@myagentroam/agent 0.9.162 → 0.9.164

package/dist/agent-core/host/local-process-executor.d.ts

@@ -4,9 +4,11 @@ export interface LocalProcessSpawnRequest {
     readonly args?: readonly string[];
     readonly cwd: string;
     readonly shell?: boolean | string;
+    /** Shell startup for exec only; native processes and workers omit this field. */
+    readonly shellLogin?: boolean;
     readonly environment: NodeJS.ProcessEnv;
     /** Explicit per-start values take precedence over execution-bound Host environment. */
-    readonly environmentOverrides?: Readonly<Record<string, string>>;
+    readonly environmentOverrides?: Readonly<Record<string, string | undefined>>;
     readonly environmentKeys?: readonly string[];
     /** Trusted, bounded read-only worker assets; never supplied by model tool input. */
     readonly runtimeDirectories?: readonly string[];

package/dist/agent-core/host/local-process-executor.js

@@ -1,7 +1,9 @@
 import { spawn } from 'node:child_process';
+import { prepareLocalShellProcess } from './local-shell.js';
 /** Preserves the direct local execution behavior used by the CLI and normal Node Workbench. */
 export const directLocalProcessExecutor = {
     async spawn(request) {
+        request = prepareLocalShellProcess(request);
         return spawn(request.command, [...(request.args ?? [])], {
             cwd: request.cwd,
             shell: request.shell ?? false,

package/dist/agent-core/host/local-session-environment.js

@@ -50,12 +50,22 @@ export class LocalSessionEnvironment {
             (this.platform !== 'win32' || request.environmentOverrides === undefined))
             return request;
         const environment = { ...request.environment };
+        const overrides = {};
         const assign = (key, value) => {
             if (this.platform === 'win32') {
                 for (const current of Object.keys(environment))
                     if (this.#key(current) === this.#key(key))
                         delete environment[current];
+                for (const current of Object.keys(overrides))
+                    if (this.#key(current) === this.#key(key))
+                        delete overrides[current];
             }
+            Object.defineProperty(overrides, key, {
+                value,
+                enumerable: true,
+                writable: true,
+                configurable: true
+            });
             if (value === undefined)
                 delete environment[key];
             else
@@ -75,6 +85,7 @@ export class LocalSessionEnvironment {
         return {
             ...request,
             environment,
+            environmentOverrides: overrides,
             ...(request.environmentKeys === undefined
                 ? {}
                 : {

package/dist/agent-core/host/local-shell.d.ts

@@ -0,0 +1,3 @@
+import type { LocalProcessSpawnRequest } from './local-process-executor.js';
+/** Resolve Shell startup in the executor, after its environment policy has been applied. */
+export declare function prepareLocalShellProcess(request: LocalProcessSpawnRequest, platform?: NodeJS.Platform): LocalProcessSpawnRequest;

