@wrongstack/core 0.309.0 → 0.309.1

package/dist/defaults/index.js

@@ -5575,11 +5575,13 @@ var CHAOS_MONKEY_AGENT = {
   tools: [...TOOLS.build],
   skillNames: ["testing", "typescript-strict"],
   spawnBudgetExempt: true,
-  // Follow fleet worktree policy (NOT 'required'): mutation targets are
-  // often freshly written and uncommitted — a worktree spawned from HEAD
-  // would not contain them and every mutant would drift. Callers pass
-  // `worktree: 'off'` in the mutation_test input for uncommitted targets.
-  worktree: "auto",
+  // Run in the live checkout: mutation targets are usually freshly
+  // written and uncommitted — a worktree spawned from HEAD would not
+  // contain them and every mutant would drift. The mutation_test tool
+  // honors this value as its default; callers can still override per
+  // call via its `chaosWorktree` input when targets are committed and
+  // isolation is wanted.
+  worktree: "off",
   // Report travels via submit_result + final text, not the leader's stream.
   textStream: "silent",
   toolStream: "silent"
@@ -9640,24 +9642,29 @@ var TOKEN_PATTERNS = [
     kind: "return-null",
     // `return <expr>;` where expr is not already null/undefined/void.
     regex: /(?<indent>\breturn\b)(?<expr>\s+[^;{}\n]+?)\s*;/g,
-    replace: () => "return null;"
+    replace: () => "return null;",
+    endpointsInCode: true
   }
 ];
 function planMutations(file, source, opts = {}) {
   const maxPerFile = opts.maxPerFile ?? 25;
   const out = [];
   const lines = source.split("\n");
+  const masks = computeLineMasks(source);
   for (let lineIdx = 0; lineIdx < lines.length; lineIdx++) {
     const line = lines[lineIdx];
     const t = line.trim();
-    if (t.startsWith("//") || t.startsWith("*") || t.startsWith("/*")) continue;
+    if (t.startsWith("//")) continue;
+    const codeRanges = masks[lineIdx];
+    const inCode = (start) => codeRanges.some(([s, e]) => start >= s && start < e);
     for (const pattern of TOKEN_PATTERNS) {
       pattern.regex.lastIndex = 0;
       let m;
       while ((m = pattern.regex.exec(line)) !== null) {
         const token = m.groups?.["op"] ?? m[0];
         const tokenStart = m.index + m[0].indexOf(token);
-        if (isMasked(line, tokenStart, token.length)) continue;
+        if (!inCode(tokenStart)) continue;
+        if (pattern.endpointsInCode && !inCode(tokenStart + token.length - 1)) continue;
         const original = line.slice(tokenStart, tokenStart + token.length);
         const replacement = pattern.replace(token);
         if (replacement === original) continue;
@@ -9676,19 +9683,179 @@ function planMutations(file, source, opts = {}) {
   }
   return out.slice(0, maxPerFile);
 }
-function isMasked(line, start, len) {
-  let inSingle = false;
-  let inDouble = false;
-  for (let i = 0; i < start; i++) {
-    const c = line[i];
-    const prev = i > 0 ? line[i - 1] : void 0;
-    if (c === "'" && prev !== "\\") inSingle = !inSingle;
-    else if (c === '"' && prev !== "\\") inDouble = !inDouble;
-    if (!inSingle && !inDouble && c === "/" && prev === "/") return true;
+function computeLineMasks(source) {
+  const lines = source.split("\n");
+  const masks = lines.map(() => []);
+  const stack = [{ kind: "code", depth: 0, parens: [] }];
+  let inBlockComment = false;
+  let lastToken = null;
+  for (let lineIdx = 0; lineIdx < lines.length; lineIdx++) {
+    const line = lines[lineIdx];
+    const ranges = masks[lineIdx];
+    let runStart = null;
+    const closeRun = (end) => {
+      if (runStart !== null && end > runStart) ranges.push([runStart, end]);
+      runStart = null;
+    };
+    let i = 0;
+    if (inBlockComment) {
+      const close = line.indexOf("*/");
+      if (close === -1) continue;
+      inBlockComment = false;
+      i = close + 2;
+    }
+    while (i < line.length) {
+      const top = stack[stack.length - 1];
+      const c = line[i];
+      if (top.kind === "template") {
+        if (c === "\\") {
+          i += 2;
+          continue;
+        }
+        if (c === "`") {
+          stack.pop();
+          lastToken = "`";
+          i++;
+          continue;
+        }
+        if (c === "$" && line[i + 1] === "{") {
+          stack.push({ kind: "code", depth: 0, parens: [] });
+          lastToken = "${";
+          i += 2;
+          continue;
+        }
+        i++;
+        continue;
+      }
+      if (/[\w$]/.test(c)) {
+        let j = i + 1;
+        while (j < line.length && /[\w$]/.test(line[j])) j++;
+        lastToken = line.slice(i, j);
+        if (runStart === null) runStart = i;
+        i = j;
+        continue;
+      }
+      if (c === "'" || c === '"') {
+        closeRun(i);
+        i++;
+        while (i < line.length && line[i] !== c) {
+          if (line[i] === "\\") i++;
+          i++;
+        }
+        i++;
+        lastToken = c;
+        continue;
+      }
+      if (c === "`") {
+        closeRun(i);
+        stack.push({ kind: "template", depth: 0, parens: [] });
+        i++;
+        continue;
+      }
+      if (c === "/" && line[i + 1] === "/") {
+        closeRun(i);
+        break;
+      }
+      if (c === "/" && line[i + 1] === "*") {
+        closeRun(i);
+        const close = line.indexOf("*/", i + 2);
+        if (close === -1) {
+          inBlockComment = true;
+          break;
+        }
+        i = close + 2;
+        continue;
+      }
+      if (c === "/") {
+        if (!tokenCanEndOperand(lastToken)) {
+          closeRun(i);
+          const next = skipRegexLiteral(line, i);
+          lastToken = next > i + 1 ? "regex" : "/";
+          i = next;
+          continue;
+        }
+      }
+      if (c === "(") {
+        top.parens.push(CONTROL_KEYWORDS.has(lastToken ?? "") ? "control" : "expr");
+        lastToken = c;
+      } else if (c === ")") {
+        const kind = top.parens.pop() ?? "expr";
+        lastToken = kind === "control" ? "control-paren-close" : ")";
+      } else if (c === "{") {
+        top.depth++;
+        lastToken = c;
+      } else if (c === "}") {
+        if (top.depth > 0) {
+          top.depth--;
+          lastToken = c;
+        } else if (stack.length > 1) {
+          closeRun(i);
+          stack.pop();
+          i++;
+          continue;
+        } else {
+          lastToken = c;
+        }
+      } else if (c !== " " && c !== "	" && c !== "\r") {
+        lastToken = c;
+      }
+      if (runStart === null) runStart = i;
+      i++;
+    }
+    closeRun(line.length);
+  }
+  return masks;
+}
+var KEYWORDS_BEFORE_REGEX = /* @__PURE__ */ new Set([
+  "return",
+  "typeof",
+  "instanceof",
+  "in",
+  "of",
+  "new",
+  "delete",
+  "void",
+  "throw",
+  "case",
+  "do",
+  "else",
+  "yield",
+  "await"
+]);
+var CONTROL_KEYWORDS = /* @__PURE__ */ new Set(["if", "for", "while", "switch", "catch", "with", "await"]);
+function tokenCanEndOperand(token) {
