@nexrall/code-core 1.4.63 → 1.4.66

package/dist/permissions/destructiveTokens.js

@@ -0,0 +1,469 @@
+"use strict";
+/**
+ * Token-level half of the destructive-command classifier.
+ *
+ * destructive.ts started life as a pile of regexes run over the command STRING. That
+ * missed most real-world spellings, because a regex does not understand shell:
+ *   - global options between the tool and its verb:  git -C repo reset --hard
+ *   - combined short flags:                           git push -fu origin main
+ *   - refspec force syntax:                           git push origin +main
+ *   - wrappers that hide the real command:            sudo / env X=1 / xargs / nohup
+ *   - interpreters that take the command as a string: bash -c "…", eval "…", ssh host "…"
+ *   - containers that run it elsewhere:               docker exec db psql … / kubectl exec -- …
+ * and it could not express "rm -rf node_modules is fine, rm -rf src is not".
+ *
+ * So this module splits the command into simple commands the way a shell would (honouring
+ * quotes, so a commit message that MENTIONS `git push --force` is one argument of
+ * `git commit`, never a command), peels wrappers off, and judges (binary, args).
+ *
+ * It is a heuristic, not a shell: no variable expansion, no aliases, no functions. When it
+ * cannot tell (an `rm -rf $DIR`), it errs toward asking — the cost of a false positive is
+ * one confirmation, the cost of a false negative is unrecoverable.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.tokenize = tokenize;
+exports.classifyTokens = classifyTokens;
+const hit = (category, reason) => ({ category, reason });
+/** Split `src` into simple commands, each a list of unquoted words. */
+function tokenize(src) {
+    const cmds = [];
+    let cur = [];
+    let word = '';
+    let has = false;
+    let q = null;
+    const pushWord = () => { if (has)
+        cur.push(word); word = ''; has = false; };
+    const pushCmd = () => { pushWord(); if (cur.length)
+        cmds.push(cur); cur = []; };
+    for (let i = 0; i < src.length; i++) {
+        const ch = src[i];
+        if (q === "'") {
+            if (ch === "'")
+                q = null;
+            else
+                word += ch;
+            continue;
+        }
+        if (q === '"') {
+            if (ch === '\\' && i + 1 < src.length) {
+                word += src[++i];
+                continue;
+            }
+            if (ch === '"') {
+                q = null;
+                continue;
+            }
+            word += ch;
+            continue;
+        }
+        if (ch === "'" || ch === '"') {
+            q = ch;
+            has = true;
+            continue;
+        }
+        if (ch === '\\') {
+            if (i + 1 < src.length) {
+                word += src[++i];
+                has = true;
+            }
+            continue;
+        }
+        // Command separators. `(` `)` and backtick make $(…) / `…` bodies their own commands.
+        if (ch === ';' || ch === '&' || ch === '|' || ch === '\n' || ch === '(' || ch === ')' || ch === '`') {
+            pushCmd();
+            continue;
+        }
+        if (ch === ' ' || ch === '\t') {
+            pushWord();
+            continue;
+        }
+        word += ch;
+        has = true;
+    }
+    pushCmd();
+    return cmds;
+}
+const ENV_ASSIGN = /^[A-Za-z_][A-Za-z0-9_]*=/;
+const CONTROL_WORDS = new Set(['{', '}', '!', 'if', 'then', 'else', 'elif', 'do', 'while', 'until', 'fi', 'done']);
+const SHELLS = new Set(['bash', 'sh', 'zsh', 'dash', 'ksh']);
+const base = (w) => {
+    const b = w.includes('/') ? w.slice(w.lastIndexOf('/') + 1) : w;
+    return b;
+};
+/** Drop leading options from `args`, consuming a value for those named in `withArg`. */
+function dropOpts(args, withArg = new Set()) {
+    let i = 0;
+    while (i < args.length && args[i].startsWith('-') && args[i] !== '--') {
+        i += withArg.has(args[i]) ? 2 : 1;
+    }
+    if (args[i] === '--')
+        i++;
+    return args.slice(i);
+}
+/** True if `args` carries the long flag (or `--flag=value`) or a short-flag bundle containing `short`. */
+function has(args, long, short) {
+    return args.some((a) => (long !== null && (a === long || a.startsWith(long + '='))) ||
+        (short !== null && /^-[A-Za-z]+$/.test(a) && a.includes(short)));
+}
+const BROAD = new Set(['.', './', '*', './*', ':/', ':/', '..', '../', '/', '~', '~/', '$HOME', '${HOME}', '.*']);
+/** Directories that are regenerated by a build/install and are routine to delete. */
+const DISPOSABLE = new Set([
+    'node_modules', 'dist', 'build', 'out', '.next', '.nuxt', '.svelte-kit', '.turbo', '.cache', '.parcel-cache',
+    'coverage', '.nyc_output', 'target', '__pycache__', '.pytest_cache', '.mypy_cache', '.ruff_cache', '.tox',
+    'venv', '.venv', '.gradle', '.dart_tool', 'tmp', '.tmp', '.vite', '.angular', '.expo', 'DerivedData',
+]);
+const SCRATCH_PREFIXES = ['/tmp/', '/private/tmp/', '/var/folders/', '/private/var/folders/'];
+function isDisposableTarget(raw) {
+    let t = raw;
+    if (t === '')
+        return false;
+    // Anything we cannot resolve statically is treated as unsafe.
