@nexrall/code-core 1.4.65 → 1.4.67

package/dist/agent/memory.d.ts

@@ -48,6 +48,17 @@ export declare function memoryStats(scope: MemoryScope, workDir?: string): {
     entries: number;
     archived: number;
 };
+/**
+ * Keep only the lines of a consolidation reply that are real memory entries.
+ *
+ * The prompt says "Output ONLY the bullet lines", but models do not always comply: a reply
+ * that opens with "I'll read the full, untruncated memory text before consolidating…" (seen
+ * in a user's global.md and a project file) used to be saved verbatim as an ACTIVE fact, then
+ * injected into every later session as ground truth. An entry is a line of the exact shape
+ * memory_write produces — `- [YYYY-MM-DD] …` — so anything else (preamble, "Here are the
+ * merged bullets:", a code fence, a trailing remark) is dropped rather than persisted.
+ */
+export declare function extractConsolidatedEntries(reply: string): string[];
 /**
  * Summarize the OLDEST half of a memory file's ACTIVE entries into a few consolidated
  * bullets via an LLM call, keeping the most recent entries verbatim — same "compact,

package/dist/agent/memory.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"memory.d.ts","sourceRoot":"","sources":["../../src/agent/memory.ts"],"names":[],"mappings":"AAiEA,MAAM,MAAM,WAAW,GAAG,SAAS,GAAG,QAAQ,CAAC;AAE/C;;;sDAGsD;AACtD,wBAAgB,cAAc,CAAC,KAAK,EAAE,WAAW,EAAE,OAAO,CAAC,EAAE,MAAM,GAAG,MAAM,CAI3E;AAED,eAAO,MAAM,sBAAsB,MAAM,CAAC;AAC1C,eAAO,MAAM,gBAAgB,QAAS,CAAC;AACvC,eAAO,MAAM,4BAA4B,QAAS,CAAC;AAMnD,eAAO,MAAM,qBAAqB,QAAmC,CAAC;AAKtE,eAAO,MAAM,wBAAwB,QAAmC,CAAC;AAoFzE,MAAM,WAAW,iBAAiB;IAChC,EAAE,EAAE,OAAO,CAAC;IACZ,OAAO,EAAE,OAAO,CAAC;IACjB,KAAK,EAAE,WAAW,CAAC;IACnB,IAAI,EAAE,MAAM,CAAC;IACb,gFAAgF;IAChF,UAAU,CAAC,EAAE,OAAO,CAAC;CACtB;AAED,MAAM,WAAW,kBAAkB;IACjC;;;;kCAI8B;IAC9B,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB;;6DAEyD;IACzD,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,wBAAsB,WAAW,CAC/B,OAAO,EAAE,MAAM,EACf,KAAK,EAAE,WAAW,EAClB,OAAO,CAAC,EAAE,MAAM,EAChB,IAAI,GAAE,kBAAuB,GAC5B,OAAO,CAAC,iBAAiB,CAAC,CA2D5B;AAED,MAAM,WAAW,iBAAiB;IAChC;;;iDAG6C;IAC7C,eAAe,CAAC,EAAE,OAAO,CAAC;CAC3B;AAED,wBAAgB,UAAU,CAAC,KAAK,EAAE,WAAW,EAAE,OAAO,CAAC,EAAE,MAAM,EAAE,IAAI,GAAE,iBAAsB,GAAG,MAAM,CAKrG;AAED;gFACgF;AAChF,wBAAgB,aAAa,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,IAAI,GAAE,iBAAsB,GAAG,MAAM,CASpF;AAED,wBAAgB,WAAW,CAAC,KAAK,EAAE,WAAW,EAAE,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAGtE;AAED,wBAAgB,WAAW,CACzB,KAAK,EAAE,WAAW,EAClB,OAAO,CAAC,EAAE,MAAM,GACf;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,CAUpE;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAsB,qBAAqB,CACzC,KAAK,EAAE,WAAW,EAClB,OAAO,EAAE,MAAM,GAAG,SAAS,EAC3B,SAAS,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,GAC7C,OAAO,CAAC,OAAO,CAAC,CAsDlB;AAkBD,uEAAuE;AACvE,eAAO,MAAM,uBAAuB,OAAQ,CAAC;AAC7C,mFAAmF;AACnF,eAAO,MAAM,sBAAsB,QAAS,CAAC;AAE7C;;;;;;;;;GASG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAErD;AAED;;;;;GAKG;AACH,wBAAgB,eAAe,CAC7B,SAAS,EAAE,MAAM,EACjB,KAAK,EAAE,SAAS,GAAG,MAAM,GAAG,OAAO,EACnC,OAAO,CAAC,EAAE,MAAM,GACf,MAAM,GAAG,IAAI,CAqBf;AAED,iEAAiE;AACjE,wBAAgB,eAAe,CAC7B,SAAS,EAAE,MAAM,EACjB,KAAK,EAAE,SAAS,GAAG,MAAM,GAAG,OAAO,EACnC,OAAO,CAAC,EAAE,MAAM,GACf,MAAM,CAIR;AAED;;;;;;;GAOG;AACH,wBAAsB,gBAAgB,CACpC,SAAS,EAAE,MAAM,EACjB,KAAK,EAAE,SAAS,GAAG,MAAM,GAAG,OAAO,EACnC,OAAO,EAAE,MAAM,EACf,OAAO,CAAC,EAAE,MAAM,GACf,OAAO,CAAC;IAAE,EAAE,EAAE,OAAO,CAAC;IAAC,OAAO,EAAE,OAAO,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC,CAyB1D;AAED;;;;;GAKG;AACH,wBAAgB,mBAAmB,CACjC,SAAS,EAAE,MAAM,EACjB,KAAK,EAAE,SAAS,GAAG,MAAM,GAAG,OAAO,EACnC,OAAO,CAAC,EAAE,MAAM,GACf,MAAM,CAYR"}
+{"version":3,"file":"memory.d.ts","sourceRoot":"","sources":["../../src/agent/memory.ts"],"names":[],"mappings":"AAiEA,MAAM,MAAM,WAAW,GAAG,SAAS,GAAG,QAAQ,CAAC;AAE/C;;;sDAGsD;AACtD,wBAAgB,cAAc,CAAC,KAAK,EAAE,WAAW,EAAE,OAAO,CAAC,EAAE,MAAM,GAAG,MAAM,CAI3E;AAED,eAAO,MAAM,sBAAsB,MAAM,CAAC;AAC1C,eAAO,MAAM,gBAAgB,QAAS,CAAC;AACvC,eAAO,MAAM,4BAA4B,QAAS,CAAC;AAMnD,eAAO,MAAM,qBAAqB,QAAmC,CAAC;AAKtE,eAAO,MAAM,wBAAwB,QAAmC,CAAC;AAoFzE,MAAM,WAAW,iBAAiB;IAChC,EAAE,EAAE,OAAO,CAAC;IACZ,OAAO,EAAE,OAAO,CAAC;IACjB,KAAK,EAAE,WAAW,CAAC;IACnB,IAAI,EAAE,MAAM,CAAC;IACb,gFAAgF;IAChF,UAAU,CAAC,EAAE,OAAO,CAAC;CACtB;AAED,MAAM,WAAW,kBAAkB;IACjC;;;;kCAI8B;IAC9B,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB;;6DAEyD;IACzD,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,wBAAsB,WAAW,CAC/B,OAAO,EAAE,MAAM,EACf,KAAK,EAAE,WAAW,EAClB,OAAO,CAAC,EAAE,MAAM,EAChB,IAAI,GAAE,kBAAuB,GAC5B,OAAO,CAAC,iBAAiB,CAAC,CA2D5B;AAED,MAAM,WAAW,iBAAiB;IAChC;;;iDAG6C;IAC7C,eAAe,CAAC,EAAE,OAAO,CAAC;CAC3B;AAED,wBAAgB,UAAU,CAAC,KAAK,EAAE,WAAW,EAAE,OAAO,CAAC,EAAE,MAAM,EAAE,IAAI,GAAE,iBAAsB,GAAG,MAAM,CAKrG;AAED;gFACgF;AAChF,wBAAgB,aAAa,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,IAAI,GAAE,iBAAsB,GAAG,MAAM,CASpF;AAED,wBAAgB,WAAW,CAAC,KAAK,EAAE,WAAW,EAAE,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAGtE;AAED,wBAAgB,WAAW,CACzB,KAAK,EAAE,WAAW,EAClB,OAAO,CAAC,EAAE,MAAM,GACf;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,CAUpE;AAED;;;;;;;;;GASG;AACH,wBAAgB,0BAA0B,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,EAAE,CAKlE;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAsB,qBAAqB,CACzC,KAAK,EAAE,WAAW,EAClB,OAAO,EAAE,MAAM,GAAG,SAAS,EAC3B,SAAS,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,GAC7C,OAAO,CAAC,OAAO,CAAC,CAyDlB;AAkBD,uEAAuE;AACvE,eAAO,MAAM,uBAAuB,OAAQ,CAAC;AAC7C,mFAAmF;AACnF,eAAO,MAAM,sBAAsB,QAAS,CAAC;AAE7C;;;;;;;;;GASG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAErD;AAED;;;;;GAKG;AACH,wBAAgB,eAAe,CAC7B,SAAS,EAAE,MAAM,EACjB,KAAK,EAAE,SAAS,GAAG,MAAM,GAAG,OAAO,EACnC,OAAO,CAAC,EAAE,MAAM,GACf,MAAM,GAAG,IAAI,CAqBf;AAED,iEAAiE;AACjE,wBAAgB,eAAe,CAC7B,SAAS,EAAE,MAAM,EACjB,KAAK,EAAE,SAAS,GAAG,MAAM,GAAG,OAAO,EACnC,OAAO,CAAC,EAAE,MAAM,GACf,MAAM,CAIR;AAED;;;;;;;GAOG;AACH,wBAAsB,gBAAgB,CACpC,SAAS,EAAE,MAAM,EACjB,KAAK,EAAE,SAAS,GAAG,MAAM,GAAG,OAAO,EACnC,OAAO,EAAE,MAAM,EACf,OAAO,CAAC,EAAE,MAAM,GACf,OAAO,CAAC;IAAE,EAAE,EAAE,OAAO,CAAC;IAAC,OAAO,EAAE,OAAO,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC,CAyB1D;AAED;;;;;GAKG;AACH,wBAAgB,mBAAmB,CACjC,SAAS,EAAE,MAAM,EACjB,KAAK,EAAE,SAAS,GAAG,MAAM,GAAG,OAAO,EACnC,OAAO,CAAC,EAAE,MAAM,GACf,MAAM,CAYR"}

