@miphamai/cli 0.24.16 → 0.26.0

package/src/shared/sanitize.ts

@@ -4,6 +4,10 @@
  * from visual inspection or enable homoglyph attacks.
  *
  * Protects against hidden command text via tabs/invisible Unicode characters.
+ *
+ * P0-1 (v2.1.223 alignment): Extended to also strip tab, CR, VT, FF,
+ * other control characters, and normalize fullwidth/homoglyph characters
+ * to ASCII equivalents for permission checks.
  */
 
 const DANGEROUS_UNICODE = /[​‌‍‎‏‪‫‬‭‮⁠⁦⁧⁨⁩]/g
@@ -36,3 +40,181 @@ export function sanitizeParams(params: Record<string, unknown>): Record<string,
   }
   return result
 }
+
+// ── P0-1: Extended sanitization for permission checks ──
+
+// Fullwidth Latin letters (U+FF21-FF3A → A-Z, U+FF41-FF5A → a-z)
+const FULLWIDTH_UPPER_START = 0xff21 // Ａ
+const FULLWIDTH_LOWER_START = 0xff41 // ａ
+const ASCII_UPPER_START = 0x41 // A
+const ASCII_LOWER_START = 0x61 // a
+
+// Fullwidth digits (U+FF10-FF19 → 0-9)
+const FULLWIDTH_DIGIT_START = 0xff10 // ０
+const ASCII_DIGIT_START = 0x30 // 0
+
+/** Map of fullwidth/homoglyph punctuation to ASCII equivalents */
+const FULLWIDTH_PUNCTUATION: Record<number, number> = {
+  0xff0f: 0x2f, // ／ → /
+  0xff0d: 0x2d, // － → -
+  0xff04: 0x24, // ＄ → $
+  0xff08: 0x28, // （ → (
+  0xff09: 0x29, // ） → )
+  0xff01: 0x21, // ！ → !
+  0xff20: 0x40, // ＠ → @
+  0xff03: 0x23, // ＃ → #
+  0xff1a: 0x3a, // ： → :
+  0xff1b: 0x3b, // ； → ;
+  0xff1c: 0x3c, // ＜ → <
+  0xff1e: 0x3e, // ＞ → >
+  0xff3b: 0x5b, // ［ → [
+  0xff3d: 0x5d, // ］ → ]
+  0xff3e: 0x5e, // ＾ → ^
+  0xff40: 0x60, // ｀ → `
+  0xff5c: 0x7c, // ｜ → |
+  0xff5e: 0x7e, // ～ → ~
+  0xff07: 0x27, // ＇ → '
+  0xff02: 0x22, // ＂ → "
+  0xff06: 0x26, // ＆ → &
+  0xff0a: 0x2a, // ＊ → *
+  0xff0b: 0x2b, // ＋ → +
+  0xff0c: 0x2c, // ， → ,
+  0xff0e: 0x2e, // ． → .
+  0xff1d: 0x3d, // ＝ → =
+  0xff05: 0x25, // ％ → %
+  0xff3f: 0x5f, // ＿ → _
+  0xff5b: 0x7b, // ｛ → {
+  0xff5d: 0x7d, // ｝ → }
+  0xff3c: 0x5c, // ＼ → \
+}
+
+/** Common Unicode homoglyphs to ASCII (NOT fullwidth — separate Unicode blocks) */
+const HOMOGLYPH_MAP: Record<number, number> = {
+  // Common bypass homoglyphs
+  0x0430: 0x61, // Cyrillic а → Latin a
+  0x0435: 0x65, // Cyrillic е → Latin e
+  0x043e: 0x6f, // Cyrillic о → Latin o
+  0x0440: 0x70, // Cyrillic р → Latin p
+  0x0441: 0x63, // Cyrillic с → Latin c
+  0x0443: 0x79, // Cyrillic у → Latin y
+  0x0445: 0x78, // Cyrillic х → Latin x
+  0x0456: 0x69, // Cyrillic і → Latin i
+  0x03bf: 0x6f, // Greek ο → Latin o
+  0x03c1: 0x70, // Greek ρ → Latin p
+  0x03bd: 0x76, // Greek ν → Latin v (looks like v)
+}
+
+/**
+ * Normalize fullwidth Latin letters, digits, and punctuation to ASCII equivalents.
+ * Also handles common homoglyph substitutions used in bypass attacks.
+ *
+ * Only normalizes characters in Latin-script ranges — does NOT affect
+ * CJK ideographs, Arabic, Devanagari, or other scripts.
+ */
+export function normalizeFullwidthAndHomoglyphs(input: string): string {
+  if (!input) return input
+  let result = ''
+  for (let i = 0; i < input.length; i++) {
+    const cp = input.codePointAt(i)
+    if (cp === undefined) {
+      result += input[i]
+      continue
+    }
+
+    // Fullwidth upper: Ａ-Ｚ → A-Z
+    if (cp >= FULLWIDTH_UPPER_START && cp <= FULLWIDTH_UPPER_START + 25) {
+      result += String.fromCodePoint(ASCII_UPPER_START + (cp - FULLWIDTH_UPPER_START))
+    }
+    // Fullwidth lower: ａ-ｚ → a-z
