@agentskit/cli 0.13.37 → 0.13.39

package/dist/{chunk-DZKCRKFS.js → chunk-AL4GKGCU.js}

@@ -1,10 +1,10 @@
 #!/usr/bin/env node
-import { readdir, stat, mkdir, writeFile, glob, readFile } from 'fs/promises';
+import { readdir, stat, glob, readFile, mkdir, lstat, mkdtemp, writeFile, rename, rm, access } from 'fs/promises';
 import { homedir } from 'os';
-import path, { join, resolve, isAbsolute, basename, dirname, sep } from 'path';
+import path, { join, resolve, isAbsolute, basename, dirname, relative, sep } from 'path';
 import { openrouter, groq, kimi, grok, deepseek, ollama, gemini, anthropic, openai } from '@agentskit/adapters';
-import { randomBytes, createHash } from 'crypto';
-import { writeFileSync, existsSync, readdirSync, statSync, readFileSync, mkdirSync, rmSync } from 'fs';
+import { randomBytes, randomUUID, createHash } from 'crypto';
+import { writeFileSync, chmodSync, existsSync, readdirSync, statSync, readFileSync, mkdirSync, rmSync } from 'fs';
 import { spawn } from 'child_process';
 import React2, { useMemo, useState, useEffect, useRef } from 'react';
 import { Box, Text, render } from 'ink';
@@ -16,6 +16,7 @@ import { getIntegration, integrationToolsFromEnv } from '@agentskit/integrations
 import { jsxs, jsx } from 'react/jsx-runtime';
 import { pathToFileURL } from 'url';
 import { createRuntime, validateFlow, flowToMermaid, compileFlow, createFileStepLog } from '@agentskit/runtime';
+import { createRequire } from 'module';
 import chokidar from 'chokidar';
 import kleur3 from 'kleur';
 import { createRAG } from '@agentskit/rag';
@@ -26,20 +27,27 @@ import { parse } from 'yaml';
 import { validatePIITaxonomy } from '@agentskit/core/security';
 import { ConfigError, ErrorCodes } from '@agentskit/core';
 
-async function loadJsonConfig(path5) {
+async function loadJsonConfig(path6) {
   try {
-    const raw = await readFile(path5, "utf8");
+    const raw = await readFile(path6, "utf8");
     return JSON.parse(raw);
-  } catch {
-    return void 0;
+  } catch (err) {
+    if (err.code === "ENOENT") return void 0;
+    throw new Error(`Failed to load JSON config ${path6}: ${err instanceof Error ? err.message : String(err)}`);
   }
 }
-async function loadTsConfig(path5) {
+async function loadTsConfig(path6) {
+  try {
+    await access(path6);
+  } catch (err) {
+    if (err.code === "ENOENT") return void 0;
+    throw err;
+  }
   try {
-    const mod = await import(path5);
+    const mod = await import(`${path6}?agentskit_config=${Date.now()}`);
     return mod.default ?? mod;
-  } catch {
-    return void 0;
+  } catch (err) {
+    throw new Error(`Failed to load TypeScript config ${path6}: ${err instanceof Error ? err.message : String(err)}`);
   }
 }
 async function loadPackageJsonConfig(dir) {
@@ -50,29 +58,31 @@ async function loadPackageJsonConfig(dir) {
       return pkg.agentskit;
     }
     return void 0;
-  } catch {
-    return void 0;
+  } catch (err) {
+    if (err.code === "ENOENT") return void 0;
+    throw new Error(`Failed to load package.json config ${dir}: ${err instanceof Error ? err.message : String(err)}`);
   }
 }
 function mergeConfigs(base, override) {
   if (!base && !override) return void 0;
   if (!base) return override;
   if (!override) return base;
-  return {
-    ...base,
-    ...override,
-    tools: { ...base.tools, ...override.tools },
-    defaults: { ...base.defaults, ...override.defaults },
-    runtime: { ...base.runtime, ...override.runtime },
-    observability: { ...base.observability, ...override.observability }
+  const merge = (left, right) => {
+    if (!left || typeof left !== "object" || Array.isArray(left)) return right;
+    if (!right || typeof right !== "object" || Array.isArray(right)) return right;
+    const out = { ...left };
+    for (const [key, value] of Object.entries(right)) {
+      out[key] = key in out ? merge(out[key], value) : value;
+    }
+    return out;
   };
+  return merge(base, override);
 }
 async function loadLocalConfig(cwd) {
   const tsConfig = await loadTsConfig(join(cwd, ".agentskit.config.ts"));
-  if (tsConfig) return tsConfig;
   const jsonConfig = await loadJsonConfig(join(cwd, ".agentskit.config.json"));
-  if (jsonConfig) return jsonConfig;
-  return await loadPackageJsonConfig(cwd);
+  const packageConfig = await loadPackageJsonConfig(cwd);
+  return mergeConfigs(mergeConfigs(packageConfig, jsonConfig), tsConfig);
 }
 async function loadGlobalConfig(home) {
   if (home === null) return void 0;
@@ -87,6 +97,21 @@ async function loadConfig(options) {
   const local = await loadLocalConfig(cwd);
   return mergeConfigs(global, local);
 }
+var SECRET_KEY = /^(api[-_]?key|token|secret|password|authorization|private[-_]?key)$/i;
+var SECRET_ENV_KEY = /(?:^|_)(?:api_?key|token|secret|password|authorization|private_?key)$/i;
+function isSecretKey(key) {
+  return SECRET_KEY.test(key) || SECRET_ENV_KEY.test(key);
+}
+function redactConfig(value) {
+  if (Array.isArray(value)) return value.map(redactConfig);
+  if (!value || typeof value !== "object") return value;
+  return Object.fromEntries(
+    Object.entries(value).map(([key, child]) => [
+      key,
+      isSecretKey(key) ? "[REDACTED]" : redactConfig(child)
+    ])
+  );
+}
 var providers = {
   openai: {
     label: "OpenAI",
@@ -158,7 +183,7 @@ function createDemoAdapter(provider, model) {
           ].join(" ");
           for (const chunk of reply.match(/.{1,18}/g) ?? []) {
             if (cancelled) return;
-            await new Promise((resolve7) => setTimeout(resolve7, 35));
+            await new Promise((resolve8) => setTimeout(resolve8, 35));
