@miphamai/cli 0.81.7 → 0.81.9

package/src/security/gate.ts

@@ -1,3 +1,21 @@
+/**
+ * SecurityGate — 判定函数集合。
+ *
+ * ⚠️ **本文件不是一个已生效的安全门。** 它是一个**判定函数的库**，其中只有一部分
+ * 被接进生产路径。别把「文件被 import」读成「这些检查在生产里跑」：
+ *
+ * - `redactCredentialLeak` — **已接线**（`core/behavior-tasks.ts`、
+ *   `core/credential-masker/output-scrub.ts`）。
+ * - 其余三个 `check*` 方法 — **生产零调用点**，唯一消费者是
+ *   `test/security/penetration/`。因此 CI 的 `penetration-test` job 全绿只说明
+ *   **这些判定函数被自己测过**，不说明生产有这三道防线。三条各自的去路（为什么不接、
+ *   生产另有哪条防线）登记在
+ *   `test/integrity/unwired-disposition.test.ts` 的 `KEPT_UNWIRED_METHODS` 里，
+ *   由机器两向强制（存在 + 生产零引用）。
+ *
+ * 想让某条真正生效时：先读那条登记的理由，再决定是接线还是改判据 —— 直接 `import`
+ * 进来调是最容易的一步，也是最容易多出一道更弱、更难维护、判据还与被取代者不一致的门。
+ */
 export interface GateResult {
   blocked: boolean
   reason?: string

package/src/security/path.ts

@@ -7,6 +7,24 @@ import { realpathSync, existsSync } from 'node:fs'
  */
 const BLOCKED_PATHS = ['/etc', '/proc', '/sys', '/dev', '/boot', '/root']
 
+/**
+ * The same list in canonical form.
+ *
+ * The check below compares against an already-resolved path, so the entries
+ * must be resolved too: on macOS `/etc` is a symlink to `/private/etc`, and
+ * comparing `/private/etc/x` against the literal `/etc` never matched — the
+ * check was dead there. Entries that don't exist yet keep their literal form
+ * (there is nothing to resolve, and a later `realpathSync` of the same path
+ * cannot produce a different spelling).
+ */
+const BLOCKED_CANONICAL: string[] = BLOCKED_PATHS.map((p) => {
+  try {
+    return existsSync(p) ? realpathSync(p) : p
+  } catch {
+    return p
+  }
+})
+
 /**
  * Windows UNC paths and NT/Win32/DOS device-namespace prefixes.
  *
@@ -86,7 +104,7 @@ export function resolveSafe(cwd: string, inputPath: string): string {
   }
 
   // Check 2: must not target sensitive system directories
-  for (const blocked of BLOCKED_PATHS) {
+  for (const blocked of BLOCKED_CANONICAL) {
     if (canonical === blocked || canonical.startsWith(blocked + '/')) {
       throw new Error(
         `Path rejected: "${inputPath}" resolves to a protected system directory (${blocked}).`,
@@ -113,8 +131,13 @@ function findExistingParent(p: string): string | undefined {
 
 /**
  * Check if `child` is within `parent` (or equal to it).
+ *
+ * Compares path segments, not string prefixes: `/a/b-evil` is NOT within
+ * `/a/b`. Both sides are expected to be resolved (no `..`, no trailing slash
+ * beyond the root). The trailing-slash normalization below is for callers that
+ * hand in an unresolved string such as `/proj/src/`.
  */
-function isWithin(child: string, parent: string): boolean {
+export function isWithin(child: string, parent: string): boolean {
   // Normalize trailing slashes for comparison
   const c = child.endsWith('/') ? child.slice(0, -1) : child
   const p = parent.endsWith('/') ? parent.slice(0, -1) : parent

package/src/shared/arg-validation.ts

@@ -29,7 +29,42 @@ const KNOWN_COMMANDS = [
   'help',
 ]
 
