@nail00749/agent-gvozd 0.1.1 → 0.1.2

package/dist/index.js

@@ -1,12 +1,56 @@
 // @bun
 // src/index.ts
-import { readFileSync as readFileSync2 } from "fs";
 import { Model, Plugin } from "@opencode/plugin";
 
+// src/agent-permissions.ts
+function normalizeMcpName(name) {
+  return name.replaceAll(/[^A-Za-z0-9_-]/g, "_");
+}
+function wildcardMatch(pattern, value) {
+  let source = "^";
+  for (const character of pattern) {
+    if (character === "*")
+      source += ".*";
+    else if (character === "?")
+      source += ".";
+    else
+      source += character.replace(/[\\^$.*+?()[\]{}|]/g, "\\$&");
+  }
+  return new RegExp(`${source}$`).test(value);
+}
+function explicitMcpAccess(agent, action, resources) {
+  if (resources.length === 0)
+    return false;
+  return resources.every((resource) => {
+    const matching = agent.permissions.filter((rule) => wildcardMatch(rule.action, action) && wildcardMatch(rule.resource, resource));
+    const effect = matching.at(-1)?.effect;
+    return effect === "allow" || effect === "ask";
+  });
+}
+function matchingMcpServers(action, mcpServers) {
+  return mcpServers.filter((server) => action.startsWith(`${normalizeMcpName(server)}_`));
+}
+function buildAgentPermissions(agent, mcpServers) {
+  const result = [
+    ...agent.permissions,
+    { action: "skill", resource: "*", effect: "deny" },
+    ...agent.skills.map((skill) => ({ action: "skill", resource: skill, effect: "allow" }))
+  ];
+  for (const server of mcpServers) {
+    const prefix = `${normalizeMcpName(server)}_`;
+    result.push({
+      action: `${prefix}*`,
+      resource: "*",
+      effect: agent.mcp.includes(server) ? "allow" : "deny"
+    });
+    result.push(...agent.permissions.filter((rule) => rule.action.startsWith(prefix)));
+  }
+  return result;
+}
+
 // src/config.ts
-import { existsSync, readdirSync, readFileSync, realpathSync } from "fs";
-import { homedir } from "os";
-import { dirname, isAbsolute, join, relative, resolve } from "path";
+import { existsSync as existsSync2, lstatSync as lstatSync2, readdirSync as readdirSync2, readFileSync as readFileSync2, realpathSync as realpathSync2 } from "fs";
+import { dirname as dirname2, isAbsolute as isAbsolute3, join as join3, relative as relative2, resolve as resolve3 } from "path";
 import { fileURLToPath } from "url";
 
 // node_modules/jsonc-parser/lib/esm/impl/scanner.js
@@ -5474,12 +5518,180 @@ function refine(fn, _params = {}) {
 function superRefine(fn, params) {
   return _superRefine(fn, params);
 }
+// src/config-root.ts
+import { homedir } from "os";
+import { isAbsolute, join, resolve } from "path";
+var GVOZD_CONFIG_ROOT_ENV = "GVOZD_OPENCODE_CONFIG_ROOT";
+function absolute(path, label) {
+  if (!isAbsolute(path))
+    throw new Error(`${label} must be an absolute path`);
+  return resolve(path);
+}
+function resolveOpenCodeConfigRootContract(env = process.env, platform = process.platform, home = homedir(), explicitRoot) {
+  if (explicitRoot)
+    return { path: absolute(explicitRoot, "OpenCode config root"), source: "explicit" };
+  const override = env[GVOZD_CONFIG_ROOT_ENV];
+  if (override) {
+    return { path: absolute(override, GVOZD_CONFIG_ROOT_ENV), source: GVOZD_CONFIG_ROOT_ENV };
+  }
+  if (env.XDG_CONFIG_HOME) {
+    return { path: join(absolute(env.XDG_CONFIG_HOME, "XDG_CONFIG_HOME"), "opencode"), source: "XDG_CONFIG_HOME" };
+  }
+  if (platform === "win32" && env.APPDATA) {
+    return { path: join(env.APPDATA, "opencode"), source: "APPDATA" };
+  }
+  return { path: join(home, ".config", "opencode"), source: "platform-default" };
+}
+function resolveOpenCodeConfigRoot(env = process.env, platform = process.platform, home = homedir(), explicitRoot) {
+  return resolveOpenCodeConfigRootContract(env, platform, home, explicitRoot).path;
+}
+
+// src/project-trust.ts
+import { createHash } from "crypto";
+import { existsSync, lstatSync, readdirSync, readFileSync, realpathSync } from "fs";
+import { dirname, isAbsolute as isAbsolute2, join as join2, relative, resolve as resolve2 } from "path";
+var PROJECT_TRUST_ENV = "GVOZD_TRUST_PROJECT_CONFIG";
+function findRoot(start) {
+  let current = resolve2(start);
+  while (true) {
+    if (existsSync(join2(current, ".git")))
+      return realpathSync(current);
+    const parent = dirname(current);
+    if (parent === current)
+      return realpathSync(resolve2(start));
+    current = parent;
+  }
+}
+function within(base, target, label) {
+  const child = relative(base, target);
+  if (child === "" || !child.startsWith("..") && !isAbsolute2(child))
+    return;
+  throw new Error(`${label} must stay inside ${base}: ${target}`);
+}
+function rejectSymlinkComponents(base, target, label) {
+  within(base, target, label);
+  const segments = relative(base, target).split(/[\\/]/).filter(Boolean);
+  let current = base;
+  for (const segment of segments) {
+    current = join2(current, segment);
+    if (!existsSync(current))
+      continue;
+    if (lstatSync(current).isSymbolicLink())
+      throw new Error(`${label} must not contain symlink components: ${current}`);
+  }
+}
+function readJsonc(path) {
+  const bytes = readFileSync(path);
+  const errors = [];
+  const value = parse2(bytes.toString("utf8"), errors, { allowTrailingComma: true, disallowComments: false });
+  if (errors.length > 0 || !value || typeof value !== "object" || Array.isArray(value)) {
+    const details = errors.map((error) => `${printParseErrorCode(error.error)} at offset ${error.offset}`).join(", ");
