@chengchenccc/oh-my-agent 0.2.0-rc.2 → 0.2.0-rc.4

package/dist/core/runtime/permission-classifier.js

@@ -91,11 +91,24 @@ export async function classifyPermissionAction(opts) {
  *  the filesystem root, a top-level system directory, home, or a glob under
  *  a shell variable (empty expansion deletes from root). Deterministic,
  *  runs BEFORE the classifier, and NOTHING overrides it — the model must
- *  re-issue a narrower, named path. $() and backtick substitution ARE
- *  caught (the separator split lands rm in command position of a segment)
- *  and a quoted binary ("rm" -rf /) is caught by quote-stripping;
- *  `command rm`, `\rm`, and variable commands ($CMD) are NOT — the
- *  classifier prompt's destruction rule is the second layer.
+ *  re-issue a narrower, named path.
+ *
+ *  Command position is found by walking past forms that shift it, since a
+ *  wrapper (`bash -c "rm -rf /"`), an exec prefix (`nice rm -rf /`) or an
+ *  absolute binary (`/bin/rm`) otherwise hides the delete: $()/backtick
+ *  substitution (the segment split lands rm in command position), the wrappers
+ *  listed in SHELL_WRAPPERS, their flags and `VAR=value` assignments, plus
+ *  quoting/escaping on the binary itself ("rm" / \rm / /bin/rm).
+ *
+ *  Ceiling (the classifier prompt's destruction rule is the second layer): an
+ *  rm behind a variable or a computed command ($CMD, `$(printf rm)`), behind a
+ *  wrapper not in the set (`chroot / rm -rf /`), and the mirror-image
+ *  ambiguity — a wrapper OPTION's argument read as command position, so
+ *  `command -v rm /etc` and `sudo -u root rm -rf /` are judged wrongly (the
+ *  first is a false positive, the second a miss). A token scan cannot resolve
+ *  that; a real shell parser is the fix, and the ponytail note below is the
+ *  standing invitation to write one.
+ *
  *  ponytail: token scan, not a shell AST; move to a real parser if models
  *  start hiding critical deletes in the remaining forms. */
 const TOP_LEVEL_DIRS = "usr|etc|var|bin|sbin|lib|lib64|boot|dev|proc|sys|opt|home|root|tmp|mnt|media|srv|run|data";
@@ -114,17 +127,75 @@ function isCriticalTarget(token) {
         return true;
     return false;
 }
+/** Shell prefixes that put the real command later in the same segment.
+ *  `bash -c "rm -rf /"` was the whole bypass: the first token was `bash`. */
+const SHELL_WRAPPERS = new Set([
+    // Shells: `bash -c "rm -rf /"` was the original bypass.
+    "bash",
+    "sh",
+    "zsh",
+    "dash",
+    "ksh",
+    "ash",
+    // Exec prefixes that take no option argument, so the next bare token really
+    // is the command: `nice rm -rf /`, `eval 'rm -rf /'`, `busybox rm -rf /`.
+    "nice",
+    "ionice",
+    "setsid",
+    "stdbuf",
+    "time",
+    "eval",
+    "exec",
+    "busybox",
+    "toybox",
+    // Privilege/environment prefixes.
+    "env",
+    "nohup",
+    "sudo",
+    "doas",
+    "su",
+    "runuser",
+    "command",
+    "xargs",
+]);
+/** The binary a token names once the shell has stripped quoting (`"rm"`),
+ *  escaping (`\rm`) and any directory prefix (`/bin/rm`, `./rm`). */
+function binaryName(token) {
+    const unquoted = token.replace(/^["']+|["']+$/g, "");
+    const unescaped = unquoted.startsWith("\\") ? unquoted.slice(1) : unquoted;
+    return unescaped.replace(/^.*\//, "");
+}
 export function isCriticalDeletion(command) {
-    // rm/rmdir must be in COMMAND POSITION (first token of a segment split
-    // on shell separators incl. newline and backtick substitution — quotes on
-    // the binary itself are stripped). "echo about rm /etc" is prose.
+    // rm/rmdir must be in COMMAND POSITION: the first token of a segment (split
+    // on shell separators incl. newline and backtick substitution) once wrappers,
+    // their flags and `VAR=value` assignments are walked past. "echo about rm
+    // /etc" is prose — its command position is `echo`, so it is not our business.
     const segments = command.split(/[;&|()`\n]/);
     for (const segment of segments) {
-        const tokens = segment.trim().split(/\s+/);
-        const first = (tokens[0] ?? "").replace(/^["']+|["']+$/g, "");
-        if (!/^(rm|rmdir)$/.test(first))
+        const tokens = segment
+            .trim()
+            .split(/\s+/)
+            .filter((t) => t.length > 0);
+        let i = 0;
+        while (i < tokens.length) {
+            const token = tokens[i];
+            if (/^[A-Za-z_]\w*=/.test(token)) {
+                i++; // env assignment FOO=1
+                continue;
+            }
+            if (SHELL_WRAPPERS.has(binaryName(token))) {
+                i++; // nested wrappers: bash -c "sh -c 'rm -rf /'"
+                continue;
+            }
+            if (token.startsWith("-")) {
+                i++; // wrapper flag (-c, -lc, -0, ...)
+                continue;
+            }
+            break;
+        }
+        if (!/^(rm|rmdir)$/.test(binaryName(tokens[i] ?? "")))
             continue;
-        for (let j = 1; j < tokens.length; j++) {
+        for (let j = i + 1; j < tokens.length; j++) {
             const token = tokens[j];
             if (token.startsWith("-"))
                 continue; // flags

package/dist/core/runtime/plugin.d.ts

@@ -80,6 +80,13 @@ export interface Plugin {
     readonly tools?: readonly PluginTool[];
     readonly meta?: readonly MetaSectionProvider[];
 }
+/** Fails closed on every collision class that is unambiguous: duplicate plugin
+ *  names, duplicate tool names, and duplicate meta-section names. The meta
+ *  check used to be missing, and renderMeta simply emitted `## <name>` twice —
+ *  two context sections that look like one, with no error anywhere.
+ *
+ *  Hook "collisions" are not a collision: every plugin's hook runs, in plugin
+ *  order, by design. */
 export declare function validatePlugins(plugins: readonly Plugin[]): void;
 export declare function renderMeta(plugins: readonly Plugin[]): string;
 export declare function collectTools(plugins: readonly Plugin[]): PluginTool[];

