@theokit/sdk 4.21.1 → 4.23.0

package/dist/{run-DFM1H2jW.d.cts → run-OJbGyweZ.d.cts}

@@ -105,7 +105,7 @@ declare class PermissionEngine {
  *
  * @public
  */
-type RunEvent = RunToolProgressEvent | RunRateLimitEvent | RunPermissionDeniedEvent | RunTaskStartedEvent | RunTaskUpdatedEvent | RunTaskCompletedEvent | RunCompactBoundaryEvent | RunTripwireEvent | RunCompletionCheckEvent;
+type RunEvent = RunToolProgressEvent | RunRateLimitEvent | RunPermissionDeniedEvent | RunTaskStartedEvent | RunTaskUpdatedEvent | RunTaskCompletedEvent | RunCompactBoundaryEvent | RunCompactionFallbackEvent | RunTripwireEvent | RunCompletionCheckEvent;
 /**
  * SE24 — a guardrail processor called `abort()`; the run stops with a tripwire.
  * Delivered via {@link SendOptions.onRunEvent} (mirrors the `RunResult.tripwire`
@@ -180,6 +180,25 @@ interface RunCompactBoundaryEvent {
     /** Token count before compaction, when known. */
     readonly preTokens?: number;
 }
+/**
+ * M77 — auto-compaction is budgeting against a FLOOR, because neither the catalog nor the caller
+ * supplied a context window for this model.
+ *
+ * The prior behaviour was to disable auto-compaction entirely and write one line to stderr per
+ * process. That is fail-OPEN: the conversation grows until the provider rejects it. This event exists
+ * so a surface can say "I am running without a real budget" instead of the user discovering it at the
+ * moment of failure.
+ *
+ * Not emitted when the window came from the catalog (the normal path) or from an explicit caller
+ * override (the caller already knows).
+ */
+interface RunCompactionFallbackEvent {
+    readonly type: "compaction_fallback";
+    /** The model whose window is unknown — what the user needs to fix in configuration. */
+    readonly model: string;
+    /** The floor being budgeted against, after the safety margin. */
+    readonly window: number;
+}
 /**
  * SE2 — the opt-in sink for {@link RunEvent}s. Supplied via `SendOptions.onRunEvent`.
  * Synchronous + best-effort: a throwing sink must never break the run (the emitter

package/dist/{run-DFM1H2jW.d.ts → run-OJbGyweZ.d.ts}

@@ -105,7 +105,7 @@ declare class PermissionEngine {
  *
  * @public
  */
-type RunEvent = RunToolProgressEvent | RunRateLimitEvent | RunPermissionDeniedEvent | RunTaskStartedEvent | RunTaskUpdatedEvent | RunTaskCompletedEvent | RunCompactBoundaryEvent | RunTripwireEvent | RunCompletionCheckEvent;
+type RunEvent = RunToolProgressEvent | RunRateLimitEvent | RunPermissionDeniedEvent | RunTaskStartedEvent | RunTaskUpdatedEvent | RunTaskCompletedEvent | RunCompactBoundaryEvent | RunCompactionFallbackEvent | RunTripwireEvent | RunCompletionCheckEvent;
 /**
  * SE24 — a guardrail processor called `abort()`; the run stops with a tripwire.
  * Delivered via {@link SendOptions.onRunEvent} (mirrors the `RunResult.tripwire`
@@ -180,6 +180,25 @@ interface RunCompactBoundaryEvent {
     /** Token count before compaction, when known. */
     readonly preTokens?: number;
 }
+/**
+ * M77 — auto-compaction is budgeting against a FLOOR, because neither the catalog nor the caller
+ * supplied a context window for this model.
+ *
+ * The prior behaviour was to disable auto-compaction entirely and write one line to stderr per
+ * process. That is fail-OPEN: the conversation grows until the provider rejects it. This event exists
+ * so a surface can say "I am running without a real budget" instead of the user discovering it at the
+ * moment of failure.
+ *
+ * Not emitted when the window came from the catalog (the normal path) or from an explicit caller
+ * override (the caller already knows).
+ */
+interface RunCompactionFallbackEvent {
+    readonly type: "compaction_fallback";
+    /** The model whose window is unknown — what the user needs to fix in configuration. */
+    readonly model: string;
+    /** The floor being budgeted against, after the safety margin. */
+    readonly window: number;
+}
 /**
  * SE2 — the opt-in sink for {@link RunEvent}s. Supplied via `SendOptions.onRunEvent`.
  * Synchronous + best-effort: a throwing sink must never break the run (the emitter

