@mastra/code-sdk 1.1.1-alpha.0 → 1.1.1-alpha.3

package/CHANGELOG.md

@@ -1,5 +1,39 @@
 # @mastra/code-sdk
 
+## 1.1.1-alpha.3
+
+### Patch Changes
+
+- Review sessions now load project AGENTS.md/CLAUDE.md from the pull request's trusted base branch instead of skipping them entirely. The working-tree copies on an untrusted checkout remain excluded from the system prompt and reminder injection; content is served from the base ref via git, and sessions without a known base ref still skip project instruction files. ([#20372](https://github.com/mastra-ai/mastra/pull/20372))
+
+- Review sessions no longer ingest AGENTS.md or CLAUDE.md from the checked-out pull request branch. A PR branch is third-party content, so its instruction files are treated as content under review instead of trusted configuration — closing a prompt-injection path into the reviewer agent. The reviewer also runs the PR's install/build/test commands with GitHub tokens stripped from the environment. ([#20372](https://github.com/mastra-ai/mastra/pull/20372))
+
+- Added an option to the instruction-file reminder processor that lets hosts disable injection entirely for a request, so instruction files from untrusted checkouts are never surfaced as reminders. ([#20372](https://github.com/mastra-ai/mastra/pull/20372))
+
+- Updated dependencies [[`1288cba`](https://github.com/mastra-ai/mastra/commit/1288cba09b8ab906dba38270c7e2a75400344a98), [`723aa54`](https://github.com/mastra-ai/mastra/commit/723aa5437106bdb708ae03c0ef6b77aa11291e73), [`723aa54`](https://github.com/mastra-ai/mastra/commit/723aa5437106bdb708ae03c0ef6b77aa11291e73), [`723aa54`](https://github.com/mastra-ai/mastra/commit/723aa5437106bdb708ae03c0ef6b77aa11291e73)]:
+  - @mastra/pg@1.18.1-alpha.0
+  - @mastra/core@1.55.0-alpha.3
+
+## 1.1.1-alpha.2
+
+### Patch Changes
+
+- Extended Mastra Code's transient retry policy to cover provider server errors with up to 10 retries and exponential backoff starting at 500ms. ([#20393](https://github.com/mastra-ai/mastra/pull/20393))
+
+- Updated dependencies [[`55c9e24`](https://github.com/mastra-ai/mastra/commit/55c9e248c27c1d72b5bb7e94ea6b8a3999eee49f), [`07f5b4b`](https://github.com/mastra-ai/mastra/commit/07f5b4ba9d608d88865030732e580298296adf99)]:
+  - @mastra/core@1.55.0-alpha.2
+
+## 1.1.1-alpha.1
+
+### Patch Changes
+
+- Fixed sandbox file tools (view, write, edit, list) failing with "Path not found" in Factory sessions when called with absolute paths inside the session working directory. File tools now also work on macOS-hosted local sandboxes, not just Linux VMs. ([#20325](https://github.com/mastra-ai/mastra/pull/20325))
+
+- Sandbox filesystem operations now behave like local ones: missing files, existing destinations, and directory misuse raise typed errors instead of generic ones, reading a directory as a file fails instead of returning empty content, moving or copying a file into a new directory works, overwrite protection can no longer be raced by concurrent writers, and each filesystem reports a unique id and status. ([#20325](https://github.com/mastra-ai/mastra/pull/20325))
+
+- Updated dependencies [[`ba369f2`](https://github.com/mastra-ai/mastra/commit/ba369f2a0aaf998da0d6aa033d26f64f96bef8ac), [`dcfed93`](https://github.com/mastra-ai/mastra/commit/dcfed93e1e256c6abfa792cbb7ca836f5d0e8638), [`2876e15`](https://github.com/mastra-ai/mastra/commit/2876e15b4d2f616a3bc1ed3af57d546c268384ce), [`598080f`](https://github.com/mastra-ai/mastra/commit/598080f224edb3f0f5b801035b067fac50a56a03)]:
+  - @mastra/core@1.55.0-alpha.1
+
 ## 1.1.1-alpha.0
 
 ### Patch Changes

package/dist/agents/prompts/agent-instructions.d.ts

@@ -6,13 +6,52 @@ export interface InstructionSource {
     path: string;
     content: string;
     scope: 'global' | 'project';
+    /** Git ref the content was read from, when not read off the working tree. */
+    ref?: string;
 }
+/**
+ * Reads project-scope instruction files. The default implementation reads the
+ * working tree via `fs`; alternative readers can serve content from another
+ * source (e.g. a trusted git ref) while keeping working-tree paths as the
+ * addressing scheme.
+ */
+export interface InstructionFileReader {
+    exists(path: string): boolean;
+    read(path: string): string;
+    /** Git ref backing this reader, recorded on the loaded sources. */
+    ref?: string;
+}
+/**
+ * Create a reader that serves instruction files from a git ref instead of the
+ * working tree. Paths are still addressed as working-tree paths under
+ * `projectPath`; content comes from `git show <ref>:<relpath>` so an untrusted
+ * checkout (e.g. a PR branch under review) cannot influence what is loaded.
+ * Tries `origin/<ref>` first (remote truth), then the local ref. Any git
+ * failure (missing ref, missing file, no repo) reports the file as absent.
+ */
+export declare function createGitRefInstructionReader(projectPath: string, ref: string): InstructionFileReader;
+/**
+ * Reader for the reactive reminder channel (AgentsMDInjector) that serves
+ * paths under `projectPath` from a trusted git ref. Paths outside the project
+ * fall back to the operator machine's filesystem (those are trusted); paths
+ * inside the project are only ever resolved against the ref, never the
+ * working tree, so an untrusted checkout cannot feed content in.
+ */
+export declare function createGitRefReminderReader(projectPath: string, ref: string): {
+    pathExists: (path: string) => boolean;
+    isDirectory: (path: string) => boolean;
+    readFile: (path: string) => string;
+};
 /**
  * Load all agent instruction files from global and project locations.
  * Returns an array of instruction sources, with global ones first.
+ *
+ * `projectReader` controls where project-scope content comes from (defaults to
+ * the working tree). Global instructions always read the operator machine's
+ * filesystem.
  */
-export declare function loadAgentInstructions(projectPath: string, configDirName?: string): InstructionSource[];
-export declare function getStaticallyLoadedInstructionPaths(projectPath: string): string[];
+export declare function loadAgentInstructions(projectPath: string, configDirName?: string, projectReader?: InstructionFileReader): InstructionSource[];
+export declare function getStaticallyLoadedInstructionPaths(projectPath: string, configDirName?: string, projectReader?: InstructionFileReader): string[];
 /**
  * Format loaded instructions into a string for the system prompt.
  */

package/dist/agents/prompts/agent-instructions.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"agent-instructions.d.ts","sourceRoot":"","sources":["../../../src/agents/prompts/agent-instructions.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAmBH,MAAM,WAAW,iBAAiB;IAChC,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,QAAQ,GAAG,SAAS,CAAC;CAC7B;AAgBD;;;GAGG;AACH,wBAAgB,qBAAqB,CAAC,WAAW,EAAE,MAAM,EAAE,aAAa,SAAqB,GAAG,iBAAiB,EAAE,CAiDlH;AAED,wBAAgB,mCAAmC,CAAC,WAAW,EAAE,MAAM,GAAG,MAAM,EAAE,CAEjF;AAED;;GAEG;AACH,wBAAgB,uBAAuB,CAAC,OAAO,EAAE,iBAAiB,EAAE,GAAG,MAAM,CAS5E"}
+{"version":3,"file":"agent-instructions.d.ts","sourceRoot":"","sources":["../../../src/agents/prompts/agent-instructions.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAoBH,MAAM,WAAW,iBAAiB;IAChC,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,QAAQ,GAAG,SAAS,CAAC;IAC5B,6EAA6E;IAC7E,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED;;;;;GAKG;AACH,MAAM,WAAW,qBAAqB;IACpC,MAAM,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC;IAC9B,IAAI,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAAC;IAC3B,mEAAmE;IACnE,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAOD;;;;;;;GAOG;AACH,wBAAgB,6BAA6B,CAAC,WAAW,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,qBAAqB,CA+BrG;AAED;;;;;;GAMG;AACH,wBAAgB,0BAA0B,CACxC,WAAW,EAAE,MAAM,EACnB,GAAG,EAAE,MAAM,GACV;IACD,UAAU,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC;IACtC,WAAW,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC;IACvC,QAAQ,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,MAAM,CAAC;CACpC,CA4CA;AAgBD;;;;;;;GAOG;AACH,wBAAgB,qBAAqB,CACnC,WAAW,EAAE,MAAM,EACnB,aAAa,SAAqB,EAClC,aAAa,GAAE,qBAA2C,GACzD,iBAAiB,EAAE,CAsDrB;AAED,wBAAgB,mCAAmC,CACjD,WAAW,EAAE,MAAM,EACnB,aAAa,SAAqB,EAClC,aAAa,CAAC,EAAE,qBAAqB,GACpC,MAAM,EAAE,CAEV;AAED;;GAEG;AACH,wBAAgB,uBAAuB,CAAC,OAAO,EAAE,iBAAiB,EAAE,GAAG,MAAM,CAU5E"}