package/dist/core/runtime/plugin.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"plugin.d.ts","sourceRoot":"","sources":["../../../src/core/runtime/plugin.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,MAAM,8BAA8B,CAAC;AACxF,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,uBAAuB,CAAC;AACrD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AACrD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AACtD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAEzD,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,WAAW,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IACzD;wEACoE;IACpE,QAAQ,CAAC,aAAa,CAAC,EAAE,QAAQ,GAAG,YAAY,CAAC;IACjD;+EAC2E;IAC3E,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,OAAO,CACL,IAAI,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,EACvC,MAAM,CAAC,EAAE,WAAW;IACpB;mDAC+C;IAC/C,OAAO,CAAC,EAAE;QACR,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,oEAAoE;QACpE,QAAQ,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAC;QACrC;;+DAEuD;QACvD,OAAO,CAAC,EAAE,CAAC,GAAG,EAAE;YAAE,MAAM,CAAC,EAAE,MAAM,CAAA;SAAE,KAAK,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC,CAAC;QACzE;;2CAEmC;QACnC,GAAG,CAAC,EAAE,CAAC,KAAK,EAAE,gBAAgB,KAAK,OAAO,CAAC,iBAAiB,GAAG,IAAI,CAAC,CAAC;KACtE,GACA,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC;CAC/C;AAED,MAAM,WAAW,WAAW;IAE1B;gFAC4E;IAC5E,SAAS,CAAC,CAAC,QAAQ,EAAE,SAAS,OAAO,EAAE,EAAE,EAAE,EAAE,aAAa,GAAG,IAAI,CAAC;IAClE;6DACyD;IACzD,QAAQ,CAAC,CACP,MAAM,EAAE,WAAW,GAAG,QAAQ,GAAG,SAAS,EAC1C,QAAQ,EAAE,SAAS,OAAO,EAAE,EAC5B,EAAE,EAAE,aAAa,GAChB,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAGxB,gEAAgE;IAChE,WAAW,CAAC,CAAC,QAAQ,EAAE,SAAS,OAAO,EAAE,EAAE,EAAE,EAAE,aAAa,GAAG,SAAS,OAAO,EAAE,CAAC;IAClF;2BACuB;IACvB,UAAU,CAAC,CAAC,QAAQ,EAAE,SAAS,OAAO,EAAE,EAAE,EAAE,EAAE,aAAa,GAAG,IAAI,CAAC;IAGnE;;mDAE+C;IAC/C,UAAU,CAAC,CACT,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,OAAO,EACd,EAAE,EAAE,aAAa,GAChB,SAAS,GAAG;QAAE,KAAK,CAAC,EAAE,OAAO,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IACpD;;0CAEsC;IACtC,SAAS,CAAC,CACR,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,OAAO,EACf,EAAE,EAAE,aAAa,GAChB,YAAY,GAAG;QAAE,OAAO,CAAC,EAAE,OAAO,CAAC;QAAC,OAAO,CAAC,EAAE,OAAO,CAAC;QAAC,SAAS,CAAC,EAAE,OAAO,CAAA;KAAE,GAAG,SAAS,CAAC;IAC5F;sEACkE;IAClE,iBAAiB,CAAC,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE,aAAa,GAAG,OAAO,CAAC;IAEjF;+DAC2D;IAC3D,UAAU,CAAC,CAAC,MAAM,EAAE,MAAM,IAAI,EAAE,EAAE,EAAE,aAAa,GAAG,IAAI,CAAC;IACzD;;wDAEoD;IACpD,SAAS,CAAC,CAAC,MAAM,EAAE,OAAO,EAAE,EAAE,EAAE,aAAa,GAAG,IAAI,CAAC;CACtD;AAED,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,MAAM,IAAI,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,MAAM;IACrB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,KAAK,CAAC,EAAE,WAAW,CAAC;IAC7B,QAAQ,CAAC,KAAK,CAAC,EAAE,SAAS,UAAU,EAAE,CAAC;IACvC,QAAQ,CAAC,IAAI,CAAC,EAAE,SAAS,mBAAmB,EAAE,CAAC;CAChD;AAED,wBAAgB,eAAe,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,GAAG,IAAI,CAYhE;AAED,wBAAgB,UAAU,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,GAAG,MAAM,CAK7D;AAED,wBAAgB,YAAY,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,GAAG,UAAU,EAAE,CAErE"}
+{"version":3,"file":"plugin.d.ts","sourceRoot":"","sources":["../../../src/core/runtime/plugin.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,MAAM,8BAA8B,CAAC;AACxF,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,uBAAuB,CAAC;AACrD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AACrD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AACtD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAEzD,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,WAAW,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IACzD;wEACoE;IACpE,QAAQ,CAAC,aAAa,CAAC,EAAE,QAAQ,GAAG,YAAY,CAAC;IACjD;+EAC2E;IAC3E,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,OAAO,CACL,IAAI,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,EACvC,MAAM,CAAC,EAAE,WAAW;IACpB;mDAC+C;IAC/C,OAAO,CAAC,EAAE;QACR,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,oEAAoE;QACpE,QAAQ,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAC;QACrC;;+DAEuD;QACvD,OAAO,CAAC,EAAE,CAAC,GAAG,EAAE;YAAE,MAAM,CAAC,EAAE,MAAM,CAAA;SAAE,KAAK,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC,CAAC;QACzE;;2CAEmC;QACnC,GAAG,CAAC,EAAE,CAAC,KAAK,EAAE,gBAAgB,KAAK,OAAO,CAAC,iBAAiB,GAAG,IAAI,CAAC,CAAC;KACtE,GACA,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC;CAC/C;AAED,MAAM,WAAW,WAAW;IAE1B;gFAC4E;IAC5E,SAAS,CAAC,CAAC,QAAQ,EAAE,SAAS,OAAO,EAAE,EAAE,EAAE,EAAE,aAAa,GAAG,IAAI,CAAC;IAClE;6DACyD;IACzD,QAAQ,CAAC,CACP,MAAM,EAAE,WAAW,GAAG,QAAQ,GAAG,SAAS,EAC1C,QAAQ,EAAE,SAAS,OAAO,EAAE,EAC5B,EAAE,EAAE,aAAa,GAChB,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAGxB,gEAAgE;IAChE,WAAW,CAAC,CAAC,QAAQ,EAAE,SAAS,OAAO,EAAE,EAAE,EAAE,EAAE,aAAa,GAAG,SAAS,OAAO,EAAE,CAAC;IAClF;2BACuB;IACvB,UAAU,CAAC,CAAC,QAAQ,EAAE,SAAS,OAAO,EAAE,EAAE,EAAE,EAAE,aAAa,GAAG,IAAI,CAAC;IAGnE;;mDAE+C;IAC/C,UAAU,CAAC,CACT,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,OAAO,EACd,EAAE,EAAE,aAAa,GAChB,SAAS,GAAG;QAAE,KAAK,CAAC,EAAE,OAAO,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IACpD;;0CAEsC;IACtC,SAAS,CAAC,CACR,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,OAAO,EACf,EAAE,EAAE,aAAa,GAChB,YAAY,GAAG;QAAE,OAAO,CAAC,EAAE,OAAO,CAAC;QAAC,OAAO,CAAC,EAAE,OAAO,CAAC;QAAC,SAAS,CAAC,EAAE,OAAO,CAAA;KAAE,GAAG,SAAS,CAAC;IAC5F;sEACkE;IAClE,iBAAiB,CAAC,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE,aAAa,GAAG,OAAO,CAAC;IAEjF;+DAC2D;IAC3D,UAAU,CAAC,CAAC,MAAM,EAAE,MAAM,IAAI,EAAE,EAAE,EAAE,aAAa,GAAG,IAAI,CAAC;IACzD;;wDAEoD;IACpD,SAAS,CAAC,CAAC,MAAM,EAAE,OAAO,EAAE,EAAE,EAAE,aAAa,GAAG,IAAI,CAAC;CACtD;AAED,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,MAAM,IAAI,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,MAAM;IACrB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,KAAK,CAAC,EAAE,WAAW,CAAC;IAC7B,QAAQ,CAAC,KAAK,CAAC,EAAE,SAAS,UAAU,EAAE,CAAC;IACvC,QAAQ,CAAC,IAAI,CAAC,EAAE,SAAS,mBAAmB,EAAE,CAAC;CAChD;AAED;;;;;;wBAMwB;AACxB,wBAAgB,eAAe,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,GAAG,IAAI,CAkBhE;AAED,wBAAgB,UAAU,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,GAAG,MAAM,CAK7D;AAED,wBAAgB,YAAY,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,GAAG,UAAU,EAAE,CAErE"}

