@bahulam/code 2.6.13 → 2.6.15

package/src/core/headless.mjs

@@ -272,7 +272,7 @@ export async function runHeadless({ instruction, model, timeout = 300, maxCost,
                     tool_calls: data?.tool_calls || 0,
                     success: data?.success !== false,
                 });
-                emit({ type: 'sub_agent', ...data });
+                emit({ ...data, type: 'sub_agent', agent_type: data?.type || '' });
                 log(`SubAgent done: ${data?.type} (${data?.tool_calls} tools, ${data?.duration_s}s)`);
             }
 
@@ -360,8 +360,19 @@ export async function runHeadless({ instruction, model, timeout = 300, maxCost,
     const subAgentToolBreakdown = countBreakdown(toolCalls.filter(t => t.internal));
 
     const subAgentReportedToolCount = subAgents.reduce((sum, sa) => sum + (sa.tool_calls || 0), 0);
-    const subAgentToolCount = backendSubAgentToolCount ?? Math.max(subAgentReportedToolCount, subAgentForwardedToolCount);
-    const totalToolCount = backendToolCount ?? (primaryToolCount + subAgentToolCount);
+    const observedSubAgentToolCount = Math.max(
+        subAgentReportedToolCount,
+        subAgentForwardedToolCount,
+    );
+    const subAgentToolCount = (
+        backendSubAgentToolCount && backendSubAgentToolCount > 0
+    )
+        ? backendSubAgentToolCount
+        : observedSubAgentToolCount;
+    const computedToolCount = primaryToolCount + subAgentToolCount;
+    const totalToolCount = backendToolCount != null
+        ? Math.max(backendToolCount, computedToolCount)
+        : computedToolCount;
     const primaryToolTotal = backendPrimaryToolCount ?? (
         backendToolCount != null
             ? Math.max(0, totalToolCount - subAgentToolCount)

package/src/core/local-agent.mjs

@@ -21,11 +21,11 @@ const MAX_ITERATIONS = 50;
 const TOOL_SCHEMAS = [
     {
         name: 'shell',
-        description: 'Run a shell command and return stdout/stderr. Use for: installing packages, running tests, builds, git operations, or any terminal command.',
+        description: 'Run one non-interactive shell command and return stdout/stderr. Do not use command substitution, backticks, or $(); run separate simple shell calls instead.',
         input_schema: {
             type: 'object',
             properties: {
-                command: { type: 'string', description: 'The shell command to execute' },
+                command: { type: 'string', description: 'The command to execute. Avoid backticks and $(); split dependent checks into separate commands.' },
                 timeout: { type: 'number', description: 'Timeout in milliseconds (default: 120000)' },
             },
             required: ['command'],
@@ -478,6 +478,7 @@ export class LocalAgent {
             'You are Bahulam Code, Bahulam\'s AI coding agent running in local mode.',
             'You have access to tools for reading, writing, and executing code.',
             'Use tools to accomplish the user\'s request. Be concise and direct.',
+            'For shell tools, never use command substitution, backticks, or $(). Run separate simple commands and carry values forward in text.',
         ];
         if (context.cwd) parts.push(`Working directory: ${context.cwd}`);
         if (context.gitBranch) parts.push(`Git branch: ${context.gitBranch}`);

package/src/core/risk-tier.mjs

@@ -14,12 +14,15 @@
  * intent can't be hidden behind a friendly description.
  */
 
+import { isApprovalRequiredWritePath, isSensitiveConfigPath } from './safety.mjs';
+
 // ── Tier enum ────────────────────────────────────────────────────────────
 
