@standardagents/code 0.13.7 → 0.13.8

package/dist/index.js

@@ -13,7 +13,7 @@ import * as transcript_delivery_star from '@standardagents/code-network/transcri
 import * as approvals_star from '@standardagents/code-network/approvals';
 import net from 'net';
 import { setImmediate } from 'timers';
-import fs11 from 'fs';
+import fs12 from 'fs';
 import { permissionKey, Bridge as Bridge$1 } from '@standardagents/code-network/bridge';
 import readline from 'readline';
 import * as types_star from '@standardagents/code-network/types';
@@ -103,10 +103,10 @@ var AccountUserStream = class {
       options.uniqueConnectionId
     );
   }
-  start() {
+  async start() {
     if (this.started) return;
     this.started = true;
-    this.hub.start();
+    await this.hub.start();
   }
   onEvent(listener) {
     this.eventListeners.add(listener);
@@ -119,7 +119,7 @@ var AccountUserStream = class {
   /** Wait for a live socket. The timeout is local and performs no network work. */
   waitUntilConnected(timeoutMs = 15e3) {
     if (this.connected) return Promise.resolve();
-    this.start();
+    void this.start();
     return new Promise((resolve, reject) => {
       let timer;
       const remove = this.onConnection((state) => {
@@ -217,6 +217,7 @@ function riskCeiling(state) {
 function decide(state, tool, risk, hasPermissionRequest) {
   const effectiveRisk = typeof risk === "number" ? Math.min(5, Math.max(1, risk)) : hasPermissionRequest ? 3 : 1;
   if (state.alwaysAllow.has(tool)) return "allow";
+  if (hasPermissionRequest) return "ask";
   return effectiveRisk <= riskCeiling(state) ? "allow" : "ask";
 }
 var CATASTROPHIC_PATTERNS = [
@@ -420,7 +421,7 @@ var ToolLedger = class {
     if (this.loaded) return;
     this.loaded = true;
     try {
-      const raw = fs11.readFileSync(this.file, "utf8");
+      const raw = fs12.readFileSync(this.file, "utf8");
       const parsed = JSON.parse(raw);
       for (const [id, entry] of Object.entries(parsed)) {
         if (entry && typeof entry.ok === "boolean") this.entries.set(id, entry);
@@ -452,13 +453,13 @@ var ToolLedger = class {
   }
   persist() {
     try {
-      fs11.mkdirSync(ledgerDir(), { recursive: true });
+      fs12.mkdirSync(ledgerDir(), { recursive: true });
       const out = {};
       for (const [id, entry] of this.entries) {
         const size = entry.result ? Buffer.byteLength(entry.result) : 0;
         out[id] = size > MAX_RESULT_BYTES ? { ...entry, result: void 0 } : entry;
       }
-      fs11.writeFileSync(this.file, JSON.stringify(out), { mode: 384 });
+      fs12.writeFileSync(this.file, JSON.stringify(out), { mode: 384 });
     } catch {
     }
   }
@@ -1546,6 +1547,46 @@ var WordMill = class {
 // src/types.ts
 var types_exports = {};
 __reExport(types_exports, types_star);
+
+// src/subprocess-env.ts
+var INHERITED_ENV_ALLOWLIST = /* @__PURE__ */ new Set([
+  "APPDATA",
+  "COMSPEC",
+  "HOME",
+  "LANG",
+  "LC_ALL",
+  "LC_CTYPE",
+  "LOCALAPPDATA",
+  "LOGNAME",
+  "PATH",
+  "PATHEXT",
+  "PROGRAMDATA",
+  "SHELL",
+  "SYSTEMROOT",
+  "TEMP",
+  "TERM",
+  "TMP",
+  "TMPDIR",
+  "USER",
+  "USERPROFILE",
+  "WINDIR"
+]);
+function inheritedSubprocessEnv(ambient = process.env) {
+  const child = { ...ambient };
+  delete child.NODE_TLS_REJECT_UNAUTHORIZED;
+  return child;
+}
+function restrictedSubprocessEnv(explicit = {}, ambient = process.env) {
+  const inherited = {};
+  for (const [name, value] of Object.entries(ambient)) {
+    if (value !== void 0 && INHERITED_ENV_ALLOWLIST.has(name.toUpperCase())) {
+      inherited[name] = value;
+    }
+  }
+  return { ...inherited, ...explicit };
+}
+
+// src/clipboard.ts
 var FILE_MIMES = {
   ".png": "image/png",
   ".jpg": "image/jpeg",
@@ -1556,7 +1597,11 @@ var FILE_MIMES = {
 var MAX_IMAGE_BYTES = 8 * 1024 * 1024;
