doer-agent 0.4.5 → 0.4.7

package/dist/agent-fs-rpc.js

@@ -1,7 +1,9 @@
 import path from "node:path";
-import { gunzipSync, gzipSync } from "node:zlib";
-import { mkdir, open, readFile, readdir, rm, stat, writeFile } from "node:fs/promises";
+import { mkdir, open, readFile, readdir, rename, rm, stat, writeFile } from "node:fs/promises";
+import crypto from "node:crypto";
 import { StringCodec } from "nats";
+import { create as createTar, extract as extractTar } from "tar";
+import { validateImageBytes } from "./agent-runtime-utils.js";
 const fsRpcCodec = StringCodec();
 function normalizeFsRpcPath(workspaceRoot, rawPath) {
     const raw = typeof rawPath === "string" && rawPath.trim() ? rawPath.trim() : ".";
@@ -25,8 +27,7 @@ function parseFsRpcAction(value) {
         value === "stat" ||
         value === "upload_file" ||
         value === "read_text" ||
-        value === "read_file" ||
-        value === "write_file" ||
+        value === "write_text" ||
         value === "download_file" ||
         value === "delete_path" ||
         value === "archive_dir" ||
@@ -88,33 +89,20 @@ function inferMimeType(filePath) {
     }
     return "application/octet-stream";
 }
-function normalizeArchiveRelativePath(value) {
-    const normalized = value.replace(/\\/g, "/").replace(/^\/+|\/+$/g, "");
-    if (!normalized || normalized.includes("..")) {
-        throw new Error("invalid archive entry path");
-    }
-    return normalized;
+function sha256Hex(bytes) {
+    return crypto.createHash("sha256").update(bytes).digest("hex");
 }
-async function collectDirectoryFiles(absDir, rootDir = absDir) {
-    const rows = await readdir(absDir, { withFileTypes: true });
-    const files = [];
-    for (const row of rows.sort((a, b) => a.name.localeCompare(b.name))) {
-        const child = path.join(absDir, row.name);
-        if (row.isDirectory()) {
-            files.push(...await collectDirectoryFiles(child, rootDir));
-            continue;
-        }
-        if (!row.isFile()) {
-            continue;
-        }
-        const bytes = await readFile(child);
-        files.push({
-            relPath: normalizeArchiveRelativePath(path.relative(rootDir, child)),
-            contentBase64: Buffer.from(bytes).toString("base64"),
-            sizeBytes: bytes.byteLength,
-        });
-    }
-    return files;
+async function createTarGzipBuffer(cwd, entries) {
+    const stream = createTar({
+        cwd,
+        gzip: true,
+        portable: true,
+    }, entries);
+    const chunks = [];
+    for await (const chunk of stream) {
+        chunks.push(Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk));
+    }
+    return Buffer.concat(chunks);
 }
 async function executeFsRpc(args) {
     const action = parseFsRpcAction(args.request.action);
@@ -168,13 +156,18 @@ async function executeFsRpc(args) {
             throw new Error("archivePath is required");
         }
         const archiveTarget = normalizeFsRpcPath(args.workspaceRoot, rawArchivePath);
-        const files = await collectDirectoryFiles(abs);
-        if (!files.some((file) => file.relPath === "SKILL.md")) {
+        try {
+            const manifestEntry = await stat(path.join(abs, "SKILL.md"));
+            if (!manifestEntry.isFile()) {
+                throw new Error("Selected skill directory must contain SKILL.md");
+            }
+        }
+        catch {
             throw new Error("Selected skill directory must contain SKILL.md");
         }
-        const payload = gzipSync(Buffer.from(JSON.stringify({ files }), "utf8"));
         await mkdir(path.dirname(archiveTarget.abs), { recursive: true });
-        await writeFile(archiveTarget.abs, payload);
+        const archiveBytes = await createTarGzipBuffer(abs, ["."]);
+        await writeFile(archiveTarget.abs, archiveBytes);
         const archiveStat = await stat(archiveTarget.abs);