package/dist/agent/memory.js

@@ -40,6 +40,7 @@ exports.readMemory = readMemory;
 exports.readAllMemory = readAllMemory;
 exports.clearMemory = clearMemory;
 exports.memoryStats = memoryStats;
+exports.extractConsolidatedEntries = extractConsolidatedEntries;
 exports.compactMemoryIfNeeded = compactMemoryIfNeeded;
 exports.isSafeAgentName = isSafeAgentName;
 exports.agentMemoryPath = agentMemoryPath;
@@ -318,6 +319,22 @@ function memoryStats(scope, workDir) {
         archived: archived.filter((l) => /^-\s\[\d{4}-\d{2}-\d{2}\]/.test(l)).length,
     };
 }
+/**
+ * Keep only the lines of a consolidation reply that are real memory entries.
+ *
+ * The prompt says "Output ONLY the bullet lines", but models do not always comply: a reply
+ * that opens with "I'll read the full, untruncated memory text before consolidating…" (seen
+ * in a user's global.md and a project file) used to be saved verbatim as an ACTIVE fact, then
+ * injected into every later session as ground truth. An entry is a line of the exact shape
+ * memory_write produces — `- [YYYY-MM-DD] …` — so anything else (preamble, "Here are the
+ * merged bullets:", a code fence, a trailing remark) is dropped rather than persisted.
+ */
+function extractConsolidatedEntries(reply) {
+    return reply
+        .split('\n')
+        .map((l) => l.trimEnd())
+        .filter((l) => /^-\s\[\d{4}-\d{2}-\d{2}\]\s*\S/.test(l));
+}
 /**
  * Summarize the OLDEST half of a memory file's ACTIVE entries into a few consolidated
  * bullets via an LLM call, keeping the most recent entries verbatim — same "compact,
@@ -370,9 +387,12 @@ async function compactMemoryIfNeeded(scope, workDir, summarize) {
                 `draws from, and preserve any leading "[src: ...]" provenance tag verbatim when present. ` +
                 `Output ONLY the bullet lines, nothing else.\n\n${older.join('\n')}`;
             try {
-                const summarized = (await summarize(prompt)).trim();
-                if (summarized) {
-                    active = [...summarized.split('\n').filter((l) => l.trim().length > 0), ...recent];
+                const summarized = extractConsolidatedEntries(await summarize(prompt));
+                // Zero valid bullets means the model answered in prose (or refused): treat it
+                // exactly like a failed call and keep the original entries. Writing the reply
+                // anyway would REPLACE the older half with chatter.
+                if (summarized.length > 0) {
+                    active = [...summarized, ...recent];
                     changed = true;
                 }
             }

package/dist/agent/planMode.d.ts

@@ -10,6 +10,20 @@ export interface PlanModeRefusal {
  * "Provably" is doing real work: unknown verbs are refused, not guessed at.
  */
 export declare function isReadOnlyCommand(command: string): boolean;
+/**
+ * Is a (possibly piped / chained) command read-only on every segment?
+ *
+ * This is what the permission GATE uses to skip a prompt in ask/edit mode. Plan mode
+ * keeps the stricter whole-shape refusal above (`checkPlanMode`): a temporary lock can
+ * afford to say "no pipelines", an approval gate that says it about `git log | head`
+ * just trains people to click through prompts.
+ *
+ * Fail-closed throughout: anything that is not plainly a chain of read-only commands —
+ * a write redirect, `$(…)`, backticks, a lone `&`, an unknown verb, a segment split
+ * wrongly by a quote — returns false, which means "ask the user". The cost of a false
+ * false is one extra keypress; the cost of a false true is `rm` running unasked.
+ */
+export declare function isReadOnlyPipeline(command: string): boolean;
 /**
  * Should this tool call be refused because the session is in plan mode?
  * Returns null when the call is allowed.

package/dist/agent/planMode.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"planMode.d.ts","sourceRoot":"","sources":["../../src/agent/planMode.ts"],"names":[],"mappings":"AAwHA,MAAM,WAAW,eAAe;IAC9B,wDAAwD;IACxD,MAAM,EAAE,eAAe,GAAG,oBAAoB,CAAC;IAC/C,gFAAgF;IAChF,OAAO,EAAE,MAAM,CAAC;CACjB;AAMD;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAgE1D;AAED;;;GAGG;AACH,wBAAgB,aAAa,CAC3B,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC7B,eAAe,GAAG,IAAI,CAoCxB;AAED,oEAAoE;AACpE,eAAO,MAAM,sBAAsB,QAqBvB,CAAC"}
+{"version":3,"file":"planMode.d.ts","sourceRoot":"","sources":["../../src/agent/planMode.ts"],"names":[],"mappings":"AAiJA,MAAM,WAAW,eAAe;IAC9B,wDAAwD;IACxD,MAAM,EAAE,eAAe,GAAG,oBAAoB,CAAC;IAC/C,gFAAgF;IAChF,OAAO,EAAE,MAAM,CAAC;CACjB;AAqFD;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CA8D1D;AAQD;;;;;;;;;;;;GAYG;AACH,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAO3D;AAED;;;GAGG;AACH,wBAAgB,aAAa,CAC3B,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC7B,eAAe,GAAG,IAAI,CAoCxB;AAED,oEAAoE;AACpE,eAAO,MAAM,sBAAsB,QAqBvB,CAAC"}