 function run(cmd, args, maxBuffer = MAX_IMAGE_BYTES * 2) {
   return new Promise((resolve) => {
-    execFile(cmd, args, { encoding: "buffer", maxBuffer }, (err, stdout) => {
+    execFile(cmd, args, {
+      encoding: "buffer",
+      maxBuffer,
+      env: inheritedSubprocessEnv()
+    }, (err, stdout) => {
       resolve({ ok: !err, stdout: stdout ?? Buffer.alloc(0) });
     });
   });
@@ -1565,9 +1610,9 @@ function fromFile(filePath) {
   const mime = FILE_MIMES[path9.extname(filePath).toLowerCase()];
   if (!mime) return null;
   try {
-    const stat = fs11.statSync(filePath);
+    const stat = fs12.statSync(filePath);
     if (!stat.isFile() || stat.size === 0 || stat.size > MAX_IMAGE_BYTES) return null;
-    return { data: fs11.readFileSync(filePath).toString("base64"), mime };
+    return { data: fs12.readFileSync(filePath).toString("base64"), mime };
   } catch {
     return null;
   }
@@ -1585,7 +1630,7 @@ async function readDarwin() {
   if (png.ok) {
     const img = fromFile(tmp);
     try {
-      fs11.unlinkSync(tmp);
+      fs12.unlinkSync(tmp);
     } catch {
     }
     if (img) return img;
@@ -1619,7 +1664,7 @@ async function readWindows() {
   await run("powershell", ["-NoProfile", "-STA", "-Command", ps]);
   const img = fromFile(tmp);
   try {
-    fs11.unlinkSync(tmp);
+    fs12.unlinkSync(tmp);
   } catch {
   }
   return img;
@@ -3816,6 +3861,18 @@ __reExport(shared_messaging_exports, shared_messaging_star);
 var history_exports = {};
 __reExport(history_exports, history_star);
 var LOG_DIR = path9.join(os6.homedir(), ".standardagents", "process-logs");
+function openPrivateProcessLog(logPath) {
+  const directory = path9.dirname(logPath);
+  fs12.mkdirSync(directory, { recursive: true, mode: 448 });
+  fs12.chmodSync(directory, 448);
+  const descriptor = fs12.openSync(
+    logPath,
+    fs12.constants.O_WRONLY | fs12.constants.O_CREAT | fs12.constants.O_APPEND,
+    384
+  );
+  fs12.fchmodSync(descriptor, 384);
+  return descriptor;
+}
 function isAlive(pid) {
   try {
     process.kill(pid, 0);
@@ -3834,7 +3891,7 @@ function configFile() {
 }
 function loadMcpConfig() {
   try {
-    const raw = fs11.readFileSync(configFile(), "utf8");
+    const raw = fs12.readFileSync(configFile(), "utf8");
     const parsed = JSON.parse(raw);
     if (!parsed.servers || typeof parsed.servers !== "object") parsed.servers = {};
     return parsed;
@@ -3865,8 +3922,8 @@ function setMcpServerEnabled(name, enabled) {
 }
 function write(cfg) {
   const file2 = configFile();
-  fs11.mkdirSync(path9.dirname(file2), { recursive: true });
-  fs11.writeFileSync(file2, JSON.stringify(cfg, null, 2), { mode: 384 });
+  fs12.mkdirSync(path9.dirname(file2), { recursive: true });
+  fs12.writeFileSync(file2, JSON.stringify(cfg, null, 2), { mode: 384 });
 }
 function parseServerSpec(spec) {
   const trimmed = spec.trim();
@@ -3937,7 +3994,11 @@ function openUrl(url) {
   const cmd = platform === "darwin" ? "open" : platform === "win32" ? "cmd" : "xdg-open";
   const args = platform === "win32" ? ["/c", "start", "", url] : [url];
   try {
-    const child = spawn(cmd, args, { stdio: "ignore", detached: true });
+    const child = spawn(cmd, args, {
+      stdio: "ignore",
+      detached: true,
+      env: inheritedSubprocessEnv()
+    });
     child.unref();
   } catch {
   }
@@ -3949,11 +4010,11 @@ __reExport(recorder_exports, recorder_star);
 __reExport(recorder_exports, recorder_node_star);
 function readVersion() {
   try {
-    const pkg = JSON.parse(fs11.readFileSync(new URL("../package.json", import.meta.url), "utf8"));
+    const pkg = JSON.parse(fs12.readFileSync(new URL("../package.json", import.meta.url), "utf8"));
     if (typeof pkg.version === "string" && pkg.version) return pkg.version;
   } catch {
   }
-  return "0.13.7" ;
+  return "0.13.8" ;
 }
 function isLocalHost(host) {