 export const TIERS = Object.freeze({
   READ:            'read',
   SENSITIVE_READ:  'sensitive-read',
   LOCAL_EDIT:      'local-edit',
+  PROTECTED_EDIT:  'protected-edit',
   SHELL_SAFE:      'shell-safe',
   SHELL_MEDIUM:    'shell-medium',
   SHELL_DANGEROUS: 'shell-dangerous',
@@ -38,6 +41,7 @@ export const BEHAVIOR = Object.freeze({
   [TIERS.READ]:            'auto',
   [TIERS.SENSITIVE_READ]:  'prompt-explicit',
   [TIERS.LOCAL_EDIT]:      'auto-with-undo',
+  [TIERS.PROTECTED_EDIT]:  'prompt-explicit',
   [TIERS.SHELL_SAFE]:      'auto',
   [TIERS.SHELL_MEDIUM]:    'prompt-safe',
   [TIERS.SHELL_DANGEROUS]: 'prompt-explicit',
@@ -77,6 +81,14 @@ const LOCAL_EDIT_TOOLS = new Set([
   'workflow_create_multi', 'workflow_sync_multi',
 ]);
 
+const WRITE_PATH_KEYS = [
+  'path', 'file_path', 'file', 'target',
+];
+
+const WRITE_PATH_ARRAY_KEYS = [
+  'paths', 'file_paths', 'targets',
+];
+
 const DESTRUCTIVE_TOOLS = new Set([
   'delete_file', 'skill_remove',
 ]);
@@ -219,6 +231,7 @@ const TIER_ORDER = [
   TIERS.SENSITIVE_READ,
   TIERS.SHELL_SAFE,
   TIERS.LOCAL_EDIT,
+  TIERS.PROTECTED_EDIT,
   TIERS.NETWORK,
   TIERS.SHELL_MEDIUM,
   TIERS.DESTRUCTIVE,
@@ -243,7 +256,9 @@ export function classify(tool, args = {}) {
   if (READ_TOOLS.has(tool)) {
     return isSensitiveRead(args) ? TIERS.SENSITIVE_READ : TIERS.READ;
   }
-  if (LOCAL_EDIT_TOOLS.has(tool))  return TIERS.LOCAL_EDIT;
+  if (LOCAL_EDIT_TOOLS.has(tool)) {
+    return isApprovalRequiredWrite(args) ? TIERS.PROTECTED_EDIT : TIERS.LOCAL_EDIT;
+  }
   if (DESTRUCTIVE_TOOLS.has(tool)) return TIERS.DESTRUCTIVE;
   if (NETWORK_TOOLS.has(tool))     return TIERS.NETWORK;
 
@@ -273,6 +288,7 @@ export function label(tier) {
     case TIERS.READ:            return 'READ';
     case TIERS.SENSITIVE_READ:  return 'SENSITIVE-READ';
     case TIERS.LOCAL_EDIT:      return 'LOCAL-EDIT';
+    case TIERS.PROTECTED_EDIT:  return 'PROTECTED-EDIT';
     case TIERS.SHELL_SAFE:      return 'SHELL-SAFE';
     case TIERS.SHELL_MEDIUM:    return 'SHELL-MEDIUM';
     case TIERS.SHELL_DANGEROUS: return 'SHELL-DANGEROUS';
@@ -310,11 +326,15 @@ export function isSensitiveReadPath(filePath = '') {
 
   const parts = normalized.split('/').filter(Boolean);
   const base = parts[parts.length - 1] || normalized;
-  if (base === '.env') return true;
+  if (isSensitiveConfigPath(base)) return true;
   if (/\.pem$/i.test(base)) return true;
   return parts.includes('secrets');
 }
 
+export function isApprovalRequiredWrite(args = {}) {
+  return extractWritePaths(args).some(isApprovalRequiredWritePath);
+}
+
 function extractReadPaths(args = {}) {
   const paths = [];
   for (const key of READ_PATH_KEYS) {
@@ -335,3 +355,34 @@ function extractReadPaths(args = {}) {
   }
   return paths;
 }
+
+function extractWritePaths(args = {}) {
+  const paths = [];
+  for (const key of WRITE_PATH_KEYS) {
+    if (typeof args[key] === 'string') paths.push(args[key]);
+  }
+  for (const key of WRITE_PATH_ARRAY_KEYS) {
+    const value = args[key];
+    if (!Array.isArray(value)) continue;
+    for (const item of value) {
+      if (typeof item === 'string') {
+        paths.push(item);
+      } else if (item && typeof item === 'object') {
+        for (const nestedKey of WRITE_PATH_KEYS) {
+          if (typeof item[nestedKey] === 'string') paths.push(item[nestedKey]);
+        }
+      }
+    }
+  }
+  if (Array.isArray(args.files)) {
+    for (const item of args.files) {
+      if (typeof item === 'string') paths.push(item);
+      else if (item && typeof item === 'object') {
+        for (const nestedKey of WRITE_PATH_KEYS) {
+          if (typeof item[nestedKey] === 'string') paths.push(item[nestedKey]);
+        }
+      }
+    }
+  }
+  return paths;
+}