-const KNOWN_FLAGS = ['--version', '-v', '-V', '--help', '-h', '--dump-config', '--safe-mode']
+const KNOWN_FLAGS = [
+  '--version',
+  '-v',
+  '-V',
+  '--help',
+  '-h',
+  '--dump-config',
+  '--safe-mode',
+  '--resume',
+]
+
+/**
+ * Flags that consume the **next** argument as their value. That value is not a
+ * command, so it must not go through the unknown-command check: with
+ * `mipham --resume "my session"` the old scan found the first token that didn't
+ * start with `-`, concluded the user had typed a command, and reported
+ * `Unknown command: mipham my session` — blaming the session name and never
+ * mentioning `--resume`, the one argument that was actually wrong.
+ */
+const VALUE_FLAGS = ['--resume']
+
+/**
+ * The first token that would be read as a command, skipping flags and the values
+ * of value-taking flags. `null` when there is none.
+ */
+function firstPositional(args: string[]): string | null {
+  for (let i = 0; i < args.length; i++) {
+    const arg = args[i]!
+    if (arg.startsWith('-')) {
+      if (VALUE_FLAGS.includes(arg)) i++ // its value is not a command
+      continue
+    }
+    return arg
+  }
+  return null
+}
 
 /** Levenshtein edit distance between two strings. */
 function levenshtein(a: string, b: string): number {
@@ -64,7 +99,7 @@ function closest(target: string, candidates: string[], maxDist = 3): string[] {
  * command is present, instead of falling through to the interactive CLI.
  */
 export function detectUnknownArgument(args: string[]): UnknownArgument | null {
-  const firstArg = args.find((a) => !a.startsWith('-'))
+  const firstArg = firstPositional(args)
   if (firstArg && !KNOWN_COMMANDS.includes(firstArg)) {
     return { kind: 'command', arg: firstArg, suggestions: closest(firstArg, KNOWN_COMMANDS) }
   }

package/src/shared/atomic-write.ts

@@ -1,17 +1,40 @@
-import { writeFileSync, renameSync } from 'node:fs'
+import { writeFileSync, renameSync, unlinkSync } from 'node:fs'
+import { randomUUID } from 'node:crypto'
 
 /**
- * Write a file atomically: write to a same-directory `.tmp` file, then rename
+ * Write a file atomically: write to a same-directory temp file, then rename
  * over the target. Same-filesystem rename is atomic, so a crash or kill
  * mid-write can never leave a truncated/corrupt file — readers see either the
  * old or the new content, never a partial write.
+ *
+ * The temp name carries the pid and a random suffix rather than being a fixed
+ * `path + '.tmp'`. Several callers write to *shared* locations (the telemetry
+ * queue on every process exit, skill usage, the CRSI ledger), so two sessions or
+ * daemon workers on one machine can be inside this function for the same path at
+ * the same time. With one shared temp name that interleaving loses a write (the
+ * first rename moves the *second* writer's content into place) and then throws
+ * ENOENT on the other writer's rename — in a function whose whole point is that
+ * the target is never observed half-written. Same directory is still required:
+ * rename is only atomic within a filesystem.
  */
 export function atomicWriteFileSync(
   path: string,
   content: string,
   options: { mode?: number } = {},
 ): void {
-  const tmp = path + '.tmp'
-  writeFileSync(tmp, content, { encoding: 'utf-8', mode: options.mode ?? 0o600 })
-  renameSync(tmp, path)
+  const tmp = `${path}.${process.pid}.${randomUUID().slice(0, 8)}.tmp`
+  try {
+    writeFileSync(tmp, content, { encoding: 'utf-8', mode: options.mode ?? 0o600 })
+    renameSync(tmp, path)
+  } catch (err) {
+    // Clean up on the failure path: a fixed temp name used to be overwritten by
+    // the next writer, but unique names mean every abandoned write would leave
+    // its own orphan forever — nothing else ever sweeps this directory.
+    try {
+      unlinkSync(tmp)
+    } catch {
+      // Already renamed away (or never created) — nothing to clean.
+    }
+    throw err
+  }
 }

package/src/shared/package-info.ts

@@ -9,7 +9,7 @@
 export const PACKAGE_NAME = '@miphamai/cli' as const
 
 /** 当前发布版本 */
-export const PACKAGE_VERSION = '0.81.7' as const
+export const PACKAGE_VERSION = '0.81.9' as const
 