+    if (/[$~`]/.test(t) || t.includes('..'))
+        return false;
+    if (t.startsWith('/'))
+        return SCRATCH_PREFIXES.some((p) => t.startsWith(p) && t.length > p.length);
+    t = t.replace(/^(?:\.\/)+/, '').replace(/\/+$/, '');
+    if (t === '' || t === '.')
+        return false;
+    const segs = t.split('/').filter(Boolean);
+    if (segs.length === 0)
+        return false;
+    return DISPOSABLE.has(segs[0]) || DISPOSABLE.has(segs[segs.length - 1]);
+}
+function checkGit(argsIn) {
+    // Skip git's GLOBAL options so `git -C repo reset --hard` is seen as `reset --hard`.
+    let i = 0;
+    while (i < argsIn.length && argsIn[i].startsWith('-')) {
+        const a = argsIn[i];
+        i += ['-C', '-c', '--git-dir', '--work-tree', '--namespace', '--exec-path'].includes(a) ? 2 : 1;
+    }
+    const sub = argsIn[i];
+    const args = argsIn.slice(i + 1);
+    const operands = args.filter((a) => !a.startsWith('-'));
+    switch (sub) {
+        case 'push': {
+            if (has(args, '--force', 'f') || operands.some((a) => a.startsWith('+'))) {
+                return hit('git-history', 'force-pushes (can overwrite/destroy remote history)');
+            }
+            if (has(args, '--delete', 'd') || operands.some((a) => a.startsWith(':'))) {
+                return hit('git-history', 'deletes a remote branch or tag');
+            }
+            if (has(args, '--mirror', null)) {
+                return hit('git-history', 'mirror-pushes (overwrites and deletes remote refs to match local)');
+            }
+            return null;
+        }
+        case 'reset':
+            if (has(args, '--hard', null) || has(args, '--keep', null) || has(args, '--merge', null)) {
+                return hit('git-history', 'hard-resets the working tree (discards uncommitted work)');
+            }
+            return null;
+        case 'clean':
+            if (has(args, '--force', 'f') && !has(args, '--dry-run', 'n')) {
+                return hit('git-history', 'deletes untracked files (git clean)');
+            }
+            return null;
+        case 'branch':
+            if (args.some((a) => /^-[A-Za-z]*D/.test(a)) ||
+                ((has(args, '--delete', 'd')) && has(args, '--force', 'f'))) {
+                return hit('git-history', 'force-deletes a git branch');
+            }
+            return null;
+        case 'checkout':
+            if (has(args, '--force', 'f'))
+                return hit('git-history', 'git checkout --force discards local changes');
+            if (args.some((a) => BROAD.has(a)))
+                return hit('git-history', 'discards every uncommitted change in the working tree');
+            return null;
+        case 'restore': {
+            const stagedOnly = has(args, '--staged', 'S') && !has(args, '--worktree', 'W');
+            if (!stagedOnly && args.some((a) => BROAD.has(a))) {
+                return hit('git-history', 'discards every uncommitted change in the working tree');
+            }
+            return null;
+        }
+        case 'stash':
+            if (args[0] === 'drop' || args[0] === 'clear')
+                return hit('git-history', 'drops stashed work (not recoverable without the commit hash)');
+            return null;
+        case 'update-ref':
+            if (has(args, '-d', 'd') || has(args, '--delete', null))
+                return hit('git-history', 'deletes a git ref');
+            return null;
+        case 'reflog':
+            if (args[0] === 'delete' || args[0] === 'expire')
+                return hit('git-history', 'reflog expire / gc prune (permanently drops recoverable commits)');
+            return null;
+        case 'gc':
+            if (args.some((a) => /^--prune=(?:now|all)$/.test(a)))
+                return hit('git-history', 'reflog expire / gc prune (permanently drops recoverable commits)');
+            return null;
+        case 'worktree':
+            if (args[0] === 'remove' && has(args, '--force', 'f'))
+                return hit('git-history', 'force-removes a worktree (discards its uncommitted work)');
+            return null;
+        case 'filter-branch':
+        case 'filter-repo':
+            return hit('git-history', 'rewrites git history (filter-branch/filter-repo)');
+        case 'rm':
+            // `git rm -r <dir>` is routine and recoverable from HEAD; only a bare `.`/`*` is a wipe.
