@standardagents/code 0.13.7 → 0.13.9

package/dist/index.js

@@ -13,7 +13,8 @@ import * as transcript_delivery_star from '@standardagents/code-network/transcri
 import * as approvals_star from '@standardagents/code-network/approvals';
 import net from 'net';
 import { setImmediate } from 'timers';
-import fs11 from 'fs';
+import fs12 from 'fs';
+import { isTranscriptMetaTool } from '@standardagents/code-network/tool-activity';
 import { permissionKey, Bridge as Bridge$1 } from '@standardagents/code-network/bridge';
 import readline from 'readline';
 import * as types_star from '@standardagents/code-network/types';
@@ -103,10 +104,10 @@ var AccountUserStream = class {
       options.uniqueConnectionId
     );
   }
-  start() {
+  async start() {
     if (this.started) return;
     this.started = true;
-    this.hub.start();
+    await this.hub.start();
   }
   onEvent(listener) {
     this.eventListeners.add(listener);
@@ -119,7 +120,7 @@ var AccountUserStream = class {
   /** Wait for a live socket. The timeout is local and performs no network work. */
   waitUntilConnected(timeoutMs = 15e3) {
     if (this.connected) return Promise.resolve();
-    this.start();
+    void this.start();
     return new Promise((resolve, reject) => {
       let timer;
       const remove = this.onConnection((state) => {
@@ -217,6 +218,7 @@ function riskCeiling(state) {
 function decide(state, tool, risk, hasPermissionRequest) {
   const effectiveRisk = typeof risk === "number" ? Math.min(5, Math.max(1, risk)) : hasPermissionRequest ? 3 : 1;
   if (state.alwaysAllow.has(tool)) return "allow";
+  if (hasPermissionRequest) return "ask";
   return effectiveRisk <= riskCeiling(state) ? "allow" : "ask";
 }
 var CATASTROPHIC_PATTERNS = [
@@ -420,7 +422,7 @@ var ToolLedger = class {
     if (this.loaded) return;
     this.loaded = true;
     try {
-      const raw = fs11.readFileSync(this.file, "utf8");
+      const raw = fs12.readFileSync(this.file, "utf8");
       const parsed = JSON.parse(raw);
       for (const [id, entry] of Object.entries(parsed)) {
         if (entry && typeof entry.ok === "boolean") this.entries.set(id, entry);
@@ -452,13 +454,13 @@ var ToolLedger = class {
   }
   persist() {
     try {
-      fs11.mkdirSync(ledgerDir(), { recursive: true });
+      fs12.mkdirSync(ledgerDir(), { recursive: true });
       const out = {};
       for (const [id, entry] of this.entries) {
         const size = entry.result ? Buffer.byteLength(entry.result) : 0;
         out[id] = size > MAX_RESULT_BYTES ? { ...entry, result: void 0 } : entry;
       }
-      fs11.writeFileSync(this.file, JSON.stringify(out), { mode: 384 });
+      fs12.writeFileSync(this.file, JSON.stringify(out), { mode: 384 });
     } catch {
     }
   }
@@ -686,7 +688,10 @@ var Bridge = class extends Bridge$1 {
         isCatastrophic: (command) => isCatastrophic(command),
         decide: (permKey, risk, requestPermission) => decide(perm, permKey, risk, requestPermission),
         grantAlways: (permKey) => void perm.alwaysAllow.add(permKey),
-        grantRisk: (risk) => void perm.allowRisk.add(risk),
+        grantRisk: (risk) => {
+          perm.level = Math.max(perm.level, risk);
+          perm.allowRisk.clear();
+        },
         persistApprovals: () => void (0, approvals_exports.saveApprovals)(api, threadId, perm)
       },
       {
@@ -797,7 +802,6 @@ function prettyAgentName(id) {
   if (!key) return "subagent";
   return AGENT_NAMES[key] || key.replace(/[_-]+/g, " ").replace(/\b\w/g, (ch) => ch.toUpperCase());
 }
-var META_TOOLS = /* @__PURE__ */ new Set(["set_goal", "update_goal_step", "reasoning"]);
 var APPROVAL_PENDING_MARKER = "Awaiting your approval";
 var ToolActivityFeed = class {
   calls = /* @__PURE__ */ new Map();
@@ -832,7 +836,7 @@ var ToolActivityFeed = class {
     const text = (0, session_state_exports.messageText)(message.content);
     if (text.includes(session_state_exports.WAITING_FOR_CLIENT_MARKER) || text.includes(APPROVAL_PENDING_MARKER)) return null;
     this.settled.add(callId);
-    if (META_TOOLS.has(req.tool)) return null;
+    if (isTranscriptMetaTool(req.tool)) return null;
     const summary = describe(req);
     if (toolResultFailed(message, text)) {
       return { line: `\u2717 ${summary} \u2014 ${text.trim() || "failed"}` };
@@ -1546,6 +1550,46 @@ var WordMill = class {
 // src/types.ts
 var types_exports = {};
 __reExport(types_exports, types_star);
+
+// src/subprocess-env.ts
+var INHERITED_ENV_ALLOWLIST = /* @__PURE__ */ new Set([
+  "APPDATA",
+  "COMSPEC",
+  "HOME",
+  "LANG",
+  "LC_ALL",
+  "LC_CTYPE",
+  "LOCALAPPDATA",
+  "LOGNAME",
+  "PATH",
+  "PATHEXT",
+  "PROGRAMDATA",
+  "SHELL",
+  "SYSTEMROOT",
+  "TEMP",
+  "TERM",
+  "TMP",
+  "TMPDIR",
+  "USER",
+  "USERPROFILE",
+  "WINDIR"
+]);
+function inheritedSubprocessEnv(ambient = process.env) {
+  const child = { ...ambient };
+  delete child.NODE_TLS_REJECT_UNAUTHORIZED;
+  return child;
+}
+function restrictedSubprocessEnv(explicit = {}, ambient = process.env) {
+  const inherited = {};
+  for (const [name, value] of Object.entries(ambient)) {
