@yanlinglabs/winter-agent-runtime 0.0.41 → 0.0.43

package/dist/index.js

@@ -55,7 +55,7 @@ import {
   DEFAULT_CLASSIFIER_TIMEOUT_MS2,
   createModelClassifier2,
   selectClassifierRoute2
-} from "./index-z9yngxj4.js";
+} from "./index-kqc3tdph.js";
 import"./index-1hef2gff.js";
 import"./index-mwew595z.js";
 import"./index-2wgfv0pa.js";

package/dist/mcp/lifecycle.d.ts

@@ -79,7 +79,7 @@ export { validateServerConfig };
  *     server that under their brand is called `acme`.
  *
  * The parameter defaults to `WINTER_SERVER_NAME`, so every existing caller and fixture keeps today's
- * behaviour byte for byte.
+ * behaviour unchanged.
  */
 export declare function resolveMcpServerSources(sources: readonly McpServerSource[], opts: {
     strictMcpConfig?: boolean;
@@ -95,6 +95,7 @@ export interface McpDiscoveryCache {
 }
 export declare function createInMemoryDiscoveryCache(): McpDiscoveryCache;
 export declare const FIRST_TURN_MCP_WAIT_DEFAULT_MS = 2000;
+/** The first-turn MCP wait's deadline: 2000 ms, or MCP_TIMEOUT when the explicit MCP config asks for the long wait (spec: first-turn-mcp-wait.md). */
 export declare function firstTurnMcpWaitDeadlineMs(opts: {
     strictMcpConfig?: boolean;
     explicitServers?: Readonly<Record<string, unknown>>;

package/dist/permissions/edit-recognition.d.ts

@@ -25,6 +25,6 @@ export declare function recognizeEditOperation(call: {
  * Why a shell command's WRITES cannot be auto-approved, or `undefined`: a process substitution, a
  * command that cannot be parsed, a write target that is a variable/command expansion, a `~user` form
  * or a glob, and `cp`/`mv` with ANY flag (`--target-directory=PATH` hides the destination). The
- * working-directory and `cd` checks that follow claude's are evaluator.ts's (they need the session).
+ * working-directory and `cd` checks that follow these are evaluator.ts's (they need the session).
  */
 export declare function shellWriteConstraint(command: string): string | undefined;

