@sayknow-cli/coding-agent 0.4.7 → 0.5.0

package/src/task/ultragoal-redteam-activation.ts

@@ -0,0 +1,75 @@
+/**
+ * Decide whether an executor assignment should inject the ultragoal red-team
+ * prompt fragment.
+ *
+ * Preference order (parse, don't re-validate later):
+ * 1. Explicit typed `executionMode` on the task / ExecutorOptions — authoritative.
+ * 2. Assignment text heuristics — only explicit Ultragoal QA/red-team phrasing.
+ *
+ * Bare mentions of `executorQa` (docs, quality-gate field names, negative
+ * instructions) must not flip the mode (#2698 / #2456).
+ *
+ * Mirrors `executor.md`:
+ * "activates only when the assignment explicitly labels Executor as Ultragoal
+ * completion QA/red-team or asks for `executorQa` red-team evidence."
+ */
+
+export const EXECUTOR_EXECUTION_MODES = ["default", "ultragoal-red-team"] as const;
+export type ExecutorExecutionMode = (typeof EXECUTOR_EXECUTION_MODES)[number];
+
+const ULTRAGOAL_COMPLETION_QA = /\bultragoal\s+completion\s+(?:qa|red[-\s]?team)\b/i;
+
+/** `executorQa` within a short window of red-team / matrix / evidence framing. */
+const EXECUTOR_QA_EVIDENCE =
+	/\bexecutorQa\b[\s\S]{0,120}\b(?:red[-\s]?team|matrix|evidence)\b|\b(?:red[-\s]?team|matrix|evidence)\b[\s\S]{0,120}\bexecutorQa\b/i;
+
+/** Common Ultragoal skill spawn phrasing: "executor QA/red-team lane". */
+const EXECUTOR_QA_LANE = /\bexecutor\b[\s\S]{0,48}\b(?:qa|red[-\s]?team)\s+lane\b/i;
+
+export function isExecutorExecutionMode(value: unknown): value is ExecutorExecutionMode {
+	return value === "default" || value === "ultragoal-red-team";
+}
+
+/**
+ * Parse a caller-supplied mode. Unknown values fail closed to `undefined`
+ * so the assignment heuristic (or default off) still applies — never invent on.
+ */
+export function parseExecutorExecutionMode(value: unknown): ExecutorExecutionMode | undefined {
+	if (typeof value !== "string") return undefined;
+	const normalized = value.trim().toLowerCase().replaceAll("_", "-");
+	if (normalized === "default" || normalized === "ordinary" || normalized === "implement") {
+		return "default";
+	}
+	if (
+		normalized === "ultragoal-red-team" ||
+		normalized === "ultragoal-redteam" ||
+		normalized === "red-team" ||
+		normalized === "redteam" ||
+		normalized === "executor-qa"
+	) {
+		return "ultragoal-red-team";
+	}
+	return undefined;
+}
+
+export function assignmentRequestsUltragoalRedTeam(assignment: string | undefined): boolean {
+	const text = assignment?.trim() ?? "";
+	if (text.length === 0) return false;
+	return ULTRAGOAL_COMPLETION_QA.test(text) || EXECUTOR_QA_EVIDENCE.test(text) || EXECUTOR_QA_LANE.test(text);
+}
+
+export interface ResolveUltragoalRedTeamArgs {
+	readonly executionMode?: unknown;
+	readonly assignment?: string;
+}
+
+/**
+ * Final activation decision for the executor prompt fragment.
+ * Typed mode wins; assignment text is a compatibility fallback only.
+ */
+export function resolveUltragoalRedTeamActivation(args: ResolveUltragoalRedTeamArgs): boolean {
+	const mode = parseExecutorExecutionMode(args.executionMode);
+	if (mode === "ultragoal-red-team") return true;
+	if (mode === "default") return false;
+	return assignmentRequestsUltragoalRedTeam(args.assignment);
+}

package/src/tools/ask.ts

@@ -553,7 +553,7 @@ export class AskTool implements AgentTool<typeof askSchema, AskToolDetails> {
 	): Promise<AgentToolResult<AskToolDetails>> {
 		await assertUltragoalAskAllowed(this.session.cwd);
 		const gateEmitter = this.session.getWorkflowGateEmitter?.();
-		const canUseWorkflowGate = gateEmitter?.isUnattended() === true;
+		const canUseWorkflowGate = !context?.hasUI && gateEmitter?.supportsRemoteGateAnswers() === true;
 