+    if (value !== void 0 && INHERITED_ENV_ALLOWLIST.has(name.toUpperCase())) {
+      inherited[name] = value;
+    }
+  }
+  return { ...inherited, ...explicit };
+}
+
+// src/clipboard.ts
 var FILE_MIMES = {
   ".png": "image/png",
   ".jpg": "image/jpeg",
@@ -1556,7 +1600,11 @@ var FILE_MIMES = {
 var MAX_IMAGE_BYTES = 8 * 1024 * 1024;
 function run(cmd, args, maxBuffer = MAX_IMAGE_BYTES * 2) {
   return new Promise((resolve) => {
-    execFile(cmd, args, { encoding: "buffer", maxBuffer }, (err, stdout) => {
+    execFile(cmd, args, {
+      encoding: "buffer",
+      maxBuffer,
+      env: inheritedSubprocessEnv()
+    }, (err, stdout) => {
       resolve({ ok: !err, stdout: stdout ?? Buffer.alloc(0) });
     });
   });
@@ -1565,9 +1613,9 @@ function fromFile(filePath) {
   const mime = FILE_MIMES[path9.extname(filePath).toLowerCase()];
   if (!mime) return null;
   try {
-    const stat = fs11.statSync(filePath);
+    const stat = fs12.statSync(filePath);
     if (!stat.isFile() || stat.size === 0 || stat.size > MAX_IMAGE_BYTES) return null;
-    return { data: fs11.readFileSync(filePath).toString("base64"), mime };
+    return { data: fs12.readFileSync(filePath).toString("base64"), mime };
   } catch {
     return null;
   }
@@ -1585,7 +1633,7 @@ async function readDarwin() {
   if (png.ok) {
     const img = fromFile(tmp);
     try {
-      fs11.unlinkSync(tmp);
+      fs12.unlinkSync(tmp);
     } catch {
     }
     if (img) return img;
@@ -1619,7 +1667,7 @@ async function readWindows() {
   await run("powershell", ["-NoProfile", "-STA", "-Command", ps]);
   const img = fromFile(tmp);
   try {
-    fs11.unlinkSync(tmp);
+    fs12.unlinkSync(tmp);
   } catch {
   }
   return img;
@@ -3816,6 +3864,18 @@ __reExport(shared_messaging_exports, shared_messaging_star);
 var history_exports = {};
 __reExport(history_exports, history_star);
 var LOG_DIR = path9.join(os6.homedir(), ".standardagents", "process-logs");
+function openPrivateProcessLog(logPath) {
+  const directory = path9.dirname(logPath);
+  fs12.mkdirSync(directory, { recursive: true, mode: 448 });
+  fs12.chmodSync(directory, 448);
+  const descriptor = fs12.openSync(
+    logPath,
+    fs12.constants.O_WRONLY | fs12.constants.O_CREAT | fs12.constants.O_APPEND,
+    384
+  );
+  fs12.fchmodSync(descriptor, 384);
+  return descriptor;
+}
 function isAlive(pid) {
   try {
     process.kill(pid, 0);
@@ -3834,7 +3894,7 @@ function configFile() {
 }
 function loadMcpConfig() {
   try {
-    const raw = fs11.readFileSync(configFile(), "utf8");
+    const raw = fs12.readFileSync(configFile(), "utf8");
     const parsed = JSON.parse(raw);
     if (!parsed.servers || typeof parsed.servers !== "object") parsed.servers = {};
     return parsed;
@@ -3865,8 +3925,8 @@ function setMcpServerEnabled(name, enabled) {
 }
 function write(cfg) {
   const file2 = configFile();
-  fs11.mkdirSync(path9.dirname(file2), { recursive: true });
-  fs11.writeFileSync(file2, JSON.stringify(cfg, null, 2), { mode: 384 });
+  fs12.mkdirSync(path9.dirname(file2), { recursive: true });
+  fs12.writeFileSync(file2, JSON.stringify(cfg, null, 2), { mode: 384 });
 }
 function parseServerSpec(spec) {
   const trimmed = spec.trim();
@@ -3937,7 +3997,11 @@ function openUrl(url) {
   const cmd = platform === "darwin" ? "open" : platform === "win32" ? "cmd" : "xdg-open";
   const args = platform === "win32" ? ["/c", "start", "", url] : [url];
   try {
-    const child = spawn(cmd, args, { stdio: "ignore", detached: true });
+    const child = spawn(cmd, args, {
+      stdio: "ignore",
+      detached: true,
+      env: inheritedSubprocessEnv()
+    });
     child.unref();
   } catch {
   }
@@ -3949,11 +4013,11 @@ __reExport(recorder_exports, recorder_star);
 __reExport(recorder_exports, recorder_node_star);
 function readVersion() {
   try {
-    const pkg = JSON.parse(fs11.readFileSync(new URL("../package.json", import.meta.url), "utf8"));
+    const pkg = JSON.parse(fs12.readFileSync(new URL("../package.json", import.meta.url), "utf8"));
     if (typeof pkg.version === "string" && pkg.version) return pkg.version;
   } catch {
   }
-  return "0.13.7" ;
+  return "0.13.9" ;
 }
 function isLocalHost(host) {
   return host === "localhost" || host === "127.0.0.1" || host === "::1" || host.endsWith(".local") || host.endsWith(".localhost") || /^10\./.test(host) || /^192\.168\./.test(host) || /^172\.(1[6-9]|2\d|3[01])\./.test(host);
@@ -3979,7 +4043,7 @@ var dir = () => path9.join(os6.homedir(), ".standardagents");
 var file = () => path9.join(dir(), "machine.json");
 function loadMachineIdentity() {
   try {
-    const parsed = JSON.parse(fs11.readFileSync(file(), "utf8"));
+    const parsed = JSON.parse(fs12.readFileSync(file(), "utf8"));
     if (typeof parsed.machine_id === "string" && parsed.machine_id.length > 0) {
       return { machine_id: parsed.machine_id, created_at: parsed.created_at ?? Date.now() };
     }
@@ -3993,8 +4057,8 @@ function loadMachineIdentity() {
   return identity;
 }
 function saveMachineIdentity(identity) {
-  fs11.mkdirSync(dir(), { recursive: true });
