@miphamai/cli 0.81.7 → 0.81.9

package/src/tools/exec/exit-worktree.ts

@@ -1,5 +1,5 @@
 import type { ToolDefinition } from '../../shared/index.ts'
-import { worktreeRoots } from '../../core/paths.ts'
+import { listsWorktree, worktreeRoots } from '../../core/paths.ts'
 
 export const exitWorktreeTool: ToolDefinition = {
   name: 'ExitWorktree',
@@ -39,7 +39,10 @@ export const exitWorktreeTool: ToolDefinition = {
     // Validate the path is under a worktree root（新目录优先，兼容历史 .claude/）
     const cwd = ctx.cwd
     const { resolve } = await import('node:path')
-    const resolvedPath = resolve(worktreePath)
+    // 基数必须是 `cwd`（= ctx.cwd）：下面每一个 `Bun.spawn` 都带 `cwd: ctx.cwd`，
+    // 单参数 `resolve()` 却拿 `process.cwd()` 当归宿 —— 相对路径于是「校验的是 A、
+    // 执行的是 B」。两者在 daemon（ctx.cwd 是会话工作区、不是进程启动目录）下分叉。
+    const resolvedPath = resolve(cwd, worktreePath)
     const roots = worktreeRoots(cwd).map((root) => resolve(root))
     const inWorktree = roots.some(
       (root) => resolvedPath === root || resolvedPath.startsWith(root + '/'),
@@ -64,7 +67,7 @@ export const exitWorktreeTool: ToolDefinition = {
       })
       const listOutput = await new Response(listProc.stdout).text()
 
-      if (!listOutput.includes(worktreePath)) {
+      if (!listsWorktree(listOutput, resolvedPath)) {
         return {
           success: false,
           content: '',

package/src/tools/exec/git.ts

@@ -1,5 +1,10 @@
+import { resolve } from 'node:path'
 import type { ToolDefinition } from '../../shared/index.ts'
 import { findWorktreeMarker } from '../../core/paths.ts'
+import { isWithin } from '../../security/path.ts'
+
+/** Generous enough for a clone or fetch, short enough to bound a hung git. */
+const GIT_TIMEOUT_MS = 120_000
 
 // P0-4 (v2.1.222 alignment): Regex-based word-boundary patterns replace
 // fragile substring matching. Each pattern describes what it blocks.
@@ -75,8 +80,11 @@ function isOutsideWorktree(command: string, cwd: string): string | null {
     let match: RegExpExecArray | null
     while ((match = pathPattern.exec(command)) !== null) {
       const refPath = match[1]!
-      // If the referenced path is outside the worktree, block it
-      if (!refPath.startsWith(cwd) && !refPath.startsWith(worktreeRoot + '/')) {
+      // 归一后按**路径分段**判归属，不用字符串前缀：此前 `refPath.startsWith(cwd)`
+      // 从不解析 `..`，`--work-tree=/proj/../etc` 因为「以 /proj/ 开头」被放行，
+      // 而 git 拿到的是 /etc。判据与 Bash 守卫（resolveWorktreeEscape）同一套。
+      const resolved = resolve(cwd, refPath)
+      if (!isWithin(resolved, cwd) && !isWithin(resolved, worktreeRoot)) {
         return `Git command references path outside worktree: ${refPath}`
       }
     }
@@ -85,6 +93,60 @@ function isOutsideWorktree(command: string, cwd: string): string | null {
   return null
 }
 
