@saadnvd1/agent-os 0.3.680 → 0.3.691

package/lib/artifacts/store.ts

@@ -54,8 +54,7 @@ export function createArtifact(
 export function getArtifact(id: string): Artifact | undefined {
   if (!ID.test(id)) return undefined;
   return db.prepare(`SELECT * FROM artifacts WHERE id = ?`).get(id) as
-    | Artifact
-    | undefined;
+    Artifact | undefined;
 }
 
 export function listArtifacts(sessionId: string): Artifact[] {

package/lib/away/report.ts

@@ -150,8 +150,7 @@ function merged(
   );
   return rows.map((r) => {
     const done = action.get(away.id, `deploy:${r.id}`) as
-      | { kind: string; detail: string | null }
-      | undefined;
+      { kind: string; detail: string | null } | undefined;
     const deploy: DeployState =
       done?.kind === "deploy_ok"
         ? "deployed"

package/lib/away/run.ts

@@ -70,8 +70,7 @@ function orchestrated(): { workspaceId: string; orchestratorId: string }[] {
 
 const sessionRow = (id: string) =>
   db.prepare(`SELECT * FROM session_rows WHERE id = ?`).get(id) as
-    | Session
-    | undefined;
+    Session | undefined;
 
 // Away mode reaches a workspace only through an orchestrator that's been
 // working inside the window: one left alone isn't told or woken.

package/lib/away/state.ts

@@ -43,8 +43,7 @@ export function activeAway(): AwayRow | null {
 export function getAway(id: number): AwayRow | null {
   return (
     (db.prepare(`SELECT * FROM away_periods WHERE id = ?`).get(id) as
-      | AwayRow
-      | undefined) ?? null
+      AwayRow | undefined) ?? null
   );
 }
 

package/lib/bookmarks/store.ts

@@ -83,8 +83,7 @@ function toBookmark(r: Joined): Bookmark {
 
 export function getBookmark(id: string): Bookmark | null {
   const r = db.prepare(`${SELECT} WHERE b.id = ?`).get(id) as
-    | Joined
-    | undefined;
+    Joined | undefined;
   return r ? toBookmark(r) : null;
 }
 

package/lib/bus/delivery.ts

@@ -7,8 +7,7 @@ import { WORKING_LINE } from "../claude-working-line";
 
 export type DeliveryState = "delivered" | "queued" | "failed";
 export type Delivery =
-  | { state: "delivered" | "queued" }
-  | { state: "failed"; why: string };
+  { state: "delivered" | "queued" } | { state: "failed"; why: string };
 
 export interface PaneView {
   text: string;

package/lib/bus/index.ts

@@ -70,8 +70,7 @@ function candidates(sessions: Session[]): Candidate[] {
 const sessionById = (id: string | null | undefined) =>
   id
     ? (db.prepare(`SELECT * FROM session_rows WHERE id = ?`).get(id) as
-        | Session
-        | undefined)
+        Session | undefined)
     : undefined;
 
 // A chat has no pane: its worker is the state, and it can always take a

package/lib/chat/compact-context.ts

@@ -31,8 +31,7 @@ export async function compactContext(sessionId: string): Promise<string> {
       `SELECT working_directory, task_prompt, role FROM session_rows WHERE id = ?`
     )
     .get(sessionId) as
-    | Pick<Session, "working_directory" | "task_prompt" | "role">
-    | undefined;
+    Pick<Session, "working_directory" | "task_prompt" | "role"> | undefined;
   // An orchestrator starts fresh instead of compacting.
   if (!session || session.role === "orchestrator") return "";
   const tools = lastItems(sessionId, 400, "tool").filter(

package/lib/chat/stop.ts

@@ -70,8 +70,7 @@ export async function stopChatAtTurnEnd(
 }
 
 export type TurnStop =
-  | { stopped: true; killed: boolean }
-  | { stopped: false; reason: string };
+  { stopped: true; killed: boolean } | { stopped: false; reason: string };
 
 export interface TurnStopOptions {
   // How long the turn gets to end after the interrupt before its agent is

