@pikaa-ai/pikaa 0.3.28 → 0.4.0

package/dist/cli.js

@@ -244,6 +244,7 @@ class DefaultModelClientSession {
       systemMessage.cache_control = { type: "ephemeral" };
     }
     const messages = [systemMessage];
+    const declaredToolCallIds = new Set;
     for (let i = 0;i < params.history.length; i++) {
       const item = params.history[i];
       if (item.type === "user_message") {
@@ -268,6 +269,9 @@ class DefaultModelClientSession {
           j++;
         }
         if (toolCalls.length > 0) {
+          for (const tc of toolCalls) {
+            declaredToolCallIds.add(tc.id);
+          }
           messages.push({
             role: "assistant",
             content: cleanedContent || null,
@@ -304,6 +308,9 @@ class DefaultModelClientSession {
           });
           j++;
         }
+        for (const tc of toolCalls) {
+          declaredToolCallIds.add(tc.id);
+        }
         messages.push({
           role: "assistant",
           content: null,
@@ -311,11 +318,13 @@ class DefaultModelClientSession {
         });
         i = j - 1;
       } else if (item.type === "function_call_output") {
-        messages.push({
-          role: "tool",
-          tool_call_id: item.callId,
-          content: item.output
-        });
+        if (declaredToolCallIds.has(item.callId)) {
+          messages.push({
+            role: "tool",
+            tool_call_id: item.callId,
+            content: item.output
+          });
+        }
       }
     }
     const toolsPayload = typeof params.tools?.toModelToolsSchema === "function" ? params.tools.toModelToolsSchema() : typeof params.tools?.toOpenAISpec === "function" ? params.tools.toOpenAISpec() : Array.isArray(params.tools) ? params.tools : [];
@@ -705,14 +714,39 @@ function compactHistory(history, retainedRecentItems = 6) {
   if (history.length <= retainedRecentItems) {
     return [...history];
   }
-  const itemsToCompact = history.slice(0, history.length - retainedRecentItems);
-  const recentItems = history.slice(history.length - retainedRecentItems);
+  const targetCutoff = history.length - retainedRecentItems;
+  let bestCutoff = -1;
+  for (let i = targetCutoff;i >= 0; i--) {
+    if (history[i]?.type === "user_message") {
+      bestCutoff = i;
+      break;
+    }
+  }
+  if (bestCutoff <= 0) {
+    for (let i = targetCutoff + 1;i < history.length; i++) {
+      if (history[i]?.type === "user_message") {
+        bestCutoff = i;
+        break;
+      }
+    }
+  }
+  let cutoffIndex = bestCutoff > 0 ? bestCutoff : targetCutoff;
+  while (cutoffIndex < history.length && history[cutoffIndex]?.type === "function_call_output") {
+    cutoffIndex++;
+  }
+  if (cutoffIndex <= 0 || cutoffIndex >= history.length) {
+    return [...history];
+  }
+  const itemsToCompact = history.slice(0, cutoffIndex);
+  const recentItems = history.slice(cutoffIndex);
   const summaryParts = ["### Summary of previous conversation context:"];
   for (const item of itemsToCompact) {
     if (item.type === "user_message") {
       summaryParts.push(`- User: ${item.content.slice(0, 200)}`);
     } else if (item.type === "function_call") {
       summaryParts.push(`- Executed tool: ${item.name}`);
+    } else if (item.type === "function_call_output") {
+      summaryParts.push(`  Tool output: ${item.output.slice(0, 100)}`);
     } else if (item.type === "agent_message") {
       summaryParts.push(`- Assistant: ${item.content.slice(0, 200)}`);
     }
@@ -1110,7 +1144,7 @@ class EphemeralWorkspaceManager {
 }
 var globalEphemeralWorkspace = new EphemeralWorkspaceManager;
 // src/verification/verifier.ts
-import { spawnSync } from "child_process";
+import { spawn, spawnSync } from "child_process";
 import { existsSync as existsSync7, readFileSync as readFileSync5 } from "fs";
 import { join as join6 } from "path";
 
@@ -1487,36 +1521,120 @@ class AutoVerifier {
     this.customCommand = options.customCommand;
     this.timeoutMs = options.timeoutMs ?? 30000;
   }
-  resolveVerificationCommand() {
-    if (this.customCommand && this.customCommand.trim()) {
-      return this.customCommand.trim();
+  findTargetedTests(modifiedFiles = []) {
+    const matchedTests = new Set;
+    for (const rawFile of modifiedFiles) {
+      const normalized = rawFile.replace(/\\/g, "/").replace(/^\.\//, "");
+      if (/\.(test|spec)\.[jt]sx?$/i.test(normalized) || /(^|\/)test_[^/]+\.py$/i.test(normalized) || /_test\.py$/i.test(normalized) || /_test\.go$/i.test(normalized)) {
+        if (existsSync7(join6(this.cwd, normalized))) {
+          matchedTests.add(normalized);
+        }
+        continue;
+      }
+      const extMatch = normalized.match(/\.[^.]+$/);
+      if (!extMatch)
+        continue;
+      const withoutExt = normalized.slice(0, -extMatch[0].length);
+      const parts = withoutExt.split("/");
+      const baseName = parts[parts.length - 1];
+      const subPath = normalized.startsWith("src/") ? normalized.slice(4, -extMatch[0].length) : normalized.startsWith("lib/") ? normalized.slice(4, -extMatch[0].length) : withoutExt;
+      const candidatePaths = [
+        `tests/${subPath}.test.ts`,
+        `tests/${subPath}.test.js`,
+        `tests/${subPath}.test.tsx`,
+        `tests/${subPath}.spec.ts`,
+        `tests/${subPath}.spec.js`,
+        `tests/${baseName}.test.ts`,
+        `tests/${baseName}.test.js`,
+        `tests/${baseName}.spec.ts`,
+        `test/${subPath}.test.ts`,
+        `test/${subPath}.test.js`,
+        `test/${baseName}.test.ts`,
+        `test/${baseName}.test.js`,
+        `src/${subPath}.test.ts`,
+        `src/${subPath}.spec.ts`,
+        `${withoutExt}.test.ts`,
+        `${withoutExt}.spec.ts`,
+        `tests/test_${baseName}.py`,
+        `test_${baseName}.py`,
+        `tests/${baseName}_test.go`
+      ];
+      for (const candidate of candidatePaths) {
+        if (existsSync7(join6(this.cwd, candidate))) {
+          matchedTests.add(candidate);
+        }
+      }
+    }
+    return Array.from(matchedTests);
+  }
+  resolveTargetedTestCommand(testFiles) {
+    if (testFiles.length === 0)
+      return null;
+    const quotedFiles = testFiles.map((f) => f.includes(" ") ? `"${f}"` : f).join(" ");
+    if (existsSync7(join6(this.cwd, "bun.lockb")) || existsSync7(join6(this.cwd, "bun.lock"))) {
+      return `bun test ${quotedFiles}`;
+    }
+    const pkgPath = join6(this.cwd, "package.json");
+    if (existsSync7(pkgPath)) {
+      try {
+        const pkg = JSON.parse(readFileSync5(pkgPath, "utf8"));
+        const allDeps = { ...pkg.dependencies || {}, ...pkg.devDependencies || {} };
+        if (allDeps.vitest) {
+          return `npx vitest run ${quotedFiles}`;
+        }
+        if (allDeps.jest) {
+          return `npx jest ${quotedFiles}`;
+        }
+        const pm = existsSync7(join6(this.cwd, "pnpm-lock.yaml")) ? "pnpm" : existsSync7(join6(this.cwd, "yarn.lock")) ? "yarn" : "npm";
+        if (pkg.scripts?.test) {
+          if (pkg.scripts.test.includes("bun test")) {
+            return `bun test ${quotedFiles}`;
+          }
+          return `${pm} test -- ${quotedFiles}`;
+        }
+      } catch (err) {
+        console.warn(`[AutoVerifier] Failed to parse package.json for test runner:`, err);
+      }
+    }
+    if (existsSync7(join6(this.cwd, "pyproject.toml")) || existsSync7(join6(this.cwd, "requirements.txt"))) {
+      if (existsSync7(join6(this.cwd, "uv.lock"))) {
+        return `uv run pytest ${quotedFiles}`;
+      }
+      return `pytest ${quotedFiles}`;
     }
+    if (existsSync7(join6(this.cwd, "go.mod"))) {
+      return `go test ${quotedFiles}`;
+    }
+    if (existsSync7(join6(this.cwd, "Cargo.toml"))) {
+      return `cargo test ${quotedFiles}`;
+    }
+    return null;
+  }
+  resolveStaticCommand() {
     try {
       const analyzer = new ProjectAnalyzer(this.cwd);
       const analysis = analyzer.analyze();
       if (analysis.commands.typecheck) {
         return analysis.commands.typecheck;
       }
-      if (analysis.commands.lint) {
-        return analysis.commands.lint;
-      }
-      if (analysis.commands.test) {
-        return analysis.commands.test;
-      }
-    } catch {}
+    } catch (err) {
+      console.warn(`[AutoVerifier] ProjectAnalyzer analysis error:`, err);
+    }
     const pkgPath = join6(this.cwd, "package.json");
     if (existsSync7(pkgPath)) {
       try {
         const pkg = JSON.parse(readFileSync5(pkgPath, "utf8"));
         if (pkg.scripts) {
+          const pm = existsSync7(join6(this.cwd, "bun.lockb")) || existsSync7(join6(this.cwd, "bun.lock")) ? "bun" : existsSync7(join6(this.cwd, "pnpm-lock.yaml")) ? "pnpm" : existsSync7(join6(this.cwd, "yarn.lock")) ? "yarn" : "npm";
+          const runCmd = pm === "bun" || pm === "pnpm" || pm === "yarn" ? `${pm} run` : "npm run";
           if (pkg.scripts.typecheck)
-            return "npm run typecheck";
+            return `${runCmd} typecheck`;
           if (pkg.scripts.check)
-            return "npm run check";