         return {
             ok: true,
@@ -256,15 +249,12 @@ async function executeFsRpc(args) {
             upload,
         };
     }
-    if (action === "write_file") {
-        const contentBase64 = typeof args.request.contentBase64 === "string" ? args.request.contentBase64 : "";
-        if (!contentBase64) {
-            throw new Error("contentBase64 is required");
-        }
+    if (action === "write_text") {
+        const text = typeof args.request.text === "string" ? args.request.text : "";
+        const encoding = typeof args.request.encoding === "string" && args.request.encoding ? args.request.encoding : "utf8";
         const parentDir = path.dirname(abs);
         await mkdir(parentDir, { recursive: true });
-        const bytes = Buffer.from(contentBase64, "base64");
-        await writeFile(abs, bytes);
+        await writeFile(abs, text, { encoding: encoding });
         const entry = await stat(abs);
         return {
             ok: true,
@@ -274,6 +264,7 @@ async function executeFsRpc(args) {
             size: entry.size,
             mimeType: inferMimeType(abs),
             mtimeMs: entry.mtimeMs,
+            encoding,
         };
     }
     if (action === "delete_path") {
@@ -305,9 +296,16 @@ async function executeFsRpc(args) {
             throw new Error(text || `download failed: ${response.status}`);
         }
         const bytes = Buffer.from(await response.arrayBuffer());
+        const validationError = validateImageBytes(abs, bytes);
+        if (validationError) {
+            throw new Error(validationError);
+        }
         const parentDir = path.dirname(abs);
         await mkdir(parentDir, { recursive: true });
         await writeFile(abs, bytes);
+        if (abs.endsWith(".skillpkg")) {
+            console.log(`[doer-agent] skillpkg downloaded path=${formatPath(abs)} size=${bytes.byteLength} sha256=${sha256Hex(bytes)}`);
+        }
         const entry = await stat(abs);
         return {
             ok: true,
@@ -330,18 +328,42 @@ async function executeFsRpc(args) {
         }
         const destinationTarget = normalizeFsRpcPath(args.workspaceRoot, rawDestinationPath);
         const archiveBytes = await readFile(abs);
-        const decoded = JSON.parse(gunzipSync(archiveBytes).toString("utf8"));
-        const files = Array.isArray(decoded.files) ? decoded.files : [];
-        await mkdir(destinationTarget.abs, { recursive: true });
-        for (const file of files) {
-            const relPath = typeof file.relPath === "string" ? normalizeArchiveRelativePath(file.relPath) : "";
-            const contentBase64 = typeof file.contentBase64 === "string" ? file.contentBase64 : "";
-            if (!relPath || !contentBase64) {
-                throw new Error("archive contains an invalid file entry");
+        const magic = archiveBytes.subarray(0, 8).toString("hex");
+        const digest = sha256Hex(archiveBytes);
+        const destinationParent = path.dirname(destinationTarget.abs);
+        const tempDestinationAbs = path.join(destinationParent, `.tmp-extract-${path.basename(destinationTarget.abs)}-${crypto.randomBytes(6).toString("hex")}`);
+        await mkdir(destinationParent, { recursive: true });
+        try {
+            const existing = await stat(destinationTarget.abs);
+            if (existing.isDirectory()) {
+                const entries = await readdir(destinationTarget.abs);
+                if (entries.length > 0) {
+                    throw new Error("destinationPath already exists");
+                }
             }
-            const targetPath = path.join(destinationTarget.abs, relPath);
-            await mkdir(path.dirname(targetPath), { recursive: true });
-            await writeFile(targetPath, Buffer.from(contentBase64, "base64"));
+            else {
+                throw new Error("destinationPath already exists");
