@agent-native/core 0.171.3 → 0.172.1

package/dist/client/chat/tool-call-display.js

@@ -1,9 +1,10 @@
 import { Fragment as _Fragment, jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
-import { IconLoader2, IconAlertTriangle, IconCircleX, IconCheck, IconChevronRight, IconCopy, IconCode, IconBrandSlack, IconTerminal2, IconDatabase, IconSearch, IconFileCode, IconShieldCheck, IconX, } from "@tabler/icons-react";
+import { IconLoader2, IconAlertTriangle, IconCircleX, IconCheck, IconChevronDown, IconChevronRight, IconCopy, IconCode, IconBrandSlack, IconTerminal2, IconDatabase, IconSearch, IconFileCode, IconShieldCheck, IconX, } from "@tabler/icons-react";
 import React, { useState, useEffect, useCallback, useLayoutEffect, useRef, } from "react";
 import { formatAgentChatContextItemsForPrompt } from "../agent-chat.js";
 import { AgentTaskCard } from "../AgentTaskCard.js";
 import { writeClipboardText } from "../clipboard.js";
+import { DropdownMenu, DropdownMenuContent, DropdownMenuItem, DropdownMenuTrigger, } from "../components/ui/dropdown-menu.js";
 import { Popover, PopoverContent, PopoverTrigger, } from "../components/ui/popover.js";
 import { ConnectBuilderCard } from "../ConnectBuilderCard.js";
 import { FileStorageSetupCard } from "../FileStorageSetupCard.js";
@@ -251,6 +252,8 @@ function ApprovalAffordance({ toolName, toolCallId, approval, }) {
     const t = useT();
     const ctx = React.useContext(ApprovalContext);
     const [localResolution, setLocalResolution] = useState(null);
+    const [isAlwaysAllowing, setIsAlwaysAllowing] = useState(false);
+    const [alwaysAllowFailed, setAlwaysAllowFailed] = useState(false);
     const retainedResolution = ctx?.getApprovalResolution?.(approval.approvalKey, toolCallId, approval.askId) ?? null;
     const resolution = retainedResolution ??
         localResolution ??
@@ -266,19 +269,32 @@ function ApprovalAffordance({ toolName, toolCallId, approval, }) {
     if (resolution === "denied") {
         return (_jsx("div", { className: "mt-1.5 text-xs text-muted-foreground", children: t("agentChat.approval.denied", { tool: toolName }) }));
     }
-    return (_jsxs("div", { className: "mt-1.5 flex min-w-0 flex-wrap items-center gap-2 rounded-md border border-border bg-muted/40 px-2.5 py-1.5", children: [_jsx(IconShieldCheck, { className: "h-3.5 w-3.5 shrink-0 text-muted-foreground" }), _jsx("span", { className: "min-w-0 flex-1 text-xs text-muted-foreground", children: t("agentChat.approval.question", { tool: toolName }) }), ctx && (_jsxs("button", { type: "button", onClick: () => {
-                    setLocalResolution("approved");
-                    ctx.onApprovalResolved?.(approval.approvalKey, "approved", toolCallId, approval.askId);
-                    ctx.onApprove(approval.approvalKey);
-                }, className: cn("inline-flex shrink-0 items-center gap-1 rounded-md px-2.5 py-1 text-xs font-medium transition-colors", "bg-foreground text-background hover:bg-foreground/90"), children: [_jsx(IconCheck, { className: "h-3.5 w-3.5" }), t("agentChat.approval.approve")] })), ctx?.onAlwaysAllow && (_jsxs("button", { type: "button", onClick: () => {
-                    setLocalResolution("approved");
-                    ctx.onApprovalResolved?.(approval.approvalKey, "approved", toolCallId, approval.askId);
-                    ctx.onAlwaysAllow?.(approval.approvalKey);
-                }, title: t("agentChat.approval.alwaysAllowHint"), className: cn("inline-flex shrink-0 items-center gap-1 rounded-md border border-border px-2.5 py-1 text-xs font-medium transition-colors", "text-foreground hover:bg-muted"), children: [_jsx(IconShieldCheck, { className: "h-3.5 w-3.5" }), t("agentChat.approval.alwaysAllow")] })), _jsxs("button", { type: "button", onClick: () => {
+    const handleAlwaysAllow = async () => {
+        if (!ctx?.onAlwaysAllow || isAlwaysAllowing)
+            return;
+        setIsAlwaysAllowing(true);
+        setAlwaysAllowFailed(false);
+        try {
+            await ctx.onAlwaysAllow(approval.approvalKey, toolName);
+            setLocalResolution("approved");
+            ctx.onApprovalResolved?.(approval.approvalKey, "approved", toolCallId, approval.askId);
+        }
+        catch {
+            setAlwaysAllowFailed(true);
+        }
+        finally {
+            setIsAlwaysAllowing(false);
+        }
+    };
+    return (_jsxs("div", { className: "mt-1.5 flex min-w-0 flex-wrap items-center gap-2 rounded-md border border-border bg-muted/40 px-2.5 py-1.5", children: [_jsx(IconShieldCheck, { className: "h-3.5 w-3.5 shrink-0 text-muted-foreground" }), _jsx("span", { className: "min-w-0 flex-1 text-xs text-muted-foreground", children: t("agentChat.approval.question", { tool: toolName }) }), ctx && (_jsxs("div", { className: "inline-flex shrink-0 items-stretch", children: [_jsxs("button", { type: "button", disabled: isAlwaysAllowing, onClick: () => {
+                            setLocalResolution("approved");
+                            ctx.onApprovalResolved?.(approval.approvalKey, "approved", toolCallId, approval.askId);
+                            ctx.onApprove(approval.approvalKey);
+                        }, className: cn("inline-flex shrink-0 items-center gap-1 px-2.5 py-1 text-xs font-medium transition-colors", "bg-foreground text-background hover:bg-foreground/90", ctx.onAlwaysAllow ? "rounded-s-md rounded-e-none" : "rounded-md", "disabled:pointer-events-none disabled:opacity-50"), children: [_jsx(IconCheck, { className: "h-3.5 w-3.5" }), t("agentChat.approval.approve")] }), ctx.onAlwaysAllow && (_jsxs(DropdownMenu, { children: [_jsx(DropdownMenuTrigger, { asChild: true, children: _jsx("button", { type: "button", disabled: isAlwaysAllowing, "aria-label": t("agentChat.approval.moreOptions"), title: t("agentChat.approval.moreOptions"), className: cn("inline-flex w-7 shrink-0 items-center justify-center rounded-s-none rounded-e-md border-s border-background/25 bg-foreground text-background transition-colors hover:bg-foreground/90", "disabled:pointer-events-none disabled:opacity-50"), children: _jsx(IconChevronDown, { className: "h-3.5 w-3.5" }) }) }), _jsx(DropdownMenuContent, { align: "end", children: _jsxs(DropdownMenuItem, { onSelect: () => void handleAlwaysAllow(), title: t("agentChat.approval.alwaysAllowActionHint"), children: [_jsx(IconShieldCheck, { className: "h-4 w-4" }), t("agentChat.approval.alwaysAllowAction")] }) })] }))] })), _jsxs("button", { type: "button", disabled: isAlwaysAllowing, onClick: () => {
                     setLocalResolution("denied");
                     ctx?.onApprovalResolved?.(approval.approvalKey, "denied", toolCallId, approval.askId);
                     ctx?.onDeny?.(approval.approvalKey);
-                }, className: cn("inline-flex shrink-0 items-center gap-1 rounded-md border border-border px-2.5 py-1 text-xs font-medium transition-colors", "text-foreground hover:bg-muted"), children: [_jsx(IconX, { className: "h-3.5 w-3.5" }), t("agentChat.approval.deny")] })] }));
+                }, className: cn("inline-flex shrink-0 items-center gap-1 rounded-md border border-border px-2.5 py-1 text-xs font-medium transition-colors", "text-foreground hover:bg-muted", "disabled:pointer-events-none disabled:opacity-50"), children: [_jsx(IconX, { className: "h-3.5 w-3.5" }), t("agentChat.approval.deny")] }), alwaysAllowFailed && (_jsx("span", { role: "alert", className: "basis-full text-xs text-destructive", children: t("agentChat.common.saveFailed") }))] }));
 }
 // ─── ToolCallDisplay ──────────────────────────────────────────────────────────
 export function ToolCallDisplay({ toolName, toolCallId, argsText, args, result, mcpApp, chatUI, isRunning, outcome, structuredMeta, activity, approval, repeatCount, isLatestRunning = isRunning, isActiveTail, }) {