+    else if (cp >= FULLWIDTH_LOWER_START && cp <= FULLWIDTH_LOWER_START + 25) {
+      result += String.fromCodePoint(ASCII_LOWER_START + (cp - FULLWIDTH_LOWER_START))
+    }
+    // Fullwidth digits: ０-９ → 0-9
+    else if (cp >= FULLWIDTH_DIGIT_START && cp <= FULLWIDTH_DIGIT_START + 9) {
+      result += String.fromCodePoint(ASCII_DIGIT_START + (cp - FULLWIDTH_DIGIT_START))
+    }
+    // Fullwidth punctuation
+    else if (FULLWIDTH_PUNCTUATION[cp] !== undefined) {
+      result += String.fromCodePoint(FULLWIDTH_PUNCTUATION[cp])
+    }
+    // Homoglyphs
+    else if (HOMOGLYPH_MAP[cp] !== undefined) {
+      result += String.fromCodePoint(HOMOGLYPH_MAP[cp])
+    }
+    // Surrogate pairs (code points > U+FFFF) — skip the low surrogate
+    else if (cp > 0xffff) {
+      result += input[i]
+      i++ // skip next char (low surrogate)
+    }
+    // Keep everything else as-is
+    else {
+      result += input[i]
+    }
+  }
+  return result
+}
+
+// Regex for control characters that should be stripped from permission-check input.
+// Strips: tab (\t), CR (\r), VT (\v), FF (\f), and other control chars
+// in ranges 0x01-0x08 and 0x0E-0x1F.
+// Preserves: newline (\n, 0x0A) — necessary for multi-line shell commands.
+const CONTROL_CHARS_FOR_PERMISSION_CHECK = /[\x00-\x09\x0b\x0c\x0d-\x1f]/g
+
+/**
+ * Strip control characters from a command string for permission checking.
+ * - Tab (\t) → single space (so words don't merge confusingly)
+ * - CR (\r), VT (\v), FF (\f) → removed
+ * - Other control chars (0x01-0x08, 0x0E-0x1F) → removed
+ * - Newline (\n) is PRESERVED for multi-line commands
+ */
+export function stripControlCharsForCheck(input: string): string {
+  if (!input) return input
+  // First, replace tabs with spaces
+  let result = input.replace(/\t/g, ' ')
+  // Then strip other control chars (but preserve \n)
+  result = result.replace(CONTROL_CHARS_FOR_PERMISSION_CHECK, '')
+  return result
+}
+
+/**
+ * Full command sanitization pipeline for permission checks.
+ * Applies in order:
+ * 1. Strip dangerous invisible Unicode (zero-width, bidi, BOM, etc.)
+ * 2. Strip control characters (tab→space, CR/VT/FF→removed)
+ * 3. Normalize fullwidth/homoglyph characters to ASCII
+ * 4. Collapse multiple spaces
+ * 5. Trim
+ *
+ * This is intended for pattern-matching input only — the original
+ * command string should still be used for actual execution.
+ */
+export function sanitizeCommand(input: string): string {
+  if (!input) return input
+  let result = input
+  result = stripDangerousUnicode(result)
+  result = stripControlCharsForCheck(result)
+  result = normalizeFullwidthAndHomoglyphs(result)
+  // Collapse multiple spaces (but preserve newlines)
+  result = result.replace(/ {2,}/g, ' ')
+  result = result.trim()
+  return result
+}
+
+/**
+ * Sanitize a command string for UI display.
+ * Makes invisible/hidden characters visible so users can see
+ * what's actually in the command.
+ *
+ * - Tab → `→` (visible arrow)
+ * - CR → `↵` (carriage return symbol)
+ * - Zero-width spaces → `⟨ZWSP⟩`
+ */
+export function sanitizeForDisplay(input: string): string {
+  if (!input) return input
+  let result = stripDangerousUnicode(input)
+  result = result.replace(/\t/g, '→')
+  result = result.replace(/\r/g, '↵')
+  result = result.replace(/\v/g, '⟨VT⟩')
+  result = result.replace(/\f/g, '⟨FF⟩')
+  return result
+}

