@nail00749/agent-gvozd 0.1.1 → 0.1.3

package/dist/index.js

@@ -1,12 +1,128 @@
 // @bun
 // src/index.ts
-import { readFileSync as readFileSync2 } from "fs";
 import { Model, Plugin } from "@opencode/plugin";
 
+// src/tool-permissions.ts
+function family(command, ...variants) {
+  return [command, ...variants].map((entry) => ({
+    exact: entry,
+    wildcard: `${entry} *`
+  }));
+}
+var INSPECTION_COMMANDS = [
+  ...family("pwd", "true", "test"),
+  ...family("cat", "head", "tail", "wc", "sort", "uniq"),
+  ...family("grep", "rg", "find", "diff", "cmp"),
+  ...family("ls", "du", "df", "stat", "file", "realpath", "basename", "dirname"),
+  ...family("shasum", "sha256sum", "md5sum"),
+  ...family("uname", "whoami", "hostname", "date", "printenv"),
+  ...family("which", "command -v"),
+  ...family("mktemp"),
+  ...family("tr", "cut", "paste", "column"),
+  ...family("node --version", "python3 --version", "python --version", "deno --version")
+];
+var TOOLCHAIN_COMMANDS = [
+  ...family("bun test", "bun run test", "bun --version"),
+  ...family("bun run typecheck", "bun run lint", "bun run build", "bun run check"),
+  ...family("tsc --noEmit", "npx tsc --noEmit"),
+  ...family("eslint", "biome check", "prettier --check"),
+  ...family("npm test", "npm run test", "npm run typecheck", "npm run lint", "npm run build"),
+  ...family("pnpm test", "pnpm run test", "pnpm run build"),
+  ...family("yarn test", "yarn build"),
+  ...family("vitest run", "jest", "playwright test"),
+  ...family("cargo check", "cargo test", "cargo build", "cargo clippy", "cargo fmt --check", "cargo --version"),
+  ...family("go build ./...", "go test ./...", "go vet ./...", "go version"),
+  ...family("pytest", "python3 -m pytest", "python -m pytest"),
+  ...family("ruff check", "mypy", "pyright"),
+  ...family("mvn test", "mvn verify", "gradle test", "gradle check", "./gradlew test", "./gradlew check"),
+  ...family("make test", "make check", "make build", "make --version"),
+  ...family("just --list")
+];
+var GIT_READONLY_COMMANDS = [
+  ...family("git status", "git status --short", "git status --short --branch", "git status --porcelain", "git status --porcelain=v1 --branch"),
+  ...family("git diff", "git diff --stat", "git diff --cached", "git diff --check"),
+  ...family("git log", "git show", "git reflog"),
+  ...family("git rev-parse", "git rev-list", "git show-ref", "git cat-file", "git symbolic-ref"),
+  ...family("git ls-files", "git ls-remote", "git grep"),
+  ...family("git branch", "git remote", "git stash list", "git tag", "git describe"),
+  ...family("git config --get", "git config --get-regexp"),
+  ...family("git -C")
+];
+var GIT_MUTATING_COMMANDS = [
+  ...family("git add", "git rm --cached"),
+  ...family("git commit", "git merge --ff-only", "git merge --no-ff"),
+  ...family("git push", "git fetch", "git pull --ff-only"),
+  ...family("git tag -a", "git tag -v", "git tag --list"),
+  ...family("git stash", "git cherry-pick", "git revert"),
+  ...family("git switch", "git checkout -b", "git worktree list", "git worktree add")
+];
+var GIT_ENV_PREFIXES = ["GIT_OPTIONAL_LOCKS=0"];
+function withEnvPrefixes(rule, prefixes = GIT_ENV_PREFIXES) {
+  return prefixes.map((prefix) => ({
+    action: rule.action,
+    resource: `${prefix} ${rule.resource}`,
+    effect: rule.effect
+  }));
+}
+
+// src/agent-permissions.ts
+function normalizeMcpName(name) {
+  return name.replaceAll(/[^A-Za-z0-9_-]/g, "_");
+}
+function wildcardMatch(pattern, value) {
+  let source = "^";
+  for (const character of pattern) {
+    if (character === "*")
+      source += ".*";
+    else if (character === "?")
+      source += ".";
+    else
+      source += character.replace(/[\\^$.*+?()[\]{}|]/g, "\\$&");
+  }
+  return new RegExp(`${source}$`).test(value);
+}
+function explicitMcpAccess(agent, action, resources) {
+  if (resources.length === 0)
+    return false;
+  return resources.every((resource) => {
+    const matching = agent.permissions.filter((rule) => wildcardMatch(rule.action, action) && wildcardMatch(rule.resource, resource));
+    const effect = matching.at(-1)?.effect;
+    return effect === "allow" || effect === "ask";
+  });
+}
+function matchingMcpServers(action, mcpServers) {
+  return mcpServers.filter((server) => action.startsWith(`${normalizeMcpName(server)}_`));
+}
+function buildAgentPermissions(agent, mcpServers) {
+  const result = [
+    ...agent.permissions,
+    { action: "skill", resource: "*", effect: "deny" },
+    ...agent.skills.map((skill) => ({ action: "skill", resource: skill, effect: "allow" }))
+  ];
+  for (const server of mcpServers) {
+    const prefix = `${normalizeMcpName(server)}_`;
+    result.push({
+      action: `${prefix}*`,
+      resource: "*",
+      effect: agent.mcp.includes(server) ? "allow" : "deny"
+    });
+    result.push(...agent.permissions.filter((rule) => rule.action.startsWith(prefix)));
+  }
+  for (const rule of agent.permissions) {
+    if (rule.action !== "shell")
+      continue;
+    if (!/(^|\s|["'])git(?:$|\s)/.test(rule.resource))
+      continue;
+    if (rule.resource.startsWith("GIT_"))
+      continue;
+    result.push(...withEnvPrefixes(rule));
+  }
+  return result;
+}
+
 // src/config.ts
-import { existsSync, readdirSync, readFileSync, realpathSync } from "fs";
-import { homedir } from "os";
-import { dirname, isAbsolute, join, relative, resolve } from "path";
+import { existsSync as existsSync3, lstatSync as lstatSync3, readdirSync as readdirSync2, readFileSync as readFileSync2, realpathSync as realpathSync3 } from "fs";
+import { dirname as dirname3, isAbsolute as isAbsolute4, join as join3, relative as relative3, resolve as resolve4 } from "path";
 import { fileURLToPath } from "url";
 
 // node_modules/jsonc-parser/lib/esm/impl/scanner.js
@@ -5474,191 +5590,178 @@ function refine(fn, _params = {}) {
 function superRefine(fn, params) {
   return _superRefine(fn, params);
 }
-// src/config.ts
-var permissionSchema = object({
-  action: string2().min(1),
-  resource: string2().min(1),
-  effect: _enum(["allow", "ask", "deny"])
-});
-var modelRefSchema = string2().min(1).regex(/^[^/#\s]+\/[^#\s]+(?:#[^#\s]+)?$/, "Expected provider/model or provider/model#variant");
-var agentIdSchema = string2().regex(/^[A-Za-z0-9][A-Za-z0-9_-]*$/, "Expected a filesystem-safe agent ID");
-var fileLeaseRoleSchema = _enum(["coordinator", "writer", "readonly"]);
-var agentPatchSchema = object({
-  description: string2().min(1).optional(),
-  mode: _enum(["primary", "subagent", "all"]).optional(),
-  models: array(modelRefSchema).min(1).optional(),
-  prompt: string2().min(1).optional(),
-  skills: array(string2().min(1)).optional(),
-  mcp: array(string2().min(1)).optional(),
-  permissions: array(permissionSchema).optional(),
-  fileLease: fileLeaseRoleSchema.optional(),
-  disabled: boolean2().optional()
-});
-var rootPatchSchema = object({
-  defaultAgent: agentIdSchema.optional(),
-  agentsDirectory: string2().min(1).optional(),
-  agents: record(agentIdSchema, agentPatchSchema).optional()
