@probelabs/probe 0.6.0-rc208 → 0.6.0-rc210

package/build/agent/index.js

@@ -3764,7 +3764,10 @@ async function delegate({
   disableTools = false,
   searchDelegate = void 0,
   schema = null,
-  enableTasks = false
+  enableTasks = false,
+  enableMcp = false,
+  mcpConfig = null,
+  mcpConfigPath = null
 }) {
   if (!task || typeof task !== "string") {
     throw new Error("Task parameter is required and must be a string");
@@ -3820,8 +3823,14 @@ async function delegate({
       allowedTools,
       disableTools,
       searchDelegate,
-      enableTasks
+      enableTasks,
       // Inherit from parent (subagent gets isolated TaskManager)
+      enableMcp,
+      // Inherit from parent (subagent creates own MCPXmlBridge)
+      mcpConfig,
+      // Inherit from parent
+      mcpConfigPath
+      // Inherit from parent
     });
     if (debug) {
       console.error(`[DELEGATE] Created subagent with session ${sessionId}`);
@@ -9791,7 +9800,7 @@ var init_vercel = __esm({
       });
     };
     delegateTool = (options = {}) => {
-      const { debug = false, timeout = 300, cwd, allowedFolders, enableBash = false, bashConfig, architectureFileName } = options;
+      const { debug = false, timeout = 300, cwd, allowedFolders, enableBash = false, bashConfig, architectureFileName, enableMcp = false, mcpConfig = null, mcpConfigPath = null } = options;
       return tool2({
         name: "delegate",
         description: delegateDescription,
@@ -9850,7 +9859,10 @@ var init_vercel = __esm({
             enableBash,
             bashConfig,
             architectureFileName,
-            searchDelegate
+            searchDelegate,
+            enableMcp,
+            mcpConfig,
+            mcpConfigPath
           });
           return result;
         }
@@ -10377,6 +10389,38 @@ function parseSimpleCommand(command) {
       isComplex: false
     };
   }
+  const stripQuotedContent = (str) => {
+    let result = "";
+    let inQuotes2 = false;
+    let quoteChar2 = "";
+    for (let i = 0; i < str.length; i++) {
+      const char = str[i];
+      const nextChar = str[i + 1];
+      if (!inQuotes2 && char === "\\" && nextChar !== void 0) {
+        i++;
+        continue;
+      }
+      if (inQuotes2 && quoteChar2 === '"' && char === "\\" && nextChar !== void 0) {
+        i++;
+        continue;
+      }
+      if (!inQuotes2 && (char === '"' || char === "'")) {
+        inQuotes2 = true;
+        quoteChar2 = char;
+        continue;
+      }
+      if (inQuotes2 && char === quoteChar2) {
+        inQuotes2 = false;
+        quoteChar2 = "";
+        continue;
+      }
+      if (!inQuotes2) {
+        result += char;
+      }
+    }
+    return result;
+  };
+  const strippedForOperators = stripQuotedContent(trimmed);
   const complexPatterns = [
     /\|/,
     // Pipes
@@ -10402,7 +10446,7 @@ function parseSimpleCommand(command) {
     // Brace expansion like {a,b} or {1..10} (but not find {} placeholders)
   ];
   for (const pattern of complexPatterns) {
-    if (pattern.test(trimmed)) {
+    if (pattern.test(strippedForOperators)) {
       return {
         success: false,
         error: "Complex shell commands with pipes, operators, or redirections are not supported for security reasons",
@@ -10417,17 +10461,17 @@ function parseSimpleCommand(command) {
   let current = "";
   let inQuotes = false;
   let quoteChar = "";
-  let escaped = false;
   for (let i = 0; i < trimmed.length; i++) {
     const char = trimmed[i];
     const nextChar = i + 1 < trimmed.length ? trimmed[i + 1] : "";
-    if (escaped) {
-      current += char;
-      escaped = false;
+    if (!inQuotes && char === "\\" && nextChar) {
+      current += nextChar;
+      i++;
       continue;
     }
-    if (char === "\\" && !inQuotes) {
-      escaped = true;
+    if (inQuotes && quoteChar === '"' && char === "\\" && nextChar) {
+      current += nextChar;
+      i++;
       continue;
     }
     if (!inQuotes && (char === '"' || char === "'")) {
@@ -10760,8 +10804,97 @@ var init_bashPermissions = __esm({
         });
         return result;
       }
+      /**
+       * Split a complex command into component commands by operators
+       *
+       * ## Escape Handling (Security-Critical)
+       *
+       * This function intentionally PRESERVES escape sequences (both backslash AND
+       * escaped character) in the output. This is step 1 of a 2-step parsing process:
+       *
+       * 1. _splitComplexCommand: Splits by operators, PRESERVES escapes → `echo "test\" && b"`
+       * 2. parseCommand: Interprets escapes in each component → args: ['test" && b']
+       *
+       * This differs from stripQuotedContent() in bashCommandUtils.js which REMOVES
+       * escapes entirely (for operator detection only).
