@phuetz/code-buddy 1.6.0 → 2.0.0

package/dist/fleet/peer-session-bridge.js

@@ -29,7 +29,9 @@
  *
  * Idempotent (mirror of peer-chat-bridge): a second wire call is a no-op.
  */
+import { normalizePeerChatProviderId, } from './peer-chat-client-factory.js';
 import { beginFleetWork } from './fleet-load.js';
+import { executeCostCappedFleetCall } from './fleet-cost-cap.js';
 import { registerPeerMethod, unregisterPeerMethod } from '../server/websocket/peer-rpc.js';
 import { broadcastChatSessionEnd, broadcastChatSessionGoal, broadcastChatSessionStart, broadcastChatSessionTurn, } from '../server/websocket/fleet-bridge.js';
 import { resolveGoalJudgeClientFailOpen } from '../goals/goal-judge-client.js';
@@ -43,6 +45,9 @@ const DEFAULT_SYSTEM_PROMPT = 'You are a peer LLM in a multi-Claude fleet. Answe
 const DEFAULT_IDLE_MS = 30 * 60 * 1000;
 const sessions = new Map();
 let cachedGetter = null;
+let cachedProviderInfo = null;
+let cachedResolver = null;
+const providerClients = new Map();
 let wired = false;
 function resolvePeerSessionProfile(params) {
     if (params.dispatchProfile === undefined) {
@@ -94,6 +99,53 @@ function assertPeerSessionContinueProfile(params, session, methodName) {
         throw new Error(`${methodName}: dispatchProfile "${requestedProfile}" does not match session profile "${session.dispatchProfile}"; start a new session to change profile`);
     }
 }
+function parsePeerSessionProvider(value, methodName) {
+    if (value === undefined)
+        return undefined;
+    const normalized = normalizePeerChatProviderId(value);
+    if (!normalized) {
+        throw new Error(`${methodName}: unknown provider "${String(value)}"`);
+    }
+    return normalized;
+}
+function assertPeerSessionContinueProvider(params, session, methodName) {
+    if (params.provider === undefined)
+        return;
+    const requested = parsePeerSessionProvider(params.provider, methodName);
+    if (!session.provider) {
+        throw new Error(`${methodName}: provider cannot be set on continue for a legacy/default session; start a new session with provider "${requested}"`);
+    }
+    if (requested !== session.provider) {
+        throw new Error(`${methodName}: provider "${requested}" does not match session provider "${session.provider}"; start a new session to change provider`);
+    }
+}
+function resolvePeerSessionClient(provider, model, methodName) {
+    if (!provider) {
+        const client = cachedGetter?.() ?? null;
+        if (!client) {
+            throw new Error(`CLIENT_UNAVAILABLE: no LLM client wired on this peer (${methodName} cannot answer)`);
+        }
+        return {
+            client,
+            ...(cachedProviderInfo ? { providerResolved: cachedProviderInfo.provider } : {}),
+        };
+    }
+    if (cachedProviderInfo?.provider === provider) {
+        const client = cachedGetter?.() ?? null;
+        if (client)
+            return { client, providerResolved: provider };
+    }
+    let resolved = providerClients.get(provider);
+    if (!resolved && cachedResolver) {
+        resolved = cachedResolver(provider, model) ?? undefined;
+        if (resolved)
+            providerClients.set(provider, resolved);
+    }
+    if (!resolved || resolved.info.provider !== provider) {
+        throw new Error(`PROVIDER_UNAVAILABLE: ${provider} is not configured on this peer (${methodName})`);
+    }
+    return { client: resolved.client, providerResolved: resolved.info.provider };
+}
 function getIdleMs() {
     const raw = process.env.CODEBUDDY_PEER_SESSION_IDLE_MS;
     if (raw) {
@@ -150,6 +202,7 @@ function snapshot(session) {
     return {
         sessionId: session.sessionId,
         systemPrompt: session.systemPrompt,
+        provider: session.provider,
         model: session.model,
         dispatchProfile: session.dispatchProfile,
         toolPolicy: session.toolPolicy,
@@ -167,7 +220,7 @@ function snapshot(session) {
  * ladder, and returns the report embedded in the RPC response. The judge is
  * fail-open; this never throws. The caller persists the session afterwards.
