@gajae-code/coding-agent 0.7.1 → 0.7.3

package/src/notifications/threaded-inbound.ts

@@ -21,11 +21,30 @@ export interface InboundUpdate {
 	message?: {
 		message_id?: unknown;
 		text?: unknown;
+		caption?: unknown;
+		photo?: unknown;
+		document?: unknown;
+		video?: unknown;
+		audio?: unknown;
+		voice?: unknown;
+		animation?: unknown;
 		chat?: { id?: unknown };
 		message_thread_id?: unknown;
 	};
 }
 
+/** A downloadable media attachment referenced by an inbound message. */
+export interface InboundAttachment {
+	/** Telegram file_id to resolve via getFile. */
+	fileId: string;
+	/** Source media kind; "photo" is always an image. */
+	kind: "photo" | "document" | "video" | "audio" | "voice" | "animation";
+	/** MIME type when Telegram provides one. */
+	mime?: string;
+	/** Original file name when provided. */
+	fileName?: string;
+}
+
 /** Context for {@link decideThreadedInbound}. All lookups are injected. */
 export interface ThreadedInboundCtx {
 	/** The single paired chat id (string-compared). */
@@ -38,7 +57,15 @@ export interface ThreadedInboundCtx {
 
 /** Outcome of routing an inbound update. */
 export type ThreadedInboundDecision =
-	| { kind: "inject"; sessionId: string; text: string; updateId: number; threadId: string; messageId?: number }
+	| {
+			kind: "inject";
+			sessionId: string;
+			text: string;
+			updateId: number;
+			threadId: string;
+			messageId?: number;
+			attachment?: InboundAttachment;
+	  }
 	| { kind: "duplicate"; updateId: number }
 	| { kind: "ignore"; reason: string };
 
@@ -48,6 +75,29 @@ function asString(value: unknown): string | undefined {
 	return undefined;
 }
 
+function extractAttachment(message: NonNullable<InboundUpdate["message"]>): InboundAttachment | undefined {
+	if (Array.isArray(message.photo) && message.photo.length > 0) {
+		const photo = message.photo[message.photo.length - 1];
+		if (photo && typeof photo === "object" && "file_id" in photo && typeof photo.file_id === "string") {
+			return { fileId: photo.file_id, kind: "photo", mime: "image/jpeg" };
+		}
+	}
+
+	for (const kind of ["document", "video", "audio", "voice", "animation"] as const) {
+		const file = message[kind];
+		if (file && typeof file === "object" && "file_id" in file && typeof file.file_id === "string") {
+			return {
+				fileId: file.file_id,
+				kind,
+				mime: "mime_type" in file && typeof file.mime_type === "string" ? file.mime_type : undefined,
+				fileName: "file_name" in file && typeof file.file_name === "string" ? file.file_name : undefined,
+			};
+		}
+	}
+
+	return undefined;
+}
+
 /**
  * Decide whether an inbound update should inject a user turn. Fail-closed:
  * returns `ignore` (with a reason) or `duplicate` for anything that is not an
@@ -72,9 +122,15 @@ export function decideThreadedInbound(update: InboundUpdate, ctx: ThreadedInboun
 	const updateId = update.update_id;
 	if (ctx.isDuplicate(updateId)) return { kind: "duplicate", updateId };
 
-	const text = typeof message.text === "string" ? message.text.trim() : "";
-	if (!text) return { kind: "ignore", reason: "empty_text" };
+	const text =
+		typeof message.text === "string"
+			? message.text.trim()
+			: typeof message.caption === "string"
+				? message.caption.trim()
+				: "";
+	const attachment = extractAttachment(message);
+	if (!text && attachment === undefined) return { kind: "ignore", reason: "empty_text" };
 
 	const messageId = typeof message.message_id === "number" ? message.message_id : undefined;
-	return { kind: "inject", sessionId, text, updateId, threadId, messageId };
+	return { kind: "inject", sessionId, text, updateId, threadId, messageId, attachment };
 }

package/src/notifications/threaded-render.ts

@@ -15,15 +15,19 @@ import type { RateLimitLane } from "./rate-limit-pool";
 
