@gajae-code/coding-agent 0.18.12 → 0.19.0

package/src/tools/ask.ts

@@ -953,6 +953,7 @@ export class AskTool implements AgentTool<AskParametersSchema, AskToolDetails> {
 			this.session.cwd,
 			{ sessionId: this.session.getSessionId?.() ?? null },
 			this.session.getSessionAgentDir?.() ?? this.session.settings.getAgentDir(),
+			params,
 		);
 		assertDeepInterviewStructuredResponseWithinLimit(params);
 		// Recheck at execution time as well: direct SDK callers and a phase change

package/src/tools/ast-grep.ts

@@ -11,6 +11,7 @@ import astGrepDescription from "../prompts/tools/ast-grep.md" with { type: "text
 import { Ellipsis, fileHyperlink, renderStatusLine, renderTreeList, truncateToWidth } from "../tui";
 import { resolveFileDisplayMode } from "../utils/file-display-mode";
 import type { ToolSession } from ".";
+import { wrapUntrustedContent } from "./fetch";
 import { createFileRecorder, formatResultPath } from "./file-recorder";
 import { formatGroupedFiles } from "./grouped-file-output";
 import { formatMatchLine } from "./match-line-format";
@@ -221,7 +222,9 @@ export class AstGrepTool implements AgentTool<typeof astGrepSchema, AstGrepToolD
 				const parseMessage = cappedParseErrors.length
 					? `\n${formatParseErrors(cappedParseErrors, parseErrorsTotal).join("\n")}`
 					: "";
-				return toolResult(baseDetails).text(`${noMatchMessage}${parseMessage}`).done();
+				return toolResult(baseDetails)
+					.text(wrapUntrustedContent(`${noMatchMessage}${parseMessage}`))
+					.done();
 			}
 
 			const useHashLines = resolveFileDisplayMode(this.session).hashLines;
@@ -291,7 +294,9 @@ export class AstGrepTool implements AgentTool<typeof astGrepSchema, AstGrepToolD
 				outputLines.push("", ...formatParseErrors(cappedParseErrors, parseErrorsTotal));
 			}
 
-			return toolResult(details).text(outputLines.join("\n")).done();
+			return toolResult(details)
+				.text(wrapUntrustedContent(outputLines.join("\n")))
+				.done();
 		});
 	}
 }

package/src/tools/auto-generated-guard.ts

@@ -212,8 +212,14 @@ function extractLeadingHeaderCommentText(content: string, commentStyles: readonl
  * Check if a file name indicates it might be auto-generated.
  * This is a quick pre-check before reading file content.
  */
+function guardFileName(filePath: string): string {
+	// resolvePlanPath keeps the platform separator. Anchored patterns such as
+	// zz_generated.* and generated.ts must see that basename on Windows too.
+	return path.win32.basename(filePath);
+}
+
 function isAutoGeneratedFileName(filePath: string): boolean {
-	const fileName = filePath.split("/").pop() ?? "";
+	const fileName = guardFileName(filePath);
 	return AUTO_GENERATED_FILENAME_PATTERNS.some(pattern => pattern.test(fileName));
 }
 
@@ -254,11 +260,14 @@ const autoGeneratedMap = new LRUCache<string, { marker: string | undefined }>({
 
 async function getAutoGeneratedMarker(filePath: string): Promise<string | undefined> {
 	if (isAutoGeneratedFileName(filePath)) {
-		return filePath.split("/").pop() ?? "";
+		return guardFileName(filePath);
 	}
 
 	const cached = autoGeneratedMap.get(filePath);
-	if (cached) return cached.marker;
+	// A cached miss only means the file was handwritten at the last read.
+	// An earlier patch entry can write a generated header before a later
+	// rename checks the same destination, so do not trust that miss.
+	if (cached && cached.marker !== undefined) return cached.marker;
 
