@staix/agent-hub 0.17.0 → 0.19.0

package/src/local/deny.ts

@@ -31,6 +31,17 @@ const HFS_IGNORABLE = `(${HFS_IGNORABLE_POINTS.join("|")})`;
 /** A regex source matching `name` with any number of HFS+-ignorable code points interleaved, at the ends included. */
 const hfsFoldedName = (name: string) => `${HFS_IGNORABLE}*${[...name].map((c) => sbplEscape(c)).join(`${HFS_IGNORABLE}*`)}${HFS_IGNORABLE}*`;
 
+/**
+ * `config.worktree`, the per-worktree config git reads beside `config` (#518), folded in BOTH halves as two NAME-only regex sources that a rule must both match. One SBPL regex
+ * literal dies at 1024 bytes in UTF-8 and every folded character costs about 65 bytes, so the whole name (1071) cannot be one literal, and a byte class cannot hold the
+ * multi-byte code points (the engine is byte-oriented, verified), so the fold stays an alternation. The first source pins the front (a folded `config`, a dot, then the rest of
+ * the name), the second the end (a folded `worktree`). Together they match every spelling of `config.worktree` with ignorable code points anywhere in it, and also
+ * `config.<anything>worktree` in the same directory, which is over-refused on purpose and names no file git uses.
+ * The root a rule is scoped to is NEVER part of these literals: it goes in its own `require-all` filter, so a long project or git path cannot push a folded name over the limit
+ * (#518 review: a 450-byte path made a 1083-byte literal when the root and the name shared one).
+ */
+const CONFIG_WORKTREE_NAME: readonly [string, string] = [`^.*/${hfsFoldedName("config")}\\.[^/]*$`, `^.*/[^/]*${hfsFoldedName("worktree")}$`];
+
 /**
  * Seatbelt rules for the hub's and git's own names (#270). `.agenthub` is refused anywhere under the project root.
  * `.git` is refused at any depth, the name itself included, so a planted repository cannot arrive by creation,
@@ -53,32 +64,101 @@ const hfsFoldedName = (name: string) => `${HFS_IGNORABLE}*${[...name].map((c) =>
  * long project path would trip. ponytail: the modules rules do contain the (plain) modules root; a project path
  * over roughly 600 bytes with submodules would exceed the limit — fold the root's segments if one ever shows up.
  */
-export function hubWriteRegexes(root: string, gitDirs: string[] = [], moduleGit?: { root: string; entries: string[] }): string[] {
+/**
+ * `hooks` as the entry directly under `parent`, and everything below it, anchored by DEPTH instead of by the unanchored any-prefix name: that one also matches an ancestor of the
+ * project that happens to be named `hooks`, and paired with a plain root prefix it refused every write below the root (#520). Seatbelt ignores a `{n}` repeat, so the depth is
+ * written out as that many `/[^/]+` terms (verified with the real sandbox-exec), which keeps the literal independent of the path's characters and costs 6 bytes a component.
+ * A path with more than MAX_ANCHOR_DEPTH components would push the folded name past the 1024-byte limit, which stops every sandboxed command, so it falls back to the
+ * unanchored name: that over-refuses only when an ancestor is named `hooks`, never under-protects. Pair it with a plain `^<parent>/` filter.