-          if (pkg.scripts.test)
-            return "npm test";
+            return `${runCmd} check`;
         }
-      } catch {}
+      } catch (err) {
+        console.warn(`[AutoVerifier] Failed to parse package.json for static check:`, err);
+      }
     }
     if (existsSync7(join6(this.cwd, "tsconfig.json"))) {
       return "npx tsc --noEmit";
@@ -1527,17 +1645,76 @@ class AutoVerifier {
     if (existsSync7(join6(this.cwd, "go.mod"))) {
       return "go vet ./...";
     }
-    if (existsSync7(join6(this.cwd, "pyproject.toml")) || existsSync7(join6(this.cwd, "setup.py"))) {
-      if (existsSync7(join6(this.cwd, "mypy.ini")) || existsSync7(join6(this.cwd, ".mypy.ini"))) {
-        return "mypy .";
-      }
+    if (existsSync7(join6(this.cwd, "mypy.ini")) || existsSync7(join6(this.cwd, ".mypy.ini"))) {
+      return "mypy .";
     }
     return null;
   }
-  verify(modifiedFiles = []) {
-    const command = this.resolveVerificationCommand();
+  resolveVerificationCommand(modifiedFiles = []) {
+    if (this.customCommand && this.customCommand.trim()) {
+      return this.customCommand.trim();
+    }
+    const targetedTests = this.findTargetedTests(modifiedFiles);
+    const targetedTestCmd = this.resolveTargetedTestCommand(targetedTests);
+    const staticCmd = this.resolveStaticCommand();
+    if (targetedTestCmd && staticCmd) {
+      return `${staticCmd} && ${targetedTestCmd}`;
+    }
+    if (targetedTestCmd) {
+      return targetedTestCmd;
+    }
+    if (staticCmd) {
+      return staticCmd;
+    }
+    try {
+      const analyzer = new ProjectAnalyzer(this.cwd);
+      const analysis = analyzer.analyze();
+      if (analysis.commands.test)
+        return analysis.commands.test;
+      if (analysis.commands.lint)
+        return analysis.commands.lint;
+    } catch {}
+    const pkgPath = join6(this.cwd, "package.json");
+    if (existsSync7(pkgPath)) {
+      try {
+        const pkg = JSON.parse(readFileSync5(pkgPath, "utf8"));
+        if (pkg.scripts?.test) {
+          const pm = existsSync7(join6(this.cwd, "bun.lockb")) || existsSync7(join6(this.cwd, "bun.lock")) ? "bun" : "npm";
+          return pm === "bun" ? "bun test" : "npm test";
+        }
+        if (pkg.scripts?.lint) {
+          return "npm run lint";
+        }
+      } catch {}
+    }
+    return null;
+  }
+  resolveVerificationStages(modifiedFiles = []) {
+    if (this.customCommand && this.customCommand.trim()) {
+      return [this.customCommand.trim()];
+    }
+    const stages = [];
+    const staticCmd = this.resolveStaticCommand();
+    const targetedTests = this.findTargetedTests(modifiedFiles);
+    const targetedTestCmd = this.resolveTargetedTestCommand(targetedTests);
+    if (staticCmd) {
+      stages.push(staticCmd);
+    }
+    if (targetedTestCmd) {
+      stages.push(targetedTestCmd);
+    }
+    if (stages.length === 0) {
+      const fallback = this.resolveVerificationCommand(modifiedFiles);
+      if (fallback) {
+        stages.push(fallback);
+      }
+    }
+    return stages;
+  }
+  async verify(modifiedFiles = [], signal) {
+    const stages = this.resolveVerificationStages(modifiedFiles);
     const startTime = performance.now();
-    if (!command) {
+    if (stages.length === 0) {
       return {
         command: "none",
         success: true,
@@ -1547,59 +1724,158 @@ class AutoVerifier {
         reason: "NO_VERIFIER_DETECTED"
       };
     }
-    try {
-      const isWindows = process.platform === "win32";
-      const proc = spawnSync(command, {
-        cwd: this.cwd,
-        shell: true,
-        encoding: "utf8",
-        timeout: this.timeoutMs,
-        maxBuffer: 10 * 1024 * 1024,
-        env: {
-          ...process.env,
-          CI: "true",
-          FORCE_COLOR: "0"
+    const combinedOutputs = [];
+    let executedCommands = [];
+    for (const cmd of stages) {
+      if (signal?.aborted) {
+        return {
+          command: cmd,
+          success: false,
+          exitCode: 1,
+          output: "Verification was aborted.",
+          durationMs: Math.round(performance.now() - startTime),
+          reason: "ABORTED"
+        };
+      }
+      executedCommands.push(cmd);
+      const stageResult = await this.executeCommandAsync(cmd, signal);
+      combinedOutputs.push(`[${cmd}]
+${stageResult.output}`);
+      if (!stageResult.success) {
+        return {
+          command: cmd,
+          success: false,
+          exitCode: stageResult.exitCode,
+          output: this.truncateOutput(combinedOutputs.join(`
+
+`)),
+          durationMs: Math.round(performance.now() - startTime)
+        };
+      }
+    }
+    return {
+      command: executedCommands.join(" && "),
+      success: true,
+      exitCode: 0,
+      output: this.truncateOutput(combinedOutputs.join(`
+
+`)),
+      durationMs: Math.round(performance.now() - startTime)
+    };
+  }
+  executeCommandAsync(command, signal) {
+    return new Promise((resolve) => {
+      let proc = null;
+      let stdoutData = "";
+      let stderrData = "";
+      let isSettled = false;
+      const finish = (success, exitCode, output) => {
+        if (isSettled)
+          return;
+        isSettled = true;
+        cleanup();
+        resolve({ success, exitCode, output: output.trim() });
+      };
+      const killProcessTree = () => {
+        if (!proc || !proc.pid)
+          return;
+        try {
+          if (process.platform === "win32") {
+            spawnSync("taskkill", ["/pid", String(proc.pid), "/T", "/F"], { stdio: "ignore" });
+          } else {
+            proc.kill("SIGTERM");
+            setTimeout(() => {
+              try {
+                proc?.kill("SIGKILL");
+              } catch {}
+            }, 500);
+          }
+        } catch {}
+      };
+      const onAbort = () => {
+        killProcessTree();
+        finish(false, 1, "Verification command aborted by user or session signal.");
+      };
+      if (signal?.aborted) {
+        return finish(false, 1, "Verification aborted before launch.");
+      }
+      if (signal) {
+        signal.addEventListener("abort", onAbort, { once: true });
+      }
+      const timer = setTimeout(() => {
+        killProcessTree();
+        const partial = (stdoutData + `
+` + stderrData).trim();
+        const timeoutMsg = `[Verification Timeout Error]: Verification command '${command}' exceeded timeout limit of ${this.timeoutMs}ms and was terminated.`;
+        finish(false, 1, partial ? `${partial}
+
+${timeoutMsg}` : timeoutMsg);
+      }, this.timeoutMs);
+      const cleanup = () => {
+        clearTimeout(timer);
+        if (signal) {
+          signal.removeEventListener("abort", onAbort);
         }
-      });
-      const durationMs = Math.round(performance.now() - startTime);
-      const stdout = proc.stdout ? String(proc.stdout) : "";
-      const stderr = proc.stderr ? String(proc.stderr) : "";
-      let combined = (stdout + `
-` + stderr).trim();
-      if (combined.length > 3000) {
-        const lines = combined.split(`
+      };
+      try {
+        proc = spawn(command, {
+          cwd: this.cwd,
+          shell: true,
+          env: {
+            ...process.env,
+            CI: "true",
+            FORCE_COLOR: "0"
+          }
+        });
+        proc.stdout?.on("data", (chunk) => {
+          stdoutData += chunk.toString();
+        });
+        proc.stderr?.on("data", (chunk) => {
+          stderrData += chunk.toString();
+        });
+        proc.on("error", (err) => {
+          const partial = (stdoutData + `
+` + stderrData).trim();
+          const spawnMsg = `[Verification Process Spawn Error]: Failed to spawn command '${command}': ${err.message}`;
+          finish(false, 1, partial ? `${partial}
+
+${spawnMsg}` : spawnMsg);
+        });
+        proc.on("close", (code) => {
+          const exitCode = code ?? 0;
+          const combined = (stdoutData + `
+` + stderrData).trim();
+          if (exitCode === 0) {
+            finish(true, 0, combined || "Verification passed cleanly.");
+          } else {
+            const errorFallback = `[Verification Failure]: Command '${command}' exited with code ${exitCode} and produced no output.`;
+            finish(false, exitCode, combined ? `${combined}
+
+[Process exited with non-zero code ${exitCode}]` : errorFallback);
+          }
+        });
+      } catch (err) {
+        finish(false, 1, `[Verification Execution Exception]: ${err.message || String(err)}`);
+      }
+    });
+  }
+  truncateOutput(output) {
+    if (output.length > 4000) {
+      const lines = output.split(`
 `);
-        if (lines.length > 60) {
-          const head = lines.slice(0, 30).join(`
+      if (lines.length > 70) {
+        const head = lines.slice(0, 35).join(`
 `);
-          const tail = lines.slice(-25).join(`
+        const tail = lines.slice(-30).join(`
 `);
-          combined = `${head}
+        return `${head}
 
-... [${lines.length - 55} lines truncated for context efficiency] ...
