kward 0.78.0 → 0.79.0

data/doc/skills.md

@@ -42,6 +42,16 @@ The `name` and `description` fields are required. The description matters: Kward
 
 Skill names should be lowercase letters, numbers, and hyphens, such as `testing`, `code-review`, or `release-checklist`.
 
+## Capture a skill from a session
+
+Use `/skill capture` after a useful session. Choose any saved session; Kward uses its active branch and asks your active model to draft a reusable `SKILL.md`. Review and edit the draft in the terminal editor, then save it explicitly. Captured skills always go to your personal Kward skill directory and are not activated automatically.
+
+The draft request includes the complete persisted branch, including available raw tool output and saved session context. Treat it like any other model request: do not capture a session whose contents you are not willing to send to the active provider. Kward rejects a source that does not fit the active model context instead of silently truncating it.
+
+If the reviewed name already exists, Kward requires an explicit overwrite confirmation. Activate a saved draft later with `/skill <name>`.
+
+Pan provides the same saved-session picker and editable review flow. RPC clients use `skills/captureSessions`, `skills/captureDraft`, and `skills/saveCapturedDraft`; see the [RPC protocol](rpc.md).
+
 ## Skill locations
 
 User-level skills are available in every project:

data/doc/workspace-tools.md

@@ -12,14 +12,14 @@ Kward normally chooses these tools itself. You do not need to know their exact n
 
 ## Guardrails
 
-Workspace tools use the active workspace as their boundary. File paths are workspace-relative by default, and file tools are guarded so Kward does not edit arbitrary unread files. Guardrails can be disabled with the `tools.workspace_guardrails` setting — see [Configuration](configuration.md). When disabled, file tools can access paths outside the workspace, but shell commands are unaffected since they already run as your OS user.
+Workspace tools use the active workspace as their boundary. File paths are workspace-relative by default, and file tools are guarded so Kward does not edit arbitrary unread files. Guardrails can be disabled with the `tools.workspace_guardrails` setting — see [Configuration](configuration.md). When disabled, file tools can access paths outside the workspace. These guardrails do not affect shell commands; model-requested commands can instead use the separate, opt-in [command sandbox](sandboxing.md).
 
 Important behavior:
 
 - Existing files must be read in the current conversation before `write_file` or `edit_file` can change them.
 - Reads are bounded to avoid pulling very large files into context by accident. Files larger than 256 KB cannot be read or edited. Read output is capped at 50 KB or 2,000 lines, whichever comes first.
 - Edits use exact text replacement, so accidental partial or fuzzy changes fail instead of guessing.
-- Shell commands run as your operating-system user from the workspace. They are powerful and should be treated like commands you run yourself. Command output is capped at 128 KB.
+- With sandboxing off (the default), shell commands run as your operating-system user from the workspace. Enable [command sandboxing](sandboxing.md) to apply an OS boundary to model-requested `run_shell_command` workers. Command output is capped at 128 KB.
 
 ## Reading the workspace
 
@@ -124,7 +124,7 @@ Arguments:
 - `command`: command to run.
 - `timeout_seconds`: optional timeout, default 30 seconds.
 
-Kward uses shell commands for tests, linters, build checks, and simple repository inspection. Command output is bounded at 128 KB and may be compacted before it is sent back into model context, while the original output remains available in the session record.
+Kward uses shell commands for tests, linters, build checks, and simple repository inspection. When configured, the [command sandbox](sandboxing.md) applies to this tool and its descendants. Command output is bounded at 128 KB and may be compacted before it is sent back into model context, while the original output remains available in the session record.
 
 The output format is `Exit status: N` followed by `STDOUT:` and `STDERR:` sections. On timeout, Kward sends SIGTERM then SIGKILL after 0.2 seconds and returns a timeout error. Commands support cooperative cancellation when the session is cancelled.
 

data/kward.gemspec

@@ -10,7 +10,7 @@ Gem::Specification.new do |spec|
   spec.description = "Kward is a Ruby CLI coding agent with local workspace tools, configurable prompts, web search, sessions, and an experimental JSON-RPC backend."
   spec.homepage = "https://github.com/kaiwood/kward"
   spec.license = "MIT"
-  spec.required_ruby_version = ">= 3.2"
+  spec.required_ruby_version = ">= 3.4"
 
   spec.metadata["rubygems_mfa_required"] = "true"
   spec.metadata["source_code_uri"] = "https://github.com/kaiwood/kward"

data/lib/kward/cli/doctor.rb

@@ -25,6 +25,7 @@ module Kward
           doctor_directory_check("Session directory", SessionStore.new(cwd: current_workspace_root).session_dir, create: true),
           doctor_workspace_check,
           doctor_model_check,
+          doctor_local_endpoint_check(config),
           doctor_auth_check(config),
           doctor_pan_check(config_result),
           { status: :ok, label: "Color", message: @color_enabled ? "enabled" : "disabled" }
@@ -89,14 +90,34 @@ module Kward
         { status: :warning, label: "Model", message: e.message }
       end
 
