@agentskit/cli 0.13.37 → 0.13.40

package/dist/index.cjs

@@ -21,6 +21,7 @@ var url = require('url');
 var runtime = require('@agentskit/runtime');
 var prompts = require('@inquirer/prompts');
 var kleur = require('kleur');
+var module$1 = require('module');
 var chokidar = require('chokidar');
 var rag = require('@agentskit/rag');
 var agentSchema = require('@agentskit/core/agent-schema');
@@ -28,6 +29,7 @@ var yaml = require('yaml');
 var security = require('@agentskit/core/security');
 var core = require('@agentskit/core');
 
+var _documentCurrentScript = typeof document !== 'undefined' ? document.currentScript : null;
 function _interopDefault (e) { return e && e.__esModule ? e : { default: e }; }
 
 var React2__default = /*#__PURE__*/_interopDefault(React2);
@@ -35,20 +37,30 @@ var path__default = /*#__PURE__*/_interopDefault(path);
 var kleur__default = /*#__PURE__*/_interopDefault(kleur);
 var chokidar__default = /*#__PURE__*/_interopDefault(chokidar);
 
-async function loadJsonConfig(path5) {
+// package.json
+var package_default = {
+  version: "0.13.40"};
+async function loadJsonConfig(path6) {
   try {
-    const raw = await promises.readFile(path5, "utf8");
+    const raw = await promises.readFile(path6, "utf8");
     return JSON.parse(raw);
-  } catch {
-    return void 0;
+  } catch (err) {
+    if (err.code === "ENOENT") return void 0;
+    throw new Error(`Failed to load JSON config ${path6}: ${err instanceof Error ? err.message : String(err)}`);
   }
 }
-async function loadTsConfig(path5) {
+async function loadTsConfig(path6) {
+  try {
+    await promises.access(path6);
+  } catch (err) {
+    if (err.code === "ENOENT") return void 0;
+    throw err;
+  }
   try {
-    const mod = await import(path5);
+    const mod = await import(`${path6}?agentskit_config=${Date.now()}`);
     return mod.default ?? mod;
-  } catch {
-    return void 0;
+  } catch (err) {
+    throw new Error(`Failed to load TypeScript config ${path6}: ${err instanceof Error ? err.message : String(err)}`);
   }
 }
 async function loadPackageJsonConfig(dir) {
@@ -59,29 +71,31 @@ async function loadPackageJsonConfig(dir) {
       return pkg.agentskit;
     }
     return void 0;
-  } catch {
-    return void 0;
+  } catch (err) {
+    if (err.code === "ENOENT") return void 0;
+    throw new Error(`Failed to load package.json config ${dir}: ${err instanceof Error ? err.message : String(err)}`);
   }
 }
 function mergeConfigs(base, override) {
   if (!base && !override) return void 0;
   if (!base) return override;
   if (!override) return base;
-  return {
-    ...base,
-    ...override,
-    tools: { ...base.tools, ...override.tools },
-    defaults: { ...base.defaults, ...override.defaults },
-    runtime: { ...base.runtime, ...override.runtime },
-    observability: { ...base.observability, ...override.observability }
+  const merge = (left, right) => {
+    if (!left || typeof left !== "object" || Array.isArray(left)) return right;
+    if (!right || typeof right !== "object" || Array.isArray(right)) return right;
+    const out = { ...left };
+    for (const [key, value] of Object.entries(right)) {
+      out[key] = key in out ? merge(out[key], value) : value;
+    }
+    return out;
   };
+  return merge(base, override);
 }
 async function loadLocalConfig(cwd) {
   const tsConfig = await loadTsConfig(path.join(cwd, ".agentskit.config.ts"));
-  if (tsConfig) return tsConfig;
   const jsonConfig = await loadJsonConfig(path.join(cwd, ".agentskit.config.json"));
-  if (jsonConfig) return jsonConfig;
-  return await loadPackageJsonConfig(cwd);
+  const packageConfig = await loadPackageJsonConfig(cwd);
+  return mergeConfigs(mergeConfigs(packageConfig, jsonConfig), tsConfig);
 }
 async function loadGlobalConfig(home) {
   if (home === null) return void 0;
@@ -96,6 +110,21 @@ async function loadConfig(options) {
   const local = await loadLocalConfig(cwd);
   return mergeConfigs(global, local);
 }
+var SECRET_KEY = /^(api[-_]?key|token|secret|password|authorization|private[-_]?key)$/i;
+var SECRET_ENV_KEY = /(?:^|_)(?:api_?key|token|secret|password|authorization|private_?key)$/i;
+function isSecretKey(key) {
+  return SECRET_KEY.test(key) || SECRET_ENV_KEY.test(key);
+}
+function redactConfig(value) {
+  if (Array.isArray(value)) return value.map(redactConfig);
+  if (!value || typeof value !== "object") return value;
+  return Object.fromEntries(
+    Object.entries(value).map(([key, child]) => [
+      key,
+      isSecretKey(key) ? "[REDACTED]" : redactConfig(child)
+    ])
+  );
+}
 var providers = {
   openai: {
     label: "OpenAI",
@@ -167,7 +196,7 @@ function createDemoAdapter(provider, model) {
           ].join(" ");
           for (const chunk of reply.match(/.{1,18}/g) ?? []) {
             if (cancelled) return;
-            await new Promise((resolve7) => setTimeout(resolve7, 35));
+            await new Promise((resolve8) => setTimeout(resolve8, 35));
             yield { type: "text", content: chunk };
           }
           yield { type: "done" };
@@ -227,7 +256,8 @@ function dirFor(cwd = process.cwd()) {
   return path.join(ROOT, cwdHash(cwd));
 }
 function ensureDir(dir) {
-  if (!fs.existsSync(dir)) fs.mkdirSync(dir, { recursive: true });
+  if (!fs.existsSync(dir)) fs.mkdirSync(dir, { recursive: true, mode: 448 });
+  fs.chmodSync(dir, 448);
 }
 function generateSessionId() {
   const ts = (/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-").slice(0, 19);
@@ -242,17 +272,19 @@ function metaPath(id, cwd = process.cwd()) {