package/dist/permissions/evaluator.d.ts

@@ -82,8 +82,8 @@ export interface EvaluationContext {
     cwd: string;
     /**
      * Does this Bash call's `dangerouslyDisableSandbox` actually take it OUT of a sandbox it would
-     * otherwise run in? (dist-session fixes, lane C C3 -- claude's `!shouldUseSandbox(input) &&
-     * shouldUseSandbox({...input, dangerouslyDisableSandbox: false})`.) False when the session's sandbox
+     * otherwise run in? (dist-session fixes, lane C C3 -- the call would be sandboxed without the flag
+     * and is not sandboxed with it.) False when the session's sandbox
      * is off, when the policy forbids unsandboxed commands (the flag is then ignored), or when the
      * command is an allowed `excludedCommands` entry. Only such a call is an ESCAPE, handled by
      * `resolveSandboxEscape`. Injected because the evaluator cannot see the session's sandbox settings;
@@ -133,8 +133,8 @@ export interface EvaluationContext {
     /**
      * The session's outputs directory (`RuntimeConfig.outputsDir`, exported to the shell as `$OUTDIR`).
      * Two effects, both mirroring what the Bash tool already does with it (a sandbox-writable root):
-     * a shell write there is inside the session's writable directories (claude's sandbox-write-allowlist
-     * step), and, when it sits inside the winter home, the protected floor's winter-home part does not
+     * a shell write there is inside the session's writable directories (sandbox-writable locations count
+     * as allowed write locations, as in Claude Code), and, when it sits inside the winter home, the protected floor's winter-home part does not
      * cover it (protected.ts's outputs carve-out). It is NOT a working directory: acceptEdits and the
      * mode allows are unchanged. Absent = no outputs directory.
      */
@@ -220,32 +220,21 @@ export declare const NO_SPECIAL_CHECKS: SpecialChecks;
 export declare function boundedRoots(ctx: EvaluationContext): string[];
 export declare function extractCandidateWritePaths(call: PermissionCall, ctx: EvaluationContext): string[];
 /**
- * Port of claude's `mL` (dump byte 14442494, pinned 2.1.250) -- the safety check `$K` (same byte
- * region) runs on every candidate write path BEFORE any other approval logic, unconditionally
- * forcing an ask (`classifierApprovable:!1` in claude's own source -- never classifier/auto-
- * approvable, unlike `$K`'s OTHER checks) when it fires. Ported here as a pure predicate; the
- * evaluator wires it in as a new stage-3 mandatory-ask reason, below.
- *
- * Two of claude's own branches are Windows/WSL-only BY CLAUDE'S OWN GATE and are DELIBERATELY
- * omitted, disclosed rather than silently dropped (this codebase targets macOS only, CLAUDE.md's own
- * latest-OS-floors rule):
- *   - the `U()==="windows"||U()==="wsl"`-gated colon-position check (a second `:` after index 2,
- *     Windows alternate-data-stream syntax) is genuinely inert off Windows/WSL in claude's OWN
- *     source -- there is nothing to port.
- *   - the trailing `Dg(e,!0)&&!Ha(e)&&!Fe(e,t)` clause is STRUCTURALLY DEAD on macOS in claude's own
- *     source too: `Dg`'s (dump byte 14418249) own first line is `if(U()!=="windows")return!1`, which
- *     short-circuits the whole `&&` chain to `false` on every non-Windows host claude itself runs
- *     on. Porting an intentional no-op would just be dead code; omitted, disclosed rather than
- *     silently dropped.
- *
- * `FU` (dump byte 11268201: `function FU(t){return lt.test(t)||t.includes("??")&&lt.test(pt(t))}`,
- * `pt` win32-normalizes only on Windows, else identity) IS ported below, in its macOS-reduced form
- * (`pt` is the identity function here, so `FU` reduces to the single regex test) -- claude calls it
- * unconditionally, not gated to Windows, so this is a straight port, not a judgment call. `lt`'s own
- * literal bytes (re-verified with a fresh byte-slice extraction after an advisor review caught a
- * narrower first draft: the dump's raw bytes are `[` `\` `\` `/` `]`, i.e. a JS source character
- * class holding an ESCAPED backslash plus a forward slash) is `/^[\\/]\?\?[\\/]/` -- EITHER separator
- * at both ends (`\??\`, `\??/`, `/??\`, `/??/`), not `/` alone.
+ * Whether a write target's path has a shape that Windows (or a Windows filesystem mounted elsewhere)
+ * could resolve to a DIFFERENT file than the text suggests. Such a write always asks, before any
+ * other approval logic, and is never classifier- or auto-approvable (stage 3's mandatory-ask
+ * reasons). Applied on every OS, as Claude Code does. True when ANY of these holds:
+ *   - the path starts with a separator (`/` or `\`), then `??`, then a separator (an NT object path:
+ *     `\??\`, `/??/`, `\??/`, `/??\`);
+ *   - `~` followed by an ASCII digit appears anywhere (an 8.3 short name such as `PROGRA~1`);
+ *   - the path starts with `\\?\`, `\\.\`, `//?/` or `//./` (a device or long-path prefix);
+ *   - a path component -- splitting on both `/` and `\`, and skipping empty components, `.` and `..`
+ *     -- ends in a `.` or a whitespace character (`\s`): Windows strips those, so `.bashrc.` and
+ *     `.bashrc ` name `.bashrc` there (this covers a component of three or more dots too);
+ *   - the WHOLE path ends in `.` plus a reserved device name -- `CON`, `PRN`, `AUX`, `NUL`, `COM1`-`COM9`
+ *     or `LPT1`-`LPT9`, in any letter case (`notes.CON`). A bare device name (`/w/CON`) is not flagged.
+ * Windows-only checks that depend on running on Windows (alternate data streams, drive-relative
+ * paths) do not apply on macOS and are not made.
  */
 export declare function isSuspiciousPath(path: string): boolean;
 export declare const REAL_SPECIAL_CHECKS: SpecialChecks;