+ */
+const MAX_ANCHOR_DEPTH = 80;
+const hooksUnder = (parent: string): string => {
+  const depth = parent.split("/").filter(Boolean).length;
+  return depth > MAX_ANCHOR_DEPTH ? `^.*/${hfsFoldedName("hooks")}(/|$)` : `^${"/[^/]+".repeat(depth)}/${hfsFoldedName("hooks")}(/|$)`;
+};
+
+export function hubWriteRegexes(root: string, gitDirs: string[] = [], moduleGit: readonly { root: string; entries: string[]; dirs?: string[] }[] = [], worktreesRoot?: string): string[] {
   const git = hfsFoldedName(".git");
   const re = (s: string) => `(regex ${sbplString(s)})`;
   const external = gitDirs.flatMap((d) => [
     `(require-all ${re(`^${sbplEscape(d)}/[^/]+$`)} ${re(`^.*/(${hfsFoldedName("config")}|${hfsFoldedName("hooks")})$`)})`,
+    `(require-all ${re(`^${sbplEscape(d)}/[^/]+$`)} ${CONFIG_WORKTREE_NAME.map(re).join(" ")})`,
     `(subpath ${sbplString(`${d}/hooks`)})`,
     `(require-all (subpath ${sbplString(d)}) ${re(`^.*/${hfsFoldedName("commondir")}$`)})`,
   ]);
-  const modules = moduleGit
-    ? [
-        // Every name matches whole components only: `(.*/)?` forces a boundary, so a submodule named `catalogs`
-        // or `prefs` keeps the refusal and one named `webhooks` keeps its ordinary writes (#281 round 2).
-        `(require-all ${re(`^${sbplEscape(moduleGit.root)}/(.*/)?${hfsFoldedName("config")}$`)} (require-not ${re(`^${sbplEscape(moduleGit.root)}/(.*/)?(refs|logs)/`)}))`,
-        `(require-all ${re(`^${sbplEscape(moduleGit.root)}/(.*/)?${hfsFoldedName("hooks")}(/|$)`)} (require-not ${re(`^${sbplEscape(moduleGit.root)}/(.*/)?(refs|logs)/`)}))`,
-        // A submodule git dir as a directory entry: no rename, replace, symlink or recreate. The basename is
-        // folded (HFS+ opens the folded spelling as the real entry); the plain prefix is the path as discovered.
-        ...moduleGit.entries.map((d) => re(`^${sbplEscape(dirname(d))}/${hfsFoldedName(basename(d))}$`)),
-      ]
+  // Every modules tree (#518, #520): the common dir's, a linked worktree's own, each sibling's, and the `modules/` of every discovered submodule git dir. Nothing is exempt by name:
+  // a `refs` or `logs` component does not make a path safe, because a later unsandboxed `git submodule update --init` reuses any git dir found at `<modules>/<name>` and runs its
+  // config and hooks. So under a modules root, everything that is not inside a DISCOVERED git dir is refused (that is a plant, a new or a renamed git dir), and inside each discovered
+  // git dir `D` the protected files are anchored to `D` itself: `D/config`, `D/config.worktree`, `D/hooks` and what is below it, and `D/worktrees/*/config.worktree`.
+  // Ordinary git work writes `D/refs`, `D/logs`, `D/objects`, `D/index`, `D/HEAD`, ... and none of those is refused, so no refs/logs exception is needed.
+  // Each literal holds either a path or a folded name, never both (the 1024-byte limit, #518 review); the folded names sit in `^.*/<name>$` filters beside a plain anchor.
+  const allDirs = moduleGit.flatMap((tree) => tree.dirs ?? []);
+  const modules = moduleGit.flatMap((tree) => {
+    const root = sbplEscape(tree.root);
+    const found = tree.dirs ?? [];   // absent means nothing is exempt: everything under the root is refused, which fails closed
+    const inside = found.map((d) => `(require-not ${re(`^${sbplEscape(d)}(/|$)`)})`).join(" ");
+    const anchored = found.flatMap((d) => {
+      const dir = sbplEscape(d);
+      return [
+        `(require-all ${re(`^${dir}/[^/]+$`)} ${re(`^.*/${hfsFoldedName("config")}$`)})`,
+        `(require-all ${re(`^${dir}/[^/]+$`)} ${CONFIG_WORKTREE_NAME.map(re).join(" ")})`,
+        `(require-all ${re(`^${dir}/`)} ${re(hooksUnder(d))})`,
+        // A linked worktree of a submodule keeps its own config.worktree one level down.
