@stigmer/runner 3.12.0 → 3.12.2

package/dist/shared/plan-mode-permissions.d.ts

@@ -2,12 +2,26 @@
  * The Plan-mode filesystem permission rules — the enforcement twin of
  * `plan-mode-prompt.ts` (which carries the instruction half of the contract).
  *
- * Plan mode is read-only BY CONSTRUCTION on the native harness: these rules
- * deny every filesystem write operation at the tool level so
- * write_file/edit_file cannot mutate the workspace regardless of what the
- * model was told. Rules are first-match-wins with a permissive default, so a
- * single deny-all-writes rule is sufficient. (The Cursor harness has no
- * tool-level lever and enforces plan mode via its prompt prefix instead.)
+ * Plan mode is contained BY CONSTRUCTION on the native harness: these rules
+ * deny every filesystem write everywhere AND scope reads to the session
+ * workspace (issue #528 — owner ruling: the workspace is plan mode's read
+ * boundary on cloud and desktop runners alike). Without the read boundary,
+ * model-provided absolute paths reached anywhere the process account could
+ * read — the pod filesystem (including /proc/self/environ) on cloud runners,
+ * the user's whole home directory on desktop — while plan mode still carries
+ * exfiltration-capable tools (web_fetch, MCP). Rules are first-match-wins
+ * with a permissive default (deepagents' decidePathAccess), so order is
+ * load-bearing: the workspace read-allow must precede the read-deny.
+ *
+ * The workspace-root pattern is matched as a STRING against the raw tool-call
+ * path (micromatch, dot:true), before the backend touches disk. That is
+ * exactly why the legitimate out-of-workspace reads keep working: skills,
+ * attachments, and the approved plan live in the platform dir but are
+ * addressed through the `{workspace}/.stigmer` symlink (see
+ * shared/workspace/stigmer-link.ts), so their path strings are in-root even
+ * though the bytes are not. The same holds for multi-workspace local entries
+ * (`{workspace}/{name}` symlinks). A realpath-based boundary would break
+ * both; do not "harden" this into one.
  *
  * Applied in execute-deep-agent/setup.ts to the parent graph AND threaded
  * into every compiled sub-agent graph: deepagents' parent-permission
@@ -18,9 +32,9 @@
  *
  * Rules travel with a companion: every graph that carries them also installs
  * the path-normalization middleware (middleware/path-normalization.ts,
- * issue #429), because deepagents' rule validation refuses workspace-relative
- * paths outright — without the shim, prompt-compliant relative READS die in
- * validation instead of just working. Both are derived from the same
+ * issues #429/#528), because deepagents' rule validation refuses
+ * workspace-relative paths outright and its `ls`/`glob`/`grep` schema default
+ * of "/" would deny the bare first listing. Both are derived from the same
  * expression at each composition site so they cannot drift apart.
  *
  * Invariant: never combine these rules with a shell-capable (sandbox)
@@ -30,4 +44,26 @@
  * for shell capability on both the parent and sub-agent backends.
  */
 import type { FilesystemPermission } from "deepagents";
-export declare const PLAN_MODE_PERMISSIONS: FilesystemPermission[];
+/**
+ * Backslash-escape every character micromatch/picomatch treats as glob
+ * syntax, so the result matches the input literally. micromatch exports no
+ * escape API of its own, and this is correctness, not caution: an unescaped
+ * `(` in a desktop project path would make the workspace read-allow rule
+ * silently never match — bricking every plan-mode read for that workspace.
+ * Semantics are pinned end-to-end through deepagents' own matcher by the
+ * special-character workspace suite in plan-mode-path-normalization.test.ts.
+ */
+export declare function escapeGlobLiteral(literal: string): string;
+/**
+ * Build the plan-mode rule set for a graph whose filesystem backend is
+ * rooted at `workspaceRootDir`. The three rules read as the policy:
+ * reads allowed in the workspace, reads denied everywhere else, writes
+ * denied everywhere.
+ *
+ * `{root}/**` matches the root itself as well as its subtree (verified
+ * against the installed micromatch), so one allow pattern suffices. The
+ * root is `path.resolve`d first because enforcement canonicalizes incoming
+ * paths (collapsed slashes, no trailing separator) before matching — a
+ * trailing slash in the pattern would silently match nothing.
+ */
+export declare function buildPlanModePermissions(workspaceRootDir: string): FilesystemPermission[];