+... [${lines.length - 65} lines truncated for context efficiency] ...
 
 ${tail}`;
-        }
       }
-      const exitCode = proc.status ?? (proc.error ? 1 : 0);
-      const success = exitCode === 0;
-      return {
-        command,
-        success,
-        exitCode,
-        output: combined || (success ? "Verification succeeded cleanly." : "Command failed with empty output."),
-        durationMs
-      };
-    } catch (err) {
-      const durationMs = Math.round(performance.now() - startTime);
-      return {
-        command,
-        success: false,
-        exitCode: 1,
-        output: `Verification execution error: ${err.message || String(err)}`,
-        durationMs
-      };
     }
+    return output;
   }
 }
 // src/session/turn.ts
@@ -1723,6 +1999,7 @@ async function runTurn(session, turnContext, input) {
         });
       }
       if (toolCallRequests.length > 0) {
+        const validCalls = [];
         for (const toolCall of toolCallRequests) {
           if (!toolCall.name || !toolCall.name.trim())
             continue;
@@ -1746,6 +2023,14 @@ async function runTurn(session, turnContext, input) {
             toolName: toolCall.name,
             arguments: toolCall.arguments
           });
+          validCalls.push({
+            callId: toolCall.callId,
+            name: toolCall.name,
+            arguments: toolCall.arguments,
+            functionCallItem
+          });
+        }
+        for (const toolCall of validCalls) {
           const toolResult = await turnContext.tools.execute(toolCall.name, toolCall.arguments, {
             cwd: turnContext.environment.cwd,
             turnId,
@@ -1753,6 +2038,12 @@ async function runTurn(session, turnContext, input) {
             execPolicy: session.execPolicy,
             mode: session.collaborationMode,
             permissionMode: session.permissionMode,
+            onFileModified: (p) => {
+              if (p) {
+                modifiedFiles.add(p);
+                hasRunVerification = false;
+              }
+            },
             onPlanUpdate: (plan, explanation) => {
               session.emitEvent({
                 type: "PlanUpdated",
@@ -1768,7 +2059,8 @@ async function runTurn(session, turnContext, input) {
                 turnId,
                 toolName: toolCall.name,
                 description,
-                command
+                command,
+                prefixRule
               });
             },
             requestInput: async (question, options) => {
@@ -1819,7 +2111,7 @@ async function runTurn(session, turnContext, input) {
           cwd,
           customCommand: session.autoVerificationCommand
         });
-        const command = verifier.resolveVerificationCommand();
+        const command = verifier.resolveVerificationCommand(Array.from(modifiedFiles));
         if (command) {
           session.emitEvent({
             type: "VerificationStarted",
@@ -1827,7 +2119,7 @@ async function runTurn(session, turnContext, input) {
             command,
             modifiedFiles: Array.from(modifiedFiles)
           });
-          const vResult = verifier.verify(Array.from(modifiedFiles));
+          const vResult = await verifier.verify(Array.from(modifiedFiles), signal);
           session.emitEvent({
             type: "VerificationCompleted",
             turnId,
@@ -1990,8 +2282,133 @@ async function submissionLoop(session, queue) {
   }
 }
 
+// src/security/shell-parser.ts
+function parseShellCommand(commandLine) {
+  const commands = [];
+  const subshellCommands = [];
+  let hasPipes = false;
+  let currentSegment = "";
+  let inSingleQuote = false;
+  let inDoubleQuote = false;
+  let isEscaped = false;
+  const len = commandLine.length;
+  for (let i = 0;i < len; i++) {
+    const char = commandLine[i];
+    if (isEscaped) {
+      currentSegment += char;
+      isEscaped = false;
+      continue;
+    }
+    if (char === "\\") {
+      isEscaped = true;
+      currentSegment += char;
+      continue;
+    }
+    if (char === "'" && !inDoubleQuote) {
+      inSingleQuote = !inSingleQuote;
+      currentSegment += char;
+      continue;
+    }
+    if (char === '"' && !inSingleQuote) {
+      inDoubleQuote = !inDoubleQuote;
+      currentSegment += char;
+      continue;
+    }
+    if (inSingleQuote) {
+      currentSegment += char;
+      continue;
+    }
+    if (char === "`") {
+      let endIdx = -1;
+      for (let j = i + 1;j < len; j++) {
+        if (commandLine[j] === "\\" && j + 1 < len) {
+          j++;
+          continue;
+        }
+        if (commandLine[j] === "`") {
+          endIdx = j;
+          break;
+        }
+      }
+      if (endIdx !== -1) {
+        const innerCmd = commandLine.slice(i + 1, endIdx);
+        if (innerCmd.trim()) {
+          subshellCommands.push(innerCmd.trim());
+        }
+        currentSegment += commandLine.slice(i, endIdx + 1);
+        i = endIdx;
+        continue;
+      }
+    }
+    if (char === "$" && i + 1 < len && commandLine[i + 1] === "(") {
+      let depth = 1;
+      let endIdx = -1;
+      for (let j = i + 2;j < len; j++) {
+        if (commandLine[j] === "\\" && j + 1 < len) {
+          j++;
+          continue;
+        }
+        if (commandLine[j] === "(")
+          depth++;
+        else if (commandLine[j] === ")") {
+          depth--;
+          if (depth === 0) {
+            endIdx = j;
+            break;
+          }
+        }
+      }
+      if (endIdx !== -1) {
+        const innerCmd = commandLine.slice(i + 2, endIdx);
+        if (innerCmd.trim()) {
+          subshellCommands.push(innerCmd.trim());
+        }
+        currentSegment += commandLine.slice(i, endIdx + 1);
+        i = endIdx;
+        continue;
+      }
+    }
+    if (!inDoubleQuote) {
+      if (char === "&" && commandLine[i + 1] === "&" || char === "|" && commandLine[i + 1] === "|") {
+        if (currentSegment.trim()) {
+          commands.push(currentSegment.trim());
+        }
+        currentSegment = "";
+        i++;
+        continue;
+      }
+      if (char === "|") {
+        hasPipes = true;
+        if (currentSegment.trim()) {
+          commands.push(currentSegment.trim());
+        }
+        currentSegment = "";
+        continue;
+      }
+      if (char === ";" || char === `
+` || char === "&") {
+        if (currentSegment.trim()) {
+          commands.push(currentSegment.trim());
+        }
+        currentSegment = "";
+        continue;
+      }
+    }
+    currentSegment += char;
+  }
+  if (currentSegment.trim()) {
+    commands.push(currentSegment.trim());
+  }
+  return {
+    commands: commands.filter(Boolean),
+    subshellCommands: subshellCommands.filter(Boolean),
+    hasPipes
+  };
+}
+
 // src/security/exec-policy.ts
 class ExecPolicy {
+  denyRules = [];
   rules = [];
   mode = "auto";
   constructor(initialMode = "auto") {
@@ -2005,12 +2422,24 @@ class ExecPolicy {
     this.mode = mode;
   }
   initDefaultRules() {
-    this.addRule(/^(git\s+(status|log|diff|branch|show|rev-parse))/i, "allow", "Safe git query");
-    this.addRule(/^(ls|dir|cat|type|grep|rg|find|pwd|echo|head|tail|wc|which|where)\b/i, "allow", "Safe read-only shell command");
-    this.addRule(/^(bun\s+(test|--version|-v)|npm\s+(test|--version|-v)|node\s+-v)\b/i, "allow", "Testing & runtime check");
-    this.addRule(/^(rm|del|rmdir|format|mkfs)\b/i, "prompt", "Destructive file removal");
-    this.addRule(/^(git\s+(push|reset\s+--hard|clean\s+-fd|rebase))\b/i, "prompt", "Destructive git operation");