+            }
+            await rm(destinationTarget.abs, { recursive: true, force: true });
+        }
+        catch (error) {
+            if (!(error instanceof Error) || !error.message.includes("ENOENT")) {
+                throw error;
+            }
+        }
+        await mkdir(tempDestinationAbs, { recursive: true });
+        try {
+            await extractTar({
+                cwd: tempDestinationAbs,
+                file: abs,
+                gzip: true,
+            });
+            await rename(tempDestinationAbs, destinationTarget.abs);
+        }
+        catch (error) {
+            await rm(tempDestinationAbs, { recursive: true, force: true }).catch(() => undefined);
+            const message = error instanceof Error ? error.message : "extract failed";
+            throw new Error(`${message} (magic=${magic} size=${archiveBytes.byteLength} sha256=${digest})`);
         }
         return {
             ok: true,
@@ -354,21 +376,6 @@ async function executeFsRpc(args) {
     if (!entry.isFile()) {
         throw new Error("path is not a file");
     }
-    if (action === "read_file") {
-        const maxBytes = Math.max(1, Math.min(normalizeFsRpcNumber(args.request.maxBytes, 2_000_000), 5_000_000));
-        const data = await readFile(abs);
-        const truncated = data.byteLength > maxBytes;
-        const bytes = truncated ? data.subarray(0, maxBytes) : data;
-        return {
-            ok: true,
-            action,
-            path: formatPath(abs),
-            mimeType: inferMimeType(abs),
-            size: entry.size,
-            truncated,
-            contentBase64: bytes.toString("base64"),
-        };
-    }
     const offset = Math.max(0, normalizeFsRpcNumber(args.request.offset, 0));
     const length = Math.max(1, Math.min(normalizeFsRpcNumber(args.request.length, 65536), 262144));
     const encoding = typeof args.request.encoding === "string" && args.request.encoding ? args.request.encoding : "utf8";

package/dist/agent-runtime-utils.js

@@ -1,4 +1,5 @@
 import { readFile } from "node:fs/promises";
+import path from "node:path";
 export function sanitizeUserId(userId) {
     const normalized = userId.trim().replace(/[^a-zA-Z0-9_-]/g, "_");
     return normalized.length > 0 ? normalized : "anonymous";
@@ -93,6 +94,93 @@ export function normalizeRunImagePaths(value) {
     }
     return out;
 }
+const PNG_SIGNATURE = Buffer.from([0x89, 0x50, 0x4e, 0x47, 0x0d, 0x0a, 0x1a, 0x0a]);
+const crc32Table = (() => {
+    const table = new Uint32Array(256);
+    for (let index = 0; index < 256; index += 1) {
+        let crc = index;
+        for (let bit = 0; bit < 8; bit += 1) {
+            crc = (crc & 1) !== 0 ? 0xedb88320 ^ (crc >>> 1) : crc >>> 1;
+        }
+        table[index] = crc >>> 0;
+    }
+    return table;
+})();
+function crc32(parts) {
+    let crc = 0xffffffff;
+    for (const part of parts) {
+        for (let index = 0; index < part.length; index += 1) {
+            crc = crc32Table[(crc ^ part[index]) & 0xff] ^ (crc >>> 8);
+        }
+    }
+    return (crc ^ 0xffffffff) >>> 0;
+}
+function validatePngBytes(bytes) {
+    if (bytes.length < PNG_SIGNATURE.length || !bytes.subarray(0, PNG_SIGNATURE.length).equals(PNG_SIGNATURE)) {
+        return "missing PNG signature";
+    }
+    let offset = PNG_SIGNATURE.length;
+    let sawIend = false;
+    while (offset < bytes.length) {
+        if (offset + 12 > bytes.length) {
+            return "truncated PNG chunk";
+        }
+        const chunkLength = bytes.readUInt32BE(offset);
+        const typeStart = offset + 4;
+        const dataStart = offset + 8;
+        const dataEnd = dataStart + chunkLength;
+        const crcOffset = dataEnd;
+        const nextOffset = crcOffset + 4;
+        if (dataEnd > bytes.length || nextOffset > bytes.length) {
+            return "truncated PNG chunk payload";
