@miphamai/cli 0.81.6 → 0.81.7

package/src/telemetry/index.ts

@@ -0,0 +1,153 @@
+import { randomUUID } from 'node:crypto'
+import { getMetrics } from '../core/metrics'
+import { resolveTelemetry, getOrCreateInstallId, type TelemetryConsent } from './consent'
+import { enqueueSync } from './queue'
+import { buildSessionEvent } from './payload'
+import { buildCrashEvent, hasCrashed, installCrashHandlers } from './crash'
+import { flushQueueInBackground } from './transport'
+
+/**
+ * Telemetry facade.
+ *
+ * Data flow — collecting and sending are deliberately decoupled, because
+ * `process.on('exit')` cannot await async work:
+ *
+ *   during a session   counters accumulate in memory (`getMetrics()`); zero I/O
+ *   at exit            synchronous: whitelist snapshot + session metadata → queue
+ *   next startup       async, fire-and-forget: drain queue → POST → ack or keep
+ *
+ * Nothing here is a parallel counting system. `getMetrics()` already exists and
+ * is the single source for what actually got used; telemetry only *reads* it,
+ * and only for the whitelisted families (`payload.ts`).
+ */
+
+interface TelemetryState {
+  consent: TelemetryConsent
+  installId: string
+  startedAt: number
+  /** Guards against a double flush when both SIGINT and a normal exit fire. */
+  flushed: boolean
+}
+
+let state: TelemetryState | null = null
+
+/**
+ * The exit flush, kept by reference so `resetTelemetryState` can remove
+ * exactly this one — `removeAllListeners('exit')` would detach the runner's
+ * own teardown and every other exit path in the process.
+ */
+let onExit: (() => void) | null = null
+
+/**
+ * Start telemetry for this process.
+ *
+ * Safe to call once at startup. Returns the resolved consent so callers (and
+ * `/telemetry status`) can report why telemetry is on or off.
+ */
+export function initTelemetry(cwd: string = process.cwd()): TelemetryConsent {
+  const consent = resolveTelemetry(cwd)
+  const installId = consent.enabled ? getOrCreateInstallId(cwd) : ''
+
+  state = { consent, installId, startedAt: Date.now(), flushed: false }
+
+  // Crash capture is installed unconditionally, even when telemetry is off:
+  // it is what keeps a crash from becoming a silent hang. When telemetry is
+  // off the record is simply never uploaded.
+  installCrashHandlers()
+
+  // Likewise unconditional. The flush has to be registered while telemetry is
+  // still off, because the user can turn it on mid-session (`/telemetry on` →
+  // `enableTelemetryNow`) and that session must still be reported. Registering
+  // it here rather than in the TUI's own `process.on('exit')` also means the
+  // remote-attach and non-interactive paths are covered, not just the one that
+  // reaches the TUI setup.
+  if (!onExit) {
+    onExit = () => shutdownTelemetry()
+    process.on('exit', onExit)
+  }
+
+  if (consent.enabled) flushQueueInBackground(consent.endpoint)
+
+  return consent
+}
+
+/**
+ * Record a slash-command invocation.
+ *
+ * Unconditional, like every other counter in the registry — `getMetrics()` is
+ * a metrics registry used by the artifact server too, not a telemetry buffer.
+ * Whether the snapshot ever leaves the machine is decided at exit.
+ */
+export function recordCommand(name: string): void {
+  getMetrics().commandCalls.inc({ command_name: name })
+}
+
+/** Record a tool invocation that bypassed the engine's `executeTool` funnel. */
+export function recordToolCall(name: string): void {
+  getMetrics().toolCalls.inc({ tool_name: name })
+}
+
+export function isTelemetryEnabled(): boolean {
+  return state?.consent.enabled === true
+}
+
+export function getTelemetryConsent(): TelemetryConsent | null {
+  return state?.consent ?? null
+}
+
+/**
+ * Form and queue the session payload. **Synchronous by requirement** — this is
+ * called from inside `process.on('exit')`, where an await would never settle.
+ *
+ * A no-op when telemetry is off, which is what makes "off" mean no collection,
+ * no queue file, and no network.
+ */
+export function shutdownTelemetry(now: Date = new Date()): void {
+  const current = state
+  if (!current || current.flushed) return
+  current.flushed = true
+  if (!current.consent.enabled) return
+
+  try {
+    if (hasCrashed()) {
+      const crash = buildCrashEvent(current.installId)
+      if (crash) enqueueSync(crash)
+    }
+    enqueueSync(
+      buildSessionEvent({
+        installId: current.installId,
+        startedAt: current.startedAt,
+        endedAt: now.getTime(),
+        crashed: hasCrashed(),
+      }),
+    )
+  } catch {
+    // A telemetry write must never break the exit path.
+  }
+}
+
+/** Test seam: drop facade state and unhook the exit flush. */
+export function resetTelemetryState(): void {
+  state = null
+  if (onExit) process.off('exit', onExit)
+  onExit = null
+}
+
+/**
+ * Persist the user's answer and start reporting immediately, so `/telemetry on`
+ * takes effect in the running session rather than at the next launch.
+ */
+export function enableTelemetryNow(cwd: string = process.cwd()): void {
+  const consent = resolveTelemetry(cwd)
+  state = {
+    consent,
+    installId: getOrCreateInstallId(cwd),
+    startedAt: state?.startedAt ?? Date.now(),
+    flushed: false,
+  }
+}
+
+/** A fresh anonymous id, for `/telemetry reset-id`. */
+export function newInstallId(): string {
+  return randomUUID()
+}