+  if (token === null) return false;
+  if (/^[\w$]+$/.test(token)) return !KEYWORDS_BEFORE_REGEX.has(token);
+  return token === ")" || token === "]" || token === "." || token === '"' || token === "'" || token === "`";
+}
+function skipRegexLiteral(line, start) {
+  let i = start + 1;
+  let inClass = false;
+  while (i < line.length) {
+    const ch = line[i];
+    if (ch === "\\") {
+      i += 2;
+      continue;
+    }
+    if (inClass) {
+      if (ch === "]") inClass = false;
+      i++;
+      continue;
+    }
+    if (ch === "[") {
+      inClass = true;
+      i++;
+      continue;
+    }
+    if (ch === "/") {
+      i++;
+      break;
+    }
+    if (ch === "\n" || ch === "\r") return line.length;
+    i++;
   }
-  if (inSingle || inDouble) return true;
-  const window = line.slice(start, start + len);
-  return /['"]/.test(window);
+  while (i < line.length && /[a-z]/.test(line[i])) i++;
+  return i;
 }
 function parseMutationReport(text) {
   const candidates = [];
@@ -9739,7 +9906,7 @@ function normalizeMutantEntry(value) {
   const rec = value;
   const id = typeof rec["id"] === "string" ? rec["id"] : void 0;
   const status = rec["status"];
-  if (!id || status !== "killed" && status !== "survived" && status !== "skipped") {
+  if (!id || status !== "killed" && status !== "survived" && status !== "skipped" && status !== "killed-by-hang") {
     return void 0;
   }
   return {
@@ -9795,7 +9962,7 @@ function makeMutationTestTool(director, roster, opts = {}) {
         },
         chaosWorktree: {
           anyOf: [{ type: "boolean" }, { type: "string", enum: ["auto", "required", "off"] }],
-          description: "Worktree override for the chaos agent. Use 'off' when targets are uncommitted \u2014 a worktree from HEAD would not contain them."
+          description: "Worktree override for the chaos agent. Defaults to the roster policy for chaos-monkey ('off'), because mutation targets are usually freshly written and uncommitted \u2014 a worktree from HEAD would not contain them and every mutant would drift to skipped. Only pass 'auto' or 'required' when the targets are committed."
         },
         timeoutMs: { type: "number", minimum: 1, description: "Per-task timeout for chaos/strengthen/rerun tasks." },
         reportOnly: {
@@ -9817,8 +9984,16 @@ function makeMutationTestTool(director, roster, opts = {}) {
           error: "No mutable sites found in the given targets (after comment/string filtering)."
         };
       }
+      const chaosBase = roster?.[CHAOS_ROLE];
+      if (!chaosBase) {
+        return {
+          verdict: "inconclusive",
+          passed: false,
+          error: "chaos-monkey role missing from the roster \u2014 refusing to spawn a saboteur without its prompt/tools contract. Build the toolset with a roster that includes 'chaos-monkey' (FLEET_ROSTER does)."
+        };
+      }
       const chaosSubagentId = await director.spawn(
-        makeChaosConfig(roster, i.chaosWorktree ?? "off")
+        makeChaosConfig(chaosBase, i.chaosWorktree ?? chaosBase.worktree ?? "off")
       );
       const chaosTaskId = await director.assign({
         id: randomUUID8(),
@@ -9836,6 +10011,7 @@ function makeMutationTestTool(director, roster, opts = {}) {
       );
       const attempts = [];
       let current = survivors;
+      let rerunUnknowns = [];
       while (current.length > 0 && attempts.length < maxAttempts && i.repairSubagentId) {
         const attemptNo = attempts.length + 1;
         const strengthenTaskId = await director.assign({
@@ -9857,7 +10033,7 @@ function makeMutationTestTool(director, roster, opts = {}) {
         }
         const survivorPlan = plan.filter((p) => current.some((s) => s.id === p.id));
         const rerunSubagentId = await director.spawn(
-          makeChaosConfig(roster, i.chaosWorktree ?? "off")
+          makeChaosConfig(chaosBase, i.chaosWorktree ?? chaosBase.worktree ?? "off")
         );
         const rerunTaskId = await director.assign({
           id: randomUUID8(),
@@ -9867,29 +10043,36 @@ function makeMutationTestTool(director, roster, opts = {}) {
         });
         const [rerunResult] = await director.awaitTasks([rerunTaskId]);
         const passN = collectOutcomes(rerunResult, survivorPlan);
-        const stillSurviving = passN.filter((m) => m.status === "survived" || m.status === "skipped");
+        const stillSurviving = passN.filter((m) => !isKill(m.status));
+        rerunUnknowns = passN.filter((m) => m.status === "skipped");
         attempts.push({
           attempt: attemptNo,
           survivorsBefore: current,
           strengthenResult: { taskId: strengthenResult.taskId, status: strengthenResult.status },
           rerunResult: { taskId: rerunTaskId, status: rerunResult?.status ?? "unknown" },
           survivorsAfter: stillSurviving,
-          suspectedEquivalent: stillSurviving.filter((m) => current.some((c) => c.id === m.id)).map((m) => m.id)
+          suspectedEquivalent: stillSurviving.filter((m) => m.status === "survived" && current.some((c) => c.id === m.id)).map((m) => m.id)
         });
-        current = stillSurviving.filter((m) => m.status === "survived");
-        if (passN.every((m) => m.status === "skipped")) break;
+        current = stillSurviving;
       }
-      const finalSurvivors = current;
+      const finalSurvivors = current.filter((m) => m.status === "survived");
       const verifiedCount = pass1.filter((m) => m.status !== "skipped").length;
       const skippedCount = pass1.filter((m) => m.status === "skipped").length;
-      const score = plan.length === 0 ? 0 : pass1.filter((m) => m.status === "killed").length / plan.length;
-      const verdict = verifiedCount === 0 ? "inconclusive" : finalSurvivors.length === 0 ? skippedCount > 0 ? "partial" : "pass" : score >= 0.8 ? "partial" : "fail";
+      const rerunUnknownCount = rerunUnknowns.length;
+      const score = plan.length === 0 ? 0 : pass1.filter((m) => isKill(m.status)).length / plan.length;
+      const verdict = verifiedCount === 0 ? "inconclusive" : finalSurvivors.length === 0 ? skippedCount > 0 || rerunUnknownCount > 0 ? "partial" : "pass" : score >= 0.8 ? "partial" : "fail";
       return {
         verdict,
         passed: verdict === "pass",
         mutationScore: Number.parseFloat(score.toFixed(3)),
         planned: plan.length,
-        killed: pass1.filter((m) => m.status === "killed").length,
+        killed: pass1.filter((m) => isKill(m.status)).length,
+        // Breakout of `killed`: how many kills were detected by the test
+        // command hanging rather than by a failing assertion. A subset of
+        // `killed`, surfaced so a director can distinguish a hang-heavy
+        // suite (mutants breaking termination, not assertions) from an
+        // assertion-strong one. hangHeavy = killedByHang === killed.