-});
-var resolvedAgentSchema = agentPatchSchema.extend({
-  description: string2().min(1),
-  mode: _enum(["primary", "subagent", "all"]),
-  models: array(modelRefSchema).min(1),
-  prompt: string2().min(1),
-  skills: array(string2().min(1)),
-  mcp: array(string2().min(1)),
-  permissions: array(permissionSchema),
-  fileLease: fileLeaseRoleSchema,
-  disabled: boolean2()
-});
-function readJsonc(path) {
-  const errors = [];
-  const value = parse2(readFileSync(path, "utf8"), errors, {
-    allowTrailingComma: true,
-    disallowComments: false
-  });
-  if (errors.length > 0) {
-    const details = errors.map((error) => `${printParseErrorCode(error.error)} at offset ${error.offset}`).join(", ");
-    throw new Error(`Invalid JSONC in ${path}: ${details}`);
-  }
-  return value;
-}
-function assertWithin(base, target, label) {
-  const child = relative(base, target);
-  if (child === "" || !child.startsWith("..") && !isAbsolute(child))
-    return;
-  throw new Error(`${label} must stay inside ${base}: ${target}`);
-}
-function resolvePrompt(patch, sourcePath, layerDirectory) {
-  if (!patch.prompt)
-    return patch;
-  const prompt = resolve(dirname(sourcePath), patch.prompt);
-  assertWithin(layerDirectory, prompt, "Agent prompt");
-  if (!existsSync(prompt))
-    throw new Error(`Agent prompt is missing: ${prompt}`);
-  const canonical = realpathSync(prompt);
-  assertWithin(realpathSync(layerDirectory), canonical, "Agent prompt");
-  return { ...patch, prompt: canonical };
+// src/config-root.ts
+import { homedir } from "os";
+import { isAbsolute, join, resolve } from "path";
+var GVOZD_CONFIG_ROOT_ENV = "GVOZD_OPENCODE_CONFIG_ROOT";
+function absolute(path, label) {
+  if (!isAbsolute(path))
+    throw new Error(`${label} must be an absolute path`);
+  return resolve(path);
 }
-function loadLayer(directory, rootFileName, required) {
-  const rootPath = join(directory, rootFileName);
-  if (!existsSync(rootPath)) {
-    if (required)
-      throw new Error(`Required config is missing: ${rootPath}`);
-    return { agents: {}, sources: [] };
+function resolveOpenCodeConfigRootContract(env = process.env, platform = process.platform, home = homedir(), explicitRoot) {
+  if (explicitRoot)
+    return { path: absolute(explicitRoot, "OpenCode config root"), source: "explicit" };
+  const override = env[GVOZD_CONFIG_ROOT_ENV];
+  if (override) {
+    return { path: absolute(override, GVOZD_CONFIG_ROOT_ENV), source: GVOZD_CONFIG_ROOT_ENV };
   }
-  const root = rootPatchSchema.parse(readJsonc(rootPath));
-  const agents = {};
-  for (const [id, patch] of Object.entries(root.agents ?? {})) {
-    agents[id] = resolvePrompt(patch, rootPath, directory);
+  if (env.XDG_CONFIG_HOME) {
+    return { path: join(absolute(env.XDG_CONFIG_HOME, "XDG_CONFIG_HOME"), "opencode"), source: "XDG_CONFIG_HOME" };
   }
-  const agentsDirectory = resolve(directory, root.agentsDirectory ?? "agents");
-  assertWithin(directory, agentsDirectory, "agentsDirectory");
-  if (existsSync(agentsDirectory)) {
-    assertWithin(realpathSync(directory), realpathSync(agentsDirectory), "agentsDirectory");
-    for (const entry of readdirSync(agentsDirectory, { withFileTypes: true }).sort((a, b) => a.name.localeCompare(b.name))) {
-      if (!entry.isFile() || !entry.name.endsWith(".jsonc"))
-        continue;
-      const id = entry.name.slice(0, -".jsonc".length);
-      agentIdSchema.parse(id);
-      const agentPath = join(agentsDirectory, entry.name);
-      const patch = agentPatchSchema.parse(readJsonc(agentPath));
-      agents[id] = mergeAgent(agents[id], resolvePrompt(patch, agentPath, directory));
-    }
+  if (platform === "win32" && env.APPDATA) {
+    return { path: join(env.APPDATA, "opencode"), source: "APPDATA" };
   }
-  return {
-    defaultAgent: root.defaultAgent,
-    agents,
-    sources: [rootPath]
-  };
+  return { path: join(home, ".config", "opencode"), source: "platform-default" };
 }
-function mergeAgent(base, override) {
-  return { ...base ?? {}, ...override };
+function resolveOpenCodeConfigRoot(env = process.env, platform = process.platform, home = homedir(), explicitRoot) {
+  return resolveOpenCodeConfigRootContract(env, platform, home, explicitRoot).path;
 }
-function resolveAgentConfig(patch) {
-  const parsed = agentPatchSchema.parse(patch);
-  return resolvedAgentSchema.parse({
-    skills: [],
-    mcp: [],
-    permissions: [],
-    fileLease: "readonly",
-    disabled: false,
-    ...parsed
-  });
-}
-function findPackageRoot() {
-  let current = dirname(fileURLToPath(import.meta.url));
+
+// src/project-trust.ts
+import { createHash } from "crypto";
+import { existsSync, lstatSync, readdirSync, readFileSync, realpathSync } from "fs";
+import { dirname, isAbsolute as isAbsolute2, join as join2, relative, resolve as resolve2 } from "path";
+var PROJECT_TRUST_ENV = "GVOZD_TRUST_PROJECT_CONFIG";
+function findRoot(start) {
+  let current = resolve2(start);
   while (true) {
-    if (existsSync(join(current, "defaults", "default.jsonc")))
-      return current;
+    if (existsSync(join2(current, ".git")))
+      return realpathSync(current);
     const parent = dirname(current);
     if (parent === current)
-      break;
+      return realpathSync(resolve2(start));
     current = parent;
   }
-  throw new Error("Unable to locate agent-gvozd package defaults");
 }
-function findProjectRoot(start) {
-  let current = resolve(start);
-  while (true) {
-    const git = join(current, ".git");
-    if (existsSync(git))
-      return current;
-    const parent = dirname(current);
-    if (parent === current)
-      return resolve(start);
-    current = parent;
-  }
+function within(base, target, label) {
+  const child = relative(base, target);
+  if (child === "" || !child.startsWith("..") && !isAbsolute2(child))
+    return;
+  throw new Error(`${label} must stay inside ${base}: ${target}`);
 }
-function resolveOpenCodeConfigRoot(env = process.env, platform = process.platform, home = homedir()) {
-  if (env.XDG_CONFIG_HOME)
-    return join(env.XDG_CONFIG_HOME, "opencode");
-  if (platform === "win32" && env.APPDATA)
-    return join(env.APPDATA, "opencode");
-  return join(home, ".config", "opencode");
+function rejectSymlinkComponents(base, target, label) {
+  within(base, target, label);
+  const segments = relative(base, target).split(/[\\/]/).filter(Boolean);
+  let current = base;
+  for (const segment of segments) {
+    current = join2(current, segment);
+    if (!existsSync(current))
+      continue;
+    if (lstatSync(current).isSymbolicLink())
+      throw new Error(`${label} must not contain symlink components: ${current}`);
+  }
 }
-function loadConfig(projectDirectory, options = {}) {
-  const projectRoot = findProjectRoot(projectDirectory);
-  const packageRoot = findPackageRoot();
-  const projectConfigDirectory = join(projectRoot, "docs", ".gvozd");
-  const globalConfigDirectory = join(options.configRoot ?? resolveOpenCodeConfigRoot(options.env, options.platform, options.home), "gvozd");
