@miphamai/cli 0.24.16 → 0.25.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@miphamai/cli",
-  "version": "0.24.16",
+  "version": "0.25.0",
   "description": "Mipham Code — Multi-model open-core intelligent coding terminal by MiphamAI",
   "keywords": [
     "ai",

package/src/agent/message-bus.ts

@@ -56,15 +56,20 @@ export class AgentMessageBus {
   /**
    * Get all unread messages addressed to the given agent.
    * Does NOT mark them as read — use markRead() for that.
+   * P2-3: Auto-prunes messages older than 1 hour before polling.
    */
   poll(agentId: string): AgentMessage[] {
+    // Auto-prune stale messages to prevent accumulation and stuck states
+    this.prune(60 * 60 * 1000) // 1 hour TTL
     return this.messages.filter((m) => m.to === agentId && !m.read)
   }
 
   /**
    * Get all messages addressed to the given agent (read + unread).
+   * P2-3: Auto-prunes stale messages before listing.
    */
   list(agentId: string): AgentMessage[] {
+    this.prune(60 * 60 * 1000) // 1 hour TTL
     return this.messages.filter((m) => m.to === agentId)
   }
 

package/src/agent/sub-agent.ts

@@ -198,6 +198,22 @@ export class SubAgent {
     const agentType = options.type || 'general'
     const agentDef = options.agentDef
 
+    // ── P0-3: Create isolated PermissionSystem for this sub-agent ──
+    // The agent definition's permissionMode is clamped against parent's org
+    // restrictions (maxAllowedMode, forbiddenModes). When permissionMode is
+    // 'inherit' or not set, the parent's mode is used but still clamped.
+    let subPermission = this.permission // default: use parent's
+    if (this.permission) {
+      const agentPermMode =
+        agentDef?.permissionMode && agentDef.permissionMode !== 'inherit'
+          ? agentDef.permissionMode
+          : 'inherit'
+      subPermission = this.permission.createSubAgentPermission(agentPermMode)
+      // P0-5: Enable sub-agent safety mode — auto mode returns 'ask' for
+      // Bash/Write/Edit so hooks remain the safety gate in background agents.
+      subPermission.setSubAgentMode(true)
+    }
+
     // Resolve execution directory: worktree isolation or process cwd
     const execCwd = options.worktreePath || process.cwd()
 
@@ -212,6 +228,25 @@ export class SubAgent {
         }
         // Otherwise, proceed with a warning — don't block agent execution
       }
+
+      // P0-4: Auto-disallow Git tool for worktree-isolated sub-agents
+      // to prevent destructive operations on the main checkout.
+      // Agent definitions can explicitly re-enable Git if needed.
+      if (!agentDef?.tools) {
+        // No explicit allowlist — add Git to disallowedTools
+        const existingDisallowed = agentDef?.disallowedTools
+          ? agentDef.disallowedTools
+              .split(',')
+              .map((s) => s.trim())
+              .filter(Boolean)
+          : []
+        if (!existingDisallowed.includes('Git')) {
+          existingDisallowed.push('Git')
+        }
+        if (agentDef) {
+          agentDef.disallowedTools = existingDisallowed.join(',')
+        }
+      }
     }
 
     // Resolve system prompt: agentDef > options.systemPrompt > builtin type
@@ -352,11 +387,36 @@ export class SubAgent {
             continue
           }
 
+          // ── P0-5: Run PreToolUse hooks (before permission check) ──
+          let effectiveInput = tu.input
+          if (this.hookEngine) {
+            const preResult = await this.hookEngine.executePreToolUse(
+              tu.name,
+              tu.input,
+              'sub-agent',
+            )
+            if (!preResult.allowed) {
+              const denialMsg = preResult.reason
+                ? `Tool "${tu.name}" blocked by PreToolUse hook: ${preResult.reason}`
+                : `Tool "${tu.name}" blocked by PreToolUse hook.`
+              currentMessages.push({
+                role: 'user' as const,
+                content: denialMsg,
+              })
+              continue
+            }
+            // Apply modified input from hooks
+            if (preResult.modifiedInput) {
+              effectiveInput = { ...tu.input, ...preResult.modifiedInput }
+            }
+          }
+
           // Security: check permission before executing.
           // Sub-agents run without user interaction — tools requiring approval are rejected.
           // When permission system is absent (undefined), allow all tools (backward compat
           // for tests and headless usage). When present, always enforce approval checks.
-          if (this.permission?.needsApproval(tool, tu.input)) {
+          // P0-3: Uses isolated subPermission (clamped by org restrictions) instead of parent's.
+          if (subPermission?.needsApproval(tool, effectiveInput)) {
             currentMessages.push({
               role: 'user' as const,
               content:
@@ -367,16 +427,40 @@ export class SubAgent {
           }
 
           try {
-            const result = await tool.execute(tu.input, {
+            const result = await tool.execute(effectiveInput, {
               cwd: execCwd,
               sessionId: 'sub-agent',
               provider: '',
               model: finalModel,
             })
 