   return host === "localhost" || host === "127.0.0.1" || host === "::1" || host.endsWith(".local") || host.endsWith(".localhost") || /^10\./.test(host) || /^192\.168\./.test(host) || /^172\.(1[6-9]|2\d|3[01])\./.test(host);
@@ -3979,7 +4040,7 @@ var dir = () => path9.join(os6.homedir(), ".standardagents");
 var file = () => path9.join(dir(), "machine.json");
 function loadMachineIdentity() {
   try {
-    const parsed = JSON.parse(fs11.readFileSync(file(), "utf8"));
+    const parsed = JSON.parse(fs12.readFileSync(file(), "utf8"));
     if (typeof parsed.machine_id === "string" && parsed.machine_id.length > 0) {
       return { machine_id: parsed.machine_id, created_at: parsed.created_at ?? Date.now() };
     }
@@ -3993,8 +4054,8 @@ function loadMachineIdentity() {
   return identity;
 }
 function saveMachineIdentity(identity) {
-  fs11.mkdirSync(dir(), { recursive: true });
-  fs11.writeFileSync(file(), JSON.stringify(identity, null, 2), { mode: 384 });
+  fs12.mkdirSync(dir(), { recursive: true });
+  fs12.writeFileSync(file(), JSON.stringify(identity, null, 2), { mode: 384 });
 }
 function daemonClientId(identity) {
   return `daemon:${identity.machine_id}`;
@@ -4325,7 +4386,8 @@ function projectRepository(projectDir) {
     const url = execFileSync("git", ["-C", projectDir, "remote", "get-url", "origin"], {
       encoding: "utf8",
       timeout: 3e3,
-      stdio: ["ignore", "pipe", "ignore"]
+      stdio: ["ignore", "pipe", "ignore"],
+      env: inheritedSubprocessEnv()
     }).trim();
     return url || null;
   } catch {
@@ -4504,7 +4566,7 @@ function markers(dirPath) {
   for (const marker of PROJECT_MARKERS) {
     let hit = false;
     try {
-      hit = fs11.existsSync(path9.join(dirPath, marker));
+      hit = fs12.existsSync(path9.join(dirPath, marker));
     } catch {
       hit = false;
     }
@@ -4526,11 +4588,11 @@ function browseDirectory(input3, opts = {}) {
   };
   let dirents;
   try {
-    const stat = fs11.statSync(abs);
+    const stat = fs12.statSync(abs);
     if (!stat.isDirectory()) {
       return { ...base, entries: [], truncated: false, error: "Not a directory" };
     }
-    dirents = fs11.readdirSync(abs, { withFileTypes: true });
+    dirents = fs12.readdirSync(abs, { withFileTypes: true });
   } catch (err) {
     const code = err?.code;
     const message = code === "EACCES" || code === "EPERM" ? "Permission denied" : code === "ENOENT" ? "Folder not found" : "Could not read this folder";
@@ -4545,7 +4607,7 @@ function browseDirectory(input3, opts = {}) {
     let isDir = d.isDirectory();
     if (d.isSymbolicLink()) {
       try {
-        isDir = fs11.statSync(path9.join(abs, name)).isDirectory();
+        isDir = fs12.statSync(path9.join(abs, name)).isDirectory();
       } catch {
         isDir = false;
       }
@@ -4576,7 +4638,7 @@ function mkdirDirectory(parentInput, name, opts = {}) {
     return { ...listParent(), error: "Invalid folder name." };
   }
   try {
-    fs11.mkdirSync(target, { recursive: false });
+    fs12.mkdirSync(target, { recursive: false });
   } catch (err) {
     const code = err?.code;
     const message = code === "EEXIST" ? "A folder with that name already exists." : code === "EACCES" || code === "EPERM" ? "Permission denied." : code === "ENOENT" ? "The parent folder no longer exists." : "Could not create the folder.";
@@ -4791,7 +4853,10 @@ function probe(cmd) {
   return new Promise((resolve) => {
     let child;
     try {
-      child = spawn(cmd, ["--version"], { stdio: "ignore" });
+      child = spawn(cmd, ["--version"], {
+        stdio: "ignore",
+        env: inheritedSubprocessEnv()
+      });
     } catch {
       resolve(false);
       return;
@@ -4827,7 +4892,7 @@ function download(url, dest, redirects = 5) {
         reject(new Error(`HTTP ${status} for ${url}`));
