@gajae-code/coding-agent 0.18.11 → 0.19.0

package/src/dap/session.ts

@@ -1,6 +1,8 @@
+import * as fs from "node:fs/promises";
 import * as path from "node:path";
 import * as timers from "node:timers/promises";
 import { logger, untilAborted } from "@gajae-code/utils";
+import { projectSafeSpawnEnv } from "@gajae-code/utils/shell-config";
 import { NON_INTERACTIVE_ENV } from "../exec/non-interactive-env";
 import { type OwnedProcess, spawnOwnedProcess } from "../runtime/process-lifecycle";
 import { DapClient } from "./client";
@@ -106,9 +108,19 @@ interface DapSession {
 	initializedSeen: boolean;
 	needsConfigurationDone: boolean;
 	configurationDoneSent: boolean;
+	/** Containment root. Distinct from `cwd`, which is the caller execution directory. */
+	workspace: string;
+	closing: boolean;
+	disposed: boolean;
+	inflightTerminal: number;
+	terminalIdle?: Promise<void>;
+	resolveTerminalIdle?: () => void;
 	runInTerminalProcesses: Set<OwnedProcess>;
 }
 
+/** Test seam: pauses after cwd containment and before the debuggee spawn. */
+export const runInTerminalTestHooks: { beforeSpawn?: () => Promise<void> } = {};
+
 export interface DapOutputSnapshot {
 	snapshot: DapSessionSummary;
 	output: string;
@@ -210,6 +222,53 @@ function buildSummary(session: DapSession): DapSessionSummary {
 	};
 }
 
+function isEnoent(error: unknown): boolean {
+	return (error as NodeJS.ErrnoException | undefined)?.code === "ENOENT";
+}
+
+/** Walk missing leaves so a not-yet-created debug cwd can still be contained. */
+async function canonicalizeRunInTerminalCwd(absolute: string): Promise<string> {
+	try {
+		return await fs.realpath(absolute);
+	} catch (error) {
+		if (!isEnoent(error)) throw error;
+	}
+	const missing: string[] = [];
+	let cursor = absolute;
+	for (;;) {
+		const parent = path.dirname(cursor);
+		if (parent === cursor) throw new Error("runInTerminal cwd escapes the workspace");
+		missing.unshift(path.basename(cursor));
+		cursor = parent;
+		try {
+			return path.join(await fs.realpath(cursor), ...missing);
+		} catch (error) {
+			if (!isEnoent(error)) throw error;
+		}
+	}
+}
+
+export function cwdEscapesWorkspace(root: string, candidate: string): boolean {
+	const relative = path.relative(root, candidate);
+	return relative === ".." || relative.startsWith(`..${path.sep}`) || path.isAbsolute(relative);
+}
+
+/**
+ * The validated cwd is the cwd that is spawned. Relative paths resolve against
+ * the session workspace, then both sides are canonicalized before containment.
+ */
+async function resolveRunInTerminalCwd(workspace: string, requested: string | undefined): Promise<string> {
+	if (typeof requested === "string" && requested.trim() === "") {
+		throw new Error("runInTerminal cwd escapes the workspace");
+	}
+	const root = await fs.realpath(workspace);
+	const candidate = await canonicalizeRunInTerminalCwd(path.resolve(workspace, requested ?? workspace));
+	if (cwdEscapesWorkspace(root, candidate)) {
+		throw new Error("runInTerminal cwd escapes the workspace");
+	}
+	return candidate;
+}
+
 export class DapSessionManager {
 	#sessions = new Map<string, DapSession>();
 	#activeSessionId: string | null = null;
@@ -234,13 +293,19 @@ export class DapSessionManager {
 	}
 
 	async launch(
-		options: DapLaunchSessionOptions,
+		options: DapLaunchSessionOptions & { workspace?: string },
 		signal?: AbortSignal,
 		timeoutMs: number = 30_000,
 	): Promise<DapSessionSummary> {
 		await this.#ensureLaunchSlot();
 		const client = await DapClient.spawn({ adapter: options.adapter, cwd: options.cwd });
-		const session = this.#registerSession(client, options.adapter, options.cwd, options.program);
+		const session = this.#registerSession(
+			client,
+			options.adapter,
+			options.cwd,
+			options.workspace ?? options.cwd,
+			options.program,
+		);
 		try {
 			session.capabilities = await client.initialize(
 				this.#buildInitializeArguments(options.adapter),
@@ -299,13 +364,13 @@ export class DapSessionManager {
 	}
 