+            // ── P0-5: Run PostToolUse hooks ──
+            let displayResult = result
+            if (this.hookEngine) {
+              const postResult = await this.hookEngine.executePostToolUse(
+                tu.name,
+                effectiveInput,
+                result,
+                'sub-agent',
+              )
+              if (postResult.updatedOutput) {
+                displayResult = { ...result, content: postResult.updatedOutput }
+              }
+              if (postResult.additionalContext) {
+                displayResult = {
+                  ...displayResult,
+                  content: displayResult.content
+                    ? displayResult.content + '\n' + postResult.additionalContext
+                    : postResult.additionalContext,
+                }
+              }
+            }
+
             currentMessages.push({
               role: 'assistant' as const,
-              content: [{ type: 'tool_use' as const, id: tu.id, name: tu.name, input: tu.input }],
+              content: [
+                { type: 'tool_use' as const, id: tu.id, name: tu.name, input: effectiveInput },
+              ],
             })
             currentMessages.push({
               role: 'user' as const,
@@ -384,11 +468,22 @@ export class SubAgent {
                 {
                   type: 'tool_result' as const,
                   tool_use_id: tu.id,
-                  content: result.success ? result.content : result.error || result.content,
+                  content: displayResult.success
+                    ? displayResult.content
+                    : displayResult.error || displayResult.content,
                 },
               ],
             })
           } catch (err) {
+            // ── P0-5: Run PostToolUseFailure hooks ──
+            if (this.hookEngine) {
+              this.hookEngine
+                .executePostToolUseFailure(tu.name, effectiveInput, String(err), 'sub-agent')
+                .catch(() => {
+                  // Hook failures never block execution
+                })
+            }
+
             currentMessages.push({
               role: 'user' as const,
               content: `Tool "${tu.name}" execution error: ${String(err)}`,

package/src/agent/types.ts

@@ -8,7 +8,8 @@ export interface AgentFrontmatter {
   tools?: string // comma-separated allowlist
   disallowedTools?: string
   model?: string // 'sonnet' | 'opus' | 'haiku' | 'inherit' | full model ID
-  permissionMode?: 'default' | 'acceptEdits' | 'auto' | 'bypass' | 'plan'
+  permissionMode?:
+    'default' | 'acceptEdits' | 'auto' | 'bypass' | 'plan' | 'bypassPermissions' | 'dontAsk'
   maxTurns?: number
   skills?: string
   background?: boolean

package/src/core/engine.ts

@@ -112,6 +112,16 @@ export class QueryEngine {
       if (messages.length > 0) {
         const bus = getMessageBus()
         for (const msg of messages) {
+          // P2-1: Trigger Notification hook for cross-session messages
+          if (this.hookEngine) {
+            this.hookEngine
+              .executeNotification(
+                `Cross-session message from ${msg.from}: ${msg.summary}`,
+                this.sessionId,
+              )
+              .catch(() => {})
+          }
+
           if (policy === 'ask') {
             // Mark as awaiting approval — the model should verify with the user before acting
             bus.post(
@@ -836,17 +846,31 @@ export class QueryEngine {
   private async executeTool(name: string, params: Record<string, unknown>): Promise<ToolResult> {
     const tool = this.tools.get(name)
     if (!tool) {
-      return { success: false, content: '', error: `Unknown tool: ${name}` }
+      // P2-4: Provide a more helpful error for unavailable tools
+      const isMcpTool = name.startsWith('mcp__')
+      const hint = isMcpTool
+        ? `\nMCP tool "${name}" is no longer available. The MCP server may have been removed or disconnected. Use tool-search to discover available tools.`
+        : `\nTool "${name}" is not registered. Available tools may have changed — check the tool list.`
+      return { success: false, content: '', error: `Unknown tool: ${name}${hint}` }
     }
 
     // Security: check permission before executing
     if (this.permission.needsApproval(tool, params)) {
+      // P1-4: Increment consecutive block counter; if limit exceeded,
+      // tell the model to move on instead of retrying.
+      const limitExceeded = this.permission.incrementBlockCounter()
+      const baseError = t('errors.tool_not_allowed', { name })
+      const moveOnHint = limitExceeded
+        ? '\n(Consecutive block limit reached. Please try a different approach or ask the user for guidance.)'
+        : ''
       return {
         success: false,
         content: '',
-        error: t('errors.tool_not_allowed', { name }),
+        error: baseError + moveOnHint,
       }
     }
+    // P1-4: Tool allowed — reset block counter
+    this.permission.resetBlockCounter()
 
     // Run PreToolUse hooks
     let effectiveParams = params
@@ -902,7 +926,21 @@ export class QueryEngine {
 
       // Run PostToolUse hooks
       if (this.hookEngine) {
-        await this.hookEngine.executePostToolUse(name, effectiveParams, result, this.sessionId)
+        const postResult = await this.hookEngine.executePostToolUse(
+          name,
+          effectiveParams,
+          result,
+          this.sessionId,
+        )
+        // P1-2: Consume hook result — apply updatedOutput and additionalContext
+        if (postResult.updatedOutput) {
+          result.content = postResult.updatedOutput
+        }
+        if (postResult.additionalContext) {
+          result.content = result.content
+            ? result.content + '\n' + postResult.additionalContext
+            : postResult.additionalContext
+        }
       }
 
       // CRSI: Track rule effectiveness after tool execution
@@ -920,6 +958,15 @@ export class QueryEngine {
 
       return result
     } catch (err) {
+      // P1-3: Trigger PostToolUseFailure hook on tool execution errors
+      if (this.hookEngine) {
+        this.hookEngine
+          .executePostToolUseFailure(name, effectiveParams, String(err), this.sessionId)
+          .catch(() => {
+            // Hook failures never block error handling
+          })
+      }
+
       // Sanitize error: strip stack traces and internal paths to prevent
       // information disclosure to the LLM conversation context.
       const message =

package/src/core/instructions.ts

@@ -47,7 +47,7 @@ export class InstructionsLoader {
     this.tryLoad(join(home, '.mipham', 'USER.md'), 'user')
   }
 
-  buildSystemPrompt(): string {
+  buildSystemPrompt(permissionMode?: string): string {
     const parts: string[] = []
 
     for (const inst of this.instructions) {
@@ -61,6 +61,11 @@ export class InstructionsLoader {
       parts.push(`<!-- ${levelLabel[inst.level] || inst.level} (${inst.path}) -->\n${inst.content}`)
     }
 
+    // P2-2: Inject current permission mode so the model knows its constraints
+    if (permissionMode) {
+      parts.push(this.buildPermissionContext(permissionMode))
+    }
+
     // Append skills reminder after all instructions
     if (this.skillsReminder) {
       parts.push(this.skillsReminder)
@@ -102,6 +107,30 @@ Script format: export const meta = { name, description, phases: [...] }
     this.skillsReminder = reminder
   }
 