         return;
       }
-      const out = fs11.createWriteStream(dest);
+      const out = fs12.createWriteStream(dest);
       res.pipe(out);
       out.on("finish", () => out.close(() => resolve()));
       out.on("error", reject);
@@ -4838,7 +4903,7 @@ function download(url, dest, redirects = 5) {
 async function sha256File(file2) {
   const hash = crypto.createHash("sha256");
   await new Promise((resolve, reject) => {
-    const stream = fs11.createReadStream(file2);
+    const stream = fs12.createReadStream(file2);
     stream.on("data", (chunk) => hash.update(chunk));
     stream.on("end", () => resolve());
     stream.on("error", reject);
@@ -4849,7 +4914,11 @@ function runOk(cmd, args, cwd) {
   return new Promise((resolve) => {
     let child;
     try {
-      child = spawn(cmd, args, { cwd, stdio: "ignore" });
+      child = spawn(cmd, args, {
+        cwd,
+        stdio: "ignore",
+        env: inheritedSubprocessEnv()
+      });
     } catch {
       resolve(false);
       return;
@@ -4876,7 +4945,7 @@ async function provision(target) {
     let extracted = null;
     for (const entry of entries) {
       const candidate = entry.isDirectory() ? path9.join(work, entry.name, binName) : entry.name === binName ? path9.join(work, entry.name) : null;
-      if (candidate && fs11.existsSync(candidate)) {
+      if (candidate && fs12.existsSync(candidate)) {
         extracted = candidate;
         break;
       }
@@ -4901,7 +4970,7 @@ function resolveRg(log) {
       const override = process.env.STANDARDCODE_RG_PATH;
       if (override && await probe(override)) return override;
       if (await probe("rg")) return "rg";
-      if (fs11.existsSync(RG_BIN) && await probe(RG_BIN)) return RG_BIN;
+      if (fs12.existsSync(RG_BIN) && await probe(RG_BIN)) return RG_BIN;
       const target = RG_TARGETS[`${process.platform}-${process.arch}`];
       if (!target) return null;
       try {
@@ -4960,16 +5029,36 @@ var HostTools = class {
   mcp;
   onMcpCatalogChange;
   api;
-  /** Resolve a user/model-supplied path against the project directory. */
+  /** Resolve a user/model-supplied path against the project directory.
+   * A leading `~` expands to the host home directory — without this, a
+   * model-supplied `~/Desktop/x` silently lands at `<project>/~/Desktop/x`.
+   * Outside-project containment checks run on the resolved result, so an
+   * expanded home path still requires a fresh human decision. */
   resolve(p) {
     if (!p || p === ".") return this.projectDir;
+    if (p === "~" || p.startsWith("~/")) {
+      p = path9.join(os6.homedir(), p.slice(1));
+    }
     return path9.resolve(this.projectDir, p);
   }
-  /** True when the resolved path escapes the project directory. */
+  /** Resolve symlinks in an existing target or its nearest existing ancestor. */
+  realPathForContainment(target) {
+    const missing = [];
+    let existing = path9.resolve(target);
+    while (!fs12.existsSync(existing)) {
+      const parent = path9.dirname(existing);
+      if (parent === existing) return path9.resolve(target);
+      missing.unshift(path9.basename(existing));
+      existing = parent;
+    }
+    return path9.join(fs12.realpathSync.native(existing), ...missing);
+  }
+  /** True when the resolved path escapes the real project directory. */
   isOutsideProject(p) {
-    const abs = this.resolve(p);
-    const rel = path9.relative(this.projectDir, abs);
-    return rel.startsWith("..") || path9.isAbsolute(rel);
+    const project = this.realPathForContainment(this.projectDir);
+    const candidate = this.realPathForContainment(this.resolve(p));
+    const rel = path9.relative(project, candidate);
+    return rel === ".." || rel.startsWith(`..${path9.sep}`) || path9.isAbsolute(rel);
   }
   async execute(tool, args) {
     try {
@@ -5065,7 +5154,7 @@ var HostTools = class {