             yield { type: "text", content: chunk };
           }
           yield { type: "done" };
@@ -218,7 +243,8 @@ function dirFor(cwd = process.cwd()) {
   return join(ROOT, cwdHash(cwd));
 }
 function ensureDir(dir) {
-  if (!existsSync(dir)) mkdirSync(dir, { recursive: true });
+  if (!existsSync(dir)) mkdirSync(dir, { recursive: true, mode: 448 });
+  chmodSync(dir, 448);
 }
 function generateSessionId() {
   const ts = (/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-").slice(0, 19);
@@ -233,17 +259,19 @@ function metaPath(id, cwd = process.cwd()) {
   return join(dirFor(cwd), `${id}${META_SUFFIX}`);
 }
 function readMeta(id, cwd = process.cwd()) {
-  const path5 = metaPath(id, cwd);
-  if (!existsSync(path5)) return null;
+  const path6 = metaPath(id, cwd);
+  if (!existsSync(path6)) return null;
   try {
-    return JSON.parse(readFileSync(path5, "utf8"));
+    return JSON.parse(readFileSync(path6, "utf8"));
   } catch {
     return null;
   }
 }
 function writeSessionMeta(meta, cwd = process.cwd()) {
   ensureDir(dirFor(cwd));
-  writeFileSync(metaPath(meta.id, cwd), JSON.stringify(meta, null, 2));
+  const path6 = metaPath(meta.id, cwd);
+  writeFileSync(path6, JSON.stringify(meta, null, 2), { mode: 384 });
+  chmodSync(path6, 384);
 }
 function derivePreview(messages) {
   const firstUser = messages.find((m) => m.role === "user" && m.content.trim());
@@ -445,7 +473,7 @@ var HookDispatcher = class {
         result = await handler.run(current);
       } catch (err) {
         this.onError(handler, err);
-        continue;
+        return { payload: current, blocked: true, reason: "hook failed" };
       }
       if (result.decision === "block") {
         return { payload: current, blocked: true, reason: result.reason };
@@ -462,6 +490,7 @@ var HookDispatcher = class {
     return handler.matcher.test(String(payload.tool ?? payload.prompt ?? ""));
   }
 };
+var MAX_HOOK_STDOUT_BYTES = 64 * 1024;
 function configHooksToHandlers(config) {
   if (!config) return [];
   const handlers = [];
@@ -491,8 +520,26 @@ function runShellHook(entry, payload) {
       detached: true
     });
     let stdout = "";
+    let stdoutBytes = 0;
     child.stdout.on("data", (chunk) => {
-      stdout += chunk.toString();
+      const text = chunk.toString();
+      const bytes = Buffer.byteLength(text);
+      if (stdoutBytes + bytes > MAX_HOOK_STDOUT_BYTES) {
+        if (child.pid !== void 0) {
+          try {
+            process.kill(-child.pid, "SIGKILL");
+          } catch {
+          }
+        }
+        try {
+          child.kill("SIGKILL");
+        } catch {
+        }
+        settle({ decision: "block", reason: `shell hook output exceeded ${MAX_HOOK_STDOUT_BYTES} bytes` });
+        return;
+      }
+      stdoutBytes += bytes;
+      stdout += text;
     });
     const timer = setTimeout(() => {
       if (child.pid !== void 0) {
@@ -524,9 +571,13 @@ function runShellHook(entry, payload) {
       }
       try {
         const parsed = JSON.parse(trimmed);
-        settle(parsed);
+        if (!parsed || typeof parsed !== "object" || !("decision" in parsed) || !["continue", "block", "modify"].includes(String(parsed.decision))) {
+          settle({ decision: "block", reason: "shell hook returned an invalid decision" });
+        } else {
+          settle(parsed);
+        }
       } catch {
-        settle({ decision: "continue" });
+        settle({ decision: "block", reason: "shell hook returned invalid JSON" });
       }
     });
     child.on("error", (err) => {
@@ -980,8 +1031,9 @@ function ChatApp(options) {
   } = useRuntime(options);
   const mergedTools = useMemo(() => {
     const extra = options.extraTools ?? [];
-    return [...tools, ...extra];
-  }, [tools, options.extraTools]);
+    const combined = [...tools, ...extra];
+    return options.permissionPolicy ? applyPolicyToTools(options.permissionPolicy, combined) : combined;
+  }, [tools, options.extraTools, options.permissionPolicy]);
   const mergedSkills = useMemo(() => {
     const extra = options.extraSkills ?? [];
     if (!skills && extra.length === 0) return void 0;
@@ -1175,7 +1227,7 @@ async function loadPlugins(options = {}) {
     specs = [],
     pluginDirs = [],
     cwd = process.cwd(),
-    autoDiscoverUserDir = true,
+    autoDiscoverUserDir = false,
     onError = (spec, err) => process.stderr.write(
       `[agentskit] plugin "${spec}" failed to load: ${err instanceof Error ? err.message : String(err)}
 `
@@ -1266,6 +1318,8 @@ function mergePluginsIntoBundle(plugins) {
   }
   return bundle;
 }
+var MAX_FRAME_BYTES = 1024 * 1024;
+var DISPOSE_GRACE_MS = 1e3;
 var McpClient = class {
   constructor(spec, onError = (err) => process.stderr.write(
     `[agentskit] mcp[${spec.name}] error: ${err instanceof Error ? err.message : String(err)}
@@ -1282,7 +1336,8 @@ var McpClient = class {
     if (this.child) return;
     const child = spawn(this.spec.command, this.spec.args ?? [], {
       env: { ...process.env, ...this.spec.env ?? {} },
-      stdio: ["pipe", "pipe", "pipe"]
+      stdio: ["pipe", "pipe", "pipe"],
+      detached: process.platform !== "win32"
     });
     this.child = child;
     child.stdout.on("data", (chunk) => this.onStdout(chunk.toString()));
@@ -1314,7 +1369,22 @@ var McpClient = class {
   dispose() {
     if (this.disposed) return;
     this.disposed = true;
-    this.child?.kill("SIGTERM");
+    for (const pending of this.pending.values()) {
+      pending({ jsonrpc: "2.0", id: 0, error: { code: -32800, message: "client disposed" } });
+    }
+    this.pending.clear();
