@yanlinglabs/winter-agent-runtime 0.0.34 → 0.0.36

package/dist/index.js

@@ -2,11 +2,11 @@ import {
   createRpcBridge2,
   registerTool2,
   onCompaction2,
+  buildWorkflowWorkerSeatbeltProfile2,
   WinterPathsError2,
   sessionTempDir2,
   ensureTasksDir2,
   resolveProjectDirName2,
-  buildWorkflowWorkerSeatbeltProfile2,
   WORKFLOW_SANDBOX_REFUSED_EXIT_CODE2,
   DEFAULT_CONTEXT_WINDOW_TOKENS2,
   createContextAccountant2,
@@ -55,7 +55,7 @@ import {
   DEFAULT_CLASSIFIER_TIMEOUT_MS2,
   createModelClassifier2,
   selectClassifierRoute2
-} from "./index-rprst8z5.js";
+} from "./index-c8j57y8v.js";
 import"./index-1hef2gff.js";
 import"./index-mwew595z.js";
 import"./index-2wgfv0pa.js";

package/dist/mcp/lifecycle.d.ts

@@ -86,6 +86,8 @@ export declare function resolveMcpServerSources(sources: readonly McpServerSourc
     trustedWorkspace: boolean;
     reservedServerName?: string;
 }): ResolveMcpServerSourcesResult;
+/** The text budget of an MCP result that carries images (≈ the default `MAX_MCP_OUTPUT_TOKENS` of 25000 at 4 characters a token). */
+export declare const MCP_IMAGE_RESULT_TEXT_CHARS = 100000;
 export interface McpDiscoveryCache {
     get(key: string): McpToolInfo[] | undefined;
     set(key: string, tools: McpToolInfo[]): void;

package/dist/provider/mock.d.ts

@@ -27,7 +27,7 @@ export declare const P5_FIXTURE_SKILL_NAME = "p5probe";
  * `{"answer":"42","doubled":"4242"}` on every leg.
  */
 export declare const P5_WORKFLOW_SCRIPT: string;
-export type TestProviderName = "boom" | "tooluse" | "hang" | "reflect" | "modeswitch" | "bgtask" | "lanea" | "laneb" | "lanec" | "laned" | "lanee" | "mcpsdk" | "subagent" | "childmsg" | "subagentperm" | "toolsearch" | "p5compact" | "p5structured" | "p5structuredfail" | "p5skill" | "p5checkpoint" | "p5workflow";
+export type TestProviderName = "boom" | "tooluse" | "hang" | "reflect" | "modeswitch" | "bgtask" | "lanea" | "laneb" | "lanec" | "laned" | "lanee" | "mcpsdk" | "subagent" | "childmsg" | "subagentperm" | "toolsearch" | "p5compact" | "p5structured" | "p5structuredfail" | "p5skill" | "p5checkpoint" | "p5workflow" | "readimage";
 export declare function isTestProviderName(v: string): v is TestProviderName;
 /**
  * The name the reserved `winter-test/<name>` namespace uses for the plain echo double.