package/src/tools/agent/send-message.ts

@@ -33,13 +33,16 @@ export const sendMessageTool: ToolDefinition = {
     const summary = (params.summary as string) || '(no subject)'
     const message = params.message as string
 
+    // P1-1: Truncate long summaries instead of rejecting (max 200 chars)
+    const truncatedSummary = summary.length > 200 ? summary.slice(0, 197) + '...' : summary
+
     const from =
       ctx.sessionId === 'sub-agent'
         ? `sub-agent-${Date.now().toString(36)}`
         : ctx.sessionId || 'main'
 
     const router = getMessageRouter()
-    const result = await router.route(from, to, summary, message)
+    const result = await router.route(from, to, truncatedSummary, message)
 
     if (!result.success) {
       return {
@@ -58,7 +61,7 @@ export const sendMessageTool: ToolDefinition = {
         `ID:      ${result.messageId}\n` +
         `From:    ${from}\n` +
         `To:      ${to}\n` +
-        `Summary: ${summary.slice(0, 100)}`,
+        `Summary: ${truncatedSummary.slice(0, 100)}`,
     }
   },
 }

package/src/tools/exec/bash.ts

@@ -1,4 +1,5 @@
 import type { ToolDefinition, CredentialMaskingConfig } from '../../shared/index.ts'
+import { sanitizeCommand } from '../../shared/sanitize.ts'
 
 // Injected at startup — set via index.tsx
 let credentialConfig: CredentialMaskingConfig | undefined
@@ -105,16 +106,27 @@ function normalizeEscapes(command: string): string {
 function isBlocked(command: string): string | null {
   // Normalize ANSI-C escape sequences for defense-in-depth
   const normalized = normalizeEscapes(command)
+  // P0-1: Also sanitize for permission check (strips invisible chars, normalizes homoglyphs)
+  const sanitized = sanitizeCommand(command)
 
-  // Check exact blocked commands (on normalized command)
+  // Check exact blocked commands (on normalized + sanitized)
   const firstWord = normalized.trim().split(/\s+/)[0]
   if (firstWord && BLOCKED_COMMANDS.includes(firstWord)) {
     return `Command "${firstWord}" rejected by security policy.`
   }
+  // Also check sanitized first word (catches fullwidth command names after normalization)
+  const sanitizedFirstWord = sanitized.trim().split(/\s+/)[0]
+  if (
+    sanitizedFirstWord &&
+    sanitizedFirstWord !== firstWord &&
+    BLOCKED_COMMANDS.includes(sanitizedFirstWord)
+  ) {
+    return `Command "${sanitizedFirstWord}" rejected by security policy.`
+  }
 