package/lib/chat/worker/host.ts

@@ -551,7 +551,7 @@ export class ChatHost {
       this.compactingNow
     )
       return;
-    for (let next; (next = claimNext(this.session.id)); ) {
+    for (let next; (next = claimNext(this.session.id));) {
       this.emit({ type: "queue" });
       this.sendUser(next);
     }

package/lib/code-health/reports.ts

@@ -20,17 +20,53 @@ interface NpmVuln {
   isDirect?: boolean;
   via?: (string | { title?: string; source?: number })[];
   fixAvailable?:
-    | boolean
-    | { name?: string; version?: string; isSemVerMajor?: boolean };
+    boolean | { name?: string; version?: string; isSemVerMajor?: boolean };
+}
+
+interface PnpmAdvisory {
+  module_name?: string;
+  title?: string;
+  severity?: string;
+  patched_versions?: string | null;
+  findings?: { paths?: string[] }[];
+}
+
+// pnpm audit lists advisories, not packages: one npm-style entry per module.
+function fromAdvisories(
+  advisories: Record<string, PnpmAdvisory>
+): Record<string, NpmVuln> {
+  const out: Record<string, NpmVuln> = {};
+  for (const a of Object.values(advisories)) {
+    const name = a.module_name ?? "";
+    if (!name) continue;
+    const paths = (a.findings ?? []).flatMap((f) => f.paths ?? []);
+    const prev = out[name];
+    const rank = (v?: string) => (v === "critical" ? 2 : v === "high" ? 1 : 0);
+    out[name] = {
+      severity:
+        rank(a.severity) >= rank(prev?.severity) ? a.severity : prev?.severity,
+      isDirect:
+        Boolean(prev?.isDirect) || paths.some((p) => /^\.>[^>]+$/.test(p)),
+      via: [...(prev?.via ?? []), a.title ?? ""],
+      fixAvailable: a.patched_versions
+        ? { name, version: a.patched_versions }
+        : false,
+    };
+  }
+  return out;
 }
 
 export function summarizeNpmAudit(json: unknown): NpmAuditSummary {
   const data = (json ?? {}) as {
     metadata?: { vulnerabilities?: Record<string, number> };
     vulnerabilities?: Record<string, NpmVuln>;
+    advisories?: Record<string, PnpmAdvisory>;
   };
   const counts = { ...(data.metadata?.vulnerabilities ?? {}) };
-  const serious = Object.entries(data.vulnerabilities ?? {})
+  const vulnerabilities = data.advisories
+    ? fromAdvisories(data.advisories)
+    : (data.vulnerabilities ?? {});
+  const serious = Object.entries(vulnerabilities)
     .filter(([, v]) => v.severity === "high" || v.severity === "critical")
     .map(([name, v]) => {
       const fix = v.fixAvailable;

package/lib/code-health/source.ts

@@ -16,7 +16,7 @@ const CODE = /\.(ts|tsx|mts|cts|js|mjs|cjs|jsx)$/;
 const TEST = /(\.test\.|\.spec\.|(^|\/)__tests__\/|(^|\/)vitest\.setup\.)/;
 // Generated, vendored or built: measured by other means or not ours.
 const NOT_OURS =
-  /(^|\/)(node_modules|\.next[^/]*|dist|out|coverage|public|src-tauri)\/|\.min\.js$|(^|\/)next-env\.d\.ts$/;
+  /(^|\/)(node_modules|\.deps|\.next[^/]*|dist|out|coverage|public)\/|\.min\.js$|(^|\/)next-env\.d\.ts$/;
 
 export const isCode = (p: string) => CODE.test(p) && !NOT_OURS.test(p);
 export const isTest = (p: string) => TEST.test(p);

package/lib/db/lumifyhub.ts

@@ -24,8 +24,7 @@ export const ATTEMPT_TTL_MINUTES = 10;
 export const lumifyhubQueries = {
   getConnection: (db: Database.Database) =>
     (db.prepare(`SELECT * FROM lumifyhub_connection WHERE id = 1`).get() as
-      | LumifyHubConnection
-      | undefined) ?? null,
+      LumifyHubConnection | undefined) ?? null,
 
