newmark-agent 0.6.7 → 0.6.8

package/dist/tools/index.js

@@ -64,6 +64,7 @@ const localOcr_1 = require("../core/localOcr");
 const visualTextFallback_1 = require("../core/visualTextFallback");
 const computerUseSession_1 = require("../core/computerUseSession");
 const searchMcpPool_1 = require("../core/searchMcpPool");
+const fileWriteObservation_1 = require("../core/fileWriteObservation");
 function normalizeComputerUseAction(action) {
     return String(action || '').trim().toLowerCase();
 }
@@ -279,6 +280,7 @@ class ToolExecutor {
     localOcr;
     argumentValidators = new toolArgumentValidator_1.ToolArgumentValidatorRegistry();
     searchMcpPool;
+    fileWriteObservationGate = new fileWriteObservation_1.FileWriteObservationGate();
     hostProfile = {
         kind: 'desktop',
         platform: process.platform,
@@ -351,15 +353,15 @@ class ToolExecutor {
         const tools = [
             t('bash', `${shellDescription} Optional timeout_ms lets the Agent choose this command timeout in milliseconds; 0 requests no limit, but a nonzero terminal.interrupt_timeout_ms setting is the upper cap.`, { command: { type: 'string' }, timeout_ms: { type: 'number', description: 'Per-command timeout in milliseconds. 0 means no requested limit unless capped by settings.' } }, ['command']),
             t('pwd', 'Print working directory (current folder path)', {}, []),
-            t('read', 'Read file contents. Use ABSOLUTE paths. The working directory is given in system prompt.', { path: { type: 'string' } }, ['path']),
-            t('write', 'Write/create a file. Use ABSOLUTE paths.', { path: { type: 'string' }, content: { type: 'string' } }, ['path', 'content']),
-            t('edit', 'Edit file with find-and-replace. Use ABSOLUTE paths.', { path: { type: 'string' }, old_str: { type: 'string' }, new_str: { type: 'string' } }, ['path', 'old_str', 'new_str']),
-            t('delete_file', 'Delete ONE file under Agent supervision. Use ABSOLUTE paths. This tool refuses directory deletion and wildcard paths; delete files one by one. Never use bash rm/del/Remove-Item for batch (recursive/wildcard/loop/pipe/multi-target) deletion — the runtime hard-blocks such commands.', { path: { type: 'string' } }, ['path']),
+            t('read', 'Read file contents. Use ABSOLUTE paths. A complete read or explicit line range records a short-lived, conversation/workspace/run-scoped observation for write/edit/delete_file. Read an exact target path before changing it. Large files can be read with start_line/end_line; overwrite/delete requires full line coverage, while edit requires the exact old_str lines.', { path: { type: 'string' }, start_line: { type: 'integer', minimum: 1, description: 'Optional inclusive first line for a bounded read. Provide together with end_line.' }, end_line: { type: 'integer', minimum: 1, description: 'Optional inclusive last line for a bounded read. Provide together with start_line.' } }, ['path']),
+            t('write', 'Write/create a file only after the exact target path has been read in this conversation, workspace, actor, and Build run. Existing files require a complete read; new files require an exact-path absence observation. Changed targets are refused until read again.', { path: { type: 'string' }, content: { type: 'string' } }, ['path', 'content']),
+            t('edit', 'Edit a file with find-and-replace only after reading the exact target lines in this conversation, workspace, actor, and Build run. The old_str must have appeared in a successful read range; stale or ambiguous matches are refused.', { path: { type: 'string' }, old_str: { type: 'string' }, new_str: { type: 'string' } }, ['path', 'old_str', 'new_str']),
+            t('delete_file', 'Delete ONE file only after reading its complete contents at the exact target path in this conversation, workspace, actor, and Build run. This tool refuses directory deletion and wildcard paths; delete files one by one. Never use bash rm/del/Remove-Item for batch (recursive/wildcard/loop/pipe/multi-target) deletion — the runtime hard-blocks such commands.', { path: { type: 'string' } }, ['path']),
             t('glob', 'Find files by glob pattern (e.g. **/*.ts, src/**/*.html)', { pattern: { type: 'string' } }, ['pattern']),
             t('grep', 'Search file content with regex', { pattern: { type: 'string' }, path: { type: 'string' } }, ['pattern', 'path']),
             t('web_search', 'Search the web', { query: { type: 'string' } }, ['query']),
             t('web_fetch', 'Fetch and extract URL content', { url: { type: 'string' } }, ['url']),