+       *
+       * The security rationale: if we stripped escapes here, `\"` would become `"`,
+       * potentially causing incorrect quote boundary detection and allowing operator
+       * injection. By preserving escapes, parseCommand() can correctly interpret them.
+       *
+       * See bashCommandUtils.js module header for the full escape handling architecture.
+       *
+       * @private
+       * @param {string} command - Complex command to split
+       * @returns {string[]} Array of component commands (with escapes preserved)
+       */
+      _splitComplexCommand(command) {
+        const components = [];
+        let current = "";
+        let inQuotes = false;
+        let quoteChar = "";
+        let i = 0;
+        while (i < command.length) {
+          const char = command[i];
+          const nextChar = command[i + 1] || "";
+          if (!inQuotes && char === "\\") {
+            current += char;
+            if (nextChar) {
+              current += nextChar;
+              i += 2;
+            } else {
+              i++;
+            }
+            continue;
+          }
+          if (inQuotes && quoteChar === '"' && char === "\\" && nextChar) {
+            current += char + nextChar;
+            i += 2;
+            continue;
+          }
+          if (!inQuotes && (char === '"' || char === "'")) {
+            inQuotes = true;
+            quoteChar = char;
+            current += char;
+            i++;
+            continue;
+          }
+          if (inQuotes && char === quoteChar) {
+            inQuotes = false;
+            quoteChar = "";
+            current += char;
+            i++;
+            continue;
+          }
+          if (!inQuotes) {
+            if (char === "&" && nextChar === "&" || char === "|" && nextChar === "|") {
+              if (current.trim()) {
+                components.push(current.trim());
+              }
+              current = "";
+              i += 2;
+              continue;
+            }
+            if (char === "|") {
+              if (current.trim()) {
+                components.push(current.trim());
+              }
+              current = "";
+              i++;
+              continue;
+            }
+          }
+          current += char;
+          i++;
+        }
+        if (current.trim()) {
+          components.push(current.trim());
+        }
+        return components;
+      }
       /**
        * Check a complex command against complex patterns in allow/deny lists
+       * Also supports auto-allowing commands where all components are individually allowed
        * @private
        * @param {string} command - Complex command to check
        * @returns {Object} Permission result
@@ -10816,6 +10949,85 @@ var init_bashPermissions = __esm({
             return result;
           }
         }
+        const components = this._splitComplexCommand(command);
+        if (this.debug) {
+          console.log(`[BashPermissions] Checking ${components.length} command components: ${JSON.stringify(components)}`);
+        }
+        if (components.length > 1) {
+          const componentResults = [];
+          let allAllowed = true;
+          let deniedComponent = null;
+          let deniedReason = null;
+          for (const component of components) {
+            const parsed = parseCommand(component);
+            if (parsed.error || parsed.isComplex) {
+              if (this.debug) {
+                console.log(`[BashPermissions] Component "${component}" is complex or has error: ${parsed.error}`);
+              }
+              allAllowed = false;
+              deniedComponent = component;
+              deniedReason = parsed.error || "Component contains nested complex constructs";
+              break;
+            }
+            if (matchesAnyPattern(parsed, this.denyPatterns)) {
+              if (this.debug) {
+                console.log(`[BashPermissions] Component "${component}" matches deny pattern`);
+              }
+              allAllowed = false;
+              deniedComponent = component;
+              deniedReason = "Component matches deny pattern";
+              break;
+            }
+            if (!matchesAnyPattern(parsed, this.allowPatterns)) {
+              if (this.debug) {
+                console.log(`[BashPermissions] Component "${component}" not in allow list`);
+              }
+              allAllowed = false;
+              deniedComponent = component;
+              deniedReason = "Component not in allow list";
+              break;
+            }
+            componentResults.push({ component, parsed, allowed: true });
+          }
+          if (allAllowed) {
+            if (this.debug) {