+      def doctor_local_endpoint_check(config)
+        provider = ENV["KWARD_PROVIDER"].to_s.strip
+        provider = config["provider"].to_s.strip if provider.empty?
+        return { status: :ok, label: "Local endpoint", message: "not selected" } unless provider.casecmp?("local")
+
+        backend = ENV["KWARD_LOCAL_BACKEND"].to_s.strip
+        backend = config["local_backend"].to_s.strip if backend.empty?
+        defaults = Kward::Client::LOCAL_BASE_URLS
+        url = ENV["KWARD_LOCAL_BASE_URL"].to_s.strip
+        url = config["local_base_url"].to_s.strip if url.empty?
+        url = defaults.fetch(backend.empty? ? "ollama" : backend, defaults.fetch("ollama")) if url.empty?
+        uri = URI.parse(url)
+        loopback = ["127.0.0.1", "::1", "localhost"].include?(uri.host)
+        { status: loopback ? :ok : :warning, label: "Local endpoint", message: "#{url}#{loopback ? " (loopback)" : " (non-loopback)"}" }
+      rescue URI::InvalidURIError
+        { status: :error, label: "Local endpoint", message: "invalid URL: #{url}" }
+      end
+
       def doctor_auth_check(config)
         openai_auth = OpenAIOAuth.default_auth_path
         github_auth = GithubOAuth.default_auth_path
         has_openrouter = !config.to_h["openrouter_api_key"].to_s.empty? || !ENV["OPENROUTER_API_KEY"].to_s.empty?
+        local_provider = @client.respond_to?(:current_provider) && @client.current_provider == "Local"
         paths = []
         paths << "OpenAI OAuth" if File.exist?(openai_auth)
         paths << "GitHub OAuth" if File.exist?(github_auth)
         paths << "OpenRouter API key" if has_openrouter
+        paths << "Local endpoint (no authentication required)" if local_provider
         return { status: :ok, label: "Auth", message: paths.join(", ") } if paths.any?
 
         { status: :warning, label: "Auth", message: "no saved credentials found; run `kward login`" }

data/lib/kward/cli/runtime_helpers.rb

@@ -318,7 +318,7 @@ module Kward
       end
 
       def configured_workspace(root: current_workspace_root)
-        Workspace.new(root: root, guardrails: workspace_guardrails_enabled?)
+        WorkspaceFactory.build(root: root, guardrails: workspace_guardrails_enabled?, config: safely_read_config.to_h)
       end
 
       def workspace_guardrails_enabled?

data/lib/kward/cli/settings.rb

@@ -88,7 +88,7 @@ module Kward
       def configure_model_settings(conversation)
         initial_index = 0
         loop do
-          selected, selected_index = select_settings_menu_item("Model & Reasoning", ["Provider", "Default model", "Reasoning effort", "Back"], initial_index)
+          selected, selected_index = select_settings_menu_item("Model & Reasoning", ["Provider", "Default model", "Local server preset", "Reasoning effort", "Back"], initial_index)
           break unless selected
 
           initial_index = selected_index if selected_index
@@ -97,6 +97,8 @@ module Kward
             configure_provider(conversation)
           when /\Adefault model/
             configure_model(conversation)
+          when /\Alocal server preset/
+            configure_local_server_preset(conversation)
           when /\Areasoning effort/
             configure_reasoning(conversation)
           else
@@ -118,7 +120,7 @@ module Kward
 
       def provider_choices
         current = current_model_provider
-        ["Codex", "Anthropic", "OpenRouter", "Copilot"].map do |provider|
+        ["Codex", "Anthropic", "OpenRouter", "Copilot", "Local"].map do |provider|
           label = provider.dup
           label += " (current)" if provider == current
           label
@@ -131,10 +133,39 @@ module Kward
         return "Anthropic" if text.start_with?("anthropic") || text.start_with?("claude")
         return "OpenRouter" if text.start_with?("openrouter")
         return "Copilot" if text.start_with?("copilot")
+        return "Local" if text.start_with?("local")
 
