doer-agent 0.9.11 → 0.9.13

package/dist/agent-fs-rpc.js

@@ -5,17 +5,25 @@ import { StringCodec } from "nats";
 import { extract as extractTar } from "tar";
 import { validateImageBytes } from "./agent-runtime-utils.js";
 const fsRpcCodec = StringCodec();
-function normalizeFsRpcPath(workspaceRoot, rawPath) {
+function isPathInsideRoot(root, target) {
+    return target === root || target.startsWith(root + path.sep);
+}
+export function normalizeFsRpcPath(workspaceRoot, rawPath, options = {}) {
     const raw = typeof rawPath === "string" && rawPath.trim() ? rawPath.trim() : ".";
     const normalizedRaw = raw.replace(/\\/g, "/");
     const useAbsolute = path.isAbsolute(normalizedRaw);
     const rel = normalizedRaw.replace(/^\/+/, "") || ".";
-    const abs = useAbsolute ? path.resolve(normalizedRaw) : path.resolve(workspaceRoot, rel);
-    if (abs !== workspaceRoot && !abs.startsWith(workspaceRoot + path.sep)) {
+    const resolvedWorkspaceRoot = path.resolve(workspaceRoot);
+    const abs = useAbsolute ? path.resolve(normalizedRaw) : path.resolve(resolvedWorkspaceRoot, rel);
+    if (!options.allowOutsideWorkspace && !isPathInsideRoot(resolvedWorkspaceRoot, abs)) {
         throw new Error("path escapes workspace root");
     }
     const formatPath = (target) => {
-        return path.relative(workspaceRoot, target).split(path.sep).join("/") || ".";
+        const resolvedTarget = path.resolve(target);
+        if (!isPathInsideRoot(resolvedWorkspaceRoot, resolvedTarget)) {
+            return resolvedTarget.split(path.sep).join("/") || "/";
+        }
+        return path.relative(resolvedWorkspaceRoot, resolvedTarget).split(path.sep).join("/") || ".";
     };
     return { abs, formatPath };
 }
@@ -90,7 +98,13 @@ function sha256Hex(bytes) {
 }
 async function executeFsRpc(args) {
     const action = parseFsRpcAction(args.request.action);
-    const { abs, formatPath } = normalizeFsRpcPath(args.workspaceRoot, args.request.path);
+    const allowOutsideWorkspace = action === "list" ||
+        action === "stat" ||
+        action === "upload_file" ||
+        action === "read_text";
+    const { abs, formatPath } = normalizeFsRpcPath(args.workspaceRoot, args.request.path, {
+        allowOutsideWorkspace,
+    });
     if (action === "stat") {
         const entry = await stat(abs);
         return {

package/dist/agent-fs-rpc.test.js

@@ -0,0 +1,78 @@
+import assert from "node:assert/strict";
+import { mkdtemp, mkdir, readFile, rm, writeFile } from "node:fs/promises";
+import os from "node:os";
+import path from "node:path";
+import test from "node:test";
+import { StringCodec } from "nats";
+import { handleFsRpcMessage, normalizeFsRpcPath } from "./agent-fs-rpc.js";
+const workspaceRoot = path.resolve("/tmp/doer-workspace");
+const outsidePath = path.resolve("/tmp/outside/file.csv");
+test("normalizes workspace paths as workspace-relative paths", () => {
+    const target = normalizeFsRpcPath(workspaceRoot, "folder/file.txt");
+    assert.equal(target.abs, path.join(workspaceRoot, "folder/file.txt"));
+    assert.equal(target.formatPath(target.abs), "folder/file.txt");
+});
+test("allows and preserves absolute paths outside the workspace for read operations", () => {
+    const target = normalizeFsRpcPath(workspaceRoot, outsidePath, {
+        allowOutsideWorkspace: true,
+    });
+    assert.equal(target.abs, outsidePath);
+    assert.equal(target.formatPath(target.abs), outsidePath.split(path.sep).join("/"));
+});
+test("allows parent traversal outside the workspace for read operations", () => {
+    const target = normalizeFsRpcPath(workspaceRoot, "../outside/file.csv", {
+        allowOutsideWorkspace: true,
+    });
+    assert.equal(target.abs, outsidePath);
+    assert.equal(target.formatPath(target.abs), outsidePath.split(path.sep).join("/"));
+});
+test("keeps paths outside the workspace blocked by default", () => {
+    assert.throws(() => normalizeFsRpcPath(workspaceRoot, outsidePath), /path escapes workspace root/);
+    assert.throws(() => normalizeFsRpcPath(workspaceRoot, "../outside/file.csv"), /path escapes workspace root/);
+});
+test("filesystem RPC lists and reads files outside the workspace but does not delete them", async () => {
+    const tempRoot = await mkdtemp(path.join(os.tmpdir(), "doer-fs-rpc-"));
+    const rpcWorkspaceRoot = path.join(tempRoot, "workspace");
+    const externalDir = path.join(tempRoot, "external");
+    const externalFile = path.join(externalDir, "example.txt");
+    const codec = StringCodec();
+    await mkdir(rpcWorkspaceRoot);
+    await mkdir(externalDir);
+    await writeFile(externalFile, "outside workspace");
+    async function request(action, targetPath) {
+        let responseData;
+        const msg = {
+            data: codec.encode(JSON.stringify({ action, path: targetPath })),
+            respond(data) {
+                responseData = data;
+                return true;
+            },
+        };
+        await handleFsRpcMessage({
+            msg,
+            workspaceRoot: rpcWorkspaceRoot,
+            serverBaseUrl: "https://example.com",
+            agentId: "agent-1",
+            agentToken: "token",
+            onError: () => undefined,
+        });
+        assert.ok(responseData);
+        return JSON.parse(codec.decode(responseData));
+    }
+    try {
+        const listing = await request("list", externalDir);
+        assert.equal(listing.ok, true);
+        assert.equal(listing.path, externalDir.split(path.sep).join("/"));
+        assert.deepEqual(listing.items.map((item) => item.path), [externalFile.split(path.sep).join("/")]);
+        const text = await request("read_text", externalFile);
+        assert.equal(text.ok, true);
+        assert.equal(text.text, "outside workspace");
+        const deletion = await request("delete_path", externalFile);
+        assert.equal(deletion.ok, false);
+        assert.match(String(deletion.error), /path escapes workspace root/);
+        assert.equal(await readFile(externalFile, "utf8"), "outside workspace");
+    }
+    finally {
+        await rm(tempRoot, { recursive: true, force: true });
+    }
+});