 /** A Telegram send derived from a threaded frame (topic id is applied by the daemon). */
 export interface ThreadedSend {
-	method: "sendMessage" | "sendPhoto";
+	method: "sendMessage" | "sendPhoto" | "sendDocument";
 	/** Rate-limit lane for prioritisation/fairness. */
 	lane: RateLimitLane;
 	/** Message text (sendMessage) or photo caption (sendPhoto). */
 	text?: string;
 	/** Base64 image bytes for sendPhoto. */
 	photoBase64?: string;
+	/** Base64 file bytes for sendDocument. */
+	documentBase64?: string;
 	/** Image MIME type for sendPhoto. */
 	mime?: string;
+	/** Suggested document filename. */
+	fileName?: string;
 	/** Coalesce key for live edits (same key collapses to the latest). */
 	coalesceKey?: string;
 	/** True for the one-time identity header (the daemon pins it once). */
@@ -49,11 +53,12 @@ interface ThreadedFrame {
 	phase?: unknown;
 	text?: unknown;
 	messageRef?: unknown;
-	// image_attachment
+	// image_attachment / file_attachment
 	source?: unknown;
 	data?: unknown;
 	mime?: unknown;
 	caption?: unknown;
+	name?: unknown;
 	// config_update
 	verbosity?: unknown;
 	redact?: unknown;
@@ -141,6 +146,19 @@ export function renderThreadedFrame(frame: ThreadedFrame): ThreadedSend | undefi
 				text: finalizeTelegramHtml(caption === undefined ? undefined : escapeHtml(caption)),
 			};
 		}
+		case "file_attachment": {
+			const data = str(frame.data);
+			if (!data) return undefined;
+			const caption = str(frame.caption);
+			return {
+				method: "sendDocument",
+				lane: "finalized",
+				documentBase64: data,
+				mime: str(frame.mime),
+				fileName: str(frame.name),
+				text: finalizeTelegramHtml(caption === undefined ? undefined : escapeHtml(caption)),
+			};
+		}
 		case "config_update": {
 			const verbosity = str(frame.verbosity);
 			const redact = typeof frame.redact === "boolean" ? `redact ${frame.redact ? "on" : "off"}` : undefined;

package/src/notifications/topic-registry.ts

@@ -65,6 +65,11 @@ export class TopicRegistry {
 		return this.byTopic.get(topicId);
 	}
 
+	/** All session ids with a persisted topic record. */
+	sessionIds(): string[] {
+		return [...this.topics.keys()];
+	}
+
 	/** The existing topic record for a session, if any. */
 	get(sessionId: string): TopicRecord | undefined {
 		return this.topics.get(sessionId);

package/src/session/agent-session.ts

@@ -286,6 +286,8 @@ import { ToolChoiceQueue } from "./tool-choice-queue";
 import { YieldQueue } from "./yield-queue";
 
