@phnx-labs/agents-cli 1.20.63 → 1.20.64

package/dist/lib/routines.js

@@ -11,7 +11,7 @@ import * as path from 'path';
 import * as yaml from 'yaml';
 import { Cron } from 'croner';
 import { getRoutinesDir, getSystemRoutinesDir, getRunsDir, ensureAgentsDir, getProjectRoutinesDir } from './state.js';
-import { safeJoin } from './paths.js';
+import { safeJoin, isSafeSegmentName } from './paths.js';
 import { atomicWriteFileSync } from './fs-atomic.js';
 import { ALL_AGENT_IDS } from './agents.js';
 import { machineId, normalizeHost } from './machine-id.js';
@@ -274,6 +274,13 @@ export function validateJob(config) {
     if (!config.name || typeof config.name !== 'string') {
         errors.push('name is required');
     }
+    else if (!isSafeSegmentName(config.name)) {
+        // The name becomes a filesystem path segment (overlay HOME under the
+        // routines dir). Reject separators, '.'/'..', and null bytes so a synced
+        // config can't traverse out of ~/.agents/routines.
+        errors.push(`invalid name ${JSON.stringify(config.name)}: must be a single path segment ` +
+            `(no '/', '\\\\', or null bytes, and not '.' or '..')`);
+    }
     const hasSchedule = Boolean(config.schedule && typeof config.schedule === 'string');
     const hasTrigger = config.trigger !== undefined;
     if (!hasSchedule && !hasTrigger) {
@@ -298,11 +305,16 @@ export function validateJob(config) {
     }
     const hasAgent = Boolean(config.agent && typeof config.agent === 'string');
     const hasWorkflow = Boolean(config.workflow && typeof config.workflow === 'string');
-    if (!hasAgent && !hasWorkflow) {
-        errors.push('exactly one of agent or workflow is required');
+    const hasCommand = Boolean(config.command && typeof config.command === 'string');
+    const set = [hasAgent, hasWorkflow, hasCommand].filter(Boolean).length;
+    if (set === 0) {
+        errors.push('exactly one of agent, workflow, or command is required');
+    }
+    else if (set > 1) {
+        errors.push('exactly one of agent, workflow, or command may be set (not more)');
     }
-    else if (hasAgent && hasWorkflow) {
-        errors.push('exactly one of agent or workflow must be set (not both)');
+    if (config.command !== undefined && (typeof config.command !== 'string' || config.command.trim() === '')) {
+        errors.push('command must be a non-empty shell command string');
     }
     if (hasAgent && config.agent && !ALL_AGENT_IDS.includes(config.agent)) {
         errors.push(`agent must be one of: ${ALL_AGENT_IDS.join(', ')}`);
@@ -336,7 +348,8 @@ export function validateJob(config) {
     if (config.effort && !['low', 'medium', 'high', 'xhigh', 'max', 'auto'].includes(config.effort)) {
         errors.push('effort must be low, medium, high, xhigh, max, or auto');
     }
-    if (!config.prompt || typeof config.prompt !== 'string') {
+    // command routines run a plain shell and never build a prompt; agent/workflow routines require one.