package/dist/codex-thread-handoff.js

@@ -6,6 +6,50 @@ const MAX_ITEM_TEXT_CHARS = 4_000;
 const MAX_TURN_TEXT_CHARS = 8_000;
 const MAX_TRANSCRIPT_CHARS = 160_000;
 const MAX_HANDOFF_CHARS = 20_000;
+const HANDOFF_USER_MARKER = "Continue from the handoff summary above and wait for my next request.";
+export function buildThreadHandoffInjectionItems(handoff) {
+    return [
+        {
+            type: "message",
+            role: "assistant",
+            content: [{
+                    type: "output_text",
+                    text: handoff,
+                }],
+        },
+    ];
+}
+export function buildThreadHandoffSeedInput() {
+    return [{
+            type: "text",
+            text: HANDOFF_USER_MARKER,
+        }];
+}
+async function waitForThreadTurnStarted(manager, threadId, timeoutMs = 1_000) {
+    await new Promise((resolve) => {
+        let settled = false;
+        let cleanup = () => { };
+        const finish = () => {
+            if (settled) {
+                return;
+            }
+            settled = true;
+            clearTimeout(timer);
+            cleanup();
+            resolve();
+        };
+        const timer = setTimeout(finish, timeoutMs);
+        cleanup = manager.onNotification((method, params) => {
+            if (method !== "turn/started") {
+                return;
+            }
+            const event = recordValue(params);
+            if (stringValue(event?.threadId) === threadId) {
+                finish();
+            }
+        });
+    });
+}
 function recordValue(value) {
     return value && typeof value === "object" && !Array.isArray(value)
         ? value
@@ -339,16 +383,26 @@ export async function createCodexThreadHandoff(args) {
     }
     try {
         args.onProgress?.("injecting");
+        // Raw injected items do not make a new thread discoverable through thread/list.
+        const seedStarted = waitForThreadTurnStarted(args.manager, threadId);
+        const seedResult = recordValue(await args.manager.request("turn/start", {
+            threadId,
+            input: buildThreadHandoffSeedInput(),
+        }, 30_000));
+        const seedTurnId = stringValue(recordValue(seedResult?.turn)?.id);
+        if (!seedTurnId) {
+            throw new Error("Codex app-server did not return a handoff seed turn");
+        }
+        await seedStarted;
+        await args.manager.request("turn/interrupt", {
+            threadId,
+            turnId: seedTurnId,
+        }, 30_000).catch((error) => {
+            warnings.push(`Could not interrupt handoff seed turn: ${error instanceof Error ? error.message : String(error)}`);
+        });
         await args.manager.request("thread/inject_items", {
             threadId,
-            items: [{
-                    type: "message",
-                    role: "assistant",
-                    content: [{
-                            type: "output_text",
-                            text: handoff,
-                        }],
-                }],
+            items: buildThreadHandoffInjectionItems(handoff),
         }, 90_000);
     }
     catch (error) {

package/dist/codex-thread-handoff.test.js

@@ -1,6 +1,24 @@
 import assert from "node:assert/strict";
 import test from "node:test";
-import { buildBoundedHandoffTranscript, summarizeThreadTurn, } from "./codex-thread-handoff.js";
+import { buildBoundedHandoffTranscript, buildThreadHandoffInjectionItems, buildThreadHandoffSeedInput, summarizeThreadTurn, } from "./codex-thread-handoff.js";
+test("buildThreadHandoffInjectionItems adds the summary to model-visible history", () => {
+    assert.deepEqual(buildThreadHandoffInjectionItems("# Thread handoff\n\nContinue the work."), [
+        {
+            type: "message",
+            role: "assistant",
+            content: [{
+                    type: "output_text",
+                    text: "# Thread handoff\n\nContinue the work.",
+                }],
+        },
+    ]);
+});
+test("buildThreadHandoffSeedInput creates a real user turn for thread indexing", () => {
+    assert.deepEqual(buildThreadHandoffSeedInput(), [{
+            type: "text",
+            text: "Continue from the handoff summary above and wait for my next request.",
+        }]);
+});
 test("summarizeThreadTurn omits raw command output, diffs, images, and MCP results", () => {
     const summary = summarizeThreadTurn({
         id: "turn-1",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "doer-agent",
-  "version": "0.9.11",
+  "version": "0.9.13",
   "description": "Reverse-polling agent runtime for doer",
   "type": "module",
   "main": "dist/agent.js",