * 1. Valid ZIP format (local file header signature present)
+ * 2. No absolute paths (entries starting with / or \)
+ * 3. No path traversal (.. components)
+ * 4. No null bytes in filenames
+ * 5. Non-empty archive (at least one file entry)
+ * 6. File count within limits (max 1000)
+ * 7. Total uncompressed size within limits (max 100 MB)
+ */
+export declare function validateZipForExtraction(zipData: Buffer, sourceFilename: string): ZipEntryInfo[];
+/**
+ * Download, validate, and inject all attachments into the workspace.
+ *
+ * Performs mount path collision detection before any downloads begin.
+ * On any failure, throws AttachmentInjectionError with an actionable message.
+ */
+export declare function injectAttachments(opts: InjectAttachmentsOptions): Promise<InjectedFile[]>;

package/dist/activities/execute-deep-agent/attachment-injector.js

@@ -0,0 +1,306 @@
+/**
+ * Attachment injection for deep agent execution.
+ *
+ * Downloads attachments from artifact storage (cloud) or local filesystem,
+ * validates ZIP archives with security guards, and writes files into the
+ * workspace via the platform mount namespace (.stigmer/inputs/).
+ *
+ * Security model: attachments are untrusted user uploads. All ZIP content
+ * is validated for path traversal, zip bombs, and format integrity before
+ * any extraction occurs.
+ *
+ * Error model: fail-hard. Any attachment failure aborts the entire injection
+ * and propagates a descriptive error. Attachments are explicit user inputs —
+ * running with partial inputs produces silently incorrect results.
+ */
+import { readFile } from "node:fs/promises";
+import { createInflateRaw } from "node:zlib";
+import { basename, posix } from "node:path";
+// ── Constants ────────────────────────────────────────────────────────
+const MAX_ZIP_FILES = 1000;
+const MAX_ZIP_EXTRACTED_SIZE = 100 * 1024 * 1024; // 100 MB
+const DEFAULT_INPUTS_PREFIX = ".stigmer/inputs";
+const ZIP_LOCAL_FILE_HEADER_SIGNATURE = 0x04034b50;
+export { MAX_ZIP_FILES, MAX_ZIP_EXTRACTED_SIZE };
+// ── Errors ───────────────────────────────────────────────────────────
+export class AttachmentInjectionError extends Error {
+    attachmentFilename;
+    reason;
+    constructor(attachmentFilename, reason) {
+        super(`Attachment '${attachmentFilename}': ${reason}`);
+        this.name = "AttachmentInjectionError";
+        this.attachmentFilename = attachmentFilename;
+        this.reason = reason;
+    }
+}
+export class AttachmentValidationError extends Error {
+    attachmentFilename;
+    reason;
+    constructor(attachmentFilename, reason) {
+        super(`Attachment '${attachmentFilename}': ${reason}`);
+        this.name = "AttachmentValidationError";
+        this.attachmentFilename = attachmentFilename;
+        this.reason = reason;
+    }
+}
+// ── ZIP Validation (pure function) ───────────────────────────────────
+/**
+ * Validate a ZIP archive for safe extraction. Returns the manifest of
+ * file entries (directories excluded) if the archive passes all checks.
