@wrongstack/core 0.309.0 → 0.309.1

package/dist/index.js

@@ -2513,7 +2513,7 @@ function walk(node, vault, transform) {
   }
   return out;
 }
-var SECRET_KEY_PATTERN = /(?:apikey|api_key|authtoken|auth_token|bearer|secret|password|passwd|pwd|refreshtoken|refresh_token|sessionkey|session_key|access[_-]?token|private[_-]?key|token\b)/i;
+var SECRET_KEY_PATTERN = /(?:api[-_]?key|auth[-_]?token|authorization|proxy-authorization|cookie|bearer|secret|password|passwd|pwd|refresh[-_]?token|session[-_]?key|access[_-]?token|private[_-]?key|token\b)/i;
 var NON_SECRET_OVERRIDES = /* @__PURE__ */ new Set(["publickey", "public_key"]);
 function isSecretField(name) {
   const lc = name.toLowerCase();
@@ -2684,6 +2684,14 @@ function keyFileNeedsHardening(keyFile, opts) {
   }
   return false;
 }
+function mkdirSecretDirSync(dir) {
+  fs2.mkdirSync(dir, { recursive: true, mode: 448 });
+  if (process.platform === "win32") return;
+  try {
+    fs2.chmodSync(dir, 448);
+  } catch {
+  }
+}
 function writeKeyFileAtomicSync(keyFile, content) {
   const tmp = `${keyFile}.${randomBytes(4).toString("hex")}.tmp`;
   const fd = fs2.openSync(tmp, "w", 384);
@@ -2831,7 +2839,7 @@ var DefaultSecretVault = class {
     const oldVersion = this._keyVersion;
     const newKey = randomBytes(KEY_BYTES);
     const newVersion = oldVersion + 1;
-    fs2.mkdirSync(path3.dirname(this.keyFile), { recursive: true });
+    mkdirSecretDirSync(path3.dirname(this.keyFile));
     const passphrase = getVaultPassphrase();
     if (passphrase) {
       writeKeyFileAtomicSync(this.keyFile, wrapDataKey(newKey, newVersion, passphrase));
@@ -2915,7 +2923,7 @@ var DefaultSecretVault = class {
     } catch (err) {
       if (err.code !== "ENOENT") throw err;
     }
-    fs2.mkdirSync(path3.dirname(this.keyFile), { recursive: true });
+    mkdirSecretDirSync(path3.dirname(this.keyFile));
     const key = randomBytes(KEY_BYTES);
     const passphrase = getVaultPassphrase();
     const initialBytes = passphrase ? wrapDataKey(key, 1, passphrase) : key;
@@ -4069,6 +4077,17 @@ var IN_PROJECT_DENIED_PATHS = [
     // See discover-mailbox-bridge.ts:findWorkspaceCliEntry.
     path: "features.mailboxBridge",
     reason: "Enables the mailbox bridge, whose CLI-entry resolution walks up from the project root \u2014 a repo-supplied packages/cli/dist/index.js would be spawned on WebUI boot."
+  },
+  {
+    // `plugins` is already denied above, so a repo cannot ADD a plugin. This
+    // closes the other half: a repo could previously ship
+    // `{"features":{"pluginsTrust":false}}` and switch off the integrity gate
+    // for plugins the user had ALREADY installed globally — disarming the
+    // trust-on-first-use pin that exists to catch a supply-chain update
+    // rewriting a plugin's entry file. Same operator-owned class as the
+    // switches above.
+    path: "features.pluginsTrust",
+    reason: "Disables the plugin trust-on-first-use integrity gate, re-trusting changed code in already-installed global plugins."
   }
 ];
 function deleteNestedPath(target, path131) {
@@ -14860,6 +14879,42 @@ function formatTaskList(tasks) {
   return lines.join("\n");
 }
 
+// src/utils/terminal-sanitize.ts
+var ANSI_RE = /\x1b\[[0-?]*[ -/]*[@-~]/g;
+var ANSI_OSC_RE = /\x1b\][\s\S]*?(?:\x07|\x1b\\)/g;
+var ANSI_CONTROL_STRING_RE = /\x1b[P^_X][\s\S]*?\x1b\\/g;
+var ANSI_ESCAPE_RE = /\x1b[ -/]*[@-~]/g;
+var BIDI_AND_ZERO_WIDTH_RE = /[​-‏‪-‮⁦-⁩]/g;
+function sanitizeTerminalText(value, tabWidth = 2) {
+  const tab = " ".repeat(Math.max(1, Math.min(8, Math.floor(tabWidth))));
+  const withoutEscapes = value.replace(ANSI_OSC_RE, "").replace(ANSI_CONTROL_STRING_RE, "").replace(ANSI_RE, "").replace(ANSI_ESCAPE_RE, "").replace(BIDI_AND_ZERO_WIDTH_RE, "").replace(/\t/g, tab).replace(/\r/g, "");
+  let safe = "";
+  for (const char of withoutEscapes) {
+    const code = char.codePointAt(0) ?? 0;
+    if (char === "\n" || code >= 32 && code !== 127 && !(code >= 128 && code <= 159)) {
+      safe += char;
+    }
+  }
+  return safe;
+}
+function sanitizeTerminalPreview(value, opts = {}) {
+  const maxLines = opts.maxLines ?? 40;
+  const maxChars = opts.maxChars ?? 8e3;
+  const safe = sanitizeTerminalText(value, opts.tabWidth);
+  let truncated = false;
+  let clipped = safe;
+  if (clipped.length > maxChars) {
+    clipped = clipped.slice(0, maxChars);
+    truncated = true;
+  }
+  const lines = clipped.split("\n");
+  if (lines.length > maxLines) {
+    clipped = lines.slice(0, maxLines).join("\n");
+    truncated = true;
+  }
+  return { text: clipped, truncated };
+}
+
 // src/utils/tool-description-mode.ts
 var DEFAULT_TOOL_DESCRIPTION_MODE = "extend";
 var ORIGINAL_TOOL_DESCRIPTION = /* @__PURE__ */ Symbol.for("wrongstack.tool.originalDescription");
@@ -15763,9 +15818,21 @@ function renderCommandLine(command, args) {
   });
   return [command, ...rendered].join(" ");
 }
-function subjectForToolInput(toolName, input, subjectKey) {
+function renderSubjectFields(obj, fields) {
+  const parts = [];
+  for (const field of fields) {