+    throw new Error(`Invalid JSONC in ${path}${details ? `: ${details}` : ""}`);
+  }
+  return { value, bytes };
+}
+function promptFromPatch(patch) {
+  if (!patch || typeof patch !== "object" || Array.isArray(patch))
+    return;
+  const prompt = patch.prompt;
+  return typeof prompt === "string" && prompt.length > 0 ? prompt : undefined;
+}
+function collectProjectTrustInputs(projectDirectory) {
+  const canonicalRoot = findRoot(projectDirectory);
+  const layer = join2(canonicalRoot, "docs", ".gvozd");
+  const rootPath = join2(layer, "config.jsonc");
+  if (!existsSync(rootPath))
+    return {
+      canonicalRoot,
+      inputs: [{ identity: "docs/.gvozd/config.jsonc:<missing>", bytes: Buffer.alloc(0) }]
+    };
+  rejectSymlinkComponents(canonicalRoot, rootPath, "Project config path");
+  const rootStat = lstatSync(rootPath);
+  if (!rootStat.isFile() || rootStat.isSymbolicLink())
+    throw new Error(`Project config must be a regular non-symlink file: ${rootPath}`);
+  const root = readJsonc(rootPath);
+  const files = new Map([[relative(canonicalRoot, rootPath).replaceAll("\\", "/"), root.bytes]]);
+  const prompts = [];
+  const inlineAgents = root.value.agents;
+  if (inlineAgents && typeof inlineAgents === "object" && !Array.isArray(inlineAgents)) {
+    for (const patch of Object.values(inlineAgents)) {
+      const prompt = promptFromPatch(patch);
+      if (prompt)
+        prompts.push({ source: rootPath, value: prompt });
+    }
+  }
+  const configuredDirectory = root.value.agentsDirectory;
+  if (configuredDirectory !== undefined && (typeof configuredDirectory !== "string" || configuredDirectory.length === 0)) {
+    throw new Error(`Invalid agentsDirectory in ${rootPath}`);
+  }
+  const agentsDirectory = resolve2(layer, configuredDirectory ?? "agents");
+  within(layer, agentsDirectory, "agentsDirectory");
+  if (existsSync(agentsDirectory)) {
+    rejectSymlinkComponents(canonicalRoot, agentsDirectory, "agentsDirectory");
+    const stat = lstatSync(agentsDirectory);
+    if (!stat.isDirectory() || stat.isSymbolicLink())
+      throw new Error(`agentsDirectory must be a regular directory: ${agentsDirectory}`);
+    within(realpathSync(layer), realpathSync(agentsDirectory), "agentsDirectory");
+    for (const entry of readdirSync(agentsDirectory, { withFileTypes: true }).sort((left, right) => left.name.localeCompare(right.name))) {
+      if (!entry.name.endsWith(".jsonc"))
+        continue;
+      const path = join2(agentsDirectory, entry.name);
+      if (!entry.isFile())
+        throw new Error(`Agent fragment must be a regular non-symlink file: ${path}`);
+      rejectSymlinkComponents(canonicalRoot, path, "Agent fragment path");
+      const stat = lstatSync(path);
+      if (!stat.isFile() || stat.isSymbolicLink())
+        throw new Error(`Agent fragment must be a regular non-symlink file: ${path}`);
+      const fragment = readJsonc(path);
+      files.set(relative(canonicalRoot, path).replaceAll("\\", "/"), fragment.bytes);
+      const prompt = promptFromPatch(fragment.value);
+      if (prompt)
+        prompts.push({ source: path, value: prompt });
+    }
+  }
+  for (const prompt of prompts) {
+    const path = resolve2(dirname(prompt.source), prompt.value);
+    within(layer, path, "Agent prompt");
+    rejectSymlinkComponents(canonicalRoot, path, "Agent prompt");
+    if (!existsSync(path))
+      throw new Error(`Agent prompt is missing: ${path}`);
+    const stat = lstatSync(path);
+    if (!stat.isFile() || stat.isSymbolicLink())
+      throw new Error(`Agent prompt must be a regular non-symlink file: ${path}`);
+    const canonical = realpathSync(path);
+    within(realpathSync(layer), canonical, "Agent prompt");
+    files.set(relative(canonicalRoot, path).replaceAll("\\", "/"), readFileSync(path));
+  }
+  return {
+    canonicalRoot,
+    inputs: [...files].map(([identity, bytes]) => ({ identity, bytes })).sort((left, right) => left.identity.localeCompare(right.identity))
+  };
+}
+function computeProjectTrustToken(projectDirectory) {
+  const collected = collectProjectTrustInputs(projectDirectory);
+  const hash = createHash("sha256");
+  hash.update("agent-gvozd-project-trust-v1\x00");
+  hash.update(collected.canonicalRoot);
+  hash.update("\x00");
+  for (const input of collected.inputs) {
+    hash.update(String(Buffer.byteLength(input.identity)));
+    hash.update(":");
+    hash.update(input.identity);
+    hash.update(":");
+    hash.update(String(input.bytes.length));
+    hash.update(":");
+    hash.update(input.bytes);
+    hash.update("\x00");
+  }
+  return `sha256:${hash.digest("hex")}`;
+}
+
 // src/config.ts
 var permissionSchema = object({
   action: string2().min(1),
   resource: string2().min(1),
   effect: _enum(["allow", "ask", "deny"])
-});
+}).strict();
 var modelRefSchema = string2().min(1).regex(/^[^/#\s]+\/[^#\s]+(?:#[^#\s]+)?$/, "Expected provider/model or provider/model#variant");
 var agentIdSchema = string2().regex(/^[A-Za-z0-9][A-Za-z0-9_-]*$/, "Expected a filesystem-safe agent ID");
 var fileLeaseRoleSchema = _enum(["coordinator", "writer", "readonly"]);
@@ -5493,12 +5705,13 @@ var agentPatchSchema = object({
   permissions: array(permissionSchema).optional(),
   fileLease: fileLeaseRoleSchema.optional(),
   disabled: boolean2().optional()
-});
+}).strict();
 var rootPatchSchema = object({
+  $schema: string2().min(1).optional(),
   defaultAgent: agentIdSchema.optional(),
   agentsDirectory: string2().min(1).optional(),