package/dist/sandbox/profile.d.ts

@@ -43,6 +43,43 @@ export declare class SandboxConfigError extends Error {
 }
 export declare function resolveNetworkPosture(network: SandboxNetworkSettings | undefined): boolean;
 export declare function canonicalizePath(p: string): string;
+/**
+ * Fix round 14 (Winter-specific hardening, NOT itself a claude port -- empirically discovered and
+ * verified while implementing `buildReadDenyWritePermitBlock` above, disclosed prominently rather
+ * than smoothed over): `pR`'s own trailing re-permit is a BLANKET, UNCONDITIONAL
+ * `(allow file-write-unlink file-write-create (subpath <every write root>))`, ported faithfully per
+ * the controller's own explicit instruction. Real `sandbox-exec` runs proved this is not merely
+ * "narrower than a later wildcard deny wins" (round 13's own finding, about an EARLIER explicit deny
+ * surviving a LATER broad `file-write*` allow) -- it runs the OTHER direction too: an EARLIER
+ * EXPLICIT `file-write-unlink`/`file-write-create` ALLOW is not overridden by a LATER, broader
+ * `(deny file-write* ...)` for the SAME target either. Seatbelt appears to give a clause naming
+ * `file-write-unlink`/`file-write-create` explicitly priority over one that only reaches those
+ * operations via the `file-write*` wildcard, independent of which clause is textually first or last.
+ *
+ * Every OTHER Winter-owned write-protection floor in this module that used only the `file-write*`
+ * wildcard was therefore silently punched through for CREATE and UNLINK/RENAME specifically (never
+ * for `file-write-data`, `file-write-mode`, etc., which this re-permit never names) by this ONE new
+ * block: the control-plane carve-outs (WS-12 §5.2's own "the seatbelt is the only enforcement point
+ * left" floor -- verified empirically: `mkdir -p .winter && echo '{}' > .winter/permissions.local.json`
+ * and `rm .winter/settings.json` both SUCCEEDED against the unpatched fix), the checkpoint/backup
+ * store write-deny (T8 rider 25's own identical floor), and a GLOB-shaped `denyWrite` entry (a plain
+ * `denyWritePaths` entry was already safe -- `Ch`'s own write-side ancestor-rename block, round 12,
+ * already emits an explicit `(subpath <path>)` deny for it; `Ch`'s own GLOB branch, by contrast, only
+ * ever emits a `(literal <fixedPrefix>)` -- protecting the prefix DIRECTORY's own identity against a
+ * rename-shuffle, never the glob-matched files themselves).
+ *
+ * The fix, verified against real `sandbox-exec` (a `(deny file-write* file-write-unlink
+ * file-write-create (regex ...))` clause DOES win back the CREATE it needs to, confirmed by a direct
+ * before/after run rather than assumed): every one of those floors now names
+ * `file-write-unlink`/`file-write-create` EXPLICITLY, alongside the `file-write*` wildcard it already
+ * carried (for the OTHER write operations the wildcard alone still covers correctly) -- this constant
+ * is that shared operation-name list, applied wherever `file-write*` ALONE previously appeared on a
+ * deny this round's own re-permit could otherwise reach. `fR` (`buildReadDenyKeepInPlaceBlock`) is
+ * deliberately NOT touched here: it already names `file-write-unlink` explicitly (never `create`, by
+ * claude's own design -- see that function's own header), so it was never in the affected set.
+ */
+/** The runtime's image working directory under the winter/store home (tools/image-prep.ts) -- write-denied to the shell. */
+export declare const IMAGE_PREP_DIRNAME = "image-prep";
 /**
  * P7a fix r1 (Important-1): render ONE brand token as a case-insensitive, regex-escaped SBPL literal.
  *

package/dist/store/dialect.d.ts

@@ -478,7 +478,7 @@ export declare class TranscriptWriter implements SessionPersistence {
     private dialectRecord;
     static readBack(store: SessionStore, key: SessionKey): Promise<SessionStoreEntry[]>;
 }
-export declare const RUNTIME_ENGINE_VERSION = "0.0.34";
+export declare const RUNTIME_ENGINE_VERSION = "0.0.36";
 export interface ResolvedEngineSession {
     config: RuntimeConfig;
     store: SessionPersistence | undefined;

package/dist/testing.js

@@ -3,7 +3,7 @@ import {
   runEngine2,
   echoProvider2,
   resolveEngineSession2
-} from "./index-rprst8z5.js";
+} from "./index-c8j57y8v.js";
 import"./index-1hef2gff.js";
 import"./index-mwew595z.js";
 import"./index-2wgfv0pa.js";
@@ -14,7 +14,7 @@ import {
   buildProductionWiring,
   withAutoSkillPermissions,
   restoreChildRoster
-} from "./index-dske1c00.js";
+} from "./index-83p1g9ap.js";
 import {
   Queue
 } from "./index-97t2rmtf.js";