 /** npm install 全局安装命令 */
 export const NPM_INSTALL_COMMAND = `npm install -g ${PACKAGE_NAME}` as const

package/src/shared/sanitize.ts

@@ -10,14 +10,39 @@
  * to ASCII equivalents for permission checks.
  */
 
-const DANGEROUS_UNICODE = /[​‌‍‎‏‪‫‬‭‮⁠⁦⁧⁨⁩]/g
+/**
+ * Invisible/formatting code points that can hide content.
+ *
+ * Written as `\u{…}` escapes (hence the `u` flag) so the set is *auditable*: the
+ * same list spelled as literal characters is unreviewable in a diff, which is how
+ * the tag block (U+E0000–E007F) went missing while every neighbouring family was
+ * already covered.
+ *
+ * Deliberately **not** included — variation selectors (U+FE00–FE0F):
+ * - they are load-bearing in emoji (e.g. U+2764 U+FE0F), so stripping them
+ *   visibly changes text;
+ * - `sanitizeParams` feeds `tool.execute` (`tools/validation.ts`), so the strip is
+ *   applied to what tools *write to disk*, not only to what gets pattern-matched.
+ *   Adding them here would silently rewrite file contents.
+ *
+ * The tag block (U+E0000–E007F) *is* included: it is invisible in itself, and the
+ * only sequences that use it (subdivision flags, e.g. U+1F3F4 + a tag run) degrade
+ * to the bare black flag — which renders the same.
+ */
+const DANGEROUS_UNICODE =
+  /[\u{061C}\u{115F}-\u{1160}\u{180E}\u{200B}-\u{200F}\u{202A}-\u{202E}\u{2060}\u{2066}-\u{2069}\u{3164}\u{FEFF}\u{FFA0}\u{E0000}-\u{E007F}]/gu
 
 /**
  * Strip dangerous invisible Unicode characters from a string.
  * - Zero-width: U+200B (ZWSP), U+200C (ZWNJ), U+200D (ZWJ), U+200E/F (LTR/RTL marks)
- * - Bidi controls: U+202A-E, U+2066-9
+ * - Bidi controls: U+202A-E, U+2066-9, U+061C (Arabic letter mark)
  * - Word joiner: U+2060
  * - BOM: U+FEFF
+ * - Invisible fillers: U+115F/1160 (Hangul choseong/jungseong), U+3164 (Hangul),
+ *   U+FFA0 (halfwidth Hangul), U+180E (Mongolian vowel separator)
+ * - Tag characters: U+E0000-E007F (deprecated, invisible, hide arbitrary text)
+ *
+ * See `DANGEROUS_UNICODE` for which *adjacent* families are left in place, and why.
  */
 export function stripDangerousUnicode(input: string): string {
   if (!input) return input

package/src/shared/types.ts

@@ -138,6 +138,15 @@ export interface StreamChunk {
   inputTokens?: number
   /** API-reported output token count (type: 'usage'). */
   outputTokens?: number
+  /**
+   * The provider stopped because it hit the output token ceiling
+   * (OpenAI `finish_reason: 'length'` / Anthropic `stop_reason: 'max_tokens'`).
+   * Set **only when true** — absent on every normal stop, so the success path
+   * stays byte-identical. Without it a truncated turn is indistinguishable
+   * from a turn the model chose to end: the provider emits its terminal stop
+   * either way, and tool calls cut off mid-arguments are dropped silently.
+   */
+  truncated?: boolean
 }
 
 // ── Config Types ──
@@ -267,6 +276,14 @@ export interface HookDefinition {
 
 export interface HookContext {
   event: HookEvent
+  /**
+   * The workspace this invocation is for.
+   *
+   * Stamped by `HookEngine` from its own cwd; hooks read it out of stdin and run
+   * in it. It is the *session's* cwd, which is not `process.cwd()` in the daemon
+   * (many sessions, one process).
+   */
+  cwd?: string
   toolName?: string
   toolInput?: Record<string, unknown>
   toolResult?: ToolResult

package/src/shared/update.ts

@@ -26,10 +26,20 @@ const REGISTRIES = [
 export interface UpdateCheck {
   /** Current installed version */
   current: string
-  /** Latest version on npm */
+  /** Latest version on npm — only meaningful when `checked` is true */
   latest: string
   /** Whether an update is available */
   available: boolean
+  /**
+   * Whether the registry was actually reached.
+   *
+   * `false` means `latest`/`available` carry **no information**: the check
+   * failed and `latest` is just `current`. Without this field the two states
+   * are the same value — "we asked, you're current" and "we couldn't ask" both
+   * read as `available: false`, which is how `/upgrade` came to print
+   * "Already up to date" while offline.
+   */
+  checked: boolean
 }
 