   agents: record(agentIdSchema, agentPatchSchema).optional()
-});
+}).strict();
 var resolvedAgentSchema = agentPatchSchema.extend({
   description: string2().min(1),
   mode: _enum(["primary", "subagent", "all"]),
@@ -5510,9 +5723,18 @@ var resolvedAgentSchema = agentPatchSchema.extend({
   fileLease: fileLeaseRoleSchema,
   disabled: boolean2()
 });
-function readJsonc(path) {
+var SAFE_UNTRUSTED_AGENT_FIELDS = new Set(["description"]);
+function assertTrustedProjectPatch(patch, sourcePath, id, trusted, knownAgents) {
+  if (trusted)
+    return;
+  const fields = Object.keys(patch).filter((field) => !SAFE_UNTRUSTED_AGENT_FIELDS.has(field));
+  if (fields.length === 0 && knownAgents.has(id))
+    return;
+  throw new Error(`Untrusted project config ${sourcePath} cannot override ${fields.join(", ") || `unknown agent ${id}`}. ` + `Set ${PROJECT_TRUST_ENV} to the exact token returned by computeProjectTrustToken() after reviewing these files.`);
+}
+function readJsonc2(path) {
   const errors = [];
-  const value = parse2(readFileSync(path, "utf8"), errors, {
+  const value = parse2(readFileSync2(path, "utf8"), errors, {
     allowTrailingComma: true,
     disallowComments: false
   });
@@ -5523,45 +5745,62 @@ function readJsonc(path) {
   return value;
 }
 function assertWithin(base, target, label) {
-  const child = relative(base, target);
-  if (child === "" || !child.startsWith("..") && !isAbsolute(child))
+  const child = relative2(base, target);
+  if (child === "" || !child.startsWith("..") && !isAbsolute3(child))
     return;
   throw new Error(`${label} must stay inside ${base}: ${target}`);
 }
 function resolvePrompt(patch, sourcePath, layerDirectory) {
   if (!patch.prompt)
     return patch;
-  const prompt = resolve(dirname(sourcePath), patch.prompt);
+  const prompt = resolve3(dirname2(sourcePath), patch.prompt);
   assertWithin(layerDirectory, prompt, "Agent prompt");
-  if (!existsSync(prompt))
+  if (!existsSync2(prompt))
     throw new Error(`Agent prompt is missing: ${prompt}`);
-  const canonical = realpathSync(prompt);
-  assertWithin(realpathSync(layerDirectory), canonical, "Agent prompt");
-  return { ...patch, prompt: canonical };
-}
-function loadLayer(directory, rootFileName, required) {
-  const rootPath = join(directory, rootFileName);
-  if (!existsSync(rootPath)) {
+  const promptStat = lstatSync2(prompt);
+  if (promptStat.isSymbolicLink() || !promptStat.isFile())
+    throw new Error(`Agent prompt must be a regular non-symlink file: ${prompt}`);
+  const canonical = realpathSync2(prompt);
+  assertWithin(realpathSync2(layerDirectory), canonical, "Agent prompt");
+  const promptContent = readFileSync2(canonical, "utf8");
+  return { ...patch, prompt: canonical, promptContent };
+}
+function loadLayer(directory, rootFileName, required, projectPolicy) {
+  const rootPath = join3(directory, rootFileName);
+  if (!existsSync2(rootPath)) {
     if (required)
       throw new Error(`Required config is missing: ${rootPath}`);
     return { agents: {}, sources: [] };
   }
-  const root = rootPatchSchema.parse(readJsonc(rootPath));
+  const root = rootPatchSchema.parse(readJsonc2(rootPath));
+  if (projectPolicy && !projectPolicy.trusted) {
+    const restricted = ["defaultAgent", "agentsDirectory"].filter((field) => Object.prototype.hasOwnProperty.call(root, field));
+    if (restricted.length > 0)
+      throw new Error(`Untrusted project config ${rootPath} cannot override ${restricted.join(", ")}`);
+  }
   const agents = {};
   for (const [id, patch] of Object.entries(root.agents ?? {})) {
+    if (projectPolicy)
+      assertTrustedProjectPatch(patch, rootPath, id, projectPolicy.trusted, projectPolicy.knownAgents);
     agents[id] = resolvePrompt(patch, rootPath, directory);
   }
-  const agentsDirectory = resolve(directory, root.agentsDirectory ?? "agents");
+  const agentsDirectory = resolve3(directory, root.agentsDirectory ?? "agents");
   assertWithin(directory, agentsDirectory, "agentsDirectory");
-  if (existsSync(agentsDirectory)) {
-    assertWithin(realpathSync(directory), realpathSync(agentsDirectory), "agentsDirectory");
-    for (const entry of readdirSync(agentsDirectory, { withFileTypes: true }).sort((a, b) => a.name.localeCompare(b.name))) {
+  if (existsSync2(agentsDirectory)) {
+    const directoryStat = lstatSync2(agentsDirectory);
+    if (directoryStat.isSymbolicLink() || !directoryStat.isDirectory()) {
+      throw new Error(`agentsDirectory must be a regular directory: ${agentsDirectory}`);
+    }
+    assertWithin(realpathSync2(directory), realpathSync2(agentsDirectory), "agentsDirectory");
+    for (const entry of readdirSync2(agentsDirectory, { withFileTypes: true }).sort((a, b) => a.name.localeCompare(b.name))) {
       if (!entry.isFile() || !entry.name.endsWith(".jsonc"))
         continue;
       const id = entry.name.slice(0, -".jsonc".length);
       agentIdSchema.parse(id);
-      const agentPath = join(agentsDirectory, entry.name);
-      const patch = agentPatchSchema.parse(readJsonc(agentPath));
+      const agentPath = join3(agentsDirectory, entry.name);
+      const patch = agentPatchSchema.parse(readJsonc2(agentPath));
+      if (projectPolicy)
+        assertTrustedProjectPatch(patch, agentPath, id, projectPolicy.trusted, projectPolicy.knownAgents);
       agents[id] = mergeAgent(agents[id], resolvePrompt(patch, agentPath, directory));
     }
   }
@@ -5575,22 +5814,24 @@ function mergeAgent(base, override) {
   return { ...base ?? {}, ...override };
 }
 function resolveAgentConfig(patch) {
