@iowarp/clio-coder 0.4.3 → 0.4.5

package/dist/{chunk-XIVNBFZS.js → chunk-4SVIVOMC.js}

@@ -1,14 +1,12 @@
 import { createRequire as __clioCreateRequire } from "node:module"; const require = __clioCreateRequire(import.meta.url);
 import {
-  loadProjectVerifierCatalog
-} from "./chunk-7DICMOS6.js";
-import {
-  pathBoundaryCovers,
-  resolvePathBoundary
-} from "./chunk-HHV2GANA.js";
+  projectSurfaceTrust,
+  safetySurfaceTrustHash,
+  workspaceTrustDirectory
+} from "./chunk-NTK3WTHM.js";
 import {
   classify
-} from "./chunk-B4OAX3SI.js";
+} from "./chunk-LUL5Z66S.js";
 import {
   extractCommandCdTargets,
   extractCommandDeleteTargets,
@@ -16,32 +14,39 @@ import {
   inlineShellScript,
   invokesClioSkillMutation,
   scanShellLike
-} from "./chunk-I7ZPNEJM.js";
-import {
-  artifactDefaultPath
-} from "./chunk-GYV6VZOC.js";
+} from "./chunk-M6TAYK66.js";
 import {
   canonicalizeExistingPath
-} from "./chunk-ECH6PKUQ.js";
+} from "./chunk-KQ6IDQIB.js";
+import {
+  loadProjectVerifierCatalog
+} from "./chunk-MDU3C27C.js";
+import {
+  pathBoundaryCovers,
+  resolvePathBoundary
+} from "./chunk-R2P2U3ZS.js";
+import {
+  artifactDefaultPath
+} from "./chunk-NTTS3O53.js";
 import {
   ToolNames
-} from "./chunk-K6BSR66V.js";
+} from "./chunk-EHOSNVVM.js";
 import {
   foreignAgentDirs
-} from "./chunk-KXDSS5WJ.js";
+} from "./chunk-5CY4Q6QI.js";
 import {
   resolvePackageRoot
-} from "./chunk-IWHMRKLL.js";
+} from "./chunk-E3LEPLQ2.js";
 import {
   require_dist
-} from "./chunk-APJ265NV.js";
+} from "./chunk-B5GGDIHT.js";
 import {
   clioConfigDir
-} from "./chunk-BYP5D4HI.js";
+} from "./chunk-CTTI7G3T.js";
 import {
   __toESM,
   init_esm_shims
-} from "./chunk-3R73A4XB.js";
+} from "./chunk-ECBHH7LU.js";
 
 // src/domains/safety/path-policy.ts
 init_esm_shims();
@@ -149,6 +154,7 @@ function normalizeSeparators(value) {
 // src/domains/safety/policy-engine.ts
 init_esm_shims();
 import { createHash as createHash2 } from "node:crypto";
+import { readFileSync as readFileSync3 } from "node:fs";
 import path4 from "node:path";
 
 // src/domains/safety/default-path-policy.ts
@@ -212,8 +218,10 @@ var DEFAULT_DAMAGE_CONTROL_PATH_POLICY = {
     // widen its own permissions in two tool calls. Both are authored by the
     // operator through the CLI (`clio-coder verifiers author` lands nothing
     // before `--yes`), so model-side writes and deletes are refused.
+    // Skills also refuse model-side writes and deletes; installs go through `clio-coder skills install`.