+    const value = obj[field];
+    if (value === void 0 || value === null || value === "" || value === false) continue;
+    const str = String(value);
+    parts.push(`${field}=${/\s/.test(str) ? `"${str.replace(/"/g, '\\"')}"` : str}`);
+  }
+  return parts.join(" ");
+}
+function subjectForToolInput(toolName, input, subjectKey, subjectFields) {
   if (!input || typeof input !== "object") return void 0;
   const obj = input;
+  const extra = subjectFields && subjectFields.length > 0 ? renderSubjectFields(obj, subjectFields) : "";
+  const withExtra = (base) => extra ? `${base} ${extra}` : base;
   if (subjectKey) {
     const value = obj[subjectKey];
     if (Array.isArray(value)) {
@@ -15781,9 +15848,9 @@ function subjectForToolInput(toolName, input, subjectKey) {
       if (subjectKey === "command") {
         const rendered = renderCommandLine(value, obj["args"]);
         if (value === "commit" && obj["dry_run"] === true) {
-          return `${escapeGlobSubject(rendered)}:dry-run`;
+          return `${escapeGlobSubject(withExtra(rendered))}:dry-run`;
         }
-        return escapeGlobSubject(rendered);
+        return escapeGlobSubject(withExtra(rendered));
       }
       if (subjectKey === "directory" && obj["dry_run"] === true) {
         return `${escapeGlobSubject(value)}:dry-run`;
@@ -15813,7 +15880,7 @@ function subjectForToolInput(toolName, input, subjectKey) {
 }
 
 // src/utils/win32-cmd.ts
-var WIN32_CMD_META = /[&|<>"\r\n\0]/;
+var WIN32_CMD_META = /[&|<>"%\r\n\0]/;
 function buildWin32CmdShimInvocation(command, args = []) {
   assertSafeWin32CmdArgs([command, ...args]);
   const line = ["call", quoteWin32CmdArg(command), ...args.map(quoteWin32CmdArg)].join(" ");
@@ -27976,6 +28043,14 @@ var PATTERNS = [
     anchor: "sk-ant-"
   },
   { type: "openai_key", regex: /(?<![A-Za-z0-9])sk-(?:proj-)?[A-Za-z0-9_-]{20,}(?![A-Za-z0-9])/g, anchor: "sk-" },
+  {
+    // `xai` is a first-class provider in this codebase, but its key shape was
+    // absent here — so the one credential format WrongStack itself hands users
+    // was the one the scrubber could not recognize (audit 2026-08-20).
+    type: "xai_key",
+    regex: /(?<![A-Za-z0-9])xai-[A-Za-z0-9]{20,}(?![A-Za-z0-9])/g,
+    anchor: "xai-"
+  },
   { type: "github_pat", regex: /(?<![A-Za-z0-9])ghp_[A-Za-z0-9]{36,}(?![A-Za-z0-9])/g, anchor: "ghp_" },
   { type: "github_pat_v2", regex: /(?<![A-Za-z0-9])github_pat_[A-Za-z0-9_]{50,}(?![A-Za-z0-9])/g, anchor: "github_pat_" },
   { type: "aws_access_key", regex: /(?<![A-Za-z0-9])AKIA[0-9A-Z]{16}(?![A-Za-z0-9])/g, anchor: "AKIA" },
@@ -28066,8 +28141,8 @@ var PATTERNS = [
     // replacement so the separator between adjacent secrets is preserved
     // rather than collapsed. Capture groups are therefore: 1=leading
     // delimiter, 2=key name, 3=value.
-    regex: /(^|\s)([A-Z_]{4,}(?:KEY|TOKEN|SECRET|PASSWORD|PWD))\s*[:=]\s*['"]?([A-Za-z0-9_/+=-]{20,512})['"]?(?=\s|$)/g,
-    anchor: ["KEY", "TOKEN", "SECRET", "PASSWORD", "PWD"]
+    regex: /(^|\s)([A-Z_]{4,}(?:KEY|TOKEN|SECRET|PASSWORD|PWD|PASSPHRASE))\s*[:=]\s*['"]?([A-Za-z0-9_/+=-]{20,512})['"]?(?=\s|$)/g,
+    anchor: ["KEY", "TOKEN", "SECRET", "PASSWORD", "PWD", "PASSPHRASE"]
   },
   {
     type: "json_credential_key",
@@ -28184,6 +28259,27 @@ var JSON_CREDENTIAL_REGEX = PATTERNS.find((p) => p.type === "json_credential_key
 var COMBINED_REPLACEMENTS = SIMPLE_PATTERNS.map((p) => `[REDACTED:${p.type}]`);
 var SCRUB_CHUNK_BYTES = 64 * 1024;
 var SCRUB_OVERLAP_BYTES = 1024;
+var PEM_PRIVATE_KEY_BEGIN_RE = /-----BEGIN (?:RSA|EC|OPENSSH|DSA|PGP)? ?PRIVATE KEY-----/;
+var PEM_END_MARKER = "-----END";
+var MAX_PEM_BLOCK_BYTES = 64 * 1024;
+var PEM_END_LINE_TOLERANCE = 64;
+function extendChunkBoundaryPastPem(text2, chunkStart, proposedEnd) {
+  const head = text2.slice(chunkStart, proposedEnd);
+  const lastBegin = head.lastIndexOf("-----BEGIN ");
+  if (lastBegin === -1) return proposedEnd;
+  const fromBegin = text2.slice(chunkStart + lastBegin);
+  const marker = PEM_PRIVATE_KEY_BEGIN_RE.exec(fromBegin);
+  if (!marker || marker.index !== 0) return proposedEnd;
+  const bodyStart = marker[0].length;
+  const cap = Math.min(text2.length, chunkStart + lastBegin + MAX_PEM_BLOCK_BYTES);
+  const closeIdx = fromBegin.indexOf(PEM_END_MARKER, bodyStart);
+  if (closeIdx === -1 || chunkStart + lastBegin + closeIdx >= cap + PEM_END_LINE_TOLERANCE) {
+    return proposedEnd;
+  }
+  const lineEnd = fromBegin.indexOf("\n", closeIdx);
+  const end = lineEnd === -1 ? text2.length : chunkStart + lastBegin + lineEnd + 1;
+  return Math.max(proposedEnd, end);
+}
 var PATTERN_ANCHORS = [
   ...new Set(
     PATTERNS.flatMap(
@@ -28220,6 +28316,7 @@ var DefaultSecretScrubber = class {
           }
         }
         end = safe === -1 ? end : safe + 1;
+        end = extendChunkBoundaryPastPem(text2, i, end);
       }
       out.push(this.scrubOne(text2.slice(i, end)));
       i = end;
@@ -32326,24 +32423,29 @@ var TOKEN_PATTERNS = [
     kind: "return-null",
     // `return <expr>;` where expr is not already null/undefined/void.