package/dist/core/runtime/plugin.js

@@ -1,6 +1,14 @@
+/** Fails closed on every collision class that is unambiguous: duplicate plugin
+ *  names, duplicate tool names, and duplicate meta-section names. The meta
+ *  check used to be missing, and renderMeta simply emitted `## <name>` twice —
+ *  two context sections that look like one, with no error anywhere.
+ *
+ *  Hook "collisions" are not a collision: every plugin's hook runs, in plugin
+ *  order, by design. */
 export function validatePlugins(plugins) {
     const names = new Set();
     const toolNames = new Set();
+    const metaNames = new Set();
     for (const p of plugins) {
         if (names.has(p.name))
             throw new Error(`Duplicate plugin name: ${p.name}`);
@@ -10,6 +18,11 @@ export function validatePlugins(plugins) {
                 throw new Error(`Duplicate tool name: ${t.name} (plugin ${p.name})`);
             toolNames.add(t.name);
         }
+        for (const m of p.meta ?? []) {
+            if (metaNames.has(m.name))
+                throw new Error(`Duplicate meta section: ${m.name} (plugin ${p.name})`);
+            metaNames.add(m.name);
+        }
     }
 }
 export function renderMeta(plugins) {

package/dist/core/runtime/process-tree.d.ts

@@ -1,12 +1,3 @@
-/** Process-tree teardown helper shared by MCP stdio clients.
-
- *  The MCP SDK's StdioClientTransport.close() only SIGKILLs its direct
- *  child. npm/npx-style servers spawn grandchildren (npm -> sh -> node)
- *  that inherit the stdio pipes; once the direct child dies they are
- *  reparented to init, so a post-close pgrep -P walk cannot find them.
- *  Collect the whole descendant tree BEFORE closing, then SIGKILL every
- *  pid after the SDK close. */
-export declare function collectDescendants(pid: number): number[];
 /** Collect pid + descendants, then SIGKILL them all (best-effort). */
 export declare function killProcessTree(pid: number): void;
 //# sourceMappingURL=process-tree.d.ts.map

package/dist/core/runtime/process-tree.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"process-tree.d.ts","sourceRoot":"","sources":["../../../src/core/runtime/process-tree.ts"],"names":[],"mappings":"AAAA;;;;;;;+BAO+B;AAC/B,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,EAAE,CAkBxD;AAED,sEAAsE;AACtE,wBAAgB,eAAe,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,CASjD"}
+{"version":3,"file":"process-tree.d.ts","sourceRoot":"","sources":["../../../src/core/runtime/process-tree.ts"],"names":[],"mappings":"AA4BA,sEAAsE;AACtE,wBAAgB,eAAe,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,CASjD"}

package/dist/core/runtime/process-tree.js

@@ -6,7 +6,7 @@
  *  reparented to init, so a post-close pgrep -P walk cannot find them.
  *  Collect the whole descendant tree BEFORE closing, then SIGKILL every
  *  pid after the SDK close. */
-export function collectDescendants(pid) {
+function collectDescendants(pid) {
     const descendants = [];
     const queue = [pid];
     while (queue.length > 0) {