   return path.join(dirFor(cwd), `${id}${META_SUFFIX}`);
 }
 function readMeta(id, cwd = process.cwd()) {
-  const path5 = metaPath(id, cwd);
-  if (!fs.existsSync(path5)) return null;
+  const path6 = metaPath(id, cwd);
+  if (!fs.existsSync(path6)) return null;
   try {
-    return JSON.parse(fs.readFileSync(path5, "utf8"));
+    return JSON.parse(fs.readFileSync(path6, "utf8"));
   } catch {
     return null;
   }
 }
 function writeSessionMeta(meta, cwd = process.cwd()) {
   ensureDir(dirFor(cwd));
-  fs.writeFileSync(metaPath(meta.id, cwd), JSON.stringify(meta, null, 2));
+  const path6 = metaPath(meta.id, cwd);
+  fs.writeFileSync(path6, JSON.stringify(meta, null, 2), { mode: 384 });
+  fs.chmodSync(path6, 384);
 }
 function derivePreview(messages) {
   const firstUser = messages.find((m) => m.role === "user" && m.content.trim());
@@ -861,7 +893,7 @@ var HookDispatcher = class {
         result = await handler.run(current);
       } catch (err) {
         this.onError(handler, err);
-        continue;
+        return { payload: current, blocked: true, reason: "hook failed" };
       }
       if (result.decision === "block") {
         return { payload: current, blocked: true, reason: result.reason };
@@ -878,6 +910,7 @@ var HookDispatcher = class {
     return handler.matcher.test(String(payload.tool ?? payload.prompt ?? ""));
   }
 };
+var MAX_HOOK_STDOUT_BYTES = 64 * 1024;
 function configHooksToHandlers(config) {
   if (!config) return [];
   const handlers = [];
@@ -907,8 +940,26 @@ function runShellHook(entry, payload) {
       detached: true
     });
     let stdout = "";
+    let stdoutBytes = 0;
     child.stdout.on("data", (chunk) => {
-      stdout += chunk.toString();
+      const text = chunk.toString();
+      const bytes = Buffer.byteLength(text);
+      if (stdoutBytes + bytes > MAX_HOOK_STDOUT_BYTES) {
+        if (child.pid !== void 0) {
+          try {
+            process.kill(-child.pid, "SIGKILL");
+          } catch {
+          }
+        }
+        try {
+          child.kill("SIGKILL");
+        } catch {
+        }
+        settle({ decision: "block", reason: `shell hook output exceeded ${MAX_HOOK_STDOUT_BYTES} bytes` });
+        return;
+      }
+      stdoutBytes += bytes;
+      stdout += text;
     });
     const timer = setTimeout(() => {
       if (child.pid !== void 0) {
@@ -940,9 +991,13 @@ function runShellHook(entry, payload) {
       }
       try {
         const parsed = JSON.parse(trimmed);
-        settle(parsed);
+        if (!parsed || typeof parsed !== "object" || !("decision" in parsed) || !["continue", "block", "modify"].includes(String(parsed.decision))) {
+          settle({ decision: "block", reason: "shell hook returned an invalid decision" });
+        } else {
+          settle(parsed);
+        }
       } catch {
-        settle({ decision: "continue" });
+        settle({ decision: "block", reason: "shell hook returned invalid JSON" });
       }
     });
     child.on("error", (err) => {
@@ -989,8 +1044,9 @@ function ChatApp(options) {
   } = useRuntime(options);
   const mergedTools = React2.useMemo(() => {
     const extra = options.extraTools ?? [];
-    return [...tools, ...extra];
-  }, [tools, options.extraTools]);
+    const combined = [...tools, ...extra];
+    return options.permissionPolicy ? applyPolicyToTools(options.permissionPolicy, combined) : combined;
+  }, [tools, options.extraTools, options.permissionPolicy]);
   const mergedSkills = React2.useMemo(() => {
     const extra = options.extraSkills ?? [];
     if (!skills && extra.length === 0) return void 0;
@@ -1202,7 +1258,7 @@ async function loadPlugins(options = {}) {
     specs = [],
     pluginDirs = [],
     cwd = process.cwd(),
-    autoDiscoverUserDir = true,
+    autoDiscoverUserDir = false,
     onError = (spec, err) => process.stderr.write(
       `[agentskit] plugin "${spec}" failed to load: ${err instanceof Error ? err.message : String(err)}
 `
@@ -1293,6 +1349,8 @@ function mergePluginsIntoBundle(plugins) {
   }
   return bundle;
 }
+var MAX_FRAME_BYTES = 1024 * 1024;
+var DISPOSE_GRACE_MS = 1e3;
 var McpClient = class {
   constructor(spec, onError = (err) => process.stderr.write(
     `[agentskit] mcp[${spec.name}] error: ${err instanceof Error ? err.message : String(err)}
@@ -1309,7 +1367,8 @@ var McpClient = class {
     if (this.child) return;
     const child = child_process.spawn(this.spec.command, this.spec.args ?? [], {
       env: { ...process.env, ...this.spec.env ?? {} },
-      stdio: ["pipe", "pipe", "pipe"]
+      stdio: ["pipe", "pipe", "pipe"],
+      detached: process.platform !== "win32"
     });
     this.child = child;
     child.stdout.on("data", (chunk) => this.onStdout(chunk.toString()));
@@ -1341,7 +1400,22 @@ var McpClient = class {
   dispose() {
     if (this.disposed) return;
     this.disposed = true;
-    this.child?.kill("SIGTERM");
+    for (const pending of this.pending.values()) {
+      pending({ jsonrpc: "2.0", id: 0, error: { code: -32800, message: "client disposed" } });
+    }
+    this.pending.clear();
+    const child = this.child;
+    if (!child || child.killed) return;
+    const kill = (signal) => {
+      try {
+        if (process.platform !== "win32" && child.pid) process.kill(-child.pid, signal);
+        else child.kill(signal);
+      } catch {
+      }
+    };
+    kill("SIGTERM");
+    const timer = setTimeout(() => kill("SIGKILL"), DISPOSE_GRACE_MS);
+    timer.unref();
   }
   request(method, params) {
     return new Promise((resolvePromise, rejectPromise) => {