-  // Check dangerous patterns (on both original and normalized)
+  // Check dangerous patterns (on original, normalized, and sanitized)
   for (const pattern of BLOCKED_PATTERNS) {
-    if (pattern.test(command) || pattern.test(normalized)) {
+    if (pattern.test(command) || pattern.test(normalized) || pattern.test(sanitized)) {
       return `Command rejected by security policy. Pattern matched: ${pattern.source.slice(0, 40)}...`
     }
   }
@@ -198,6 +210,31 @@ export const bashTool: ToolDefinition = {
     const command = params.command as string
     const timeout = Math.min((params.timeout as number) || 120_000, 600_000)
 
+    // P0-4: Worktree isolation — block cd escape attempts
+    const WORKTREE_MARKER = '.claude/worktrees/'
+    if (ctx.cwd.includes(WORKTREE_MARKER)) {
+      const worktreeRoot = ctx.cwd.substring(0, ctx.cwd.indexOf(WORKTREE_MARKER))
+      // Detect cd to absolute paths outside the worktree
+      const cdEscapePattern = /\bcd\s+(?:"([^"]+)"|'([^']+)'|([^\s;|&]+))/
+      const cdMatch = command.match(cdEscapePattern)
+      if (cdMatch) {
+        const target = cdMatch[1] || cdMatch[2] || cdMatch[3] || ''
+        // Resolve relative to cwd
+        const resolved = target.startsWith('/')
+          ? target
+          : `${ctx.cwd}/${target}`.replace(/\/\.\//g, '/')
+        if (!resolved.startsWith(ctx.cwd) && !resolved.startsWith(worktreeRoot + '/')) {
+          return {
+            success: false,
+            content: '',
+            error:
+              `Worktree isolation: cannot cd outside worktree directory. ` +
+              `Attempted: ${target}. Use tools within the worktree only.`,
+          }
+        }
+      }
+    }
+
     // Security: check command against deny list
     const blockedReason = isBlocked(command)
     if (blockedReason) {

package/src/tools/exec/git.ts

@@ -1,6 +1,62 @@
 import type { ToolDefinition } from '../../shared/index.ts'
 
-const DANGEROUS_COMMANDS = ['push --force', 'reset --hard', 'clean -fd', 'branch -D']
+// P0-4 (v2.1.222 alignment): Regex-based word-boundary patterns replace
+// fragile substring matching. Each pattern describes what it blocks.
+const DANGEROUS_GIT_PATTERNS: Array<{ pattern: RegExp; description: string }> = [
+  // Destructive push
+  { pattern: /\bpush\s+.*--force(?:-with-lease)?\b/, description: 'push --force' },
+  { pattern: /\bpush\s+.*-[fF]\b/, description: 'push -f (force)' },
+  { pattern: /\bpush\s+--delete\b/, description: 'push --delete (remote branch deletion)' },
+  { pattern: /\bpush\s+--mirror\b/, description: 'push --mirror' },
+  // Destructive reset
+  { pattern: /\breset\s+--hard\b/, description: 'reset --hard' },
+  { pattern: /\breset\s+--merge\b/, description: 'reset --merge' },
+  { pattern: /\breset\s+--keep\b/, description: 'reset --keep' },
+  // Destructive clean
+  { pattern: /\bclean\s+-[a-z]*f[a-z]*d[a-z]*\b/, description: 'clean -fd' },
+  { pattern: /\bclean\s+-[a-z]*d[a-z]*f[a-z]*\b/, description: 'clean -fd' },
+  { pattern: /\bclean\s+-[a-z]*x[a-z]*\b/, description: 'clean -x (remove ignored files)' },
+  // Force-delete branch
+  { pattern: /\bbranch\s+-D\b/, description: 'branch -D (force delete)' },
+  { pattern: /\bbranch\s+--delete\s+--force\b/, description: 'branch --delete --force' },
+  // Rebase (potentially destructive)
+  { pattern: /\brebase\s+--onto\b/, description: 'rebase --onto' },
+  // Force checkout (overwrites local changes)
+  { pattern: /\bcheckout\s+.*(?:--force|-f)\b/, description: 'checkout --force' },
+  // Stash manipulation
+  { pattern: /\bstash\s+drop\b/, description: 'stash drop' },
+  { pattern: /\bstash\s+clear\b/, description: 'stash clear' },
+  // Identity spoofing via config
+  { pattern: /\bconfig\s+.*user\./, description: 'config user.* (identity spoofing)' },
+]
+
+/**
+ * Check if the command references paths outside the current working directory
+ * when operating in a worktree context.
+ */
+function isOutsideWorktree(command: string, cwd: string): string | null {
+  const WORKTREE_MARKER = '.claude/worktrees/'
+  if (!cwd.includes(WORKTREE_MARKER)) return null
+
+  // Extract the project root (everything before .claude/worktrees/)
+  const worktreeRoot = cwd.substring(0, cwd.indexOf(WORKTREE_MARKER))
+
+  // Detect git commands that reference the main checkout path
+  const mainCheckoutPaths = [/\b--work-tree=([^\s]+)/g, /\b--git-dir=([^\s]+)/g, /\b-C\s+([^\s]+)/g]
+
+  for (const pathPattern of mainCheckoutPaths) {
+    let match: RegExpExecArray | null
+    while ((match = pathPattern.exec(command)) !== null) {
+      const refPath = match[1]!
+      // If the referenced path is outside the worktree, block it
+      if (!refPath.startsWith(cwd) && !refPath.startsWith(worktreeRoot + '/')) {
+        return `Git command references path outside worktree: ${refPath}`
+      }
+    }
+  }
+
+  return null
+}
 