+              console.log(`[BashPermissions] ALLOWED - all ${components.length} components passed individual checks`);
+            }
+            const result = {
+              allowed: true,
+              command,
+              isComplex: true,
+              allowedByComponents: true,
+              components: componentResults
+            };
+            this.recordBashEvent("permission.allowed", {
+              command,
+              isComplex: true,
+              allowedByComponents: true,
+              componentCount: components.length
+            });
+            return result;
+          } else {
+            if (this.debug) {
+              console.log(`[BashPermissions] DENIED - component "${deniedComponent}" failed: ${deniedReason}`);
+            }
+            const result = {
+              allowed: false,
+              reason: `Component "${deniedComponent}" not allowed: ${deniedReason}`,
+              command,
+              isComplex: true,
+              failedComponent: deniedComponent
+            };
+            this.recordBashEvent("permission.denied", {
+              command,
+              reason: "component_not_allowed",
+              failedComponent: deniedComponent,
+              componentReason: deniedReason,
+              isComplex: true
+            });
+            return result;
+          }
+        }
         if (this.debug) {
           console.log(`[BashPermissions] DENIED - no matching complex pattern found`);
         }
@@ -58583,7 +58795,7 @@ var init_client = __esm({
             clientInfo.client.callTool({
               name: tool4.originalName,
               arguments: args
-            }),
+            }, void 0, { timeout }),
             timeoutPromise
           ]);
           const durationMs = Date.now() - startTime;
@@ -69138,7 +69350,7 @@ var init_ProbeAgent = __esm({
         this.maxIterations = options.maxIterations || null;
         this.disableMermaidValidation = !!options.disableMermaidValidation;
         this.disableJsonValidation = !!options.disableJsonValidation;
-        this.enableSkills = options.disableSkills ? false : options.enableSkills !== void 0 ? !!options.enableSkills : true;
+        this.enableSkills = options.disableSkills ? false : !!(options.allowSkills || options.enableSkills);
         if (Array.isArray(options.skillDirs)) {
           this.skillDirs = options.skillDirs;
         } else if (typeof options.skillDirs === "string") {
@@ -71033,6 +71245,9 @@ You are working with a repository located at: ${searchDirectory}
           let lastFormatErrorType = null;
           let sameFormatErrorCount = 0;
           const MAX_REPEATED_FORMAT_ERRORS = 3;
+          let lastNoToolResponse = null;
+          let sameResponseCount = 0;
+          const MAX_REPEATED_IDENTICAL_RESPONSES = 3;
           while (currentIteration < maxIterations && !completionAttempted) {
             currentIteration++;
             if (this.cancelled) throw new Error("Request was cancelled by the user");
@@ -71514,6 +71729,26 @@ ${errorXml}
                 }
                 break;
               }
+              if (lastNoToolResponse !== null && assistantResponseContent === lastNoToolResponse) {
+                sameResponseCount++;
+                if (sameResponseCount >= MAX_REPEATED_IDENTICAL_RESPONSES) {
+                  let cleanedResponse = assistantResponseContent;
+                  cleanedResponse = cleanedResponse.replace(/<thinking>[\s\S]*?<\/thinking>/gi, "").trim();
+                  cleanedResponse = cleanedResponse.replace(/<thinking>[\s\S]*$/gi, "").trim();
+                  const hasSubstantialContent = cleanedResponse.length > 50 && !cleanedResponse.includes("<api_call>") && !cleanedResponse.includes("<tool_name>") && !cleanedResponse.includes("<function>");
+                  if (hasSubstantialContent) {
+                    if (this.debug) {
+                      console.log(`[DEBUG] Same response repeated ${sameResponseCount} times - accepting as final answer (${cleanedResponse.length} chars)`);
+                    }
+                    finalResult = cleanedResponse;
+                    completionAttempted = true;
+                    break;
+                  }
+                }
+              } else {
+                lastNoToolResponse = assistantResponseContent;
+                sameResponseCount = 1;
+              }
               currentMessages.push({ role: "assistant", content: assistantResponseContent });
               const unrecognizedTool = detectUnrecognizedToolCall(assistantResponseContent, validTools);
               let reminderContent;
@@ -71586,10 +71821,35 @@ Or if your previous response already contains a complete, direct answer (not a t
 
