@sayknow-cli/coding-agent 0.4.7 → 0.5.1

package/src/skc-runtime/workflow-manifest.generated.json

@@ -110,7 +110,13 @@
           "doctor",
           "kickoff",
           "write-spec",
-          "write-artifact"
+          "write-artifact",
+          "stage",
+          "check",
+          "apply",
+          "discard",
+          "read",
+          "write"
         ],
         "name": "session-id",
         "type": "string"
@@ -256,11 +262,49 @@
       },
       {
         "appliesToVerbs": [
-          "write-spec"
+          "write-spec",
+          "stage",
+          "check",
+          "apply",
+          "discard",
+          "read",
+          "write",
+          "clear",
+          "handoff"
         ],
         "name": "json",
         "type": "boolean"
       },
+      {
+        "appliesToVerbs": [
+          "stage",
+          "write"
+        ],
+        "name": "input",
+        "required": true,
+        "type": "string"
+      },
+      {
+        "appliesToVerbs": [
+          "write"
+        ],
+        "name": "reset",
+        "type": "boolean"
+      },
+      {
+        "appliesToVerbs": [
+          "stage"
+        ],
+        "enumValues": [
+          "initialize-context",
+          "record-round",
+          "update-facts",
+          "merge-state"
+        ],
+        "name": "for",
+        "required": true,
+        "type": "enum"
+      },
       {
         "name": "args",
         "planned": true,
@@ -305,6 +349,38 @@
         "name": "write-spec",
         "surface": "command-flag"
       },
+      {
+        "name": "stage",
+        "surface": "command-positional"
+      },
+      {
+        "name": "check",
+        "surface": "command-positional"
+      },
+      {
+        "name": "apply",
+        "surface": "command-positional"
+      },
+      {
+        "name": "discard",
+        "surface": "command-positional"
+      },
+      {
+        "name": "read",
+        "surface": "command-positional"
+      },
+      {
+        "name": "write",
+        "surface": "command-positional"
+      },
+      {
+        "name": "clear",
+        "surface": "command-positional"
+      },
+      {
+        "name": "handoff",
+        "surface": "command-positional"
+      },
       {
         "name": "graph",
         "planned": true,
@@ -534,7 +610,13 @@
           "doctor",
           "kickoff",
           "write-spec",
-          "write-artifact"
+          "write-artifact",
+          "stage",
+          "check",
+          "apply",
+          "discard",
+          "read",
+          "write"
         ],
         "name": "session-id",
         "type": "string"
@@ -922,7 +1004,13 @@
           "doctor",
           "kickoff",
           "write-spec",
-          "write-artifact"
+          "write-artifact",
+          "stage",
+          "check",
+          "apply",
+          "discard",
+          "read",
+          "write"
         ],
         "name": "session-id",
         "type": "string"
@@ -1046,6 +1134,9 @@
           "read-worker-status",
           "read-worker-heartbeat",
           "update-worker-heartbeat",
+          "read-worker-memory-guard",
+          "update-worker-memory-guard",
+          "apply-worker-memory-guard",
           "write-worker-inbox",
           "write-worker-identity",
           "append-event",
@@ -1111,6 +1202,41 @@
         "name": "completionEvidence",
         "type": "object"
       },
+      {
+        "appliesToVerbs": [
+          "api"
+        ],
+        "name": "platform",
+        "type": "string"
+      },
+      {
+        "appliesToVerbs": [
+          "api"
+        ],
+        "name": "automatic-action-allowed",
+        "type": "boolean"
+      },
+      {
+        "appliesToVerbs": [
+          "api"
+        ],
+        "name": "incident-id",
+        "type": "string"
+      },
+      {
+        "appliesToVerbs": [
+          "api"
+        ],
+        "name": "pid-probe",
+        "type": "object"
+      },
+      {
+        "appliesToVerbs": [
+          "api"
+        ],
+        "name": "candidates",
+        "type": "object"
+      },
       {
         "name": "args",
         "planned": true,
@@ -1370,7 +1496,13 @@
           "doctor",
           "kickoff",
           "write-spec",
-          "write-artifact"
+          "write-artifact",
+          "stage",
+          "check",
+          "apply",
+          "discard",
+          "read",
+          "write"
         ],
         "name": "session-id",
         "type": "string"
@@ -1515,12 +1647,60 @@
           "record-review-blockers",
           "steer",
           "classify-blocker",
+          "record-critic-verdict",
+          "record-critic-gate-override",
           "rebaseline-pipeline-overlap"
         ],
         "name": "evidence",
         "required": true,
         "type": "string"
       },
+      {
+        "appliesToVerbs": [
+          "record-critic-verdict"
+        ],
+        "enumValues": [
+          "completion",
+          "pause"
+        ],
+        "name": "terminus",
+        "required": true,
+        "type": "enum"
+      },
+      {
+        "appliesToVerbs": [
+          "record-critic-verdict"
+        ],
+        "enumValues": [
+          "OKAY",
+          "ITERATE",
+          "REJECT"
+        ],
+        "name": "verdict",
+        "required": true,
+        "type": "enum"
+      },
+      {
+        "appliesToVerbs": [
+          "record-critic-verdict"
+        ],
+        "name": "blockers-json",
+        "type": "string"
+      },
+      {
+        "appliesToVerbs": [
+          "record-critic-verdict"
+        ],
+        "name": "goal-id",
+        "type": "string"
+      },
+      {
+        "appliesToVerbs": [
+          "record-critic-verdict"
+        ],
+        "name": "classification-event-id",
+        "type": "string"
+      },
       {
         "appliesToVerbs": [
           "create-goals"
@@ -1743,6 +1923,8 @@
           "record-review-blockers",
           "steer",
           "classify-blocker",
+          "record-critic-verdict",
+          "record-critic-gate-override",
           "start-pipeline-overlap",
           "join-pipeline-overlap",
           "rebaseline-pipeline-overlap"
@@ -1830,6 +2012,14 @@
         "name": "classify-blocker",
         "surface": "command-positional"
       },
+      {
+        "name": "record-critic-verdict",
+        "surface": "command-positional"
+      },
+      {
+        "name": "record-critic-gate-override",
+        "surface": "command-positional"
+      },
       {
         "name": "start-pipeline-overlap",
         "surface": "command-positional"