 	let marker: string | undefined;
 	try {

package/src/tools/awaiting-input.ts

@@ -0,0 +1,114 @@
+/**
+ * Detects a running command that printed an interactive auth prompt and is now
+ * waiting for a human (browser sign-in URL or device code).
+ *
+ * The agent cannot see this on its own: the tool call is simply still running.
+ * The detector watches the streamed output tail and fires once per command when
+ * all of these hold:
+ *   - a known auth-prompt signature is present in the recent output tail;
+ *   - the command is still running (the caller stops feeding it on exit);
+ *   - no new output arrived for `quietMs` after the match.
+ *
+ * Requiring the quiet window keeps `cat README.md` or `grep` over docs that
+ * merely mention "enter the code" from firing: those commands exit or keep
+ * printing. The signal carries only the prompt kind, never the URL or code,
+ * because both are short-lived credential-equivalent values.
+ */
+import { stripVTControlCharacters } from "node:util";
+
+export type AwaitingInputKind = "browser_auth" | "device_code";
+
+export interface AwaitingInputSignal {
+	kind: AwaitingInputKind;
+	/** Epoch milliseconds when the quiet window elapsed after the match. */
+	detectedAt: number;
+}
+
+/** Cancels a scheduled callback. */
+export type CancelScheduled = () => void;
+
+export interface AwaitingInputDetectorOptions {
+	onDetect: (signal: AwaitingInputSignal) => void;
+	/** Quiet window after a match before the signal fires. */
+	quietMs?: number;
+	/** Injectable scheduler; defaults to `setTimeout`. */
+	schedule?: (callback: () => void, ms: number) => CancelScheduled;
+	/** Injectable clock; defaults to `Date.now`. */
+	now?: () => number;
+}
+
+export const AWAITING_INPUT_QUIET_MS = 3_000;
+
+/** Only the most recent output can be the prompt the process is blocked on. */
+const TAIL_CHARS = 2_048;
+
+const URL_PATTERN = /\bhttps?:\/\/\S+/i;
+
+const DEVICE_CODE_PATTERNS: readonly RegExp[] = [
+	/\bone-time code\b/i,
+	/\benter the code\b/i,
+	/\benter code\b/i,
+	/\buser_code=/i,
+];
+
+const BROWSER_AUTH_PATTERNS: readonly RegExp[] = [
+	/\bto authenticate,? visit\b/i,
+	/\blogin\.tailscale\.com\/a\//i,
+	/\bgo to the following link in your browser\b/i,
+	/\bopen the following url\b/i,
+	/\bvisit this url to authori[sz]e\b/i,
+	/\bopen (?:this|the) (?:url|link) in (?:a|your) browser\b/i,
+];
+
+/** Classify an output tail; `undefined` when it does not look like an auth prompt. */
+export function classifyAwaitingInput(tail: string): AwaitingInputKind | undefined {
+	const text = stripVTControlCharacters(tail);
+	if (DEVICE_CODE_PATTERNS.some(pattern => pattern.test(text))) return "device_code";
+	if (URL_PATTERN.test(text) && BROWSER_AUTH_PATTERNS.some(pattern => pattern.test(text))) return "browser_auth";
+	return undefined;
+}
+
+function defaultSchedule(callback: () => void, ms: number): CancelScheduled {
+	const timer = setTimeout(callback, ms);
+	return () => clearTimeout(timer);
+}
+
+export class AwaitingInputDetector {
+	readonly #onDetect: (signal: AwaitingInputSignal) => void;
+	readonly #quietMs: number;
+	readonly #schedule: (callback: () => void, ms: number) => CancelScheduled;
+	readonly #now: () => number;
+	#tail = "";
+	#cancel: CancelScheduled | undefined;
+	#done = false;
+
+	constructor(options: AwaitingInputDetectorOptions) {
+		this.#onDetect = options.onDetect;
+		this.#quietMs = options.quietMs ?? AWAITING_INPUT_QUIET_MS;
+		this.#schedule = options.schedule ?? defaultSchedule;
+		this.#now = options.now ?? Date.now;
+	}
+
+	/** Feed one streamed output chunk. Any new output restarts the quiet window. */
+	push(chunk: string): void {
+		if (this.#done || chunk.length === 0) return;
+		this.#cancel?.();
+		this.#cancel = undefined;
+		this.#tail = (this.#tail + chunk).slice(-TAIL_CHARS);
+		const kind = classifyAwaitingInput(this.#tail);
+		if (!kind) return;
+		this.#cancel = this.#schedule(() => {
+			this.#cancel = undefined;
+			if (this.#done) return;
+			this.#done = true;
+			this.#onDetect({ kind, detectedAt: this.#now() });
+		}, this.#quietMs);
+	}
+
+	/** Stop watching; the command exited or was folded. Never fires afterwards. */
+	dispose(): void {
+		this.#done = true;
+		this.#cancel?.();
+		this.#cancel = undefined;
+	}
+}