package/dist/agent/planMode.js

@@ -19,6 +19,7 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.PLAN_MODE_INSTRUCTIONS = void 0;
 exports.isReadOnlyCommand = isReadOnlyCommand;
+exports.isReadOnlyPipeline = isReadOnlyPipeline;
 exports.checkPlanMode = checkPlanMode;
 /**
  * Tools that cannot alter anything outside the conversation.
@@ -35,6 +36,7 @@ const READ_ONLY_TOOLS = new Set([
     // list, not the repo, so it stays available — a plan mode that cannot draft
     // a checklist is missing the point of plan mode.
     'todo_write', 'todo_read',
+    'cron_list', 'mcp_list_resources', 'mcp_read_resource',
     // Reading memory is fine; memory_write is NOT here on purpose. Memory is
     // durable state that survives the session, so writing it is a real mutation
     // even though no file in the repo changes.
@@ -71,10 +73,31 @@ const READ_ONLY_BASH = new Set([
     'grep', 'egrep', 'fgrep', 'rg', 'ag', 'ack', 'find', 'fd', 'locate',
     'diff', 'comm', 'cmp', 'sort', 'uniq', 'cut', 'tr', 'column', 'jq', 'yq',
     'date', 'whoami', 'hostname', 'uname', 'env', 'printenv', 'id', 'groups',
-    'ps', 'top', 'uptime', 'free', 'node', 'python', 'python3',
-    'tree', 'less', 'more', 'nl', 'tac', 'strings', 'md5sum', 'sha256sum',
+    'ps', 'uptime', 'free', 'node', 'python', 'python3',
+    // `less`/`more`/`top` are deliberately NOT here: pagers run `!cmd` from inside and
+    // `top` never exits. `env` is listed but only bare — see toolFlagsOk.
+    'tree', 'nl', 'tac', 'strings', 'md5sum', 'sha256sum',
     'true', 'false', 'test', 'sleep', 'seq', 'expr',
+    // Changes this shell's cwd only. Needed so `cd x && ls` is not refused.
+    'cd',
 ]);
+/**
+ * A verb written with a path is only trusted when it lives in a system bin dir.
+ * Stripping to the basename (the old behaviour) meant `./ls`, `/tmp/evil/cat` and
+ * `build/git` — attacker-written files — were classified by their NAME and waved
+ * through as read-only.
+ */
+const SYSTEM_BIN_DIRS = new Set([
+    '/bin', '/usr/bin', '/usr/local/bin', '/sbin', '/usr/sbin', '/opt/homebrew/bin',
+]);
+/**
+ * Environment assignments that change WHAT a read-only verb runs: the search path,
+ * loader, pager/editor/external-diff hooks, and the interpreters' option vars.
+ * `GIT_EXTERNAL_DIFF=./x git diff` and `PATH=/tmp ls` run the attacker's program
+ * while every word the classifier looks at is innocent.
+ */
+const UNSAFE_ENV = /^(PATH|HOME|SHELL|IFS|ENV|BASH_ENV|PAGER|MANPAGER|EDITOR|VISUAL|BROWSER|LD_\w*|DYLD_\w*|GIT_\w*|NODE_\w*|NPM_\w*|npm_\w*|PYTHON\w*|BASH\w*|RUBY\w*|PERL\w*|LESS\w*|XDG_\w*|\w*OPTS?)=/i;
+const GH_NOUNS = new Set(['pr', 'issue', 'run', 'repo', 'release', 'workflow', 'gist', 'label']);
 /**
  * Subcommands that are read-only for tools whose safety depends on the verb.
  *
@@ -117,6 +140,83 @@ const READ_ONLY_NESTED = {
  * `|` is included: `cat x | tee y` writes, and so does `... | sh`.
  */
 const SHELL_CONTROL = /[\n\r;&|`]|\$\(|>>|>|<\(/;
+const isShort = (f) => f.startsWith('-') && !f.startsWith('--');
+const flagName = (f) => f.split('=')[0];
+/**
+ * Flags of an allowlisted VERB that turn it into a writer or an executor. The verb
+ * list says `sort` is read-only; `sort -o f` writes f. Each entry below is a real way
+ * to mutate through a verb the list trusts — the list alone was the hole.
+ */
+function toolFlagsOk(verb, args) {
+    const flags = args.filter((a) => a.startsWith('-'));
+    const pos = args.filter((a) => !a.startsWith('-'));
+    switch (verb) {
+        case 'env': return args.length === 0; // `env CMD` RUNS CMD
+        case 'sort':
+            return !flags.some((f) => (isShort(f) && /^-[A-Za-z]*o/.test(f)) || f.startsWith('--output') || f.startsWith('--compress-program'));
+        case 'uniq': return pos.length <= 1; // second positional is an OUTPUT file
+        case 'find':
+            return !args.some((a) => ['-exec', '-execdir', '-delete', '-ok', '-okdir', '-fprint', '-fprint0', '-fprintf', '-fls'].includes(a));
+        case 'fd':
+            return !flags.some((f) => f.startsWith('--exec') || (isShort(f) && /^-[A-Za-z]*[xX]/.test(f)));
+        case 'rg': return !flags.some((f) => flagName(f) === '--pre' || f.startsWith('--hostname-bin'));
+        case 'ag':
+        case 'ack': return !flags.some((f) => f.startsWith('--pager'));
+        case 'yq': return !flags.some((f) => (isShort(f) && /^-[A-Za-z]*i/.test(f)) || f.startsWith('--inplace'));
+        case 'tree': return !flags.some((f) => isShort(f) && /^-[A-Za-z]*o/.test(f));
+        case 'date': return !flags.some((f) => (isShort(f) && /^-[A-Za-z]*s/.test(f)) || f.startsWith('--set'));
+        case 'hostname': return pos.length === 0; // `hostname NAME` renames the machine
+        case 'file': return !flags.some((f) => (isShort(f) && /^-[A-Za-z]*C/.test(f)) || f.startsWith('--compile'));
+        default: return true;
+    }
+}
+/** Every flag must be a known read-only one; anything unfamiliar fails closed. */
+function flagsWithin(flags, shorts, longs) {
+    return flags.every((f) => {
+        if (isShort(f))
+            return [...f.slice(1)].every((c) => shorts.includes(c) || /\d/.test(c));
+        return longs.includes(flagName(f));
+    });
+}
+const LISTISH = ['-l', '--list', '--contains', '--no-contains', '--merged', '--no-merged', '--points-at'];
+/**
+ * Same idea one level down: `git branch` lists, `git branch newbranch` creates,
+ * `git branch -D main` deletes — one subcommand, three effects.
+ */
+function subcommandFlagsOk(verb, sub, args) {
+    const flags = args.filter((a) => a.startsWith('-'));
+    const pos = args.filter((a) => !a.startsWith('-')); // pos[0] === sub
+    const listish = flags.some((f) => LISTISH.includes(flagName(f)) || (isShort(f) && f.includes('l')));
+    if (verb === 'git') {
+        if (flags.some((f) => f.startsWith('--output') || f === '--ext-diff' || f === '-O' || f.startsWith('--open-files-in-pager')))
+            return false;
+        switch (sub) {
+            case 'branch':