package/dist/core/runtime/run-runtime.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"run-runtime.d.ts","sourceRoot":"","sources":["../../../src/core/runtime/run-runtime.ts"],"names":[],"mappings":"AAGA,OAAO,EACL,KAAK,gBAAgB,EAErB,KAAK,oBAAoB,EAC1B,MAAM,8BAA8B,CAAC;AACtC,OAAO,EAAE,KAAK,YAAY,EAAE,KAAK,iBAAiB,EAAqB,MAAM,kBAAkB,CAAC;AAMhG,OAAO,EACL,KAAK,aAAa,EAClB,KAAK,iBAAiB,EAItB,KAAK,UAAU,EACf,KAAK,MAAM,EAEX,KAAK,UAAU,EACf,KAAK,YAAY,EAClB,MAAM,aAAa,CAAC;AAQrB,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,8BAA8B,CAAC;AAEpE,OAAO,EAIL,KAAK,YAAY,EAElB,MAAM,iCAAiC,CAAC;AAGzC,OAAO,EAkBL,KAAK,YAAY,EACjB,KAAK,aAAa,EACnB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACL,KAAK,cAAc,EAGpB,MAAM,uBAAuB,CAAC;AAK/B,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,qBAAqB,CAAC;AAyFnE;;;;8DAI8D;AAC9D,wBAAgB,iBAAiB,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAI1D;AA6BD;;;gFAGgF;AAChF,wBAAsB,iBAAiB,CACrC,YAAY,EAAE,YAAY,EAC1B,OAAO,EAAE,MAAM,GACd,OAAO,CAAC,iBAAiB,CAAC,CAM5B;AAED;;;;;;;;gBAQgB;AAChB,MAAM,WAAW,cACf,SAAQ,IAAI,CAAC,uBAAuB,EAAE,SAAS,GAAG,mBAAmB,GAAG,kBAAkB,CAAC;IAC3F,SAAS,CAAC,EAAE,aAAa,CAAC;IAC1B,QAAQ,CAAC,EAAE,YAAY,CAAC;IACxB;iDAC6C;IAC7C,WAAW,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAChC,2EAA2E;IAC3E,gBAAgB,CAAC,EAAE,SAAS,eAAe,EAAE,CAAC;CAC/C;AAED,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,KAAK,EAAE,YAAY,CAAC;IAC7B;wDACoD;IACpD,QAAQ,CAAC,KAAK,EAAE,YAAY,CAAC;IAC7B,QAAQ,CAAC,OAAO,EAAE,UAAU,CAAC;IAC7B,+EAA+E;IAC/E,QAAQ,CAAC,eAAe,EAAE,SAAS,cAAc,EAAE,CAAC;IACpD,QAAQ,CAAC,SAAS,EAAE,iBAAiB,CAAC;IACtC,QAAQ,CAAC,aAAa,EAAE,aAAa,GAAG,SAAS,CAAC;IAClD,oEAAoE;IACpE,YAAY,CAAC,GAAG,EAAE,gBAAgB,CAAC,KAAK,CAAC,GAAG,IAAI,GAAG,IAAI,CAAC;IACxD;;sEAEkE;IAClE,eAAe,CAAC,KAAK,EAAE;QACrB,MAAM,EAAE,MAAM,CAAC;QACf,IAAI,CAAC,EAAE,OAAO,CAAC;KAChB,GAAG,OAAO,CAAC;QAAE,EAAE,EAAE,OAAO,CAAC;QAAC,WAAW,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,OAAO,CAAA;KAAE,CAAC,CAAC;IAClE;;sDAEkD;IAClD,eAAe,IAAI;QACjB,WAAW,EAAE,MAAM,CAAC;QACpB,YAAY,EAAE,MAAM,CAAC;QACrB,eAAe,EAAE,MAAM,CAAC;QACxB,gBAAgB,EAAE,MAAM,CAAC;KAC1B,CAAC;IACF,yDAAyD;IACzD,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACxB;AAED;;qDAEqD;AACrD,wBAAgB,wBAAwB,CACtC,OAAO,EAAE,YAAY,EACrB,GAAG,GAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAe,GAC9D,IAAI,CAON;AA+rBD;;+DAE+D;AAC/D,wBAAsB,kBAAkB,CAAC,IAAI,EAAE,cAAc,GAAG,OAAO,CAAC,UAAU,CAAC,CA2YlF;AAED,YAAY,EAAE,gBAAgB,EAAE,UAAU,EAAE,oBAAoB,EAAE,CAAC"}
+{"version":3,"file":"run-runtime.d.ts","sourceRoot":"","sources":["../../../src/core/runtime/run-runtime.ts"],"names":[],"mappings":"AAGA,OAAO,EACL,KAAK,gBAAgB,EAIrB,KAAK,oBAAoB,EAC1B,MAAM,8BAA8B,CAAC;AACtC,OAAO,EAAE,KAAK,YAAY,EAAE,KAAK,iBAAiB,EAAqB,MAAM,kBAAkB,CAAC;AAMhG,OAAO,EACL,KAAK,aAAa,EAClB,KAAK,iBAAiB,EAItB,KAAK,UAAU,EACf,KAAK,MAAM,EAEX,KAAK,UAAU,EACf,KAAK,YAAY,EAClB,MAAM,aAAa,CAAC;AAQrB,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,8BAA8B,CAAC;AAEpE,OAAO,EAIL,KAAK,YAAY,EAElB,MAAM,iCAAiC,CAAC;AAGzC,OAAO,EAkBL,KAAK,YAAY,EACjB,KAAK,aAAa,EACnB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACL,KAAK,cAAc,EAGpB,MAAM,uBAAuB,CAAC;AAM/B,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,qBAAqB,CAAC;AAuEnE;;;;8DAI8D;AAC9D,wBAAgB,iBAAiB,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAI1D;AA6BD;;;gFAGgF;AAChF,wBAAsB,iBAAiB,CACrC,YAAY,EAAE,YAAY,EAC1B,OAAO,EAAE,MAAM,GACd,OAAO,CAAC,iBAAiB,CAAC,CAM5B;AAED;;;;;;;;gBAQgB;AAChB,MAAM,WAAW,cACf,SAAQ,IAAI,CAAC,uBAAuB,EAAE,SAAS,GAAG,mBAAmB,GAAG,kBAAkB,CAAC;IAC3F,SAAS,CAAC,EAAE,aAAa,CAAC;IAC1B,QAAQ,CAAC,EAAE,YAAY,CAAC;IACxB;iDAC6C;IAC7C,WAAW,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAChC,2EAA2E;IAC3E,gBAAgB,CAAC,EAAE,SAAS,eAAe,EAAE,CAAC;CAC/C;AAED,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,KAAK,EAAE,YAAY,CAAC;IAC7B;wDACoD;IACpD,QAAQ,CAAC,KAAK,EAAE,YAAY,CAAC;IAC7B,QAAQ,CAAC,OAAO,EAAE,UAAU,CAAC;IAC7B,+EAA+E;IAC/E,QAAQ,CAAC,eAAe,EAAE,SAAS,cAAc,EAAE,CAAC;IACpD,QAAQ,CAAC,SAAS,EAAE,iBAAiB,CAAC;IACtC,QAAQ,CAAC,aAAa,EAAE,aAAa,GAAG,SAAS,CAAC;IAClD,oEAAoE;IACpE,YAAY,CAAC,GAAG,EAAE,gBAAgB,CAAC,KAAK,CAAC,GAAG,IAAI,GAAG,IAAI,CAAC;IACxD;;sEAEkE;IAClE,eAAe,CAAC,KAAK,EAAE;QACrB,MAAM,EAAE,MAAM,CAAC;QACf,IAAI,CAAC,EAAE,OAAO,CAAC;KAChB,GAAG,OAAO,CAAC;QAAE,EAAE,EAAE,OAAO,CAAC;QAAC,WAAW,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,OAAO,CAAA;KAAE,CAAC,CAAC;IAClE;;sDAEkD;IAClD,eAAe,IAAI;QACjB,WAAW,EAAE,MAAM,CAAC;QACpB,YAAY,EAAE,MAAM,CAAC;QACrB,eAAe,EAAE,MAAM,CAAC;QACxB,gBAAgB,EAAE,MAAM,CAAC;KAC1B,CAAC;IACF,yDAAyD;IACzD,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACxB;AAED;;qDAEqD;AACrD,wBAAgB,wBAAwB,CACtC,OAAO,EAAE,YAAY,EACrB,GAAG,GAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAe,GAC9D,IAAI,CAON;AAuuBD;;+DAE+D;AAC/D,wBAAsB,kBAAkB,CAAC,IAAI,EAAE,cAAc,GAAG,OAAO,CAAC,UAAU,CAAC,CA+alF;AAED,YAAY,EAAE,gBAAgB,EAAE,UAAU,EAAE,oBAAoB,EAAE,CAAC"}