 	async attach(
-		options: DapAttachSessionOptions,
+		options: DapAttachSessionOptions & { workspace?: string },
 		signal?: AbortSignal,
 		timeoutMs: number = 30_000,
 	): Promise<DapSessionSummary> {
 		await this.#ensureLaunchSlot();
 		const client = await DapClient.spawn({ adapter: options.adapter, cwd: options.cwd });
-		const session = this.#registerSession(client, options.adapter, options.cwd);
+		const session = this.#registerSession(client, options.adapter, options.cwd, options.workspace ?? options.cwd);
 		try {
 			session.capabilities = await client.initialize(
 				this.#buildInitializeArguments(options.adapter),
@@ -886,24 +951,29 @@ export class DapSessionManager {
 		const session = this.#getActiveSessionOrNull();
 		if (!session) return null;
 		session.lastUsedAt = Date.now();
-		if (session.status !== "terminated") {
-			if (session.capabilities?.supportsTerminateRequest) {
+		// Close before the first await. A runInTerminal paused on cwd resolution
+		// must not spawn while terminate or disconnect is still outstanding.
+		session.closing = true;
+		try {
+			if (session.status !== "terminated") {
+				if (session.capabilities?.supportsTerminateRequest) {
+					await untilAborted(
+						signal,
+						session.client.sendRequest("terminate", undefined, signal, timeoutMs).catch(() => undefined),
+					);
+				}
 				await untilAborted(
 					signal,
-					session.client.sendRequest("terminate", undefined, signal, timeoutMs).catch(() => undefined),
+					session.client
+						.sendRequest("disconnect", { terminateDebuggee: true }, signal, timeoutMs)
+						.catch(() => undefined),
 				);
 			}
-			await untilAborted(
-				signal,
-				session.client
-					.sendRequest("disconnect", { terminateDebuggee: true }, signal, timeoutMs)
-					.catch(() => undefined),
-			);
+			session.status = "terminated";
+			return buildSummary(session);
+		} finally {
+			await this.#disposeSession(session);
 		}
-		session.status = "terminated";
-		const summary = buildSummary(session);
-		await this.#disposeSession(session);
-		return summary;
 	}
 
 	#startCleanupTimer(): void {
@@ -945,12 +1015,22 @@ export class DapSessionManager {
 		throw new Error(`Debug session ${active.id} is still active. Terminate it before launching another.`);
 	}
 