-  const parsed = agentPatchSchema.parse(patch);
-  return resolvedAgentSchema.parse({
+  const parsed = agentPatchSchema.extend({ promptContent: string2().optional() }).parse(patch);
+  const { promptContent, ...agentPatch } = parsed;
+  const resolved = resolvedAgentSchema.parse({
     skills: [],
     mcp: [],
     permissions: [],
     fileLease: "readonly",
     disabled: false,
-    ...parsed
+    ...agentPatch
   });
+  return promptContent === undefined ? resolved : { ...resolved, promptContent };
 }
 function findPackageRoot() {
-  let current = dirname(fileURLToPath(import.meta.url));
+  let current = dirname2(fileURLToPath(import.meta.url));
   while (true) {
-    if (existsSync(join(current, "defaults", "default.jsonc")))
+    if (existsSync2(join3(current, "defaults", "default.jsonc")))
       return current;
-    const parent = dirname(current);
+    const parent = dirname2(current);
     if (parent === current)
       break;
     current = parent;
@@ -5598,34 +5839,35 @@ function findPackageRoot() {
   throw new Error("Unable to locate agent-gvozd package defaults");
 }
 function findProjectRoot(start) {
-  let current = resolve(start);
+  let current = resolve3(start);
   while (true) {
-    const git = join(current, ".git");
-    if (existsSync(git))
+    const git = join3(current, ".git");
+    if (existsSync2(git))
       return current;
-    const parent = dirname(current);
+    const parent = dirname2(current);
     if (parent === current)
-      return resolve(start);
+      return resolve3(start);
     current = parent;
   }
 }
-function resolveOpenCodeConfigRoot(env = process.env, platform = process.platform, home = homedir()) {
-  if (env.XDG_CONFIG_HOME)
-    return join(env.XDG_CONFIG_HOME, "opencode");
-  if (platform === "win32" && env.APPDATA)
-    return join(env.APPDATA, "opencode");
-  return join(home, ".config", "opencode");
-}
 function loadConfig(projectDirectory, options = {}) {
   const projectRoot = findProjectRoot(projectDirectory);
   const packageRoot = findPackageRoot();
-  const projectConfigDirectory = join(projectRoot, "docs", ".gvozd");
-  const globalConfigDirectory = join(options.configRoot ?? resolveOpenCodeConfigRoot(options.env, options.platform, options.home), "gvozd");
-  const layers = [
-    loadLayer(join(packageRoot, "defaults"), "default.jsonc", true),
-    loadLayer(globalConfigDirectory, "config.jsonc", false),
-    ...options.includeProject === false ? [] : [loadLayer(projectConfigDirectory, "config.jsonc", false)]
+  const projectConfigDirectory = join3(projectRoot, "docs", ".gvozd");
+  const globalConfigDirectory = join3(resolveOpenCodeConfigRoot(options.env, options.platform, options.home, options.configRoot), "gvozd");
+  const baseLayers = [
+    loadLayer(join3(packageRoot, "defaults"), "default.jsonc", true),
+    loadLayer(globalConfigDirectory, "config.jsonc", false)
   ];
+  const knownAgents = new Set(baseLayers.flatMap((layer) => Object.keys(layer.agents)));
+  const includeProject = options.includeProject !== false;
+  const suppliedToken = includeProject ? options.projectTrustToken ?? (options.env ?? process.env)[PROJECT_TRUST_ENV] : undefined;
+  const trustProjectConfig = includeProject && suppliedToken !== undefined && suppliedToken === computeProjectTrustToken(projectRoot);
+  const projectLayer = includeProject ? loadLayer(projectConfigDirectory, "config.jsonc", false, { trusted: trustProjectConfig, knownAgents }) : undefined;
+  if (trustProjectConfig && suppliedToken !== computeProjectTrustToken(projectRoot)) {
+    throw new Error("Project configuration changed while its trust token was being validated; review it and compute a new token");
+  }
+  const layers = [...baseLayers, ...projectLayer ? [projectLayer] : []];
   let defaultAgent;
   const agents = {};
   for (const layer of layers) {
@@ -5638,7 +5880,12 @@ function loadConfig(projectDirectory, options = {}) {
     throw new Error("defaultAgent is not configured");
   const resolvedAgents = Object.fromEntries(Object.entries(agents).map(([id, patch]) => [
     id,
-    resolveAgentConfig(patch)
+    (() => {
+      const agent = resolveAgentConfig(patch);
+      if (agent.promptContent === undefined)
+        throw new Error(`Agent prompt snapshot is missing after configuration load: ${agent.prompt}`);
+      return agent;
+    })()
   ]));
   const defaultConfig = resolvedAgents[defaultAgent];
   if (!defaultConfig || defaultConfig.disabled || defaultConfig.mode === "subagent") {
@@ -5657,8 +5904,8 @@ function loadConfig(projectDirectory, options = {}) {
 
 // src/file-leases.ts
 import { randomUUID } from "crypto";
-import { existsSync as existsSync2, lstatSync, realpathSync as realpathSync2, statSync } from "fs";
-import { basename, dirname as dirname2, isAbsolute as isAbsolute2, relative as relative2, resolve as resolve2, sep } from "path";
+import { existsSync as existsSync3, lstatSync as lstatSync3, realpathSync as realpathSync3, statSync } from "fs";
+import { basename, dirname as dirname3, isAbsolute as isAbsolute4, relative as relative3, resolve as resolve4, sep } from "path";
 
 class LeaseError extends Error {
   code;
@@ -5670,6 +5917,18 @@ class LeaseError extends Error {
 }
 var DEFAULT_RESERVATION_TTL_MS = 5 * 60 * 1000;
 var DEFAULT_ACTIVE_TTL_MS = 30 * 60 * 1000;
+var GVOZD_CASE_INSENSITIVE_FILESYSTEM = "GVOZD_CASE_INSENSITIVE_FILESYSTEM";
+function resolveCaseInsensitiveFilesystem(env = process.env, platform = process.platform) {