+            if (operands.some((a) => BROAD.has(a))) {
+                return hit('git-history', 'removes every tracked file from the working tree and index');
+            }
+            return null;
+        default:
+            return null;
+    }
+}
+function checkRm(args) {
+    const targets = [];
+    let recursive = false;
+    let endOpts = false;
+    for (const a of args) {
+        if (!endOpts && a === '--') {
+            endOpts = true;
+            continue;
+        }
+        if (!endOpts && a.startsWith('-')) {
+            if (a === '--recursive' || /^-[A-Za-z]*[rR]/.test(a))
+                recursive = true;
+            continue;
+        }
+        targets.push(a);
+    }
+    if (targets.some((t) => BROAD.has(t)))
+        return hit('filesystem', 'deletes the current directory, home, or everything matching a bare glob');
+    if (recursive && targets.some((t) => !isDisposableTarget(t))) {
+        return hit('filesystem', 'recursively deletes files or directories that are not a known build artefact');
+    }
+    return null;
+}
+function checkFind(args) {
+    if (args.includes('-delete'))
+        return hit('filesystem', 'find -delete removes every match');
+    for (let i = 0; i < args.length - 1; i++) {
+        if ((args[i] === '-exec' || args[i] === '-execdir' || args[i] === '-ok') && ['rm', 'shred', 'unlink'].includes(base(args[i + 1]))) {
+            return hit('filesystem', 'find -exec rm removes every match');
+        }
+    }
+    return null;
+}
+/** Judge one already-unwrapped command. `recurse` re-enters the string classifier. */
+function judge(bin, args) {
+    switch (bin) {
+        case 'git': return checkGit(args);
+        case 'rm':
+        case 'unlink': return checkRm(args);
+        case 'find': return checkFind(args);
+        case 'rsync':
+            if (args.some((a) => a === '--del' || /^--delete(?:-[a-z]+)?$/.test(a)))
+                return hit('filesystem', 'rsync --delete removes destination files that are absent from the source');
+            return null;
+        case 'truncate': return hit('filesystem', 'truncate cuts a file (contents lost)');
+        case 'shred': return hit('filesystem', 'shred irrecoverably overwrites a file');
+        case 'dd':
+            if (args.some((a) => /^of=\/dev\//.test(a)))
+                return hit('filesystem', 'dd writing to a device (overwrites the disk)');
+            return null;
+        case 'diskutil':
+            if (/^(?:erase|secureErase|zeroDisk|randomDisk|partitionDisk|reformat)/i.test(args[0] ?? ''))
+                return hit('filesystem', 'diskutil erases or repartitions a disk');
+            return null;
+        case 'chmod': {
+            if (!has(args, '--recursive', 'R'))
+                return null;
+            const operands = args.filter((a) => !a.startsWith('-'));
+            if (operands.slice(1).some((t) => BROAD.has(t)))
+                return hit('filesystem', 'recursive chmod over the current directory / home / root');
+            return null;
+        }
+        case 'terraform':
+        case 'tofu':
+        case 'terragrunt':
+            if (args.includes('destroy') || (args.includes('apply') && (args.includes('-destroy') || args.includes('-auto-approve')))) {
+                return hit('infra', 'destroys or applies Terraform-managed infrastructure without a plan review');
+            }
+            return null;
+        case 'kubectl':
+        case 'oc': {
+            const a = dropOpts(args, new Set(['-n', '--namespace', '--context', '--cluster', '--kubeconfig', '-s', '--server', '--user']));
+            if (a[0] === 'delete')
+                return hit('infra', 'deletes Kubernetes resources');
+            if (a[0] === 'drain')
+                return hit('infra', 'drains a node (evicts every pod)');
+            if (a[0] === 'replace' && has(a, '--force', null))
+                return hit('infra', 'kubectl replace --force deletes and recreates the resource');
+            return null;
+        }
+        case 'helm': {
+            const a = dropOpts(args, new Set(['-n', '--namespace', '--kube-context', '--kubeconfig']));
+            if (a[0] === 'uninstall' || a[0] === 'delete')
+                return hit('infra', 'helm uninstall / delete (removes a release)');
+            return null;
+        }
+        case 'aws':
+            if (args[0] === 's3' && args[1] === 'sync' && has(args, '--delete', null))
+                return hit('cloud', 'aws s3 sync --delete removes bucket objects missing locally');
+            return null;
+        case 'vercel':
+            if (args[0] === 'remove' || args[0] === 'rm')
