blun-king-cli 9.1.480 → 9.1.482

package/bin/glob-pattern-policy.cjs

@@ -0,0 +1,13 @@
+"use strict";
+
+function quotedPattern(pattern) {
+  return `'${pattern.replaceAll("\\", "\\\\").replaceAll("'", "\\'")}'`;
+}
+
+function globPatternError(pattern) {
+  if (typeof pattern !== "string") return "Invalid glob pattern";
+  if (!pattern.replaceAll("\\", "/").split("/").includes("..")) return undefined;
+  return `Path traversal not allowed in glob pattern ${quotedPattern(pattern)}`;
+}
+
+module.exports = { globPatternError };

package/bin/subagent-max-tokens-handoff-policy.cjs

@@ -23,6 +23,19 @@ function shouldRequestSubagentHandoff(stopReason, attempts) {
     && attempts < MAX_SUBAGENT_HANDOFF_ATTEMPTS;
 }
 
+function isSubagentMaxTokensTurnError(error) {
+  if (typeof error !== "object" || error === null) return false;
+  const details = typeof error.details === "object" && error.details !== null
+    ? error.details
+    : {};
+  if (details.emptyResponseKind === "length") return true;
+  if (details.finishReason === "truncated" || details.rawFinishReason === "length") return true;
+
+  const message = typeof error.message === "string" ? error.message : "";
+  return /\bmax[_ -]?tokens?\b/iu.test(message)
+    && /(?:\bno\b|\bwithout\b|did not produce)[^\n.]*\btool(?: call)?\b/iu.test(message);
+}
+
 function boundedPartialHandoff(partialSummary) {
   const normalized = typeof partialSummary === "string" ? partialSummary.trim() : "";
   if (normalized.length <= MAX_PARTIAL_HANDOFF_CHARS) return normalized;
@@ -51,5 +64,6 @@ module.exports = {
   SUBAGENT_MAX_TOKENS_ERROR,
   SUBAGENT_MAX_TOKENS_HANDOFF_PROMPT,
   buildSubagentMaxTokensFailure,
+  isSubagentMaxTokensTurnError,
   shouldRequestSubagentHandoff,
 };

package/bin/tool-result-offload-policy.cjs

@@ -14,6 +14,7 @@ const TOOL_RESULT_HISTORICAL_REPLACEMENT_BUDGET_CHARS = 600;
 const TOOL_RESULT_SUCCESS_KEEP_RECENT_MESSAGES = 12;
 const TOOL_RESULT_HISTORICAL_SUCCESS_MARKER = '[Old tool result content cleared]';
 const TOOL_RESULT_REPEAT_MARKER = '[Repeated tool result omitted]';
+const READ_CONTINUATION_LINE_OFFSET_RE = /^Continue reading with line_offset=(\d+)\. Do not assume you have reached the end of the file\.$/mu;
 
 function shouldOffloadToolResult(textLength) {
   return Number.isFinite(textLength) && textLength > TOOL_RESULT_MAX_CHARS;
@@ -32,6 +33,12 @@ function createToolResultPreview(text) {
   return `${text.slice(0, headChars)}\n\n[... ${String(omittedChars)} characters omitted ...]\n\n${text.slice(-tailChars)}`;
 }
 
+function readContinuationLineOffset(text) {
+  if (typeof text !== 'string') return undefined;
+  const value = Number(text.match(READ_CONTINUATION_LINE_OFFSET_RE)?.[1]);
+  return Number.isSafeInteger(value) && value >= 1 ? value : undefined;
+}
+
 function isPersistedToolResultReference(content) {
   if (!Array.isArray(content)) return false;
 
@@ -89,10 +96,14 @@ function compactPersistedToolResultReference(content) {
     const outputPath = lines.find((line) => line.startsWith('output_path: '));
     if (outputPath === undefined) return part;
     const recoveryLines = [TOOL_RESULT_OFFLOAD_MARKER];
-    for (const prefix of ['tool_name: ', 'output_size_chars: ']) {
+    for (const prefix of ['tool_name: ', 'output_size_chars: ', 'next_line_offset: ']) {
       const line = lines.find((candidate) => candidate.startsWith(prefix));
       if (line !== undefined) recoveryLines.push(line);
     }
+    if (recoveryLines.some((line) => line.startsWith('next_line_offset: '))) {
+      const nextStep = lines.find((line) => line.startsWith('next_step: '));
+      if (nextStep !== undefined) recoveryLines.push(nextStep);
+    }
     recoveryLines.push(outputPath);
     const text = recoveryLines.join('\n');
     if (text === part.text) return part;
@@ -298,6 +309,7 @@ module.exports = {
   dedupeRepeatedSuccessfulToolResults,
   freshToolResultIds,
   isPersistedToolResultReference,
+  readContinuationLineOffset,
   selectHistoricalToolResultOffloads,
   selectToolResultBatchOffloads,
   shouldKeepFreshToolResult,