+        killedByHang: pass1.filter((m) => m.status === "killed-by-hang").length,
         survived: pass1.filter((m) => m.status === "survived").length,
         skipped: pass1.filter((m) => m.status === "skipped").length,
         finalSurvivors: finalSurvivors.map((m) => ({ id: m.id, file: m.file, kind: m.kind })),
@@ -9897,7 +10080,11 @@ function makeMutationTestTool(director, roster, opts = {}) {
         strengthenAttempts: attempts.length,
         attempts,
         chaosTaskId,
-        nextAction: finalSurvivors.length === 0 ? "accept" : attempts.length >= maxAttempts && i.repairSubagentId ? "manual_review_survivors" : "strengthen_tests"
+        // Unverified leftovers from the strengthen loop: surfaced so the
+        // caller can see WHICH mutants lack kill evidence, and counted by
+        // the verdict gate above.
+        unverifiedFromRerun: rerunUnknowns.map((m) => ({ id: m.id, file: m.file, kind: m.kind })),
+        nextAction: finalSurvivors.length === 0 && rerunUnknownCount === 0 && skippedCount === 0 ? "accept" : attempts.length >= maxAttempts && i.repairSubagentId ? "manual_review_survivors" : "strengthen_tests"
       };
     }
   };
@@ -9913,7 +10100,7 @@ function normalizeMutationTestInput(input) {
     maxPerFile: typeof raw["maxPerFile"] === "number" ? raw["maxPerFile"] : void 0,
     maxStrengthenAttempts: typeof raw["maxStrengthenAttempts"] === "number" ? raw["maxStrengthenAttempts"] : void 0,
     repairSubagentId: typeof raw["repairSubagentId"] === "string" && raw["repairSubagentId"].trim() ? raw["repairSubagentId"].trim() : void 0,
-    chaosWorktree: raw["chaosWorktree"] ?? void 0,
+    chaosWorktree: normalizeWorktreeOverride(raw["chaosWorktree"]),
     timeoutMs: typeof raw["timeoutMs"] === "number" ? raw["timeoutMs"] : void 0,
     reportOnly: raw["reportOnly"] === true
   };
@@ -9935,8 +10122,7 @@ function buildPlan(i, projectRoot) {
   }
   return plan;
 }
-function makeChaosConfig(roster, worktree) {
-  const base = roster?.[CHAOS_ROLE] ?? getAgentDefinition(CHAOS_ROLE)?.config ?? { name: "Chaos Monkey", role: CHAOS_ROLE };
+function makeChaosConfig(base, worktree) {
   return { ...instantiateRosterConfig2(CHAOS_ROLE, base), worktree };
 }
 function buildChaosTask(plan, i, pass, priorSurvivors) {
@@ -9952,7 +10138,7 @@ ${priorSurvivors.map((s) => `- ${s.id} (${s.kind} @ ${s.file}:${s.line})`).join(
     "For each mutant, in order:",
     "1. Apply ONLY that mutation at its exact (file, line, column).",
     `2. Run the test command: ${i.testCommand}${i.cwd ? ` (cwd: ${i.cwd})` : ""}`,
-    "3. Record killed (tests failed \u2014 quote first failing assertion) or survived (suite green).",
+    "3. Record killed (tests failed \u2014 quote first failing assertion), survived (suite green), or killed-by-hang (the test command timed out or was aborted \u2014 the mutation broke the suite by non-termination; record the timeout as evidence, do NOT report it as survived).",
     "4. Restore the file byte-for-byte before the next mutant.",
     "",
     "Mutants:",
@@ -9964,23 +10150,49 @@ ${priorSurvivors.map((s) => `- ${s.id} (${s.kind} @ ${s.file}:${s.line})`).join(
   ].join("\n");
 }
 function buildStrengthenTask(survivors, i, attempt) {
+  const confirmed = survivors.filter((s) => s.status === "survived");
+  const unverified = survivors.filter((s) => s.status === "skipped");
+  const row = (s) => `- ${s.id} | ${s.file}:${s.line} | ${s.kind}${s.evidence ? ` | ${s.evidence}` : ""}`;
   return [
-    `Strengthen the tests so these SURVIVING mutants die (attempt ${attempt}).`,
-    "",
-    "Each survivor below was a deliberate sabotage of production code that the current suite did NOT catch:",
-    ...survivors.map((s) => `- ${s.id} | ${s.file}:${s.line} | ${s.kind}${s.evidence ? ` | ${s.evidence}` : ""}`),
+    `Strengthen the tests so the mutants below die (attempt ${attempt}).`,
     "",
-    `Test command that must fail under each mutant: ${i.testCommand}`,
+    ...confirmed.length > 0 ? [
+      "CONFIRMED SURVIVORS \u2014 each was a deliberate sabotage of production code that the current suite did NOT catch:",
+      ...confirmed.map(row),
+      ""
+    ] : [],
+    ...unverified.length > 0 ? [
+      "UNVERIFIED \u2014 these mutations were never actually re-tested (the re-verify pass skipped or did not report them). Do NOT assume the suite misses them: first apply each mutation, run the tests, and confirm it really survives; if the tests already fail, report that instead of writing new assertions.",
+      ...unverified.map(row),
+      ""
+    ] : [],
+    `Test command that must fail under each CONFIRMED mutant: ${i.testCommand}`,
     "",
-    "For each survivor add or tighten exactly one assertion that pins the sabotaged boundary/behavior. Do not change production code. Do not weaken other tests. Run the suite green on clean code before finishing."