@@ -1369,10 +1443,20 @@ var McpClient = class {
   }
   onStdout(chunk) {
     this.buffer += chunk;
+    if (Buffer.byteLength(this.buffer, "utf8") > MAX_FRAME_BYTES && !this.buffer.includes("\n")) {
+      this.onError(new Error(`mcp ${this.spec.name} frame exceeded ${MAX_FRAME_BYTES} bytes`));
+      this.dispose();
+      return;
+    }
     let newlineIndex = this.buffer.indexOf("\n");
     while (newlineIndex !== -1) {
       const line = this.buffer.slice(0, newlineIndex).trim();
       this.buffer = this.buffer.slice(newlineIndex + 1);
+      if (Buffer.byteLength(line, "utf8") > MAX_FRAME_BYTES) {
+        this.onError(new Error(`mcp ${this.spec.name} frame exceeded ${MAX_FRAME_BYTES} bytes`));
+        this.dispose();
+        return;
+      }
       if (line) {
         try {
           const parsed = JSON.parse(line);
@@ -1434,7 +1518,7 @@ function registerChatCommand(program) {
     "Extra directory to auto-discover plugin modules from (repeatable)",
     (value, prev = []) => [...prev, value],
     []
-  ).option(
+  ).option("--discover-plugins", "Also auto-discover plugins from ~/.agentskit/plugins").option(
     "--mode <mode>",
     "Permission mode: default | plan | acceptEdits | bypassPermissions"
   ).action(async (options) => {
@@ -1471,7 +1555,8 @@ function registerChatCommand(program) {
     }
     const pluginBundle = await loadPlugins({
       specs: config?.plugins ?? [],
-      pluginDirs: options.pluginDir ?? []
+      pluginDirs: options.pluginDir ?? [],
+      autoDiscoverUserDir: Boolean(options.discoverPlugins)
     });
     const configHooks = configHooksToHandlers(config?.hooks);
     const hookHandlers = [...configHooks, ...pluginBundle.hooks];
@@ -1559,8 +1644,7 @@ function formatEvent(event) {
 }
 async function runAgent(task, options) {
   if (options.skill && options.skills) {
-    process.stderr.write("Error: --skill and --skills are mutually exclusive. Use one or the other.\n");
-    process.exit(1);
+    throw new Error("--skill and --skills are mutually exclusive. Use one or the other.");
   }
   const { adapter } = resolveChatProvider({
     provider: options.provider,
@@ -1752,6 +1836,69 @@ var PROVIDER_ENV_KEY = {
   openrouter: "OPENROUTER_API_KEY",
   demo: null
 };
+var PACKAGE_RANGES = {
+  "@agentskit/adapters": "^0.15.2",
+  "@agentskit/angular": "^0.5.3",
+  "@agentskit/ink": "^0.10.9",
+  "@agentskit/memory": "^0.11.8",
+  "@agentskit/react": "^0.8.3",
+  "@agentskit/runtime": "^0.10.15",
+  "@agentskit/skills": "^0.9.3",
+  "@agentskit/svelte": "^0.5.3",
+  "@agentskit/tools": "^0.13.6",
+  "@agentskit/vue": "^0.5.3"
+};
+function align(files) {
+  const result = { ...files };
+  for (const file of ["package.json", "deno.json"]) {
+    if (!files[file]) continue;
+    const parsed = JSON.parse(files[file]);
+    const sections = file === "package.json" ? ["dependencies", "devDependencies", "peerDependencies"] : ["imports"];
+    for (const sectionName of sections) {
+      const section = parsed[sectionName];
+      if (!section || typeof section !== "object" || Array.isArray(section)) continue;
+      for (const [name, range] of Object.entries(PACKAGE_RANGES)) if (name in section) {
+        section[name] = file === "deno.json" ? `npm:${name}@${range}` : range;
+      }
+    }
+    result[file] = `${JSON.stringify(parsed, null, 2)}
+`;
+  }
+  return result;
+}
+async function existing(filePath) {
+  try {
+    return await promises.lstat(filePath);
+  } catch (error) {
+    if (error.code === "ENOENT") return void 0;
+    throw error;
+  }
+}
+async function writeStarterProject(options, renderers) {
+  const ctx = { template: options.template, provider: options.provider ?? "demo", tools: options.tools ?? [], memory: options.memory ?? "none", pm: options.packageManager ?? "pnpm" };
+  const files = align(renderers[ctx.template](ctx));
+  await promises.mkdir(options.targetDir, { recursive: true });
+  const target = await promises.lstat(options.targetDir);
+  if (target.isSymbolicLink() || !target.isDirectory()) throw new Error(`Refusing to write starter into non-directory target: ${options.targetDir}`);
+  if ((await promises.readdir(options.targetDir)).length > 0 && !options.force) throw new Error(`Target directory is not empty: ${options.targetDir} (re-run with --force to overwrite generated files)`);
+  const overwritten = [];
+  for (const [relativePath, content] of Object.entries(files)) {
+    const absolutePath = path__default.default.join(options.targetDir, relativePath);
+    await promises.mkdir(path__default.default.dirname(absolutePath), { recursive: true });
+    const destination = await existing(absolutePath);
+    if (destination?.isSymbolicLink()) throw new Error(`Refusing to overwrite symlink: ${absolutePath}`);
+    if (destination) overwritten.push(relativePath);
+    const tempDir = await promises.mkdtemp(path__default.default.join(path__default.default.dirname(absolutePath), `.agentskit-init-${crypto.randomUUID()}-`));
+    try {
+      await promises.writeFile(path__default.default.join(tempDir, path__default.default.basename(absolutePath)), content, "utf8");
+      await promises.rename(path__default.default.join(tempDir, path__default.default.basename(absolutePath)), absolutePath);
+    } finally {
+      await promises.rm(tempDir, { recursive: true, force: true }).catch(() => {
+      });
+    }
+  }
+  return overwritten;
+}
 
 // src/init.ts
 function adapterCall(provider, prefix = "process.env") {
@@ -3137,23 +3284,8 @@ var TEMPLATE_FN = {
