@nail00749/agent-gvozd 0.1.2 → 0.1.4

package/dist/index.js

@@ -2,6 +2,77 @@
 // src/index.ts
 import { Model, Plugin } from "@opencode/plugin";
 
+// src/tool-permissions.ts
+function family(command, ...variants) {
+  return [command, ...variants].map((entry) => ({
+    exact: entry,
+    wildcard: `${entry} *`
+  }));
+}
+function exactOnly(command, ...variants) {
+  return [command, ...variants].map((entry) => ({ exact: entry, wildcard: entry }));
+}
+var INSPECTION_COMMANDS = [
+  ...family("pwd", "true", "test"),
+  ...family("cat", "head", "tail", "wc", "sort", "uniq"),
+  ...family("grep", "rg", "find", "diff", "cmp"),
+  ...family("ls", "du", "df", "stat", "file", "realpath", "basename", "dirname"),
+  ...family("shasum", "sha256sum", "md5sum"),
+  ...family("uname", "whoami", "hostname", "date", "printenv"),
+  ...family("which", "command -v"),
+  ...family("mktemp"),
+  ...family("tr", "cut", "paste", "column"),
+  ...family("node --version", "python3 --version", "python --version", "deno --version")
+];
+var TOOLCHAIN_COMMANDS = [
+  ...family("bun test", "bun run test", "bun --version"),
+  ...family("bun run typecheck", "bun run lint", "bun run build", "bun run check"),
+  ...family("tsc --noEmit", "npx tsc --noEmit"),
+  ...family("eslint", "biome check", "prettier --check"),
+  ...family("npm test", "npm run test", "npm run typecheck", "npm run lint", "npm run build"),
+  ...family("pnpm test", "pnpm run test", "pnpm run build"),
+  ...family("yarn test", "yarn build"),
+  ...family("vitest run", "jest", "playwright test"),
+  ...family("cargo check", "cargo test", "cargo build", "cargo clippy", "cargo fmt --check", "cargo --version"),
+  ...family("go build ./...", "go test ./...", "go vet ./...", "go version"),
+  ...family("pytest", "python3 -m pytest", "python -m pytest"),
+  ...family("ruff check", "mypy", "pyright"),
+  ...family("mvn test", "mvn verify", "gradle test", "gradle check", "./gradlew test", "./gradlew check"),
+  ...family("make test", "make check", "make build", "make --version"),
+  ...family("just --list")
+];
+var GIT_READONLY_COMMANDS = [
+  ...family("git status", "git status --short", "git status --short --branch", "git status --porcelain", "git status --porcelain=v1 --branch"),
+  ...family("git diff", "git diff --stat", "git diff --cached", "git diff --check"),
+  ...family("git log", "git show"),
+  ...family("git rev-parse", "git rev-list", "git show-ref", "git cat-file"),
+  ...exactOnly("git symbolic-ref HEAD", "git symbolic-ref --short HEAD"),
+  ...family("git ls-files", "git ls-remote", "git grep"),
+  ...exactOnly("git branch", "git tag", "git remote", "git reflog"),
+  ...family("git branch --list", "git branch -l", "git branch -a", "git branch -r", "git branch -v", "git branch -vv", "git branch --all", "git branch --remotes", "git branch --show-current", "git branch --contains"),
+  ...family("git tag --list", "git tag -l", "git tag -n"),
+  ...family("git remote -v", "git remote --verbose", "git remote show", "git remote get-url"),
+  ...family("git reflog show"),
+  ...family("git stash list", "git describe", "git worktree list"),
+  ...family("git config --get", "git config --get-regexp")
+];
+var GIT_MUTATING_COMMANDS = [
+  ...family("git add", "git rm --cached"),
+  ...family("git commit", "git merge --ff-only", "git merge --no-ff"),
+  ...family("git push", "git fetch", "git pull --ff-only"),
+  ...family("git stash", "git cherry-pick", "git revert"),
+  ...family("git switch", "git checkout -b", "git worktree add"),
+  ...exactOnly("git branch *", "git tag *", "git remote *", "git symbolic-ref *", "git reflog *")
+];
+var GIT_ENV_PREFIXES = ["GIT_OPTIONAL_LOCKS=0"];
+function withEnvPrefixes(rule, prefixes = GIT_ENV_PREFIXES) {
+  return prefixes.map((prefix) => ({
+    action: rule.action,
+    resource: `${prefix} ${rule.resource}`,
+    effect: rule.effect
+  }));
+}
+
 // src/agent-permissions.ts
 function normalizeMcpName(name) {
   return name.replaceAll(/[^A-Za-z0-9_-]/g, "_");
@@ -45,12 +116,21 @@ function buildAgentPermissions(agent, mcpServers) {
     });