 export const gitTool: ToolDefinition = {
   name: 'Git',
@@ -20,16 +76,27 @@ export const gitTool: ToolDefinition = {
   async execute(params, ctx) {
     const command = params.command as string
 
-    for (const dangerous of DANGEROUS_COMMANDS) {
-      if (command.includes(dangerous)) {
+    // P0-4: Regex-based word-boundary pattern matching
+    for (const { pattern, description } of DANGEROUS_GIT_PATTERNS) {
+      if (pattern.test(command)) {
         return {
           success: false,
           content: '',
-          error: `Dangerous git command blocked: "${dangerous}". Run manually if intended.`,
+          error: `Dangerous git command blocked: "${description}". Run manually if intended.`,
         }
       }
     }
 
+    // P0-4: Worktree isolation — block commands referencing outside paths
+    const worktreeErr = isOutsideWorktree(command, ctx.cwd)
+    if (worktreeErr) {
+      return {
+        success: false,
+        content: '',
+        error: `Worktree isolation: ${worktreeErr}. Blocked for safety.`,
+      }
+    }
+
     try {
       const proc = Bun.spawn(['git', ...command.split(/\s+/)], {
         cwd: ctx.cwd,

package/src/ui/app.tsx

@@ -24,6 +24,7 @@ import {
 } from './commands'
 import { useI18n } from '../i18n-context'
 import type { PermissionMode } from '../shared/index.ts'
+import { sanitizeForDisplay } from '../shared/sanitize.ts'
 
 interface AppProps {
   engine: QueryEngine
@@ -90,7 +91,7 @@ const PERMISSION_COLORS: Record<PermissionMode, string> = {
 function formatToolDetail(name: string, input: Record<string, unknown>): string {
   switch (name) {
     case 'Bash':
-      return (input.command as string) || ''
+      return sanitizeForDisplay((input.command as string) || '')
     case 'Read':
       return (input.file_path as string) || ''
     case 'Write':
@@ -689,10 +690,14 @@ export function App({
                 ⏵⏵ {PERMISSION_LABELS[permissionMode]}
               </Text>
               <Text dimColor>
-                {' '}({t('ui.status.shift_tab_cycle')}: {PERMISSION_LABELS.default} ·{' '}
+                {' '}
+                ({t('ui.status.shift_tab_cycle')}: {PERMISSION_LABELS.default} ·{' '}
                 {PERMISSION_LABELS.acceptEdits} · {PERMISSION_LABELS.bypassPermissions} ·{' '}
                 {PERMISSION_LABELS.plan} · {PERMISSION_LABELS.auto} · {PERMISSION_LABELS.dontAsk})
-                {' · '}{t('ui.status.esc_to_interrupt')}{' · '}{t('ui.status.left_for_agents')}
+                {' · '}
+                {t('ui.status.esc_to_interrupt')}
+                {' · '}
+                {t('ui.status.left_for_agents')}
               </Text>
             </Box>
           </Box>