         nil
       end
 
+      def configure_local_server_preset(conversation)
+        choices = [
+          "Ollama (http://127.0.0.1:11434/v1)",
+          "LM Studio (http://127.0.0.1:1234/v1)",
+          "llama.cpp (http://127.0.0.1:8080/v1)",
+          "Custom endpoint (edit config)",
+          "Back"
+        ]
+        selected = @prompt.select("Local server preset", choices, title: "Settings")
+        return unless selected
+
+        backend, url = case selected.to_s
+                       when /\AOllama/ then ["ollama", "http://127.0.0.1:11434/v1"]
+                       when /\ALM Studio/ then ["lm_studio", "http://127.0.0.1:1234/v1"]
+                       when /\Allama\.cpp/ then ["llama_cpp", "http://127.0.0.1:8080/v1"]
+                       when /\ACustom endpoint/
+                         runtime_output("Set local_base_url in #{ConfigFiles.config_path}.")
+                         return
+                       else
+                         return
+                       end
+
+        ConfigFiles.update_config("local_backend" => backend, "local_base_url" => url)
+        reload_client_config
+        refresh_conversation_runtime(conversation)
+        @prompt.redraw if @prompt.respond_to?(:redraw)
+      end
+
       def configure_account_settings
         initial_index = 0
         loop do
@@ -524,6 +555,10 @@ module Kward
           case selected.to_s.downcase
           when /\Adefault persona/
             configure_default_persona(conversation)
+          when /\Aenable global principles/, /\Adisable global principles/
+            toggle_global_principles(conversation)
+          when /\Aglobal principles \(ignored/
+            runtime_output("Global principles are ignored while a replacement system prompt is configured.")
           when /\Aactive instructions/
             show_active_instructions_summary(conversation)
           else
@@ -533,13 +568,31 @@ module Kward
       end
 
       def personalization_setting_choices(conversation)
+        config = safely_read_config.to_h
+        replacement = ConfigFiles.system_prompt_file_path(config)
+        principles = if replacement
+                       "Global principles (ignored by replacement)"
+                     elsif ConfigFiles.include_config_principles?(config)
+                       "Disable global principles"
+                     else
+                       "Enable global principles"
+                     end
         [
           "Default persona (#{default_persona_label})",
+          principles,
           "Active instructions summary",
           "Back"
         ]
       end
 
+      def toggle_global_principles(conversation)
+        config = safely_read_config.to_h
+        settings = config["system_prompt"].is_a?(Hash) ? config["system_prompt"] : {}
+        ConfigFiles.update_config("system_prompt" => settings.merge("include_principles" => !ConfigFiles.include_config_principles?(config)))
+        conversation&.refresh_system_message!
+        @prompt.redraw if @prompt.respond_to?(:redraw)
+      end
+
       def default_persona_label
         personas = safely_read_config.to_h["personas"]
         value = personas.is_a?(Hash) ? personas["default"] : nil
@@ -569,9 +622,18 @@ module Kward
 
       def show_active_instructions_summary(conversation)
         label = ConfigFiles.active_persona_label(workspace_root: current_workspace_root, model: current_model_id, config: safely_read_config.to_h)
+        config = safely_read_config.to_h
+        replacement_path = ConfigFiles.system_prompt_file_path(config)
         lines = ["Active persona: #{label || "none"}"]
-        lines << "Global PRINCIPLES.md: #{ConfigFiles.agents_prompt ? "present" : "absent"}"
-        lines << "Workspace AGENTS.md: #{ConfigFiles.workspace_agents_prompt(current_workspace_root) ? "present" : "absent"}"
+        if replacement_path
+          lines << "System prompt: replacement (#{replacement_path})"
+          lines << "Global PRINCIPLES.md: ignored by replacement"
+          lines << "Workspace AGENTS.md: ignored by replacement"
+        else
+          lines << "System prompt: Kward default"
+          lines << "Global PRINCIPLES.md: #{ConfigFiles.include_config_principles?(config) ? (ConfigFiles.agents_prompt ? "present" : "absent") : "disabled"}"
+          lines << "Workspace AGENTS.md: #{ConfigFiles.workspace_agents_prompt(current_workspace_root) ? "present" : "absent"}"
+        end
         lines << "Messages: #{conversation.messages.length}" if conversation&.respond_to?(:messages)
         runtime_output(lines.join("\n"))
       end

