@bahulam/code 0.1.23 → 0.1.24

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bahulam/code",
-  "version": "0.1.23",
+  "version": "0.1.24",
   "description": "Bahulam Code — abundance, in your terminal. CLI-first, reliability-first, sub-agents, 65.6% SWE-bench Verified.",
   "type": "module",
   "bin": {

package/src/core/tool-executor.mjs

@@ -152,8 +152,13 @@ export function createToolExecutor({
         return project.resource.root;
     }
 
-    async function commandCwd(args = {}) {
-        return await resolvePath(args.cwd || null, args);
+    async function commandCwd(args = {}, { readOnly = false } = {}) {
+        try {
+            return await resolvePath(args.cwd || null, args);
+        } catch (err) {
+            if (readOnly) return args.cwd ? path.resolve(args.cwd) : process.cwd();
+            throw err;
+        }
     }
 
     function shellTargetPath(cwd, target) {
@@ -1390,7 +1395,7 @@ export function createToolExecutor({
                 args._riskReason = classification.reason || shellCheck.reason;
             }
             args._classification = classification.classification; // 'safe' or 'contained'
-            const cwd = await commandCwd(args);
+            const cwd = await commandCwd(args, { readOnly: classification.classification === 'safe' });
 
             // Background execution: start via the BackgroundTasks registry
             // and return immediately. Safety checks above still apply;

package/src/local-service/agent-relay.mjs

@@ -755,6 +755,13 @@ export class LocalAgentRelay {
   _makeWorkspaceSessionSubstrate(pluginRegistry) {
     return (agent, node, instruction, { scopedExecutor } = {}) => (async function* (relay) {
       const execContext = await relay._buildExecContext(instruction);
+      // Per-agent model override from YAML — same pattern as agents.mjs:330.
+      // If the agent definition declares a `model` field, it wins over
+      // the session default for this sub-agent's turn.
+      if (agent.model) execContext.model_override = agent.model;
+      if (agent.models && typeof agent.models === 'object' && Object.keys(agent.models).length) {
+        execContext.model_overrides = { ...(execContext.model_overrides || {}), ...agent.models };
+      }
       const slug = agent.slug || agent.command || agent.name || node?.agent_slug || node?.id || 'agent';
       execContext.sub_agent = {
         slug,

package/src/permissions/command-classifier.mjs

@@ -238,6 +238,24 @@ const EXACT_SAFE = new Set([
     'python --version', 'python3 --version',
 ]);
 
+/** Tools commonly invoked with -version/--version to probe the installed version.
+ *  These are pure reads (no file access, no network) and should never require
+ *  project-scoping — they probe the local system's SDK/toolchain. */
+const VERSION_PROBE_TOOLS = new Set([
+    'java', 'javac', 'python', 'python3', 'node', 'ruby', 'go', 'rustc',
+    'deno', 'bun', 'php', 'perl', 'gcc', 'clang', 'make', 'cmake', 'mvn',
+    'gradle', 'pip', 'npm', 'yarn', 'pnpm', 'cargo', 'swift', 'kotlin',
+]);
+
+/** Absolute paths to system probes that are safe to invoke for read-only
+ *  version/path queries. These live outside any project root and should not
+ *  trigger project-scope errors. */
+const SAFE_ABS_PROBE_PATHS = new Set([
+    '/usr/libexec/java_home',
+    '/usr/bin/xcode-select',
+    '/usr/bin/which',
+]);
+
 /**
  * Commands with allowed flags — allowlist approach.
  * Key: command name (or "git diff" for multi-word).
@@ -682,6 +700,23 @@ function classifySingleCommand(command) {
         return { classification: 'safe', reason: 'Echo without expansion' };
     }
 
+    // ── Version probe: <tool> -version / --version (pure OS read, no project needed) ──
+    if (VERSION_PROBE_TOOLS.has(baseCmd)) {
+        const token = tokenize(trimmed);
+        const flag = token[1] || '';
+        if (/^--?v(ersion)?$/.test(flag)) {
+            return { classification: 'safe', reason: `Version probe: ${baseCmd}` };
+        }
+    }
+
+    // ── Known system-probe absolute paths (e.g. /usr/libexec/java_home -V) ──
+    if (SAFE_ABS_PROBE_PATHS.has(baseCmd)) {
+        const rest = trimmed.slice(baseCmd.length).trim();
+        if (!rest || /^--?[a-z]/i.test(rest)) {
+            return { classification: 'safe', reason: `System probe: ${baseCmd}` };
+        }
+    }
+
     // ── Default: contained (unknown command, not explicitly blocked) ──
     return { classification: 'contained', reason: `Unknown command, defaulting to contained: ${baseCmd}` };
 }

package/src/tools/bash.mjs

@@ -10,6 +10,17 @@
  */
 import { spawn } from 'child_process';
 
+/**
+ * Resolve shell binary and args for the current platform.
+ * Windows uses cmd.exe; Linux/macOS use bash.
+ */
+function shellSpawnArgs(command) {
+    if (process.platform === 'win32') {
+        return ['cmd.exe', ['/d', '/s', '/c', command]];
+    }
+    return ['bash', ['-c', command]];
+}
+
 // Strip ANSI escape sequences
 function stripAnsi(str) {
     // eslint-disable-next-line no-control-regex
@@ -73,7 +84,8 @@ export const BashTool = {
             let killTimer = null;
             let settled = false;
 
-            const proc = spawn('bash', ['-c', input.command], {
+            const [shellBin, shellArgs] = shellSpawnArgs(input.command);
+            const proc = spawn(shellBin, shellArgs, {
                 cwd: input.cwd,
                 env: { ...process.env },
                 stdio: ['pipe', 'pipe', 'pipe'],
@@ -221,7 +233,8 @@ let bgJobId = 0;
 
 function runBackground(command, cwd) {
     const id = ++bgJobId;
-    const proc = spawn('bash', ['-c', command], {
+    const [shellBin, shellArgs] = shellSpawnArgs(command);
+    const proc = spawn(shellBin, shellArgs, {
         cwd,
         detached: true,
         stdio: ['ignore', 'pipe', 'pipe'],