+                return hit('cloud', 'removes a Vercel project or deployment');
+            return null;
+        case 'fly':
+        case 'flyctl':
+            if (args.includes('destroy'))
+                return hit('cloud', 'destroys a Fly.io app, volume or machine');
+            return null;
+        case 'heroku':
+            if (args.some((a) => /:destroy$/.test(a) || a === 'pg:reset'))
+                return hit('cloud', 'destroys a Heroku app or resets its database');
+            return null;
+        case 'supabase':
+            if ((args[0] === 'db' && args[1] === 'reset') || (args[0] === 'projects' && args[1] === 'delete'))
+                return hit('cloud', 'resets a Supabase database or deletes a project');
+            return null;
+        case 'firebase':
+            if (args.some((a) => /:delete$/.test(a)))
+                return hit('cloud', 'deletes Firebase data or a project');
+            return null;
+        case 'netlify':
+            if (args.some((a) => /:delete$/.test(a)))
+                return hit('cloud', 'deletes a Netlify site');
+            return null;
+        case 'npm':
+        case 'pnpm':
+        case 'yarn':
+            if (args[0] === 'unpublish')
+                return hit('publish', 'unpublishes a package version');
+            if (args[0] === 'dist-tag' && (args[1] === 'rm' || args[1] === 'remove'))
+                return hit('publish', 'removes an npm dist-tag (can break `npm i pkg@latest`)');
+            return null;
+        case 'gh': {
+            if ((args[0] === 'repo' || args[0] === 'release') && args[1] === 'delete')
+                return hit('cloud', 'deletes a GitHub repository or release');
+            if (args[0] === 'api') {
+                const m = args.findIndex((a) => a === '-X' || a === '--method');
+                const inline = args.find((a) => /^(?:-X|--method=)DELETE$/i.test(a));
+                if ((m >= 0 && /^delete$/i.test(args[m + 1] ?? '')) || inline)
+                    return hit('cloud', 'sends an HTTP DELETE to the GitHub API');
+            }
+            return null;
+        }
+        case 'docker':
+        case 'docker-compose':
+        case 'podman': {
+            const a = bin === 'docker-compose' ? ['compose', ...args] : dropOpts(args, new Set(['-H', '--host', '--context', '-c']));
+            const verb = a[0] === 'container' ? a[1] : a[0];
+            const rest = a.slice(a[0] === 'container' ? 2 : 1);
+            if (verb === 'rm' && has(rest, '--force', 'f') && rest.some((x) => x.startsWith('$')))
+                return hit('container', 'force-removes many containers at once');
+            if (a[0] === 'compose' && rest.includes('down') && (has(rest, '--volumes', 'v')))
+                return hit('container', 'docker compose down with -v (deletes named volumes)');
+            return null;
+        }
+        case 'dropdb':
+        case 'dropuser': return hit('database', 'drops a Postgres database or role');
+        default:
+            if (bin.startsWith('mkfs'))
+                return hit('filesystem', 'mkfs formats a filesystem (destroys its contents)');
+            return null;
+    }
+}
+/**
+ * Peel wrappers off one simple command and judge what is really being run.
+ * `recurse` classifies a nested command STRING (bash -c "…", ssh host "…", eval …).
+ */
+const DB_BINS = new Set([
+    'psql', 'mysql', 'mariadb', 'mongo', 'mongosh', 'sqlite3', 'cockroach', 'clickhouse-client', 'pgcli', 'mycli', 'usql', 'sqlcmd', 'redis-cli',
+]);
+function classifyTokens(tokens, recurse, rawSql) {
+    let t = tokens.slice();
+    for (let guard = 0; guard < 12; guard++) {
+        while (t.length && (ENV_ASSIGN.test(t[0]) || CONTROL_WORDS.has(t[0])))
+            t = t.slice(1);
+        if (t.length === 0)
+            return null;
+        // A bare redirect with no command (`> file`, `: > file`, `true > file`) truncates the file.
+        {
+            const r = /^>(?![>&])/.test(t[0]) ? t : ((t[0] === ':' || t[0] === 'true') && /^>(?![>&])/.test(t[1] ?? '')) ? t.slice(1) : null;
+            if (r) {
+                const target = r[0].length > 1 ? r[0].slice(1) : (r[1] ?? '');
+                if (!target.startsWith('/dev/'))
+                    return hit('filesystem', 'a bare `>` redirect truncates the file (contents lost)');
+                return null;
+            }
+        }
+        const bin = base(t[0]);
+        const args = t.slice(1);
+        // Real SQL lives inside quotes, which the tokenizer has already unwrapped; hand it back
+        // to the quote-preserving SQL rules as a normal `client "arg" "arg"` string.