+    const child = this.child;
+    if (!child || child.killed) return;
+    const kill = (signal) => {
+      try {
+        if (process.platform !== "win32" && child.pid) process.kill(-child.pid, signal);
+        else child.kill(signal);
+      } catch {
+      }
+    };
+    kill("SIGTERM");
+    const timer = setTimeout(() => kill("SIGKILL"), DISPOSE_GRACE_MS);
+    timer.unref();
   }
   request(method, params) {
     return new Promise((resolvePromise, rejectPromise) => {
@@ -1342,10 +1412,20 @@ var McpClient = class {
   }
   onStdout(chunk) {
     this.buffer += chunk;
+    if (Buffer.byteLength(this.buffer, "utf8") > MAX_FRAME_BYTES && !this.buffer.includes("\n")) {
+      this.onError(new Error(`mcp ${this.spec.name} frame exceeded ${MAX_FRAME_BYTES} bytes`));
+      this.dispose();
+      return;
+    }
     let newlineIndex = this.buffer.indexOf("\n");
     while (newlineIndex !== -1) {
       const line = this.buffer.slice(0, newlineIndex).trim();
       this.buffer = this.buffer.slice(newlineIndex + 1);
+      if (Buffer.byteLength(line, "utf8") > MAX_FRAME_BYTES) {
+        this.onError(new Error(`mcp ${this.spec.name} frame exceeded ${MAX_FRAME_BYTES} bytes`));
+        this.dispose();
+        return;
+      }
       if (line) {
         try {
           const parsed = JSON.parse(line);
@@ -1421,8 +1501,7 @@ function formatEvent(event) {
 }
 async function runAgent(task, options) {
   if (options.skill && options.skills) {
-    process.stderr.write("Error: --skill and --skills are mutually exclusive. Use one or the other.\n");
-    process.exit(1);
+    throw new Error("--skill and --skills are mutually exclusive. Use one or the other.");
   }
   const { adapter } = resolveChatProvider({
     provider: options.provider,
@@ -1492,6 +1571,69 @@ var PROVIDER_ENV_KEY = {
   openrouter: "OPENROUTER_API_KEY",
   demo: null
 };
+var PACKAGE_RANGES = {
+  "@agentskit/adapters": "^0.15.2",
+  "@agentskit/angular": "^0.5.3",
+  "@agentskit/ink": "^0.10.9",
+  "@agentskit/memory": "^0.11.8",
+  "@agentskit/react": "^0.8.3",
+  "@agentskit/runtime": "^0.10.15",
+  "@agentskit/skills": "^0.9.3",
+  "@agentskit/svelte": "^0.5.3",
+  "@agentskit/tools": "^0.13.6",
+  "@agentskit/vue": "^0.5.3"
+};
+function align(files) {
+  const result = { ...files };
+  for (const file of ["package.json", "deno.json"]) {
+    if (!files[file]) continue;
+    const parsed = JSON.parse(files[file]);
+    const sections = file === "package.json" ? ["dependencies", "devDependencies", "peerDependencies"] : ["imports"];
+    for (const sectionName of sections) {
+      const section = parsed[sectionName];
+      if (!section || typeof section !== "object" || Array.isArray(section)) continue;
+      for (const [name, range] of Object.entries(PACKAGE_RANGES)) if (name in section) {
+        section[name] = file === "deno.json" ? `npm:${name}@${range}` : range;
+      }
+    }
+    result[file] = `${JSON.stringify(parsed, null, 2)}
+`;
+  }
+  return result;
+}
+async function existing(filePath) {
+  try {
+    return await lstat(filePath);
+  } catch (error) {
+    if (error.code === "ENOENT") return void 0;
+    throw error;
+  }
+}
+async function writeStarterProject(options, renderers) {
+  const ctx = { template: options.template, provider: options.provider ?? "demo", tools: options.tools ?? [], memory: options.memory ?? "none", pm: options.packageManager ?? "pnpm" };
+  const files = align(renderers[ctx.template](ctx));
+  await mkdir(options.targetDir, { recursive: true });
+  const target = await lstat(options.targetDir);
+  if (target.isSymbolicLink() || !target.isDirectory()) throw new Error(`Refusing to write starter into non-directory target: ${options.targetDir}`);
+  if ((await readdir(options.targetDir)).length > 0 && !options.force) throw new Error(`Target directory is not empty: ${options.targetDir} (re-run with --force to overwrite generated files)`);
+  const overwritten = [];
+  for (const [relativePath, content] of Object.entries(files)) {
+    const absolutePath = path.join(options.targetDir, relativePath);
+    await mkdir(path.dirname(absolutePath), { recursive: true });
+    const destination = await existing(absolutePath);
+    if (destination?.isSymbolicLink()) throw new Error(`Refusing to overwrite symlink: ${absolutePath}`);
+    if (destination) overwritten.push(relativePath);
+    const tempDir = await mkdtemp(path.join(path.dirname(absolutePath), `.agentskit-init-${randomUUID()}-`));
+    try {
+      await writeFile(path.join(tempDir, path.basename(absolutePath)), content, "utf8");
+      await rename(path.join(tempDir, path.basename(absolutePath)), absolutePath);
+    } finally {
+      await rm(tempDir, { recursive: true, force: true }).catch(() => {
+      });
+    }
+  }
+  return overwritten;
+}
 
 // src/init.ts
 function adapterCall(provider, prefix = "process.env") {
@@ -2877,23 +3019,8 @@ var TEMPLATE_FN = {
   "deno-deploy": denoDeployStarter,
   angular: angularStarter
 };
-async function writeStarterProject(options) {
-  const ctx = {
-    template: options.template,
-    provider: options.provider ?? "demo",
-    tools: options.tools ?? [],
-    memory: options.memory ?? "none",
-    pm: options.packageManager ?? "pnpm"
-  };
-  const files = TEMPLATE_FN[ctx.template](ctx);
-  await mkdir(options.targetDir, { recursive: true });
-  await Promise.all(
-    Object.entries(files).map(async ([relativePath, content]) => {
-      const absolutePath = path.join(options.targetDir, relativePath);
-      await mkdir(path.dirname(absolutePath), { recursive: true });