+        `(require-all ${re(`^${dir}/worktrees/[^/]+/[^/]+$`)} ${CONFIG_WORKTREE_NAME.map(re).join(" ")})`,
+        // The directories on the way to those files are directory-entry targets, so none can be moved out of the protected path, edited and put back (#520 review): `worktrees`
+        // and each `worktrees/<name>` (no rename, replace, symlink or removal), and the `hooks` directory itself. The root and the folded name are separate filters.
+        `(require-all ${re(`^${dir}/[^/]+$`)} ${re(`^.*/${hfsFoldedName("worktrees")}$`)})`,
+        re(`^${dir}/worktrees/[^/]+$`),
+        `(require-all ${re(`^${dir}/[^/]+$`)} ${re(`^.*/${hfsFoldedName("hooks")}$`)})`,
+        // A submodule's own linked worktrees keep their `modules/` at `D/worktrees/<wt>/modules` (#520 review), inside the exemption above. Everything under one that is not inside a
+        // DISCOVERED git dir is refused, whether the worktree exists yet or not (the pattern needs no discovery), and the `modules` entry itself cannot be renamed or replaced.
+        `(require-all ${re(`^${dir}/worktrees/[^/]+/modules/.`)} ${allDirs.filter((f) => f.startsWith(`${d}/worktrees/`)).map((f) => `(require-not ${re(`^${sbplEscape(f)}(/|$)`)})`).join(" ")})`,
+        `(require-all ${re(`^${dir}/worktrees/[^/]+/[^/]+$`)} ${re(`^.*/${hfsFoldedName("modules")}$`)})`,
+      ];
+    });
+    return [
+      // Everything under the root that is not inside a discovered git dir. The root's own entry is a directory entry rule below, so this is the contents.
+      `(require-all ${re(`^${root}/.`)} ${inside})`,
+      ...anchored,
+      // A submodule git dir as a directory entry: no rename, replace, symlink or recreate. The basename is folded (HFS+ opens the folded spelling as the real entry);
+      // the directory and the folded name are separate filters (a ~520-byte git path went over the limit when they shared one, #518 review).
+      ...tree.entries.map((d) => `(require-all ${re(`^${sbplEscape(dirname(d))}/[^/]+$`)} ${re(`^.*/${hfsFoldedName(basename(d))}$`)})`),
+    ];
+  });
+  // Every linked worktree's git dir under `<common>/worktrees/` by pattern, not by discovery (#518): a sibling's `modules/` tree that does not exist yet, or a sibling created
+  // after this profile was built, is as protected as one that does. The sandbox can write the common dir, so it could otherwise pre-create them. The worktree name is one
+  // plain component (a folded spelling of `worktrees` or of a sibling's name on HFS+ is the same residual as the folded `modules` component above).
+  const siblings = worktreesRoot
+    ? (() => {
+        const w = sbplEscape(worktreesRoot);
+        return [
+          // The ancestors of every protected git dir, as directory entries: no rename, replace, symlink or recreate. Without them the container or a worktree git dir could be moved
+          // out of the protected path, its submodule config or hooks edited, and moved back (#518 review). Git itself never renames or removes these during ordinary work.
+          // The container's folded name and the directory it sits in are separate filters (one literal holding both grows with the path); a worktree git dir has any name.
+          `(require-all ${re(`^${sbplEscape(dirname(worktreesRoot))}/[^/]+$`)} ${re(`^.*/${hfsFoldedName(basename(worktreesRoot))}$`)})`,
+          re(`^${w}/[^/]+$`),
+          // A worktree git dir's own `config` and `config.worktree`: direct children only.
+          `(require-all ${re(`^${w}/[^/]+/[^/]+$`)} ${re(`^.*/${hfsFoldedName("config")}$`)})`,
+          `(require-all ${re(`^${w}/[^/]+/[^/]+$`)} ${CONFIG_WORKTREE_NAME.map(re).join(" ")})`,
+          // A worktree git dir's own `hooks` directory and everything in it, which git runs for that worktree, anchored by depth so an ancestor named `hooks` is not matched (#520).