-  const layers = [
-    loadLayer(join(packageRoot, "defaults"), "default.jsonc", true),
-    loadLayer(globalConfigDirectory, "config.jsonc", false),
-    ...options.includeProject === false ? [] : [loadLayer(projectConfigDirectory, "config.jsonc", false)]
-  ];
-  let defaultAgent;
-  const agents = {};
-  for (const layer of layers) {
-    defaultAgent = layer.defaultAgent ?? defaultAgent;
-    for (const [id, patch] of Object.entries(layer.agents)) {
-      agents[id] = mergeAgent(agents[id], patch);
-    }
+function readJsonc(path) {
+  const bytes = readFileSync(path);
+  const errors = [];
+  const value = parse2(bytes.toString("utf8"), errors, { allowTrailingComma: true, disallowComments: false });
+  if (errors.length > 0 || !value || typeof value !== "object" || Array.isArray(value)) {
+    const details = errors.map((error) => `${printParseErrorCode(error.error)} at offset ${error.offset}`).join(", ");
+    throw new Error(`Invalid JSONC in ${path}${details ? `: ${details}` : ""}`);
   }
-  if (!defaultAgent)
-    throw new Error("defaultAgent is not configured");
-  const resolvedAgents = Object.fromEntries(Object.entries(agents).map(([id, patch]) => [
-    id,
-    resolveAgentConfig(patch)
-  ]));
-  const defaultConfig = resolvedAgents[defaultAgent];
-  if (!defaultConfig || defaultConfig.disabled || defaultConfig.mode === "subagent") {
-    throw new Error(`defaultAgent must reference an enabled primary agent: ${defaultAgent}`);
+  return { value, bytes };
+}
+function promptFromPatch(patch) {
+  if (!patch || typeof patch !== "object" || Array.isArray(patch))
+    return;
+  const prompt = patch.prompt;
+  return typeof prompt === "string" && prompt.length > 0 ? prompt : undefined;
+}
+function collectProjectTrustInputs(projectDirectory) {
+  const canonicalRoot = findRoot(projectDirectory);
+  const layer = join2(canonicalRoot, "docs", ".gvozd");
+  const rootPath = join2(layer, "config.jsonc");
+  if (!existsSync(rootPath))
+    return {
+      canonicalRoot,
+      inputs: [{ identity: "docs/.gvozd/config.jsonc:<missing>", bytes: Buffer.alloc(0) }]
+    };
+  rejectSymlinkComponents(canonicalRoot, rootPath, "Project config path");
+  const rootStat = lstatSync(rootPath);
+  if (!rootStat.isFile() || rootStat.isSymbolicLink())
+    throw new Error(`Project config must be a regular non-symlink file: ${rootPath}`);
+  const root = readJsonc(rootPath);
+  const files = new Map([[relative(canonicalRoot, rootPath).replaceAll("\\", "/"), root.bytes]]);
+  const prompts = [];
+  const inlineAgents = root.value.agents;
+  if (inlineAgents && typeof inlineAgents === "object" && !Array.isArray(inlineAgents)) {
+    for (const patch of Object.values(inlineAgents)) {
+      const prompt = promptFromPatch(patch);
+      if (prompt)
+        prompts.push({ source: rootPath, value: prompt });
+    }
+  }
+  const configuredDirectory = root.value.agentsDirectory;
+  if (configuredDirectory !== undefined && (typeof configuredDirectory !== "string" || configuredDirectory.length === 0)) {
+    throw new Error(`Invalid agentsDirectory in ${rootPath}`);
+  }
+  const agentsDirectory = resolve2(layer, configuredDirectory ?? "agents");
+  within(layer, agentsDirectory, "agentsDirectory");
+  if (existsSync(agentsDirectory)) {
+    rejectSymlinkComponents(canonicalRoot, agentsDirectory, "agentsDirectory");
+    const stat = lstatSync(agentsDirectory);
+    if (!stat.isDirectory() || stat.isSymbolicLink())
+      throw new Error(`agentsDirectory must be a regular directory: ${agentsDirectory}`);
+    within(realpathSync(layer), realpathSync(agentsDirectory), "agentsDirectory");
+    for (const entry of readdirSync(agentsDirectory, { withFileTypes: true }).sort((left, right) => left.name.localeCompare(right.name))) {
+      if (!entry.name.endsWith(".jsonc"))
+        continue;
+      const path = join2(agentsDirectory, entry.name);
+      if (!entry.isFile())
+        throw new Error(`Agent fragment must be a regular non-symlink file: ${path}`);
+      rejectSymlinkComponents(canonicalRoot, path, "Agent fragment path");
+      const stat = lstatSync(path);
+      if (!stat.isFile() || stat.isSymbolicLink())
+        throw new Error(`Agent fragment must be a regular non-symlink file: ${path}`);
+      const fragment = readJsonc(path);
+      files.set(relative(canonicalRoot, path).replaceAll("\\", "/"), fragment.bytes);
+      const prompt = promptFromPatch(fragment.value);
+      if (prompt)
+        prompts.push({ source: path, value: prompt });
+    }
+  }
+  for (const prompt of prompts) {
+    const path = resolve2(dirname(prompt.source), prompt.value);
+    within(layer, path, "Agent prompt");
+    rejectSymlinkComponents(canonicalRoot, path, "Agent prompt");
+    if (!existsSync(path))
+      throw new Error(`Agent prompt is missing: ${path}`);
+    const stat = lstatSync(path);
+    if (!stat.isFile() || stat.isSymbolicLink())
+      throw new Error(`Agent prompt must be a regular non-symlink file: ${path}`);
+    const canonical = realpathSync(path);
+    within(realpathSync(layer), canonical, "Agent prompt");
+    files.set(relative(canonicalRoot, path).replaceAll("\\", "/"), readFileSync(path));
   }
   return {
-    defaultAgent,
-    agents: resolvedAgents,
-    packageRoot,
-    projectRoot,
-    projectConfigDirectory,
-    globalConfigDirectory,
-    sources: layers.flatMap((layer) => layer.sources)
+    canonicalRoot,
+    inputs: [...files].map(([identity, bytes]) => ({ identity, bytes })).sort((left, right) => left.identity.localeCompare(right.identity))
   };
 }
+function computeProjectTrustToken(projectDirectory) {
+  const collected = collectProjectTrustInputs(projectDirectory);
+  const hash = createHash("sha256");
+  hash.update("agent-gvozd-project-trust-v1\x00");
+  hash.update(collected.canonicalRoot);
+  hash.update("\x00");
+  for (const input of collected.inputs) {
+    hash.update(String(Buffer.byteLength(input.identity)));
+    hash.update(":");
+    hash.update(input.identity);
+    hash.update(":");
+    hash.update(String(input.bytes.length));
+    hash.update(":");
+    hash.update(input.bytes);
+    hash.update("\x00");
+  }
+  return `sha256:${hash.digest("hex")}`;
+}
 
 // src/file-leases.ts
 import { randomUUID } from "crypto";
-import { existsSync as existsSync2, lstatSync, realpathSync as realpathSync2, statSync } from "fs";
-import { basename, dirname as dirname2, isAbsolute as isAbsolute2, relative as relative2, resolve as resolve2, sep } from "path";
+import { existsSync as existsSync2, lstatSync as lstatSync2, realpathSync as realpathSync2, statSync } from "fs";
+import { basename, dirname as dirname2, isAbsolute as isAbsolute3, relative as relative2, resolve as resolve3, sep } from "path";
 
 class LeaseError extends Error {
   code;
@@ -5670,6 +5773,18 @@ class LeaseError extends Error {
 }
 var DEFAULT_RESERVATION_TTL_MS = 5 * 60 * 1000;
 var DEFAULT_ACTIVE_TTL_MS = 30 * 60 * 1000;
+var GVOZD_CASE_INSENSITIVE_FILESYSTEM = "GVOZD_CASE_INSENSITIVE_FILESYSTEM";
