@bunny-agent/runner-cli 0.9.62 → 0.9.63-beta.2

package/dist/bundle.mjs

@@ -23504,14 +23504,73 @@ function approvalFileName(toolCallId) {
   return `${stem}.json`;
 }
 
+// ../../packages/manager/dist/tool-output.js
+import { randomBytes } from "node:crypto";
+import { writeFile } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import { join as join2 } from "node:path";
+var TOOL_OUTPUT_MAX_BYTES = 50 * 1024;
+var TOOL_OUTPUT_MAX_LINES = 2e3;
+function countLines(text) {
+  let lines = 1;
+  for (let index = 0; index < text.length; index++) {
+    if (text[index] === "\n")
+      lines++;
+  }
+  return lines;
+}
+function previewText(text, maxBytes, maxLines) {
+  const buffer = Buffer.from(text.slice(0, maxBytes), "utf8");
+  let end = Math.min(buffer.length, maxBytes);
+  while (end > 0 && end < buffer.length && (buffer[end] & 192) === 128) {
+    end--;
+  }
+  const prefix = buffer.subarray(0, end).toString("utf8");
+  let lines = 1;
+  for (let index = 0; index < prefix.length; index++) {
+    if (prefix[index] === "\n" && ++lines > maxLines) {
+      return prefix.slice(0, index);
+    }
+  }
+  return prefix;
+}
+async function guardToolOutput(text) {
+  const originalBytes = Buffer.byteLength(text, "utf8");
+  const originalLines = countLines(text);
+  if (originalBytes <= TOOL_OUTPUT_MAX_BYTES && originalLines <= TOOL_OUTPUT_MAX_LINES) {
+    return { text };
+  }
+  let fullOutputPath;
+  try {
+    const path3 = join2(tmpdir(), `bunny-tool-output-${randomBytes(8).toString("hex")}.txt`);
+    await writeFile(path3, text, { encoding: "utf8", mode: 384, flag: "wx" });
+    fullOutputPath = path3;
+  } catch {
+  }
+  const retrieval = fullOutputPath ? `Full output saved to: ${JSON.stringify(fullOutputPath)}. Use read with offset/limit or bash to extract a bounded fragment.` : "Full output could not be saved. Retry with a narrower query or fewer fields.";
+  const notice = `
+
+[Tool output truncated: original ${originalBytes} bytes / ${originalLines} lines; preview limit ${TOOL_OUTPUT_MAX_BYTES} bytes / ${TOOL_OUTPUT_MAX_LINES} lines. ${retrieval}]`;
+  const preview = previewText(text, TOOL_OUTPUT_MAX_BYTES - Buffer.byteLength(notice, "utf8"), TOOL_OUTPUT_MAX_LINES - countLines(notice) + 1);
+  return {
+    text: `${preview}${notice}`,
+    outputGuard: {
+      truncated: true,
+      originalBytes,
+      originalLines,
+      ...fullOutputPath ? { fullOutputPath } : {}
+    }
+  };
+}
+
 // ../../packages/runner-claude/dist/ai-sdk-stream.js
 import { appendFileSync, existsSync as existsSync2, unlinkSync } from "node:fs";
-import { join as join2 } from "node:path";
+import { join as join3 } from "node:path";
 function trace(data, reset = false) {
   if (process.env.DEBUG !== "true")
     return;
   try {
-    const file3 = join2(process.cwd(), "claude-message-stream-debug.json");
+    const file3 = join3(process.cwd(), "claude-message-stream-debug.json");
     if (reset && existsSync2(file3))
       unlinkSync(file3);
     const entry = {
@@ -23861,22 +23920,22 @@ function streamSDKMessagesToAISDKUI(messageIterator) {
 
 // ../../packages/runner-claude/dist/skill-plugin.js
 import { cpSync, mkdirSync, mkdtempSync, symlinkSync, writeFileSync } from "node:fs";
-import { tmpdir } from "node:os";
-import { basename, join as join3 } from "node:path";
+import { tmpdir as tmpdir2 } from "node:os";
+import { basename, join as join4 } from "node:path";
 var PLUGIN_NAME = "bunny-agent-skills";
 function createSkillPlugin(skillPaths) {
   if (skillPaths.length === 0)
     return void 0;
   try {
-    const pluginDir = mkdtempSync(join3(tmpdir(), "bunny-claude-skills-"));
-    const manifestDir = join3(pluginDir, ".claude-plugin");
+    const pluginDir = mkdtempSync(join4(tmpdir2(), "bunny-claude-skills-"));
+    const manifestDir = join4(pluginDir, ".claude-plugin");
     mkdirSync(manifestDir, { recursive: true });
-    writeFileSync(join3(manifestDir, "plugin.json"), JSON.stringify({
+    writeFileSync(join4(manifestDir, "plugin.json"), JSON.stringify({
       name: PLUGIN_NAME,
       version: "0.0.0",
       description: "Bunny Agent skills exposed to the Claude runner"
     }, null, 2));
-    const skillsDir = join3(pluginDir, "skills");
+    const skillsDir = join4(pluginDir, "skills");
     mkdirSync(skillsDir, { recursive: true });
     const usedNames = /* @__PURE__ */ new Set();
     for (const skillPath of skillPaths) {
@@ -23886,7 +23945,7 @@ function createSkillPlugin(skillPaths) {
         name = `${basename(skillPath)}-${suffix++}`;
       }
       usedNames.add(name);
-      const target = join3(skillsDir, name);
+      const target = join4(skillsDir, name);
       try {
         symlinkSync(skillPath, target, "dir");
       } catch {
@@ -37687,13 +37746,15 @@ function buildOne(ref) {
         response = await executeToolRef(ref, args, void 0);