+        }
+        const type = bytes.subarray(typeStart, dataStart);
+        const expectedCrc = bytes.readUInt32BE(crcOffset);
+        const actualCrc = crc32([type, bytes.subarray(dataStart, dataEnd)]);
+        if (expectedCrc !== actualCrc) {
+            const chunkName = type.toString("ascii");
+            return `PNG CRC mismatch in ${chunkName} chunk`;
+        }
+        if (type.equals(Buffer.from("IEND"))) {
+            sawIend = true;
+            if (nextOffset !== bytes.length) {
+                return "unexpected trailing bytes after PNG IEND";
+            }
+            break;
+        }
+        offset = nextOffset;
+    }
+    return sawIend ? null : "missing PNG IEND chunk";
+}
+export function validateImageBytes(filePath, bytes) {
+    const ext = path.extname(filePath).toLowerCase();
+    if (ext === ".png") {
+        return validatePngBytes(bytes);
+    }
+    return null;
+}
+export async function filterValidRunImagePaths(args) {
+    const valid = [];
+    for (const imagePath of args.imagePaths) {
+        const absPath = path.isAbsolute(imagePath) ? imagePath : path.resolve(args.workspaceRoot, imagePath);
+        let bytes;
+        try {
+            bytes = await readFile(absPath);
+        }
+        catch (error) {
+            const reason = error instanceof Error ? error.message : "failed to read image";
+            args.onInvalidImage?.(imagePath, reason);
+            continue;
+        }
+        const validationError = validateImageBytes(absPath, bytes);
+        if (validationError) {
+            args.onInvalidImage?.(imagePath, validationError);
+            continue;
+        }
+        valid.push(imagePath);
+    }
+    return valid;
+}
 export function fatalExit(message, error, writeAgentError) {
     const detail = error instanceof Error ? error.message : typeof error === "string" ? error : error ? String(error) : "";
     const full = detail ? `${message}: ${detail}` : message;
@@ -102,17 +190,6 @@ export function fatalExit(message, error, writeAgentError) {
 export function sleep(ms) {
     return new Promise((resolve) => setTimeout(resolve, ms));
 }
-export function writeTaskStream(taskId, stream, chunk) {
-    const target = stream === "stdout" ? process.stdout : process.stderr;
-    const lines = chunk.replace(/\r/g, "\n").split("\n");
-    for (let i = 0; i < lines.length; i += 1) {
-        const line = lines[i];
-        if (line.length === 0 && i === lines.length - 1) {
-            continue;
-        }
-        target.write(`[doer-agent][task=${taskId}][${stream}] ${line}\n`);
-    }
-}
 export function writeTaskUpload(taskId, message) {
     process.stdout.write(`[doer-agent][task=${taskId}][upload] ${message}\n`);
 }
@@ -127,9 +204,6 @@ export function writeRpcStream(requestId, stream, chunk) {
         target.write(`[doer-agent][rpc=${requestId}][${stream}] ${line}\n`);
     }
 }
-export function writeRpcStatus(requestId, message) {
-    process.stdout.write(`[doer-agent][rpc=${requestId}][status] ${message}\n`);
-}
 export function writeRunStatus(runId, message) {
     process.stdout.write(`[doer-agent][run=${runId}][status] ${message}\n`);
 }

package/dist/agent-runtime-utils.test.js

@@ -0,0 +1,38 @@
+import test from "node:test";
+import assert from "node:assert/strict";
+import os from "node:os";
+import path from "node:path";
+import { mkdtemp, rm, writeFile } from "node:fs/promises";
+import { filterValidRunImagePaths } from "./agent-runtime-utils.js";
+const invalidTinyPngBase64 = "iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAQAAAC1HAwCAAAAC0lEQVR42mP8/x8AAwMCAO+aK1cAAAAASUVORK5CYII=";
+function buildValidTinyPng() {
+    const bytes = Buffer.from(invalidTinyPngBase64, "base64");
+    bytes.writeUInt32BE(0xefa2a75b, 0x34);
+    return bytes;
+}
+test("filterValidRunImagePaths drops PNGs with CRC mismatches", async () => {