   "deno-deploy": denoDeployStarter,
   angular: angularStarter
 };
-async function writeStarterProject(options) {
-  const ctx = {
-    template: options.template,
-    provider: options.provider ?? "demo",
-    tools: options.tools ?? [],
-    memory: options.memory ?? "none",
-    pm: options.packageManager ?? "pnpm"
-  };
-  const files = TEMPLATE_FN[ctx.template](ctx);
-  await promises.mkdir(options.targetDir, { recursive: true });
-  await Promise.all(
-    Object.entries(files).map(async ([relativePath, content]) => {
-      const absolutePath = path__default.default.join(options.targetDir, relativePath);
-      await promises.mkdir(path__default.default.dirname(absolutePath), { recursive: true });
-      await promises.writeFile(absolutePath, content, "utf8");
-    })
-  );
+async function writeStarterProject2(options) {
+  return writeStarterProject(options, TEMPLATE_FN);
 }
 async function runInteractiveInit(defaults = {}) {
   process.stdout.write(`
@@ -3302,7 +3434,7 @@ function printNextSteps(options) {
 
 // src/commands/init.ts
 function registerInitCommand(program) {
-  program.command("init").description("Generate a starter project. Run with no flags for interactive mode.").option("--template <template>", "Starter template (react|nextjs|sveltekit|nuxt|ink|vite-ink|cloudflare-workers|bun|deno-deploy|expo|angular|runtime|multi-agent)").option("--dir <directory>", "Target directory", "agentskit-app").option("--provider <provider>", "LLM provider (openai|anthropic|gemini|ollama|deepseek|grok|kimi|groq|openrouter|demo)").option("--tools <tools>", "Comma-separated tools (web_search,filesystem,shell)").option("--memory <backend>", "Memory backend (none|file|sqlite)").option("--pm <packageManager>", "Package manager (pnpm|npm|yarn|bun)").option("-y, --yes", "Skip interactive prompts; use flag values + defaults").action(async (rawOptions) => {
+  program.command("init").description("Generate a starter project. Run with no flags for interactive mode.").option("--template <template>", "Starter template (react|nextjs|sveltekit|nuxt|ink|vite-ink|cloudflare-workers|bun|deno-deploy|expo|angular|runtime|multi-agent)").option("--dir <directory>", "Target directory", "agentskit-app").option("--provider <provider>", "LLM provider (openai|anthropic|gemini|ollama|deepseek|grok|kimi|groq|openrouter|demo)").option("--tools <tools>", "Comma-separated tools (web_search,filesystem,shell)").option("--memory <backend>", "Memory backend (none|file|sqlite)").option("--pm <packageManager>", "Package manager (pnpm|npm|yarn|bun)").option("--force", "Overwrite generated files in a non-empty target directory").option("-y, --yes", "Skip interactive prompts; use flag values + defaults").action(async (rawOptions) => {
     const isCi = !process.stdout.isTTY || rawOptions.yes || rawOptions.template;
     let resolved;
     if (isCi) {
@@ -3313,7 +3445,8 @@ function registerInitCommand(program) {
         provider: rawOptions.provider ?? "demo",
         tools: rawOptions.tools ? rawOptions.tools.split(",").map((t) => t.trim()) : [],
         memory: rawOptions.memory ?? "none",
-        packageManager: rawOptions.pm ?? "pnpm"
+        packageManager: rawOptions.pm ?? "pnpm",
+        force: Boolean(rawOptions.force)
       };
     } else {
       const result = await runInteractiveInit({
@@ -3323,17 +3456,22 @@ function registerInitCommand(program) {
       if (result.cancelled) {
         process.exit(0);
       }
-      resolved = result.options;
+      resolved = { ...result.options, force: Boolean(rawOptions.force) };
     }
-    await writeStarterProject(resolved);
+    const overwritten = await writeStarterProject2(resolved) ?? [];
     if (isCi) {
       process.stdout.write(
         `Created ${resolved.template} starter in ${path__default.default.relative(process.cwd(), resolved.targetDir) || "."}
-\u2605 Star AgentsKit (solo-built \u2014 it helps a lot): https://github.com/AgentsKit-io/agentskit
+` + (overwritten.length > 0 ? `Overwritten: ${overwritten.join(", ")}
+` : "") + `\u2605 Star AgentsKit (solo-built \u2014 it helps a lot): https://github.com/AgentsKit-io/agentskit
 `
       );
     } else {
       printNextSteps(resolved);
+      if (overwritten.length > 0) {
+        process.stdout.write(`Overwritten: ${overwritten.join(", ")}
+`);
+      }
     }
   });
 }
@@ -3582,8 +3720,8 @@ async function checkPnpm() {
   };
 }
 async function checkPackageJson() {
-  const path5 = path.join(process.cwd(), "package.json");
-  if (!fs.existsSync(path5)) {
+  const path6 = path.join(process.cwd(), "package.json");
+  if (!fs.existsSync(path6)) {
     return {
       status: "warn",
       name: "package.json",
@@ -3592,7 +3730,7 @@ async function checkPackageJson() {
     };
   }
   try {
-    const pkg = JSON.parse(await promises.readFile(path5, "utf8"));
+    const pkg = JSON.parse(await promises.readFile(path6, "utf8"));
     const deps = {
       ...pkg.dependencies ?? {},
       ...pkg.devDependencies ?? {}
@@ -3825,6 +3963,14 @@ function registerDoctorCommand(program) {
     if (report.fail > 0) process.exit(1);
   });
 }
+var require2 = module$1.createRequire((typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('index.cjs', document.baseURI).href)));
+function resolveTsxCli() {
+  try {
+    return require2.resolve("tsx/cli");
+  } catch {
+    throw new Error("TypeScript execution requires the packaged tsx dependency");
+  }
+}
 var DEFAULT_WATCH = [
   "**/*.ts",
   "**/*.tsx",
@@ -3852,8 +3998,8 @@ function startDev(options) {
   const stderr = options.stderr ?? process.stderr;