+/**
+ * Git options whose value is a program git will execute. The regex list above
+ * covers command execution reached through config keys; these are the ones it
+ * does not name at all, and each was confirmed to run an arbitrary local
+ * program: `ls-remote --upload-pack=/tmp/x.sh <path>`, `push --receive-pack=…`,
+ * and `--exec-path=<dir>` followed by a planted `<dir>/git-<subcommand>`.
+ */
+const PROGRAM_EXECUTING_OPTIONS = ['--upload-pack', '--receive-pack', '--exec-path']
+
+/** Config keys whose value git runs as a program. */
+const PROGRAM_EXECUTING_CONFIG_KEY =
+  /^(?:core\.(?:sshCommand|pager|askpass|editor)|alias\.|credential\.helper)/i
+
+/**
+ * Find an argv entry that makes git execute a program the caller named.
+ *
+ * This runs on the parsed argv rather than the raw command string. The regex
+ * list above is organised by *spelling*, so it has to anticipate every way the
+ * text can be written — `" -c " + "core.pager=…" ` written with quotes between
+ * the two halves never matches it, yet git receives the same two tokens. argv
+ * is what git actually gets, so it has no such gap.
+ */
+export function findProgramExecutingArg(argv: string[]): string | null {
+  for (let i = 0; i < argv.length; i++) {
+    const arg = argv[i]!
+
+    for (const opt of PROGRAM_EXECUTING_OPTIONS) {
+      // `--upload-pack=<exec>` and `--upload-pack <exec>` are both accepted.
+      if (arg === opt) return `${arg} ${argv[i + 1] ?? ''}`
+      if (arg.startsWith(`${opt}=`)) return arg
+    }
+
+    // `-c<key>=<value>` / `--config=<key>=<value>`. `--config=…` is checked
+    // first so `/^-c[^-]/` cannot swallow it.
+    const attached = arg.startsWith('--config=')
+      ? arg.slice('--config='.length)
+      : /^-c[^-]/.test(arg)
+        ? arg.slice(2)
+        : null
+    if (attached !== null && PROGRAM_EXECUTING_CONFIG_KEY.test(attached)) return arg
+
+    // `-c <key>=<value>` / `--config <key>=<value>`. A bare `-c` also means
+    // "reuse this commit" for `git commit`, but that value never contains `=`,
+    // so the config read cannot swallow it.
+    if ((arg === '-c' || arg === '--config') && i + 1 < argv.length) {
+      const next = argv[i + 1]!
+      if (next.includes('=') && PROGRAM_EXECUTING_CONFIG_KEY.test(next)) {
+        return `${arg} ${next}`
+      }
+    }
+  }
+  return null
+}
+
 /**
  * Split a git command string into argv tokens, honoring shell-style quoting
  * (single quotes, double quotes, and backslash escapes). Unlike a naive
@@ -178,14 +240,32 @@ export const gitTool: ToolDefinition = {
       }
     }
 
+    // Git runs without an approval prompt (`permission: 'auto'`), so an option
+    // that names a program to execute is a code-execution path Bash would have
+    // had to ask for. Checked on argv, which is what git is handed below.
+    const argv = splitCommand(command)
+    const execArg = findProgramExecutingArg(argv)
+    if (execArg) {
+      return {
+        success: false,
+        content: '',
+        error: `Dangerous git option blocked: "${execArg}" makes git run an arbitrary program. Run manually if intended.`,
+      }
+    }
+
     try {
-      const proc = Bun.spawn(['git', ...splitCommand(command)], {
+      const proc = Bun.spawn(['git', ...argv], {
         cwd: ctx.cwd,
         stdout: 'pipe',
         stderr: 'pipe',
       })
+
+      // Bounded like Bash: a git command that blocks on a pager, a credential
+      // prompt, or an unreachable remote would otherwise hang the turn forever.
+      const timer = setTimeout(() => proc.kill(), GIT_TIMEOUT_MS)
       const output = await new Response(proc.stdout).text()
       const exitCode = await proc.exited
+      clearTimeout(timer)
 
       if (exitCode !== 0) {
         const stderr = await new Response(proc.stderr).text()

package/src/tools/file/glob.ts

@@ -6,6 +6,10 @@ import { toolKey } from '../seam'
 import { withValidation } from '../validation'
 import { maskGlobOutput } from '../../core/credential-masker'
 