-      await writeFile(absolutePath, content, "utf8");
-    })
-  );
+async function writeStarterProject2(options) {
+  return writeStarterProject(options, TEMPLATE_FN);
 }
 
 // src/provider-registry.ts
@@ -3140,8 +3267,8 @@ async function checkPnpm() {
   };
 }
 async function checkPackageJson() {
-  const path5 = join(process.cwd(), "package.json");
-  if (!existsSync(path5)) {
+  const path6 = join(process.cwd(), "package.json");
+  if (!existsSync(path6)) {
     return {
       status: "warn",
       name: "package.json",
@@ -3150,7 +3277,7 @@ async function checkPackageJson() {
     };
   }
   try {
-    const pkg = JSON.parse(await readFile(path5, "utf8"));
+    const pkg = JSON.parse(await readFile(path6, "utf8"));
     const deps = {
       ...pkg.dependencies ?? {},
       ...pkg.devDependencies ?? {}
@@ -3363,6 +3490,14 @@ function renderReport(report, opts = {}) {
   lines.push("");
   return lines.join("\n");
 }
+var require2 = createRequire(import.meta.url);
+function resolveTsxCli() {
+  try {
+    return require2.resolve("tsx/cli");
+  } catch {
+    throw new Error("TypeScript execution requires the packaged tsx dependency");
+  }
+}
 var DEFAULT_WATCH = [
   "**/*.ts",
   "**/*.tsx",
@@ -3390,8 +3525,8 @@ function startDev(options) {
   const stderr = options.stderr ?? process.stderr;
   const debounceMs = options.debounceMs ?? 200;
   const isTs = entry.endsWith(".ts") || entry.endsWith(".tsx");
-  const cmd = isTs ? "tsx" : "node";
-  const baseArgs = [entry, ...options.scriptArgs ?? []];
+  const cmd = isTs ? process.execPath : "node";
+  const baseArgs = isTs ? [resolveTsxCli(), entry, ...options.scriptArgs ?? []] : [entry, ...options.scriptArgs ?? []];
   const spawnFn = options.spawn ?? ((c, a) => spawn(c, a, {
     stdio: ["inherit", "pipe", "pipe"],
     env: { ...process.env, FORCE_COLOR: "1" }
@@ -3403,7 +3538,9 @@ function startDev(options) {
   let child;
   let restartCount = 0;
   let restartTimer;
+  let delayedStartTimer;
   let stopped = false;
+  let stdinListener;
   let resolveDone;
   const done = new Promise((r) => {
     resolveDone = r;
@@ -3429,15 +3566,18 @@ function startDev(options) {
       }
     });
   };
-  const restart = (path5) => {
+  const restart = (path6) => {
     if (restartTimer) clearTimeout(restartTimer);
     restartTimer = setTimeout(() => {
       restartTimer = void 0;
-      banner(`\u21BB change detected \u2014 ${path5}`, "yellow");
+      banner(`\u21BB change detected \u2014 ${path6}`, "yellow");
       if (child && !child.killed && child.exitCode === null) {
         child.kill("SIGTERM");
       }
-      setTimeout(startChild, 80);
+      delayedStartTimer = setTimeout(() => {
+        delayedStartTimer = void 0;
+        if (!stopped) startChild();
+      }, 80);
     }, debounceMs);
   };
   watcher.on("change", restart);
@@ -3448,6 +3588,9 @@ function startDev(options) {
     if (stopped) return;
     stopped = true;
     if (restartTimer) clearTimeout(restartTimer);
+    if (delayedStartTimer) clearTimeout(delayedStartTimer);
+    if (stdinListener) process.stdin.off("data", stdinListener);
+    if (process.stdin.isTTY && process.stdin.setRawMode) process.stdin.setRawMode(false);
     if (child && !child.killed && child.exitCode === null) {
       child.kill("SIGTERM");
     }
@@ -3458,11 +3601,12 @@ function startDev(options) {
   if (process.stdin.isTTY && process.stdin.setRawMode) {
     process.stdin.setRawMode(true);
     process.stdin.resume();
-    process.stdin.on("data", (data) => {
+    stdinListener = (data) => {
       const key = data.toString();
       if (key === "r") restart("manual");
       if (key === "q" || key === "") void stop();
-    });
+    };
+    process.stdin.on("data", stdinListener);
   }
   return {
     done,
@@ -3488,6 +3632,7 @@ async function startTunnel(options) {
   });
   let requests = 0;
   let stopped = false;
+  let signalHandler;
   let resolveDone;
   const done = new Promise((r) => {
     resolveDone = r;
@@ -3497,12 +3642,14 @@ async function startTunnel(options) {
   });
   tunnel.on("close", () => {
     if (stopped) return;
+    if (signalHandler) process.off("SIGINT", signalHandler);
     banner(`tunnel closed by remote`, "yellow");
     resolveDone();
   });
   tunnel.on("error", (...args) => {
     const err = args[0];
     banner(`error: ${err?.message ?? "unknown"}`, "red");
+    resolveDone();
   });
   banner(`\u2713 ready`, "green");
   stdout.write("\n");
@@ -3518,14 +3665,16 @@ async function startTunnel(options) {
   const stop = async () => {
     if (stopped) return;
     stopped = true;
+    if (signalHandler) process.off("SIGINT", signalHandler);
     tunnel.close();
     banner(`stopped \u2014 proxied ${requests} request${requests === 1 ? "" : "s"}`, "cyan");
     resolveDone();
   };
   if (process.stdin.isTTY) {
-    process.on("SIGINT", () => {
+    signalHandler = () => {
       void stop();
-    });
+    };
+    process.on("SIGINT", signalHandler);
   }
   return {
     url: tunnel.url,
@@ -3596,16 +3745,20 @@ async function indexSources(rag, config, cwd) {
     }
   }
   const documents = await Promise.all(
-    absolutePaths.map(async (path5) => ({
-      id: path5,
-      content: await readFile(path5, "utf8"),
-      source: path5
+    absolutePaths.map(async (path6) => ({
+      id: path6,
+      content: await readFile(path6, "utf8"),
+      source: path6
     }))
   );
   if (documents.length > 0) await rag.ingest(documents);
   return { documentCount: documents.length, sources: absolutePaths };
 }
 
+// package.json
+var package_default = {
+  version: "0.13.39"};
+