package/dist/agents/prompts/agent-instructions.js

@@ -1,7 +1,8 @@
 import { DEFAULT_CONFIG_DIR } from "../../constants.js";
-import { existsSync, readFileSync } from "fs";
+import { existsSync, readFileSync, statSync } from "fs";
 import { homedir } from "os";
-import { join, normalize } from "path";
+import { isAbsolute, join, normalize, relative, sep } from "path";
+import { execFileSync } from "child_process";
 //#region src/agents/prompts/agent-instructions.ts
 /**
 * Load project and global agent instruction files (AGENTS.md, CLAUDE.md).
@@ -19,22 +20,130 @@ const GLOBAL_LOCATIONS = [
 	".config/claude",
 	".config/mastracode"
 ];
+const fsInstructionReader = {
+	exists: (path) => existsSync(path),
+	read: (path) => readFileSync(path, "utf-8")
+};
+/**
+* Create a reader that serves instruction files from a git ref instead of the
+* working tree. Paths are still addressed as working-tree paths under
+* `projectPath`; content comes from `git show <ref>:<relpath>` so an untrusted
+* checkout (e.g. a PR branch under review) cannot influence what is loaded.
+* Tries `origin/<ref>` first (remote truth), then the local ref. Any git
+* failure (missing ref, missing file, no repo) reports the file as absent.
+*/
+function createGitRefInstructionReader(projectPath, ref) {
+	const toRelative = (path) => {
+		const rel = relative(projectPath, path);
+		if (!rel || rel.startsWith("..") || isAbsolute(rel)) return null;
+		return rel.split(sep).join("/");
+	};
+	const show = (path) => {
+		const rel = toRelative(path);
+		if (rel === null) return null;
+		for (const candidate of [`origin/${ref}`, ref]) try {
+			return execFileSync("git", [
+				"-C",
+				projectPath,
+				"show",
+				`${candidate}:${rel}`
+			], {
+				encoding: "utf-8",
+				stdio: [
+					"ignore",
+					"pipe",
+					"ignore"
+				],
+				maxBuffer: 1024 * 1024
+			});
+		} catch {}
+		return null;
+	};
+	return {
+		ref,
+		exists: (path) => show(path) !== null,
+		read: (path) => {
+			const content = show(path);
+			if (content === null) throw new Error(`Not found at ref ${ref}: ${path}`);
+			return content;
+		}
+	};
+}
+/**
+* Reader for the reactive reminder channel (AgentsMDInjector) that serves
+* paths under `projectPath` from a trusted git ref. Paths outside the project
+* fall back to the operator machine's filesystem (those are trusted); paths
+* inside the project are only ever resolved against the ref, never the
+* working tree, so an untrusted checkout cannot feed content in.
+*/
+function createGitRefReminderReader(projectPath, ref) {
+	const gitReader = createGitRefInstructionReader(projectPath, ref);
+	const toRelative = (path) => {
+		const rel = relative(projectPath, normalize(path));
+		if (rel.startsWith("..") || isAbsolute(rel)) return null;
+		return rel.split(sep).join("/");
+	};
+	const objectType = (rel) => {
+		if (rel === "") return "tree";
+		for (const candidate of [`origin/${ref}`, ref]) try {
+			return execFileSync("git", [
+				"-C",
+				projectPath,
+				"cat-file",
+				"-t",
+				`${candidate}:${rel}`
+			], {
+				encoding: "utf-8",
+				stdio: [
+					"ignore",
+					"pipe",
+					"ignore"
+				]
+			}).trim();
+		} catch {}
+		return null;
+	};
+	return {
+		pathExists: (path) => {
+			const rel = toRelative(path);
+			if (rel === null) return existsSync(path);
+			return objectType(rel) !== null;
+		},
+		isDirectory: (path) => {
+			const rel = toRelative(path);
+			if (rel === null) try {
+				return statSync(path).isDirectory();
+			} catch {
+				return false;
+			}
+			return objectType(rel) === "tree";
+		},
+		readFile: (path) => {
+			if (toRelative(path) === null) return readFileSync(path, "utf-8");
+			return gitReader.read(path);
+		}
+	};
+}
 /**
 * Find the first existing instruction file at a given base path.
 * Prefers AGENTS.md over CLAUDE.md.
 */
-function findInstructionFile(basePath) {
+function findInstructionFile(basePath, reader = fsInstructionReader) {
 	for (const filename of INSTRUCTION_FILES) {
 		const fullPath = join(basePath, filename);
-		if (existsSync(fullPath)) return fullPath;
+		if (reader.exists(fullPath)) return fullPath;
 	}
 	return null;
 }
 /**
 * Load all agent instruction files from global and project locations.
 * Returns an array of instruction sources, with global ones first.
+*
+* `projectReader` controls where project-scope content comes from (defaults to
+* the working tree). Global instructions always read the operator machine's
+* filesystem.
 */
-function loadAgentInstructions(projectPath, configDirName = DEFAULT_CONFIG_DIR) {
+function loadAgentInstructions(projectPath, configDirName = DEFAULT_CONFIG_DIR, projectReader = fsInstructionReader) {
 	const sources = [];
 	const home = homedir();
 	const projectLocations = PROJECT_LOCATIONS.map((loc) => loc === ".mastracode" ? configDirName : loc);
@@ -58,14 +167,15 @@ function loadAgentInstructions(projectPath, configDirName = DEFAULT_CONFIG_DIR)
 		} catch {}
 	}
 	for (const location of projectLocations) {
-		const filePath = findInstructionFile(location ? join(projectPath, location) : projectPath);
+		const filePath = findInstructionFile(location ? join(projectPath, location) : projectPath, projectReader);
 		if (filePath) try {
-			const content = readFileSync(filePath, "utf-8").trim();
+			const content = projectReader.read(filePath).trim();
 			if (content) {
 				sources.push({
 					path: filePath,
 					content,
-					scope: "project"
+					scope: "project",
+					...projectReader.ref ? { ref: projectReader.ref } : {}
 				});
 				break;
 			}
@@ -73,8 +183,8 @@ function loadAgentInstructions(projectPath, configDirName = DEFAULT_CONFIG_DIR)
 	}
 	return sources;
 }
-function getStaticallyLoadedInstructionPaths(projectPath) {
-	return loadAgentInstructions(projectPath).map((source) => normalize(source.path));
+function getStaticallyLoadedInstructionPaths(projectPath, configDirName = DEFAULT_CONFIG_DIR, projectReader) {
+	return loadAgentInstructions(projectPath, configDirName, projectReader).map((source) => normalize(source.path));
 }
 /**
 * Format loaded instructions into a string for the system prompt.
@@ -82,10 +192,10 @@ function getStaticallyLoadedInstructionPaths(projectPath) {
 function formatAgentInstructions(sources) {
 	if (sources.length === 0) return "";
 	return `\n# Agent Instructions\n\n${sources.map((source) => {
-		return `<!-- ${source.scope === "global" ? "Global" : "Project"} instructions from ${source.path} -->\n${source.content}`;
+		return `<!-- ${source.scope === "global" ? "Global" : "Project"} instructions from ${source.ref ? `${source.path} (at ref ${source.ref})` : source.path} -->\n${source.content}`;
 	}).join("\n\n")}\n`;
 }
 //#endregion
-export { formatAgentInstructions, getStaticallyLoadedInstructionPaths, loadAgentInstructions };
+export { createGitRefInstructionReader, createGitRefReminderReader, formatAgentInstructions, getStaticallyLoadedInstructionPaths, loadAgentInstructions };
 