package/dist/core/runtime/run-runtime.js

@@ -1,7 +1,7 @@
 import { randomUUID } from "node:crypto";
 import { existsSync, mkdirSync, writeFileSync } from "node:fs";
 import { join } from "node:path";
-import { debugLog, } from "@chengchenccc/agent-contract";
+import { CONSENTED_MCP_TOOLS_ENV, debugLog, decodeEnvList, } from "@chengchenccc/agent-contract";
 import { resolveModelAlias } from "@chengchenccc/ai";
 import { createHubTool } from "../coordination/index.js";
 import { createCoordinationRegistry } from "../coordination/registry.js";
@@ -25,37 +25,16 @@ import { createSkill } from "../tools/skill.js";
 import { createTodo, createTodoReadTool } from "../tools/todo.js";
 import { createFileTodoStore } from "../tools/todo-store.js";
 import { DEFAULT_APPROVAL_TIMEOUT_MS, withApprovalDeadline } from "./approval.js";
+import { estimateMessageTokens } from "./context-estimate.js";
 import { fakeProvider } from "./fake-provider.js";
 import { reasoningEffortOptions } from "./model-effort.js";
 import { classifyPermissionAction, DEFAULT_CLASSIFIER_TIMEOUT_MS, isCriticalDeletion, } from "./permission-classifier.js";
 import { loadRuntimeCatalog, registerProvidersFromCatalog } from "./runtime-catalog.js";
 import { loadStreamRules } from "./stream-rules.js";
 import { toolFilterAllows } from "./tool-filter.js";
-/** Token estimation via content char/4 (approx 1 token per 4 chars of
- *  English/code). More accurate than JSON.stringify char/4 which includes
- *  ~30% syntax overhead from key names, quotes, braces. Counts actual text +
- *  block content, adds a fixed overhead per message for role/structure
- *  framing. Swap for a real tokenizer (tiktoken, provider SDK) by replacing
- *  this function — the ContextBudget.estimate interface is the extension
- *  point. */
-function estimateMessageTokens(message) {
-    let chars = message.text?.length ?? 0;
-    if (message.blocks) {
-        for (const b of message.blocks) {
-            if (b.type === "text")
-                chars += b.text.length;
-            else if (b.type === "tool_use")
-                chars += JSON.stringify(b.input).length;
-            else if (b.type === "tool_result" && typeof b.content === "string")
-                chars += b.content.length;
-            else if (b.type === "thinking" && typeof b.text === "string")
-                chars += b.text.length;
-        }
-    }
-    // ~4 chars/token for content + 4 tokens framing overhead per message
-    // (role tag, separators — matches Anthropic's documented overhead).
-    return Math.ceil(chars / 4) + 4;
-}
+// The estimator lives in context-estimate.ts: pruning and the compaction
+// budget must measure the same quantity, or pruning's savedTokens are not
+// comparable to the budget they are subtracted from.
 /** Default native tool timeout (ms) for file/web/bash unless overridden. */
 const DEFAULT_NATIVE_TOOL_TIMEOUT_MS = 30_000;
 /** Wall-clock cap on ONE model call: a silent/stuck provider must not leave
@@ -199,8 +178,13 @@ function toPluginTool(t) {
  *  timeouts only on the main path). */
 async function buildNativeToolStage(deps, ctx) {
     const { knobs, bashSandbox, scope, registry } = ctx;
+    // Write freshness: "require" unless the workspace explicitly downgraded it.
+    // Absent knobs.editFreshness therefore means ON, so a workspace that never
+    // mentions it still gets the gate. (A backend RPC run never sees a workspace
+    // value here at all — see the projectSettings allowlist in assembleRunRuntime.)
+    const fileFreshness = knobs.editFreshness ?? "require";
     const agentTools = [
-        toPluginTool(createReadTool({ cwd: deps.workspaceRoot })),
+        toPluginTool(createReadTool({ cwd: deps.workspaceRoot, freshness: fileFreshness })),
         toPluginTool(createReadImageTool({ cwd: deps.workspaceRoot })),
         // ls and tree are the two directory views: ls is flat + mtime sorted
         // (cheap orientation), tree is recursive (structure). Both are read-side,
@@ -211,8 +195,16 @@ async function buildNativeToolStage(deps, ctx) {
         toPluginTool(createGrepTool({ workspaceRoot: deps.workspaceRoot })),
     ];
     if (deps.workspaceAccess === "read_write") {
-        agentTools.push(toPluginTool(createWriteTool({ cwd: deps.workspaceRoot })));
-        agentTools.push(toPluginTool(createEditTool({ cwd: deps.workspaceRoot })));
+        agentTools.push(toPluginTool(createWriteTool({
+            cwd: deps.workspaceRoot,
+            freshness: fileFreshness,
+            ...(deps.planMode ? { planMode: deps.planMode } : {}),
+        })));
+        agentTools.push(toPluginTool(createEditTool({
+            cwd: deps.workspaceRoot,
+            freshness: fileFreshness,
+            ...(deps.planMode ? { planMode: deps.planMode } : {}),
+        })));
         const bashToolOpts = { workspaceRoot: deps.workspaceRoot, scope, timeouts: knobs, registry };
         if (bashSandbox)
             bashToolOpts.sandbox = bashSandbox;
@@ -228,12 +220,17 @@ async function buildNativeToolStage(deps, ctx) {
         // Interactive web (JS/interaction/screenshots): browser is a headless
         // Chromium subprocess — read_only runs don't get it (it writes
         // screenshots into the workspace and drives real sessions).
-        agentTools.push(toPluginTool(createBrowserTool({ workspaceRoot: deps.workspaceRoot })));
+        agentTools.push(toPluginTool(createBrowserTool({
+            workspaceRoot: deps.workspaceRoot,
+            // Opt-in local access (dev-server screenshots). Absent = the same
+            // egress rule web_fetch enforces.
+            ...(knobs.browserLocalNetwork ? { allowLocalNetwork: true } : {}),
+        })));
     }
-    // Generic .mcp.json mounting (ADR 0022): user servers + knowledge.
-    // Skips "product-tools" (the manifest path owns it) and names that
-    // collide with the native table. The mounted clients join the run's
-    // teardown set so stdio children never outlive the run.
+    // Generic .mcp.json mounting (ADR 0022): user servers + spawner-bridged
+    // servers. Skips names that collide with the native table; the mounted
+    // clients join the run's teardown set so stdio children never outlive
+    // the run.
     // Standalone gating: an untrusted repo-controlled .mcp.json mounts
     // nothing (fail-closed) — the mode layer surfaces the warning.
     let includeWorkspaceMcp = true;
@@ -358,20 +355,23 @@ function createRunPermissionGates(deps, ctx) {
         eval: true,
         write: true,
         edit: true,
-        create_file: true,
         // learn/manage_skill write files; the skill branch writes OUTSIDE the
         // workspace (<agentDir>/managed-skills), so the workspace-sandbox
         // exemption cannot cover them (omp marks both approval="write").
         learn: true,
         manage_skill: true,
     };
-    // Product-owned mounts (workspace-bridge: features.ts names them
-    // "product-tools" / "knowledge") are consented-by-design read/context