     const file2 = this.resolve(String(args.path || ""));
     const content = String(args.content ?? "");
     await fsp2.mkdir(path9.dirname(file2), { recursive: true });
-    const existed = fs11.existsSync(file2);
+    const existed = fs12.existsSync(file2);
     await fsp2.writeFile(file2, content, "utf8");
     return {
       ok: true,
@@ -5107,7 +5196,7 @@ var HostTools = class {
     if (!bytes) return { ok: false, error: `Could not download ${source} from the thread filesystem.` };
     const dest = this.resolve(destArg);
     await fsp2.mkdir(path9.dirname(dest), { recursive: true });
-    const existed = fs11.existsSync(dest);
+    const existed = fs12.existsSync(dest);
     await fsp2.writeFile(dest, bytes);
     return {
       ok: true,
@@ -5184,7 +5273,7 @@ var HostTools = class {
     return await new Promise((resolvePromise) => {
       const child = spawn(cmd, argv, {
         cwd: this.projectDir,
-        env: { ...process.env, SKILL_DIR: skillDir },
+        env: restrictedSubprocessEnv({ SKILL_DIR: skillDir }),
         stdio: ["ignore", "pipe", "pipe"]
       });
       let out = "";
@@ -5237,30 +5326,34 @@ ${truncated}`
     const command = String(args.command || "");
     if (!command.trim()) return { ok: false, error: "command is required" };
     const cwd = args.cwd ? this.resolve(String(args.cwd)) : this.projectDir;
-    if (!fs11.existsSync(cwd)) {
+    if (!fs12.existsSync(cwd)) {
       return { ok: false, error: `cwd does not exist: ${cwd}` };
     }
     const id = crypto.randomUUID().slice(0, 8);
     const logPath = path9.join(LOG_DIR, `${id}.log`);
     let out;
     try {
-      await fsp2.mkdir(LOG_DIR, { recursive: true });
-      out = fs11.openSync(logPath, "a");
+      out = openPrivateProcessLog(logPath);
     } catch (err) {
       return { ok: false, error: `Could not open log file: ${err instanceof Error ? err.message : String(err)}` };
     }
     let child;
     try {
-      child = spawn("bash", ["-lc", command], { cwd, detached: true, stdio: ["ignore", out, out] });
+      child = spawn("bash", ["-lc", command], {
+        cwd,
+        detached: true,
+        stdio: ["ignore", out, out],
+        env: inheritedSubprocessEnv()
+      });
     } catch (err) {
-      fs11.closeSync(out);
+      fs12.closeSync(out);
       return { ok: false, error: `Failed to start: ${err instanceof Error ? err.message : String(err)}` };
     }
     let spawnError = null;
     child.on("error", (err) => {
       spawnError = err;
     });
-    fs11.closeSync(out);
+    fs12.closeSync(out);
     const pid = child.pid;
     let earlyExit;
     const onEarlyExit = (code) => {
@@ -5466,7 +5559,11 @@ ${tail2}` : " No output was captured.")
       const MAX_OUTPUT = 256 * 1024;
       let child;
       try {
-        child = spawn(cmd, args, { cwd, detached: true });
+        child = spawn(cmd, args, {
+          cwd,
+          detached: true,
+          env: inheritedSubprocessEnv()
+        });
       } catch {
         resolve({ stdout: "", stderr: "", code: 127, timedOut: false });
         return;
@@ -5566,7 +5663,7 @@ var McpClient = class {
   async connect(defaultCwd) {
     const child = spawn(this.config.command, this.config.args, {
       cwd: this.config.cwd || defaultCwd,
-      env: { ...process.env, ...this.config.env || {} },
+      env: restrictedSubprocessEnv(this.config.env),
       stdio: ["pipe", "pipe", "pipe"]
     });
     this.child = child;
@@ -6030,7 +6127,7 @@ var DaemonUserStream = class {
     if (hooks.onConnection) this.stream.onConnection(hooks.onConnection);
   }
   start() {
-    this.stream.start();
+    return this.stream.start();
   }
   close() {
     this.stream.close();
@@ -6073,7 +6170,7 @@ function cachePath() {
 }
 function readCache() {
   try {