     ".clio-coder/safety.yaml",
     ".clio-coder/verifiers.yaml",
+    ".clio-coder/skills/",
     "/etc/",
     "/usr/",
     "/bin/",
@@ -267,12 +275,20 @@ function mergePathPolicyInputs(base, override) {
     noDeletePaths: [...base.noDeletePaths ?? [], ...override.noDeletePaths ?? []]
   };
 }
+var OPERATOR_PATH_POLICY = {
+  zeroAccessPaths: DEFAULT_DAMAGE_CONTROL_PATH_POLICY.zeroAccessPaths?.filter((entry) => entry.startsWith("~/")) ?? [],
+  readOnlyPaths: DEFAULT_DAMAGE_CONTROL_PATH_POLICY.readOnlyPaths?.filter(
+    (entry) => entry.startsWith("~/") || entry.startsWith("/") || entry.startsWith(".clio-coder/")
+  ) ?? [],
+  noWritePaths: DEFAULT_DAMAGE_CONTROL_PATH_POLICY.noWritePaths ?? [],
+  noDeletePaths: DEFAULT_DAMAGE_CONTROL_PATH_POLICY.noDeletePaths?.filter((entry) => entry.startsWith("~/")) ?? []
+};
 
 // src/domains/safety/project-policy.ts
 init_esm_shims();
 var import_yaml = __toESM(require_dist(), 1);
 import { createHash } from "node:crypto";
-import { existsSync, readFileSync } from "node:fs";
+import { existsSync, readFileSync, realpathSync } from "node:fs";
 import path2 from "node:path";
 var POLICY_RELATIVE_PATH = path2.join(".clio-coder", "safety.yaml");
 var ACTION_CLASSES = /* @__PURE__ */ new Set([
@@ -313,7 +329,7 @@ function projectSafetyPolicyPath(cwd = process.cwd()) {
   }
 }
 function loadProjectSafetyPolicy(cwd = process.cwd()) {
-  const policyPath = projectSafetyPolicyPath(cwd);
+  let policyPath = projectSafetyPolicyPath(cwd);
   if (policyPath === null) {
     return {
       path: null,
@@ -327,6 +343,7 @@ function loadProjectSafetyPolicy(cwd = process.cwd()) {
   }
   let raw;
   try {
+    policyPath = realpathSync(policyPath);
     raw = readFileSync(policyPath, "utf8");
   } catch (err) {
     return {
@@ -770,13 +787,38 @@ function expandHome(value) {
   return value === "~" ? homedir2() : value.startsWith("~/") ? path3.join(homedir2(), value.slice(2)) : value;
 }
 
+// src/domains/safety/workspace-trust.ts
+init_esm_shims();
+function gateProjectSafetyPolicy(workspaceRoot, policy) {
+  if (policy.path === null) return policy;
+  const trustVerdict = policy.hash === null ? "untrusted" : projectSurfaceTrust(workspaceRoot, "safety", safetySurfaceTrustHash(policy.path, policy.hash));
+  if (trustVerdict === "trusted") return { ...policy, trustVerdict };
+  return {
+    ...policy,
+    trustVerdict,
+    // This is the admitted empty policy, whose execution defaults are valid.
+    // Unapproved parse failures retain diagnostics below but cannot acquire the
+    // authority to block execution. An approved malformed policy stays invalid.
+    valid: true,
+    commands: [],
+    pathPolicy: {},
+    disableDefaultPathPolicy: false,
+    errors: [
+      ...policy.errors,
+      `${policy.path} is ${trustVerdict}; project safety ignored. Review with clio-coder config trust safety.`
+    ]
+  };
+}
+
 // src/domains/safety/policy-engine.ts
 var BUILTIN_ALLOWLIST = [
   { id: "builtin:pwd", re: /^pwd$/ },
   { id: "builtin:ls", re: /^ls(?:\s+(-[A-Za-z0-9]+|\.[/\w.-]*|[/\w.-]+))*$/ },
   { id: "builtin:git-status", re: /^git\s+status(?:\s+--short|\s+--branch|\s+-sb)*$/ },
   { id: "builtin:git-diff", re: /^git\s+diff(?:\s+--cached|\s+--stat|\s+--name-only|\s+--\s+[\w./-]+)*$/ },
-  { id: "builtin:git-log", re: /^git\s+log\s+--oneline(?:\s+-n\s+[1-9]\d{0,2})?(?:\s+--\s+[\w./-]+)?$/ },
+  { id: "builtin:git-log", re: /^git\s+log\s+--oneline(?:\s+-n\s+[1-9]\d{0,2})?(?:\s+--\s+[\w./-]+)?$/ }
+];
+var PROJECT_SCRIPT_COMMANDS = [
   { id: "builtin:npm-test", re: /^npm\s+(?:test|run\s+test)(?:\s+--\s+[\w=./:-]+(?:\s+[\w=./:-]+)*)?$/ },
   { id: "builtin:npm-lint", re: /^npm\s+run\s+lint(?:\s+--\s+[\w=./:-]+(?:\s+[\w=./:-]+)*)?$/ },