+        if (DB_BINS.has(bin)) {
+            return rawSql(bin + ' ' + args.map((a) => JSON.stringify(a)).join(' '));
+        }
+        if (bin === 'sudo' || bin === 'doas') {
+            t = dropOpts(args, new Set(['-u', '-g', '-h', '-p', '-C', '-D', '-R', '-T', '-U']));
+            continue;
+        }
+        if (bin === 'env') {
+            t = dropOpts(args, new Set(['-u', '-C', '-S']));
+            continue;
+        }
+        if (bin === 'nice') {
+            t = dropOpts(args, new Set(['-n']));
+            continue;
+        }
+        if (bin === 'ionice') {
+            t = dropOpts(args, new Set(['-c', '-n', '-p']));
+            continue;
+        }
+        if (bin === 'timeout') {
+            t = dropOpts(args, new Set(['-s', '-k'])).slice(1);
+            continue;
+        }
+        if (bin === 'xargs') {
+            t = dropOpts(args, new Set(['-I', '-n', '-P', '-L', '-s', '-d', '-E', '-a', '-J']));
+            continue;
+        }
+        if (['command', 'builtin', 'nohup', 'exec', 'time', 'setsid', 'caffeinate', 'stdbuf', 'unbuffer'].includes(bin)) {
+            t = dropOpts(args);
+            continue;
+        }
+        if (SHELLS.has(bin)) {
+            const i = args.findIndex((a) => /^-[A-Za-z]*c[A-Za-z]*$/.test(a));
+            if (i >= 0 && args[i + 1] !== undefined)
+                return recurse(args[i + 1]);
+            return null;
+        }
+        if (bin === 'eval')
+            return recurse(args.join(' '));
+        if (bin === 'ssh') {
+            const a = dropOpts(args, new Set(['-p', '-i', '-l', '-o', '-F', '-J', '-L', '-R', '-D', '-b', '-c', '-E', '-e', '-I', '-m', '-O', '-Q', '-S', '-w', '-W']));
+            return a.length > 1 ? recurse(a.slice(1).join(' ')) : null;
+        }
+        if (bin === 'docker' || bin === 'podman' || bin === 'docker-compose') {
+            const a0 = bin === 'docker-compose' ? ['compose', ...args] : dropOpts(args, new Set(['-H', '--host', '--context', '-c']));
+            const isExec = a0[0] === 'exec' || (a0[0] === 'compose' && dropOpts(a0.slice(1), new Set(['-f', '-p', '--project-name', '--file', '--profile']))[0] === 'exec');
+            if (isExec) {
+                const afterVerb = a0[0] === 'exec'
+                    ? a0.slice(1)
+                    : dropOpts(a0.slice(1), new Set(['-f', '-p', '--project-name', '--file', '--profile'])).slice(1);
+                const inner = dropOpts(afterVerb, new Set(['-e', '-u', '-w', '--env', '--user', '--workdir', '--env-file', '--detach-keys', '--index']));
+                if (inner.length > 1) {
+                    t = inner.slice(1);
+                    continue;
+                }
+                return null;
+            }
+        }
+        if (bin === 'kubectl' || bin === 'oc') {
+            const i = args.indexOf('--');
+            if (i >= 0 && args.includes('exec') && i + 1 < args.length) {
+                t = args.slice(i + 1);
+                continue;
+            }
+        }
+        return judge(bin, args);
+    }
+    return null;
+}
+//# sourceMappingURL=destructiveTokens.js.map

package/dist/permissions/modePolicy.d.ts

@@ -18,6 +18,16 @@ export interface PolicyInput {
  * in two windows. Note `memory_write` is NOT here even though the CLI's old list had it
  * — it mutates durable cross-session state, and listing it under "read-only / safe"
  * meant it silently bypassed plan mode's read-only guarantee.
+ *
+ * `task` IS here on purpose, to stay in lockstep with `planMode.ts`'s own
+ * READ_ONLY_TOOLS: that module already lets `task` through its plan-mode lock
+ * because delegating research to a sub-agent is safe — `runAgentLoop` passes
+ * `planMode` down, so the sub-agent is under the identical read-only lock and
+ * its own write tools are refused one level deeper. Without `task` here too,
+ * step 3 of `decide()` (`mode === 'plan' → deny`) would silently re-block a
+ * call that `checkPlanMode()` had already deliberately allowed through — the
+ * exact "two copies that drift" failure this module exists to prevent, just
+ * hitting `task` specifically instead of the read-only tools it was written for.
  */
 export declare const READ_ONLY_TOOLS: Set<string>;
 /** Tools that write to the filesystem. */
@@ -27,16 +37,20 @@ export declare const FILE_MUTATE_TOOLS: Set<string>;
 /** Tools that run a shell command. */
 export declare const BASH_TOOLS: Set<string>;
 /**
- * Is this bash command read-only?