package/dist/tools/image-prep.d.ts

@@ -0,0 +1,208 @@
+import type { ToolResultBlock } from "./registry.js";
+/**
+ * The exact refusal a model with no image input gets (the host's composer shows the same words). Exported
+ * so a host or a test matches it rather than retyping it.
+ */
+export declare const MODEL_DOES_NOT_SUPPORT_IMAGES = "The selected model doesn't support images";
+/** The image types every provider adapter can carry (Anthropic, Bedrock, Gemini and OpenAI all accept exactly these four). */
+export declare const DELIVERABLE_IMAGE_TYPES: ReadonlySet<string>;
+/**
+ * The largest image handed to a model, in raw bytes: 3.75 MiB, whose base64 is exactly 5 MiB.
+ *
+ * The strictest per-image limit among the providers Winter drives: "5 MB (base64-encoded) on Amazon
+ * Bedrock and Google Cloud" for Claude (https://platform.claude.com/docs/en/build-with-claude/vision,
+ * "Request limits"; the Claude API itself takes 10 MB). An image over a provider's limit stays in the
+ * conversation and fails EVERY later request, so the limit is applied here, before the image enters
+ * history, not in an adapter. A SOURCE file may be larger (up to `IMAGE_MAX_INPUT_BYTES`): it is shrunk
+ * and, if it must be, re-encoded as JPEG to fit (`prepareImageForModel`).
+ */
+export declare const READ_IMAGE_MAX_BYTES = 3932160;
+/** The largest width or height any provider accepts: "The maximum dimensions per image are 8000x8000 px" (same page). */
+export declare const READ_IMAGE_MAX_DIMENSION = 8000;
+/** What the bytes actually are, from their magic numbers -- never trusting the extension. `undefined` when none matches. */
+export declare function sniffImageType(buf: Uint8Array): string | undefined;
+export declare function parsePngDimensions(buf: Uint8Array): {
+    width: number;
+    height: number;
+} | undefined;
+export declare function parseGifDimensions(buf: Uint8Array): {
+    width: number;
+    height: number;
+} | undefined;
+export declare function parseBmpDimensions(buf: Uint8Array): {
+    width: number;
+    height: number;
+} | undefined;
+export declare function parseJpegDimensions(buf: Uint8Array): {
+    width: number;
+    height: number;
+} | undefined;
+/** WebP's canvas size from its VP8 (lossy), VP8L (lossless) or VP8X (extended) header. */
+export declare function parseWebpDimensions(buf: Uint8Array): {
+    width: number;
+    height: number;
+} | undefined;
+/** A TIFF's first image size, from its first IFD's ImageWidth (256) / ImageLength (257) tags (SHORT or LONG). */
+export declare function parseTiffDimensions(buf: Uint8Array): {
+    width: number;
+    height: number;
+} | undefined;
+/**
+ * A HEIC's size from its `ispe` (image spatial extents) boxes: the LARGEST one, since a grid image carries
+ * a small `ispe` per tile and one for the whole picture. A scan for well-formed `ispe` boxes (size 20,
+ * version/flags 0), not a full box walk; `sips -g`'s answer is taken too and the larger wins.
+ */
+export declare function parseHeicDimensions(buf: Uint8Array): {
+    width: number;
+    height: number;
+} | undefined;
+/**
+ * A GIF's size for the PIXEL CHECK: the larger of its logical screen and every frame's own descriptor --
+ * a tiny logical screen can front a frame that declares 60000x60000 px, and the decoder allocates for the
+ * frame.
+ */
+export declare function parseGifExtent(buf: Uint8Array): {
+    width: number;
+    height: number;
+} | undefined;
+export declare function parseImageDimensions(mediaType: string, bytes: Uint8Array): {
+    width: number;
+    height: number;
+} | undefined;
+/**
+ * The long edge an image is shrunk to before a model sees it: 1568 px, the size above which Claude's
+ * standard tier downsizes an image anyway ("Resolution and token cost",