+ *
+ * Security checks enforced:
+ * 1. Valid ZIP format (local file header signature present)
+ * 2. No absolute paths (entries starting with / or \)
+ * 3. No path traversal (.. components)
+ * 4. No null bytes in filenames
+ * 5. Non-empty archive (at least one file entry)
+ * 6. File count within limits (max 1000)
+ * 7. Total uncompressed size within limits (max 100 MB)
+ */
+export function validateZipForExtraction(zipData, sourceFilename) {
+    if (zipData.length < 4) {
+        throw new AttachmentValidationError(sourceFilename, "not a valid ZIP archive (file too small)");
+    }
+    const view = new DataView(zipData.buffer, zipData.byteOffset, zipData.byteLength);
+    const firstSignature = view.getUint32(0, true);
+    if (firstSignature !== ZIP_LOCAL_FILE_HEADER_SIGNATURE) {
+        throw new AttachmentValidationError(sourceFilename, "not a valid ZIP archive (invalid header signature)");
+    }
+    const entries = [];
+    let totalUncompressed = 0;
+    let offset = 0;
+    while (offset < zipData.length - 4) {
+        const signature = view.getUint32(offset, true);
+        if (signature !== ZIP_LOCAL_FILE_HEADER_SIGNATURE)
+            break;
+        if (offset + 30 > zipData.length) {
+            throw new AttachmentValidationError(sourceFilename, "not a valid ZIP archive (truncated local file header)");
+        }
+        const compressionMethod = view.getUint16(offset + 8, true);
+        const compressedSize = view.getUint32(offset + 18, true);
+        const uncompressedSize = view.getUint32(offset + 22, true);
+        const fileNameLength = view.getUint16(offset + 26, true);
+        const extraFieldLength = view.getUint16(offset + 28, true);
+        const fileNameStart = offset + 30;
+        const fileNameEnd = fileNameStart + fileNameLength;
+        if (fileNameEnd > zipData.length) {
+            throw new AttachmentValidationError(sourceFilename, "not a valid ZIP archive (truncated filename)");
+        }
+        const fileNameBytes = zipData.subarray(fileNameStart, fileNameEnd);
+        for (let i = 0; i < fileNameBytes.length; i++) {
+            if (fileNameBytes[i] === 0x00) {
+                throw new AttachmentValidationError(sourceFilename, "contains a filename with null bytes and cannot be safely extracted");
+            }
+        }
+        const fileName = new TextDecoder().decode(fileNameBytes);
+        const isDirectory = fileName.endsWith("/");
+        if (!isDirectory) {
+            if (fileName.startsWith("/") || fileName.startsWith("\\")) {
+                throw new AttachmentValidationError(sourceFilename, `contains an absolute path entry and cannot be safely extracted: ${fileName}`);
+            }
+            if (hasPathTraversal(fileName)) {
+                throw new AttachmentValidationError(sourceFilename, `contains a path traversal entry and cannot be safely extracted: ${fileName}`);
+            }
+            entries.push({ relativePath: fileName, uncompressedSize });
+            totalUncompressed += uncompressedSize;
+        }
+        const dataStart = fileNameStart + fileNameLength + extraFieldLength;
+        // Handle data descriptor (bit 3 of general purpose flag)
+        const generalFlags = view.getUint16(offset + 6, true);
+        let dataSize = compressedSize;
+        if ((generalFlags & 0x08) !== 0 && compressedSize === 0) {
+            // Data descriptor follows compressed data — scan for next header
+            // This is a simplified approach; for untrusted inputs we require
+            // sizes in the local header. Reject archives that use streaming.
+            if (!isDirectory && compressionMethod !== 0) {
+                throw new AttachmentValidationError(sourceFilename, "uses streaming (data descriptors without sizes) which is not supported for security validation");
+            }
+        }
+        offset = dataStart + dataSize;
+    }
+    if (entries.length === 0) {
+        throw new AttachmentValidationError(sourceFilename, "is an empty ZIP archive (no file entries)");
+    }
+    if (entries.length > MAX_ZIP_FILES) {
+        throw new AttachmentValidationError(sourceFilename, `contains ${entries.length} files (limit: ${MAX_ZIP_FILES})`);
+    }
+    if (totalUncompressed > MAX_ZIP_EXTRACTED_SIZE) {
+        const sizeMb = (totalUncompressed / (1024 * 1024)).toFixed(1);
+        const limitMb = (MAX_ZIP_EXTRACTED_SIZE / (1024 * 1024)).toFixed(0);
+        throw new AttachmentValidationError(sourceFilename, `would extract to ${sizeMb} MB (limit: ${limitMb} MB)`);
+    }
+    return entries.sort((a, b) => a.relativePath.localeCompare(b.relativePath));
+}
+// ── Attachment Injection ─────────────────────────────────────────────
+/**
+ * Download, validate, and inject all attachments into the workspace.
+ *
+ * Performs mount path collision detection before any downloads begin.
+ * On any failure, throws AttachmentInjectionError with an actionable message.