     result.push(...agent.permissions.filter((rule) => rule.action.startsWith(prefix)));
   }
+  for (const rule of agent.permissions) {
+    if (rule.action !== "shell")
+      continue;
+    if (!/(^|\s|["'])git(?:$|\s)/.test(rule.resource))
+      continue;
+    if (rule.resource.startsWith("GIT_"))
+      continue;
+    result.push(...withEnvPrefixes(rule));
+  }
   return result;
 }
 
 // src/config.ts
-import { existsSync as existsSync2, lstatSync as lstatSync2, readdirSync as readdirSync2, readFileSync as readFileSync2, realpathSync as realpathSync2 } from "fs";
-import { dirname as dirname2, isAbsolute as isAbsolute3, join as join3, relative as relative2, resolve as resolve3 } from "path";
+import { existsSync as existsSync3, lstatSync as lstatSync3, readdirSync as readdirSync2, readFileSync as readFileSync2, realpathSync as realpathSync3 } from "fs";
+import { dirname as dirname3, isAbsolute as isAbsolute4, join as join3, relative as relative3, resolve as resolve4 } from "path";
 import { fileURLToPath } from "url";
 
 // node_modules/jsonc-parser/lib/esm/impl/scanner.js
@@ -5686,226 +5766,10 @@ function computeProjectTrustToken(projectDirectory) {
   return `sha256:${hash.digest("hex")}`;
 }
 
-// src/config.ts
-var permissionSchema = object({
-  action: string2().min(1),
-  resource: string2().min(1),
-  effect: _enum(["allow", "ask", "deny"])
-}).strict();
-var modelRefSchema = string2().min(1).regex(/^[^/#\s]+\/[^#\s]+(?:#[^#\s]+)?$/, "Expected provider/model or provider/model#variant");
-var agentIdSchema = string2().regex(/^[A-Za-z0-9][A-Za-z0-9_-]*$/, "Expected a filesystem-safe agent ID");
-var fileLeaseRoleSchema = _enum(["coordinator", "writer", "readonly"]);
-var agentPatchSchema = object({
-  description: string2().min(1).optional(),
-  mode: _enum(["primary", "subagent", "all"]).optional(),
-  models: array(modelRefSchema).min(1).optional(),
-  prompt: string2().min(1).optional(),
-  skills: array(string2().min(1)).optional(),
-  mcp: array(string2().min(1)).optional(),
-  permissions: array(permissionSchema).optional(),
-  fileLease: fileLeaseRoleSchema.optional(),
-  disabled: boolean2().optional()
-}).strict();
-var rootPatchSchema = object({
-  $schema: string2().min(1).optional(),
-  defaultAgent: agentIdSchema.optional(),
-  agentsDirectory: string2().min(1).optional(),
-  agents: record(agentIdSchema, agentPatchSchema).optional()
-}).strict();
-var resolvedAgentSchema = agentPatchSchema.extend({
-  description: string2().min(1),
-  mode: _enum(["primary", "subagent", "all"]),
-  models: array(modelRefSchema).min(1),
-  prompt: string2().min(1),
-  skills: array(string2().min(1)),
-  mcp: array(string2().min(1)),
-  permissions: array(permissionSchema),
-  fileLease: fileLeaseRoleSchema,
-  disabled: boolean2()
-});
-var SAFE_UNTRUSTED_AGENT_FIELDS = new Set(["description"]);
-function assertTrustedProjectPatch(patch, sourcePath, id, trusted, knownAgents) {
-  if (trusted)
-    return;
-  const fields = Object.keys(patch).filter((field) => !SAFE_UNTRUSTED_AGENT_FIELDS.has(field));
-  if (fields.length === 0 && knownAgents.has(id))
-    return;
-  throw new Error(`Untrusted project config ${sourcePath} cannot override ${fields.join(", ") || `unknown agent ${id}`}. ` + `Set ${PROJECT_TRUST_ENV} to the exact token returned by computeProjectTrustToken() after reviewing these files.`);
-}
-function readJsonc2(path) {
-  const errors = [];
-  const value = parse2(readFileSync2(path, "utf8"), errors, {
-    allowTrailingComma: true,
-    disallowComments: false
-  });
-  if (errors.length > 0) {
-    const details = errors.map((error) => `${printParseErrorCode(error.error)} at offset ${error.offset}`).join(", ");
-    throw new Error(`Invalid JSONC in ${path}: ${details}`);
-  }
-  return value;
-}
-function assertWithin(base, target, label) {
-  const child = relative2(base, target);
-  if (child === "" || !child.startsWith("..") && !isAbsolute3(child))
-    return;
-  throw new Error(`${label} must stay inside ${base}: ${target}`);
-}
-function resolvePrompt(patch, sourcePath, layerDirectory) {
-  if (!patch.prompt)
-    return patch;