-    const raw = fs11.readFileSync(cachePath(), "utf-8");
+    const raw = fs12.readFileSync(cachePath(), "utf-8");
     return JSON.parse(raw);
   } catch {
     return null;
@@ -6082,14 +6179,14 @@ function readCache() {
 function writeCache(latest) {
   try {
     const dir2 = cacheDir();
-    if (!fs11.existsSync(dir2)) fs11.mkdirSync(dir2, { recursive: true });
-    fs11.writeFileSync(cachePath(), JSON.stringify({ latest, timestamp: Date.now() }));
+    if (!fs12.existsSync(dir2)) fs12.mkdirSync(dir2, { recursive: true });
+    fs12.writeFileSync(cachePath(), JSON.stringify({ latest, timestamp: Date.now() }));
   } catch {
   }
 }
 function readAutoUpdateState(dir2 = cacheDir()) {
   try {
-    const raw = fs11.readFileSync(path9.join(dir2, STATE_FILE), "utf-8");
+    const raw = fs12.readFileSync(path9.join(dir2, STATE_FILE), "utf-8");
     const state = JSON.parse(raw);
     return typeof state?.version === "string" ? state : null;
   } catch {
@@ -6098,14 +6195,14 @@ function readAutoUpdateState(dir2 = cacheDir()) {
 }
 function writeAutoUpdateState(state, dir2 = cacheDir()) {
   try {
-    if (!fs11.existsSync(dir2)) fs11.mkdirSync(dir2, { recursive: true });
-    fs11.writeFileSync(path9.join(dir2, STATE_FILE), JSON.stringify(state));
+    if (!fs12.existsSync(dir2)) fs12.mkdirSync(dir2, { recursive: true });
+    fs12.writeFileSync(path9.join(dir2, STATE_FILE), JSON.stringify(state));
   } catch {
   }
 }
 function clearAutoUpdateState(dir2 = cacheDir()) {
   try {
-    fs11.unlinkSync(path9.join(dir2, STATE_FILE));
+    fs12.unlinkSync(path9.join(dir2, STATE_FILE));
   } catch {
   }
 }
@@ -6152,7 +6249,11 @@ function startBackgroundUpdate(latest, pm, dir2 = cacheDir()) {
   const { cmd, args } = updateCommand(pm);
   const script = `const cp=require('child_process');const fs=require('fs');const r=cp.spawnSync(${JSON.stringify(cmd)},${JSON.stringify(args)},{shell:process.platform==='win32',encoding:'utf8'});const out=((r.stdout||'')+(r.stderr||'')).slice(-2000);fs.writeFileSync(${JSON.stringify(stateFile)},JSON.stringify({version:${JSON.stringify(latest)},startedAt:${startedAt},exitCode:r.status==null?-1:r.status,finishedAt:Date.now(),output:out}));`;
   try {
-    const child = spawn(process.execPath, ["-e", script], { detached: true, stdio: "ignore" });
+    const child = spawn(process.execPath, ["-e", script], {
+      detached: true,
+      stdio: "ignore",
+      env: inheritedSubprocessEnv()
+    });
     child.unref();
     return true;
   } catch {
@@ -6224,7 +6325,8 @@ function runUpdate(pm) {
     const { cmd, args } = updateCommand(pm);
     const child = spawn(cmd, args, {
       shell: process.platform === "win32",
-      stdio: ["ignore", "pipe", "pipe"]
+      stdio: ["ignore", "pipe", "pipe"],
+      env: inheritedSubprocessEnv()
     });
     let out = "";
     child.stdout?.on("data", (d) => out += d);
@@ -6240,22 +6342,30 @@ var UPDATE_CHECK_MS = 6 * 60 * 6e4;
 var MAX_WORKERS = 30;
 var BRIDGE_ATTACH_GRACE_MS = 15e3;
 var BRIDGE_IDLE_MS = 2e3;
+var LIVE_FRAME_APPROVAL_TIMEOUT_MS = 45e3;
 var LOG_MAX_BYTES = 1e6;
 var LOG_FILE = path9.join(os6.homedir(), ".standardagents", "daemon.log");
-function daemonLog(line) {
+function appendPrivateLog(file2, line, maxBytes) {
   try {
-    fs11.mkdirSync(path9.dirname(LOG_FILE), { recursive: true });
+    const directory = path9.dirname(file2);
+    fs12.mkdirSync(directory, { recursive: true, mode: 448 });
+    fs12.chmodSync(directory, 448);
     try {
-      if (fs11.statSync(LOG_FILE).size > LOG_MAX_BYTES) {
-        fs11.renameSync(LOG_FILE, `${LOG_FILE}.old`);
+      fs12.chmodSync(file2, 384);
+      if (fs12.statSync(file2).size > maxBytes) {
+        fs12.renameSync(file2, `${file2}.old`);
       }
     } catch {
     }
-    fs11.appendFileSync(LOG_FILE, `${(/* @__PURE__ */ new Date()).toISOString()} ${line}