-            t('web_catch', 'Download a public web resource, save a webpage, or capture one page component into an exact workspace destination. Advanced Build/Goal tool; unavailable in Plan and Chat. This writes only the requested local output and never changes the remote page.', {
+            t('web_catch', 'Download a public web resource, save a webpage, or capture one page component into an exact workspace destination. Read the exact destination first; existing files require a complete read and new files require an exact-path absence observation. Advanced Build/Goal tool; unavailable in Plan and Chat. This writes only the requested local output and never changes the remote page.', {
                 action: { type: 'string', enum: ['download', 'save_page', 'capture_component'], description: 'download saves response bytes; save_page stores the HTML response; capture_component selects one CSS element and saves its src/href asset, or its outer HTML when no asset attribute exists.' },
                 url: { type: 'string', description: 'Public http:// or https:// URL.' },
                 destination: { type: 'string', description: 'Exact output file path. Relative paths resolve inside the active workspace.' },
@@ -405,23 +407,25 @@ class ToolExecutor {
                 capture_max_height: { type: 'number', minimum: 240, maximum: 2048, description: 'Maximum ephemeral screenshot height; defaults to 960. Aspect ratio is preserved and the source is never enlarged.' },
                 max_chars: { type: 'number', minimum: 1000, maximum: 100000, description: 'Maximum returned semantic UI text characters.' },
             }, []),
-            t('computer_use', 'Native Windows desktop control with persistent observation/action helpers. Use observe/app_observe before acting. For passive observe, sparse_wait_ms can wait up to 5 seconds on a coarse local pixel-change signal without a local perception model; after a signal or timeout it always captures a fresh full screenshot and UI Automation tree for the selected vision model. This low-resolution signal can miss small or brief changes and does not prove that no change occurred. sequence may perform up to three stable low-risk move/click/scroll/wait/app_activate steps and stops when focus, window, menu, dialog, scene, or risk changes. Vision screenshots remain one-time inputs and are deleted immediately.', {
-                action: { type: 'string', enum: ['observe', 'app_list', 'app_observe', 'sequence', 'takeover_start', 'takeover_stop', 'move', 'click', 'scroll', 'type', 'key', 'wait', 'app_activate', 'app_click', 'app_scroll', 'app_type', 'app_key'] },
+            t('computer_use', 'Native Windows desktop control with persistent observation/action helpers. Use observe/app_observe before acting. Set include_ui_tree=false for a fast screenshot-only observation; the default includes a bounded UI Automation tree for semantic targets. wait_for polls one visible app window for text, a target_id from the latest observation, or window availability. A match refreshes the semantic target cache; inspect the returned element before acting. For passive observe, sparse_wait_ms can wait up to 5 seconds on a coarse local pixel-change signal without a local perception model; after a signal or timeout it captures a fresh screenshot and the requested UI Automation data. This low-resolution signal can miss small or brief changes and does not prove that no change occurred. sequence may perform up to three stable low-risk move/click/scroll/wait/app_activate steps and stops when focus, window, menu, dialog, scene, or risk changes. Vision screenshots remain one-time inputs and are deleted immediately.', {
+                action: { type: 'string', enum: ['observe', 'app_list', 'app_observe', 'wait_for', 'sequence', 'takeover_start', 'takeover_stop', 'move', 'click', 'scroll', 'type', 'key', 'wait', 'app_activate', 'app_click', 'app_scroll', 'app_type', 'app_key'] },
                 capture_max_width: { type: 'number', minimum: 320, maximum: 2048, description: 'For observe/app_observe only. Maximum ephemeral screenshot width; defaults to 1280. Aspect ratio is preserved and the source is never enlarged.' },
                 capture_max_height: { type: 'number', minimum: 240, maximum: 2048, description: 'For observe/app_observe only. Maximum ephemeral screenshot height; defaults to 960. Aspect ratio is preserved and the source is never enlarged.' },