-	#registerSession(client: DapClient, adapter: DapResolvedAdapter, cwd: string, program?: string): DapSession {
+	#registerSession(
+		client: DapClient,
+		adapter: DapResolvedAdapter,
+		cwd: string,
+		workspace: string,
+		program?: string,
+	): DapSession {
 		const session: DapSession = {
 			id: `debug-${++this.#nextId}`,
 			adapter,
 			cwd,
+			workspace,
 			program,
+			closing: false,
+			disposed: false,
+			inflightTerminal: 0,
 			client,
 			status: "launching",
 			launchedAt: Date.now(),
@@ -975,24 +1055,40 @@ export class DapSessionManager {
 			if (!Array.isArray(args.args) || args.args.length === 0) {
 				throw new Error("runInTerminal request did not include a command");
 			}
-			const env = Object.fromEntries(
-				Object.entries(args.env ?? {}).filter((entry): entry is [string, string] => entry[1] !== null),
-			);
-			const owner = spawnOwnedProcess(args.args, {
-				cwd: args.cwd ?? session.cwd,
-				stdin: "ignore",
-				env: {
-					...Bun.env,
-					...NON_INTERACTIVE_ENV,
-					...env,
-				},
-				name: `dap:${session.id}:runInTerminal`,
-			});
-			drainStream(owner.child.stdout);
-			drainStream(owner.child.stderr);
-			session.runInTerminalProcesses.add(owner);
-			owner.exited.finally(() => session.runInTerminalProcesses.delete(owner));
-			return { processId: owner.pid } satisfies DapRunInTerminalResponse;
+			if (session.closing) throw new Error("runInTerminal session is closed");
+			this.#beginTerminal(session);
+			try {
+				if (session.closing) throw new Error("runInTerminal session is closed");
+				const env = Object.fromEntries(
+					Object.entries(args.env ?? {}).filter((entry): entry is [string, string] => entry[1] !== null),
+				);
+				const cwd = await resolveRunInTerminalCwd(session.workspace, args.cwd ?? session.cwd);
+				await runInTerminalTestHooks.beforeSpawn?.();
+				if (session.closing || !this.#sessions.has(session.id)) {
+					throw new Error("runInTerminal session is closed");
+				}
+				const owner = spawnOwnedProcess(args.args, {
+					cwd,
+					stdin: "ignore",
+					env: {
+						...projectSafeSpawnEnv(),
+						...NON_INTERACTIVE_ENV,
+						...env,
+					},
+					name: `dap:${session.id}:runInTerminal`,
+				});
+				if (session.closing || !this.#sessions.has(session.id)) {
+					await owner.dispose();
+					throw new Error("runInTerminal session is closed");
+				}
+				drainStream(owner.child.stdout);
+				drainStream(owner.child.stderr);
+				session.runInTerminalProcesses.add(owner);
+				owner.exited.finally(() => session.runInTerminalProcesses.delete(owner));
+				return { processId: owner.pid } satisfies DapRunInTerminalResponse;
+			} finally {
+				this.#endTerminal(session);
+			}
 		});
 		client.onReverseRequest("startDebugging", async rawArgs => {
 			const startArgs = (rawArgs ?? {}) as Partial<DapStartDebuggingArguments>;
@@ -1319,7 +1415,36 @@ export class DapSessionManager {
 		return session;
 	}
 
+	#beginTerminal(session: DapSession): void {
+		session.inflightTerminal++;
+		if (session.inflightTerminal !== 1) return;
+		session.terminalIdle = new Promise(resolve => {
+			session.resolveTerminalIdle = resolve;
+		});
+	}
+
+	#endTerminal(session: DapSession): void {
+		session.inflightTerminal = Math.max(0, session.inflightTerminal - 1);
+		if (session.inflightTerminal !== 0) return;
+		session.resolveTerminalIdle?.();
+		session.resolveTerminalIdle = undefined;
+		session.terminalIdle = undefined;
+	}
+
+	async #waitTerminalIdle(session: DapSession): Promise<void> {
+		while (session.inflightTerminal > 0 && session.terminalIdle) {
+			await session.terminalIdle;
+		}
+	}
+
 	async #disposeSession(session: DapSession) {
+		session.closing = true;
+		if (session.disposed) {
+			await this.#waitTerminalIdle(session);
+			return;
+		}
+		session.disposed = true;
+		await this.#waitTerminalIdle(session);
 		if (this.#activeSessionId === session.id) {
 			this.#activeSessionId = null;
 		}

package/src/debug/crash-diagnostics.ts

@@ -1,6 +1,8 @@
+import { constants as fsConstants } from "node:fs";
 import * as fs from "node:fs/promises";
 import * as os from "node:os";
 import * as path from "node:path";
+import { redactCrashSecrets } from "@gajae-code/utils";
 
 const CRASH_DIAGNOSTICS_ENV = "GJC_CRASH_DIAGNOSTICS";
 const CRASH_DIAGNOSTICS_DIR_ENV = "GJC_CRASH_DIAGNOSTICS_DIR";
@@ -169,7 +171,7 @@ export async function writeCrashReport(
 		pid: process.pid,
 		cwd: options.cwd ?? process.cwd(),
 		...classification,
-		stderrPreview: input.stderr ? trimStartBytes(input.stderr, STDERR_PREVIEW_BYTES) : undefined,
+		stderrPreview: input.stderr ? trimStartBytes(redactCrashSecrets(input.stderr), STDERR_PREVIEW_BYTES) : undefined,
 		spawnError: input.spawnError === undefined ? undefined : stringifyError(input.spawnError),
 	};
 	const enabled = crashDiagnosticsEnabled(options.env);
@@ -179,10 +181,10 @@ export async function writeCrashReport(
 	}
 