 //# sourceMappingURL=agent-instructions.js.map

package/dist/agents/prompts/agent-instructions.js.map

@@ -1 +1 @@
-{"version":3,"file":"agent-instructions.js","names":[],"sources":["../../../src/agents/prompts/agent-instructions.ts"],"sourcesContent":["/**\n * Load project and global agent instruction files (AGENTS.md, CLAUDE.md).\n * Prefers AGENTS.md over CLAUDE.md when multiple exist at the same location.\n */\n\nimport { existsSync, readFileSync } from 'node:fs';\nimport { homedir } from 'node:os';\nimport { join, normalize } from 'node:path';\nimport { DEFAULT_CONFIG_DIR } from '../../constants.js';\n\n// Filenames to check, in order of preference\nconst INSTRUCTION_FILES = ['AGENTS.md', 'CLAUDE.md'];\n\n// Locations to scan (relative to project root or home)\nconst PROJECT_LOCATIONS = [\n  '', // project root\n  '.claude',\n  '.mastracode',\n];\n\nconst GLOBAL_LOCATIONS = ['.claude', '.mastracode', '.config/claude', '.config/mastracode'];\n\nexport interface InstructionSource {\n  path: string;\n  content: string;\n  scope: 'global' | 'project';\n}\n\n/**\n * Find the first existing instruction file at a given base path.\n * Prefers AGENTS.md over CLAUDE.md.\n */\nfunction findInstructionFile(basePath: string): string | null {\n  for (const filename of INSTRUCTION_FILES) {\n    const fullPath = join(basePath, filename);\n    if (existsSync(fullPath)) {\n      return fullPath;\n    }\n  }\n  return null;\n}\n\n/**\n * Load all agent instruction files from global and project locations.\n * Returns an array of instruction sources, with global ones first.\n */\nexport function loadAgentInstructions(projectPath: string, configDirName = DEFAULT_CONFIG_DIR): InstructionSource[] {\n  const sources: InstructionSource[] = [];\n  const home = homedir();\n\n  // Derive location arrays from the base constants, substituting the config dir name\n  const projectLocations = PROJECT_LOCATIONS.map(loc => (loc === '.mastracode' ? configDirName : loc));\n  const globalLocations = GLOBAL_LOCATIONS.map(loc => {\n    if (loc === '.mastracode') return configDirName;\n    // XDG-style path (~/.config/<name>): strip the leading dot since the\n    // .config/ prefix already signals a hidden/config directory.\n    if (loc === '.config/mastracode') return '.config/' + configDirName.replace(/^\\./, '');\n    return loc;\n  });\n\n  // Load global instructions first\n  for (const location of globalLocations) {\n    const basePath = join(home, location);\n    const filePath = findInstructionFile(basePath);\n    if (filePath) {\n      try {\n        const content = readFileSync(filePath, 'utf-8').trim();\n        if (content) {\n          sources.push({ path: filePath, content, scope: 'global' });\n          break; // Only use first found global instruction file\n        }\n      } catch {\n        // Skip unreadable files\n      }\n    }\n  }\n\n  // Load project instructions\n  for (const location of projectLocations) {\n    const basePath = location ? join(projectPath, location) : projectPath;\n    const filePath = findInstructionFile(basePath);\n    if (filePath) {\n      try {\n        const content = readFileSync(filePath, 'utf-8').trim();\n        if (content) {\n          sources.push({ path: filePath, content, scope: 'project' });\n          break; // Only use first found project instruction file\n        }\n      } catch {\n        // Skip unreadable files\n      }\n    }\n  }\n\n  return sources;\n}\n\nexport function getStaticallyLoadedInstructionPaths(projectPath: string): string[] {\n  return loadAgentInstructions(projectPath).map(source => normalize(source.path));\n}\n\n/**\n * Format loaded instructions into a string for the system prompt.\n */\nexport function formatAgentInstructions(sources: InstructionSource[]): string {\n  if (sources.length === 0) return '';\n\n  const sections = sources.map(source => {\n    const label = source.scope === 'global' ? 'Global' : 'Project';\n    return `<!-- ${label} instructions from ${source.path} -->\\n${source.content}`;\n  });\n\n  return `\\n# Agent Instructions\\n\\n${sections.join('\\n\\n')}\\n`;\n}\n"],"mappings":";;;;;;;;;AAWA,MAAM,oBAAoB,CAAC,aAAa,WAAW;AAGnD,MAAM,oBAAoB;CACxB;CACA;CACA;AACF;AAEA,MAAM,mBAAmB;CAAC;CAAW;CAAe;CAAkB;AAAoB;;;;;AAY1F,SAAS,oBAAoB,UAAiC;CAC5D,KAAK,MAAM,YAAY,mBAAmB;EACxC,MAAM,WAAW,KAAK,UAAU,QAAQ;EACxC,IAAI,WAAW,QAAQ,GACrB,OAAO;CAEX;CACA,OAAO;AACT;;;;;AAMA,SAAgB,sBAAsB,aAAqB,gBAAgB,oBAAyC;CAClH,MAAM,UAA+B,CAAC;CACtC,MAAM,OAAO,QAAQ;CAGrB,MAAM,mBAAmB,kBAAkB,KAAI,QAAQ,QAAQ,gBAAgB,gBAAgB,GAAI;CACnG,MAAM,kBAAkB,iBAAiB,KAAI,QAAO;EAClD,IAAI,QAAQ,eAAe,OAAO;EAGlC,IAAI,QAAQ,sBAAsB,OAAO,aAAa,cAAc,QAAQ,OAAO,EAAE;EACrF,OAAO;CACT,CAAC;CAGD,KAAK,MAAM,YAAY,iBAAiB;EAEtC,MAAM,WAAW,oBADA,KAAK,MAAM,QACgB,CAAC;EAC7C,IAAI,UACF,IAAI;GACF,MAAM,UAAU,aAAa,UAAU,OAAO,CAAC,CAAC,KAAK;GACrD,IAAI,SAAS;IACX,QAAQ,KAAK;KAAE,MAAM;KAAU;KAAS,OAAO;IAAS,CAAC;IACzD;GACF;EACF,QAAQ,CAER;CAEJ;CAGA,KAAK,MAAM,YAAY,kBAAkB;EAEvC,MAAM,WAAW,oBADA,WAAW,KAAK,aAAa,QAAQ,IAAI,WACb;EAC7C,IAAI,UACF,IAAI;GACF,MAAM,UAAU,aAAa,UAAU,OAAO,CAAC,CAAC,KAAK;GACrD,IAAI,SAAS;IACX,QAAQ,KAAK;KAAE,MAAM;KAAU;KAAS,OAAO;IAAU,CAAC;IAC1D;GACF;EACF,QAAQ,CAER;CAEJ;CAEA,OAAO;AACT;AAEA,SAAgB,oCAAoC,aAA+B;CACjF,OAAO,sBAAsB,WAAW,CAAC,CAAC,KAAI,WAAU,UAAU,OAAO,IAAI,CAAC;AAChF;;;;AAKA,SAAgB,wBAAwB,SAAsC;CAC5E,IAAI,QAAQ,WAAW,GAAG,OAAO;CAOjC,OAAO,6BALU,QAAQ,KAAI,WAAU;EAErC,OAAO,QADO,OAAO,UAAU,WAAW,WAAW,UAChC,qBAAqB,OAAO,KAAK,QAAQ,OAAO;CACvE,CAE2C,CAAC,CAAC,KAAK,MAAM,EAAE;AAC5D"}
+{"version":3,"file":"agent-instructions.js","names":[],"sources":["../../../src/agents/prompts/agent-instructions.ts"],"sourcesContent":["/**\n * Load project and global agent instruction files (AGENTS.md, CLAUDE.md).\n * Prefers AGENTS.md over CLAUDE.md when multiple exist at the same location.\n */\n\nimport { execFileSync } from 'node:child_process';\nimport { existsSync, readFileSync, statSync } from 'node:fs';\nimport { homedir } from 'node:os';\nimport { isAbsolute, join, normalize, relative, sep } from 'node:path';\nimport { DEFAULT_CONFIG_DIR } from '../../constants.js';\n\n// Filenames to check, in order of preference\nconst INSTRUCTION_FILES = ['AGENTS.md', 'CLAUDE.md'];\n\n// Locations to scan (relative to project root or home)\nconst PROJECT_LOCATIONS = [\n  '', // project root\n  '.claude',\n  '.mastracode',\n];\n\nconst GLOBAL_LOCATIONS = ['.claude', '.mastracode', '.config/claude', '.config/mastracode'];\n\nexport interface InstructionSource {\n  path: string;\n  content: string;\n  scope: 'global' | 'project';\n  /** Git ref the content was read from, when not read off the working tree. */\n  ref?: string;\n}\n\n/**\n * Reads project-scope instruction files. The default implementation reads the\n * working tree via `fs`; alternative readers can serve content from another\n * source (e.g. a trusted git ref) while keeping working-tree paths as the\n * addressing scheme.\n */\nexport interface InstructionFileReader {\n  exists(path: string): boolean;\n  read(path: string): string;\n  /** Git ref backing this reader, recorded on the loaded sources. */\n  ref?: string;\n}\n\nconst fsInstructionReader: InstructionFileReader = {\n  exists: path => existsSync(path),\n  read: path => readFileSync(path, 'utf-8'),\n};\n\n/**\n * Create a reader that serves instruction files from a git ref instead of the\n * working tree. Paths are still addressed as working-tree paths under\n * `projectPath`; content comes from `git show <ref>:<relpath>` so an untrusted\n * checkout (e.g. a PR branch under review) cannot influence what is loaded.\n * Tries `origin/<ref>` first (remote truth), then the local ref. Any git\n * failure (missing ref, missing file, no repo) reports the file as absent.\n */\nexport function createGitRefInstructionReader(projectPath: string, ref: string): InstructionFileReader {\n  const toRelative = (path: string): string | null => {\n    const rel = relative(projectPath, path);\n    if (!rel || rel.startsWith('..') || isAbsolute(rel)) return null;\n    return rel.split(sep).join('/');\n  };\n  const show = (path: string): string | null => {\n    const rel = toRelative(path);\n    if (rel === null) return null;\n    for (const candidate of [`origin/${ref}`, ref]) {\n      try {\n        return execFileSync('git', ['-C', projectPath, 'show', `${candidate}:${rel}`], {\n          encoding: 'utf-8',\n          stdio: ['ignore', 'pipe', 'ignore'],\n          maxBuffer: 1024 * 1024,\n        });\n      } catch {\n        // Ref or file missing at this candidate — try the next one.\n      }\n    }\n    return null;\n  };\n  return {\n    ref,\n    exists: path => show(path) !