package/src/core/safety.mjs

@@ -28,6 +28,18 @@ const PROTECTED_NAMES = new Set([
   'go.sum',
 ]);
 
+const APPROVAL_REQUIRED_WRITE_NAMES = new Set([
+  '.env',
+  '.env.local',
+  '.env.production',
+  'package.json',
+  'package-lock.json',
+  'yarn.lock',
+  'pnpm-lock.yaml',
+  'Cargo.lock',
+  'go.sum',
+]);
+
 /** Directory names that indicate a source root — never delete the dir itself. */
 const SOURCE_DIRS = new Set([
   'src',
@@ -80,13 +92,35 @@ const HIGH_RISK_COMMANDS = [
 
 // ── Validation Functions ─────────────────────────────────────
 
+function basenameFor(filePath = '') {
+  return path.basename(String(filePath || '').replace(/\\/g, '/'));
+}
+
+function isEnvLikeName(name = '') {
+  return /^\.env(?:\.|$)/.test(String(name || ''));
+}
+
+function isProtectedName(name = '') {
+  return PROTECTED_NAMES.has(name) || isEnvLikeName(name);
+}
+
+export function isSensitiveConfigPath(filePath = '') {
+  return isEnvLikeName(basenameFor(filePath));
+}
+
+export function isApprovalRequiredWritePath(filePath = '') {
+  const basename = basenameFor(filePath);
+  return isSensitiveConfigPath(filePath) || APPROVAL_REQUIRED_WRITE_NAMES.has(basename);
+}
+
 /**
  * Check if a path is protected (should not be deleted/overwritten entirely).
  * @param {string} filePath - Absolute path
  * @param {string} cwd - Current working directory
- * @returns {{ safe: boolean, reason?: string }}
+ * @param {{ allowApprovalRequiredWrite?: boolean }} options
+ * @returns {{ safe: boolean, reason?: string, requiresApproval?: boolean, sensitive?: boolean, protected?: boolean }}
  */
-export function validatePath(filePath, cwd = process.cwd()) {
+export function validatePath(filePath, cwd = process.cwd(), options = {}) {
   if (!filePath) return { safe: false, reason: 'Empty path' };
 
   const resolved = path.resolve(cwd, filePath);
@@ -100,7 +134,16 @@ export function validatePath(filePath, cwd = process.cwd()) {
   }
 
   // Block protected file names at any level
-  if (PROTECTED_NAMES.has(basename) && !resolved.includes('node_modules/')) {
+  if (isProtectedName(basename) && !resolved.includes('node_modules/')) {
+    if (options.allowApprovalRequiredWrite && isApprovalRequiredWritePath(resolved)) {
+      return {
+        safe: true,
+        reason: `Approval required for protected path: ${basename}`,
+        requiresApproval: true,
+        protected: true,
+        sensitive: isSensitiveConfigPath(resolved),
+      };
+    }
     return { safe: false, reason: `Protected path: ${basename}` };
   }
 
@@ -172,16 +215,29 @@ export function validateShellCommand(command) {
  * @returns {{ safe: boolean, reason?: string }}
  */
 export function validateWrite(filePath, content, cwd = process.cwd()) {
-  const pathCheck = validatePath(filePath, cwd);
+  const pathCheck = validatePath(filePath, cwd, { allowApprovalRequiredWrite: true });
   if (!pathCheck.safe) return pathCheck;
 
   const resolved = path.resolve(cwd, filePath);
+  const basename = path.basename(resolved);
 