+    if (!hasCommand && (!config.prompt || typeof config.prompt !== 'string')) {
         errors.push('prompt is required');
     }
     if (config.timeout && !parseTimeout(config.timeout)) {
@@ -445,7 +458,7 @@ export function resolveJobPrompt(config) {
     // Last report (special handling)
     const latestRun = getLatestRun(config.name);
     if (latestRun) {
-        const reportPath = path.join(getRunsDir(), config.name, latestRun.runId, 'report.md');
+        const reportPath = path.join(getJobRunsDir(config.name), latestRun.runId, 'report.md');
         if (fs.existsSync(reportPath)) {
             const report = fs.readFileSync(reportPath, 'utf-8');
             prompt = prompt.replace(/\{last_report\}/g, report);
@@ -481,8 +494,7 @@ export function parseTimeout(timeout) {
 }
 /** List all run metadata entries for a job, sorted chronologically. */
 export function listRuns(jobName) {
-    const runsDir = getRunsDir();
-    const jobRunsDir = path.join(runsDir, jobName);
+    const jobRunsDir = getJobRunsDir(jobName);
     if (!fs.existsSync(jobRunsDir))
         return [];
     const entries = fs.readdirSync(jobRunsDir, { withFileTypes: true })
@@ -505,13 +517,13 @@ export function getLatestRun(jobName) {
 /** Persist run metadata to its run directory as meta.json. */
 export function writeRunMeta(meta) {
     ensureAgentsDir();
-    const runDir = path.join(getRunsDir(), meta.jobName, meta.runId);
+    const runDir = path.join(getJobRunsDir(meta.jobName), meta.runId);
     fs.mkdirSync(runDir, { recursive: true });
     fs.writeFileSync(path.join(runDir, 'meta.json'), JSON.stringify(meta, null, 2), 'utf-8');
 }
 /** Read run metadata from disk. Returns null if missing or corrupt. */
 export function readRunMeta(jobName, runId) {
-    const metaPath = path.join(getRunsDir(), jobName, runId, 'meta.json');
+    const metaPath = path.join(getJobRunsDir(jobName), runId, 'meta.json');
     if (!fs.existsSync(metaPath))
         return null;
     try {
@@ -521,9 +533,20 @@ export function readRunMeta(jobName, runId) {
         return null;
     }
 }
+/**
+ * Runs directory for a single job, with the (untrusted) job name contained to a
+ * single segment beneath the runs dir — same guard as `getJobHomePath`. The name
+ * comes from routine YAML and can arrive via a synced config repo; every runs-dir
+ * sink (run dir, meta read/write, last-report read) routes through here so a
+ * crafted `name` like `../../../../tmp/x` can't `mkdirSync`/write `stdout.log`,
+ * `meta.json`, or `report.md` outside `~/.agents/.history/runs`.
+ */
+export function getJobRunsDir(jobName) {
+    return safeJoin(getRunsDir(), jobName);
+}
 /** Get the filesystem path for a specific run's directory. */
 export function getRunDir(jobName, runId) {
-    return path.join(getRunsDir(), jobName, runId);
+    return path.join(getJobRunsDir(jobName), runId);
 }
 /** Discover routine YAML files in a repository's routines/ directory. */
 export function discoverJobsFromRepo(repoPath) {

package/dist/lib/runner.js

@@ -44,17 +44,20 @@ export function buildJobCommand(config, resolvedPrompt) {
         const cmd = ['agents', 'run', config.workflow, resolvedPrompt, '--mode', config.mode];
         return cmd;
     }
+    // Past the workflow branch this is an agent (or resume) job — command jobs never
+    // reach buildJobCommand (execute*Job branches out first), and validateJob guarantees agent.
+    const agent = config.agent;
     // Resume branch: reopen an EXISTING session via `agents run <agent> --resume <id>`
     // instead of starting fresh. The real session resumes with its full prior context
     // (index-based lookup, cwd-independent) and `resolvedPrompt` becomes its next turn —
     // so a self-scheduled wake (e.g. /hibernate) is handled by the session that scheduled
     // it, not a fresh, context-less agent that would refuse an "opaque" instruction.
     if (config.resume) {
-        return ['agents', 'run', config.agent, '--resume', config.resume, resolvedPrompt, '--mode', config.mode];
+        return ['agents', 'run', agent, '--resume', config.resume, resolvedPrompt, '--mode', config.mode];
     }
-    const template = AGENT_COMMANDS[config.agent];
+    const template = AGENT_COMMANDS[agent];
     if (!template) {
-        throw new Error(`Unsupported agent for daemon jobs: ${config.agent}`);
+        throw new Error(`Unsupported agent for daemon jobs: ${agent}`);
     }
     let cmd = template.map((part) => part.replace('{prompt}', resolvedPrompt));
     // Canonicalize mode (accepts legacy `full` as alias for `skip`).
@@ -155,10 +158,12 @@ export function buildJobCommand(config, resolvedPrompt) {
  * Reasoning level (config.config.reasoning) maps to per-agent flags via models.ts.
  */
 function appendModelAndReasoning(cmd, config) {
+    // Only called from buildJobCommand's agent path — config.agent is set.