 /**
@@ -101,15 +111,19 @@ export function checkForUpdates(): UpdateCheck {
   const current = getCurrentVersion()
   let latest = current
   let available = false
+  let checked = false
 
   try {
     latest = fetchLatestVersion()
     available = compareVersions(latest, current) > 0
+    checked = true
   } catch {
-    // If we can't reach npm, treat as up-to-date (don't alarm the user)
+    // Registry unreachable — stay quiet rather than alarm, but do **not** claim
+    // we are current: `checked: false` is what lets `/upgrade` say "couldn't
+    // check" instead of "Already up to date".
   }
 
-  return { current, latest, available }
+  return { current, latest, available, checked }
 }
 
 /**
@@ -222,13 +236,16 @@ export async function checkForUpdatesAsync(): Promise<UpdateCheck> {
   const current: string = PACKAGE_VERSION
   let latest: string = current
   let available = false
+  let checked = false
   try {
     latest = await fetchLatestVersionAsync()
     available = compareVersions(latest, current) > 0
+    checked = true
   } catch {
-    // offline → treat as up-to-date (don't alarm the user)
+    // offline → don't alarm the user, but don't report `available: false` as if
+    // it were an answer either (`checked` is what keeps the two apart)
   }
-  return { current, latest, available }
+  return { current, latest, available, checked }
 }
 
 /**

package/src/tools/agent/agent.ts

@@ -88,6 +88,9 @@ export const agentTool: ToolDefinition = {
         type: agentType,
         agentDef,
         runInBackground,
+        // Hand the caller's services down: the sub-agent keeps running the same
+        // skills/agents/artifacts, and only the fields it owns are overridden.
+        toolContext: ctx,
       })
 
       // If background execution, also register in the task system for Task tool integration

package/src/tools/artifact/artifact.ts

@@ -1,7 +1,8 @@
 import { writeFileSync, mkdirSync, existsSync } from 'node:fs'
 import { join } from 'node:path'
 import type { ToolDefinition } from '../../shared/index.ts'
-import { ARTIFACTS_DIR, ARTIFACT_MAX_SIZE } from '../../shared/constants'
+import { ARTIFACT_MAX_SIZE } from '../../shared/constants'
+import { artifactsRoot } from '../../artifacts/paths'
 import { addToManifest, readManifest, archiveVersion } from '../../artifacts/manifest'
 
 const NAME_PATTERN = /^[a-z0-9][a-z0-9-]*[a-z0-9]$/
@@ -57,8 +58,10 @@ export const artifactTool: ToolDefinition = {
       }
     }
 
-    // Determine output paths
-    const baseDir = join(ctx.cwd, ARTIFACTS_DIR)
+    // Determine output paths — the server's root, the manifest's home and this
+    // directory are one and the same; computing it here is what made the URL a
+    // guaranteed 404 before.
+    const baseDir = artifactsRoot(ctx.cwd)
     const sessionDir = join(baseDir, ctx.sessionId)
     mkdirSync(sessionDir, { recursive: true })
 
@@ -100,7 +103,7 @@ export const artifactTool: ToolDefinition = {
     const prev = manifestPre.artifacts.find((a) => a.name === name && a.sessionId === ctx.sessionId)
     const versionCount = prev?.versionCount || (isUpdate ? 1 : undefined)
 
-    addToManifest(
+    const { quarantined } = addToManifest(
       baseDir,
       {
         name,
@@ -124,6 +127,12 @@ export const artifactTool: ToolDefinition = {
     const galleryUrl = port ? `http://localhost:${port}` : undefined
     const versionLine = archivedVersion ? `   Prev archived as: ${archivedVersion}` : ''
     const galleryLine = galleryUrl ? `Gallery: ${galleryUrl}` : ''
+    // The index was unreadable and got moved aside, so this publish started from
+    // nothing: say it here, or the user reads "saved" and never learns that the
+    // rest of the index is now a file next to it.
+    const warnLine = quarantined
+      ? `   ⚠️  Index was unreadable; previous index kept at ${quarantined}`
+      : ''
 