-    // surfaces with their own per-run auth — never gate them, or ask/deny
-    // modes would demand a human click per history_* call.
-    const PRODUCT_MOUNTED_PREFIXES = ["mcp__product-tools__", "mcp__knowledge__"];
-    const isProductMounted = (toolName) => PRODUCT_MOUNTED_PREFIXES.some((p) => toolName.startsWith(p));
-    const classifierGated = (toolName, input) => !isProductMounted(toolName) &&
+    // Consent for mounted MCP tools is INJECTED policy (spawner-declared env
+    // var; name + comma codec single-sourced in agent-contract env.ts): the
+    // product declares its own read surfaces — reads of the run's
+    // conversation / knowledge / artifact storage, the run's todo scratch
+    // state, and the interactive ask — so ask/deny modes don't demand a
+    // human click per history_* call. oma itself holds NO product tool
+    // names; absent = every mcp__ tool is gated (fail-safe: a tool the
+    // product adds later stays gated until the spawner lists it).
+    const CONSENTED_MCP_TOOLS = new Set(decodeEnvList(process.env[CONSENTED_MCP_TOOLS_ENV]));
+    const isConsentedProductTool = (toolName) => CONSENTED_MCP_TOOLS.has(toolName);
+    const classifierGated = (toolName, input) => !isConsentedProductTool(toolName) &&
         (toolName === "bash" ||
             toolName === "browser" ||
             toolName === "eval" ||
@@ -460,14 +460,22 @@ function createRunPermissionGates(deps, ctx) {
      *  escalatedActions set per Run) but judge against their own intent —
      *  a subagent's "user request" is the task it was assigned. */
     const makeSessionPermissionGate = (intentTexts) => async (toolName, input, callId) => {
-        if (deps.permissionMode === undefined)
+        // "yolo" and absent are both ungated BY DESIGN: yolo is the
+        // skip-permissions mode. Everything that does not depend on judgment
+        // still applies (workspace containment, protected files, secret
+        // stripping, egress rules, write freshness) — those are tool-layer
+        // boundaries, not this gate.
+        const ungated = deps.permissionMode === undefined || deps.permissionMode === "yolo";
+        if (ungated)
             return undefined;
         if (deps.permissionMode === "auto") {
             if (!classifierGated(toolName, input))
                 return undefined;
-            // The auto gate must be fail-CLOSED end to end: the agent loop
-            // swallows gate exceptions as "no verdict" (= allow), so any
-            // error in here must convert to a block, never propagate.
+            // The auto gate must be fail-CLOSED end to end: any error in here
+            // must convert to a block, never propagate. The loop also catches a
+            // throwing gate and blocks ("permission gate error — fail closed",
+            // pinned by permission-gate-loop.test.ts); this try/catch is
+            // defense-in-depth with the block reason naming the real cause.
             try {
                 return await autoGateDecision(toolName, input, callId, [
                     ...intentTexts,
@@ -481,7 +489,7 @@ function createRunPermissionGates(deps, ctx) {
                 };
             }
         }
-        const isHighRisk = !isProductMounted(toolName) &&
+        const isHighRisk = !isConsentedProductTool(toolName) &&
             (HIGH_RISK_NATIVE_TOOLS[toolName] === true || toolName.startsWith("mcp__"));
         if (!isHighRisk)
             return undefined;
@@ -717,12 +725,30 @@ export async function assembleRunRuntime(deps) {
     // enabled-but-tool-missing — the Run fails loudly rather than silently
     // running unconstrained.
     let bashSandbox;
-    if (projectSettings.bashSandbox) {
+    const sandboxConfigured = projectSettings.bashSandbox === true;
+    if (sandboxConfigured) {
         bashSandbox = resolveBashSandbox({
             workspaceRoot: deps.workspaceRoot,
             enabled: true,
         });
     }
+    // Yolo needs a boundary that does not depend on judgment (the 2026
+    // consensus after the s1ngularity incident: an installed agent CLI with
+    // its permission flag disabled is a standing capability any package can
+    // borrow). Force the OS bash sandbox when the platform has one; a missing
+    // one degrades with a loud log instead of failing the Run — the remaining
+    // static boundaries (workspace containment for file tools, secret
+    // stripping, egress rules) still hold.
+    const yoloWantsBoundary = deps.permissionMode === "yolo" && bashSandbox === undefined;
+    if (yoloWantsBoundary) {
+        try {
+            bashSandbox = resolveBashSandbox({ workspaceRoot: deps.workspaceRoot, enabled: true });
+            debugLog("oma", "yolo: OS bash sandbox force-enabled");
+        }
+        catch (err) {
+            debugLog("oma", `yolo: no OS bash sandbox available (${err instanceof Error ? err.message : String(err)}) — bash runs unsandboxed; workspace/egress boundaries remain`);
+        }
+    }
     const scope = deps.coordinationScope ?? deps.runId;
     const registry = deps.registry ?? createCoordinationRegistry();
     const toolStage = await buildNativeToolStage(deps, {
@@ -751,6 +777,14 @@ export async function assembleRunRuntime(deps) {
             const nativeNames = new Set(plugins.flatMap((p) => (p.tools ?? []).map((t) => t.name)));
             const askGate = deps.permissionMode === "ask";
             for (const cp of deps.codePlugins) {
+                // A shadowed plugin tool is dropped, not merged (spec conflict
+                // matrix). Say so: an operator debugging a missing tool otherwise gets
+                // no signal at all.
+                for (const t of cp.tools ?? []) {
+                    if (nativeNames.has(t.name)) {
+                        debugLog("oma", `plugin tool "${t.name}" shadowed by a native tool; dropped`);
+                    }
+                }
                 const tools = (cp.tools ?? [])
                     .filter((t) => !nativeNames.has(t.name))
                     .map((t) => {
@@ -1055,8 +1089,13 @@ export async function assembleRunRuntime(deps) {
             // then dropped entirely (nothing can outlive it); a surface-provided
             // one keeps completed handles for a later Run's resume.
             delegationExecutor.stopLiveSubagents();
-            if (!deps.registry)
+            if (!deps.registry) {
+                // Kill what this Run owns BEFORE dropping the table: bg bash/eval
+                // children must not outlive the Run just because the bookkeeping
+                // did (clearAll alone orphans the processes).
+                registry.stopRunningEntries();
                 registry.clearAll();
+            }
             // Tear down mounted MCP clients so no child process or connection
             // outlives the Run. Each close is BOUNDED: a stuck transport (e.g. an
             // SSE socket that never answers close) must not wedge the child.