package/dist/agent-core/host/local-shell.js

@@ -0,0 +1,78 @@
+import { randomUUID } from 'node:crypto';
+import { basename, win32 } from 'node:path';
+/** Resolve Shell startup in the executor, after its environment policy has been applied. */
+export function prepareLocalShellProcess(request, platform = process.platform) {
+    if (!request.shell || request.shellLogin === undefined)
+        return request;
+    const shell = typeof request.shell === 'string'
+        ? request.shell
+        : platform === 'win32'
+            ? (request.environment.ComSpec ?? request.environment.COMSPEC ?? 'cmd.exe')
+            : '/bin/sh';
+    const name = (platform === 'win32' ? win32.basename(shell) : basename(shell))
+        .replace(/\.exe$/iu, '')
+        .toLowerCase();
+    const powershell = name === 'pwsh' || name === 'powershell';
+    if (!powershell && !['bash', 'zsh', 'sh'].includes(name))
+        return request;
+    const login = request.shellLogin;
+    const environment = { ...request.environment };
+    const script = [];
+    if (login && name === 'bash') {
+        script.push('if [ -z "${BASH_ENV-}" ] && [ -n "${HOME-}" ] && [ -r "$HOME/.bashrc" ]; then', '  . "$HOME/.bashrc"', 'fi');
+    }
+    else if (login && name === 'zsh') {
+        script.push('if [[ -n "${ZDOTDIR-}" ]]; then', '  [[ ! -r "$ZDOTDIR/.zshrc" ]] || . "$ZDOTDIR/.zshrc"', 'elif [[ -n "${HOME-}" ]]; then', '  [[ ! -r "$HOME/.zshrc" ]] || . "$HOME/.zshrc"', 'fi');
+    }
+    // Keep values out of argv and tool-visible command history, including quoting-sensitive values.
+    const privatePrefix = `__MAR_SHELL_${randomUUID().replaceAll('-', '')}_`;
+    const restoration = [];
+    let index = 0;
+    for (const [key, value] of Object.entries(request.environmentOverrides ?? {})) {
+        if (!powershell && !/^[A-Za-z_][A-Za-z0-9_]*$/u.test(key))
+            continue;
+        const quotedKey = `'${key.replaceAll("'", "''")}'`;
+        if (value === undefined) {
+            restoration.push(powershell
+                ? `[Environment]::SetEnvironmentVariable(${quotedKey}, $null, 'Process')`
+                : `if [ "\${${key}+x}" = x ]; then unset ${key} || exit; fi`);
+            continue;
+        }
+        const privateKey = `${privatePrefix}${index++}`;
+        environment[privateKey] = value;
+        restoration.push(powershell
+            ? `if (-not (Test-Path Env:${privateKey})) { throw 'Shell startup removed a protected environment value.' }`
+            : `[ "\${${privateKey}+x}" = x ] || { printf '%s\\n' 'Shell startup removed a protected environment value.' >&2; exit 1; }`);
+        restoration.push(powershell
+            ? `[Environment]::SetEnvironmentVariable(${quotedKey}, $env:${privateKey}, 'Process'); Remove-Item Env:${privateKey}`
+            : `if [ "\${${key}+x}" != x ] || [ "\${${key}-}" != "\$${privateKey}" ]; then export ${key}="\$${privateKey}" || exit; else export ${key} || exit; fi; unset ${privateKey}`);
+    }
+    if (restoration.length && !powershell) {
+        const traceKey = `${privatePrefix}TRACE`;
+        // A profile may enable xtrace; do not print expanded private values during restoration.
+        script.push(`case $- in *x*) set +x; ${traceKey}=1 ;; *) ${traceKey}= ;; esac`, ...restoration, `if [ "\$${traceKey}" = 1 ]; then unset ${traceKey}; set -x; else unset ${traceKey}; fi`);
+    }
+    else {
+        script.push(...restoration);
+    }
+    script.push(request.command);
+    return {
+        ...request,
+        command: shell,
+        args: [
+            ...(powershell ? [...(login ? [] : ['-NoProfile']), '-Command'] : [login ? '-lc' : '-c']),
+            script.join('\n'),
+            ...(request.args ?? [])
+        ],
+        shell: false,
+        environment,
+        ...(request.environmentKeys === undefined
+            ? {}
+            : {
+                environmentKeys: [
+                    ...request.environmentKeys,
+                    ...Object.keys(environment).filter((key) => key.startsWith(privatePrefix))
+                ]
+            })
+    };
+}