+  /**
+   * P2-2: Build a permission-mode context block for the system prompt.
+   * Tells the model its current permission level and what to expect.
+   */
+  private buildPermissionContext(mode: string): string {
+    const modeDescriptions: Record<string, string> = {
+      default:
+        'You are in **default** mode. Tools marked as requiring approval will be blocked. Use Read/Grep/Glob for exploration.',
+      acceptEdits:
+        'You are in **acceptEdits** mode. File reads and edits are allowed; Bash requires approval.',
+      plan: 'You are in **plan** mode. Only Read/Grep/Glob are allowed — no file modifications or command execution.',
+      auto: 'You are in **auto** mode. Most tools run without approval. If a tool is blocked by security policy or hooks, try a different approach instead of retrying.',
+      dontAsk:
+        'You are in **dontAsk** mode. All tools blocked unless explicitly allowlisted. Check your allow rules before acting.',
+      bypassPermissions:
+        'You are in **bypassPermissions** mode. All tools are allowed. Use this power responsibly.',
+    }
+
+    const description = modeDescriptions[mode]
+    if (!description) return ''
+
+    return `## Permission Context\n\n${description}\n\nWhen a tool is denied, do NOT retry with the same tool and similar parameters. Move on to a different approach or ask the user for guidance.`
+  }
+
   list(): InstructionFile[] {
     return [...this.instructions]
   }

package/src/core/permission.ts

@@ -29,6 +29,13 @@ export class PermissionSystem {
   // ── Org-level restrictions (P0 security) ──
   private restrictions: PermissionRestrictions | undefined = undefined
 
+  // ── P0-5: Sub-agent mode (auto mode hardening for background tasks) ──
+  private isSubAgent = false
+
+  // ── P1-4: Consecutive block counter (prevents infinite retry loops) ──
+  private consecutiveBlockCount = 0
+  private static readonly MAX_CONSECUTIVE_BLOCKS = 3
+
   /** Invalidate the permission cache (called on any rule/mode change). */
   private invalidateCache(): void {
     this.checkCache.clear()
@@ -77,6 +84,85 @@ export class PermissionSystem {
     return this.restrictions
   }
 
+  /**
+   * P0-5 (v2.1.222 alignment): Enable sub-agent safety mode.
+   * When true, auto mode returns 'ask' for Bash/Write/Edit tools instead of
+   * 'bypass', ensuring PreToolUse hooks remain the safety gate in background agents.
+   */
+  setSubAgentMode(enabled: boolean): void {
+    this.isSubAgent = enabled
+    this.invalidateCache()
+  }
+
+  /**
+   * P1-4 (v2.1.225 alignment): Increment the consecutive block counter
+   * when a tool is denied. Safety-filter refusals should NOT count.
+   * Returns true if the consecutive block limit has been exceeded.
+   */
+  incrementBlockCounter(): boolean {
+    this.consecutiveBlockCount++
+    return this.consecutiveBlockCount >= PermissionSystem.MAX_CONSECUTIVE_BLOCKS
+  }
+
+  /** Reset the block counter when a tool is successfully executed. */
+  resetBlockCounter(): void {
+    this.consecutiveBlockCount = 0
+  }
+
+  /** Get the current consecutive block count. */
+  getBlockCount(): number {
+    return this.consecutiveBlockCount
+  }
+
+  /**
+   * P0-3 (v2.1.223 alignment): Create a permission context for a sub-agent.
+   *
+   * The sub-agent's requested permissionMode is clamped against the parent's
+   * org restrictions (maxAllowedMode, forbiddenModes). Deny rules from the
+   * parent are propagated so org safety policies always apply.
+   *
+   * Returns a new PermissionSystem instance — NOT shared with the parent.
+   */
+  createSubAgentPermission(agentPermissionMode: string): PermissionSystem {
+    const resolvedMode = this.resolveAgentMode(agentPermissionMode)
+    const subPerm = new PermissionSystem(resolvedMode)
+
+    // Propagate org restrictions to sub-agent
+    if (this.restrictions) {
+      subPerm.setRestrictions(this.restrictions)
+    }
+
+    // Propagate deny rules (org safety policies must always apply)
+    for (const denyEntry of this.denyRules) {
+      subPerm.deny(denyEntry.pattern)
+    }
+
+    return subPerm
+  }
+
+  /**
+   * Resolve an agent's permissionMode string to a clamped PermissionMode.
+   * 'inherit' means "use the parent's current mode".
+   * 'bypass' is treated as an alias for 'bypassPermissions'.
+   */
+  private resolveAgentMode(agentMode: string): PermissionMode {
+    // Normalize aliases
+    const normalized = agentMode === 'bypass' ? 'bypassPermissions' : agentMode
+
+    const modeMap: Record<string, PermissionMode> = {
+      bypassPermissions: 'bypassPermissions',
+      dontAsk: 'dontAsk',
+      auto: 'auto',
+      plan: 'plan',
+      acceptEdits: 'acceptEdits',
+      default: 'default',
+      inherit: this.mode,
+    }
+
+    const desired: PermissionMode = modeMap[normalized] || 'default'
+    return clampMode(desired, this.restrictions)
+  }
+
   // ── Rule management ──
 
   allow(rule: string): void {
@@ -267,6 +353,12 @@ export class PermissionSystem {
         if (tool.name === 'SendMessage') {
           return 'mode-baseline'
         }
+        // P0-5: In sub-agent context, enforce 'ask' for destructive tools
+        // so hooks remain the sole safety gate. Without hooks, these tools
+        // would otherwise run completely un-gated in auto mode.
+        if (this.isSubAgent && ['Bash', 'Write', 'Edit'].includes(tool.name)) {
+          return 'ask'
+        }
         return 'bypass'
 
       case 'dontAsk':

package/src/index.tsx

@@ -238,12 +238,12 @@ export async function runApp(options: RunOptions): Promise<void> {
       for (const msg of saved.messages) {
         context.addMessage(msg)
       }
-      context.setSystemPrompt(instructions.buildSystemPrompt())
+      context.setSystemPrompt(instructions.buildSystemPrompt(config.permission as string))
     }
   }
 
   if (context.getMessageCount() === 0) {
-    const basePrompt = instructions.buildSystemPrompt()
+    const basePrompt = instructions.buildSystemPrompt(config.permission as string)
     const memoryReminder = loadSessionMemories(basePrompt)
 