   saveConnection: (
     db: Database.Database,
@@ -65,8 +64,7 @@ export const lumifyhubQueries = {
            FROM lumifyhub_connect_attempts WHERE state = ?`
         )
         .get(`-${ATTEMPT_TTL_MINUTES} minutes`, state) as
-        | (LumifyHubConnectAttempt & { fresh: number })
-        | undefined;
+        (LumifyHubConnectAttempt & { fresh: number }) | undefined;
       db.prepare(`DELETE FROM lumifyhub_connect_attempts WHERE state = ?`).run(
         state
       );

package/lib/db/schedules-move.ts

@@ -200,8 +200,7 @@ export function revertSchedulesMove(db: Database.Database): {
     for (const s of moved) {
       const r = s.recipe_id
         ? (recipe.get(s.recipe_id) as
-            | { brief: string; project_id: string }
-            | undefined)
+            { brief: string; project_id: string } | undefined)
         : undefined;
       restore.run(
         s.migrated_from_kind,

package/lib/db/session-parts/tasks.ts

@@ -20,8 +20,7 @@ export function startTaskClock(
   const row = db
     .prepare(`SELECT created_at, task_since FROM session_rows WHERE id = ?`)
     .get(sessionId) as
-    | { created_at: string; task_since: string | null }
-    | undefined;
+    { created_at: string; task_since: string | null } | undefined;
   if (!row || row.task_since) return;
   setTask(db, sessionId, { task_since: at ?? row.created_at });
 }

package/lib/db/stacks.ts

@@ -1,11 +1,7 @@
 import type Database from "better-sqlite3";
 
 export type StackStatus =
-  | "running"
-  | "paused"
-  | "landing"
-  | "landed"
-  | "failed";
+  "running" | "paused" | "landing" | "landed" | "failed";
 
 export type StackItemStatus =
   | "planned"
@@ -131,8 +127,7 @@ export const stackQueries = {
 
   get: (db: Database.Database, id: string) =>
     (db.prepare(`SELECT * FROM stacks WHERE id = ?`).get(id) as
-      | StackRow
-      | undefined) ?? null,
+      StackRow | undefined) ?? null,
 
   // The board's stack that has not finished yet, if any.
   openForBoard: (db: Database.Database, boardId: string) =>
@@ -150,8 +145,7 @@ export const stackQueries = {
 
   item: (db: Database.Database, id: string) =>
     (db.prepare(`SELECT * FROM stack_items WHERE id = ?`).get(id) as
-      | StackItemRow
-      | undefined) ?? null,
+      StackItemRow | undefined) ?? null,
 
   itemForSession: (db: Database.Database, sessionId: string) =>
     (db

package/lib/db/types.ts

@@ -42,13 +42,7 @@ export interface Session {
   // done: finished without a merge (no PR, or its PR closed).
   // moving: handing it to another machine (moved_to); moved: handed over.
   task_status:
-    | "running"
-    | "merged"
-    | "dropped"
-    | "done"
-    | "moving"
-    | "moved"
-    | null;
+    "running" | "merged" | "dropped" | "done" | "moving" | "moved" | null;
   moved_to: string | null;
   // The session on another machine this task arrived from.
   moved_from: string | null;

package/lib/dev-instance/spawnServer.ts

@@ -20,12 +20,16 @@ export function spawnServer(opts: {
 }): ChildProcess {
   const { repo, port, env, stdio, detached, native } = opts;
   assertNotLivePort(port, process.env, readLiveRecord());
-  const run = (script: string) =>
-    execFileSync(process.execPath, [path.join(repo, "scripts", script)], {
-      cwd: repo,
-      stdio: "ignore",
-    });
-  if (native) run("ensure-native.mjs");
+  const run = (script: string, ...args: string[]) =>
+    execFileSync(
+      process.execPath,
+      [path.join(repo, "scripts", script), ...args],
+      {
+        cwd: repo,
+        stdio: "ignore",
+      }
+    );
+  if (native) run("check-native.mjs", "--rebuild");
   run("gen-migrations-index.mjs");
   return spawn(process.execPath, ["--import", "tsx", "server.ts"], {
     cwd: repo,

package/lib/doctor/checks.ts

@@ -11,7 +11,7 @@ import { getAllProviderDefinitions } from "../providers/registry";
 