+    "For each CONFIRMED survivor add or tighten exactly one assertion that pins the sabotaged boundary/behavior. Do not change production code. Do not weaken other tests. Run the suite green on clean code before finishing."
   ].join("\n");
 }
 function collectOutcomes(result, plan) {
   const fromText = parseTextOutcomes(result);
   if (fromText.length > 0) {
-    const planned = new Set(plan.map((p) => p.id));
-    const matched = fromText.filter((m) => planned.has(m.id));
-    if (matched.length > 0) return matched;
+    const remaining = [...plan];
+    const matched = [];
+    for (const m of fromText) {
+      const idx = remaining.findIndex((p) => p.id === m.id);
+      if (idx === -1) continue;
+      remaining.splice(idx, 1);
+      matched.push(m);
+    }
+    if (matched.length > 0) {
+      const missing = remaining.map((p) => ({
+        id: p.id,
+        file: p.file,
+        line: p.line,
+        kind: p.kind,
+        status: "skipped",
+        evidence: "not reported by chaos task"
+      }));
+      return [...matched, ...missing];
+    }
   }
   return plan.map((p) => ({
     id: p.id,
@@ -9991,6 +10203,9 @@ function collectOutcomes(result, plan) {
     evidence: result ? `chaos task ended ${result.status}` : "chaos task produced no result"
   }));
 }
+function isKill(status) {
+  return status === "killed" || status === "killed-by-hang";
+}
 function parseTextOutcomes(result) {
   const text = typeof result?.result === "string" ? result.result : void 0;
   if (!text) return [];
@@ -10693,6 +10908,14 @@ var PATTERNS = [
     anchor: "sk-ant-"
   },
   { type: "openai_key", regex: /(?<![A-Za-z0-9])sk-(?:proj-)?[A-Za-z0-9_-]{20,}(?![A-Za-z0-9])/g, anchor: "sk-" },
+  {
+    // `xai` is a first-class provider in this codebase, but its key shape was
+    // absent here — so the one credential format WrongStack itself hands users
+    // was the one the scrubber could not recognize (audit 2026-08-20).
+    type: "xai_key",
+    regex: /(?<![A-Za-z0-9])xai-[A-Za-z0-9]{20,}(?![A-Za-z0-9])/g,
+    anchor: "xai-"
+  },
   { type: "github_pat", regex: /(?<![A-Za-z0-9])ghp_[A-Za-z0-9]{36,}(?![A-Za-z0-9])/g, anchor: "ghp_" },
   { type: "github_pat_v2", regex: /(?<![A-Za-z0-9])github_pat_[A-Za-z0-9_]{50,}(?![A-Za-z0-9])/g, anchor: "github_pat_" },
   { type: "aws_access_key", regex: /(?<![A-Za-z0-9])AKIA[0-9A-Z]{16}(?![A-Za-z0-9])/g, anchor: "AKIA" },
@@ -10783,8 +11006,8 @@ var PATTERNS = [
     // replacement so the separator between adjacent secrets is preserved
     // rather than collapsed. Capture groups are therefore: 1=leading
     // delimiter, 2=key name, 3=value.
-    regex: /(^|\s)([A-Z_]{4,}(?:KEY|TOKEN|SECRET|PASSWORD|PWD))\s*[:=]\s*['"]?([A-Za-z0-9_/+=-]{20,512})['"]?(?=\s|$)/g,
-    anchor: ["KEY", "TOKEN", "SECRET", "PASSWORD", "PWD"]
+    regex: /(^|\s)([A-Z_]{4,}(?:KEY|TOKEN|SECRET|PASSWORD|PWD|PASSPHRASE))\s*[:=]\s*['"]?([A-Za-z0-9_/+=-]{20,512})['"]?(?=\s|$)/g,
+    anchor: ["KEY", "TOKEN", "SECRET", "PASSWORD", "PWD", "PASSPHRASE"]
   },
   {
     type: "json_credential_key",
@@ -10901,6 +11124,27 @@ var JSON_CREDENTIAL_REGEX = PATTERNS.find((p) => p.type === "json_credential_key
 var COMBINED_REPLACEMENTS = SIMPLE_PATTERNS.map((p) => `[REDACTED:${p.type}]`);
 var SCRUB_CHUNK_BYTES = 64 * 1024;
 var SCRUB_OVERLAP_BYTES = 1024;
+var PEM_PRIVATE_KEY_BEGIN_RE = /-----BEGIN (?:RSA|EC|OPENSSH|DSA|PGP)? ?PRIVATE KEY-----/;
+var PEM_END_MARKER = "-----END";
+var MAX_PEM_BLOCK_BYTES = 64 * 1024;
+var PEM_END_LINE_TOLERANCE = 64;
+function extendChunkBoundaryPastPem(text, chunkStart, proposedEnd) {
+  const head = text.slice(chunkStart, proposedEnd);
+  const lastBegin = head.lastIndexOf("-----BEGIN ");
+  if (lastBegin === -1) return proposedEnd;
+  const fromBegin = text.slice(chunkStart + lastBegin);
+  const marker = PEM_PRIVATE_KEY_BEGIN_RE.exec(fromBegin);
+  if (!marker || marker.index !== 0) return proposedEnd;
+  const bodyStart = marker[0].length;
+  const cap = Math.min(text.length, chunkStart + lastBegin + MAX_PEM_BLOCK_BYTES);
+  const closeIdx = fromBegin.indexOf(PEM_END_MARKER, bodyStart);
+  if (closeIdx === -1 || chunkStart + lastBegin + closeIdx >= cap + PEM_END_LINE_TOLERANCE) {
+    return proposedEnd;
+  }
+  const lineEnd = fromBegin.indexOf("\n", closeIdx);
+  const end = lineEnd === -1 ? text.length : chunkStart + lastBegin + lineEnd + 1;
+  return Math.max(proposedEnd, end);
+}
 var PATTERN_ANCHORS = [
   ...new Set(
     PATTERNS.flatMap(
@@ -10937,6 +11181,7 @@ var DefaultSecretScrubber = class {
           }
         }
         end = safe === -1 ? end : safe + 1;
+        end = extendChunkBoundaryPastPem(text, i, end);
       }
       out.push(this.scrubOne(text.slice(i, end)));
       i = end;
@@ -14768,9 +15013,21 @@ function renderCommandLine(command, args) {
   });
   return [command, ...rendered].join(" ");
 }
-function subjectForToolInput(toolName, input, subjectKey) {
+function renderSubjectFields(obj, fields) {
+  const parts = [];
+  for (const field of fields) {
+    const value = obj[field];
+    if (value === void 0 || value === null || value === "" || value === false) continue;
+    const str = String(value);
+    parts.push(`${field}=${/\s/.test(str) ? `"${str.replace(/"/g, '\\"')}"` : str}`);
+  }
+  return parts.join(" ");
+}
+function subjectForToolInput(toolName, input, subjectKey, subjectFields) {
   if (!input || typeof input !== "object") return void 0;
   const obj = input;
+  const extra = subjectFields && subjectFields.length > 0 ? renderSubjectFields(obj, subjectFields) : "";