 /** Session-specific events that extend the core AgentEvent */
+export type AutoCompactionContinuationSkipReason = "auto_continue_disabled_non_resumable_tail";
+
 export type AgentSessionEvent =
 	| AgentEvent
 	| { type: "auto_compaction_start"; reason: "threshold" | "overflow" | "idle"; action: "context-full" | "handoff" }
@@ -298,6 +300,7 @@ export type AgentSessionEvent =
 			errorMessage?: string;
 			/** True when compaction was skipped for a benign reason (no model, no candidates, nothing to compact). */
 			skipped?: boolean;
+			continuationSkipReason?: AutoCompactionContinuationSkipReason;
 	  }
 	| {
 			type: "auto_retry_start";
@@ -1869,7 +1872,6 @@ export class AgentSession {
 										this.#resolveTtsrResume();
 										return;
 									}
-									this.#ttsrAbortPending = false;
 									this.#perToolTtsrInjections.clear();
 									const ttsrSettings = this.#ttsrManager?.getSettings();
 									if (ttsrSettings?.contextMode === "discard" && targetAssistantIndex !== -1) {
@@ -1898,11 +1900,22 @@ export class AgentSession {
 										);
 										this.#markTtsrInjected(details.rules);
 									}
-									try {
-										await this.agent.continue();
-									} catch {
-										this.#resolveTtsrResume();
-									}
+									await this.#scheduleAgentContinue({
+										delayMs: 0,
+										generation,
+										shouldContinue: () => {
+											this.#ttsrAbortPending = false;
+											return true;
+										},
+										onSkip: () => {
+											this.#ttsrAbortPending = false;
+											this.#resolveTtsrResume();
+										},
+										onError: () => {
+											this.#ttsrAbortPending = false;
+											this.#resolveTtsrResume();
+										},
+									});
 								},
 								{ delayMs: 50 },
 							);
@@ -2214,7 +2227,7 @@ export class AgentSession {
 	#schedulePostPromptTask(
 		task: (signal: AbortSignal) => Promise<void>,
 		options?: { delayMs?: number; generation?: number; onSkip?: () => void },
-	): void {
+	): Promise<void> {
 		const delayMs = options?.delayMs ?? 0;
 		const signal = this.#postPromptTasksAbortController.signal;
 		const scheduled = (async () => {
@@ -2236,18 +2249,20 @@ export class AgentSession {
 			await task(signal);
 		})();
 		this.#trackPostPromptTask(scheduled);
+		return scheduled;
 	}
 
 	#scheduleAgentContinue(options?: {
 		delayMs?: number;
 		generation?: number;
+		skipCompactionCheck?: boolean;
 		shouldContinue?: () => boolean;
 		onSkip?: (reason: "generation_changed" | "aborted_signal" | "queue_drained") => void;
 		onError?: (error: unknown) => void;
-	}): void {
+	}): Promise<void> {
 		const scheduledGeneration = options?.generation;
 		const signal = this.#postPromptTasksAbortController.signal;
-		this.#schedulePostPromptTask(
+		return this.#schedulePostPromptTask(
 			async () => {
 				if (signal.aborted) {
 					options?.onSkip?.("aborted_signal");
@@ -2263,6 +2278,9 @@ export class AgentSession {
 				}
 				try {
 					await this.#maybeRestoreRetryFallbackPrimary();
+					if (!options?.skipCompactionCheck) {
+						await this.#checkEstimatedContextBeforePrompt();
+					}
 					await this.agent.continue();
 				} catch (error) {
 					logger.warn("agent.continue failed after scheduling", {
@@ -2307,6 +2325,34 @@ export class AgentSession {
 		}
 	}
 