+/** 结果上限：超过则显式截断并附标记（不能静默丢内容——模型会误以为看全了，
+ *  与 Grep 的 `truncateGrepOutput` 同一约定）。 */
+const GLOB_MAX_RESULTS = 500
+
 export function createGlobTool(credentialConfig?: CredentialMaskingConfig): ToolDefinition {
   return {
     name: 'Glob',
@@ -25,12 +29,24 @@ export function createGlobTool(credentialConfig?: CredentialMaskingConfig): Tool
       const basePath = resolveSafe(ctx.cwd, (params.path as string) || '.')
       const glob = new Glob(pattern)
       const results: string[] = []
+      let truncated = false
       for await (const file of glob.scan({ cwd: basePath, absolute: true })) {
+        if (results.length >= GLOB_MAX_RESULTS) {
+          // 只有真的还有第 501 个匹配时才叫截断 —— 恰好 500 个匹配是完整结果。
+          truncated = true
+          break
+        }
         results.push(file)
-        if (results.length >= 500) break
       }
-      const content = results.join('\n') || '(no matches)'
-      return { success: true, content: maskGlobOutput(content, credentialConfig) }
+      // 先掩码正文、再拼注解：`maskGlobOutput` 是**逐行当路径**去比对的
+      // （每行都过 `matchCredentialFile`），注解不是路径，不该喂给它。
+      const content = maskGlobOutput(results.join('\n') || '(no matches)', credentialConfig)
+      return {
+        success: true,
+        content: truncated
+          ? `${content}\n\n... (truncated at ${GLOB_MAX_RESULTS} matches — narrow the pattern or "path")`
+          : content,
+      }
     },
   }
 }

package/src/tools/file/grep.ts

@@ -16,17 +16,23 @@ export async function runSearch(
   cmd: string[],
   cwd: string,
   timeoutMs: number,
-): Promise<{ stdout: string; timedOut: boolean; exitCode: number | null }> {
+): Promise<{ stdout: string; stderr: string; timedOut: boolean; exitCode: number | null }> {
   const proc = Bun.spawn(cmd, { cwd, stdout: 'pipe', stderr: 'pipe' })
   let timedOut = false
   const timer = setTimeout(() => {
     timedOut = true
     proc.kill()
   }, timeoutMs)
-  const stdout = await new Response(proc.stdout).text()
+  // 两条管道必须**并发**读。先读满 stdout 再读 stderr 会在子进程写满
+  // stderr（~64 KB 管道缓冲）时死锁：它阻塞在 write 上不退出，stdout 也就
+  // 永远读不到 EOF —— 只能等超时兜底，而超时会把「慢」和「错」说成同一件事。
+  const [stdout, stderr] = await Promise.all([
+    new Response(proc.stdout).text(),
+    new Response(proc.stderr).text(),
+  ])
   await proc.exited
   clearTimeout(timer)
-  return { stdout, timedOut, exitCode: proc.exitCode }
+  return { stdout, stderr, timedOut, exitCode: proc.exitCode }
 }
 
 /** grep 输出上限：超过则显式截断并附标记（不能静默丢内容——模型会误以为看全了）。 */
@@ -48,6 +54,27 @@ export function isTopLevelScope(searchPath: string, home = homedir()): boolean {
   return searchPath === home || searchPath === parse(searchPath).root
 }
 