+  const override = env[GVOZD_CASE_INSENSITIVE_FILESYSTEM];
+  if (override === "1")
+    return true;
+  if (override === "0")
+    return false;
+  if (override !== undefined) {
+    throw new Error(`${GVOZD_CASE_INSENSITIVE_FILESYSTEM} must be exactly 1 or 0`);
+  }
+  return platform === "darwin" || platform === "win32";
+}
 function nonEmpty(value, label) {
   const normalized = value.trim();
   if (normalized === "")
@@ -5682,11 +5941,11 @@ function assertPositiveDuration(value, label) {
   return value;
 }
 function isWithin(root, target) {
-  const child = relative2(root, target);
-  return child !== "" && !child.startsWith(`..${sep}`) && child !== ".." && !isAbsolute2(child);
+  const child = relative3(root, target);
+  return child !== "" && !child.startsWith(`..${sep}`) && child !== ".." && !isAbsolute4(child);
 }
 function displayPath(root, target) {
-  return relative2(root, target).replaceAll("\\", "/");
+  return relative3(root, target).replaceAll("\\", "/");
 }
 
 class FileLeaseManager {
@@ -5695,17 +5954,19 @@ class FileLeaseManager {
   activeTtlMs;
   now;
   createID;
+  caseInsensitive;
   leases = new Map;
   fileOwners = new Map;
   sessionOwners = new Map;
   constructor(options) {
-    this.projectRoot = realpathSync2(options.projectRoot);
+    this.projectRoot = realpathSync3(options.projectRoot);
     if (!statSync(this.projectRoot).isDirectory())
       throw new Error(`Project root is not a directory: ${this.projectRoot}`);
     this.reservationTtlMs = assertPositiveDuration(options.reservationTtlMs ?? DEFAULT_RESERVATION_TTL_MS, "reservationTtlMs");
     this.activeTtlMs = assertPositiveDuration(options.activeTtlMs ?? DEFAULT_ACTIVE_TTL_MS, "activeTtlMs");
     this.now = options.now ?? Date.now;
     this.createID = options.createID ?? randomUUID;
+    this.caseInsensitive = options.caseInsensitive ?? resolveCaseInsensitiveFilesystem({}, options.platform ?? process.platform);
   }
   reserve(input) {
     this.sweep();
@@ -5724,14 +5985,14 @@ class FileLeaseManager {
       agent,
       label,
       state: "reserved",
-      files: new Set(files),
+      files: new Map(files.map((file) => [file.key, file.canonicalPath])),
       createdAt: now,
       lastActivityAt: now,
       expiresAt: now + this.reservationTtlMs
     };
     this.leases.set(leaseId, lease);
     for (const file of files)
-      this.fileOwners.set(file, leaseId);
+      this.fileOwners.set(file.key, leaseId);
     return this.toStatus(lease);
   }
   extend(input) {
@@ -5743,8 +6004,9 @@ class FileLeaseManager {
     const files = this.normalizeLeaseFiles(input.files);
     this.assertFilesAvailable(files, lease.leaseId);
     for (const file of files) {
-      lease.files.add(file);
-      this.fileOwners.set(file, lease.leaseId);
+      if (!lease.files.has(file.key))
+        lease.files.set(file.key, file.canonicalPath);
+      this.fileOwners.set(file.key, lease.leaseId);
     }
     this.refresh(lease);
     return this.toStatus(lease);
@@ -5790,10 +6052,11 @@ class FileLeaseManager {
     if (!leaseId)
       throw new LeaseError("NO_ACTIVE_LEASE", `Session ${sessionID} has no active file lease`);
     const lease = this.requireLease(leaseId);
-    const files = resources.map((resource) => this.canonicalize(resource, true));
-    const outside = files.find((file) => !lease.files.has(file));
+    const files = resources.map((resource) => this.toLeaseFile(this.canonicalize(resource, true)));
+    const canonicalPaths = new Set(lease.files.values());
+    const outside = files.find((file) => !canonicalPaths.has(file.canonicalPath));
     if (outside) {
-      throw new LeaseError("OUT_OF_SCOPE", `File ${displayPath(this.projectRoot, outside)} is outside lease ${lease.leaseId} (${lease.label}); ask Master to extend the scope`);
+      throw new LeaseError("OUT_OF_SCOPE", `File ${displayPath(this.projectRoot, outside.canonicalPath)} is outside lease ${lease.leaseId} (${lease.label}); ask Master to extend the scope`);
     }
     this.refresh(lease);
     return this.toStatus(lease);
@@ -5872,18 +6135,18 @@ class FileLeaseManager {
     this.leases.delete(lease.leaseId);
     if (lease.sessionID)
       this.sessionOwners.delete(lease.sessionID);
-    for (const file of lease.files) {
-      if (this.fileOwners.get(file) === lease.leaseId)
-        this.fileOwners.delete(file);
+    for (const key of lease.files.keys()) {
+      if (this.fileOwners.get(key) === lease.leaseId)
+        this.fileOwners.delete(key);
     }
   }
   assertFilesAvailable(files, currentLeaseId) {
     for (const file of files) {
-      const ownerId = this.fileOwners.get(file);
+      const ownerId = this.fileOwners.get(file.key);
       if (!ownerId || ownerId === currentLeaseId)
         continue;
       const owner = this.leases.get(ownerId);
-      const relativeFile = displayPath(this.projectRoot, file);
+      const relativeFile = displayPath(this.projectRoot, file.canonicalPath);
       if (!owner)
         throw new LeaseError("FILE_CONFLICT", `File ${relativeFile} is already reserved`);
       throw new LeaseError("FILE_CONFLICT", `File ${relativeFile} is ${owner.state} by ${owner.agent} for ${owner.label}; change the split or serialize the work`);
@@ -5892,13 +6155,27 @@ class FileLeaseManager {
   normalizeLeaseFiles(files) {
     if (files.length === 0)
       throw new LeaseError("INVALID_PATH", "A lease requires at least one exact file");
-    return [...new Set(files.map((file) => this.canonicalize(file, false)))].sort();
+    const normalized = new Map;