 // src/commands/shared.ts
 function mergeWithConfig(options, config) {
   if (!config) return options;
@@ -3631,7 +3784,7 @@ function registerChatCommand(program) {
     "Extra directory to auto-discover plugin modules from (repeatable)",
     (value, prev = []) => [...prev, value],
     []
-  ).option(
+  ).option("--discover-plugins", "Also auto-discover plugins from ~/.agentskit/plugins").option(
     "--mode <mode>",
     "Permission mode: default | plan | acceptEdits | bypassPermissions"
   ).action(async (options) => {
@@ -3668,7 +3821,8 @@ function registerChatCommand(program) {
     }
     const pluginBundle = await loadPlugins({
       specs: config?.plugins ?? [],
-      pluginDirs: options.pluginDir ?? []
+      pluginDirs: options.pluginDir ?? [],
+      autoDiscoverUserDir: Boolean(options.discoverPlugins)
     });
     const configHooks = configHooksToHandlers(config?.hooks);
     const hookHandlers = [...configHooks, ...pluginBundle.hooks];
@@ -4003,7 +4157,7 @@ function printNextSteps(options) {
 
 // src/commands/init.ts
 function registerInitCommand(program) {
-  program.command("init").description("Generate a starter project. Run with no flags for interactive mode.").option("--template <template>", "Starter template (react|nextjs|sveltekit|nuxt|ink|vite-ink|cloudflare-workers|bun|deno-deploy|expo|angular|runtime|multi-agent)").option("--dir <directory>", "Target directory", "agentskit-app").option("--provider <provider>", "LLM provider (openai|anthropic|gemini|ollama|deepseek|grok|kimi|groq|openrouter|demo)").option("--tools <tools>", "Comma-separated tools (web_search,filesystem,shell)").option("--memory <backend>", "Memory backend (none|file|sqlite)").option("--pm <packageManager>", "Package manager (pnpm|npm|yarn|bun)").option("-y, --yes", "Skip interactive prompts; use flag values + defaults").action(async (rawOptions) => {
+  program.command("init").description("Generate a starter project. Run with no flags for interactive mode.").option("--template <template>", "Starter template (react|nextjs|sveltekit|nuxt|ink|vite-ink|cloudflare-workers|bun|deno-deploy|expo|angular|runtime|multi-agent)").option("--dir <directory>", "Target directory", "agentskit-app").option("--provider <provider>", "LLM provider (openai|anthropic|gemini|ollama|deepseek|grok|kimi|groq|openrouter|demo)").option("--tools <tools>", "Comma-separated tools (web_search,filesystem,shell)").option("--memory <backend>", "Memory backend (none|file|sqlite)").option("--pm <packageManager>", "Package manager (pnpm|npm|yarn|bun)").option("--force", "Overwrite generated files in a non-empty target directory").option("-y, --yes", "Skip interactive prompts; use flag values + defaults").action(async (rawOptions) => {
     const isCi = !process.stdout.isTTY || rawOptions.yes || rawOptions.template;
     let resolved;
     if (isCi) {
@@ -4014,7 +4168,8 @@ function registerInitCommand(program) {
         provider: rawOptions.provider ?? "demo",
         tools: rawOptions.tools ? rawOptions.tools.split(",").map((t) => t.trim()) : [],
         memory: rawOptions.memory ?? "none",
-        packageManager: rawOptions.pm ?? "pnpm"
+        packageManager: rawOptions.pm ?? "pnpm",
+        force: Boolean(rawOptions.force)
       };
     } else {
       const result = await runInteractiveInit({
@@ -4024,17 +4179,22 @@ function registerInitCommand(program) {
       if (result.cancelled) {
         process.exit(0);
       }
-      resolved = result.options;
+      resolved = { ...result.options, force: Boolean(rawOptions.force) };
     }
-    await writeStarterProject(resolved);
+    const overwritten = await writeStarterProject2(resolved) ?? [];
     if (isCi) {
       process.stdout.write(
         `Created ${resolved.template} starter in ${path.relative(process.cwd(), resolved.targetDir) || "."}
-\u2605 Star AgentsKit (solo-built \u2014 it helps a lot): https://github.com/AgentsKit-io/agentskit
+` + (overwritten.length > 0 ? `Overwritten: ${overwritten.join(", ")}
+` : "") + `\u2605 Star AgentsKit (solo-built \u2014 it helps a lot): https://github.com/AgentsKit-io/agentskit
 `
       );
     } else {
       printNextSteps(resolved);
+      if (overwritten.length > 0) {
+        process.stdout.write(`Overwritten: ${overwritten.join(", ")}
+`);
+      }
     }
   });
 }
@@ -4090,7 +4250,7 @@ function registerConfigCommand(program) {
     const targetPath = isLocal ? path.join(process.cwd(), ".agentskit.config.json") : path.join(homedir(), ".agentskit", "config.json");
     if (action === "show") {
       const config = await loadConfig();
-      process.stdout.write(JSON.stringify(config ?? {}, null, 2) + "\n");
+      process.stdout.write(JSON.stringify(redactConfig(config ?? {}), null, 2) + "\n");
       return;
     }
     if (action !== "init") {
@@ -4284,7 +4444,7 @@ function scaffoldAgent(schema) {
   return files;
 }
 async function writeScaffold(files, outDir, opts = {}) {
-  const { writeFile: writeFile5, mkdir: mkdir5, access } = await import('fs/promises');
+  const { writeFile: writeFile5, mkdir: mkdir5, access: access2 } = await import('fs/promises');
   const { dirname: dirname5, join: join11 } = await import('path');
   const written = [];
   for (const f of files) {
@@ -4292,7 +4452,7 @@ async function writeScaffold(files, outDir, opts = {}) {
     await mkdir5(dirname5(full), { recursive: true });
     if (!opts.overwrite) {
       try {
-        await access(full);
+        await access2(full);
         continue;
       } catch {
       }
@@ -4768,66 +4928,66 @@ After writing, summarise which files landed and what each one does.
