@dreb/coding-agent 2.40.2 → 2.42.0

package/README.md

@@ -81,7 +81,7 @@ Or use a custom provider (corporate proxy, Bedrock, etc.) — see [Custom provid
 
 Then just talk to dreb. All 11 built-in tools are enabled by default: `read`, `write`, `edit`, `bash`, `grep`, `find`, `ls`, `web_search`, `web_fetch`, `subagent`, and `wait`. Use `--tools` to restrict to a subset (e.g., `--tools read,grep,find,ls` for read-only). Three additional tools — `search`, `skill`, and `tasks_update` — are always active regardless of `--tools`. `suggest_next` is active by default but excluded when `--tools` is specified. The model uses these to fulfill your requests. Add capabilities via [skills](#skills), [prompt templates](#prompt-templates), [extensions](#extensions), or [packages](#packages).
 
-**Also available:** [`@dreb/telegram`](https://www.npmjs.com/package/@dreb/telegram) — run dreb as a Telegram bot with live tool status and visible results for user-facing tools (`npm install -g @dreb/telegram`). [`@dreb/dashboard`](https://www.npmjs.com/package/@dreb/dashboard) — run `dreb dashboard` for a browser UI with fleet overview, full chat steering, subagent observability, host file browser, and Tailscale/rotating-code pairing (`npm install -g @dreb/dashboard`; see [docs/dashboard.md](docs/dashboard.md)).
+**Also available:** [`@dreb/telegram`](https://www.npmjs.com/package/@dreb/telegram) — run dreb as a Telegram bot with live tool status and visible results for user-facing tools (`npm install -g @dreb/telegram`). [`@dreb/dashboard`](https://www.npmjs.com/package/@dreb/dashboard) — run `dreb dashboard` for a browser UI with fleet overview, full chat steering, subagent observability, host file browser, and Tailscale/rotating-code pairing (`npm install -g @dreb/dashboard`; see [docs/dashboard.md](docs/dashboard.md)). Its top bar and persistent session header indicators report connecting, connected, retrying, resyncing, disconnected, or auth failed; bounded SSE replay plus an explicit snapshot barrier restores session state and tasks after a reload, restart, gap, backpressure disconnect, or stalled stream.
 
 **Platform notes:** [Windows](docs/windows.md) | [Termux (Android)](docs/termux.md) | [tmux](docs/tmux.md) | [Terminal setup](docs/terminal-setup.md) | [Shell aliases](docs/shell-aliases.md)
 
@@ -276,7 +276,7 @@ Use `/settings` to modify common options, or edit JSON files directly:
 | `~/.dreb/agent/settings.json` | Global (all projects) |
 | `.dreb/settings.json` | Project (overrides global) |
 
-See [docs/settings.md](docs/settings.md) for all options.
+See [docs/settings.md](docs/settings.md) for all options. Dashboard Settings re-entry reloads durable global and project settings after flushing pending writes, so it sees external file edits; unreadable, invalid, or failed writes are surfaced as errors rather than showing stale values. See the [RPC settings contract](docs/rpc.md#get_settings).
 
 ---
 
@@ -289,16 +289,29 @@ dreb loads `AGENTS.md` (or `CLAUDE.md`) at startup from:
 
 Use for project instructions, conventions, common commands. All matching files are concatenated.
 
-### Nested context auto-load
+### Nested context trust
 
-The startup scan only walks **upward** from cwd, so an `AGENTS.md`/`CLAUDE.md` that lives in a **subdirectory** (e.g. a monorepo subpackage) is not loaded until the agent actually works there. When `context.autoLoadNested` is enabled (default), the first time any tool operates in a directory, dreb loads that directory's context files and appends them to the tool result — explaining why the load happened and headering each file with its source path.
+At startup, dreb **always** performs a separate upward scan from its launch cwd and loads matching `AGENTS.md`/`CLAUDE.md` files there and in parent directories. That initial scan is not lazy nested loading and is **not** controlled by the settings below. A context file in a subdirectory — or in a different repo an agent later visits — is considered only when a tool operates there.
 
-- Triggers on path-bearing tools (`read`, `edit`, `write`, `grep`, `find`, `ls`) and on `bash` commands that begin with `cd <dir>`.
-- Walks up from the target directory to a sensible ceiling: the session cwd (for in-tree targets), otherwise the outermost git repo root, otherwise the outermost directory containing a context file.
-- Each file is injected at most once per session, and files already loaded at startup are never repeated. Applies to subagents too — including subagents that work in a different repo than the parent.
-- Disable with `context.autoLoadNested: false` in settings, or toggle "Auto-load nested context" in `/settings`.
+Lazy nested/out-of-cwd context loading is **off by default**. Configure explicit global trusted roots in `~/.dreb/agent/settings.json`:
 
-**Security caution:** when working across untrusted or third-party repositories, their `AGENTS.md`/`CLAUDE.md` files may be auto-injected into the agent's context, which is a prompt-injection consideration. Auto-loaded content is secret-scrubbed before injection, but extension `tool_result` transforms do not see it because nested context is injected after those transforms for cache safety.
+```json
+{
+  "context": {
+    "trustedFolders": ["~/src/my-company", "/srv/controlled-repos"]
+  }
+}
+```
+
+A trusted root permits lazy loading for that existing directory and all of its descendants. dreb resolves both the root and each tool target through canonical native `realpath` at decision time: relative, missing, non-directory, and broken-symlink roots fail closed; duplicate and nested roots are deduplicated/subsumed. A lexical descendant that symlinks outside the canonical root is therefore **not** trusted. Project `.dreb/settings.json` cannot add, override, or otherwise widen this policy.
+
+- Lazy loading triggers on path-bearing tools (`read`, `edit`, `write`, `grep`, `find`, `ls`) and on `bash` commands that begin with `cd <dir>`.
+- It walks from the target toward the applicable ceiling. A trusted root is a hard ceiling; otherwise the session cwd is used for in-tree targets, then the outermost git repo root, then the outermost directory containing a context file.
+- Each file is injected at most once per session, including files from the initial upward scan. The paths are realpath-deduplicated. If a triggering `read` or full `cat`/`bat` already returns a context file in full, dreb marks it loaded without adding a duplicate block.
+- Auto-loaded text is secret-scrubbed and appended **after** extension `tool_result` transforms, so those transforms intentionally do not see it.
+- Main agents and subagents make the same global trust decision. Global trust changes are observed by active processes for **future** lazy loads; already injected content cannot be removed from their conversation.
+
+**Expert trust-all override — prompt-injection warning:** setting `context.autoLoadNested: true` in the **global** `~/.dreb/agent/settings.json` allows lazy loading from any resolvable tool target. This can inject instructions from untrusted or third-party repositories. It is global-only; a project `.dreb/settings.json` cannot enable it. Leave it off and trust only folders you control whenever possible. The Files view shows the effective trust for the directory being viewed and lets you trust a folder or untrust the actual granting root; untrusting an inherited folder removes that root's trust for all of its descendants.
 
 ### System Prompt
 

package/dist/core/agent-session.d.ts

@@ -253,7 +253,8 @@ export declare class AgentSession {
      * should be injected. Resolves the directory the tool operates in, walks up to a
      * sensible ceiling collecting not-yet-loaded AGENTS.md/CLAUDE.md files, and formats
      * them. Each directory is scanned at most once (negative cache) and each file is
-     * injected at most once per session (realpath dedup). Gated by `context.autoLoadNested`.
+     * injected at most once per session (realpath dedup). Every decision consumes the
+     * refreshed global-only trust policy; absent settings managers fail closed.
      */
     private _computeNestedContextBlock;
     /**