+    const workspaceRoot = await mkdtemp(path.join(os.tmpdir(), "doer-agent-image-filter-"));
+    try {
+        const invalidPngPath = path.join(workspaceRoot, "bad.png");
+        const validPngPath = path.join(workspaceRoot, "good.png");
+        const validJpgPath = path.join(workspaceRoot, "photo.jpg");
+        await writeFile(invalidPngPath, Buffer.from(invalidTinyPngBase64, "base64"));
+        await writeFile(validPngPath, buildValidTinyPng());
+        await writeFile(validJpgPath, Buffer.from([0xff, 0xd8, 0xff, 0xd9]));
+        const invalid = [];
+        const result = await filterValidRunImagePaths({
+            workspaceRoot,
+            imagePaths: ["bad.png", "good.png", "photo.jpg"],
+            onInvalidImage: (imagePath, reason) => {
+                invalid.push({ imagePath, reason });
+            },
+        });
+        assert.deepEqual(result, ["good.png", "photo.jpg"]);
+        assert.equal(invalid.length, 1);
+        assert.equal(invalid[0]?.imagePath, "bad.png");
+        assert.match(invalid[0]?.reason ?? "", /CRC mismatch/i);
+    }
+    finally {
+        await rm(workspaceRoot, { recursive: true, force: true });
+    }
+});

package/dist/agent-task-execution.js

@@ -1,6 +1,3 @@
-import { spawn } from "node:child_process";
-import { mkdir } from "node:fs/promises";
-import path from "node:path";
 export function sendSignalToTaskProcess(child, signal) {
     if (process.platform !== "win32" && typeof child.pid === "number") {
         try {
@@ -30,17 +27,8 @@ export function sendSignalToPid(pid, signal) {
     }
     process.kill(pid, signal);
 }
-async function checkCancelRequested(args) {
-    const query = new URLSearchParams({
-        userId: args.userId,
-        agentToken: args.agentToken,
-    });
-    const response = await args.getJson(`${args.serverBaseUrl}/api/agent/tasks/${encodeURIComponent(args.taskId)}/events?${query.toString()}`);
-    return Boolean(response.task?.cancelRequested);
-}
 async function syncCodexAuthState(args) {
     const envPatch = {};
-    const synced = false;
     if (args.authMode === "api_key" && args.apiKey) {
         envPatch.OPENAI_API_KEY = args.apiKey;
     }
@@ -54,19 +42,10 @@ async function syncCodexAuthState(args) {
             codexAuthHasAuthJson: Boolean(args.authJson),
             codexAuthIssuedAt: args.issuedAt ?? null,
             codexAuthExpiresAt: args.expiresAt ?? null,
-            codexAuthSynced: synced,
+            codexAuthSynced: false,
         },
     };
 }
-async function prepareTaskCodexAuth(args) {
-    void args;
-    return await syncCodexAuthState({
-        source: "agent_local",
-        authJson: null,
-        issuedAt: null,
-        expiresAt: null,
-    });
-}
 export async function prepareCodexAuthBundle(bundle) {
     if (!bundle) {
         return null;
@@ -80,196 +59,3 @@ export async function prepareCodexAuthBundle(bundle) {
         expiresAt: bundle.expiresAt ?? null,
     });
 }
-export async function runTask(args) {
-    args.setActiveTaskLogContext({
-        jetstream: args.jetstream,
-        serverBaseUrl: args.serverBaseUrl,
-        taskId: args.taskId,
-        userId: args.userId,
-    });
-    const shellPath = args.resolveShellPath();
-    const taskWorkspace = args.resolveTaskWorkspace(args.cwd);
-    const codexHome = args.resolveCodexHomePath();
-    await mkdir(codexHome, { recursive: true });
-    const runtimeConfig = await args.prepareTaskRuntimeConfig({
-        serverBaseUrl: args.serverBaseUrl,
-        taskId: args.taskId,
-        userId: args.userId,
-        agentToken: args.agentToken,
-    });
-    const codexAuth = await prepareTaskCodexAuth({
-        serverBaseUrl: args.serverBaseUrl,
-        taskId: args.taskId,
-        userId: args.userId,
-        agentToken: args.agentToken,
-    });