   { id: "builtin:npm-build", re: /^npm\s+run\s+build(?:\s+--\s+[\w=./:-]+(?:\s+[\w=./:-]+)*)?$/ },
@@ -821,10 +863,13 @@ function createSafetyPolicyEngine(options = {}) {
   const writeRoots = (options.writeRoots ?? []).map((root) => resolvePathBoundary(writeRootCwd, root));
   const skillRoots = activeClioSkillRoots(cwd);
   const packs = options.rulePacks ?? getCachedDefaultRulePacks();
-  const projectPolicy = options.projectPolicy ?? loadProjectSafetyPolicy(cwd);
-  const projectPolicyRoot = projectPolicy.path === null ? cwd : path4.dirname(path4.dirname(canonicalizeExistingPath(projectPolicy.path)));
+  const projectPolicy = options.projectPolicy ?? gateProjectSafetyPolicy(cwd, loadProjectSafetyPolicy(cwd));
+  const projectPolicyRoot = projectPolicy.path === null ? cwd : path4.dirname(path4.dirname(path4.resolve(projectPolicy.path)));
   const pathPolicyInput = projectPolicy.disableDefaultPathPolicy ? projectPolicy.pathPolicy : mergePathPolicyInputs(DEFAULT_DAMAGE_CONTROL_PATH_POLICY, projectPolicy.pathPolicy);
-  const expandedDefaults = projectPolicy.disableDefaultPathPolicy ? pathPolicyInput : mergePathPolicyInputs(pathPolicyInput, { zeroAccessPaths: clioCredentialStorePaths() });
+  const expandedDefaults = mergePathPolicyInputs(mergePathPolicyInputs(pathPolicyInput, OPERATOR_PATH_POLICY), {
+    zeroAccessPaths: clioCredentialStorePaths(),
+    readOnlyPaths: [...clioSkillsRootPaths(), path4.join(clioConfigDir(), "settings.yaml"), workspaceTrustDirectory()]
+  });
   const pathPolicy = compilePathPolicy(expandedDefaults, projectPolicyRoot);
   const zeroAccessPolicy = {
     root: pathPolicy.root,
@@ -885,6 +930,27 @@ function createSafetyPolicyEngine(options = {}) {
         return blockDecision(base, blockInput);
       }
       const mutationCommand = call.tool === ToolNames.Bash ? command : catalogCommand;
+      if (mutationCommand !== null && invokesTrustMutation(mutationCommand)) {
+        return blockDecision(base, {
+          reasonCode: "trust-authority",
+          ruleId: "trust-authority",
+          reasons: ["workspace trust grants require the operator CLI"],
+          policySource: "builtin-classifier"
+        });
+      }
+      if (skillMutationReason(
+        [path4.join(clioConfigDir(), "settings.yaml"), workspaceTrustDirectory()],
+        pathPolicyTargets(catalogCommand === null ? call : { tool: ToolNames.Bash, args: { command: catalogCommand } }),
+        callCwd,
+        mutationCommand
+      ) !== null) {
+        return blockDecision(base, {
+          reasonCode: "path-policy:readOnlyPaths",
+          ruleId: "path-policy:readOnlyPaths",
+          reasons: ["Clio settings and workspace trust records are operator-owned and cannot be mutated by tools"],
+          policySource: "builtin-classifier"
+        });
+      }
       const skillReason = mutationCommand !== null && invokesClioSkillMutation(mutationCommand) ? "skill installation and updates require the operator CLI or an explicit operator install choice; draft outside active skill roots" : skillMutationReason(
         skillRoots,
         pathPolicyTargets(catalogCommand === null ? call : { tool: ToolNames.Bash, args: { command: catalogCommand } }),
@@ -955,8 +1021,25 @@ function createSafetyPolicyEngine(options = {}) {
         };
         return posture === "confirmed" ? allowDecision(base, input) : askDecision(base, input);
       }
-      if (call.tool === ToolNames.Bash && classification.actionClass === "execute") {
-        const bash = evaluateBashPolicy(command ?? "", callCwd, cwd, posture, projectPolicy);