 // The oldest Node major AgentOS runs on; scripts/lib/prerequisites.sh must agree
 // (lib/doctor/drift.test.ts fails when they don't).
-export const MIN_NODE_MAJOR = 20;
+export const MIN_NODE_MAJOR = 22;
 
 const TOOL_MS = 5_000;
 const CACHE_MS = 60 * 1000;
@@ -207,15 +207,13 @@ export function runDoctor(
     d
       .probe(fresh)
       .then(checkAgents)
-      .catch(
-        (): DoctorCheck => ({
-          id: "agents",
-          label: "Agent CLI",
-          status: "warn",
-          detail: "Couldn't check the agent CLIs",
-          fix: "Check again",
-        })
-      ),
+      .catch((): DoctorCheck => ({
+        id: "agents",
+        label: "Agent CLI",
+        status: "warn",
+        detail: "Couldn't check the agent CLIs",
+        fix: "Check again",
+      })),
   ]);
   if (!custom) cache = { at: Date.now(), checks };
   return checks;

package/lib/done/archive.ts

@@ -35,8 +35,7 @@ export function unarchiveSession(id: string): Session {
     )
     .run(id).changes;
   const row = db.prepare(`SELECT * FROM session_rows WHERE id = ?`).get(id) as
-    | Session
-    | undefined;
+    Session | undefined;
   if (!row) throw new Error("Session not found");
   if (!changed) throw new Error(`${row.name} isn't archived`);
   return row;

package/lib/env-setup.ts

@@ -22,6 +22,8 @@ export interface SetupStep {
   success: boolean;
   output?: string;
   error?: string;
+  // The step worked, but the agent should know something about it.
+  warning?: string;
 }
 
 // The stages a worktree's setup goes through, in order, for progress.

package/lib/experiments/meter.ts

@@ -18,13 +18,7 @@ import { experimentOn } from ".";
 import { getExperiment, type ExperimentId } from "./registry";
 
 export type ExperimentEvent =
-  | "model"
-  | "script"
-  | "shown"
-  | "accepted"
-  | "dismissed"
-  | "applied"
-  | "error";
+  "model" | "script" | "shown" | "accepted" | "dismissed" | "applied" | "error";
 
 export interface MeterContext {
   trigger: string;

package/lib/files.ts

@@ -17,6 +17,7 @@ const DEFAULT_EXCLUDES = [
   "node_modules",
   ".git",
   ".next",
+  ".deps",
   "dist",
   "build",
   "out",

package/lib/health/env/classes.ts

@@ -7,8 +7,6 @@
 
 import type { EnvClass } from "./types";
 
-const OLD_PYTHON =
-  /python3?\.[0-9]\b|Python3?\.framework\/Versions\/3\.[0-9]\b|Python\/3\.[0-9]\b/i;
 const USE_ENV =
   "run it through the repo's own environment (`uv run …` when it has a pyproject.toml or uv.lock, else its .venv/bin/python), not a bare `python3`";
 

package/lib/health/env/recordHit.ts

@@ -19,8 +19,7 @@ export function recordHit(
        WHERE r.id = ?`
     )
     .get(sessionId) as
-    | { project_id: string | null; ws: string | null }
-    | undefined;
+    { project_id: string | null; ws: string | null } | undefined;
   db.prepare(
     `INSERT INTO env_failures
        (session_id, class, project_id, workspace_id, command, line,

package/lib/health/spin.ts

@@ -45,10 +45,7 @@ export interface SpinSample {
 }
 
 export type SpinClass =
-  | "warming"
-  | "sleeping"
-  | "busy-with-output"
-  | "spinning";
+  "warming" | "sleeping" | "busy-with-output" | "spinning";
 
 export function classifySpin(samples: SpinSample[]): SpinClass {
   if (samples.length < 2) return "warming";