+  const withExtra = (base) => extra ? `${base} ${extra}` : base;
   if (subjectKey) {
     const value = obj[subjectKey];
     if (Array.isArray(value)) {
@@ -14786,9 +15043,9 @@ function subjectForToolInput(toolName, input, subjectKey) {
       if (subjectKey === "command") {
         const rendered = renderCommandLine(value, obj["args"]);
         if (value === "commit" && obj["dry_run"] === true) {
-          return `${escapeGlobSubject(rendered)}:dry-run`;
+          return `${escapeGlobSubject(withExtra(rendered))}:dry-run`;
         }
-        return escapeGlobSubject(rendered);
+        return escapeGlobSubject(withExtra(rendered));
       }
       if (subjectKey === "directory" && obj["dry_run"] === true) {
         return `${escapeGlobSubject(value)}:dry-run`;
@@ -20778,6 +21035,7 @@ function worktreeOwnerLabel(task, config) {
 }
 
 // src/coordination/director.ts
+var BUSY_REARM_FLOOR_MS = 1e3;
 var Director = class _Director {
   /* eslint-disable-next-line @typescript-eslint/no-unused-vars — just a cast helper */
   static _asManifestEntry(v) {
@@ -20843,6 +21101,13 @@ var Director = class _Director {
   subagentIdleTimeoutMs;
   retireSubagentOnTaskComplete;
   subagentIdleTimers = /* @__PURE__ */ new Map();
+  /**
+   * Effective idle window per subagent (spawn-time `idleTimeoutMs` override
+   * or the Director-wide default; undefined = no window). Internal-task
+   * completion re-arms with THIS value, not the Director-wide default, so
+   * a subagent-configured window survives its first internal probe.
+   */
+  subagentIdleDelayMs = /* @__PURE__ */ new Map();
   sharedScratchpadPath;
   maxSpawns;
   maxSpawnDepth;
@@ -20999,7 +21264,13 @@ var Director = class _Director {
   handleTaskCompleted(payload) {
     const r = payload.result;
     const settled = this.tasks.settle(r);
-    if (settled.internal) return;
+    if (settled.internal) {
+      this.armSubagentIdleRetirement(
+        r.subagentId,
+        this.subagentIdleDelayMs.get(r.subagentId) ?? this.subagentIdleTimeoutMs
+      );
+      return;
+    }
     const title = this.tasks.descriptionFor(r.taskId, payload.task.description ?? r.taskId);
     if (!settled.consumedInBand && this.taskResultNotifier) {
       const resultText = typeof r.result === "string" ? r.result : r.result !== void 0 ? safeStringify(r.result) : void 0;
@@ -21064,7 +21335,7 @@ var Director = class _Director {
     }
     this.armSubagentIdleRetirement(
       r.subagentId,
-      this.retireSubagentOnTaskComplete ? 0 : this.subagentIdleTimeoutMs
+      this.retireSubagentOnTaskComplete ? 0 : this.subagentIdleDelayMs.get(r.subagentId) ?? this.subagentIdleTimeoutMs
     );
   }
   extensionsFor(subagentId) {
@@ -21150,6 +21421,7 @@ var Director = class _Director {
     this.resolveSpawnModel(config);
     const subagentId = await spawn3(this, config, priceLookup);
     const perSubagentIdleMs = typeof config.idleTimeoutMs === "number" && Number.isFinite(config.idleTimeoutMs) && config.idleTimeoutMs >= 0 ? config.idleTimeoutMs : this.subagentIdleTimeoutMs;
+    this.subagentIdleDelayMs.set(subagentId, perSubagentIdleMs);
     this.armSubagentIdleRetirement(subagentId, perSubagentIdleMs);
     return subagentId;
   }
@@ -21203,6 +21475,7 @@ var Director = class _Director {
     this.budgetPolicy.dispose();
     for (const timer of this.subagentIdleTimers.values()) clearTimeout(timer);
     this.subagentIdleTimers.clear();
+    this.subagentIdleDelayMs.clear();
     await this.coordinator.stopAll();
     this.tasks.resolveWaitersOnShutdown();
     for (const b of this.subagentBridges.values()) {
@@ -21261,6 +21534,7 @@ var Director = class _Director {
   }
   async remove(subagentId) {
     this.clearSubagentIdleRetirement(subagentId);
+    this.subagentIdleDelayMs.delete(subagentId);
     void this.appendSessionEvent({
       type: "agent_stopped",
       ts: (/* @__PURE__ */ new Date()).toISOString(),
@@ -21313,9 +21587,13 @@ var Director = class _Director {
     const timer = setTimeout(() => {
       this.subagentIdleTimers.delete(subagentId);
       const entry = this.coordinator.getStatus().subagents.find((a) => a.id === subagentId);
-      if (entry?.status !== "idle") return;
+      if (entry === void 0) return;
+      if (entry.status !== "idle") {
+        this.armSubagentIdleRetirement(subagentId, Math.max(delayMs, BUSY_REARM_FLOOR_MS));
+        return;
+      }
       if (this.coordinator.listPendingTasks().some((task) => task.subagentId === subagentId)) {
-        this.armSubagentIdleRetirement(subagentId, this.subagentIdleTimeoutMs);
+        this.armSubagentIdleRetirement(subagentId, Math.max(delayMs, BUSY_REARM_FLOOR_MS));
         return;
       }
       void this.remove(subagentId).catch(
@@ -28587,6 +28865,10 @@ var DefaultSkillLoader = class {
         );
         for (const e of entries) {
           if (!await entryIsDirectory(dir, e)) continue;
+          if (!isValidSkillNameFormat(e.name)) {
+            this.skipped.push({ dir, entry: e.name, reason: "invalid-name-format" });
+            continue;
+          }
           const skillFile = path30.join(dir, e.name, "SKILL.md");
           let raw;
           try {
@@ -30260,7 +30542,7 @@ var ToolExecutor = class _ToolExecutor {
         return { result, tool, durationMs: Date.now() - start };
       }
       if (effectivePermission === "confirm") {
-        const suggestedPattern = boundary.decision === "confirm" ? `kanban-boundary:${boundary.path ?? tool.name}` : subjectForToolInput(tool.name, use.input, tool.subjectKey) ?? tool.name;