package/src/telemetry/payload.ts

@@ -0,0 +1,141 @@
+import { randomUUID } from 'node:crypto'
+import { getMetrics } from '../core/metrics'
+import { PACKAGE_VERSION } from '../shared/package-info'
+import type { QueuedEvent } from './queue'
+import { runtimeTag } from './redact'
+
+/**
+ * Payload construction.
+ *
+ * The counters are a **whitelist, not a whole-registry dump**. A dump would
+ * silently enrol every future counter into the uploaded payload, and a future
+ * counter's labels may well carry PII. A whitelist is explicit, can be written
+ * into the public data dictionary, and can be locked down by a test asserting
+ * the emitted key set is a subset of it.
+ *
+ * See `docs/telemetry.md` for the public data dictionary.
+ */
+
+/**
+ * Bumped whenever the payload shape changes, so the endpoint can evolve.
+ *
+ * v2 (this version) = the crash event no longer carries `stackFrames`.
+ * The collector never kept them — "dimensional aggregates only" leaves a frame
+ * string nowhere to live — so sending them bought ~3 KB per crash of transfer
+ * and a privacy surface in exchange for nothing. The frame *count* stays: it is
+ * what keeps "this stack was short" distinguishable from "this stack was cut",
+ * and it is a single integer.
+ *
+ * The ordering was not optional: the collector had to accept v1 **before** any
+ * client stopped sending frames. Checked in `apps/telemetry/src/schema.ts`,
+ * which lists both versions.
+ */
+export const SCHEMA_VERSION = 2
+
+/**
+ * Counter family names cleared for upload, as they appear in the registry.
+ * Adding to this list is a privacy decision — it must be matched by a
+ * data-dictionary entry in the same commit.
+ */
+export const COUNTER_WHITELIST = [
+  'mipham_code_cli_invocations_total',
+  'mipham_code_command_calls_total',
+  'mipham_code_tool_calls_total',
+  'mipham_code_crsi_rule_applications_total',
+  'mipham_code_sis_interceptions_total',
+] as const
+
+/** Maximum length of a label value kept in the payload. */
+const MAX_LABEL_LENGTH = 64
+
+/** `Counter.toJSON()` reports `object`; this is the shape it actually returns. */
+interface CounterJson {
+  name: string
+  series: { labels: string; value: number }[]
+}
+
+/**
+ * Pull the first `="…"` value out of the registry's formatted label string
+ * (e.g. `{tool_name="Bash"}` → `Bash`). Whitelisted families carry at most one
+ * label, so first-value is the whole story.
+ */
+function firstLabelValue(labels: string): string {
+  const match = /="((?:[^"\\]|\\.)*)"/.exec(labels)
+  if (!match || match[1] === undefined) return ''
+  return match[1]