package/src/tools/bash-allowed-prefixes.ts

@@ -280,7 +280,9 @@ function shellQuote(value: string): string {
 }
 
 function resolvedExternalCommand(command: string): string | undefined {
-	return Bun.which(command) ?? undefined;
+	// Bun.which caches a command name until PATH is passed explicitly, so a test
+	// or a later session that changes PATH must be visible here.
+	return Bun.which(command, { PATH: process.env.PATH ?? "" }) ?? undefined;
 }
 
 function validateReadOnlyCommand(words: readonly string[]): BashAllowedPrefixesCheck {
@@ -322,16 +324,50 @@ function validateReadOnlyCommand(words: readonly string[]): BashAllowedPrefixesC
 	return { allowed: true };
 }
 
+const GIT_DIFF_FAMILY_SUBCOMMANDS = new Set(["blame", "diff", "log", "show"]);
+
+function gitOptionName(word: string): string {
+	const equalsAt = word.indexOf("=");
+	return equalsAt === -1 ? word : word.slice(0, equalsAt);
+}
+
+/** Enabling forms only. `--no-ext-diff` and `--no-textconv` stay allowed. */
+function gitEnablesExternalHelper(word: string): boolean {
+	if (!word.startsWith("--")) return false;
+	const name = gitOptionName(word);
+	return name === "--ext-diff" || name === "--textconv";
+}
+
 function rejectGitHostAccess(words: readonly string[]): BashAllowedPrefixesCheck | undefined {
 	if (words[0] !== "git") return undefined;
 	for (const option of optionWords(words)) {
 		if (isLongOption(option, "--output") || isLongOption(option, "--no-index")) {
 			return { allowed: false, reason: "restricted bash does not allow git --output or --no-index" };
 		}
+		if (gitEnablesExternalHelper(option)) {
+			return {
+				allowed: false,
+				reason: "restricted bash does not allow git external diff or textconv helpers",
+			};
+		}
 	}
 	return undefined;
 }
 
+/**
+ * Diff-family git commands run `diff.external`, `GIT_EXTERNAL_DIFF`, and textconv
+ * filters unless these flags are present. Place them immediately after the
+ * subcommand so a later value-taking option cannot consume them and they stay
+ * before a `--` pathspec. The gate rejects a later `--ext-diff` or `--textconv`,
+ * which would otherwise win.
+ */
+function disableGitExternalHelpers(commandName: string, argv: readonly string[]): string[] {
+	if (commandName !== "git" || !GIT_DIFF_FAMILY_SUBCOMMANDS.has(argv[1] ?? "")) return [...argv];
+	const next = [...argv];
+	next.splice(2, 0, "--no-ext-diff", "--no-textconv");
+	return next;
+}
+
 const GJC_SESSION_BIND_REASON = "restricted role-agent bash binds gjc to the current session";
 const GJC_WORKTREE_BIND_REASON = "restricted role-agent bash binds gjc --worktree-root to the current repository";
 
@@ -472,6 +508,30 @@ function commandAllowedPrefixesReason(normalizedPrefixes: readonly string[], opt
 		: `restricted role-agent bash only allows commands starting with: ${prefixList}`;
 }
 