       } catch (error109) {
         const message = error109 instanceof Error ? error109.message : String(error109);
-        return errorResult(`Tool "${ref.name}" transport error: ${message}`);
+        const output3 = await guardToolOutput(`Tool "${ref.name}" transport error: ${message}`);
+        return errorResult(output3.text);
       }
+      const output2 = await guardToolOutput(response.body);
       if (response.status < 200 || response.status >= 300) {
-        const body = response.body.trim();
+        const body = output2.text.trim();
         return errorResult(body.length > 0 ? body : `Tool execution failed with status ${response.status}`);
       }
-      return { content: [{ type: "text", text: response.body }] };
+      return { content: [{ type: "text", text: output2.text }] };
     }
   };
 }
@@ -38447,7 +38508,7 @@ ${inputToCodex}`;
 
 // ../../packages/runner-copilot/dist/copilot-runner.js
 import { existsSync as existsSync3, mkdirSync as mkdirSync2, readFileSync as readFileSync2, unlinkSync as unlinkSync3, writeFileSync as writeFileSync3 } from "node:fs";
-import { join as join5 } from "node:path";
+import { join as join6 } from "node:path";
 import { approveAll, CopilotClient } from "@github/copilot-sdk";
 var AsyncEventQueue = class {
   values = [];
@@ -38539,8 +38600,8 @@ function createFilePermissionHandler(cwd) {
   return async (request) => {
     const rawId = request.toolCallId ?? `copilot-${Date.now()}`;
     const approvalId = rawId.replace(/[^a-zA-Z0-9_.-]/g, "_");
-    const approvalDir = join5(cwd, ".bunny-agent", "approvals");
-    const approvalFile = join5(approvalDir, `${approvalId}.json`);
+    const approvalDir = join6(cwd, ".bunny-agent", "approvals");
+    const approvalFile = join6(approvalDir, `${approvalId}.json`);
     mkdirSync2(approvalDir, { recursive: true });
     if (!existsSync3(approvalFile)) {
       writeFileSync3(approvalFile, JSON.stringify({
@@ -38818,7 +38879,7 @@ function createCopilotRunner(options) {
 // ../../packages/runner-acp/dist/process-runner.js
 import { spawn } from "node:child_process";
 import { existsSync as existsSync4, mkdirSync as mkdirSync3, readFileSync as readFileSync3, unlinkSync as unlinkSync4, writeFileSync as writeFileSync4 } from "node:fs";
-import { join as join6 } from "node:path";
+import { join as join7 } from "node:path";
 import { Readable, Writable } from "node:stream";
 var AsyncQueue2 = class {
   values = [];
@@ -38902,8 +38963,8 @@ function usageMetadata(usage) {
 async function waitForFileApproval(cwd, request) {
   const rawId = request.toolCall.toolCallId ?? `acp-${Date.now()}`;
   const approvalId = rawId.replace(/[^a-zA-Z0-9_.-]/g, "_");
-  const approvalDir = join6(cwd, ".bunny-agent", "approvals");
-  const approvalFile = join6(approvalDir, `${approvalId}.json`);
+  const approvalDir = join7(cwd, ".bunny-agent", "approvals");
+  const approvalFile = join7(approvalDir, `${approvalId}.json`);
   mkdirSync3(approvalDir, { recursive: true });
   if (!existsSync4(approvalFile)) {
     writeFileSync4(approvalFile, JSON.stringify({
@@ -39206,7 +39267,7 @@ var mcpAdapterModule;
 function getMcpAdapterModule() {
   if (!mcpAdapterModule) {
     const jiti = createJiti(import.meta.url, {
-      fsCache: false,
+      fsCache: true,
       moduleCache: true
     });
     mcpAdapterModule = jiti("pi-mcp-adapter");
@@ -39490,15 +39551,15 @@ function createMcpExtension(config4) {
 }
 
 // ../../packages/runner-pi/dist/pi-runner.js
-import { appendFileSync as appendFileSync2, existsSync as existsSync9, unlinkSync as unlinkSync7 } from "node:fs";
-import { join as join12 } from "node:path";
+import { appendFileSync as appendFileSync2, existsSync as existsSync8, unlinkSync as unlinkSync7 } from "node:fs";
+import { isAbsolute, join as join12, resolve as resolve2 } from "node:path";
 import { getBuiltinModel } from "@earendil-works/pi-ai/providers/all";
-import { createAgentSession, createCodingTools, ModelRuntime, SessionManager as SessionManager2 } from "@earendil-works/pi-coding-agent";
+import { CONFIG_DIR_NAME, createAgentSession, DefaultResourceLoader, getAgentDir, ModelRuntime, SessionManager as SessionManager2, SettingsManager } from "@earendil-works/pi-coding-agent";
 
 // ../../packages/runner-pi/dist/apply-patch-shim.js
 import { chmodSync, existsSync as existsSync5, mkdirSync as mkdirSync4, renameSync, writeFileSync as writeFileSync5 } from "node:fs";
-import { tmpdir as tmpdir3 } from "node:os";
-import { join as join7 } from "node:path";
+import { tmpdir as tmpdir4 } from "node:os";
+import { join as join8 } from "node:path";
 import { fileURLToPath } from "node:url";
 var SHIM_FILE = "apply_patch";
 function resolveApplyPatchBin() {
@@ -39514,15 +39575,15 @@ function ensureApplyPatchShim(binPath = resolveApplyPatchBin()) {
   }
   try {
     const uid = process.getuid?.() ?? 0;