+                return flagsWithin(flags, 'arvlq', ['--all', '--remotes', '--verbose', '--list', '--show-current', '--contains', '--no-contains', '--merged', '--no-merged', '--points-at', '--sort', '--format', '--column', '--no-column', '--color', '--no-color', '--abbrev', '--no-abbrev', '--ignore-case', '--omit-empty'])
+                    && (pos.length <= 1 || listish);
+            case 'tag':
+                return flagsWithin(flags, 'lnv', ['--list', '--contains', '--no-contains', '--merged', '--no-merged', '--points-at', '--sort', '--format', '--column', '--no-column', '--color', '--no-color', '--verify', '--ignore-case', '--omit-empty'])
+                    && (pos.length <= 1 || listish || flags.some((f) => f === '-v' || f === '--verify'));
+            case 'remote':
+                return flagsWithin(flags, 'vn', ['--verbose']) && (pos[1] === undefined || pos[1] === 'show' || pos[1] === 'get-url');
+            case 'config':
+                return flagsWithin(flags, 'lz', ['--get', '--get-all', '--get-regexp', '--list', '--show-origin', '--show-scope', '--global', '--local', '--system', '--worktree', '--name-only', '--null', '--includes', '--no-includes', '--type'])
+                    && pos.length <= 2; // `config` itself + at most one key
+            case 'reflog': return pos[1] !== 'expire' && pos[1] !== 'delete';
+            default: return true;
+        }
+    }
+    if (sub === 'config' && (verb === 'npm' || verb === 'pnpm' || verb === 'yarn')) {
+        return pos[1] === undefined || pos[1] === 'get' || pos[1] === 'list' || pos[1] === 'ls';
+    }
+    if (verb === 'go') {
+        return !flags.some((f) => {
+            const n = f.replace(/^--?/, '-');
+            return n === '-w' || n === '-u' || n.startsWith('-vettool') || n.startsWith('-toolexec') || n === '-exec';
+        });
+    }
+    return true;
+}
 function firstWords(command) {
     return command.trim().split(/\s+/).filter(Boolean);
 }
@@ -137,15 +237,21 @@ function isReadOnlyCommand(command) {
         return false;
     // `VAR=x cmd` — skip leading environment assignments to find the real verb.
     let i = 0;
-    while (i < words.length && /^[A-Za-z_][A-Za-z0-9_]*=/.test(words[i]))
+    while (i < words.length && /^[A-Za-z_][A-Za-z0-9_]*=/.test(words[i])) {
+        if (UNSAFE_ENV.test(words[i]))
+            return false;
         i++;
+    }
     if (i >= words.length)
         return false;
     let verb = words[i];
-    // Strip a path prefix: /usr/bin/git → git
+    // /usr/bin/git → git, but ONLY for a system bin dir (see SYSTEM_BIN_DIRS).
     const slash = verb.lastIndexOf('/');
-    if (slash >= 0)
+    if (slash >= 0) {
+        if (!SYSTEM_BIN_DIRS.has(verb.slice(0, slash)))
+            return false;
         verb = verb.slice(slash + 1);
+    }
     // `sudo anything` is refused outright regardless of the verb behind it: plan
     // mode is a promise about this machine, and privilege escalation is exactly
     // where a mistaken allow is least recoverable.
@@ -159,16 +265,12 @@ function isReadOnlyCommand(command) {
             // Bare `git` / `npm` just prints help — harmless.
             return true;
         }
-        if (subs.has(sub)) {
-            // `git config --global x y` WRITES. Only the read form (no value) passes.
-            if (verb === 'git' && sub === 'config') {
-                const args = words.slice(i + 2).filter((w) => !w.startsWith('-'));
-                return args.length <= 1;
-            }
-            return true;
-        }
+        if (subs.has(sub))
+            return subcommandFlagsOk(verb, sub, words.slice(i + 1));
         const nested = READ_ONLY_NESTED[verb];
-        if (nested && rest[1] && nested.has(rest[1]))
+        // `gh api list -X DELETE` has "list" in second position too — the noun must be a
+        // real resource noun, and `api` (arbitrary HTTP verbs) is not one.
+        if (nested && rest[1] && nested.has(rest[1]) && (verb !== 'gh' || GH_NOUNS.has(sub)))
             return true;
         return false;
     }
@@ -179,15 +281,42 @@ function isReadOnlyCommand(command) {
     if (verb === 'node' || verb === 'python' || verb === 'python3') {
         return words.slice(i + 1).every((w) => w === '--version' || w === '-V' || w === '-v');
     }
-    // `find` can execute and delete.
-    if (verb === 'find' && words.some((w) => w === '-exec' || w === '-execdir' || w === '-delete')) {
+    if (!toolFlagsOk(verb, words.slice(i + 1)))
         return false;
-    }
     // Reading a file with `test`/`stat` is fine, but `tee` is not in the list at
     // all, and `echo`/`printf` are only safe because redirection is already
     // rejected by SHELL_CONTROL above.
     return true;
 }
+/**
+ * Output redirections that cannot write anywhere interesting. Without this `ls 2>&1`
+ * and `cmd 2>/dev/null` — extremely common — would all count as "redirection".
+ */
+const HARMLESS_REDIRECT = /\s*\d?>\s*&\d\b|\s*\d?>>?\s*\/dev\/null(?=\s|$)/g;
+/**
+ * Is a (possibly piped / chained) command read-only on every segment?
+ *
+ * This is what the permission GATE uses to skip a prompt in ask/edit mode. Plan mode
+ * keeps the stricter whole-shape refusal above (`checkPlanMode`): a temporary lock can
+ * afford to say "no pipelines", an approval gate that says it about `git log | head`
+ * just trains people to click through prompts.
+ *
+ * Fail-closed throughout: anything that is not plainly a chain of read-only commands —
+ * a write redirect, `$(…)`, backticks, a lone `&`, an unknown verb, a segment split
+ * wrongly by a quote — returns false, which means "ask the user". The cost of a false
+ * false is one extra keypress; the cost of a false true is `rm` running unasked.
+ */
+function isReadOnlyPipeline(command) {
+    const cmd = command.replace(HARMLESS_REDIRECT, ' ').trim();
+    if (!cmd)
+        return false;
+    if (/[>`]|\$\(|<\(/.test(cmd))
+        return false;
+    const segs = cmd.split(/\|\||&&|[;|\n\r]/).map((x) => x.trim()).filter(Boolean);
+    if (!segs.length)
+        return false;
+    return segs.every((seg) => !seg.includes('&') && isReadOnlyCommand(seg));
+}
 /**
  * Should this tool call be refused because the session is in plan mode?
  * Returns null when the call is allowed.