+        const suggestedPattern = boundary.decision === "confirm" ? `kanban-boundary:${boundary.path ?? tool.name}` : subjectForToolInput(tool.name, use.input, tool.subjectKey, tool.subjectFields) ?? tool.name;
         if (this.opts.confirmAwaiter) {
           const awaiter = this.opts.confirmAwaiter;
           const choice = await new Promise(
@@ -32790,7 +33072,9 @@ function hasRecursiveForceDelete(command, projectRoot) {
     if (token === "rd" || token === "rmdir") {
       const args = commandSegment(tokens, i + 1).map((arg) => arg.toLowerCase());
       if (args.includes("/s")) {
-        const targets = args.filter((arg) => !arg.startsWith("-") && !arg.startsWith("/") && !SHELL_OPERATORS.has(arg));
+        const targets = args.filter(
+          (arg) => !arg.startsWith("-") && !arg.startsWith("/") && !SHELL_OPERATORS.has(arg)
+        );
         if (targets.length === 0) return true;
         if (targets.some(isCatastrophicDeleteTarget)) return true;
         if (targets.some((target) => !pathLooksInsideProject(target, projectRoot))) return true;
@@ -32859,7 +33143,8 @@ function hasFindExec(command) {
 function isCatastrophicDeleteTarget(rawTarget) {
   const t = rawTarget.replace(/^['"]|['"]$/g, "").trim();
   if (!t) return false;
-  if (t === "*" || t === "." || t === "./" || t === ".\\" || t === "./*" || t === ".\\*") return true;
+  if (t === "*" || t === "." || t === "./" || t === ".\\" || t === "./*" || t === ".\\*")
+    return true;
   const s = t.replace(/[\\/]\*+$/, "").replace(/[\\/]+$/, "");
   if (s === "") return true;
   if (s === "~" || /^\$HOME$/i.test(s) || /^%USERPROFILE%$/i.test(s)) return true;
@@ -32899,12 +33184,16 @@ function hasCatastrophicDelete(command) {
       const args = tokens.slice(i + 1);
       const recursive = args.some((arg) => arg.toLowerCase() === "/s");
       if (!recursive) continue;
-      const targets = args.filter((arg) => !arg.startsWith("-") && !arg.startsWith("/") && !SHELL_OPERATORS.has(arg));
+      const targets = args.filter(
+        (arg) => !arg.startsWith("-") && !arg.startsWith("/") && !SHELL_OPERATORS.has(arg)
+      );
       if (targets.some(isCatastrophicDeleteTarget)) return true;
     }
     if (token === "del" || token === "erase") {
       const args = tokens.slice(i + 1);
-      const targets = args.filter((arg) => !arg.startsWith("-") && !arg.startsWith("/") && !SHELL_OPERATORS.has(arg));
+      const targets = args.filter(
+        (arg) => !arg.startsWith("-") && !arg.startsWith("/") && !SHELL_OPERATORS.has(arg)
+      );
       if (targets.some(isCatastrophicDeleteTarget)) return true;
     }
   }
@@ -32965,6 +33254,47 @@ function isClearlyDestructiveBashCommand(command, projectRoot) {
   if (HIGH_IMPACT_PATTERNS.some((pattern) => pattern.test(trimmed))) return true;
   return false;
 }
+var WELL_KNOWN_CREDENTIAL_ENV_VARS = /* @__PURE__ */ new Set([
+  "ANTHROPIC_API_KEY",
+  "ANTHROPIC_AUTH_TOKEN",
+  "OPENAI_API_KEY",
+  "AZURE_OPENAI_API_KEY",
+  "GEMINI_API_KEY",
+  "GOOGLE_API_KEY",
+  "GOOGLE_APPLICATION_CREDENTIALS",
+  "GOOGLE_GENERATIVE_AI_API_KEY",
+  "GROQ_API_KEY",
+  "MISTRAL_API_KEY",
+  "COHERE_API_KEY",
+  "DEEPSEEK_API_KEY",
+  "XAI_API_KEY",
+  "OPENROUTER_API_KEY",
+  "PERPLEXITY_API_KEY",
+  "TOGETHER_API_KEY",
+  "FIREWORKS_API_KEY",
+  "HUGGINGFACE_API_KEY",
+  "HF_TOKEN",
+  "GITHUB_TOKEN",
+  "GH_TOKEN",
+  "NPM_TOKEN",
+  "AWS_ACCESS_KEY_ID",
+  "AWS_SECRET_ACCESS_KEY",
+  "AWS_SESSION_TOKEN",
+  "AZURE_CLIENT_SECRET",
+  "GITLAB_TOKEN",
+  "SLACK_TOKEN",
+  "STRIPE_SECRET_KEY",
+  "TELEGRAM_BOT_TOKEN",
+  "WRONGSTACK_VAULT_PASSPHRASE"
+]);
+function attachesWellKnownCredential(input) {
+  if (!input || typeof input !== "object") return false;
+  const envVars = input["envVars"];
+  if (!Array.isArray(envVars)) return false;
+  return envVars.some(
+    (name) => typeof name === "string" && WELL_KNOWN_CREDENTIAL_ENV_VARS.has(name.toUpperCase())
+  );
+}
 
 // src/security/permission-helpers.ts
 function matchesTrust(patterns, subject) {
@@ -32981,7 +33311,7 @@ function hasShellSubject(tool) {
   ]);
 }
 function alwaysAllowUnavailableReason(tool, input) {
-  const subject = subjectForToolInput(tool.name, input, tool.subjectKey);
+  const subject = subjectForToolInput(tool.name, input, tool.subjectKey, tool.subjectFields);
   if (subject !== void 0) return void 0;
   return `"always allow" needs a subject to remember, and ${tool.name} calls do not carry one (no subjectKey, and no path/url/name input). Recording it would store a rule that can never match. Approve this call, or set a trust rule for ${tool.name} explicitly.`;
 }
@@ -33041,8 +33371,18 @@ var AGENT_STATE_SENSITIVE_BASENAMES = /^(?:config\.json|config\.local\.json|trus
 function unescapeGlobSubject(value) {
   return value.replace(/\\([*?[\]])/g, "$1");
 }
+function stripAdsSuffix(forwardSlashPath) {
+  const cut = forwardSlashPath.lastIndexOf("/");
+  const dir = cut === -1 ? "" : forwardSlashPath.slice(0, cut + 1);
+  const base = cut === -1 ? forwardSlashPath : forwardSlashPath.slice(cut + 1);
+  const colon = base.indexOf(":");
+  if (colon === -1 || cut === -1 && colon === 1 && base.length <= 2) return forwardSlashPath;
+  return dir + base.slice(0, colon);
+}
 function normalizeForCompare(value) {
-  const forward = unescapeGlobSubject(value).replace(/\\/g, "/").replace(/\/+$/, "");
+  const forward = stripAdsSuffix(
+    unescapeGlobSubject(value).replace(/\\/g, "/").replace(/\/+$/, "")