package/dist/client/resources/McpIntegrationDialog.js

@@ -242,7 +242,7 @@ export function McpIntegrationDialog({ open, onOpenChange, initialIntegrationId
         });
     };
     const quickConnect = (integration) => {
-        if (hasOrg) {
+        if (hasOrg && supportsMcpIntegrationOrganizationScope(integration)) {
             setSelected(integration);
             setMode("choice");
             return;
@@ -271,7 +271,7 @@ export function McpIntegrationDialog({ open, onOpenChange, initialIntegrationId
     const selectCatalogConnection = (integration) => {
         if (!mcpServersQuery.isSuccess)
             return;
-        if (hasOrg) {
+        if (hasOrg && supportsMcpIntegrationOrganizationScope(integration)) {
             setSelected(integration);
             setMode("choice");
             return;
@@ -329,7 +329,7 @@ export function McpIntegrationDialog({ open, onOpenChange, initialIntegrationId
         if (quickConnectAttemptedRef.current === attemptKey)
             return;
         quickConnectAttemptedRef.current = attemptKey;
-        if (hasOrg) {
+        if (hasOrg && supportsMcpIntegrationOrganizationScope(integration)) {
             setSelected(integration);
             setMode("choice");
             return;
@@ -507,7 +507,7 @@ export function McpIntegrationDialog({ open, onOpenChange, initialIntegrationId
                                                 : t("mcpIntegrations.presetAuthDescription")
                                         : t("mcpIntegrations.customDescription") })] }), _jsx("div", { className: "min-h-0 flex-1 overflow-y-auto px-7 py-7 sm:px-10", children: _jsxs("div", { className: "mx-auto max-w-2xl space-y-3", children: [renderScopeSelector(), selected?.setupNoteKey && !selectedRequiresSetup ? (_jsx("div", { className: "rounded-md bg-muted/40 px-3 py-2 text-[11px] leading-relaxed text-muted-foreground", children: t(selected.setupNoteKey) })) : null, selectedRequiresSetup && selected && (_jsxs("div", { className: "mx-auto grid w-full max-w-xl gap-4 py-8", children: [_jsxs("div", { children: [_jsx("p", { className: "text-base font-semibold tracking-[-0.02em] text-foreground", children: t("mcpIntegrations.providerSetupRequired") }), _jsx("p", { className: "mt-1 text-sm leading-6 text-muted-foreground", children: t("mcpIntegrations.providerSetupDescription", {
                                                             name: selected.name,
-                                                        }) })] }), selected.setupNoteKey ? (_jsx("p", { className: "text-sm leading-6 text-muted-foreground", children: t(selected.setupNoteKey) })) : null, selected.docsUrl ? (_jsxs("a", { href: selected.docsUrl, target: "_blank", rel: "noopener noreferrer", className: "inline-flex w-fit items-center gap-1 text-sm font-medium text-foreground underline underline-offset-4 hover:text-muted-foreground", children: [t("mcpIntegrations.viewSetup"), _jsx(IconExternalLink, { className: "size-3.5" })] })) : null] })), !selected && (_jsxs("div", { className: "flex items-center justify-between gap-3 rounded-md bg-muted/30 px-3 py-2 text-[11px]", children: [_jsx("span", { className: "text-muted-foreground", children: customAuthMode === "oauth"
+                                                        }) })] }), selected.setupNoteKey ? (_jsx("p", { className: "text-sm leading-6 text-muted-foreground", children: t(selected.setupNoteKey) })) : null, _jsxs("div", { className: "flex items-center justify-between gap-3 rounded-md border border-border px-3 py-2", children: [_jsxs("div", { className: "min-w-0", children: [_jsx("p", { className: "text-sm font-medium text-foreground", children: t("mcpIntegrations.personalConnection") }), _jsx("p", { className: "text-[11px] leading-relaxed text-muted-foreground", children: t("mcpIntegrations.personalDescription") })] }), _jsx("span", { className: "shrink-0 text-[11px] text-muted-foreground", children: t("mcpIntegrations.personal") })] }), selected.docsUrl ? (_jsxs("a", { href: selected.docsUrl, target: "_blank", rel: "noopener noreferrer", className: "inline-flex w-fit items-center gap-1 text-sm font-medium text-foreground underline underline-offset-4 hover:text-muted-foreground", children: [t("mcpIntegrations.viewSetup"), _jsx(IconExternalLink, { className: "size-3.5" })] })) : null] })), !selected && (_jsxs("div", { className: "flex items-center justify-between gap-3 rounded-md bg-muted/30 px-3 py-2 text-[11px]", children: [_jsx("span", { className: "text-muted-foreground", children: customAuthMode === "oauth"
                                                     ? t(
                                                     /* i18n-key-ignore */
                                                     "mcpIntegrations.customOAuthDefault", { defaultValue: "Sign in with OAuth" })
@@ -541,5 +541,5 @@ export function McpIntegrationDialog({ open, onOpenChange, initialIntegrationId
                                                         }, placeholder: selected?.headerPlaceholder ??
                                                             t("mcpIntegrations.headersPlaceholder") })] })), selected?.docsUrl && (_jsxs("a", { href: selected.docsUrl, target: "_blank", rel: "noopener noreferrer", className: "inline-flex items-center gap-1 text-[11px] text-muted-foreground underline hover:text-foreground", children: [t("mcpIntegrations.openSetupDocs"), _jsx(IconExternalLink, { className: "h-3 w-3" })] }))] })), testResult && (_jsxs("div", { className: cn("flex items-start gap-1 rounded-md px-3 py-2 text-[11px] leading-snug", testResult.ok
                                             ? "bg-green-500/5 text-green-600 dark:text-green-400"