+/**
+ * Workflow restricted bash keeps the lexical prefix check, then runs the resolved
+ * executable. Callers also skip the shell snapshot and shell prefix, because a
+ * snapshot function can be named for that absolute path.
+ */
+export function normalizeWorkflowBashCommand(
+	command: string,
+	allowedPrefixes: readonly string[] | undefined,
+	options: BashRestrictionOptions = {},
+): string | undefined {
+	if (options.profile === "read-only") return undefined;
+	const gate = checkBashAllowedPrefixes(command, allowedPrefixes, { ...options, profile: "workflow" });
+	if (!gate.allowed) return undefined;
+	const parsed = parseShellWords(command.trim());
+	if (parsed.reason || parsed.words.length === 0) return undefined;
+	const [head, ...rest] = parsed.words;
+	if (!head) return undefined;
+	const resolvedHead = resolvedExternalCommand(head);
+	if (!resolvedHead) return undefined;
+	return disableGitExternalHelpers(head, [resolvedHead, ...rest])
+		.map(shellQuote)
+		.join(" ");
+}
+
 export function normalizeReadOnlyBashCommand(command: string): string | undefined {
 	const parsed = parseShellWords(command.trim());
 	if (parsed.reason || parsed.words.length === 0) return undefined;

package/src/tools/bash-skill-urls.ts

@@ -1,3 +1,4 @@
+import type * as fsTypes from "node:fs";
 import * as fs from "node:fs/promises";
 import * as path from "node:path";
 import { isEnoent } from "@gajae-code/utils";
@@ -40,7 +41,7 @@ export interface InternalUrlExpansionOptions {
  * Resolve a single skill:// URL to its absolute filesystem path.
  * Does NOT read file content or verify existence.
  */
-export function resolveSkillUrlToPath(url: string, skills: readonly Skill[]): string {
+export function resolveSkillUrl(url: string, skills: readonly Skill[]): { skill: Skill; lexicalPath: string } {
 	const parsed = /^skill:\/\/([^/?#]+)(\/[^?#]*)?(?:[?#].*)?$/.exec(url);
 	if (!parsed) {
 		throw new ToolError(`Invalid skill:// URL: ${url}`);
@@ -72,7 +73,7 @@ export function resolveSkillUrlToPath(url: string, skills: readonly Skill[]): st
 	const hasRelativePath = rawPath !== "" && rawPath !== "/";
 
 	if (!hasRelativePath) {
-		return path.resolve(skill.filePath);
+		return { skill, lexicalPath: path.resolve(skill.filePath) };
 	}
 
 	let relativePath: string;
@@ -95,7 +96,11 @@ export function resolveSkillUrlToPath(url: string, skills: readonly Skill[]): st
 		throw new ToolError("Path traversal is not allowed in skill:// URLs");
 	}
 
-	return resolvedPath;
+	return { skill, lexicalPath: resolvedPath };
+}
+
+export function resolveSkillUrlToPath(url: string, skills: readonly Skill[]): string {
+	return resolveSkillUrl(url, skills).lexicalPath;
 }
 
 /**
@@ -150,7 +155,7 @@ async function canonicalLocalPath(localRoot: string, lexicalPath: string): Promi
 	const missing: string[] = [];
 	let cursor = lexicalPath;
 	for (;;) {
-		let stat: Awaited<ReturnType<typeof fs.lstat>> | undefined;
+		let stat: fsTypes.Stats | undefined;
 		try {
 			stat = await fs.lstat(cursor);
 		} catch (error) {
@@ -177,6 +182,53 @@ async function canonicalLocalPath(localRoot: string, lexicalPath: string): Promi
 	}
 }
 