package/bin/user-home-path-policy.cjs

@@ -0,0 +1,13 @@
+"use strict";
+
+function quotedPath(path) {
+  return `'${path.replaceAll("\\", "\\\\").replaceAll("'", "\\'")}'`;
+}
+
+function unsupportedUserHomePathError(path) {
+  if (typeof path !== "string" || !path.startsWith("~")) return undefined;
+  if (path === "~" || path.startsWith("~/") || path.startsWith("~\\")) return undefined;
+  return `Named home-directory paths are not supported: ${quotedPath(path)}. Use '~/' for the current user or './' for a literal path.`;
+}
+
+module.exports = { unsupportedUserHomePathError };

package/blun.mjs

@@ -14,6 +14,8 @@ import agentResumeSnapshot from "./bin/agent-resume-snapshot.cjs";
 import sessionResumeCheckpoint from "./bin/session-resume-checkpoint.cjs";
 import sessionScrollbackArchive from "./bin/session-scrollback-archive.cjs";
 import sessionReplayWindowPolicy from "./bin/session-replay-window-policy.cjs";
+import globPatternPolicy from "./bin/glob-pattern-policy.cjs";
+import userHomePathPolicy from "./bin/user-home-path-policy.cjs";
 import crypto$1, { createHash, randomBytes, randomInt, randomUUID, timingSafeEqual } from "node:crypto";
 import * as fs$16 from "node:fs";
 import Kt, { accessSync, appendFileSync, chmodSync, closeSync, constants, copyFileSync, createReadStream, createWriteStream, existsSync, fsyncSync, linkSync, lstatSync, mkdirSync, openSync, promises, readFileSync, readSync, readdirSync, realpathSync, renameSync, rmSync, statSync, unlinkSync, writeFileSync, writeSync } from "node:fs";
@@ -52,6 +54,8 @@ const { createAgentResumeSnapshot, restoreAgentResumeSnapshot } = agentResumeSna
 const { loadResumeCheckpoint, writeResumeCheckpoint } = sessionResumeCheckpoint;
 const { SessionScrollbackArchive, sessionScrollbackArchiveDirectory } = sessionScrollbackArchive;
 const { replayWindowStartIndex } = sessionReplayWindowPolicy;
+const { globPatternError } = globPatternPolicy;
+const { unsupportedUserHomePathError } = userHomePathPolicy;
 import { EventEmitter as EventEmitter$1 } from "node:events";
 import { StringDecoder } from "node:string_decoder";
 import co from "node:assert";
@@ -77727,6 +77731,8 @@ function relativeOutsideMessage(path, operation) {
 	return `"${path}" is not an absolute path. You must provide an absolute path to ${operation === "write" ? "write or edit a file" : operation === "search" ? "search" : "read a file"} outside the working directory.`;
 }
 function resolvePathAccess(path, cwd, config, options) {
+	const homePathError = unsupportedUserHomePathError(path);
+	if (homePathError !== void 0) throw new PathSecurityError("PATH_INVALID", path, path, homePathError);
 	const pathClass = options.pathClass ?? DEFAULT_PATH_CLASS;
 	const expandedPath = expandUserPath$1(normalizeUserPath(path, pathClass), options.homeDir, pathClass);
 	const rawIsAbsolute = isAbsolute$2(expandedPath);
@@ -252363,6 +252369,7 @@ async function runChildTurnToCompletion(child, signal) {
 	const turnEnded = completion.event;
 	if (turnEnded.reason !== "completed") {
 		if (turnEnded.reason === "filtered") throw new Error("Subagent turn blocked by provider safety policy");
+		if (isSubagentMaxTokensTurnError(turnEnded.error)) return "max_tokens";
 		if (turnEnded.error?.code === ErrorCodes.PROVIDER_RATE_LIMIT) throw providerRateLimitErrorFromPayload(turnEnded.error);