package/dist/agent/securityLint.js

@@ -19,7 +19,7 @@
 //
 // Consequently every pattern here is tuned for PRECISION over recall. A check that
 // fires on ordinary code was removed rather than loosened. Deep analysis is the
-// `security-auditor` agent's job; this only catches the flagrant cases at the
+// a dedicated security review's job; this only catches the flagrant cases at the
 // moment they are written.
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.checkSecurity = checkSecurity;
@@ -116,7 +116,7 @@ const RULES = [
         // So the interpolation must name something that plausibly came from the
         // outside: req/request/params/query/body/input/user/args, or a bare
         // `'...' + ident`. This trades recall for precision on purpose — thorough SQL
-        // review is the security-auditor agent's job, not an inline regex's.
+        // review is a dedicated security review's job, not an inline regex's.
         //
         // THE GAP IS PER-ALTERNATIVE, and that asymmetry is load-bearing. The concat
         // branch originally shared the no-quote gap, which made it miss the QUOTED

package/dist/agent/sharedTasks.d.ts

@@ -59,5 +59,12 @@ export declare const _sharedTasksInternal: {
     CLAIM_STALE_MS: number;
     MIN_CLAIM_AGE_FOR_DEATH_CHECK_MS: number;
 };
+/**
+ * Remove a task outright — the veto path for a `TaskCreated` hook. Claude Code creates the
+ * task, and when a hook refuses it the task is DELETED and the reason goes back to the
+ * model as the tool's error; so "no task remains" is the observable contract of a veto,
+ * and this is the only place that needs to make it true.
+ */
+export declare function deleteSharedTask(workDir: string, taskId: string): boolean;
 export {};
 //# sourceMappingURL=sharedTasks.d.ts.map