package/src/skc-runtime/workflow-manifest.ts

@@ -72,7 +72,22 @@ const PLANNED_ADMIN_VERBS = ["graph", "prune", "migrate", "force-overwrite"] as
 const COMMON_TYPED_ARGS: TypedArgSpec[] = [
 	{ name: "input", type: "string", appliesToVerbs: ["write", "api"] },
 	{ name: "mode", type: "enum", enumValues: [...CANONICAL_SKC_WORKFLOW_SKILLS], appliesToVerbs: [...STATE_VERBS] },
-	{ name: "session-id", type: "string", appliesToVerbs: [...STATE_VERBS, "kickoff", "write-spec", "write-artifact"] },
+	{
+		name: "session-id",
+		type: "string",
+		appliesToVerbs: [
+			...STATE_VERBS,
+			"kickoff",
+			"write-spec",
+			"write-artifact",
+			"stage",
+			"check",
+			"apply",
+			"discard",
+			"read",
+			"write",
+		],
+	},
 	{ name: "thread-id", type: "string", appliesToVerbs: ["write", "clear", "handoff"] },
 	{ name: "turn-id", type: "string", appliesToVerbs: ["write", "clear", "handoff"] },
 	{ name: "to", type: "string", required: true, appliesToVerbs: ["handoff"] },
@@ -160,7 +175,12 @@ export const WORKFLOW_MANIFEST: Record<CanonicalSkcWorkflowSkill, SkillManifest>
 			{ from: "handoff", to: "complete", verb: "clear" },
 			{ from: "interviewing", to: "complete", verb: "clear" },
 		],
-		verbs: [...stateVerbs(), ...flagVerbs(["kickoff", "write-spec"]), ...plannedVerbs(PLANNED_ADMIN_VERBS)],
+		verbs: [
+			...stateVerbs(),
+			...flagVerbs(["kickoff", "write-spec"]),
+			...positionalVerbs(["stage", "check", "apply", "discard", "read", "write", "clear", "handoff"]),
+			...plannedVerbs(PLANNED_ADMIN_VERBS),
+		],
 		typedArgs: [
 			{ name: "quick", type: "boolean", appliesToVerbs: ["kickoff"] },
 			{ name: "standard", type: "boolean", appliesToVerbs: ["kickoff"] },
@@ -172,7 +192,20 @@ export const WORKFLOW_MANIFEST: Record<CanonicalSkcWorkflowSkill, SkillManifest>
 			{ name: "spec", type: "string", required: true, appliesToVerbs: ["write-spec"] },
 			{ name: "handoff", type: "enum", enumValues: ["ralplan"], appliesToVerbs: ["write-spec"] },
 			{ name: "deliberate", type: "boolean", appliesToVerbs: ["write-spec"] },
-			{ name: "json", type: "boolean", appliesToVerbs: ["write-spec"] },
+			{
+				name: "json",
+				type: "boolean",
+				appliesToVerbs: ["write-spec", "stage", "check", "apply", "discard", "read", "write", "clear", "handoff"],
+			},
+			{ name: "input", type: "string", required: true, appliesToVerbs: ["stage", "write"] },
+			{ name: "reset", type: "boolean", appliesToVerbs: ["write"] },
+			{
+				name: "for",
+				type: "enum",
+				enumValues: ["initialize-context", "record-round", "update-facts", "merge-state"],
+				required: true,
+				appliesToVerbs: ["stage"],
+			},
 			{ name: "args", type: "string", planned: true },
 			{ name: "metadata-json", type: "string", planned: true },
 		],
@@ -255,6 +288,8 @@ export const WORKFLOW_MANIFEST: Record<CanonicalSkcWorkflowSkill, SkillManifest>
 				"record-review-blockers",
 				"steer",
 				"classify-blocker",
+				"record-critic-verdict",
+				"record-critic-gate-override",
 				"start-pipeline-overlap",
 				"join-pipeline-overlap",
 				"rebaseline-pipeline-overlap",
@@ -290,9 +325,28 @@ export const WORKFLOW_MANIFEST: Record<CanonicalSkcWorkflowSkill, SkillManifest>
 					"record-review-blockers",
 					"steer",
 					"classify-blocker",
+					"record-critic-verdict",
+					"record-critic-gate-override",
 					"rebaseline-pipeline-overlap",
 				],
 			},
+			{
+				name: "terminus",
+				type: "enum",
+				enumValues: ["completion", "pause"],
+				required: true,
+				appliesToVerbs: ["record-critic-verdict"],
+			},
+			{
+				name: "verdict",
+				type: "enum",
+				enumValues: ["OKAY", "ITERATE", "REJECT"],
+				required: true,
+				appliesToVerbs: ["record-critic-verdict"],
+			},
+			{ name: "blockers-json", type: "string", appliesToVerbs: ["record-critic-verdict"] },
+			{ name: "goal-id", type: "string", appliesToVerbs: ["record-critic-verdict"] },
+			{ name: "classification-event-id", type: "string", appliesToVerbs: ["record-critic-verdict"] },
 			{
 				name: "goal-metadata-json",
 				type: "string",
@@ -403,6 +457,8 @@ export const WORKFLOW_MANIFEST: Record<CanonicalSkcWorkflowSkill, SkillManifest>
 					"record-review-blockers",
 					"steer",
 					"classify-blocker",
+					"record-critic-verdict",
+					"record-critic-gate-override",
 					"start-pipeline-overlap",
 					"join-pipeline-overlap",
 					"rebaseline-pipeline-overlap",
@@ -470,6 +526,9 @@ export const WORKFLOW_MANIFEST: Record<CanonicalSkcWorkflowSkill, SkillManifest>
 					"read-worker-status",
 					"read-worker-heartbeat",
 					"update-worker-heartbeat",
+					"read-worker-memory-guard",
+					"update-worker-memory-guard",
+					"apply-worker-memory-guard",
 					"write-worker-inbox",
 					"write-worker-identity",
 					"append-event",
@@ -496,6 +555,11 @@ export const WORKFLOW_MANIFEST: Record<CanonicalSkcWorkflowSkill, SkillManifest>
 			},
 			{ name: "completion_evidence", type: "object", appliesToVerbs: ["api"] },
 			{ name: "completionEvidence", type: "object", appliesToVerbs: ["api"] },
+			{ name: "platform", type: "string", appliesToVerbs: ["api"] },
+			{ name: "automatic-action-allowed", type: "boolean", appliesToVerbs: ["api"] },
+			{ name: "incident-id", type: "string", appliesToVerbs: ["api"] },
+			{ name: "pid-probe", type: "object", appliesToVerbs: ["api"] },
+			{ name: "candidates", type: "object", appliesToVerbs: ["api"] },
 			{ name: "args", type: "string", planned: true },
 			{ name: "metadata-json", type: "string", planned: true },
 		],