     regex: /(?<indent>\breturn\b)(?<expr>\s+[^;{}\n]+?)\s*;/g,
-    replace: () => "return null;"
+    replace: () => "return null;",
+    endpointsInCode: true
   }
 ];
 function planMutations(file, source, opts = {}) {
   const maxPerFile = opts.maxPerFile ?? 25;
   const out = [];
   const lines = source.split("\n");
+  const masks = computeLineMasks(source);
   for (let lineIdx = 0; lineIdx < lines.length; lineIdx++) {
     const line = lines[lineIdx];
     const t2 = line.trim();
-    if (t2.startsWith("//") || t2.startsWith("*") || t2.startsWith("/*")) continue;
+    if (t2.startsWith("//")) continue;
+    const codeRanges = masks[lineIdx];
+    const inCode = (start) => codeRanges.some(([s, e]) => start >= s && start < e);
     for (const pattern of TOKEN_PATTERNS) {
       pattern.regex.lastIndex = 0;
       let m;
       while ((m = pattern.regex.exec(line)) !== null) {
         const token = m.groups?.["op"] ?? m[0];
         const tokenStart = m.index + m[0].indexOf(token);
-        if (isMasked(line, tokenStart, token.length)) continue;
+        if (!inCode(tokenStart)) continue;
+        if (pattern.endpointsInCode && !inCode(tokenStart + token.length - 1)) continue;
         const original = line.slice(tokenStart, tokenStart + token.length);
         const replacement = pattern.replace(token);
         if (replacement === original) continue;
@@ -32362,19 +32464,179 @@ function planMutations(file, source, opts = {}) {
   }
   return out.slice(0, maxPerFile);
 }
-function isMasked(line, start, len) {
-  let inSingle = false;
-  let inDouble = false;
-  for (let i = 0; i < start; i++) {
-    const c = line[i];
-    const prev = i > 0 ? line[i - 1] : void 0;
-    if (c === "'" && prev !== "\\") inSingle = !inSingle;
-    else if (c === '"' && prev !== "\\") inDouble = !inDouble;
-    if (!inSingle && !inDouble && c === "/" && prev === "/") return true;
+function computeLineMasks(source) {
+  const lines = source.split("\n");
+  const masks = lines.map(() => []);
+  const stack = [{ kind: "code", depth: 0, parens: [] }];
+  let inBlockComment = false;
+  let lastToken = null;
+  for (let lineIdx = 0; lineIdx < lines.length; lineIdx++) {
+    const line = lines[lineIdx];
+    const ranges = masks[lineIdx];
+    let runStart = null;
+    const closeRun = (end) => {
+      if (runStart !== null && end > runStart) ranges.push([runStart, end]);
+      runStart = null;
+    };
+    let i = 0;
+    if (inBlockComment) {
+      const close = line.indexOf("*/");
+      if (close === -1) continue;
+      inBlockComment = false;
+      i = close + 2;
+    }
+    while (i < line.length) {
+      const top = stack[stack.length - 1];
+      const c = line[i];
+      if (top.kind === "template") {
+        if (c === "\\") {
+          i += 2;
+          continue;
+        }
+        if (c === "`") {
+          stack.pop();
+          lastToken = "`";
+          i++;
+          continue;
+        }
+        if (c === "$" && line[i + 1] === "{") {
+          stack.push({ kind: "code", depth: 0, parens: [] });
+          lastToken = "${";
+          i += 2;
+          continue;
+        }
+        i++;
+        continue;
+      }
+      if (/[\w$]/.test(c)) {
+        let j = i + 1;
+        while (j < line.length && /[\w$]/.test(line[j])) j++;
+        lastToken = line.slice(i, j);
+        if (runStart === null) runStart = i;
+        i = j;
+        continue;
+      }
+      if (c === "'" || c === '"') {
+        closeRun(i);
+        i++;
+        while (i < line.length && line[i] !== c) {
+          if (line[i] === "\\") i++;
+          i++;
+        }
+        i++;
+        lastToken = c;
+        continue;
+      }
+      if (c === "`") {
+        closeRun(i);
+        stack.push({ kind: "template", depth: 0, parens: [] });
+        i++;
+        continue;
+      }
+      if (c === "/" && line[i + 1] === "/") {
+        closeRun(i);
+        break;
+      }
+      if (c === "/" && line[i + 1] === "*") {
+        closeRun(i);
+        const close = line.indexOf("*/", i + 2);
+        if (close === -1) {
+          inBlockComment = true;
+          break;
+        }
+        i = close + 2;
+        continue;
+      }
+      if (c === "/") {
+        if (!tokenCanEndOperand(lastToken)) {
+          closeRun(i);
+          const next = skipRegexLiteral(line, i);
+          lastToken = next > i + 1 ? "regex" : "/";
+          i = next;
+          continue;
+        }
+      }
+      if (c === "(") {
+        top.parens.push(CONTROL_KEYWORDS.has(lastToken ?? "") ? "control" : "expr");
+        lastToken = c;
+      } else if (c === ")") {
+        const kind = top.parens.pop() ?? "expr";
+        lastToken = kind === "control" ? "control-paren-close" : ")";
+      } else if (c === "{") {
+        top.depth++;
+        lastToken = c;
+      } else if (c === "}") {
+        if (top.depth > 0) {
+          top.depth--;
+          lastToken = c;
+        } else if (stack.length > 1) {
+          closeRun(i);
+          stack.pop();
+          i++;
+          continue;
+        } else {
+          lastToken = c;
+        }
+      } else if (c !== " " && c !== "	" && c !== "\r") {
+        lastToken = c;
+      }
+      if (runStart === null) runStart = i;
+      i++;
+    }
+    closeRun(line.length);
+  }
+  return masks;
+}
+var KEYWORDS_BEFORE_REGEX = /* @__PURE__ */ new Set([
+  "return",
+  "typeof",
+  "instanceof",
+  "in",
+  "of",
+  "new",
+  "delete",
+  "void",
+  "throw",
+  "case",
+  "do",
+  "else",
+  "yield",
+  "await"
+]);
+var CONTROL_KEYWORDS = /* @__PURE__ */ new Set(["if", "for", "while", "switch", "catch", "with", "await"]);
+function tokenCanEndOperand(token) {
+  if (token === null) return false;
+  if (/^[\w$]+$/.test(token)) return !KEYWORDS_BEFORE_REGEX.has(token);
+  return token === ")" || token === "]" || token === "." || token === '"' || token === "'" || token === "`";
+}
+function skipRegexLiteral(line, start) {
+  let i = start + 1;
+  let inClass = false;
+  while (i < line.length) {
+    const ch = line[i];
+    if (ch === "\\") {
+      i += 2;
+      continue;
+    }
+    if (inClass) {
+      if (ch === "]") inClass = false;
+      i++;
+      continue;
+    }
+    if (ch === "[") {
+      inClass = true;
+      i++;
+      continue;