-                                            : "bg-red-500/5 text-red-600 dark:text-red-400"), children: [testResult.ok && (_jsx(IconCheck, { className: "mt-0.5 h-3 w-3 shrink-0" })), _jsx("span", { className: "min-w-0 break-words", children: testResult.message })] })), error && (_jsx("div", { className: "break-words rounded-md bg-red-500/5 px-3 py-2 text-[11px] leading-snug text-red-600 dark:text-red-400", children: error }))] }) }), _jsxs("div", { className: "flex shrink-0 items-center justify-between gap-2 border-t border-border px-7 py-4", children: [!selectedRequiresSetup && (_jsx("button", { type: "button", onClick: runTest, disabled: !url.trim() || busy, className: "rounded-md border border-border bg-background px-3 py-1.5 text-[12px] font-medium text-foreground hover:bg-accent disabled:pointer-events-none disabled:opacity-40", children: t("mcpIntegrations.test") })), !selected && customAuthMode === "oauth" ? (_jsxs("button", { type: "button", onClick: connectCustomWithOAuth, disabled: !name.trim() || !url.trim() || busy, "aria-busy": busy, className: "rounded-md border border-border bg-background px-3 py-1.5 text-[12px] font-medium text-foreground hover:bg-accent disabled:pointer-events-none disabled:opacity-40", children: [busy && (_jsx(IconLoader2, { className: "me-1.5 inline h-3.5 w-3.5 animate-spin" })), t("mcpIntegrations.connectWithOAuth")] })) : null, selectedRequiresSetup ? (_jsxs("div", { className: "ms-auto flex items-center gap-2", children: [selected?.docsUrl ? (_jsxs("a", { href: selected.docsUrl, target: "_blank", rel: "noopener noreferrer", className: "inline-flex min-w-[92px] items-center justify-center gap-1.5 rounded-md border border-border bg-background px-3 py-1.5 text-[12px] font-medium text-foreground hover:bg-accent", children: [t("mcpIntegrations.viewSetup"), _jsx(IconExternalLink, { className: "h-3 w-3" })] })) : null, selected?.authMode === "oauth" && (_jsxs("button", { type: "button", onClick: () => connectWithOAuth(selected), disabled: busy, "aria-busy": busy, className: "inline-flex min-w-[132px] items-center justify-center gap-1.5 rounded-md bg-primary px-3 py-1.5 text-[12px] font-medium text-primary-foreground hover:bg-primary/90 disabled:pointer-events-none disabled:opacity-40", children: [busy && (_jsx(IconLoader2, { className: "h-3.5 w-3.5 animate-spin" })), t("mcpIntegrations.continueToConnect")] }))] })) : selected?.authMode === "oauth" ? (_jsxs("button", { type: "button", onClick: () => connectWithOAuth(selected), disabled: !name.trim() || !url.trim() || busy, "aria-busy": busy, className: "inline-flex min-w-[92px] items-center justify-center gap-1.5 rounded-md bg-primary px-3 py-1.5 text-[12px] font-medium text-primary-foreground hover:bg-primary/90 disabled:pointer-events-none disabled:opacity-40", children: [busy && _jsx(IconLoader2, { className: "h-3.5 w-3.5 animate-spin" }), t("mcpIntegrations.connectWithOAuth")] })) : !selected && customAuthMode === "oauth" ? null : (_jsxs("button", { type: "button", onClick: submitForm, disabled: !name.trim() || !url.trim() || busy, className: "inline-flex min-w-[92px] items-center justify-center gap-1.5 rounded-md bg-primary px-3 py-1.5 text-[12px] font-medium text-primary-foreground hover:bg-primary/90 disabled:pointer-events-none disabled:opacity-40", children: [busy && _jsx(IconLoader2, { className: "h-3.5 w-3.5 animate-spin" }), t("mcpIntegrations.connect")] }))] })] }))] }) }));
+                                            : "bg-red-500/5 text-red-600 dark:text-red-400"), children: [testResult.ok && (_jsx(IconCheck, { className: "mt-0.5 h-3 w-3 shrink-0" })), _jsx("span", { className: "min-w-0 break-words", children: testResult.message })] })), error && (_jsx("div", { className: "break-words rounded-md bg-red-500/5 px-3 py-2 text-[11px] leading-snug text-red-600 dark:text-red-400", children: error }))] }) }), _jsxs("div", { className: "flex shrink-0 items-center justify-between gap-2 border-t border-border px-7 py-4", children: [!selectedRequiresSetup && (_jsx("button", { type: "button", onClick: runTest, disabled: !url.trim() || busy, className: "rounded-md border border-border bg-background px-3 py-1.5 text-[12px] font-medium text-foreground hover:bg-accent disabled:pointer-events-none disabled:opacity-40", children: t("mcpIntegrations.test") })), !selected && customAuthMode === "oauth" ? (_jsxs("button", { type: "button", onClick: connectCustomWithOAuth, disabled: !name.trim() || !url.trim() || busy, "aria-busy": busy, className: "rounded-md border border-border bg-background px-3 py-1.5 text-[12px] font-medium text-foreground hover:bg-accent disabled:pointer-events-none disabled:opacity-40", children: [busy && (_jsx(IconLoader2, { className: "me-1.5 inline h-3.5 w-3.5 animate-spin" })), t("mcpIntegrations.connectWithOAuth")] })) : null, selectedRequiresSetup ? (_jsx("div", { className: "ms-auto flex items-center gap-2", children: selected?.authMode === "oauth" && (_jsxs("button", { type: "button", onClick: () => connectWithOAuth(selected), disabled: busy, "aria-busy": busy, className: "inline-flex min-w-[132px] items-center justify-center gap-1.5 rounded-md bg-primary px-3 py-1.5 text-[12px] font-medium text-primary-foreground hover:bg-primary/90 disabled:pointer-events-none disabled:opacity-40", children: [busy && (_jsx(IconLoader2, { className: "h-3.5 w-3.5 animate-spin" })), t("mcpIntegrations.continueToConnect")] })) })) : selected?.authMode === "oauth" ? (_jsxs("button", { type: "button", onClick: () => connectWithOAuth(selected), disabled: !name.trim() || !url.trim() || busy, "aria-busy": busy, className: "inline-flex min-w-[92px] items-center justify-center gap-1.5 rounded-md bg-primary px-3 py-1.5 text-[12px] font-medium text-primary-foreground hover:bg-primary/90 disabled:pointer-events-none disabled:opacity-40", children: [busy && _jsx(IconLoader2, { className: "h-3.5 w-3.5 animate-spin" }), t("mcpIntegrations.connectWithOAuth")] })) : !selected && customAuthMode === "oauth" ? null : (_jsxs("button", { type: "button", onClick: submitForm, disabled: !name.trim() || !url.trim() || busy, className: "inline-flex min-w-[92px] items-center justify-center gap-1.5 rounded-md bg-primary px-3 py-1.5 text-[12px] font-medium text-primary-foreground hover:bg-primary/90 disabled:pointer-events-none disabled:opacity-40", children: [busy && _jsx(IconLoader2, { className: "h-3.5 w-3.5 animate-spin" }), t("mcpIntegrations.connect")] }))] })] }))] }) }));
 }