-    const shimDir = join7(tmpdir3(), `bunny-agent-apply-patch-${uid}`);
+    const shimDir = join8(tmpdir4(), `bunny-agent-apply-patch-${uid}`);
     mkdirSync4(shimDir, { recursive: true });
     const script = `#!/bin/sh
 exec "${process.execPath}" "${binPath}" "$@"
 `;
-    const staging = join7(shimDir, `.${SHIM_FILE}.${process.pid}.tmp`);
+    const staging = join8(shimDir, `.${SHIM_FILE}.${process.pid}.tmp`);
     writeFileSync5(staging, script);
     chmodSync(staging, 493);
-    renameSync(staging, join7(shimDir, SHIM_FILE));
+    renameSync(staging, join8(shimDir, SHIM_FILE));
     return shimDir;
   } catch {
     return void 0;
@@ -39787,102 +39848,6 @@ function buildApplyPatchTool(cwd) {
   };
 }
 
-// ../../packages/runner-pi/dist/bunny-agent-resource-loader.js
-import { existsSync as existsSync7 } from "node:fs";
-import { homedir } from "node:os";
-import { isAbsolute, join as join8, resolve as resolve2 } from "node:path";
-import { DefaultResourceLoader, loadSkills } from "@earendil-works/pi-coding-agent";
-var LOG_PREFIX = "[bunny-agent:pi]";
-function logSkillLoad(cwd, agentDir, skillPaths, result) {
-  const lines = [
-    `${LOG_PREFIX} loadSkills`,
-    `  cwd: ${cwd}`,
-    `  agentDir: ${agentDir}`,
-    `  extra skillPaths (${skillPaths.length}):`
-  ];
-  for (const raw of skillPaths) {
-    const abs = isAbsolute(raw) ? raw : resolve2(cwd, raw);
-    lines.push(`    ${raw} -> ${abs} (exists: ${existsSync7(abs) ? "yes" : "no"})`);
-  }
-  lines.push(`  loaded skills: ${result.skills.length}`);
-  if (result.skills.length > 0) {
-    lines.push(`  skill names: ${result.skills.map((s) => s.name).join(", ")}`);
-  }
-  if (result.diagnostics.length > 0) {
-    lines.push(`  diagnostics (${result.diagnostics.length}):`);
-    for (const d of result.diagnostics) {
-      const pathPart = d.path !== void 0 ? ` path=${d.path}` : "";
-      lines.push(`    [${d.type}] ${d.message}${pathPart}`);
-    }
-  }
-  console.error(lines.join("\n"));
-}
-var BunnyAgentResourceLoader = class {
-  constructor(options = {}) {
-    this.cwd = options.cwd ?? process.cwd();
-    this.agentDir = options.agentDir ?? join8(homedir(), ".bunny", "agent");
-    this.skillPaths = options.skillPaths ?? [];
-    this.extraAppendPrompt = options.appendSystemPrompt;
-    this.delegate = new DefaultResourceLoader({
-      cwd: this.cwd,
-      agentDir: this.agentDir,
-      settingsManager: options.settingsManager,
-      extensionFactories: options.extensionFactories
-    });
-  }
-  async reload() {
-    await this.delegate.reload();
-    this.cachedSkills = void 0;
-  }
-  getSkills() {
-    if (!this.cachedSkills) {
-      this.cachedSkills = loadSkills({
-        cwd: this.cwd,
-        agentDir: this.agentDir,
-        skillPaths: this.skillPaths,
-        includeDefaults: true
-      });
-      if (this.skillPaths.length > 0) {
-        logSkillLoad(this.cwd, this.agentDir, this.skillPaths, this.cachedSkills);
-      }
-    }
-    return this.cachedSkills;
-  }
-  // Delegate all other methods
-  getExtensions() {
-    return this.delegate.getExtensions();
-  }
-  getPrompts() {
-    return this.delegate.getPrompts();
-  }
-  getThemes() {
-    return this.delegate.getThemes();
-  }
-  getAgentsFiles() {
-    return this.delegate.getAgentsFiles();
-  }
-  getSystemPrompt() {
-    return this.delegate.getSystemPrompt();
-  }
-  getSystemPromptSource() {
-    return this.delegate.getSystemPromptSource();
-  }
-  getAppendSystemPromptSources() {
-    return this.delegate.getAppendSystemPromptSources();
-  }
-  getAppendSystemPrompt() {
-    const base = this.delegate.getAppendSystemPrompt();
-    if (this.extraAppendPrompt) {
-      console.error(`${LOG_PREFIX} getAppendSystemPrompt: appending extra prompt (${this.extraAppendPrompt.length} chars)`);
-      return [...base, this.extraAppendPrompt];
-    }
-    return base;
-  }
-  extendResources(paths) {
-    this.delegate.extendResources(paths);
-  }
-};
-
 // ../../packages/runner-pi/dist/image-tools.js
 import { mkdirSync as mkdirSync6, writeFileSync as writeFileSync7 } from "node:fs";
 import { dirname as dirname3, extname, join as join9 } from "node:path";
@@ -40294,7 +40259,7 @@ function buildImageEditTool(cwd, imageModelId, baseUrl, apiKey) {
     // biome-ignore lint/suspicious/noExplicitAny: plain JSON Schema compatible with TypeBox TSchema
     parameters: editImageSchema,
     async execute(_toolCallId, params, signal, _onUpdate) {
-      const { readFileSync: readFileSync8, existsSync: existsSync13 } = await import("node:fs");
+      const { readFileSync: readFileSync8, existsSync: existsSync12 } = await import("node:fs");
       const { resolve: resolve5, basename: basename3 } = await import("node:path");
       const p = params;
       const imagePath = p.image;