package/dist/core/runtime/runtime-catalog.d.ts

@@ -2,10 +2,6 @@ import { type CatalogSpec, type ModelRuntime } from "@chengchenccc/ai";
 /** Read and merge the first available runtime models.yml with BUILTIN_CATALOG.
  *  Returns BUILTIN_CATALOG unchanged if no file is found. */
 export declare function loadRuntimeCatalog(env?: Record<string, string | undefined>): CatalogSpec;
-/** Deep-merge two catalogs: override providers/models win; new entries added.
- *  Provider-level fields (api, baseUrl, apiKeyEnv) are overridden when present.
- *  Within a provider, models merge by id. */
-export declare function mergeCatalogs(base: CatalogSpec, override: CatalogSpec): CatalogSpec;
 /** Register every provider in the catalog whose apiKey env var is set.
  *  Providers without credentials are silently skipped. */
 export declare function registerProvidersFromCatalog(runtime: ModelRuntime, catalog: CatalogSpec, env: Record<string, string | undefined>): void;

package/dist/core/runtime/runtime-catalog.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"runtime-catalog.d.ts","sourceRoot":"","sources":["../../../src/core/runtime/runtime-catalog.ts"],"names":[],"mappings":"AAGA,OAAO,EAGL,KAAK,WAAW,EAEhB,KAAK,YAAY,EAIlB,MAAM,kBAAkB,CAAC;AAsB1B;6DAC6D;AAC7D,wBAAgB,kBAAkB,CAChC,GAAG,GAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAe,GACpD,WAAW,CAOb;AAED;;6CAE6C;AAC7C,wBAAgB,aAAa,CAAC,IAAI,EAAE,WAAW,EAAE,QAAQ,EAAE,WAAW,GAAG,WAAW,CASnF;AASD;0DAC0D;AAC1D,wBAAgB,4BAA4B,CAC1C,OAAO,EAAE,YAAY,EACrB,OAAO,EAAE,WAAW,EACpB,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,GACtC,IAAI,CAgBN"}
+{"version":3,"file":"runtime-catalog.d.ts","sourceRoot":"","sources":["../../../src/core/runtime/runtime-catalog.ts"],"names":[],"mappings":"AAGA,OAAO,EAGL,KAAK,WAAW,EAEhB,KAAK,YAAY,EAIlB,MAAM,kBAAkB,CAAC;AAsB1B;6DAC6D;AAC7D,wBAAgB,kBAAkB,CAChC,GAAG,GAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAe,GACpD,WAAW,CAOb;AAuBD;0DAC0D;AAC1D,wBAAgB,4BAA4B,CAC1C,OAAO,EAAE,YAAY,EACrB,OAAO,EAAE,WAAW,EACpB,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,GACtC,IAAI,CAgBN"}

package/dist/core/runtime/runtime-catalog.js

@@ -36,7 +36,7 @@ export function loadRuntimeCatalog(env = process.env) {
 /** Deep-merge two catalogs: override providers/models win; new entries added.
  *  Provider-level fields (api, baseUrl, apiKeyEnv) are overridden when present.
  *  Within a provider, models merge by id. */
-export function mergeCatalogs(base, override) {
+function mergeCatalogs(base, override) {
     const providers = { ...base.providers };
     for (const [pid, oSpec] of Object.entries(override.providers)) {
         const bSpec = providers[pid];