package/src/skill-state/workflow-hud.ts

@@ -23,6 +23,9 @@ interface RalplanHudState extends WorkflowGateHudState {
 	iteration?: number;
 	iterationFromIndex?: number;
 	stages?: string;
+	architectPasses?: number;
+	criticPasses?: number;
+	reviewPassBudget?: number;
 	verdict?: string;
 	latestSummary?: string;
 	pendingApproval?: boolean;
@@ -194,13 +197,31 @@ export function deriveDeepInterviewHud(
 export function buildRalplanHudSummary(state: RalplanHudState): WorkflowHudSummary {
 	const verdict = state.verdict?.toUpperCase();
 	const verdictSeverity =
-		verdict === "BLOCK"
+		verdict === "BLOCK" || verdict === "REJECT"
 			? "blocked"
 			: verdict === "ITERATE" || verdict === "WATCH"
 				? "warning"
-				: verdict === "APPROVE" || verdict === "CLEAR"
+				: verdict === "APPROVE" || verdict === "CLEAR" || verdict === "OKAY"
 					? "success"
 					: undefined;
+	const reviewPassChip = (
+		label: "arch" | "crit",
+		passes: number | undefined,
+		priority: number,
+	): WorkflowHudChip | null => {
+		if (
+			state.pendingApproval ||
+			typeof passes !== "number" ||
+			!Number.isFinite(passes) ||
+			passes <= 0 ||
+			typeof state.reviewPassBudget !== "number" ||
+			!Number.isFinite(state.reviewPassBudget) ||
+			state.reviewPassBudget <= 0
+		) {
+			return null;
+		}
+		return chip(label, `${passes}/${state.reviewPassBudget}`, priority);
+	};
 	return {
 		version: 1,
 		summary: state.latestSummary,
@@ -217,6 +238,8 @@ export function buildRalplanHudSummary(state: RalplanHudState): WorkflowHudSumma
 				30,
 			),
 			chip("stages", state.stages, 35),
+			reviewPassChip("arch", state.architectPasses, 36),
+			reviewPassChip("crit", state.criticPasses, 38),
 			chip("verdict", verdict, 40, verdictSeverity),
 		]),
 		...(state.updatedAt ? { updated_at: state.updatedAt } : {}),

package/src/skill-state/workflow-mutation-guard.ts

@@ -35,17 +35,31 @@ function planningPhaseBlockMessage(skill: CanonicalSkcWorkflowSkill): string {
 }
 