@@ -40307,7 +40272,7 @@ function buildImageEditTool(cwd, imageModelId, baseUrl, apiKey) {
       const rawFilename = p.filename;
       const safePrompt = buildPolicySafeEditPrompt(prompt);
       const resolvedImage = resolve5(cwd, imagePath);
-      if (!existsSync13(resolvedImage)) {
+      if (!existsSync12(resolvedImage)) {
         return {
           content: [
             {
@@ -40351,7 +40316,7 @@ function buildImageEditTool(cwd, imageModelId, baseUrl, apiKey) {
         ];
         if (maskPath) {
           const resolvedMask = resolve5(cwd, maskPath);
-          if (existsSync13(resolvedMask)) {
+          if (existsSync12(resolvedMask)) {
             files.push({
               name: "mask",
               filename: basename3(resolvedMask),
@@ -43568,37 +43533,37 @@ function buildAskUserQuestionTool(options) {
     }
   };
 }
-function wrapToolWithApproval(tool, options) {
+function createToolApprovalExtension(options) {
   return {
-    name: tool.name,
-    label: tool.label ?? tool.name,
-    description: tool.description,
-    parameters: tool.parameters,
-    async execute(toolCallId, params, signal, onUpdate, ctx) {
-      const decision = await waitForApproval({
-        cwd: options.cwd,
-        toolCallId,
-        toolName: tool.name,
-        input: params,
-        signal: signal ?? options.fallbackSignal,
-        pollIntervalMs: options.pollIntervalMs,
-        timeoutMs: options.timeoutMs
+    name: "bunny-agent-tool-approval",
+    factory: (pi) => {
+      pi.on("tool_call", async (event, ctx) => {
+        if (isAskUserQuestionToolName(event.toolName) || event.parentToolCallId !== void 0) {
+          return void 0;
+        }
+        const decision = await waitForApproval({
+          cwd: options.cwd,
+          toolCallId: event.toolCallId,
+          toolName: event.toolName,
+          input: event.input,
+          signal: ctx.signal ?? options.fallbackSignal,
+          pollIntervalMs: options.pollIntervalMs,
+          timeoutMs: options.timeoutMs
+        });
+        if (decision.behavior === "deny") {
+          return {
+            block: true,
+            reason: `Tool "${event.toolName}" was not approved: ${decision.message}`
+          };
+        }
+        return void 0;
       });
-      if (decision.behavior === "deny") {
-        throw new Error(`Tool "${tool.name}" was not approved: ${decision.message}`);
-      }
-      return tool.execute(toolCallId, params, signal, onUpdate, ctx);
     }
   };
 }
-function gateToolsForApproval(tools, bypass, options) {
-  if (bypass)
-    return tools;
-  return tools.map((tool) => wrapToolWithApproval(tool, options));
-}
 
 // ../../packages/runner-pi/dist/tool-overrides.js
-import { createBashTool, createReadTool } from "@earendil-works/pi-coding-agent";
+import { createBashToolDefinition } from "@earendil-works/pi-coding-agent";
 
 // ../../packages/runner-pi/dist/web-tools.js
 var braveProvider = {
@@ -44020,11 +43985,11 @@ function buildWebFetchTool() {
 
 // ../../packages/runner-pi/dist/tool-overrides.js
 function redactSecrets(text, secrets) {
-  if (Object.keys(secrets).length === 0)
+  const values = secretValues(secrets).filter((v) => text.includes(v));
+  if (values.length === 0)
     return text;
   let result = text;
   const escapeRegex3 = (s) => s.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
-  const values = Object.values(secrets).filter((v) => v.length >= 8).filter((v) => !/^\//.test(v) && !/^[A-Za-z]:[/\\]/.test(v)).sort((a, b) => b.length - a.length);
   for (const v of values) {
     const ev = escapeRegex3(v);
     result = result.replace(new RegExp(`^\\S+=.*${ev}.*$\\n?`, "gm"), "");
@@ -44034,19 +43999,61 @@ function redactSecrets(text, secrets) {
   result = result.replace(/\n{3,}/g, "\n\n");
   return result.trim();
 }
-function redactResultContent(result, secrets) {
-  if (result?.content && Array.isArray(result.content)) {
-    result.content = result.content.map((c) => c.type === "text" && typeof c.text === "string" ? { ...c, text: redactSecrets(c.text, secrets) } : c);
+function secretValues(secrets) {
+  return Object.values(secrets).filter((v) => v.length >= 8).filter((v) => !/^\//.test(v) && !/^[A-Za-z]:[/\\]/.test(v)).sort((a, b) => b.length - a.length);
+}
+function maskSecrets(value, values) {
+  if (typeof value === "string") {
+    let masked = value;
+    for (const v of values)
+      masked = masked.split(v).join("***");
+    return masked;
+  }
+  if (Array.isArray(value)) {
+    const next = value.map((item) => maskSecrets(item, values));
+    return next.some((item, i) => item !== value[i]) ? next : value;
+  }
+  if (value !== null && typeof value === "object") {
+    let changed = false;
+    const next = {};
+    for (const [key, item] of Object.entries(value)) {
+      next[key] = maskSecrets(item, values);
+      if (next[key] !== item)
+        changed = true;