  */
-async function evaluateSessionGoalAfterTurn(session, assistantText) {
+async function evaluateSessionGoalAfterTurn(session, assistantText, baseClient) {
     const goal = session.goal;
     if (!goal || goal.status !== 'active')
         return null;
@@ -194,7 +247,6 @@ async function evaluateSessionGoalAfterTurn(session, assistantText) {
     let report;
     try {
         const config = resolveGoalsConfig();
-        const baseClient = cachedGetter?.() ?? null;
         const judgeClient = await resolveGoalJudgeClientFailOpen(baseClient, config.judgeModel);
         const criteria = getGoalJudgeCriteria(goal);
         const outcome = await judgeGoal(judgeClient, {
@@ -240,12 +292,14 @@ async function evaluateSessionGoalAfterTurn(session, assistantText) {
  * Idempotent — a second call is a no-op (does NOT replace the cached
  * getter; un-wire first if you need to swap).
  */
-export async function wirePeerSessionBridge(getClient) {
+export async function wirePeerSessionBridge(getClient, providerInfo, resolveClient) {
     if (wired) {
         logger.debug('[peer-session-bridge] wire() called while already wired — no-op');
         return;
     }
     cachedGetter = getClient;
+    cachedProviderInfo = providerInfo ?? null;
+    cachedResolver = resolveClient ?? null;
     // V1.2-saga — replay sessions from disk that haven't idled out.
     // Best-effort: if the store can't be read (perms, corrupt dir), we
     // continue with an empty in-memory map rather than refusing to wire.
@@ -259,9 +313,11 @@ export async function wirePeerSessionBridge(getClient) {
             if (now - p.lastUsedAt > idleMs)
                 continue; // double-check vs the boundary
             const goal = p.goal ? normalizeGoalState(p.goal) : null;
+            const persistedProvider = normalizePeerChatProviderId(p.provider);
             sessions.set(p.sessionId, {
                 sessionId: p.sessionId,
                 systemPrompt: p.systemPrompt,
+                ...(persistedProvider ? { provider: persistedProvider } : {}),
                 model: p.model,
                 dispatchProfile: p.dispatchProfile,
                 toolPolicy: p.toolPolicy,
@@ -290,10 +346,15 @@ export async function wirePeerSessionBridge(getClient) {
         const profile = resolvePeerSessionProfile(params);
         const systemPrompt = resolvePeerSessionSystemPrompt(params, profile.dispatchProfile);
         const model = typeof params.model === 'string' && params.model.length > 0 ? params.model : undefined;
+        const provider = parsePeerSessionProvider(params.provider, 'peer.chat-session.start');
+        const providerResolved = provider
+            ? resolvePeerSessionClient(provider, model, 'peer.chat-session.start').providerResolved
+            : undefined;
         const sessionId = newSessionId();
         const session = {
             sessionId,
             systemPrompt,
+            provider,
             model,
             dispatchProfile: profile.dispatchProfile,
             toolPolicy: profile.toolPolicy,
@@ -327,6 +388,8 @@ export async function wirePeerSessionBridge(getClient) {
             sessionId,
             expiresAt: now + idleMs,
             traceId: ctx.traceId,
+            ...(provider ? { providerRequested: provider } : {}),
+            ...(providerResolved ? { providerResolved } : {}),
             ...(profile.dispatchProfile ? { dispatchProfile: profile.dispatchProfile } : {}),
             ...(profile.toolPolicy ? { toolPolicy: profile.toolPolicy } : {}),
             ...(profile.toolDecisions ? { toolDecisions: profile.toolDecisions } : {}),
@@ -363,27 +426,33 @@ export async function wirePeerSessionBridge(getClient) {
             throw new Error(`SESSION_EXPIRED: session "${sessionId}" idled past ${idleMs}ms`);
         }
         assertPeerSessionContinueProfile(params, session, 'peer.chat-session.continue');
+        assertPeerSessionContinueProvider(params, session, 'peer.chat-session.continue');
         // FIFO serialise: chain onto the session's pending promise so
         // concurrent continue() calls run one after the other rather than
         // racing on session.messages.