package/dist/shared/plan-mode-permissions.js

@@ -2,12 +2,26 @@
  * The Plan-mode filesystem permission rules — the enforcement twin of
  * `plan-mode-prompt.ts` (which carries the instruction half of the contract).
  *
- * Plan mode is read-only BY CONSTRUCTION on the native harness: these rules
- * deny every filesystem write operation at the tool level so
- * write_file/edit_file cannot mutate the workspace regardless of what the
- * model was told. Rules are first-match-wins with a permissive default, so a
- * single deny-all-writes rule is sufficient. (The Cursor harness has no
- * tool-level lever and enforces plan mode via its prompt prefix instead.)
+ * Plan mode is contained BY CONSTRUCTION on the native harness: these rules
+ * deny every filesystem write everywhere AND scope reads to the session
+ * workspace (issue #528 — owner ruling: the workspace is plan mode's read
+ * boundary on cloud and desktop runners alike). Without the read boundary,
+ * model-provided absolute paths reached anywhere the process account could
+ * read — the pod filesystem (including /proc/self/environ) on cloud runners,
+ * the user's whole home directory on desktop — while plan mode still carries
+ * exfiltration-capable tools (web_fetch, MCP). Rules are first-match-wins
+ * with a permissive default (deepagents' decidePathAccess), so order is
+ * load-bearing: the workspace read-allow must precede the read-deny.
+ *
+ * The workspace-root pattern is matched as a STRING against the raw tool-call
+ * path (micromatch, dot:true), before the backend touches disk. That is
+ * exactly why the legitimate out-of-workspace reads keep working: skills,
+ * attachments, and the approved plan live in the platform dir but are
+ * addressed through the `{workspace}/.stigmer` symlink (see
+ * shared/workspace/stigmer-link.ts), so their path strings are in-root even
+ * though the bytes are not. The same holds for multi-workspace local entries
+ * (`{workspace}/{name}` symlinks). A realpath-based boundary would break
+ * both; do not "harden" this into one.
  *
  * Applied in execute-deep-agent/setup.ts to the parent graph AND threaded
  * into every compiled sub-agent graph: deepagents' parent-permission
@@ -18,9 +32,9 @@
  *
  * Rules travel with a companion: every graph that carries them also installs
  * the path-normalization middleware (middleware/path-normalization.ts,
- * issue #429), because deepagents' rule validation refuses workspace-relative
- * paths outright — without the shim, prompt-compliant relative READS die in
- * validation instead of just working. Both are derived from the same
+ * issues #429/#528), because deepagents' rule validation refuses
+ * workspace-relative paths outright and its `ls`/`glob`/`grep` schema default
+ * of "/" would deny the bare first listing. Both are derived from the same
  * expression at each composition site so they cannot drift apart.
  *
  * Invariant: never combine these rules with a shell-capable (sandbox)
@@ -29,7 +43,37 @@
  * it is the mode that clears `shellEnv`, and `shellEnv` is the single switch
  * for shell capability on both the parent and sub-agent backends.
  */
-export const PLAN_MODE_PERMISSIONS = [
-    { operations: ["write"], paths: ["/**"], mode: "deny" },
-];
+import { resolve } from "node:path";
+/**
+ * Backslash-escape every character micromatch/picomatch treats as glob
+ * syntax, so the result matches the input literally. micromatch exports no
+ * escape API of its own, and this is correctness, not caution: an unescaped
+ * `(` in a desktop project path would make the workspace read-allow rule
+ * silently never match — bricking every plan-mode read for that workspace.
+ * Semantics are pinned end-to-end through deepagents' own matcher by the
+ * special-character workspace suite in plan-mode-path-normalization.test.ts.
+ */
+export function escapeGlobLiteral(literal) {
+    return literal.replace(/[\\*?()[\]{}!+@]/g, "\\$&");
+}
+/**
+ * Build the plan-mode rule set for a graph whose filesystem backend is
+ * rooted at `workspaceRootDir`. The three rules read as the policy:
+ * reads allowed in the workspace, reads denied everywhere else, writes
+ * denied everywhere.
+ *
+ * `{root}/**` matches the root itself as well as its subtree (verified
+ * against the installed micromatch), so one allow pattern suffices. The
+ * root is `path.resolve`d first because enforcement canonicalizes incoming
+ * paths (collapsed slashes, no trailing separator) before matching — a
+ * trailing slash in the pattern would silently match nothing.
+ */
+export function buildPlanModePermissions(workspaceRootDir) {
+    const canonicalRoot = resolve(workspaceRootDir);
+    return [
+        { operations: ["read"], paths: [`${escapeGlobLiteral(canonicalRoot)}/**`] },
+        { operations: ["read"], paths: ["/**"], mode: "deny" },
+        { operations: ["write"], paths: ["/**"], mode: "deny" },
+    ];
+}
 //# sourceMappingURL=plan-mode-permissions.js.map

package/dist/shared/plan-mode-permissions.js.map

@@ -1 +1 @@
-{"version":3,"file":"plan-mode-permissions.js","sourceRoot":"","sources":["../../src/shared/plan-mode-permissions.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AAIH,MAAM,CAAC,MAAM,qBAAqB,GAA2B;IAC3D,EAAE,UAAU,EAAE,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,CAAC,KAAK,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE;CACxD,CAAC"}
+{"version":3,"file":"plan-mode-permissions.js","sourceRoot":"","sources":["../../src/shared/plan-mode-permissions.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4CG;AAEH,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAGpC;;;;;;;;GAQG;AACH,MAAM,UAAU,iBAAiB,CAAC,OAAe;IAC/C,OAAO,OAAO,CAAC,OAAO,CAAC,mBAAmB,EAAE,MAAM,CAAC,CAAC;AACtD,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,wBAAwB,CACtC,gBAAwB;IAExB,MAAM,aAAa,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAAC;IAChD,OAAO;QACL,EAAE,UAAU,EAAE,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,CAAC,GAAG,iBAAiB,CAAC,aAAa,CAAC,KAAK,CAAC,EAAE;QAC3E,EAAE,UAAU,EAAE,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,CAAC,KAAK,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE;QACtD,EAAE,UAAU,EAAE,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,CAAC,KAAK,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE;KACxD,CAAC;AACJ,CAAC"}

package/dist/shared/zip-extract.d.ts

@@ -1,10 +1,24 @@
 /**
- * Minimal, dependency-free ZIP archive parser.
+ * Skill-artifact ZIP extraction: text-decoded entries with non-fatal
+ * structural failure.
  *
- * Handles the local file header format, supporting stored (method 0) and
- * deflated (method 8) entries. Returns parsed entries as path + content
- * pairs — consumers bring their own write mechanism (WorkspaceBackend,
- * node:fs, etc.).
+ * Structural parsing lives in zip-structure.ts (central-directory-based —
+ * see that module's doc for why local-header walks are never acceptable,
+ * issue #450). This module owns the skill-artifact *policy* on top of it:
+ *
+ * Input without a readable central directory is not given a second
+ * chance on purpose: every artifact reaching the runner was validated at
+ * push by a central-directory-based reader on both editions (OSS:
+ * `safearchive/zip` in stigmer-server's skill storage; cloud:
+ * commons-compress `ZipFile` in SkillArtifactExtractor), so a missing
+ * EOCD here can only mean a truncated or corrupted download — and the
+ * honest result for that is the documented empty return, not a guess.
+ * (The attachment injector consumes the same structural layer under the
+ * opposite policy — fail-hard — because its input is untrusted.)
+ *
+ * Handles stored (method 0) and deflated (method 8) entries. Returns
+ * parsed entries as path + content pairs — consumers bring their own
+ * write mechanism (WorkspaceBackend, node:fs, etc.).
  *
  * Extracted from skill-writer.ts so both the deep-agent and Cursor
  * harnesses can share the same ZIP parsing logic without coupling to
@@ -23,7 +37,11 @@ export interface ZipFileEntry {
  * entries whose filename (basename or full path) matches any excluded name.
  *
  * Returns an empty array for empty, truncated, or non-ZIP input rather
- * than throwing — callers treat missing artifacts as non-fatal.
+ * than throwing — callers treat missing artifacts as non-fatal. Errors
+ * while *decompressing* a structurally valid entry (corrupt deflate
+ * stream, unsupported compression method) do propagate: at that point
+ * the archive's structure vouched for the entry, and silently dropping
+ * it would be the exact corruption this module exists to prevent.
  */
 export declare function extractZipFileEntries(zipBytes: Uint8Array, options?: {
     exclude?: readonly string[];