== null,\n    read: path => {\n      const content = show(path);\n      if (content === null) throw new Error(`Not found at ref ${ref}: ${path}`);\n      return content;\n    },\n  };\n}\n\n/**\n * Reader for the reactive reminder channel (AgentsMDInjector) that serves\n * paths under `projectPath` from a trusted git ref. Paths outside the project\n * fall back to the operator machine's filesystem (those are trusted); paths\n * inside the project are only ever resolved against the ref, never the\n * working tree, so an untrusted checkout cannot feed content in.\n */\nexport function createGitRefReminderReader(\n  projectPath: string,\n  ref: string,\n): {\n  pathExists: (path: string) => boolean;\n  isDirectory: (path: string) => boolean;\n  readFile: (path: string) => string;\n} {\n  const gitReader = createGitRefInstructionReader(projectPath, ref);\n  const toRelative = (path: string): string | null => {\n    const rel = relative(projectPath, normalize(path));\n    if (rel.startsWith('..') || isAbsolute(rel)) return null;\n    return rel.split(sep).join('/');\n  };\n  const objectType = (rel: string): string | null => {\n    if (rel === '') return 'tree'; // project root\n    for (const candidate of [`origin/${ref}`, ref]) {\n      try {\n        return execFileSync('git', ['-C', projectPath, 'cat-file', '-t', `${candidate}:${rel}`], {\n          encoding: 'utf-8',\n          stdio: ['ignore', 'pipe', 'ignore'],\n        }).trim();\n      } catch {\n        // Ref or object missing at this candidate — try the next one.\n      }\n    }\n    return null;\n  };\n  return {\n    pathExists: path => {\n      const rel = toRelative(path);\n      if (rel === null) return existsSync(path);\n      return objectType(rel) !== null;\n    },\n    isDirectory: path => {\n      const rel = toRelative(path);\n      if (rel === null) {\n        try {\n          return statSync(path).isDirectory();\n        } catch {\n          return false;\n        }\n      }\n      return objectType(rel) === 'tree';\n    },\n    readFile: path => {\n      const rel = toRelative(path);\n      if (rel === null) return readFileSync(path, 'utf-8');\n      return gitReader.read(path);\n    },\n  };\n}\n\n/**\n * Find the first existing instruction file at a given base path.\n * Prefers AGENTS.md over CLAUDE.md.\n */\nfunction findInstructionFile(basePath: string, reader: InstructionFileReader = fsInstructionReader): string | null {\n  for (const filename of INSTRUCTION_FILES) {\n    const fullPath = join(basePath, filename);\n    if (reader.exists(fullPath)) {\n      return fullPath;\n    }\n  }\n  return null;\n}\n\n/**\n * Load all agent instruction files from global and project locations.\n * Returns an array of instruction sources, with global ones first.\n *\n * `projectReader` controls where project-scope content comes from (defaults to\n * the working tree). Global instructions always read the operator machine's\n * filesystem.\n */\nexport function loadAgentInstructions(\n  projectPath: string,\n  configDirName = DEFAULT_CONFIG_DIR,\n  projectReader: InstructionFileReader = fsInstructionReader,\n): InstructionSource[] {\n  const sources: InstructionSource[] = [];\n  const home = homedir();\n\n  // Derive location arrays from the base constants, substituting the config dir name\n  const projectLocations = PROJECT_LOCATIONS.map(loc => (loc === '.mastracode' ? configDirName : loc));\n  const globalLocations = GLOBAL_LOCATIONS.map(loc => {\n    if (loc === '.mastracode') return configDirName;\n    // XDG-style path (~/.config/<name>): strip the leading dot since the\n    // .config/ prefix already signals a hidden/config directory.\n    if (loc === '.config/mastracode') return '.config/' + configDirName.replace(/^\\./, '');\n    return loc;\n  });\n\n  // Load global instructions first\n  for (const location of globalLocations) {\n    const basePath = join(home, location);\n    const filePath = findInstructionFile(basePath);\n    if (filePath) {\n      try {\n        const content = readFileSync(filePath, 'utf-8').trim();\n        if (content) {\n          sources.push({ path: filePath, content, scope: 'global' });\n          break; // Only use first found global instruction file\n        }\n      } catch {\n        // Skip unreadable files\n      }\n    }\n  }\n\n  // Load project instructions\n  for (const location of projectLocations) {\n    const basePath = location ? join(projectPath, location) : projectPath;\n    const filePath = findInstructionFile(basePath, projectReader);\n    if (filePath) {\n      try {\n        const content = projectReader.read(filePath).trim();\n        if (content) {\n          sources.push({\n            path: filePath,\n            content,\n            scope: 'project',\n            ...(projectReader.ref ? { ref: projectReader.ref } : {}),\n          });\n          break; // Only use first found project instruction file\n        }\n      } catch {\n        // Skip unreadable files\n      }\n    }\n  }\n\n  return sources;\n}\n\nexport function getStaticallyLoadedInstructionPaths(\n  projectPath: string,\n  configDirName = DEFAULT_CONFIG_DIR,\n  projectReader?: InstructionFileReader,\n): string[] {\n  return loadAgentInstructions(projectPath, configDirName, projectReader).map(source => normalize(source.path));\n}\n\n/**\n * Format loaded instructions into a string for the system prompt.\n */\nexport function formatAgentInstructions(sources: InstructionSource[]): string {\n  if (sources.length === 0) return '';\n\n  const sections = sources.map(source => {\n    const label = source.scope === 'global' ? 'Global' : 'Project';\n    const origin = source.ref ? `${source.path} (at ref ${source.ref})` : source.path;\n    return `<!-- ${label} instructions from ${origin} -->\\n${source.content}`;\n  });\n\n  return `\\n# Agent Instructions\\n\\n${sections.join('\\n\\n')}\\n`;\n}\n"],"mappings":";;;;;;;;;;AAYA,MAAM,oBAAoB,CAAC,aAAa,WAAW;AAGnD,MAAM,oBAAoB;CACxB;CACA;CACA;AACF;AAEA,MAAM,mBAAmB;CAAC;CAAW;CAAe;CAAkB;AAAoB;AAuB1F,MAAM,sBAA6C;CACjD,SAAQ,SAAQ,WAAW,IAAI;CAC/B,OAAM,SAAQ,aAAa,MAAM,OAAO;AAC1C;;;;;;;;;AAUA,SAAgB,8BAA8B,aAAqB,KAAoC;CACrG,MAAM,cAAc,SAAgC;EAClD,MAAM,MAAM,SAAS,aAAa,IAAI;EACtC,IAAI,CAAC,OAAO,IAAI,WAAW,IAAI,KAAK,WAAW,GAAG,GAAG,OAAO;EAC5D,OAAO,IAAI,MAAM,GAAG,CAAC,CAAC,KAAK,GAAG;CAChC;CACA,MAAM,QAAQ,SAAgC;EAC5C,MAAM,MAAM,WAAW,IAAI;EAC3B,IAAI,QAAQ,MAAM,OAAO;EACzB,KAAK,MAAM,aAAa,CAAC,UAAU,OAAO,GAAG,GAC3C,IAAI;GACF,OAAO,aAAa,OAAO;IAAC;IAAM;IAAa;IAAQ,GAAG,UAAU,GAAG;GAAK,GAAG;IAC7E,UAAU;IACV,OAAO;KAAC;KAAU;KAAQ;IAAQ;IAClC,WAAW,OAAO;GACpB,CAAC;EACH,QAAQ,CAER;EAEF,OAAO;CACT;CACA,OAAO;EACL;EACA,SAAQ,SAAQ,KAAK,IAAI,MAAM;EAC/B,OAAM,SAAQ;GACZ,MAAM,UAAU,KAAK,IAAI;GACzB,IAAI,YAAY,MAAM,MAAM,IAAI,MAAM,oBAAoB,IAAI,IAAI,MAAM;GACxE,OAAO;EACT;CACF;AACF;;;;;;;;AASA,SAAgB,2BACd,aACA,KAKA;CACA,MAAM,YAAY,8BAA8B,aAAa,GAAG;CAChE,MAAM,cAAc,SAAgC;EAClD,MAAM,MAAM,SAAS,aAAa,UAAU,IAAI,CAAC;EACjD,IAAI,IAAI,WAAW,IAAI,KAAK,WAAW,GAAG,GAAG,OAAO;EACpD,OAAO,IAAI,MAAM,GAAG,CAAC,CAAC,KAAK,GAAG;CAChC;CACA,MAAM,cAAc,QAA+B;EACjD,IAAI,QAAQ,IAAI,OAAO;EACvB,KAAK,MAAM,aAAa,CAAC,UAAU,OAAO,GAAG,GAC3C,IAAI;GACF,OAAO,aAAa,OAAO;IAAC;IAAM;IAAa;IAAY;IAAM,GAAG,UAAU,GAAG;GAAK,GAAG;IACvF,UAAU;IACV,OAAO;KAAC;KAAU;KAAQ;IAAQ;GACpC,CAAC,CAAC,CAAC,KAAK;EACV,QAAQ,CAER;EAEF,OAAO;CACT;CACA,OAAO;EACL,aAAY,SAAQ;GAClB,MAAM,MAAM,WAAW,IAAI;GAC3B,IAAI,QAAQ,MAAM,OAAO,WAAW,IAAI;GACxC,OAAO,WAAW,GAAG,MAAM;EAC7B;EACA,cAAa,SAAQ;GACnB,MAAM,MAAM,WAAW,IAAI;GAC3B,IAAI,QAAQ,MACV,IAAI;IACF,OAAO,SAAS,IAAI,CAAC,CAAC,YAAY;GACpC,QAAQ;IACN,OAAO;GACT;GAEF,OAAO,WAAW,GAAG,MAAM;EAC7B;EACA,WAAU,SAAQ;GAEhB,IADY,WAAW,IACjB,MAAM,MAAM,OAAO,aAAa,MAAM,OAAO;GACnD,OAAO,UAAU,KAAK,IAAI;EAC5B;CACF;AACF;;;;;AAMA,SAAS,oBAAoB,UAAkB,SAAgC,qBAAoC;CACjH,KAAK,MAAM,YAAY,mBAAmB;EACxC,MAAM,WAAW,KAAK,UAAU,QAAQ;EACxC,IAAI,OAAO,OAAO,QAAQ,GACxB,OAAO;CAEX;CACA,OAAO;AACT;;;;;;;;;AAUA,SAAgB,sBACd,aACA,gBAAgB,oBAChB,gBAAuC,qBAClB;CACrB,MAAM,UAA+B,CAAC;CACtC,MAAM,OAAO,QAAQ;CAGrB,MAAM,mBAAmB,kBAAkB,KAAI,QAAQ,QAAQ,gBAAgB,gBAAgB,GAAI;CACnG,MAAM,kBAAkB,iBAAiB,KAAI,QAAO;EAClD,IAAI,QAAQ,eAAe,OAAO;EAGlC,IAAI,QAAQ,sBAAsB,OAAO,aAAa,cAAc,QAAQ,OAAO,EAAE;EACrF,OAAO;CACT,CAAC;CAGD,KAAK,MAAM,YAAY,iBAAiB;EAEtC,MAAM,WAAW,oBADA,KAAK,MAAM,QACgB,CAAC;EAC7C,IAAI,UACF,IAAI;GACF,MAAM,UAAU,aAAa,UAAU,OAAO,CAAC,CAAC,KAAK;GACrD,IAAI,SAAS;IACX,QAAQ,KAAK;KAAE,MAAM;KAAU;KAAS,OAAO;IAAS,CAAC;IACzD;GACF;EACF,QAAQ,CAER;CAEJ;CAGA,KAAK,MAAM,YAAY,kBAAkB;EAEvC,MAAM,WAAW,oBADA,WAAW,KAAK,aAAa,QAAQ,IAAI,aACX,aAAa;EAC5D,IAAI,UACF,IAAI;GACF,MAAM,UAAU,cAAc,KAAK,QAAQ,CAAC,CAAC,KAAK;GAClD,IAAI,SAAS;IACX,QAAQ,KAAK;KACX,MAAM;KACN;KACA,OAAO;KACP,GAAI,cAAc,MAAM,EAAE,KAAK,cAAc,IAAI,IAAI,CAAC;IACxD,CAAC;IACD;GACF;EACF,QAAQ,CAER;CAEJ;CAEA,OAAO;AACT;AAEA,SAAgB,oCACd,aACA,gBAAgB,oBAChB,eACU;CACV,OAAO,sBAAsB,aAAa,eAAe,aAAa,CAAC,CAAC,KAAI,WAAU,UAAU,OAAO,IAAI,CAAC;AAC9G;;;;AAKA,SAAgB,wBAAwB,SAAsC;CAC5E,IAAI,QAAQ,WAAW,GAAG,OAAO;CAQjC,OAAO,6BANU,QAAQ,KAAI,WAAU;EAGrC,OAAO,QAFO,OAAO,UAAU,WAAW,WAAW,UAEhC,qBADN,OAAO,MAAM,GAAG,OAAO,KAAK,WAAW,OAAO,IAAI,KAAK,OAAO,KAC5B,QAAQ,OAAO;CAClE,CAE2C,CAAC,CAAC,KAAK,MAAM,EAAE;AAC5D"}