+          // Its `modules/` is a different component, so this never reaches a submodule's own tree.
+          `(require-all ${re(`^${w}/[^/]+/`)} ${re(hooksUnder(`${worktreesRoot}/x`))})`,
+          // Every write under any worktree's `modules/` that is not inside a DISCOVERED submodule git dir (#520): a plant, or a tree that does not exist yet. The discovered git dirs
+          // (the sandboxed worktree's own, and any sibling's that exists) are exempt here and get their anchored rules from their own tree above. No name is exempt.
+          `(require-all ${re(`^${w}/[^/]+/modules/.`)} ${moduleGit.flatMap((tree) => tree.dirs ?? []).filter((d) => d.startsWith(`${worktreesRoot}/`)).map((d) => `(require-not ${re(`^${sbplEscape(d)}(/|$)`)})`).join(" ")})`,
+          `(require-all ${re(`^${w}/[^/]+/[^/]+$`)} ${re(`^.*/${hfsFoldedName("modules")}$`)})`,
+        ];
+      })()
     : [];
   return [
     `(require-all (subpath ${sbplString(root)}) ${re(`^.*/${hfsFoldedName(".agenthub")}(/|$)`)})`,
     re(`^.*/${git}$`),
     re(`^.*/${git}/${hfsFoldedName("config")}$`),
+    `(require-all ${re(`^.*/${git}/[^/]+$`)} ${CONFIG_WORKTREE_NAME.map(re).join(" ")})`,
     re(`^.*/${git}/${hfsFoldedName("hooks")}(/|$)`),
     `(require-all ${re(`^.*/${git}/.*$`)} ${re(`^.*/${hfsFoldedName("commondir")}$`)})`,
     ...modules,
+    ...siblings,
     ...external,
   ];
 }

package/src/local/sandbox.ts

@@ -48,38 +48,76 @@ function externalGitDirs(root: string): string[] {
   return [...new Set(dirs)].filter((d) => !d.startsWith(`${root}/`));
 }
 
+/** `<common>/worktrees`: where every linked worktree keeps its git dir. The rules for it are patterns, so they need no worktree to exist (#518). */
+function worktreesRoot(root: string): string | undefined {
+  const out = hubGitSync(["-C", root, "rev-parse", "--git-common-dir"], { encoding: "utf8" });
+  return out.status === 0 && out.stdout.trim() ? join(resolve(root, out.stdout.trim()), "worktrees") : undefined;
+}
+
 /**
- * The project's submodule git directories live under the common dir's `modules/` tree (the worktree case included:
- * it is the main repo's `.git/modules`). Returns the modules root and every directory entry that must not be
- * renamed, replaced, symlinked or recreated: each discovered git dir (a directory holding HEAD and config) and
- * every component between it and the modules root (#281). Discovered in the hub process, outside the sandbox.
+ * One modules tree: its root, the submodule git dirs found directly under it (`dirs`, each a directory holding HEAD and config, however it is named) and every directory entry
+ * that must not be renamed, replaced, symlinked or recreated (the root, each git dir and every component between them, #281). Everything else under the root is refused to
+ * write (#520): a git dir that is not discovered here is a plant, whatever its name.