+    }
+    if (ch === "/") {
+      i++;
+      break;
+    }
+    if (ch === "\n" || ch === "\r") return line.length;
+    i++;
   }
-  if (inSingle || inDouble) return true;
-  const window = line.slice(start, start + len);
-  return /['"]/.test(window);
+  while (i < line.length && /[a-z]/.test(line[i])) i++;
+  return i;
 }
 function parseMutationReport(text2) {
   const candidates = [];
@@ -32425,7 +32687,7 @@ function normalizeMutantEntry(value) {
   const rec = value;
   const id = typeof rec["id"] === "string" ? rec["id"] : void 0;
   const status = rec["status"];
-  if (!id || status !== "killed" && status !== "survived" && status !== "skipped") {
+  if (!id || status !== "killed" && status !== "survived" && status !== "skipped" && status !== "killed-by-hang") {
     return void 0;
   }
   return {
@@ -32481,7 +32743,7 @@ function makeMutationTestTool(director, roster, opts = {}) {
         },
         chaosWorktree: {
           anyOf: [{ type: "boolean" }, { type: "string", enum: ["auto", "required", "off"] }],
-          description: "Worktree override for the chaos agent. Use 'off' when targets are uncommitted \u2014 a worktree from HEAD would not contain them."
+          description: "Worktree override for the chaos agent. Defaults to the roster policy for chaos-monkey ('off'), because mutation targets are usually freshly written and uncommitted \u2014 a worktree from HEAD would not contain them and every mutant would drift to skipped. Only pass 'auto' or 'required' when the targets are committed."
         },
         timeoutMs: { type: "number", minimum: 1, description: "Per-task timeout for chaos/strengthen/rerun tasks." },
         reportOnly: {
@@ -32503,8 +32765,16 @@ function makeMutationTestTool(director, roster, opts = {}) {
           error: "No mutable sites found in the given targets (after comment/string filtering)."
         };
       }
+      const chaosBase = roster?.[CHAOS_ROLE];
+      if (!chaosBase) {
+        return {
+          verdict: "inconclusive",
+          passed: false,
+          error: "chaos-monkey role missing from the roster \u2014 refusing to spawn a saboteur without its prompt/tools contract. Build the toolset with a roster that includes 'chaos-monkey' (FLEET_ROSTER does)."
+        };
+      }
       const chaosSubagentId = await director.spawn(
-        makeChaosConfig(roster, i.chaosWorktree ?? "off")
+        makeChaosConfig(chaosBase, i.chaosWorktree ?? chaosBase.worktree ?? "off")
       );
       const chaosTaskId = await director.assign({
         id: randomUUID14(),
@@ -32522,6 +32792,7 @@ function makeMutationTestTool(director, roster, opts = {}) {
       );
       const attempts = [];
       let current = survivors;
+      let rerunUnknowns = [];
       while (current.length > 0 && attempts.length < maxAttempts && i.repairSubagentId) {
         const attemptNo = attempts.length + 1;
         const strengthenTaskId = await director.assign({
@@ -32543,7 +32814,7 @@ function makeMutationTestTool(director, roster, opts = {}) {
         }
         const survivorPlan = plan.filter((p) => current.some((s) => s.id === p.id));
         const rerunSubagentId = await director.spawn(
-          makeChaosConfig(roster, i.chaosWorktree ?? "off")
+          makeChaosConfig(chaosBase, i.chaosWorktree ?? chaosBase.worktree ?? "off")
         );
         const rerunTaskId = await director.assign({
           id: randomUUID14(),
@@ -32553,29 +32824,36 @@ function makeMutationTestTool(director, roster, opts = {}) {
         });
         const [rerunResult] = await director.awaitTasks([rerunTaskId]);
         const passN = collectOutcomes(rerunResult, survivorPlan);
-        const stillSurviving = passN.filter((m) => m.status === "survived" || m.status === "skipped");
+        const stillSurviving = passN.filter((m) => !isKill(m.status));
+        rerunUnknowns = passN.filter((m) => m.status === "skipped");
         attempts.push({
           attempt: attemptNo,
           survivorsBefore: current,
           strengthenResult: { taskId: strengthenResult.taskId, status: strengthenResult.status },
           rerunResult: { taskId: rerunTaskId, status: rerunResult?.status ?? "unknown" },
           survivorsAfter: stillSurviving,
-          suspectedEquivalent: stillSurviving.filter((m) => current.some((c) => c.id === m.id)).map((m) => m.id)
+          suspectedEquivalent: stillSurviving.filter((m) => m.status === "survived" && current.some((c) => c.id === m.id)).map((m) => m.id)
         });
-        current = stillSurviving.filter((m) => m.status === "survived");
-        if (passN.every((m) => m.status === "skipped")) break;
+        current = stillSurviving;
       }
-      const finalSurvivors = current;
+      const finalSurvivors = current.filter((m) => m.status === "survived");
       const verifiedCount = pass1.filter((m) => m.status !== "skipped").length;
       const skippedCount = pass1.filter((m) => m.status === "skipped").length;
-      const score = plan.length === 0 ? 0 : pass1.filter((m) => m.status === "killed").length / plan.length;
-      const verdict = verifiedCount === 0 ? "inconclusive" : finalSurvivors.length === 0 ? skippedCount > 0 ? "partial" : "pass" : score >= 0.8 ? "partial" : "fail";
+      const rerunUnknownCount = rerunUnknowns.length;
+      const score = plan.length === 0 ? 0 : pass1.filter((m) => isKill(m.status)).length / plan.length;
+      const verdict = verifiedCount === 0 ? "inconclusive" : finalSurvivors.length === 0 ? skippedCount > 0 || rerunUnknownCount > 0 ? "partial" : "pass" : score >= 0.8 ? "partial" : "fail";
       return {
         verdict,
         passed: verdict === "pass",
         mutationScore: Number.parseFloat(score.toFixed(3)),
         planned: plan.length,
-        killed: pass1.filter((m) => m.status === "killed").length,
+        killed: pass1.filter((m) => isKill(m.status)).length,
+        // Breakout of `killed`: how many kills were detected by the test
+        // command hanging rather than by a failing assertion. A subset of
+        // `killed`, surfaced so a director can distinguish a hang-heavy
+        // suite (mutants breaking termination, not assertions) from an
+        // assertion-strong one. hangHeavy = killedByHang === killed.