-  const prompt = resolve3(dirname2(sourcePath), patch.prompt);
-  assertWithin(layerDirectory, prompt, "Agent prompt");
-  if (!existsSync2(prompt))
-    throw new Error(`Agent prompt is missing: ${prompt}`);
-  const promptStat = lstatSync2(prompt);
-  if (promptStat.isSymbolicLink() || !promptStat.isFile())
-    throw new Error(`Agent prompt must be a regular non-symlink file: ${prompt}`);
-  const canonical = realpathSync2(prompt);
-  assertWithin(realpathSync2(layerDirectory), canonical, "Agent prompt");
-  const promptContent = readFileSync2(canonical, "utf8");
-  return { ...patch, prompt: canonical, promptContent };
-}
-function loadLayer(directory, rootFileName, required, projectPolicy) {
-  const rootPath = join3(directory, rootFileName);
-  if (!existsSync2(rootPath)) {
-    if (required)
-      throw new Error(`Required config is missing: ${rootPath}`);
-    return { agents: {}, sources: [] };
-  }
-  const root = rootPatchSchema.parse(readJsonc2(rootPath));
-  if (projectPolicy && !projectPolicy.trusted) {
-    const restricted = ["defaultAgent", "agentsDirectory"].filter((field) => Object.prototype.hasOwnProperty.call(root, field));
-    if (restricted.length > 0)
-      throw new Error(`Untrusted project config ${rootPath} cannot override ${restricted.join(", ")}`);
-  }
-  const agents = {};
-  for (const [id, patch] of Object.entries(root.agents ?? {})) {
-    if (projectPolicy)
-      assertTrustedProjectPatch(patch, rootPath, id, projectPolicy.trusted, projectPolicy.knownAgents);
-    agents[id] = resolvePrompt(patch, rootPath, directory);
-  }
-  const agentsDirectory = resolve3(directory, root.agentsDirectory ?? "agents");
-  assertWithin(directory, agentsDirectory, "agentsDirectory");
-  if (existsSync2(agentsDirectory)) {
-    const directoryStat = lstatSync2(agentsDirectory);
-    if (directoryStat.isSymbolicLink() || !directoryStat.isDirectory()) {
-      throw new Error(`agentsDirectory must be a regular directory: ${agentsDirectory}`);
-    }
-    assertWithin(realpathSync2(directory), realpathSync2(agentsDirectory), "agentsDirectory");
-    for (const entry of readdirSync2(agentsDirectory, { withFileTypes: true }).sort((a, b) => a.name.localeCompare(b.name))) {
-      if (!entry.isFile() || !entry.name.endsWith(".jsonc"))
-        continue;
-      const id = entry.name.slice(0, -".jsonc".length);
-      agentIdSchema.parse(id);
-      const agentPath = join3(agentsDirectory, entry.name);
-      const patch = agentPatchSchema.parse(readJsonc2(agentPath));
-      if (projectPolicy)
-        assertTrustedProjectPatch(patch, agentPath, id, projectPolicy.trusted, projectPolicy.knownAgents);
-      agents[id] = mergeAgent(agents[id], resolvePrompt(patch, agentPath, directory));
-    }
-  }
-  return {
-    defaultAgent: root.defaultAgent,
-    agents,
-    sources: [rootPath]
-  };
-}
-function mergeAgent(base, override) {
-  return { ...base ?? {}, ...override };
-}
-function resolveAgentConfig(patch) {
-  const parsed = agentPatchSchema.extend({ promptContent: string2().optional() }).parse(patch);
-  const { promptContent, ...agentPatch } = parsed;
-  const resolved = resolvedAgentSchema.parse({
-    skills: [],
-    mcp: [],
-    permissions: [],
-    fileLease: "readonly",
-    disabled: false,
-    ...agentPatch
-  });
-  return promptContent === undefined ? resolved : { ...resolved, promptContent };
-}
-function findPackageRoot() {
-  let current = dirname2(fileURLToPath(import.meta.url));
-  while (true) {
-    if (existsSync2(join3(current, "defaults", "default.jsonc")))
-      return current;
-    const parent = dirname2(current);
-    if (parent === current)
-      break;
-    current = parent;
-  }
-  throw new Error("Unable to locate agent-gvozd package defaults");
-}
-function findProjectRoot(start) {
-  let current = resolve3(start);
-  while (true) {
-    const git = join3(current, ".git");
-    if (existsSync2(git))
-      return current;
-    const parent = dirname2(current);
-    if (parent === current)
-      return resolve3(start);
-    current = parent;
-  }
-}
-function loadConfig(projectDirectory, options = {}) {