package/dist/agent-core/prompts/subagent.d.ts

@@ -1,2 +1,2 @@
-export declare const subagentPrompt = "# Subagents\nUse your own direct tools by default. Delegate only when a bounded task can proceed independently and parallelism has real value; do not delegate ordinary local search, a known-file read, a single verification command, a small edit, or sequential debugging. Give each child a self-contained objective, relevant paths and constraints, expected evidence, and a clear read/write boundary. Subagents cannot recurse and share the real filesystem; do not assign conflicting writes or assume isolation. Track background agent IDs, wait or cancel them, inspect their actual workspace effects, and verify every claim before incorporating it. Continue meaningful non-overlapping work after starting a background child. Wait for completion only when the next critical-path action is blocked on the final result, and then prefer one long wait measured in minutes rather than repeated short waits. Wait for a public message only when a fresh progress update would change the next decision; do not use message waits as heartbeat checks or request progress merely to confirm that a child is still running. The parent retains responsibility for the final result.";
+export declare const subagentPrompt = "# Subagents\nCall agent_start, agent_wait, agent_message and agent_cancel directly, never inside code_exec; they are absent from the cell tools namespace. Use your own direct tools by default. Delegate only when a bounded task can proceed independently and parallelism has real value; do not delegate ordinary local search, a known-file read, a single verification command, a small edit, or sequential debugging. Give each child a self-contained objective, relevant paths and constraints, expected evidence, and a clear read/write boundary. Subagents cannot recurse and share the real filesystem; do not assign conflicting writes or assume isolation. Track background agent IDs, wait or cancel them, inspect their actual workspace effects, and verify every claim before incorporating it. Continue meaningful non-overlapping work after starting a background child. Wait for completion only when the next critical-path action is blocked on the final result, and then prefer one long wait measured in minutes rather than repeated short waits. Wait for a public message only when a fresh progress update would change the next decision; do not use message waits as heartbeat checks or request progress merely to confirm that a child is still running. The parent retains responsibility for the final result.";
 export declare const childSubagentInstruction = "You are a non-recursive subagent. Work only on the delegated objective and within its stated read/write scope. Do not broaden the parent task, ask the user, start another subagent, commit, or claim parent-level completion. Inspect relevant evidence, make only authorized changes, run proportional verification, and return a concise factual handoff containing findings, exact files changed, commands/tests actually run, failures or uncertainty, and anything the parent must verify.";

package/dist/agent-core/prompts/subagent.js

@@ -1,2 +1,2 @@
-export const subagentPrompt = '# Subagents\nUse your own direct tools by default. Delegate only when a bounded task can proceed independently and parallelism has real value; do not delegate ordinary local search, a known-file read, a single verification command, a small edit, or sequential debugging. Give each child a self-contained objective, relevant paths and constraints, expected evidence, and a clear read/write boundary. Subagents cannot recurse and share the real filesystem; do not assign conflicting writes or assume isolation. Track background agent IDs, wait or cancel them, inspect their actual workspace effects, and verify every claim before incorporating it. Continue meaningful non-overlapping work after starting a background child. Wait for completion only when the next critical-path action is blocked on the final result, and then prefer one long wait measured in minutes rather than repeated short waits. Wait for a public message only when a fresh progress update would change the next decision; do not use message waits as heartbeat checks or request progress merely to confirm that a child is still running. The parent retains responsibility for the final result.';
+export const subagentPrompt = '# Subagents\nCall agent_start, agent_wait, agent_message and agent_cancel directly, never inside code_exec; they are absent from the cell tools namespace. Use your own direct tools by default. Delegate only when a bounded task can proceed independently and parallelism has real value; do not delegate ordinary local search, a known-file read, a single verification command, a small edit, or sequential debugging. Give each child a self-contained objective, relevant paths and constraints, expected evidence, and a clear read/write boundary. Subagents cannot recurse and share the real filesystem; do not assign conflicting writes or assume isolation. Track background agent IDs, wait or cancel them, inspect their actual workspace effects, and verify every claim before incorporating it. Continue meaningful non-overlapping work after starting a background child. Wait for completion only when the next critical-path action is blocked on the final result, and then prefer one long wait measured in minutes rather than repeated short waits. Wait for a public message only when a fresh progress update would change the next decision; do not use message waits as heartbeat checks or request progress merely to confirm that a child is still running. The parent retains responsibility for the final result.';
 export const childSubagentInstruction = 'You are a non-recursive subagent. Work only on the delegated objective and within its stated read/write scope. Do not broaden the parent task, ask the user, start another subagent, commit, or claim parent-level completion. Inspect relevant evidence, make only authorized changes, run proportional verification, and return a concise factual handoff containing findings, exact files changed, commands/tests actually run, failures or uncertainty, and anything the parent must verify.';