     // Inject previous session summary for AI continuity
@@ -430,12 +430,19 @@ export async function runApp(options: RunOptions): Promise<void> {
   const crossSessionConfig = loadCrossSessionConfig(process.cwd())
   engine.setCrossSessionConfig(crossSessionConfig)
 
+  // P2-1: Trigger SessionStart hooks after full initialization
+  hookEngine.executeSessionStart(sessionName).catch(() => {
+    // Hook failures never block session startup
+  })
+
   // Auto-save session on exit
   let saved = false
   const saveAndExit = () => {
     saved = true
     clearInterval(heartbeatInterval)
     unregisterSession(sessionName)
+    // P2-1: Trigger SessionEnd hooks before cleanup (best-effort)
+    hookEngine.executeSessionEnd(sessionName).catch(() => {})
     artifactServer.stop()
     if (context.getMessageCount() > 0) {
       SessionStore.save(sessionName, context.getMessages(), {

package/src/shared/sanitize.ts

@@ -4,6 +4,10 @@
  * from visual inspection or enable homoglyph attacks.
  *
  * Protects against hidden command text via tabs/invisible Unicode characters.
+ *
+ * P0-1 (v2.1.223 alignment): Extended to also strip tab, CR, VT, FF,
+ * other control characters, and normalize fullwidth/homoglyph characters
+ * to ASCII equivalents for permission checks.
  */
 