package/dist/agent/sharedTasks.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sharedTasks.d.ts","sourceRoot":"","sources":["../../src/agent/sharedTasks.ts"],"names":[],"mappings":"AA6DA,MAAM,MAAM,UAAU,GAAG,SAAS,GAAG,aAAa,GAAG,WAAW,GAAG,SAAS,CAAC;AAE7E,MAAM,WAAW,UAAU;IACzB,EAAE,EAAE,MAAM,CAAC;IACX,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,UAAU,CAAC;IACnB,4HAA4H;IAC5H,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,8HAA8H;IAC9H,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,kGAAkG;IAClG,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC;IACrB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AA0BD,iBAAS,SAAS,IAAI,MAAM,CAE3B;AAED,iBAAS,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAGzC;AAED,iBAAS,QAAQ,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,CAEzD;AA4BD,0HAA0H;AAC1H,iBAAS,gBAAgB,CAAC,IAAI,EAAE,UAAU,GAAG,OAAO,CAUnD;AAED,4GAA4G;AAC5G,iBAAS,WAAW,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU,GAAG,OAAO,CAG/D;AAED,0IAA0I;AAC1I,wBAAgB,eAAe,CAAC,OAAO,EAAE,MAAM,GAAG,UAAU,EAAE,CAW7D;AAED,sJAAsJ;AACtJ,wBAAgB,gBAAgB,CAC9B,OAAO,EAAE,MAAM,EACf,OAAO,EAAE,MAAM,EACf,IAAI,GAAE;IAAE,EAAE,CAAC,EAAE,MAAM,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,EAAE,CAAA;CAAO,GAC/C,UAAU,CAUZ;AAED,MAAM,MAAM,WAAW,GACnB;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,IAAI,EAAE,UAAU,CAAA;CAAE,GAC9B;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,WAAW,GAAG,iBAAiB,GAAG,SAAS,GAAG,aAAa,CAAA;CAAE,CAAC;AAEvF;;;;GAIG;AACH,wBAAsB,SAAS,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC,CA+BxG;AAED;;;;;;GAMG;AACH,wBAAsB,sBAAsB,CAC1C,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,IAAI,GAAE;IAAE,SAAS,CAAC,EAAE,MAAM,CAAA;CAAO,GACrF,OAAO,CAAC,WAAW,CAAC,CAoBtB;AAED,eAAO,MAAM,oBAAoB;;;;;;;;CAAqH,CAAC"}
+{"version":3,"file":"sharedTasks.d.ts","sourceRoot":"","sources":["../../src/agent/sharedTasks.ts"],"names":[],"mappings":"AA6DA,MAAM,MAAM,UAAU,GAAG,SAAS,GAAG,aAAa,GAAG,WAAW,GAAG,SAAS,CAAC;AAE7E,MAAM,WAAW,UAAU;IACzB,EAAE,EAAE,MAAM,CAAC;IACX,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,UAAU,CAAC;IACnB,4HAA4H;IAC5H,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,8HAA8H;IAC9H,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,kGAAkG;IAClG,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC;IACrB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AA0BD,iBAAS,SAAS,IAAI,MAAM,CAE3B;AAED,iBAAS,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAGzC;AAED,iBAAS,QAAQ,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,CAEzD;AA4BD,0HAA0H;AAC1H,iBAAS,gBAAgB,CAAC,IAAI,EAAE,UAAU,GAAG,OAAO,CAUnD;AAED,4GAA4G;AAC5G,iBAAS,WAAW,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU,GAAG,OAAO,CAG/D;AAED,0IAA0I;AAC1I,wBAAgB,eAAe,CAAC,OAAO,EAAE,MAAM,GAAG,UAAU,EAAE,CAW7D;AAED,sJAAsJ;AACtJ,wBAAgB,gBAAgB,CAC9B,OAAO,EAAE,MAAM,EACf,OAAO,EAAE,MAAM,EACf,IAAI,GAAE;IAAE,EAAE,CAAC,EAAE,MAAM,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,EAAE,CAAA;CAAO,GAC/C,UAAU,CAUZ;AAED,MAAM,MAAM,WAAW,GACnB;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,IAAI,EAAE,UAAU,CAAA;CAAE,GAC9B;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,WAAW,GAAG,iBAAiB,GAAG,SAAS,GAAG,aAAa,CAAA;CAAE,CAAC;AAEvF;;;;GAIG;AACH,wBAAsB,SAAS,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC,CA+BxG;AAED;;;;;;GAMG;AACH,wBAAsB,sBAAsB,CAC1C,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,IAAI,GAAE;IAAE,SAAS,CAAC,EAAE,MAAM,CAAA;CAAO,GACrF,OAAO,CAAC,WAAW,CAAC,CAoBtB;AAED,eAAO,MAAM,oBAAoB;;;;;;;;CAAqH,CAAC;AAEvJ;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAEzE"}

package/dist/agent/sharedTasks.js

@@ -38,6 +38,7 @@ exports.listSharedTasks = listSharedTasks;
 exports.createSharedTask = createSharedTask;
 exports.claimTask = claimTask;
 exports.updateSharedTaskStatus = updateSharedTaskStatus;
+exports.deleteSharedTask = deleteSharedTask;
 /**
  * Shared task list — lets MULTIPLE independent sessions (two CLI windows, or
  * CLI + VS Code + Desktop, all working the same project) coordinate who is
@@ -281,4 +282,19 @@ async function updateSharedTaskStatus(workDir, taskId, status, opts = {}) {
     }, workDir);
 }
 exports._sharedTasksInternal = { tasksRoot, scopeDir, taskPath, isClaimAbandoned, isUnblocked, CLAIM_STALE_MS, MIN_CLAIM_AGE_FOR_DEATH_CHECK_MS };
+/**
+ * Remove a task outright — the veto path for a `TaskCreated` hook. Claude Code creates the
+ * task, and when a hook refuses it the task is DELETED and the reason goes back to the
+ * model as the tool's error; so "no task remains" is the observable contract of a veto,
+ * and this is the only place that needs to make it true.
+ */
+function deleteSharedTask(workDir, taskId) {
+    try {
+        fs.unlinkSync(taskPath(workDir, taskId));
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
 //# sourceMappingURL=sharedTasks.js.map