package/dist/agent-core/runtime/rollout-budget.js

@@ -50,7 +50,7 @@ export class RolloutBudget {
     }
     assertAvailable() {
         if (this.stage === 'exhausted')
-            throw new MarAgentError('MAR_AGENT_ROLLOUT_BUDGET_EXCEEDED', 'The shared execution token budget has been exhausted.');
+            throw new MarAgentError('MAR_AGENT_ROLLOUT_BUDGET_EXCEEDED', 'The execution token budget has been exhausted.');
     }
 }
 export function resolveRolloutBudgetOptions(options) {

package/dist/agent-core/sdk/session.d.ts

@@ -9,7 +9,7 @@ import type { CoreAgentsBackend } from '../extensions/agents.js';
 import type { HostDescription, MarAgentHost } from '../host/contracts.js';
 import { type MarAgentReasoningEffort } from '../model/configuration.js';
 import type { ModelAdapter, ModelMessage } from '../model/contracts.js';
-import { RolloutBudget, resolveRolloutBudgetOptions } from '../runtime/rollout-budget.js';
+import { resolveRolloutBudgetOptions } from '../runtime/rollout-budget.js';
 import { JsonlSessionStore } from '../session/jsonl-store.js';
 import { SubagentSessionController, type SubagentMailboxMessage, type SubagentMessageDelivery, type SubagentTurnHandle } from '../subagent/session-controller.js';
 import { createSessionToolScheduler } from '../tools/scheduler.js';
@@ -50,7 +50,6 @@ interface InternalMarAgentSession extends MarAgentSession {
         readonly initialMailbox: readonly SubagentMailboxMessage[];
         readonly turnId: string;
         readonly delivery?: SubagentMessageDelivery;
-        readonly sharedRolloutBudget?: RolloutBudget;
         readonly mcpExecutionScopeId?: string;
         readonly origin?: CoreOperationContext;
     }): SubagentTurnHandle;

package/dist/agent-core/sdk/session.js

@@ -328,9 +328,9 @@ export function createSessionOpener(services) {
                 let finalAnswer = '';
                 let executionLoop;
                 let manualCompaction;
-                const rolloutBudget = internal.sharedRolloutBudget ??
-                    (rolloutBudgetOptions ? new RolloutBudget(rolloutBudgetOptions) : undefined);
-                const ownsRolloutBudget = rolloutBudget !== undefined && internal.sharedRolloutBudget === undefined;
+                const rolloutBudget = sessionSource.type === 'user' && rolloutBudgetOptions
+                    ? new RolloutBudget(rolloutBudgetOptions)
+                    : undefined;
                 let releaseSession;
                 let executionToolSources;
                 let selectedTurn;
@@ -583,8 +583,7 @@ export function createSessionOpener(services) {
                                     turnId: turn.turnId,
                                     ...(turn.origin === undefined ? {} : { origin: turn.origin }),
                                     mcpExecutionScopeId: executionId,
-                                    ...(turn.delivery ? { delivery: turn.delivery } : {}),
-                                    ...(rolloutBudget === undefined ? {} : { sharedRolloutBudget: rolloutBudget })
+                                    ...(turn.delivery ? { delivery: turn.delivery } : {})
                                 });
                             }
                         });
@@ -1466,8 +1465,7 @@ export function createSessionOpener(services) {
                     if (sessionRuntime.toolSources === executionToolSources)
                         delete sessionRuntime.toolSources;
                     internal.signal?.removeEventListener('abort', abortSource);
-                    if (ownsRolloutBudget)
-                        rolloutBudget.discard();
+                    rolloutBudget?.discard();
                     await manualCompaction?.dispose();
                     await selectedTurn?.close().catch(() => undefined);
                     try {
@@ -1778,10 +1776,7 @@ export function createSessionOpener(services) {
                 ...(turn.mcpExecutionScopeId === undefined
                     ? {}
                     : { mcpExecutionScopeId: turn.mcpExecutionScopeId }),
-                ...(turn.delivery ? { delivery: turn.delivery } : {}),
-                ...(turn.sharedRolloutBudget === undefined
-                    ? {}
-                    : { sharedRolloutBudget: turn.sharedRolloutBudget })
+                ...(turn.delivery ? { delivery: turn.delivery } : {})
             })
         };
     };

