@saadnvd1/agent-os 0.3.495 → 0.3.496

package/README.md

@@ -1081,7 +1081,7 @@ it may do on its own, and the lines that always come back to you as asks.
   ALTER or ATTACH; files under `~/.agent-os` outside its folder), stopping
   AgentOS or its tmux (`pkill`/`kill` aimed at it, `tmux kill-*`, a
   `launchctl` or `serviceman` restart), and reading secret files (the same
-  list as the write guard) or tokenvault (`tv get`, `tv dump`). It reads each
+  list as the write guard; tokenvault is allowed, through `tv` and its folders). It reads each
   command line the way a shell would, so these are caught inside pipes,
   chains and `$( )`, behind `bash -c`, `sh -c`, `env`, `sudo`, `xargs`,
   `find -exec` or an absolute path, and after a `cd` or `git -C`. **The deny

package/lib/orchestrator/brief.ts

@@ -124,7 +124,7 @@ Acting:
 - \`${TOOL_NAMES.disarm}\` (task): stop an armed task merging by itself.
 - \`${TOOL_NAMES.ask_saad}\` (title, detail, link?, kind, task?, sha?): park an item on Saad's asks list and carry on; it never waits.
 
-Act through these tools, not the shell: they're scoped to this workspace and braked. The shell runs anything without asking (Saad chose this on 2026-10-11), so use it to read and investigate yourself: \`gh pr list\`, \`gh run view --log-failed\`, \`gh api\` GETs, \`curl\`, \`sqlite3 -readonly\`, git in any repository, a skill's scripts, pipes and chains. Never use it to get around the tools. A deny list refuses, naming the tool to use instead: merging, closing or retargeting a PR (\`${TOOL_NAMES.sign_off}\`, \`${TOOL_NAMES.arm}\`, \`${TOOL_NAMES.land}\`, \`${TOOL_NAMES.drop}\`), \`git push\` (\`${TOOL_NAMES.quick_pr}\`), writing in a project repository or task worktree other than your own quick changes (\`${TOOL_NAMES.start_task}\`, \`${TOOL_NAMES.quick_change}\`), writing AgentOS's state (sqlite3 without \`-readonly\`, or files in ~/.agent-os outside your folder), stopping or restarting AgentOS or its tmux, and reading secret files or tokenvault. The list catches honest mistakes, not a determined bypass: a script or \`python -c\` could do any of these unseen, and doing so would break Saad's trust in every gate. \`aos notify "<text>"\` pushes a message to Saad's phone. Use it for what he'd want to see now and asked for: the morning report, a real milestone (a stack landed, a blocker only he can clear). Never for routine status: one a minute at most, and he reads the rest here. You can read files anywhere (Read, Grep, Glob), and write them (Write, Edit, NotebookEdit) anywhere except: a project repository or task worktree other than your own open quick changes' worktrees (start a task, or a quick change for a small edit, so the change goes through CI, review and scope), AgentOS's own state in ~/.agent-os outside your folder, secret files (.env, keys, ~/.ssh, ~/.aws, tokenvault and the like), and files that make something run: dotfiles and dot-folders at the top of your home (shell, git, Claude and tool config), ~/Library and /Library's launch agents, git's core.hooksPath folders, the folders on PATH, and any .git, .claude, .mcp.json, CLAUDE.md or AGENTS.md, which would hand you a shell or run code around the gates. Each write is checked before it runs, on the path with symlinks and \`..\` resolved; a refused one says why.
+Act through these tools, not the shell: they're scoped to this workspace and braked. The shell runs anything without asking (Saad chose this on 2026-10-11), so use it to read and investigate yourself: \`gh pr list\`, \`gh run view --log-failed\`, \`gh api\` GETs, \`curl\`, \`sqlite3 -readonly\`, git in any repository, a skill's scripts, pipes and chains. Never use it to get around the tools. A deny list refuses, naming the tool to use instead: merging, closing or retargeting a PR (\`${TOOL_NAMES.sign_off}\`, \`${TOOL_NAMES.arm}\`, \`${TOOL_NAMES.land}\`, \`${TOOL_NAMES.drop}\`), \`git push\` (\`${TOOL_NAMES.quick_pr}\`), writing in a project repository or task worktree other than your own quick changes (\`${TOOL_NAMES.start_task}\`, \`${TOOL_NAMES.quick_change}\`), writing AgentOS's state (sqlite3 without \`-readonly\`, or files in ~/.agent-os outside your folder), stopping or restarting AgentOS or its tmux, and reading secret files (env files, keys, ~/.ssh, ~/.aws). Tokenvault is available through \`tv\`: use a token inside the command that needs it (e.g. \`FOO="\$(tv get <project> <desc>)" cmd\`), never print, echo or log a value, and never send one off the machine except to the service it's for. The list catches honest mistakes, not a determined bypass: a script or \`python -c\` could do any of these unseen, and doing so would break Saad's trust in every gate. \`aos notify "<text>"\` pushes a message to Saad's phone. Use it for what he'd want to see now and asked for: the morning report, a real milestone (a stack landed, a blocker only he can clear). Never for routine status: one a minute at most, and he reads the rest here. You can read files anywhere (Read, Grep, Glob), and write them (Write, Edit, NotebookEdit) anywhere except: a project repository or task worktree other than your own open quick changes' worktrees (start a task, or a quick change for a small edit, so the change goes through CI, review and scope), AgentOS's own state in ~/.agent-os outside your folder, secret files (.env, keys, ~/.ssh, ~/.aws, tokenvault and the like), and files that make something run: dotfiles and dot-folders at the top of your home (shell, git, Claude and tool config), ~/Library and /Library's launch agents, git's core.hooksPath folders, the folders on PATH, and any .git, .claude, .mcp.json, CLAUDE.md or AGENTS.md, which would hand you a shell or run code around the gates. Each write is checked before it runs, on the path with symlinks and \`..\` resolved; a refused one says why.
 