-    this.addRule(/^(curl|wget|fetch|ssh|scp|ftp)\b/i, "prompt", "Network / remote transfer");
+    this.addDenyRule(/(?:^|[/\\])(mkfs|format|fdisk|parted)\b/i, "Destructive filesystem formatting operation");
+    this.addDenyRule(/^dd\s+.*(of=\/dev\/|\/dev\/sd|\/dev\/nvme)/i, "Raw block device write attempt");
+    this.addDenyRule(/(?:^|[/\\])(reboot|shutdown|poweroff|init\s+0)\b/i, "System power manipulation");
+    this.addRule(/^(sudo|su|doas|runas)\b/i, "prompt", "Privilege escalation attempt");
+    this.addRule(/^(rm|del|rmdir|shred|unlink)\b/i, "prompt", "Destructive file removal");
+    this.addRule(/^(chmod|chown|kill|pkill|killall|systemctl|service|crontab)\b/i, "prompt", "System administration & process control");
+    this.addRule(/^(git\s+(push|reset\s+--hard|clean\s+-fd|rebase|branch\s+-D|checkout\s+-f))\b/i, "prompt", "Destructive git operation");
+    this.addRule(/^(curl|wget|fetch|ssh|scp|sftp|ftp|rsync|nc|ncat|netcat|socat|telnet)\b/i, "prompt", "Network & remote transfer");
+    this.addRule(/^(bash|sh|zsh|dash|ksh|cmd(\.exe)?|powershell(\.exe)?|pwsh)\s+(-c|-command|\/c)\b/i, "prompt", "Arbitrary subshell command execution");
+    this.addRule(/^(python|python3|node|bun|perl|ruby)\s+(-c|-e)\b/i, "prompt", "Inline arbitrary code evaluation");
+    this.addRule(/^(eval|exec)\b/i, "prompt", "Dynamic code execution");
+    this.addRule(/^(npm\s+publish|bun\s+publish|cargo\s+publish)\b/i, "prompt", "Package registry publication");
+    this.addRule(/^(git\s+(status|log|diff|branch|show|rev-parse|tag|remote|describe))\b/i, "allow", "Safe git query");
+    this.addRule(/^(ls|dir|cat|type|grep|rg|find|pwd|echo|head|tail|wc|which|where|stat|file|du|df)\b/i, "allow", "Safe read-only shell command");
+    this.addRule(/^(bun\s+(test|run|--version|-v)|npm\s+(test|run|--version|-v)|npx\s+(tsc|eslint|oxlint)|tsc|cargo\s+(check|test|build)|go\s+(test|vet|build)|pytest|python\s+-m\s+unittest|node\s+(-v|--version|--test))\b/i, "allow", "Testing, typechecking & build verification");
+  }
+  addDenyRule(pattern, description) {
+    this.denyRules.push({ pattern, decision: "deny", description });
   }
   addRule(pattern, decision, description) {
     this.rules.unshift({ pattern, decision, description });
@@ -2033,8 +2462,49 @@ class ExecPolicy {
   }
   evaluate(command) {
     const trimmed = command.trim();
+    if (!trimmed) {
+      return { decision: "allow" };
+    }
+    const parsed = parseShellCommand(trimmed);
+    const subCommands = [...parsed.commands, ...parsed.subshellCommands].map((c) => c.trim()).filter(Boolean);
+    if (subCommands.length > 1 || parsed.subshellCommands.length > 0) {
+      for (const subCmd of subCommands) {
+        const subResult = this.evaluateSingle(subCmd);
+        if (subResult.decision === "deny") {
+          return {
+            decision: "deny",
+            reason: `Chained command contains denied operation: '${subCmd}' (${subResult.reason || "Forbidden"})`
+          };
+        }
+        if (subResult.decision === "prompt") {
+          return {
+            decision: "prompt",
+            reason: `Chained command contains operation requiring confirmation: '${subCmd}' (${subResult.reason || "Requires approval"})`
+          };
+        }
+      }
+      if (parsed.hasPipes && /\|\s*(ba|z|k|c)?sh\b/i.test(trimmed)) {
+        return {
+          decision: "prompt",
+          reason: "Pipeline executes piped input directly into shell interpreter (| sh)"
+        };
+      }
+      return { decision: "allow", reason: "All chained sub-commands are permitted" };
+    }
+    return this.evaluateSingle(trimmed);
+  }
+  evaluateSingle(command) {
+    const trimmed = command.trim();
+    for (const rule of this.denyRules) {
+      if (rule.pattern.test(trimmed)) {
+        return {
+          decision: "deny",
+          reason: rule.description
+        };
+      }
+    }
     if (this.mode === "plan") {
-      const isReadOnly = /^(git\s+(status|log|diff|branch|show|rev-parse)|ls|dir|cat|type|grep|rg|find|pwd|which|where)\b/i.test(trimmed);
+      const isReadOnly = /^(git\s+(status|log|diff|branch|show|rev-parse|tag|remote)|ls|dir|cat|type|grep|rg|find|pwd|which|where)\b/i.test(trimmed);
       if (isReadOnly) {
         return { decision: "allow", reason: "Read-only inspection allowed in Plan mode" };
       }
@@ -2050,7 +2520,7 @@ class ExecPolicy {
       };
     }
     if (this.mode === "accept-edits") {
-      const isReadOnly = /^(git\s+(status|log|diff|branch|show)|ls|dir|cat|type|grep|rg|find|pwd|bun\s+test|npm\s+test)\b/i.test(trimmed);
+      const isReadOnly = /^(git\s+(status|log|diff|branch|show|rev-parse)|ls|dir|cat|type|grep|rg|find|pwd|bun\s+test|npm\s+test)\b/i.test(trimmed);
       if (isReadOnly) {
         return { decision: "allow", reason: "Safe read-only command in accept-edits mode" };
       }
@@ -2067,11 +2537,21 @@ class ExecPolicy {
         };
       }
     }
+    if (this.isRecognizedSafeDevCommand(trimmed)) {
+      return {
+        decision: "allow",
+        reason: "Safe development workspace command"
+      };
+    }
+    const firstWord = trimmed.split(/\s+/)[0] || trimmed;
     return {
-      decision: "allow",
-      reason: "Auto mode allows execution"
+      decision: "prompt",
+      reason: `Command '${firstWord}' is unclassified and requires confirmation in auto mode`
     };
   }
+  isRecognizedSafeDevCommand(command) {
+    return /^(git\s+(checkout|add|commit|stash|merge|pull|init)|bun\s+(install|add|remove)|npm\s+(install|i|add|remove)|yarn\s+(add|remove)|pnpm\s+(add|remove|install)|mkdir|touch|cp|copy|mv|move|clear|cls|echo|printf|node|bun|python|python3|cargo|go)\b/i.test(command);
+  }
 }
 
 // src/session/session.ts
@@ -2204,7 +2684,8 @@ class Session {
       turnId: params.turnId,
       toolName: params.toolName,
       description: params.description,
-      command: params.command
+      command: params.command,
+      prefixRule: params.prefixRule
     });
     this.emitEvent({
       type: "StatusChanged",
@@ -2382,6 +2863,7 @@ var applyPatchTool = {
       try {
         mkdirSync4(dirname3(filePath), { recursive: true });
         writeFileSync2(filePath, replacementContent, "utf8");
+        ctx.onFileModified?.(rawPath);
         return { output: `Successfully created new file '${rawPath}'` };
       } catch (err) {
         return {
@@ -2402,7 +2884,31 @@ var applyPatchTool = {
           isError: true
         };
       }
-      const firstIndex = originalFileContent.indexOf(targetContent);
+      let targetToFind = targetContent;
+      let replacementToUse = replacementContent;
+      const fileHasCrlf = originalFileContent.includes(`\r
+`);
+      let firstIndex = originalFileContent.indexOf(targetToFind);
+      if (firstIndex === -1 && fileHasCrlf) {
+        const crlfTarget = targetContent.replace(/\r?\n/g, `\r
+`);
+        firstIndex = originalFileContent.indexOf(crlfTarget);
+        if (firstIndex !== -1) {
+          targetToFind = crlfTarget;
+          replacementToUse = replacementContent.replace(/\r?\n/g, `\r
+`);
+        }
+      } else if (firstIndex === -1 && !fileHasCrlf && targetContent.includes(`\r
+`)) {
+        const lfTarget = targetContent.replace(/\r\n/g, `
+`);
+        firstIndex = originalFileContent.indexOf(lfTarget);
+        if (firstIndex !== -1) {
+          targetToFind = lfTarget;
+          replacementToUse = replacementContent.replace(/\r\n/g, `
+`);
+        }
+      }
       if (firstIndex === -1) {
         return {
           output: `Error: targetContent was not found in '${rawPath}'.