+    .replace(/\\(.)/g, '$1')
+    .replace(/[^\x20-\x7e]/g, '')
+    .slice(0, MAX_LABEL_LENGTH)
+}
+
+/**
+ * Snapshot the whitelisted counters into a flat `Record<string, number>`.
+ *
+ * Keys are the family name with the `mipham_code_` prefix and `_total` suffix
+ * stripped, plus the label value when there is one:
+ *   `mipham_code_cli_invocations_total`              → `cli_invocations`
+ *   `mipham_code_tool_calls_total{tool_name="Bash"}` → `tool_calls.Bash`
+ *
+ * Label cardinality: `tool_name` is closed by construction — there are only as
+ * many tool names as the registry declares. `command_name` is **not**: it comes
+ * from user input, so the caller is responsible for collapsing unrecognised
+ * names (see `commandLabelFor` in `ui/commands.ts`). `MAX_LABEL_LENGTH` below
+ * truncates a value, it does not bound how many keys there are.
+ */
+export function snapshotCounters(): Record<string, number> {
+  const metrics = getMetrics()
+  const { counters } = metrics.toJSON() as { counters: CounterJson[] }
+  const out: Record<string, number> = {}
+
+  for (const counter of counters) {
+    const family = counter.name
+    if (!(COUNTER_WHITELIST as readonly string[]).includes(family)) continue
+
+    const short = family.replace(/^mipham_code_/, '').replace(/_total$/, '')
+
+    for (const series of counter.series) {
+      const value = firstLabelValue(series.labels)
+      const key = value ? `${short}.${value}` : short
+      out[key] = (out[key] ?? 0) + series.value
+    }
+  }
+
+  return out
+}
+
+/** `darwin/arm64`, `linux/x64`, … — coarse platform identity, no hostname. */
+function platformTag(): string {
+  return `${process.platform}/${process.arch}`
+}
+
+export interface SessionMeta {
+  installId: string
+  startedAt: number
+  endedAt: number
+  crashed: boolean
+}
+
+/**
+ * The `session` event: one per CLI launch, formed at exit.
+ *
+ * Contains counters and coarse environment facts only. It never carries
+ * conversation content, prompts, file contents, paths, user names, hostnames,
+ * API keys, or environment variable values.
+ */
+export function buildSessionEvent(meta: SessionMeta, now: Date = new Date()): QueuedEvent {
+  return {
+    id: randomUUID(),
+    kind: 'session',
+    payload: {
+      installId: meta.installId,
+      schemaVersion: SCHEMA_VERSION,
+      occurredAt: now.toISOString(),
+      appVersion: PACKAGE_VERSION,
+      runtime: runtimeTag(),
+      platform: platformTag(),
+      sessionDurationMs: Math.max(0, meta.endedAt - meta.startedAt),
+      crashed: meta.crashed,
+      counters: snapshotCounters(),
+    },
+  }
+}