+function resolveCaseInsensitiveFilesystem(env = process.env, platform = process.platform) {
+  const override = env[GVOZD_CASE_INSENSITIVE_FILESYSTEM];
+  if (override === "1")
+    return true;
+  if (override === "0")
+    return false;
+  if (override !== undefined) {
+    throw new Error(`${GVOZD_CASE_INSENSITIVE_FILESYSTEM} must be exactly 1 or 0`);
+  }
+  return platform === "darwin" || platform === "win32";
+}
 function nonEmpty(value, label) {
   const normalized = value.trim();
   if (normalized === "")
@@ -5683,7 +5798,7 @@ function assertPositiveDuration(value, label) {
 }
 function isWithin(root, target) {
   const child = relative2(root, target);
-  return child !== "" && !child.startsWith(`..${sep}`) && child !== ".." && !isAbsolute2(child);
+  return child !== "" && !child.startsWith(`..${sep}`) && child !== ".." && !isAbsolute3(child);
 }
 function displayPath(root, target) {
   return relative2(root, target).replaceAll("\\", "/");
@@ -5695,6 +5810,7 @@ class FileLeaseManager {
   activeTtlMs;
   now;
   createID;
+  caseInsensitive;
   leases = new Map;
   fileOwners = new Map;
   sessionOwners = new Map;
@@ -5706,6 +5822,7 @@ class FileLeaseManager {
     this.activeTtlMs = assertPositiveDuration(options.activeTtlMs ?? DEFAULT_ACTIVE_TTL_MS, "activeTtlMs");
     this.now = options.now ?? Date.now;
     this.createID = options.createID ?? randomUUID;
+    this.caseInsensitive = options.caseInsensitive ?? resolveCaseInsensitiveFilesystem({}, options.platform ?? process.platform);
   }
   reserve(input) {
     this.sweep();
@@ -5724,14 +5841,14 @@ class FileLeaseManager {
       agent,
       label,
       state: "reserved",
-      files: new Set(files),
+      files: new Map(files.map((file) => [file.key, file.canonicalPath])),
       createdAt: now,
       lastActivityAt: now,
       expiresAt: now + this.reservationTtlMs
     };
     this.leases.set(leaseId, lease);
     for (const file of files)
-      this.fileOwners.set(file, leaseId);
+      this.fileOwners.set(file.key, leaseId);
     return this.toStatus(lease);
   }
   extend(input) {
@@ -5743,8 +5860,9 @@ class FileLeaseManager {
     const files = this.normalizeLeaseFiles(input.files);
     this.assertFilesAvailable(files, lease.leaseId);
     for (const file of files) {
-      lease.files.add(file);
-      this.fileOwners.set(file, lease.leaseId);
+      if (!lease.files.has(file.key))
+        lease.files.set(file.key, file.canonicalPath);
+      this.fileOwners.set(file.key, lease.leaseId);
     }
     this.refresh(lease);
     return this.toStatus(lease);
@@ -5790,10 +5908,11 @@ class FileLeaseManager {
     if (!leaseId)
       throw new LeaseError("NO_ACTIVE_LEASE", `Session ${sessionID} has no active file lease`);
     const lease = this.requireLease(leaseId);
-    const files = resources.map((resource) => this.canonicalize(resource, true));
-    const outside = files.find((file) => !lease.files.has(file));
+    const files = resources.map((resource) => this.toLeaseFile(this.canonicalize(resource, true)));
+    const canonicalPaths = new Set(lease.files.values());
+    const outside = files.find((file) => !canonicalPaths.has(file.canonicalPath));
     if (outside) {
-      throw new LeaseError("OUT_OF_SCOPE", `File ${displayPath(this.projectRoot, outside)} is outside lease ${lease.leaseId} (${lease.label}); ask Master to extend the scope`);
+      throw new LeaseError("OUT_OF_SCOPE", `File ${displayPath(this.projectRoot, outside.canonicalPath)} is outside lease ${lease.leaseId} (${lease.label}); ask Master to extend the scope`);
     }
     this.refresh(lease);
     return this.toStatus(lease);
@@ -5872,18 +5991,18 @@ class FileLeaseManager {
     this.leases.delete(lease.leaseId);
     if (lease.sessionID)
       this.sessionOwners.delete(lease.sessionID);
-    for (const file of lease.files) {
-      if (this.fileOwners.get(file) === lease.leaseId)
-        this.fileOwners.delete(file);
+    for (const key of lease.files.keys()) {
+      if (this.fileOwners.get(key) === lease.leaseId)
+        this.fileOwners.delete(key);
     }
   }
   assertFilesAvailable(files, currentLeaseId) {
     for (const file of files) {
-      const ownerId = this.fileOwners.get(file);
+      const ownerId = this.fileOwners.get(file.key);
       if (!ownerId || ownerId === currentLeaseId)
         continue;
       const owner = this.leases.get(ownerId);
-      const relativeFile = displayPath(this.projectRoot, file);
+      const relativeFile = displayPath(this.projectRoot, file.canonicalPath);
       if (!owner)
         throw new LeaseError("FILE_CONFLICT", `File ${relativeFile} is already reserved`);
       throw new LeaseError("FILE_CONFLICT", `File ${relativeFile} is ${owner.state} by ${owner.agent} for ${owner.label}; change the split or serialize the work`);
@@ -5892,13 +6011,27 @@ class FileLeaseManager {
   normalizeLeaseFiles(files) {
     if (files.length === 0)
       throw new LeaseError("INVALID_PATH", "A lease requires at least one exact file");
-    return [...new Set(files.map((file) => this.canonicalize(file, false)))].sort();
+    const normalized = new Map;
+    for (const file of files) {
+      const canonical = this.toLeaseFile(this.canonicalize(file, false));
+      const existing = normalized.get(canonical.key);
+      if (!existing)
+        normalized.set(canonical.key, canonical);
+      else if (existing.canonicalPath !== canonical.canonicalPath) {
+        throw new LeaseError("INVALID_PATH", `Lease request contains ambiguous file aliases ${displayPath(this.projectRoot, existing.canonicalPath)} and ${displayPath(this.projectRoot, canonical.canonicalPath)}`);
+      }
+    }
+    return [...normalized.values()].sort((left, right) => left.canonicalPath.localeCompare(right.canonicalPath));
+  }
+  toLeaseFile(canonicalPath) {
+    const key = this.caseInsensitive ? canonicalPath.toLowerCase().normalize("NFC") : canonicalPath;
+    return { canonicalPath, key };
   }
   canonicalize(input, allowAbsolute) {
     const value = input.trim();
     if (value === "" || value.includes("\x00"))
       throw new LeaseError("INVALID_PATH", "File path must not be empty");
-    if (!allowAbsolute && isAbsolute2(value))
+    if (!allowAbsolute && isAbsolute3(value))
       throw new LeaseError("INVALID_PATH", `Absolute lease path is not allowed: ${value}`);
     if (value.includes("*") || value.includes("?")) {
       throw new LeaseError("INVALID_PATH", `Lease paths must name exact files, not patterns: ${value}`);
@@ -5906,10 +6039,24 @@ class FileLeaseManager {
     if (value.endsWith("/") || value.endsWith("\\")) {
       throw new LeaseError("INVALID_PATH", `Lease paths must name files, not directories: ${value}`);
     }
-    const candidate = resolve2(this.projectRoot, value);
-    if ((!allowAbsolute || !isAbsolute2(value)) && !isWithin(this.projectRoot, candidate)) {
+    const candidate = resolve3(this.projectRoot, value);
+    if ((!allowAbsolute || !isAbsolute3(value)) && !isWithin(this.projectRoot, candidate)) {