package/src/workflow/primitives/parallel.ts

@@ -1,8 +1,61 @@
 /**
  * parallel() — barrier: executes all thunks concurrently, waits for all.
  * Failed thunks resolve to null. Never throws.
+ *
+ * P0-2 (v2.1.223 alignment): Added concurrency cap (MAX_CONCURRENT = 16)
+ * to prevent resource exhaustion from unbounded fan-out.
  */
+const MAX_CONCURRENT = 16
+
+/**
+ * Simple async semaphore for concurrency limiting.
+ */
+class Semaphore {
+  private permits: number
+  private queue: Array<() => void> = []
+
+  constructor(count: number) {
+    this.permits = count
+  }
+
+  async acquire(): Promise<void> {
+    if (this.permits > 0) {
+      this.permits--
+      return
+    }
+    return new Promise<void>((resolve) => {
+      this.queue.push(resolve)
+    })
+  }
+
+  release(): void {
+    if (this.queue.length > 0) {
+      const next = this.queue.shift()!
+      next()
+    } else {
+      this.permits++
+    }
+  }
+}
+
 export async function parallel<T>(thunks: Array<() => Promise<T>>): Promise<(T | null)[]> {
-  const results = await Promise.allSettled(thunks.map((t) => t()))
-  return results.map((r) => (r.status === 'fulfilled' ? r.value : null))
+  if (thunks.length === 0) return []
+
+  const semaphore = new Semaphore(MAX_CONCURRENT)
+  const results: (T | null)[] = new Array(thunks.length)
+
+  await Promise.all(
+    thunks.map(async (thunk, index) => {
+      await semaphore.acquire()
+      try {
+        results[index] = await thunk()
+      } catch {
+        results[index] = null
+      } finally {
+        semaphore.release()
+      }
+    }),
+  )
+
+  return results
 }

package/src/workflow/primitives/pipeline.ts

@@ -2,23 +2,72 @@
  * pipeline() — no barrier: each item flows through all stages independently.
  * Item A can be in stage 3 while item B is still in stage 1.
  * Failed items become null and skip remaining stages.
+ *
+ * P0-2 (v2.1.223 alignment): Added concurrency cap (MAX_CONCURRENT = 16)
+ * to prevent resource exhaustion from unbounded fan-out.
  */
+const MAX_CONCURRENT = 16
+
+/**
+ * Simple async semaphore for concurrency limiting.
+ */
+class Semaphore {
+  private permits: number
+  private queue: Array<() => void> = []
+
+  constructor(count: number) {
+    this.permits = count
+  }
+
+  async acquire(): Promise<void> {
+    if (this.permits > 0) {
+      this.permits--
+      return
+    }
+    return new Promise<void>((resolve) => {
+      this.queue.push(resolve)
+    })
+  }
+
+  release(): void {
+    if (this.queue.length > 0) {
+      const next = this.queue.shift()!
+      next()
+    } else {
+      this.permits++
+    }
+  }
+}
+
 export async function pipeline<T, R>(
   items: T[],
   ...stages: Array<(item: T, index: number, original: T) => Promise<R>>
 ): Promise<(R | null)[]> {
-  // Process each item through all stages concurrently
-  return Promise.all(
+  if (items.length === 0) return []
+
+  const semaphore = new Semaphore(MAX_CONCURRENT)
+  const results: (R | null)[] = new Array(items.length)
+
+  // Process each item through all stages concurrently, with concurrency cap
+  await Promise.all(
     items.map(async (item, index) => {
-      let current: unknown = item
-      for (const stage of stages) {
-        try {
-          current = await stage(current as T, index, item)
-        } catch {
-          return null // item failed, skip remaining stages
+      await semaphore.acquire()
+      try {
+        let current: unknown = item
+        for (const stage of stages) {
+          try {
+            current = await stage(current as T, index, item)
+          } catch {
+            results[index] = null
+            return // item failed, skip remaining stages
+          }
         }
+        results[index] = current as R
+      } finally {
+        semaphore.release()
       }
-      return current as R
     }),
   )
+
+  return results
 }