 Note: <attempt_complete></attempt_complete> reuses your PREVIOUS assistant message as the final answer. Only use this if that message was already a valid, complete response to the user's question.`;
               }
-              currentMessages.push({
-                role: "user",
-                content: reminderContent
-              });
+              const prevUserMsgIndex = currentMessages.length - 2;
+              const prevUserMsg = currentMessages[prevUserMsgIndex];
+              const isExistingReminder = prevUserMsg && prevUserMsg.role === "user" && (prevUserMsg.content.includes("Please use one of the available tools") || prevUserMsg.content.includes("<tool_result>"));
+              if (isExistingReminder && sameResponseCount > 1) {
+                const prevAssistantIndex = prevUserMsgIndex - 1;
+                const hasSystemMessage2 = currentMessages.length > 0 && currentMessages[0].role === "system";
+                const minValidIndex = hasSystemMessage2 ? 1 : 0;
+                const canSafelyRemove = prevAssistantIndex >= minValidIndex && currentMessages[prevAssistantIndex] && currentMessages[prevAssistantIndex].role === "assistant" && currentMessages.length - 2 >= (hasSystemMessage2 ? 2 : 1);
+                if (canSafelyRemove) {
+                  currentMessages.splice(prevAssistantIndex, 2);
+                  if (this.debug) {
+                    console.log(`[DEBUG] Removed duplicate assistant+reminder pair (iteration ${currentIteration}, same response #${sameResponseCount})`);
+                  }
+                } else if (this.debug) {
+                  console.log(`[DEBUG] Skipped deduplication: pattern validation failed (prevAssistantIndex=${prevAssistantIndex}, arrayLength=${currentMessages.length})`);
+                }
+                const iterationHint = `
+
+(Attempt #${sameResponseCount}: Your previous ${sameResponseCount} responses were identical. If you have a complete answer, use <attempt_complete></attempt_complete> to finalize it.)`;
+                currentMessages.push({
+                  role: "user",
+                  content: reminderContent + iterationHint
+                });
+              } else {
+                currentMessages.push({
+                  role: "user",
+                  content: reminderContent
+                });
+              }
               if (this.debug) {
                 if (unrecognizedTool) {
                   console.log(`[DEBUG] Unrecognized tool '${unrecognizedTool}' used. Providing error feedback.`);
@@ -73115,8 +73375,8 @@ function parseArgs() {
     // Tool filtering: ['*'] = all, [] = none, ['tool1', 'tool2'] = specific
     disableTools: false,
     // Convenience flag to disable all tools
-    disableSkills: false,
-    // Disable skill discovery and activation
+    allowSkills: false,
+    // Enable skill discovery and activation (disabled by default)
     skillDirs: null,
     // Comma-separated list of repo-relative skill directories
     // Task management
@@ -73188,8 +73448,8 @@ function parseArgs() {
       }
     } else if (arg === "--disable-tools") {
       config.disableTools = true;
-    } else if (arg === "--no-skills") {
-      config.disableSkills = true;
+    } else if (arg === "--allow-skills") {
+      config.allowSkills = true;
     } else if (arg === "--skills-dir" && i + 1 < args.length) {
       config.skillDirs = args[++i].split(",").map((dir) => dir.trim()).filter(Boolean);
     } else if (arg === "--allow-tasks") {
@@ -73246,8 +73506,8 @@ Options:
                                    Supports exclusion: '*,!bash' (all except bash)
   --disable-tools                  Disable all tools (raw AI mode, no code analysis)
                                    Convenience flag equivalent to --allowed-tools none
+  --allow-skills                   Enable skill discovery and activation (disabled by default)
   --skills-dir <dirs>              Comma-separated list of repo-relative skill directories to scan
-  --no-skills                      Disable skill discovery and activation
   --allow-tasks                    Enable task management for tracking multi-step progress
   --verbose                        Enable verbose output
   --outline                        Use outline-xml format for code search results
@@ -73719,7 +73979,7 @@ async function main() {
       disableMermaidValidation: config.noMermaidValidation,
       allowedTools: config.allowedTools,
       disableTools: config.disableTools,
-      enableSkills: !config.disableSkills,
+      allowSkills: config.allowSkills,
       skillDirs: config.skillDirs,
       enableBash: config.enableBash,
       bashConfig,

