blun-king-cli 9.1.480 → 9.1.481

package/bin/glob-pattern-policy.cjs

@@ -0,0 +1,13 @@
+"use strict";
+
+function quotedPattern(pattern) {
+  return `'${pattern.replaceAll("\\", "\\\\").replaceAll("'", "\\'")}'`;
+}
+
+function globPatternError(pattern) {
+  if (typeof pattern !== "string") return "Invalid glob pattern";
+  if (!pattern.replaceAll("\\", "/").split("/").includes("..")) return undefined;
+  return `Path traversal not allowed in glob pattern ${quotedPattern(pattern)}`;
+}
+
+module.exports = { globPatternError };

package/bin/subagent-max-tokens-handoff-policy.cjs

@@ -23,6 +23,19 @@ function shouldRequestSubagentHandoff(stopReason, attempts) {
     && attempts < MAX_SUBAGENT_HANDOFF_ATTEMPTS;
 }
 
+function isSubagentMaxTokensTurnError(error) {
+  if (typeof error !== "object" || error === null) return false;
+  const details = typeof error.details === "object" && error.details !== null
+    ? error.details
+    : {};
+  if (details.emptyResponseKind === "length") return true;
+  if (details.finishReason === "truncated" || details.rawFinishReason === "length") return true;
+
+  const message = typeof error.message === "string" ? error.message : "";
+  return /\bmax[_ -]?tokens?\b/iu.test(message)
+    && /(?:\bno\b|\bwithout\b|did not produce)[^\n.]*\btool(?: call)?\b/iu.test(message);
+}
+
 function boundedPartialHandoff(partialSummary) {
   const normalized = typeof partialSummary === "string" ? partialSummary.trim() : "";
   if (normalized.length <= MAX_PARTIAL_HANDOFF_CHARS) return normalized;
@@ -51,5 +64,6 @@ module.exports = {
   SUBAGENT_MAX_TOKENS_ERROR,
   SUBAGENT_MAX_TOKENS_HANDOFF_PROMPT,
   buildSubagentMaxTokensFailure,
+  isSubagentMaxTokensTurnError,
   shouldRequestSubagentHandoff,
 };

package/bin/user-home-path-policy.cjs

@@ -0,0 +1,13 @@
+"use strict";
+
+function quotedPath(path) {
+  return `'${path.replaceAll("\\", "\\\\").replaceAll("'", "\\'")}'`;
+}
+
+function unsupportedUserHomePathError(path) {
+  if (typeof path !== "string" || !path.startsWith("~")) return undefined;
+  if (path === "~" || path.startsWith("~/") || path.startsWith("~\\")) return undefined;
+  return `Named home-directory paths are not supported: ${quotedPath(path)}. Use '~/' for the current user or './' for a literal path.`;
+}
+
+module.exports = { unsupportedUserHomePathError };