data/lib/kward/cli/slash_commands.rb

@@ -15,6 +15,9 @@ module Kward
         when "stats"
           run_busy_local_command_and_requeue { print_stats(argument) }
           [true, nil]
+        when "sandbox"
+          run_busy_local_command_and_requeue { handle_sandbox_command(argument, interactive_workspace_root(agent)) }
+          [true, nil]
         when "memory"
           activity = memory_summarize_command?(argument) ? "summarizing" : "loading"
           run_busy_local_command_and_requeue(activity: activity) { handle_memory_command(argument, agent) }
@@ -23,7 +26,11 @@ module Kward
           run_busy_local_command_and_requeue { handle_hooks_command(argument) }
           [true, nil]
         when "skill"
-          run_busy_local_command_and_requeue { activate_skill_command(argument, agent) }
+          if argument.to_s.strip == "capture"
+            capture_skill_from_session(session_store)
+          else
+            run_busy_local_command_and_requeue { activate_skill_command(argument, agent) }
+          end
           [true, nil]
         when "redraw"
           run_busy_local_command_and_requeue { @prompt.redraw if @prompt.respond_to?(:redraw) }
@@ -114,6 +121,48 @@ module Kward
         PromptCommands.parse(command) || [nil, ""]
       end
 
+      def handle_sandbox_command(argument, workspace_root)
+        action, value = argument.to_s.strip.split(/\s+/, 2)
+        case action
+        when nil, "", "status"
+          print_sandbox_status(workspace_root)
+        when *Sandbox::Policy::MODES
+          ConfigFiles.update_nested_config("sandbox", { "mode" => action })
+          runtime_output("Command sandbox mode set to #{action}. New sessions and tabs use the updated policy.")
+        when "network"
+          network = value.to_s
+          unless Sandbox::Policy::NETWORK_MODES.include?(network)
+            runtime_output("Usage: /sandbox network allow|deny")
+            return
+          end
+
+          ConfigFiles.update_nested_config("sandbox", { "network" => network })
+          runtime_output("Command sandbox child network set to #{network}. New sessions and tabs use the updated policy.")
+        else
+          runtime_output("Usage: /sandbox [status|off|read_only|workspace_write|network allow|network deny]")
+        end
+      rescue ArgumentError => error
+        runtime_output("Sandbox configuration error: #{error.message}")
+      end
+
+      def print_sandbox_status(workspace_root)
+        config = ConfigFiles.read_config
+        policy = ConfigFiles.sandbox_policy(workspace_root, config)
+        runner = Sandbox::RunnerFactory.build(policy)
+        capabilities = runner.capabilities
+        lines = [
+          "Command sandbox",
+          "Mode: #{policy.mode}",
+          "Child network: #{policy.network}",
+          "Backend: #{capabilities.backend}",
+          "Filesystem enforcement: #{capabilities.filesystem_enforced? ? "active" : "inactive"}",
+          "Child-network enforcement: #{capabilities.child_network_enforced? ? "active" : "inactive"}",
+          "Scope: model-requested run_shell_command workers only"
+        ]
+        lines << "Reason: #{capabilities.reason}" unless capabilities.reason.to_s.empty?
+        runtime_output(lines.join("\n"))
+      end
+
       def open_or_resume_session(session_store, argument)
         unless session_store
           say_sessions_unavailable
@@ -144,6 +193,65 @@ module Kward
         end
       end
 
+      def capture_skill_from_session(session_store)
+        unless session_store
+          say_sessions_unavailable
+          return
+        end
+        unless @prompt.respond_to?(:review_document)
+          runtime_output("Skill capture is available only in the interactive terminal prompt.")
+          return
+        end
+
+        source_path = select_skill_capture_session(session_store)
+        return unless source_path
+
+        capture = Skills::Capture.new(session_store: session_store, client: @client)
+        draft = run_busy_local_command_and_requeue(activity: "capturing skill") { capture.generate(source_path) }
+        review_captured_skill(capture, draft)
+      rescue Skills::Capture::Error => error
+        runtime_output("Skill capture failed: #{error.message}")
+      end
+
+      def select_skill_capture_session(session_store)
+        sessions = session_store.capture_candidates
+        if sessions.empty?
+          runtime_output("No saved sessions found.")
+          return nil
+        end
+
+        labels = session_picker_labels(sessions)
+        if @prompt.respond_to?(:select)
+          choice = @prompt.select("Capture session>", labels, title: "Capture skill from session")
+          return sessions[labels.index(choice)]&.path
+        end
+
+        runtime_output((["Saved sessions:"] + labels.each_with_index.map { |label, index| "#{index + 1}. #{label}" }).join("\n"))
+        answer = @prompt.ask("Session number or path>").to_s.strip
+        answer.match?(/\A\d+\z/) ? sessions[answer.to_i - 1]&.path : answer
+      end
+
+      def review_captured_skill(capture, draft)
+        overwrite = false
+        saved = nil
+        @prompt.review_document(title: "Review captured skill", content: draft.content) do |content|
+          begin
+            saved = capture.save(content, overwrite: overwrite)
+            nil
+          rescue Skills::Capture::ConflictError
+            if overwrite
+              "Could not overwrite the existing skill. Review the name and try again."
+            else
+              overwrite = true
+              "A personal skill with this name exists. Press Ctrl+S again to overwrite it."
+            end
+          rescue Skills::Capture::Error => error
+            error.message
+          end
+        end
+        runtime_output("Saved personal skill: #{capture.skill_path(saved.name)}") if saved
+      end
+
       def activate_skill_command(name, agent)
         skill_name = name.to_s.strip
         if skill_name.empty?