package/dist/agents/prompts/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/agents/prompts/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAE,eAAe,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAChE,OAAO,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AAC3C,OAAO,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AAG3C,OAAO,KAAK,EAAE,aAAa,IAAI,iBAAiB,EAAE,MAAM,2BAA2B,CAAC;AAUpF,MAAM,WAAW,aAAc,SAAQ,IAAI,CAAC,iBAAiB,EAAE,cAAc,CAAC;IAC5E,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,CAAC,EAAE,GAAG,CAAC;IACZ,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,MAAM,CAAC;CACpB;AAQD;;;GAGG;AACH,wBAAgB,eAAe,CAAC,GAAG,EAAE,aAAa,GAAG,MAAM,CAmD1D"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/agents/prompts/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAE,eAAe,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAChE,OAAO,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AAC3C,OAAO,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AAG3C,OAAO,KAAK,EAAE,aAAa,IAAI,iBAAiB,EAAE,MAAM,2BAA2B,CAAC;AAUpF,MAAM,WAAW,aAAc,SAAQ,IAAI,CAAC,iBAAiB,EAAE,cAAc,CAAC;IAC5E,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,CAAC,EAAE,GAAG,CAAC;IACZ,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,MAAM,CAAC;CACpB;AAQD;;;GAGG;AACH,wBAAgB,eAAe,CAAC,GAAG,EAAE,aAAa,GAAG,MAAM,CAiE1D"}