     return {
       success: true,
@@ -132,6 +141,7 @@ export const artifactTool: ToolDefinition = {
         `   URL:  ${url}`,
         `   Size: ${size.toLocaleString()} bytes`,
         versionLine,
+        warnLine,
         galleryLine,
         '',
         `Open in browser: /artifact open ${name}`,

package/src/tools/exec/bash.ts

@@ -1,7 +1,9 @@
+import { resolve } from 'node:path'
+import { existsSync } from 'node:fs'
 import type { ToolDefinition, CredentialMaskingConfig } from '../../shared/index.ts'
 import { sanitizeCommand } from '../../shared/sanitize.ts'
 import { DANGEROUS_GIT_PATTERNS } from './git.ts'
-import { isUncOrDevicePath } from '../../security/path.ts'
+import { isUncOrDevicePath, isWithin } from '../../security/path.ts'
 import { findWorktreeMarker } from '../../core/paths.ts'
 import type { Service } from '../../vajra'
 import { toolKey } from '../seam'
@@ -308,6 +310,36 @@ function parseErrorLocations(stderr: string): ErrorLocation[] {
   return unique.slice(0, 10)
 }
 
+/**
+ * 找出命令里第一个 `cd` 到工作区之外的**目标原样字符串**（供错误文案用）；
+ * 无逃逸返回 null。判定边界是 `worktreeRoot`（项目根），不是 `cwd` ——
+ * 既有行为即如此：`cd <项目内其它目录>` 放行（见 test/tools/exec.test.ts
+ * 「allows cd inside the project from a .mipham worktree」）。
+ *
+ * 此前三个缺陷，其中两个是活的绕过：
+ *  - 相对路径用字符串拼接而非 `resolve`：`cd ../../../..` 拼出来的串仍以
+ *    cwd 开头，于是被当成「在区内」放行 —— **活绕过**；
+ *  - `command.match(...)` 非全局，只看第一个 `cd`，`cd sub && cd /etc` 的
+ *    后半段完全不检查 —— **活绕过**；
+ *  - 归属判定用 `resolved.startsWith(cwd)` 字符串前缀比较，`/proj/w1-evil`
+ *    会被判成「在 /proj/w1 里」；它只被 root 那个析取项兜住才没显形，故一并
+ *    改成按路径分段比较的 `isWithin`。
+ */
+export function resolveWorktreeEscape(
+  cwd: string,
+  worktreeRoot: string,
+  command: string,
+): string | null {
+  const cdRe = /\bcd\s+(?:"([^"]+)"|'([^']+)'|([^\s;|&]+))/g
+  for (const m of command.matchAll(cdRe)) {
+    const target = m[1] ?? m[2] ?? m[3]
+    if (!target) continue
+    const resolved = resolve(cwd, target)
+    if (!isWithin(resolved, cwd) && !isWithin(resolved, worktreeRoot)) return target
+  }
+  return null
+}
+
 export function createBashTool(credentialConfig?: CredentialMaskingConfig): ToolDefinition {
   return {
     name: 'Bash',
@@ -332,30 +364,36 @@ export function createBashTool(credentialConfig?: CredentialMaskingConfig): Tool
     },
     async execute(params, ctx) {
       const command = params.command as string
-      const timeout = Math.min((params.timeout as number) || 120_000, 600_000)
+      const requestedTimeout = params.timeout as number | undefined
+      // A negative timeout is not "no timeout". `Math.min(-1 || 120_000, 600_000)` is `-1`,
+      // and `setTimeout(fn, -1)` is clamped to **1 ms** — so the command is group-killed on
+      // the spot and reported as a bare `Exit code 137` (measured with real bun). Node does
+      // warn, but only on stderr, where the model never sees it. Refuse rather than silently
+      // reinterpret; `0`, `NaN` and `undefined` already fall back to the default via `||`.
+      if (typeof requestedTimeout === 'number' && requestedTimeout < 0) {
+        return {
+          success: false,
+          content: '',
+          error:
+            `timeout must not be negative (got ${requestedTimeout}ms). ` +
+            `Omit it for the 120000ms default.`,
+        }
+      }
+      const timeout = Math.min(requestedTimeout || 120_000, 600_000)
 