package/lib/health/store.ts

@@ -29,8 +29,7 @@ export interface RecordResult {
 
 const rowOf = (id: number) =>
   db.prepare(`SELECT * FROM health_anomalies WHERE id = ?`).get(id) as
-    | AnomalyRow
-    | undefined;
+    AnomalyRow | undefined;
 
 export function anomaly(id: number): AnomalyRow | null {
   return rowOf(id) ?? null;

package/lib/hosts/index.ts

@@ -39,8 +39,7 @@ export function getHost(hostId: string | null | undefined): Host | null {
   if (!isRemoteHost(hostId)) return LOCAL_HOST;
   return (
     (getDb().prepare(`SELECT * FROM hosts WHERE id = ?`).get(hostId) as
-      | Host
-      | undefined) ?? null
+      Host | undefined) ?? null
   );
 }
 

package/lib/hosts/peer-sync.ts

@@ -95,8 +95,7 @@ export function syncPeerMirrors(
     const [name, view, tmuxName, projectId, prUrl, prNumber, prStatus, at] =
       fields;
     const cur = current.get(peer.id, hostId) as
-      | Record<string, string | number | null>
-      | undefined;
+      Record<string, string | number | null> | undefined;
     if (!cur) return;
     const same =
       cur.name === name &&
@@ -126,8 +125,7 @@ export function syncPeerMirrors(
   db.transaction(() => {
     for (const peer of listed) {
       const row = owner.get(peer.id) as
-        | { host_id: string; project_id: string | null }
-        | undefined;
+        { host_id: string; project_id: string | null } | undefined;
       // One started here for a project here keeps it (lib/hosts/peer-actions.ts).
       const kept =
         row?.project_id && here.has(row.project_id) ? row.project_id : null;

package/lib/hosts/remote-api.ts

@@ -21,8 +21,7 @@ export function hostLink(hostId: string | null | undefined): HostLink | null {
          JOIN hosts h ON h.id = l.host_id WHERE l.host_id = ?`
     )
     .get(hostId) as
-    | { host_id: string; url: string; token: string; name: string }
-    | undefined;
+    { host_id: string; url: string; token: string; name: string } | undefined;
   return row
     ? {
         hostId: row.host_id,

package/lib/lumifyhub/types.ts

@@ -23,11 +23,7 @@ export interface LhBoard {
 }
 
 export type LhListCategory =
-  | "backlog"
-  | "unstarted"
-  | "started"
-  | "completed"
-  | "canceled";
+  "backlog" | "unstarted" | "started" | "completed" | "canceled";
 
 export interface LhList {
   id: string;
@@ -39,9 +35,7 @@ export interface LhList {
 
 // A TipTap/ProseMirror document, or a bare string on older cards.
 export type LhRichText =
-  | string
-  | { type?: string; text?: string; content?: LhRichText[] }
-  | null;
+  string | { type?: string; text?: string; content?: LhRichText[] } | null;
 
 export interface LhCard {
   id: string;

package/lib/notify/index.ts

@@ -161,8 +161,7 @@ export async function notifyFrom(
 ): Promise<Outcome> {
   const session = from
     ? (db.prepare(`SELECT * FROM session_rows WHERE id = ?`).get(from) as
-        | Session
-        | undefined)
+        Session | undefined)
     : undefined;
   if (from && !session) throw new Error("Unknown sender session");
   const body = text.trim();

package/lib/notify/push/index.ts

@@ -39,11 +39,7 @@ export function pushStatus(): { linked: boolean; unavailable: string | null } {
 }
 
 export type PushOutcome =
-  | "queued"
-  | "folded"
-  | "dropped"
-  | "muted"
-  | "unavailable";
+  "queued" | "folded" | "dropped" | "muted" | "unavailable";
 
 export interface PushOptions {
   /** Held text that goes by Telegram if no phone is reached. */
@@ -59,8 +55,7 @@ function isMirrored(sessionId: string): boolean {
   const s = db
     .prepare(`SELECT host_id, peer_mirror FROM session_rows WHERE id = ?`)
     .get(sessionId) as
-    | { host_id: string | null; peer_mirror: number | null }
-    | undefined;
+    { host_id: string | null; peer_mirror: number | null } | undefined;
   return !!s && (!!s.peer_mirror || (!!s.host_id && s.host_id !== "local"));
 }
 

package/lib/orchestrator/brief.ts

@@ -164,7 +164,7 @@ Acting:
 