+        killedByHang: pass1.filter((m) => m.status === "killed-by-hang").length,
         survived: pass1.filter((m) => m.status === "survived").length,
         skipped: pass1.filter((m) => m.status === "skipped").length,
         finalSurvivors: finalSurvivors.map((m) => ({ id: m.id, file: m.file, kind: m.kind })),
@@ -32583,7 +32861,11 @@ function makeMutationTestTool(director, roster, opts = {}) {
         strengthenAttempts: attempts.length,
         attempts,
         chaosTaskId,
-        nextAction: finalSurvivors.length === 0 ? "accept" : attempts.length >= maxAttempts && i.repairSubagentId ? "manual_review_survivors" : "strengthen_tests"
+        // Unverified leftovers from the strengthen loop: surfaced so the
+        // caller can see WHICH mutants lack kill evidence, and counted by
+        // the verdict gate above.
+        unverifiedFromRerun: rerunUnknowns.map((m) => ({ id: m.id, file: m.file, kind: m.kind })),
+        nextAction: finalSurvivors.length === 0 && rerunUnknownCount === 0 && skippedCount === 0 ? "accept" : attempts.length >= maxAttempts && i.repairSubagentId ? "manual_review_survivors" : "strengthen_tests"
       };
     }
   };
@@ -32599,7 +32881,7 @@ function normalizeMutationTestInput(input) {
     maxPerFile: typeof raw["maxPerFile"] === "number" ? raw["maxPerFile"] : void 0,
     maxStrengthenAttempts: typeof raw["maxStrengthenAttempts"] === "number" ? raw["maxStrengthenAttempts"] : void 0,
     repairSubagentId: typeof raw["repairSubagentId"] === "string" && raw["repairSubagentId"].trim() ? raw["repairSubagentId"].trim() : void 0,
-    chaosWorktree: raw["chaosWorktree"] ?? void 0,
+    chaosWorktree: normalizeWorktreeOverride(raw["chaosWorktree"]),
     timeoutMs: typeof raw["timeoutMs"] === "number" ? raw["timeoutMs"] : void 0,
     reportOnly: raw["reportOnly"] === true
   };
@@ -32621,8 +32903,7 @@ function buildPlan(i, projectRoot) {
   }
   return plan;
 }
-function makeChaosConfig(roster, worktree) {
-  const base = roster?.[CHAOS_ROLE] ?? getAgentDefinition(CHAOS_ROLE)?.config ?? { name: "Chaos Monkey", role: CHAOS_ROLE };
+function makeChaosConfig(base, worktree) {
   return { ...instantiateRosterConfig(CHAOS_ROLE, base), worktree };
 }
 function buildChaosTask(plan, i, pass, priorSurvivors) {
@@ -32638,7 +32919,7 @@ ${priorSurvivors.map((s) => `- ${s.id} (${s.kind} @ ${s.file}:${s.line})`).join(
     "For each mutant, in order:",
     "1. Apply ONLY that mutation at its exact (file, line, column).",
     `2. Run the test command: ${i.testCommand}${i.cwd ? ` (cwd: ${i.cwd})` : ""}`,
-    "3. Record killed (tests failed \u2014 quote first failing assertion) or survived (suite green).",
+    "3. Record killed (tests failed \u2014 quote first failing assertion), survived (suite green), or killed-by-hang (the test command timed out or was aborted \u2014 the mutation broke the suite by non-termination; record the timeout as evidence, do NOT report it as survived).",
     "4. Restore the file byte-for-byte before the next mutant.",
     "",
     "Mutants:",
@@ -32650,23 +32931,49 @@ ${priorSurvivors.map((s) => `- ${s.id} (${s.kind} @ ${s.file}:${s.line})`).join(
   ].join("\n");
 }
 function buildStrengthenTask(survivors, i, attempt) {
+  const confirmed = survivors.filter((s) => s.status === "survived");
+  const unverified = survivors.filter((s) => s.status === "skipped");
+  const row = (s) => `- ${s.id} | ${s.file}:${s.line} | ${s.kind}${s.evidence ? ` | ${s.evidence}` : ""}`;
   return [
-    `Strengthen the tests so these SURVIVING mutants die (attempt ${attempt}).`,
-    "",
-    "Each survivor below was a deliberate sabotage of production code that the current suite did NOT catch:",
-    ...survivors.map((s) => `- ${s.id} | ${s.file}:${s.line} | ${s.kind}${s.evidence ? ` | ${s.evidence}` : ""}`),
+    `Strengthen the tests so the mutants below die (attempt ${attempt}).`,
     "",
-    `Test command that must fail under each mutant: ${i.testCommand}`,
+    ...confirmed.length > 0 ? [
+      "CONFIRMED SURVIVORS \u2014 each was a deliberate sabotage of production code that the current suite did NOT catch:",
+      ...confirmed.map(row),
+      ""
+    ] : [],
+    ...unverified.length > 0 ? [
+      "UNVERIFIED \u2014 these mutations were never actually re-tested (the re-verify pass skipped or did not report them). Do NOT assume the suite misses them: first apply each mutation, run the tests, and confirm it really survives; if the tests already fail, report that instead of writing new assertions.",
+      ...unverified.map(row),
+      ""
+    ] : [],
+    `Test command that must fail under each CONFIRMED mutant: ${i.testCommand}`,
     "",
-    "For each survivor add or tighten exactly one assertion that pins the sabotaged boundary/behavior. Do not change production code. Do not weaken other tests. Run the suite green on clean code before finishing."