 	try {
-		const dir = getCrashDiagnosticsDirectory(options.env);
-		await ensurePrivateDiagnosticsDirectory(dir);
+		const directory = diagnosticsDirectoryPath(getCrashDiagnosticsDirectory(options.env));
+		await ensurePrivateDiagnosticsDirectory(directory);
 		const filename = `${report.createdAt.replace(/[:.]/g, "-")}-${report.kind}-${report.class}-${process.pid}.json`;
-		const reportPath = path.join(dir, filename);
+		const reportPath = path.join(directory, filename);
 		await writePrivateCrashReport(reportPath, `${JSON.stringify(report, null, 2)}\n`);
 		return { report, path: reportPath, enabled };
 	} catch {
@@ -196,19 +198,100 @@ export function formatCrashDiagnosticNotice(result: CrashReportWriteResult): str
 	return `[crash:${result.report.kind}:${result.report.class}] ${result.report.reason}${location}`;
 }
 
+const POSIX_NOFOLLOW = process.platform === "win32" ? 0 : (fsConstants.O_NOFOLLOW ?? 0);
+
+function isFilesystemRoot(dir: string): boolean {
+	const root = path.parse(dir).root;
+	return root.length > 0 && dir === root;
+}
+
+/** Drop trailing platform separators and "." segments. A backslash stays in the name on POSIX. ".." is unchanged. */
+function diagnosticsDirectoryPath(dir: string): string {
+	const sep = path.sep;
+	let current = dir;
+	while (!isFilesystemRoot(current)) {
+		let end = current.length;
+		while (end > 0 && current[end - 1] === sep) end -= 1;
+		if (end !== current.length) {
+			const stripped = current.slice(0, end);
+			if (stripped === "" || isFilesystemRoot(stripped)) return path.parse(current).root || current;
+			if (process.platform === "win32" && /^[A-Za-z]:$/.test(stripped)) return `${stripped}\\`;
+			current = stripped;
+			continue;
+		}
+		const dotSuffix = `${sep}.`;
+		if (current.endsWith(dotSuffix) && !current.endsWith(`${sep}..`)) {
+			const parent = current.slice(0, -dotSuffix.length);
+			if (parent === "" || isFilesystemRoot(parent)) {
+				return parent === "" ? path.parse(current).root || current : parent;
+			}
+			if (process.platform === "win32" && /^[A-Za-z]:$/.test(parent)) return `${parent}\\`;
+			current = parent;
+			continue;
+		}
+		return current;
+	}
+	return current;
+}
+
 async function ensurePrivateDiagnosticsDirectory(dir: string): Promise<void> {
+	await assertRealDiagnosticsDirectory(dir);
 	await fs.mkdir(dir, { recursive: true, mode: DIRECTORY_MODE });
+	await assertRealDiagnosticsDirectory(dir);
+	await chmodRealDiagnosticsDirectory(dir);
+}
+
+async function assertRealDiagnosticsDirectory(dir: string): Promise<void> {
+	let stat: Awaited<ReturnType<typeof fs.lstat>>;
+	try {
+		stat = await fs.lstat(dir);
+	} catch (error) {
+		if (typeof error === "object" && error !== null && "code" in error && error.code === "ENOENT") return;
+		throw error;
+	}
+	if (stat.isSymbolicLink() || !stat.isDirectory()) {
+		throw new Error("crash diagnostics path is not a private directory");
+	}
+}
+
+async function chmodRealDiagnosticsDirectory(dir: string): Promise<void> {
+	const stat = await fs.lstat(dir);
+	if (stat.isSymbolicLink() || !stat.isDirectory()) {
+		throw new Error("crash diagnostics path is not a private directory");
+	}
+	// macOS lchmod sets the mode without read permission and without following a symlink.
+	// Linux has no equivalent here, so an unreadable directory is left unchanged. A path chmod would follow a swapped symlink.
+	if (process.platform === "darwin" && typeof fs.lchmod === "function") {
+		await fs.lchmod(dir, DIRECTORY_MODE);
+		return;
+	}
+	const directoryFlag = fsConstants.O_DIRECTORY ?? 0;
+	const pathFlag = (fsConstants as { O_PATH?: number }).O_PATH ?? 0;
+	if (POSIX_NOFOLLOW !== 0 && directoryFlag !== 0) {
+		const openFlag = pathFlag !== 0 ? pathFlag : fsConstants.O_RDONLY;
+		const handle = await fs.open(dir, openFlag | directoryFlag | POSIX_NOFOLLOW);
+		try {
+			await handle.chmod(DIRECTORY_MODE);
+		} finally {
+			await handle.close();
+		}
+		return;
+	}
 	await fs.chmod(dir, DIRECTORY_MODE);
 }
 