package/dist/agent-core/tools/agent/agent-cancel.js

@@ -1,9 +1,9 @@
 import { MarAgentError } from '../../error.js';
 export const agentCancelToolDefinition = {
     name: 'agent_cancel',
-    allowedCallers: ['direct', 'programmatic'],
+    allowedCallers: ['direct'],
     parallelSafety: 'serial',
-    description: 'Idempotently cancel a child agent using the agentId returned by agent_start. For an exec processId, use exec with action:"cancel" instead. Waits for a running task to reach cancelled and returns its agentId and description.',
+    description: 'Idempotently cancel a child agent using the agentId returned by agent_start. For an exec processId, use exec_wait with action:"cancel" instead (tools.exec_wait in Code Mode). Waits for a running task to reach cancelled and returns its agentId and description.',
     inputSchema: {
         type: 'object',
         properties: { agentId: { type: 'string' } },

package/dist/agent-core/tools/agent/agent-message.js

@@ -2,7 +2,7 @@ import { MarAgentError } from '../../error.js';
 import { TOOL_EXECUTION_LIMITS } from '../execution-limits.js';
 export const agentMessageToolDefinition = {
     name: 'agent_message',
-    allowedCallers: ['direct', 'programmatic'],
+    allowedCallers: ['direct'],
     parallelSafety: 'serial',
     description: 'Send a real user message to an existing child agent. Default delivery=append inserts guidance into a running child turn at the next safe boundary after the current model response or complete tool batch. Explicit delivery=replace immediately requests cancellation, waits for the old turn to close, then starts a new turn in the same Session. When idle, either mode starts a new turn using persisted history. Returns messageId, turnId, deliveryStatus, current status, and model metadata without repeating the child’s previous latestMessage, latestActivity, summary, or verification evidence. accepted means queued in memory; applied means persisted in model context, not that the guidance has been executed. Use agent_wait for subsequent progress or completion. Does not wait for the new task to complete or roll back existing side effects.',
     inputSchema: {

package/dist/agent-core/tools/agent/agent-start.js

@@ -3,7 +3,7 @@ import { marAgentReasoningEffortSchema } from '../../model/configuration.js';
 import { TOOL_EXECUTION_LIMITS } from '../execution-limits.js';
 export const agentStartToolDefinition = {
     name: 'agent_start',
-    allowedCallers: ['direct', 'programmatic'],
+    allowedCallers: ['direct'],
     parallelSafety: 'serial',
     description: 'Start one bounded, non-recursive child agent with self-contained context. Use when an independent investigation would consume substantial main-context space or when safe parallel work has real value; keep small or tightly coupled work in the main context. All agents share the filesystem, so avoid conflicting writes. The optional reasoningEffort overrides the parent effort and must be supported by the selected model; omit it to inherit. Returns agentId for agent_wait, agent_message, or agent_cancel, description, queued/running/completed/failed/cancelled status, bounded summary, changedFiles, verification, and read evidence; background returns immediately while foreground waits for a terminal result.',
     inputSchema: {