         const run = async () => {
-            const client = cachedGetter?.() ?? null;
-            if (!client) {
-                throw new Error('CLIENT_UNAVAILABLE: no LLM client wired on this peer (peer.chat-session.continue cannot answer)');
-            }
+            const selected = resolvePeerSessionClient(session.provider, session.model, 'peer.chat-session.continue');
+            const client = selected.client;
             session.messages.push({ role: 'user', content: prompt });
             const requestMessages = [
                 { role: 'system', content: session.systemPrompt },
                 ...session.messages,
             ];
-            const chatOptions = session.model
-                ? { model: session.model }
-                : undefined;
             const turnStartedAt = Date.now();
             let response;
             const doneLoad = beginFleetWork('peer.chat-session');
             try {
-                response = await client.chat(requestMessages, undefined, chatOptions);
+                response = await executeCostCappedFleetCall({
+                    peerId: ctx.connectionId,
+                    provider: selected.providerResolved ?? session.provider ?? cachedProviderInfo?.provider,
+                    model: session.model,
+                    sagaId: ctx.traceId,
+                    runId: session.sessionId,
+                    requestedMaxTokens: params.maxTokens,
+                    inputText: requestMessages.map((message) => message.content).join('\n'),
+                    client,
+                    invoke: (maxTokens) => client.chat(requestMessages, undefined, { ...(session.model ? { model: session.model } : {}), maxTokens }),
+                });
             }
             catch (err) {
                 // Roll back the user message we appended so a retry doesn't
@@ -402,7 +471,7 @@ export async function wirePeerSessionBridge(getClient) {
             // mutate the session goal state, and report the verdict to the caller
             // (who drives the continuation). Runs BEFORE the disk flush so the
             // snapshot below persists the updated goal counters.
-            const goalReport = await evaluateSessionGoalAfterTurn(session, text);
+            const goalReport = await evaluateSessionGoalAfterTurn(session, text, client);
             // V1.2-saga — flush the new turn to disk before returning so a
             // crash mid-conversation can be replayed on next boot. Failure
             // logs but doesn't fail the turn: the caller already got an
@@ -431,6 +500,8 @@ export async function wirePeerSessionBridge(getClient) {
                 finishReason: response?.choices?.[0]?.finish_reason,
                 usage: response?.usage,
                 traceId: ctx.traceId,
+                ...(session.provider ? { providerRequested: session.provider } : {}),
+                ...(selected.providerResolved ? { providerResolved: selected.providerResolved } : {}),
                 ...(goalReport ? { goal: goalReport } : {}),
                 ...sessionPolicyMetadata(session),
             };
@@ -475,11 +546,10 @@ export async function wirePeerSessionBridge(getClient) {
             throw new Error(`SESSION_EXPIRED: session "${sessionId}" idled past ${idleMs}ms`);
         }
         assertPeerSessionContinueProfile(params, session, 'peer.chat-session.continue-stream');
+        assertPeerSessionContinueProvider(params, session, 'peer.chat-session.continue-stream');
         const run = async () => {
-            const client = cachedGetter?.() ?? null;
-            if (!client) {
-                throw new Error('CLIENT_UNAVAILABLE: no LLM client wired on this peer (peer.chat-session.continue-stream cannot answer)');
-            }
+            const selected = resolvePeerSessionClient(session.provider, session.model, 'peer.chat-session.continue-stream');
+            const client = selected.client;
             session.messages.push({ role: 'user', content: prompt });
             const requestMessages = [
                 { role: 'system', content: session.systemPrompt },
@@ -532,7 +602,7 @@ export async function wirePeerSessionBridge(getClient) {
             session.messages.push({ role: 'assistant', content: aggregate });
             session.lastUsedAt = Date.now();
             // Goal Ralph-loop — same server-side judge as the non-streaming path.