+	#detectOverflowRetryContinuationSkip(): AutoCompactionContinuationSkipReason | undefined {
+		this.#stripOverflowFailedTurnForRetry();
+		if (this.#isResumableAgentTail()) return undefined;
+		const compactionSettings = this.settings.getGroup("compaction");
+		return compactionSettings.autoContinue === false ? "auto_continue_disabled_non_resumable_tail" : undefined;
+	}
+
+	#scheduleOverflowRetryContinuation(generation: number): void {
+		this.#stripOverflowFailedTurnForRetry();
+		if (this.#isResumableAgentTail()) {
+			this.#scheduleAgentContinue({
+				delayMs: 100,
+				generation,
+				onSkip: reason => this.#logCompactionContinuationSkipped("overflow_retry", reason),
+				onError: error => this.#logCompactionContinuationError("overflow_retry", error),
+			});
+			return;
+		}
+
+		const compactionSettings = this.settings.getGroup("compaction");
+		if (compactionSettings.autoContinue !== false) {
+			this.#scheduleAutoContinuePrompt(generation);
+			return;
+		}
+
+		this.#logCompactionContinuationSkipped("overflow_retry", "auto_continue_disabled_non_resumable_tail");
+	}
+
 	#scheduleAutoContinuePrompt(generation: number): void {
 		const continuePrompt = async () => {
 			await this.#promptWithMessage(
@@ -3052,6 +3098,7 @@ export class AgentSession {
 				willRetry: event.willRetry,
 				errorMessage: event.errorMessage,
 				skipped: event.skipped,
+				continuationSkipReason: event.continuationSkipReason,
 			});
 		} else if (event.type === "auto_retry_start") {
 			await this.#extensionRunner.emit({
@@ -6722,6 +6769,8 @@ export class AgentSession {
 			const compactionSettings = this.settings.getGroup("compaction");
 			if (compactionSettings.enabled && compactionSettings.strategy !== "off") {
 				await this.#runAutoCompaction("overflow", true);
+			} else {
+				this.#scheduleOverflowRetryContinuation(generation);
 			}
 			return;
 		}
@@ -6732,17 +6781,19 @@ export class AgentSession {
 		// Skip if this was an error (non-overflow errors don't have usage data)
 		if (assistantMessage.stopReason === "error") return;
 		let contextTokens = calculateContextTokens(assistantMessage.usage);
-		const maxOutputTokens = this.model?.maxTokens ?? 0;
+		// Model maxTokens is a capability ceiling, not a per-turn reservation.
+		// Auto maintenance should track actual context fullness.
+		const autoCompactionOutputReserveTokens = 0;
 		// Cache-epoch invariant: pruning rewrites already-sent toolResult history,
 		// which breaks the provider prompt-cache prefix mid-epoch. Only prune at a
 		// sanctioned maintenance boundary, i.e. when the un-pruned context already
 		// crosses the compaction threshold. Pruning may then avert full compaction.
-		if (!shouldCompact(contextTokens, contextWindow, compactionSettings, maxOutputTokens)) return;
+		if (!shouldCompact(contextTokens, contextWindow, compactionSettings, autoCompactionOutputReserveTokens)) return;
 		const pruneResult = await this.#pruneToolOutputs();
 		if (pruneResult) {
 			contextTokens = Math.max(0, contextTokens - pruneResult.tokensSaved);
 		}
-		if (shouldCompact(contextTokens, contextWindow, compactionSettings, maxOutputTokens)) {
+		if (shouldCompact(contextTokens, contextWindow, compactionSettings, autoCompactionOutputReserveTokens)) {
 			// Try promotion first — if a larger model is available, switch instead of compacting
 			const promoted = await this.#tryContextPromotion(assistantMessage);
 			if (!promoted) {
@@ -6820,14 +6871,16 @@ export class AgentSession {
 		if (!compactionSettings.enabled || compactionSettings.strategy === "off") return;
 
 		let contextTokens = this.#estimateContextTokensForCompaction(pendingMessages).tokens;
-		const maxOutputTokens = model.maxTokens ?? 0;
-		if (!shouldCompact(contextTokens, contextWindow, compactionSettings, maxOutputTokens)) return;
+		// Model maxTokens is a capability ceiling, not a per-turn reservation.
+		// Auto maintenance should track actual context fullness.
+		const autoCompactionOutputReserveTokens = 0;
+		if (!shouldCompact(contextTokens, contextWindow, compactionSettings, autoCompactionOutputReserveTokens)) return;
 
 		const pruneResult = await this.#pruneToolOutputs();
 		if (pruneResult) {
 			contextTokens = Math.max(0, contextTokens - pruneResult.tokensSaved);
 		}
-		if (shouldCompact(contextTokens, contextWindow, compactionSettings, maxOutputTokens)) {
+		if (shouldCompact(contextTokens, contextWindow, compactionSettings, autoCompactionOutputReserveTokens)) {
 			await this.#runAutoCompaction("threshold", false, false, {
 				continueAfterMaintenance: false,
 				deferHandoffMaintenance: false,
@@ -7730,32 +7783,18 @@ export class AgentSession {
 