package/src/workflow/sandbox.ts

@@ -8,6 +8,10 @@ const FORBIDDEN = new Set(['Date.now', 'Math.random', 'crypto.randomUUID'])
  * Blocks Date.now(), Math.random(), argless new Date(), crypto.randomUUID(),
  * plus explicit sandbox escape vectors: eval, Function constructor, import(),
  * require(), process, Bun, fetch, setTimeout/setInterval, etc.
+ *
+ * P0-2 (v2.1.223 alignment): Added explicit defense-in-depth denial of all
+ * host globals (process, require, Bun, fetch, setTimeout, etc.) and
+ * constructor.constructor escape vector blocking.
  */
 export function createSandbox(
   args: unknown,
@@ -29,6 +33,27 @@ export function createSandbox(
     Function: () => {
       throw new Error('new Function() is disabled in workflow sandbox.')
     },
+
+    // ── P0-2: Defense-in-depth — explicit denial of all host globals ──
+    // vm.createContext() does NOT inherit host globals by default, but these
+    // explicit undefined entries prevent prototype-chain access and serve as
+    // auditable documentation of what is deliberately blocked.
+    process: undefined,
+    require: undefined,
+    import: undefined,
+    Bun: undefined,
+    fetch: undefined,
+    setTimeout: undefined,
+    setInterval: undefined,
+    queueMicrotask: undefined,
+    clearTimeout: undefined,
+    clearInterval: undefined,
+    globalThis: undefined,
+    global: undefined,
+    __dirname: undefined,
+    __filename: undefined,
+    module: undefined,
+    exports: undefined,
   }
 
   // Override Date to block now() and argless constructor
@@ -81,6 +106,45 @@ export function createSandbox(
     })
   }
 
+  // ── P0-2: Block constructor.constructor escape vector ──
+  // The chain [].constructor.constructor('return this')() can escape
+  // vm.createContext if not blocked. We override Object to intercept
+  // constructor access on prototype chains.
+  sandboxObj.Object = new Proxy(Object, {
+    get(target, prop) {
+      if (prop === 'prototype') {
+        return new Proxy(Object.prototype, {
+          get(protoTarget, protoProp) {
+            if (protoProp === 'constructor') {
+              const ctor = Object.prototype.constructor
+              return new Proxy(ctor, {
+                construct() {
+                  throw new Error('Dynamic constructor invocation is disabled in workflow sandbox.')
+                },
+                get(_t, ctorProp) {
+                  // Block [].constructor.constructor chain
+                  if (ctorProp === 'constructor') {
+                    throw new Error('constructor.constructor is disabled in workflow sandbox.')
+                  }
+                  const val = (ctor as unknown as Record<string, unknown>)[ctorProp as string]
+                  return typeof val === 'function'
+                    ? (val as (...args: unknown[]) => unknown).bind(ctor)
+                    : val
+                },
+              })
+            }
+            const val = (protoTarget as Record<string, unknown>)[protoProp as string]
+            return typeof val === 'function'
+              ? (val as (...args: unknown[]) => unknown).bind(protoTarget)
+              : val
+          },
+        })
+      }
+      const val = (Object as unknown as Record<string, unknown>)[prop as string]
+      return typeof val === 'function' ? (val as (...args: unknown[]) => unknown).bind(Object) : val
+    },
+  })
+
   return vm.createContext(sandboxObj)
 }