  */
-function moduleGitDirs(root: string): { root: string; entries: string[] } | undefined {
-  const out = hubGitSync(["-C", root, "rev-parse", "--git-common-dir"], { encoding: "utf8" });
-  if (out.status !== 0) return undefined;
-  const modulesRoot = join(resolve(root, out.stdout.trim()), "modules");
-  const dirs: string[] = [];
-  const walk = (dir: string, depth: number): void => {
-    if (depth > 8) return; // submodules do not nest deeper in practice; the regex rules still cover the names
-    let entries: Dirent[];
-    try {
-      entries = readdirSync(dir, { withFileTypes: true });
-    } catch {
-      return; // no modules tree (no submodules): nothing to discover
+export interface ModuleGit { root: string; entries: string[]; dirs?: string[] }
+
+/** The deepest submodule nesting the profile follows: a git dir below it is not exempt, so a write there fails closed instead of going unprotected. */
+const MODULE_DEPTH = 8;
+
+/**
+ * The submodule git directories the project can reach, as modules trees. A plain checkout keeps them under the common dir's `modules/`; a LINKED worktree keeps its own under that
+ * worktree's git dir, `<common>/worktrees/<wt>/modules/`, so the trees are the common dir's, this worktree's own git dir's (whether or not it exists yet, so it cannot be pre-created)
+ * and every sibling worktree's that already has one: the common dir is writable from here (#518). Every discovered git dir also gets a tree of its own for its `modules/`, existing
+ * or not, so a submodule of a submodule is covered the same way (#520). Discovered in the hub process, outside the sandbox.
+ */
+function moduleGitDirs(root: string): ModuleGit[] {
+  const out = hubGitSync(["-C", root, "rev-parse", "--git-common-dir", "--absolute-git-dir"], { encoding: "utf8" });
+  if (out.status !== 0) return [];
+  const [commonRaw, ownRaw] = out.stdout.trim().split("\n");
+  if (!commonRaw || !ownRaw) return [];
+  const common = resolve(root, commonRaw), own = resolve(root, ownRaw);
+  const roots = new Set<string>([join(common, "modules"), join(own, "modules")]);
+  try {
+    for (const e of readdirSync(join(common, "worktrees"), { withFileTypes: true })) {
+      if (!e.isDirectory()) continue;
+      const modules = join(common, "worktrees", e.name, "modules");
+      if (existsSync(modules)) roots.add(modules);
     }
-    const names = new Set(entries.map((e) => e.name));
-    if (names.has("HEAD") && names.has("config")) {
-      dirs.push(dir);
-      const nested = join(dir, "modules");
-      if (names.has("modules")) walk(nested, depth + 1); // a submodule of a submodule
-      return;
+  } catch { /* no linked worktrees */ }
+  const trees: ModuleGit[] = [];
+  const tree = (modulesRoot: string, nesting: number): void => {
+    const dirs: string[] = [];
+    const walk = (dir: string, depth: number): void => {
+      if (depth > 8) return; // a path this deep is not a submodule layout git makes
+      let entries: Dirent[];
+      try {
+        entries = readdirSync(dir, { withFileTypes: true });
+      } catch {
+        return; // no modules tree (no submodules): nothing to discover
+      }
+      const names = new Set(entries.map((e) => e.name));
+      if (names.has("HEAD") && names.has("config")) { dirs.push(dir); return; }
+      for (const e of entries) if (e.isDirectory()) walk(join(dir, e.name), depth + 1);
+    };
+    walk(modulesRoot, 0);
+    // Past the nesting limit nothing is exempt, so a write below it is refused rather than left unprotected.
+    const found = nesting >= MODULE_DEPTH ? [] : dirs;
+    const entries = new Set<string>([modulesRoot]);
+    for (const d of found) for (let p = d; p.length > modulesRoot.length; p = dirname(p)) entries.add(p);
+    trees.push({ root: modulesRoot, entries: [...entries], dirs: found });
+    for (const d of found) {
+      tree(join(d, "modules"), nesting + 1); // a submodule of a submodule, whether or not it exists yet
+      // A submodule is a repository: its linked worktrees keep their own modules trees at `<d>/worktrees/<wt>/modules`. Existing ones are discovered here; ones that do not exist yet
+      // are covered by pattern in hubWriteRegexes (#520 review).