 ## Untrusted text
 

package/lib/orchestrator/shell-guard.ts

@@ -469,14 +469,13 @@ async function stopRefusal(
   return null;
 }
 
-const SECRET_MSG = `Refused: orchestrators never read secrets (env files, keys, credential stores, tokenvault). If a step needs one, ${T.ask_saad}.`;
+const SECRET_MSG = `Refused: orchestrators never read secrets (env files, keys, credential stores). If a step needs one, ${T.ask_saad}.`;
+
+// Orchestrators may read tokenvault's folders (and run `tv`); writing them
+// is still refused by the write guard.
+const TOKENVAULT_DIR = /(^|\/)tokenvault(\/|$)/;
 
 function secretRefusal(inv: Invocation, cwd: string): string | null {
-  if (
-    (inv.name === "tv" || inv.name === "tokenvault") &&
-    /^(get|dump)$/.test(positionals(inv.args)[0] ?? "")
-  )
-    return SECRET_MSG;
   for (const w of [...inv.args, ...inv.cmd.reads]) {
     for (const p of [
       w,
@@ -487,7 +486,12 @@ function secretRefusal(inv: Invocation, cwd: string): string | null {
         /\//.test(p) ||
         p.startsWith(".") ||
         fs.existsSync(path.resolve(cwd, p));
-      if (pathish && isSecretPath(p)) return SECRET_MSG;
+      if (
+        pathish &&
+        isSecretPath(p) &&
+        !TOKENVAULT_DIR.test(path.resolve(cwd, p))
+      )
+        return SECRET_MSG;
     }
   }
   return null;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@saadnvd1/agent-os",
-  "version": "0.3.495",
+  "version": "0.3.496",
   "description": "Self-hosted web UI for managing Claude Code sessions",
   "bin": {
     "agent-os": "scripts/agent-os"