+const SKILL_ESCAPE = "Path traversal is not allowed in skill:// URLs";
+
+/** Real path of `target`, or the real ancestor plus the missing suffix. */
+async function canonicalPathOrAncestor(target: string, escapeMessage: string): Promise<string> {
+	try {
+		return await fs.realpath(target);
+	} catch (error) {
+		if (!isEnoent(error)) throw error;
+	}
+
+	const missing: string[] = [];
+	let cursor = target;
+	for (;;) {
+		let stat: fsTypes.Stats | undefined;
+		try {
+			stat = await fs.lstat(cursor);
+		} catch (error) {
+			if (!isEnoent(error)) throw error;
+		}
+		if (stat) {
+			try {
+				return path.join(await fs.realpath(cursor), ...missing);
+			} catch (error) {
+				if (isEnoent(error)) throw new ToolError(escapeMessage);
+				throw error;
+			}
+		}
+		const parent = path.dirname(cursor);
+		if (parent === cursor) throw new ToolError(escapeMessage);
+		missing.unshift(path.basename(cursor));
+		cursor = parent;
+	}
+}
+
+/**
+ * Keep the lexical skill path, then bind the shell to the real path inside the skill directory.
+ * A missing file under a real in-skill ancestor still expands.
+ */
+async function canonicalSkillExpansionPath(baseDir: string, lexicalPath: string): Promise<string> {
+	const realBase = await canonicalPathOrAncestor(baseDir, SKILL_ESCAPE);
+	const realTarget = await canonicalPathOrAncestor(lexicalPath, SKILL_ESCAPE);
+	if (localPathEscapes(realBase, realTarget)) {
+		throw new ToolError(SKILL_ESCAPE);
+	}
+	return realTarget;
+}
+
 function extractScheme(url: string): SupportedInternalScheme | undefined {
 	const match = /^([a-z][a-z0-9+.-]*):\/\//i.exec(url);
 	if (!match) return undefined;
@@ -211,7 +263,8 @@ async function resolveInternalUrlToPath(
 	}
 
 	if (scheme === "skill") {
-		return resolveSkillUrlToPath(url, skills);
+		const { skill, lexicalPath } = resolveSkillUrl(url, skills);
+		return canonicalSkillExpansionPath(skill.baseDir, lexicalPath);
 	}
 
 	// Managed artifact and agent resources carry session authority. Expanding

package/src/tools/bash.ts

@@ -64,7 +64,12 @@ import { CachedOutputBlock, getOutputBlockContentWidth } from "../tui/output-blo
 import { truncateToWidth } from "../tui/utils";
 import { getSixelLineMask } from "../utils/sixel";
 import type { ToolSession } from ".";
-import { checkBashAllowedPrefixes, normalizeReadOnlyBashCommand } from "./bash-allowed-prefixes";
+import { AwaitingInputDetector, type AwaitingInputSignal } from "./awaiting-input";
+import {
+	checkBashAllowedPrefixes,
+	normalizeReadOnlyBashCommand,
+	normalizeWorkflowBashCommand,
+} from "./bash-allowed-prefixes";
 import { applyBashFixups } from "./bash-command-fixup";
 import { type BashInteractiveResult, runInteractiveBashPty } from "./bash-interactive";
 import { checkBashInterception } from "./bash-interceptor";
@@ -578,6 +583,12 @@ export interface BashToolDetails {
 	foldReason?: FoldReason;
 	/** The accepted model-declared activity declaration, when the call carried one. */
 	activity?: BashActivityDeclaration;
+	/**
+	 * Set on a running (partial) update when the foreground command printed an
+	 * interactive auth prompt and then went quiet. Carries only the prompt kind,
+	 * never the URL or code.
+	 */
+	awaitingInput?: AwaitingInputSignal;
 	async?: {
 		state: "running" | "completed" | "failed";
 		jobId: string;
@@ -1125,6 +1136,17 @@ export class BashTool implements AgentTool<BashToolSchema, BashToolDetails> {
 				const spillThreshold = resolveBashOutputSinkTailBytes(this.session.settings);
 				const headBytes = resolveBashOutputSinkHeadBytes(this.session.settings);
 				const tailBuffer = new TailBuffer(spillThreshold);
+				// Only a foreground wait blocks the turn; once folded or started in the
+				// background the agent is free and this tool call has already settled.
+				const awaitingInput = new AwaitingInputDetector({
+					onDetect: signal => {
+						if (backgrounded) return;
+						void options.onUpdate?.({
+							content: [{ type: "text", text: latestText }],
+							details: { ...activityDetails, awaitingInput: signal },
+						});
+					},
+				});
 