+      const packageCommand = call.tool === ToolNames.Verify && catalogCheck === null && typeof call.args?.check === "string" && call.args.check !== "frontend" ? `npm run ${call.args.check}` : null;
+      if ((call.tool === ToolNames.Bash || catalogCheck !== null || packageCommand !== null) && classification.actionClass === "execute") {
+        const bash = evaluateBashPolicy(
+          catalogCheck?.command ?? packageCommand ?? command ?? "",
+          catalogCheck === null ? callCwd : path4.resolve(cwd, catalogCheck.cwd),
+          cwd,
+          posture,
+          projectPolicy
+        );
+        if ((catalogCheck !== null || packageCommand !== null) && bash.kind === "allow" && bash.execRecognition !== "recognized" && posture !== "confirmed") {
+          return askDecision(base, {
+            ...bash,
+            reasonCode: "project-verifier-confirm",
+            reasons: [
+              ...bash.reasons,
+              `Repository verifier requires confirmation or an approved safety declaration: ${catalogCommand ?? packageCommand}`
+            ]
+          });
+        }
         if (bash.kind === "block") return blockDecision(base, bash);
         if (bash.kind === "ask") return askDecision(base, bash);
         return allowDecision(base, bash);
@@ -968,15 +1051,7 @@ function createSafetyPolicyEngine(options = {}) {
       };
       if (hit?.match.ruleId !== void 0) allowInput.ruleId = hit.match.ruleId;
       if (hit?.match !== void 0) allowInput.match = hit.match;
-      if (classification.actionClass === "execute") {
-        allowInput.execRecognition = catalogCheck === null ? "recognized" : "unrecognized";
-        if (catalogCheck !== null) {
-          allowInput.reasons = [
-            ...allowInput.reasons,
-            `project verifier '${catalogCheck.id}' runs declared argv: ${catalogCommand ?? ""}`
-          ];
-        }
-      }
+      if (classification.actionClass === "execute") allowInput.execRecognition = "recognized";
       return allowDecision(base, allowInput);
     },
     metadata() {
@@ -989,6 +1064,8 @@ function createSafetyPolicyEngine(options = {}) {
         projectPolicyHash: projectPolicy.hash,
         projectPolicyValid: projectPolicy.valid,
         projectPolicyErrors: [...projectPolicy.errors, ...pathPolicy.diagnostics],
+        disableDefaultPathPolicy: projectPolicy.disableDefaultPathPolicy,
+        workspaceTrustVerdict: projectPolicy.trustVerdict ?? "trusted",
         cwd
       };
     }
@@ -1001,6 +1078,13 @@ function clioCredentialStorePaths() {
     return [];
   }
 }
+function clioSkillsRootPaths() {
+  try {
+    return [path4.join(clioConfigDir(), "skills")];
+  } catch {
+    return [];
+  }
+}
 var SAFE_PRESENCE_RE = /^\s*grep\s+(?:-(?:q|sq|qs)\s+)('[^']*'|"[^"]*"|\S+)\s+\S+\s*$/;
 function isSafePresenceCheck(command) {
   const match = SAFE_PRESENCE_RE.exec(command);
@@ -1080,7 +1164,18 @@ function pathPolicyTargets(call) {
       return [];
   }
 }
-function evaluateBashPolicy(command, callCwd, workspaceRoot, posture, policy) {
+function evaluateBashPolicy(input, callCwd, workspaceRoot, posture, policy) {
+  if (typeof input !== "string" && !input.every((arg) => /^[\w=./:-]+$/u.test(arg))) {
+    return {
+      kind: posture === "confirmed" ? "allow" : "ask",
+      ruleId: "verify-unrecognized-argv",
+      reasonCode: "verify-unrecognized-argv",
+      reasons: ["project verifier argv is outside the bare-word no-prompt command set"],
+      policySource: "builtin-command-allowlist",
+      execRecognition: "unrecognized"
+    };
+  }
+  const command = typeof input === "string" ? input : input.join(" ");
   if (command.trim().length === 0) {
     return {
       kind: "block",