+    const agent = config.agent;
     const model = config.config?.model;
     if (model) {
         if (config.version) {
-            const resolved = resolveModel(config.agent, config.version, model);
+            const resolved = resolveModel(agent, config.version, model);
             if (resolved.warning) {
                 process.stderr.write(`[agents] ${resolved.warning}\n`);
             }
@@ -170,7 +175,7 @@ function appendModelAndReasoning(cmd, config) {
     }
     const reasoning = config.config?.reasoning;
     if (reasoning) {
-        const flags = buildReasoningFlags(config.agent, reasoning);
+        const flags = buildReasoningFlags(agent, reasoning);
         if (flags.length > 0)
             cmd.push(...flags);
     }
@@ -178,6 +183,48 @@ function appendModelAndReasoning(cmd, config) {
 function generateRunId() {
     return new Date().toISOString().replace(/[:.]/g, '-');
 }
+/**
+ * Build the argv for a command-mode routine: run the shell string directly
+ * through the platform shell. No agent binary, no rotation, no sandbox.
+ */
+function buildShellCommand(command) {
+    return process.platform === 'win32'
+        ? ['cmd', '/c', command]
+        : ['/bin/sh', '-c', command];
+}
+/**
+ * Real (un-sandboxed) environment for a command routine. Command routines do
+ * `npm i -g` / `git pull` and need the actual $HOME / $PATH, not the sandbox
+ * overlay. Only TZ is injected when the routine pins a timezone.
+ */
+function commandSpawnEnv(config) {
+    const env = { ...process.env };
+    if (config.timezone)
+        env.TZ = config.timezone;
+    return env;
+}
+/** POSIX single-quote a string so it is safe to embed in a `/bin/sh -c` script. */
+function shSingleQuote(s) {
+    return `'${s.replace(/'/g, `'\\''`)}'`;
+}
+/**
+ * Detached command routines write their own exit code to `<runDir>/exit-code`
+ * (see the wrapper in executeCommandJobDetached). `monitorRunningJobs` reads it
+ * to recover the true terminal status when the daemon restarted between spawn and
+ * exit and so missed the in-process `child.on('exit')`. Returns null when the
+ * file is absent/unparseable (child killed or crashed before writing it).
+ */
+function readCommandExitCode(runDir) {
+    try {
+        const raw = fs.readFileSync(path.join(runDir, 'exit-code'), 'utf-8').trim();
+        if (!/^-?\d+$/.test(raw))
+            return null;
+        return parseInt(raw, 10);
+    }
+    catch {
+        return null;
+    }
+}
 /**
  * Resolve the version/account chain for a routine the same way `agents run`
  * does: honor an explicit `version:` pin; otherwise use the configured run
@@ -191,6 +238,8 @@ export async function resolveRoutineLaunch(config, cwd = process.cwd()) {
     if (config.workflow) {
         return { chain: [], rotation: null, pinned: false };
     }
+    // resolveRoutineLaunch is only called for agent jobs (workflow returns above;
+    // command jobs branch out of execute*Job before reaching this).
     const agent = config.agent;
     if (config.version) {
         const version = config.version;
@@ -399,6 +448,12 @@ export async function executeJob(config, deps) {
     if (eligibility) {
         throw new Error(eligibility.message);
     }
+    // Command-mode: run a plain shell command directly (no agent, no rotation,
+    // no pinning, no sandbox overlay). Reuses the run-record machinery so
+    // list/runs/overdue keep working.
+    if (config.command) {
+        return executeCommandJobForeground(config);
+    }
     maybeRotate();
     const launch = await resolveRoutineLaunch(config);
     const primaryVersion = launch.chain[0]?.version ?? config.version;
@@ -425,6 +480,7 @@ export async function executeJob(config, deps) {
         : { ...process.env };
     // Workflows run via `agents run <workflow>` which delegates to claude under the hood.
     // Use 'claude' as the effective agent for report extraction and metadata when workflow is set.
+    // (command jobs branched out earlier, so config.agent is set on the non-workflow path.)
     const effectiveAgent = config.workflow ? 'claude' : config.agent;
     const meta = {
         jobName: config.name,
@@ -561,6 +617,100 @@ export async function executeJob(config, deps) {
     timer.end({ status: 'failed', exitCode: 1, runId });
     return { meta, reportPath: null };
 }
+/**
+ * Foreground execution for a command-mode routine (`config.command`). Runs a
+ * plain shell command in the REAL environment (no sandbox), captures stdout+
+ * stderr to `stdout.log`, awaits completion, and honors `config.timeout` with
+ * the same SIGTERM→SIGKILL kill mechanism the agent path uses. No agent is
+ * spawned; the run record carries `command` instead of `agent`. There is no
+ * agent report to extract, so `reportPath` is always null (the stdout log is
+ * the artifact — same location the agent path writes).