 				let executionResult: BashResult | BashInteractiveResult | undefined;
 				try {
@@ -1148,18 +1170,24 @@ export class BashTool implements AgentTool<BashToolSchema, BashToolDetails> {
 								spillThreshold,
 								headBytes,
 								oneShot: true,
-								ignoreShellPrefix: this.session.bashRestrictionProfile === "read-only",
-								disableShellSnapshot: this.session.bashRestrictionProfile === "read-only",
+								ignoreShellPrefix: this.#isolateRestrictedShell(),
+								disableShellSnapshot: this.#isolateRestrictedShell(),
 								onChunk: chunk => {
 									tailBuffer.append(chunk);
 									latestText = tailBuffer.text();
 									void reportProgress(latestText, runningDetails(jobId));
 								},
-								onRawChunk: chunk => manager.appendOutput(jobId, chunk),
+								// onChunk is throttled and drops chunks inside the window; the
+								// detector must see every chunk, so it reads the raw stream.
+								onRawChunk: chunk => {
+									manager.appendOutput(jobId, chunk);
+									awaitingInput.push(chunk);
+								},
 								onMinimizedSave: async originalText =>
 									saveBashOriginalArtifact(options.artifactPublication, originalText),
 							});
 					executionResult = result;
+					awaitingInput.dispose();
 					const finalResult = this.#buildCompletedResult(result, options.timeoutSec, {
 						requestedTimeoutSec: options.requestedTimeoutSec,
 						notices: options.notices,
@@ -1173,6 +1201,7 @@ export class BashTool implements AgentTool<BashToolSchema, BashToolDetails> {
 					await reportProgress(finalText, completedDetails(jobId));
 					return finalText;
 				} catch (error) {
+					awaitingInput.dispose();
 					const message = error instanceof Error ? error.message : String(error);
 					latestText = message;
 					options.onCompletion?.();
@@ -1323,6 +1352,11 @@ export class BashTool implements AgentTool<BashToolSchema, BashToolDetails> {
 	 * helper after `AgentSession` has applied the public-tool permission gate, so
 	 * Monitor inherits Bash's cwd / env / artifact / interceptor pipeline 1:1.
 	 */
+	/** Read-only and workflow allowlists must not source a snapshot or a shell prefix. */
+	#isolateRestrictedShell(): boolean {
+		return this.session.bashRestrictionProfile === "read-only" || (this.session.bashAllowedPrefixes?.length ?? 0) > 0;
+	}
+
 	async #prepareBashExecution(
 		input: { command: string; env?: Record<string, string>; timeout?: number; cwd?: string },
 		ctx?: AgentToolContext,
@@ -1447,19 +1481,6 @@ export class BashTool implements AgentTool<BashToolSchema, BashToolDetails> {
 			...internalUrlOptions,
 			ensureLocalParentDirs: this.session.bashRestrictionProfile !== "read-only",
 		});
-		// Issue #5039: refuse tmux write verbs whose target resolves to this
-		// agent's own tmux pane — such bytes forge a human `user` turn in the
-		// transcript. This is after command expansion but before any spawn, so
-		// blocked attempts inject no bytes and create no transcript turn.
-		if (this.session.bashRestrictionProfile !== "read-only") {
-			const injection = await checkTmuxSelfInjection(command, {
-				env: process.env,
-				cwd: this.session.cwd,
-			});
-			if (injection.block) {
-				throw new ToolError(injection.reason ?? "Blocked: tmux self-pane injection.");
-			}
-		}
 		const expandedEnv = env
 			? Object.fromEntries(
 					await Promise.all(
@@ -1541,6 +1562,45 @@ export class BashTool implements AgentTool<BashToolSchema, BashToolDetails> {
 		if (this.session.bashRestrictionProfile === "read-only" || (allowedPrefixes?.length ?? 0) > 0) {
 			await assertCwdInsideWorkspace(this.session.cwd, commandCwd);
 		}
+		// Issue #5039: refuse tmux write verbs whose target resolves to this
+		// agent's own tmux pane — such bytes forge a human `user` turn in the
+		// transcript. This is after command/env/cwd preparation but before any
+		// spawn, so guard discovery matches execution without trusting caller env
+		// for the agent's tmux identity.
+		if (this.session.bashRestrictionProfile !== "read-only") {
+			const shellConfigEnv = this.session.settings.getShellConfig().env;
+			const injection = await checkTmuxSelfInjection(command, {
+				env: process.env,
+				cwd: commandCwd,
+				executionEnv: { ...process.env, ...shellConfigEnv, ...resolvedEnv },
+			});
+			if (injection.block) {
+				throw new ToolError(injection.reason ?? "Blocked: tmux self-pane injection.");
+			}
+		}
+		// Direct master spawn parses the original command itself and does not source
+		// a shell snapshot. Every other restricted workflow command is rebound here,
+		// after the allowlist and interceptor have seen the caller's text.
+		if (
+			!directMasterSpawn &&
+			this.session.bashRestrictionProfile !== "read-only" &&
+			allowedPrefixes &&
+			allowedPrefixes.length > 0
+		) {
+			const normalizedWorkflowCommand = normalizeWorkflowBashCommand(command, allowedPrefixes, {
+				profile: "workflow",
+				gjcSessionBinding: {
+					sessionId: this.session.getSessionId?.() ?? null,
+					credentialSessionId: this.session.getCredentialSessionId?.() ?? null,
+					worktreeRoot: this.session.cwd,
+					invocationCwd: commandCwd,
+				},
+			});
+			if (!normalizedWorkflowCommand) {
+				throw new ToolError("Restricted role-agent bash command could not be normalized safely.");
+			}
+			command = normalizedWorkflowCommand;
+		}
 