+ * https://platform.claude.com/docs/en/build-with-claude/vision). Sending more only costs request bytes:
+ * the per-request limits (32 MB on the Claude API, 20 MB of inline data on Gemini) fill up after a few
+ * full-size screenshots, and past 20 images Anthropic refuses any image over 2000 px. At 1568 none of
+ * that is reached by an ordinary session.
+ */
+export declare const IMAGE_MAX_LONG_EDGE = 1568;
+/** The largest file Read or an MCP result may hand the resizer at all (a guard against absurd inputs, not a provider limit). */
+export declare const IMAGE_MAX_INPUT_BYTES: number;
+/**
+ * The most pixels an image may DECLARE before anything decodes it: 100 megapixels. A few-kilobyte PNG can
+ * declare 40000x40000 px, and decoding that (sips does, to resize it) takes gigabytes; a declared size is
+ * all a header costs. 100 MP is above any camera or screenshot in ordinary use (a 12K frame is ~80 MP).
+ */
+export declare const IMAGE_MAX_PIXELS = 100000000;
+/** An image ready for a model: the bytes to send, and what happened to them on the way. */
+export interface PreparedImage {
+    ok: true;
+    mediaType: string;
+    bytes: Buffer;
+    width?: number;
+    height?: number;
+    /** The source as found. */
+    original: {
+        mediaType: string;
+        bytes: number;
+        width?: number;
+        height?: number;
+    };
+    /** True when the pixels were scaled down. */
+    resized: boolean;
+    /** Set when the format changed (a conversion, or a JPEG re-encode to fit the byte limit): the quality used for a JPEG. */
+    jpegQuality?: number;
+}
+export type ImagePreparation = PreparedImage | {
+    ok: false;
+    reason: string;
+};
+export interface PrepareImageOptions {
+    /**
+     * The runtime-owned directory the per-call working directory is made in: `<winter or store home>/
+     * image-prep` (`imagePrepWorkRoot`), which the Bash sandbox's seatbelt profile write-denies
+     * (sandbox/profile.ts, `IMAGE_PREP_DIRNAME`) -- NEVER the session temp dir, which a sandboxed shell can
+     * write (a link planted there would make `sips` write through it). A getter, read only when `sips`
+     * actually runs. `undefined`: no private place to work, so nothing is converted or resized.
+     */
+    workRoot: () => string | undefined;
+    /** Test seam: the `sips` binary (a missing path simulates a platform without it). Default `/usr/bin/sips`. */
+    sipsPath?: string;
+    /** Test seam: the byte limit. Default `READ_IMAGE_MAX_BYTES`. */
+    maxBytes?: number;
+    /** The turn's abort: an interrupt kills a running `sips`. */
+    signal?: AbortSignal;
+}
+/** A short, model-facing description of what happened, e.g. `image/png, 25856 bytes, 1568x1018, resized from 3024x1964`. */
+export declare function describePreparedImage(image: PreparedImage): string;
+/**
+ * Reads `path` only if it is a regular file, and never through a link: `O_NOFOLLOW` refuses a symlink at
+ * open time, and the type is checked on the OPENED descriptor, so nothing can be swapped in between the
+ * check and the read. `undefined` for anything else (a link, a directory, a missing file).
+ */
+export declare function readRegularFileNoFollow(path: string): Buffer | undefined;
+/**
+ * Where image work happens for a session: `<store home or winter home>/image-prep` -- the two anchors the
+ * seatbelt profile write-denies `image-prep` under, both handed to a session EXPLICITLY by its host. With
+ * neither, `undefined`: nothing is resized or converted (an image already within every limit is still
+ * sent as it is). There is deliberately NO fallback, and here is why each candidate is unsafe:
+ *   - `~/<homeDirName>`: a guess at the user's real winter home, which a process given no home must not
+ *     write into (and which a test would reach);