package/dist/shared/zip-extract.js

@@ -1,16 +1,31 @@
 /**
- * Minimal, dependency-free ZIP archive parser.
+ * Skill-artifact ZIP extraction: text-decoded entries with non-fatal
+ * structural failure.
  *
- * Handles the local file header format, supporting stored (method 0) and
- * deflated (method 8) entries. Returns parsed entries as path + content
- * pairs — consumers bring their own write mechanism (WorkspaceBackend,
- * node:fs, etc.).
+ * Structural parsing lives in zip-structure.ts (central-directory-based —
+ * see that module's doc for why local-header walks are never acceptable,
+ * issue #450). This module owns the skill-artifact *policy* on top of it:
+ *
+ * Input without a readable central directory is not given a second
+ * chance on purpose: every artifact reaching the runner was validated at
+ * push by a central-directory-based reader on both editions (OSS:
+ * `safearchive/zip` in stigmer-server's skill storage; cloud:
+ * commons-compress `ZipFile` in SkillArtifactExtractor), so a missing
+ * EOCD here can only mean a truncated or corrupted download — and the
+ * honest result for that is the documented empty return, not a guess.
+ * (The attachment injector consumes the same structural layer under the
+ * opposite policy — fail-hard — because its input is untrusted.)
+ *
+ * Handles stored (method 0) and deflated (method 8) entries. Returns
+ * parsed entries as path + content pairs — consumers bring their own
+ * write mechanism (WorkspaceBackend, node:fs, etc.).
  *
  * Extracted from skill-writer.ts so both the deep-agent and Cursor
  * harnesses can share the same ZIP parsing logic without coupling to
  * a specific workspace abstraction.
  */
 import { createInflateRaw } from "node:zlib";
+import { EOCD_MIN_SIZE, parseZipStructure } from "./zip-structure.js";
 /**
  * Parse and decompress all file entries from a ZIP archive.
  *
@@ -18,16 +33,22 @@ import { createInflateRaw } from "node:zlib";
  * entries whose filename (basename or full path) matches any excluded name.
  *
  * Returns an empty array for empty, truncated, or non-ZIP input rather
- * than throwing — callers treat missing artifacts as non-fatal.
+ * than throwing — callers treat missing artifacts as non-fatal. Errors
+ * while *decompressing* a structurally valid entry (corrupt deflate
+ * stream, unsupported compression method) do propagate: at that point
+ * the archive's structure vouched for the entry, and silently dropping
+ * it would be the exact corruption this module exists to prevent.
  */
 export async function extractZipFileEntries(zipBytes, options) {
-    if (zipBytes.length < 4)
+    if (zipBytes.length < EOCD_MIN_SIZE)
         return [];
     let entries;
     try {
-        entries = parseZipEntries(zipBytes);
+        entries = parseZipStructure(zipBytes);
     }
-    catch {
+    catch (err) {
+        console.warn("[zip-extract] archive has no readable central directory " +
+            `(truncated or corrupt download?): ${err instanceof Error ? err.message : String(err)}`);
         return [];
     }
     const excludeSet = new Set(options?.exclude ?? []);
@@ -50,87 +71,7 @@ function isExcluded(name, excludeSet) {
     const basename = name.includes("/") ? name.slice(name.lastIndexOf("/") + 1) : name;
     return excludeSet.has(basename);
 }
-function parseZipEntries(data) {
-    const entries = [];
-    const view = new DataView(data.buffer, data.byteOffset, data.byteLength);
-    let offset = 0;
-    while (offset < data.length - 4) {
-        const signature = view.getUint32(offset, true);
-        if (signature !== 0x04034b50)
-            break; // Local file header signature
-        const generalFlags = view.getUint16(offset + 6, true);
-        const hasDataDescriptor = (generalFlags & 0x08) !== 0;
-        const compressionMethod = view.getUint16(offset + 8, true);
-        let compressedSize = view.getUint32(offset + 18, true);
-        let uncompressedSize = view.getUint32(offset + 22, true);
-        const fileNameLength = view.getUint16(offset + 26, true);
-        const extraFieldLength = view.getUint16(offset + 28, true);
-        const fileNameStart = offset + 30;
-        const fileName = new TextDecoder().decode(data.subarray(fileNameStart, fileNameStart + fileNameLength));
-        const dataStart = fileNameStart + fileNameLength + extraFieldLength;
-        if (hasDataDescriptor && compressedSize === 0) {
-            const sizes = findDataDescriptor(data, view, dataStart, compressionMethod);
-            compressedSize = sizes.compressedSize;
-            uncompressedSize = sizes.uncompressedSize;
-        }
-        const compressedData = data.subarray(dataStart, dataStart + compressedSize);
-        entries.push({
-            name: fileName,
-            isDirectory: fileName.endsWith("/"),
-            compressedData,
-            compressionMethod,
-            uncompressedSize,
-        });
-        let nextOffset = dataStart + compressedSize;
-        if (hasDataDescriptor) {
-            if (nextOffset + 4 <= data.length && view.getUint32(nextOffset, true) === 0x08074b50) {
-                nextOffset += 16; // signature(4) + crc(4) + compressedSize(4) + uncompressedSize(4)
-            }
-            else {
-                nextOffset += 12; // crc(4) + compressedSize(4) + uncompressedSize(4)
-            }
-        }
-        offset = nextOffset;
-    }
-    return entries;
-}
-/**
- * Scan forward from dataStart to find the data descriptor that contains
- * the actual compressed and uncompressed sizes. Looks for either the
- * optional signature 0x08074b50 or falls back to scanning the central
- * directory for the matching entry.
- */
-function findDataDescriptor(data, view, dataStart, _compressionMethod) {
-    for (let pos = dataStart; pos < data.length - 16; pos++) {
-        const sig = view.getUint32(pos, true);
-        if (sig === 0x08074b50) {
-            return {
-                compressedSize: view.getUint32(pos + 8, true),
-                uncompressedSize: view.getUint32(pos + 12, true),
-            };
-        }
-        if (sig === 0x04034b50 || sig === 0x02014b50) {
-            const descStart = pos - 12;
-            if (descStart >= dataStart) {
-                return {
-                    compressedSize: view.getUint32(descStart + 4, true),
-                    uncompressedSize: view.getUint32(descStart + 8, true),
-                };
-            }
-            break;
-        }
-    }
-    for (let pos = dataStart; pos < data.length - 4; pos++) {
-        const sig = view.getUint32(pos, true);
-        if (sig === 0x04034b50 || sig === 0x02014b50 || sig === 0x08074b50) {
-            const compressedSize = sig === 0x08074b50
-                ? view.getUint32(pos + 8, true)
-                : pos - dataStart;
-            return { compressedSize, uncompressedSize: 0 };
-        }
-    }
-    return { compressedSize: data.length - dataStart, uncompressedSize: 0 };
-}
+// ─── Decompression ───────────────────────────────────────────────────────
 async function decompressEntry(entry) {
     if (entry.compressionMethod === 0) {
         return new TextDecoder().decode(entry.compressedData);