package/dist/sandbox/index.cjs

@@ -542,7 +542,7 @@ var LinuxSandbox = class extends LocalSandbox {
     this.cwd = config.workDir ?? process.cwd();
     this.bin = opts.bin ?? "bwrap";
     this.env = opts.env ?? allowlistedEnv();
-    this.seccompPath = this.network ? void 0 : restrictedSeccompPath();
+    this.seccompPath = seccompPathParaRede(this.network);
   }
   /** Extracted for test visibility — delegates to the pure `wrapCommandForSandbox` (M57, single wrap SoT). */
   wrapCommand(command) {
@@ -558,6 +558,32 @@ var LinuxSandbox = class extends LocalSandbox {
       command
     );
   }
+  /**
+   * M75 review (arquitetura, HIGH) — sem este override a classe MENTIA.
+   *
+   * `LinuxSandbox` se documenta como "kernel-enforced sandbox backend", mas sobrescrevia apenas
+   * `execute`. `uploadFile` continuava o herdado de `LocalSandbox`, que escreve direto no host via
+   * `fs/promises` e aceita caminho ABSOLUTO — sem bwrap, sem seccomp, sem restrição de caminho. E
+   * `SandboxBackend.writeFile` delega a ele. O resultado era uma classe incoerente: ler, buscar e
+   * listar passavam pelo confinamento; escrever, não.
+   *
+   * Rotear pelo `execute` embrulhado resolve na raiz: a escrita passa a viver sob a MESMA política
+   * do resto — se o bwrap nega o caminho, a escrita falha, como deve. O conteúdo vai por stdin (não
+   * por argv) porque argv tem limite de tamanho e conteúdo de arquivo não tem.
+   */
+  async uploadFile(caminho, conteudo) {
+    if (this.mode === "danger-full-access") return super.uploadFile(caminho, conteudo);
+    const alvo = caminho.startsWith("/") ? caminho : `${this.cwd}/${caminho}`;
+    const b64 = Buffer.from(conteudo).toString("base64");
+    const r = await this.execute(
+      `mkdir -p ${shellQuote(path.dirname(alvo))} && printf %s ${shellQuote(b64)} | base64 -d > ${shellQuote(alvo)}`
+    );
+    if (r.exitCode !== 0) {
+      throw new Error(
+        `uploadFile bloqueado ou falhou sob confinamento (${alvo}): ${r.stderr.trim() || `exit ${r.exitCode}`}`
+      );
+    }
+  }
   execute(command, opts) {
     const wrapped = this.wrapCommand(command);
     if (wrapped === null) return super.execute(command, opts);
@@ -632,28 +658,34 @@ var avisouInterativo = false;
 function resetInteractiveWarnLatch() {
   avisouInterativo = false;
 }
+function seccompPathParaRede(redeLiberada) {
+  return redeLiberada ? void 0 : restrictedSeccompPath();
+}
+function decidirConfinamento(opts) {
+  if (opts.mode === "danger-full-access") return null;
+  const detection = (opts.detect ?? detectBwrapMemoizado)();
+  if (detection.ok) return detection.bin;
+  if (!avisouInterativo) {
+    avisouInterativo = true;
+    const warn = opts.warn ?? ((m) => console.warn(redactSecrets(m)));
+    warn(
+      `[sandbox] OS-level enforcement unavailable (${detection.reason}) \u2014 interactive session runs WITHOUT kernel confinement (sandbox_mode=${opts.mode}).`
+    );
+  }
+  return null;
+}
 function interactiveWrapCommand(opts) {
   return (command, cwd) => {
-    if (opts.mode === "danger-full-access") return null;
-    const detection = (opts.detect ?? detectBwrapMemoizado)();
-    if (!detection.ok) {
-      if (!avisouInterativo) {
-        avisouInterativo = true;
-        const warn = opts.warn ?? ((m) => console.warn(redactSecrets(m)));
-        warn(
-          `[sandbox] OS-level enforcement unavailable (${detection.reason}) \u2014 interactive session runs WITHOUT kernel confinement (sandbox_mode=${opts.mode}).`
-        );
-      }
-      return null;
-    }
+    const bin = decidirConfinamento(opts);
+    if (bin === null) return null;
     return wrapCommandForSandbox(
       opts.mode,
       {
         cwd,
         network: opts.network ?? false,
         env: allowlistedEnv(),
-        bin: detection.bin,
-        seccompPath: restrictedSeccompPath()
+        bin,
+        seccompPath: seccompPathParaRede(opts.network ?? false)
       },
       command
     );