darwin-agents 0.12.1 → 0.12.2
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
package/CHANGELOG.md
CHANGED
|
@@ -2,6 +2,26 @@
|
|
|
2
2
|
|
|
3
3
|
## [Unreleased]
|
|
4
4
|
|
|
5
|
+
## [0.12.2] — 2026-07-17
|
|
6
|
+
|
|
7
|
+
### Security
|
|
8
|
+
|
|
9
|
+
- **Evolution-loop optimizer/reflector subprocesses no longer run with
|
|
10
|
+
`bypassPermissions`.** `buildEvolutionLoop`'s two LLM closures (legacy
|
|
11
|
+
optimizer meta-prompt + GEPA reflector) are pure text mutators, but they
|
|
12
|
+
passed `autonomous: true` to `runAgent`, which spawns the Claude CLI with
|
|
13
|
+
`--permission-mode bypassPermissions` — and since neither agent definition
|
|
14
|
+
declares tools/MCP servers, no `--allowedTools` restriction was emitted
|
|
15
|
+
either. Their input quotes untrusted agent output (critic feedback reports
|
|
16
|
+
can contain scraped web content), so a prompt injection could in principle
|
|
17
|
+
have steered an unrestricted subprocess into tool calls. Both closures now
|
|
18
|
+
run `autonomous: false` (the CLI's deny-by-default permission mode);
|
|
19
|
+
legitimate runs are unaffected because the templates demand "return ONLY
|
|
20
|
+
the prompt text". Found by an adversarial review of the first external
|
|
21
|
+
consumer wiring `buildEvolutionLoop` (severity: plausible, low
|
|
22
|
+
probability, real surface). `tests/build-loop-security.test.ts` is the
|
|
23
|
+
regression tripwire.
|
|
24
|
+
|
|
5
25
|
## [0.12.1] — 2026-07-16
|
|
6
26
|
|
|
7
27
|
Export patch — no behavioural change. Completes the v0.12.0
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"build-loop.d.ts","sourceRoot":"","sources":["../../../src/evolution/build-loop.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAGH,OAAO,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AAOvC,OAAO,KAAK,EAAE,eAAe,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAEjF;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAChC,KAAK,EAAE,eAAe,EACtB,MAAM,EAAE,YAAY,EACpB,MAAM,EAAE,cAAc,GACrB,UAAU,
|
|
1
|
+
{"version":3,"file":"build-loop.d.ts","sourceRoot":"","sources":["../../../src/evolution/build-loop.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAGH,OAAO,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AAOvC,OAAO,KAAK,EAAE,eAAe,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAEjF;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAChC,KAAK,EAAE,eAAe,EACtB,MAAM,EAAE,YAAY,EACpB,MAAM,EAAE,cAAc,GACrB,UAAU,CA+DZ"}
|
|
@@ -27,6 +27,14 @@ export function buildEvolutionLoop(agent, config, memory) {
|
|
|
27
27
|
const patterns = new PatternDetector(memory);
|
|
28
28
|
const safety = new SafetyGate();
|
|
29
29
|
// The optimizer uses the configured provider to generate improved prompts.
|
|
30
|
+
//
|
|
31
|
+
// SECURITY (v0.12.2): optimizer + reflector are pure TEXT mutators — they
|
|
32
|
+
// never need tools. Running them non-autonomously keeps the spawned CLI in
|
|
33
|
+
// its deny-by-default permission mode instead of bypassPermissions, so a
|
|
34
|
+
// prompt-injection smuggled in via critic feedback (which quotes untrusted
|
|
35
|
+
// agent output, including scraped web content) cannot make the subprocess
|
|
36
|
+
// execute tool calls. Legitimate runs are unaffected: the templates demand
|
|
37
|
+
// "return ONLY the prompt text".
|
|
30
38
|
const optimizer = new PromptOptimizer(async (metaPrompt) => {
|
|
31
39
|
const optimizerResult = await runAgent({
|
|
32
40
|
name: 'optimizer',
|
|
@@ -36,7 +44,7 @@ export function buildEvolutionLoop(agent, config, memory) {
|
|
|
36
44
|
systemPrompt: 'You are a prompt optimization expert. Return ONLY the improved prompt text.',
|
|
37
45
|
maxTurns: 3,
|
|
38
46
|
model: 'claude-sonnet-4-6',
|
|
39
|
-
}, metaPrompt, { config, taskType: 'optimization', autonomous:
|
|
47
|
+
}, metaPrompt, { config, taskType: 'optimization', autonomous: false });
|
|
40
48
|
return optimizerResult.output;
|
|
41
49
|
});
|
|
42
50
|
// v0.6.0 — GEPA reflective optimizer (opt-in via agent.evolution.useGepa).
|
|
@@ -57,7 +65,9 @@ export function buildEvolutionLoop(agent, config, memory) {
|
|
|
57
65
|
systemPrompt: 'You are a prompt-engineering reflector. Return ONLY the mutated prompt text.',
|
|
58
66
|
maxTurns: 3,
|
|
59
67
|
model: reflectionModel ?? agent.model ?? 'claude-sonnet-4-6',
|
|
60
|
-
}, reflectionPrompt,
|
|
68
|
+
}, reflectionPrompt,
|
|
69
|
+
// Same deny-by-default posture as the optimizer above (v0.12.2).