   // Don't allow overwriting .git internals
   if (resolved.includes('/.git/')) {
     return { safe: false, reason: 'Cannot write to .git directory' };
   }
 
+  if (pathCheck.requiresApproval) {
+    return {
+      safe: true,
+      reason: pathCheck.sensitive
+        ? `Sensitive config write requires approval: ${basename}`
+        : `Protected file write requires approval: ${basename}`,
+      requiresApproval: true,
+      protected: true,
+      sensitive: pathCheck.sensitive,
+    };
+  }
+
   // Warn if writing a very large file (> 1MB)
   if (content && content.length > 1_000_000) {
     return { safe: true, reason: `Large file write: ${(content.length / 1024).toFixed(0)}KB` };
@@ -196,6 +252,7 @@ export function validateWrite(filePath, content, cwd = process.cwd()) {
 export function getSafetyRules() {
   return {
     protectedNames: [...PROTECTED_NAMES],
+    approvalRequiredWriteNames: [...APPROVAL_REQUIRED_WRITE_NAMES],
     sourceDirs: [...SOURCE_DIRS],
     blockedPatterns: DANGEROUS_SHELL_PATTERNS.length,
     highRiskPatterns: HIGH_RISK_COMMANDS.length,

package/src/core/tool-executor.mjs

@@ -10,7 +10,7 @@
 
 import { createToolRegistry } from '../tools/registry.mjs';
 import { detectCommandType, filterOutput } from './output-filter.mjs';
-import { validatePath, validateDelete, validateShellCommand, validateWrite } from './safety.mjs';
+import { isSensitiveConfigPath, validatePath, validateDelete, validateShellCommand, validateWrite } from './safety.mjs';
 import { classifyCommand, isExitCodeError } from '../permissions/command-classifier.mjs';
 import { analyzeCode } from '../context/ast-parser.mjs';
 import { ProjectRegistry } from '../tools/project-overview.mjs';
@@ -74,6 +74,14 @@ export function createToolExecutor({
         return path.resolve(cwd, value);
     }
 
+    function blockedShellOutput(reason) {
+        const text = String(reason || 'Blocked by shell safety policy').trim();
+        const hint = /command substitution|backticks|\$\(\)/i.test(text)
+            ? 'Retry with separate simple shell commands instead of backticks or $().'
+            : 'Work only inside a registered project root.';
+        return `BLOCKED: ${text}. ${hint}`;
+    }
+
     function longRunningObservationTimeoutMs() {
         const configured = Number(process.env.KEPLER_LONG_RUNNING_TIMEOUT_MS);
         return Number.isFinite(configured) && configured > 0 ? configured : 15_000;
@@ -358,18 +366,35 @@ export function createToolExecutor({
         return result;
     }
 
+    function buildResultFileDiff(filePath, before, after) {
+        const diff = buildFileDiff({
+            filePath,
+            before,
+            after,
+            cwd: projectRootFor(filePath),
+        });
+        if (!isSensitiveConfigPath(filePath)) return diff;
+        return {
+            ...diff,
+            hunks: [],
+            unified: '',
+            redacted: true,
+            sensitive: true,
+            redaction_reason: 'Sensitive config diff redacted',
+        };
+    }
+
     function attachFileDiff(result, filePath, before, after) {
         try {
-            const diff = buildFileDiff({
-                filePath,
-                before,
-                after,
-                cwd: projectRootFor(filePath),
-            });
+            const diff = buildResultFileDiff(filePath, before, after);
             result.file_diff = diff;
             result.diff = diff.unified;
             result.lines_added = diff.lines_added;
             result.lines_removed = diff.lines_removed;
+            if (diff.redacted) {
+                result.output = `File updated: ${diff.relative_path || filePath}\nDiff redacted for sensitive config file.`;
+                result.redacted = true;
+            }
         } catch { /* best effort */ }
         return result;
     }
@@ -578,7 +603,7 @@ export function createToolExecutor({
             if (!shellCheck.safe) {
                 return {
                     success: false,
-                    output: `BLOCKED: ${shellCheck.reason}. Work only inside a registered project root.`,
+                    output: blockedShellOutput(shellCheck.reason),
                     _tool: 'shell', _blocked: true,
                 };
             }
@@ -588,7 +613,7 @@ export function createToolExecutor({
             if (classification.classification === 'blocked') {
                 return {
                     success: false,
-                    output: `BLOCKED: ${classification.reason}`,
+                    output: blockedShellOutput(classification.reason),
                     _tool: 'shell', _blocked: true,
                 };
             }
@@ -813,12 +838,7 @@ export function createToolExecutor({
 
