langbot-plugin 0.6.2__tar.gz → 0.6.3__tar.gz

{langbot_plugin-0.6.2 → langbot_plugin-0.6.3}/ARCHITECTURE.md

@@ -250,8 +250,12 @@ Core mechanics:
 - `Handler.call_action_generator()` consumes streamed responses.
 - Streaming emits `chunk_status: "continue"` chunks and ends with `"end"`.
 - File transfer uses `CommonAction.FILE_CHUNK` with 16KB base64 chunks stored
-  under `data/temp/lbp/`. Transfer keys are high-entropy opaque basenames; the
-  receiver rejects absolute paths, separators, `..`, and unsafe extensions.
+  under `data/temp/lbp/`. New transfer keys are high-entropy opaque capabilities;
+  the receiver durably binds each capability to its exact authority namespace so
+  a later read can recover that namespace after the action or handler ends. An
+  explicit current context must still match, and the receiver never scans other
+  namespaces. Legacy opaque basenames remain supported. Absolute paths,
+  separators, `..`, and unsafe extensions are rejected.
 
 Action enums are the protocol contract:
 
@@ -346,6 +350,15 @@ APIs (`get_box_status`, `list_boxes`, `acquire_box`) and run-bound operations
 owns atomic capacity enforcement and container reuse/lifecycle. Reusing an existing
 Box is allowed when no additional capacity remains.
 
+Transfer payloads are assembled through private, inode-bound staging files and are
+published with no-overwrite links only after the final chunk succeeds. Durable owner
+records include the published payload device/inode identity, so reads and deletion
+fail closed if a canonical name is replaced. The transfer root assumes no untrusted
+process can mutate its directories with the same Unix UID: such a mutator can rename
+an owned inode to an unknowable name, which cannot be recovered safely. The SDK
+reports that condition as local filesystem corruption, retains owner authority, and
+never treats it as successful cleanup or as cross-tenant access.
+
 A run binds one Box before native sandbox tools or file transfer. The Host does not
 choose a conversation scope or stage attachments before starting the Runner. Input
 references retain the original attachment metadata; import yields paths specific to

{langbot_plugin-0.6.2 → langbot_plugin-0.6.3}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: langbot-plugin
-Version: 0.6.2
+Version: 0.6.3
 Summary: This package contains the SDK, CLI for building plugins for LangBot, plus the runtime for hosting LangBot plugins
 Project-URL: Homepage, https://langbot.app
 Project-URL: Repository, https://github.com/langbot-app/langbot-plugin-sdk

{langbot_plugin-0.6.2 → langbot_plugin-0.6.3}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "langbot-plugin"
-version = "0.6.2"
+version = "0.6.3"
 description = "This package contains the SDK, CLI for building plugins for LangBot, plus the runtime for hosting LangBot plugins"
 readme = "README.md"
 authors = [