+    "For each CONFIRMED survivor add or tighten exactly one assertion that pins the sabotaged boundary/behavior. Do not change production code. Do not weaken other tests. Run the suite green on clean code before finishing."
   ].join("\n");
 }
 function collectOutcomes(result, plan) {
   const fromText = parseTextOutcomes(result);
   if (fromText.length > 0) {
-    const planned = new Set(plan.map((p) => p.id));
-    const matched = fromText.filter((m) => planned.has(m.id));
-    if (matched.length > 0) return matched;
+    const remaining = [...plan];
+    const matched = [];
+    for (const m of fromText) {
+      const idx = remaining.findIndex((p) => p.id === m.id);
+      if (idx === -1) continue;
+      remaining.splice(idx, 1);
+      matched.push(m);
+    }
+    if (matched.length > 0) {
+      const missing = remaining.map((p) => ({
+        id: p.id,
+        file: p.file,
+        line: p.line,
+        kind: p.kind,
+        status: "skipped",
+        evidence: "not reported by chaos task"
+      }));
+      return [...matched, ...missing];
+    }
   }
   return plan.map((p) => ({
     id: p.id,
@@ -32677,6 +32984,9 @@ function collectOutcomes(result, plan) {
     evidence: result ? `chaos task ended ${result.status}` : "chaos task produced no result"
   }));
 }
+function isKill(status) {
+  return status === "killed" || status === "killed-by-hang";
+}
 function parseTextOutcomes(result) {
   const text2 = typeof result?.result === "string" ? result.result : void 0;
   if (!text2) return [];
@@ -39402,11 +39712,13 @@ var CHAOS_MONKEY_AGENT = {
   tools: [...TOOLS.build],
   skillNames: ["testing", "typescript-strict"],
   spawnBudgetExempt: true,
-  // Follow fleet worktree policy (NOT 'required'): mutation targets are
-  // often freshly written and uncommitted — a worktree spawned from HEAD
-  // would not contain them and every mutant would drift. Callers pass
-  // `worktree: 'off'` in the mutation_test input for uncommitted targets.
-  worktree: "auto",
+  // Run in the live checkout: mutation targets are usually freshly
+  // written and uncommitted — a worktree spawned from HEAD would not
+  // contain them and every mutant would drift. The mutation_test tool
+  // honors this value as its default; callers can still override per
+  // call via its `chaosWorktree` input when targets are committed and
+  // isolation is wanted.
+  worktree: "off",
   // Report travels via submit_result + final text, not the leader's stream.
   textStream: "silent",
   toolStream: "silent"
@@ -40665,6 +40977,7 @@ function worktreeOwnerLabel(task, config) {
 }
 
 // src/coordination/director.ts
+var BUSY_REARM_FLOOR_MS = 1e3;
 var Director = class _Director {
   /* eslint-disable-next-line @typescript-eslint/no-unused-vars — just a cast helper */
   static _asManifestEntry(v) {
@@ -40730,6 +41043,13 @@ var Director = class _Director {
   subagentIdleTimeoutMs;
   retireSubagentOnTaskComplete;
   subagentIdleTimers = /* @__PURE__ */ new Map();
+  /**
+   * Effective idle window per subagent (spawn-time `idleTimeoutMs` override
+   * or the Director-wide default; undefined = no window). Internal-task
+   * completion re-arms with THIS value, not the Director-wide default, so
+   * a subagent-configured window survives its first internal probe.
+   */
+  subagentIdleDelayMs = /* @__PURE__ */ new Map();
   sharedScratchpadPath;
   maxSpawns;
   maxSpawnDepth;
@@ -40886,7 +41206,13 @@ var Director = class _Director {
   handleTaskCompleted(payload) {
     const r = payload.result;
     const settled = this.tasks.settle(r);
-    if (settled.internal) return;
+    if (settled.internal) {
+      this.armSubagentIdleRetirement(
+        r.subagentId,
+        this.subagentIdleDelayMs.get(r.subagentId) ?? this.subagentIdleTimeoutMs
+      );
+      return;
+    }
     const title = this.tasks.descriptionFor(r.taskId, payload.task.description ?? r.taskId);
     if (!settled.consumedInBand && this.taskResultNotifier) {
       const resultText = typeof r.result === "string" ? r.result : r.result !== void 0 ? safeStringify(r.result) : void 0;
@@ -40951,7 +41277,7 @@ var Director = class _Director {
     }
     this.armSubagentIdleRetirement(
       r.subagentId,
-      this.retireSubagentOnTaskComplete ? 0 : this.subagentIdleTimeoutMs
+      this.retireSubagentOnTaskComplete ? 0 : this.subagentIdleDelayMs.get(r.subagentId) ?? this.subagentIdleTimeoutMs
     );
   }
   extensionsFor(subagentId) {
@@ -41037,6 +41363,7 @@ var Director = class _Director {
     this.resolveSpawnModel(config);
     const subagentId = await spawn6(this, config, priceLookup);
     const perSubagentIdleMs = typeof config.idleTimeoutMs === "number" && Number.isFinite(config.idleTimeoutMs) && config.idleTimeoutMs >= 0 ? config.idleTimeoutMs : this.subagentIdleTimeoutMs;
+    this.subagentIdleDelayMs.set(subagentId, perSubagentIdleMs);
     this.armSubagentIdleRetirement(subagentId, perSubagentIdleMs);
     return subagentId;
   }
@@ -41090,6 +41417,7 @@ var Director = class _Director {
     this.budgetPolicy.dispose();
     for (const timer of this.subagentIdleTimers.values()) clearTimeout(timer);
     this.subagentIdleTimers.clear();
+    this.subagentIdleDelayMs.clear();
     await this.coordinator.stopAll();
     this.tasks.resolveWaitersOnShutdown();
     for (const b of this.subagentBridges.values()) {
@@ -41148,6 +41476,7 @@ var Director = class _Director {
   }
   async remove(subagentId) {
     this.clearSubagentIdleRetirement(subagentId);
+    this.subagentIdleDelayMs.delete(subagentId);
     void this.appendSessionEvent({
       type: "agent_stopped",
       ts: (/* @__PURE__ */ new Date()).toISOString(),
@@ -41200,9 +41529,13 @@ var Director = class _Director {
     const timer = setTimeout(() => {