-  fs11.writeFileSync(file(), JSON.stringify(identity, null, 2), { mode: 384 });
+  fs12.mkdirSync(dir(), { recursive: true });
+  fs12.writeFileSync(file(), JSON.stringify(identity, null, 2), { mode: 384 });
 }
 function daemonClientId(identity) {
   return `daemon:${identity.machine_id}`;
@@ -4325,7 +4389,8 @@ function projectRepository(projectDir) {
     const url = execFileSync("git", ["-C", projectDir, "remote", "get-url", "origin"], {
       encoding: "utf8",
       timeout: 3e3,
-      stdio: ["ignore", "pipe", "ignore"]
+      stdio: ["ignore", "pipe", "ignore"],
+      env: inheritedSubprocessEnv()
     }).trim();
     return url || null;
   } catch {
@@ -4504,7 +4569,7 @@ function markers(dirPath) {
   for (const marker of PROJECT_MARKERS) {
     let hit = false;
     try {
-      hit = fs11.existsSync(path9.join(dirPath, marker));
+      hit = fs12.existsSync(path9.join(dirPath, marker));
     } catch {
       hit = false;
     }
@@ -4526,11 +4591,11 @@ function browseDirectory(input3, opts = {}) {
   };
   let dirents;
   try {
-    const stat = fs11.statSync(abs);
+    const stat = fs12.statSync(abs);
     if (!stat.isDirectory()) {
       return { ...base, entries: [], truncated: false, error: "Not a directory" };
     }
-    dirents = fs11.readdirSync(abs, { withFileTypes: true });
+    dirents = fs12.readdirSync(abs, { withFileTypes: true });
   } catch (err) {
     const code = err?.code;
     const message = code === "EACCES" || code === "EPERM" ? "Permission denied" : code === "ENOENT" ? "Folder not found" : "Could not read this folder";
@@ -4545,7 +4610,7 @@ function browseDirectory(input3, opts = {}) {
     let isDir = d.isDirectory();
     if (d.isSymbolicLink()) {
       try {
-        isDir = fs11.statSync(path9.join(abs, name)).isDirectory();
+        isDir = fs12.statSync(path9.join(abs, name)).isDirectory();
       } catch {
         isDir = false;
       }
@@ -4576,7 +4641,7 @@ function mkdirDirectory(parentInput, name, opts = {}) {
     return { ...listParent(), error: "Invalid folder name." };
   }
   try {
-    fs11.mkdirSync(target, { recursive: false });
+    fs12.mkdirSync(target, { recursive: false });
   } catch (err) {
     const code = err?.code;
     const message = code === "EEXIST" ? "A folder with that name already exists." : code === "EACCES" || code === "EPERM" ? "Permission denied." : code === "ENOENT" ? "The parent folder no longer exists." : "Could not create the folder.";
@@ -4791,7 +4856,10 @@ function probe(cmd) {
   return new Promise((resolve) => {
     let child;
     try {
-      child = spawn(cmd, ["--version"], { stdio: "ignore" });
+      child = spawn(cmd, ["--version"], {
+        stdio: "ignore",
+        env: inheritedSubprocessEnv()
+      });
     } catch {
       resolve(false);
       return;
@@ -4827,7 +4895,7 @@ function download(url, dest, redirects = 5) {
         reject(new Error(`HTTP ${status} for ${url}`));
         return;
       }
-      const out = fs11.createWriteStream(dest);
+      const out = fs12.createWriteStream(dest);
       res.pipe(out);
       out.on("finish", () => out.close(() => resolve()));
       out.on("error", reject);
@@ -4838,7 +4906,7 @@ function download(url, dest, redirects = 5) {
 async function sha256File(file2) {
   const hash = crypto.createHash("sha256");
   await new Promise((resolve, reject) => {
-    const stream = fs11.createReadStream(file2);
+    const stream = fs12.createReadStream(file2);
     stream.on("data", (chunk) => hash.update(chunk));
     stream.on("end", () => resolve());
     stream.on("error", reject);
@@ -4849,7 +4917,11 @@ function runOk(cmd, args, cwd) {
   return new Promise((resolve) => {
     let child;
     try {
-      child = spawn(cmd, args, { cwd, stdio: "ignore" });
+      child = spawn(cmd, args, {
+        cwd,
+        stdio: "ignore",
+        env: inheritedSubprocessEnv()
+      });
     } catch {
       resolve(false);
       return;
@@ -4876,7 +4948,7 @@ async function provision(target) {
     let extracted = null;
     for (const entry of entries) {
       const candidate = entry.isDirectory() ? path9.join(work, entry.name, binName) : entry.name === binName ? path9.join(work, entry.name) : null;
-      if (candidate && fs11.existsSync(candidate)) {
+      if (candidate && fs12.existsSync(candidate)) {
         extracted = candidate;
         break;
       }
@@ -4901,7 +4973,7 @@ function resolveRg(log) {
       const override = process.env.STANDARDCODE_RG_PATH;
       if (override && await probe(override)) return override;
       if (await probe("rg")) return "rg";
-      if (fs11.existsSync(RG_BIN) && await probe(RG_BIN)) return RG_BIN;
+      if (fs12.existsSync(RG_BIN) && await probe(RG_BIN)) return RG_BIN;
       const target = RG_TARGETS[`${process.platform}-${process.arch}`];
       if (!target) return null;
       try {
@@ -4960,16 +5032,36 @@ var HostTools = class {
   mcp;
   onMcpCatalogChange;
   api;
-  /** Resolve a user/model-supplied path against the project directory. */
+  /** Resolve a user/model-supplied path against the project directory.