package/src/telemetry/queue.ts

@@ -0,0 +1,95 @@
+import { existsSync, mkdirSync, readFileSync } from 'node:fs'
+import { join } from 'node:path'
+import { atomicWriteFileSync } from '../shared/atomic-write'
+import { telemetryDir } from './consent'
+
+/**
+ * Local queue of telemetry events awaiting upload.
+ *
+ * Every operation here is **synchronous**, and that is a requirement, not a
+ * convenience: the session payload is written from inside
+ * `process.on('exit')`, which cannot await async work. Every other exit-path
+ * write in the repo is synchronous for the same reason (`persistSession` in
+ * `index.tsx`, `EffectivenessTracker.persist()`).
+ *
+ * Sending is therefore decoupled from collecting: events are queued at exit and
+ * uploaded on the *next* startup, where async is allowed.
+ */
+
+/** Entries kept before the oldest are dropped. Bounds disk use on a machine that can never reach an endpoint. */
+export const QUEUE_MAX_ENTRIES = 100
+
+export interface QueuedEvent {
+  /** Stable per-event id, used to acknowledge a successful upload. */
+  id: string
+  kind: 'session' | 'crash'
+  payload: Record<string, unknown>
+}
+
+export function queuePath(): string {
+  return join(telemetryDir(), 'queue.jsonl')
+}
+
+/**
+ * Read the queue. A missing file is an empty queue; an unparsable *line* is
+ * skipped rather than thrown, so one truncated write can never wedge every
+ * future session.
+ */
+export function readQueue(): QueuedEvent[] {
+  const path = queuePath()
+  if (!existsSync(path)) return []
+
+  let raw: string
+  try {
+    raw = readFileSync(path, 'utf-8')
+  } catch {
+    return []
+  }
+
+  const events: QueuedEvent[] = []
+  for (const line of raw.split('\n')) {
+    const trimmed = line.trim()
+    if (!trimmed) continue
+    try {
+      const parsed = JSON.parse(trimmed) as QueuedEvent
+      if (parsed && typeof parsed === 'object' && typeof parsed.id === 'string') events.push(parsed)
+    } catch {
+      /* skip the damaged line, keep the rest */
+    }
+  }
+  return events
+}
+
+/**
+ * Replace the queue wholesale, atomically.
+ *
+ * Capacity is enforced by dropping the *oldest* entries — the newest events
+ * describe the current version, which is the version worth hearing about.
+ * Silent: a queue write must never surface as a user-visible error, and must
+ * never take down an exit path.
+ */
+export function writeQueue(events: QueuedEvent[]): void {
+  try {
+    const kept = events.length > QUEUE_MAX_ENTRIES ? events.slice(-QUEUE_MAX_ENTRIES) : events
+    const body = kept.map((e) => JSON.stringify(e)).join('\n')
+    // atomicWriteFileSync does not create parents (same as the settings writer,
+    // which mkdirs first) — without this the queue silently never materialises
+    // on a fresh machine, where ~/.mipham/telemetry/ does not exist yet.
+    mkdirSync(telemetryDir(), { recursive: true })
+    atomicWriteFileSync(queuePath(), body.length > 0 ? body + '\n' : '', { mode: 0o600 })
+  } catch {
+    /* best-effort by design */
+  }
+}
+
+/** Append one event, dropping the oldest if the queue is at capacity. */
+export function enqueueSync(event: QueuedEvent): void {
+  writeQueue([...readQueue(), event])
+}
+
+/** Drop events whose ids are no longer wanted (i.e. they uploaded successfully). */
+export function ackQueue(ids: Iterable<string>): void {
+  const done = new Set(ids)
+  if (done.size === 0) return
+  writeQueue(readQueue().filter((e) => !done.has(e.id)))
+}