 		const requestedTimeoutSec = input.timeout ?? 300;
 		const timeoutSec = clampTimeout("bash", requestedTimeoutSec);
@@ -1724,9 +1784,8 @@ export class BashTool implements AgentTool<BashToolSchema, BashToolDetails> {
 						spillThreshold,
 						headBytes,
 						oneShot: true,
-						ignoreShellPrefix: this.session.bashRestrictionProfile === "read-only" || prepared.directMasterSpawn,
-						disableShellSnapshot:
-							this.session.bashRestrictionProfile === "read-only" || prepared.directMasterSpawn,
+						ignoreShellPrefix: this.#isolateRestrictedShell() || prepared.directMasterSpawn,
+						disableShellSnapshot: this.#isolateRestrictedShell() || prepared.directMasterSpawn,
 						onChunk: chunk => {
 							tailBuffer.append(chunk);
 							void reportProgress(tailBuffer.text(), {
@@ -2651,6 +2710,14 @@ export class BashTool implements AgentTool<BashToolSchema, BashToolDetails> {
 
 		// Track output for streaming updates (tail only)
 		const tailBuffer = new TailBuffer(spillThreshold);
+		const awaitingInput = new AwaitingInputDetector({
+			onDetect: signal => {
+				void onUpdate?.({
+					content: [{ type: "text", text: tailBuffer.text() }],
+					details: { ...(activity === undefined ? {} : { activity }), awaitingInput: signal },
+				});
+			},
+		});
 
 		const artifactPublisher = createBashArtifactPublisher(artifactPublication);
 
@@ -2833,11 +2900,15 @@ export class BashTool implements AgentTool<BashToolSchema, BashToolDetails> {
 					onOutput: chunk => {
 						ptyOutputSeen = true;
 						if (ptyJobId) ownedManager?.appendOutput(ptyJobId, chunk);
+						awaitingInput.push(chunk);
 					},
-				}).catch(error => {
-					if (ptyAdmission) ownedManager?.releaseCapacity(ptyAdmission);
-					throw error;
 				})
+					.catch(error => {
+						if (ptyAdmission) ownedManager?.releaseCapacity(ptyAdmission);
+						throw error;
+					})
+					// Completion, error, and a fold all settle this foreground wait.
+					.finally(() => awaitingInput.dispose())
 			: await executeBash(command, {
 					cwd: commandCwd,
 					settings: this.session.settings,
@@ -2851,10 +2922,12 @@ export class BashTool implements AgentTool<BashToolSchema, BashToolDetails> {
 					spillThreshold,
 					headBytes,
 					onChunk: streamTailUpdates(tailBuffer, onUpdate),
+					// onChunk is throttled and drops chunks; the detector needs all of them.
+					onRawChunk: chunk => awaitingInput.push(chunk),
 					onMinimizedSave: async originalText => saveBashOriginalArtifact(artifactPublication, originalText),
-					ignoreShellPrefix: this.session.bashRestrictionProfile === "read-only" || directMasterSpawn,
-					disableShellSnapshot: this.session.bashRestrictionProfile === "read-only" || directMasterSpawn,
-				});
+					ignoreShellPrefix: this.#isolateRestrictedShell() || directMasterSpawn,
+					disableShellSnapshot: this.#isolateRestrictedShell() || directMasterSpawn,
+				}).finally(() => awaitingInput.dispose());
 		ptyFoldUnregister?.();
 		// Folded: the foreground was settled by the fold, so return the background
 		// -start result verbatim instead of presenting a half-finished command.