 const BLOCKED_TOOL_NAMES = new Set(["edit", "write", "ast_edit", "bash"]);
+/**
+ * Only `/dev/null` is exempt. `/dev/stdout`, `/dev/stderr`, and `/dev/fd/<n>` are descriptor
+ * aliases: `exec 1<>src/product.ts; printf x >/dev/stdout` reaches a real repository file
+ * through a rebound descriptor, so they must stay blocked.
+ */
+const DEVICE_SINK_PATHS = new Set(["/dev/null"]);
+/** Bash write forms the plain `>`/`>>` scanner misses: clobber, dup-to-path, and read-write open. */
+const BASH_EXTENDED_WRITE_RE = /(?:>\||<>|>&(?![\s;&|]*(?:\d+|-)(?:[\s;&|]|$)))\s*([^\s;&|]+)/g;
+/** Descriptor rebinding is not statically resolvable; any `exec` redirection forces a fail-closed verdict. */
+const BASH_EXEC_REDIRECT_RE = /(?:^|[;&|\n])\s*(?:sudo\s+)?exec\b[^;&|\n]*[<>]/i;
+
 const ARCHIVE_OR_SQLITE_BASE_RE = /^(.+?\.(?:tar\.gz|sqlite3|sqlite|db3|zip|tgz|tar|db))(?:$|:)/i;
 const INTERNAL_SCHEME_RE = /^[a-z][a-z0-9+.-]*:\/\//i;
 const VIM_FILE_SWITCH_RE = /^\s*:(?:e|e!|edit|edit!)(?:\s+([^<\r\n]+))?(?:<CR>|\r|\n|$)/i;
 const BASH_MUTATION_COMMAND_RE =
-	/(?:^|[;&|\n])\s*(?:\w+=[^\s]+\s+)*(?:sudo\s+)?(?:tee|touch|rm|mkdir|cp|mv|install|truncate)\b([^;&|\n]*)|(?:^|[^<>])(?:>>?|\d>>?)\s*([^\s;&|]+)/gi;
+	/(?:^|[;&|\n])\s*(?:\w+=[^\s]+\s+)*(?:sudo\s+)?(?:[^\s;&|]*\/)?(?:tee|touch|rm|mkdir|cp|mv|install|truncate)\b([^;&|\n]*)|(?:^|[^<>])(?:>>?|\d>>?)\s*([^\s;&|]+)/gi;
 const BASH_IN_PLACE_MUTATION_COMMAND_RE = /(?:^|[;&|\n])\s*(?:\w+=[^\s]+\s+)*(?:sudo\s+)?(?:sed|perl)\b([^;&|\n]*)/gi;
 const BASH_OPAQUE_INTERPRETER_WRITE_RE =
 	/(?:^|[;&|\n])\s*(?:\w+=[^\s]+\s+)*(?:sudo\s+)?(?:python3?|node|ruby)\b[^;&|\n]*(?:-c|-e)\b[^;&|\n]*(?:open\s*\(|writeFile(?:Sync)?\s*\(|\.write\s*\()/i;
 const BASH_HEREDOC_OPAQUE_INTERPRETER_WRITE_RE =
 	/(?:^|[;&|\n])\s*(?:\w+=[^\s]+\s+)*(?:sudo\s+)?(?:python3?|node|ruby)\b[^;&|\n]*(?:<<[-]?\s*['"]?\w+['"]?)[\s\S]*(?:open\s*\(|writeFile(?:Sync)?\s*\(|\.write\s*\()/i;
-const BASH_DD_OUTPUT_RE = /(?:^|[;&|\n])\s*(?:\w+=[^\s]+\s+)*(?:sudo\s+)?dd\b([^;&|\n]*)/gi;
+const BASH_DD_OUTPUT_RE = /(?:^|[;&|\n])\s*(?:\w+=[^\s]+\s+)*(?:sudo\s+)?(?:[^\s;&|]*\/)?dd\b([^;&|\n]*)/gi;
+/** Literal `sh|bash|zsh -c '<script>'` payloads whose nested script must also be scanned. */
+const BASH_NESTED_SHELL_RE =
+	/(?:^|[;&|\n])\s*(?:\w+=[^\s]+\s+)*(?:sudo\s+)?(?:[^\s;&|]*\/)?(?:ba|z|da)?sh\s+(?:-[A-Za-z]+\s+)*-[A-Za-z]*c\s+(?:(')([^']*)'|(")([^"]*)")/g;
 
 type ToolWithEditMode = AgentTool & {
 	mode?: unknown;
@@ -66,6 +80,12 @@ export interface WorkflowMutationGuardInput {
 interface ExtractedTargets {
 	paths: string[];
 	unknown: boolean;
+	/**
+	 * Set when a bash command was recognized as performing a filesystem write.
+	 * During a planning phase an unrecognized bash command is allowed (reading
+	 * and inspection must not be blocked); only a recognized mutation blocks.
+	 */
+	explicitMutation?: boolean;
 }
 
 export interface WorkflowMutationDecision {
@@ -371,7 +391,34 @@ function cleanShellWord(value: string): string {
 	return value.replace(/^['"]|['"]$/g, "");
 }
 