+/** 把未知异常变成一句可读的原因（`code` 才是可操作的部分：ENOENT / EAGAIN）。 */
+function describeError(err: unknown): string {
+  if (err instanceof Error) {
+    const code = (err as { code?: unknown }).code
+    return typeof code === 'string' ? `${code}: ${err.message}` : err.message
+  }
+  return String(err)
+}
+
+/**
+ * 只有「rg 不在 PATH」才该回退到 `find`。别的异常（EAGAIN / EPERM / spawn
+ * 失败）说明 rg 装了却起不来 —— 那不是回退能解决的问题，再起一个 find 只会
+ * 换来第二个失败，而错误信息里的「去装 ripgrep」会把排查方向整条带偏。
+ */
+function isMissingBinary(err: unknown): boolean {
+  if (!(err instanceof Error)) return false
+  if ((err as { code?: unknown }).code === 'ENOENT') return true
+  // 有些抛出方只给句子不给 code。
+  return /ENOENT|not found|no such file or directory/i.test(err.message)
+}
+
 export function createGrepTool(credentialConfig?: CredentialMaskingConfig): ToolDefinition {
   return {
     name: 'Grep',
@@ -107,7 +134,9 @@ export function createGrepTool(credentialConfig?: CredentialMaskingConfig): Tool
         if (exitCode === 0) {
           return {
             success: true,
-            content: maskSearchOutput(stdout || '(no matches)', credentialConfig, 'heading'),
+            content: truncateGrepOutput(
+              maskSearchOutput(stdout || '(no matches)', credentialConfig, 'heading'),
+            ),
           }
         }
         // rg exit 2 (error, e.g. permission denied on protected dirs) — do NOT
@@ -117,12 +146,11 @@ export function createGrepTool(credentialConfig?: CredentialMaskingConfig): Tool
         if (stdout && stdout.trim()) {
           return {
             success: true,
-            content: maskSearchOutput(
-              stdout +
-                '\n\n(rg exited 2 — some paths unreadable; narrow scope for complete results)',
-              credentialConfig,
-              'heading',
-            ),
+            // 先截断正文、再拼注解：注解拼在截断之内的话，它自己会被切掉，
+            // 模型拿到的就是一句没头没尾的提示。
+            content:
+              truncateGrepOutput(maskSearchOutput(stdout, credentialConfig, 'heading')) +
+              '\n\n(rg exited 2 — some paths unreadable; narrow scope for complete results)',
           }
         }
         return {
@@ -132,7 +160,14 @@ export function createGrepTool(credentialConfig?: CredentialMaskingConfig): Tool
             'rg error (exit 2) — likely permission denied on a large/protected tree. ' +
             'Narrow scope with "path" (project directory) and "include".',
         }
-      } catch {
+      } catch (err) {
+        if (!isMissingBinary(err)) {
+          return {
+            success: false,
+            content: '',
+            error: `ripgrep failed: ${describeError(err)}`,
+          }
+        }
         // rg not installed → fall through to grep (find + grep fallback)
       }
 
@@ -153,7 +188,11 @@ export function createGrepTool(credentialConfig?: CredentialMaskingConfig): Tool
         '+',
       ]
       try {
-        const { stdout, timedOut, exitCode } = await runSearch(grepArgs, ctx.cwd, GREP_TIMEOUT_MS)
+        const { stdout, stderr, timedOut, exitCode } = await runSearch(
+          grepArgs,
+          ctx.cwd,
+          GREP_TIMEOUT_MS,
+        )
         if (timedOut) {
           return {
             success: false,
@@ -161,7 +200,17 @@ export function createGrepTool(credentialConfig?: CredentialMaskingConfig): Tool
             error: `Grep timed out after ${GREP_TIMEOUT_MS / 1000}s — narrow scope with "path" and "include".`,
           }
         }
-        if (exitCode === 1) return { success: true, content: '(no matches)' }
+        // 退出码 1 在 find 这里是**两件事**：真的没搜到，和「根本没搜成」
+        // —— 目录不可读、grep 正则非法、grep 不在 PATH，BSD find 全都退 1。
+        // 后者一律伴随 stderr，所以用 stderr 而非退出码分辨；不加这一刀，
+        // 模型会被告知「没有匹配」，而真相是这次搜索压根没跑起来。
+        if (exitCode === 1) {
+          const err = stderr.trim()
+          if (err) {
+            return { success: false, content: '', error: `Search failed: ${err.slice(0, 500)}` }
+          }
+          return { success: true, content: '(no matches)' }
+        }
         if (exitCode === 0) {
           return {
             success: true,
@@ -171,13 +220,18 @@ export function createGrepTool(credentialConfig?: CredentialMaskingConfig): Tool
         return {
           success: false,
           content: '',
-          error: 'grep failed. Install ripgrep: brew install ripgrep',
+          error:
+            `grep failed (exit ${exitCode})` +
+            (stderr.trim() ? `: ${stderr.trim().slice(0, 500)}` : '') +
+            '. Install ripgrep: brew install ripgrep',
         }
-      } catch {
+      } catch (err) {
+        // 这里回退自己起不来 —— 报回退的真实原因，别再断言「rg 没装」
+        // （走到这一步的路径本来就有「rg 没装」和「装了但起不来」两种）。
         return {
           success: false,
           content: '',
-          error: 'grep failed. Install ripgrep: brew install ripgrep',
+          error: `Search failed to start: ${describeError(err)}`,
         }
       }
     },