+ *   - the session temp dir, the cwd, the outputs dir and any `allowWrite` entry: sandbox-WRITABLE roots,
+ *     where a sandboxed command could plant a link;
+ *   - `$TMPDIR` (the per-user temp dir): its DIRECT children are sandbox-writable (the profile's mktemp
+ *     allowance), so a folder made there could be renamed away and replaced by a link mid-run.
+ */
+export declare function imagePrepWorkRoot(ctx: {
+    storeHome?: string;
+    winterHome?: string;
+}): string | undefined;
+/**
+ * How many frames a GIF holds (image descriptors), walking its block structure; `undefined` when the
+ * structure cannot be walked. OpenAI takes only a "non-animated GIF"
+ * (https://developers.openai.com/api/docs/guides/images-vision) and Claude reads only the first frame.
+ */
+export declare function gifFrameCount(buf: Uint8Array): number | undefined;
+/** Every frame's own size (its image descriptor), in order; `undefined` when the structure cannot be walked to its end. */
+export declare function gifFrameSizes(buf: Uint8Array): Array<{
+    width: number;
+    height: number;
+}> | undefined;
+/**
+ * Makes `source` ready for a model, or says why it cannot be.
+ *
+ * - The type is SNIFFED from the bytes; something that is none of PNG/JPEG/GIF/WebP/BMP/TIFF/HEIC is refused.
+ * - An image whose long edge is over `IMAGE_MAX_LONG_EDGE` is scaled down to it (aspect kept).
+ * - The format is kept where a provider takes it: PNG stays PNG and JPEG stays JPEG (quality 85 when
+ *   re-encoded). `sips` cannot WRITE WebP, so a WebP that has to be rewritten becomes PNG. EVERY GIF
+ *   becomes PNG (its first frame): Gemini reads no GIF, OpenAI no animated one, Claude only the first
+ *   frame. BMP and TIFF, which no provider takes, become PNG; HEIC (a camera photo) becomes JPEG. A WebP
+ *   that needs no rewrite is sent as it is.
+ * - An image DECLARING more than `IMAGE_MAX_PIXELS` is refused before anything decodes it.
+ * - Still over `READ_IMAGE_MAX_BYTES`? Re-encoded as JPEG at quality 85, 70, 55, then 40; still over,
+ *   refused. Never truncated.
+ * - Without `sips`, or when it fails: the image as it is if it is already a deliverable type within the
+ *   byte limit and `READ_IMAGE_MAX_DIMENSION` (and, for a GIF, a single frame), else a refusal naming the
+ *   reason.
+ * - `sips` works in a FRESH private directory per call (`mkdtemp`) under `imagePrepWorkRoot` -- a tree
+ *   the Bash sandbox is denied writing to, so no link can be planted where `sips` writes -- its input is
+ *   written with `wx`, and its output is read through `readRegularFileNoFollow` (no link, no swap).
+ */
+export declare function prepareImageForModel(source: Buffer, opts: PrepareImageOptions): Promise<ImagePreparation>;
+/** One part of a result before it is made model-ready: text, or an image's raw bytes. */
+export type RawResultPart = {
+    type: "text";
+    text: string;
+} | {
+    type: "image";
+    bytes: Buffer;
+};
+export interface ModelResult {
+    /** The model-facing blocks, in order (adjacent text merged). */
+    blocks: ToolResultBlock[];
+    /** A text rendering of the same result (each image as `[image: …]`) -- for hooks, logs and a text-only reader. */
+    text: string;
+    /** True when at least one image block survived. */
+    hasImage: boolean;
+}
+/**
+ * Makes a mixed text/image result model-ready: every image goes through `prepareImageForModel`, and an
+ * image that cannot be shown -- a text-only model (`readsImages: false`), a refusal, or images past the
+ * result's total of `maxBytes` -- becomes a one-line `[image omitted: …]` note IN ITS PLACE, never
+ * dropped and never base64 text.
+ */
+export declare function resultBlocksForModel(parts: readonly RawResultPart[], opts: PrepareImageOptions & {
+    readsImages: boolean;
+}): Promise<ModelResult>;