+      try {
+        for (const e of readdirSync(join(d, "worktrees"), { withFileTypes: true })) {
+          if (e.isDirectory() && existsSync(join(d, "worktrees", e.name, "modules"))) tree(join(d, "worktrees", e.name, "modules"), nesting + 1);
+        }
+      } catch { /* no linked worktrees */ }
     }
-    for (const e of entries) if (e.isDirectory()) walk(join(dir, e.name), depth + 1);
   };
-  walk(modulesRoot, 0);
-  const entries = new Set<string>([modulesRoot]);
-  for (const d of dirs) for (let p = d; p.length > modulesRoot.length; p = dirname(p)) entries.add(p);
-  return { root: modulesRoot, entries: [...entries] };
+  for (const modulesRoot of roots) tree(modulesRoot, 0);
+  return trees;
 }
 
 /** The system directories a deny-default profile lets commands read and run from: dyld, frameworks, toolchains. */
@@ -111,6 +149,7 @@ export function profile(cwd: string, network: SandboxNetwork, readAllow: string[
   const root = realPath(cwd);
   const gitDirs = externalGitDirs(root);
   const moduleGit = moduleGitDirs(root);
+  const worktrees = worktreesRoot(root);
   const creds = [".ssh", ".aws", ".gnupg", ".config/gh", ".config/gcloud", ".kube", ".docker", ".netrc", ".npmrc", ".omniroute", ".claude", ".codex", ".kimi-code", "Library/Keychains"];
   const dev = developerDir();
   const readable = [root, ...HOME_READABLE.map((p) => join(home, p)), ...readAllow.map(inHome), ...gitDirs, ...(dev ? [dev] : [])];
@@ -144,7 +183,7 @@ export function profile(cwd: string, network: SandboxNetwork, readAllow: string[
     // at any depth (creation, rename, symlink, gitfile), a submodule git dir's config and hooks under
     // .git/modules/ are refused at the depth submodules nest (#281), and the external git dirs get folded
     // hooks/config rules (#270). The cost: git init, clone and worktree add no longer run inside the sandbox.
-    `(deny file-write* ${hubWriteRegexes(root, gitDirs, moduleGit).join(" ")})`,
+    `(deny file-write* ${hubWriteRegexes(root, gitDirs, moduleGit, worktrees).join(" ")})`,
     `(deny file-read* file-write* ${creds.map((c) => `(subpath ${q(join(home, c))})`).join(" ")})`,
     `(deny file-read* file-write* ${denyRegexes(root, deny).join(" ")})`,
     // Python's own CA bundle (certifi, which pip vendors too): pip, requests and httpx read it instead of the system's (#64).

package/src/local/shell-environment.ts

@@ -0,0 +1,10 @@
+import { homedir } from "node:os";
+
+export interface HostShellEnvironment extends Record<string, string> { PATH: string; HOME: string; LANG: string; TERM: string }
+
+/** The #816 executor's fixed baseline, shared by the proof and host wrapper; never inherit a native agent's environment.