 		// Headless fallback: unattended workflow gates are the non-TUI answer path.
 		if (!canUseWorkflowGate && (!context?.hasUI || !context.ui)) {

package/src/tools/ast-edit.ts

@@ -3,7 +3,7 @@ import type { AgentTool, AgentToolContext, AgentToolResult, AgentToolUpdateCallb
 import { type AstReplaceChange, type AstReplaceFileChange, astEdit } from "@sayknow-cli/natives";
 import type { Component } from "@sayknow-cli/tui";
 import { Text } from "@sayknow-cli/tui";
-import { $envpos, prompt, untilAborted } from "@sayknow-cli/utils";
+import { $pickenvpos, prompt, untilAborted } from "@sayknow-cli/utils";
 import * as z from "zod/v4";
 import type { RenderResultOptions } from "../extensibility/custom-tools/types";
 import { computeLineHash, HL_BODY_SEP } from "../hashline/hash";
@@ -199,7 +199,7 @@ export class AstEditTool implements AgentTool<typeof astEditSchema, AstEditToolD
 				seenPatterns.add(pat);
 			}
 			const normalizedRewrites = Object.fromEntries(ops);
-			const maxFiles = $envpos("PI_MAX_AST_FILES", 1000);
+			const maxFiles = $pickenvpos(["SKC_MAX_AST_FILES", "PI_MAX_AST_FILES"], 1000);
 
 			const scope = await resolveToolSearchScope({
 				rawPaths: params.paths,

package/src/tools/bash-allowed-prefixes.ts

@@ -18,7 +18,14 @@ export interface BashRestrictionOptions {
 }
 
 const SHELL_CONTROL_CHARS = new Set([";", "|", "&", "<", ">", "(", ")"]);
-const UNSAFE_UNQUOTED_EXPANSION_CHARS = new Set(["$", "*", "?", "[", "]", "{", "}", "~"]);
+// `~` is handled separately: bash performs tilde expansion only at positions where a
+// tilde can open an expansion - the start of a word, and inside an assignment word
+// directly after the first `=` or after a `:` in the assigned value. A tilde anywhere
+// else (e.g. the git revision `HEAD~1`) is a literal character.
+const UNSAFE_UNQUOTED_EXPANSION_CHARS = new Set(["$", "*", "?", "[", "]", "{", "}"]);
+// A bash assignment word has a plain assignment name before its first unquoted `=`,
+// in either the `name=value` or the compound `name+=value` form.
+const ASSIGNMENT_NAME_PATTERN = /^[A-Za-z_][A-Za-z0-9_]*\+?$/u;
 const ALLOWED_STATE_ACTIONS = new Set(["read", "write", "contract"]);
 const CANONICAL_STATE_TARGETS = new Set<string>(CANONICAL_SKC_WORKFLOW_SKILLS);
 const READ_ONLY_COMMANDS = new Set(["grep", "rg", "tree", "ls", "pwd", "wc", "du", "file", "stat"]);
@@ -29,6 +36,14 @@ function parseShellWords(command: string): { words: string[]; reason?: string }
 	let quote: "single" | "double" | null = null;
 
 	let wordStarted = false;
+	// Per-token tilde-expansion state. `assignmentNameCandidate` stays true while the
+	// characters before the first unquoted `=` could still form an assignment name (any
+	// quoting in that region disqualifies the token), `sawAssignmentEquals` records that
+	// the token is an assignment word, and `tildeExpandable` means an unquoted `~` at the
+	// current index would actually be expanded by bash.
+	let assignmentNameCandidate = true;
+	let sawAssignmentEquals = false;
+	let tildeExpandable = false;
 	for (let index = 0; index < command.length; index += 1) {
 		const char = command[index]!;
 		const next = command[index + 1];
@@ -63,11 +78,15 @@ function parseShellWords(command: string): { words: string[]; reason?: string }
 		if (char === "'") {
 			quote = "single";
 			wordStarted = true;
+			if (!sawAssignmentEquals) assignmentNameCandidate = false;
+			tildeExpandable = false;
 			continue;
 		}
 		if (char === '"') {
 			quote = "double";
 			wordStarted = true;
+			if (!sawAssignmentEquals) assignmentNameCandidate = false;
+			tildeExpandable = false;
 			continue;
 		}
 		if (char === "`" || (char === "$" && next === "(")) {
@@ -82,17 +101,42 @@ function parseShellWords(command: string): { words: string[]; reason?: string }
 		if (UNSAFE_UNQUOTED_EXPANSION_CHARS.has(char)) {
 			return { words, reason: `shell expansion character '${char}' is not allowed in restricted bash commands` };
 		}
+		// Tilde expansion is positional: bash expands a tilde only where one can open an
+		// expansion, i.e. at the start of a word or, inside an assignment word, directly
+		// after the first `=` or after a `:` in the assigned value. A tilde anywhere else
+		// is literal, which is what git revision syntax such as `HEAD~1` relies on.
+		if (char === "~" && (!wordStarted || tildeExpandable)) {
+			return { words, reason: "shell expansion character '~' is not allowed in restricted bash commands" };
+		}
 		if (/\s/u.test(char)) {
 			if (wordStarted) {
 				words.push(current);
 				current = "";
 				wordStarted = false;
 			}
+			assignmentNameCandidate = true;
+			sawAssignmentEquals = false;
+			tildeExpandable = false;
 			continue;
 		}
 		if (char === "\\") {
 			return { words, reason: "backslash escapes are not allowed in restricted bash commands" };
 		}
+		if (char === "=" && !sawAssignmentEquals) {
+			// Only a plain assignment name before the first unquoted `=` makes this an
+			// assignment word whose value bash scans for tilde expansions.
+			if (assignmentNameCandidate && ASSIGNMENT_NAME_PATTERN.test(current)) {
+				sawAssignmentEquals = true;
+				tildeExpandable = true;
+			} else {
+				assignmentNameCandidate = false;
+				tildeExpandable = false;
+			}
+		} else if (char === ":" && sawAssignmentEquals) {
+			tildeExpandable = true;
+		} else {
+			tildeExpandable = false;
+		}
 		current += char;
 		wordStarted = true;
 	}