 const DANGEROUS_UNICODE = /[​‌‍‎‏‪‫‬‭‮⁠⁦⁧⁨⁩]/g
@@ -36,3 +40,181 @@ export function sanitizeParams(params: Record<string, unknown>): Record<string,
   }
   return result
 }
+
+// ── P0-1: Extended sanitization for permission checks ──
+
+// Fullwidth Latin letters (U+FF21-FF3A → A-Z, U+FF41-FF5A → a-z)
+const FULLWIDTH_UPPER_START = 0xff21 // Ａ
+const FULLWIDTH_LOWER_START = 0xff41 // ａ
+const ASCII_UPPER_START = 0x41 // A
+const ASCII_LOWER_START = 0x61 // a
+
+// Fullwidth digits (U+FF10-FF19 → 0-9)
+const FULLWIDTH_DIGIT_START = 0xff10 // ０
+const ASCII_DIGIT_START = 0x30 // 0
+
+/** Map of fullwidth/homoglyph punctuation to ASCII equivalents */
+const FULLWIDTH_PUNCTUATION: Record<number, number> = {
+  0xff0f: 0x2f, // ／ → /
+  0xff0d: 0x2d, // － → -
+  0xff04: 0x24, // ＄ → $
+  0xff08: 0x28, // （ → (
+  0xff09: 0x29, // ） → )
+  0xff01: 0x21, // ！ → !
+  0xff20: 0x40, // ＠ → @
+  0xff03: 0x23, // ＃ → #
+  0xff1a: 0x3a, // ： → :
+  0xff1b: 0x3b, // ； → ;
+  0xff1c: 0x3c, // ＜ → <
+  0xff1e: 0x3e, // ＞ → >
+  0xff3b: 0x5b, // ［ → [
+  0xff3d: 0x5d, // ］ → ]
+  0xff3e: 0x5e, // ＾ → ^
+  0xff40: 0x60, // ｀ → `
+  0xff5c: 0x7c, // ｜ → |
+  0xff5e: 0x7e, // ～ → ~
+  0xff07: 0x27, // ＇ → '
+  0xff02: 0x22, // ＂ → "
+  0xff06: 0x26, // ＆ → &
+  0xff0a: 0x2a, // ＊ → *
+  0xff0b: 0x2b, // ＋ → +
+  0xff0c: 0x2c, // ， → ,
+  0xff0e: 0x2e, // ． → .
+  0xff1d: 0x3d, // ＝ → =
+  0xff05: 0x25, // ％ → %
+  0xff3f: 0x5f, // ＿ → _
+  0xff5b: 0x7b, // ｛ → {
+  0xff5d: 0x7d, // ｝ → }
+  0xff3c: 0x5c, // ＼ → \
+}
+
+/** Common Unicode homoglyphs to ASCII (NOT fullwidth — separate Unicode blocks) */
+const HOMOGLYPH_MAP: Record<number, number> = {
+  // Common bypass homoglyphs
+  0x0430: 0x61, // Cyrillic а → Latin a
+  0x0435: 0x65, // Cyrillic е → Latin e
+  0x043e: 0x6f, // Cyrillic о → Latin o
+  0x0440: 0x70, // Cyrillic р → Latin p
+  0x0441: 0x63, // Cyrillic с → Latin c
+  0x0443: 0x79, // Cyrillic у → Latin y
+  0x0445: 0x78, // Cyrillic х → Latin x
+  0x0456: 0x69, // Cyrillic і → Latin i
+  0x03bf: 0x6f, // Greek ο → Latin o
+  0x03c1: 0x70, // Greek ρ → Latin p
+  0x03bd: 0x76, // Greek ν → Latin v (looks like v)
+}
+
+/**
+ * Normalize fullwidth Latin letters, digits, and punctuation to ASCII equivalents.
+ * Also handles common homoglyph substitutions used in bypass attacks.
+ *
+ * Only normalizes characters in Latin-script ranges — does NOT affect
+ * CJK ideographs, Arabic, Devanagari, or other scripts.
+ */
+export function normalizeFullwidthAndHomoglyphs(input: string): string {
+  if (!input) return input
+  let result = ''
+  for (let i = 0; i < input.length; i++) {
+    const cp = input.codePointAt(i)
+    if (cp === undefined) {
+      result += input[i]
+      continue
+    }
+
+    // Fullwidth upper: Ａ-Ｚ → A-Z
+    if (cp >= FULLWIDTH_UPPER_START && cp <= FULLWIDTH_UPPER_START + 25) {
+      result += String.fromCodePoint(ASCII_UPPER_START + (cp - FULLWIDTH_UPPER_START))
+    }
+    // Fullwidth lower: ａ-ｚ → a-z
+    else if (cp >= FULLWIDTH_LOWER_START && cp <= FULLWIDTH_LOWER_START + 25) {
+      result += String.fromCodePoint(ASCII_LOWER_START + (cp - FULLWIDTH_LOWER_START))
+    }
+    // Fullwidth digits: ０-９ → 0-9
+    else if (cp >= FULLWIDTH_DIGIT_START && cp <= FULLWIDTH_DIGIT_START + 9) {
+      result += String.fromCodePoint(ASCII_DIGIT_START + (cp - FULLWIDTH_DIGIT_START))
+    }
+    // Fullwidth punctuation
+    else if (FULLWIDTH_PUNCTUATION[cp] !== undefined) {
+      result += String.fromCodePoint(FULLWIDTH_PUNCTUATION[cp])
+    }
+    // Homoglyphs
+    else if (HOMOGLYPH_MAP[cp] !== undefined) {
+      result += String.fromCodePoint(HOMOGLYPH_MAP[cp])
+    }
+    // Surrogate pairs (code points > U+FFFF) — skip the low surrogate
+    else if (cp > 0xffff) {
+      result += input[i]
+      i++ // skip next char (low surrogate)
+    }
+    // Keep everything else as-is
+    else {
+      result += input[i]
+    }
+  }
+  return result
+}
+
+// Regex for control characters that should be stripped from permission-check input.
+// Strips: tab (\t), CR (\r), VT (\v), FF (\f), and other control chars
+// in ranges 0x01-0x08 and 0x0E-0x1F.
+// Preserves: newline (\n, 0x0A) — necessary for multi-line shell commands.
+const CONTROL_CHARS_FOR_PERMISSION_CHECK = /[\x00-\x09\x0b\x0c\x0d-\x1f]/g
+
+/**
+ * Strip control characters from a command string for permission checking.
+ * - Tab (\t) → single space (so words don't merge confusingly)
+ * - CR (\r), VT (\v), FF (\f) → removed
+ * - Other control chars (0x01-0x08, 0x0E-0x1F) → removed
+ * - Newline (\n) is PRESERVED for multi-line commands
+ */
+export function stripControlCharsForCheck(input: string): string {
+  if (!input) return input
+  // First, replace tabs with spaces
+  let result = input.replace(/\t/g, ' ')
+  // Then strip other control chars (but preserve \n)
+  result = result.replace(CONTROL_CHARS_FOR_PERMISSION_CHECK, '')
+  return result
+}
+
+/**
+ * Full command sanitization pipeline for permission checks.
+ * Applies in order:
+ * 1. Strip dangerous invisible Unicode (zero-width, bidi, BOM, etc.)
+ * 2. Strip control characters (tab→space, CR/VT/FF→removed)
+ * 3. Normalize fullwidth/homoglyph characters to ASCII
+ * 4. Collapse multiple spaces
+ * 5. Trim
+ *
+ * This is intended for pattern-matching input only — the original
+ * command string should still be used for actual execution.
+ */
+export function sanitizeCommand(input: string): string {
+  if (!input) return input
+  let result = input
+  result = stripDangerousUnicode(result)
+  result = stripControlCharsForCheck(result)
+  result = normalizeFullwidthAndHomoglyphs(result)
+  // Collapse multiple spaces (but preserve newlines)
+  result = result.replace(/ {2,}/g, ' ')
+  result = result.trim()
+  return result
+}
+
+/**
+ * Sanitize a command string for UI display.
+ * Makes invisible/hidden characters visible so users can see
+ * what's actually in the command.
+ *
+ * - Tab → `→` (visible arrow)
+ * - CR → `↵` (carriage return symbol)
+ * - Zero-width spaces → `⟨ZWSP⟩`
+ */
+export function sanitizeForDisplay(input: string): string {
+  if (!input) return input
+  let result = stripDangerousUnicode(input)
+  result = result.replace(/\t/g, '→')
+  result = result.replace(/\r/g, '↵')
+  result = result.replace(/\v/g, '⟨VT⟩')
+  result = result.replace(/\f/g, '⟨FF⟩')
+  return result
+}

package/src/tools/agent/send-message.ts

@@ -33,13 +33,16 @@ export const sendMessageTool: ToolDefinition = {
     const summary = (params.summary as string) || '(no subject)'
     const message = params.message as string
 
+    // P1-1: Truncate long summaries instead of rejecting (max 200 chars)
+    const truncatedSummary = summary.length > 200 ? summary.slice(0, 197) + '...' : summary
+
     const from =
       ctx.sessionId === 'sub-agent'
         ? `sub-agent-${Date.now().toString(36)}`
         : ctx.sessionId || 'main'
 
     const router = getMessageRouter()
-    const result = await router.route(from, to, summary, message)
+    const result = await router.route(from, to, truncatedSummary, message)
 
     if (!result.success) {
       return {
@@ -58,7 +61,7 @@ export const sendMessageTool: ToolDefinition = {
         `ID:      ${result.messageId}\n` +
         `From:    ${from}\n` +
         `To:      ${to}\n` +
-        `Summary: ${summary.slice(0, 100)}`,
+        `Summary: ${truncatedSummary.slice(0, 100)}`,
     }
   },
 }

package/src/tools/exec/bash.ts

@@ -1,4 +1,5 @@
 import type { ToolDefinition, CredentialMaskingConfig } from '../../shared/index.ts'
+import { sanitizeCommand } from '../../shared/sanitize.ts'
 