package/dist/shared/zip-extract.js.map

@@ -1 +1 @@
-{"version":3,"file":"zip-extract.js","sourceRoot":"","sources":["../../src/shared/zip-extract.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAC;AAW7C;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,QAAoB,EACpB,OAAyC;IAEzC,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,EAAE,CAAC;IAEnC,IAAI,OAAmB,CAAC;IACxB,IAAI,CAAC;QACH,OAAO,GAAG,eAAe,CAAC,QAAQ,CAAC,CAAC;IACtC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,OAAO,EAAE,OAAO,IAAI,EAAE,CAAC,CAAC;IACnD,MAAM,OAAO,GAAmB,EAAE,CAAC;IAEnC,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC5B,IAAI,KAAK,CAAC,WAAW;YAAE,SAAS;QAChC,IAAI,UAAU,CAAC,KAAK,CAAC,IAAI,EAAE,UAAU,CAAC;YAAE,SAAS;QAEjD,MAAM,OAAO,GAAG,MAAM,eAAe,CAAC,KAAK,CAAC,CAAC;QAC7C,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;IAC9C,CAAC;IAED,OAAO,OAAO,CAAC;AACjB,CAAC;AAYD,SAAS,UAAU,CAAC,IAAY,EAAE,UAA+B;IAC/D,IAAI,UAAU,CAAC,IAAI,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACxC,IAAI,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IAEtC,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACnF,OAAO,UAAU,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;AAClC,CAAC;AAED,SAAS,eAAe,CAAC,IAAgB;IACvC,MAAM,OAAO,GAAe,EAAE,CAAC;IAC/B,MAAM,IAAI,GAAG,IAAI,QAAQ,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC;IACzE,IAAI,MAAM,GAAG,CAAC,CAAC;IAEf,OAAO,MAAM,GAAG,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAChC,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QAC/C,IAAI,SAAS,KAAK,UAAU;YAAE,MAAM,CAAC,8BAA8B;QAEnE,MAAM,YAAY,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,IAAI,CAAC,CAAC;QACtD,MAAM,iBAAiB,GAAG,CAAC,YAAY,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC;QACtD,MAAM,iBAAiB,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,IAAI,CAAC,CAAC;QAC3D,IAAI,cAAc,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,GAAG,EAAE,EAAE,IAAI,CAAC,CAAC;QACvD,IAAI,gBAAgB,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,GAAG,EAAE,EAAE,IAAI,CAAC,CAAC;QACzD,MAAM,cAAc,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,GAAG,EAAE,EAAE,IAAI,CAAC,CAAC;QACzD,MAAM,gBAAgB,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,GAAG,EAAE,EAAE,IAAI,CAAC,CAAC;QAE3D,MAAM,aAAa,GAAG,MAAM,GAAG,EAAE,CAAC;QAClC,MAAM,QAAQ,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CACvC,IAAI,CAAC,QAAQ,CAAC,aAAa,EAAE,aAAa,GAAG,cAAc,CAAC,CAC7D,CAAC;QAEF,MAAM,SAAS,GAAG,aAAa,GAAG,cAAc,GAAG,gBAAgB,CAAC;QAEpE,IAAI,iBAAiB,IAAI,cAAc,KAAK,CAAC,EAAE,CAAC;YAC9C,MAAM,KAAK,GAAG,kBAAkB,CAAC,IAAI,EAAE,IAAI,EAAE,SAAS,EAAE,iBAAiB,CAAC,CAAC;YAC3E,cAAc,GAAG,KAAK,CAAC,cAAc,CAAC;YACtC,gBAAgB,GAAG,KAAK,CAAC,gBAAgB,CAAC;QAC5C,CAAC;QAED,MAAM,cAAc,GAAG,IAAI,CAAC,QAAQ,CAAC,SAAS,EAAE,SAAS,GAAG,cAAc,CAAC,CAAC;QAE5E,OAAO,CAAC,IAAI,CAAC;YACX,IAAI,EAAE,QAAQ;YACd,WAAW,EAAE,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC;YACnC,cAAc;YACd,iBAAiB;YACjB,gBAAgB;SACjB,CAAC,CAAC;QAEH,IAAI,UAAU,GAAG,SAAS,GAAG,cAAc,CAAC;QAC5C,IAAI,iBAAiB,EAAE,CAAC;YACtB,IAAI,UAAU,GAAG,CAAC,IAAI,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,SAAS,CAAC,UAAU,EAAE,IAAI,CAAC,KAAK,UAAU,EAAE,CAAC;gBACrF,UAAU,IAAI,EAAE,CAAC,CAAC,kEAAkE;YACtF,CAAC;iBAAM,CAAC;gBACN,UAAU,IAAI,EAAE,CAAC,CAAC,mDAAmD;YACvE,CAAC;QACH,CAAC;QACD,MAAM,GAAG,UAAU,CAAC;IACtB,CAAC;IAED,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;;;GAKG;AACH,SAAS,kBAAkB,CACzB,IAAgB,EAChB,IAAc,EACd,SAAiB,EACjB,kBAA0B;IAE1B,KAAK,IAAI,GAAG,GAAG,SAAS,EAAE,GAAG,GAAG,IAAI,CAAC,MAAM,GAAG,EAAE,EAAE,GAAG,EAAE,EAAE,CAAC;QACxD,MAAM,GAAG,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QACtC,IAAI,GAAG,KAAK,UAAU,EAAE,CAAC;YACvB,OAAO;gBACL,cAAc,EAAE,IAAI,CAAC,SAAS,CAAC,GAAG,GAAG,CAAC,EAAE,IAAI,CAAC;gBAC7C,gBAAgB,EAAE,IAAI,CAAC,SAAS,CAAC,GAAG,GAAG,EAAE,EAAE,IAAI,CAAC;aACjD,CAAC;QACJ,CAAC;QACD,IAAI,GAAG,KAAK,UAAU,IAAI,GAAG,KAAK,UAAU,EAAE,CAAC;YAC7C,MAAM,SAAS,GAAG,GAAG,GAAG,EAAE,CAAC;YAC3B,IAAI,SAAS,IAAI,SAAS,EAAE,CAAC;gBAC3B,OAAO;oBACL,cAAc,EAAE,IAAI,CAAC,SAAS,CAAC,SAAS,GAAG,CAAC,EAAE,IAAI,CAAC;oBACnD,gBAAgB,EAAE,IAAI,CAAC,SAAS,CAAC,SAAS,GAAG,CAAC,EAAE,IAAI,CAAC;iBACtD,CAAC;YACJ,CAAC;YACD,MAAM;QACR,CAAC;IACH,CAAC;IACD,KAAK,IAAI,GAAG,GAAG,SAAS,EAAE,GAAG,GAAG,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,GAAG,EAAE,EAAE,CAAC;QACvD,MAAM,GAAG,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QACtC,IAAI,GAAG,KAAK,UAAU,IAAI,GAAG,KAAK,UAAU,IAAI,GAAG,KAAK,UAAU,EAAE,CAAC;YACnE,MAAM,cAAc,GAAG,GAAG,KAAK,UAAU;gBACvC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,GAAG,CAAC,EAAE,IAAI,CAAC;gBAC/B,CAAC,CAAC,GAAG,GAAG,SAAS,CAAC;YACpB,OAAO,EAAE,cAAc,EAAE,gBAAgB,EAAE,CAAC,EAAE,CAAC;QACjD,CAAC;IACH,CAAC;IACD,OAAO,EAAE,cAAc,EAAE,IAAI,CAAC,MAAM,GAAG,SAAS,EAAE,gBAAgB,EAAE,CAAC,EAAE,CAAC;AAC1E,CAAC;AAED,KAAK,UAAU,eAAe,CAAC,KAAe;IAC5C,IAAI,KAAK,CAAC,iBAAiB,KAAK,CAAC,EAAE,CAAC;QAClC,OAAO,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC;IACxD,CAAC;IAED,IAAI,KAAK,CAAC,iBAAiB,KAAK,CAAC,EAAE,CAAC;QAClC,OAAO,IAAI,OAAO,CAAS,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YAC7C,MAAM,OAAO,GAAG,gBAAgB,EAAE,CAAC;YACnC,MAAM,MAAM,GAAa,EAAE,CAAC;YAC5B,OAAO,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;YAC1D,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;YAC1E,OAAO,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;YAC5B,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC,CAAC;QACjD,CAAC,CAAC,CAAC;IACL,CAAC;IAED,MAAM,IAAI,KAAK,CAAC,uCAAuC,KAAK,CAAC,iBAAiB,EAAE,CAAC,CAAC;AACpF,CAAC"}
+{"version":3,"file":"zip-extract.js","sourceRoot":"","sources":["../../src/shared/zip-extract.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAEH,OAAO,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAC;AAC7C,OAAO,EAAE,aAAa,EAAE,iBAAiB,EAA2B,MAAM,oBAAoB,CAAC;AAW/F;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,QAAoB,EACpB,OAAyC;IAEzC,IAAI,QAAQ,CAAC,MAAM,GAAG,aAAa;QAAE,OAAO,EAAE,CAAC;IAE/C,IAAI,OAA6B,CAAC;IAClC,IAAI,CAAC;QACH,OAAO,GAAG,iBAAiB,CAAC,QAAQ,CAAC,CAAC;IACxC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,CAAC,IAAI,CACV,0DAA0D;YAC1D,qCAAqC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CACxF,CAAC;QACF,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,OAAO,EAAE,OAAO,IAAI,EAAE,CAAC,CAAC;IACnD,MAAM,OAAO,GAAmB,EAAE,CAAC;IAEnC,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC5B,IAAI,KAAK,CAAC,WAAW;YAAE,SAAS;QAChC,IAAI,UAAU,CAAC,KAAK,CAAC,IAAI,EAAE,UAAU,CAAC;YAAE,SAAS;QAEjD,MAAM,OAAO,GAAG,MAAM,eAAe,CAAC,KAAK,CAAC,CAAC;QAC7C,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;IAC9C,CAAC;IAED,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,SAAS,UAAU,CAAC,IAAY,EAAE,UAA+B;IAC/D,IAAI,UAAU,CAAC,IAAI,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACxC,IAAI,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IAEtC,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACnF,OAAO,UAAU,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;AAClC,CAAC;AAED,4EAA4E;AAE5E,KAAK,UAAU,eAAe,CAAC,KAAyB;IACtD,IAAI,KAAK,CAAC,iBAAiB,KAAK,CAAC,EAAE,CAAC;QAClC,OAAO,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC;IACxD,CAAC;IAED,IAAI,KAAK,CAAC,iBAAiB,KAAK,CAAC,EAAE,CAAC;QAClC,OAAO,IAAI,OAAO,CAAS,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YAC7C,MAAM,OAAO,GAAG,gBAAgB,EAAE,CAAC;YACnC,MAAM,MAAM,GAAa,EAAE,CAAC;YAC5B,OAAO,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;YAC1D,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;YAC1E,OAAO,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;YAC5B,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC,CAAC;QACjD,CAAC,CAAC,CAAC;IACL,CAAC;IAED,MAAM,IAAI,KAAK,CAAC,uCAAuC,KAAK,CAAC,iBAAiB,EAAE,CAAC,CAAC;AACpF,CAAC"}