   const debounceMs = options.debounceMs ?? 200;
   const isTs = entry.endsWith(".ts") || entry.endsWith(".tsx");
-  const cmd = isTs ? "tsx" : "node";
-  const baseArgs = [entry, ...options.scriptArgs ?? []];
+  const cmd = isTs ? process.execPath : "node";
+  const baseArgs = isTs ? [resolveTsxCli(), entry, ...options.scriptArgs ?? []] : [entry, ...options.scriptArgs ?? []];
   const spawnFn = options.spawn ?? ((c, a) => child_process.spawn(c, a, {
     stdio: ["inherit", "pipe", "pipe"],
     env: { ...process.env, FORCE_COLOR: "1" }
@@ -3865,7 +4011,9 @@ function startDev(options) {
   let child;
   let restartCount = 0;
   let restartTimer;
+  let delayedStartTimer;
   let stopped = false;
+  let stdinListener;
   let resolveDone;
   const done = new Promise((r) => {
     resolveDone = r;
@@ -3891,15 +4039,18 @@ function startDev(options) {
       }
     });
   };
-  const restart = (path5) => {
+  const restart = (path6) => {
     if (restartTimer) clearTimeout(restartTimer);
     restartTimer = setTimeout(() => {
       restartTimer = void 0;
-      banner(`\u21BB change detected \u2014 ${path5}`, "yellow");
+      banner(`\u21BB change detected \u2014 ${path6}`, "yellow");
       if (child && !child.killed && child.exitCode === null) {
         child.kill("SIGTERM");
       }
-      setTimeout(startChild, 80);
+      delayedStartTimer = setTimeout(() => {
+        delayedStartTimer = void 0;
+        if (!stopped) startChild();
+      }, 80);
     }, debounceMs);
   };
   watcher.on("change", restart);
@@ -3910,6 +4061,9 @@ function startDev(options) {
     if (stopped) return;
     stopped = true;
     if (restartTimer) clearTimeout(restartTimer);
+    if (delayedStartTimer) clearTimeout(delayedStartTimer);
+    if (stdinListener) process.stdin.off("data", stdinListener);
+    if (process.stdin.isTTY && process.stdin.setRawMode) process.stdin.setRawMode(false);
     if (child && !child.killed && child.exitCode === null) {
       child.kill("SIGTERM");
     }
@@ -3920,11 +4074,12 @@ function startDev(options) {
   if (process.stdin.isTTY && process.stdin.setRawMode) {
     process.stdin.setRawMode(true);
     process.stdin.resume();
-    process.stdin.on("data", (data) => {
+    stdinListener = (data) => {
       const key = data.toString();
       if (key === "r") restart("manual");
       if (key === "q" || key === "") void stop();
-    });
+    };
+    process.stdin.on("data", stdinListener);
   }
   return {
     done,
@@ -3964,7 +4119,7 @@ function registerConfigCommand(program) {
     const targetPath = isLocal ? path__default.default.join(process.cwd(), ".agentskit.config.json") : path__default.default.join(os.homedir(), ".agentskit", "config.json");
     if (action === "show") {
       const config = await loadConfig();
-      process.stdout.write(JSON.stringify(config ?? {}, null, 2) + "\n");
+      process.stdout.write(JSON.stringify(redactConfig(config ?? {}), null, 2) + "\n");
       return;
     }
     if (action !== "init") {
@@ -4023,6 +4178,7 @@ async function startTunnel(options) {
   });
   let requests = 0;
   let stopped = false;
+  let signalHandler;
   let resolveDone;
   const done = new Promise((r) => {
     resolveDone = r;
@@ -4032,12 +4188,14 @@ async function startTunnel(options) {
   });
   tunnel.on("close", () => {
     if (stopped) return;
+    if (signalHandler) process.off("SIGINT", signalHandler);
     banner(`tunnel closed by remote`, "yellow");
     resolveDone();
   });
   tunnel.on("error", (...args) => {
     const err = args[0];
     banner(`error: ${err?.message ?? "unknown"}`, "red");
+    resolveDone();
   });
   banner(`\u2713 ready`, "green");
   stdout.write("\n");
@@ -4053,14 +4211,16 @@ async function startTunnel(options) {
   const stop = async () => {
     if (stopped) return;
     stopped = true;
+    if (signalHandler) process.off("SIGINT", signalHandler);
     tunnel.close();
     banner(`stopped \u2014 proxied ${requests} request${requests === 1 ? "" : "s"}`, "cyan");
     resolveDone();
   };
   if (process.stdin.isTTY) {
-    process.on("SIGINT", () => {
+    signalHandler = () => {
       void stop();
-    });
+    };
+    process.on("SIGINT", signalHandler);
   }
   return {
     url: tunnel.url,
@@ -4155,10 +4315,10 @@ async function indexSources(rag, config, cwd) {
     }
   }
   const documents = await Promise.all(
-    absolutePaths.map(async (path5) => ({
-      id: path5,
-      content: await promises.readFile(path5, "utf8"),
-      source: path5
+    absolutePaths.map(async (path6) => ({
+      id: path6,
+      content: await promises.readFile(path6, "utf8"),
+      source: path6
     }))
   );
   if (documents.length > 0) await rag.ingest(documents);
@@ -4293,7 +4453,7 @@ function scaffoldAgent(schema) {
   return files;
 }
 async function writeScaffold(files, outDir, opts = {}) {
-  const { writeFile: writeFile5, mkdir: mkdir5, access } = await import('fs/promises');
+  const { writeFile: writeFile5, mkdir: mkdir5, access: access2 } = await import('fs/promises');
   const { dirname: dirname5, join: join11 } = await import('path');
   const written = [];
   for (const f of files) {
@@ -4301,7 +4461,7 @@ async function writeScaffold(files, outDir, opts = {}) {
     await mkdir5(dirname5(full), { recursive: true });
     if (!opts.overwrite) {
       try {
-        await access(full);
+        await access2(full);
         continue;
       } catch {
       }
@@ -4777,66 +4937,66 @@ After writing, summarise which files landed and what each one does.