@@ -1090,6 +1185,16 @@ function evaluateBashPolicy(command, callCwd, workspaceRoot, posture, policy) {
       policySource: "builtin-command-allowlist"
     };
   }
+  if (typeof input === "string" && (/\$(?:[A-Za-z_{0-9@*#?!-])/.test(command) || /(?:^|[\s;&|])(?:python[\d.]*|node|ruby|perl|php|lua)\s+(?:[^\n]*?\s)?-[ce]\b/.test(command)) && posture !== "confirmed") {
+    return {
+      kind: "ask",
+      reasonCode: "bash-hidden-content",
+      ruleId: "bash-hidden-content",
+      reasons: ["shell variables or interpreter source hide paths from the safety scan and require one-shot confirmation"],
+      policySource: "builtin-command-allowlist",
+      execRecognition: "unrecognized"
+    };
+  }
   const projectMatch = matchingProjectCommand(policy, command, callCwd);
   if (projectMatch) {
     const base = {
@@ -1132,15 +1237,34 @@ function evaluateBashPolicy(command, callCwd, workspaceRoot, posture, policy) {
       execRecognition: "unrecognized"
     };
   }
+  if (PROJECT_SCRIPT_COMMANDS.some((entry) => entry.re.test(recognitionCommand))) {
+    return {
+      kind: posture === "confirmed" ? "allow" : "ask",
+      reasonCode: "project-script-confirm",
+      ruleId: "project-script-confirm",
+      reasons: [
+        "Repository-authored code requires one-shot confirmation or an operator-approved safety command declaration.",
+        projectScriptPreview(recognitionCommand, callCwd)
+      ],
+      policySource: "builtin-command-allowlist",
+      execRecognition: "unrecognized"
+    };
+  }
   const chain = recognizeCommandChain(recognitionCommand, callCwd, workspaceRoot, policy);
   if (chain !== null) {
     const chainReasons = [`every step of the && chain is recognized: ${chain.ruleIds.join(", ")}`];
+    if (chain.requiresConfirmation) {
+      for (const segment of recognitionCommand.split("&&").map((part) => part.trim())) {
+        if (PROJECT_SCRIPT_COMMANDS.some((entry) => entry.re.test(segment)))
+          chainReasons.push(projectScriptPreview(segment, callCwd));
+      }
+    }
     if (chain.requiresConfirmation && posture !== "confirmed") {
       return {
         kind: "ask",
         ruleId: "bash-recognized-chain",
         reasonCode: "bash-recognized-chain",
-        reasons: [...chainReasons, "project policy requires confirmation for one step"],
+        reasons: [...chainReasons, "repository code or project policy requires confirmation for one step"],
         policySource: "builtin-command-allowlist",
         execRecognition: "recognized"
       };
@@ -1155,6 +1279,20 @@ function evaluateBashPolicy(command, callCwd, workspaceRoot, posture, policy) {
     };
   }
   if (hasSequencingOperators(command)) {
+    const scriptSegments = recognitionCommand.split(/&&|\|\||[;|\n]/).map((part) => part.trim()).filter((part) => PROJECT_SCRIPT_COMMANDS.some((entry) => entry.re.test(part)));
+    if (scriptSegments.length > 0 && posture !== "confirmed") {
+      return {
+        kind: "ask",
+        ruleId: "project-script-confirm",
+        reasonCode: "project-script-confirm",
+        reasons: [
+          "Repository scripts in compound commands require one-shot confirmation",
+          ...scriptSegments.map((part) => projectScriptPreview(part, callCwd))
+        ],
+        policySource: "builtin-command-allowlist",
+        execRecognition: "unrecognized"
+      };
+    }
     return {
       kind: "allow",
       ruleId: "bash-shell-operators",
@@ -1304,6 +1442,11 @@ function recognizeCommandChain(command, callCwd, workspaceRoot, policy) {
       if (projectMatch.requireConfirmation) requiresConfirmation = true;
       continue;
     }
+    if (PROJECT_SCRIPT_COMMANDS.some((entry) => entry.re.test(rendered))) {