@@ -2413,7 +2919,7 @@ var applyPatchTool = {
           isError: true
         };
       }
-      const secondIndex = originalFileContent.indexOf(targetContent, firstIndex + 1);
+      const secondIndex = originalFileContent.indexOf(targetToFind, firstIndex + 1);
       if (secondIndex !== -1) {
         return {
           output: `Error: targetContent matched multiple locations in '${rawPath}'.
@@ -2424,8 +2930,9 @@ var applyPatchTool = {
           isError: true
         };
       }
-      const newFileContent = originalFileContent.slice(0, firstIndex) + replacementContent + originalFileContent.slice(firstIndex + targetContent.length);
+      const newFileContent = originalFileContent.slice(0, firstIndex) + replacementToUse + originalFileContent.slice(firstIndex + targetToFind.length);
       writeFileSync2(filePath, newFileContent, "utf8");
+      ctx.onFileModified?.(rawPath);
       return {
         output: `Successfully applied patch to '${rawPath}'`
       };
@@ -2537,8 +3044,12 @@ class LinuxSandbox {
     }
     this.hasBwrap = existsSync9("/usr/bin/bwrap") || existsSync9("/bin/bwrap") || existsSync9("/usr/local/bin/bwrap");
   }
-  wrapCommand(cmd, profile) {
-    if (!this.hasBwrap || profile.kind === "danger-unrestricted") {
+  wrapCommand(cmd, profile, onWarning) {
+    if (profile.kind === "danger-unrestricted") {
+      return cmd;
+    }
+    if (!this.hasBwrap) {
+      onWarning?.("Linux kernel sandbox (Bubblewrap / bwrap) is not available. Command will execute without OS-level namespace isolation.");
       return cmd;
     }
     const bwrapArgs = [
@@ -2554,6 +3065,23 @@ class LinuxSandbox {
       "--tmpfs",
       "/tmp"
     ];
+    const homeDir = process.env.HOME || "/root";
+    const sensitivePaths = [
+      `${homeDir}/.ssh`,
+      `${homeDir}/.aws`,
+      `${homeDir}/.gnupg`,
+      `${homeDir}/.azure`,
+      `${homeDir}/.kube`,
+      `${homeDir}/.docker`,
+      `${homeDir}/.netrc`,
+      "/etc/shadow",
+      "/etc/sudoers"
+    ];
+    for (const sensitive of sensitivePaths) {
+      if (existsSync9(sensitive)) {
+        bwrapArgs.push("--tmpfs", sensitive);
+      }
+    }
     for (const writableRoot of profile.writableRoots) {
       bwrapArgs.push("--bind", writableRoot, writableRoot);
     }
@@ -2603,11 +3131,21 @@ class MacOSSandbox {
     } else {
       rules.push("(deny network*)");
     }
+    const home = process.env.HOME || "/Users/Shared";
+    rules.push(`(deny file-read* (subpath "${home}/.ssh"))`);
+    rules.push(`(deny file-read* (subpath "${home}/.aws"))`);
+    rules.push(`(deny file-read* (subpath "${home}/.gnupg"))`);
+    rules.push(`(deny file-read* (subpath "${home}/.kube"))`);
+    rules.push(`(deny file-read* (subpath "${home}/.docker"))`);
     return rules.join(`
 `);
   }
-  wrapCommand(cmd, profile) {
-    if (!this.hasSandboxExec || profile.kind === "danger-unrestricted") {
+  wrapCommand(cmd, profile, onWarning) {
+    if (profile.kind === "danger-unrestricted") {
+      return cmd;
+    }
+    if (!this.hasSandboxExec) {
+      onWarning?.("macOS Seatbelt (sandbox-exec) is not available. Command will execute without OS-level namespace isolation.");
       return cmd;
     }
     const policy = this.generateProfile(profile);
@@ -2640,7 +3178,7 @@ class KernelSandboxManager {
       isSandboxingActive: this.windowsSandbox.isSupported() || this.linuxSandbox.isSupported() || this.macOsSandbox.isSupported()
     };
   }
-  buildDefaultProfile(cwd, allowNetwork = true) {
+  buildDefaultProfile(cwd, allowNetwork = false) {
     const normCwd = normalize(resolve6(cwd));
     return {
       kind: "workspace-write",
@@ -2655,11 +3193,15 @@ class KernelSandboxManager {
       }
     };
   }
-  wrapCommand(cmd, profile) {
+  wrapCommand(cmd, profile, onWarning) {
     if (process.platform === "linux") {
-      return this.linuxSandbox.wrapCommand(cmd, profile);
+      return this.linuxSandbox.wrapCommand(cmd, profile, onWarning);
     } else if (process.platform === "darwin") {
-      return this.macOsSandbox.wrapCommand(cmd, profile);
+      return this.macOsSandbox.wrapCommand(cmd, profile, onWarning);
+    } else if (process.platform === "win32") {
+      if (!this.windowsSandbox.isSupported() && profile.kind !== "danger-unrestricted") {
+        onWarning?.("Windows JobObject isolation is not available in this environment. Command will execute without OS-level process limits.");
+      }
     }
     return cmd;
   }
@@ -2791,6 +3333,12 @@ class PrefixRulesStore {
   matchesPrefix(cmdTokens, prefixTokens) {
     if (prefixTokens.length > cmdTokens.length)
       return false;
+    const SHELL_OPERATORS = new Set([";", "&&", "||", "|", "&", ";;", "&|"]);
+    for (const token of cmdTokens) {
+      if (SHELL_OPERATORS.has(token) || token.includes(";") || token.includes("&&") || token.includes("||")) {
+        return false;
+      }
+    }
     for (let i = 0;i < prefixTokens.length; i++) {
       const cmd = cmdTokens[i];
       const prefix = prefixTokens[i];
@@ -2846,11 +3394,29 @@ function createShellTool(policy = new ExecPolicy) {
       }
       const args = rawArgs;
       const rulesStore = ctx.prefixRulesStore || globalPrefixRulesStore;
-      const cmdTokens = command.split(/\s+/).filter(Boolean);
+      const activePolicy = ctx.execPolicy || policy;
+      const policyDecision = activePolicy.evaluate(command);
+      if (policyDecision.decision === "deny") {
+        return {
+          output: `Error: Command execution denied by policy: ${policyDecision.reason}`,
+          isError: true
+        };
+      }
+      const parsed = parseShellCommand(command);
+      const isCompound = parsed.commands.length > 1 || parsed.subshellCommands.length > 0 || parsed.hasPipes;
       let isEscalated = false;
-      if (rulesStore.isApproved(ctx.cwd, cmdTokens)) {
-        isEscalated = true;
-      } else if (args.sandbox_permissions === "require_escalated") {
+      if (!isCompound) {
+        const cmdTokens = command.split(/\s+/).filter(Boolean);
+        if (rulesStore.isApproved(ctx.cwd, cmdTokens)) {
+          isEscalated = true;
+        }
+      } else {
+        const allSubCommands = [...parsed.commands, ...parsed.subshellCommands];
+        if (allSubCommands.length > 0 && allSubCommands.every((sub) => rulesStore.isApproved(ctx.cwd, sub.split(/\s+/).filter(Boolean)))) {
+          isEscalated = true;
+        }
+      }
+      if (!isEscalated && args.sandbox_permissions === "require_escalated") {
         if (ctx.requestApproval) {
           const promptDesc = args.justification || "Executing command with escalated permissions";
           const approvalResult = await ctx.requestApproval(promptDesc, command, args.prefix_rule);
@@ -2868,16 +3434,8 @@ function createShellTool(policy = new ExecPolicy) {
           isEscalated = true;
         }
       }
-      if (!isEscalated) {
-        const activePolicy = ctx.execPolicy || policy;
-        const policyDecision = activePolicy.evaluate(command);
-        if (policyDecision.decision === "deny") {
-          return {
-            output: `Error: Command execution denied by policy: ${policyDecision.reason}`,
-            isError: true
-          };
-        }
-        if (policyDecision.decision === "prompt" && ctx.requestApproval) {
+      if (policyDecision.decision === "prompt" && !isEscalated) {
+        if (ctx.requestApproval) {
           const approvalResult = await ctx.requestApproval(policyDecision.reason || "Executing external command", command);
           const isAllowed = typeof approvalResult === "boolean" ? approvalResult : approvalResult?.allowed;
           if (!isAllowed) {
@@ -2886,17 +3444,22 @@ function createShellTool(policy = new ExecPolicy) {
               isError: true
             };
           }
+        } else {
+          return {
+            output: `Error: Command execution requires user confirmation: '${command}' (${policyDecision.reason || "Requires approval"})`,
+            isError: true
+          };
         }
       }
       const timeoutMs = typeof args.timeoutMs === "number" ? args.timeoutMs : 30000;
       const isWindows = process.platform === "win32";
       const baseCmd = isWindows ? ["cmd.exe", "/d", "/s", "/c", command] : ["/bin/sh", "-c", command];
       const ephemeralScratchpad = globalEphemeralWorkspace.createScratchpad(ctx.turnId);