       throw new LeaseError("INVALID_PATH", `File must stay inside the project root: ${value}`);
     }
+    const code = allowAbsolute ? "OUT_OF_SCOPE" : "INVALID_PATH";
+    if (existsSync2(candidate)) {
+      try {
+        const target = lstatSync2(candidate);
+        if (!target.isSymbolicLink() && !target.isFile()) {
+          throw new LeaseError(code, `Lease targets must be regular files: ${value}`);
+        }
+      } catch (error) {
+        if (error instanceof LeaseError)
+          throw error;
+        if (error.code !== "ENOENT")
+          throw error;
+      }
+    }
     let ancestor = candidate;
     const suffix = [];
     while (!existsSync2(ancestor)) {
@@ -5925,13 +6072,17 @@ class FileLeaseManager {
     } catch {
       throw new LeaseError("INVALID_PATH", `Cannot canonicalize file path: ${value}`);
     }
-    const canonical = resolve2(canonicalAncestor, ...suffix);
+    const canonical = resolve3(canonicalAncestor, ...suffix);
     if (!isWithin(this.projectRoot, canonical)) {
       throw new LeaseError("INVALID_PATH", `File resolves outside the project root: ${value}`);
     }
     try {
-      if (lstatSync(canonical).isDirectory()) {
-        throw new LeaseError("INVALID_PATH", `Lease paths must name files, not directories: ${value}`);
+      const target = lstatSync2(canonical);
+      if (!target.isFile()) {
+        throw new LeaseError(code, `Lease targets must be regular files: ${value}`);
+      }
+      if (target.nlink > 1) {
+        throw new LeaseError(code, `Hard-linked files cannot be used as lease targets: ${value}`);
       }
     } catch (error) {
       if (error instanceof LeaseError)
@@ -5949,7 +6100,7 @@ class FileLeaseManager {
       agent: lease.agent,
       label: lease.label,
       state: lease.state,
-      files: [...lease.files].map((file) => displayPath(this.projectRoot, file)).sort(),
+      files: [...lease.files.values()].map((file) => displayPath(this.projectRoot, file)).sort(),
       createdAt: lease.createdAt,
       ...lease.claimedAt === undefined ? {} : { claimedAt: lease.claimedAt },
       lastActivityAt: lease.lastActivityAt,
@@ -5958,6 +6109,243 @@ class FileLeaseManager {
   }
 }
 
+// src/config.ts
+var permissionSchema = object({
+  action: string2().min(1),
+  resource: string2().min(1),
+  effect: _enum(["allow", "ask", "deny"])
+}).strict();
+var modelRefSchema = string2().min(1).regex(/^[^/#\s]+\/[^#\s]+(?:#[^#\s]+)?$/, "Expected provider/model or provider/model#variant");
+var agentIdSchema = string2().regex(/^[A-Za-z0-9][A-Za-z0-9_-]*$/, "Expected a filesystem-safe agent ID");
+var fileLeaseRoleSchema = _enum(["coordinator", "writer", "readonly"]);
+var agentPatchSchema = object({
+  description: string2().min(1).optional(),
+  mode: _enum(["primary", "subagent", "all"]).optional(),
+  models: array(modelRefSchema).min(1).optional(),
+  prompt: string2().min(1).optional(),
+  skills: array(string2().min(1)).optional(),
+  mcp: array(string2().min(1)).optional(),
+  permissions: array(permissionSchema).optional(),
+  fileLease: fileLeaseRoleSchema.optional(),
+  disabled: boolean2().optional()
+}).strict();
+var leaseSchema = object({
+  reservationTtlMinutes: number2().int().positive().max(24 * 60).optional(),
+  activeTtlMinutes: number2().int().positive().max(24 * 60).optional()
+}).strict();
+var rootPatchSchema = object({
+  $schema: string2().min(1).optional(),
+  defaultAgent: agentIdSchema.optional(),
+  agentsDirectory: string2().min(1).optional(),
+  agents: record(agentIdSchema, agentPatchSchema).optional(),
+  lease: leaseSchema.optional()
+}).strict();
+var resolvedAgentSchema = agentPatchSchema.extend({
+  description: string2().min(1),
+  mode: _enum(["primary", "subagent", "all"]),
+  models: array(modelRefSchema).min(1),
+  prompt: string2().min(1),
+  skills: array(string2().min(1)),
+  mcp: array(string2().min(1)),
+  permissions: array(permissionSchema),
+  fileLease: fileLeaseRoleSchema,
+  disabled: boolean2()
+});
+var SAFE_UNTRUSTED_AGENT_FIELDS = new Set(["description"]);
+function assertTrustedProjectPatch(patch, sourcePath, id, trusted, knownAgents) {
+  if (trusted)
+    return;
+  const fields = Object.keys(patch).filter((field) => !SAFE_UNTRUSTED_AGENT_FIELDS.has(field));
+  if (fields.length === 0 && knownAgents.has(id))
+    return;
+  throw new Error(`Untrusted project config ${sourcePath} cannot override ${fields.join(", ") || `unknown agent ${id}`}. ` + `Set ${PROJECT_TRUST_ENV} to the exact token returned by computeProjectTrustToken() after reviewing these files.`);
+}
+function readJsonc2(path) {
+  const errors = [];
+  const value = parse2(readFileSync2(path, "utf8"), errors, {
+    allowTrailingComma: true,
+    disallowComments: false
+  });
+  if (errors.length > 0) {
+    const details = errors.map((error) => `${printParseErrorCode(error.error)} at offset ${error.offset}`).join(", ");
+    throw new Error(`Invalid JSONC in ${path}: ${details}`);
+  }
+  return value;
+}
+function assertWithin(base, target, label) {
+  const child = relative3(base, target);
+  if (child === "" || !child.startsWith("..") && !isAbsolute4(child))
+    return;
+  throw new Error(`${label} must stay inside ${base}: ${target}`);
+}
+function resolvePrompt(patch, sourcePath, layerDirectory) {
+  if (!patch.prompt)
+    return patch;
+  const prompt = resolve4(dirname3(sourcePath), patch.prompt);
+  assertWithin(layerDirectory, prompt, "Agent prompt");
+  if (!existsSync3(prompt))
+    throw new Error(`Agent prompt is missing: ${prompt}`);
+  const promptStat = lstatSync3(prompt);
+  if (promptStat.isSymbolicLink() || !promptStat.isFile())
+    throw new Error(`Agent prompt must be a regular non-symlink file: ${prompt}`);
+  const canonical = realpathSync3(prompt);
+  assertWithin(realpathSync3(layerDirectory), canonical, "Agent prompt");
+  const promptContent = readFileSync2(canonical, "utf8");
+  return { ...patch, prompt: canonical, promptContent };
+}
+function loadLayer(directory, rootFileName, required, projectPolicy) {
+  const rootPath = join3(directory, rootFileName);
+  if (!existsSync3(rootPath)) {
+    if (required)
+      throw new Error(`Required config is missing: ${rootPath}`);
+    return { agents: {}, sources: [] };
+  }
+  const root = rootPatchSchema.parse(readJsonc2(rootPath));
+  if (projectPolicy && !projectPolicy.trusted) {
+    const restricted = ["defaultAgent", "agentsDirectory", "lease"].filter((field) => Object.prototype.hasOwnProperty.call(root, field));
+    if (restricted.length > 0)
+      throw new Error(`Untrusted project config ${rootPath} cannot override ${restricted.join(", ")}`);
+  }
+  const agents = {};
+  for (const [id, patch] of Object.entries(root.agents ?? {})) {
+    if (projectPolicy)
+      assertTrustedProjectPatch(patch, rootPath, id, projectPolicy.trusted, projectPolicy.knownAgents);
+    agents[id] = resolvePrompt(patch, rootPath, directory);
+  }
+  const agentsDirectory = resolve4(directory, root.agentsDirectory ?? "agents");
+  assertWithin(directory, agentsDirectory, "agentsDirectory");