 			const preparation = prepareCompaction(pathEntries, compactionSettings);
 			if (!preparation) {
+				const continuationSkipReason = willRetry ? this.#detectOverflowRetryContinuationSkip() : undefined;
 				await this.#emitSessionEvent({
 					type: "auto_compaction_end",
 					action,
 					result: undefined,
 					aborted: false,
-					willRetry: false,
+					willRetry: willRetry && !continuationSkipReason,
 					skipped: true,
+					continuationSkipReason,
 				});
 				if (willRetry) {
-					this.#stripOverflowFailedTurnForRetry();
-					if (this.#isResumableAgentTail()) {
-						this.#scheduleAgentContinue({
-							delayMs: 100,
-							generation,
-							onSkip: skipReason => this.#logCompactionContinuationSkipped("overflow_retry", skipReason),
-							onError: error => this.#logCompactionContinuationError("overflow_retry", error),
-						});
-					} else {
-						const tail = this.agent.state.messages.at(-1) as AssistantMessage | undefined;
-						logger.warn("Auto-compaction continuation skipped", {
-							source: "overflow_retry",
-							reason: "not_resumable_tail",
-							role: tail?.role,
-							stopReason: tail?.stopReason,
-						});
-					}
+					this.#scheduleOverflowRetryContinuation(generation);
 				} else if (continueAfterMaintenance && reason !== "idle" && this.agent.hasQueuedMessages()) {
 					this.#scheduleAgentContinue({
 						delayMs: 100,
@@ -7966,26 +8005,18 @@ export class AgentSession {
 				details,
 				preserveData,
 			};
-			await this.#emitSessionEvent({ type: "auto_compaction_end", action, result, aborted: false, willRetry });
+			const continuationSkipReason = willRetry ? this.#detectOverflowRetryContinuationSkip() : undefined;
+			await this.#emitSessionEvent({
+				type: "auto_compaction_end",
+				action,
+				result,
+				aborted: false,
+				willRetry: willRetry && !continuationSkipReason,
+				continuationSkipReason,
+			});
 
 			if (willRetry) {
-				this.#stripOverflowFailedTurnForRetry();
-				if (!this.#isResumableAgentTail()) {
-					const tail = this.agent.state.messages.at(-1) as AssistantMessage | undefined;
-					logger.warn("Auto-compaction continuation skipped", {
-						source: "overflow_retry",
-						reason: "not_resumable_tail",
-						role: tail?.role,
-						stopReason: tail?.stopReason,
-					});
-				} else {
-					this.#scheduleAgentContinue({
-						delayMs: 100,
-						generation,
-						onSkip: reason => this.#logCompactionContinuationSkipped("overflow_retry", reason),
-						onError: error => this.#logCompactionContinuationError("overflow_retry", error),
-					});
-				}
+				this.#scheduleOverflowRetryContinuation(generation);
 			} else if (continueAfterMaintenance && reason !== "idle" && this.agent.hasQueuedMessages()) {
 				// Auto-compaction can complete while follow-up/steering/custom messages are waiting.
 				// Kick the loop so queued messages are actually delivered.

package/src/slash-commands/helpers/parse.ts

@@ -1,3 +1,4 @@
+import { parseCommandArgs } from "../../utils/command-args";
 import type { ParsedSlashCommand, SlashCommandResult, SlashCommandRuntime } from "../types";
 
 export interface ParsedSubcommand {
@@ -65,7 +66,7 @@ export function errorMessage(error: unknown): string {
  * "name required" diagnostics with their own messaging.
  */
 export function parseNamedScopeArgs(rest: string, invalidScopeMessage: string): NamedScopeArgs {
-	const tokens = rest.split(/\s+/).filter(Boolean);
+	const tokens = parseCommandArgs(rest);
 	let name: string | undefined;
 	let scope: ConfigScope = "project";
 	let i = 0;

