agentcert 0.2.3 → 0.2.4

package/README.md

@@ -46,9 +46,11 @@ in one command. By default, both commands also upload local files referenced by
 the bundle. Reads are confined to `--artifact-root` (the current directory by
 default), path and symlink escapes are rejected, and uploads are capped at 25
 files, 10 MiB per file, and 50 MiB total. Skipped references are reported in
-the CLI and hosted run timeline. Pass `--no-artifacts` to upload only the JSON
-bundle. Project API keys can create runs, record events, and upload evidence,
-but cannot approve their own runtime actions.
+the CLI and hosted run timeline. Companion uploads are restricted to
+PNG/JPEG/WebP, JSON/JSONL, HTML, PDF, and ZIP; other extensions are skipped
+before they are read. Pass `--no-artifacts` to upload only the JSON bundle.
+Project API keys can create runs, record events, and upload evidence, but
+cannot approve their own runtime actions.
 
 Review/export helpers:
 

package/dist/companion-artifacts.js

@@ -19,6 +19,11 @@ export async function collectCompanionArtifacts(bundle, artifactRoot, limits = D
             skipped.push(skip(entry, "remote_url"));
             continue;
         }
+        const descriptor = describeArtifact(entry.sourcePath);
+        if (!descriptor) {
+            skipped.push(skip(entry, "unsupported_type", "accepted formats: PNG, JPEG, WebP, JSON, JSONL, HTML, PDF, ZIP"));
+            continue;
+        }
         if (artifacts.length >= limits.maxFiles) {
             skipped.push(skip(entry, "file_limit", `maximum ${limits.maxFiles} files`));
             continue;
@@ -90,7 +95,6 @@ export async function collectCompanionArtifacts(bundle, artifactRoot, limits = D
             skipped.push(skip(entry, reason));
             continue;
         }
-        const descriptor = describeArtifact(entry.sourcePath);
         artifacts.push({
             sourcePath: normalizeSourcePath(entry.sourcePath),
             fileName: basename(resolvedPath),
@@ -140,31 +144,17 @@ function describeArtifact(path) {
         const imageType = extension === ".jpg" ? "jpeg" : extension.slice(1);
         return { kind: "screenshot", contentType: `image/${imageType}` };
     }
-    if (extension === ".svg")
-        return { kind: "report", contentType: "image/svg+xml" };
-    if (extension === ".zip" || lower.includes("trace")) {
-        const contentType = extension === ".zip" ? "application/zip" : extension === ".json" ? "application/json" : "application/octet-stream";
-        return { kind: "trace", contentType };
-    }
-    if ([".html", ".htm"].includes(extension) || lower.includes("dom")) {
-        const contentType = [".html", ".htm"].includes(extension)
-            ? "text/html; charset=utf-8"
-            : extension === ".json"
-                ? "application/json"
-                : "application/octet-stream";
-        return { kind: "dom", contentType };
-    }
+    if (extension === ".zip")
+        return { kind: "trace", contentType: "application/zip" };
+    if ([".html", ".htm"].includes(extension))
+        return { kind: "dom", contentType: "text/html; charset=utf-8" };
     if (extension === ".json")
-        return { kind: "json", contentType: "application/json" };
+        return { kind: lower.includes("trace") ? "trace" : lower.includes("dom") ? "dom" : "json", contentType: "application/json" };
     if (extension === ".jsonl")
-        return { kind: "json", contentType: "application/x-ndjson" };
+        return { kind: lower.includes("trace") ? "trace" : "json", contentType: "application/x-ndjson" };
     if (extension === ".pdf")
         return { kind: "report", contentType: "application/pdf" };
-    if (extension === ".md")
-        return { kind: "report", contentType: "text/markdown; charset=utf-8" };
-    if (extension === ".txt")
-        return { kind: "artifact", contentType: "text/plain; charset=utf-8" };
-    return { kind: "artifact", contentType: "application/octet-stream" };
+    return undefined;
 }
 function normalizeSourcePath(path) {
     return path.replace(/\\/g, "/").slice(0, 1024);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "agentcert",
-  "version": "0.2.3",
+  "version": "0.2.4",
   "description": "Assurance release gates, runtime evidence, and regression CI for AI agents.",
   "type": "module",
   "license": "Apache-2.0",