+  if (existsSync3(agentsDirectory)) {
+    const directoryStat = lstatSync3(agentsDirectory);
+    if (directoryStat.isSymbolicLink() || !directoryStat.isDirectory()) {
+      throw new Error(`agentsDirectory must be a regular directory: ${agentsDirectory}`);
+    }
+    assertWithin(realpathSync3(directory), realpathSync3(agentsDirectory), "agentsDirectory");
+    for (const entry of readdirSync2(agentsDirectory, { withFileTypes: true }).sort((a, b) => a.name.localeCompare(b.name))) {
+      if (!entry.isFile() || !entry.name.endsWith(".jsonc"))
+        continue;
+      const id = entry.name.slice(0, -".jsonc".length);
+      agentIdSchema.parse(id);
+      const agentPath = join3(agentsDirectory, entry.name);
+      const patch = agentPatchSchema.parse(readJsonc2(agentPath));
+      if (projectPolicy)
+        assertTrustedProjectPatch(patch, agentPath, id, projectPolicy.trusted, projectPolicy.knownAgents);
+      agents[id] = mergeAgent(agents[id], resolvePrompt(patch, agentPath, directory));
+    }
+  }
+  return {
+    defaultAgent: root.defaultAgent,
+    agents,
+    lease: root.lease,
+    sources: [rootPath]
+  };
+}
+function mergeAgent(base, override) {
+  return { ...base ?? {}, ...override };
+}
+function resolveAgentConfig(patch) {
+  const parsed = agentPatchSchema.extend({ promptContent: string2().optional() }).parse(patch);
+  const { promptContent, ...agentPatch } = parsed;
+  const resolved = resolvedAgentSchema.parse({
+    skills: [],
+    mcp: [],
+    permissions: [],
+    fileLease: "readonly",
+    disabled: false,
+    ...agentPatch
+  });
+  return promptContent === undefined ? resolved : { ...resolved, promptContent };
+}
+function findPackageRoot() {
+  let current = dirname3(fileURLToPath(import.meta.url));
+  while (true) {
+    if (existsSync3(join3(current, "defaults", "default.jsonc")))
+      return current;
+    const parent = dirname3(current);
+    if (parent === current)
+      break;
+    current = parent;
+  }
+  throw new Error("Unable to locate agent-gvozd package defaults");
+}
+function findProjectRoot(start) {
+  let current = resolve4(start);
+  while (true) {
+    const git = join3(current, ".git");
+    if (existsSync3(git))
+      return current;
+    const parent = dirname3(current);
+    if (parent === current)
+      return resolve4(start);
+    current = parent;
+  }
+}
+function loadConfig(projectDirectory, options = {}) {
+  const projectRoot = findProjectRoot(projectDirectory);
+  const packageRoot = findPackageRoot();
+  const projectConfigDirectory = join3(projectRoot, "docs", ".gvozd");
+  const globalConfigDirectory = join3(resolveOpenCodeConfigRoot(options.env, options.platform, options.home, options.configRoot), "gvozd");
+  const baseLayers = [
+    loadLayer(join3(packageRoot, "defaults"), "default.jsonc", true),
+    loadLayer(globalConfigDirectory, "config.jsonc", false)
+  ];
+  const knownAgents = new Set(baseLayers.flatMap((layer) => Object.keys(layer.agents)));
+  const includeProject = options.includeProject !== false;
+  const suppliedToken = includeProject ? options.projectTrustToken ?? (options.env ?? process.env)[PROJECT_TRUST_ENV] : undefined;
+  const trustProjectConfig = includeProject && suppliedToken !== undefined && suppliedToken === computeProjectTrustToken(projectRoot);
+  const projectLayer = includeProject ? loadLayer(projectConfigDirectory, "config.jsonc", false, { trusted: trustProjectConfig, knownAgents }) : undefined;
+  if (trustProjectConfig && suppliedToken !== computeProjectTrustToken(projectRoot)) {
+    throw new Error("Project configuration changed while its trust token was being validated; review it and compute a new token");
+  }
+  const layers = [...baseLayers, ...projectLayer ? [projectLayer] : []];
+  const lease = {
+    reservationTtlMs: DEFAULT_RESERVATION_TTL_MS,
+    activeTtlMs: DEFAULT_ACTIVE_TTL_MS
+  };
+  for (const layer of layers) {
+    if (!layer.lease)
+      continue;
+    if (layer.lease.reservationTtlMinutes !== undefined) {
+      lease.reservationTtlMs = layer.lease.reservationTtlMinutes * 60000;
+    }
+    if (layer.lease.activeTtlMinutes !== undefined) {
+      lease.activeTtlMs = layer.lease.activeTtlMinutes * 60000;
+    }
+  }
+  let defaultAgent;
+  const agents = {};
+  for (const layer of layers) {
+    defaultAgent = layer.defaultAgent ?? defaultAgent;
+    for (const [id, patch] of Object.entries(layer.agents)) {
+      agents[id] = mergeAgent(agents[id], patch);
+    }
+  }
+  if (!defaultAgent)
+    throw new Error("defaultAgent is not configured");
+  const resolvedAgents = Object.fromEntries(Object.entries(agents).map(([id, patch]) => [
+    id,
+    (() => {
+      const agent = resolveAgentConfig(patch);
+      if (agent.promptContent === undefined)
+        throw new Error(`Agent prompt snapshot is missing after configuration load: ${agent.prompt}`);
+      return agent;
+    })()
+  ]));
+  const defaultConfig = resolvedAgents[defaultAgent];
+  if (!defaultConfig || defaultConfig.disabled || defaultConfig.mode === "subagent") {
+    throw new Error(`defaultAgent must reference an enabled primary agent: ${defaultAgent}`);
+  }
+  return {
+    defaultAgent,
+    agents: resolvedAgents,
+    lease,
+    packageRoot,
+    projectRoot,
+    projectConfigDirectory,
+    globalConfigDirectory,
+    sources: layers.flatMap((layer) => layer.sources)
+  };
+}
+
 // src/file-lease-plugin.ts
 var GVOZD_LEASE_TOOL = "gvozd_lease";
 var GVOZD_CLAIM_TOOL = "gvozd_claim";
@@ -5968,26 +6356,12 @@ var TERMINAL_SESSION_EVENTS = new Set([
   "session.idle",
   "session.deleted"
 ]);
-var SAFE_SHELL_DURING_ACTIVE_LEASES = new Set([
-  "git status",
-  "git status --short",
-  "git status --short --branch",
-  "git status --porcelain=v1 --branch",
-  "git rev-parse --show-toplevel",
-  "git rev-parse --git-dir",
-  "git remote -v",
-  "git branch --show-current",
-  "git stash list",
-  "GIT_OPTIONAL_LOCKS=0 git status",
-  "GIT_OPTIONAL_LOCKS=0 git status --short",
-  "GIT_OPTIONAL_LOCKS=0 git status --short --branch",
-  "GIT_OPTIONAL_LOCKS=0 git status --porcelain=v1 --branch",
-  "GIT_OPTIONAL_LOCKS=0 git rev-parse --show-toplevel",
-  "GIT_OPTIONAL_LOCKS=0 git rev-parse --git-dir",
-  "GIT_OPTIONAL_LOCKS=0 git remote -v",
-  "GIT_OPTIONAL_LOCKS=0 git branch --show-current",
-  "GIT_OPTIONAL_LOCKS=0 git stash list"
-]);
+var SAFE_SHELL_DURING_ACTIVE_LEASES = new Set([...INSPECTION_COMMANDS, ...TOOLCHAIN_COMMANDS, ...GIT_READONLY_COMMANDS].flatMap(({ exact, wildcard }) => [
+  exact,
+  wildcard,
+  ...GIT_ENV_PREFIXES.map((prefix) => `${prefix} ${exact}`),
+  ...GIT_ENV_PREFIXES.map((prefix) => `${prefix} ${wildcard}`)
+]));
 var leaseInputSchema = discriminatedUnion("operation", [
   object({
     operation: literal("reserve"),
@@ -6037,8 +6411,8 @@ function deny(event, message) {
   event.message = message;
   return true;
 }
-function safeGitInspection(agent, resources) {
-  return agent === "git" && resources.length > 0 && resources.every((resource) => SAFE_SHELL_DURING_ACTIVE_LEASES.has(resource));