package/src/telemetry/redact.ts

@@ -0,0 +1,127 @@
+import { createHash } from 'node:crypto'
+import { homedir } from 'node:os'
+
+/**
+ * Redaction for crash reports.
+ *
+ * Nothing in this module is reusable from the existing scrubbers: the four
+ * families in the repo (`credential-masker/`, `security/gate.ts`,
+ * `shared/sanitize.ts`, `skills/sanitizer.ts`) all match *credential shapes* —
+ * token prefixes, JWTs, `sk-ant-…`. None of them removes a user name out of a
+ * path. The only home→`~` helper is `ui/chat.tsx` `displayCwd()`, which is
+ * unexported, has zero call sites, and only ever looks at `process.cwd()` — it
+ * cannot touch a path inside an error object or a stack frame.
+ *
+ * So the guarantee below has to be carried by tests, not by reuse.
+ */
+
+/** Frames kept by default. `Error.stackTraceLimit` is 10; we allow headroom. */
+export const MAX_STACK_FRAMES = 15
+
+/** Marker substituted for the working directory — hides the project name. */
+const CWD_MARKER = '<cwd>'
+
+/** Marker substituted for the home directory. */
+const HOME_MARKER = '~'
+
+/**
+ * Marker substituted for the first directory segment under home.
+ *
+ * Home replacement alone still discloses the user's own naming: a frame in
+ * `~/acme-secret-merger-2026/src/a.ts` would render as exactly that. The
+ * data dictionary promises no project names, so the segment right after `~` is
+ * collapsed too. Structure and the frame's own file name survive — which is
+ * what makes a frame useful — but the user's label for a directory does not.
+ */
+const DIR_MARKER = '<dir>'
+
+function escapeRegExp(s: string): string {
+  return s.replace(/[.*+?^${}()|[\]\\]/g, '\\$&')
+}
+
+/**
+ * Replace absolute home/cwd paths with their markers, anywhere in the string.
+ *
+ * Order matters and is not arbitrary: cwd is normally *inside* home, so
+ * replacing home first would leave `~/proj/src/a.ts` — which leaks the project
+ * directory name. Replacing cwd first yields `<cwd>/src/a.ts`, which does not.
+ * This ordering is asserted by a test.
+ *
+ * Paths that are neither under cwd nor under home are left alone. Those are
+ * system/package locations (e.g. `/usr/local/lib/node_modules/…`) that contain
+ * no user data, and keeping them is what makes a frame useful for debugging.
+ */
+export function redactText(input: string, cwd?: string): string {
+  let out = input
+
+  if (cwd && cwd.length > 1) {
+    out = out.replace(new RegExp(escapeRegExp(cwd), 'g'), CWD_MARKER)
+  }
+
+  let home = ''
+  try {
+    home = homedir()
+  } catch {
+    /* homedir() can throw when neither HOME nor the passwd entry resolves */
+  }
+  if (home && home.length > 1) {
+    out = out.replace(new RegExp(escapeRegExp(home), 'g'), HOME_MARKER)
+  }
+
+  // Collapse the first segment after `~` (both separators — Windows stacks use
+  // backslashes) so a user-chosen directory name is not disclosed. The matched
+  // separator is echoed back rather than normalised, so a Windows path does not
+  // come out with mixed separators.
+  out = out.replace(
+    /~([\\/])[^\\/\s:)]+/g,
+    (_match, sep: string) => `${HOME_MARKER}${sep}${DIR_MARKER}`,
+  )
+
+  return out
+}
+
+export interface RedactedStack {
+  /** Redacted frame lines, truncated to `maxFrames`. */
+  frames: string[]
+  /** Frame count *before* truncation — truncation loses data, this bounds the loss. */
+  frameCount: number
+}
+
+/**
+ * Extract and redact the frame lines of a V8 stack.
+ *
+ * The first line of a stack is `"TypeError: <message>"` — it is dropped
+ * outright, never redacted, because the message routinely embeds paths and user
+ * data. `crash.ts` sends only `hashMessage(error.message)` instead.
+ */
+export function redactStack(
+  stack: string,
+  opts: { cwd?: string; maxFrames?: number } = {},
+): RedactedStack {
+  const { cwd = process.cwd(), maxFrames = MAX_STACK_FRAMES } = opts
+
+  const frameLines = stack.split('\n').filter((line) => /^\s*at\s/.test(line))
+  const redacted = frameLines.map((line) => redactText(line.trim(), cwd))
+
+  return {
+    frames: redacted.slice(0, maxFrames),
+    frameCount: frameLines.length,
+  }
+}
+
+/**
+ * sha256 of the error message, first 16 hex chars.
+ *
+ * Only the digest is reportable. The plaintext message is not — same reason the
+ * stack's first line is dropped.
+ */
+export function hashMessage(message: string): string {
+  return createHash('sha256').update(message).digest('hex').slice(0, 16)
+}
+
+/** Runtime tag for the session payload, e.g. `bun@1.2` / `node@22`. */
+export function runtimeTag(): string {
+  const versions = process.versions as Record<string, string | undefined>
+  if (versions.bun) return `bun@${versions.bun}`
+  return `node@${(versions.node ?? '0').split('.')[0]}`
+}