+    }
+    return changed ? next : value;
   }
+  return value;
 }
+var ENV_OPTIONS_WITH_VALUE = /* @__PURE__ */ new Set([
+  "-u",
+  "--unset",
+  "-C",
+  "--chdir",
+  "-S",
+  "--split-string"
+]);
 function isEnvDumpCommand(command) {
   const cmd = command.replace(/\s+/g, " ").trim();
-  return /(?:^|[|;&])\s*(?:env|printenv|export\s+-p|declare\s+-x)\b/.test(cmd);
+  if (/(?:^|[|;&])\s*(?:printenv|export\s+-p|declare\s+-x)\b/.test(cmd)) {
+    return true;
+  }
+  for (const match of cmd.matchAll(/(?:^|[|;&])\s*env(?=$|[\s|;&>])([^|;&>]*)/g)) {
+    const words = match[1].trim().split(" ").filter(Boolean);
+    let i = 0;
+    while (i < words.length && (words[i].startsWith("-") || /^[A-Za-z_]\w*=/.test(words[i]))) {
+      i += ENV_OPTIONS_WITH_VALUE.has(words[i]) ? 2 : 1;
+    }
+    if (i >= words.length || isEnvDumpCommand(words.slice(i).join(" "))) {
+      return true;
+    }
+  }
+  return false;
 }
-function buildEnvInjectedBashTool(cwd, extraEnv, opts = {}) {
+function buildEnvInjectedBashTool(cwd, opts = {}) {
   const safeEnv = opts.systemEnv ?? {};
   const pathPrepend = opts.pathPrepend;
-  const bashAgentTool = createBashTool(cwd, {
+  return createBashToolDefinition(cwd, {
     spawnHook: (ctx) => {
       const env = {
         ...ctx.env,
@@ -44059,50 +44066,45 @@ function buildEnvInjectedBashTool(cwd, extraEnv, opts = {}) {
       return { ...ctx, env };
     }
   });
-  return {
-    name: bashAgentTool.name,
-    label: bashAgentTool.label ?? "bash",
-    description: bashAgentTool.description,
-    // biome-ignore lint/suspicious/noExplicitAny: TypeBox schema from pi internals
-    parameters: bashAgentTool.parameters,
-    async execute(toolCallId, params, signal, onUpdate) {
-      const command = params.command ?? "";
-      if (isEnvDumpCommand(command)) {
-        return {
-          content: [
-            {
-              type: "text",
-              text: "Command blocked: printing or redirecting environment variables is not allowed."
-            }
-          ],
-          details: void 0
-        };
-      }
-      const result = await bashAgentTool.execute(toolCallId, params, signal, onUpdate);
-      redactResultContent(result, extraEnv);
-      return result;
-    }
-  };
 }
-function buildSecretRedactingReadTool(cwd, secrets) {
-  const readAgentTool = createReadTool(cwd);
+var ENV_DUMP_BLOCKED_MESSAGE = "Command blocked: printing or redirecting environment variables is not allowed.";
+function createSecretGuardExtension(secrets) {
   return {
-    name: readAgentTool.name,
-    label: readAgentTool.label ?? "read",
-    description: readAgentTool.description,
-    // biome-ignore lint/suspicious/noExplicitAny: TypeBox schema from pi internals
-    parameters: readAgentTool.parameters,
-    async execute(toolCallId, params, signal, onUpdate) {
-      const result = await readAgentTool.execute(toolCallId, params, signal, onUpdate);
-      redactResultContent(result, secrets);
-      return result;
+    name: "bunny-agent-secret-guard",
+    factory: (pi) => {
+      pi.on("tool_call", (event) => {
+        if (event.toolName === "bash" && typeof event.input.command === "string" && isEnvDumpCommand(event.input.command)) {
+          return { block: true, reason: ENV_DUMP_BLOCKED_MESSAGE };
+        }
+        return void 0;
+      });
+      const values = secretValues(secrets);
+      pi.on("tool_result", (event) => {
+        if (values.length === 0)
+          return void 0;
+        let contentChanged = false;
+        const content = event.content.map((part) => {
+          if (part.type !== "text")
+            return part;
+          const text = redactSecrets(part.text, secrets);
+          if (text === part.text)
+            return part;
+          contentChanged = true;
+          return { ...part, text };
+        });
+        const details = maskSecrets(event.details, values);
+        const structuredContent = maskSecrets(event.structuredContent, values);
+        if (!contentChanged && details === event.details && structuredContent === event.structuredContent) {
+          return void 0;
+        }
+        return { content, details, structuredContent };
+      });
     }
   };
 }
 function buildSecretAwareTools(cwd, secrets, opts = {}) {
   const tools = [
-    buildEnvInjectedBashTool(cwd, secrets, opts),
-    buildSecretRedactingReadTool(cwd, secrets),
+    buildEnvInjectedBashTool(cwd, opts),
     buildWebFetchTool()
   ];
   if (resolveSearchProvider(secrets)) {
@@ -44136,17 +44138,21 @@ function buildOne2(spec) {
       try {
         response = await executeToolRef2(spec, params, signal);
       } catch (error109) {
-        const message = formatTransportError(error109);
-        throw new PiToolRefError(`Tool "${spec.name}" transport error: ${message}`, { toolName: spec.name });