       this.subagentIdleTimers.delete(subagentId);
       const entry = this.coordinator.getStatus().subagents.find((a) => a.id === subagentId);
-      if (entry?.status !== "idle") return;
+      if (entry === void 0) return;
+      if (entry.status !== "idle") {
+        this.armSubagentIdleRetirement(subagentId, Math.max(delayMs, BUSY_REARM_FLOOR_MS));
+        return;
+      }
       if (this.coordinator.listPendingTasks().some((task) => task.subagentId === subagentId)) {
-        this.armSubagentIdleRetirement(subagentId, this.subagentIdleTimeoutMs);
+        this.armSubagentIdleRetirement(subagentId, Math.max(delayMs, BUSY_REARM_FLOOR_MS));
         return;
       }
       void this.remove(subagentId).catch(
@@ -44858,16 +45191,14 @@ var ExploreCompanion = class {
     this.running = true;
     this.unsubscribers.push(
       this.opts.events.on("tool.executed", (e) => {
-        const lsid = this.resolveLeaderSessionId();
-        if (lsid && e.sessionId && e.sessionId !== lsid) return;
+        if (e.sessionId !== this.resolveLeaderSessionId()) return;
         this.trackToolExecuted(e);
       })
     );
     if (this.cfg.signals.todoInProgress && this.resolveLeaderAgentId()) {
       this.unsubscribers.push(
         this.opts.events.on("session.agents_updated", (e) => {
-          const lsid = this.resolveLeaderSessionId();
-          if (lsid && e.sessionId && e.sessionId !== lsid) return;
+          if (e.sessionId !== this.resolveLeaderSessionId()) return;
           this.trackAgentTodos(e.agents);
         })
       );
@@ -44875,8 +45206,7 @@ var ExploreCompanion = class {
     if (this.cfg.signals.errorSymbol) {
       this.unsubscribers.push(
         this.opts.events.on("error", (e) => {
-          const lsid = this.resolveLeaderSessionId();
-          if (lsid && e.sessionId && e.sessionId !== lsid) return;
+          if (e.sessionId !== this.resolveLeaderSessionId()) return;
           this.trackError(e.err);
         })
       );
@@ -44989,9 +45319,18 @@ var ExploreCompanion = class {
         limit: 20
       });
       const lsid = this.resolveLeaderSessionId();
+      const selfRecipients = new Set(
+        [
+          this.cfg.companionAgentId,
+          mailboxIdentityBase(this.cfg.companionAgentId),
+          ...lsid != null ? [sessionRecipient(lsid)] : []
+        ].map((r) => r.toLowerCase())
+      );
       for (const msg of messages) {
         if (msg.type !== "ask" && msg.type !== "assign") continue;
-        const fromLeader = isMailboxLeader(msg.from) || lsid != null && msg.senderSessionId === lsid;
+        const to = msg.to.trim().toLowerCase();
+        if (to !== "*" && !selfRecipients.has(to)) continue;
+        const fromLeader = msg.senderSessionId === void 0 && isMailboxLeader(msg.from) || lsid != null && msg.senderSessionId === lsid;
         if (!fromLeader) continue;
         this.engage({
           id: randomUUID24(),
@@ -54945,6 +55284,7 @@ function requestLimitExtension(opts) {
 // src/prompts/prompt-journal.ts
 import * as fs31 from "node:fs/promises";
 import * as path77 from "node:path";
+var defaultScrubber2 = new DefaultSecretScrubber();
 var PROMPT_JOURNAL_RAW_MARKER = "promptJournal.raw";
 async function ensureGitignore(projectRoot) {
   const gitignorePath = path77.join(projectRoot, ".gitignore");
@@ -54973,7 +55313,9 @@ async function recordPromptJournalEntry(opts) {
   const monthStr = dateStr.slice(0, 7);
   const sessionId = opts.sessionId && opts.sessionId.trim() ? opts.sessionId.trim() : "general";
   const id = `pmt_${Date.now()}_${Math.random().toString(36).slice(2, 9)}`;
-  const content = opts.content ?? "";
+  const content = defaultScrubber2.scrub(opts.content ?? "");
+  const rawContent = typeof opts.rawContent === "string" && opts.rawContent.length > 0 ? defaultScrubber2.scrub(opts.rawContent) : opts.rawContent;
+  const decisionReason = typeof opts.decisionReason === "string" && opts.decisionReason.length > 0 ? defaultScrubber2.scrub(opts.decisionReason) : opts.decisionReason;
   const lines = content.split("\n");
   const characterCount = content.length;
   const lineCount2 = lines.length;
@@ -54986,7 +55328,7 @@ async function recordPromptJournalEntry(opts) {
     role: opts.role ?? (opts.category === "system_prompt" ? "system" : "user"),
     category: opts.category,
     content,
-    rawContent: opts.rawContent,
+    rawContent,
     metadata: {
       model: opts.model,
       provider: opts.provider,
@@ -54997,7 +55339,7 @@ async function recordPromptJournalEntry(opts) {
       activeTools: opts.activeTools,
       contextFiles: opts.contextFiles,
       durationMs: opts.durationMs,
-      decisionReason: opts.decisionReason,
+      decisionReason,
       tags: opts.tags
     }
   };
@@ -56560,10 +56902,7 @@ function createAgentToolHandler(a) {
           } catch {
           }
         }
-        if (decision === "yes") {
-          const p = a.permission;
-          p.allowOnce?.({ tool: tool.name, pattern: result.suggestedPattern });
-        } else if (decision === "no") {
+        if (decision === "no") {
           const p = a.permission;
           p.denyOnce?.({ tool: tool.name, pattern: result.suggestedPattern });
         }
@@ -64327,6 +64666,10 @@ var DefaultSkillLoader = class {
         );
         for (const e of entries) {
           if (!await entryIsDirectory(dir, e)) continue;
+          if (!isValidSkillNameFormat(e.name)) {
+            this.skipped.push({ dir, entry: e.name, reason: "invalid-name-format" });
+            continue;
+          }
           const skillFile = path80.join(dir, e.name, "SKILL.md");
           let raw;
           try {
@@ -65731,7 +66074,7 @@ var SENSITIVE_FLAG_PATTERNS = [
   // redaction function (false positive = cosmetic noise; false negative = leak).