 async function writePrivateCrashReport(reportPath: string, contents: string): Promise<void> {
-	const file = await fs.open(reportPath, "wx", REPORT_FILE_MODE);
+	const file = await fs.open(
+		reportPath,
+		fsConstants.O_WRONLY | fsConstants.O_CREAT | fsConstants.O_EXCL | POSIX_NOFOLLOW,
+		REPORT_FILE_MODE,
+	);
 	try {
 		await file.writeFile(contents);
+		await file.chmod(REPORT_FILE_MODE);
 	} finally {
 		await file.close();
 	}
-	await fs.chmod(reportPath, REPORT_FILE_MODE);
 }
 
 function stringifyError(error: unknown): string {

package/src/debug/report-bundle.ts

@@ -3,6 +3,7 @@
  *
  * Creates a .tar.gz archive with session data, logs, system info, and optional profiling data.
  */
+import { constants as fsConstants } from "node:fs";
 import * as fs from "node:fs/promises";
 import * as path from "node:path";
 import type { WorkProfile } from "@gajae-code/natives";
@@ -13,7 +14,9 @@ import {
 	getLogPath,
 	getLogsDir,
 	getReportsDir,
+	hasFsCode,
 	isEnoent,
+	redactCrashSecrets,
 	resolveEquivalentPath,
 } from "@gajae-code/utils";
 import type { CpuProfile, HeapSnapshot } from "./profiler";
@@ -132,6 +135,72 @@ export interface DebugLogSource {
 	loadOlderLogs(limitDays?: number): Promise<string>;
 }
 
+/** Owner-only mode. umask cannot widen this, and fchmod repeats it after open. */
+const REPORT_BUNDLE_MODE = 0o600;
+
+/**
+ * Open the archive path without following a final symlink.
+ * A missing path is created with O_EXCL. An existing regular file is replaced.
+ * A symlink fails the open (ELOOP, or EEXIST on macOS with O_EXCL) and is left in place.
+ */
+async function openReportBundleForWrite(outputPath: string): Promise<fs.FileHandle> {
+	const noFollow = process.platform === "win32" ? 0 : (fsConstants.O_NOFOLLOW ?? 0);
+	const createFlags = fsConstants.O_WRONLY | fsConstants.O_CREAT | fsConstants.O_EXCL | noFollow;
+	const replaceFlags = fsConstants.O_WRONLY | noFollow;
+
+	const openRegular = async (): Promise<fs.FileHandle> => {
+		const current = await fs.lstat(outputPath);
+		if (current.isSymbolicLink() || !current.isFile()) {
+			throw new Error("report bundle output is not a regular file");
+		}
+		try {
+			return await fs.open(outputPath, replaceFlags, REPORT_BUNDLE_MODE);
+		} catch (error) {
+			if (hasFsCode(error, "ELOOP")) throw new Error("report bundle output is not a regular file");
+			throw error;
+		}
+	};
+
+	let missing = false;
+	try {
+		await fs.lstat(outputPath);
+	} catch (error) {
+		if (!isEnoent(error)) throw error;
+		missing = true;
+	}
+	if (!missing) return openRegular();
+
+	try {
+		return await fs.open(outputPath, createFlags, REPORT_BUNDLE_MODE);
+	} catch (error) {
+		if (hasFsCode(error, "ELOOP")) throw new Error("report bundle output is not a regular file");
+		if (!hasFsCode(error, "EEXIST")) throw error;
+	}
+	return openRegular();
+}
+
+async function writeReportBundleFile(outputPath: string, bytes: Uint8Array): Promise<void> {
+	const handle = await openReportBundleForWrite(outputPath);
+	try {
+		const opened = await handle.stat();
+		const current = await fs.lstat(outputPath);
+		if (
+			current.isSymbolicLink() ||
+			!opened.isFile() ||
+			!current.isFile() ||
+			opened.dev !== current.dev ||
+			opened.ino !== current.ino
+		) {
+			throw new Error("report bundle output is not a regular file");
+		}
+		if (process.platform !== "win32") await handle.chmod(REPORT_BUNDLE_MODE);
+		await handle.truncate(0);
+		await handle.writeFile(bytes);
+	} finally {
+		await handle.close();
+	}
+}
+
 /**
  * Create a debug report bundle.
  *
@@ -228,12 +297,31 @@ export async function createReportBundle(options: ReportBundleOptions): Promise<
 		}
 	}
 