 // src/rules.ts
 var CODEX_BLOCK_START = "<!-- agentskit-codex-profile:start -->";
 var CODEX_BLOCK_END = "<!-- agentskit-codex-profile:end -->";
-async function ensureDir2(path5) {
-  await mkdir(dirname(path5), { recursive: true });
+async function ensureDir2(path6) {
+  await mkdir(dirname(path6), { recursive: true });
 }
 async function writeIfChanged(absPath, contents, force) {
-  let existing;
+  let existing2;
   try {
-    existing = await readFile(absPath, "utf8");
+    existing2 = await readFile(absPath, "utf8");
   } catch {
   }
-  if (existing === contents) return "skipped";
-  if (existing !== void 0 && !force) {
+  if (existing2 === contents) return "skipped";
+  if (existing2 !== void 0 && !force) {
     return "skipped";
   }
   await ensureDir2(absPath);
   await writeFile(absPath, contents, "utf8");
-  return existing === void 0 ? "wrote" : "updated";
+  return existing2 === void 0 ? "wrote" : "updated";
 }
 async function writeCursor(rootDir, force) {
-  const path5 = join(rootDir, ".cursor", "rules", "agentskit.mdc");
-  const action = await writeIfChanged(path5, CURSOR_RULE, force);
-  return [{ path: path5, action }];
+  const path6 = join(rootDir, ".cursor", "rules", "agentskit.mdc");
+  const action = await writeIfChanged(path6, CURSOR_RULE, force);
+  return [{ path: path6, action }];
 }
 async function writeWindsurf(rootDir, force) {
-  const path5 = join(rootDir, ".windsurfrules");
-  const action = await writeIfChanged(path5, WINDSURF_RULE, force);
-  return [{ path: path5, action }];
+  const path6 = join(rootDir, ".windsurfrules");
+  const action = await writeIfChanged(path6, WINDSURF_RULE, force);
+  return [{ path: path6, action }];
 }
 async function writeCodex(rootDir, force) {
-  const path5 = join(rootDir, "AGENTS.md");
-  let existing = "";
+  const path6 = join(rootDir, "AGENTS.md");
+  let existing2 = "";
   try {
-    existing = await readFile(path5, "utf8");
+    existing2 = await readFile(path6, "utf8");
   } catch {
   }
-  const startIdx = existing.indexOf(CODEX_BLOCK_START);
-  const endIdx = startIdx >= 0 ? existing.lastIndexOf(CODEX_BLOCK_END, existing.length) : -1;
+  const startIdx = existing2.indexOf(CODEX_BLOCK_START);
+  const endIdx = startIdx >= 0 ? existing2.lastIndexOf(CODEX_BLOCK_END, existing2.length) : -1;
   if (startIdx >= 0 && endIdx <= startIdx) {
     throw new ConfigError({
       code: ErrorCodes.AK_CONFIG_INVALID,
-      message: `${path5}: found agentskit-codex-profile:start sentinel but no matching :end after it \u2014 refusing to modify a half-edited block.`,
+      message: `${path6}: found agentskit-codex-profile:start sentinel but no matching :end after it \u2014 refusing to modify a half-edited block.`,
       hint: "Restore the closing sentinel or remove the partial block, then re-run."
     });
   }
   let next;
   if (startIdx >= 0 && endIdx > startIdx) {
-    next = existing.slice(0, startIdx) + CODEX_PROFILE.trimEnd() + existing.slice(endIdx + CODEX_BLOCK_END.length);
-  } else if (existing) {
-    next = `${existing.replace(/\s+$/, "")}
+    next = existing2.slice(0, startIdx) + CODEX_PROFILE.trimEnd() + existing2.slice(endIdx + CODEX_BLOCK_END.length);
+  } else if (existing2) {
+    next = `${existing2.replace(/\s+$/, "")}
 
 ${CODEX_PROFILE}`;
   } else {
     next = CODEX_PROFILE;
   }
-  if (next === existing) return [{ path: path5, action: "skipped" }];
-  if (existing && !force) {
-    return [{ path: path5, action: "skipped" }];
+  if (next === existing2) return [{ path: path6, action: "skipped" }];
+  if (existing2 && !force) {
+    return [{ path: path6, action: "skipped" }];
   }
-  await ensureDir2(path5);
-  await writeFile(path5, next, "utf8");
-  return [{ path: path5, action: existing ? "updated" : "wrote" }];
+  await ensureDir2(path6);
+  await writeFile(path6, next, "utf8");
+  return [{ path: path6, action: existing2 ? "updated" : "wrote" }];
 }
 async function writeClaudeCode(rootDir, force) {
   const out = [];
@@ -4915,17 +5075,78 @@ rules failed: ${message}
 }
 var RAW_BASE = "https://raw.githubusercontent.com/AgentsKit-io/agentskit-registry/main";
 var HOSTED_BASE = `${RAW_BASE}/public/r`;
+var FETCH_TIMEOUT_MS = 15e3;
+var MAX_RESPONSE_BYTES = 2 * 1024 * 1024;
+var MAX_AGENT_FILES = 100;
+var SAFE_ID = /^[a-z0-9]+(?:-[a-z0-9]+)*$/;
+function assertSafeId(id) {
+  if (!SAFE_ID.test(id)) throw new Error(`Invalid registry agent id: ${JSON.stringify(id)}`);
+}
+function assertSafeRelativePath(filePath) {
+  if (!filePath || isAbsolute(filePath) || filePath.includes("\0")) {
+    throw new Error(`Invalid registry file path: ${JSON.stringify(filePath)}`);
+  }
+  const normalized = filePath.replace(/\\/g, "/");
+  if (normalized.split("/").some((part) => part === ".." || part === "")) {
+    throw new Error(`Registry file path must stay relative: ${JSON.stringify(filePath)}`);
+  }
+}
+function assertInside(parent, child) {
+  const rel = relative(resolve(parent), resolve(child));
+  if (rel === ".." || rel.startsWith(`..${sep}`) || isAbsolute(rel)) {
+    throw new Error(`Registry destination escapes target directory: ${child}`);