-            const goalReport = await evaluateSessionGoalAfterTurn(session, aggregate);
+            const goalReport = await evaluateSessionGoalAfterTurn(session, aggregate, client);
             try {
                 await getPeerSessionStore().save(snapshot(session));
             }
@@ -554,6 +624,8 @@ export async function wirePeerSessionBridge(getClient) {
                 finishReason,
                 usage,
                 traceId: ctx.traceId,
+                ...(session.provider ? { providerRequested: session.provider } : {}),
+                ...(selected.providerResolved ? { providerResolved: selected.providerResolved } : {}),
                 ...(goalReport ? { goal: goalReport } : {}),
                 ...sessionPolicyMetadata(session),
             };
@@ -578,6 +650,7 @@ export async function wirePeerSessionBridge(getClient) {
             sessionId: s.sessionId,
             turnCount: Math.floor(s.messages.length / 2),
             model: s.model,
+            provider: s.provider,
             dispatchProfile: s.dispatchProfile,
             toolPolicy: s.toolPolicy,
             toolDecisions: s.toolDecisions,
@@ -767,8 +840,12 @@ export function unwirePeerSessionBridge() {
     unregisterPeerMethod('peer.chat-session.continue');
     unregisterPeerMethod('peer.chat-session.continue-stream');
     unregisterPeerMethod('peer.chat-session.goal');
+    unregisterPeerMethod('peer.chat-session.list');
     unregisterPeerMethod('peer.chat-session.end');
     cachedGetter = null;
+    cachedProviderInfo = null;
+    cachedResolver = null;
+    providerClients.clear();
     wired = false;
     logger.debug('[peer-session-bridge] unwired');
 }
@@ -794,6 +871,9 @@ export function _unwireForTests() {
         /* peer-rpc may not be initialised in some test setups */
     }
     cachedGetter = null;
+    cachedProviderInfo = null;
+    cachedResolver = null;
+    providerClients.clear();
     wired = false;
     sessions.clear();
 }
@@ -804,6 +884,7 @@ export function _listSessionsForTests() {
         messageCount: s.messages.length,
         lastUsedAt: s.lastUsedAt,
         dispatchProfile: s.dispatchProfile,
+        provider: s.provider,
     }));
 }
 //# sourceMappingURL=peer-session-bridge.js.map

package/dist/fleet/peer-session-store.d.ts

@@ -36,6 +36,8 @@ export interface PersistedChatMessage {
 export interface PersistedChatSession {
     sessionId: string;
     systemPrompt: string;
+    /** Exact backend pinned for this session. Absent in legacy records. */
+    provider?: string;
     model?: string;
     dispatchProfile?: FleetDispatchProfile;
     toolPolicy?: FleetDispatchToolPolicy;

package/dist/fleet/peer-session-store.js

@@ -32,6 +32,7 @@ import * as os from 'os';
 import * as path from 'path';
 import { withSessionLock } from '../persistence/session-lock.js';
 import { logger } from '../utils/logger.js';
+import { readJsonAtomic, writeJsonAtomic } from '../utils/atomic-write.js';
 /**
  * Disk-backed registry for `peer.chat-session.*` state. Pattern copied
  * from `SagaStore` — the storage discipline is identical, only the
@@ -56,8 +57,10 @@ export class PeerSessionStore {
         if (!fs.existsSync(file))
             return null;
         try {
-            const raw = await fs.promises.readFile(file, 'utf-8');
-            return JSON.parse(raw);
+            return await readJsonAtomic(file, null, {
+                mode: 0o600,
+                isValid: (value) => Boolean(value && typeof value === 'object' && !Array.isArray(value)),
+            });
         }
         catch (err) {
             logger.warn?.('[peer-session-store] failed to read session', {
@@ -156,9 +159,7 @@ export class PeerSessionStore {
     }
     async writeUnlocked(record) {
         const file = this.fileFor(record.sessionId);
-        const tmp = `${file}.tmp.${process.pid}`;
-        await fs.promises.writeFile(tmp, JSON.stringify(record, null, 2));
-        await fs.promises.rename(tmp, file);
+        await writeJsonAtomic(file, record, { mode: 0o600 });
     }
 }
 let cachedStore = null;

package/dist/fleet/peer-text-sanitizer.d.ts

@@ -0,0 +1,59 @@
+/**
+ * Sanitization of free-form text received from a fleet peer.