-  const projectRoot = findProjectRoot(projectDirectory);
-  const packageRoot = findPackageRoot();
-  const projectConfigDirectory = join3(projectRoot, "docs", ".gvozd");
-  const globalConfigDirectory = join3(resolveOpenCodeConfigRoot(options.env, options.platform, options.home, options.configRoot), "gvozd");
-  const baseLayers = [
-    loadLayer(join3(packageRoot, "defaults"), "default.jsonc", true),
-    loadLayer(globalConfigDirectory, "config.jsonc", false)
-  ];
-  const knownAgents = new Set(baseLayers.flatMap((layer) => Object.keys(layer.agents)));
-  const includeProject = options.includeProject !== false;
-  const suppliedToken = includeProject ? options.projectTrustToken ?? (options.env ?? process.env)[PROJECT_TRUST_ENV] : undefined;
-  const trustProjectConfig = includeProject && suppliedToken !== undefined && suppliedToken === computeProjectTrustToken(projectRoot);
-  const projectLayer = includeProject ? loadLayer(projectConfigDirectory, "config.jsonc", false, { trusted: trustProjectConfig, knownAgents }) : undefined;
-  if (trustProjectConfig && suppliedToken !== computeProjectTrustToken(projectRoot)) {
-    throw new Error("Project configuration changed while its trust token was being validated; review it and compute a new token");
-  }
-  const layers = [...baseLayers, ...projectLayer ? [projectLayer] : []];
-  let defaultAgent;
-  const agents = {};
-  for (const layer of layers) {
-    defaultAgent = layer.defaultAgent ?? defaultAgent;
-    for (const [id, patch] of Object.entries(layer.agents)) {
-      agents[id] = mergeAgent(agents[id], patch);
-    }
-  }
-  if (!defaultAgent)
-    throw new Error("defaultAgent is not configured");
-  const resolvedAgents = Object.fromEntries(Object.entries(agents).map(([id, patch]) => [
-    id,
-    (() => {
-      const agent = resolveAgentConfig(patch);
-      if (agent.promptContent === undefined)
-        throw new Error(`Agent prompt snapshot is missing after configuration load: ${agent.prompt}`);
-      return agent;
-    })()
-  ]));
-  const defaultConfig = resolvedAgents[defaultAgent];
-  if (!defaultConfig || defaultConfig.disabled || defaultConfig.mode === "subagent") {
-    throw new Error(`defaultAgent must reference an enabled primary agent: ${defaultAgent}`);
-  }
-  return {
-    defaultAgent,
-    agents: resolvedAgents,
-    packageRoot,
-    projectRoot,
-    projectConfigDirectory,
-    globalConfigDirectory,
-    sources: layers.flatMap((layer) => layer.sources)
-  };
-}
-
 // src/file-leases.ts
 import { randomUUID } from "crypto";
-import { existsSync as existsSync3, lstatSync as lstatSync3, realpathSync as realpathSync3, statSync } from "fs";
-import { basename, dirname as dirname3, isAbsolute as isAbsolute4, relative as relative3, resolve as resolve4, sep } from "path";
+import { existsSync as existsSync2, lstatSync as lstatSync2, realpathSync as realpathSync2, statSync } from "fs";
+import { basename, dirname as dirname2, isAbsolute as isAbsolute3, relative as relative2, resolve as resolve3, sep } from "path";
 
 class LeaseError extends Error {
   code;
@@ -5941,11 +5805,11 @@ function assertPositiveDuration(value, label) {
   return value;
 }
 function isWithin(root, target) {
-  const child = relative3(root, target);
-  return child !== "" && !child.startsWith(`..${sep}`) && child !== ".." && !isAbsolute4(child);
+  const child = relative2(root, target);
+  return child !== "" && !child.startsWith(`..${sep}`) && child !== ".." && !isAbsolute3(child);
 }
 function displayPath(root, target) {
-  return relative3(root, target).replaceAll("\\", "/");
+  return relative2(root, target).replaceAll("\\", "/");
 }
 
 class FileLeaseManager {
@@ -5959,7 +5823,7 @@ class FileLeaseManager {
   fileOwners = new Map;
   sessionOwners = new Map;
   constructor(options) {
-    this.projectRoot = realpathSync3(options.projectRoot);
+    this.projectRoot = realpathSync2(options.projectRoot);
     if (!statSync(this.projectRoot).isDirectory())
       throw new Error(`Project root is not a directory: ${this.projectRoot}`);