package/dist/shared/zip-structure.d.ts

@@ -0,0 +1,61 @@
+/**
+ * Policy-free structural ZIP parsing: end-of-central-directory (EOCD)
+ * location plus central-directory walk, producing one record per entry.
+ *
+ * Parsing is *central-directory-based* — never a front-to-back walk of
+ * local file headers. This is a correctness decision, not a style choice
+ * (issues #450 and #567): local headers of streaming entries
+ * (general-purpose flag bit 3) carry zeroed sizes, and the only
+ * local-only way to recover them is scanning the payload for the
+ * data-descriptor signature — which silently truncates any stored entry
+ * whose *content* happens to contain those four bytes, and
+ * desynchronizes every entry after it. The central directory always
+ * carries the real sizes, and every consumer here holds the complete
+ * archive bytes, so nothing a local-header walk could offer is needed.
+ *
+ * This layer maps bytes to entry records and nothing else. Policy — what
+ * a structural failure means, which entries are acceptable, how payloads
+ * are decoded — belongs to the consumers, and they differ on purpose:
+ *
+ *   - shared/zip-extract.ts (skill artifacts): structural failure is
+ *     NON-FATAL — both editions' push gates validated every artifact
+ *     with a central-directory-based reader before storage, so a defect
+ *     here can only be a truncated or corrupted download.
+ *   - execute-deep-agent/attachment-injector.ts (user attachments):
+ *     structural failure is FAIL-HARD — the input is an untrusted
+ *     upload and nothing upstream vouched for it.
+ *
+ * ZIP64 is deliberately unsupported: both consumers cap input far below
+ * every ZIP64 threshold (skill push gates: 100MB / 10,000 files;
+ * attachment uploads: 10MB).
+ *
+ * Throws plain `Error`s on structural defects (no valid EOCD, a central
+ * directory or local header record that does not parse, a payload slice
+ * that runs past the end of the buffer); consumers translate those into
+ * their own error models.
+ */
+export interface ZipStructuralEntry {
+    /** Entry path exactly as recorded in the central directory. */
+    readonly name: string;
+    readonly isDirectory: boolean;
+    readonly compressionMethod: number;
+    /**
+     * The central directory's declared uncompressed size — authoritative for
+     * pre-extraction accounting (e.g. ZIP-bomb budgeting), but still a
+     * *declaration*: a consumer that distrusts its input must enforce it
+     * against the actual decompressed output.
+     */
+    readonly uncompressedSize: number;
+    /** The entry's raw payload slice (a view, not a copy) of the archive buffer. */
+    readonly compressedData: Uint8Array;
+}
+/** Fixed size of the EOCD record, excluding the variable-length comment. */
+export declare const EOCD_MIN_SIZE = 22;
+/**
+ * Enumerate the archive's entries from its central directory.
+ *
+ * Throws on any structural defect: no valid EOCD, a central directory or
+ * local header record that doesn't parse, or a payload slice that runs
+ * past the end of the buffer.
+ */
+export declare function parseZipStructure(data: Uint8Array): ZipStructuralEntry[];