+  }
+}
+async function assertNoSymlinkAncestors(targetDir, baseDir) {
+  for (const path6 of [targetDir, baseDir]) {
+    try {
+      if ((await lstat(resolve(path6))).isSymbolicLink()) {
+        throw new Error(`Registry destination contains a symlink ancestor: ${resolve(path6)}`);
+      }
+    } catch (error) {
+      if (error.code !== "ENOENT") throw error;
+    }
+  }
+  let current = resolve(baseDir);
+  while (true) {
+    try {
+      if ((await lstat(current)).isSymbolicLink()) {
+        throw new Error(`Registry destination contains a symlink ancestor: ${current}`);
+      }
+      return;
+    } catch (error) {
+      if (error.code !== "ENOENT") throw error;
+    }
+    const parent = dirname(current);
+    if (parent === current) return;
+    current = parent;
+  }
+}
+async function fetchWithLimits(url, fetchImpl) {
+  const controller = new AbortController();
+  const timer = setTimeout(() => controller.abort(), FETCH_TIMEOUT_MS);
+  try {
+    const response = await fetchImpl(url, { signal: controller.signal });
+    if (!response.ok) throw new Error(`${response.status} ${response.statusText}`);
+    const body = await response.arrayBuffer();
+    if (body.byteLength > MAX_RESPONSE_BYTES) {
+      throw new Error(`Registry response exceeded ${MAX_RESPONSE_BYTES} bytes`);
+    }
+    return new Response(body, { status: response.status, headers: response.headers });
+  } finally {
+    clearTimeout(timer);
+  }
+}
 async function getJson(url, fetchImpl) {
-  const res = await fetchImpl(url);
-  if (!res.ok) throw new Error(`${res.status} ${res.statusText}`);
-  return res.json();
+  const res = await fetchWithLimits(url, fetchImpl);
+  return JSON.parse(await res.text());
 }
 async function getText(url, fetchImpl) {
-  const res = await fetchImpl(url);
-  if (!res.ok) throw new Error(`${res.status} ${res.statusText}`);
+  const res = await fetchWithLimits(url, fetchImpl);
   return res.text();
 }
 async function fetchAgent(id, options = {}) {
+  assertSafeId(id);
   const fetchImpl = options.fetchImpl ?? globalThis.fetch;
   try {
     const hosted = await getJson(`${HOSTED_BASE}/${id}.json`, fetchImpl);
@@ -4933,6 +5154,10 @@ async function fetchAgent(id, options = {}) {
     throw new Error("hosted entry missing sources");
   } catch {
     const meta = await getJson(`${RAW_BASE}/registry/${id}/meta.json`, fetchImpl);
+    if (!Array.isArray(meta.files) || meta.files.length > MAX_AGENT_FILES) {
+      throw new Error(`Registry agent contains too many files (maximum ${MAX_AGENT_FILES})`);
+    }
+    for (const rel of meta.files) assertSafeRelativePath(rel);
     const sources = await Promise.all(
       meta.files.map(async (rel) => ({
         path: rel,
@@ -4949,10 +5174,10 @@ function resolveSystemPrompt(agent) {
   const m = src.match(/systemPrompt:\s*`((?:\\.|[^`\\])*)`/);
   return m ? m[1].replace(/\\`/g, "`").replace(/\\\$\{/g, "${") : null;
 }
-async function defaultExists(path5) {
-  const { access } = await import('fs/promises');
+async function defaultExists(path6) {
+  const { access: access2 } = await import('fs/promises');
   try {
-    await access(path5);
+    await access2(path6);
     return true;
   } catch {
     return false;
@@ -4976,17 +5201,24 @@ async function addAgent(id, options = {}) {
   assertInstallable(agent);
   const baseDir = options.outDir ?? "agents";
   const targetDir = join(baseDir, id);
+  assertInside(baseDir, targetDir);
+  await assertNoSymlinkAncestors(targetDir, baseDir);
   const exists = options.existsImpl ?? defaultExists;
-  const write = options.writeFileImpl ?? (async (path5, content) => {
-    await mkdir(dirname(path5), { recursive: true });
-    await writeFile(path5, content, "utf8");
+  const write = options.writeFileImpl ?? (async (path6, content) => {
+    await mkdir(dirname(path6), { recursive: true });
+    await writeFile(path6, content, "utf8");
   });
   const written = [];
   for (const file of agent.sources) {
+    assertSafeRelativePath(file.path);
     const dest = join(targetDir, file.path);
+    assertInside(targetDir, dest);
     if (!options.force && await exists(dest)) {
       throw new Error(`${dest} already exists (re-run with --force to overwrite)`);
     }
+  }
+  for (const file of agent.sources) {
+    const dest = join(targetDir, file.path);
     await write(dest, file.content);
     written.push(dest);
   }
@@ -5049,8 +5281,8 @@ function allDeps(pkg) {
   if (!pkg) return {};
   return { ...pkg.peerDependencies, ...pkg.devDependencies, ...pkg.dependencies };
 }
-function readJson(fs, path5) {
-  const raw = fs.readFile(path5);
+function readJson(fs, path6) {
+  const raw = fs.readFile(path6);
   if (raw == null) return null;
   try {
     return JSON.parse(raw);
@@ -5234,13 +5466,13 @@ function readConfig(io, root = ".") {
   return raw == null ? null : parseConfig(raw);
 }
 function writeConfig(io, config, root = ".") {
-  const path5 = join(root, CONFIG_PATH);
-  io.write(path5, serializeConfig(config));
-  return path5;
+  const path6 = join(root, CONFIG_PATH);
+  io.write(path6, serializeConfig(config));
+  return path6;
 }