+  );
   return process.platform === "win32" ? forward.toLowerCase() : forward;
 }
 function realpathOfNearestExisting(p) {
@@ -33079,7 +33419,7 @@ function isProtectedAgentStatePath(absPath) {
   return AGENT_STATE_SENSITIVE_BASENAMES.test(path40.basename(normalizeForCompare(absPath)));
 }
 function pathLooksSensitive(rawPath) {
-  const normalized = stripShellQuotes(rawPath).replace(/\\/g, "/");
+  const normalized = stripAdsSuffix(stripShellQuotes(rawPath).replace(/\\/g, "/"));
   if (SENSITIVE_READ_PATHS.some((pattern) => pattern.test(normalized))) return true;
   return isProtectedAgentStatePath(normalized);
 }
@@ -33103,10 +33443,24 @@ function shellCommandReadsSensitivePath(command) {
   }
   return false;
 }
+function isSensitiveReadCall(tool, input) {
+  const isReadTool = hasCapability(tool, ToolCapabilities.FS_READ) || tool.name === "read" || tool.name === "grep" || tool.name === "glob" || tool.name === "tree";
+  if (isReadTool && inputPathLooksSensitive(input)) return true;
+  const hasShellCap = hasCapability(tool, [
+    ToolCapabilities.SHELL_ARBITRARY,
+    ToolCapabilities.SHELL_RESTRICTED,
+    ToolCapabilities.SHELL_EXEC
+  ]);
+  if (!hasShellCap && tool.name !== "bash" && tool.name !== "shell" && tool.name !== "exec") {
+    return false;
+  }
+  const command = shellCommandLineFromInput(input);
+  return command ? shellCommandReadsSensitivePath(command) : false;
+}
 
 // src/security/permission-explain.ts
 function explainPermissionTrace(state, tool, input, ctx) {
-  const subject = subjectForToolInput(tool.name, input, tool.subjectKey);
+  const subject = subjectForToolInput(tool.name, input, tool.subjectKey, tool.subjectFields);
   const steps = [];
   let winnerIndex = -1;
   const add = (rule, matched, decision, source, detail) => {
@@ -33327,13 +33681,7 @@ function explainPermissionTrace(state, tool, input, ctx) {
         }
       };
     }
-    add(
-      "yolo",
-      true,
-      "auto",
-      "yolo",
-      "YOLO mode is active \u2014 auto-approving every non-denied call"
-    );
+    add("yolo", true, "auto", "yolo", "YOLO mode is active \u2014 auto-approving every non-denied call");
     winnerIndex = steps.length - 1;
     return {
       toolName: tool.name,
@@ -33604,7 +33952,14 @@ var AutoApprovePermissionPolicy = class _AutoApprovePermissionPolicy {
   static isMcpTool(name) {
     return name.startsWith("mcp__");
   }
-  async evaluate(tool) {
+  async evaluate(tool, input) {
+    if (input !== void 0 && isSensitiveReadCall(tool, input)) {
+      return {
+        permission: "deny",
+        source: "subagent_guard",
+        reason: "subagents may not read credential-bearing paths \u2014 the leader must perform this read so the user can approve it"
+      };
+    }
     const caps = tool.capabilities ?? [];
     const hasAllowedCap = caps.some((c) => this.allowedCapabilities.includes(c));
     const isMcp = _AutoApprovePermissionPolicy.isMcpTool(tool.name);
@@ -33631,8 +33986,8 @@ var AutoApprovePermissionPolicy = class _AutoApprovePermissionPolicy {
   }
   allowOnce() {
   }
-  async explain(tool) {
-    const decision = await this.evaluate(tool);
+  async explain(tool, input) {
+    const decision = await this.evaluate(tool, input);
     return {
       toolName: tool.name,
       subject: null,
@@ -33682,6 +34037,17 @@ function fsWriteTargetPaths(input) {
   }
   return out;
 }
+function mergeTrustEntries(exact, wildcard) {
+  if (!exact) return wildcard;
+  if (!wildcard) return exact;
+  const deny = [...wildcard.deny ?? [], ...exact.deny ?? []];
+  const merged = {
+    ...wildcard,
+    ...exact
+  };
+  if (deny.length > 0) merged.deny = [...new Set(deny)];
+  return merged;
+}
 var DefaultPermissionPolicy = class {
   policy = {};
   loaded = false;
@@ -33720,6 +34086,7 @@ var DefaultPermissionPolicy = class {
   yoloBlockedAsDestructive(tool, input, ctx) {
     if (!this.yolo || this.yoloDestructive) return false;
     if (this.hasAgentStateWriteTarget(tool, input, ctx)) return true;
+    if (attachesWellKnownCredential(input)) return true;
     const isShellSurface = tool.name === "bash" || tool.name === "exec" || (tool.capabilities ?? []).includes("shell.arbitrary");
     if (!isShellSurface) return false;
     const command = getInputString(input, "command") ?? shellCommandLineFromInput(input);
@@ -33813,8 +34180,8 @@ var DefaultPermissionPolicy = class {
       };
     }
     const namespaceEntry = this.findNamespaceEntry(tool.name);
-    const entry = this.policy[tool.name] ?? namespaceEntry;
-    const subject = subjectForToolInput(tool.name, input, tool.subjectKey);
+    const entry = mergeTrustEntries(this.policy[tool.name], namespaceEntry);
+    const subject = subjectForToolInput(tool.name, input, tool.subjectKey, tool.subjectFields);
     const cacheKey = `${tool.name}::${subject ?? tool.name}`;
     const evalKey = `${cacheKey}::${permissionFingerprint(tool)}`;
     if (tool.name !== "write" && !this.hasAgentStateWriteTarget(tool, input, ctx)) {
@@ -33831,15 +34198,6 @@ var DefaultPermissionPolicy = class {
       this._evalCache.set(evalKey, decision);
       return decision;
     }
-    if (this.sessionAllowed.has(cacheKey)) {
-      this.sessionAllowed.delete(cacheKey);
-      const decision = {
-        permission: "auto",
-        source: "trust",
-        reason: "session one-shot allow (user pressed yes)"
-      };
-      return decision;
-    }
     if (entry?.deny && subject && matchesTrust(entry.deny, subject)) {