 		if (turnEnded.error === void 0) throw new Error(`Subagent turn ${turnEnded.reason}`);
 		const error = new Error(`[${turnEnded.error.code}] ${turnEnded.error.message}`);
@@ -252406,7 +252413,7 @@ function shouldSuppressQueuedAttemptFailureEvent(options, error) {
 	if (isProviderRateLimitError(error)) return true;
 	return isAbortError$4(error) || options.signal.aborted;
 }
-var DEFAULT_SUBAGENT_TIMEOUT_MS, resolveSubagentTimeoutMs, runAgentWithTimeoutContinuation, buildSubagentUsageDelta, inheritSubagentAllowedTools, inheritSubagentLifecycleTools, SUBAGENT_MAX_TOKENS_ERROR, SUBAGENT_MAX_TOKENS_HANDOFF_PROMPT, buildSubagentMaxTokensFailure, shouldRequestSubagentHandoff, SUMMARY_MIN_LENGTH, SUMMARY_CONTINUATION_ATTEMPTS, HOOK_TEXT_PREVIEW_LENGTH, TOOL_CALL_DISABLED_MESSAGE, SUBAGENT_PROMPT_ORIGIN, SIDE_QUESTION_SYSTEM_REMINDER, SessionSubagentHost;
+var DEFAULT_SUBAGENT_TIMEOUT_MS, resolveSubagentTimeoutMs, runAgentWithTimeoutContinuation, buildSubagentUsageDelta, inheritSubagentAllowedTools, inheritSubagentLifecycleTools, SUBAGENT_MAX_TOKENS_ERROR, SUBAGENT_MAX_TOKENS_HANDOFF_PROMPT, buildSubagentMaxTokensFailure, isSubagentMaxTokensTurnError, shouldRequestSubagentHandoff, SUMMARY_MIN_LENGTH, SUMMARY_CONTINUATION_ATTEMPTS, HOOK_TEXT_PREVIEW_LENGTH, TOOL_CALL_DISABLED_MESSAGE, SUBAGENT_PROMPT_ORIGIN, SIDE_QUESTION_SYSTEM_REMINDER, SessionSubagentHost;
 var init_subagent_host = __esmMin((() => {
 	init_src$4();
 	init_errors$8();
@@ -252425,6 +252432,7 @@ var init_subagent_host = __esmMin((() => {
 		SUBAGENT_MAX_TOKENS_ERROR,
 		SUBAGENT_MAX_TOKENS_HANDOFF_PROMPT,
 		buildSubagentMaxTokensFailure,
+		isSubagentMaxTokensTurnError,
 		shouldRequestSubagentHandoff
 	} = createRequire(import.meta.url)("./bin/subagent-max-tokens-handoff-policy.cjs"));
 	SUMMARY_MIN_LENGTH = 200;
@@ -258611,6 +258619,11 @@ glob_default = "Find files by glob pattern, sorted by modification time with the
 		}
 		async execution(args, signal, searchRoots) {
 			const searchRoot = searchRoots[0] ?? this.workspace.workspaceDir;
+			const patternError = globPatternError(args.pattern);
+			if (patternError !== void 0) return {
+				isError: true,
+				output: patternError
+			};
 			try {
 				if (((await this.kaos.stat(searchRoot)).stMode & S_IFMT$2) !== S_IFDIR$1) return {
 					isError: true,
@@ -261019,6 +261032,7 @@ async function persistHistoricalToolResultForModel(options, knownText) {
 	};
 }
 function renderHistoricalToolResultReference(toolName, toolCallId, text, outputPath, storageMode) {
+	const nextLineOffset = toolName === "Read" ? readContinuationLineOffset(text) : void 0;
 	return [
 		TOOL_RESULT_OFFLOAD_MARKER,
 		"An older tool result was archived to keep the active context fast.",
@@ -261027,14 +261041,15 @@ function renderHistoricalToolResultReference(toolName, toolCallId, text, outputP
 		`tool_call_id: ${toolCallId}`,
 		`output_size_chars: ${String(text.length)}`,
 		`output_size_bytes: ${String(Buffer.byteLength(text, "utf8"))}`,
+		...(nextLineOffset === void 0 ? [] : [`next_line_offset: ${String(nextLineOffset)}`]),
 		`output_path: ${outputPath}`,
-		`next_step: Use Read with output_path using n_lines <= ${String(TOOL_RESULT_RECOVERY_PAGE_LINES)}; advance line_offset between calls.`