 The MCP servers this workspace allows (Settings → Workspaces) are yours to use through their own tools, for reading and for additive, reversible changes. Anything outbound through them (sending a message, an email, a post) is a hard line: park it with \`ask_saad\`.
 
-Act through these tools, not the shell: they're scoped to this workspace and braked. ${full ? `The shell and your file writes are unchecked (Saad's decision, 2026-10-18: Orchestrator full access, switched in Settings → Workspaces): \`git push\`, \`gh pr merge\`, commits, \`stash\`, \`clean\`, edits in any project checkout or task worktree, AgentOS's own state, dotfiles, launch agents, .claude, CLAUDE.md, .mcp.json, hooks, \`sqlite3\` writes, \`aos sweep --arm\`, other workspaces' repositories. Use that to fix things directly instead of starting a task for every small job, but still prefer the tools for what they cover (they're scoped to this workspace and logged), and never use the shell to get around a hard line. One warning stays: never stop or restart AgentOS or its tmux; that ends every session it runs, this one included. If AgentOS itself needs a restart, \`ask_saad\`. Reading a secret file is allowed; its value is never printed, logged or sent off the machine. ` : `The shell runs anything without asking (Saad chose this on 2026-10-11), so use it to read and investigate yourself: \`gh pr list\`, \`gh run view --log-failed\`, \`gh api\` GETs, \`curl\`, \`sqlite3 -readonly\`, git in any repository, a skill's scripts, pipes and chains. Never use it to get around the tools. A deny list refuses, naming the tool to use instead: merging, closing or retargeting a PR (\`${TOOL_NAMES.sign_off}\`, \`${TOOL_NAMES.arm}\`, \`${TOOL_NAMES.land}\`, \`${TOOL_NAMES.drop}\`), \`git push\` (\`${TOOL_NAMES.quick_pr}\`), writing in a project repository or task worktree other than your own quick changes, except in a project checkout of your own workspace, where you may update and move the branch: \`git pull\` in any form, \`merge\`, \`reset\` (even \`--hard\`), \`checkout\`, \`switch\` and \`rebase\` (also as \`git -C <path>\`), then \`bundle install\`, \`npm install\` or \`bin/rails db:prepare\`. Commits, \`stash\`, \`clean\`, \`restore\` and file edits there still go through tasks and quick changes, and other workspaces' repositories, task worktrees and AgentOS's own live checkout (autodeploy deploys it) are refused for all of it are refused (\`${TOOL_NAMES.start_task}\`, \`${TOOL_NAMES.quick_change}\`), writing AgentOS's state (sqlite3 without \`-readonly\`, or files in ~/.agent-os outside your folder), stopping or restarting AgentOS or its tmux, and reading secret files (env files, keys, ~/.ssh, ~/.aws). `}Tokenvault is available through \`tv\`: use a token inside the command that needs it (e.g. \`FOO="\$(tv get <project> <desc>)" cmd\`), never print, echo or log a value, and never send one off the machine except to the service it's for. ${full ? `` : `The list catches honest mistakes, not a determined bypass: a script or \`python -c\` could do any of these unseen, and doing so would break Saad's trust in every gate. `}\`aos notify "<text>"\` pushes a message to Saad's phone. Use it for what he'd want to see now and asked for: the morning report, a real milestone (a stack landed, a blocker only he can clear). Never for routine status: one a minute at most, and he reads the rest here. ${full ? `You can read and write files anywhere (Read, Grep, Glob, Write, Edit, NotebookEdit); nothing is checked.` : `You can read files anywhere (Read, Grep, Glob), and write them (Write, Edit, NotebookEdit) anywhere except: a project repository or task worktree other than your own open quick changes' worktrees (start a task, or a quick change for a small edit, so the change goes through CI, review and scope), AgentOS's own state in ~/.agent-os outside your folder, secret files (.env, keys, ~/.ssh, ~/.aws, tokenvault and the like), and files that make something run: dotfiles and dot-folders at the top of your home (shell, git, Claude and tool config), ~/Library and /Library's launch agents, git's core.hooksPath folders, the folders on PATH, and any .git, .claude, .mcp.json, CLAUDE.md or AGENTS.md, which would hand you a shell or run code around the gates. Each write is checked before it runs, on the path with symlinks and \`..\` resolved; a refused one says why.`}