     this.reservationTtlMs = assertPositiveDuration(options.reservationTtlMs ?? DEFAULT_RESERVATION_TTL_MS, "reservationTtlMs");
@@ -6175,7 +6039,7 @@ class FileLeaseManager {
     const value = input.trim();
     if (value === "" || value.includes("\x00"))
       throw new LeaseError("INVALID_PATH", "File path must not be empty");
-    if (!allowAbsolute && isAbsolute4(value))
+    if (!allowAbsolute && isAbsolute3(value))
       throw new LeaseError("INVALID_PATH", `Absolute lease path is not allowed: ${value}`);
     if (value.includes("*") || value.includes("?")) {
       throw new LeaseError("INVALID_PATH", `Lease paths must name exact files, not patterns: ${value}`);
@@ -6183,14 +6047,14 @@ class FileLeaseManager {
     if (value.endsWith("/") || value.endsWith("\\")) {
       throw new LeaseError("INVALID_PATH", `Lease paths must name files, not directories: ${value}`);
     }
-    const candidate = resolve4(this.projectRoot, value);
-    if ((!allowAbsolute || !isAbsolute4(value)) && !isWithin(this.projectRoot, candidate)) {
+    const candidate = resolve3(this.projectRoot, value);
+    if ((!allowAbsolute || !isAbsolute3(value)) && !isWithin(this.projectRoot, candidate)) {
       throw new LeaseError("INVALID_PATH", `File must stay inside the project root: ${value}`);
     }
     const code = allowAbsolute ? "OUT_OF_SCOPE" : "INVALID_PATH";
-    if (existsSync3(candidate)) {
+    if (existsSync2(candidate)) {
       try {
-        const target = lstatSync3(candidate);
+        const target = lstatSync2(candidate);
         if (!target.isSymbolicLink() && !target.isFile()) {
           throw new LeaseError(code, `Lease targets must be regular files: ${value}`);
         }
@@ -6203,8 +6067,8 @@ class FileLeaseManager {
     }
     let ancestor = candidate;
     const suffix = [];
-    while (!existsSync3(ancestor)) {
-      const parent = dirname3(ancestor);
+    while (!existsSync2(ancestor)) {
+      const parent = dirname2(ancestor);
       if (parent === ancestor)
         throw new LeaseError("INVALID_PATH", `Cannot resolve file path: ${value}`);
       suffix.unshift(basename(ancestor));
@@ -6212,16 +6076,16 @@ class FileLeaseManager {
     }
     let canonicalAncestor;
     try {
-      canonicalAncestor = realpathSync3(ancestor);
+      canonicalAncestor = realpathSync2(ancestor);
     } catch {
       throw new LeaseError("INVALID_PATH", `Cannot canonicalize file path: ${value}`);
     }
-    const canonical = resolve4(canonicalAncestor, ...suffix);
+    const canonical = resolve3(canonicalAncestor, ...suffix);
     if (!isWithin(this.projectRoot, canonical)) {
       throw new LeaseError("INVALID_PATH", `File resolves outside the project root: ${value}`);
     }
     try {
-      const target = lstatSync3(canonical);
+      const target = lstatSync2(canonical);
       if (!target.isFile()) {
         throw new LeaseError(code, `Lease targets must be regular files: ${value}`);
       }
@@ -6253,6 +6117,243 @@ class FileLeaseManager {
   }
 }
 
+// src/config.ts
+var permissionSchema = object({
+  action: string2().min(1),
+  resource: string2().min(1),
+  effect: _enum(["allow", "ask", "deny"])
+}).strict();
+var modelRefSchema = string2().min(1).regex(/^[^/#\s]+\/[^#\s]+(?:#[^#\s]+)?$/, "Expected provider/model or provider/model#variant");
+var agentIdSchema = string2().regex(/^[A-Za-z0-9][A-Za-z0-9_-]*$/, "Expected a filesystem-safe agent ID");
+var fileLeaseRoleSchema = _enum(["coordinator", "writer", "readonly"]);
+var agentPatchSchema = object({
+  description: string2().min(1).optional(),
+  mode: _enum(["primary", "subagent", "all"]).optional(),
+  models: array(modelRefSchema).min(1).optional(),
+  prompt: string2().min(1).optional(),
+  skills: array(string2().min(1)).optional(),
+  mcp: array(string2().min(1)).optional(),
+  permissions: array(permissionSchema).optional(),
+  fileLease: fileLeaseRoleSchema.optional(),
+  disabled: boolean2().optional()
+}).strict();
+var leaseSchema = object({
+  reservationTtlMinutes: number2().int().positive().max(24 * 60).optional(),
+  activeTtlMinutes: number2().int().positive().max(24 * 60).optional()
+}).strict();
+var rootPatchSchema = object({