+ * Is this bash command read-only — i.e. safe to run WITHOUT asking?
  *
- * Deliberately delegates to `bashNeedsRepoLock`, the classifier written for the
- * concurrency work: it already distinguishes commands that mutate shared state
- * (`git`, `npm`, `cargo`, `make` …) from ones that only read (`grep`, `ls`, `cat`,
- * `rg`), scanning every shell segment so `cd x && npm publish` is caught.
+ * History: this used to be `!bashNeedsRepoLock(command)`. That classifier answers a
+ * different question — "does this need the repo-state LOCK?" — by listing the ~30
+ * build/VCS verbs that take one (git, npm, make …). Everything NOT on that list was
+ * therefore "read-only", so `rm file`, `mv`, `echo x > f`, `sed -i`, `kill` and
+ * `curl … | sh` all ran with no prompt in `ask` and `edit` mode. Measured through the
+ * real `requestPermission`: prompted=0 for each. A denylist of mutators can never be
+ * complete; the gate needs an ALLOWLIST of readers, which plan mode already had.
  *
- * Reusing it is the point. Writing a second classifier here would create two
- * definitions of "mutating" that must agree forever — the exact failure this whole
- * audit keeps finding. If the lock treats a command as mutating, so does the gate.
+ * It now delegates to `isReadOnlyPipeline` (agent/planMode.ts), the same "provably
+ * read-only" classifier the plan-mode lock uses, so "read-only" means one thing in
+ * both places. `bashNeedsRepoLock` is unchanged and still correct for what it is for:
+ * deciding which calls must not run concurrently.
  */
 export declare function isReadOnlyBash(command: string): boolean;
 /**

package/dist/permissions/modePolicy.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"modePolicy.d.ts","sourceRoot":"","sources":["../../src/permissions/modePolicy.ts"],"names":[],"mappings":"AAsBA,yDAAyD;AACzD,MAAM,MAAM,cAAc,GAAG,MAAM,GAAG,KAAK,GAAG,MAAM,GAAG,MAAM,CAAC;AAE9D,kDAAkD;AAClD,MAAM,MAAM,cAAc,GACtB,OAAO,GACP,KAAK,GACL,MAAM,GACN,SAAS,CAAC;AAEd,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC/B,IAAI,EAAE,cAAc,CAAC;IACrB,oFAAoF;IACpF,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,2EAA2E;IAC3E,WAAW,CAAC,EAAE,OAAO,CAAC;CACvB;AAED;;;;;;;GAOG;AACH,eAAO,MAAM,eAAe,aAU1B,CAAC;AAEH,0CAA0C;AAC1C,eAAO,MAAM,gBAAgB,aAG3B,CAAC;AAEH,oEAAoE;AACpE,eAAO,MAAM,iBAAiB,aAE5B,CAAC;AAEH,sCAAsC;AACtC,eAAO,MAAM,UAAU,aAAsD,CAAC;AAE9E;;;;;;;;;;;GAWG;AACH,wBAAgB,cAAc,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAEvD;AAED;;;;;;;GAOG;AACH,wBAAgB,MAAM,CAAC,GAAG,EAAE,WAAW,GAAG,cAAc,CAwDvD;AAED,4DAA4D;AAC5D,wBAAgB,YAAY,CAAC,IAAI,EAAE,cAAc,GAAG,MAAM,CAOzD;AAED,gFAAgF;AAChF,wBAAgB,SAAS,CAAC,GAAG,EAAE,OAAO,GAAG,cAAc,CAGtD"}
+{"version":3,"file":"modePolicy.d.ts","sourceRoot":"","sources":["../../src/permissions/modePolicy.ts"],"names":[],"mappings":"AAsBA,yDAAyD;AACzD,MAAM,MAAM,cAAc,GAAG,MAAM,GAAG,KAAK,GAAG,MAAM,GAAG,MAAM,CAAC;AAE9D,kDAAkD;AAClD,MAAM,MAAM,cAAc,GACtB,OAAO,GACP,KAAK,GACL,MAAM,GACN,SAAS,CAAC;AAEd,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC/B,IAAI,EAAE,cAAc,CAAC;IACrB,oFAAoF;IACpF,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,2EAA2E;IAC3E,WAAW,CAAC,EAAE,OAAO,CAAC;CACvB;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,eAAO,MAAM,eAAe,aAW1B,CAAC;AAEH,0CAA0C;AAC1C,eAAO,MAAM,gBAAgB,aAG3B,CAAC;AAEH,oEAAoE;AACpE,eAAO,MAAM,iBAAiB,aAE5B,CAAC;AAEH,sCAAsC;AACtC,eAAO,MAAM,UAAU,aAAsD,CAAC;AAE9E;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,cAAc,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAEvD;AAED;;;;;;;GAOG;AACH,wBAAgB,MAAM,CAAC,GAAG,EAAE,WAAW,GAAG,cAAc,CAwDvD;AAED,4DAA4D;AAC5D,wBAAgB,YAAY,CAAC,IAAI,EAAE,cAAc,GAAG,MAAM,CAOzD;AAED,gFAAgF;AAChF,wBAAgB,SAAS,CAAC,GAAG,EAAE,OAAO,GAAG,cAAc,CAGtD"}

package/dist/permissions/modePolicy.js

@@ -5,7 +5,7 @@ exports.isReadOnlyBash = isReadOnlyBash;
 exports.decide = decide;
 exports.describeMode = describeMode;
 exports.parseMode = parseMode;
-const bashClassify_1 = require("./bashClassify");
+const planMode_1 = require("../agent/planMode");
 /**
  * Tools that only ever READ. Always allowed, in every mode including plan.