package/dist/agent-core/tools/agent/agent-wait.js

@@ -2,7 +2,7 @@ import { MarAgentError } from '../../error.js';
 import { TOOL_EXECUTION_LIMITS } from '../execution-limits.js';
 export const agentWaitToolDefinition = {
     name: 'agent_wait',
-    allowedCallers: ['direct', 'programmatic'],
+    allowedCallers: ['direct'],
     parallelSafety: 'serial',
     description: 'Read or wait a bounded time for a child agent result. waitFor defaults to "completion"; use "message" only when a fresh public commentary/final message would change the next decision. Omit agentId to wait for whichever live child returns first, matching Codex-style untargeted waiting and avoiding UUID transcription; provide the exact agentId returned by agent_start only when observing a specific child. If no child is live, untargeted waiting reads the most recently created child. For an exec processId, use exec_wait instead (tools.exec_wait in Code Mode). Omitting waitMs waits up to 30 seconds by default; waitMs=0 returns the current snapshot immediately. Positive waits range up to 5 minutes, and positive values below 10 seconds are raised to 10 seconds. When blocked on a live child result, prefer one 300000 ms completion wait rather than repeated short waits. Every result includes waitOutcome as snapshot, message, completion, or timeout plus the real agentId and description. A message, timeout with unread progress, or first terminal completion result includes the newly observed latest public commentary/final message; snapshots and repeated observations omit previously observed message text. latestActivity can still identify a public message or bounded tool started/completed/failed status. A queued or running result is not completion. A message wait consumes only the latest unread public message in the current Session runtime; tool activity does not wake it, and parent cancellation preserves unread progress for a later Execution. Do not use message waits as heartbeat checks or request progress merely to confirm that a child is still running. First terminal results include bounded summary, changedFiles, verification, and read evidence with path/line ranges; use that evidence to avoid repeating the full exploration, while independently checking consequential edits and claims.',
     inputSchema: {

package/dist/agent-core/tools/agent/todo-read.js

@@ -2,7 +2,7 @@ export const todoReadToolDefinition = {
     name: 'todo_read',
     allowedCallers: ['direct', 'programmatic'],
     parallelSafety: 'safe',
-    description: 'Read this session’s current Todo revision and items. Use before updating when the revision may have changed. Do not read an empty or new Todo merely to decide whether straightforward bounded work needs one.',
+    description: 'Read this session’s current Todo revision and items when you need the existing list. A prior read is not required to write Todo. Do not read an empty or new Todo merely to decide whether straightforward bounded work needs one.',
     inputSchema: { type: 'object', properties: {}, additionalProperties: false }
 };
 export function executeTodoRead(context) {

package/dist/agent-core/tools/agent/todo-write.js

@@ -4,11 +4,10 @@ export const todoWriteToolDefinition = {
     name: 'todo_write',
     allowedCallers: ['direct', 'programmatic'],
     parallelSafety: 'serial',
-    description: 'Replace this session’s entire Todo list using optimistic expectedRevision. Preserve stable IDs and statuses only when extending the same objective. For a materially different objective, include only the new objective’s items. Do not retain completed items from an earlier objective; when all current items are completed, default a substantive new request to replacement unless the user explicitly asks to continue, extend, verify, or follow up. Use only after Todo has been chosen for coordination-heavy work; straightforward bounded work does not need it. Keep at most one in_progress item and update statuses after meaningful stage changes. When another substantive tool call is already ready and does not depend on the Todo result, include both in the same model response instead of spending a response only for Todo bookkeeping.',
+    description: 'Replace this session’s entire Todo list with the supplied items; no prior read is required. Preserve stable IDs and statuses only when extending the same objective. For a materially different objective, include only the new objective’s items. Do not retain completed items from an earlier objective; when all current items are completed, default a substantive new request to replacement unless the user explicitly asks to continue, extend, verify, or follow up. Use only after Todo has been chosen for coordination-heavy work; straightforward bounded work does not need it. Keep at most one in_progress item and update statuses after meaningful stage changes. When another substantive tool call is already ready and does not depend on the Todo result, include both in the same model response instead of spending a response only for Todo bookkeeping.',
     inputSchema: {
         type: 'object',
         properties: {
-            expectedRevision: { type: 'integer' },
             items: {
                 type: 'array',
                 maxItems: TOOL_EXECUTION_LIMITS.todoMaxItems,
@@ -24,7 +23,7 @@ export const todoWriteToolDefinition = {
                 }
             }
         },
-        required: ['expectedRevision', 'items'],
+        required: ['items'],
         additionalProperties: false
     }
 };
@@ -38,9 +37,7 @@ function parseTodoWriteInput(value) {
     if (!value || typeof value !== 'object' || Array.isArray(value))
         return invalid();
     const input = value;
-    if (Object.keys(input).some((key) => !['expectedRevision', 'items'].includes(key)) ||
-        !Number.isInteger(input.expectedRevision) ||
-        input.expectedRevision < 0 ||
+    if (Object.keys(input).some((key) => key !== 'items') ||
         !Array.isArray(input.items) ||
         input.items.length > TOOL_EXECUTION_LIMITS.todoMaxItems)
         return invalid();
@@ -59,7 +56,7 @@ function parseTodoWriteInput(value) {
             return invalid();
         return { id: record.id, step: record.step, status: record.status };
     });
-    return { expectedRevision: input.expectedRevision, items };
+    return { items };
 }
 function invalid() {
     throw new MarAgentError('MAR_AGENT_TOOL_INPUT_INVALID', 'Todo input is invalid.');