package/dist/tools/image-test-fixtures.d.ts

@@ -0,0 +1,7 @@
+/**
+ * A real, decodable 8-bit RGB PNG of `width` x `height`. `noise: true` fills it with random pixels (it
+ * does not compress, so it is large); otherwise a repeating gradient (tiny once compressed).
+ */
+export declare function realPng(width: number, height: number, opts?: {
+    noise?: boolean;
+}): Buffer;

package/dist/tools/impl/monitor.d.ts

@@ -34,6 +34,8 @@ declare function buildMonitorRunCommandOptions(ctx: ToolExecutionContext): {
     home: string;
     /** Phase 5 fix wave, I1: the resolved winter root, distinct from the OS home above. */
     winterHome?: string;
+    /** WS-21 fix round 1, item 4: the shared store home -- see `ToolExecutionContext.storeHome`. */
+    storeHome?: string;
     /** P7a (D19): the session's brand -- the dot-dir names the seatbelt fences. */
     brand?: SandboxBrand;
     /** Fix round 16, item 2: `sandbox.filesystem.allowGitConfig` -- see `SandboxFilesystemSettings.allowGitConfig`'s own header. */

package/dist/tools/impl/read.d.ts

@@ -1,44 +1,3 @@
 import "../descriptors/index.ts";
-export type ReadBlock = {
-    type: "text";
-    text: string;
-} | {
-    type: "image";
-    media_type: string;
-    bytes: number;
-    width?: number;
-    height?: number;
-    data?: string;
-    note?: string;
-} | {
-    type: "pdf";
-    media_type: "application/pdf";
-    bytes: number;
-    totalPages?: number;
-    requestedPages?: {
-        start: number;
-        end: number;
-    };
-    data?: string;
-    note: string;
-};
-export interface ReadBlocksEnvelope {
-    winterReadBlocks: ReadBlock[];
-}
-export declare function parsePngDimensions(buf: Uint8Array): {
-    width: number;
-    height: number;
-} | undefined;
-export declare function parseGifDimensions(buf: Uint8Array): {
-    width: number;
-    height: number;
-} | undefined;
-export declare function parseBmpDimensions(buf: Uint8Array): {
-    width: number;
-    height: number;
-} | undefined;
-export declare function parseJpegDimensions(buf: Uint8Array): {
-    width: number;
-    height: number;
-} | undefined;
+export { IMAGE_MAX_LONG_EDGE, MODEL_DOES_NOT_SUPPORT_IMAGES, READ_IMAGE_MAX_BYTES, READ_IMAGE_MAX_DIMENSION, parseBmpDimensions, parseGifDimensions, parseJpegDimensions, parsePngDimensions, parseWebpDimensions, sniffImageType, } from "../image-prep.js";
 export declare function countPdfPages(bytes: Buffer): number | undefined;

package/dist/tools/registry.d.ts

@@ -64,8 +64,34 @@ export interface ToolDescriptor {
 }
 export interface ToolResultPayload {
     output: string;
+    /**
+     * Code-mode images: what the MODEL is shown for this call, when it is more than text. Present only on
+     * a result that carries an image (the Read tool on an image file or a notebook with plot output);
+     * the engine then writes these blocks as the `tool_result`'s content array -- claude's own shape --
+     * in place of `output`. `output` stays a short TEXT rendering of the same result, and it is what every
+     * text-only consumer reads: the PostToolUse hook's `tool_response`, a log line, a flattening. Kept
+     * separate so no text channel ever carries base64 (a hook payload rides the same capped stdout line
+     * a frame does).
+     */
+    blocks?: ToolResultBlock[];
     isError?: boolean;
 }
+/**
+ * One block of a multimodal tool result (see `ToolResultPayload.blocks`). Structurally the engine's own
+ * `text` and `image` ContentBlock variants, so the engine carries them into history, the transcript and
+ * every provider adapter unchanged.
+ */
+export type ToolResultBlock = {
+    type: "text";
+    text: string;
+} | {
+    type: "image";
+    source: {
+        type: "base64";
+        media_type: string;
+        data: string;
+    };
+};
 /** See `ToolExecutionContext.permission`. */
 export interface ToolCallPermission {
     explicitApproval: "prompt" | "rule";
@@ -132,6 +158,13 @@ export interface ToolExecutionContext {
      * ABSENT READS AS `WINTER_BRAND`, which is byte-identical to the behaviour before this field.
      */
     brand?: BrandProfile;
+    /**
+     * Code-mode images: whether the model the session is on RIGHT NOW accepts image input (its catalog
+     * row's `inputModalities` lists "image"). The Read tool answers an image file with a short text
+     * refusal instead of image blocks when this is `false`. Absent reads as "yes" -- a scripted double or
+     * a row with no modality facts, the same default `ModelDescription.readsImages` has.
+     */
+    modelReadsImages?: boolean;
     sessionId: string;
     readState: SessionReadState;
     emitFrame: (frame: BackgroundTaskMessage) => void;
@@ -366,6 +399,8 @@ export interface EngineToolCall {
 }
 export interface EngineToolResult {
     output: string;
+    /** See `ToolResultPayload.blocks`: when present, the model-facing content of the `tool_result`. */
+    blocks?: ToolResultBlock[];
     /**
      * Spawn-surface parity (R-S4, research gap 6): the executor's own `isError`, carried to the engine
      * so the model-facing `tool_result` block says `is_error: true` -- claude's shape for every tool
@@ -381,6 +416,8 @@ export interface EngineFacingToolExecutor {
 export interface RegistryToolExecutorDeps {
     sessionId: string;
     home: string;
+    /** Code-mode images: read per call, so a `set_model` since the last call is seen -- see `ToolExecutionContext.modelReadsImages`. */
+    modelReadsImages?: () => boolean;
     /** Phase 5 fix wave, I1: the resolved winter root -- see `ToolExecutionContext.winterHome`. */
     winterHome?: string;
     /** WS-21 fix round 1, item 4: the shared store home -- see `ToolExecutionContext.storeHome`. */