package/src/tools/file/read.ts

@@ -1,4 +1,4 @@
-import { readFileSync, fstatSync, closeSync, constants } from 'node:fs'
+import { readFileSync, readSync, fstatSync, closeSync, constants } from 'node:fs'
 import type { ToolDefinition, CredentialMaskingConfig } from '../../shared/index.ts'
 import { resolveSafe } from '../../security/path'
 import { openNoFollow, isSymlinkLoop } from '../../security/fd'
@@ -6,6 +6,115 @@ import type { Service } from '../../vajra'
 import { toolKey } from '../seam'
 import { withValidation } from '../validation'
 
+/** Lines returned when the caller passes no `limit`. */
+const DEFAULT_LIMIT = 2000
+
+/** Bytes per syscall while scanning for newlines. */
+const CHUNK_BYTES = 64 * 1024
+
+/**
+ * How far a single Read may scan to locate the requested lines. Lines are
+ * addressed by index, so finding line N means scanning everything before it;
+ * this is what keeps that scan from turning a request for two lines of a 2 GB
+ * file into a 2 GB read.
+ */
+const MAX_SCAN_BYTES = 50_000_000
+
+/** Render a line window the way the tool reports it: `   123\ttext`. */
+function formatLines(lines: string[], offset: number): string {
+  return lines.map((l, i) => `${String(offset + i + 1).padStart(6, ' ')}\t${l}`).join('\n')
+}
+
+/**
+ * Lines `[offset, offset + limit)` of an already-decoded string.
+ *
+ * Scans newlines instead of `content.split('\n')`, which materializes one JS
+ * string for *every* line of the file in order to return `limit` of them. On a
+ * 20 MB source, returning 2000 lines that way cost +34 MB of heap for 60-char
+ * lines and +100 MB for 3-char lines (333k vs 10M lines — it tracks line count,
+ * not bytes); scanning costs ~0 on top of the string it is handed.
+ */
+function windowFromString(content: string, offset: number, limit: number): string[] {
+  const out: string[] = []
+  let lineNo = 0
+  let start = 0
+  while (out.length < limit) {
+    const nl = content.indexOf('\n', start)
+    const end = nl === -1 ? content.length : nl
+    if (lineNo >= offset) out.push(content.slice(start, end))
+    lineNo++
+    if (nl === -1) break
+    start = nl + 1
+  }
+  return out
+}
+
+/**
+ * Lines `[offset, offset + limit)` read from `fd` — only those lines are ever
+ * materialized, so cost tracks the window rather than the file: a 2000-line
+ * window of a 20 MB file leaves RSS at the process baseline (~38 MB), where
+ * reading the file whole and slicing it cost 142–255 MB.
+ *
+ * Two passes over the same bytes: the first only *looks* for newline bytes to
+ * learn where the window starts and ends, the second reads exactly that byte
+ * range and decodes it once. Scanning raw bytes is safe because `0x0a` never
+ * occurs inside a multi-byte UTF-8 sequence (continuation bytes are >= 0x80),
+ * and the decoded range starts and ends on a newline — so neither pass can split
+ * a character. Returns null when the window cannot be located within
+ * `MAX_SCAN_BYTES`.
+ */
+function windowFromFd(fd: number, offset: number, limit: number): string[] | null {
+  if (limit <= 0) return []
+
+  const buf = Buffer.allocUnsafe(CHUNK_BYTES)
+  let scanned = 0 // bytes consumed by the scan
+  let lineNo = 0
+  let windowStart = offset <= 0 ? 0 : -1
+  let windowEnd = -1
+  let eof = false
+
+  while (windowEnd === -1 && scanned < MAX_SCAN_BYTES) {
+    const n = readSync(fd, buf, 0, buf.length, scanned)
+    if (n <= 0) {
+      eof = true
+      break
+    }
+    const lastNl = buf.lastIndexOf(0x0a, n - 1)
+    if (lastNl !== -1) {
+      let from = 0
+      for (;;) {
+        const nl = buf.indexOf(0x0a, from)
+        if (nl === -1 || nl > lastNl) break
+        lineNo++ // line `lineNo - 1` ends at this newline
+        if (lineNo === offset) windowStart = scanned + nl + 1
+        if (lineNo === offset + limit) {
+          windowEnd = scanned + nl
+          break
+        }
+        from = nl + 1
+      }
+    }
+    scanned += n
+  }
+
+  if (windowEnd === -1) {
+    // Either the file ended (the window is everything that is left) or the scan
+    // budget ran out before the window's last line was reached.
+    if (!eof) return null
+    windowEnd = scanned
+  }
+  if (windowStart === -1) return [] // `offset` is past the end of the file
+
+  const out = Buffer.allocUnsafe(windowEnd - windowStart)
+  let got = 0
+  while (got < out.length) {
+    const n = readSync(fd, out, got, out.length - got, windowStart + got)
+    if (n <= 0) break
+    got += n
+  }
+  return out.toString('utf-8', 0, got).split('\n')
+}
+
 export function createReadTool(credentialConfig?: CredentialMaskingConfig): ToolDefinition {
   return {
     name: 'Read',
@@ -40,59 +149,56 @@ export function createReadTool(credentialConfig?: CredentialMaskingConfig): Tool
         throw err
       }
 