+        const { text: message } = await guardToolOutput(`Tool "${spec.name}" transport error: ${formatTransportError(error109)}`);
+        throw new PiToolRefError(message, { toolName: spec.name });
       }
+      const output2 = await guardToolOutput(response.body);
       if (response.status < 200 || response.status >= 300) {
-        throw new PiToolRefError(formatToolRuntimeErrorMessage(response), {
+        throw new PiToolRefError(formatToolRuntimeErrorMessage({ ...response, body: output2.text }), {
           toolName: spec.name,
           status: response.status,
-          body: response.body
+          body: output2.text
         });
       }
-      return okResult(response.body);
+      return {
+        content: [{ type: "text", text: output2.text }],
+        details: output2.outputGuard ? { outputGuard: output2.outputGuard } : void 0
+      };
     }
   };
 }
@@ -44203,12 +44209,6 @@ async function executeModuleTool2(runtime, params, signal) {
   const result = await fn(params, { signal });
   return { status: 200, body: serializeResult2(result) };
 }
-function okResult(text) {
-  return {
-    content: [{ type: "text", text }],
-    details: void 0
-  };
-}
 function serializeResult2(result) {
   if (typeof result === "string")
     return result;
@@ -44216,7 +44216,7 @@ function serializeResult2(result) {
 }
 
 // ../../packages/runner-pi/dist/pi-runner.js
-var LOG_PREFIX2 = "[bunny-agent:pi]";
+var LOG_PREFIX = "[bunny-agent:pi]";
 var DEFAULT_DYNAMIC_MODEL_PROFILE = {
   contextWindow: 128e3,
   maxTokens: 16384,
@@ -44345,7 +44345,7 @@ function traceRawMessage(debugCwd, data, reset = false, optionsEnv) {
     return;
   try {
     const file3 = join12(debugCwd, "pi-message-stream-debug.json");
-    if (reset && existsSync9(file3))
+    if (reset && existsSync8(file3))
       unlinkSync7(file3);
     const type = data !== null && typeof data === "object" ? data.type : void 0;
     let payload = data;
@@ -44359,6 +44359,39 @@ function traceRawMessage(debugCwd, data, reset = false, optionsEnv) {
   } catch {
   }
 }
+async function createPiResourceLoader(options) {
+  const { systemPrompt } = options;
+  const defaultSkillDirs = [
+    join12(options.agentDir, "skills"),
+    join12(options.cwd, CONFIG_DIR_NAME, "skills")
+  ].filter((dir) => existsSync8(dir));
+  const loader = new DefaultResourceLoader({
+    cwd: options.cwd,
+    agentDir: options.agentDir,
+    settingsManager: options.settingsManager,
+    noSkills: true,
+    additionalSkillPaths: [...defaultSkillDirs, ...options.skillPaths ?? []],
+    appendSystemPromptOverride: systemPrompt ? (base) => [...base, systemPrompt] : void 0,
+    extensionFactories: options.extensionFactories
+  });
+  await loader.reload();
+  if (options.skillPaths && options.skillPaths.length > 0) {
+    logSkillLoad(options.cwd, options.skillPaths, loader.getSkills());
+  }
+  return loader;
+}
+function logSkillLoad(cwd, skillPaths, result) {
+  const lines = [`${LOG_PREFIX} loadSkills cwd=${cwd}`];
+  for (const raw of skillPaths) {
+    const abs = isAbsolute(raw) ? raw : resolve2(cwd, raw);
+    lines.push(`  ${raw} -> ${abs} (exists: ${existsSync8(abs) ? "yes" : "no"})`);
+  }
+  lines.push(`  loaded skills (${result.skills.length}): ${result.skills.map((s) => s.name).join(", ")}`);
+  for (const d of result.diagnostics) {
+    lines.push(`  [${d.type}] ${d.message}${d.path !== void 0 ? ` path=${d.path}` : ""}`);
+  }
+  console.error(lines.join("\n"));
+}
 function createPiRunner(options = {}) {
   const modelSpec = options.model;
   if (modelSpec == null || modelSpec.trim() === "") {
@@ -44372,6 +44405,8 @@ function createPiRunner(options = {}) {
   const mcpExtension = shouldEnableMcp(options.mcpConfig, options.allowedTools) ? createMcpExtension(options.mcpConfig) : void 0;
   return {
     async *run(userInput) {
+      const agentDir = getAgentDir();
+      const settingsManager = SettingsManager.create(cwd, agentDir);
       const modelRuntime = await ModelRuntime.create({
         modelsPath: null,
         allowModelNetwork: false
@@ -44418,7 +44453,7 @@ function createPiRunner(options = {}) {
         const sessionManager = await (async () => {
           if (forkFrom) {
             const sourcePath = resolveSessionPathById(cwd, forkFrom);
-            console.error(`${LOG_PREFIX2} fork: sourceId=${forkFrom} sourcePath=${sourcePath ?? "(not found)"}`);
+            console.error(`${LOG_PREFIX} fork: sourceId=${forkFrom} sourcePath=${sourcePath ?? "(not found)"}`);
             if (!sourcePath) {
               throw new Error(`Pi runner: forkFrom source session not found: ${forkFrom}`);
             }
@@ -44426,11 +44461,11 @@ function createPiRunner(options = {}) {
           }
           if (resume) {
             const sessionPath2 = resolveSessionPathById(cwd, resume);