data/lib/kward/cli.rb

@@ -38,13 +38,14 @@ require_relative "tab_store"
 require_relative "tab_driver"
 require_relative "session_trash"
 require_relative "session_tree_renderer"
+require_relative "skills/capture"
 require_relative "starter_pack_installer"
 require_relative "steering"
 require_relative "update_check"
 require_relative "tools/tool_call"
 require_relative "tools/registry"
 require_relative "telemetry/stats"
-require_relative "workspace"
+require_relative "workspace_factory"
 require_relative "cli/commands"
 require_relative "cli/auth_commands"
 require_relative "cli/doctor"

data/lib/kward/config_files.rb

@@ -6,6 +6,7 @@ require_relative "frontmatter"
 require_relative "private_file"
 require_relative "path_guard"
 require_relative "permissions/policy"
+require_relative "sandbox/policy"
 require_relative "ekwsh"
 require_relative "editor_mode"
 require_relative "diff_view_mode"
@@ -151,6 +152,9 @@ module Kward
           "trust_project" => false
         },
         "enforce_workspace_agents_file" => false,
+        "system_prompt" => {
+          "include_principles" => true
+        },
         "mcpServers" => {},
         "tools" => {
           "workspace_guardrails" => true
@@ -158,6 +162,12 @@ module Kward
         "permissions" => {
           "enabled" => false,
           "mode" => "ask"
+        },
+        "sandbox" => {
+          "mode" => "off",
+          "network" => "deny",
+          "writable_roots" => [],
+          "protect_git_metadata" => true
         }
       }
     end
@@ -498,6 +508,18 @@ module Kward
       Permissions::Policy.from_config(config)
     end
 
+    # Builds the user-controlled command sandbox policy for a workspace.
+    def sandbox_policy(workspace_root, config = read_config)
+      sandbox = config["sandbox"].is_a?(Hash) ? config["sandbox"] : {}
+      Sandbox::Policy.new(
+        mode: sandbox.fetch("mode", "off"),
+        network: sandbox.fetch("network", "deny"),
+        workspace_root: workspace_root,
+        writable_roots: sandbox.fetch("writable_roots", []),
+        protect_git_metadata: sandbox.fetch("protect_git_metadata", true)
+      )
+    end
+
     # Returns whether project-level Agent Skills should be loaded from the workspace.
     def project_skills_trusted?(config = read_config)
       skills = config["skills"].is_a?(Hash) ? config["skills"] : {}
@@ -558,13 +580,61 @@ module Kward
     # alias for existing installations.
     #
     # @return [String, nil] prompt text, or nil when absent/too large
-    def agents_prompt
+    def agents_prompt(config: read_config)
+      return nil unless include_config_principles?(config)
+
       path = config_principles_path
       return read_prompt_file(path, "Kward principles file") if File.exist?(path)
 