+ *
+ * A peer is ANOTHER Code Buddy instance, on another machine, possibly driven by
+ * someone else. Its `peer.chat` / `peer.chat-session.*` replies are model prose
+ * that we fold straight into local reasoning: the council judge prompt, an agent
+ * tool result, a terminal transcript. Local model output is already stripped of
+ * leakage/control tokens before it reaches any of those surfaces (agent-executor,
+ * council engine, triage); peer text has to get the SAME treatment at the door,
+ * otherwise a peer can smuggle `<think>`, `<|im_start|>`, `[INST]`, `<<SYS>>` or
+ * invisible characters into a prompt we build — a cross-machine prompt-injection
+ * channel. Sanitizing at the emitter would be pointless: a hostile peer simply
+ * doesn't run our code. Reception is the only enforceable point.
+ *
+ * Scope note (deliberate): this is for MODEL PROSE only. It must NOT be applied
+ * to structured peer payloads — `peer.describe` capability JSON, peer ids,
+ * session ids — nor to `peer.tool.invoke` output, which is verbatim file/
+ * directory content where `<think>` or `[INST]` may legitimately appear.
+ *
+ * `defangPeerKnowledgeText` is the second, deliberately weaker rule, for peer
+ * text that is PERSISTED and re-injected later (`peer.ckg.sync`). It neutralizes
+ * the same markers without deleting anything — see its own doc for why deletion
+ * is the wrong trade there.
+ *
+ * @module fleet/peer-text-sanitizer
+ */
+/**
+ * Clean one free-form text answer coming from a peer machine.
+ *
+ * Strips model control/leakage tokens (`sanitizeModelOutput`) AND invisible
+ * Unicode (`stripInvisibleChars`) — the local agent path does both
+ * (`agent/execution/context-pipeline.ts`), and untrusted remote prose has no
+ * legitimate use for zero-width characters.
+ *
+ * @param text - Raw text as returned on the wire by a peer.
+ * @returns The sanitized text (empty string for a non-string / empty input).
+ */
+export declare function sanitizePeerText(text: unknown): string;
+/**
+ * Neutralize control tokens in peer text that will be PERSISTED rather than read once.
+ *
+ * `sanitizePeerText` is right for a one-shot answer: it DELETES the offending
+ * spans, and a `<think>…</think>` block a peer's model leaked is worth nothing.
+ * That rule cannot be reused for `peer.ckg.sync`, whose entries land in the
+ * append-only collective ledger and are injected into later prompts: an entry
+ * can be derived from indexed code (`buddy research ingest-code`), where
+ * `[INST]…[/INST]` or `<|im_start|>` are the very subject of the knowledge.
+ * Deleting the span would silently destroy the payload of a legitimate entry,
+ * permanently, and the loss would only surface much later.