  *
@@ -13,6 +13,16 @@ const bashClassify_1 = require("./bashClassify");
  * in two windows. Note `memory_write` is NOT here even though the CLI's old list had it
  * — it mutates durable cross-session state, and listing it under "read-only / safe"
  * meant it silently bypassed plan mode's read-only guarantee.
+ *
+ * `task` IS here on purpose, to stay in lockstep with `planMode.ts`'s own
+ * READ_ONLY_TOOLS: that module already lets `task` through its plan-mode lock
+ * because delegating research to a sub-agent is safe — `runAgentLoop` passes
+ * `planMode` down, so the sub-agent is under the identical read-only lock and
+ * its own write tools are refused one level deeper. Without `task` here too,
+ * step 3 of `decide()` (`mode === 'plan' → deny`) would silently re-block a
+ * call that `checkPlanMode()` had already deliberately allowed through — the
+ * exact "two copies that drift" failure this module exists to prevent, just
+ * hitting `task` specifically instead of the read-only tools it was written for.
  */
 exports.READ_ONLY_TOOLS = new Set([
     'read_file', 'list_directory', 'search_files', 'glob', 'grep',
@@ -24,6 +34,7 @@ exports.READ_ONLY_TOOLS = new Set([
     'notebook_read',
     'get_diagnostics', 'go_to_definition', 'find_references',
     'get_symbols', 'get_workspace_symbols', 'get_hover',
+    'task',
 ]);
 /** Tools that write to the filesystem. */
 exports.FILE_WRITE_TOOLS = new Set([
@@ -37,19 +48,23 @@ exports.FILE_MUTATE_TOOLS = new Set([
 /** Tools that run a shell command. */
 exports.BASH_TOOLS = new Set(['bash', 'run_command', 'execute_command']);
 /**
- * Is this bash command read-only?
+ * Is this bash command read-only — i.e. safe to run WITHOUT asking?
  *
- * Deliberately delegates to `bashNeedsRepoLock`, the classifier written for the
- * concurrency work: it already distinguishes commands that mutate shared state
- * (`git`, `npm`, `cargo`, `make` …) from ones that only read (`grep`, `ls`, `cat`,
- * `rg`), scanning every shell segment so `cd x && npm publish` is caught.
+ * History: this used to be `!bashNeedsRepoLock(command)`. That classifier answers a
+ * different question — "does this need the repo-state LOCK?" — by listing the ~30
+ * build/VCS verbs that take one (git, npm, make …). Everything NOT on that list was
+ * therefore "read-only", so `rm file`, `mv`, `echo x > f`, `sed -i`, `kill` and
+ * `curl … | sh` all ran with no prompt in `ask` and `edit` mode. Measured through the
+ * real `requestPermission`: prompted=0 for each. A denylist of mutators can never be
+ * complete; the gate needs an ALLOWLIST of readers, which plan mode already had.
  *
- * Reusing it is the point. Writing a second classifier here would create two
- * definitions of "mutating" that must agree forever — the exact failure this whole
- * audit keeps finding. If the lock treats a command as mutating, so does the gate.
+ * It now delegates to `isReadOnlyPipeline` (agent/planMode.ts), the same "provably
+ * read-only" classifier the plan-mode lock uses, so "read-only" means one thing in
+ * both places. `bashNeedsRepoLock` is unchanged and still correct for what it is for:
+ * deciding which calls must not run concurrently.
  */
 function isReadOnlyBash(command) {
-    return !(0, bashClassify_1.bashNeedsRepoLock)(command);
+    return (0, planMode_1.isReadOnlyPipeline)(command);
 }
 /**
  * The single source of truth for "should we prompt?".