-    const localAgentSettings = await args.readAgentSettingsConfig({ workspaceRoot: args.resolveWorkspaceRoot() });
-    const baseTaskEnvPatch = {
-        CODEX_HOME: codexHome,
-        ...args.buildAgentSettingsEnvPatch(localAgentSettings),
-        ...(runtimeConfig?.envPatch ?? {}),
-        ...(codexAuth?.envPatch ?? {}),
-        WORKSPACE: taskWorkspace,
-    };
-    const taskGitEnv = await args.prepareTaskGitEnv({
-        cwd: taskWorkspace,
-        baseEnvPatch: baseTaskEnvPatch,
-    });
-    await args.recordAgentEvent({
-        jetstream: args.jetstream,
-        serverBaseUrl: args.serverBaseUrl,
-        taskId: args.taskId,
-        userId: args.userId,
-        type: "meta",
-        seq: args.reserveNextEventSeq(args.taskId),
-        payload: {
-            host: process.platform,
-            pid: process.pid,
-            startedAt: args.formatLocalTimestamp(),
-            command: args.command,
-            cwd: taskWorkspace,
-            requestedCwd: args.cwd,
-            shell: shellPath,
-            ...(runtimeConfig?.meta ?? { runtimeConfigSynced: false }),
-            ...(codexAuth?.meta ?? { codexAuthSynced: false }),
-            ...(taskGitEnv.meta ?? {}),
-        },
-    });
-    try {
-        let terminationReason = null;
-        let cancelStage1Timer = null;
-        let cancelStage2Timer = null;
-        let stopCancelPolling = false;
-        let cancelSignalSent = false;
-        const runtimeBinPath = path.join(args.agentProjectDir, "runtime/bin");
-        const taskPath = [runtimeBinPath, process.env.PATH || ""].filter(Boolean).join(path.delimiter);
-        const child = spawn(args.command, {
-            cwd: taskWorkspace,
-            shell: shellPath,
-            detached: process.platform !== "win32",
-            env: {
-                ...process.env,
-                ...baseTaskEnvPatch,
-                ...taskGitEnv.envPatch,
-                PATH: taskPath,
-                DOER_AGENT_TOKEN: args.agentToken,
-            },
-            stdio: ["ignore", "pipe", "pipe"],
-        });
-        child.stdout?.setEncoding("utf8");
-        child.stderr?.setEncoding("utf8");
-        const requestCancel = () => {
-            if (cancelSignalSent || terminationReason === "cancel") {
-                return;
-            }
-            cancelSignalSent = true;
-            terminationReason = "cancel";
-            sendSignalToTaskProcess(child, "SIGINT");
-            cancelStage1Timer = setTimeout(() => {
-                sendSignalToTaskProcess(child, "SIGTERM");
-            }, 1200);
-            cancelStage1Timer.unref?.();
-            cancelStage2Timer = setTimeout(() => {
-                sendSignalToTaskProcess(child, "SIGKILL");
-            }, 3500);
-            cancelStage2Timer.unref?.();
-        };
-        child.stdout?.on("data", (chunk) => {
-            args.writeTaskStream(args.taskId, "stdout", chunk);
-            const seq = args.reserveNextEventSeq(args.taskId);
-            args.persistEventOrFatal({
-                jetstream: args.jetstream,
-                serverBaseUrl: args.serverBaseUrl,
-                taskId: args.taskId,
-                userId: args.userId,
-                type: "stdout",
-                seq,
-                payload: { chunk, at: args.formatLocalTimestamp() },
-                context: "stdout persist failed",
-            });
-        });
-        child.stderr?.on("data", (chunk) => {
-            args.writeTaskStream(args.taskId, "stderr", chunk);
-            const seq = args.reserveNextEventSeq(args.taskId);
-            args.persistEventOrFatal({
-                jetstream: args.jetstream,
-                serverBaseUrl: args.serverBaseUrl,
-                taskId: args.taskId,
-                userId: args.userId,
-                type: "stderr",
-                seq,
-                payload: { chunk, at: args.formatLocalTimestamp() },