-	// Write archive
-	await Bun.Archive.write(outputPath, data, { compress: "gzip" });
+	// Scrub the transcript copies only. Settings, system info, and profiles are
+	// separate payloads and stay as collected. Sources on disk are not rewritten.
+	for (const archivePath of Object.keys(data)) {
+		const content = data[archivePath];
+		if (content === undefined || !reportEntryCarriesUserText(archivePath)) continue;
+		data[archivePath] = redactCrashSecrets(content);
+	}
+
+	// Write archive. Bytes are built in memory so the path open can refuse a symlink.
+	const archiveBytes = await new Bun.Archive(data, { compress: "gzip" }).bytes();
+	await writeReportBundleFile(outputPath, archiveBytes);
 
 	return { path: outputPath, files };
 }
 
+/** Session, log, artifact, and subagent copies are the transcript the user may attach. */
+function reportEntryCarriesUserText(archivePath: string): boolean {
+	return (
+		archivePath === "logs.txt" ||
+		archivePath === "session.jsonl" ||
+		archivePath.startsWith("artifacts/") ||
+		archivePath.startsWith("subagents/")
+	);
+}
+
 /** Add all files from a directory to the archive */
 async function addDirectoryToArchive(
 	data: Record<string, string>,

package/src/debug/system-info.ts

@@ -3,7 +3,7 @@
  */
 
 import * as os from "node:os";
-import { APP_NAME, formatBytes, getProjectDir, VERSION } from "@gajae-code/utils";
+import { APP_NAME, formatBytes, getProjectDir, redactCrashSecrets, VERSION } from "@gajae-code/utils";
 
 export interface SystemInfo {
 	os: string;
@@ -97,7 +97,12 @@ export function formatSystemInfo(info: SystemInfo): string {
 	return lines.join("\n");
 }
 
-/** Sanitize environment variables by redacting sensitive values */
+/**
+ * Sanitize environment variables for a debug report.
+ * Sensitive names stay fully replaced. Other values keep their text, with the
+ * same credential shapes removed that crash records already scrub before they
+ * are written to disk.
+ */
 export function sanitizeEnv(env: Record<string, string | undefined>): Record<string, string> {
 	const SENSITIVE_PATTERNS = [
 		/key/i,
@@ -117,7 +122,7 @@ export function sanitizeEnv(env: Record<string, string | undefined>): Record<str
 	for (const [k, v] of Object.entries(env)) {
 		if (v === undefined) continue;
 		const isSensitive = SENSITIVE_PATTERNS.some(p => p.test(k));
-		result[k] = isSensitive ? "[REDACTED]" : v;
+		result[k] = isSensitive ? "[REDACTED]" : redactCrashSecrets(v);
 	}
 	return result;
 }