 // Injected at startup — set via index.tsx
 let credentialConfig: CredentialMaskingConfig | undefined
@@ -105,16 +106,27 @@ function normalizeEscapes(command: string): string {
 function isBlocked(command: string): string | null {
   // Normalize ANSI-C escape sequences for defense-in-depth
   const normalized = normalizeEscapes(command)
+  // P0-1: Also sanitize for permission check (strips invisible chars, normalizes homoglyphs)
+  const sanitized = sanitizeCommand(command)
 
-  // Check exact blocked commands (on normalized command)
+  // Check exact blocked commands (on normalized + sanitized)
   const firstWord = normalized.trim().split(/\s+/)[0]
   if (firstWord && BLOCKED_COMMANDS.includes(firstWord)) {
     return `Command "${firstWord}" rejected by security policy.`
   }
+  // Also check sanitized first word (catches fullwidth command names after normalization)
+  const sanitizedFirstWord = sanitized.trim().split(/\s+/)[0]
+  if (
+    sanitizedFirstWord &&
+    sanitizedFirstWord !== firstWord &&
+    BLOCKED_COMMANDS.includes(sanitizedFirstWord)
+  ) {
+    return `Command "${sanitizedFirstWord}" rejected by security policy.`
+  }
 
-  // Check dangerous patterns (on both original and normalized)
+  // Check dangerous patterns (on original, normalized, and sanitized)
   for (const pattern of BLOCKED_PATTERNS) {
-    if (pattern.test(command) || pattern.test(normalized)) {
+    if (pattern.test(command) || pattern.test(normalized) || pattern.test(sanitized)) {
       return `Command rejected by security policy. Pattern matched: ${pattern.source.slice(0, 40)}...`
     }
   }
@@ -198,6 +210,31 @@ export const bashTool: ToolDefinition = {
     const command = params.command as string
     const timeout = Math.min((params.timeout as number) || 120_000, 600_000)
 
+    // P0-4: Worktree isolation — block cd escape attempts
+    const WORKTREE_MARKER = '.claude/worktrees/'
+    if (ctx.cwd.includes(WORKTREE_MARKER)) {
+      const worktreeRoot = ctx.cwd.substring(0, ctx.cwd.indexOf(WORKTREE_MARKER))
+      // Detect cd to absolute paths outside the worktree
+      const cdEscapePattern = /\bcd\s+(?:"([^"]+)"|'([^']+)'|([^\s;|&]+))/
+      const cdMatch = command.match(cdEscapePattern)
+      if (cdMatch) {
+        const target = cdMatch[1] || cdMatch[2] || cdMatch[3] || ''
+        // Resolve relative to cwd
+        const resolved = target.startsWith('/')
+          ? target
+          : `${ctx.cwd}/${target}`.replace(/\/\.\//g, '/')
+        if (!resolved.startsWith(ctx.cwd) && !resolved.startsWith(worktreeRoot + '/')) {
+          return {
+            success: false,
+            content: '',
+            error:
+              `Worktree isolation: cannot cd outside worktree directory. ` +
+              `Attempted: ${target}. Use tools within the worktree only.`,
+          }
+        }
+      }
+    }
+
     // Security: check command against deny list
     const blockedReason = isBlocked(command)
     if (blockedReason) {

package/src/tools/exec/git.ts

@@ -1,6 +1,62 @@
 import type { ToolDefinition } from '../../shared/index.ts'
 
-const DANGEROUS_COMMANDS = ['push --force', 'reset --hard', 'clean -fd', 'branch -D']
+// P0-4 (v2.1.222 alignment): Regex-based word-boundary patterns replace
+// fragile substring matching. Each pattern describes what it blocks.
+const DANGEROUS_GIT_PATTERNS: Array<{ pattern: RegExp; description: string }> = [
+  // Destructive push
+  { pattern: /\bpush\s+.*--force(?:-with-lease)?\b/, description: 'push --force' },
+  { pattern: /\bpush\s+.*-[fF]\b/, description: 'push -f (force)' },
+  { pattern: /\bpush\s+--delete\b/, description: 'push --delete (remote branch deletion)' },
+  { pattern: /\bpush\s+--mirror\b/, description: 'push --mirror' },
+  // Destructive reset
+  { pattern: /\breset\s+--hard\b/, description: 'reset --hard' },
+  { pattern: /\breset\s+--merge\b/, description: 'reset --merge' },
+  { pattern: /\breset\s+--keep\b/, description: 'reset --keep' },
+  // Destructive clean
+  { pattern: /\bclean\s+-[a-z]*f[a-z]*d[a-z]*\b/, description: 'clean -fd' },
+  { pattern: /\bclean\s+-[a-z]*d[a-z]*f[a-z]*\b/, description: 'clean -fd' },
+  { pattern: /\bclean\s+-[a-z]*x[a-z]*\b/, description: 'clean -x (remove ignored files)' },
+  // Force-delete branch
+  { pattern: /\bbranch\s+-D\b/, description: 'branch -D (force delete)' },
+  { pattern: /\bbranch\s+--delete\s+--force\b/, description: 'branch --delete --force' },
+  // Rebase (potentially destructive)
+  { pattern: /\brebase\s+--onto\b/, description: 'rebase --onto' },
+  // Force checkout (overwrites local changes)
+  { pattern: /\bcheckout\s+.*(?:--force|-f)\b/, description: 'checkout --force' },
+  // Stash manipulation
+  { pattern: /\bstash\s+drop\b/, description: 'stash drop' },
+  { pattern: /\bstash\s+clear\b/, description: 'stash clear' },
+  // Identity spoofing via config
+  { pattern: /\bconfig\s+.*user\./, description: 'config user.* (identity spoofing)' },
+]
+
+/**
+ * Check if the command references paths outside the current working directory
+ * when operating in a worktree context.
+ */
+function isOutsideWorktree(command: string, cwd: string): string | null {
+  const WORKTREE_MARKER = '.claude/worktrees/'
+  if (!cwd.includes(WORKTREE_MARKER)) return null
+
+  // Extract the project root (everything before .claude/worktrees/)
+  const worktreeRoot = cwd.substring(0, cwd.indexOf(WORKTREE_MARKER))
+
+  // Detect git commands that reference the main checkout path
+  const mainCheckoutPaths = [/\b--work-tree=([^\s]+)/g, /\b--git-dir=([^\s]+)/g, /\b-C\s+([^\s]+)/g]
+
+  for (const pathPattern of mainCheckoutPaths) {
+    let match: RegExpExecArray | null
+    while ((match = pathPattern.exec(command)) !== null) {
+      const refPath = match[1]!
+      // If the referenced path is outside the worktree, block it
+      if (!refPath.startsWith(cwd) && !refPath.startsWith(worktreeRoot + '/')) {
+        return `Git command references path outside worktree: ${refPath}`
+      }
+    }
+  }
+
+  return null
+}
 