+Act through these tools, not the shell: they're scoped to this workspace and braked. ${full ? `The shell and your file writes are unchecked (Saad's decision, 2026-10-18: Orchestrator full access, switched in Settings → Workspaces): \`git push\`, \`gh pr merge\`, commits, \`stash\`, \`clean\`, edits in any project checkout or task worktree, AgentOS's own state, dotfiles, launch agents, .claude, CLAUDE.md, .mcp.json, hooks, \`sqlite3\` writes, \`aos sweep --arm\`, other workspaces' repositories. Use that to fix things directly instead of starting a task for every small job, but still prefer the tools for what they cover (they're scoped to this workspace and logged), and never use the shell to get around a hard line. One warning stays: never stop or restart AgentOS or its tmux; that ends every session it runs, this one included. If AgentOS itself needs a restart, \`ask_saad\`. Reading a secret file is allowed; its value is never printed, logged or sent off the machine. ` : `The shell runs anything without asking (Saad chose this on 2026-10-11), so use it to read and investigate yourself: \`gh pr list\`, \`gh run view --log-failed\`, \`gh api\` GETs, \`curl\`, \`sqlite3 -readonly\`, git in any repository, a skill's scripts, pipes and chains. Never use it to get around the tools. A deny list refuses, naming the tool to use instead: merging, closing or retargeting a PR (\`${TOOL_NAMES.sign_off}\`, \`${TOOL_NAMES.arm}\`, \`${TOOL_NAMES.land}\`, \`${TOOL_NAMES.drop}\`), \`git push\` (\`${TOOL_NAMES.quick_pr}\`), writing in a project repository or task worktree other than your own quick changes, except in a project checkout of your own workspace, where you may update and move the branch: \`git pull\` in any form, \`merge\`, \`reset\` (even \`--hard\`), \`checkout\`, \`switch\` and \`rebase\` (also as \`git -C <path>\`), then \`bundle install\`, \`npm install\`, \`pnpm install\` or \`bin/rails db:prepare\`. Commits, \`stash\`, \`clean\`, \`restore\` and file edits there still go through tasks and quick changes, and other workspaces' repositories, task worktrees and AgentOS's own live checkout (autodeploy deploys it) are refused for all of it are refused (\`${TOOL_NAMES.start_task}\`, \`${TOOL_NAMES.quick_change}\`), writing AgentOS's state (sqlite3 without \`-readonly\`, or files in ~/.agent-os outside your folder), stopping or restarting AgentOS or its tmux, and reading secret files (env files, keys, ~/.ssh, ~/.aws). `}Tokenvault is available through \`tv\`: use a token inside the command that needs it (e.g. \`FOO="\$(tv get <project> <desc>)" cmd\`), never print, echo or log a value, and never send one off the machine except to the service it's for. ${full ? `` : `The list catches honest mistakes, not a determined bypass: a script or \`python -c\` could do any of these unseen, and doing so would break Saad's trust in every gate. `}\`aos notify "<text>"\` pushes a message to Saad's phone. Use it for what he'd want to see now and asked for: the morning report, a real milestone (a stack landed, a blocker only he can clear). Never for routine status: one a minute at most, and he reads the rest here. ${full ? `You can read and write files anywhere (Read, Grep, Glob, Write, Edit, NotebookEdit); nothing is checked.` : `You can read files anywhere (Read, Grep, Glob), and write them (Write, Edit, NotebookEdit) anywhere except: a project repository or task worktree other than your own open quick changes' worktrees (start a task, or a quick change for a small edit, so the change goes through CI, review and scope), AgentOS's own state in ~/.agent-os outside your folder, secret files (.env, keys, ~/.ssh, ~/.aws, tokenvault and the like), and files that make something run: dotfiles and dot-folders at the top of your home (shell, git, Claude and tool config), ~/Library and /Library's launch agents, git's core.hooksPath folders, the folders on PATH, and any .git, .claude, .mcp.json, CLAUDE.md or AGENTS.md, which would hand you a shell or run code around the gates. Each write is checked before it runs, on the path with symlinks and \`..\` resolved; a refused one says why.`}
 