       // P0-4: Worktree isolation — block cd escape attempts
       // 标记取自 core/paths.ts：新目录与历史 .claude/worktrees/ 都认，
       // 隔离度只增不减（只认新前缀会让旧工作树失去保护）。
       const worktreeMarker = findWorktreeMarker(ctx.cwd)
       if (worktreeMarker) {
-        // Detect cd to absolute paths outside the worktree
-        const cdEscapePattern = /\bcd\s+(?:"([^"]+)"|'([^']+)'|([^\s;|&]+))/
-        const cdMatch = command.match(cdEscapePattern)
-        if (cdMatch) {
-          const target = cdMatch[1] || cdMatch[2] || cdMatch[3] || ''
-          // Resolve relative to cwd
-          const resolved = target.startsWith('/')
-            ? target
-            : `${ctx.cwd}/${target}`.replace(/\/\.\//g, '/')
-          if (!resolved.startsWith(ctx.cwd) && !resolved.startsWith(worktreeMarker.root + '/')) {
-            return {
-              success: false,
-              content: '',
-              error:
-                `Worktree isolation: cannot cd outside worktree directory. ` +
-                `Attempted: ${target}. Use tools within the worktree only.`,
-            }
+        const escapeTarget = resolveWorktreeEscape(ctx.cwd, worktreeMarker.root, command)
+        if (escapeTarget !== null) {
+          return {
+            success: false,
+            content: '',
+            error:
+              `Worktree isolation: cannot cd outside worktree directory. ` +
+              `Attempted: ${escapeTarget}. Use tools within the worktree only.`,
           }
         }
       }
@@ -379,15 +417,42 @@ export function createBashTool(credentialConfig?: CredentialMaskingConfig): Tool
           stdout: 'pipe',
           stderr: 'pipe',
           env: spawnEnv,
+          // Own process group. Required for the group kill below to reach
+          // grandchildren — and for it to target *our* group at all: without
+          // this the child inherits the parent's pgid, so `kill(-pid)` aims at
+          // the wrong group and fails (or, worse, hits the parent's).
+          detached: true,
         })
 
-        const timer = setTimeout(() => proc.kill(), timeout)
-        const rawOutput = await new Response(proc.stdout).text()
+        // Start reading at once — a child that fills the pipe buffer blocks on
+        // write and would then never exit — but do **not** await here: if a
+        // descendant inherits the pipe and outlives the shell, EOF never comes,
+        // and awaiting this before `exited` is what hung the call for good.
+        const stdoutRead = new Response(proc.stdout).text()
+        const stderrRead = new Response(proc.stderr).text()
+
+        // Remember whether we were the ones who killed it: the exit code is 137 and
+        // stderr is empty either way, so the model cannot tell a timeout from the
+        // command's own failure (measured with real bun — both are `Exit code 137: `).
+        let timedOut = false
+        const timer = setTimeout(() => {
+          timedOut = true
+          killProcessGroup(proc.pid)
+        }, timeout)
         const exitCode = await proc.exited
         clearTimeout(timer)
 
+        // The shell is gone, so only a pipe-holding descendant can still be
+        // holding these up. Released by the group kill, at most once.
+        let released = false
+        const release = () => {
+          if (released) return
+          released = true
+          killProcessGroup(proc.pid)
+        }
+        const rawOutput = await settlePipe(stdoutRead, release)
         // Read stderr for violation detection and error reporting
-        const rawStderr = await new Response(proc.stderr).text()
+        const rawStderr = await settlePipe(stderrRead, release)
 
         // ── Credential masking: scrub output ──
         let output = rawOutput
@@ -428,7 +493,9 @@ export function createBashTool(credentialConfig?: CredentialMaskingConfig): Tool
           return {
             success: false,
             content: errorContent,
-            error: `Exit code ${exitCode}: ${stderr.slice(0, 1_000)}`,
+            error: timedOut
+              ? `Command timed out after ${timeout}ms (killed): ${stderr.slice(0, 1_000)}`
+              : `Exit code ${exitCode}: ${stderr.slice(0, 1_000)}`,
           }
         }
 
