replicas-engine 0.1.652 → 0.1.653

package/dist/src/{chunk-XUQTF7P5.js → chunk-KWNVQJRM.js}

@@ -955,8 +955,11 @@ function containsKnownSecret(value, secrets) {
     return flattened.length >= MIN_SECRET_MATCH_CHARS && haystack.includes(flattened);
   }));
 }
-function isUnsafeMemoryOutput(value, secrets, maxChars) {
-  return maxChars !== void 0 && value.length > maxChars || containsSecret(value) || containsKnownSecret(value, secrets);
+function getMemoryOutputSafetyViolation(value, secrets, maxChars) {
+  if (maxChars !== void 0 && value.length > maxChars) return "max_chars";
+  if (containsSecret(value)) return "secret_pattern";
+  if (containsKnownSecret(value, secrets)) return "known_secret";
+  return null;
 }
 
 // ../shared/src/async.ts
@@ -5929,7 +5932,7 @@ var DEFAULT_CODEX_ARGS = [
 var MIN_CODEX_CLI_VERSION = "0.144.6";
 var CODEX_UPGRADE_TIMEOUT_MS = 12e4;
 var codexCliVersionEnsured = null;
-var ENGINE_PACKAGE_VERSION = "0.1.652";
+var ENGINE_PACKAGE_VERSION = "0.1.653";
 var INITIALIZE_METHOD = "initialize";
 var INITIALIZED_NOTIFICATION = "initialized";
 var ACCOUNT_LOGIN_START_METHOD = "account/login/start";
@@ -6294,7 +6297,7 @@ export {
   MEMORY_ROOT,
   MEMORY_SUMMARY_FILENAME,
   MEMORY_INDEX_FILENAME,
-  isUnsafeMemoryOutput,
+  getMemoryOutputSafetyViolation,
   isSkillRegistryManifest,
   putPresignedFile,
   buildCodexAgentEnv,

package/dist/src/headless-agent.js

@@ -3,11 +3,11 @@ import {
   AGENT,
   AppServerProcess,
   buildCodexAgentEnv,
+  getMemoryOutputSafetyViolation,
   headlessAgentRequestSchema,
-  isUnsafeMemoryOutput,
   putPresignedFile,
   recoverCompletedTurn
-} from "./chunk-XUQTF7P5.js";
+} from "./chunk-KWNVQJRM.js";
 
 // src/headless-agent.ts
 import { createHash } from "crypto";
@@ -59,8 +59,13 @@ async function publishFilesystemOutputs(request) {
   for (const output of request.outputFiles) {
     const filePath = resolveFile(request.workingDirectory, output.path);
     const content = (await readFile(filePath, "utf8")).trim();
-    if (output.minChars !== void 0 && content.length < output.minChars || isUnsafeMemoryOutput(content, request.sensitiveValues, output.maxChars)) {
-      throw new Error(`Headless agent output failed validation: ${output.path}`);
+    if (output.minChars !== void 0 && content.length < output.minChars) {
+      throw new Error(`Headless agent output failed validation: ${output.path} has ${content.length} characters; minimum is ${output.minChars}`);
+    }
+    const safetyViolation = getMemoryOutputSafetyViolation(content, request.sensitiveValues, output.maxChars);
+    if (safetyViolation) {
+      const reason = safetyViolation === "max_chars" ? `has ${content.length} characters; maximum is ${output.maxChars}` : safetyViolation === "secret_pattern" ? "contains secret-like content" : "contains an installed credential";
+      throw new Error(`Headless agent output failed validation: ${output.path} ${reason}`);
     }
     await writeFile(filePath, content, { mode: 384 });
     const { size } = await stat(filePath);

package/dist/src/index.js

@@ -173,7 +173,7 @@ import {
   serializeCanvasContentResponse,
   shellQuotePosix,
   stripAgentDiagnosticErrors
-} from "./chunk-XUQTF7P5.js";
+} from "./chunk-KWNVQJRM.js";
 
 // src/index.ts
 import { serve } from "@hono/node-server";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "replicas-engine",
-  "version": "0.1.652",
+  "version": "0.1.653",
   "description": "Lightweight API server for Replicas workspaces",
   "type": "module",
   "main": "dist/src/index.js",