+function safeReadonlyShell(agent, resources) {
+  return agent !== undefined && resources.length > 0 && resources.every((resource) => SAFE_SHELL_DURING_ACTIVE_LEASES.has(resource));
 }
 function enforceFileLeasePermission(event, config, manager) {
   const role = roleOf(config, event.agent);
@@ -6061,7 +6435,7 @@ function enforceFileLeasePermission(event, config, manager) {
   if (role === "coordinator" || role === "writer") {
     return deny(event, `Agent ${event.agent} cannot use shell while file leases enforce structured mutations`);
   }
-  if (manager.hasActiveLeases() && !(role === "readonly" && safeGitInspection(event.agent, event.resources))) {
+  if (manager.hasActiveLeases() && !(role === "readonly" && safeReadonlyShell(event.agent, event.resources))) {
     return deny(event, "Shell commands are paused until all active writer file leases are released");
   }
   return false;
@@ -6085,8 +6459,14 @@ function requireRole(config, agentID, allowed) {
   }
   return role;
 }
-async function installFileLeaseRuntime(ctx, config) {
-  const manager = new FileLeaseManager({ projectRoot: config.projectRoot });
+async function installFileLeaseRuntime(ctx, config, options = {}) {
+  const caseInsensitive = options.caseInsensitive ?? resolveCaseInsensitiveFilesystem(options.env ?? process.env, options.platform ?? process.platform);
+  const manager = new FileLeaseManager({
+    projectRoot: config.projectRoot,
+    caseInsensitive,
+    reservationTtlMs: config.lease.reservationTtlMs,
+    activeTtlMs: config.lease.activeTtlMs
+  });
   const toolTransform = await ctx.tool.transform((tools) => {
     tools.namespace({
       name: "gvozd",
@@ -6176,43 +6556,103 @@ async function installFileLeaseRuntime(ctx, config) {
   };
 }
 
-// src/index.ts
-function normalizeMcpName(name) {
-  return name.replaceAll(/[^A-Za-z0-9_-]/g, "_");
-}
-function wildcardMatch(pattern, value) {
-  let source = "^";
-  for (const character of pattern) {
-    if (character === "*")
-      source += ".*";
-    else if (character === "?")
-      source += ".";
-    else
-      source += character.replace(/[\\^$.*+?()[\]{}|]/g, "\\$&");
+// src/runtime-events.ts
+function redactDiagnostic(error) {
+  const message = error instanceof Error ? error.message : String(error);
+  return message.replace(/-----BEGIN [^-\r\n]*PRIVATE KEY-----[\s\S]*?-----END [^-\r\n]*PRIVATE KEY-----/gi, "[redacted private key]").replace(/\b([a-z][a-z0-9+.-]*:\/\/)[^\s/@]+:[^\s/@]*@/gi, "$1[redacted]@").replace(/([?&](?:access_?token|auth(?:orization)?|api_?key|cookie|credential|password|secret|token)=)[^&#\s]*/gi, "$1[redacted]").replace(/\bBearer\s+[^\s,;]+/gi, "Bearer [redacted]").replace(/\b([A-Za-z0-9_]*(?:token|password|authorization|api_?key|secret|credential|cookie)[A-Za-z0-9_]*)\s*[:=]\s*["']?[^\s,;}"']+/gi, "$1=[redacted]").replace(/\s+/g, " ").slice(0, 300);
+}
+async function disposeResources(resources, diagnostic) {
+  const failures = [];
+  for (const resource of [...resources].reverse()) {
+    try {
+      await resource.dispose();
+    } catch (error) {
+      failures.push(error);
+      diagnostic?.(`agent-gvozd cleanup failed: ${redactDiagnostic(error)}`);
+    }
   }
-  return new RegExp(`${source}$`).test(value);
+  if (failures.length > 0)
+    throw new AggregateError(failures, "agent-gvozd cleanup failed");
 }
-function explicitMcpAccess(agent, action, resources) {
-  if (resources.length === 0)
-    return false;
-  return resources.every((resource) => {
-    const matching = agent.permissions.filter((rule) => wildcardMatch(rule.action, action) && wildcardMatch(rule.resource, resource));
-    const effect = matching.at(-1)?.effect;
-    return effect === "allow" || effect === "ask";
+var DEFAULT_RETRY_BASE_DELAY_MS = 25;
+var DEFAULT_RETRY_MAX_DELAY_MS = 30000;
+function defaultDelay(milliseconds, signal) {
+  if (signal.aborted)
+    return Promise.resolve();
+  return new Promise((resolve) => {
+    const timeout = setTimeout(finish, milliseconds);
+    function finish() {
+      clearTimeout(timeout);
+      signal.removeEventListener("abort", finish);
+      resolve();
+    }
+    signal.addEventListener("abort", finish, { once: true });
   });
 }
-function mcpPermissions(agent, mcpServers) {
-  return mcpServers.flatMap((server) => {
-    const prefix = `${normalizeMcpName(server)}_`;
-    const baseline = {
-      action: `${prefix}*`,
-      resource: "*",
-      effect: agent.mcp.includes(server) ? "allow" : "deny"
-    };
-    const explicit = agent.permissions.filter((rule) => rule.action.startsWith(prefix));
-    return [baseline, ...explicit];
+function retryDelay(attempt, baseDelayMs, maxDelayMs, random) {
+  const capped = Math.min(baseDelayMs * 2 ** attempt, maxDelayMs);
+  const boundedRandom = Math.max(0, Math.min(1, random()));
+  return Math.round(capped * (0.5 + boundedRandom * 0.5));
+}
+async function waitForRetry(delay, milliseconds, signal) {
+  if (signal.aborted)
+    return false;
+  let onAbort;
+  const aborted = new Promise((resolve) => {
+    onAbort = () => resolve();
+    signal.addEventListener("abort", onAbort, { once: true });
+    if (signal.aborted)
+      onAbort();
   });
+  try {
+    await Promise.race([delay(milliseconds, signal), aborted]);
+  } finally {
+    signal.removeEventListener("abort", onAbort);
+  }
+  return !signal.aborted;
+}
+function startRuntimeEventLoop(input) {
+  const controller = new AbortController;
+  const delay = input.delay ?? defaultDelay;
+  const random = input.random ?? Math.random;
+  const baseDelayMs = Math.max(1, input.retryBaseDelayMs ?? DEFAULT_RETRY_BASE_DELAY_MS);
+  const maxDelayMs = Math.max(baseDelayMs, input.retryMaxDelayMs ?? DEFAULT_RETRY_MAX_DELAY_MS);
+  const done = (async () => {
+    let retryAttempt = 0;
+    while (!controller.signal.aborted) {
+      try {
+        for await (const event of input.subscribe(controller.signal)) {
+          retryAttempt = 0;
+          try {
+            await input.handle(event);
+          } catch (error) {
+            input.diagnostic(`agent-gvozd runtime refresh failed: ${redactDiagnostic(error)}`);
+          }
+        }
+        if (controller.signal.aborted)
+          return;
+        input.diagnostic("agent-gvozd event subscription ended unexpectedly");
+      } catch (error) {
+        if (controller.signal.aborted)
+          return;
+        input.diagnostic(`agent-gvozd event subscription failed: ${redactDiagnostic(error)}`);
+      }
+      const milliseconds = retryDelay(retryAttempt, baseDelayMs, maxDelayMs, random);
+      retryAttempt += 1;
+      if (!await waitForRetry(delay, milliseconds, controller.signal))
+        return;
+    }
+  })();
+  return {
+    done,
+    async dispose() {
+      controller.abort();
+      await done;
+    }
+  };
 }
+
+// src/index.ts
 function selectModel(models, available) {
   const configured = models.map((model) => Model.Ref.parse(model));
   const selected = configured.find((candidate) => {
@@ -6232,11 +6672,14 @@ function applyAgentConfiguration(agents, config, models, mcpServers) {