+ *
+ * So this variant defangs instead of deleting: invisible characters go (they
+ * have no use in a knowledge entry, and they can hide a token from the rules
+ * below), then one space is inserted inside each control-token delimiter. The
+ * text stays complete and readable; the marker stops parsing as a role switch.
+ *
+ * @param text - Raw `name` / `text` field of an entry received from a peer.
+ * @returns The defanged text (empty string for a non-string / empty input).
+ */
+export declare function defangPeerKnowledgeText(text: unknown): string;

package/dist/fleet/peer-text-sanitizer.js

@@ -0,0 +1,99 @@
+/**
+ * Sanitization of free-form text received from a fleet peer.
+ *
+ * A peer is ANOTHER Code Buddy instance, on another machine, possibly driven by
+ * someone else. Its `peer.chat` / `peer.chat-session.*` replies are model prose
+ * that we fold straight into local reasoning: the council judge prompt, an agent
+ * tool result, a terminal transcript. Local model output is already stripped of
+ * leakage/control tokens before it reaches any of those surfaces (agent-executor,
+ * council engine, triage); peer text has to get the SAME treatment at the door,
+ * otherwise a peer can smuggle `<think>`, `<|im_start|>`, `[INST]`, `<<SYS>>` or
+ * invisible characters into a prompt we build — a cross-machine prompt-injection
+ * channel. Sanitizing at the emitter would be pointless: a hostile peer simply
+ * doesn't run our code. Reception is the only enforceable point.
+ *
+ * Scope note (deliberate): this is for MODEL PROSE only. It must NOT be applied
+ * to structured peer payloads — `peer.describe` capability JSON, peer ids,
+ * session ids — nor to `peer.tool.invoke` output, which is verbatim file/
+ * directory content where `<think>` or `[INST]` may legitimately appear.
+ *
+ * `defangPeerKnowledgeText` is the second, deliberately weaker rule, for peer
+ * text that is PERSISTED and re-injected later (`peer.ckg.sync`). It neutralizes
+ * the same markers without deleting anything — see its own doc for why deletion
+ * is the wrong trade there.
+ *
+ * @module fleet/peer-text-sanitizer
+ */
+import { sanitizeModelOutput, stripInvisibleChars } from '../utils/output-sanitizer.js';
+/**
+ * Clean one free-form text answer coming from a peer machine.
+ *
+ * Strips model control/leakage tokens (`sanitizeModelOutput`) AND invisible
+ * Unicode (`stripInvisibleChars`) — the local agent path does both
+ * (`agent/execution/context-pipeline.ts`), and untrusted remote prose has no
+ * legitimate use for zero-width characters.
+ *
+ * @param text - Raw text as returned on the wire by a peer.
+ * @returns The sanitized text (empty string for a non-string / empty input).
+ */
+export function sanitizePeerText(text) {
+    if (typeof text !== 'string' || text.length === 0)
+        return '';
+    return stripInvisibleChars(sanitizeModelOutput(text));
+}
+/**
+ * Control-token shapes, and where to break them.
+ *
+ * Each rule inserts ONE ASCII space just after the opening delimiter. Every
+ * character of the payload survives and stays readable to a human; the marker
+ * simply stops being an exact match for any tokenizer special token or prompt
+ * parser. Order matters only in that invisible characters must already be gone
+ * (see `defangPeerKnowledgeText`): a zero-width space wedged between the `<`
+ * and the `|` would slip past these rules, then re-form into a live token the
+ * moment something else strips it.
+ */
+const KNOWLEDGE_DEFANG_RULES = [
+    // ChatML and every other `<|…|>` control token.
+    { pattern: /<\|/g, replacement: '< |' },
+    // Its JSON-escaped form, which survives a round-trip through a JSON payload.
+    { pattern: /\\u003c\|/gi, replacement: '\\u003c |' },
+    // GLM-5 full-width variant ＜｜…｜＞.