+  $schema: string2().min(1).optional(),
+  defaultAgent: agentIdSchema.optional(),
+  agentsDirectory: string2().min(1).optional(),
+  agents: record(agentIdSchema, agentPatchSchema).optional(),
+  lease: leaseSchema.optional()
+}).strict();
+var resolvedAgentSchema = agentPatchSchema.extend({
+  description: string2().min(1),
+  mode: _enum(["primary", "subagent", "all"]),
+  models: array(modelRefSchema).min(1),
+  prompt: string2().min(1),
+  skills: array(string2().min(1)),
+  mcp: array(string2().min(1)),
+  permissions: array(permissionSchema),
+  fileLease: fileLeaseRoleSchema,
+  disabled: boolean2()
+});
+var SAFE_UNTRUSTED_AGENT_FIELDS = new Set(["description"]);
+function assertTrustedProjectPatch(patch, sourcePath, id, trusted, knownAgents) {
+  if (trusted)
+    return;
+  const fields = Object.keys(patch).filter((field) => !SAFE_UNTRUSTED_AGENT_FIELDS.has(field));
+  if (fields.length === 0 && knownAgents.has(id))
+    return;
+  throw new Error(`Untrusted project config ${sourcePath} cannot override ${fields.join(", ") || `unknown agent ${id}`}. ` + `Set ${PROJECT_TRUST_ENV} to the exact token returned by computeProjectTrustToken() after reviewing these files.`);
+}
+function readJsonc2(path) {
+  const errors = [];
+  const value = parse2(readFileSync2(path, "utf8"), errors, {
+    allowTrailingComma: true,
+    disallowComments: false
+  });
+  if (errors.length > 0) {
+    const details = errors.map((error) => `${printParseErrorCode(error.error)} at offset ${error.offset}`).join(", ");
+    throw new Error(`Invalid JSONC in ${path}: ${details}`);
+  }
+  return value;
+}
+function assertWithin(base, target, label) {
+  const child = relative3(base, target);
+  if (child === "" || !child.startsWith("..") && !isAbsolute4(child))
+    return;
+  throw new Error(`${label} must stay inside ${base}: ${target}`);
+}
+function resolvePrompt(patch, sourcePath, layerDirectory) {
+  if (!patch.prompt)
+    return patch;
+  const prompt = resolve4(dirname3(sourcePath), patch.prompt);
+  assertWithin(layerDirectory, prompt, "Agent prompt");
+  if (!existsSync3(prompt))
+    throw new Error(`Agent prompt is missing: ${prompt}`);
+  const promptStat = lstatSync3(prompt);
+  if (promptStat.isSymbolicLink() || !promptStat.isFile())
+    throw new Error(`Agent prompt must be a regular non-symlink file: ${prompt}`);
+  const canonical = realpathSync3(prompt);
+  assertWithin(realpathSync3(layerDirectory), canonical, "Agent prompt");
+  const promptContent = readFileSync2(canonical, "utf8");
+  return { ...patch, prompt: canonical, promptContent };
+}
+function loadLayer(directory, rootFileName, required, projectPolicy) {
+  const rootPath = join3(directory, rootFileName);
+  if (!existsSync3(rootPath)) {
+    if (required)
+      throw new Error(`Required config is missing: ${rootPath}`);
+    return { agents: {}, sources: [] };
+  }
+  const root = rootPatchSchema.parse(readJsonc2(rootPath));
+  if (projectPolicy && !projectPolicy.trusted) {
+    const restricted = ["defaultAgent", "agentsDirectory", "lease"].filter((field) => Object.prototype.hasOwnProperty.call(root, field));
+    if (restricted.length > 0)
+      throw new Error(`Untrusted project config ${rootPath} cannot override ${restricted.join(", ")}`);
+  }
+  const agents = {};
+  for (const [id, patch] of Object.entries(root.agents ?? {})) {
+    if (projectPolicy)
+      assertTrustedProjectPatch(patch, rootPath, id, projectPolicy.trusted, projectPolicy.knownAgents);
+    agents[id] = resolvePrompt(patch, rootPath, directory);
+  }
+  const agentsDirectory = resolve4(directory, root.agentsDirectory ?? "agents");
+  assertWithin(directory, agentsDirectory, "agentsDirectory");
+  if (existsSync3(agentsDirectory)) {
+    const directoryStat = lstatSync3(agentsDirectory);
+    if (directoryStat.isSymbolicLink() || !directoryStat.isDirectory()) {
+      throw new Error(`agentsDirectory must be a regular directory: ${agentsDirectory}`);
+    }
+    assertWithin(realpathSync3(directory), realpathSync3(agentsDirectory), "agentsDirectory");