-            console.error(`${LOG_PREFIX2} resume: id=${resume} path=${sessionPath2 ?? "(not found)"}`);
+            console.error(`${LOG_PREFIX} resume: id=${resume} path=${sessionPath2 ?? "(not found)"}`);
             if (sessionPath2) {
               if (isSessionFileTooLarge(sessionPath2)) {
                 const context = extractSessionContext(sessionPath2);
-                console.error(`${LOG_PREFIX2} session file too large, starting fresh${context ? " (with context)" : ""}`);
+                console.error(`${LOG_PREFIX} session file too large, starting fresh${context ? " (with context)" : ""}`);
                 const newMgr = SessionManager2.create(cwd);
                 if (context) {
                   const firstId = newMgr.getEntries()[0]?.id ?? "";
@@ -44444,24 +44479,14 @@ function createPiRunner(options = {}) {
           }
           return SessionManager2.create(cwd);
         })();
-        const resourceLoader = options.skillPaths || options.systemPrompt || mcpExtension ? new BunnyAgentResourceLoader({
-          cwd,
-          skillPaths: options.skillPaths,
-          appendSystemPrompt: options.systemPrompt,
-          extensionFactories: mcpExtension ? [mcpExtension] : void 0
-        }) : void 0;
-        if (options.skillPaths && options.skillPaths.length > 0) {
-          console.error(`${LOG_PREFIX2} runner: cwd=${cwd} skillPaths=${JSON.stringify(options.skillPaths)}`);
-        }
-        if (resourceLoader) {
-          await resourceLoader.reload();
-        }
         const applyPatchShimDir = ensureApplyPatchShim();
         const customTools = options.env && Object.keys(options.env).length > 0 ? buildSecretAwareTools(cwd, options.env, {
           systemEnv: options.systemEnv,
           pathPrepend: applyPatchShimDir
         }) : applyPatchShimDir ? [
-          buildEnvInjectedBashTool(cwd, {}, { pathPrepend: applyPatchShimDir })
+          buildEnvInjectedBashTool(cwd, {
+            pathPrepend: applyPatchShimDir
+          })
         ] : [];
         if (provider === "openai") {
           customTools.push(buildApplyPatchTool(cwd));
@@ -44482,29 +44507,34 @@ function createPiRunner(options = {}) {
           cwd,
           fallbackSignal: options.abortController?.signal
         };
-        let regularTools = [
-          ...applyAllowedTools(customTools, allowedTools),
-          ...toolRefDefinitions
-        ];
-        if (!bypassApproval) {
-          const overriddenNames = new Set(regularTools.map((tool) => tool.name));
-          const builtinTools = applyAllowedTools(createCodingTools(cwd), allowedTools).filter((tool) => !overriddenNames.has(tool.name));
-          regularTools = [...regularTools, ...builtinTools];
-        }
-        const gatedTools = gateToolsForApproval(regularTools, bypassApproval, approvalGate);
         const askUserQuestionEnabled = allowedTools === void 0 || allowedTools.includes(ASK_USER_QUESTION_TOOL_NAME);
         const previousModel = sessionManager.buildSessionContext?.().model;
         const thinkingLevel = resolveInitialThinkingLevel(options.effort, previousModel, model);
+        const resourceLoader = await createPiResourceLoader({
+          cwd,
+          agentDir,
+          settingsManager,
+          skillPaths: options.skillPaths,
+          systemPrompt: options.systemPrompt,
+          extensionFactories: [
+            createSecretGuardExtension(options.env ?? {}),
+            ...bypassApproval ? [] : [createToolApprovalExtension(approvalGate)],
+            ...mcpExtension ? [mcpExtension] : []
+          ]
+        });
         const { session } = await createAgentSession({
           cwd,
+          agentDir,
           model,
           sessionManager,
+          settingsManager,
           modelRuntime,
           resourceLoader,
           thinkingLevel,
           tools: allowedTools,
           customTools: [
-            ...gatedTools,
+            ...applyAllowedTools(customTools, allowedTools),
+            ...toolRefDefinitions,
             ...askUserQuestionEnabled ? [
               buildAskUserQuestionTool({
                 ...approvalGate,
@@ -44637,7 +44667,7 @@ function createPiRunner(options = {}) {
 }
 
 // ../../packages/runner-harness/dist/session.js
-import { existsSync as existsSync10, mkdirSync as mkdirSync8, readFileSync as readFileSync6, writeFileSync as writeFileSync9 } from "node:fs";
+import { existsSync as existsSync9, mkdirSync as mkdirSync8, readFileSync as readFileSync6, writeFileSync as writeFileSync9 } from "node:fs";
 import { join as join13 } from "node:path";
 var DIR = ".bunny-agent";
 var FILE = "session-id";
@@ -44647,7 +44677,7 @@ function sessionPath(cwd) {
 function readSessionId(cwd) {
   try {
     const p = sessionPath(cwd);
-    if (!existsSync10(p))
+    if (!existsSync9(p))
       return void 0;
     return readFileSync6(p, "utf8").trim() || void 0;