     if (!agents.get(id))
       continue;
     agents.update(id, (agent) => {
+      if (configured.promptContent === undefined) {
+        throw new Error(`Agent ${id} is missing its immutable prompt snapshot (${configured.prompt})`);
+      }
       agent.description = configured.description;
       agent.mode = configured.mode;
-      agent.system = readFileSync2(configured.prompt, "utf8").trim();
+      agent.system = configured.promptContent.trim();
       agent.model = selectModel(configured.models, models);
-      agent.permissions.push(...mcpPermissions(configured, mcpServers));
+      agent.permissions = buildAgentPermissions(configured, mcpServers);
     });
   }
   if (agents.get(config.defaultAgent))
@@ -6245,74 +6688,82 @@ function applyAgentConfiguration(agents, config, models, mcpServers) {
 var src_default = Plugin.define({
   id: "agent-gvozd",
   async setup(ctx) {
-    const config = loadConfig(ctx.location.project.directory);
+    const caseInsensitive = resolveCaseInsensitiveFilesystem(process.env);
+    const config = loadConfig(ctx.location.project.directory, { env: process.env });
     const mcp = await ctx.mcp.list();
     let mcpServers = mcp.data.map((server) => server.name);
     let models = await ctx.catalog.model.list();
-    const fileLeases = await installFileLeaseRuntime(ctx, config);
-    const agentTransform = await ctx.agent.transform((agents) => {
-      applyAgentConfiguration(agents, config, models.data, mcpServers);
-    });
-    const permissionHook = await ctx.permission.hook("evaluate", async (event) => {
-      if (fileLeases.enforcePermission(event))
-        return;
-      if (!event.agent)
-        return;
-      const configured = config.agents[event.agent];
-      if (!configured || configured.disabled)
-        return;
-      if (event.action === "skill") {
-        const allowed = new Set(configured.skills);
-        if (event.resources.some((resource) => !allowed.has(resource))) {
-          event.effect = "deny";
-          event.message = `Agent ${event.agent} cannot use this skill`;
+    const diagnostic = (message) => console.error(message);
+    const resources = [];
+    try {
+      const fileLeases = await installFileLeaseRuntime(ctx, config, { caseInsensitive });
+      resources.push(fileLeases);
+      const agentTransform = await ctx.agent.transform((agents) => {
+        applyAgentConfiguration(agents, config, models.data, mcpServers);
+      });
+      resources.push(agentTransform);
+      const permissionHook = await ctx.permission.hook("evaluate", async (event) => {
+        if (fileLeases.enforcePermission(event))
+          return;
+        if (!event.agent)
+          return;
+        const configured = config.agents[event.agent];
+        if (!configured || configured.disabled)
+          return;
+        if (event.action === "skill") {
+          const allowed = new Set(configured.skills);
+          if (event.resources.some((resource) => !allowed.has(resource))) {
+            event.effect = "deny";
+            event.message = `Agent ${event.agent} cannot use this skill`;
+          }
+          return;
         }
-        return;
-      }
-      let matchingServers = mcpServers.filter((server) => event.action.startsWith(`${normalizeMcpName(server)}_`));
-      if (matchingServers.length === 0 && event.action.includes("_")) {
-        const mcp = await ctx.mcp.list();
-        mcpServers = mcp.data.map((server) => server.name);
-        matchingServers = mcpServers.filter((server) => event.action.startsWith(`${normalizeMcpName(server)}_`));
-      }
-      if (matchingServers.length === 0)
-        return;
-      if (matchingServers.length > 1) {
-        event.effect = "deny";
-        event.message = `MCP action has an ambiguous server prefix: ${matchingServers.join(", ")}`;
-        return;
-      }
-      if (!matchingServers.some((server) => configured.mcp.includes(server)) && !explicitMcpAccess(configured, event.action, event.resources)) {
-        event.effect = "deny";
-        event.message = `Agent ${event.agent} cannot use this MCP server`;
-      }
-    });
-    const events = new AbortController;
-    const refreshMcp = (async () => {
-      for await (const event of ctx.event.subscribe({ signal: events.signal })) {
-        fileLeases.handleEvent(event);
-        if (event.type === "mcp.status.changed") {
+        let matchingServers = matchingMcpServers(event.action, mcpServers);
+        if (matchingServers.length === 0 && event.action.includes("_")) {
           const mcp = await ctx.mcp.list();
-          const next = mcp.data.map((server) => server.name);
-          if (next.length === mcpServers.length && next.every((server, index) => server === mcpServers[index]))
-            continue;
-          mcpServers = next;
-          await ctx.agent.reload();
+          mcpServers = mcp.data.map((server) => server.name);
+          matchingServers = matchingMcpServers(event.action, mcpServers);
+        }
+        if (matchingServers.length === 0)
+          return;
+        if (matchingServers.length > 1) {
+          event.effect = "deny";
+          event.message = `MCP action has an ambiguous server prefix: ${matchingServers.join(", ")}`;
+          return;
         }
-        if (event.type === "catalog.updated") {
-          models = await ctx.catalog.model.list();
-          await ctx.agent.reload();
+        if (!matchingServers.some((server) => configured.mcp.includes(server)) && !explicitMcpAccess(configured, event.action, event.resources)) {
+          event.effect = "deny";
+          event.message = `Agent ${event.agent} cannot use this MCP server`;
         }
-      }
-    })();
-    refreshMcp.catch(() => {});
-    return async () => {
-      events.abort();
-      await refreshMcp.catch(() => {});
-      await fileLeases.dispose();
-      await permissionHook.dispose();
-      await agentTransform.dispose();
-    };
+      });
+      resources.push(permissionHook);
+      const eventLoop = startRuntimeEventLoop({
+        subscribe: (signal) => ctx.event.subscribe({ signal }),
+        diagnostic,
+        async handle(event) {
+          fileLeases.handleEvent(event);
+          if (event.type === "mcp.status.changed") {
+            const mcp = await ctx.mcp.list();
+            const next = mcp.data.map((server) => server.name);
+            if (next.length === mcpServers.length && next.every((server, index) => server === mcpServers[index]))
+              return;
+            mcpServers = next;
+            await ctx.agent.reload();
+          }
+          if (event.type === "catalog.updated") {
+            models = await ctx.catalog.model.list();
+            await ctx.agent.reload();
+          }
+        }
+      });
+      resources.push(eventLoop);
+      return async () => disposeResources(resources, diagnostic);
+    } catch (error) {
+      try {
+        await disposeResources(resources, diagnostic);
+      } catch {}
+      throw error;
+    }
   }
 });
 export {