package/dist/client/resources/mcp-integration-catalog.js

@@ -272,7 +272,7 @@ export const DEFAULT_MCP_INTEGRATIONS = [
     },
     {
         id: "atlassian",
-        name: "Atlassian",
+        name: "Jira",
         provider: "atlassian",
         description: "Read and write Jira issues and Confluence content.",
         descriptionKey: "mcpIntegrations.catalog.atlassian.description",

package/dist/coding-tools/index.d.ts

@@ -5,6 +5,12 @@ export interface CodingCommandResult {
     stderr: string;
     timedOut: boolean;
     durationMs?: number;
+    /**
+     * The command exited but something it started outlived it and still holds the
+     * output pipe, so the captured output stops here rather than at end-of-stream.
+     * Distinct from a clean finish — the caller is not looking at the whole story.
+     */
+    outputStillOpen?: boolean;
 }
 /**
  * Structured metadata emitted on tool_start / tool_done events so the UI can
@@ -103,4 +109,29 @@ export declare function truncateCodingOutput(value: string, max: number): string
  * signal (error messages, test results, etc.).
  */
 export declare function truncateBashOutput(value: string, headChars?: number, tailChars?: number): string;
+/**
+ * Strip shell quoting so a policy regex sees the word the shell will actually
+ * run. Bash removes quotes before the command word exists, so `git 'checkout'`
+ * and `gi''t checkout` both execute `git checkout` while matching no rule
+ * written against the literal text — every denylist entry is otherwise one pair
+ * of quotes away from being bypassed.
+ *
+ * `unanalyzable` reports constructs whose executed text this pass cannot
+ * recover, so no rule matched against the canonical form can be trusted:
+ * `$'…'` ANSI-C escapes (`$'\x67it'` → `git`) and command substitution
+ * (`$(printf git) $(printf checkout) main` runs the forbidden operation while
+ * the string contains neither token). Callers must escalate rather than clear a
+ * command when this is set. Substitution inside single quotes is literal, so it
+ * does not set the flag.
+ *
+ * ponytail: plain parameter expansion (`$VAR`, `${VAR}`) can also build a token
+ * at runtime and is NOT flagged — doing so would make ordinary `cd $TMPDIR`
+ * commands require approval. Closing that needs a real shell parser, which is
+ * the upgrade path if this boundary ever has to hold against a determined
+ * attacker rather than a misbehaving model.
+ */
+export declare function canonicalizeShellCommand(command: string): {
+    canonical: string;
+    unanalyzable: boolean;
+};
 export declare function isReadOnlyShellCommand(command: string): boolean;