       read_prompt_file(config_agents_path, "Kward AGENTS.md alias")
     end
 
+    # Returns whether config-directory principles are included in normal system
+    # prompt assembly. Replacement prompt files bypass all assembled sections.
+    def include_config_principles?(config = read_config)
+      settings = config["system_prompt"]
+      return true unless settings.is_a?(Hash)
+
+      settings["include_principles"] != false
+    end
+
+    # Returns the configured replacement system prompt path, or nil when normal
+    # prompt assembly should be used. Relative paths are anchored to the config
+    # directory so configuration remains portable with KWARD_CONFIG_PATH.
+    def system_prompt_file_path(config = read_config)
+      settings = config["system_prompt"]
+      value = settings.is_a?(Hash) ? settings["file"].to_s.strip : ""
+      return nil if value.empty?
+
+      File.expand_path(value, config_dir)
+    end
+
+    # Returns the replacement system prompt text when configured. A configured
+    # but unavailable file intentionally yields nil: callers must not fall back
+    # to Kward's larger assembled prompt in replacement mode.
+    def system_prompt_file(config = read_config)
+      path = system_prompt_file_path(config)
+      return nil unless path
+
+      read_prompt_file(path, "custom system prompt file")
+    end
+
+    def replacement_system_prompt?(config = read_config)
+      !system_prompt_file_path(config).nil?
+    end
+
+    # Returns a lightweight fingerprint for config-owned prompt sources. It is
+    # used by active conversations to pick up prompt edits without a restart.
+    def system_prompt_sources_fingerprint
+      config = read_config
+      paths = [config_path, system_prompt_file_path(config)]
+      if include_config_principles?(config)
+        paths << (File.exist?(config_principles_path) ? config_principles_path : config_agents_path)
+      end
+
+      paths.compact.map { |path| prompt_source_signature(path) }.join("\0")
+    end
+
     def config_principles_path
       File.join(config_dir, "PRINCIPLES.md")
     end
@@ -686,6 +756,15 @@ module Kward
       read_prompt_file(workspace_agents_path(workspace_root), "workspace AGENTS.md")
     end
 
+    def prompt_source_signature(path)
+      return "#{path}:missing" unless File.exist?(path)
+
+      stat = File.stat(path)
+      "#{path}:#{stat.size}:#{stat.mtime.to_f}"
+    rescue StandardError
+      "#{path}:unavailable"
+    end
+
     def read_prompt_file(path, label)
       return nil unless File.exist?(path)
 

data/lib/kward/conversation.rb

@@ -87,6 +87,7 @@ module Kward
       end
       @compaction_system_message = compaction_system_message
       @workspace_agents_mtime = workspace_agents_mtime
+      @system_prompt_sources_fingerprint = ConfigFiles.system_prompt_sources_fingerprint
       @last_entry_compaction = false
       @memory_context = memory_context
       @session_memories = Array(session_memories)
@@ -191,6 +192,7 @@ module Kward
       @on_system_message_change&.call(replacement)
       @compaction_system_message = Prompts.system_message(workspace_root: @workspace_root, include_workspace_personality: false, model: @model, reasoning_effort: @reasoning_effort, now: prompt_time)
       @workspace_agents_mtime = workspace_agents_mtime
+      @system_prompt_sources_fingerprint = ConfigFiles.system_prompt_sources_fingerprint
       replacement
     end
 
@@ -206,7 +208,18 @@ module Kward
     end
 
     def refresh_system_message_if_workspace_agents_changed!
-      refresh_system_message! if @system_message_enabled && workspace_agents_mtime != @workspace_agents_mtime
+      refresh_system_message_if_sources_changed!
+    end
+
+    # Refreshes runtime prompt state after workspace or config-owned prompt
+    # sources change. Keep the older public method above as a compatibility
+    # alias for existing callers.
+    def refresh_system_message_if_sources_changed!
+      return unless @system_message_enabled
+
+      changed = workspace_agents_mtime != @workspace_agents_mtime ||
+        ConfigFiles.system_prompt_sources_fingerprint != @system_prompt_sources_fingerprint
+      refresh_system_message! if changed
     end
 
     def mark_read(path)

data/lib/kward/local_command_runner.rb

@@ -18,7 +18,7 @@ module Kward
       @terminate_on_output_limit = terminate_on_output_limit
     end
 
-    def run(*command, env: {}, cwd: Dir.pwd, cancellation: nil, &block)
+    def run(*command, env: {}, cwd: Dir.pwd, cancellation: nil, unsetenv_others: false, &block)
       cancellation&.raise_if_cancelled!
       stdout_buffer = +""
       stderr_buffer = +""
@@ -27,7 +27,7 @@ module Kward
       timed_out = false
       queue = Queue.new
 
-      Open3.popen3(env.to_h, *command, chdir: cwd.to_s, pgroup: true) do |stdin, stdout, stderr, wait_thread|
+      Open3.popen3(env.to_h, *command, chdir: cwd.to_s, pgroup: true, unsetenv_others: unsetenv_others) do |stdin, stdout, stderr, wait_thread|
         stdin.close
         readers = [
           read_stream(stdout, :stdout, queue),