-      const sandboxProfile = globalKernelSandbox.buildDefaultProfile(ctx.cwd);
-      if (isEscalated) {
-        sandboxProfile.allowNetwork = true;
-      }
-      const wrappedCmd = globalKernelSandbox.wrapCommand(baseCmd, sandboxProfile);
+      const sandboxProfile = globalKernelSandbox.buildDefaultProfile(ctx.cwd, isEscalated);
+      let sandboxNotice = null;
+      const wrappedCmd = globalKernelSandbox.wrapCommand(baseCmd, sandboxProfile, (w) => {
+        sandboxNotice = w;
+      });
       try {
         const proc = Bun.spawn(wrappedCmd, {
           cwd: ctx.cwd,
@@ -2950,10 +3513,38 @@ ${result.stderr.trim()}`);
 2. If this is a test failure, trace the failure in source code and fix the root cause before re-running.
 3. If this is a missing command/module, install or configure the prerequisite.`);
         }
-        const output = outputParts.join(`
+        let rawOutput = outputParts.join(`
 `) || "[Command completed with no output]";
+        const lines = rawOutput.split(`
+`);
+        const MAX_LINES = 250;
+        const MAX_CHARS = 30000;
+        if (lines.length > MAX_LINES) {
+          const headLines = lines.slice(0, 125).join(`
+`);
+          const tailLines = lines.slice(-100).join(`
+`);
+          rawOutput = `${headLines}
+
+... [${lines.length - 225} lines truncated for context efficiency] ...
+
+${tailLines}`;
+        }
+        if (rawOutput.length > MAX_CHARS) {
+          const headChars = rawOutput.slice(0, 16000);
+          const tailChars = rawOutput.slice(-12000);
+          rawOutput = `${headChars}
+
+... [${rawOutput.length - 28000} characters truncated for context efficiency] ...
+
+${tailChars}`;
+        }
+        if (sandboxNotice) {
+          rawOutput = `[Sandbox Notice]: ${sandboxNotice}
+${rawOutput}`;
+        }
         return {
-          output,
+          output: rawOutput,
           isError: result.code !== 0
         };
       } catch (err) {
@@ -2972,7 +3563,7 @@ ${result.stderr.trim()}`);
 }
 var shellTool = createShellTool();
 // src/tools/handlers/file-ops.ts
-import { readdirSync as readdirSync4, readFileSync as readFileSync7, writeFileSync as writeFileSync3, existsSync as existsSync12, statSync as statSync4, mkdirSync as mkdirSync6 } from "fs";
+import { readdirSync as readdirSync4, readFileSync as readFileSync7, writeFileSync as writeFileSync3, existsSync as existsSync12, statSync as statSync4, lstatSync, mkdirSync as mkdirSync6 } from "fs";
 import { resolve as resolve8, dirname as dirname5 } from "path";
 var DEFAULT_MAX_UNPAGINATED_LINES = 250;
 var readFileTool = {
@@ -3084,6 +3675,7 @@ var viewFileTool = {
   name: "view_file",
   description: "View file content with surgical line-range support. Alias for read_file matching Antigravity & Claude Code conventions."
 };
+var DEFAULT_MAX_DIR_ENTRIES = 500;
 var listDirTool = {
   name: "list_dir",
   description: "List contents of a directory with file names and types.",
@@ -3100,13 +3692,31 @@ var listDirTool = {
     }
     try {
       const entries = readdirSync4(dirPath);
-      const formatted = entries.map((entry) => {
+      const totalEntries = entries.length;
+      const displayEntries = entries.slice(0, DEFAULT_MAX_DIR_ENTRIES);
+      const formatted = displayEntries.map((entry) => {
         const full = resolve8(dirPath, entry);
-        const isDir = statSync4(full).isDirectory();
+        let isDir = false;
+        try {
+          isDir = statSync4(full).isDirectory();
+        } catch {
+          try {
+            const lst = lstatSync(full);
+            if (lst.isSymbolicLink())
+              return `[SYMLINK] ${entry}`;
+          } catch {}
+          return `[FILE] ${entry}`;
+        }
         return `${isDir ? "[DIR]" : "[FILE]"} ${entry}`;
       });
-      return { output: formatted.join(`
-`) || "[Empty directory]" };
+      let output = formatted.join(`
+`) || "[Empty directory]";
+      if (totalEntries > DEFAULT_MAX_DIR_ENTRIES) {
+        output += `
+
+... [Truncated: ${totalEntries - DEFAULT_MAX_DIR_ENTRIES} more entries. Showing first ${DEFAULT_MAX_DIR_ENTRIES} of ${totalEntries}]`;
+      }
+      return { output };
     } catch (err) {
       return { output: `Failed to list directory: ${err instanceof Error ? err.message : String(err)}`, isError: true };
     }
@@ -3147,6 +3757,7 @@ var writeFileTool = {
     try {
       mkdirSync6(dirname5(filePath), { recursive: true });
       writeFileSync3(filePath, String(args.content ?? ""), "utf8");
+      ctx.onFileModified?.(rawPath);
       return { output: `Successfully wrote to '${args.path}'` };
     } catch (err) {
       return {
@@ -3640,6 +4251,12 @@ class CodeModeToolsProxy {
           if (result.isError) {
             throw new Error(`Tool '${tool.name}' failed: ${result.output}`);
           }
+          if (normalizedName === "write_file" || normalizedName === "apply_patch" || tool.name === "write_file" || tool.name === "apply_patch") {
+            const pathArg = String(args?.path || "");
+            if (pathArg) {
+              this.context.onFileModified?.(pathArg);
+            }
+          }
           return result.output;
         };
       }
@@ -3713,6 +4330,9 @@ class SandboxedWorkerHost {
       const fetch = undefined;
       const XMLHttpRequest = undefined;
       const WebSocket = undefined;
+      const globalThis = Object.freeze(Object.create(null));
+      const global = undefined;
+      const window = undefined;
       
       return (async () => {
         ${cleanCode}
@@ -4307,7 +4927,11 @@ class AgentGraphStore {
       if (dbPath !== ":memory:") {
         const dir = resolve11(dbPath, "..");
         if (!existsSync15(dir)) {
-          mkdirSync7(dir, { recursive: true });
+          try {
+            mkdirSync7(dir, { recursive: true });
+          } catch (err) {
+            console.warn(`[AgentGraphStore] Failed to create database directory '${dir}':`, err);
+          }
         }
       }
       this.db = new Database2(dbPath);
@@ -4389,25 +5013,45 @@ class AgentGraphStore {
   close() {
     try {
       this.db.close();
-    } catch {}
+    } catch (err) {
+      console.warn("[AgentGraphStore] Failed to close database cleanly:", err);
+    }
   }
 }
 
 // src/agents/spawner.ts
 class AgentSpawner {
   parentSession;
+  depth;
   subAgents = new Map;
   nextAgentId = 1;
   roleRegistry;
   parentIdentity;
   graphStore;
-  constructor(parentSession, roleRegistry, parentIdentity, graphStore) {
+  maxConcurrentAgents;
+  maxDepth;
+  maxRetainedCompleted;
+  defaultTokenBudget;
+  constructor(parentSession, roleRegistry, parentIdentity, graphStore, options, depth = 0) {
     this.parentSession = parentSession;
+    this.depth = depth;
     this.roleRegistry = roleRegistry || new AgentRoleRegistry;
     this.parentIdentity = parentIdentity || createAgentIdentity(undefined, "groupy-main");
     this.graphStore = graphStore || new AgentGraphStore;
+    const envMax = process.env.PIKAA_MAX_SUBAGENTS ? parseInt(process.env.PIKAA_MAX_SUBAGENTS, 10) : NaN;
+    this.maxConcurrentAgents = options?.maxConcurrentAgents ?? (!isNaN(envMax) && envMax > 0 ? envMax : 5);
+    this.maxDepth = options?.maxDepth ?? 2;
+    this.maxRetainedCompleted = options?.maxRetainedCompleted ?? 20;
+    this.defaultTokenBudget = options?.defaultTokenBudget ?? 50000;
   }
   async spawnAgent(params) {
+    if (this.depth >= this.maxDepth) {
+      throw new GroupyError(`Recursion limit exceeded: Maximum sub-agent nesting depth (${this.maxDepth}) reached.`);
+    }
+    const activeRunningCount = Array.from(this.subAgents.values()).filter((h) => h.status === "running").length;
+    if (activeRunningCount >= this.maxConcurrentAgents) {
+      throw new GroupyError(`Resource limit exceeded: Maximum concurrent sub-agents limit (${this.maxConcurrentAgents}) reached. Please wait for running sub-agents to complete or close them.`);
+    }
     const roleName = params.role || "default";
     const roleConfig = this.roleRegistry.getRole(roleName);
     const agentIndex = this.nextAgentId++;
@@ -4419,7 +5063,18 @@ class AgentSpawner {
 
 Your nickname is ${nickname}. Your assigned task is: '${params.taskName}'. Focus strictly on this task.` : `You are a specialized sub-agent named ${nickname} tasked with: '${params.taskName}'. Focus strictly on this task.`);