+   * A leading `~` expands to the host home directory — without this, a
+   * model-supplied `~/Desktop/x` silently lands at `<project>/~/Desktop/x`.
+   * Outside-project containment checks run on the resolved result, so an
+   * expanded home path still requires a fresh human decision. */
   resolve(p) {
     if (!p || p === ".") return this.projectDir;
+    if (p === "~" || p.startsWith("~/")) {
+      p = path9.join(os6.homedir(), p.slice(1));
+    }
     return path9.resolve(this.projectDir, p);
   }
-  /** True when the resolved path escapes the project directory. */
+  /** Resolve symlinks in an existing target or its nearest existing ancestor. */
+  realPathForContainment(target) {
+    const missing = [];
+    let existing = path9.resolve(target);
+    while (!fs12.existsSync(existing)) {
+      const parent = path9.dirname(existing);
+      if (parent === existing) return path9.resolve(target);
+      missing.unshift(path9.basename(existing));
+      existing = parent;
+    }
+    return path9.join(fs12.realpathSync.native(existing), ...missing);
+  }
+  /** True when the resolved path escapes the real project directory. */
   isOutsideProject(p) {
-    const abs = this.resolve(p);
-    const rel = path9.relative(this.projectDir, abs);
-    return rel.startsWith("..") || path9.isAbsolute(rel);
+    const project = this.realPathForContainment(this.projectDir);
+    const candidate = this.realPathForContainment(this.resolve(p));
+    const rel = path9.relative(project, candidate);
+    return rel === ".." || rel.startsWith(`..${path9.sep}`) || path9.isAbsolute(rel);
   }
   async execute(tool, args) {
     try {
@@ -5065,7 +5157,7 @@ var HostTools = class {
     const file2 = this.resolve(String(args.path || ""));
     const content = String(args.content ?? "");
     await fsp2.mkdir(path9.dirname(file2), { recursive: true });
-    const existed = fs11.existsSync(file2);
+    const existed = fs12.existsSync(file2);
     await fsp2.writeFile(file2, content, "utf8");
     return {
       ok: true,
@@ -5107,7 +5199,7 @@ var HostTools = class {
     if (!bytes) return { ok: false, error: `Could not download ${source} from the thread filesystem.` };
     const dest = this.resolve(destArg);
     await fsp2.mkdir(path9.dirname(dest), { recursive: true });
-    const existed = fs11.existsSync(dest);
+    const existed = fs12.existsSync(dest);
     await fsp2.writeFile(dest, bytes);
     return {
       ok: true,
@@ -5184,7 +5276,7 @@ var HostTools = class {
     return await new Promise((resolvePromise) => {
       const child = spawn(cmd, argv, {
         cwd: this.projectDir,
-        env: { ...process.env, SKILL_DIR: skillDir },
+        env: restrictedSubprocessEnv({ SKILL_DIR: skillDir }),
         stdio: ["ignore", "pipe", "pipe"]
       });
       let out = "";
@@ -5237,30 +5329,34 @@ ${truncated}`
     const command = String(args.command || "");
     if (!command.trim()) return { ok: false, error: "command is required" };
     const cwd = args.cwd ? this.resolve(String(args.cwd)) : this.projectDir;
-    if (!fs11.existsSync(cwd)) {
+    if (!fs12.existsSync(cwd)) {
       return { ok: false, error: `cwd does not exist: ${cwd}` };
     }
     const id = crypto.randomUUID().slice(0, 8);
     const logPath = path9.join(LOG_DIR, `${id}.log`);
     let out;
     try {
-      await fsp2.mkdir(LOG_DIR, { recursive: true });
-      out = fs11.openSync(logPath, "a");
+      out = openPrivateProcessLog(logPath);
     } catch (err) {
       return { ok: false, error: `Could not open log file: ${err instanceof Error ? err.message : String(err)}` };
     }
     let child;
     try {
-      child = spawn("bash", ["-lc", command], { cwd, detached: true, stdio: ["ignore", out, out] });
+      child = spawn("bash", ["-lc", command], {
+        cwd,
+        detached: true,
+        stdio: ["ignore", out, out],
+        env: inheritedSubprocessEnv()
+      });
     } catch (err) {
-      fs11.closeSync(out);
+      fs12.closeSync(out);
       return { ok: false, error: `Failed to start: ${err instanceof Error ? err.message : String(err)}` };
     }
     let spawnError = null;
     child.on("error", (err) => {
       spawnError = err;
     });
-    fs11.closeSync(out);
+    fs12.closeSync(out);
     const pid = child.pid;
     let earlyExit;
     const onEarlyExit = (code) => {
@@ -5466,7 +5562,11 @@ ${tail2}` : " No output was captured.")