@@ -438,16 +505,71 @@ export function createBashTool(credentialConfig?: CredentialMaskingConfig): Tool
         }
         return { success: true, content: successContent }
       } catch (err) {
+        // A missing `cwd` and a missing `bash` both surface as the *same*
+        // `ENOENT: no such file or directory, posix_spawn 'bash'` (measured), which reads
+        // as "bash is not installed" and points the model at the wrong root cause. The cwd
+        // is the one we can actually check — so check it, and only claim it when it is
+        // genuinely absent, or a truly missing bash would get relabelled as a bad cwd.
+        const code = (err as NodeJS.ErrnoException | undefined)?.code
         return {
           success: false,
           content: '',
-          error: `Command failed: ${String(err)}`,
+          error:
+            code === 'ENOENT' && !existsSync(ctx.cwd)
+              ? `Working directory does not exist: ${ctx.cwd}`
+              : `Command failed: ${String(err)}`,
         }
       }
     },
   }
 }
 
+/** Grace given to a descendant still holding the output pipe after the shell itself has exited. */
+const PIPE_GRACE_MS = 1_000
+
+/**
+ * Kill a whole process group. `proc.kill()` reaches only the direct child, so a
+ * `bash -c` that spawned its own children leaves them orphaned and unnotified.
+ * The negative pid addresses the group led by that pid, which exists only when
+ * the child was spawned `detached` — verified on this host: without it the
+ * child's pgid is the *parent's* group, and this call fails with ESRCH rather
+ * than reaching the grandchildren.
+ */
+export function killProcessGroup(pid: number | undefined): void {
+  if (pid === undefined || pid <= 0) return
+  try {
+    process.kill(-pid, 'SIGKILL')
+  } catch (err: unknown) {
+    // ESRCH: the group is already gone, which is the normal case when the
+    // command finished on its own. Anything else means a group kill isn't
+    // available here, so fall back to the direct child.
+    if ((err as NodeJS.ErrnoException).code === 'ESRCH') return
+    try {
+      process.kill(pid, 'SIGKILL')
+    } catch {
+      // Already gone.
+    }
+  }
+}
+
+/**
+ * Await an already-started pipe read, but not forever. A descendant that
+ * inherited the pipe keeps EOF from arriving, and that read is what used to
+ * hang the call after the command itself had finished. Once the grace expires,
+ * take the group down — which closes the pipe — and finish the read.
+ */
+async function settlePipe<T>(read: Promise<T>, release: () => void): Promise<T> {
+  let timer: ReturnType<typeof setTimeout> | undefined
+  const stalled = new Promise<null>((resolve) => {
+    timer = setTimeout(() => resolve(null), PIPE_GRACE_MS)
+  })
+  const winner = await Promise.race([read, stalled])
+  clearTimeout(timer)
+  if (winner !== null) return winner
+  release()
+  return read
+}
+
 export const bashToolService: Service = {
   inject: ['credentials'],
   apply(ctx) {

package/src/tools/exec/enter-worktree.ts

@@ -1,5 +1,5 @@
 import type { ToolDefinition } from '../../shared/index.ts'
-import { worktreeRoot } from '../../core/paths.ts'
+import { listsWorktree, worktreeRoot } from '../../core/paths.ts'
 
 export const enterWorktreeTool: ToolDefinition = {
   name: 'EnterWorktree',
@@ -95,7 +95,7 @@ export const enterWorktreeTool: ToolDefinition = {
         stderr: 'pipe',
       })
       const existingWorktrees = await new Response(checkProc.stdout).text()
-      if (existingWorktrees.includes(worktreePath)) {
+      if (listsWorktree(existingWorktrees, worktreePath)) {
         return {
           success: true,
           content:
@@ -126,8 +126,14 @@ export const enterWorktreeTool: ToolDefinition = {
 
       // Create worktree with new branch
       const branchName = `worktree/${name}`
+      // `--` ends git's option parsing. `baseRef` comes from the model and is
+      // otherwise unvalidated, so without it a ref spelled `--force` is read as
+      // an *option*: measured on this machine, `git worktree add -b b <path>
+      // --force` succeeds, while a bogus ref in that same slot is `fatal:
+      // invalid reference`. After `--` git reads it as a ref and rejects
+      // nonsense, which is what a bad base ref should do.
       const proc = Bun.spawn(
-        ['git', 'worktree', 'add', '-b', branchName, worktreePath, resolvedBaseRef],
+        ['git', 'worktree', 'add', '-b', branchName, worktreePath, '--', resolvedBaseRef],
         { cwd, stdout: 'pipe', stderr: 'pipe' },
       )
       const _stdout = await new Response(proc.stdout).text()