     const baseTools = params.tools || this.parentSession.tools;
-    const effectiveTools = this.roleRegistry.filterRouterForRole(baseTools, roleName);
+    let effectiveTools = this.roleRegistry.filterRouterForRole(baseTools, roleName);
+    if (this.depth + 1 >= this.maxDepth) {
+      const sanitizedRouter = new ToolRouter;
+      for (const t of effectiveTools.list()) {
+        if (t.name !== "spawn_agent") {
+          sanitizedRouter.register(t);
+        }
+      }
+      effectiveTools = sanitizedRouter;
+    }
+    const tokenBudget = params.maxTokens ?? this.defaultTokenBudget;
+    let accumulatedTokens = 0;
     const childSession = new Session({
       threadId: agentId,
       model: effectiveModel,
@@ -4443,45 +5098,87 @@ Your nickname is ${nickname}. Your assigned task is: '${params.taskName}'. Focus
       createdAt: Date.now(),
       identity: childIdentity,
       session: childSession,
-      promise: taskPromise
+      promise: taskPromise,
+      depth: this.depth + 1,
+      tokenBudget,
+      totalTokens: 0
     };
     try {
       this.graphStore.upsertEdge(this.parentSession.threadId, agentId, "open");
-    } catch {}
+    } catch (err) {
+      console.warn(`[AgentSpawner] Failed to record edge in graph store for agent '${agentId}':`, err);
+    }
     let collectedAgentText = "";
     childSession.onEvent((event) => {
       if (event.msg.type === "AgentMessageDelta") {
         collectedAgentText += event.msg.delta;
+        accumulatedTokens += Math.ceil(event.msg.delta.length / 4);
+        handle.totalTokens = accumulatedTokens;
+        if (accumulatedTokens > tokenBudget && handle.status === "running") {
+          handle.status = "error";
+          handle.error = `Token budget limit exceeded (${tokenBudget} tokens).`;
+          childSession.interrupt();
+          try {
+            this.graphStore.setEdgeStatus(agentId, "closed");
+          } catch (err) {
+            console.warn(`[AgentSpawner] Failed to update edge status for agent '${agentId}':`, err);
+          }
+          rejectPromise(new Error(handle.error));
+        }
       } else if (event.msg.type === "TurnCompleted") {
-        handle.status = "completed";
-        handle.lastOutput = collectedAgentText.trim();
-        try {
-          this.graphStore.setEdgeStatus(agentId, "closed");
-        } catch {}
-        resolvePromise(handle.lastOutput);
+        if (handle.status === "running") {
+          handle.status = "completed";
+          handle.lastOutput = collectedAgentText.trim();
+          handle.totalTokens = accumulatedTokens;
+          try {
+            this.graphStore.setEdgeStatus(agentId, "closed");
+          } catch (err) {
+            console.warn(`[AgentSpawner] Failed to update edge status for agent '${agentId}':`, err);
+          }
+          this.pruneCompletedAgents();
+          resolvePromise(handle.lastOutput);
+        }
       } else if (event.msg.type === "Error") {
-        handle.status = "error";
-        handle.error = event.msg.message;
-        try {
-          this.graphStore.setEdgeStatus(agentId, "closed");
-        } catch {}
-        rejectPromise(new Error(event.msg.message));
+        if (handle.status === "running") {
+          handle.status = "error";
+          handle.error = event.msg.message;
+          handle.totalTokens = accumulatedTokens;
+          try {
+            this.graphStore.setEdgeStatus(agentId, "closed");
+          } catch (err) {
+            console.warn(`[AgentSpawner] Failed to update edge status for agent '${agentId}':`, err);
+          }
+          this.pruneCompletedAgents();
+          rejectPromise(new Error(event.msg.message));
+        }
       } else if (event.msg.type === "StatusChanged" && event.msg.status === "interrupted") {
-        handle.status = "interrupted";
-        try {
-          this.graphStore.setEdgeStatus(agentId, "closed");
-        } catch {}
-        resolvePromise(collectedAgentText.trim() || "[Task was interrupted]");
+        if (handle.status === "running") {
+          handle.status = "interrupted";
+          handle.totalTokens = accumulatedTokens;
+          try {
+            this.graphStore.setEdgeStatus(agentId, "closed");
+          } catch (err) {
+            console.warn(`[AgentSpawner] Failed to update edge status for agent '${agentId}':`, err);
+          }
+          this.pruneCompletedAgents();
+          resolvePromise(collectedAgentText.trim() || "[Task was interrupted]");
+        }
       }
     });
     this.subAgents.set(agentId, handle);
     childSession.prompt(params.message).catch((err) => {
-      handle.status = "error";
-      handle.error = err instanceof Error ? err.message : String(err);
-      try {
-        this.graphStore.setEdgeStatus(agentId, "closed");
-      } catch {}
-      rejectPromise(err);
+      if (handle.status === "running") {
+        handle.status = "error";
+        handle.error = err instanceof Error ? err.message : String(err);
+        handle.totalTokens = accumulatedTokens;
+        try {
+          this.graphStore.setEdgeStatus(agentId, "closed");
+        } catch (storeErr) {
+          console.warn(`[AgentSpawner] Failed to update edge status for agent '${agentId}':`, storeErr);
+        }
+        this.pruneCompletedAgents();
+        rejectPromise(err);
+      }
     });
     return {
       id: handle.id,
@@ -4490,9 +5187,22 @@ Your nickname is ${nickname}. Your assigned task is: '${params.taskName}'. Focus
       role: handle.role,
       status: handle.status,
       createdAt: handle.createdAt,
-      agentRuntimeId: childIdentity.agentRuntimeId
+      agentRuntimeId: childIdentity.agentRuntimeId,
+      depth: handle.depth,
+      tokenBudget: handle.tokenBudget,
+      totalTokens: handle.totalTokens
     };
   }
+  pruneCompletedAgents() {
+    const finishedHandles = Array.from(this.subAgents.values()).filter((h) => h.status !== "running");
+    if (finishedHandles.length > this.maxRetainedCompleted) {
+      finishedHandles.sort((a, b) => a.createdAt - b.createdAt);
+      const toRemove = finishedHandles.slice(0, finishedHandles.length - this.maxRetainedCompleted);
+      for (const h of toRemove) {
+        this.subAgents.delete(h.id);
+      }
+    }
+  }
   async waitAgent(agentIdOrTaskName, timeoutMs = 60000) {
     if (!agentIdOrTaskName) {
       const handles = Array.from(this.subAgents.values());
@@ -4546,9 +5256,36 @@ Your nickname is ${nickname}. Your assigned task is: '${params.taskName}'. Focus
     handle.status = "interrupted";
     try {
       this.graphStore.setEdgeStatus(agentId, "closed");
-    } catch {}
+    } catch (err) {
+      console.warn(`[AgentSpawner] Failed to close edge for agent '${agentId}':`, err);
+    }
+    this.pruneCompletedAgents();
     return `Sub-agent ${handle.nickname} (${agentId}) interrupted and closed.`;
   }
+  removeAgent(agentId) {
+    const handle = this.subAgents.get(agentId);
+    if (!handle)
+      return false;
+    if (handle.status === "running") {
+      handle.session.interrupt();
+    }
+    try {
+      this.graphStore.setEdgeStatus(agentId, "closed");
+    } catch (err) {
+      console.warn(`[AgentSpawner] Failed to close edge on removal for '${agentId}':`, err);
+    }
+    return this.subAgents.delete(agentId);
+  }
+  clearCompleted() {
+    let cleared = 0;
+    for (const [id, handle] of this.subAgents.entries()) {
+      if (handle.status !== "running") {
+        this.subAgents.delete(id);
+        cleared++;
+      }
+    }
+    return cleared;
+  }
   listAgents() {
     const list = [];
     for (const handle of this.subAgents.values()) {
@@ -4560,7 +5297,10 @@ Your nickname is ${nickname}. Your assigned task is: '${params.taskName}'. Focus
         status: handle.status,
         createdAt: handle.createdAt,
         agentRuntimeId: handle.identity.agentRuntimeId,
-        lastOutput: handle.lastOutput
+        lastOutput: handle.lastOutput,
+        depth: handle.depth,
+        tokenBudget: handle.tokenBudget,
+        totalTokens: handle.totalTokens
       });
     }
     return list;
@@ -4594,6 +5334,10 @@ function createMultiAgentTools(spawner) {
         model: {
           type: "string",
           description: "Optional model override. Defaults to inheriting parent model."