+ */
+export async function injectAttachments(opts) {
+    const { backend, attachments, storage, isLocalMode } = opts;
+    if (attachments.length === 0)
+        return [];
+    // Phase 1: Pre-compute mount paths and detect collisions
+    const mountPaths = resolveMountPaths(attachments);
+    // Phase 2: Download, validate, and write each attachment
+    const injectedFiles = [];
+    for (const attachment of attachments) {
+        const content = await downloadAttachment(attachment, storage, isLocalMode);
+        const mountPath = mountPaths.get(attachment);
+        if (attachment.extract) {
+            const entries = validateZipForExtraction(content, attachment.filename);
+            const extracted = await extractZipToWorkspace(content, entries, mountPath, backend);
+            injectedFiles.push(...extracted);
+        }
+        else {
+            await backend.writeFileBuffer(mountPath, content);
+            injectedFiles.push({
+                filename: attachment.filename || basename(mountPath),
+                path: mountPath,
+                sizeBytes: content.length,
+            });
+        }
+    }
+    console.log(`[attachment-injector] Injected ${injectedFiles.length} file(s) into workspace`);
+    return injectedFiles;
+}
+// ── Internal Helpers ─────────────────────────────────────────────────
+function resolveMountPaths(attachments) {
+    const result = new Map();
+    const pathToAttachment = new Map();
+    for (const attachment of attachments) {
+        const mountPath = resolveMountPath(attachment);
+        const existing = pathToAttachment.get(mountPath);
+        if (existing) {
+            throw new AttachmentInjectionError(attachment.filename, `mount path '${mountPath}' collides with attachment '${existing.filename}'. ` +
+                "Set distinct mountPath values on the attachments to resolve this conflict.");
+        }
+        pathToAttachment.set(mountPath, attachment);
+        result.set(attachment, mountPath);
+    }
+    return result;
+}
+function resolveMountPath(attachment) {
+    if (attachment.mountPath) {
+        const cleaned = attachment.mountPath.replace(/^\/+/, "");
+        if (cleaned.length === 0) {
+            throw new AttachmentInjectionError(attachment.filename, "mountPath resolves to an empty path after removing leading slashes");
+        }
+        return cleaned;
+    }
+    const filename = attachment.filename || deriveFilename(attachment.storageKey);
+    if (!filename) {
+        throw new AttachmentInjectionError("(unknown)", "attachment has neither filename nor storageKey — cannot determine mount path");
+    }
+    return `${DEFAULT_INPUTS_PREFIX}/${filename}`;
+}
+function deriveFilename(storageKey) {
+    if (!storageKey)
+        return "";
+    const parts = storageKey.split("/");
+    return parts[parts.length - 1] || "";
+}
+async function downloadAttachment(attachment, storage, isLocalMode) {
+    // Local mode fast path: read directly from filesystem
+    if (isLocalMode && attachment.localPath) {
+        try {
+            return await readFile(attachment.localPath);
+        }
+        catch (err) {
+            throw new AttachmentInjectionError(attachment.filename, `failed to read local file '${attachment.localPath}': ${err instanceof Error ? err.message : String(err)}`);
+        }
+    }