-      let content: string
       try {
-        const stat = fstatSync(fd)
-        if (stat.isDirectory()) {
+        if (fstatSync(fd).isDirectory()) {
           return { success: false, content: '', error: `Path is a directory: ${filePath}` }
         }
-        // Prevent OOM on single-line files (e.g. 500MB JSON blob)
-        const MAX_FILE_SIZE = 50_000_000 // 50 MB
-        if (stat.size > MAX_FILE_SIZE) {
-          return {
-            success: false,
-            content: '',
-            error: `File too large (${(stat.size / 1e6).toFixed(1)} MB). Max: 50 MB. Use offset/limit for large files.`,
+
+        const offset = (params.offset as number) || 0
+        const limit = (params.limit as number) || DEFAULT_LIMIT
+
+        // ── Credential masking ──
+        // The rule matches on path alone, so this is decided before any read: a
+        // masked file needs its whole content (the mask is content-shaped), while
+        // every other file is served straight from the fd. Reading the file
+        // *first* is what used to make `offset`/`limit` useless on large files —
+        // the size check ran before the window was ever applied.
+        let result: string | null = null
+        if (credentialConfig) {
+          const { matchCredentialFile, maskContent, CREDENTIAL_SENTINEL } =
+            await import('../../core/credential-masker')
+          const rule = matchCredentialFile(filePath, credentialConfig)
+          if (rule) {
+            const masked = maskContent(readFileSync(fd, 'utf-8'), rule)
+            // Full-file mask: return the sentinel immediately (offset/limit don't apply)
+            result =
+              masked === CREDENTIAL_SENTINEL
+                ? masked
+                : formatLines(windowFromString(masked, offset, limit), offset)
           }
         }
-        content = readFileSync(fd, 'utf-8')
-      } finally {
-        closeSync(fd)
-      }
 