package/dist/agent-core/tools/agent/todo.d.ts

@@ -12,7 +12,6 @@ export declare class TodoStore {
         }[];
     };
     write(input: {
-        expectedRevision: number;
         items: readonly TodoItem[];
     }): {
         revision: number;

package/dist/agent-core/tools/agent/todo.js

@@ -14,10 +14,6 @@ export class TodoStore {
         return { revision: this.#revision, items: this.#items.map((item) => ({ ...item })) };
     }
     write(input) {
-        if (input.expectedRevision !== this.#revision)
-            throw new MarAgentError('MAR_AGENT_TODO_CONFLICT', 'Todo revision is stale.', {
-                details: { revision: this.#revision }
-            });
         this.#items = normalizeTodoItems(input.items);
         this.#revision++;
         return this.read();
@@ -44,10 +40,7 @@ export function restoreTodoStore(snapshots) {
         const items = todoItemsFromSnapshot(snapshot);
         if (!items)
             continue;
-        todo.write({
-            expectedRevision: todo.read().revision,
-            items
-        });
+        todo.write({ items });
     }
     return todo;
 }

package/dist/agent-core/tools/callers.js

@@ -13,7 +13,17 @@ export function toolCallers(tool) {
 export function allowsToolCaller(tool, caller) {
     // Control tools cannot be widened by a Host override or historical definition.
     if (caller === 'programmatic' &&
-        ['code_exec', 'code_exec_wait', 'tool_search', 'question', 'skill'].includes(tool.name))
+        [
+            'code_exec',
+            'code_exec_wait',
+            'tool_search',
+            'question',
+            'skill',
+            'agent_start',
+            'agent_wait',
+            'agent_message',
+            'agent_cancel'
+        ].includes(tool.name))
         return false;
     return toolCallers(tool).includes(caller);
 }

package/dist/agent-core/tools/local/exec.d.ts

@@ -9,6 +9,7 @@ export type ExecInput = {
     action?: 'start';
     command: string;
     cwd?: string;
+    login?: boolean;
     timeoutMs?: number;
     yieldMs?: number;
 } | {