+    // Cloud mode: download via artifact storage
+    if (!attachment.storageKey) {
+        throw new AttachmentInjectionError(attachment.filename, "missing storageKey — cannot download attachment from storage");
+    }
+    try {
+        const url = await storage.getDownloadUrl(attachment.storageKey);
+        const response = await fetch(url);
+        if (!response.ok) {
+            throw new Error(`HTTP ${response.status}: ${response.statusText}`);
+        }
+        const arrayBuffer = await response.arrayBuffer();
+        return Buffer.from(arrayBuffer);
+    }
+    catch (err) {
+        if (err instanceof AttachmentInjectionError)
+            throw err;
+        throw new AttachmentInjectionError(attachment.filename, `failed to download from storage (key: ${attachment.storageKey}): ${err instanceof Error ? err.message : String(err)}`);
+    }
+}
+async function extractZipToWorkspace(zipData, entries, mountDir, backend) {
+    const cleanMountDir = mountDir.replace(/\/+$/, "");
+    const injected = [];
+    const parsedEntries = parseZipFileData(zipData);
+    for (const entry of entries) {
+        const fileData = parsedEntries.get(entry.relativePath);
+        if (!fileData)
+            continue;
+        const content = await decompressEntry(fileData);
+        const targetPath = `${cleanMountDir}/${entry.relativePath}`;
+        await backend.writeFileBuffer(targetPath, content);
+        injected.push({
+            filename: posix.basename(entry.relativePath),
+            path: targetPath,
+            sizeBytes: content.length,
+        });
+    }
+    return injected;
+}
+function parseZipFileData(zipData) {
+    const result = new Map();
+    const view = new DataView(zipData.buffer, zipData.byteOffset, zipData.byteLength);
+    let offset = 0;
+    while (offset < zipData.length - 4) {
+        const signature = view.getUint32(offset, true);
+        if (signature !== ZIP_LOCAL_FILE_HEADER_SIGNATURE)
+            break;
+        const compressionMethod = view.getUint16(offset + 8, true);
+        const compressedSize = view.getUint32(offset + 18, true);
+        const fileNameLength = view.getUint16(offset + 26, true);
+        const extraFieldLength = view.getUint16(offset + 28, true);
+        const fileNameStart = offset + 30;
+        const fileName = new TextDecoder().decode(zipData.subarray(fileNameStart, fileNameStart + fileNameLength));
+        const dataStart = fileNameStart + fileNameLength + extraFieldLength;
+        const compressedData = zipData.subarray(dataStart, dataStart + compressedSize);
+        if (!fileName.endsWith("/")) {
+            result.set(fileName, {
+                compressedData: Buffer.from(compressedData),
+                compressionMethod,
+            });
+        }
+        offset = dataStart + compressedSize;
+    }
+    return result;
+}
+async function decompressEntry(entry) {
+    if (entry.compressionMethod === 0) {
+        return entry.compressedData;
+    }
+    if (entry.compressionMethod === 8) {
+        return new Promise((resolve, reject) => {
+            const inflate = createInflateRaw();
+            const chunks = [];
+            inflate.on("data", (chunk) => chunks.push(chunk));
+            inflate.on("end", () => resolve(Buffer.concat(chunks)));
+            inflate.on("error", reject);
+            inflate.end(entry.compressedData);