 export const gitTool: ToolDefinition = {
   name: 'Git',
@@ -20,16 +76,27 @@ export const gitTool: ToolDefinition = {
   async execute(params, ctx) {
     const command = params.command as string
 
-    for (const dangerous of DANGEROUS_COMMANDS) {
-      if (command.includes(dangerous)) {
+    // P0-4: Regex-based word-boundary pattern matching
+    for (const { pattern, description } of DANGEROUS_GIT_PATTERNS) {
+      if (pattern.test(command)) {
         return {
           success: false,
           content: '',
-          error: `Dangerous git command blocked: "${dangerous}". Run manually if intended.`,
+          error: `Dangerous git command blocked: "${description}". Run manually if intended.`,
         }
       }
     }
 
+    // P0-4: Worktree isolation — block commands referencing outside paths
+    const worktreeErr = isOutsideWorktree(command, ctx.cwd)
+    if (worktreeErr) {
+      return {
+        success: false,
+        content: '',
+        error: `Worktree isolation: ${worktreeErr}. Blocked for safety.`,
+      }
+    }
+
     try {
       const proc = Bun.spawn(['git', ...command.split(/\s+/)], {
         cwd: ctx.cwd,

package/src/ui/app.tsx

@@ -24,6 +24,7 @@ import {
 } from './commands'
 import { useI18n } from '../i18n-context'
 import type { PermissionMode } from '../shared/index.ts'
+import { sanitizeForDisplay } from '../shared/sanitize.ts'
 
 interface AppProps {
   engine: QueryEngine
@@ -90,7 +91,7 @@ const PERMISSION_COLORS: Record<PermissionMode, string> = {
 function formatToolDetail(name: string, input: Record<string, unknown>): string {
   switch (name) {
     case 'Bash':
-      return (input.command as string) || ''
+      return sanitizeForDisplay((input.command as string) || '')
     case 'Read':
       return (input.file_path as string) || ''
     case 'Write':
@@ -689,10 +690,14 @@ export function App({
                 ⏵⏵ {PERMISSION_LABELS[permissionMode]}
               </Text>
               <Text dimColor>
-                {' '}({t('ui.status.shift_tab_cycle')}: {PERMISSION_LABELS.default} ·{' '}
+                {' '}
+                ({t('ui.status.shift_tab_cycle')}: {PERMISSION_LABELS.default} ·{' '}
                 {PERMISSION_LABELS.acceptEdits} · {PERMISSION_LABELS.bypassPermissions} ·{' '}
                 {PERMISSION_LABELS.plan} · {PERMISSION_LABELS.auto} · {PERMISSION_LABELS.dontAsk})
-                {' · '}{t('ui.status.esc_to_interrupt')}{' · '}{t('ui.status.left_for_agents')}
+                {' · '}
+                {t('ui.status.esc_to_interrupt')}
+                {' · '}
+                {t('ui.status.left_for_agents')}
               </Text>
             </Box>
           </Box>

package/src/workflow/primitives/parallel.ts

@@ -1,8 +1,61 @@
 /**
  * parallel() — barrier: executes all thunks concurrently, waits for all.
  * Failed thunks resolve to null. Never throws.
+ *
+ * P0-2 (v2.1.223 alignment): Added concurrency cap (MAX_CONCURRENT = 16)
+ * to prevent resource exhaustion from unbounded fan-out.
  */
+const MAX_CONCURRENT = 16
+
+/**
+ * Simple async semaphore for concurrency limiting.
+ */
+class Semaphore {
+  private permits: number
+  private queue: Array<() => void> = []
+
+  constructor(count: number) {
+    this.permits = count
+  }
+
+  async acquire(): Promise<void> {
+    if (this.permits > 0) {
+      this.permits--
+      return
+    }
+    return new Promise<void>((resolve) => {
+      this.queue.push(resolve)
+    })
+  }
+
+  release(): void {
+    if (this.queue.length > 0) {
+      const next = this.queue.shift()!
+      next()
+    } else {
+      this.permits++
+    }
+  }
+}
+
 export async function parallel<T>(thunks: Array<() => Promise<T>>): Promise<(T | null)[]> {
-  const results = await Promise.allSettled(thunks.map((t) => t()))
-  return results.map((r) => (r.status === 'fulfilled' ? r.value : null))
+  if (thunks.length === 0) return []
+
+  const semaphore = new Semaphore(MAX_CONCURRENT)
+  const results: (T | null)[] = new Array(thunks.length)
+
+  await Promise.all(
+    thunks.map(async (thunk, index) => {
+      await semaphore.acquire()
+      try {
+        results[index] = await thunk()
+      } catch {
+        results[index] = null
+      } finally {
+        semaphore.release()
+      }
+    }),
+  )
+
+  return results
 }