+      ruleIds.push("project-script-confirm");
+      requiresConfirmation = true;
+      continue;
+    }
     const builtin = BUILTIN_ALLOWLIST.find((entry) => entry.re.test(rendered));
     if (builtin === void 0) return null;
     ruleIds.push(builtin.id);
@@ -1338,7 +1481,13 @@ function cwdArg(args, fallback) {
   const resolved = typeof args?.cwd === "string" && args.cwd.length > 0 ? path4.resolve(fallback, args.cwd) : fallback;
   return canonicalizeExistingPath(resolved);
 }
-var CONTENT_BEARING_TOOLS = /* @__PURE__ */ new Set([ToolNames.Write, ToolNames.Edit, ToolNames.Artifact]);
+var CONTENT_BEARING_TOOLS = /* @__PURE__ */ new Set([
+  ToolNames.Write,
+  ToolNames.Edit,
+  ToolNames.Artifact,
+  ToolNames.Dispatch,
+  ToolNames.Tasks
+]);
 function damageControlScan(call) {
   if (!CONTENT_BEARING_TOOLS.has(call.tool)) return serializeArgs(call.args);
   const pathArg2 = call.args?.path;
@@ -1389,10 +1538,30 @@ function packPayload(rules) {
     ...rule.ask !== void 0 ? { ask: rule.ask } : {}
   }));
 }
+function invokesTrustMutation(command) {
+  const words = scanShellLike(command).filter((token) => !token.operator).map((token) => token.value);
+  return words.some((word, index) => word === "config" && words[index + 1] === "trust") || /\bconfig\s+trust\b/.test(inlineShellScript(command) ?? "");
+}
+function projectScriptPreview(command, cwd) {
+  const match = /^npm\s+(?:run\s+)?([\w:-]+)/.exec(command);
+  if (match) {
+    try {
+      const manifest = JSON.parse(readFileSync3(path4.join(cwd, "package.json"), "utf8"));
+      const name = match[1] ?? "test";
+      const scripts = [`pre${name}`, name, `post${name}`].flatMap(
+        (key) => typeof manifest.scripts?.[key] === "string" ? [`${key}: ${manifest.scripts[key]}`] : []
+      );
+      return `package.json scripts (repository data): ${scripts.join("; ") || "no script resolved"}`;
+    } catch {
+      return "package.json script body could not be resolved; repository code will execute.";
+    }
+  }
+  return `Repository command: ${command}. Its test/build files and dependencies execute with the child process permissions.`;
+}
 
 export {
   formatModelRejection,
   WRITE_ROOT_REFUSED_TOOLS,
   createSafetyPolicyEngine
 };
-//# sourceMappingURL=chunk-XIVNBFZS.js.map
+//# sourceMappingURL=chunk-4SVIVOMC.js.map

package/dist/{chunk-NMJXSHBJ.js → chunk-5A6XR3RJ.js}

@@ -1,25 +1,28 @@
 import { createRequire as __clioCreateRequire } from "node:module"; const require = __clioCreateRequire(import.meta.url);
+import {
+  isSecretArgKey
+} from "./chunk-EFSEIZE6.js";
 import {
   gitCommitAttributionEnabled,
   reportCommitAttributionDiagnostic,
   withManagedGitCommitAttributionEnvironment
-} from "./chunk-JIEGK6UF.js";
+} from "./chunk-LTR5QCLS.js";
 import {
   clampTimerDelayMs
-} from "./chunk-EBY63B7G.js";
+} from "./chunk-6EXUUOSN.js";
 import {
   AI_AGENT_NAME
-} from "./chunk-6EJMN2Y3.js";
+} from "./chunk-ZTNFYMIO.js";
 import {
   init_esm_shims
-} from "./chunk-3R73A4XB.js";
+} from "./chunk-ECBHH7LU.js";
 
 // src/core/bash-exec.ts
 init_esm_shims();
 import { spawn } from "node:child_process";
 import { StringDecoder } from "node:string_decoder";
 var BASH_HARD_CAP_BYTES = 16 * 1024 * 1024;
-var CLIO_CONTROL_ENV_KEYS = ["CLIO_CODER_INTERACTIVE"];
+var CLIO_CONTROL_ENV_KEYS = ["CLIO_CODER_INTERACTIVE", "BASH_ENV", "ENV"];
 var BASH_UPDATE_THROTTLE_MS = 100;
 var SYSTEM_PROGRESS_SCHEDULER = {
   now: Date.now,
@@ -107,8 +110,10 @@ function createBashOutputProgressController(onUpdate, scheduler = SYSTEM_PROGRES
     }
   };
 }
-function buildToolEnv() {
-  const env = { ...process.env };
+function buildToolEnv(source = process.env) {
+  const env = { ...source };