package/src/defaults/gjc/extensions/grok-cli-vendor/src/shared/base-url.ts

@@ -1,5 +1,8 @@
+import { $credentialEnv, $pickCredentialEnv } from '@gajae-code/utils';
+
 const DEFAULT_GROK_BUILD_BASE_URL = 'https://cli-chat-proxy.grok.com/v1';
 const ALLOWED_GROK_BUILD_HOSTS = new Set(['cli-chat-proxy.grok.com']);
+const UNSAFE_BASE_URL_ENV = 'GJC_GROK_CLI_ALLOW_UNSAFE_BASE_URL';
 
 function normalizeBaseUrl(baseUrl: string): string {
   return baseUrl.trim().replace(/\/+$/, '');
@@ -14,23 +17,34 @@ function isAllowedCredentialHost(baseUrl: string): boolean {
   }
 }
 
+/**
+ * Operator environment only. `$credentialEnv` already drops a cwd dotenv value,
+ * including a dynamic declaration, using the snapshot taken when the env module
+ * loaded. A repository `.env` therefore cannot name the Grok Build base URL or
+ * approve that URL with the unsafe opt-in.
+ */
+function trustedConfiguredBaseUrl(): string | undefined {
+  return $pickCredentialEnv('GJC_GROK_CLI_BASE_URL', 'GROK_CLI_BASE_URL');
+}
+
+function unsafeOverrideAllowed(): boolean {
+  return $credentialEnv(UNSAFE_BASE_URL_ENV) === '1';
+}
+
 export function getBaseUrl(): string {
-  const configured = process.env.GJC_GROK_CLI_BASE_URL || process.env.GROK_CLI_BASE_URL;
+  const configured = trustedConfiguredBaseUrl();
   if (!configured) return DEFAULT_GROK_BUILD_BASE_URL;
 
   const normalized = normalizeBaseUrl(configured);
   if (isAllowedCredentialHost(normalized)) return normalized;
-
-  if (process.env.GJC_GROK_CLI_ALLOW_UNSAFE_BASE_URL === '1') return normalized;
+  if (unsafeOverrideAllowed()) return normalized;
 
   return DEFAULT_GROK_BUILD_BASE_URL;
 }
 
 export function isGrokBuildBaseUrlOverrideIgnored(): boolean {
-  const configured = process.env.GJC_GROK_CLI_BASE_URL || process.env.GROK_CLI_BASE_URL;
+  const configured = trustedConfiguredBaseUrl();
   if (!configured) return false;
   const normalized = normalizeBaseUrl(configured);
-  return (
-    !isAllowedCredentialHost(normalized) && process.env.GJC_GROK_CLI_ALLOW_UNSAFE_BASE_URL !== '1'
-  );
+  return !isAllowedCredentialHost(normalized) && !unsafeOverrideAllowed();
 }

package/src/discovery/agents-md.ts

@@ -43,7 +43,7 @@ async function readBoundedAgentsMdFile(
 	const homeIsStable = async (): Promise<boolean> => {
 		if (!options?.home || !options.homeIdentity) return true;
 		try {
-			const current = await fs.stat(options.home);
+			const current = await fs.stat(options.home, { bigint: true });
 			return current.dev === options.homeIdentity.dev && current.ino === options.homeIdentity.ino;
 		} catch {
 			return false;

package/src/discovery/builtin.ts

@@ -399,10 +399,11 @@ async function loadSlashCommands(ctx: LoadContext): Promise<LoadResult<SlashComm
 		const commandsDir = path.join(dir, "commands");
 		const result = await loadFilesFromDir<SlashCommand>(ctx, commandsDir, PROVIDER_ID, level, {
 			extensions: ["md"],
+			recursive: true,
 			scope: readScopeForLevel(level),
-			transform: (name, content, path, source) => ({
-				name: name.replace(/\.md$/, ""),
-				path,
+			transform: (_name, content, filePath, source) => ({
+				name: path.relative(commandsDir, filePath).replace(/\.md$/, "").split(path.sep).join(":"),
+				path: filePath,
 				content,
 				level,
 				_source: source,