package/src/workflow/primitives/pipeline.ts

@@ -2,23 +2,72 @@
  * pipeline() — no barrier: each item flows through all stages independently.
  * Item A can be in stage 3 while item B is still in stage 1.
  * Failed items become null and skip remaining stages.
+ *
+ * P0-2 (v2.1.223 alignment): Added concurrency cap (MAX_CONCURRENT = 16)
+ * to prevent resource exhaustion from unbounded fan-out.
  */
+const MAX_CONCURRENT = 16
+
+/**
+ * Simple async semaphore for concurrency limiting.
+ */
+class Semaphore {
+  private permits: number
+  private queue: Array<() => void> = []
+
+  constructor(count: number) {
+    this.permits = count
+  }
+
+  async acquire(): Promise<void> {
+    if (this.permits > 0) {
+      this.permits--
+      return
+    }
+    return new Promise<void>((resolve) => {
+      this.queue.push(resolve)
+    })
+  }
+
+  release(): void {
+    if (this.queue.length > 0) {
+      const next = this.queue.shift()!
+      next()
+    } else {
+      this.permits++
+    }
+  }
+}
+
 export async function pipeline<T, R>(
   items: T[],
   ...stages: Array<(item: T, index: number, original: T) => Promise<R>>
 ): Promise<(R | null)[]> {
-  // Process each item through all stages concurrently
-  return Promise.all(
+  if (items.length === 0) return []
+
+  const semaphore = new Semaphore(MAX_CONCURRENT)
+  const results: (R | null)[] = new Array(items.length)
+
+  // Process each item through all stages concurrently, with concurrency cap
+  await Promise.all(
     items.map(async (item, index) => {
-      let current: unknown = item
-      for (const stage of stages) {
-        try {
-          current = await stage(current as T, index, item)
-        } catch {
-          return null // item failed, skip remaining stages
+      await semaphore.acquire()
+      try {
+        let current: unknown = item
+        for (const stage of stages) {
+          try {
+            current = await stage(current as T, index, item)
+          } catch {
+            results[index] = null
+            return // item failed, skip remaining stages
+          }
         }
+        results[index] = current as R
+      } finally {
+        semaphore.release()
       }
-      return current as R
     }),
   )
+
+  return results
 }

package/src/workflow/sandbox.ts

@@ -8,6 +8,10 @@ const FORBIDDEN = new Set(['Date.now', 'Math.random', 'crypto.randomUUID'])
  * Blocks Date.now(), Math.random(), argless new Date(), crypto.randomUUID(),
  * plus explicit sandbox escape vectors: eval, Function constructor, import(),
  * require(), process, Bun, fetch, setTimeout/setInterval, etc.
+ *
+ * P0-2 (v2.1.223 alignment): Added explicit defense-in-depth denial of all
+ * host globals (process, require, Bun, fetch, setTimeout, etc.) and
+ * constructor.constructor escape vector blocking.
  */
 export function createSandbox(
   args: unknown,
@@ -29,6 +33,27 @@ export function createSandbox(
     Function: () => {
       throw new Error('new Function() is disabled in workflow sandbox.')
     },
+
+    // ── P0-2: Defense-in-depth — explicit denial of all host globals ──
+    // vm.createContext() does NOT inherit host globals by default, but these
+    // explicit undefined entries prevent prototype-chain access and serve as
+    // auditable documentation of what is deliberately blocked.
+    process: undefined,
+    require: undefined,
+    import: undefined,
+    Bun: undefined,
+    fetch: undefined,
+    setTimeout: undefined,
+    setInterval: undefined,
+    queueMicrotask: undefined,
+    clearTimeout: undefined,
+    clearInterval: undefined,
+    globalThis: undefined,
+    global: undefined,
+    __dirname: undefined,
+    __filename: undefined,
+    module: undefined,
+    exports: undefined,
   }
 
   // Override Date to block now() and argless constructor
@@ -81,6 +106,45 @@ export function createSandbox(
     })
   }
 
+  // ── P0-2: Block constructor.constructor escape vector ──
+  // The chain [].constructor.constructor('return this')() can escape
+  // vm.createContext if not blocked. We override Object to intercept
+  // constructor access on prototype chains.
+  sandboxObj.Object = new Proxy(Object, {
+    get(target, prop) {
+      if (prop === 'prototype') {
+        return new Proxy(Object.prototype, {
+          get(protoTarget, protoProp) {
+            if (protoProp === 'constructor') {
+              const ctor = Object.prototype.constructor
+              return new Proxy(ctor, {
+                construct() {
+                  throw new Error('Dynamic constructor invocation is disabled in workflow sandbox.')
+                },
+                get(_t, ctorProp) {
+                  // Block [].constructor.constructor chain
+                  if (ctorProp === 'constructor') {
+                    throw new Error('constructor.constructor is disabled in workflow sandbox.')
+                  }
+                  const val = (ctor as unknown as Record<string, unknown>)[ctorProp as string]
+                  return typeof val === 'function'
+                    ? (val as (...args: unknown[]) => unknown).bind(ctor)
+                    : val
+                },
+              })
+            }
+            const val = (protoTarget as Record<string, unknown>)[protoProp as string]
+            return typeof val === 'function'
+              ? (val as (...args: unknown[]) => unknown).bind(protoTarget)
+              : val
+          },
+        })
+      }
+      const val = (Object as unknown as Record<string, unknown>)[prop as string]
+      return typeof val === 'function' ? (val as (...args: unknown[]) => unknown).bind(Object) : val
+    },
+  })
+
   return vm.createContext(sandboxObj)
 }