package/dist/core/runtime/stream-rules.d.ts

@@ -3,7 +3,14 @@ import type { StreamRule } from "../index.js";
  * `<root>/.oma/rules/*.md`. Frontmatter `condition: <regex>` is required;
  * the body below the frontmatter is the reminder text injected when the
  * rule matches mid-stream. Rule name = filename without `.md`.
- * Fail-open: an unreadable file, missing condition, empty body, or invalid
- * regex is skipped — rules must never block session startup. */
+ *
+ *  Fail-open: an unreadable file, missing condition, empty body, or invalid
+ *  regex is skipped — rules must never block session startup.
+ *
+ *  Two silent no-ops were NOT fail-open, they were fail-dead: the value is
+ *  read from the raw `condition:` line (no YAML parse), so a quoted pattern
+ *  compiled WITH its quotes and never matched anything, and the frontmatter
+ *  anchor required bare LF, so a CRLF rule file dropped every rule in it. Both
+ *  now load as written. */
 export declare function loadStreamRules(root: string): StreamRule[];
 //# sourceMappingURL=stream-rules.d.ts.map

package/dist/core/runtime/stream-rules.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"stream-rules.d.ts","sourceRoot":"","sources":["../../../src/core/runtime/stream-rules.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAE9C;;;;;gEAKgE;AAChE,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,UAAU,EAAE,CA+B1D"}
+{"version":3,"file":"stream-rules.d.ts","sourceRoot":"","sources":["../../../src/core/runtime/stream-rules.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAE9C;;;;;;;;;;;;2BAY2B;AAC3B,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,UAAU,EAAE,CAuC1D"}

package/dist/core/runtime/stream-rules.js

@@ -4,8 +4,15 @@ import { join } from "node:path";
  * `<root>/.oma/rules/*.md`. Frontmatter `condition: <regex>` is required;
  * the body below the frontmatter is the reminder text injected when the
  * rule matches mid-stream. Rule name = filename without `.md`.
- * Fail-open: an unreadable file, missing condition, empty body, or invalid
- * regex is skipped — rules must never block session startup. */
+ *
+ *  Fail-open: an unreadable file, missing condition, empty body, or invalid
+ *  regex is skipped — rules must never block session startup.
+ *
+ *  Two silent no-ops were NOT fail-open, they were fail-dead: the value is
+ *  read from the raw `condition:` line (no YAML parse), so a quoted pattern
+ *  compiled WITH its quotes and never matched anything, and the frontmatter
+ *  anchor required bare LF, so a CRLF rule file dropped every rule in it. Both
+ *  now load as written. */
 export function loadStreamRules(root) {
     const dir = join(root, ".oma", "rules");
     let files;
@@ -21,11 +28,18 @@ export function loadStreamRules(root) {
     for (const file of files) {
         try {
             const content = readFileSync(join(dir, file), "utf8");
-            const frontmatter = content.match(/^---\n([\s\S]*?)\n---/)?.[1];
-            const condition = frontmatter?.match(/^condition:\s*(.+)$/m)?.[1]?.trim();
+            // \r?\n: a CRLF rule file must load, not silently yield no rules.
+            const frontmatter = content.match(/^---\r?\n([\s\S]*?)\r?\n---/)?.[1];
+            const raw = frontmatter?.match(/^condition:\s*(.+)$/m)?.[1]?.trim();
+            // One matching pair of quotes is YAML syntax, not part of the pattern:
+            // `condition: 'foo|bar'` must compile to foo|bar.
+            const condition = raw &&
+                ((raw.startsWith("'") && raw.endsWith("'")) || (raw.startsWith('"') && raw.endsWith('"')))
+                ? raw.slice(1, -1)
+                : raw;
             if (!condition)
                 continue;
-            const message = content.replace(/^---\n[\s\S]*?\n---\n?/, "").trim();
+            const message = content.replace(/^---\r?\n[\s\S]*?\r?\n---\r?\n?/, "").trim();
             if (!message)
                 continue;
             rules.push({

package/dist/core/runtime/title.d.ts

@@ -2,6 +2,18 @@ import { type Message } from "@chengchenccc/message";
 import type { PluginRuntime } from "./plugin-runtime.js";
 export declare function isLowSignalTitleInput(message: string): boolean;
 export declare function normalizeGeneratedTitle(raw: string): string | null;
+/** The one-sentence session summary that rides the title call. Null when the
+ *  model answered with a bare title (older prompts, weak models) — the resume
+ *  list then falls back to the title/preview it showed before. */
+export declare function normalizeGeneratedSummary(raw: string): string | null;
 export declare function buildTitleContext(msgs: Message[], maxTurns?: number): string;
-export declare function generateTitle(rt: PluginRuntime, context: string): Promise<string | null>;
+/** Title + summary from ONE ephemeral call. Both ride the same 3-7-word
+ *  prompt because a second call would double the per-session cost for a
+ *  resume-list nicety; a weak model that answers title-only still yields a
+ *  usable title and a null summary. */
+export interface GeneratedLabels {
+    readonly title: string | null;
+    readonly summary: string | null;
+}
+export declare function generateTitleAndSummary(rt: PluginRuntime, context: string): Promise<GeneratedLabels>;
 //# sourceMappingURL=title.d.ts.map

package/dist/core/runtime/title.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"title.d.ts","sourceRoot":"","sources":["../../../src/core/runtime/title.ts"],"names":[],"mappings":"AAAA,OAAO,EAAe,KAAK,OAAO,EAAE,MAAM,uBAAuB,CAAC;AAClE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AA0CzD,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAI9D;AA0BD,wBAAgB,uBAAuB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAelE;AAID,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,OAAO,EAAE,EAAE,QAAQ,SAAI,GAAG,MAAM,CAOvE;AAID,wBAAsB,aAAa,CAAC,EAAE,EAAE,aAAa,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAmB9F"}
+{"version":3,"file":"title.d.ts","sourceRoot":"","sources":["../../../src/core/runtime/title.ts"],"names":[],"mappings":"AAAA,OAAO,EAAe,KAAK,OAAO,EAAE,MAAM,uBAAuB,CAAC;AAClE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AA0CzD,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAI9D;AA6CD,wBAAgB,uBAAuB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAYlE;AAED;;kEAEkE;AAClE,wBAAgB,yBAAyB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAWpE;AAID,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,OAAO,EAAE,EAAE,QAAQ,SAAI,GAAG,MAAM,CAOvE;AAID;;;uCAGuC;AACvC,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;CACjC;AAED,wBAAsB,uBAAuB,CAC3C,EAAE,EAAE,aAAa,EACjB,OAAO,EAAE,MAAM,GACd,OAAO,CAAC,eAAe,CAAC,CAsB1B"}