+ * ponytail: Seatbelt's accepted source stays byte-identical and adds TMPDIR separately; a future shared-executor
+ * extraction must preserve the runtime environment parity test and explicitly revise that source's byte guard. */
+export function hostShellEnvironment(extra: Readonly<Record<string, string>> = {}): HostShellEnvironment {
+  return { PATH: process.env.PATH ?? "/usr/bin:/bin", HOME: homedir(), LANG: process.env.LANG ?? "en_US.UTF-8", TERM: "dumb", ...extra };
+}

package/src/local/tools.ts

@@ -17,6 +17,8 @@ const approvalError = (picked: ToolApproval, denied: string): string | undefined
   : picked === "expired" ? APPROVAL_EXPIRED_TEXT
   : picked === "aborted" ? "error: approval withdrawn because the turn ended; no operation was executed" : denied;
 
+export type ShellPermitPolicy = { forceAsk?: true };
+export type ShellExecutionCheck = "valid" | "ask" | "aborted";
 export interface ToolContext {
   readOnly?: string[];
   cwd: string;
@@ -29,7 +31,9 @@ export interface ToolContext {
   /** Turn cancellation signal, including the execution-budget wall cap. */
   signal?: AbortSignal;
   /** Only true permits an effect; expiry and abort remain distinct from a person's denial. */
-  permit: (title: string, tool?: string, signal?: AbortSignal, canonicalTarget?: string, observe?: ApprovalObserver, originalPath?: string, input?: unknown) => Promise<ToolApproval>;
+  permit: (title: string, tool?: string, signal?: AbortSignal, canonicalTarget?: string, observe?: ApprovalObserver, originalPath?: string, input?: unknown, policy?: ShellPermitPolicy) => Promise<ToolApproval>;
+  /** Host-only synchronous recheck, immediately before a shell process can be spawned. */
+  shellExecutionCheck?: (input: unknown) => ShellExecutionCheck;
   /** Trusted process status, independent of what its stdout says. */
   onProcessExit?: (code: number | null) => void;
   /** Publish a message to other peers mid-turn. Returns a one-line receipt. */
@@ -102,7 +106,7 @@ export const TOOL_SCHEMAS = [
   fn("read", "Read a text file inside the project. Returns numbered lines.", { path: str, offset: { type: "integer", minimum: 1 }, limit: { type: "integer", minimum: 1 } }, ["path"]),
   fn("write", "Create or overwrite a file inside the project. Needs the user's approval.", { path: str, content: str }, ["path", "content"]),
   fn("edit", "Replace one exact, unique occurrence of `old` with `new` in a file. Needs the user's approval.", { path: str, old: str, new: str }, ["path", "old", "new"]),
-  fn("bash", "Run a shell command in the project directory, sandboxed: no writes outside the project, no credential reads, no network unless the hub enables it. Needs the user's approval.", { command: str, timeout_s: { type: "integer", minimum: 1, maximum: 600 } }, ["command"]),
+  fn("bash", "Run a shell command in the project directory, sandboxed: no writes outside the project, no credential reads, no network unless the hub enables it. Follows hub permission policy: proven bounded read-only commands may run automatically in ask-when-needed; other commands ask.", { command: str, timeout_s: { type: "integer", minimum: 1, maximum: 600 } }, ["command"]),
   fn("git", "Run git in the project. status, diff, log, show, ls-files, blame, rev-parse run freely; add, commit, restore, checkout, switch, stash, mv, rm, branch, merge, rebase, cherry-pick, revert, tag need approval; everything else (push, fetch, config, remote ...) is refused.", { args: { type: "array", items: str, minItems: 1 } }, ["args"]),
   fn("hub_send", "Send a message to the other agents now, before your turn ends. Conclusions only. Your final answer is shared anyway; use this for something that cannot wait.", { text: str, to: { type: "array", items: str } }, ["text"]),
 ];
@@ -179,8 +183,17 @@ export async function runTool(name: string, rawArgs: string, ctx: ToolContext):
         if (!command.trim()) return "error: empty command";
         // The approver sees the whole command, not a prefix: what is hidden cannot be approved.