       const MAX_OUTPUT = 256 * 1024;
       let child;
       try {
-        child = spawn(cmd, args, { cwd, detached: true });
+        child = spawn(cmd, args, {
+          cwd,
+          detached: true,
+          env: inheritedSubprocessEnv()
+        });
       } catch {
         resolve({ stdout: "", stderr: "", code: 127, timedOut: false });
         return;
@@ -5566,7 +5666,7 @@ var McpClient = class {
   async connect(defaultCwd) {
     const child = spawn(this.config.command, this.config.args, {
       cwd: this.config.cwd || defaultCwd,
-      env: { ...process.env, ...this.config.env || {} },
+      env: restrictedSubprocessEnv(this.config.env),
       stdio: ["pipe", "pipe", "pipe"]
     });
     this.child = child;
@@ -6030,7 +6130,7 @@ var DaemonUserStream = class {
     if (hooks.onConnection) this.stream.onConnection(hooks.onConnection);
   }
   start() {
-    this.stream.start();
+    return this.stream.start();
   }
   close() {
     this.stream.close();
@@ -6073,7 +6173,7 @@ function cachePath() {
 }
 function readCache() {
   try {
-    const raw = fs11.readFileSync(cachePath(), "utf-8");
+    const raw = fs12.readFileSync(cachePath(), "utf-8");
     return JSON.parse(raw);
   } catch {
     return null;
@@ -6082,14 +6182,14 @@ function readCache() {
 function writeCache(latest) {
   try {
     const dir2 = cacheDir();
-    if (!fs11.existsSync(dir2)) fs11.mkdirSync(dir2, { recursive: true });
-    fs11.writeFileSync(cachePath(), JSON.stringify({ latest, timestamp: Date.now() }));
+    if (!fs12.existsSync(dir2)) fs12.mkdirSync(dir2, { recursive: true });
+    fs12.writeFileSync(cachePath(), JSON.stringify({ latest, timestamp: Date.now() }));
   } catch {
   }
 }
 function readAutoUpdateState(dir2 = cacheDir()) {
   try {
-    const raw = fs11.readFileSync(path9.join(dir2, STATE_FILE), "utf-8");
+    const raw = fs12.readFileSync(path9.join(dir2, STATE_FILE), "utf-8");
     const state = JSON.parse(raw);
     return typeof state?.version === "string" ? state : null;
   } catch {
@@ -6098,14 +6198,14 @@ function readAutoUpdateState(dir2 = cacheDir()) {
 }
 function writeAutoUpdateState(state, dir2 = cacheDir()) {
   try {
-    if (!fs11.existsSync(dir2)) fs11.mkdirSync(dir2, { recursive: true });
-    fs11.writeFileSync(path9.join(dir2, STATE_FILE), JSON.stringify(state));
+    if (!fs12.existsSync(dir2)) fs12.mkdirSync(dir2, { recursive: true });
+    fs12.writeFileSync(path9.join(dir2, STATE_FILE), JSON.stringify(state));
   } catch {
   }
 }
 function clearAutoUpdateState(dir2 = cacheDir()) {
   try {
-    fs11.unlinkSync(path9.join(dir2, STATE_FILE));
+    fs12.unlinkSync(path9.join(dir2, STATE_FILE));
   } catch {
   }
 }
@@ -6152,7 +6252,11 @@ function startBackgroundUpdate(latest, pm, dir2 = cacheDir()) {
   const { cmd, args } = updateCommand(pm);
   const script = `const cp=require('child_process');const fs=require('fs');const r=cp.spawnSync(${JSON.stringify(cmd)},${JSON.stringify(args)},{shell:process.platform==='win32',encoding:'utf8'});const out=((r.stdout||'')+(r.stderr||'')).slice(-2000);fs.writeFileSync(${JSON.stringify(stateFile)},JSON.stringify({version:${JSON.stringify(latest)},startedAt:${startedAt},exitCode:r.status==null?-1:r.status,finishedAt:Date.now(),output:out}));`;
   try {
-    const child = spawn(process.execPath, ["-e", script], { detached: true, stdio: "ignore" });
+    const child = spawn(process.execPath, ["-e", script], {
+      detached: true,
+      stdio: "ignore",
+      env: inheritedSubprocessEnv()
+    });
     child.unref();
     return true;
   } catch {
@@ -6224,7 +6328,8 @@ function runUpdate(pm) {
     const { cmd, args } = updateCommand(pm);
     const child = spawn(cmd, args, {
       shell: process.platform === "win32",
-      stdio: ["ignore", "pipe", "pipe"]
+      stdio: ["ignore", "pipe", "pipe"],
+      env: inheritedSubprocessEnv()
     });
     let out = "";
     child.stdout?.on("data", (d) => out += d);
@@ -6240,22 +6345,30 @@ var UPDATE_CHECK_MS = 6 * 60 * 6e4;
 var MAX_WORKERS = 30;
 var BRIDGE_ATTACH_GRACE_MS = 15e3;
 var BRIDGE_IDLE_MS = 2e3;
+var LIVE_FRAME_APPROVAL_TIMEOUT_MS = 45e3;
 var LOG_MAX_BYTES = 1e6;
 var LOG_FILE = path9.join(os6.homedir(), ".standardagents", "daemon.log");
-function daemonLog(line) {
+function appendPrivateLog(file2, line, maxBytes) {
   try {
-    fs11.mkdirSync(path9.dirname(LOG_FILE), { recursive: true });
+    const directory = path9.dirname(file2);
+    fs12.mkdirSync(directory, { recursive: true, mode: 448 });
+    fs12.chmodSync(directory, 448);
     try {
-      if (fs11.statSync(LOG_FILE).size > LOG_MAX_BYTES) {
-        fs11.renameSync(LOG_FILE, `${LOG_FILE}.old`);
+      fs12.chmodSync(file2, 384);
+      if (fs12.statSync(file2).size > maxBytes) {
+        fs12.renameSync(file2, `${file2}.old`);
       }
     } catch {
     }
-    fs11.appendFileSync(LOG_FILE, `${(/* @__PURE__ */ new Date()).toISOString()} ${line}
-`);
+    fs12.appendFileSync(file2, line, { mode: 384 });
+    fs12.chmodSync(file2, 384);
   } catch {
   }
 }
+function daemonLog(line) {
+  appendPrivateLog(LOG_FILE, `${(/* @__PURE__ */ new Date()).toISOString()} ${line}
+`, LOG_MAX_BYTES);
+}
 function pathFromTags(tags) {
   const tag = tags.find((t) => t.startsWith("path:"));
   if (!tag) return null;
@@ -6320,7 +6433,8 @@ var ThreadWorker = class {
           const permKey = permissionKey(req);
           const fresh = decide(this.perm, permKey, effectiveRisk, !!req.requestPermission);
           if (fresh === "allow") return { choice: "allow" };
-          if (!req.toolCallId) {
+          const relayId = req.toolCallId ?? req.id;
+          if (!relayId) {
             return { choice: "deny", reason: "No one is available to approve this right now." };
           }
           daemonLog(`[${threadId.slice(0, 8)}] relaying approval: ${summary} (risk ${effectiveRisk})`);
@@ -6331,7 +6445,7 @@ var ThreadWorker = class {
               api,
               threadId,
               {
-                tool_call_id: req.toolCallId,
+                tool_call_id: relayId,
                 tool: req.tool,
                 summary,
                 permission: req.requestPermission,
@@ -6339,13 +6453,24 @@ var ThreadWorker = class {
                 machine: machineName,
                 requested_at: Date.now()
               },
-              { subscribe: (wake) => approvalWakes.subscribe(threadId, wake) }
+              {
+                subscribe: (wake) => approvalWakes.subscribe(threadId, wake),
+                // A live frame is answered over the socket and the server fails
+                // the call on its own frame timeout — bound the human wait so a
+                // late "allow" can never execute a side effect into a frame the
+                // server already gave up on. Durable calls park server-side and
+                // keep the long default.