+        });
+    }
+    throw new Error(`Unsupported ZIP compression method: ${entry.compressionMethod}`);
+}
+function hasPathTraversal(filePath) {
+    const normalized = posix.normalize(filePath);
+    if (normalized.startsWith("../") || normalized === "..")
+        return true;
+    const segments = filePath.split(/[/\\]/);
+    for (const seg of segments) {
+        if (seg === "..")
+            return true;
+    }
+    return false;
+}
+//# sourceMappingURL=attachment-injector.js.map

package/dist/activities/execute-deep-agent/attachment-injector.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"attachment-injector.js","sourceRoot":"","sources":["../../../src/activities/execute-deep-agent/attachment-injector.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAC;AAC7C,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,WAAW,CAAC;AAK5C,wEAAwE;AAExE,MAAM,aAAa,GAAG,IAAI,CAAC;AAC3B,MAAM,sBAAsB,GAAG,GAAG,GAAG,IAAI,GAAG,IAAI,CAAC,CAAC,SAAS;AAC3D,MAAM,qBAAqB,GAAG,iBAAiB,CAAC;AAChD,MAAM,+BAA+B,GAAG,UAAU,CAAC;AAEnD,OAAO,EAAE,aAAa,EAAE,sBAAsB,EAAE,CAAC;AAsBjD,wEAAwE;AAExE,MAAM,OAAO,wBAAyB,SAAQ,KAAK;IACxC,kBAAkB,CAAS;IAC3B,MAAM,CAAS;IAExB,YAAY,kBAA0B,EAAE,MAAc;QACpD,KAAK,CAAC,eAAe,kBAAkB,MAAM,MAAM,EAAE,CAAC,CAAC;QACvD,IAAI,CAAC,IAAI,GAAG,0BAA0B,CAAC;QACvC,IAAI,CAAC,kBAAkB,GAAG,kBAAkB,CAAC;QAC7C,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;IACvB,CAAC;CACF;AAED,MAAM,OAAO,yBAA0B,SAAQ,KAAK;IACzC,kBAAkB,CAAS;IAC3B,MAAM,CAAS;IAExB,YAAY,kBAA0B,EAAE,MAAc;QACpD,KAAK,CAAC,eAAe,kBAAkB,MAAM,MAAM,EAAE,CAAC,CAAC;QACvD,IAAI,CAAC,IAAI,GAAG,2BAA2B,CAAC;QACxC,IAAI,CAAC,kBAAkB,GAAG,kBAAkB,CAAC;QAC7C,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;IACvB,CAAC;CACF;AAED,wEAAwE;AAExE;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,wBAAwB,CACtC,OAAe,EACf,cAAsB;IAEtB,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvB,MAAM,IAAI,yBAAyB,CACjC,cAAc,EACd,0CAA0C,CAC3C,CAAC;IACJ,CAAC;IAED,MAAM,IAAI,GAAG,IAAI,QAAQ,CAAC,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,UAAU,EAAE,OAAO,CAAC,UAAU,CAAC,CAAC;IAClF,MAAM,cAAc,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;IAE/C,IAAI,cAAc,KAAK,+BAA+B,EAAE,CAAC;QACvD,MAAM,IAAI,yBAAyB,CACjC,cAAc,EACd,oDAAoD,CACrD,CAAC;IACJ,CAAC;IAED,MAAM,OAAO,GAAmB,EAAE,CAAC;IACnC,IAAI,iBAAiB,GAAG,CAAC,CAAC;IAC1B,IAAI,MAAM,GAAG,CAAC,CAAC;IAEf,OAAO,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACnC,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QAC/C,IAAI,SAAS,KAAK,+BAA+B;YAAE,MAAM;QAEzD,IAAI,MAAM,GAAG,EAAE,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;YACjC,MAAM,IAAI,yBAAyB,CACjC,cAAc,EACd,uDAAuD,CACxD,CAAC;QACJ,CAAC;QAED,MAAM,iBAAiB,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,IAAI,CAAC,CAAC;QAC3D,MAAM,cAAc,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,GAAG,EAAE,EAAE,IAAI,CAAC,CAAC;QACzD,MAAM,gBAAgB,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,GAAG,EAAE,EAAE,IAAI,CAAC,CAAC;QAC3D,MAAM,cAAc,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,GAAG,EAAE,EAAE,IAAI,CAAC,CAAC;QACzD,MAAM,gBAAgB,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,GAAG,EAAE,EAAE,IAAI,CAAC,CAAC;QAE3D,MAAM,aAAa,GAAG,MAAM,GAAG,EAAE,CAAC;QAClC,MAAM,WAAW,GAAG,aAAa,GAAG,cAAc,CAAC;QAEnD,IAAI,WAAW,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;YACjC,MAAM,IAAI,yBAAyB,CACjC,cAAc,EACd,8CAA8C,CAC/C,CAAC;QACJ,CAAC;QAED,MAAM,aAAa,GAAG,OAAO,CAAC,QAAQ,CAAC,aAAa,EAAE,WAAW,CAAC,CAAC;QAEnE,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,aAAa,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YAC9C,IAAI,aAAa,CAAC,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;gBAC9B,MAAM,IAAI,yBAAyB,CACjC,cAAc,EACd,oEAAoE,CACrE,CAAC;YACJ,CAAC;QACH,CAAC;QAED,MAAM,QAAQ,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC;QAEzD,MAAM,WAAW,GAAG,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;QAE3C,IAAI,CAAC,WAAW,EAAE,CAAC;YACjB,IAAI,QAAQ,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC1D,MAAM,IAAI,yBAAyB,CACjC,cAAc,EACd,mEAAmE,QAAQ,EAAE,CAC9E,CAAC;YACJ,CAAC;YAED,IAAI,gBAAgB,CAAC,QAAQ,CAAC,EAAE,CAAC;gBAC/B,MAAM,IAAI,yBAAyB,CACjC,cAAc,EACd,mEAAmE,QAAQ,EAAE,CAC9E,CAAC;YACJ,CAAC;YAED,OAAO,CAAC,IAAI,CAAC,EAAE,YAAY,EAAE,QAAQ,EAAE,gBAAgB,EAAE,CAAC,CAAC;YAC3D,iBAAiB,IAAI,gBAAgB,CAAC;QACxC,CAAC;QAED,MAAM,SAAS,GAAG,aAAa,GAAG,cAAc,GAAG,gBAAgB,CAAC;QAEpE,yDAAyD;QACzD,MAAM,YAAY,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,IAAI,CAAC,CAAC;QACtD,IAAI,QAAQ,GAAG,cAAc,CAAC;QAE9B,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,cAAc,KAAK,CAAC,EAAE,CAAC;YACxD,iEAAiE;YACjE,iEAAiE;YACjE,iEAAiE;YACjE,IAAI,CAAC,WAAW,IAAI,iBAAiB,KAAK,CAAC,EAAE,CAAC;gBAC5C,MAAM,IAAI,yBAAyB,CACjC,cAAc,EACd,gGAAgG,CACjG,CAAC;YACJ,CAAC;QACH,CAAC;QAED,MAAM,GAAG,SAAS,GAAG,QAAQ,CAAC;IAChC,CAAC;IAED,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,MAAM,IAAI,yBAAyB,CACjC,cAAc,EACd,2CAA2C,CAC5C,CAAC;IACJ,CAAC;IAED,IAAI,OAAO,CAAC,MAAM,GAAG,aAAa,EAAE,CAAC;QACnC,MAAM,IAAI,yBAAyB,CACjC,cAAc,EACd,YAAY,OAAO,CAAC,MAAM,kBAAkB,aAAa,GAAG,CAC7D,CAAC;IACJ,CAAC;IAED,IAAI,iBAAiB,GAAG,sBAAsB,EAAE,CAAC;QAC/C,MAAM,MAAM,GAAG,CAAC,iBAAiB,GAAG,CAAC,IAAI,GAAG,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;QAC9D,MAAM,OAAO,GAAG,CAAC,sBAAsB,GAAG,CAAC,IAAI,GAAG,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;QACpE,MAAM,IAAI,yBAAyB,CACjC,cAAc,EACd,oBAAoB,MAAM,eAAe,OAAO,MAAM,CACvD,CAAC;IACJ,CAAC;IAED,OAAO,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,YAAY,CAAC,aAAa,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC;AAC9E,CAAC;AAED,wEAAwE;AAExE;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,IAA8B;IACpE,MAAM,EAAE,OAAO,EAAE,WAAW,EAAE,OAAO,EAAE,WAAW,EAAE,GAAG,IAAI,CAAC;IAE5D,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IAExC,yDAAyD;IACzD,MAAM,UAAU,GAAG,iBAAiB,CAAC,WAAW,CAAC,CAAC;IAElD,yDAAyD;IACzD,MAAM,aAAa,GAAmB,EAAE,CAAC;IAEzC,KAAK,MAAM,UAAU,IAAI,WAAW,EAAE,CAAC;QACrC,MAAM,OAAO,GAAG,MAAM,kBAAkB,CAAC,UAAU,EAAE,OAAO,EAAE,WAAW,CAAC,CAAC;QAC3E,MAAM,SAAS,GAAG,UAAU,CAAC,GAAG,CAAC,UAAU,CAAE,CAAC;QAE9C,IAAI,UAAU,CAAC,OAAO,EAAE,CAAC;YACvB,MAAM,OAAO,GAAG,wBAAwB,CAAC,OAAO,EAAE,UAAU,CAAC,QAAQ,CAAC,CAAC;YACvE,MAAM,SAAS,GAAG,MAAM,qBAAqB,CAC3C,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,OAAO,CACrC,CAAC;YACF,aAAa,CAAC,IAAI,CAAC,GAAG,SAAS,CAAC,CAAC;QACnC,CAAC;aAAM,CAAC;YACN,MAAM,OAAO,CAAC,eAAe,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;YAClD,aAAa,CAAC,IAAI,CAAC;gBACjB,QAAQ,EAAE,UAAU,CAAC,QAAQ,IAAI,QAAQ,CAAC,SAAS,CAAC;gBACpD,IAAI,EAAE,SAAS;gBACf,SAAS,EAAE,OAAO,CAAC,MAAM;aAC1B,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,OAAO,CAAC,GAAG,CACT,kCAAkC,aAAa,CAAC,MAAM,yBAAyB,CAChF,CAAC;IAEF,OAAO,aAAa,CAAC;AACvB,CAAC;AAED,wEAAwE;AAExE,SAAS,iBAAiB,CACxB,WAAkC;IAElC,MAAM,MAAM,GAAG,IAAI,GAAG,EAAsB,CAAC;IAC7C,MAAM,gBAAgB,GAAG,IAAI,GAAG,EAAsB,CAAC;IAEvD,KAAK,MAAM,UAAU,IAAI,WAAW,EAAE,