         if (command.length > 4000) return "error: command longer than 4000 characters; put it in a script file with write, then run that";
-        const refused = approvalError(await ctx.permit(`bash: ${command}`, "bash", ctx.signal, undefined, undefined, undefined, a), "error: the user did not approve this command");
-        if (refused) return refused;
+        const input=Object.freeze({...a,command});
+        for(let attempt=0;;attempt++) {
+          const refused = approvalError(await ctx.permit(`bash: ${command}`, "bash", ctx.signal, undefined, undefined, undefined, input, attempt?{forceAsk:true}:undefined), "error: the user did not approve this command");
+          if (refused) return refused;
+          if(ctx.signal?.aborted)return "error: turn cancelled before shell execution";
+          let check:ShellExecutionCheck="valid";
+          try {check=ctx.shellExecutionCheck?.(input)??"valid";}catch{check="ask";}
+          if(check==="aborted" || ctx.signal?.aborted)return "error: turn cancelled before shell execution";
+          if(check==="valid")break;
+          if(attempt)return "error: read-only shell proof remained unstable; no command was executed";
+        }
         const res = await sandboxedExec(["/bin/bash", "-c", command], { cwd: ctx.cwd, profile: ctx.sandboxProfile, readOnlyData: !!ctx.readOnly?.length, timeoutMs: (Number(a.timeout_s) || 120) * 1000, ...(ctx.sandboxEnv ? { env: ctx.sandboxEnv } : {}), ...(ctx.signal ? { signal: ctx.signal } : {}) });
         try { ctx.onProcessExit?.(res.code); } catch { /* optional status observer never changes a tool result */ }
         return `${res.output}\n(exit ${res.code})`;

package/src/ui/index.html

@@ -1399,7 +1399,8 @@ function renderBoard(snapshot, peers, ids) {
       const data=(snapshot.boardLegend || []).find(item=>item.peer===id), row=el('div',undefined,'agent-slot');
       row.append(peerMark(id),el('p',String(peers[id].state || 'unknown'),'meta'));
       const wip=data && Number.isSafeInteger(data.wip) && data.wip>=0 ? data.wip : 'unknown';
-      row.append(el('p','WIP '+wip+(Number.isSafeInteger(data?.wipLimit) ? '/'+data.wipLimit : '')+' / permission '+(data?.permissionMode || 'unknown'),'meta'));
+      const split=data?.wipBreakdown,splitText=split && [split.active,split.reviewWait,split.reserved].every(Number.isSafeInteger) ? ' (active '+split.active+', review-wait '+split.reviewWait+', reserved '+split.reserved+')' : '';
+      row.append(el('p','WIP '+wip+(Number.isSafeInteger(data?.wipLimit) ? '/'+data.wipLimit : '')+splitText+' / permission '+(data?.permissionMode || 'unknown'),'meta'));
       if (Array.isArray(data?.activeTasks) && data.activeTasks.length) row.append(el('p','Active tasks: '+data.activeTasks.map(id=>'#'+id).join(', '),'meta'));
       const filter=el('button','View '+id);filter.type='button';filter.addEventListener('click',()=>{if(!boardViewState)return;peerFilter.value=id;renderBoard(boardViewState.snapshot,boardViewState.peers,boardViewState.ids)});row.append(filter);
       if (eligible.includes(id)) dropTarget(row,card=>card.assignable,{action:'assign',peer:id});
@@ -1673,6 +1674,7 @@ function render(snapshot) {
       if (peer.pullOnly && adapterDisplay[id]?.pullOnlyRead) more.append(el('p', 'Last hub_inbox read: ' + (typeof peer.lastInboxAt === 'number' ? Math.max(0, Math.floor((Date.now() - peer.lastInboxAt) / 1000)) + 's ago' : 'never'), 'meta'));
       if (peer.paused) more.append(el('p', peer.paused, 'meta'));
       if (peer.requestedModel) more.append(el('p', 'Requested: ' + peer.requestedModel, 'meta'));
+      if (peer.reviewScope === 'code' || peer.reviewScope === 'full') more.append(el('p', 'Review scope: ' + (peer.reviewScope === 'code' ? 'code only (cannot run tests or read CI; the merger gates on exact-head CI)' : 'full'), 'meta'));
       if (typeof peer.modelSource === 'string' && peer.modelSource) more.append(el('p', 'Model source: ' + peer.modelSource, 'meta'));
       for (const backend of peer.backends || []) {
         if (backend.requestedModel) more.append(el('p', backend.kind.toUpperCase() + ': ' + (backend.actualModel || 'model not reported') + ' (' + backend.state + ')', 'meta'));