package/dist/shared/zip-structure.js

@@ -0,0 +1,128 @@
+/**
+ * Policy-free structural ZIP parsing: end-of-central-directory (EOCD)
+ * location plus central-directory walk, producing one record per entry.
+ *
+ * Parsing is *central-directory-based* — never a front-to-back walk of
+ * local file headers. This is a correctness decision, not a style choice
+ * (issues #450 and #567): local headers of streaming entries
+ * (general-purpose flag bit 3) carry zeroed sizes, and the only
+ * local-only way to recover them is scanning the payload for the
+ * data-descriptor signature — which silently truncates any stored entry
+ * whose *content* happens to contain those four bytes, and
+ * desynchronizes every entry after it. The central directory always
+ * carries the real sizes, and every consumer here holds the complete
+ * archive bytes, so nothing a local-header walk could offer is needed.
+ *
+ * This layer maps bytes to entry records and nothing else. Policy — what
+ * a structural failure means, which entries are acceptable, how payloads
+ * are decoded — belongs to the consumers, and they differ on purpose:
+ *
+ *   - shared/zip-extract.ts (skill artifacts): structural failure is
+ *     NON-FATAL — both editions' push gates validated every artifact
+ *     with a central-directory-based reader before storage, so a defect
+ *     here can only be a truncated or corrupted download.
+ *   - execute-deep-agent/attachment-injector.ts (user attachments):
+ *     structural failure is FAIL-HARD — the input is an untrusted
+ *     upload and nothing upstream vouched for it.
+ *
+ * ZIP64 is deliberately unsupported: both consumers cap input far below
+ * every ZIP64 threshold (skill push gates: 100MB / 10,000 files;
+ * attachment uploads: 10MB).
+ *
+ * Throws plain `Error`s on structural defects (no valid EOCD, a central
+ * directory or local header record that does not parse, a payload slice
+ * that runs past the end of the buffer); consumers translate those into
+ * their own error models.
+ */
+// ─── Format constants ────────────────────────────────────────────────────
+const LOCAL_FILE_HEADER_SIG = 0x04034b50;
+const CENTRAL_DIRECTORY_SIG = 0x02014b50;
+const EOCD_SIG = 0x06054b50;
+/** Fixed size of the EOCD record, excluding the variable-length comment. */
+export const EOCD_MIN_SIZE = 22;
+/** The archive comment length is a u16, so the EOCD sits within the last 64KB + 22 bytes. */
+const EOCD_MAX_COMMENT = 0xffff;
+const LOCAL_HEADER_SIZE = 30;
+const CD_RECORD_SIZE = 46;
+// ─── Parsing ─────────────────────────────────────────────────────────────
+/**
+ * Enumerate the archive's entries from its central directory.
+ *
+ * Throws on any structural defect: no valid EOCD, a central directory or
+ * local header record that doesn't parse, or a payload slice that runs
+ * past the end of the buffer.
+ */
+export function parseZipStructure(data) {
+    const view = new DataView(data.buffer, data.byteOffset, data.byteLength);
+    const eocd = findEndOfCentralDirectory(data, view);
+    const entries = [];
+    let offset = eocd.centralDirectoryOffset;
+    for (let i = 0; i < eocd.entryCount; i++) {
+        if (offset + CD_RECORD_SIZE > data.length || view.getUint32(offset, true) !== CENTRAL_DIRECTORY_SIG) {
+            throw new Error(`invalid central directory record at offset ${offset}`);
+        }
+        const compressionMethod = view.getUint16(offset + 10, true);
+        const compressedSize = view.getUint32(offset + 20, true);
+        const uncompressedSize = view.getUint32(offset + 24, true);
+        const fileNameLength = view.getUint16(offset + 28, true);
+        const extraFieldLength = view.getUint16(offset + 30, true);
+        const commentLength = view.getUint16(offset + 32, true);
+        const localHeaderOffset = view.getUint32(offset + 42, true);
+        const fileName = new TextDecoder().decode(data.subarray(offset + CD_RECORD_SIZE, offset + CD_RECORD_SIZE + fileNameLength));
+        // The local header is consulted for one thing only: the payload start.
+        // Its name/extra field lengths can legitimately differ from the central
+        // directory's (streaming writers pad the extra field), so the offset
+        // cannot be derived from CD fields alone.
+        const dataStart = payloadStart(data, view, localHeaderOffset, fileName);
+        if (dataStart + compressedSize > data.length) {
+            throw new Error(`entry "${fileName}" payload runs past end of archive`);
+        }
+        entries.push({
+            name: fileName,
+            isDirectory: fileName.endsWith("/"),
+            compressionMethod,
+            uncompressedSize,
+            compressedData: data.subarray(dataStart, dataStart + compressedSize),
+        });
+        offset += CD_RECORD_SIZE + fileNameLength + extraFieldLength + commentLength;
+    }
+    return entries;
+}
+/**
+ * Locate and validate the end-of-central-directory record.
+ *
+ * Scans backward from the end of the archive across the maximum comment
+ * span. A signature match alone is not trusted (the four bytes can occur
+ * inside a trailing comment): the record must also point at an offset
+ * that actually holds a central directory record, or be a genuinely
+ * empty archive.
+ */
+function findEndOfCentralDirectory(data, view) {
+    const scanFloor = Math.max(0, data.length - EOCD_MIN_SIZE - EOCD_MAX_COMMENT);
+    for (let pos = data.length - EOCD_MIN_SIZE; pos >= scanFloor; pos--) {
+        if (view.getUint32(pos, true) !== EOCD_SIG)
+            continue;
+        const entryCount = view.getUint16(pos + 10, true);
+        const centralDirectorySize = view.getUint32(pos + 12, true);
+        const centralDirectoryOffset = view.getUint32(pos + 16, true);
+        const directoryEndsAtRecord = centralDirectoryOffset + centralDirectorySize <= pos;
+        const directoryLooksReal = entryCount === 0 ||
+            (centralDirectoryOffset + 4 <= data.length &&
+                view.getUint32(centralDirectoryOffset, true) === CENTRAL_DIRECTORY_SIG);
+        if (directoryEndsAtRecord && directoryLooksReal) {
+            return { centralDirectoryOffset, entryCount };
+        }
+    }
+    throw new Error("no end-of-central-directory record found");
+}
+/** Resolve where an entry's payload begins, from its local file header. */
+function payloadStart(data, view, localHeaderOffset, fileName) {
+    if (localHeaderOffset + LOCAL_HEADER_SIZE > data.length ||
+        view.getUint32(localHeaderOffset, true) !== LOCAL_FILE_HEADER_SIG) {
+        throw new Error(`entry "${fileName}" has no local file header at offset ${localHeaderOffset}`);
+    }
+    const localNameLength = view.getUint16(localHeaderOffset + 26, true);
+    const localExtraLength = view.getUint16(localHeaderOffset + 28, true);
+    return localHeaderOffset + LOCAL_HEADER_SIZE + localNameLength + localExtraLength;
+}
+//# sourceMappingURL=zip-structure.js.map