+ */
+async function executeCommandJobForeground(config) {
+    const timer = createTimer('agent.run', {
+        jobName: config.name,
+        mode: config.mode,
+        schedule: config.schedule,
+    });
+    const runId = generateRunId();
+    const runDir = getRunDir(config.name, runId);
+    fs.mkdirSync(runDir, { recursive: true });
+    const stdoutPath = path.join(runDir, 'stdout.log');
+    const stdoutFd = fs.openSync(stdoutPath, 'w', 0o600);
+    const meta = {
+        jobName: config.name,
+        runId,
+        command: config.command,
+        pid: null,
+        spawnedAt: Date.now(),
+        status: 'running',
+        startedAt: new Date().toISOString(),
+        completedAt: null,
+        exitCode: null,
+    };
+    writeRunMeta(meta);
+    const timeoutMs = parseTimeout(config.timeout) || 10 * 60 * 1000;
+    const cmd = buildShellCommand(config.command);
+    const env = commandSpawnEnv(config);
+    process.stderr.write(`[agents] routine ${config.name}: running command\n`);
+    const result = await new Promise((resolve) => {
+        const child = spawn(cmd[0], cmd.slice(1), {
+            stdio: ['ignore', stdoutFd, stdoutFd],
+            ...backgroundSpawnOptions({ fdStdio: true }),
+            env,
+        });
+        meta.pid = child.pid || null;
+        writeRunMeta(meta);
+        let settled = false;
+        const finish = (r) => {
+            if (settled)
+                return;
+            settled = true;
+            try {
+                fs.closeSync(stdoutFd);
+            }
+            catch { /* fd already closed */ }
+            resolve(r);
+        };
+        const timeoutTimer = setTimeout(() => {
+            try {
+                if (child.pid)
+                    process.kill(-child.pid, 'SIGTERM');
+            }
+            catch { /* process already exited */ }
+            setTimeout(() => {
+                try {
+                    if (child.pid)
+                        process.kill(-child.pid, 'SIGKILL');
+                }
+                catch { /* process already exited */ }
+            }, 5000);
+            finish({ exitCode: null, status: 'timeout' });
+        }, timeoutMs);
+        child.on('exit', (code) => {
+            clearTimeout(timeoutTimer);
+            finish({ exitCode: code, status: code === 0 ? 'completed' : 'failed' });
+        });
+        child.on('error', (err) => {
+            clearTimeout(timeoutTimer);
+            finish({ exitCode: 1, status: 'failed', error: err.message });
+        });
+    });
+    meta.status = result.status;
+    meta.exitCode = result.exitCode ?? (result.status === 'completed' ? 0 : 1);
+    meta.completedAt = new Date().toISOString();
+    writeRunMeta(meta);
+    if (result.error) {
+        process.stderr.write(`[agents] routine ${config.name}: command spawn failed: ${result.error}\n`);
+    }
+    timer.end({
+        status: meta.status,
+        exitCode: meta.exitCode ?? undefined,
+        runId,
+        ...(result.error ? { error: result.error } : {}),
+    });
+    return { meta, reportPath: null };
+}
 /** Spawn a job as a detached process and return immediately with run metadata. */
 export async function executeJobDetached(config) {
     const eligibility = checkJobDeviceEligibility(config);
@@ -568,6 +718,12 @@ export async function executeJobDetached(config) {
         process.stderr.write(`[agents] daemon: skipping '${config.name}' — ${eligibility.message}\n`);
         throw new Error(eligibility.message);
     }
+    // Command-mode: fire a plain shell command detached (no agent, no rotation,
+    // no pinning, no sandbox overlay). Still writes a run record so the daemon,
+    // list/runs, and overdue tracking keep working.
+    if (config.command) {
+        return executeCommandJobDetached(config);
+    }
     // Pre-flight: pick a healthy version/account so the daemon does not launch
     // into a credit-exhausted install. Detached cannot mid-run failover (no exit
     // wait); the next schedule tick re-selects if this attempt still fails.
@@ -577,7 +733,7 @@ export async function executeJobDetached(config) {
     let cmd = buildJobCommand(config, resolvedPrompt);
     // workflow AND resume dispatch through `agents run` — never binary-pin them (pinning
     // rewrites cmd[0] to the agent binary → broken `<binary> run …`).