package/src/tools/bash.ts

@@ -25,6 +25,7 @@ import { type BashInteractiveResult, runInteractiveBashPty } from "./bash-intera
 import { checkBashInterception } from "./bash-interceptor";
 import { canUseInteractiveBashPty } from "./bash-pty-selection";
 import { expandInternalUrls, type InternalUrlExpansionOptions } from "./bash-skill-urls";
+import { checkComposerBashPolicy } from "./composer-bash-policy";
 import { formatStyledTruncationWarning, type OutputMeta, stripOutputNotice } from "./output-meta";
 import { resolveToCwd } from "./path-utils";
 import { formatToolWorkingDirectory, replaceTabs } from "./render-utils";
@@ -570,6 +571,14 @@ export class BashTool implements AgentTool<BashToolSchema, BashToolDetails> {
 			}
 		}
 
+		const composerPolicy = checkComposerBashPolicy({
+			modelId: this.session.getActiveModelString?.() ?? this.session.getModelString?.() ?? this.session.model?.id,
+			commands: rawCommand === command ? [command] : [rawCommand, command],
+		});
+		if (!composerPolicy.allowed) {
+			throw new ToolError(composerPolicy.message);
+		}
+
 		const internalUrlOptions: InternalUrlExpansionOptions = {
 			skills: this.session.skills ?? [],
 			internalRouter: InternalUrlRouter.instance(),