package/dist/coding-tools/index.js

@@ -3,6 +3,10 @@ import fs from "node:fs";
 import path from "node:path";
 const DEFAULT_COMMAND_TIMEOUT_MS = 120_000;
 const DEFAULT_MAX_OUTPUT_CHARS = 50_000;
+/** How long `close` may lag `exit` before we settle on the exit code anyway. */
+const CLOSE_GRACE_MS = 500;
+/** How long a signalled process group has to exit before it is SIGKILLed. */
+const SIGKILL_GRACE_MS = 1_000;
 const DEFAULT_MAX_FILE_READ_CHARS = 120_000;
 /**
  * Output retention window for bash: keep first HEAD_CHARS + last TAIL_CHARS,
@@ -305,17 +309,45 @@ export function createCodingToolRegistry(options = {}) {
     };
 }
 export async function runCodingCommand(command, cwd, timeoutMs, options = {}) {
+    // `detached` puts the child in its own process group so `abort` can signal
+    // everything it spawned. Without it a timeout signals only the `sh -c`
+    // wrapper, which a backgrounding command has usually already outlived.
     const child = spawn(command, {
         cwd,
         shell: true,
         stdio: ["pipe", "pipe", "pipe"],
+        detached: true,
         env: { ...process.env, FORCE_COLOR: "0" },
     });
     let stdout = "";
     let stderr = "";
     let timedOut = false;
+    let outputStillOpen = false;
     const startMs = Date.now();
-    const abort = () => child.kill("SIGTERM");
+    const killGroup = (signal) => {
+        try {
+            if (child.pid !== undefined)
+                process.kill(-child.pid, signal);
+            else
+                child.kill(signal);
+        }
+        catch {
+            // The group is already gone, or we never got a pid. Fall back to the
+            // direct child; if that also throws the process is already reaped.
+            try {
+                child.kill(signal);
+            }
+            catch {
+                /* already exited */
+            }
+        }
+    };
+    let sigkillTimer;
+    const abort = () => {
+        killGroup("SIGTERM");
+        sigkillTimer ??= setTimeout(() => killGroup("SIGKILL"), SIGKILL_GRACE_MS);
+        sigkillTimer.unref?.();
+    };
     const timer = setTimeout(() => {
         timedOut = true;
         abort();
@@ -341,9 +373,39 @@ export async function runCodingCommand(command, cwd, timeoutMs, options = {}) {
             options.signal.addEventListener("abort", abort, { once: true });
     }
     try {
+        // `close` fires only once every inherited pipe is closed, so a command that
+        // leaves a grandchild running (`npm run dev &`) never reaches it. Treat
+        // `exit` as authoritative and allow `close` a short grace to deliver
+        // buffered output, then settle on what we have.
         const code = await new Promise((resolve, reject) => {
-            child.once("error", reject);
-            child.once("close", resolve);
+            let settled = false;
+            let graceTimer;
+            const settle = (value) => {
+                if (settled)
+                    return;
+                settled = true;
+                if (graceTimer)
+                    clearTimeout(graceTimer);
+                resolve(value);
+            };
+            child.once("error", (err) => {
+                if (settled)
+                    return;
+                settled = true;
+                if (graceTimer)
+                    clearTimeout(graceTimer);
+                reject(err);
+            });
+            child.once("close", (closeCode) => settle(closeCode));
+            child.once("exit", (exitCode) => {
+                if (settled)
+                    return;
+                graceTimer = setTimeout(() => {
+                    outputStillOpen = true;
+                    settle(exitCode);
+                }, CLOSE_GRACE_MS);
+                graceTimer.unref?.();
+            });
         });
         return {
             code,
@@ -351,10 +413,16 @@ export async function runCodingCommand(command, cwd, timeoutMs, options = {}) {
             stderr,
             timedOut,
             durationMs: Date.now() - startMs,
+            ...(outputStillOpen ? { outputStillOpen: true } : {}),
         };
     }
     finally {
         clearTimeout(timer);
+        // Deliberately NOT clearing `sigkillTimer`. It exists only when abort ran,
+        // and the exit-grace path can settle before the 1s escalation fires — a
+        // descendant that ignored SIGTERM would then outlive the call untouched.
+        // Letting it run costs nothing: it is unref'd, and `killGroup` on an
+        // already-dead group is a caught no-op.
         options.signal?.removeEventListener("abort", abort);
     }
 }
@@ -399,6 +467,9 @@ export function formatCodingCommandResult(result, maxChars = DEFAULT_MAX_OUTPUT_
             ? ""
             : `exitCode: ${result.code}`,
         result.timedOut ? "timedOut: true" : "",
+        result.outputStillOpen
+            ? "note: the command exited but a process it started is still running and holding the output stream, so the output below may be incomplete"
+            : "",
         result.stdout ? `stdout:\n${result.stdout}` : "",
         result.stderr ? `stderr:\n${result.stderr}` : "",
     ].filter(Boolean);
@@ -422,6 +493,71 @@ export function truncateBashOutput(value, headChars = BASH_OUTPUT_HEAD_CHARS, ta
     const omitted = value.length - max;
     return `${value.slice(0, headChars)}\n\n...[${omitted} chars omitted]\n\n${value.slice(value.length - tailChars)}`;
 }
+/**
+ * Strip shell quoting so a policy regex sees the word the shell will actually
+ * run. Bash removes quotes before the command word exists, so `git 'checkout'`
+ * and `gi''t checkout` both execute `git checkout` while matching no rule
+ * written against the literal text — every denylist entry is otherwise one pair
+ * of quotes away from being bypassed.
+ *
+ * `unanalyzable` reports constructs whose executed text this pass cannot
+ * recover, so no rule matched against the canonical form can be trusted:
+ * `$'…'` ANSI-C escapes (`$'\x67it'` → `git`) and command substitution
+ * (`$(printf git) $(printf checkout) main` runs the forbidden operation while
+ * the string contains neither token). Callers must escalate rather than clear a
+ * command when this is set. Substitution inside single quotes is literal, so it
+ * does not set the flag.
+ *
+ * ponytail: plain parameter expansion (`$VAR`, `${VAR}`) can also build a token
+ * at runtime and is NOT flagged — doing so would make ordinary `cd $TMPDIR`
+ * commands require approval. Closing that needs a real shell parser, which is
+ * the upgrade path if this boundary ever has to hold against a determined
+ * attacker rather than a misbehaving model.
+ */
+export function canonicalizeShellCommand(command) {
+    let canonical = "";
+    let unanalyzable = false;
+    let quote = null;
+    for (let i = 0; i < command.length; i += 1) {
+        const ch = command[i];
+        if (quote === "'") {
+            if (ch === "'")
+                quote = null;
+            else
+                canonical += ch;
+            continue;
+        }
+        if (ch === "\\") {
+            const next = command[i + 1];
+            if (next === undefined)
+                continue;
+            // Backslash-newline is a line continuation: both characters vanish.
+            if (next !== "\n")
+                canonical += next;
+            i += 1;
+            continue;
+        }
+        // Substitution expands inside double quotes as well as unquoted.
+        if (ch === "`" || (ch === "$" && command[i + 1] === "(")) {
+            unanalyzable = true;
+        }
+        if (quote === '"') {
+            if (ch === '"')
+                quote = null;
+            else
+                canonical += ch;
+            continue;
+        }
+        if (ch === "$" && command[i + 1] === "'")
+            unanalyzable = true;
+        if (ch === "'" || ch === '"') {
+            quote = ch;
+            continue;
+        }
+        canonical += ch;
+    }
+    return { canonical, unanalyzable };
+}
 export function isReadOnlyShellCommand(command) {
     const normalized = command.trim().toLowerCase();
     if (!normalized)