package/dist/shared/zip-structure.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"zip-structure.js","sourceRoot":"","sources":["../../src/shared/zip-structure.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AAoBH,4EAA4E;AAE5E,MAAM,qBAAqB,GAAG,UAAU,CAAC;AACzC,MAAM,qBAAqB,GAAG,UAAU,CAAC;AACzC,MAAM,QAAQ,GAAG,UAAU,CAAC;AAE5B,4EAA4E;AAC5E,MAAM,CAAC,MAAM,aAAa,GAAG,EAAE,CAAC;AAChC,6FAA6F;AAC7F,MAAM,gBAAgB,GAAG,MAAM,CAAC;AAEhC,MAAM,iBAAiB,GAAG,EAAE,CAAC;AAC7B,MAAM,cAAc,GAAG,EAAE,CAAC;AAE1B,4EAA4E;AAE5E;;;;;;GAMG;AACH,MAAM,UAAU,iBAAiB,CAAC,IAAgB;IAChD,MAAM,IAAI,GAAG,IAAI,QAAQ,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC;IACzE,MAAM,IAAI,GAAG,yBAAyB,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IAEnD,MAAM,OAAO,GAAyB,EAAE,CAAC;IACzC,IAAI,MAAM,GAAG,IAAI,CAAC,sBAAsB,CAAC;IAEzC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,UAAU,EAAE,CAAC,EAAE,EAAE,CAAC;QACzC,IAAI,MAAM,GAAG,cAAc,GAAG,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,CAAC,KAAK,qBAAqB,EAAE,CAAC;YACpG,MAAM,IAAI,KAAK,CAAC,8CAA8C,MAAM,EAAE,CAAC,CAAC;QAC1E,CAAC;QAED,MAAM,iBAAiB,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,GAAG,EAAE,EAAE,IAAI,CAAC,CAAC;QAC5D,MAAM,cAAc,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,GAAG,EAAE,EAAE,IAAI,CAAC,CAAC;QACzD,MAAM,gBAAgB,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,GAAG,EAAE,EAAE,IAAI,CAAC,CAAC;QAC3D,MAAM,cAAc,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,GAAG,EAAE,EAAE,IAAI,CAAC,CAAC;QACzD,MAAM,gBAAgB,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,GAAG,EAAE,EAAE,IAAI,CAAC,CAAC;QAC3D,MAAM,aAAa,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,GAAG,EAAE,EAAE,IAAI,CAAC,CAAC;QACxD,MAAM,iBAAiB,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,GAAG,EAAE,EAAE,IAAI,CAAC,CAAC;QAE5D,MAAM,QAAQ,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CACvC,IAAI,CAAC,QAAQ,CAAC,MAAM,GAAG,cAAc,EAAE,MAAM,GAAG,cAAc,GAAG,cAAc,CAAC,CACjF,CAAC;QAEF,uEAAuE;QACvE,wEAAwE;QACxE,qEAAqE;QACrE,0CAA0C;QAC1C,MAAM,SAAS,GAAG,YAAY,CAAC,IAAI,EAAE,IAAI,EAAE,iBAAiB,EAAE,QAAQ,CAAC,CAAC;QACxE,IAAI,SAAS,GAAG,cAAc,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;YAC7C,MAAM,IAAI,KAAK,CAAC,UAAU,QAAQ,oCAAoC,CAAC,CAAC;QAC1E,CAAC;QAED,OAAO,CAAC,IAAI,CAAC;YACX,IAAI,EAAE,QAAQ;YACd,WAAW,EAAE,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC;YACnC,iBAAiB;YACjB,gBAAgB;YAChB,cAAc,EAAE,IAAI,CAAC,QAAQ,CAAC,SAAS,EAAE,SAAS,GAAG,cAAc,CAAC;SACrE,CAAC,CAAC;QAEH,MAAM,IAAI,cAAc,GAAG,cAAc,GAAG,gBAAgB,GAAG,aAAa,CAAC;IAC/E,CAAC;IAED,OAAO,OAAO,CAAC;AACjB,CAAC;AAOD;;;;;;;;GAQG;AACH,SAAS,yBAAyB,CAAC,IAAgB,EAAE,IAAc;IACjE,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,MAAM,GAAG,aAAa,GAAG,gBAAgB,CAAC,CAAC;IAE9E,KAAK,IAAI,GAAG,GAAG,IAAI,CAAC,MAAM,GAAG,aAAa,EAAE,GAAG,IAAI,SAAS,EAAE,GAAG,EAAE,EAAE,CAAC;QACpE,IAAI,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,IAAI,CAAC,KAAK,QAAQ;YAAE,SAAS;QAErD,MAAM,UAAU,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,GAAG,EAAE,EAAE,IAAI,CAAC,CAAC;QAClD,MAAM,oBAAoB,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,GAAG,EAAE,EAAE,IAAI,CAAC,CAAC;QAC5D,MAAM,sBAAsB,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,GAAG,EAAE,EAAE,IAAI,CAAC,CAAC;QAE9D,MAAM,qBAAqB,GAAG,sBAAsB,GAAG,oBAAoB,IAAI,GAAG,CAAC;QACnF,MAAM,kBAAkB,GACtB,UAAU,KAAK,CAAC;YAChB,CAAC,sBAAsB,GAAG,CAAC,IAAI,IAAI,CAAC,MAAM;gBACxC,IAAI,CAAC,SAAS,CAAC,sBAAsB,EAAE,IAAI,CAAC,KAAK,qBAAqB,CAAC,CAAC;QAE5E,IAAI,qBAAqB,IAAI,kBAAkB,EAAE,CAAC;YAChD,OAAO,EAAE,sBAAsB,EAAE,UAAU,EAAE,CAAC;QAChD,CAAC;IACH,CAAC;IAED,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC;AAC9D,CAAC;AAED,2EAA2E;AAC3E,SAAS,YAAY,CACnB,IAAgB,EAChB,IAAc,EACd,iBAAyB,EACzB,QAAgB;IAEhB,IACE,iBAAiB,GAAG,iBAAiB,GAAG,IAAI,CAAC,MAAM;QACnD,IAAI,CAAC,SAAS,CAAC,iBAAiB,EAAE,IAAI,CAAC,KAAK,qBAAqB,EACjE,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,UAAU,QAAQ,wCAAwC,iBAAiB,EAAE,CAAC,CAAC;IACjG,CAAC;IAED,MAAM,eAAe,GAAG,IAAI,CAAC,SAAS,CAAC,iBAAiB,GAAG,EAAE,EAAE,IAAI,CAAC,CAAC;IACrE,MAAM,gBAAgB,GAAG,IAAI,CAAC,SAAS,CAAC,iBAAiB,GAAG,EAAE,EAAE,IAAI,CAAC,CAAC;IACtE,OAAO,iBAAiB,GAAG,iBAAiB,GAAG,eAAe,GAAG,gBAAgB,CAAC;AACpF,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@stigmer/runner",
-  "version": "3.12.0",
+  "version": "3.12.2",
   "description": "Embeddable Temporal worker for the Stigmer AI agent platform — handles agent execution, workflow orchestration, and MCP server management",
   "license": "Apache-2.0",
   "type": "module",
@@ -90,7 +90,7 @@
     "@opentelemetry/sdk-metrics": "^2.0.0",
     "@opentelemetry/sdk-trace-base": "^2.0.0",
     "@opentelemetry/sdk-trace-node": "^2.0.0",
-    "@stigmer/protos": "3.12.0",
+    "@stigmer/protos": "3.12.2",
     "@temporalio/activity": "^1.11.0",
     "@temporalio/common": "^1.11.0",
     "@temporalio/interceptors-opentelemetry": "~1.16.0",