package/src/telemetry/transport.ts

@@ -0,0 +1,81 @@
+import { fetchWithRetry } from '../providers/fetch-utils'
+import { ackQueue, readQueue, type QueuedEvent } from './queue'
+
+/**
+ * Upload queued events.
+ *
+ * Runs at *startup*, not at exit: `process.on('exit')` cannot await async work,
+ * so collecting and sending are decoupled — the session queue is written
+ * synchronously at exit and drained here on the next launch. Same shape as the
+ * existing startup update check (`shared/update.ts`), which is likewise
+ * fire-and-forget.
+ *
+ * Every failure is silent and leaves the event queued for the next attempt. A
+ * telemetry endpoint being unreachable must never be visible to the user.
+ */
+
+/** Per-request budget. Short: this runs alongside startup, not during it. */
+const REQUEST_TIMEOUT_MS = 10_000
+
+export interface FlushResult {
+  sent: number
+  failed: number
+}
+
+/**
+ * Drain the queue to `endpoint`.
+ *
+ * Returns without sending anything when the endpoint is empty — which is the
+ * shipped default, so an unconfigured install performs **zero** network calls.
+ */
+export async function flushQueue(
+  endpoint: string,
+  opts: { fetchImpl?: typeof fetch; events?: QueuedEvent[] } = {},
+): Promise<FlushResult> {
+  if (!endpoint) return { sent: 0, failed: 0 }
+
+  const events = opts.events ?? readQueue()
+  if (events.length === 0) return { sent: 0, failed: 0 }
+
+  const sent: string[] = []
+  let failed = 0
+
+  for (const event of events) {
+    try {
+      const response = await fetchWithRetry(
+        endpoint,
+        {
+          method: 'POST',
+          headers: { 'Content-Type': 'application/json' },
+          body: JSON.stringify(event),
+        },
+        { timeout: REQUEST_TIMEOUT_MS, maxRetries: 2, baseDelay: 1000 },
+      )
+
+      // 4xx means we are sending something the endpoint will never accept —
+      // retrying forever would wedge the queue behind a permanently bad event.
+      // Drop it on the floor rather than block every later event.
+      if (response.ok || (response.status >= 400 && response.status < 500)) {
+        sent.push(event.id)
+      } else {
+        failed++
+      }
+    } catch {
+      failed++
+    }
+  }
+
+  ackQueue(sent)
+  return { sent: sent.length, failed }
+}
+
+/**
+ * Fire-and-forget startup flush. Never rejects, never blocks the caller, and
+ * never surfaces an error — the caller does not await it.
+ */
+export function flushQueueInBackground(endpoint: string): void {
+  if (!endpoint) return
+  void flushQueue(endpoint).catch(() => {
+    /* best-effort by design */
+  })
+}

package/src/tools/agent/workflow.ts

@@ -1,5 +1,6 @@
 import type { ToolDefinition } from '../../shared/index.ts'
 import { runWorkflow } from '../../workflow/runtime'
+import { workflowScriptDir } from '../../core/paths.ts'
 import type { QueryEngine } from '../../core/engine'
 
 export const workflowTool: ToolDefinition = {
@@ -108,10 +109,11 @@ export const workflowTool: ToolDefinition = {
       )
 