-    if (!dispatchesViaAgentsRun(config) && version) {
+    if (!dispatchesViaAgentsRun(config) && version && config.agent) {
         cmd = pinJobBinary(cmd, config.agent, version);
     }
     // Resume must run against the REAL home: `--resume <id>` resolves the session from
@@ -601,6 +757,7 @@ export async function executeJobDetached(config) {
                 e.TZ = config.timezone;
             return e;
         })()
+        // Non-command path only: config.agent is always set here (command/workflow branch earlier).
         : buildRoutineSpawnEnv(baseEnv, config.agent, version, config.timezone);
     const effectiveAgent = config.workflow ? 'claude' : config.agent;
     const meta = {
@@ -640,6 +797,74 @@ export async function executeJobDetached(config) {
     writeRunMeta(meta);
     return meta;
 }
+/**
+ * Detached (fire-and-forget) execution for a command-mode routine. Mirrors the
+ * agent detached flow: write an initial running record, spawn the shell command
+ * un-sandboxed, unref, then record the pid. The daemon does not wait for exit;
+ * `monitorRunningJobs` reaps the record on the next tick.
+ */
+function executeCommandJobDetached(config) {
+    const runId = generateRunId();
+    const runDir = getRunDir(config.name, runId);
+    fs.mkdirSync(runDir, { recursive: true });
+    const stdoutPath = path.join(runDir, 'stdout.log');
+    const stdoutFd = fs.openSync(stdoutPath, 'w', 0o600);
+    // Wrap the shell so the child records its own exit code to <runDir>/exit-code.
+    // The in-process `child.on('exit')` below writes the terminal record while the
+    // daemon is alive (the common case); the file lets monitorRunningJobs recover
+    // the real status if the daemon restarted between spawn and exit. (win32 relies
+    // on the exit event only.)
+    const exitCodePath = path.join(runDir, 'exit-code');
+    // Run the command in a SUBSHELL `( … )` so that if it calls `exit`, only the
+    // subshell exits — the outer shell still captures `$?` and writes the file.
+    const cmd = process.platform === 'win32'
+        ? buildShellCommand(config.command)
+        : ['/bin/sh', '-c',
+            `(\n${config.command}\n)\n__ac_rc=$?; printf '%s' "$__ac_rc" > ${shSingleQuote(exitCodePath)} 2>/dev/null; exit $__ac_rc`];
+    const env = commandSpawnEnv(config);
+    const meta = {
+        jobName: config.name,
+        runId,
+        command: config.command,
+        pid: null,
+        spawnedAt: Date.now(),
+        status: 'running',
+        startedAt: new Date().toISOString(),
+        completedAt: null,
+        exitCode: null,
+    };
+    const child = spawn(cmd[0], cmd.slice(1), {
+        stdio: ['ignore', stdoutFd, stdoutFd],
+        ...backgroundSpawnOptions({ fdStdio: true }),
+        env,
+    });
+    // Record the real terminal status ourselves — the daemon stays alive after this
+    // fire-and-forget call, so the exit event fires here. (monitorRunningJobs no
+    // longer force-fails command jobs; it reads exit-code only on the restart edge.)
+    let settled = false;
+    const settle = (status, exitCode) => {
+        if (settled)
+            return;
+        settled = true;
+        meta.status = status;
+        meta.exitCode = exitCode;
+        meta.completedAt = new Date().toISOString();
+        writeRunMeta(meta);
+    };
+    child.on('exit', (code) => settle(code === 0 ? 'completed' : 'failed', code ?? 1));
+    child.on('error', (err) => {
+        settle('failed', 1);
+        process.stderr.write(`[agents] daemon: command spawn failed for job "${config.name}": ${err.message}\n`);
+    });
+    child.unref();
+    try {
+        fs.closeSync(stdoutFd);
+    }
+    catch { /* fd already closed */ }
+    meta.pid = child.pid || null;
+    writeRunMeta(meta);
+    return meta;
+}
 function extractAndSaveReport(stdoutPath, agentType, runDir) {
     try {
         const report = extractReport(stdoutPath, agentType);
@@ -792,26 +1017,43 @@ export function monitorRunningJobs() {
                     continue;
                 const runDirPath = path.join(jobRunsPath, runDirEntry.name);
                 const stdoutPath = path.join(runDirPath, 'stdout.log');
+                // Command-mode records carry no agent; there is no stream-json report to
+                // parse or extract. Reap them on pid liveness alone.