package/dist/agents/prompts/index.js

@@ -3,7 +3,7 @@ import { planModePrompt } from "./plan.js";
 import { fastModePrompt } from "./fast.js";
 import { hasTavilyKey } from "../../tools/web-search.js";
 import "../../tools/index.js";
-import { formatAgentInstructions, loadAgentInstructions } from "./agent-instructions.js";
+import { createGitRefInstructionReader, formatAgentInstructions, loadAgentInstructions } from "./agent-instructions.js";
 import { modelSpecificPrompts } from "./model.js";
 import { buildToolGuidance } from "./tool-guidance.js";
 import { buildBasePrompt } from "@mastra/core/coding-agent";
@@ -45,9 +45,15 @@ function buildFullPrompt(ctx) {
 	const modeSpecific = (typeof entry === "function" ? entry(ctx) : entry) ?? "";
 	const modelSpecific = ctx.modelId ? modelSpecificPrompts[ctx.modelId] ?? "" : "";
 	const configDir = ctx.state?.configDir;
+	const untrustedCheckout = ctx.state?.untrustedCheckout === true;
+	const baseRef = typeof ctx.state?.baseRef === "string" ? ctx.state.baseRef : void 0;
+	const projectReader = untrustedCheckout ? baseRef ? createGitRefInstructionReader(ctx.workingDir, baseRef) : {
+		exists: () => false,
+		read: () => ""
+	} : void 0;
 	return [
 		base,
-		formatAgentInstructions(loadAgentInstructions(ctx.workingDir, configDir)).trim(),
+		formatAgentInstructions(loadAgentInstructions(ctx.workingDir, configDir, projectReader)).trim(),
 		modelSpecific.trim(),
 		modeSpecific.trim()
 	].filter(Boolean).join("\n\n");