CAAC;QACrC,MAAM,SAAS,GAAG,gBAAgB,CAAC,UAAU,CAAC,CAAC;QAC/C,MAAM,QAAQ,GAAG,gBAAgB,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QAEjD,IAAI,QAAQ,EAAE,CAAC;YACb,MAAM,IAAI,wBAAwB,CAChC,UAAU,CAAC,QAAQ,EACnB,eAAe,SAAS,+BAA+B,QAAQ,CAAC,QAAQ,KAAK;gBAC7E,4EAA4E,CAC7E,CAAC;QACJ,CAAC;QAED,gBAAgB,CAAC,GAAG,CAAC,SAAS,EAAE,UAAU,CAAC,CAAC;QAC5C,MAAM,CAAC,GAAG,CAAC,UAAU,EAAE,SAAS,CAAC,CAAC;IACpC,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,gBAAgB,CAAC,UAAsB;IAC9C,IAAI,UAAU,CAAC,SAAS,EAAE,CAAC;QACzB,MAAM,OAAO,GAAG,UAAU,CAAC,SAAS,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QACzD,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACzB,MAAM,IAAI,wBAAwB,CAChC,UAAU,CAAC,QAAQ,EACnB,oEAAoE,CACrE,CAAC;QACJ,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,MAAM,QAAQ,GAAG,UAAU,CAAC,QAAQ,IAAI,cAAc,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC;IAC9E,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,MAAM,IAAI,wBAAwB,CAChC,WAAW,EACX,8EAA8E,CAC/E,CAAC;IACJ,CAAC;IAED,OAAO,GAAG,qBAAqB,IAAI,QAAQ,EAAE,CAAC;AAChD,CAAC;AAED,SAAS,cAAc,CAAC,UAAkB;IACxC,IAAI,CAAC,UAAU;QAAE,OAAO,EAAE,CAAC;IAC3B,MAAM,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACpC,OAAO,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;AACvC,CAAC;AAED,KAAK,UAAU,kBAAkB,CAC/B,UAAsB,EACtB,OAAwB,EACxB,WAAoB;IAEpB,sDAAsD;IACtD,IAAI,WAAW,IAAI,UAAU,CAAC,SAAS,EAAE,CAAC;QACxC,IAAI,CAAC;YACH,OAAO,MAAM,QAAQ,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;QAC9C,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,IAAI,wBAAwB,CAChC,UAAU,CAAC,QAAQ,EACnB,8BAA8B,UAAU,CAAC,SAAS,MAAM,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAC3G,CAAC;QACJ,CAAC;IACH,CAAC;IAED,4CAA4C;IAC5C,IAAI,CAAC,UAAU,CAAC,UAAU,EAAE,CAAC;QAC3B,MAAM,IAAI,wBAAwB,CAChC,UAAU,CAAC,QAAQ,EACnB,8DAA8D,CAC/D,CAAC;IACJ,CAAC;IAED,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,cAAc,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC;QAChE,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,CAAC;QAElC,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,IAAI,KAAK,CAAC,QAAQ,QAAQ,CAAC,MAAM,KAAK,QAAQ,CAAC,UAAU,EAAE,CAAC,CAAC;QACrE,CAAC;QAED,MAAM,WAAW,GAAG,MAAM,QAAQ,CAAC,WAAW,EAAE,CAAC;QACjD,OAAO,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;IAClC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,GAAG,YAAY,wBAAwB;YAAE,MAAM,GAAG,CAAC;QACvD,MAAM,IAAI,wBAAwB,CAChC,UAAU,CAAC,QAAQ,EACnB,yCAAyC,UAAU,CAAC,UAAU,MAAM,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CACvH,CAAC;IACJ,CAAC;AACH,CAAC;AAED,KAAK,UAAU,qBAAqB,CAClC,OAAe,EACf,OAAgC,EAChC,QAAgB,EAChB,OAAyB;IAEzB,MAAM,aAAa,GAAG,QAAQ,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IACnD,MAAM,QAAQ,GAAmB,EAAE,CAAC;IACpC,MAAM,aAAa,GAAG,gBAAgB,CAAC,OAAO,CAAC,CAAC;IAEhD,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC5B,MAAM,QAAQ,GAAG,aAAa,CAAC,GAAG,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;QACvD,IAAI,CAAC,QAAQ;YAAE,SAAS;QAExB,MAAM,OAAO,GAAG,MAAM,eAAe,CAAC,QAAQ,CAAC,CAAC;QAChD,MAAM,UAAU,GAAG,GAAG,aAAa,IAAI,KAAK,CAAC,YAAY,EAAE,CAAC;QAE5D,MAAM,OAAO,CAAC,eAAe,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;QACnD,QAAQ,CAAC,IAAI,CAAC;YACZ,QAAQ,EAAE,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,YAAY,CAAC;YAC5C,IAAI,EAAE,UAAU;YAChB,SAAS,EAAE,OAAO,CAAC,MAAM;SAC1B,CAAC,CAAC;IACL,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC;AAOD,SAAS,gBAAgB,CAAC,OAAe;IACvC,MAAM,MAAM,GAAG