       // Persist last-run state for /workflow save
+      let persistWarning = ''
       try {
         const { existsSync, mkdirSync, writeFileSync } = await import('node:fs')
         const { join } = await import('node:path')
-        const workflowsDir = join(process.cwd(), '.claude', 'workflows')
+        const workflowsDir = workflowScriptDir(process.cwd())
         if (!existsSync(workflowsDir)) {
           mkdirSync(workflowsDir, { recursive: true })
         }
@@ -120,8 +122,13 @@ export const workflowTool: ToolDefinition = {
           JSON.stringify({ runId, script, timestamp: new Date().toISOString() }),
           'utf-8',
         )
-      } catch {
-        // best-effort — don't fail the workflow if state persistence fails
+      } catch (err) {
+        // Persistence stays best-effort — the workflow itself succeeded, so a
+        // disk error must not fail it. But it must not be *silent* either:
+        // swallowing this made the next `/workflow save` report "No recent
+        // workflow run found" while the script sat intact in
+        // ~/.mipham/workflows/<runId>/script.js.
+        persistWarning = `\n\n⚠️  Could not persist last-run state for /workflow save: ${String(err)}`
       }
 
       let content = `Workflow ${runId} completed.\n\n`
@@ -130,7 +137,7 @@ export const workflowTool: ToolDefinition = {
       }
       content += `Result:\n${typeof result === 'string' ? result : JSON.stringify(result, null, 2)}`
 
-      return { success: true, content }
+      return { success: true, content: content + persistWarning }
     } catch (err) {
       return {
         success: false,

package/src/tools/exec/bash.ts

@@ -2,6 +2,7 @@ import type { ToolDefinition, CredentialMaskingConfig } from '../../shared/index
 import { sanitizeCommand } from '../../shared/sanitize.ts'
 import { DANGEROUS_GIT_PATTERNS } from './git.ts'
 import { isUncOrDevicePath } from '../../security/path.ts'
+import { findWorktreeMarker } from '../../core/paths.ts'
 import type { Service } from '../../vajra'
 import { toolKey } from '../seam'
 import { withValidation } from '../validation'
@@ -334,9 +335,10 @@ export function createBashTool(credentialConfig?: CredentialMaskingConfig): Tool
       const timeout = Math.min((params.timeout as number) || 120_000, 600_000)
 
       // P0-4: Worktree isolation — block cd escape attempts
-      const WORKTREE_MARKER = '.claude/worktrees/'
-      if (ctx.cwd.includes(WORKTREE_MARKER)) {
-        const worktreeRoot = ctx.cwd.substring(0, ctx.cwd.indexOf(WORKTREE_MARKER))
+      // 标记取自 core/paths.ts：新目录与历史 .claude/worktrees/ 都认，
+      // 隔离度只增不减（只认新前缀会让旧工作树失去保护）。
+      const worktreeMarker = findWorktreeMarker(ctx.cwd)
+      if (worktreeMarker) {
         // Detect cd to absolute paths outside the worktree
         const cdEscapePattern = /\bcd\s+(?:"([^"]+)"|'([^']+)'|([^\s;|&]+))/
         const cdMatch = command.match(cdEscapePattern)
@@ -346,7 +348,7 @@ export function createBashTool(credentialConfig?: CredentialMaskingConfig): Tool
           const resolved = target.startsWith('/')
             ? target
             : `${ctx.cwd}/${target}`.replace(/\/\.\//g, '/')
-          if (!resolved.startsWith(ctx.cwd) && !resolved.startsWith(worktreeRoot + '/')) {
+          if (!resolved.startsWith(ctx.cwd) && !resolved.startsWith(worktreeMarker.root + '/')) {
             return {
               success: false,
               content: '',