-      const offset = (params.offset as number) || 0
-      const limit = (params.limit as number) || 2000
-
-      // ── Read tracking: mark file as read for Write tool safety ──
-      ctx.readFiles?.add(filePath)
-
-      // ── Credential masking ──
-      if (credentialConfig) {
-        const { matchCredentialFile, maskContent, CREDENTIAL_SENTINEL } =
-          await import('../../core/credential-masker')
-        const rule = matchCredentialFile(filePath, credentialConfig)
-        if (rule) {
-          const masked = maskContent(content, rule)
-          // Full-file mask: return sentinel immediately (offset/limit don't apply)
-          if (masked === CREDENTIAL_SENTINEL) {
-            return { success: true, content: masked }
+        if (result === null) {
+          const lines = windowFromFd(fd, offset, limit)
+          if (lines === null) {
+            return {
+              success: false,
+              content: '',
+              error:
+                `File too large: scanned ${MAX_SCAN_BYTES / 1e6} MB without reaching the end of lines ` +
+                `${offset}–${offset + limit - 1}. Narrow the range (smaller offset or limit), or use a ` +
+                `shell tool to slice the file.`,
+            }
           }
-          // Extract mode: apply offset/limit on masked content
-          const maskedLines = masked.split('\n')
-          const maskedSlice = maskedLines.slice(offset, offset + limit)
-          const maskedResult = maskedSlice
-            .map((l, i) => `${String(offset + i + 1).padStart(6, ' ')}\t${l}`)
-            .join('\n')
-          return { success: true, content: maskedResult }
+          result = formatLines(lines, offset)
         }
-      }
 
-      const lines = content.split('\n')
-      const slice = lines.slice(offset, offset + limit)
-      const result = slice
-        .map((l, i) => `${String(offset + i + 1).padStart(6, ' ')}\t${l}`)
-        .join('\n')
-      return { success: true, content: result }
+        // ── Read tracking: mark file as read for Write tool safety ──
+        ctx.readFiles?.add(filePath)
+        return { success: true, content: result }
+      } finally {
+        closeSync(fd)
+      }
     },
   }
 }

package/src/tools/index.ts

@@ -31,13 +31,21 @@ import { listAgentsTool } from './agent/list-agents'
 import { computerUseTool } from './computer/computer-use'
 import { scheduleWakeupTool } from './scheduling/schedule-wakeup.js'
 import { cronCreateTool, cronDeleteTool, cronListTool } from './scheduling/cron.js'
-import { DISABLED_CREDENTIAL_MASKING_CONFIG } from '../config/defaults'
+import { loadUserCredentialMaskingConfig } from '../config/loader'
 
 function defaultVajraContext(): Context {
   const ctx = new Context()
-  // 掩码中立默认：无参调用（daemon/workflow）保持 Read/Bash 挂载，但不启用掩码，
-  // 对齐 pre-seam 行为（那些路径从不调用 setter）。显式开启掩码走 index.tsx 的加载配置。
-  ctx.provide('credentials', DISABLED_CREDENTIAL_MASKING_CONFIG)
+  // Fail-closed 默认：无参调用（daemon / workflow）拿到的是**用户级**掩码策略，
+  // 且配置读不出来时留下的是默认值（掩码开），不是一块关掉的掩码。
+  //
+  // 原先给的是 DISABLED 配置，理由是「对齐 pre-seam 行为」—— 但掩码是安全控制，
+  // 「没配置就关掉」是把默认值的方向定反了：daemon 里 Read/Bash/Grep/Glob 的
+  // 掩码整套失效，子进程继承完整 process.env、输出不擦洗。
+  //
+  // 只取用户级、不取项目级：注册表是 daemon 进程级的一个实例而会话 cwd 各不相同
+  // （见 `loadUserCredentialMaskingConfig` 的注释），把某个项目的段套上去等于让它溢到
+  // 别的会话。交互式 CLI 走 index.tsx 自己的 ctx（含项目级），不经过这里。
+  ctx.provide('credentials', loadUserCredentialMaskingConfig())
   return ctx
 }