package/src/tools/composer-bash-policy.ts

@@ -0,0 +1,96 @@
+import { isComposerHarnessModel } from "@gajae-code/ai/providers/composer-discipline";
+
+export const COMPOSER_BASH_POLICY_ERROR =
+	"Composer bash policy blocked repository file I/O. Use find, search, read, and edit tools for file discovery, file inspection, and file mutation.";
+
+type ComposerBashPolicyResult =
+	| { allowed: true }
+	| {
+			allowed: false;
+			reason: string;
+			message: string;
+	  };
+
+const BLOCK_PATTERNS: Array<{ id: string; pattern: RegExp }> = [
+	{ id: "pipe", pattern: /\|/ },
+	{ id: "process-substitution", pattern: /<[>(]/ },
+	{ id: "heredoc", pattern: /<<[-~]?/ },
+	{ id: "command-substitution", pattern: /\$\(|`/ },
+	{ id: "redirection", pattern: /(^|[^<>])(?:>>?|<)(?!=)/ },
+	{ id: "tee", pattern: /(?:^|[;&|\s])tee(?:\s|$)/ },
+	{
+		id: "shell-file-read-discovery",
+		pattern: /(?:^|[;&|()\s])(?:\S*\/)?(?:cat|head|tail|less|more|grep|rg|find|fd|tree|ls)\b/,
+	},
+	{
+		id: "shell-file-mutation",
+		pattern: /(?:^|[;&|()\s])(?:\S*\/)?(?:cp|mv|rm|touch|mkdir|chmod|chown|ln)\b/,
+	},
+	{ id: "sed-print", pattern: /(?:^|[;&|()\s])sed\s+(?:-[^\s]*n\b|.*\bp\b)/ },
+	{ id: "awk-print", pattern: /(?:^|[;&|()\s])awk\b/ },
+	{ id: "git-ls-files", pattern: /(?:^|[;&|()\s])git(?:\s+-C\s+\S+)?\s+ls-files\b/ },
+	{ id: "git-grep", pattern: /(?:^|[;&|()\s])git(?:\s+-C\s+\S+)?\s+grep\b/ },
+	{ id: "git-show-path", pattern: /(?:^|[;&|()\s])git(?:\s+-C\s+\S+)?\s+show\s+\S+:\S+/ },
+	{ id: "git-diff", pattern: /(?:^|[;&|()\s])git(?:\s+-C\s+\S+)?\s+diff(?:\s|$)/ },
+	{ id: "git-cat-file", pattern: /(?:^|[;&|()\s])git(?:\s+-C\s+\S+)?\s+cat-file\b/ },
+	{
+		id: "git-show-discovery",
+		pattern: /(?:^|[;&|()\s])git(?:\s+-C\s+\S+)?\s+show\b.*(?:--name-only|--name-status|--stat)/,
+	},
+	{
+		id: "git-log-path-discovery",
+		pattern: /(?:^|[;&|()\s])git(?:\s+-C\s+\S+)?\s+log\b.*(?:--name-only|--name-status|--stat)/,
+	},
+	{ id: "sed-in-place", pattern: /(?:^|[;&|()\s])sed\s+-[^\s]*i\b/ },
+	{ id: "perl-in-place", pattern: /(?:^|[;&|()\s])perl\s+-[^\s]*p[^\s]*i\b/ },
+	{
+		id: "script-file-io",
+		pattern:
+			/(?:^|[;&|()\s])(?:python3?|node|bun)\s+(?:-\s*<<|-c\b|-e\b|--eval\b).*?(?:read_text|read_bytes|write_text|iterdir|listdir|glob\.glob|readFile|readFileSync|writeFile|writeFileSync|readdir|readdirSync|stat|statSync|cpSync|rmSync|mkdirSync|createReadStream|createWriteStream|Bun\.file|Bun\.write|fs\.readFile|fs\.writeFile|fs\.readdir|fs\.stat|fs\.cp|fs\.rm|fs\.mkdir|open\s*\()/s,
+	},
+	{
+		id: "contaminated-command",
+		pattern: /```|^\s*(?:I\s+(?:will|need|am going)|We\s+(?:need|will)|First[, ]|Now[, ]|Let's)\b/im,
+	},
+];
+
+const ALLOWED_TERMINAL_PATTERNS: RegExp[] = [
+	/^bun\s+test(?:\s+[\w./:@=-]+)*$/,
+	/^bun\s+run\s+(?:check(?::[\w-]+)?|test(?::[\w-]+)?|build(?::[\w-]+)?)(?:\s+[\w./:@=-]+)*$/,
+	/^bun\s+--version$/,
+	/^mise\s+x\s+bun@\d+\.\d+\.\d+\s+--\s+bun\s+test(?:\s+[\w./:@=-]+)*$/,
+	/^mise\s+x\s+bun@\d+\.\d+\.\d+\s+--\s+bun\s+run\s+(?:check(?::[\w-]+)?|test(?::[\w-]+)?|build(?::[\w-]+)?)(?:\s+[\w./:@=-]+)*$/,
+	/^cargo\s+(?:test|check|build)(?:\s+[\w./:@=-]+)*$/,
+	/^git\s+status(?:\s+--short)?(?:\s+--branch)?$/,
+	/^git\s+rev-parse\s+HEAD$/,
+	/^npm\s+--version$/,
+	/^pnpm\s+--version$/,
+	/^yarn\s+--version$/,
+];
+
+function isAllowedComposerTerminalCommand(command: string): boolean {
+	const normalized = command.trim().replace(/\s+/g, " ");
+	return ALLOWED_TERMINAL_PATTERNS.some(pattern => pattern.test(normalized));
+}
+
+export function isComposerBashPolicyModel(modelId: string | undefined): boolean {
+	return Boolean(modelId && isComposerHarnessModel(modelId));
+}
+
+export function checkComposerBashPolicy(input: {
+	modelId?: string;
+	commands: readonly string[];
+}): ComposerBashPolicyResult {
+	if (!isComposerBashPolicyModel(input.modelId)) return { allowed: true };
+	for (const command of input.commands) {
+		for (const block of BLOCK_PATTERNS) {
+			if (block.pattern.test(command)) {
+				return { allowed: false, reason: block.id, message: COMPOSER_BASH_POLICY_ERROR };
+			}
+		}
+		if (!isAllowedComposerTerminalCommand(command)) {
+			return { allowed: false, reason: "not-allowlisted", message: COMPOSER_BASH_POLICY_ERROR };
+		}
+	}
+	return { allowed: true };
+}