-                context: "stderr persist failed",
-            });
-        });
-        const cancelPoller = (async () => {
-            while (!stopCancelPolling) {
-                await args.sleep(5000);
-                if (stopCancelPolling || terminationReason === "cancel") {
-                    continue;
-                }
-                const cancelRequested = await checkCancelRequested({
-                    serverBaseUrl: args.serverBaseUrl,
-                    taskId: args.taskId,
-                    userId: args.userId,
-                    agentToken: args.agentToken,
-                    getJson: args.getJson,
-                }).catch(() => false);
-                if (!cancelRequested) {
-                    continue;
-                }
-                requestCancel();
-            }
-        })();
-        const result = await new Promise((resolve, reject) => {
-            child.once("error", reject);
-            child.once("close", (code, signal) => {
-                resolve({ code, signal });
-            });
-        }).finally(() => {
-            stopCancelPolling = true;
-            if (cancelStage1Timer) {
-                clearTimeout(cancelStage1Timer);
-            }
-            if (cancelStage2Timer) {
-                clearTimeout(cancelStage2Timer);
-            }
-        });
-        await cancelPoller.catch(() => undefined);
-        const canceled = await checkCancelRequested({
-            serverBaseUrl: args.serverBaseUrl,
-            taskId: args.taskId,
-            userId: args.userId,
-            agentToken: args.agentToken,
-            getJson: args.getJson,
-        }).catch(() => false);
-        const status = canceled || terminationReason === "cancel"
-            ? "canceled"
-            : (result.code ?? 1) === 0
-                ? "completed"
-                : "failed";
-        const statusPayload = {
-            status,
-            exitCode: typeof result.code === "number" ? result.code : null,
-            signal: result.signal,
-            finishedAt: args.formatLocalTimestamp(),
-            error: status === "failed"
-                ? `Command exited with code ${result.code ?? "null"}`
-                : null,
-        };
-        await args.recordAgentEvent({
-            jetstream: args.jetstream,
-            serverBaseUrl: args.serverBaseUrl,
-            taskId: args.taskId,
-            userId: args.userId,
-            type: "status",
-            seq: args.reserveNextEventSeq(args.taskId),
-            payload: statusPayload,
-        });
-        args.writeAgentInfo(`task=${args.taskId} status=${status} exitCode=${typeof result.code === "number" ? result.code : "null"} signal=${result.signal ?? "null"}`);
-    }
-    finally {
-        args.clearActiveTaskLogContext(args.taskId);
-        await codexAuth?.cleanup().catch(() => undefined);
-    }
-}

package/dist/agent.js

@@ -16,7 +16,7 @@ import { subscribeToSkillRpc } from "./agent-skill-rpc.js";
 import { prepareCodexAuthBundle, sendSignalToPid, sendSignalToTaskProcess, } from "./agent-task-execution.js";
 import { collectSessionJsonlFiles, detectPendingRunSession, findSessionFilePathBySessionId, stopAllSessionWatchers, subscribeToSessionRpc, } from "./agent-session-rpc.js";
 import { handleNonStartRunRpc, normalizeRunRpcRequest, publishRunRpcResponse, } from "./agent-run-rpc.js";
-import { buildAgentCodexAuthRpcSubject, buildAgentFsRpcSubject, buildAgentGitRpcSubject, buildAgentRunEventsSubject, buildAgentRunRpcSubject, buildAgentSessionRpcSubject, buildAgentSettingsRpcSubject, buildAgentSkillRpcSubject, formatLocalTimestamp, normalizeEnvPatch, normalizeRunImagePaths, parseArgs, resolveAgentVersion, resolveArgOrEnv, resolveContainerReachableServerBaseUrl, sanitizeUserId, sleep, writeRunStatus, writeRunStream, } from "./agent-runtime-utils.js";