+    { pattern: /＜｜/g, replacement: '＜ ｜' },
+    // Half-formed pipe markers leaked by local runtimes: `<channel|>`, `<message|>`, …
+    { pattern: /<(channel|message|tool_call|constrain)\|>/gi, replacement: '< $1|>' },
+    // DeepSeek / Qwen reasoning fences.
+    { pattern: /<(\/?)(think|reasoning)>/gi, replacement: '< $1$2>' },
+    // LLaMA instruction and system markers.
+    { pattern: /\[(\/?)INST\]/gi, replacement: '[ $1INST]' },
+    { pattern: /<<(\/?)SYS>>/gi, replacement: '< <$1SYS>>' },
+];
+/**
+ * Neutralize control tokens in peer text that will be PERSISTED rather than read once.
+ *
+ * `sanitizePeerText` is right for a one-shot answer: it DELETES the offending
+ * spans, and a `<think>…</think>` block a peer's model leaked is worth nothing.
+ * That rule cannot be reused for `peer.ckg.sync`, whose entries land in the
+ * append-only collective ledger and are injected into later prompts: an entry
+ * can be derived from indexed code (`buddy research ingest-code`), where
+ * `[INST]…[/INST]` or `<|im_start|>` are the very subject of the knowledge.
+ * Deleting the span would silently destroy the payload of a legitimate entry,
+ * permanently, and the loss would only surface much later.
+ *
+ * So this variant defangs instead of deleting: invisible characters go (they
+ * have no use in a knowledge entry, and they can hide a token from the rules
+ * below), then one space is inserted inside each control-token delimiter. The
+ * text stays complete and readable; the marker stops parsing as a role switch.
+ *
+ * @param text - Raw `name` / `text` field of an entry received from a peer.
+ * @returns The defanged text (empty string for a non-string / empty input).
+ */
+export function defangPeerKnowledgeText(text) {
+    if (typeof text !== 'string' || text.length === 0)
+        return '';
+    let defanged = stripInvisibleChars(text);
+    for (const rule of KNOWLEDGE_DEFANG_RULES) {
+        defanged = defanged.replace(rule.pattern, rule.replacement);
+    }
+    return defanged;
+}
+//# sourceMappingURL=peer-text-sanitizer.js.map

package/dist/fleet/peer-tool-bridge.js

@@ -23,7 +23,7 @@
  * from `dispatchPeerRequest` — no extra wiring here.
  */
 import { spawn } from 'child_process';
-import { rgPath } from '@vscode/ripgrep';
+import { getRipgrepPath } from '../utils/ripgrep-path.js';
 import * as fs from 'fs/promises';
 import { createReadStream } from 'fs';
 import * as path from 'path';
@@ -43,19 +43,34 @@ function getWorkspaceRoot() {
     return raw ? path.resolve(raw) : null;
 }
 function assertToolAllowed(name, scopes) {
+    const fleetSafe = getToolRegistry().isFleetSafe(name);
     assertPeerToolInvokeAllowed({
         toolName: name,
         scopes,
-        fleetSafe: getToolRegistry().isFleetSafe(name),
+        fleetSafe,
     });
+    return fleetSafe;
 }
 async function assertPathInsideWorkspace(p) {
     const root = getWorkspaceRoot();
     if (!root) {
         throw new Error('PEER_WORKSPACE_NOT_CONFIGURED: set CODEBUDDY_PEER_TOOL_WORKSPACE_ROOT before exposing peer.tool.invoke');
     }
+    let rootResolved;
+    try {
+        rootResolved = await fs.realpath(root);
+    }
+    catch {
+        throw new Error(`INVALID_WORKSPACE_ROOT: ${root} does not exist or cannot be resolved`);
+    }
+    const rootStat = await fs.stat(rootResolved).catch(() => null);
+    if (!rootStat?.isDirectory()) {
+        throw new Error(`INVALID_WORKSPACE_ROOT: ${rootResolved} is not a directory`);
+    }
+    if (isFilesystemRoot(rootResolved)) {
+        throw new Error(`ROOT_FORBIDDEN: ${rootResolved} cannot be exposed as a peer tool workspace`);