-                sparse_wait_ms: { type: 'integer', minimum: 0, maximum: 5000, description: 'Optional for action=observe only; defaults to 0 (immediate capture). Wait this many milliseconds for a coarse 32×18 grayscale change signal with no local neural model, then capture a fresh full screenshot and UI Automation tree whether signaled or timed out. Small/transient changes can be missed.' },
+                include_ui_tree: { type: 'boolean', description: 'For observe/app_observe only. Defaults to true. Set false to skip UI Automation traversal and return a screenshot-only observation; prior semantic target IDs are invalidated.' },
+                sparse_wait_ms: { type: 'integer', minimum: 0, maximum: 5000, description: 'Optional for action=observe only; defaults to 0 (immediate capture). Wait this many milliseconds for a coarse 32×18 grayscale change signal with no local neural model, then capture a fresh screenshot and the UI Automation tree when include_ui_tree=true, whether signaled or timed out. Small/transient changes can be missed.' },
                 x: { type: 'number' },
                 y: { type: 'number' },
-                target_id: { type: 'string', description: 'Stable id from the latest observe perception.objects entry. Preferred over raw coordinates when available.' },
+                target_id: { type: 'string', description: 'Stable id from the latest observe perception.objects entry. Preferred over raw coordinates when available; for wait_for it must come from the latest semantic observation.' },
                 app_target: { type: 'string', description: 'Application title, process name, or process id for app-scoped observation and actions.' },
                 window_handle: { type: 'string', description: 'Native window handle from app_list/app_observe for exact app-scoped actions.' },
                 max_chars: { type: 'number', minimum: 1000, maximum: 100000, description: 'Maximum returned text characters for observation and application listings.' },
                 scroll_x: { type: 'number', description: 'Horizontal scroll delta for action=scroll.' },
                 scroll_y: { type: 'number', description: 'Vertical scroll delta for action=scroll. Positive scrolls down.' },
                 button: { type: 'string', enum: ['left', 'right'] },
-                text: { type: 'string' },
+                text: { type: 'string', description: 'Text to type, or for wait_for a case-insensitive substring of a visible UI Automation Name or AutomationId.' },
                 key: { type: 'string' },
                 duration_ms: { type: 'number' },
+                timeout_ms: { type: 'integer', minimum: 250, maximum: 30000, description: 'For wait_for only. Polling budget in milliseconds; defaults to 5000 and is capped at 30000. A UI Automation call already in flight can add bounded completion latency.' },
                 dry_run: { type: 'boolean' },
                 include_raw_ui: { type: 'boolean', description: 'Debug only. Include the raw UI Automation element list; normal observation returns compact semantic objects.' },
                 steps: {
@@ -651,14 +655,18 @@ class ToolExecutor {
             if (tool.function?.name !== 'computer_use')
                 return tool;
             const copy = JSON.parse(JSON.stringify(tool));
-            copy.function.description = 'Plan read-only desktop: observe, app_list, app_observe only.';
+            copy.function.description = 'Plan read-only desktop: observe, app_list, app_observe, wait_for only.';
             copy.function.parameters.properties = {
                 action: { type: 'string', enum: [...toolPolicy_1.PLAN_COMPUTER_USE_ACTIONS] },
                 app_target: copy.function.parameters.properties.app_target,
                 window_handle: copy.function.parameters.properties.window_handle,
+                target_id: copy.function.parameters.properties.target_id,
+                text: copy.function.parameters.properties.text,
                 max_chars: copy.function.parameters.properties.max_chars,
                 capture_max_width: copy.function.parameters.properties.capture_max_width,
                 capture_max_height: copy.function.parameters.properties.capture_max_height,
+                include_ui_tree: copy.function.parameters.properties.include_ui_tree,
+                timeout_ms: copy.function.parameters.properties.timeout_ms,
                 include_raw_ui: copy.function.parameters.properties.include_raw_ui,
             };
             return copy;
@@ -788,15 +796,99 @@ class ToolExecutor {