package/dist/agent-core/tools/local/exec.js

@@ -53,6 +53,11 @@ export const execToolDefinition = {
                 type: 'string',
                 description: 'Optional relative/absolute start directory; defaults to workspace. Command-internal relative paths resolve from this directory.'
             },
+            login: {
+                type: 'boolean',
+                default: true,
+                description: 'Use the Shell login/profile initialization. Defaults to true; false skips login startup. Does not force an interactive Shell.'
+            },
             timeoutMs: {
                 type: 'integer',
                 minimum: 1,
@@ -105,7 +110,7 @@ export function execToolInput(name, value) {
         return invalidExecInput();
     const input = value;
     const allowed = name === 'exec'
-        ? ['command', 'cwd', 'timeoutMs', 'yieldMs']
+        ? ['command', 'cwd', 'login', 'timeoutMs', 'yieldMs']
         : ['processId', 'action', 'yieldMs', 'data'];
     if (Object.keys(input).some((key) => !allowed.includes(key)))
         return invalidExecInput();
@@ -174,6 +179,7 @@ export class ExecTool {
                 command: input.command,
                 cwd: cwd.physicalPath,
                 shell: this.shell ?? true,
+                shellLogin: input.login ?? true,
                 environment: this.environment,
                 displayCwd: cwd.displayPath,
                 detached: process.platform !== 'win32',
@@ -662,11 +668,14 @@ function parseExecInput(value) {
             return invalidExecInput();
         if (input.cwd !== undefined && input.cwd !== null && typeof input.cwd !== 'string')
             return invalidExecInput();
+        if (input.login !== undefined && input.login !== null && typeof input.login !== 'boolean')
+            return invalidExecInput();
         const timeoutMs = optionalBoundedInteger(input.timeoutMs, 1, TOOL_EXECUTION_LIMITS.execMaxTimeoutMs);
         return {
             ...(input.action === 'start' ? { action: 'start' } : {}),
             command: input.command,
             ...(typeof input.cwd === 'string' ? { cwd: input.cwd } : {}),
+            ...(typeof input.login === 'boolean' ? { login: input.login } : {}),
             ...(timeoutMs === undefined ? {} : { timeoutMs }),
             ...(yieldMs === undefined ? {} : { yieldMs })
         };

package/dist/sandbox/linux/bubblewrap-sandbox-executor.js

@@ -5,6 +5,7 @@ import { tmpdir } from 'node:os';
 import { isAbsolute, join, posix, relative, resolve, sep } from 'node:path';
 import { promisify } from 'node:util';
 import { MarAgentError } from '../../agent-core/error.js';
+import { prepareLocalShellProcess } from '../../agent-core/host/local-shell.js';
 import { LINUX_BUBBLEWRAP_SANDBOX_POLICY_VERSION } from './profile.js';
 const execFileAsync = promisify(execFile);
 const DEFAULT_BUBBLEWRAP_PATH = '/usr/bin/bwrap';
@@ -63,12 +64,24 @@ export class BubblewrapSandboxExecutor {
         const mounts = await this.#mounts();
         const runtimeMounts = await trustedRuntimeMounts(request.runtimeDirectories ?? [], mounts);
         const cwd = await workingDirectory(request, mounts, this.options.profile.workingDirectory);
-        const command = sandboxCommand(request, mounts);
+        // Apply the sandbox policy before creating private startup-override variables.
+        const environment = Object.fromEntries(explicitEnvironment(request));
+        const shellRequest = prepareLocalShellProcess({
+            ...request,
+            environment,
+            environmentKeys: Object.keys(environment),
+            environmentOverrides: Object.fromEntries(Object.entries(request.environmentOverrides ?? {})
+                .filter(([name, value]) => SAFE_ENVIRONMENT_NAME.test(name) &&
+                !FORBIDDEN_ENVIRONMENT_NAMES.has(name) &&
+                (value === undefined || Object.hasOwn(environment, name)))
+                .map(([name, value]) => [name, value === undefined ? undefined : environment[name]]))
+        });
+        const command = sandboxCommand(shellRequest, mounts);
         const launchDirectory = await mkdtemp(join(tmpdir(), 'mar-agent-bwrap-launch-'));
         const argumentPath = join(launchDirectory, 'arguments');
         const seccompPath = join(launchDirectory, 'seccomp.bpf');
         try {
-            const arguments_ = this.#arguments(mounts, cwd, request, runtimeMounts);
+            const arguments_ = this.#arguments(mounts, cwd, shellRequest, runtimeMounts);
             await Promise.all([
                 writeFile(argumentPath, `${arguments_.join('\0')}\0`, { mode: 0o600, flag: 'wx' }),
                 writeFile(seccompPath, seccompFilter(process.arch), { mode: 0o600, flag: 'wx' })

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@myagentroam/agent",
-  "version": "0.9.162",
+  "version": "0.9.164",
   "description": "Embeddable MAR coding agent SDK and CLI.",
   "license": "Apache-2.0",
   "type": "module",