package/dist/tools/executor.d.ts

@@ -1,5 +1,41 @@
 import type { ToolResult } from '../types';
 import { type SandboxConfig } from './sandbox';
+/**
+ * Cap output from a tool we do not control (MCP servers). Built-in tools all cap their
+ * own output, but an MCP result went into the conversation verbatim: one call to a
+ * DB/browser/log server could inline megabytes, which is then re-sent (and re-billed as
+ * cache writes) on every later round until compaction. Keep HEAD+TAIL inline and spill
+ * the full text to a temp file the model can read_file with offset/limit — the same
+ * contract as bash's GAP B spill.
+ */
+export declare function capExternalOutput(output: string, label: string, maxChars?: number): string;
+/**
+ * Async drop-in for the subset of `spawnSync` the search tools use. spawnSync blocked
+ * the Node event loop for the whole search: several search_files calls issued in one
+ * parallel tool batch ran strictly one after another, and a search started by the
+ * mid-stream prefetcher froze SSE parsing and UI rendering until it finished. Result
+ * shape mirrors spawnSync's (`status`, `signal`, `error` with code ETIMEDOUT / ENOBUFS)
+ * so the callers' existing failure handling is unchanged.
+ */
+export interface CaptureResult {
+    stdout: string;
+    stderr: string;
+    status: number | null;
+    signal: NodeJS.Signals | null;
+    error?: NodeJS.ErrnoException;
+}
+export declare function runCapture(cmd: string, args: string[], opts: {
+    cwd?: string;
+    timeout: number;
+    maxBuffer: number;
+}): Promise<CaptureResult>;
+/**
+ * Glob → anchored RegExp. Scans the pattern once, so the `*` / `?` rules can never
+ * rewrite the regex emitted for `**` (the old chained .replace() calls turned
+ * `**\/` into `([^/]:[^/]+/)` — every `**` pattern silently matched nothing).
+ * Supports `**`, `*`, `?`, `{a,b}` and `[...]` classes.
+ */
+export declare function globToRegex(pattern: string): RegExp;
 export declare function executeTool(name: string, input: Record<string, unknown>, abortSignal?: {
     aborted: boolean;
 }, sandbox?: SandboxConfig, workDir?: string, agentScope?: string, onStream?: (chunk: string) => void, selfPeer?: {

package/dist/tools/executor.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"executor.d.ts","sourceRoot":"","sources":["../../src/tools/executor.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,UAAU,CAAC;AAC3C,OAAO,EAAyB,KAAK,aAAa,EAAE,MAAM,WAAW,CAAC;AAqxFtE,wBAAsB,WAAW,CAC/B,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC9B,WAAW,CAAC,EAAE;IAAE,OAAO,EAAE,OAAO,CAAA;CAAE,EAClC,OAAO,CAAC,EAAE,aAAa,EACvB,OAAO,CAAC,EAAE,MAAM,EAChB,UAAU,CAAC,EAAE,MAAM,EACnB,QAAQ,CAAC,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,IAAI,EAMlC,QAAQ,CAAC,EAAE;IAAE,EAAE,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GACtC,OAAO,CAAC,UAAU,CAAC,CAkCrB"}
+{"version":3,"file":"executor.d.ts","sourceRoot":"","sources":["../../src/tools/executor.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,UAAU,CAAC;AAC3C,OAAO,EAAyB,KAAK,aAAa,EAAE,MAAM,WAAW,CAAC;AAokCtE;;;;;;;GAOG;AACH,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,SAAmB,GAAG,MAAM,CAcpG;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,aAAa;IAC5B,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,MAAM,EAAE,MAAM,CAAC,OAAO,GAAG,IAAI,CAAC;IAC9B,KAAK,CAAC,EAAE,MAAM,CAAC,cAAc,CAAC;CAC/B;AACD,wBAAgB,UAAU,CACxB,GAAG,EAAE,MAAM,EACX,IAAI,EAAE,MAAM,EAAE,EACd,IAAI,EAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,GACzD,OAAO,CAAC,aAAa,CAAC,CA0CxB;AAsoCD;;;;;GAKG;AACH,wBAAgB,WAAW,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAqCnD;AAwwBD,wBAAsB,WAAW,CAC/B,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC9B,WAAW,CAAC,EAAE;IAAE,OAAO,EAAE,OAAO,CAAA;CAAE,EAClC,OAAO,CAAC,EAAE,aAAa,EACvB,OAAO,CAAC,EAAE,MAAM,EAChB,UAAU,CAAC,EAAE,MAAM,EACnB,QAAQ,CAAC,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,IAAI,EAMlC,QAAQ,CAAC,EAAE;IAAE,EAAE,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GACtC,OAAO,CAAC,UAAU,CAAC,CAkCrB"}