+    for (const file of files) {
+      const canonical = this.toLeaseFile(this.canonicalize(file, false));
+      const existing = normalized.get(canonical.key);
+      if (!existing)
+        normalized.set(canonical.key, canonical);
+      else if (existing.canonicalPath !== canonical.canonicalPath) {
+        throw new LeaseError("INVALID_PATH", `Lease request contains ambiguous file aliases ${displayPath(this.projectRoot, existing.canonicalPath)} and ${displayPath(this.projectRoot, canonical.canonicalPath)}`);
+      }
+    }
+    return [...normalized.values()].sort((left, right) => left.canonicalPath.localeCompare(right.canonicalPath));
+  }
+  toLeaseFile(canonicalPath) {
+    const key = this.caseInsensitive ? canonicalPath.toLowerCase().normalize("NFC") : canonicalPath;
+    return { canonicalPath, key };
   }
   canonicalize(input, allowAbsolute) {
     const value = input.trim();
     if (value === "" || value.includes("\x00"))
       throw new LeaseError("INVALID_PATH", "File path must not be empty");
-    if (!allowAbsolute && isAbsolute2(value))
+    if (!allowAbsolute && isAbsolute4(value))
       throw new LeaseError("INVALID_PATH", `Absolute lease path is not allowed: ${value}`);
     if (value.includes("*") || value.includes("?")) {
       throw new LeaseError("INVALID_PATH", `Lease paths must name exact files, not patterns: ${value}`);
@@ -5906,14 +6183,28 @@ class FileLeaseManager {
     if (value.endsWith("/") || value.endsWith("\\")) {
       throw new LeaseError("INVALID_PATH", `Lease paths must name files, not directories: ${value}`);
     }
-    const candidate = resolve2(this.projectRoot, value);
-    if ((!allowAbsolute || !isAbsolute2(value)) && !isWithin(this.projectRoot, candidate)) {
+    const candidate = resolve4(this.projectRoot, value);
+    if ((!allowAbsolute || !isAbsolute4(value)) && !isWithin(this.projectRoot, candidate)) {
       throw new LeaseError("INVALID_PATH", `File must stay inside the project root: ${value}`);
     }
+    const code = allowAbsolute ? "OUT_OF_SCOPE" : "INVALID_PATH";
+    if (existsSync3(candidate)) {
+      try {
+        const target = lstatSync3(candidate);
+        if (!target.isSymbolicLink() && !target.isFile()) {
+          throw new LeaseError(code, `Lease targets must be regular files: ${value}`);
+        }
+      } catch (error) {
+        if (error instanceof LeaseError)
+          throw error;
+        if (error.code !== "ENOENT")
+          throw error;
+      }
+    }
     let ancestor = candidate;
     const suffix = [];
-    while (!existsSync2(ancestor)) {
-      const parent = dirname2(ancestor);
+    while (!existsSync3(ancestor)) {
+      const parent = dirname3(ancestor);
       if (parent === ancestor)
         throw new LeaseError("INVALID_PATH", `Cannot resolve file path: ${value}`);
       suffix.unshift(basename(ancestor));
@@ -5921,17 +6212,21 @@ class FileLeaseManager {
     }
     let canonicalAncestor;
     try {
-      canonicalAncestor = realpathSync2(ancestor);
+      canonicalAncestor = realpathSync3(ancestor);
     } catch {
       throw new LeaseError("INVALID_PATH", `Cannot canonicalize file path: ${value}`);
     }
-    const canonical = resolve2(canonicalAncestor, ...suffix);
+    const canonical = resolve4(canonicalAncestor, ...suffix);
     if (!isWithin(this.projectRoot, canonical)) {
       throw new LeaseError("INVALID_PATH", `File resolves outside the project root: ${value}`);
     }
     try {
-      if (lstatSync(canonical).isDirectory()) {
-        throw new LeaseError("INVALID_PATH", `Lease paths must name files, not directories: ${value}`);
+      const target = lstatSync3(canonical);
+      if (!target.isFile()) {
+        throw new LeaseError(code, `Lease targets must be regular files: ${value}`);
+      }
+      if (target.nlink > 1) {
+        throw new LeaseError(code, `Hard-linked files cannot be used as lease targets: ${value}`);
       }
     } catch (error) {
       if (error instanceof LeaseError)
@@ -5949,7 +6244,7 @@ class FileLeaseManager {
       agent: lease.agent,
       label: lease.label,
       state: lease.state,
-      files: [...lease.files].map((file) => displayPath(this.projectRoot, file)).sort(),
+      files: [...lease.files.values()].map((file) => displayPath(this.projectRoot, file)).sort(),
       createdAt: lease.createdAt,
       ...lease.claimedAt === undefined ? {} : { claimedAt: lease.claimedAt },
       lastActivityAt: lease.lastActivityAt,
@@ -6085,8 +6380,9 @@ function requireRole(config, agentID, allowed) {
   }
   return role;
 }
-async function installFileLeaseRuntime(ctx, config) {
-  const manager = new FileLeaseManager({ projectRoot: config.projectRoot });
+async function installFileLeaseRuntime(ctx, config, options = {}) {
+  const caseInsensitive = options.caseInsensitive ?? resolveCaseInsensitiveFilesystem(options.env ?? process.env, options.platform ?? process.platform);
+  const manager = new FileLeaseManager({ projectRoot: config.projectRoot, caseInsensitive });
   const toolTransform = await ctx.tool.transform((tools) => {
     tools.namespace({
       name: "gvozd",
@@ -6176,43 +6472,103 @@ async function installFileLeaseRuntime(ctx, config) {
   };
 }
 
-// src/index.ts
-function normalizeMcpName(name) {
-  return name.replaceAll(/[^A-Za-z0-9_-]/g, "_");
-}
-function wildcardMatch(pattern, value) {
-  let source = "^";
-  for (const character of pattern) {
-    if (character === "*")
-      source += ".*";
-    else if (character === "?")