             switch (tool) {
                 case 'bash': return await this.bash(g('command'), wsPath, args.timeout_ms, context.signal);
                 case 'pwd': return `Current directory: ${wsPath}`;
-                case 'read': return this.fread(resolve(g('path')));
-                case 'write': return this.fwrite(resolve(g('path')), g('content'));
-                case 'edit': return this.fedit(resolve(g('path')), g('old_str'), g('new_str'));
-                case 'delete_file': return this.fdelete(resolve(g('path')));
+                case 'read':
+                    return await this.fileWriteObservationGate.read(resolve(g('path')), this.fileWriteObservationScope(context, wsPath), {
+                        startLine: args.start_line === undefined ? undefined : Number(args.start_line),
+                        endLine: args.end_line === undefined ? undefined : Number(args.end_line),
+                    });
+                case 'write': {
+                    const target = resolve(g('path'));
+                    const mutation = await this.fileWriteObservationGate.mutate(target, this.fileWriteObservationScope(context, wsPath), { kind: 'full' }, gate => {
+                        const denied = this.checkWorkspaceAccess('write', gate.canonicalPath, context.workspacePath || wsPath);
+                        if (denied)
+                            return { value: denied, committed: false };
+                        if (gate.exists) {
+                            gate.assertBeforeCommit();
+                            fs.writeFileSync(target, g('content'), 'utf-8');
+                        }
+                        else {
+                            fs.mkdirSync(path.dirname(target), { recursive: true });
+                            gate.assertBeforeCommit();
+                            fs.writeFileSync(target, g('content'), { encoding: 'utf-8', flag: 'wx' });
+                        }
+                        return { value: '[write] OK: ' + target, committed: true };
+                    });
+                    return mutation.ok ? mutation.value : mutation.error;
+                }
+                case 'edit': {
+                    const target = resolve(g('path'));
+                    const oldText = g('old_str');
+                    const replacement = g('new_str');
+                    const mutation = await this.fileWriteObservationGate.mutate(target, this.fileWriteObservationScope(context, wsPath), { kind: 'edit', oldText }, gate => {
+                        const denied = this.checkWorkspaceAccess('edit', gate.canonicalPath, context.workspacePath || wsPath);
+                        if (denied)
+                            return { value: denied, committed: false };
+                        if (!gate.exists || gate.text === undefined)
+                            return { value: '[edit] Target file does not exist: ' + target, committed: false };
+                        const first = gate.text.indexOf(oldText);
+                        if (first < 0)
+                            return { value: '[edit] String not found in ' + target + '.', committed: false };
+                        if (gate.text.indexOf(oldText, first + oldText.length) >= 0) {
+                            return { value: '[edit] Refused: old_str matches more than one position in ' + target + '; read a more specific context and retry.', committed: false };
+                        }
+                        gate.assertBeforeCommit();
+                        const updated = gate.text.slice(0, first) + replacement + gate.text.slice(first + oldText.length);
+                        fs.writeFileSync(target, updated, 'utf-8');
+                        return { value: '[edit] OK: ' + target, committed: true };
+                    });
+                    return mutation.ok ? mutation.value : mutation.error;
+                }
+                case 'delete_file': {
+                    const target = resolve(g('path'));
+                    if (/[*?]/.test(target))
+                        return '[delete_file] Refused: wildcard paths are not allowed. Delete one file per call.';
+                    try {
+                        if (fs.lstatSync(target).isDirectory()) {
+                            return '[delete_file] Refused: deleting a directory is not allowed. Delete files one by one under Agent supervision.';
+                        }
+                    }
+                    catch (error) {
+                        if (error?.code !== 'ENOENT') {