+        },
+        max_tokens: {
+          type: "number",
+          description: "Optional token budget limit for the sub-agent (default: 50000)."
         }
       },
       required: ["task_name", "message"]
@@ -4603,8 +5347,9 @@ function createMultiAgentTools(spawner) {
       const message = String(args.message || "");
       const role = args.role ? String(args.role) : undefined;
       const model = args.model ? String(args.model) : undefined;
+      const maxTokens = typeof args.max_tokens === "number" ? args.max_tokens : undefined;
       try {
-        const handle = await spawner.spawnAgent({ taskName, message, role, model });
+        const handle = await spawner.spawnAgent({ taskName, message, role, model, maxTokens });
         return {
           output: `Successfully spawned sub-agent '${handle.id}' with role '${handle.role}' for task '${handle.taskName}' (status: ${handle.status}). Use 'wait_agent' to collect results.`
         };
@@ -5898,7 +6643,8 @@ class SessionPersistenceManager {
   loadSession(threadId) {
     try {
       return this.store.restoreSession(threadId);
-    } catch {
+    } catch (err) {
+      console.warn(`[SessionPersistenceManager] Failed to restore session '${threadId}':`, err);
       return null;
     }
   }
@@ -5906,7 +6652,9 @@ class SessionPersistenceManager {
     for (const unsub of this.unsubscribers) {
       try {
         unsub();
-      } catch {}
+      } catch (err) {
+        console.warn("[SessionPersistenceManager] Error in unbindSession callback:", err);
+      }
     }
     this.unsubscribers = [];
   }
@@ -5933,7 +6681,9 @@ class SessionPersistenceManager {
     for (const unsub of this.unsubscribers) {
       try {
         unsub();
-      } catch {}
+      } catch (err) {
+        console.warn("[SessionPersistenceManager] Error closing session persistence listener:", err);
+      }
     }
     this.unsubscribers = [];
     this.store.close();
@@ -6268,7 +7018,9 @@ class MemoryStore {
       if (!existsSync20(dir)) {
         try {
           mkdirSync11(dir, { recursive: true });
-        } catch {}
+        } catch (err) {
+          console.warn(`[MemoryStore] Failed to create custom memory directory '${dir}':`, err);
+        }
       }
       return dir;
     }
@@ -6277,7 +7029,9 @@ class MemoryStore {
     if (!existsSync20(dir)) {
       try {
         mkdirSync11(dir, { recursive: true });
-      } catch {}
+      } catch (err) {
+        console.warn(`[MemoryStore] Failed to create project memory directory '${dir}':`, err);
+      }
     }
     return dir;
   }
@@ -6421,7 +7175,9 @@ class MemoryStore {
 `)[0] || parsed.name,
           file: f
         });
-      } catch {}
+      } catch (err) {
+        console.warn(`[MemoryStore] Failed to parse topic memory file '${f}':`, err);
+      }
     }
     const indexLines = [
       "# Project Auto-Memory Index",
@@ -6463,7 +7219,9 @@ class MemoryStore {
       try {
         const full = join12(memoryDir, f);
         list.push(this.parseTopicFile(readFileSync12(full, "utf8"), full));
-      } catch {}
+      } catch (err) {
+        console.warn(`[MemoryStore] Failed to read topic memory file '${f}':`, err);
+      }
     }
     return list;
   }
@@ -7397,7 +8155,7 @@ function parsePatch(oldSrc, newSrc, contextLines = 3) {
 // package.json
 var package_default = {
   name: "@pikaa-ai/pikaa",
-  version: "0.3.28",
+  version: "0.4.0",
   description: "PIKAA CLI - AI coding agent that runs locally in your terminal.",
   main: "./dist/index.js",
   module: "./dist/index.js",
@@ -7429,14 +8187,14 @@ var package_default = {
     prepublishOnly: "bun run build:js"
   },
   optionalDependencies: {
-    "@pikaa-ai/pikaa-linux-x64": "0.3.28",
-    "@pikaa-ai/pikaa-linux-x64-musl": "0.3.28",
-    "@pikaa-ai/pikaa-linux-arm64": "0.3.28",
-    "@pikaa-ai/pikaa-linux-arm64-musl": "0.3.28",
-    "@pikaa-ai/pikaa-darwin-x64": "0.3.28",
-    "@pikaa-ai/pikaa-darwin-arm64": "0.3.28",
-    "@pikaa-ai/pikaa-windows-x64": "0.3.28",
-    "@pikaa-ai/pikaa-windows-arm64": "0.3.28"
+    "@pikaa-ai/pikaa-linux-x64": "0.4.0",
+    "@pikaa-ai/pikaa-linux-x64-musl": "0.4.0",
+    "@pikaa-ai/pikaa-linux-arm64": "0.4.0",
+    "@pikaa-ai/pikaa-linux-arm64-musl": "0.4.0",
+    "@pikaa-ai/pikaa-darwin-x64": "0.4.0",
+    "@pikaa-ai/pikaa-darwin-arm64": "0.4.0",
+    "@pikaa-ai/pikaa-windows-x64": "0.4.0",
+    "@pikaa-ai/pikaa-windows-arm64": "0.4.0"
   },
   keywords: [
     "ai",
@@ -11068,9 +11826,15 @@ class CliRepl {
     try {
       const decision = await promptToolApproval(msg);
       if (decision === "always") {
-        this.session.execPolicy.addRule(/.*/, "allow", "User allowed all actions for this session");
-        this.session.resolveApproval(msg.approvalId, true);
-        this.spinner.start(`Executing approved action (auto-approved for session)...`, this.turnStartTime);
+        if (msg.prefixRule && Array.isArray(msg.prefixRule) && msg.prefixRule.length > 0) {
+          globalPrefixRulesStore.addRule(this.session.cwd, msg.prefixRule);
+          this.session.resolveApproval(msg.approvalId, { allowed: true, rememberPrefix: true });
+          this.spinner.start(`Executing approved action (saved prefix rule)...`, this.turnStartTime);
+        } else {
+          this.session.execPolicy.addRule(/.*/, "allow", "User allowed all standard actions for this session");
+          this.session.resolveApproval(msg.approvalId, true);
+          this.spinner.start(`Executing approved action (auto-approved for session)...`, this.turnStartTime);
+        }
       } else if (decision === "yes") {
         this.session.resolveApproval(msg.approvalId, true);
         this.spinner.start(`Executing approved action...`, this.turnStartTime);