+import { buildAgentCodexAuthRpcSubject, buildAgentFsRpcSubject, buildAgentGitRpcSubject, buildAgentRunEventsSubject, buildAgentRunRpcSubject, buildAgentSessionRpcSubject, buildAgentSettingsRpcSubject, buildAgentSkillRpcSubject, formatLocalTimestamp, normalizeEnvPatch, filterValidRunImagePaths, normalizeRunImagePaths, parseArgs, resolveAgentVersion, resolveArgOrEnv, resolveContainerReachableServerBaseUrl, sanitizeUserId, sleep, writeRunStatus, writeRunStream, } from "./agent-runtime-utils.js";
 import { createRuntimeEnvHelpers } from "./agent-runtime-env.js";
 import { createEventPersistenceHelpers, heartbeatAgentSession, postJson, } from "./agent-runtime-io.js";
 import { handleSettingsRpcMessage } from "./agent-settings-rpc.js";
@@ -32,30 +32,6 @@ function resolveWorkspaceRoot() {
     return workspaceRootOverride ?? (process.env.WORKSPACE?.trim() || process.cwd());
 }
 const runRpcCodec = StringCodec();
-async function prepareTaskRuntimeConfig(args) {
-    const bundle = await postJson(`${args.serverBaseUrl}/api/agent/tasks/${encodeURIComponent(args.taskId)}/runtime-config`, {
-        userId: args.userId,
-        agentToken: args.agentToken,
-    }).catch((error) => {
-        const message = error instanceof Error ? error.message : String(error);
-        writeAgentError(`task=${args.taskId} runtime config sync skipped: ${message}`);
-        return null;
-    });
-    if (!bundle) {
-        return null;
-    }
-    const envPatch = normalizeEnvPatch(bundle.envPatch);
-    return {
-        envPatch,
-        meta: {
-            runtimeConfigIssuedAt: bundle.issuedAt ?? null,
-            runtimeConfigExpiresAt: bundle.expiresAt ?? null,
-            runtimeConfigVarCount: Object.keys(envPatch).length,
-            runtimeConfigSynced: true,
-            ...(bundle.meta && typeof bundle.meta === "object" && !Array.isArray(bundle.meta) ? bundle.meta : {}),
-        },
-    };
-}
 function writeAgentInfo(message) {
     process.stdout.write(`[doer-agent] ${message}\n`);
     eventPersistenceHelpers.emitAgentMetaLog("info", message);
@@ -275,6 +251,13 @@ async function handleRunRpcMessage(args) {
                 const workspaceRoot = resolveWorkspaceRoot();
                 const localAgentSettings = await readAgentSettingsConfig({ workspaceRoot });
                 const customInstructions = await readAgentModelInstructions(workspaceRoot);
+                const validImagePaths = await filterValidRunImagePaths({
+                    workspaceRoot,
+                    imagePaths: request.imagePaths,
+                    onInvalidImage: (imagePath, reason) => {
+                        writeRunStatus(runId, `skipping invalid image path=${imagePath} reason=${reason}`);
+                    },
+                });
                 const task = await startManagedRun({
                     requestId,
                     runId,
@@ -285,7 +268,7 @@ async function handleRunRpcMessage(args) {
                     sessionId: request.sessionId,
                     codexArgs: buildManagedCodexArgs({
                         prompt: request.prompt ?? "",
-                        imagePaths: request.imagePaths,
+                        imagePaths: validImagePaths,
                         sessionId: request.sessionId,
                         model: request.model,
                         personality: localAgentSettings.general.personality,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "doer-agent",
-  "version": "0.4.5",
+  "version": "0.4.7",
   "description": "Reverse-polling agent runtime for doer",
   "type": "module",
   "main": "dist/agent.js",
@@ -26,7 +26,8 @@
   "dependencies": {
     "@modelcontextprotocol/sdk": "^1.27.1",
     "@openai/codex-sdk": "^0.115.0",
-    "nats": "^2.29.3"
+    "nats": "^2.29.3",
+    "tar": "^7.5.13"
   },
   "devDependencies": {
     "@types/node": "^20",