package/dist/agents/prompts/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","names":[],"sources":["../../../src/agents/prompts/index.ts"],"sourcesContent":["/**\n * Prompt system — exports the prompt builder and mode-specific prompts.\n */\n\nexport { buildModePrompt, buildModePromptFn } from './build.js';\nexport { planModePrompt } from './plan.js';\nexport { fastModePrompt } from './fast.js';\n\nimport { buildBasePrompt } from '@mastra/core/coding-agent';\nimport type { PromptContext as BasePromptContext } from '@mastra/core/coding-agent';\nimport { hasTavilyKey } from '../../tools/index.js';\nimport { loadAgentInstructions, formatAgentInstructions } from './agent-instructions.js';\nimport { buildModePromptFn } from './build.js';\nimport { fastModePrompt } from './fast.js';\nimport { modelSpecificPrompts } from './model.js';\nimport { planModePrompt } from './plan.js';\nimport { buildToolGuidance } from './tool-guidance.js';\n\n// Extended prompt context that includes runtime information\nexport interface PromptContext extends Omit<BasePromptContext, 'toolGuidance'> {\n  modeId: string;\n  state?: any;\n  currentDate: string;\n  workingDir: string;\n}\n\nconst modePrompts: Record<string, string | ((ctx: PromptContext) => string)> = {\n  build: buildModePromptFn,\n  plan: planModePrompt,\n  fast: fastModePrompt,\n};\n\n/**\n * Build the full system prompt for a given mode and context.\n * Combines the base prompt with mode-specific instructions.\n */\nexport function buildFullPrompt(ctx: PromptContext): string {\n  // Determine whether web search tools are available\n  const modelId = ctx.modelId;\n  const hasWebSearch = hasTavilyKey() || (!!modelId && modelId.startsWith('anthropic/'));\n\n  // Collect per-tool deny rules so guidance omits denied tools\n  const deniedTools = new Set<string>();\n  const permRules = ctx.state?.permissionRules as { tools?: Record<string, string> } | undefined;\n  if (permRules?.tools) {\n    for (const [name, policy] of Object.entries(permRules.tools)) {\n      if (policy === 'deny') deniedTools.add(name);\n    }\n  }\n\n  // Build mode-aware tool guidance\n  const toolGuidance = buildToolGuidance(ctx.modeId, { hasWebSearch, deniedTools });\n\n  // Map new context to base context\n  const baseCtx: BasePromptContext = {\n    projectPath: ctx.workingDir,\n    projectName: ctx.projectName || 'unknown',\n    gitBranch: ctx.gitBranch,\n    platform: process.platform,\n    commonBinaries: ctx.commonBinaries,\n    date: ctx.currentDate,\n    mode: ctx.modeId,\n    modelId: ctx.modelId,\n    activePlan: ctx.state?.activePlan,\n    toolGuidance,\n  };\n\n  const base = buildBasePrompt(baseCtx);\n  const entry = modePrompts[ctx.modeId] || modePrompts.build;\n  const modeSpecific = (typeof entry === 'function' ? entry(ctx) : entry) ?? '';\n  const modelSpecific = ctx.modelId\n    ? (modelSpecificPrompts[ctx.modelId as keyof typeof modelSpecificPrompts] ?? '')\n    : '';\n\n  // The current task list is carried on the agent state-signal lane (see\n  // TaskStateProcessor) rather than injected into the cached system prompt. This\n  // keeps the prompt prefix stable across task updates (preserving prompt cache)\n  // while still surviving observational-memory truncation.\n\n  // Load and inject agent instructions from AGENTS.md/CLAUDE.md files\n  const configDir = ctx.state?.configDir as string | undefined;\n  const instructionSources = loadAgentInstructions(ctx.workingDir, configDir);\n  const instructionsSection = formatAgentInstructions(instructionSources);\n\n  const sections = [base, instructionsSection.trim(), modelSpecific.trim(), modeSpecific.trim()].filter(Boolean);\n\n  return sections.join('\\n\\n');\n}\n"],"mappings":";;;;;;;;;;AA0BA,MAAM,cAAyE;CAC7E,OAAO;CACP,MAAM;CACN,MAAM;AACR;;;;;AAMA,SAAgB,gBAAgB,KAA4B;CAE1D,MAAM,UAAU,IAAI;CACpB,MAAM,eAAe,aAAa,KAAM,CAAC,CAAC,WAAW,QAAQ,WAAW,YAAY;CAGpF,MAAM,8BAAc,IAAI,IAAY;CACpC,MAAM,YAAY,IAAI,OAAO;CAC7B,IAAI,WAAW,OACR;OAAA,MAAM,CAAC,MAAM,WAAW,OAAO,QAAQ,UAAU,KAAK,GACzD,IAAI,WAAW,QAAQ,YAAY,IAAI,IAAI;CAAA;CAK/C,MAAM,eAAe,kBAAkB,IAAI,QAAQ;EAAE;EAAc;CAAY,CAAC;CAgBhF,MAAM,OAAO,gBAAgB;EAZ3B,aAAa,IAAI;EACjB,aAAa,IAAI,eAAe;EAChC,WAAW,IAAI;EACf,UAAU,QAAQ;EAClB,gBAAgB,IAAI;EACpB,MAAM,IAAI;EACV,MAAM,IAAI;EACV,SAAS,IAAI;EACb,YAAY,IAAI,OAAO;EACvB;CAGiC,CAAC;CACpC,MAAM,QAAQ,YAAY,IAAI,WAAW,YAAY;CACrD,MAAM,gBAAgB,OAAO,UAAU,aAAa,MAAM,GAAG,IAAI,UAAU;CAC3E,MAAM,gBAAgB,IAAI,UACrB,qBAAqB,IAAI,YAAiD,KAC3E;CAQJ,MAAM,YAAY,IAAI,OAAO;CAM7B,OAFiB;EAAC;EAFU,wBADD,sBAAsB,IAAI,YAAY,SACI,CAE3B,CAAC,CAAC,KAAK;EAAG,cAAc,KAAK;EAAG,aAAa,KAAK;CAAC,CAAC,CAAC,OAAO,OAExF,CAAC,CAAC,KAAK,MAAM;AAC7B"}
+{"version":3,"file":"index.js","names":[],"sources":["../../../src/agents/prompts/index.ts"],"sourcesContent":["/**\n * Prompt system — exports the prompt builder and mode-specific prompts.\n */\n\nexport { buildModePrompt, buildModePromptFn } from './build.js';\nexport { planModePrompt } from './plan.js';\nexport { fastModePrompt } from './fast.js';\n\nimport { buildBasePrompt } from '@mastra/core/coding-agent';\nimport type { PromptContext as BasePromptContext } from '@mastra/core/coding-agent';\nimport { hasTavilyKey } from '../../tools/index.js';\nimport { loadAgentInstructions, formatAgentInstructions, createGitRefInstructionReader } from './agent-instructions.js';\nimport { buildModePromptFn } from './build.js';\nimport { fastModePrompt } from './fast.js';\nimport { modelSpecificPrompts } from './model.js';\nimport { planModePrompt } from './plan.js';\nimport { buildToolGuidance } from './tool-guidance.js';\n\n// Extended prompt context that includes runtime information\nexport interface PromptContext extends Omit<BasePromptContext, 'toolGuidance'> {\n  modeId: string;\n  state?: any;\n  currentDate: string;\n  workingDir: string;\n}\n\nconst modePrompts: Record<string, string | ((ctx: PromptContext) => string)> = {\n  build: buildModePromptFn,\n  plan: planModePrompt,\n  fast: fastModePrompt,\n};\n\n/**\n * Build the full system prompt for a given mode and context.\n * Combines the base prompt with mode-specific instructions.\n */\nexport function buildFullPrompt(ctx: PromptContext): string {\n  // Determine whether web search tools are available\n  const modelId = ctx.modelId;\n  const hasWebSearch = hasTavilyKey() || (!!modelId && modelId.startsWith('anthropic/'));\n\n  // Collect per-tool deny rules so guidance omits denied tools\n  const deniedTools = new Set<string>();\n  const permRules = ctx.state?.permissionRules as { tools?: Record<string, string> } | undefined;\n  if (permRules?.tools) {\n    for (const [name, policy] of Object.entries(permRules.tools)) {\n      if (policy === 'deny') deniedTools.add(name);\n    }\n  }\n\n  // Build mode-aware tool guidance\n  const toolGuidance = buildToolGuidance(ctx.modeId, { hasWebSearch, deniedTools });\n\n  // Map new context to base context\n  const baseCtx: BasePromptContext = {\n    projectPath: ctx.workingDir,\n    projectName: ctx.projectName || 'unknown',\n    gitBranch: ctx.gitBranch,\n    platform: process.platform,\n    commonBinaries: ctx.commonBinaries,\n    date: ctx.currentDate,\n    mode: ctx.modeId,\n    modelId: ctx.modelId,\n    activePlan: ctx.state?.activePlan,\n    toolGuidance,\n  };\n\n  const base = buildBasePrompt(baseCtx);\n  const entry = modePrompts[ctx.modeId] || modePrompts.build;\n  const modeSpecific = (typeof entry === 'function' ? entry(ctx) : entry) ?? '';\n  const modelSpecific = ctx.modelId\n    ? (modelSpecificPrompts[ctx.modelId as keyof typeof modelSpecificPrompts] ?? '')\n    : '';\n\n  // The current task list is carried on the agent state-signal lane (see\n  // TaskStateProcessor) rather than injected into the cached system prompt. This\n  // keeps the prompt prefix stable across task updates (preserving prompt cache)\n  // while still surviving observational-memory truncation.\n\n  // Load and inject agent instructions from AGENTS.md/CLAUDE.md files.\n  // Untrusted checkouts (e.g. a PR branch under review) never read\n  // project-scope files off the working tree: their AGENTS.md is\n  // attacker-writable and would otherwise land in the system prompt as\n  // trusted configuration. When the session carries a trusted base ref, the\n  // project instructions are served from that ref instead (`git show`);\n  // without one, project-scope files are skipped entirely. Global (operator\n  // machine) instructions always load.\n  const configDir = ctx.state?.configDir as string | undefined;\n  const untrustedCheckout = ctx.state?.untrustedCheckout === true;\n  const baseRef = typeof ctx.state?.baseRef === 'string' ? ctx.state.baseRef : undefined;\n  const projectReader = untrustedCheckout\n    ? baseRef\n      ? createGitRefInstructionReader(ctx.workingDir, baseRef)\n      : { exists: () => false, read: () => '' }\n    : undefined;\n  const instructionSources = loadAgentInstructions(ctx.workingDir, configDir, projectReader);\n  const instructionsSection = formatAgentInstructions(instructionSources);\n\n  const sections = [base, instructionsSection.trim(), modelSpecific.trim(), modeSpecific.trim()].filter(Boolean);\n\n  return sections.join('\\n\\n');\n}\n"],"mappings":";;;;;;;;;;AA0BA,MAAM,cAAyE;CAC7E,OAAO;CACP,MAAM;CACN,MAAM;AACR;;;;;AAMA,SAAgB,gBAAgB,KAA4B;CAE1D,MAAM,UAAU,IAAI;CACpB,MAAM,eAAe,aAAa,KAAM,CAAC,CAAC,WAAW,QAAQ,WAAW,YAAY;CAGpF,MAAM,8BAAc,IAAI,IAAY;CACpC,MAAM,YAAY,IAAI,OAAO;CAC7B,IAAI,WAAW,OACR;OAAA,MAAM,CAAC,MAAM,WAAW,OAAO,QAAQ,UAAU,KAAK,GACzD,IAAI,WAAW,QAAQ,YAAY,IAAI,IAAI;CAAA;CAK/C,MAAM,eAAe,kBAAkB,IAAI,QAAQ;EAAE;EAAc;CAAY,CAAC;CAgBhF,MAAM,OAAO,gBAAgB;EAZ3B,aAAa,IAAI;EACjB,aAAa,IAAI,eAAe;EAChC,WAAW,IAAI;EACf,UAAU,QAAQ;EAClB,gBAAgB,IAAI;EACpB,MAAM,IAAI;EACV,MAAM,IAAI;EACV,SAAS,IAAI;EACb,YAAY,IAAI,OAAO;EACvB;CAGiC,CAAC;CACpC,MAAM,QAAQ,YAAY,IAAI,WAAW,YAAY;CACrD,MAAM,gBAAgB,OAAO,UAAU,aAAa,MAAM,GAAG,IAAI,UAAU;CAC3E,MAAM,gBAAgB,IAAI,UACrB,qBAAqB,IAAI,YAAiD,KAC3E;CAeJ,MAAM,YAAY,IAAI,OAAO;CAC7B,MAAM,oBAAoB,IAAI,OAAO,sBAAsB;CAC3D,MAAM,UAAU,OAAO,IAAI,OAAO,YAAY,WAAW,IAAI,MAAM,UAAU,KAAA;CAC7E,MAAM,gBAAgB,oBAClB,UACE,8BAA8B,IAAI,YAAY,OAAO,IACrD;EAAE,cAAc;EAAO,YAAY;CAAG,IACxC,KAAA;CAMJ,OAFiB;EAAC;EAFU,wBADD,sBAAsB,IAAI,YAAY,WAAW,aACP,CAE3B,CAAC,CAAC,KAAK;EAAG,cAAc,KAAK;EAAG,aAAa,KAAK;CAAC,CAAC,CAAC,OAAO,OAExF,CAAC,CAAC,KAAK,MAAM;AAC7B"}