       this._logDeny(tool.name, subject, "matched deny pattern");
       const decision = {
@@ -33850,6 +34208,15 @@ var DefaultPermissionPolicy = class {
       this._evalCache.set(evalKey, decision);
       return decision;
     }
+    if (this.sessionAllowed.has(cacheKey)) {
+      this.sessionAllowed.delete(cacheKey);
+      const decision = {
+        permission: "auto",
+        source: "trust",
+        reason: "session one-shot allow (user pressed yes)"
+      };
+      return decision;
+    }
     if (tool.permission === "deny") {
       this._logDeny(tool.name, subject, "tool default deny");
       const decision = {
@@ -33860,6 +34227,7 @@ var DefaultPermissionPolicy = class {
       this._evalCache.set(evalKey, decision);
       return decision;
     }
+    const denyUnevaluated = Boolean(entry?.deny?.length) && subject === void 0;
     const allowMatches = hasShellSubject(tool) ? matchesCommandTrust : matchesTrust;
     if (entry?.allow && subject && allowMatches(entry.allow, subject)) {
       const decision = {
@@ -33870,7 +34238,7 @@ var DefaultPermissionPolicy = class {
       this._evalCache.set(evalKey, decision);
       return decision;
     }
-    if (entry?.auto) {
+    if (entry?.auto && !denyUnevaluated) {
       const decision = { permission: "auto", source: "trust" };
       this._evalCache.set(evalKey, decision);
       return decision;
@@ -33970,19 +34338,10 @@ var DefaultPermissionPolicy = class {
     }
     return { permission: "confirm", source: "default" };
   }
+  // Delegates to the shared helper so the subagent policy applies the exact
+  // same rule — see `isSensitiveReadCall` in ./permission-helpers.ts.
   isSensitiveReadCall(tool, input) {
-    const isReadTool = hasCapability(tool, ToolCapabilities.FS_READ) || tool.name === "read" || tool.name === "grep" || tool.name === "glob" || tool.name === "tree";
-    if (isReadTool && inputPathLooksSensitive(input)) return true;
-    const hasShellCap = hasCapability(tool, [
-      ToolCapabilities.SHELL_ARBITRARY,
-      ToolCapabilities.SHELL_RESTRICTED,
-      ToolCapabilities.SHELL_EXEC
-    ]);
-    if (!hasShellCap && tool.name !== "bash" && tool.name !== "shell" && tool.name !== "exec") {
-      return false;
-    }
-    const command = shellCommandLineFromInput(input);
-    return command ? shellCommandReadsSensitivePath(command) : false;
+    return isSensitiveReadCall(tool, input);
   }
   async trust(rule) {
     if (!this.loaded) await this.reload();
@@ -34106,7 +34465,7 @@ function walk2(node, vault, transform) {
   }
   return out;
 }
-var SECRET_KEY_PATTERN = /(?:apikey|api_key|authtoken|auth_token|bearer|secret|password|passwd|pwd|refreshtoken|refresh_token|sessionkey|session_key|access[_-]?token|private[_-]?key|token\b)/i;
+var SECRET_KEY_PATTERN = /(?:api[-_]?key|auth[-_]?token|authorization|proxy-authorization|cookie|bearer|secret|password|passwd|pwd|refresh[-_]?token|session[-_]?key|access[_-]?token|private[_-]?key|token\b)/i;
 var NON_SECRET_OVERRIDES = /* @__PURE__ */ new Set(["publickey", "public_key"]);
 function isSecretField(name) {
   const lc = name.toLowerCase();
@@ -34215,6 +34574,14 @@ function keyFileNeedsHardening(keyFile, opts) {
   }
   return false;
 }
+function mkdirSecretDirSync(dir) {
+  fs14.mkdirSync(dir, { recursive: true, mode: 448 });
+  if (process.platform === "win32") return;
+  try {
+    fs14.chmodSync(dir, 448);
+  } catch {
+  }
+}
 function writeKeyFileAtomicSync(keyFile, content) {
   const tmp = `${keyFile}.${randomBytes3(4).toString("hex")}.tmp`;
   const fd = fs14.openSync(tmp, "w", 384);
@@ -34362,7 +34729,7 @@ var DefaultSecretVault = class {
     const oldVersion = this._keyVersion;
     const newKey = randomBytes3(KEY_BYTES);
     const newVersion = oldVersion + 1;
-    fs14.mkdirSync(path42.dirname(this.keyFile), { recursive: true });
+    mkdirSecretDirSync(path42.dirname(this.keyFile));
     const passphrase = getVaultPassphrase();
     if (passphrase) {
       writeKeyFileAtomicSync(this.keyFile, wrapDataKey(newKey, newVersion, passphrase));
@@ -34446,7 +34813,7 @@ var DefaultSecretVault = class {
     } catch (err) {
       if (err.code !== "ENOENT") throw err;
     }
-    fs14.mkdirSync(path42.dirname(this.keyFile), { recursive: true });
+    mkdirSecretDirSync(path42.dirname(this.keyFile));
     const key = randomBytes3(KEY_BYTES);
     const passphrase = getVaultPassphrase();
     const initialBytes = passphrase ? wrapDataKey(key, 1, passphrase) : key;
@@ -35148,6 +35515,17 @@ var IN_PROJECT_DENIED_PATHS = [
     // See discover-mailbox-bridge.ts:findWorkspaceCliEntry.
     path: "features.mailboxBridge",
     reason: "Enables the mailbox bridge, whose CLI-entry resolution walks up from the project root \u2014 a repo-supplied packages/cli/dist/index.js would be spawned on WebUI boot."
+  },
+  {
+    // `plugins` is already denied above, so a repo cannot ADD a plugin. This
+    // closes the other half: a repo could previously ship
+    // `{"features":{"pluginsTrust":false}}` and switch off the integrity gate
+    // for plugins the user had ALREADY installed globally — disarming the
+    // trust-on-first-use pin that exists to catch a supply-chain update
+    // rewriting a plugin's entry file. Same operator-owned class as the
+    // switches above.
+    path: "features.pluginsTrust",
+    reason: "Disables the plugin trust-on-first-use integrity gate, re-trusting changed code in already-installed global plugins."
   }
 ];
 function deleteNestedPath(target, path47) {