 // src/rules.ts
 var CODEX_BLOCK_START = "<!-- agentskit-codex-profile:start -->";
 var CODEX_BLOCK_END = "<!-- agentskit-codex-profile:end -->";
-async function ensureDir2(path5) {
-  await promises.mkdir(path.dirname(path5), { recursive: true });
+async function ensureDir2(path6) {
+  await promises.mkdir(path.dirname(path6), { recursive: true });
 }
 async function writeIfChanged(absPath, contents, force) {
-  let existing;
+  let existing2;
   try {
-    existing = await promises.readFile(absPath, "utf8");
+    existing2 = await promises.readFile(absPath, "utf8");
   } catch {
   }
-  if (existing === contents) return "skipped";
-  if (existing !== void 0 && !force) {
+  if (existing2 === contents) return "skipped";
+  if (existing2 !== void 0 && !force) {
     return "skipped";
   }
   await ensureDir2(absPath);
   await promises.writeFile(absPath, contents, "utf8");
-  return existing === void 0 ? "wrote" : "updated";
+  return existing2 === void 0 ? "wrote" : "updated";
 }
 async function writeCursor(rootDir, force) {
-  const path5 = path.join(rootDir, ".cursor", "rules", "agentskit.mdc");
-  const action = await writeIfChanged(path5, CURSOR_RULE, force);
-  return [{ path: path5, action }];
+  const path6 = path.join(rootDir, ".cursor", "rules", "agentskit.mdc");
+  const action = await writeIfChanged(path6, CURSOR_RULE, force);
+  return [{ path: path6, action }];
 }
 async function writeWindsurf(rootDir, force) {
-  const path5 = path.join(rootDir, ".windsurfrules");
-  const action = await writeIfChanged(path5, WINDSURF_RULE, force);
-  return [{ path: path5, action }];
+  const path6 = path.join(rootDir, ".windsurfrules");
+  const action = await writeIfChanged(path6, WINDSURF_RULE, force);
+  return [{ path: path6, action }];
 }
 async function writeCodex(rootDir, force) {
-  const path5 = path.join(rootDir, "AGENTS.md");
-  let existing = "";
+  const path6 = path.join(rootDir, "AGENTS.md");
+  let existing2 = "";
   try {
-    existing = await promises.readFile(path5, "utf8");
+    existing2 = await promises.readFile(path6, "utf8");
   } catch {
   }
-  const startIdx = existing.indexOf(CODEX_BLOCK_START);
-  const endIdx = startIdx >= 0 ? existing.lastIndexOf(CODEX_BLOCK_END, existing.length) : -1;
+  const startIdx = existing2.indexOf(CODEX_BLOCK_START);
+  const endIdx = startIdx >= 0 ? existing2.lastIndexOf(CODEX_BLOCK_END, existing2.length) : -1;
   if (startIdx >= 0 && endIdx <= startIdx) {
     throw new core.ConfigError({
       code: core.ErrorCodes.AK_CONFIG_INVALID,
-      message: `${path5}: found agentskit-codex-profile:start sentinel but no matching :end after it \u2014 refusing to modify a half-edited block.`,
+      message: `${path6}: found agentskit-codex-profile:start sentinel but no matching :end after it \u2014 refusing to modify a half-edited block.`,
       hint: "Restore the closing sentinel or remove the partial block, then re-run."