-      source += ".";
-    else
-      source += character.replace(/[\\^$.*+?()[\]{}|]/g, "\\$&");
+// src/runtime-events.ts
+function redactDiagnostic(error) {
+  const message = error instanceof Error ? error.message : String(error);
+  return message.replace(/-----BEGIN [^-\r\n]*PRIVATE KEY-----[\s\S]*?-----END [^-\r\n]*PRIVATE KEY-----/gi, "[redacted private key]").replace(/\b([a-z][a-z0-9+.-]*:\/\/)[^\s/@]+:[^\s/@]*@/gi, "$1[redacted]@").replace(/([?&](?:access_?token|auth(?:orization)?|api_?key|cookie|credential|password|secret|token)=)[^&#\s]*/gi, "$1[redacted]").replace(/\bBearer\s+[^\s,;]+/gi, "Bearer [redacted]").replace(/\b([A-Za-z0-9_]*(?:token|password|authorization|api_?key|secret|credential|cookie)[A-Za-z0-9_]*)\s*[:=]\s*["']?[^\s,;}"']+/gi, "$1=[redacted]").replace(/\s+/g, " ").slice(0, 300);
+}
+async function disposeResources(resources, diagnostic) {
+  const failures = [];
+  for (const resource of [...resources].reverse()) {
+    try {
+      await resource.dispose();
+    } catch (error) {
+      failures.push(error);
+      diagnostic?.(`agent-gvozd cleanup failed: ${redactDiagnostic(error)}`);
+    }
   }
-  return new RegExp(`${source}$`).test(value);
+  if (failures.length > 0)
+    throw new AggregateError(failures, "agent-gvozd cleanup failed");
 }
-function explicitMcpAccess(agent, action, resources) {
-  if (resources.length === 0)
-    return false;
-  return resources.every((resource) => {
-    const matching = agent.permissions.filter((rule) => wildcardMatch(rule.action, action) && wildcardMatch(rule.resource, resource));
-    const effect = matching.at(-1)?.effect;
-    return effect === "allow" || effect === "ask";
+var DEFAULT_RETRY_BASE_DELAY_MS = 25;
+var DEFAULT_RETRY_MAX_DELAY_MS = 30000;
+function defaultDelay(milliseconds, signal) {
+  if (signal.aborted)
+    return Promise.resolve();
+  return new Promise((resolve) => {
+    const timeout = setTimeout(finish, milliseconds);
+    function finish() {
+      clearTimeout(timeout);
+      signal.removeEventListener("abort", finish);
+      resolve();
+    }
+    signal.addEventListener("abort", finish, { once: true });
   });
 }
-function mcpPermissions(agent, mcpServers) {
-  return mcpServers.flatMap((server) => {
-    const prefix = `${normalizeMcpName(server)}_`;
-    const baseline = {
-      action: `${prefix}*`,
-      resource: "*",
-      effect: agent.mcp.includes(server) ? "allow" : "deny"
-    };
-    const explicit = agent.permissions.filter((rule) => rule.action.startsWith(prefix));
-    return [baseline, ...explicit];
+function retryDelay(attempt, baseDelayMs, maxDelayMs, random) {
+  const capped = Math.min(baseDelayMs * 2 ** attempt, maxDelayMs);
+  const boundedRandom = Math.max(0, Math.min(1, random()));
+  return Math.round(capped * (0.5 + boundedRandom * 0.5));
+}
+async function waitForRetry(delay, milliseconds, signal) {
+  if (signal.aborted)
+    return false;
+  let onAbort;
+  const aborted = new Promise((resolve) => {
+    onAbort = () => resolve();
+    signal.addEventListener("abort", onAbort, { once: true });
+    if (signal.aborted)
+      onAbort();
   });
+  try {
+    await Promise.race([delay(milliseconds, signal), aborted]);
+  } finally {
+    signal.removeEventListener("abort", onAbort);
+  }
+  return !signal.aborted;
+}
+function startRuntimeEventLoop(input) {
+  const controller = new AbortController;
+  const delay = input.delay ?? defaultDelay;
+  const random = input.random ?? Math.random;
+  const baseDelayMs = Math.max(1, input.retryBaseDelayMs ?? DEFAULT_RETRY_BASE_DELAY_MS);
+  const maxDelayMs = Math.max(baseDelayMs, input.retryMaxDelayMs ?? DEFAULT_RETRY_MAX_DELAY_MS);
+  const done = (async () => {
+    let retryAttempt = 0;
+    while (!controller.signal.aborted) {
+      try {
+        for await (const event of input.subscribe(controller.signal)) {
+          retryAttempt = 0;
+          try {
+            await input.handle(event);
+          } catch (error) {
+            input.diagnostic(`agent-gvozd runtime refresh failed: ${redactDiagnostic(error)}`);
+          }
+        }
+        if (controller.signal.aborted)
+          return;
+        input.diagnostic("agent-gvozd event subscription ended unexpectedly");
+      } catch (error) {
+        if (controller.signal.aborted)
+          return;
+        input.diagnostic(`agent-gvozd event subscription failed: ${redactDiagnostic(error)}`);
+      }
+      const milliseconds = retryDelay(retryAttempt, baseDelayMs, maxDelayMs, random);
+      retryAttempt += 1;
+      if (!await waitForRetry(delay, milliseconds, controller.signal))
+        return;
+    }
+  })();
+  return {
+    done,
+    async dispose() {
+      controller.abort();
+      await done;
+    }
+  };
 }
+
+// src/index.ts
 function selectModel(models, available) {
   const configured = models.map((model) => Model.Ref.parse(model));
   const selected = configured.find((candidate) => {
@@ -6232,11 +6588,14 @@ function applyAgentConfiguration(agents, config, models, mcpServers) {
     if (!agents.get(id))
       continue;
     agents.update(id, (agent) => {
+      if (configured.promptContent === undefined) {
+        throw new Error(`Agent ${id} is missing its immutable prompt snapshot (${configured.prompt})`);
+      }
       agent.description = configured.description;
       agent.mode = configured.mode;
-      agent.system = readFileSync2(configured.prompt, "utf8").trim();
+      agent.system = configured.promptContent.trim();
       agent.model = selectModel(configured.models, models);
-      agent.permissions.push(...mcpPermissions(configured, mcpServers));
+      agent.permissions = buildAgentPermissions(configured, mcpServers);
     });
   }
   if (agents.get(config.defaultAgent))
@@ -6245,74 +6604,82 @@ function applyAgentConfiguration(agents, config, models, mcpServers) {
 var src_default = Plugin.define({
   id: "agent-gvozd",
   async setup(ctx) {
-    const config = loadConfig(ctx.location.project.directory);