,IAAI,GAAG,EAAuB,CAAC;IAC9C,MAAM,IAAI,GAAG,IAAI,QAAQ,CAAC,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,UAAU,EAAE,OAAO,CAAC,UAAU,CAAC,CAAC;IAClF,IAAI,MAAM,GAAG,CAAC,CAAC;IAEf,OAAO,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACnC,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QAC/C,IAAI,SAAS,KAAK,+BAA+B;YAAE,MAAM;QAEzD,MAAM,iBAAiB,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,IAAI,CAAC,CAAC;QAC3D,MAAM,cAAc,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,GAAG,EAAE,EAAE,IAAI,CAAC,CAAC;QACzD,MAAM,cAAc,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,GAAG,EAAE,EAAE,IAAI,CAAC,CAAC;QACzD,MAAM,gBAAgB,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,GAAG,EAAE,EAAE,IAAI,CAAC,CAAC;QAE3D,MAAM,aAAa,GAAG,MAAM,GAAG,EAAE,CAAC;QAClC,MAAM,QAAQ,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CACvC,OAAO,CAAC,QAAQ,CAAC,aAAa,EAAE,aAAa,GAAG,cAAc,CAAC,CAChE,CAAC;QAEF,MAAM,SAAS,GAAG,aAAa,GAAG,cAAc,GAAG,gBAAgB,CAAC;QACpE,MAAM,cAAc,GAAG,OAAO,CAAC,QAAQ,CAAC,SAAS,EAAE,SAAS,GAAG,cAAc,CAAC,CAAC;QAE/E,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;YAC5B,MAAM,CAAC,GAAG,CAAC,QAAQ,EAAE;gBACnB,cAAc,EAAE,MAAM,CAAC,IAAI,CAAC,cAAc,CAAC;gBAC3C,iBAAiB;aAClB,CAAC,CAAC;QACL,CAAC;QAED,MAAM,GAAG,SAAS,GAAG,cAAc,CAAC;IACtC,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,KAAK,UAAU,eAAe,CAAC,KAAkB;IAC/C,IAAI,KAAK,CAAC,iBAAiB,KAAK,CAAC,EAAE,CAAC;QAClC,OAAO,KAAK,CAAC,cAAc,CAAC;IAC9B,CAAC;IAED,IAAI,KAAK,CAAC,iBAAiB,KAAK,CAAC,EAAE,CAAC;QAClC,OAAO,IAAI,OAAO,CAAS,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YAC7C,MAAM,OAAO,GAAG,gBAAgB,EAAE,CAAC;YACnC,MAAM,MAAM,GAAa,EAAE,CAAC;YAC5B,OAAO,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;YAC1D,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;YACxD,OAAO,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;YAC5B,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC;QACpC,CAAC,CAAC,CAAC;IACL,CAAC;IAED,MAAM,IAAI,KAAK,CAAC,uCAAuC,KAAK,CAAC,iBAAiB,EAAE,CAAC,CAAC;AACpF,CAAC;AAED,SAAS,gBAAgB,CAAC,QAAgB;IACxC,MAAM,UAAU,GAAG,KAAK,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;IAC7C,IAAI,UAAU,CAAC,UAAU,CAAC,KAAK,CAAC,IAAI,UAAU,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAErE,MAAM,QAAQ,GAAG,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IACzC,KAAK,MAAM,GAAG,IAAI,QAAQ,EAAE,CAAC;QAC3B,IAAI,GAAG,KAAK,IAAI;YAAE,OAAO,IAAI,CAAC;IAChC,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC"}

package/dist/activities/execute-deep-agent/auto-publish.d.ts

@@ -0,0 +1,17 @@
+/**
+ * Post-stream safety net for artifact publishing.
+ *
+ * Scans completed tool calls for file-modifying operations (write, edit,
+ * create) and publishes any files that were not already published inline.
+ * This catches files modified by paths not triggered during streaming
+ * (e.g., shell commands, race conditions in fire-and-forget publish).
+ */
+import type { AgentExecutionStatus } from "@stigmer/protos/ai/stigmer/agentic/agentexecution/v1/api_pb";
+import type { InlinePublisher } from "./inline-publisher.js";
+/**
+ * Scan all tool calls in the execution status for file-modifying operations
+ * and publish any files that were not already published inline.
+ *
+ * Returns the count of additionally published artifacts.
+ */
+export declare function autoPublishWrittenFiles(status: AgentExecutionStatus, inlinePublisher: InlinePublisher): Promise<number>;