+                            return '[delete_file] ' + (error instanceof Error ? error.message : String(error));
+                        }
+                    }
+                    const mutation = await this.fileWriteObservationGate.mutate(target, this.fileWriteObservationScope(context, wsPath), { kind: 'full' }, gate => {
+                        const denied = this.checkWorkspaceAccess('delete_file', gate.canonicalPath, context.workspacePath || wsPath);
+                        if (denied)
+                            return { value: denied, committed: false };
+                        if (!gate.exists)
+                            return { value: '[delete_file] Target does not exist: ' + target, committed: false };
+                        gate.assertBeforeCommit();
+                        fs.unlinkSync(target);
+                        return { value: '[delete_file] OK: ' + target, committed: true };
+                    });
+                    return mutation.ok ? mutation.value : mutation.error;
+                }
                 case 'glob': return this.glob(g('pattern'), wsPath);
                 case 'grep': return this.grep(g('pattern'), resolve(g('path')));
                 case 'web_search': return await this.wsearch(g('query'), context.signal);
                 case 'web_fetch': return await this.wfetch(g('url'), context.signal);
-                case 'web_catch': return await this.wcatch(args, resolve(g('destination')), context.signal);
+                case 'web_catch': {
+                    const destination = resolve(g('destination'));
+                    const mutation = await this.fileWriteObservationGate.mutate(destination, this.fileWriteObservationScope(context, wsPath), { kind: 'full' }, async (gate) => {
+                        const denied = this.checkWorkspaceAccess('web_catch', gate.canonicalPath, context.workspacePath || wsPath);
+                        if (denied)
+                            return { value: denied, committed: false };
+                        const value = await this.wcatch(args, destination, context.signal, () => gate.assertBeforeCommit());
+                        let committed = false;
+                        try {
+                            committed = JSON.parse(value).ok === true;
+                        }
+                        catch { }
+                        return { value, committed };
+                    });
+                    return mutation.ok ? mutation.value : mutation.error;
+                }
                 case 'browser_open': return await this.browserRun({ action: 'open', url: g('url') }, context.signal, context, wsPath);
                 case 'browser_snapshot': return await this.browserRun({ action: 'snapshot', maxChars: Number(args.max_chars || 12000) }, context.signal, context, wsPath);
                 case 'browser_click': return await this.browserRun({ action: 'click', selector: g('selector') }, context.signal, context, wsPath);
@@ -1000,6 +1092,14 @@ class ToolExecutor {
                 }
                 case 'computer_use': {
                     const action = normalizeComputerUseAction(g('action'));
+                    if (process.env.NEWMARK_TEST_CU_OBSERVE_ONLY === '1'
+                        && !['observe', 'app_observe', 'app_list', 'wait_for'].includes(action)) {
+                        return JSON.stringify({
+                            ok: false,
+                            action,
+                            error: '[computer_use test guard] The live-model smoke only permits read-only desktop observation.',
+                        });
+                    }
                     const owner = `${computerUseOwner(context, wsPath)}:${String(context.actorId || 'root')}`;
                     const lockGuard = action === 'takeover_stop'
                         ? assertComputerUseLockOwner(action, owner, context, wsPath)
@@ -1065,6 +1165,8 @@ class ToolExecutor {
                         captureMaxWidth: Number(args.capture_max_width),
                         captureMaxHeight: Number(args.capture_max_height),
                         sparseWaitMs: Number(args.sparse_wait_ms),
+                        includeUiTree: args.include_ui_tree !== false,
+                        timeoutMs: Number(args.timeout_ms),
                         signal: context.signal,
                         gradientColors: Array.isArray(args.gradient_colors) ? args.gradient_colors : undefined,
                         gradientSpeed: args.gradient_speed !== undefined ? Number(args.gradient_speed) : undefined,