package/dist/collab/awareness.d.ts

@@ -62,11 +62,11 @@ export declare const postAwareness: import("h3").EventHandlerWithFetch<import("h
     error: string;
     states?: undefined;
 } | {
-    error?: undefined;
     states: {
         clientId: number;
         state: string;
     }[];
+    error?: undefined;
 }>>;
 /**
  * GET /_agent-native/collab/:docId/users
@@ -77,9 +77,9 @@ export declare const getActiveUsers: import("h3").EventHandlerWithFetch<import("
     error: string;
     users?: undefined;
 } | {
-    error?: undefined;
     users: {
         clientId: number;
         lastSeen: number;
     }[];
+    error?: undefined;
 }>>;

package/dist/collab/struct-routes.d.ts

@@ -13,8 +13,8 @@
  * Body: { json: any, fieldName?: string, type?: "map"|"array", requestSource?: string }
  */
 export declare const postCollabJson: import("h3").EventHandlerWithFetch<import("h3").EventHandlerRequest, Promise<{
-    ok?: undefined;
     error: string;
+    ok?: undefined;
 } | {
     error?: undefined;
     ok: boolean;

package/dist/localization/core-messages/ar-SA.js

@@ -1,10 +1,13 @@
 const messages = {
     "approval.alwaysAllow": "السماح دائمًا",
     "approval.alwaysAllowHint": "الموافقة على هذا الأمر المحدد والسماح به دائمًا",
+    "approval.alwaysAllowAction": "السماح بهذا الإجراء دائمًا",
+    "approval.alwaysAllowActionHint": "الموافقة والسماح بهذا الإجراء دائمًا",
     "approval.approve": "موافقة",
     "approval.approved": "تمت الموافقة. جارٍ إعادة تشغيل {{tool}}...",
     "approval.denied": "تم الرفض. لم يتم تشغيل {{tool}}.",
     "approval.deny": "رفض",
+    "approval.moreOptions": "المزيد من خيارات الموافقة",
     "approval.question": "هل توافق على تشغيل {{tool}}؟",
     "auth.expiredDescription": "ربما انتهت صلاحية جلستك. سجّل الخروج ثم ادخل مجددًا لإعادة الاتصال.",
     "auth.expiredTitle": "انتهت صلاحية الجلسة",