+                timeoutMs: req.toolCallId ? void 0 : LIVE_FRAME_APPROVAL_TIMEOUT_MS
+              }
             );
             if (!response) {
               return { choice: "deny", reason: "The approval request timed out with no one to approve it." };
             }
             if (response.choice === "always") this.perm.alwaysAllow.add(permKey);
-            if (response.choice === "always_risk") this.perm.allowRisk.add(effectiveRisk);
+            if (response.choice === "always_risk") {
+              this.perm.level = Math.max(this.perm.level, effectiveRisk);
+              this.perm.allowRisk.clear();
+            }
             if (response.choice === "always" || response.choice === "always_risk") {
               (0, approvals_exports.saveApprovals)(api, threadId, this.perm);
             }
@@ -6514,7 +6639,7 @@ Run \`standardcode daemon install\` (or plain \`standardcode\`) once to sign in.
       daemonLog(`detached ${oldest.threadId.slice(0, 8)} (worker cap)`);
     }
     try {
-      fs11.mkdirSync(projectDir, { recursive: true });
+      fs12.mkdirSync(projectDir, { recursive: true });
     } catch (e) {
       daemonLog(`cannot prepare project dir ${projectDir}: ${e instanceof Error ? e.message : String(e)}`);
       return;
@@ -6817,7 +6942,7 @@ function resolveDaemonCommand(extraArgs = []) {
     let tsx = null;
     for (let i = 0; i < 6 && dir2 !== path9.dirname(dir2); i++) {
       const candidate = path9.join(dir2, "node_modules", "tsx", "dist", "cli.mjs");
-      if (fs11.existsSync(candidate)) {
+      if (fs12.existsSync(candidate)) {
         tsx = candidate;
         break;
       }
@@ -6847,13 +6972,25 @@ function servicePath() {
   return [.../* @__PURE__ */ new Set([...current, ...parts])].join(":");
 }
 function run2(cmd, args) {
-  const res = spawnSync(cmd, args, { encoding: "utf8" });
+  const res = spawnSync(cmd, args, {
+    encoding: "utf8",
+    env: inheritedSubprocessEnv()
+  });
   const output4 = `${res.stdout ?? ""}${res.stderr ?? ""}`.trim();
   return { ok: res.status === 0, output: output4 };
 }
 var plistPath = () => path9.join(os6.homedir(), "Library", "LaunchAgents", `${SERVICE_LABEL}.plist`);
 var unitPath = () => path9.join(os6.homedir(), ".config", "systemd", "user", SYSTEMD_UNIT);
 var xmlEscape = (s) => s.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;");
+function restartServiceInvocation(platform, uid = 501) {
+  if (platform === "darwin") {
+    return { cmd: "launchctl", args: ["kickstart", "-k", `gui/${uid}/${SERVICE_LABEL}`] };
+  }
+  if (platform === "linux") {
+    return { cmd: "systemctl", args: ["--user", "restart", SYSTEMD_UNIT] };
+  }
+  return null;
+}
 function installService(command, endpoint) {
   if (process.platform === "darwin") return installLaunchd(command, endpoint);
   if (process.platform === "linux") return installSystemd(command, endpoint);
@@ -6865,8 +7002,8 @@ function installService(command, endpoint) {
 }
 function installLaunchd(command, endpoint) {
   const logDir = path9.join(os6.homedir(), ".standardagents");
-  fs11.mkdirSync(logDir, { recursive: true });
-  fs11.mkdirSync(path9.dirname(plistPath()), { recursive: true });
+  fs12.mkdirSync(logDir, { recursive: true });
+  fs12.mkdirSync(path9.dirname(plistPath()), { recursive: true });
   const envEntries = [
     `      <key>PATH</key><string>${xmlEscape(servicePath())}</string>`,
     ...endpoint ? [`      <key>STANDARD_CODE_DAEMON_ENDPOINT</key><string>${xmlEscape(endpoint)}</string>`] : []
@@ -6892,7 +7029,7 @@ ${envEntries}
   </dict>
 </plist>
 `;
-  fs11.writeFileSync(plistPath(), plist);
+  fs12.writeFileSync(plistPath(), plist);
   const uid = typeof process.getuid === "function" ? process.getuid() : 501;
   run2("launchctl", ["bootout", `gui/${uid}`, plistPath()]);
   const boot = run2("launchctl", ["bootstrap", `gui/${uid}`, plistPath()]);
@@ -6909,7 +7046,7 @@ ${envEntries}
   return { ok: true, detail: `LaunchAgent installed (${plistPath()})` };
 }
 function installSystemd(command, endpoint) {
-  fs11.mkdirSync(path9.dirname(unitPath()), { recursive: true });
+  fs12.mkdirSync(path9.dirname(unitPath()), { recursive: true });
   const unit = `[Unit]
 Description=Standard Code daemon (headless coding-agent execution client)
 After=network-online.target
@@ -6924,7 +7061,7 @@ ${endpoint ? `Environment=STANDARD_CODE_DAEMON_ENDPOINT=${endpoint}
 [Install]
 WantedBy=default.target
 `;
-  fs11.writeFileSync(unitPath(), unit);
+  fs12.writeFileSync(unitPath(), unit);
   const reload = run2("systemctl", ["--user", "daemon-reload"]);
   if (!reload.ok) {
     return {
@@ -6948,7 +7085,7 @@ function uninstallService() {
     const uid = typeof process.getuid === "function" ? process.getuid() : 501;
     run2("launchctl", ["bootout", `gui/${uid}`, plistPath()]);
     try {
-      fs11.unlinkSync(plistPath());
+      fs12.unlinkSync(plistPath());
     } catch {
     }
     return { ok: true, detail: "LaunchAgent removed" };
@@ -6956,7 +7093,7 @@ function uninstallService() {
   if (process.platform === "linux") {
     run2("systemctl", ["--user", "disable", "--now", SYSTEMD_UNIT]);
     try {
-      fs11.unlinkSync(unitPath());
+      fs12.unlinkSync(unitPath());
     } catch {
     }
     run2("systemctl", ["--user", "daemon-reload"]);
@@ -6964,9 +7101,42 @@ function uninstallService() {
   }
   return { ok: false, detail: `Unsupported platform: ${process.platform}` };
 }
+function restartService() {
+  if (process.platform === "darwin") {
+    if (!fs12.existsSync(plistPath())) {
+      return {
+        ok: false,
+        detail: "The daemon service is not installed. Run `standardcode daemon install` first."