+    for (const entry of readdirSync2(agentsDirectory, { withFileTypes: true }).sort((a, b) => a.name.localeCompare(b.name))) {
+      if (!entry.isFile() || !entry.name.endsWith(".jsonc"))
+        continue;
+      const id = entry.name.slice(0, -".jsonc".length);
+      agentIdSchema.parse(id);
+      const agentPath = join3(agentsDirectory, entry.name);
+      const patch = agentPatchSchema.parse(readJsonc2(agentPath));
+      if (projectPolicy)
+        assertTrustedProjectPatch(patch, agentPath, id, projectPolicy.trusted, projectPolicy.knownAgents);
+      agents[id] = mergeAgent(agents[id], resolvePrompt(patch, agentPath, directory));
+    }
+  }
+  return {
+    defaultAgent: root.defaultAgent,
+    agents,
+    lease: root.lease,
+    sources: [rootPath]
+  };
+}
+function mergeAgent(base, override) {
+  return { ...base ?? {}, ...override };
+}
+function resolveAgentConfig(patch) {
+  const parsed = agentPatchSchema.extend({ promptContent: string2().optional() }).parse(patch);
+  const { promptContent, ...agentPatch } = parsed;
+  const resolved = resolvedAgentSchema.parse({
+    skills: [],
+    mcp: [],
+    permissions: [],
+    fileLease: "readonly",
+    disabled: false,
+    ...agentPatch
+  });
+  return promptContent === undefined ? resolved : { ...resolved, promptContent };
+}
+function findPackageRoot() {
+  let current = dirname3(fileURLToPath(import.meta.url));
+  while (true) {
+    if (existsSync3(join3(current, "defaults", "default.jsonc")))
+      return current;
+    const parent = dirname3(current);
+    if (parent === current)
+      break;
+    current = parent;
+  }
+  throw new Error("Unable to locate agent-gvozd package defaults");
+}
+function findProjectRoot(start) {
+  let current = resolve4(start);
+  while (true) {
+    const git = join3(current, ".git");
+    if (existsSync3(git))
+      return current;
+    const parent = dirname3(current);
+    if (parent === current)
+      return resolve4(start);
+    current = parent;
+  }
+}
+function loadConfig(projectDirectory, options = {}) {
+  const projectRoot = findProjectRoot(projectDirectory);
+  const packageRoot = findPackageRoot();
+  const projectConfigDirectory = join3(projectRoot, "docs", ".gvozd");
+  const globalConfigDirectory = join3(resolveOpenCodeConfigRoot(options.env, options.platform, options.home, options.configRoot), "gvozd");
+  const baseLayers = [
+    loadLayer(join3(packageRoot, "defaults"), "default.jsonc", true),
+    loadLayer(globalConfigDirectory, "config.jsonc", false)
+  ];
+  const knownAgents = new Set(baseLayers.flatMap((layer) => Object.keys(layer.agents)));
+  const includeProject = options.includeProject !== false;
+  const suppliedToken = includeProject ? options.projectTrustToken ?? (options.env ?? process.env)[PROJECT_TRUST_ENV] : undefined;
+  const trustProjectConfig = includeProject && suppliedToken !== undefined && suppliedToken === computeProjectTrustToken(projectRoot);
+  const projectLayer = includeProject ? loadLayer(projectConfigDirectory, "config.jsonc", false, { trusted: trustProjectConfig, knownAgents }) : undefined;
+  if (trustProjectConfig && suppliedToken !== computeProjectTrustToken(projectRoot)) {
+    throw new Error("Project configuration changed while its trust token was being validated; review it and compute a new token");
+  }
+  const layers = [...baseLayers, ...projectLayer ? [projectLayer] : []];
+  const lease = {
+    reservationTtlMs: DEFAULT_RESERVATION_TTL_MS,
+    activeTtlMs: DEFAULT_ACTIVE_TTL_MS
+  };
+  for (const layer of layers) {
+    if (!layer.lease)
+      continue;
+    if (layer.lease.reservationTtlMinutes !== undefined) {
+      lease.reservationTtlMs = layer.lease.reservationTtlMinutes * 60000;
+    }
+    if (layer.lease.activeTtlMinutes !== undefined) {
+      lease.activeTtlMs = layer.lease.activeTtlMinutes * 60000;
+    }
+  }
+  let defaultAgent;
+  const agents = {};
+  for (const layer of layers) {
+    defaultAgent = layer.defaultAgent ?? defaultAgent;
+    for (const [id, patch] of Object.entries(layer.agents)) {
+      agents[id] = mergeAgent(agents[id], patch);
+    }
+  }
+  if (!defaultAgent)
+    throw new Error("defaultAgent is not configured");