+                const isCommandRun = Boolean(meta.command) || !meta.agent;
                 const wallClockMs = Date.now() - Date.parse(meta.startedAt);
                 if (Number.isFinite(wallClockMs) && wallClockMs > MAX_WALL_CLOCK_MS) {
                     meta.status = 'timeout';
                     meta.completedAt = new Date().toISOString();
                     writeRunMeta(meta);
-                    extractAndSaveReport(stdoutPath, meta.agent, runDirPath);
+                    if (!isCommandRun)
+                        extractAndSaveReport(stdoutPath, meta.agent, runDirPath);
                     continue;
                 }
                 if (!isPidOurs(meta.pid, meta.spawnedAt)) {
-                    const inferred = inferFinalStatusFromLog(stdoutPath, meta.agent);
-                    if (inferred) {
-                        meta.status = inferred.status;
-                        meta.exitCode = inferred.exitCode;
+                    if (isCommandRun) {
+                        // Command routines normally record their own terminal status via
+                        // child.on('exit') (so this record would already be non-'running' and
+                        // skipped above). Reaching here means the daemon restarted mid-run and
+                        // missed the exit event — recover the true code from the exit-code file
+                        // the child wrote; its absence means the child was killed/crashed.
+                        const ec = readCommandExitCode(runDirPath);
+                        meta.status = ec === 0 ? 'completed' : 'failed';
+                        meta.exitCode = ec;
                     }
                     else {
-                        meta.status = 'failed';
+                        const inferred = inferFinalStatusFromLog(stdoutPath, meta.agent);
+                        if (inferred) {
+                            meta.status = inferred.status;
+                            meta.exitCode = inferred.exitCode;
+                        }
+                        else {
+                            meta.status = 'failed';
+                        }
                     }
                     meta.completedAt = new Date().toISOString();
                     writeRunMeta(meta);
-                    extractAndSaveReport(stdoutPath, meta.agent, runDirPath);
+                    if (!isCommandRun)
+                        extractAndSaveReport(stdoutPath, meta.agent, runDirPath);
                 }
             }
             catch { /* corrupt or unreadable meta.json */ }

package/dist/lib/sandbox.d.ts

@@ -9,7 +9,15 @@
 import type { JobConfig } from './routines.js';
 /** Build a restricted environment for a sandboxed process, setting HOME to the overlay. */
 export declare function buildSpawnEnv(overlayHome: string, extraEnv?: Record<string, string>): Record<string, string>;
-/** Get the overlay HOME directory path for a named job. */
+/**
+ * Get the overlay HOME directory path for a named job.
+ *
+ * The job name originates from routine YAML (`name:` field or file basename),
+ * which can arrive from a synced user/system config repo. `safeJoin` contains
+ * it to a single segment beneath the routines dir so a crafted name such as
+ * `../../../..` cannot steer `prepareJobHome`/`cleanJobHome` (which does a
+ * recursive `rmSync`) at a path outside `~/.agents/routines`.
+ */
 export declare function getJobHomePath(name: string): string;
 /** Create a fresh overlay HOME for a job, including agent config and allowed-dir symlinks. */
 export declare function prepareJobHome(config: JobConfig): string;

package/dist/lib/sandbox.js

@@ -11,6 +11,7 @@ import * as path from 'path';
 import * as os from 'os';
 import { setGeminiAutoUpdateDisabled, updateGeminiSettings } from './gemini-settings.js';
 import { getRoutinesDir, getUserAgentsDir } from './state.js';
+import { safeJoin } from './paths.js';
 import { createLink } from './platform/index.js';
 function resolveRealHome() {
     const home = os.homedir();
@@ -79,9 +80,17 @@ export function buildSpawnEnv(overlayHome, extraEnv) {
     }
     return env;
 }
-/** Get the overlay HOME directory path for a named job. */
+/**
+ * Get the overlay HOME directory path for a named job.
+ *
+ * The job name originates from routine YAML (`name:` field or file basename),
+ * which can arrive from a synced user/system config repo. `safeJoin` contains
+ * it to a single segment beneath the routines dir so a crafted name such as
+ * `../../../..` cannot steer `prepareJobHome`/`cleanJobHome` (which does a
+ * recursive `rmSync`) at a path outside `~/.agents/routines`.
+ */
 export function getJobHomePath(name) {
-    return path.join(getRoutinesDir(), name, 'home');
+    return path.join(safeJoin(getRoutinesDir(), name), 'home');
 }
 /** Create a fresh overlay HOME for a job, including agent config and allowed-dir symlinks. */
 export function prepareJobHome(config) {