+      };
+    }
+    const uid = typeof process.getuid === "function" ? process.getuid() : 501;
+    const invocation = restartServiceInvocation(process.platform, uid);
+    const restart = run2(invocation.cmd, invocation.args);
+    if (restart.ok) return { ok: true, detail: "LaunchAgent restarted" };
+    const boot = run2("launchctl", ["bootstrap", `gui/${uid}`, plistPath()]);
+    if (boot.ok) return { ok: true, detail: "LaunchAgent loaded and started" };
+    return {
+      ok: false,
+      detail: `launchctl failed: ${restart.output || boot.output}`,
+      manualHint: `Load it manually: launchctl bootstrap gui/${uid} ${plistPath()}`
+    };
+  }
+  if (process.platform === "linux") {
+    if (!fs12.existsSync(unitPath())) {
+      return {
+        ok: false,
+        detail: "The daemon service is not installed. Run `standardcode daemon install` first."
+      };
+    }
+    const invocation = restartServiceInvocation(process.platform);
+    const restart = run2(invocation.cmd, invocation.args);
+    return restart.ok ? { ok: true, detail: "systemd user service restarted" } : { ok: false, detail: `systemctl restart failed: ${restart.output}` };
+  }
+  return { ok: false, detail: `Unsupported platform: ${process.platform}` };
+}
 function serviceStatus() {
   if (process.platform === "darwin") {
-    const installed = fs11.existsSync(plistPath());
+    const installed = fs12.existsSync(plistPath());
     const list = run2("launchctl", ["list", SERVICE_LABEL]);
     const pidMatch = list.output.match(/"PID"\s*=\s*(\d+)/);
     return {
@@ -6976,7 +7146,7 @@ function serviceStatus() {
     };
   }
   if (process.platform === "linux") {
-    const installed = fs11.existsSync(unitPath());
+    const installed = fs12.existsSync(unitPath());
     const active = run2("systemctl", ["--user", "is-active", SYSTEMD_UNIT]);
     return {
       installed,
@@ -7011,6 +7181,8 @@ function usage() {
       "                             e.g. when another app drives the install).",
       "  uninstall                  Stop and remove the service.",
       "  status                     Service + registry status for this machine.",
+      "  restart                    Restart the installed service immediately.",
+      "  update [--endpoint url]    Install the latest CLI, then restart the service.",
       "  run [--endpoint url]       Run the daemon in the foreground (what the service runs).",
       "  add-project <path>         Register a project directory for remote sessions.",
       "  remove-project <path>      Remove a registered project directory.",
@@ -7140,9 +7312,10 @@ async function installCommand(endpointFlag, opts = {}) {
     stdout.write(
       `${c3.green}\u2713${c3.reset} ${c3.bold}${displayName}${c3.reset} is online.
 
-Sessions started elsewhere can now run on this machine.
-${c3.dim}Projects register automatically when you run standardcode in a directory here,
-or add one now: standardcode daemon add-project <path>${c3.reset}
+Standard Code sessions can now edit files and run tools on this machine while you drive them from any device signed in to your account.
+${c3.dim}Projects are added automatically when you start Standard Code from their directory.
+To add a project manually, run:${c3.reset}
+  ${c3.bold}standardcode daemon add-project /absolute/path/to/project${c3.reset}
 `
     );
   } else {
@@ -7192,6 +7365,55 @@ async function statusCommand() {
   for (const p of projects.sort()) stdout.write(`  ${c3.dim}${p}${c3.reset}
 `);
 }
+async function updateDaemonCommand(endpointFlag) {
+  const status = serviceStatus();
+  if (!status.installed) {
+    stdout.write(
+      `${c3.red}\u2717${c3.reset} The daemon service is not installed. Run \`standardcode daemon install\` first.
+`
+    );
+    process.exit(1);
+  }
+  const endpoint = resolveEndpoint(endpointFlag);
+  const api = await ensureSignedIn(endpoint);
+  const identity = loadMachineIdentity();
+  const record = await loadMachine(api, identity.machine_id).catch(() => null);
+  if (status.running && record && daemonOnline(record)) {
+    await enqueueMachineCommand(api, identity.machine_id, "update");
+    stdout.write(
+      `${c3.green}\u2713${c3.reset} Update requested. The daemon will finish active tool calls, install the latest Standard Code, and restart.