package/build/agent/mcp/client.js

@@ -474,11 +474,12 @@ export class MCPClientManager {
       });
 
       // Race between the actual call and timeout
+      // Pass timeout to SDK's callTool to override its default 60s timeout
       const result = await Promise.race([
         clientInfo.client.callTool({
           name: tool.originalName,
           arguments: args
-        }),
+        }, undefined, { timeout }),
         timeoutPromise
       ]);
 

package/build/delegate.js

@@ -186,6 +186,9 @@ const delegationManager = new DelegationManager();
  * @param {boolean} [options.searchDelegate] - Use delegated search in the subagent
  * @param {Object|string} [options.schema] - Optional JSON schema to enforce response format
  * @param {boolean} [options.enableTasks=false] - Enable task management for the subagent (isolated instance)
+ * @param {boolean} [options.enableMcp=false] - Enable MCP tool integration (inherited from parent)
+ * @param {Object} [options.mcpConfig] - MCP configuration object (inherited from parent)
+ * @param {string} [options.mcpConfigPath] - Path to MCP configuration file (inherited from parent)
  * @returns {Promise<string>} The response from the delegate agent
  */
 export async function delegate({
@@ -208,7 +211,10 @@ export async function delegate({
 	disableTools = false,
 	searchDelegate = undefined,
 	schema = null,
-	enableTasks = false
+	enableTasks = false,
+	enableMcp = false,
+	mcpConfig = null,
+	mcpConfigPath = null
 }) {
 	if (!task || typeof task !== 'string') {
 		throw new Error('Task parameter is required and must be a string');
@@ -270,7 +276,10 @@ export async function delegate({
 			allowedTools,
 			disableTools,
 			searchDelegate,
-			enableTasks // Inherit from parent (subagent gets isolated TaskManager)
+			enableTasks, // Inherit from parent (subagent gets isolated TaskManager)
+			enableMcp,   // Inherit from parent (subagent creates own MCPXmlBridge)
+			mcpConfig,   // Inherit from parent
+			mcpConfigPath // Inherit from parent
 		});
 
 		if (debug) {

package/build/tools/vercel.js

@@ -469,7 +469,7 @@ export const extractTool = (options = {}) => {
  * @returns {Object} Configured delegate tool
  */
 export const delegateTool = (options = {}) => {
-	const { debug = false, timeout = 300, cwd, allowedFolders, enableBash = false, bashConfig, architectureFileName } = options;
+	const { debug = false, timeout = 300, cwd, allowedFolders, enableBash = false, bashConfig, architectureFileName, enableMcp = false, mcpConfig = null, mcpConfigPath = null } = options;
 
 	return tool({
 		name: 'delegate',
@@ -558,7 +558,10 @@ export const delegateTool = (options = {}) => {
 				enableBash,
 				bashConfig,
 				architectureFileName,
-				searchDelegate
+				searchDelegate,
+				enableMcp,
+				mcpConfig,
+				mcpConfigPath
 			});
 
 			return result;