package/dist/localization/core-messages/de-DE.js

@@ -1,10 +1,13 @@
 const messages = {
     "approval.alwaysAllow": "Immer erlauben",
     "approval.alwaysAllowHint": "Diesen exakten Befehl genehmigen und immer erlauben",
+    "approval.alwaysAllowAction": "Diese Aktion immer erlauben",
+    "approval.alwaysAllowActionHint": "Genehmigen und diese Aktion immer erlauben",
     "approval.approve": "Genehmigen",
     "approval.approved": "Genehmigt. {{tool}} wird erneut ausgeführt...",
     "approval.denied": "Abgelehnt. {{tool}} wurde nicht ausgeführt.",
     "approval.deny": "Ablehnen",
+    "approval.moreOptions": "Weitere Genehmigungsoptionen",
     "approval.question": "Ausführung von {{tool}} genehmigen?",
     "auth.expiredDescription": "Deine Sitzung ist möglicherweise abgelaufen. Melde dich ab und wieder an, um die Verbindung wiederherzustellen.",
     "auth.expiredTitle": "Sitzung abgelaufen",

package/dist/localization/core-messages/en-US.d.ts

@@ -1,10 +1,13 @@
 declare const messages: {
     readonly "approval.alwaysAllow": "Always allow";
     readonly "approval.alwaysAllowHint": "Approve and always allow this exact command";
+    readonly "approval.alwaysAllowAction": "Always allow this action";
+    readonly "approval.alwaysAllowActionHint": "Approve and always allow this action";
     readonly "approval.approve": "Approve";
     readonly "approval.approved": "Approved. Re-running {{tool}}...";
     readonly "approval.denied": "Denied. {{tool}} did not run.";
     readonly "approval.deny": "Deny";
+    readonly "approval.moreOptions": "More approval options";
     readonly "approval.question": "Approve to run {{tool}}?";
     readonly "auth.expiredDescription": "Your session may have expired. Log out and log back in to reconnect.";
     readonly "auth.expiredTitle": "Session expired";

package/dist/localization/core-messages/en-US.js

@@ -1,10 +1,13 @@
 const messages = {
     "approval.alwaysAllow": "Always allow",
     "approval.alwaysAllowHint": "Approve and always allow this exact command",
+    "approval.alwaysAllowAction": "Always allow this action",
+    "approval.alwaysAllowActionHint": "Approve and always allow this action",
     "approval.approve": "Approve",
     "approval.approved": "Approved. Re-running {{tool}}...",
     "approval.denied": "Denied. {{tool}} did not run.",
     "approval.deny": "Deny",
+    "approval.moreOptions": "More approval options",
     "approval.question": "Approve to run {{tool}}?",
     "auth.expiredDescription": "Your session may have expired. Log out and log back in to reconnect.",
     "auth.expiredTitle": "Session expired",

package/dist/localization/core-messages/es-ES.js

@@ -1,10 +1,13 @@
 const messages = {
     "approval.alwaysAllow": "Permitir siempre",
     "approval.alwaysAllowHint": "Aprobar y permitir siempre este comando exacto",
+    "approval.alwaysAllowAction": "Permitir siempre esta acción",
+    "approval.alwaysAllowActionHint": "Aprobar y permitir siempre esta acción",
     "approval.approve": "Aprobar",
     "approval.approved": "Aprobado. Ejecutando {{tool}} de nuevo...",
     "approval.denied": "Denegado. {{tool}} no se ejecutó.",
     "approval.deny": "Denegar",
+    "approval.moreOptions": "Más opciones de aprobación",
     "approval.question": "¿Aprobar la ejecución de {{tool}}?",
     "auth.expiredDescription": "Es posible que tu sesión haya caducado. Cierra sesión y vuelve a iniciarla para reconectarte.",
     "auth.expiredTitle": "Sesión caducada",

package/dist/localization/core-messages/fr-FR.js

@@ -1,10 +1,13 @@
 const messages = {
     "approval.alwaysAllow": "Toujours autoriser",
     "approval.alwaysAllowHint": "Approuver et toujours autoriser cette commande exacte",
+    "approval.alwaysAllowAction": "Toujours autoriser cette action",
+    "approval.alwaysAllowActionHint": "Approuver et toujours autoriser cette action",
     "approval.approve": "Approuver",
     "approval.approved": "Approuvé. Nouvelle exécution de {{tool}}...",
     "approval.denied": "Refusé. {{tool}} n’a pas été exécuté.",
     "approval.deny": "Refuser",
+    "approval.moreOptions": "Plus d’options d’approbation",
     "approval.question": "Approuver l’exécution de {{tool}} ?",
     "auth.expiredDescription": "Votre session a peut-être expiré. Déconnectez-vous, puis reconnectez-vous pour rétablir la connexion.",
     "auth.expiredTitle": "Session expirée",

package/dist/localization/core-messages/hi-IN.js

@@ -1,10 +1,13 @@
 const messages = {
     "approval.alwaysAllow": "हमेशा अनुमति दें",
     "approval.alwaysAllowHint": "इस सटीक कमांड को स्वीकृत करें और हमेशा अनुमति दें",
+    "approval.alwaysAllowAction": "इस कार्रवाई को हमेशा अनुमति दें",
+    "approval.alwaysAllowActionHint": "स्वीकृत करें और इस कार्रवाई को हमेशा अनुमति दें",
     "approval.approve": "स्वीकृत करें",
     "approval.approved": "स्वीकृत। {{tool}} को फिर से चलाया जा रहा है...",
     "approval.denied": "अस्वीकृत। {{tool}} नहीं चला।",
     "approval.deny": "अस्वीकार करें",
+    "approval.moreOptions": "अनुमति के और विकल्प",
     "approval.question": "क्या {{tool}} को चलाने की अनुमति दें?",
     "auth.expiredDescription": "आपका सत्र समाप्त हो गया हो सकता है। दोबारा कनेक्ट करने के लिए लॉग आउट करके फिर लॉग इन करें।",
     "auth.expiredTitle": "सत्र समाप्त हो गया",