-`);
+    fs12.appendFileSync(file2, line, { mode: 384 });
+    fs12.chmodSync(file2, 384);
   } catch {
   }
 }
+function daemonLog(line) {
+  appendPrivateLog(LOG_FILE, `${(/* @__PURE__ */ new Date()).toISOString()} ${line}
+`, LOG_MAX_BYTES);
+}
 function pathFromTags(tags) {
   const tag = tags.find((t) => t.startsWith("path:"));
   if (!tag) return null;
@@ -6320,7 +6430,8 @@ var ThreadWorker = class {
           const permKey = permissionKey(req);
           const fresh = decide(this.perm, permKey, effectiveRisk, !!req.requestPermission);
           if (fresh === "allow") return { choice: "allow" };
-          if (!req.toolCallId) {
+          const relayId = req.toolCallId ?? req.id;
+          if (!relayId) {
             return { choice: "deny", reason: "No one is available to approve this right now." };
           }
           daemonLog(`[${threadId.slice(0, 8)}] relaying approval: ${summary} (risk ${effectiveRisk})`);
@@ -6331,7 +6442,7 @@ var ThreadWorker = class {
               api,
               threadId,
               {
-                tool_call_id: req.toolCallId,
+                tool_call_id: relayId,
                 tool: req.tool,
                 summary,
                 permission: req.requestPermission,
@@ -6339,7 +6450,15 @@ var ThreadWorker = class {
                 machine: machineName,
                 requested_at: Date.now()
               },
-              { subscribe: (wake) => approvalWakes.subscribe(threadId, wake) }
+              {
+                subscribe: (wake) => approvalWakes.subscribe(threadId, wake),
+                // A live frame is answered over the socket and the server fails
+                // the call on its own frame timeout — bound the human wait so a
+                // late "allow" can never execute a side effect into a frame the
+                // server already gave up on. Durable calls park server-side and
+                // keep the long default.
+                timeoutMs: req.toolCallId ? void 0 : LIVE_FRAME_APPROVAL_TIMEOUT_MS
+              }
             );
             if (!response) {
               return { choice: "deny", reason: "The approval request timed out with no one to approve it." };
@@ -6514,7 +6633,7 @@ Run \`standardcode daemon install\` (or plain \`standardcode\`) once to sign in.
       daemonLog(`detached ${oldest.threadId.slice(0, 8)} (worker cap)`);
     }
     try {
-      fs11.mkdirSync(projectDir, { recursive: true });
+      fs12.mkdirSync(projectDir, { recursive: true });
     } catch (e) {
       daemonLog(`cannot prepare project dir ${projectDir}: ${e instanceof Error ? e.message : String(e)}`);
       return;
@@ -6817,7 +6936,7 @@ function resolveDaemonCommand(extraArgs = []) {
     let tsx = null;
     for (let i = 0; i < 6 && dir2 !== path9.dirname(dir2); i++) {
       const candidate = path9.join(dir2, "node_modules", "tsx", "dist", "cli.mjs");
-      if (fs11.existsSync(candidate)) {
+      if (fs12.existsSync(candidate)) {
         tsx = candidate;
         break;
       }
@@ -6847,7 +6966,10 @@ function servicePath() {
   return [.../* @__PURE__ */ new Set([...current, ...parts])].join(":");
 }
 function run2(cmd, args) {
-  const res = spawnSync(cmd, args, { encoding: "utf8" });
+  const res = spawnSync(cmd, args, {
+    encoding: "utf8",
+    env: inheritedSubprocessEnv()
+  });
   const output4 = `${res.stdout ?? ""}${res.stderr ?? ""}`.trim();
   return { ok: res.status === 0, output: output4 };
 }
@@ -6865,8 +6987,8 @@ function installService(command, endpoint) {
 }
 function installLaunchd(command, endpoint) {
   const logDir = path9.join(os6.homedir(), ".standardagents");
-  fs11.mkdirSync(logDir, { recursive: true });
-  fs11.mkdirSync(path9.dirname(plistPath()), { recursive: true });
+  fs12.mkdirSync(logDir, { recursive: true });