+		nextLineOffset === void 0 ? `next_step: Use Read with output_path using n_lines <= ${String(TOOL_RESULT_RECOVERY_PAGE_LINES)}; advance line_offset between calls.` : `next_step: Continue the original Read with line_offset=${String(nextLineOffset)}; do not restart at the beginning.`
 	].join("\n");
 }
 function safeToolResultFileStem(toolName, toolCallId) {
 	return `${toolName}-${toolCallId}`.replace(/[^a-zA-Z0-9._-]+/g, "_").replace(/^_+|_+$/g, "").slice(0, 80) || "tool-result";
 }
-var TOOL_RESULT_MAX_CHARS, TOOL_RESULT_PREVIEW_CHARS, TOOL_RESULT_RECOVERY_PAGE_LINES, TOOL_RESULT_OFFLOAD_MARKER, TOOL_RESULT_HISTORICAL_KEEP_RECENT_MESSAGES, shouldKeepFreshToolResult, shouldOffloadToolResult, createToolResultPreview, compactPersistedToolResultReference, compactHistoricalSuccessfulToolResults, dedupeRepeatedSuccessfulToolResults, selectToolResultBatchOffloads, selectHistoricalToolResultOffloads, buildToolResultOffloadTelemetry;
+var TOOL_RESULT_MAX_CHARS, TOOL_RESULT_PREVIEW_CHARS, TOOL_RESULT_RECOVERY_PAGE_LINES, TOOL_RESULT_OFFLOAD_MARKER, TOOL_RESULT_HISTORICAL_KEEP_RECENT_MESSAGES, shouldKeepFreshToolResult, shouldOffloadToolResult, createToolResultPreview, compactPersistedToolResultReference, compactHistoricalSuccessfulToolResults, dedupeRepeatedSuccessfulToolResults, readContinuationLineOffset, selectToolResultBatchOffloads, selectHistoricalToolResultOffloads, buildToolResultOffloadTelemetry;
 var init_tool_result_budget = __esmMin((() => {
 	init_dist$6();
 	const toolResultOffloadPolicy = createRequire(import.meta.url)("./bin/tool-result-offload-policy.cjs");
@@ -261051,6 +261066,7 @@ var init_tool_result_budget = __esmMin((() => {
 	compactHistoricalSuccessfulToolResults = toolResultOffloadPolicy.compactHistoricalSuccessfulToolResults;
 	dedupeRepeatedSuccessfulToolResults = toolResultOffloadPolicy.dedupeRepeatedSuccessfulToolResults;
 	freshToolResultIds = toolResultOffloadPolicy.freshToolResultIds;
+	readContinuationLineOffset = toolResultOffloadPolicy.readContinuationLineOffset;
 	selectToolResultBatchOffloads = toolResultOffloadPolicy.selectToolResultBatchOffloads;
 	selectHistoricalToolResultOffloads = toolResultOffloadPolicy.selectHistoricalToolResultOffloads;
 }));
@@ -517648,6 +517664,7 @@ var BlunTUI = class {
 		const items = this.state.queuedMessages.slice(0, batchEnd < 0 ? this.state.queuedMessages.length : batchEnd);
 		if (items.length === 0) return false;
 		this.state.queuedMessages = this.state.queuedMessages.slice(items.length);
+		this.updateQueueDisplay();
 		const transcriptRendered = items.map((queued) => queued.channelTranscriptRendered === true);
 		const renderTranscripts = () => {
 			items.forEach((queued, index) => {
@@ -517915,6 +517932,7 @@ var BlunTUI = class {
 		}
 		const items = this.state.queuedMessages.slice(0, prefixLength);
 		this.state.queuedMessages = this.state.queuedMessages.slice(prefixLength);
+		this.updateQueueDisplay();
 		const turnId = this.streamingUI.getTurnContext().turnId;
 		const inFlight = {
 			items,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "blun-king-cli",
-  "version": "9.1.480",
+  "version": "9.1.482",
   "description": "BLUN CLI - your own AI agent with a Telegram channel. Get it done. With BLUN.",
   "license": "MIT",
   "bin": {