-function extractBashTargets(args: unknown): ExtractedTargets {
+/**
+ * Blank out single-quoted spans so shell metacharacters inside a literal
+ * argument value (e.g. `--value 'uses `x`; a > b'`) are not misread as
+ * redirections or separators. Single quotes suppress every expansion in POSIX
+ * shells, so their contents are always inert data. Double-quoted spans are left
+ * intact because they still expand `$(...)` and backticks.
+ */
+function maskSingleQuotedSpans(command: string): string {
+	let masked = "";
+	let inSingle = false;
+	for (const character of command) {
+		if (character === "'") {
+			inSingle = !inSingle;
+			masked += character;
+			continue;
+		}
+		masked += inSingle && character !== "\n" ? " " : character;
+	}
+	// An unbalanced quote means the parse is unreliable; keep the original text
+	// so the scanner stays fail-closed rather than blind.
+	return inSingle ? command : masked;
+}
+
+function isDeviceSinkPath(value: string): boolean {
+	return DEVICE_SINK_PATHS.has(cleanShellWord(value));
+}
+
+function extractBashTargets(args: unknown, depth = 0): ExtractedTargets {
 	const record = getRecord(args);
 	const command = safeString(record?.command);
 	const targets: ExtractedTargets = { paths: [], unknown: false };
@@ -379,32 +426,74 @@ function extractBashTargets(args: unknown): ExtractedTargets {
 		targets.unknown = true;
 		return targets;
 	}
+	// A literal `sh|bash|zsh -c '<script>'` payload is a real command list. Its
+	// mutations never match the top-level patterns, so recurse into it; anything
+	// deeper than a bounded depth is not statically analyzable and fails closed.
+	for (const match of command.matchAll(BASH_NESTED_SHELL_RE)) {
+		if (depth >= 2) {
+			targets.explicitMutation = true;
+			targets.unknown = true;
+			break;
+		}
+		const nested = extractBashTargets({ command: match[2] ?? match[4] ?? "" }, depth + 1);
+		for (const nestedPath of nested.paths) addPath(targets, nestedPath);
+		if (nested.unknown) targets.unknown = true;
+		if (nested.explicitMutation) targets.explicitMutation = true;
+	}
+	// Nested scripts were read from the raw text above; every scanner below works
+	// on the masked view so quoted argument data cannot look like a redirection.
+	const scanned = maskSingleQuotedSpans(command);
 	if (BASH_OPAQUE_INTERPRETER_WRITE_RE.test(command) || BASH_HEREDOC_OPAQUE_INTERPRETER_WRITE_RE.test(command)) {
+		targets.explicitMutation = true;
 		targets.unknown = true;
 	}
-	for (const match of command.matchAll(BASH_DD_OUTPUT_RE)) {
+	// `exec 1<>file` rebinds a descriptor, so a later `>/dev/null` may not reach the device at all.
+	if (BASH_EXEC_REDIRECT_RE.test(scanned)) {
+		targets.explicitMutation = true;
+		targets.unknown = true;
+	}
+	for (const match of scanned.matchAll(BASH_EXTENDED_WRITE_RE)) {
+		targets.explicitMutation = true;
+		const cleaned = cleanShellWord(match[1] ?? "");
+		if (!cleaned) targets.unknown = true;