+  fs12.mkdirSync(path9.dirname(plistPath()), { recursive: true });
   const envEntries = [
     `      <key>PATH</key><string>${xmlEscape(servicePath())}</string>`,
     ...endpoint ? [`      <key>STANDARD_CODE_DAEMON_ENDPOINT</key><string>${xmlEscape(endpoint)}</string>`] : []
@@ -6892,7 +7014,7 @@ ${envEntries}
   </dict>
 </plist>
 `;
-  fs11.writeFileSync(plistPath(), plist);
+  fs12.writeFileSync(plistPath(), plist);
   const uid = typeof process.getuid === "function" ? process.getuid() : 501;
   run2("launchctl", ["bootout", `gui/${uid}`, plistPath()]);
   const boot = run2("launchctl", ["bootstrap", `gui/${uid}`, plistPath()]);
@@ -6909,7 +7031,7 @@ ${envEntries}
   return { ok: true, detail: `LaunchAgent installed (${plistPath()})` };
 }
 function installSystemd(command, endpoint) {
-  fs11.mkdirSync(path9.dirname(unitPath()), { recursive: true });
+  fs12.mkdirSync(path9.dirname(unitPath()), { recursive: true });
   const unit = `[Unit]
 Description=Standard Code daemon (headless coding-agent execution client)
 After=network-online.target
@@ -6924,7 +7046,7 @@ ${endpoint ? `Environment=STANDARD_CODE_DAEMON_ENDPOINT=${endpoint}
 [Install]
 WantedBy=default.target
 `;
-  fs11.writeFileSync(unitPath(), unit);
+  fs12.writeFileSync(unitPath(), unit);
   const reload = run2("systemctl", ["--user", "daemon-reload"]);
   if (!reload.ok) {
     return {
@@ -6948,7 +7070,7 @@ function uninstallService() {
     const uid = typeof process.getuid === "function" ? process.getuid() : 501;
     run2("launchctl", ["bootout", `gui/${uid}`, plistPath()]);
     try {
-      fs11.unlinkSync(plistPath());
+      fs12.unlinkSync(plistPath());
     } catch {
     }
     return { ok: true, detail: "LaunchAgent removed" };
@@ -6956,7 +7078,7 @@ function uninstallService() {
   if (process.platform === "linux") {
     run2("systemctl", ["--user", "disable", "--now", SYSTEMD_UNIT]);
     try {
-      fs11.unlinkSync(unitPath());
+      fs12.unlinkSync(unitPath());
     } catch {
     }
     run2("systemctl", ["--user", "daemon-reload"]);
@@ -6966,7 +7088,7 @@ function uninstallService() {
 }
 function serviceStatus() {
   if (process.platform === "darwin") {
-    const installed = fs11.existsSync(plistPath());
+    const installed = fs12.existsSync(plistPath());
     const list = run2("launchctl", ["list", SERVICE_LABEL]);
     const pidMatch = list.output.match(/"PID"\s*=\s*(\d+)/);
     return {
@@ -6976,7 +7098,7 @@ function serviceStatus() {
     };
   }
   if (process.platform === "linux") {
-    const installed = fs11.existsSync(unitPath());
+    const installed = fs12.existsSync(unitPath());
     const active = run2("systemctl", ["--user", "is-active", SYSTEMD_UNIT]);
     return {
       installed,
@@ -7199,7 +7321,7 @@ async function projectCommand(action, target) {
     process.exit(1);
   }
   const dir2 = path9.resolve(target);
-  if (action === "add" && !fs11.existsSync(dir2)) {
+  if (action === "add" && !fs12.existsSync(dir2)) {
     stdout.write(`${c3.red}\u2717${c3.reset} ${dir2} does not exist on this machine.
 `);
     process.exit(1);
@@ -7268,15 +7390,15 @@ var DIR = path9.join(os6.homedir(), ".standardagents");
 var FILE = path9.join(DIR, "prefs.json");
 function loadPrefs(file2 = FILE) {
   try {
-    return JSON.parse(fs11.readFileSync(file2, "utf8"));
+    return JSON.parse(fs12.readFileSync(file2, "utf8"));
   } catch {
     return {};
   }
 }
 function savePrefs(update, file2 = FILE) {
   const merged = { ...loadPrefs(file2), ...update };
-  fs11.mkdirSync(path9.dirname(file2), { recursive: true });
-  fs11.writeFileSync(file2, JSON.stringify(merged, null, 2));
+  fs12.mkdirSync(path9.dirname(file2), { recursive: true });
+  fs12.writeFileSync(file2, JSON.stringify(merged, null, 2));
 }
 function shouldOfferDaemonInstall(facts) {
   if (facts.optedOutEnv) return false;