package/src/tools/bash-pty-selection.ts

@@ -1,4 +1,4 @@
-import { $env } from "@sayknow-cli/utils/env";
+import { $pickenv } from "@sayknow-cli/utils/env";
 
 /** Minimal UI-capability fields needed to decide whether bash can use the local PTY overlay. */
 export interface BashPtyContext {
@@ -9,6 +9,6 @@ export interface BashPtyContext {
 /** Return whether a bash tool call should use the local interactive PTY overlay. */
 export function canUseInteractiveBashPty(pty: boolean, ctx: BashPtyContext | undefined): boolean {
 	if (!pty) return false;
-	if ($env.PI_NO_PTY === "1") return false;
+	if ($pickenv("SKC_NO_PTY", "PI_NO_PTY") === "1") return false;
 	return ctx?.hasUI === true && ctx.ui !== undefined;
 }

package/src/tools/browser/launch.ts

@@ -3,6 +3,7 @@ import * as os from "node:os";
 import * as path from "node:path";
 import * as browsers from "@puppeteer/browsers";
 import { getPuppeteerDir } from "@sayknow-cli/utils/dirs";
+import { $credentialEnv } from "@sayknow-cli/utils/env";
 import * as logger from "@sayknow-cli/utils/logger";
 import { $which } from "@sayknow-cli/utils/which";
 import type { Browser, CDPSession, Page, default as Puppeteer, Target } from "puppeteer-core";
@@ -80,6 +81,42 @@ export async function loadPuppeteerInWorker(safeDir: string): Promise<typeof Pup
 	}
 }
 
+/**
+ * Browser launch overrides resolved from trusted environment sources only.
+ *
+ * These choose the browser binary and route/verify its traffic, so whatever can
+ * set them controls what runs and who sees the session. `$env` merges the
+ * caller's `cwd/.env` into `process.env`, so reading them directly would let
+ * repository content pick the executable, point every request at an attacker's
+ * proxy, or disable certificate validation. Resolve them the same way provider
+ * credentials are: launching shell plus SKC/user-owned `.env` files, never the
+ * project `.env`.
+ */
+function trustedBrowserEnv(name: string): string | undefined {
+	return $credentialEnv(name);
+}
+
+/** Boolean-like trusted browser env knob (`true`/`1`/`yes`/`on`). */
+function browserLaunchFlagEnabled(name: string): boolean {
+	const value = trustedBrowserEnv(name)?.toLowerCase();
+	return value === "true" || value === "1" || value === "yes" || value === "on";
+}
+
+/** Test seam: the browser launch overrides as resolved from trusted env. */
+export function resolveBrowserEnvOverridesForTest(): {
+	executablePath: string | undefined;
+	proxy: string | undefined;
+	proxyBypassLoopback: boolean;
+	ignoreCertErrors: boolean;
+} {
+	return {
+		executablePath: trustedBrowserEnv("PUPPETEER_EXECUTABLE_PATH"),
+		proxy: trustedBrowserEnv("PUPPETEER_PROXY"),
+		proxyBypassLoopback: browserLaunchFlagEnabled("PUPPETEER_PROXY_BYPASS_LOOPBACK"),
+		ignoreCertErrors: browserLaunchFlagEnabled("PUPPETEER_PROXY_IGNORE_CERT_ERRORS"),
+	};
+}
+
 /**
  * Lazily download Chromium on first browser launch via @puppeteer/browsers.
  * Skipped when a system Chromium (NixOS) or PUPPETEER_EXECUTABLE_PATH is set.
@@ -89,7 +126,7 @@ let chromiumExecutablePromise: Promise<string | undefined> | undefined;
 async function ensureChromiumExecutable(): Promise<string | undefined> {
 	const sysChrome = resolveSystemChromium();
 	if (sysChrome) return sysChrome;
-	const envPath = process.env.PUPPETEER_EXECUTABLE_PATH;
+	const envPath = trustedBrowserEnv("PUPPETEER_EXECUTABLE_PATH");
 	if (envPath) return envPath;
 	if (chromiumExecutablePromise) return chromiumExecutablePromise;
 