package/blun.mjs

@@ -14,6 +14,8 @@ import agentResumeSnapshot from "./bin/agent-resume-snapshot.cjs";
 import sessionResumeCheckpoint from "./bin/session-resume-checkpoint.cjs";
 import sessionScrollbackArchive from "./bin/session-scrollback-archive.cjs";
 import sessionReplayWindowPolicy from "./bin/session-replay-window-policy.cjs";
+import globPatternPolicy from "./bin/glob-pattern-policy.cjs";
+import userHomePathPolicy from "./bin/user-home-path-policy.cjs";
 import crypto$1, { createHash, randomBytes, randomInt, randomUUID, timingSafeEqual } from "node:crypto";
 import * as fs$16 from "node:fs";
 import Kt, { accessSync, appendFileSync, chmodSync, closeSync, constants, copyFileSync, createReadStream, createWriteStream, existsSync, fsyncSync, linkSync, lstatSync, mkdirSync, openSync, promises, readFileSync, readSync, readdirSync, realpathSync, renameSync, rmSync, statSync, unlinkSync, writeFileSync, writeSync } from "node:fs";
@@ -52,6 +54,8 @@ const { createAgentResumeSnapshot, restoreAgentResumeSnapshot } = agentResumeSna
 const { loadResumeCheckpoint, writeResumeCheckpoint } = sessionResumeCheckpoint;
 const { SessionScrollbackArchive, sessionScrollbackArchiveDirectory } = sessionScrollbackArchive;
 const { replayWindowStartIndex } = sessionReplayWindowPolicy;
+const { globPatternError } = globPatternPolicy;
+const { unsupportedUserHomePathError } = userHomePathPolicy;
 import { EventEmitter as EventEmitter$1 } from "node:events";
 import { StringDecoder } from "node:string_decoder";
 import co from "node:assert";
@@ -77727,6 +77731,8 @@ function relativeOutsideMessage(path, operation) {
 	return `"${path}" is not an absolute path. You must provide an absolute path to ${operation === "write" ? "write or edit a file" : operation === "search" ? "search" : "read a file"} outside the working directory.`;
 }
 function resolvePathAccess(path, cwd, config, options) {
+	const homePathError = unsupportedUserHomePathError(path);
+	if (homePathError !== void 0) throw new PathSecurityError("PATH_INVALID", path, path, homePathError);
 	const pathClass = options.pathClass ?? DEFAULT_PATH_CLASS;
 	const expandedPath = expandUserPath$1(normalizeUserPath(path, pathClass), options.homeDir, pathClass);
 	const rawIsAbsolute = isAbsolute$2(expandedPath);
@@ -252363,6 +252369,7 @@ async function runChildTurnToCompletion(child, signal) {
 	const turnEnded = completion.event;
 	if (turnEnded.reason !== "completed") {
 		if (turnEnded.reason === "filtered") throw new Error("Subagent turn blocked by provider safety policy");
+		if (isSubagentMaxTokensTurnError(turnEnded.error)) return "max_tokens";
 		if (turnEnded.error?.code === ErrorCodes.PROVIDER_RATE_LIMIT) throw providerRateLimitErrorFromPayload(turnEnded.error);
 		if (turnEnded.error === void 0) throw new Error(`Subagent turn ${turnEnded.reason}`);
 		const error = new Error(`[${turnEnded.error.code}] ${turnEnded.error.message}`);
@@ -252406,7 +252413,7 @@ function shouldSuppressQueuedAttemptFailureEvent(options, error) {
 	if (isProviderRateLimitError(error)) return true;
 	return isAbortError$4(error) || options.signal.aborted;
 }
-var DEFAULT_SUBAGENT_TIMEOUT_MS, resolveSubagentTimeoutMs, runAgentWithTimeoutContinuation, buildSubagentUsageDelta, inheritSubagentAllowedTools, inheritSubagentLifecycleTools, SUBAGENT_MAX_TOKENS_ERROR, SUBAGENT_MAX_TOKENS_HANDOFF_PROMPT, buildSubagentMaxTokensFailure, shouldRequestSubagentHandoff, SUMMARY_MIN_LENGTH, SUMMARY_CONTINUATION_ATTEMPTS, HOOK_TEXT_PREVIEW_LENGTH, TOOL_CALL_DISABLED_MESSAGE, SUBAGENT_PROMPT_ORIGIN, SIDE_QUESTION_SYSTEM_REMINDER, SessionSubagentHost;
+var DEFAULT_SUBAGENT_TIMEOUT_MS, resolveSubagentTimeoutMs, runAgentWithTimeoutContinuation, buildSubagentUsageDelta, inheritSubagentAllowedTools, inheritSubagentLifecycleTools, SUBAGENT_MAX_TOKENS_ERROR, SUBAGENT_MAX_TOKENS_HANDOFF_PROMPT, buildSubagentMaxTokensFailure, isSubagentMaxTokensTurnError, shouldRequestSubagentHandoff, SUMMARY_MIN_LENGTH, SUMMARY_CONTINUATION_ATTEMPTS, HOOK_TEXT_PREVIEW_LENGTH, TOOL_CALL_DISABLED_MESSAGE, SUBAGENT_PROMPT_ORIGIN, SIDE_QUESTION_SYSTEM_REMINDER, SessionSubagentHost;
 var init_subagent_host = __esmMin((() => {
 	init_src$4();
 	init_errors$8();
@@ -252425,6 +252432,7 @@ var init_subagent_host = __esmMin((() => {
 		SUBAGENT_MAX_TOKENS_ERROR,
 		SUBAGENT_MAX_TOKENS_HANDOFF_PROMPT,
 		buildSubagentMaxTokensFailure,
+		isSubagentMaxTokensTurnError,
 		shouldRequestSubagentHandoff
 	} = createRequire(import.meta.url)("./bin/subagent-max-tokens-handoff-policy.cjs"));
 	SUMMARY_MIN_LENGTH = 200;
@@ -258611,6 +258619,11 @@ glob_default = "Find files by glob pattern, sorted by modification time with the
 		}
 		async execution(args, signal, searchRoots) {
 			const searchRoot = searchRoots[0] ?? this.workspace.workspaceDir;
+			const patternError = globPatternError(args.pattern);
+			if (patternError !== void 0) return {
+				isError: true,
+				output: patternError
+			};
 			try {
 				if (((await this.kaos.stat(searchRoot)).stMode & S_IFMT$2) !== S_IFDIR$1) return {
 					isError: true,
@@ -517648,6 +517661,7 @@ var BlunTUI = class {
 		const items = this.state.queuedMessages.slice(0, batchEnd < 0 ? this.state.queuedMessages.length : batchEnd);
 		if (items.length === 0) return false;
 		this.state.queuedMessages = this.state.queuedMessages.slice(items.length);
+		this.updateQueueDisplay();
 		const transcriptRendered = items.map((queued) => queued.channelTranscriptRendered === true);
 		const renderTranscripts = () => {
 			items.forEach((queued, index) => {
@@ -517915,6 +517929,7 @@ var BlunTUI = class {
 		}
 		const items = this.state.queuedMessages.slice(0, prefixLength);
 		this.state.queuedMessages = this.state.queuedMessages.slice(prefixLength);
+		this.updateQueueDisplay();
 		const turnId = this.streamingUI.getTurnContext().turnId;
 		const inFlight = {
 			items,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "blun-king-cli",
-  "version": "9.1.480",
+  "version": "9.1.481",
   "description": "BLUN CLI - your own AI agent with a Telegram channel. Get it done. With BLUN.",
   "license": "MIT",
   "bin": {