package/dist/tools/sandbox-run-inputs.d.ts

@@ -0,0 +1,41 @@
+import type { ToolExecutionContext } from "./registry.js";
+import { type GlobDenyEntry } from "../permissions/file-rules.js";
+import type { SandboxBrand } from "../sandbox/profile.js";
+/** Everything about the SESSION the seatbelt profile needs, for any tool that runs a shell command. */
+export interface SandboxRunInputs {
+    cwd: string;
+    env: NodeJS.ProcessEnv;
+    settings: ToolExecutionContext["sandboxSettings"];
+    writableRoots: string[];
+    denyWritePaths?: string[];
+    denyReadPaths?: string[];
+    /** Fix round 11: glob-shaped denyWrite/denyRead entries, pre-converted to SBPL regex source -- see `splitDenyPathsByGlobShape`'s own header. */
+    denyWriteRegexes?: string[];
+    denyReadRegexes?: string[];
+    /** Fix round 12: each glob-shaped denyWrite/denyRead entry's own canonicalized fixed-prefix directory -- feeds the ancestor-rename-bypass fix. */
+    denyWriteGlobFixedPrefixes?: string[];
+    denyReadGlobFixedPrefixes?: string[];
+    /** Fix round 13: each glob-shaped denyRead entry, its regex PAIRED with its own fixed prefix -- feeds the read-deny-keep-in-place fix. */
+    denyReadGlobEntries?: GlobDenyEntry[];
+    home: string;
+    /** Phase 5 fix wave, I1: the resolved winter root, distinct from the OS home above. */
+    winterHome?: string;
+    /** WS-21 fix round 1, item 4: the shared store home -- see `ToolExecutionContext.storeHome`. */
+    storeHome?: string;
+    /** P7a (D19): the session's brand -- the dot-dir names the seatbelt fences. */
+    brand?: SandboxBrand;
+    /** Fix round 16, item 2: `sandbox.filesystem.allowGitConfig` -- see `SandboxFilesystemSettings.allowGitConfig`'s own header. */
+    allowGitConfigWrites?: boolean;
+}
+/**
+ * Where a spawn may write: the session scratch dir, the session's bounded roots (the cwd among them),
+ * the outputs dir when configured, and `filesystem.allowWrite` (WS-12 §12 Q5: additive, never a
+ * replacement).
+ */
+export declare function computeWritableRoots(ctx: ToolExecutionContext): string[];
+/** The child's environment: this process's, with `TMPDIR` (and `OUTDIR` when configured) pointed at the session's own dirs. */
+export declare function buildSandboxChildEnv(ctx: ToolExecutionContext): NodeJS.ProcessEnv;
+/** `filesystem.denyWrite`/`denyRead`, split into plain paths and glob-shaped regexes (C1 / fix rounds 11-13). */
+export declare function computeDenyPaths(ctx: ToolExecutionContext): Pick<SandboxRunInputs, "denyWritePaths" | "denyReadPaths" | "denyWriteRegexes" | "denyReadRegexes" | "denyWriteGlobFixedPrefixes" | "denyReadGlobFixedPrefixes" | "denyReadGlobEntries">;
+/** The session's sandbox inputs, identical for every tool that runs a shell command. */
+export declare function sandboxRunInputs(ctx: ToolExecutionContext): SandboxRunInputs;

package/dist/version.d.ts

@@ -1 +1 @@
-export declare const RUNTIME_VERSION = "0.0.34";
+export declare const RUNTIME_VERSION = "0.0.36";

package/dist/version.js

@@ -1,5 +1,5 @@
 // src/version.ts
-var RUNTIME_VERSION = "0.0.34";
+var RUNTIME_VERSION = "0.0.36";
 export {
   RUNTIME_VERSION
 };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@yanlinglabs/winter-agent-runtime",
-  "version": "0.0.34",
+  "version": "0.0.36",
   "license": "MIT",
   "type": "module",
   "engines": {
@@ -73,9 +73,9 @@
     "@modelcontextprotocol/client": "^2.1.0",
     "ajv": "^8.20.0",
     "ignore": "7.0.5",
-    "@yanlinglabs/winter-agent-sdk": "0.0.34",
-    "@yanlinglabs/winter-provider-runtime": "0.0.34",
-    "@yanlinglabs/winter-provider-catalog": "0.0.34"
+    "@yanlinglabs/winter-provider-catalog": "0.0.36",
+    "@yanlinglabs/winter-provider-runtime": "0.0.36",
+    "@yanlinglabs/winter-agent-sdk": "0.0.36"
   },
   "devDependencies": {
     "@modelcontextprotocol/server": "^2.1.0"