+		else if (!isDeviceSinkPath(cleaned)) addPath(targets, cleaned);
+	}
+	for (const match of scanned.matchAll(BASH_DD_OUTPUT_RE)) {
+		targets.explicitMutation = true;
 		const parts = shellWords(match[1] ?? "").map(cleanShellWord);
-		const output = parts.find(part => part.startsWith("of="));
-		if (output) addPath(targets, output.slice(3));
-		else targets.unknown = true;
+		// Every `of=` counts: GNU dd honors the last one, so `of=/dev/null of=real.ts` writes real.ts.
+		const outputs = parts.filter(part => part.startsWith("of="));
+		if (outputs.length === 0) targets.unknown = true;
+		for (const output of outputs) {
+			const outputPath = cleanShellWord(output.slice(3));
+			if (!outputPath) targets.unknown = true;
+			else if (!isDeviceSinkPath(outputPath)) addPath(targets, outputPath);
+		}
 	}
-	for (const match of command.matchAll(BASH_IN_PLACE_MUTATION_COMMAND_RE)) {
+	for (const match of scanned.matchAll(BASH_IN_PLACE_MUTATION_COMMAND_RE)) {
 		const parts = shellWords(match[1] ?? "").map(cleanShellWord);
 		const hasInPlaceFlag = parts.some(part => /^-.*i/.test(part));
 		if (!hasInPlaceFlag) continue;
+		targets.explicitMutation = true;
 		const target = [...parts].reverse().find(part => part && !part.startsWith("-"));
 		if (target) addPath(targets, target);
 		else targets.unknown = true;
 	}
-	for (const match of command.matchAll(BASH_MUTATION_COMMAND_RE)) {
+	for (const match of scanned.matchAll(BASH_MUTATION_COMMAND_RE)) {
+		targets.explicitMutation = true;
 		const redirected = match[2]?.trim();
 		if (redirected) {
-			addPath(targets, cleanShellWord(redirected));
+			const cleaned = cleanShellWord(redirected);
+			// A capture that dequotes to nothing (e.g. `>" src.ts"`) is a truncated parse, not a safe no-op.
+			if (!cleaned) targets.unknown = true;
+			else if (!isDeviceSinkPath(cleaned)) addPath(targets, cleaned);
 			continue;
 		}
 		const parts = shellWords(match[1] ?? "");
 		const commandName = match[0]
-			?.match(/(?:^|[;&|\n])\s*(?:\w+=[^\s]+\s+)*(?:sudo\s+)?(tee|touch|rm|mkdir|cp|mv|install|truncate)\b/i)?.[1]
+			?.match(
+				/(?:^|[;&|\n])\s*(?:\w+=[^\s]+\s+)*(?:sudo\s+)?(?:[^\s;&|]*\/)?(tee|touch|rm|mkdir|cp|mv|install|truncate)\b/i,
+			)?.[1]
 			?.toLowerCase();
 		const targetParts =
 			commandName === "cp" || commandName === "mv" || commandName === "install" || commandName === "truncate"
@@ -632,7 +721,10 @@ export async function getWorkflowMutationDecision(
 	}
 	if (input.forceOverride) return { blocked: false, targets: [] };
 	const message = planningPhaseBlockMessage(planning.skill);
-	if (targets.unknown) {
+	// Bash during a planning phase blocks only when a filesystem mutation was
+	// actually recognized. Inspection, reads, and CLI invocations the scanner does
+	// not model stay usable; other tools keep failing closed on unknown targets.
+	if (targets.unknown && (input.tool.name !== "bash" || targets.explicitMutation)) {
 		return {
 			blocked: true,
 			message,