     });
   }
   let next;
   if (startIdx >= 0 && endIdx > startIdx) {
-    next = existing.slice(0, startIdx) + CODEX_PROFILE.trimEnd() + existing.slice(endIdx + CODEX_BLOCK_END.length);
-  } else if (existing) {
-    next = `${existing.replace(/\s+$/, "")}
+    next = existing2.slice(0, startIdx) + CODEX_PROFILE.trimEnd() + existing2.slice(endIdx + CODEX_BLOCK_END.length);
+  } else if (existing2) {
+    next = `${existing2.replace(/\s+$/, "")}
 
 ${CODEX_PROFILE}`;
   } else {
     next = CODEX_PROFILE;
   }
-  if (next === existing) return [{ path: path5, action: "skipped" }];
-  if (existing && !force) {
-    return [{ path: path5, action: "skipped" }];
+  if (next === existing2) return [{ path: path6, action: "skipped" }];
+  if (existing2 && !force) {
+    return [{ path: path6, action: "skipped" }];
   }
-  await ensureDir2(path5);
-  await promises.writeFile(path5, next, "utf8");
-  return [{ path: path5, action: existing ? "updated" : "wrote" }];
+  await ensureDir2(path6);
+  await promises.writeFile(path6, next, "utf8");
+  return [{ path: path6, action: existing2 ? "updated" : "wrote" }];
 }
 async function writeClaudeCode(rootDir, force) {
   const out = [];
@@ -4924,17 +5084,78 @@ rules failed: ${message}
 }
 var RAW_BASE = "https://raw.githubusercontent.com/AgentsKit-io/agentskit-registry/main";
 var HOSTED_BASE = `${RAW_BASE}/public/r`;
+var FETCH_TIMEOUT_MS = 15e3;
+var MAX_RESPONSE_BYTES = 2 * 1024 * 1024;
+var MAX_AGENT_FILES = 100;
+var SAFE_ID = /^[a-z0-9]+(?:-[a-z0-9]+)*$/;
+function assertSafeId(id) {
+  if (!SAFE_ID.test(id)) throw new Error(`Invalid registry agent id: ${JSON.stringify(id)}`);
+}
+function assertSafeRelativePath(filePath) {
+  if (!filePath || path.isAbsolute(filePath) || filePath.includes("\0")) {
+    throw new Error(`Invalid registry file path: ${JSON.stringify(filePath)}`);
+  }
+  const normalized = filePath.replace(/\\/g, "/");
+  if (normalized.split("/").some((part) => part === ".." || part === "")) {
+    throw new Error(`Registry file path must stay relative: ${JSON.stringify(filePath)}`);
+  }
+}
+function assertInside(parent, child) {
+  const rel = path.relative(path.resolve(parent), path.resolve(child));
+  if (rel === ".." || rel.startsWith(`..${path.sep}`) || path.isAbsolute(rel)) {
+    throw new Error(`Registry destination escapes target directory: ${child}`);
+  }
+}
+async function assertNoSymlinkAncestors(targetDir, baseDir) {
+  for (const path6 of [targetDir, baseDir]) {
+    try {
+      if ((await promises.lstat(path.resolve(path6))).isSymbolicLink()) {
+        throw new Error(`Registry destination contains a symlink ancestor: ${path.resolve(path6)}`);
+      }
+    } catch (error) {
+      if (error.code !== "ENOENT") throw error;
+    }
+  }
+  let current = path.resolve(baseDir);
+  while (true) {
+    try {
+      if ((await promises.lstat(current)).isSymbolicLink()) {
+        throw new Error(`Registry destination contains a symlink ancestor: ${current}`);
+      }
+      return;
+    } catch (error) {
+      if (error.code !== "ENOENT") throw error;
+    }
+    const parent = path.dirname(current);
+    if (parent === current) return;
+    current = parent;
+  }
+}
+async function fetchWithLimits(url, fetchImpl) {
+  const controller = new AbortController();
+  const timer = setTimeout(() => controller.abort(), FETCH_TIMEOUT_MS);
+  try {
+    const response = await fetchImpl(url, { signal: controller.signal });
+    if (!response.ok) throw new Error(`${response.status} ${response.statusText}`);
+    const body = await response.arrayBuffer();
+    if (body.byteLength > MAX_RESPONSE_BYTES) {
+      throw new Error(`Registry response exceeded ${MAX_RESPONSE_BYTES} bytes`);
+    }
+    return new Response(body, { status: response.status, headers: response.headers });
+  } finally {
+    clearTimeout(timer);
+  }
+}
 async function getJson(url, fetchImpl) {
-  const res = await fetchImpl(url);
-  if (!res.ok) throw new Error(`${res.status} ${res.statusText}`);
-  return res.json();
+  const res = await fetchWithLimits(url, fetchImpl);
+  return JSON.parse(await res.text());
 }
 async function getText(url, fetchImpl) {
-  const res = await fetchImpl(url);
-  if (!res.ok) throw new Error(`${res.status} ${res.statusText}`);
+  const res = await fetchWithLimits(url, fetchImpl);
   return res.text();
 }
 async function fetchAgent(id, options = {}) {
+  assertSafeId(id);
   const fetchImpl = options.fetchImpl ?? globalThis.fetch;
   try {
     const hosted = await getJson(`${HOSTED_BASE}/${id}.json`, fetchImpl);
@@ -4942,6 +5163,10 @@ async function fetchAgent(id, options = {}) {
     throw new Error("hosted entry missing sources");
   } catch {
     const meta = await getJson(`${RAW_BASE}/registry/${id}/meta.json`, fetchImpl);
+    if (!Array.isArray(meta.files) || meta.files.length > MAX_AGENT_FILES) {
+      throw new Error(`Registry agent contains too many files (maximum ${MAX_AGENT_FILES})`);
+    }
+    for (const rel of meta.files) assertSafeRelativePath(rel);
     const sources = await Promise.all(
       meta.files.map(async (rel) => ({
         path: rel,
@@ -4958,10 +5183,10 @@ function resolveSystemPrompt(agent) {
   const m = src.match(/systemPrompt:\s*`((?:\\.|[^`\\])*)`/);
   return m ? m[1].replace(/\\`/g, "`").replace(/\\\$\{/g, "${") : null;
 }
-async function defaultExists(path5) {
-  const { access } = await import('fs/promises');
+async function defaultExists(path6) {
+  const { access: access2 } = await import('fs/promises');
   try {
-    await access(path5);
+    await access2(path6);
     return true;
   } catch {
     return false;
@@ -4985,17 +5210,24 @@ async function addAgent(id, options = {}) {
   assertInstallable(agent);
   const baseDir = options.outDir ?? "agents";
   const targetDir = path.join(baseDir, id);
+  assertInside(baseDir, targetDir);