+  for (const key of Object.keys(env))
+    if (isSecretArgKey(key) || key.startsWith("BASH_FUNC_")) Reflect.deleteProperty(env, key);
   env.AI_AGENT = AI_AGENT_NAME;
   for (const key of CLIO_CONTROL_ENV_KEYS) {
     Reflect.deleteProperty(env, key);
@@ -155,12 +160,8 @@ function captureLoginEnv() {
 async function bashSpawnPlan() {
   loginEnvCapture ??= captureLoginEnv();
   const captured = await loginEnvCapture;
-  if (captured === null) return { mode: "-lc", env: buildToolEnv() };
-  const env = { ...process.env, ...captured };
-  env.AI_AGENT = AI_AGENT_NAME;
-  for (const key of CLIO_CONTROL_ENV_KEYS) {
-    Reflect.deleteProperty(env, key);
-  }
+  if (captured === null) return { mode: "-c", env: buildToolEnv() };
+  const env = buildToolEnv({ ...process.env, ...captured });
   return { mode: "-c", env };
 }
 function combineBashOutput(result) {
@@ -182,6 +183,7 @@ async function runBashCommand(command, options = {}) {
     let timeoutId = null;
     let killGraceTimer = null;
     let killSent = false;
+    let pendingClose = null;
     const output = createBashOutputProgressController(options.onUpdate);
     const child = spawn("/bin/bash", [plan.mode, command], {
       ...options.cwd === void 0 ? {} : { cwd: options.cwd },
@@ -206,12 +208,37 @@ async function runBashCommand(command, options = {}) {
       }
       child.kill(signalName);
     };
+    const hasOwnedProcesses = () => {
+      const pid = child.pid;
+      if (pid === void 0) return false;
+      if (process.platform !== "win32") {
+        try {
+          process.kill(-pid, 0);
+          return true;
+        } catch (error) {
+          if (error.code === "EPERM") return true;
+        }
+      }
+      return child.exitCode === null && child.signalCode === null;
+    };
+    const resolveAfterCancellation = (result) => {
+      if (killGraceTimer !== null && hasOwnedProcesses()) {
+        pendingClose = () => resolve(result);
+        return;
+      }
+      clearKillGraceTimer();
+      resolve(result);
+    };
     const killChild = () => {
       if (killSent) return;
       killSent = true;
       sendSignal("SIGTERM");
       killGraceTimer = setTimeout(() => {
-        sendSignal("SIGKILL");
+        killGraceTimer = null;
+        if (hasOwnedProcesses()) sendSignal("SIGKILL");
+        const finish = pendingClose;
+        pendingClose = null;
+        finish?.();
       }, 5e3);
     };
     function onAbort() {
@@ -238,10 +265,9 @@ async function runBashCommand(command, options = {}) {
       if (settled) return;
       settled = true;
       if (timeoutId) clearTimeout(timeoutId);
-      clearKillGraceTimer();
       const finalOutput = output.settle();
       options.signal?.removeEventListener("abort", onAbort);
-      resolve({
+      resolveAfterCancellation({
         error,
         ...finalOutput,
         exitCode: null,
@@ -254,7 +280,6 @@ async function runBashCommand(command, options = {}) {
       if (settled) return;
       settled = true;
       if (timeoutId) clearTimeout(timeoutId);
-      clearKillGraceTimer();
       const finalOutput = output.settle();
       options.signal?.removeEventListener("abort", onAbort);
       const error = code === 0 && signalName === null ? null : {
@@ -263,7 +288,7 @@ async function runBashCommand(command, options = {}) {
         code: code ?? void 0,
         signal: signalName ?? void 0
       };
-      resolve({
+      resolveAfterCancellation({
         error,
         ...finalOutput,
         exitCode: code,
@@ -280,4 +305,4 @@ export {
   combineBashOutput,
   runBashCommand
 };
-//# sourceMappingURL=chunk-NMJXSHBJ.js.map
+//# sourceMappingURL=chunk-5A6XR3RJ.js.map