package/dist/agents/sandbox-filesystem.d.ts

@@ -45,6 +45,11 @@ export declare class SandboxFilesystem implements WorkspaceFilesystem {
     /**
      * Resolve a workspace path to an absolute path inside the sandbox, enforcing
      * that it stays within the workdir.
+     *
+     * Accepts both workspace-relative paths (`src/foo.ts`, `/src/foo.ts`) and
+     * absolute sandbox paths that already live under the workdir — the agent's
+     * prompt advertises the workdir as its working directory, so tools are
+     * routinely called with fully-qualified paths like `<workdir>/src/foo.ts`.
      */
     private resolve;
     resolveAbsolutePath(inputPath: string): string | undefined;
@@ -53,6 +58,11 @@ export declare class SandboxFilesystem implements WorkspaceFilesystem {
      * Lexical guard catches `..` traversal, but a symlink inside the workdir can
      * still point outside it. After resolving a path that refers to an existing
      * entry, verify its realpath is still contained in the workdir.
+     *
+     * Canonicalization tries `realpath`, then `readlink -f` (GNU/busybox), then
+     * `cd && pwd -P` for directories — covering GNU hosts, macOS/BSD, and
+     * busybox. If the path exists but cannot be canonicalized we fail CLOSED:
+     * returning without a check would let a symlink bypass containment.
      */
     private assertContainedRealpath;
     /**

package/dist/agents/sandbox-filesystem.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sandbox-filesystem.d.ts","sourceRoot":"","sources":["../../src/agents/sandbox-filesystem.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAGH,OAAO,KAAK,EACV,WAAW,EACX,WAAW,EACX,SAAS,EACT,QAAQ,EACR,cAAc,EACd,WAAW,EACX,cAAc,EACd,WAAW,EACX,aAAa,EACb,mBAAmB,EACnB,YAAY,EACb,MAAM,wBAAwB,CAAC;AAEhC,iDAAiD;AACjD,MAAM,WAAW,oBAAoB;IACnC,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,oDAAoD;AACpD,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,cAAc,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,MAAM,EAAE,EAAE,OAAO,CAAC,EAAE;QAAE,OAAO,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAAC;CACjH;AAED,MAAM,WAAW,wBAAwB;IACvC,uCAAuC;IACvC,OAAO,EAAE,WAAW,CAAC;IACrB,mEAAmE;IACnE,OAAO,EAAE,MAAM,CAAC;IAChB,4DAA4D;IAC5D,EAAE,CAAC,EAAE,MAAM,CAAC;CACb;AAmBD,qBAAa,iBAAkB,YAAW,mBAAmB;IAC3D,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,IAAI,uBAAuB;IACpC,QAAQ,CAAC,QAAQ,aAAa;IAC9B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,MAAM,EAAE,cAAc,CAAW;IAEjC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAc;gBAE1B,OAAO,EAAE,wBAAwB;IAQ7C;;;OAGG;IACH,OAAO,CAAC,OAAO;IAUf,mBAAmB,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS;YAM5C,IAAI;IAIlB;;;;OAIG;YACW,uBAAuB;IAWrC;;;;;;OAMG;YACW,mBAAmB;YAWnB,MAAM;IAUd,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,MAAM,GAAG,MAAM,CAAC;IAcvE,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,WAAW,EAAE,OAAO,CAAC,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC;IAapF,UAAU,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC;IAU7D,UAAU,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC;IAShE,QAAQ,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC;IAazE,QAAQ,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC;IAczE,KAAK,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE;QAAE,SAAS,CAAC,EAAE,OAAO,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC;IAOrE,KAAK,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC;IAa3D,OAAO,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,SAAS,EAAE,CAAC;IAmBxE,OAAO,CAAC,eAAe;IAevB,OAAO,CAAC,eAAe;IAgBvB,OAAO,CAAC,gBAAgB;IAQlB,MAAM,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAMtC,IAAI,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,CAAC;IAyBrC,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;IAIrB,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC;IAIxB,OAAO,IAAI,OAAO,CAAC,OAAO,CAAC;IAKjC,OAAO,IAAI,cAAc;IASzB,eAAe,IAAI,MAAM;CAG1B"}
+{"version":3,"file":"sandbox-filesystem.d.ts","sourceRoot":"","sources":["../../src/agents/sandbox-filesystem.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAGH,OAAO,KAAK,EACV,WAAW,EACX,WAAW,EACX,SAAS,EACT,QAAQ,EACR,cAAc,EACd,WAAW,EACX,cAAc,EACd,WAAW,EACX,aAAa,EACb,mBAAmB,EACnB,YAAY,EACb,MAAM,wBAAwB,CAAC;AAWhC,iDAAiD;AACjD,MAAM,WAAW,oBAAoB;IACnC,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,oDAAoD;AACpD,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,cAAc,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,MAAM,EAAE,EAAE,OAAO,CAAC,EAAE;QAAE,OAAO,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAAC;CACjH;AAED,MAAM,WAAW,wBAAwB;IACvC,uCAAuC;IACvC,OAAO,EAAE,WAAW,CAAC;IACrB,mEAAmE;IACnE,OAAO,EAAE,MAAM,CAAC;IAChB,4DAA4D;IAC5D,EAAE,CAAC,EAAE,MAAM,CAAC;CACb;AAmBD,qBAAa,iBAAkB,YAAW,mBAAmB;IAC3D,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,IAAI,uBAAuB;IACpC,QAAQ,CAAC,QAAQ,aAAa;IAC9B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,MAAM,EAAE,cAAc,CAAW;IAEjC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAc;gBAE1B,OAAO,EAAE,wBAAwB;IAU7C;;;;;;;;OAQG;IACH,OAAO,CAAC,OAAO;IAmBf,mBAAmB,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS;YAM5C,IAAI;IAIlB;;;;;;;;;OASG;YACW,uBAAuB;IA0BrC;;;;;;OAMG;YACW,mBAAmB;YAWnB,MAAM;IAUd,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,MAAM,GAAG,MAAM,CAAC;IAoBvE,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,WAAW,EAAE,OAAO,CAAC,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC;IAqBpF,UAAU,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC;IAU7D,UAAU,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC;IAqBhE,QAAQ,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC;IA2CzE,QAAQ,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC;IAqCzE,KAAK,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE;QAAE,SAAS,CAAC,EAAE,OAAO,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC;IAOrE,KAAK,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC;IAgB3D,OAAO,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,SAAS,EAAE,CAAC;IAuBxE,OAAO,CAAC,eAAe;IAevB,OAAO,CAAC,eAAe;IAgBvB,OAAO,CAAC,gBAAgB;IAQlB,MAAM,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAMtC,IAAI,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,CAAC;IA+BrC,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;IAIrB,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC;IAIxB,OAAO,IAAI,OAAO,CAAC,OAAO,CAAC;IAKjC,OAAO,IAAI,cAAc;IAUzB,eAAe,IAAI,MAAM;CAG1B"}