package/src/slash-commands/builtin-registry.ts

@@ -1516,7 +1516,7 @@ const BUILTIN_SLASH_COMMAND_REGISTRY: ReadonlyArray<SlashCommandSpec> = [
 	},
 	{
 		name: "btw",
-		description: "Ask an ephemeral side question using the current session context",
+		description: "Start an ephemeral multi-turn side chat using the current session context",
 		inlineHint: "<question>",
 		allowArgs: true,
 		handleTui: async (command, runtime) => {

package/src/ssh/utils.ts

@@ -3,6 +3,20 @@ export function sanitizeHostName(name: string): string {
 	return sanitized.length > 0 ? sanitized : "remote";
 }
 
+export function validateSshDestination(username: string | undefined, host: string): string | undefined {
+	if (host.startsWith("-") || username?.startsWith("-")) {
+		return "username and host must not begin with '-'";
+	}
+	if (/\0|\r|\n/.test(host) || (username !== undefined && /\0|\r|\n/.test(username))) {
+		return "username and host must not contain NUL or line breaks";
+	}
+	return undefined;
+}
+
 export function buildSshTarget(username: string | undefined, host: string): string {
+	const validationError = validateSshDestination(username, host);
+	if (validationError) {
+		throw new Error(`Invalid SSH destination: ${validationError}`);
+	}
 	return username ? `${username}@${host}` : host;
 }