 function resolveConfig(io, scan, root = ".") {
-  const existing = readConfig(io, root);
-  if (existing) return { config: existing, fromDisk: true };
+  const existing2 = readConfig(io, root);
+  if (existing2) return { config: existing2, fromDisk: true };
   return { config: buildConfig(scan), fromDisk: false };
 }
 var IntegrityError = class extends Error {
@@ -5325,7 +5557,18 @@ function resolveAuthHeader(base, config, env = {}) {
   const map = config?.registryAuth;
   if (!map) return {};
   for (const [registryBase, envVar] of Object.entries(map)) {
-    if (base.startsWith(registryBase)) {
+    let configured;
+    let target;
+    try {
+      configured = new URL(registryBase);
+      target = new URL(base);
+    } catch {
+      continue;
+    }
+    const configuredPath = configured.pathname.replace(/\/+$/, "") || "/";
+    const targetPath = target.pathname.replace(/\/+$/, "") || "/";
+    const samePathBoundary = configuredPath === "/" || targetPath === configuredPath || targetPath.startsWith(`${configuredPath}/`);
+    if (target.origin === configured.origin && samePathBoundary) {
       const token = env[envVar];
       if (token) return { authorization: `Bearer ${token}` };
     }
@@ -5344,8 +5587,8 @@ function verifyChecksums(files) {
 function manifestUrl(ref) {
   return `${ref.base}/r/${ref.itemId}.json`;
 }
-function fileUrl(ref, path5) {
-  return `${ref.base}/r/${ref.itemId}/${path5}`;
+function fileUrl(ref, path6) {
+  return `${ref.base}/r/${ref.itemId}/${path6}`;
 }
 async function getText2(fetchImpl, url, headers) {
   const res = await fetchImpl(url, { headers });
@@ -5682,44 +5925,44 @@ async function addComponent(options, deps) {
 }
 function nodeScanFs() {
   return {
-    readFile(path5) {
+    readFile(path6) {
       try {
-        return readFileSync(path5, "utf8");
+        return readFileSync(path6, "utf8");
       } catch {
         return null;
       }
     },
-    exists(path5) {
-      return existsSync(path5);
+    exists(path6) {
+      return existsSync(path6);
     }
   };
 }
 function nodeWriteFs() {
   return {
-    exists(path5) {
-      return existsSync(path5);
+    exists(path6) {
+      return existsSync(path6);
     },
-    write(path5, content) {
-      mkdirSync(dirname(path5), { recursive: true });
-      writeFileSync(path5, content, "utf8");
+    write(path6, content) {
+      mkdirSync(dirname(path6), { recursive: true });
+      writeFileSync(path6, content, "utf8");
     },
-    remove(path5) {
-      rmSync(path5, { force: true });
+    remove(path6) {
+      rmSync(path6, { force: true });
     }
   };
 }
 function nodeConfigIo() {
   return {
-    read(path5) {
+    read(path6) {
       try {
-        return readFileSync(path5, "utf8");
+        return readFileSync(path6, "utf8");
       } catch {
         return null;
       }
     },
-    write(path5, content) {
-      mkdirSync(dirname(path5), { recursive: true });
-      writeFileSync(path5, content, "utf8");
+    write(path6, content) {
+      mkdirSync(dirname(path6), { recursive: true });
+      writeFileSync(path6, content, "utf8");
     }
   };
 }
@@ -5939,7 +6182,7 @@ update failed: ${err instanceof Error ? err.message : String(err)}
 // src/commands/index.ts
 function createCli() {
   const program = new Command();
-  program.name("agentskit").description("AgentsKit CLI for chat demos and project bootstrapping.");
+  program.name("agentskit").description("AgentsKit CLI for chat demos and project bootstrapping.").version(package_default.version);
   registerChatCommand(program);
   registerRunCommand(program);
   registerInitCommand(program);
@@ -5958,6 +6201,6 @@ function createCli() {
   return program;
 }
 
-export { ChatApp, HookDispatcher, McpClient, applyPolicyToTool, applyPolicyToTools, bridgeMcpServers, buildRagFromConfig, computeCost, configHooksToHandlers, createCli, createOpenAiEmbedder, defaultPolicy, derivePreview, disposeMcpClients, evaluatePolicy, findLatestSession, findSession, forkSession, generateSessionId, getPricing, indexSources, listSessions, loadConfig, loadPlugins, mergePluginsIntoBundle, registerPricing, renameSession, renderChatHeader, renderReport, resolveChatProvider, resolveSession, runAgent, runDoctor, sessionFilePath, startDev, startTunnel, writeSessionMeta, writeStarterProject };
-//# sourceMappingURL=chunk-DZKCRKFS.js.map
-//# sourceMappingURL=chunk-DZKCRKFS.js.map
+export { ChatApp, HookDispatcher, McpClient, applyPolicyToTool, applyPolicyToTools, bridgeMcpServers, buildRagFromConfig, computeCost, configHooksToHandlers, createCli, createOpenAiEmbedder, defaultPolicy, derivePreview, disposeMcpClients, evaluatePolicy, findLatestSession, findSession, forkSession, generateSessionId, getPricing, indexSources, listSessions, loadConfig, loadPlugins, mergePluginsIntoBundle, registerPricing, renameSession, renderChatHeader, renderReport, resolveChatProvider, resolveSession, runAgent, runDoctor, sessionFilePath, startDev, startTunnel, writeSessionMeta, writeStarterProject2 as writeStarterProject };
+//# sourceMappingURL=chunk-AL4GKGCU.js.map
+//# sourceMappingURL=chunk-AL4GKGCU.js.map