package/dist/agent/subAgentBudget.d.ts

@@ -0,0 +1,65 @@
+/**
+ * Resolve the fan-out limit: env → settings.json → default.
+ *
+ * Was env-ONLY, the same gap as the sub-task timeout: a project on a small machine that
+ * wanted 2, or a big one that wanted 6, had to set a shell variable, and nobody reading
+ * settings.json could see what the limit even was. Capped at HARD_MAX_CONCURRENT_SUBTASKS
+ * (32 — above Claude Code's default 20, so a user who wants that width can have it)
+ * because this bounds real shared resources (CPU, the API rate limit, file handles) and a
+ * typo like 400 should degrade to "a lot" rather than fork-bomb the machine.
+ */
+export declare function resolveMaxConcurrentSubtasks(settingsRaw?: Record<string, unknown>): number;
+/** Resolve the session-total sub-agent ceiling: env → settings.json → default. */
+export declare function resolveMaxSubagentsPerSession(settingsRaw?: Record<string, unknown>): number;
+/**
+ * Minimal concurrency gate. Hand-rolled rather than pulling in `p-limit` because
+ * the CLI ships as a single esbuild bundle with no node_modules, and this is a
+ * dozen lines.
+ */
+export declare function createLimiter(max: number): <T>(fn: () => Promise<T>) => Promise<T>;
+/** In-flight count per depth — used only to detect queueing, so the notice is accurate. */
+export declare const _inFlightByDepth: Map<number, number>;
+export declare function subTaskLimiter(depth: number, workDir?: string): {
+    run: <T>(fn: () => Promise<T>) => Promise<T>;
+    max: number;
+};
+/** Test-only: forget the memoised limiter so a new limit can take effect. */
+export declare function _resetSubTaskLimiter(): void;
+export declare const PROCESS_BUDGET_KEY = "\0process";
+/**
+ * Start a fresh sub-agent budget. Call when a NEW conversation begins.
+ *
+ * Exported for clients that reuse one process across conversations (the VS Code extension
+ * host). A client that never calls it gets process-lifetime semantics, which is correct
+ * for a one-shot CLI invocation.
+ */
+export declare function resetSessionSubAgentBudget(sessionKey?: string): void;
+/**
+ * Claim one slot against the session total. Returns an error string when exhausted.
+ *
+ * `notify` surfaces exhaustion to the HUMAN exactly once. Without it only the model is
+ * told, and a model instructed to "do the remaining work directly" complies silently — so
+ * the user never learns delegation was capped, which is the one thing a runaway guard has
+ * to make visible.
+ */
+export declare function claimSessionSubAgentSlot(workDir?: string, notify?: (msg: string) => void, sessionKey?: string): string | null;
+/**
+ * Give back a slot claimed for a spawn that never started an agent.
+ *
+ * The claim happens at the dispatch site, BEFORE the concurrency limiter, so that a spawn
+ * which is already over budget is refused immediately instead of queueing behind running
+ * siblings. That ordering is what makes the guard useful in a runaway — but it also means
+ * the claim precedes runSubTask's own validation, which rejects on several paths without
+ * ever starting a loop (empty prompt, a `deny` rule, an unusable resume id).
+ *
+ * Without a refund those rejections spend budget: a model retrying against a deny rule would
+ * silently burn the whole allowance on spawns that never ran, then lose delegation for the
+ * session with a notice blaming a runaway that never happened. The counter's contract is
+ * "sub-agents STARTED", and this is what keeps that true while preserving fast refusal.
+ *
+ * Floored at 0 so a double refund can never manufacture budget.
+ */
+export declare function refundSessionSubAgentSlot(sessionKey?: string): void;
+/** Test-only: observe the session counter without exporting the mutable binding. */
+export declare function _sessionSubAgentCount(sessionKey?: string): number;
+//# sourceMappingURL=subAgentBudget.d.ts.map

package/dist/agent/subAgentBudget.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"subAgentBudget.d.ts","sourceRoot":"","sources":["../../src/agent/subAgentBudget.ts"],"names":[],"mappings":"AAyCA;;;;;;;;;GASG;AACH,wBAAgB,4BAA4B,CAAC,WAAW,GAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAM,GAAG,MAAM,CAW9F;AAoBD,kFAAkF;AAClF,wBAAgB,6BAA6B,CAAC,WAAW,GAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAM,GAAG,MAAM,CAa/F;AAED;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,GAAG,EAAE,MAAM,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,KAAK,OAAO,CAAC,CAAC,CAAC,CAgBlF;AA8BD,2FAA2F;AAC3F,eAAO,MAAM,gBAAgB,qBAA4B,CAAC;AAE1D,wBAAgB,cAAc,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,GAAG;IAC/D,GAAG,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,KAAK,OAAO,CAAC,CAAC,CAAC,CAAC;IAC7C,GAAG,EAAE,MAAM,CAAC;CACb,CAuBA;AAED,6EAA6E;AAC7E,wBAAgB,oBAAoB,IAAI,IAAI,CAM3C;AAkBD,eAAO,MAAM,kBAAkB,cAAc,CAAC;AAQ9C;;;;;;GAMG;AACH,wBAAgB,0BAA0B,CAAC,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAGpE;AAED;;;;;;;GAOG;AACH,wBAAgB,wBAAwB,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,EAAE,UAAU,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAuB7H;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,yBAAyB,CAAC,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAGnE;AAED,oFAAoF;AACpF,wBAAgB,qBAAqB,CAAC,UAAU,CAAC,EAAE,MAAM,GAAG,MAAM,CAEjE"}