+    const caseInsensitive = resolveCaseInsensitiveFilesystem(process.env);
+    const config = loadConfig(ctx.location.project.directory, { env: process.env });
     const mcp = await ctx.mcp.list();
     let mcpServers = mcp.data.map((server) => server.name);
     let models = await ctx.catalog.model.list();
-    const fileLeases = await installFileLeaseRuntime(ctx, config);
-    const agentTransform = await ctx.agent.transform((agents) => {
-      applyAgentConfiguration(agents, config, models.data, mcpServers);
-    });
-    const permissionHook = await ctx.permission.hook("evaluate", async (event) => {
-      if (fileLeases.enforcePermission(event))
-        return;
-      if (!event.agent)
-        return;
-      const configured = config.agents[event.agent];
-      if (!configured || configured.disabled)
-        return;
-      if (event.action === "skill") {
-        const allowed = new Set(configured.skills);
-        if (event.resources.some((resource) => !allowed.has(resource))) {
-          event.effect = "deny";
-          event.message = `Agent ${event.agent} cannot use this skill`;
+    const diagnostic = (message) => console.error(message);
+    const resources = [];
+    try {
+      const fileLeases = await installFileLeaseRuntime(ctx, config, { caseInsensitive });
+      resources.push(fileLeases);
+      const agentTransform = await ctx.agent.transform((agents) => {
+        applyAgentConfiguration(agents, config, models.data, mcpServers);
+      });
+      resources.push(agentTransform);
+      const permissionHook = await ctx.permission.hook("evaluate", async (event) => {
+        if (fileLeases.enforcePermission(event))
+          return;
+        if (!event.agent)
+          return;
+        const configured = config.agents[event.agent];
+        if (!configured || configured.disabled)
+          return;
+        if (event.action === "skill") {
+          const allowed = new Set(configured.skills);
+          if (event.resources.some((resource) => !allowed.has(resource))) {
+            event.effect = "deny";
+            event.message = `Agent ${event.agent} cannot use this skill`;
+          }
+          return;
         }
-        return;
-      }
-      let matchingServers = mcpServers.filter((server) => event.action.startsWith(`${normalizeMcpName(server)}_`));
-      if (matchingServers.length === 0 && event.action.includes("_")) {
-        const mcp = await ctx.mcp.list();
-        mcpServers = mcp.data.map((server) => server.name);
-        matchingServers = mcpServers.filter((server) => event.action.startsWith(`${normalizeMcpName(server)}_`));
-      }
-      if (matchingServers.length === 0)
-        return;
-      if (matchingServers.length > 1) {
-        event.effect = "deny";
-        event.message = `MCP action has an ambiguous server prefix: ${matchingServers.join(", ")}`;
-        return;
-      }
-      if (!matchingServers.some((server) => configured.mcp.includes(server)) && !explicitMcpAccess(configured, event.action, event.resources)) {
-        event.effect = "deny";
-        event.message = `Agent ${event.agent} cannot use this MCP server`;
-      }
-    });
-    const events = new AbortController;
-    const refreshMcp = (async () => {
-      for await (const event of ctx.event.subscribe({ signal: events.signal })) {
-        fileLeases.handleEvent(event);
-        if (event.type === "mcp.status.changed") {
+        let matchingServers = matchingMcpServers(event.action, mcpServers);
+        if (matchingServers.length === 0 && event.action.includes("_")) {
           const mcp = await ctx.mcp.list();
-          const next = mcp.data.map((server) => server.name);
-          if (next.length === mcpServers.length && next.every((server, index) => server === mcpServers[index]))
-            continue;
-          mcpServers = next;
-          await ctx.agent.reload();
+          mcpServers = mcp.data.map((server) => server.name);
+          matchingServers = matchingMcpServers(event.action, mcpServers);
         }
-        if (event.type === "catalog.updated") {
-          models = await ctx.catalog.model.list();
-          await ctx.agent.reload();
+        if (matchingServers.length === 0)
+          return;
+        if (matchingServers.length > 1) {
+          event.effect = "deny";
+          event.message = `MCP action has an ambiguous server prefix: ${matchingServers.join(", ")}`;
+          return;
         }
-      }
-    })();
-    refreshMcp.catch(() => {});
-    return async () => {
-      events.abort();
-      await refreshMcp.catch(() => {});
-      await fileLeases.dispose();
-      await permissionHook.dispose();
-      await agentTransform.dispose();
-    };
+        if (!matchingServers.some((server) => configured.mcp.includes(server)) && !explicitMcpAccess(configured, event.action, event.resources)) {
+          event.effect = "deny";
+          event.message = `Agent ${event.agent} cannot use this MCP server`;
+        }
+      });
+      resources.push(permissionHook);
+      const eventLoop = startRuntimeEventLoop({
+        subscribe: (signal) => ctx.event.subscribe({ signal }),
+        diagnostic,
+        async handle(event) {
+          fileLeases.handleEvent(event);
+          if (event.type === "mcp.status.changed") {
+            const mcp = await ctx.mcp.list();
+            const next = mcp.data.map((server) => server.name);
+            if (next.length === mcpServers.length && next.every((server, index) => server === mcpServers[index]))
+              return;
+            mcpServers = next;
+            await ctx.agent.reload();
+          }
+          if (event.type === "catalog.updated") {
+            models = await ctx.catalog.model.list();
+            await ctx.agent.reload();
+          }
+        }
+      });
+      resources.push(eventLoop);
+      return async () => disposeResources(resources, diagnostic);
+    } catch (error) {
+      try {
+        await disposeResources(resources, diagnostic);
+      } catch {}
+      throw error;
+    }
   }
 });
 export {