|
|
70
|
+
{ config, taskType: 'reflection', autonomous: false });
|
|
61
71
|
return reflectionResult.output;
|
|
62
72
|
});
|
|
63
73
|
}
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"build-loop.js","sourceRoot":"","sources":["../../../src/evolution/build-loop.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AAC7C,OAAO,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AACvC,OAAO,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC;AACjD,OAAO,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAChD,OAAO,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AACjD,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACpD,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,sBAAsB,EAAE,MAAM,oBAAoB,CAAC;AAG5D;;;;;GAKG;AACH,MAAM,UAAU,kBAAkB,CAChC,KAAsB,EACtB,MAAoB,EACpB,MAAsB;IAEtB,MAAM,OAAO,GAAG,IAAI,iBAAiB,CAAC,MAAM,CAAC,CAAC;IAC9C,MAAM,QAAQ,GAAG,IAAI,eAAe,CAAC,MAAM,CAAC,CAAC;IAC7C,MAAM,MAAM,GAAG,IAAI,UAAU,EAAE,CAAC;IAEhC,2EAA2E;IAC3E,MAAM,SAAS,GAAG,IAAI,eAAe,CAAC,KAAK,EAAE,UAAkB,EAAE,EAAE;QACjE,MAAM,eAAe,GAAG,MAAM,QAAQ,CACpC;YACE,IAAI,EAAE,WAAW;YACjB,IAAI,EAAE,kBAAkB;YACxB,WAAW,EAAE,oCAAoC;YACjD,IAAI,EAAE,KAAK;YACX,YAAY,EAAE,6EAA6E;YAC3F,QAAQ,EAAE,CAAC;YACX,KAAK,EAAE,mBAAmB;SAC3B,EACD,UAAU,EACV,EAAE,MAAM,EAAE,QAAQ,EAAE,cAAc,EAAE,UAAU,EAAE,
|
|
1
|
+
{"version":3,"file":"build-loop.js","sourceRoot":"","sources":["../../../src/evolution/build-loop.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AAC7C,OAAO,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AACvC,OAAO,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC;AACjD,OAAO,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAChD,OAAO,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AACjD,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACpD,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,sBAAsB,EAAE,MAAM,oBAAoB,CAAC;AAG5D;;;;;GAKG;AACH,MAAM,UAAU,kBAAkB,CAChC,KAAsB,EACtB,MAAoB,EACpB,MAAsB;IAEtB,MAAM,OAAO,GAAG,IAAI,iBAAiB,CAAC,MAAM,CAAC,CAAC;IAC9C,MAAM,QAAQ,GAAG,IAAI,eAAe,CAAC,MAAM,CAAC,CAAC;IAC7C,MAAM,MAAM,GAAG,IAAI,UAAU,EAAE,CAAC;IAEhC,2EAA2E;IAC3E,EAAE;IACF,0EAA0E;IAC1E,2EAA2E;IAC3E,yEAAyE;IACzE,2EAA2E;IAC3E,0EAA0E;IAC1E,2EAA2E;IAC3E,iCAAiC;IACjC,MAAM,SAAS,GAAG,IAAI,eAAe,CAAC,KAAK,EAAE,UAAkB,EAAE,EAAE;QACjE,MAAM,eAAe,GAAG,MAAM,QAAQ,CACpC;YACE,IAAI,EAAE,WAAW;YACjB,IAAI,EAAE,kBAAkB;YACxB,WAAW,EAAE,oCAAoC;YACjD,IAAI,EAAE,KAAK;YACX,YAAY,EAAE,6EAA6E;YAC3F,QAAQ,EAAE,CAAC;YACX,KAAK,EAAE,mBAAmB;SAC3B,EACD,UAAU,EACV,EAAE,MAAM,EAAE,QAAQ,EAAE,cAAc,EAAE,UAAU,EAAE,KAAK,EAAE,CACxD,CAAC;QACF,OAAO,eAAe,CAAC,MAAM,CAAC;IAChC,CAAC,CAAC,CAAC;IAEH,2EAA2E;IAC3E,IAAI,IAA+B,CAAC;IACpC,IAAI,KAAK,CAAC,SAAS,EAAE,OAAO,EAAE,CAAC;QAC7B,MAAM,eAAe,GAAG,KAAK,CAAC,SAAS,CAAC,eAAe,CAAC;QACxD,IAAI,CAAC,eAAe,EAAE,CAAC;YACrB,OAAO,CAAC,IAAI,CACV,6EAA6E;gBAC7E,kFAAkF;gBAClF,oFAAoF,CACrF,CAAC;QACJ,CAAC;QACD,IAAI,GAAG,IAAI,aAAa,CAAC,KAAK,EAAE,gBAAwB,EAAE,EAAE;YAC1D,MAAM,gBAAgB,GAAG,MAAM,QAAQ,CACrC;gBACE,IAAI,EAAE,WAAW;gBACjB,IAAI,EAAE,gBAAgB;gBACtB,WAAW,EAAE,yDAAyD;gBACtE,IAAI,EAAE,KAAK;gBACX,YAAY,EAAE,8EAA8E;gBAC5F,QAAQ,EAAE,CAAC;gBACX,KAAK,EAAE,eAAe,IAAI,KAAK,CAAC,KAAK,IAAI,mBAAmB;aAC7D,EACD,gBAAgB;YAChB,iEAAiE;YACjE,EAAE,MAAM,EAAE,QAAQ,EAAE,YAAY,EAAE,UAAU,EAAE,KAAK,EAAE,CACtD,CAAC;YACF,OAAO,gBAAgB,CAAC,MAAM,CAAC;QACjC,CAAC,CAAC,CAAC;IACL,CAAC;IAED,MAAM,aAAa,GAAG,sBAAsB,EAAE,CAAC;IAC/C,OAAO,IAAI,UAAU,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;AACtG,CAAC"}
|
package/package.json
CHANGED