package/src/tools/browser/tab-worker.ts

@@ -3,7 +3,6 @@ import * as os from "node:os";
 import * as path from "node:path";
 
 import { untilAborted } from "@gajae-code/utils/abortable";
-import { Snowflake } from "@gajae-code/utils/snowflake";
 import type { HTMLElement } from "linkedom";
 import type {
 	Browser,
@@ -414,6 +413,31 @@ interface ActiveRun {
 	pendingTools: Map<string, { resolve(value: unknown): void; reject(error: Error): void }>;
 }
 
+async function writePrivateScreenshot(bytes: Uint8Array): Promise<string> {
+	// Random directory plus an exclusive create: a preexisting symlink under the
+	// shared temp directory is not opened, and the screenshot is not left world-readable.
+	// Create the temp root first: base created it with a recursive mkdir, and
+	// mkdtemp fails when that root does not exist yet. Do not change the root's mode.
+	const root = os.tmpdir();
+	await fs.promises.mkdir(root, { recursive: true });
+	const tempDir = await fs.promises.mkdtemp(path.join(root, "gjc-sshots-"));
+	try {
+		if (process.platform !== "win32") await fs.promises.chmod(tempDir, 0o700);
+		const dest = path.join(tempDir, "screenshot.png");
+		const handle = await fs.promises.open(dest, "wx", 0o600);
+		try {
+			await handle.writeFile(bytes);
+		} finally {
+			await handle.close();
+		}
+		if (process.platform !== "win32") await fs.promises.chmod(dest, 0o600);
+		return dest;
+	} catch (error) {
+		await fs.promises.rm(tempDir, { recursive: true, force: true });
+		throw error;
+	}
+}
+
 export class WorkerCore {
 	#transport: Transport;
 	#browser?: Browser;
@@ -852,20 +876,22 @@ export class WorkerCore {
 			{ maxWidth: 1024, maxHeight: 1024, maxBytes: 150 * 1024, jpegQuality: 70 },
 		);
 		const explicitPath = opts.save ? resolveTabWorkerPath(opts.save, session.cwd) : undefined;
-
-		const dest =
-			explicitPath ??
-			(session.browserScreenshotDir
-				? path.join(
-						session.browserScreenshotDir,
-						`screenshot-${new Date().toISOString().replace(/[:.]/g, "-").slice(0, -1)}.png`,
-					)
-				: path.join(os.tmpdir(), `gjc-sshots-${Snowflake.next()}.png`));
-		await fs.promises.mkdir(path.dirname(dest), { recursive: true });
-		const saveFullRes = !!(explicitPath || session.browserScreenshotDir);
+		const configuredDir = session.browserScreenshotDir;
+		const saveFullRes = !!(explicitPath || configuredDir);
 		const savedBuffer = saveFullRes ? buffer : resized.buffer;
 		const savedMimeType = saveFullRes ? "image/png" : resized.mimeType;
-		await Bun.write(dest, savedBuffer);
+		// Caller-chosen destinations stay as they were. Only the shared temp
+		// fallback is an exclusive private file: a preexisting symlink at the old
+		// predictable name is not opened, and the bytes are not left world-readable.
+		const dest = explicitPath
+			? explicitPath
+			: configuredDir
+				? path.join(configuredDir, `screenshot-${new Date().toISOString().replace(/[:.]/g, "-").slice(0, -1)}.png`)
+				: await writePrivateScreenshot(savedBuffer);
+		if (explicitPath || configuredDir) {
+			await fs.promises.mkdir(path.dirname(dest), { recursive: true });
+			await Bun.write(dest, savedBuffer);
+		}
 		const info: ScreenshotResult = {
 			dest,
 			mimeType: savedMimeType,