 ## Untrusted text
 

package/lib/orchestrator/external-pr.ts

@@ -59,8 +59,7 @@ export interface ExternalPR {
 type WorkspaceTask = Session & { project_name: string };
 
 export type GateTarget =
-  | { kind: "task"; task: WorkspaceTask }
-  | { kind: "external"; pr: ExternalPR };
+  { kind: "task"; task: WorkspaceTask } | { kind: "external"; pr: ExternalPR };
 
 const FIELDS =
   "number,url,state,headRefOid,headRefName,baseRefName,isDraft,labels,isCrossRepository,statusCheckRollup,body,title,mergeable";

package/lib/orchestrator/gates.ts

@@ -19,12 +19,7 @@ import { untrusted } from "./untrusted";
 import { markStatusDirty } from "../status/dirty";
 
 export type GateName =
-  | "ci"
-  | "review"
-  | "code-review"
-  | "blocked"
-  | "scope"
-  | "stack";
+  "ci" | "review" | "code-review" | "blocked" | "scope" | "stack";
 
 export interface GateOutcome {
   gate: GateName;

package/lib/orchestrator/needs-you-items.ts

@@ -72,26 +72,22 @@ export function needsYouItems(input: {
 }): NeedsYouItem[] {
   const hidden = new Set(input.dismissed);
   const items: NeedsYouItem[] = [
-    ...input.asks.map(
-      (ask): NeedsYouItem => ({
-        key: `ask:${ask.id}`,
-        kind: "ask",
-        title: ask.title,
-        sub: ask.kind,
-        at: sqliteMs(ask.createdAt),
-        ask,
-      })
-    ),
-    ...input.questions.map(
-      (question): NeedsYouItem => ({
-        key: `question:${question.id}`,
-        kind: "question",
-        title: question.text,
-        sub: question.taskName ?? "Question",
-        at: sqliteMs(question.createdAt),
-        question,
-      })
-    ),
+    ...input.asks.map((ask): NeedsYouItem => ({
+      key: `ask:${ask.id}`,
+      kind: "ask",
+      title: ask.title,
+      sub: ask.kind,
+      at: sqliteMs(ask.createdAt),
+      ask,
+    })),
+    ...input.questions.map((question): NeedsYouItem => ({
+      key: `question:${question.id}`,
+      kind: "question",
+      title: question.text,
+      sub: question.taskName ?? "Question",
+      at: sqliteMs(question.createdAt),
+      question,
+    })),
   ];
   for (const card of input.cards ?? [])
     items.push({

package/lib/orchestrator/pr-wake.ts

@@ -95,8 +95,7 @@ const failures = new Map<string, number>();
 
 const sessionRow = (id: string) =>
   db.prepare(`SELECT * FROM session_rows WHERE id = ?`).get(id) as
-    | Session
-    | undefined;
+    Session | undefined;
 
 // True when this call took the key; false when it was taken before.
 const claim = (task: string, key: string, kind: string) =>

package/lib/orchestrator/rebase.ts

@@ -74,8 +74,7 @@ const tried = new Map<string, string>();
 
 const sessionRow = (id: string) =>
   db.prepare(`SELECT * FROM session_rows WHERE id = ?`).get(id) as
-    | Session
-    | undefined;
+    Session | undefined;
 
 // Every open task PR in the workspace that conflicts with its base.
 export async function rebaseConflicting(