+`
+    );
+    return;
+  }
+  const pm = detectPackageManager();
+  if (!pm) {
+    stdout.write(
+      `${c3.red}\u2717${c3.reset} This source checkout cannot update the installed CLI. Run \`standardcode daemon update\` through your global Standard Code command.
+`
+    );
+    process.exit(1);
+  }
+  const { display } = updateCommand(pm);
+  stdout.write(`${c3.dim}Running ${display}\u2026${c3.reset}
+`);
+  const result = await runUpdate(pm);
+  if (!result.ok) {
+    stdout.write(`${c3.red}\u2717${c3.reset} Update failed.
+`);
+    for (const line of result.output.trim().split("\n").slice(-6)) {
+      if (line) stdout.write(`${c3.dim}${line}${c3.reset}
+`);
+    }
+    process.exit(1);
+  }
+  const restarted = restartService();
+  stdout.write(
+    `${restarted.ok ? c3.green + "\u2713" : c3.red + "\u2717"}${c3.reset} ${restarted.ok ? "Standard Code updated. " : "Standard Code updated, but the daemon restart failed. "}${restarted.detail}
+`
+  );
+  if (!restarted.ok) process.exit(1);
+}
 async function projectCommand(action, target) {
   if (!target) {
     stdout.write(`${c3.red}\u2717${c3.reset} Expected a project path.
@@ -7199,7 +7421,7 @@ async function projectCommand(action, target) {
     process.exit(1);
   }
   const dir2 = path9.resolve(target);
-  if (action === "add" && !fs11.existsSync(dir2)) {
+  if (action === "add" && !fs12.existsSync(dir2)) {
     stdout.write(`${c3.red}\u2717${c3.reset} ${dir2} does not exist on this machine.
 `);
     process.exit(1);
@@ -7247,6 +7469,18 @@ async function runDaemonCommand(argv) {
     case "status":
       await statusCommand();
       return;
+    case "restart": {
+      const result = restartService();
+      stdout.write(`${result.ok ? c3.green + "\u2713" : c3.red + "\u2717"}${c3.reset} ${result.detail}
+`);
+      if (result.manualHint) stdout.write(`${c3.dim}${result.manualHint}${c3.reset}
+`);
+      if (!result.ok) process.exit(1);
+      return;
+    }
+    case "update":
+      await updateDaemonCommand(endpoint);
+      return;
     case "add-project":
       await projectCommand("add", rest[0]);
       return;
@@ -7268,15 +7502,15 @@ var DIR = path9.join(os6.homedir(), ".standardagents");
 var FILE = path9.join(DIR, "prefs.json");
 function loadPrefs(file2 = FILE) {
   try {
-    return JSON.parse(fs11.readFileSync(file2, "utf8"));
+    return JSON.parse(fs12.readFileSync(file2, "utf8"));
   } catch {
     return {};
   }
 }
 function savePrefs(update, file2 = FILE) {
   const merged = { ...loadPrefs(file2), ...update };
-  fs11.mkdirSync(path9.dirname(file2), { recursive: true });
-  fs11.writeFileSync(file2, JSON.stringify(merged, null, 2));
+  fs12.mkdirSync(path9.dirname(file2), { recursive: true });
+  fs12.writeFileSync(file2, JSON.stringify(merged, null, 2));
 }
 function shouldOfferDaemonInstall(facts) {
   if (facts.optedOutEnv) return false;
@@ -8464,13 +8698,9 @@ async function runInteractive(tui, api, accountStream, threadId, projectDir, mac
   const pendingSent = /* @__PURE__ */ new Map();
   let lastSent = null;
   let upgradeInFlight = false;
-  let tokensIn = 0;
-  let tokensOut = 0;
   let liveOut = 0;
-  const countedLogs = /* @__PURE__ */ new Set();
   const activeSteps = /* @__PURE__ */ new Map();
   const refreshStatus = () => {
-    tui.setTokens(tokensIn, tokensOut + liveOut);
     let label = null;
     for (const v of activeSteps.values()) label = v;
     tui.setStep(label, liveOut);
@@ -9310,24 +9540,6 @@ ${c5.dim}runs on ${request.machine || runnerName}${c5.reset}`,
     refreshBgCount();
     void relayApprovals().catch(() => {
     });
-    try {
-      const logs = await api.getLogs(threadId, 100);
-      let landed = 0;
-      for (const l of logs) {
-        if (!l.is_complete) continue;
-        const id = l.id ?? `${l.created_at}:${l.total_tokens}`;
-        if (countedLogs.has(id)) continue;
-        countedLogs.add(id);
-        const inT = Number(l.input_tokens) || 0;
-        const outT = Number(l.output_tokens) || 0;
-        tokensIn += inT;
-        tokensOut += outT;
-        landed += outT;
-      }
-      if (landed > 0) liveOut = 0;
-      refreshStatus();
-    } catch {
-    }
     const COMPACTION_TRIGGER_FRACTION = 0.5;
     const COMPACTION_TRIGGER_CAP = 5e4;
     try {
@@ -9611,7 +9823,8 @@ function showDaemonInfo(tui, session) {
       `${c5.dim}The daemon is the executor on every machine: it runs the agent's tools, keeps working after you close the terminal, self-restarts, self-updates, and picks up sessions you start from anywhere.${c5.reset}`
     );
   } else {
-    tui.print(`${c5.dim}Manage it with standardcode daemon status | uninstall | add-project <path>.${c5.reset}`);
+    tui.print(`${c5.dim}Daemon commands: standardcode daemon status | restart | update | uninstall.${c5.reset}`);
+    tui.print(`${c5.dim}Add a project: standardcode daemon add-project /absolute/path/to/project${c5.reset}`);
   }
 }
 function showKeybindings(tui) {