@@ -1302,6 +1404,18 @@ class ToolExecutor {
         const action = policy === 'ask_user' ? 'User approval required' : 'Denied';
         return `[permission] ${action}: ${tool} cannot access outside workspace (${target}).`;
     }
+    fileWriteObservationScope(context, wsPath) {
+        const workspacePath = path.resolve(context.workspacePath || wsPath || this.root);
+        return JSON.stringify({
+            runtimeKey: String(context.runtimeKey || process.env.NEWMARK_RUNTIME_KEY || ''),
+            runId: String(context.runId || ''),
+            workspaceId: String(context.workspaceId || workspacePath),
+            workspacePath,
+            conversationId: String(context.conversationId || 'default'),
+            actorId: String(context.actorId || terminalTakeover_1.ROOT_TERMINAL_ACTOR_ID),
+            backend: String(context.backend || (process.env.NEWMARK_WSL_DISTRO ? 'wsl' : process.platform)),
+        });
+    }
     checkBashWorkspaceAccess(command, wsPath) {
         const perm = this.config.getStr('workspace', 'access_permission');
         if (perm === 'full_access')
@@ -1389,54 +1503,6 @@ class ToolExecutor {
             return `[bash] ${e instanceof Error ? e.message : String(e)}`;
         }
     }
-    fread(p) {
-        try {
-            const c = fs.readFileSync(p, 'utf-8');
-            return c.length > 30000 ? c.slice(0, 30000) + '...\n[truncated]' : c;
-        }
-        catch (e) {
-            return `[read] ${e}`;
-        }
-    }
-    fwrite(p, content) {
-        try {
-            fs.mkdirSync(path.dirname(p), { recursive: true });
-            fs.writeFileSync(p, content, 'utf-8');
-            return `[write] OK: ${p}`;
-        }
-        catch (e) {
-            return `[write] ${e}`;
-        }
-    }
-    fedit(p, oldStr, newStr) {
-        try {
-            const c = fs.readFileSync(p, 'utf-8');
-            if (!c.includes(oldStr))
-                return `[edit] String not found in ${p}.`;
-            const updated = c.replace(oldStr, newStr);
-            fs.writeFileSync(p, updated, 'utf-8');
-            return `[edit] OK: ${p}`;
-        }
-        catch (e) {
-            return `[edit] ${e}`;
-        }
-    }
-    fdelete(p) {
-        try {
-            if (/[*?]/.test(p))
-                return '[delete_file] Refused: wildcard paths are not allowed. Delete one file per call.';
-            const resolved = path.resolve(p);
-            const stat = fs.lstatSync(resolved);
-            if (stat.isDirectory()) {
-                return '[delete_file] Refused: deleting a directory is not allowed. Delete files one by one under Agent supervision.';
-            }
-            fs.unlinkSync(resolved);
-            return `[delete_file] OK: ${resolved}`;
-        }
-        catch (e) {
-            return `[delete_file] ${e instanceof Error ? e.message : String(e)}`;
-        }
-    }
     glob(pattern, ws) {
         try {
             const results = globSync(pattern, {
@@ -1888,7 +1954,7 @@ class ToolExecutor {
             guard.dispose();
         }
     }
-    async wcatch(args, destination, signal) {
+    async wcatch(args, destination, signal, beforeCommit) {
         const action = String(args.action || 'download');
         const maxBytes = Math.max(1, Math.min(100 * 1024 * 1024, Number(args.max_bytes || 50 * 1024 * 1024)));
         const sourceUrl = this.checkedPublicWebUrl(String(args.url || ''));
@@ -1932,9 +1998,20 @@ class ToolExecutor {
         const backup = destinationExists ? `${destination}.newmark-${crypto.randomUUID()}.bak` : '';
         try {
             fs.writeFileSync(temp, bytes, { flag: 'wx' });
-            if (destinationExists)
+            beforeCommit?.();
+            const currentDestinationExists = fs.existsSync(destination);
+            if (currentDestinationExists !== destinationExists)
+                throw new Error('Destination changed during download; read it again and retry.');
+            if (currentDestinationExists && !fs.statSync(destination).isFile())
+                throw new Error('Destination changed to a non-file during download.');
+            if (destinationExists) {
                 fs.renameSync(destination, backup);
-            fs.renameSync(temp, destination);
+                fs.renameSync(temp, destination);
+            }
+            else {
+                fs.linkSync(temp, destination);
+                fs.unlinkSync(temp);
+            }
             if (backup)
                 fs.unlinkSync(backup);
         }