@@ -272,13 +309,12 @@ export async function launchHeadlessBrowser(opts: LaunchHeadlessOptions): Promis
 		// Isolated copy only (caller guarantees). Never point this at a live profile.
 		launchArgs.push(`--user-data-dir=${opts.profileWarmupDir}`);
 	}
-	const proxy = process.env.PUPPETEER_PROXY;
+	const proxy = trustedBrowserEnv("PUPPETEER_PROXY");
 	if (proxy) {
 		launchArgs.push(`--proxy-server=${proxy}`);
 		// Chrome (since v72) bypasses proxies for localhost by default. When PUPPETEER_PROXY_BYPASS_LOOPBACK
 		// is true, add <-loopback> so traffic to localhost reaches the proxy (e.g. for mitmdump/auth capture).
-		const bypassLoopback = process.env.PUPPETEER_PROXY_BYPASS_LOOPBACK?.toLowerCase();
-		if (bypassLoopback === "true" || bypassLoopback === "1" || bypassLoopback === "yes" || bypassLoopback === "on") {
+		if (browserLaunchFlagEnabled("PUPPETEER_PROXY_BYPASS_LOOPBACK")) {
 			launchArgs.push("--proxy-bypass-list=<-loopback>");
 		}
 	}
@@ -287,8 +323,7 @@ export async function launchHeadlessBrowser(opts: LaunchHeadlessOptions): Promis
 	if (opts.geo?.locale) {
 		launchArgs.push(`--lang=${opts.geo.locale}`);
 	}
-	const ignoreCert = process.env.PUPPETEER_PROXY_IGNORE_CERT_ERRORS?.toLowerCase();
-	if (ignoreCert === "true" || ignoreCert === "1" || ignoreCert === "yes" || ignoreCert === "on") {
+	if (browserLaunchFlagEnabled("PUPPETEER_PROXY_IGNORE_CERT_ERRORS")) {
 		launchArgs.push("--ignore-certificate-errors");
 	}
 	const launchEnv = opts.geo?.timezone ? { ...process.env, TZ: opts.geo.timezone } : undefined;

package/src/tools/browser/screenshot-format.ts

@@ -1,10 +1,15 @@
 import * as os from "node:os";
+import * as path from "node:path";
 
 import { formatDimensionNote, type ResizedImage } from "../../utils/image-resize";
 
 function shortenPath(filePath: string): string {
 	const home = os.homedir();
-	return home && filePath.startsWith(home) ? `~${filePath.slice(home.length)}` : filePath;
+	if (!home) return filePath;
+	// Require a separator boundary so a sibling that shares the home prefix
+	// (e.g. "/home/woodyx/x" for home "/home/woody") is not corrupted into "~x/x".
+	const boundary = home.endsWith(path.sep) ? home : home + path.sep;
+	return filePath === home || filePath.startsWith(boundary) ? `~${filePath.slice(home.length)}` : filePath;
 }
 
 export function formatScreenshot(opts: {

package/src/tools/cron.ts

@@ -36,7 +36,7 @@ const cronSchema = z
 			.string()
 			.optional()
 			.describe(
-				"(op=create, required) Prompt to inject between turns when the cron fires. May reference slash commands (e.g. '/review-pr 1234') or natural-language instructions.",
+				"(op=create, required) Prompt to inject between turns when the cron fires. Every firing starts a normal agent turn whose response may be visible; use a persistent monitor, not cron, for ongoing polling that should emit only on state changes.",
 			),
 		recurring: z
 			.boolean()