package/dist/localization/core-messages/ja-JP.js

@@ -1,10 +1,13 @@
 const messages = {
     "approval.alwaysAllow": "常に許可",
     "approval.alwaysAllowHint": "この完全に同じコマンドを承認し、今後も常に許可します",
+    "approval.alwaysAllowAction": "このアクションを常に許可",
+    "approval.alwaysAllowActionHint": "承認してこのアクションを常に許可します",
     "approval.approve": "承認",
     "approval.approved": "承認しました。{{tool}} を再実行しています...",
     "approval.denied": "拒否しました。{{tool}} は実行されませんでした。",
     "approval.deny": "拒否",
+    "approval.moreOptions": "その他の承認オプション",
     "approval.question": "{{tool}} の実行を承認しますか？",
     "auth.expiredDescription": "セッションの有効期限が切れた可能性があります。再接続するには、ログアウトしてからもう一度ログインしてください。",
     "auth.expiredTitle": "セッションの有効期限が切れました",

package/dist/localization/core-messages/ko-KR.js

@@ -1,10 +1,13 @@
 const messages = {
     "approval.alwaysAllow": "항상 허용",
     "approval.alwaysAllowHint": "이 명령과 정확히 일치하는 명령을 승인하고 항상 허용합니다",
+    "approval.alwaysAllowAction": "이 작업 항상 허용",
+    "approval.alwaysAllowActionHint": "승인하고 이 작업을 항상 허용합니다",
     "approval.approve": "승인",
     "approval.approved": "승인했습니다. {{tool}}을(를) 다시 실행하는 중...",
     "approval.denied": "거부했습니다. {{tool}}이(가) 실행되지 않았습니다.",
     "approval.deny": "거부",
+    "approval.moreOptions": "추가 승인 옵션",
     "approval.question": "{{tool}} 실행을 승인하시겠습니까?",
     "auth.expiredDescription": "세션이 만료되었을 수 있습니다. 다시 연결하려면 로그아웃한 후 다시 로그인하세요.",
     "auth.expiredTitle": "세션이 만료되었습니다",

package/dist/localization/core-messages/pt-BR.js

@@ -1,10 +1,13 @@
 const messages = {
     "approval.alwaysAllow": "Sempre permitir",
     "approval.alwaysAllowHint": "Aprovar e sempre permitir este comando exato",
+    "approval.alwaysAllowAction": "Sempre permitir esta ação",
+    "approval.alwaysAllowActionHint": "Aprovar e sempre permitir esta ação",
     "approval.approve": "Aprovar",
     "approval.approved": "Aprovado. Executando {{tool}} novamente...",
     "approval.denied": "Negado. {{tool}} não foi executado.",
     "approval.deny": "Negar",
+    "approval.moreOptions": "Mais opções de aprovação",
     "approval.question": "Aprovar a execução de {{tool}}?",
     "auth.expiredDescription": "Sua sessão pode ter expirado. Saia e entre novamente para restabelecer a conexão.",
     "auth.expiredTitle": "Sessão expirada",

package/dist/localization/core-messages/zh-CN.js

@@ -1,10 +1,13 @@
 const messages = {
     "approval.alwaysAllow": "始终允许",
     "approval.alwaysAllowHint": "批准并始终允许此完全相同的命令",
+    "approval.alwaysAllowAction": "始终允许此操作",
+    "approval.alwaysAllowActionHint": "批准并始终允许此操作",
     "approval.approve": "批准",
     "approval.approved": "已批准。正在重新运行 {{tool}}...",
     "approval.denied": "已拒绝。{{tool}} 未运行。",
     "approval.deny": "拒绝",
+    "approval.moreOptions": "更多批准选项",
     "approval.question": "批准运行 {{tool}}？",
     "auth.expiredDescription": "您的会话可能已过期。请退出登录后重新登录以恢复连接。",
     "auth.expiredTitle": "会话已过期",

package/dist/localization/core-messages/zh-TW.js

@@ -1,10 +1,13 @@
 const messages = {
     "approval.alwaysAllow": "一律允許",
     "approval.alwaysAllowHint": "核准並一律允許這個完全相同的命令",
+    "approval.alwaysAllowAction": "一律允許此動作",
+    "approval.alwaysAllowActionHint": "核准並一律允許此動作",
     "approval.approve": "核准",
     "approval.approved": "已核准。正在重新執行 {{tool}}...",
     "approval.denied": "已拒絕。{{tool}} 未執行。",
     "approval.deny": "拒絕",
+    "approval.moreOptions": "更多核准選項",
     "approval.question": "要核准執行 {{tool}} 嗎？",
     "auth.expiredDescription": "您的工作階段可能已過期。請登出後重新登入以恢復連線。",
     "auth.expiredTitle": "工作階段已過期",

package/dist/localization/core-messages.d.ts

@@ -3,10 +3,13 @@ export type CoreLocaleMessages = Record<string, unknown>;
 export declare const englishAgentChatMessages: {
     readonly "approval.alwaysAllow": "Always allow";
     readonly "approval.alwaysAllowHint": "Approve and always allow this exact command";
+    readonly "approval.alwaysAllowAction": "Always allow this action";
+    readonly "approval.alwaysAllowActionHint": "Approve and always allow this action";
     readonly "approval.approve": "Approve";
     readonly "approval.approved": "Approved. Re-running {{tool}}...";
     readonly "approval.denied": "Denied. {{tool}} did not run.";
     readonly "approval.deny": "Deny";
+    readonly "approval.moreOptions": "More approval options";
     readonly "approval.question": "Approve to run {{tool}}?";
     readonly "auth.expiredDescription": "Your session may have expired. Log out and log back in to reconnect.";
     readonly "auth.expiredTitle": "Session expired";

package/dist/localization/default-messages.d.ts

@@ -1014,6 +1014,7 @@ declare const messages: {
         continueToConnect: string;
         setupTitle: string;
         personal: string;
+        personalConnection: string;
         organization: string;
         scopeQuestion: string;
         scopeChoiceTitle: string;