                     await occRegistry.call('Write', { file_path: filePath, content });
                     const after = readTextIfExists(filePath);
-                    diffs.push(buildFileDiff({
-                        filePath,
-                        before,
-                        after,
-                        cwd: projectRootFor(filePath),
-                    }));
+                    diffs.push(buildResultFileDiff(filePath, before, after));
                     updateProjectIndex(filePath);
                     results.push(rawPath);
                 } catch (err) {
@@ -1513,7 +1533,9 @@ print('OK: replaced')
             const created = listLocalAgents(process.cwd()).find(agent => agent.slug === result.slug);
             const payload = {
                 ...result,
-                agent: created ? compactAgentMetadata(created) : null,
+                agent: created
+                    ? { ...compactAgentMetadata(created), spec: created.spec }
+                    : null,
                 next_actions: [
                     `Edit ${result.filePath}`,
                     `Run /agents sync ${result.slug} when ready`,

package/src/core/trust.mjs

@@ -96,11 +96,13 @@ export class TrustStore {
       }
     }
     if ((reask.on_risk_increase ?? this.policy.hitl?.reaskOnRiskIncrease) && rule.tier && tier) {
-      const order = [TIERS.READ, TIERS.SHELL_SAFE, TIERS.LOCAL_EDIT, TIERS.SHELL_MEDIUM, TIERS.NETWORK, TIERS.SHELL_DANGEROUS, TIERS.DESTRUCTIVE];
+      const order = [TIERS.READ, TIERS.SHELL_SAFE, TIERS.LOCAL_EDIT, TIERS.PROTECTED_EDIT, TIERS.SHELL_MEDIUM, TIERS.NETWORK, TIERS.SHELL_DANGEROUS, TIERS.DESTRUCTIVE];
       if (order.indexOf(tier) > order.indexOf(rule.tier)) return 'risk tier increased';
     }
-    if ((this.policy.hitl?.alwaysAskForDangerous ?? true) && (tier === TIERS.SHELL_DANGEROUS || tier === TIERS.DESTRUCTIVE)) {
-      return 'dangerous tier requires fresh approval';
+    if ((this.policy.hitl?.alwaysAskForDangerous ?? true) && (tier === TIERS.SHELL_DANGEROUS || tier === TIERS.DESTRUCTIVE || tier === TIERS.PROTECTED_EDIT)) {
+      return tier === TIERS.PROTECTED_EDIT
+        ? 'protected edit requires fresh approval'
+        : 'dangerous tier requires fresh approval';
     }
     if ((reask.on_command_shape_change ?? this.policy.hitl?.reaskOnCommandShapeChange) && rule.command_shape && args.command) {
       if (rule.command_shape !== commandShape(args.command)) return 'command shape changed';

package/src/index.mjs

@@ -35,7 +35,7 @@ import { printBanner, printProjectInfo, printHints, printAuthStatus, printStyled
 import { ContextRetriever } from './context/retriever.mjs';
 import { loadSettings } from './config/settings.mjs';
 
-const VERSION = '2.6.13';
+const VERSION = '2.6.15';
 
 // ── Arg Parsing (consolidated from index.mjs + cli-args.mjs) ──