+  const resolvedAgents = Object.fromEntries(Object.entries(agents).map(([id, patch]) => [
+    id,
+    (() => {
+      const agent = resolveAgentConfig(patch);
+      if (agent.promptContent === undefined)
+        throw new Error(`Agent prompt snapshot is missing after configuration load: ${agent.prompt}`);
+      return agent;
+    })()
+  ]));
+  const defaultConfig = resolvedAgents[defaultAgent];
+  if (!defaultConfig || defaultConfig.disabled || defaultConfig.mode === "subagent") {
+    throw new Error(`defaultAgent must reference an enabled primary agent: ${defaultAgent}`);
+  }
+  return {
+    defaultAgent,
+    agents: resolvedAgents,
+    lease,
+    packageRoot,
+    projectRoot,
+    projectConfigDirectory,
+    globalConfigDirectory,
+    sources: layers.flatMap((layer) => layer.sources)
+  };
+}
+
 // src/file-lease-plugin.ts
 var GVOZD_LEASE_TOOL = "gvozd_lease";
 var GVOZD_CLAIM_TOOL = "gvozd_claim";
@@ -6263,26 +6364,12 @@ var TERMINAL_SESSION_EVENTS = new Set([
   "session.idle",
   "session.deleted"
 ]);
-var SAFE_SHELL_DURING_ACTIVE_LEASES = new Set([
-  "git status",
-  "git status --short",
-  "git status --short --branch",
-  "git status --porcelain=v1 --branch",
-  "git rev-parse --show-toplevel",
-  "git rev-parse --git-dir",
-  "git remote -v",
-  "git branch --show-current",
-  "git stash list",
-  "GIT_OPTIONAL_LOCKS=0 git status",
-  "GIT_OPTIONAL_LOCKS=0 git status --short",
-  "GIT_OPTIONAL_LOCKS=0 git status --short --branch",
-  "GIT_OPTIONAL_LOCKS=0 git status --porcelain=v1 --branch",
-  "GIT_OPTIONAL_LOCKS=0 git rev-parse --show-toplevel",
-  "GIT_OPTIONAL_LOCKS=0 git rev-parse --git-dir",
-  "GIT_OPTIONAL_LOCKS=0 git remote -v",
-  "GIT_OPTIONAL_LOCKS=0 git branch --show-current",
-  "GIT_OPTIONAL_LOCKS=0 git stash list"
-]);
+var SAFE_SHELL_DURING_ACTIVE_LEASES = new Set([...INSPECTION_COMMANDS, ...TOOLCHAIN_COMMANDS, ...GIT_READONLY_COMMANDS].flatMap(({ exact, wildcard }) => [
+  exact,
+  wildcard,
+  ...GIT_ENV_PREFIXES.map((prefix) => `${prefix} ${exact}`),
+  ...GIT_ENV_PREFIXES.map((prefix) => `${prefix} ${wildcard}`)
+]));
 var leaseInputSchema = discriminatedUnion("operation", [
   object({
     operation: literal("reserve"),
@@ -6332,8 +6419,8 @@ function deny(event, message) {
   event.message = message;
   return true;
 }
-function safeGitInspection(agent, resources) {
-  return agent === "git" && resources.length > 0 && resources.every((resource) => SAFE_SHELL_DURING_ACTIVE_LEASES.has(resource));
+function safeReadonlyShell(agent, resources) {
+  return agent !== undefined && resources.length > 0 && resources.every((resource) => SAFE_SHELL_DURING_ACTIVE_LEASES.has(resource));
 }
 function enforceFileLeasePermission(event, config, manager) {
   const role = roleOf(config, event.agent);
@@ -6356,7 +6443,7 @@ function enforceFileLeasePermission(event, config, manager) {
   if (role === "coordinator" || role === "writer") {
     return deny(event, `Agent ${event.agent} cannot use shell while file leases enforce structured mutations`);
   }
-  if (manager.hasActiveLeases() && !(role === "readonly" && safeGitInspection(event.agent, event.resources))) {
+  if (manager.hasActiveLeases() && !(role === "readonly" && safeReadonlyShell(event.agent, event.resources))) {
     return deny(event, "Shell commands are paused until all active writer file leases are released");
   }
   return false;
@@ -6382,7 +6469,12 @@ function requireRole(config, agentID, allowed) {
 }
 async function installFileLeaseRuntime(ctx, config, options = {}) {
   const caseInsensitive = options.caseInsensitive ?? resolveCaseInsensitiveFilesystem(options.env ?? process.env, options.platform ?? process.platform);
-  const manager = new FileLeaseManager({ projectRoot: config.projectRoot, caseInsensitive });
+  const manager = new FileLeaseManager({
+    projectRoot: config.projectRoot,
+    caseInsensitive,
+    reservationTtlMs: config.lease.reservationTtlMs,
+    activeTtlMs: config.lease.activeTtlMs
+  });
   const toolTransform = await ctx.tool.transform((tools) => {
     tools.namespace({
       name: "gvozd",