+  await assertNoSymlinkAncestors(targetDir, baseDir);
   const exists = options.existsImpl ?? defaultExists;
-  const write = options.writeFileImpl ?? (async (path5, content) => {
-    await promises.mkdir(path.dirname(path5), { recursive: true });
-    await promises.writeFile(path5, content, "utf8");
+  const write = options.writeFileImpl ?? (async (path6, content) => {
+    await promises.mkdir(path.dirname(path6), { recursive: true });
+    await promises.writeFile(path6, content, "utf8");
   });
   const written = [];
   for (const file of agent.sources) {
+    assertSafeRelativePath(file.path);
     const dest = path.join(targetDir, file.path);
+    assertInside(targetDir, dest);
     if (!options.force && await exists(dest)) {
       throw new Error(`${dest} already exists (re-run with --force to overwrite)`);
     }
+  }
+  for (const file of agent.sources) {
+    const dest = path.join(targetDir, file.path);
     await write(dest, file.content);
     written.push(dest);
   }
@@ -5058,8 +5290,8 @@ function allDeps(pkg) {
   if (!pkg) return {};
   return { ...pkg.peerDependencies, ...pkg.devDependencies, ...pkg.dependencies };
 }
-function readJson(fs, path5) {
-  const raw = fs.readFile(path5);
+function readJson(fs, path6) {
+  const raw = fs.readFile(path6);
   if (raw == null) return null;
   try {
     return JSON.parse(raw);
@@ -5243,13 +5475,13 @@ function readConfig(io, root = ".") {
   return raw == null ? null : parseConfig(raw);
 }
 function writeConfig(io, config, root = ".") {
-  const path5 = path.join(root, CONFIG_PATH);
-  io.write(path5, serializeConfig(config));
-  return path5;
+  const path6 = path.join(root, CONFIG_PATH);
+  io.write(path6, serializeConfig(config));
+  return path6;
 }
 function resolveConfig(io, scan, root = ".") {
-  const existing = readConfig(io, root);
-  if (existing) return { config: existing, fromDisk: true };
+  const existing2 = readConfig(io, root);
+  if (existing2) return { config: existing2, fromDisk: true };
   return { config: buildConfig(scan), fromDisk: false };
 }
 var IntegrityError = class extends Error {
@@ -5334,7 +5566,18 @@ function resolveAuthHeader(base, config, env = {}) {
   const map = config?.registryAuth;
   if (!map) return {};
   for (const [registryBase, envVar] of Object.entries(map)) {
-    if (base.startsWith(registryBase)) {
+    let configured;
+    let target;
+    try {
+      configured = new URL(registryBase);
+      target = new URL(base);
+    } catch {
+      continue;
+    }
+    const configuredPath = configured.pathname.replace(/\/+$/, "") || "/";
+    const targetPath = target.pathname.replace(/\/+$/, "") || "/";
+    const samePathBoundary = configuredPath === "/" || targetPath === configuredPath || targetPath.startsWith(`${configuredPath}/`);
+    if (target.origin === configured.origin && samePathBoundary) {
       const token = env[envVar];
       if (token) return { authorization: `Bearer ${token}` };
     }
@@ -5353,8 +5596,8 @@ function verifyChecksums(files) {
 function manifestUrl(ref) {
   return `${ref.base}/r/${ref.itemId}.json`;
 }
-function fileUrl(ref, path5) {
-  return `${ref.base}/r/${ref.itemId}/${path5}`;
+function fileUrl(ref, path6) {
+  return `${ref.base}/r/${ref.itemId}/${path6}`;
 }
 async function getText2(fetchImpl, url, headers) {
   const res = await fetchImpl(url, { headers });
@@ -5691,44 +5934,44 @@ async function addComponent(options, deps) {
 }
 function nodeScanFs() {
   return {
-    readFile(path5) {
+    readFile(path6) {
       try {
-        return fs.readFileSync(path5, "utf8");
+        return fs.readFileSync(path6, "utf8");
       } catch {
         return null;
       }
     },
-    exists(path5) {
-      return fs.existsSync(path5);
+    exists(path6) {
+      return fs.existsSync(path6);
     }
   };
 }
 function nodeWriteFs() {
   return {
-    exists(path5) {
-      return fs.existsSync(path5);
+    exists(path6) {
+      return fs.existsSync(path6);
     },
-    write(path5, content) {
-      fs.mkdirSync(path.dirname(path5), { recursive: true });
-      fs.writeFileSync(path5, content, "utf8");
+    write(path6, content) {
+      fs.mkdirSync(path.dirname(path6), { recursive: true });
+      fs.writeFileSync(path6, content, "utf8");
     },
-    remove(path5) {
-      fs.rmSync(path5, { force: true });
+    remove(path6) {
+      fs.rmSync(path6, { force: true });
     }
   };
 }
 function nodeConfigIo() {
   return {
-    read(path5) {
+    read(path6) {
       try {
-        return fs.readFileSync(path5, "utf8");
+        return fs.readFileSync(path6, "utf8");
       } catch {
         return null;
       }
     },
-    write(path5, content) {
-      fs.mkdirSync(path.dirname(path5), { recursive: true });
-      fs.writeFileSync(path5, content, "utf8");
+    write(path6, content) {
+      fs.mkdirSync(path.dirname(path6), { recursive: true });
+      fs.writeFileSync(path6, content, "utf8");
     }
   };
 }
@@ -5948,7 +6191,7 @@ update failed: ${err instanceof Error ? err.message : String(err)}
 // src/commands/index.ts
 function createCli() {
   const program = new commander.Command();
-  program.name("agentskit").description("AgentsKit CLI for chat demos and project bootstrapping.");
+  program.name("agentskit").description("AgentsKit CLI for chat demos and project bootstrapping.").version(package_default.version);
   registerChatCommand(program);
   registerRunCommand(program);
   registerInitCommand(program);
@@ -6004,6 +6247,6 @@ exports.sessionFilePath = sessionFilePath;
 exports.startDev = startDev;
 exports.startTunnel = startTunnel;
 exports.writeSessionMeta = writeSessionMeta;
-exports.writeStarterProject = writeStarterProject;
+exports.writeStarterProject = writeStarterProject2;
 //# sourceMappingURL=index.cjs.map
 //# sourceMappingURL=index.cjs.map