   } catch {
@@ -44663,21 +44693,21 @@ function writeSessionId(cwd, id) {
 }
 
 // ../../packages/runner-harness/dist/skills.js
-import { existsSync as existsSync11, readdirSync as readdirSync2, statSync as statSync2 } from "node:fs";
-import { homedir as homedir2 } from "node:os";
+import { existsSync as existsSync10, readdirSync as readdirSync2, statSync as statSync2 } from "node:fs";
+import { homedir } from "node:os";
 import { join as join14 } from "node:path";
 function discoverSkillPaths(cwd) {
   const paths = [];
   for (const base of [
     join14(cwd, "skills"),
-    join14(homedir2(), ".bunny-agent", "skills")
+    join14(homedir(), ".bunny-agent", "skills")
   ]) {
-    if (!existsSync11(base))
+    if (!existsSync10(base))
       continue;
     try {
       for (const entry of readdirSync2(base)) {
         const full = join14(base, entry);
-        if (statSync2(full).isDirectory() && existsSync11(join14(full, "SKILL.md"))) {
+        if (statSync2(full).isDirectory() && existsSync10(join14(full, "SKILL.md"))) {
           paths.push(full);
         }
       }
@@ -45211,7 +45241,7 @@ async function runAcpAgent(options) {
 import { execSync } from "node:child_process";
 import {
   copyFileSync,
-  existsSync as existsSync12,
+  existsSync as existsSync11,
   mkdirSync as mkdirSync9,
   readdirSync as readdirSync3,
   readFileSync as readFileSync7,
@@ -45239,7 +45269,7 @@ function getShippedDockerfile() {
     resolve3(process.cwd(), "docker", "bunny-agent-claude", "Dockerfile")
   ];
   for (const p of candidates) {
-    if (existsSync12(p)) return p;
+    if (existsSync11(p)) return p;
   }
   console.error(
     `\u274C Dockerfile not found. Searched:
@@ -45260,7 +45290,7 @@ function ensureDocker() {
 }
 function resolveTemplatePath(template) {
   const abs = resolve3(process.cwd(), template);
-  if (!existsSync12(abs)) {
+  if (!existsSync11(abs)) {
     console.error(`\u274C Template directory not found: ${abs}`);
     process.exit(1);
   }
@@ -45297,16 +45327,16 @@ async function buildImage(opts) {
     const destDir = join15(buildContext, "templates", templateName);
     mkdirSync9(destDir, { recursive: true });
     const claudeMd = join15(templatePath, "CLAUDE.md");
-    if (existsSync12(claudeMd))
+    if (existsSync11(claudeMd))
       copyFileSync(claudeMd, join15(destDir, "CLAUDE.md"));
     const claudeDir = join15(templatePath, ".claude");
-    if (existsSync12(claudeDir)) copyDirSync(claudeDir, join15(destDir, ".claude"));
+    if (existsSync11(claudeDir)) copyDirSync(claudeDir, join15(destDir, ".claude"));
     let copyLines = "\n# Template files\nRUN mkdir -p /opt/bunny-agent/templates";
-    if (existsSync12(join15(destDir, "CLAUDE.md"))) {
+    if (existsSync11(join15(destDir, "CLAUDE.md"))) {
       copyLines += `
 COPY templates/${templateName}/CLAUDE.md /opt/bunny-agent/templates/CLAUDE.md`;
     }
-    if (existsSync12(join15(destDir, ".claude"))) {
+    if (existsSync11(join15(destDir, ".claude"))) {
       copyLines += `
 COPY templates/${templateName}/.claude /opt/bunny-agent/templates/.claude`;
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bunny-agent/runner-cli",
-  "version": "0.9.62",
+  "version": "0.9.63-beta.2",
   "description": "BunnyAgent Runner CLI - Like gemini-cli or claude-code, runs in your local terminal with AI SDK UI streaming",
   "type": "module",
   "bin": {
@@ -42,15 +42,15 @@
   "dependencies": {
     "@anthropic-ai/claude-agent-sdk": "0.3.215",
     "@anthropic-ai/sdk": "0.112.3",
-    "@earendil-works/pi-agent-core": "1.2.0",
-    "@earendil-works/pi-ai": "1.2.0",
-    "@earendil-works/pi-coding-agent": "1.2.0",
-    "@earendil-works/pi-tui": "1.2.0",
+    "@earendil-works/pi-agent-core": "1.3.0",
+    "@earendil-works/pi-ai": "1.3.0",
+    "@earendil-works/pi-coding-agent": "1.3.0",
+    "@earendil-works/pi-tui": "1.3.0",
     "@github/copilot-sdk": "1.0.7",
     "@openai/codex-sdk": "^0.144.6",
     "dotenv": "^17.3.1",
     "jiti": "2.7.0",
-    "pi-mcp-adapter": "5.3.0",
+    "pi-mcp-adapter": "5.3.1",
     "typebox": "1.1.38",
     "zod": "^4.0.0"
   },
@@ -60,15 +60,15 @@
     "typescript": "^5.3.0",
     "vitest": "^1.6.1",
     "@bunny-agent/apply-patch": "0.1.0",
-    "@bunny-agent/runner-claude": "0.6.2",
-    "@bunny-agent/manager": "0.9.62",
     "@bunny-agent/runner-codex": "0.6.2",
+    "@bunny-agent/runner-claude": "0.6.2",
     "@bunny-agent/runner-gemini": "0.6.2",
     "@bunny-agent/runner-harness": "0.1.1-beta.0",
     "@bunny-agent/runner-copilot": "0.1.0",
-    "@bunny-agent/server-acp": "0.1.0",
+    "@bunny-agent/runner-opencode": "0.6.2",
     "@bunny-agent/runner-pi": "0.6.4-beta.0",
-    "@bunny-agent/runner-opencode": "0.6.2"
+    "@bunny-agent/manager": "0.9.63-beta.2",
+    "@bunny-agent/server-acp": "0.1.0"
   },
   "scripts": {
     "build": "tsc && pnpm bundle",