+    }
     const absolute = path.isAbsolute(p) ? p : path.resolve(root, p);
-    const rootResolved = await fs.realpath(root).catch(() => root);
     const resolved = await realpathFollowingExistingAncestors(absolute);
     if (!isPathInsideOrEqual(resolved, rootResolved)) {
         throw new Error(`PATH_OUTSIDE_PEER_WORKSPACE: ${p} resolves to ${resolved}, outside ${rootResolved}`);
@@ -66,6 +81,10 @@ function normalizePathForContainment(p) {
     const resolved = path.resolve(p);
     return process.platform === 'win32' ? resolved.toLowerCase() : resolved;
 }
+function isFilesystemRoot(p) {
+    const normalized = normalizePathForContainment(p);
+    return normalized === normalizePathForContainment(path.parse(normalized).root);
+}
 function isPathInsideOrEqual(candidate, root) {
     const candidateForCheck = normalizePathForContainment(candidate);
     const rootForCheck = normalizePathForContainment(root);
@@ -229,7 +248,7 @@ async function execSearch({ args, emitChunk }) {
             '--max-count', '50',
             '--', query, resolved,
         ];
-        const proc = spawn(rgPath, rgArgs, { stdio: ['ignore', 'pipe', 'pipe'] });
+        const proc = spawn(getRipgrepPath(), rgArgs, { stdio: ['ignore', 'pipe', 'pipe'] });
         let stdout = '';
         let stderr = '';
         let truncated = false;
@@ -355,12 +374,21 @@ async function runInvocation(params, ctx, stream) {
         throw new Error('peer.tool.invoke.stream: this transport does not support streaming');
     }
     try {
-        assertToolAllowed(tool, ctx.scopes);
+        const fleetSafe = assertToolAllowed(tool, ctx.scopes);
         // Evaluate against Policy Engine
         const policyResult = PolicyEngine.getInstance().evaluate({
             capability: 'peer:invoke',
-            risk: 'medium',
-            detail: { tool, args: argsRaw, peerId: ctx.connectionId },
+            risk: 'low',
+            detail: {
+                tool,
+                args: argsRaw,
+                peerId: ctx.connectionId,
+                path: argsRaw.file_path ?? argsRaw.path,
+                fleetSafe,
+                readOnly: EXECUTORS[tool] !== undefined,
+                scopeAuthorized: true,
+                workspaceRestricted: getWorkspaceRoot() !== null,
+            },
         });
         if (policyResult.decision === 'deny') {
             throw new Error(`PEER_INVOKE_DENIED: ${policyResult.reason}`);
@@ -368,11 +396,11 @@ async function runInvocation(params, ctx, stream) {
         if (policyResult.decision === 'needs_approval') {
             const confirmResult = await ConfirmationService.getInstance().requestConfirmation({
                 operation: `peer.tool.invoke:${tool}`,
-                filename: argsRaw.file_path || argsRaw.path || '',
+                filename: String(argsRaw.file_path ?? argsRaw.path ?? ''),
                 content: `Peer ${ctx.connectionId} requests execution of tool ${tool} with arguments: ${JSON.stringify(argsRaw)}`,
             });
             if (!confirmResult.confirmed) {
-                throw new Error(`PEER_INVOKE_DENIED: Human approval was rejected or timed out`);
+                throw new Error('PEER_INVOKE_DENIED: Human approval was rejected or timed out');
             }
         }
         const exec = EXECUTORS[tool];
@@ -408,7 +436,7 @@ function logAudit(input) {
             metadata: { peerId: input.ctx.connectionId, tool: input.tool, ok: input.ok, error: input.error }
         });
     }
-    catch (err) {
+    catch (_err) {
         // ignore
     }
     auditLogger.log({