   /(?<![-\w])-(?:password|p|a)(?:[=\s]+)?[^\s,-]+/gi,
   // env var–style secrets: TOKEN=x, API_KEY=y, etc.
-  /(?:TOKEN|API_KEY|API_SECRET|AUTH_TOKEN|GITHUB_TOKEN|GH_TOKEN|BEARER|JWT|OAUTH|CREDENTIAL|SECRET|PRIVATE_KEY|PASSWORD|PASSWD)\s*[=:]\s*[^\s,]+/gi,
+  /(?:TOKEN|API_KEY|API_SECRET|AUTH_TOKEN|GITHUB_TOKEN|GH_TOKEN|BEARER|JWT|OAUTH|CREDENTIAL|SECRET|PRIVATE_KEY|PASSWORD|PASSWD|PASSPHRASE)\s*[=:]\s*[^\s,]+/gi,
   // Generic high-entropy look: base64 strings >32 chars or hex strings >32 digits — but only
   // when preceded by a flag name (e.g. --github-token=EyJ...). Global flag so
   // every such flag in the command line is redacted, not just the first.
@@ -66106,7 +66449,7 @@ var ToolExecutor = class _ToolExecutor {
         return { result, tool, durationMs: Date.now() - start };
       }
       if (effectivePermission === "confirm") {
-        const suggestedPattern = boundary.decision === "confirm" ? `kanban-boundary:${boundary.path ?? tool.name}` : subjectForToolInput(tool.name, use.input, tool.subjectKey) ?? tool.name;
+        const suggestedPattern = boundary.decision === "confirm" ? `kanban-boundary:${boundary.path ?? tool.name}` : subjectForToolInput(tool.name, use.input, tool.subjectKey, tool.subjectFields) ?? tool.name;
         if (this.opts.confirmAwaiter) {
           const awaiter = this.opts.confirmAwaiter;
           const choice = await new Promise(
@@ -68643,7 +68986,9 @@ function hasRecursiveForceDelete(command, projectRoot) {
     if (token === "rd" || token === "rmdir") {
       const args = commandSegment(tokens, i + 1).map((arg) => arg.toLowerCase());
       if (args.includes("/s")) {
-        const targets = args.filter((arg) => !arg.startsWith("-") && !arg.startsWith("/") && !SHELL_OPERATORS.has(arg));
+        const targets = args.filter(
+          (arg) => !arg.startsWith("-") && !arg.startsWith("/") && !SHELL_OPERATORS.has(arg)
+        );
         if (targets.length === 0) return true;
         if (targets.some(isCatastrophicDeleteTarget)) return true;
         if (targets.some((target) => !pathLooksInsideProject(target, projectRoot))) return true;
@@ -68712,7 +69057,8 @@ function hasFindExec(command) {
 function isCatastrophicDeleteTarget(rawTarget) {
   const t2 = rawTarget.replace(/^['"]|['"]$/g, "").trim();
   if (!t2) return false;
-  if (t2 === "*" || t2 === "." || t2 === "./" || t2 === ".\\" || t2 === "./*" || t2 === ".\\*") return true;
+  if (t2 === "*" || t2 === "." || t2 === "./" || t2 === ".\\" || t2 === "./*" || t2 === ".\\*")
+    return true;
   const s = t2.replace(/[\\/]\*+$/, "").replace(/[\\/]+$/, "");
   if (s === "") return true;
   if (s === "~" || /^\$HOME$/i.test(s) || /^%USERPROFILE%$/i.test(s)) return true;
@@ -68752,12 +69098,16 @@ function hasCatastrophicDelete(command) {
       const args = tokens.slice(i + 1);
       const recursive = args.some((arg) => arg.toLowerCase() === "/s");
       if (!recursive) continue;
-      const targets = args.filter((arg) => !arg.startsWith("-") && !arg.startsWith("/") && !SHELL_OPERATORS.has(arg));
+      const targets = args.filter(
+        (arg) => !arg.startsWith("-") && !arg.startsWith("/") && !SHELL_OPERATORS.has(arg)
+      );
       if (targets.some(isCatastrophicDeleteTarget)) return true;
     }
     if (token === "del" || token === "erase") {
       const args = tokens.slice(i + 1);
-      const targets = args.filter((arg) => !arg.startsWith("-") && !arg.startsWith("/") && !SHELL_OPERATORS.has(arg));
+      const targets = args.filter(
+        (arg) => !arg.startsWith("-") && !arg.startsWith("/") && !SHELL_OPERATORS.has(arg)
+      );
       if (targets.some(isCatastrophicDeleteTarget)) return true;
     }
   }
@@ -68818,6 +69168,47 @@ function isClearlyDestructiveBashCommand(command, projectRoot) {
   if (HIGH_IMPACT_PATTERNS.some((pattern) => pattern.test(trimmed))) return true;
   return false;
 }
+var WELL_KNOWN_CREDENTIAL_ENV_VARS = /* @__PURE__ */ new Set([
+  "ANTHROPIC_API_KEY",
+  "ANTHROPIC_AUTH_TOKEN",
+  "OPENAI_API_KEY",
+  "AZURE_OPENAI_API_KEY",
+  "GEMINI_API_KEY",
+  "GOOGLE_API_KEY",
+  "GOOGLE_APPLICATION_CREDENTIALS",
+  "GOOGLE_GENERATIVE_AI_API_KEY",
+  "GROQ_API_KEY",
+  "MISTRAL_API_KEY",
+  "COHERE_API_KEY",
+  "DEEPSEEK_API_KEY",
+  "XAI_API_KEY",
+  "OPENROUTER_API_KEY",
+  "PERPLEXITY_API_KEY",
+  "TOGETHER_API_KEY",
+  "FIREWORKS_API_KEY",
+  "HUGGINGFACE_API_KEY",
+  "HF_TOKEN",
+  "GITHUB_TOKEN",
+  "GH_TOKEN",
+  "NPM_TOKEN",
+  "AWS_ACCESS_KEY_ID",
+  "AWS_SECRET_ACCESS_KEY",
+  "AWS_SESSION_TOKEN",
+  "AZURE_CLIENT_SECRET",
+  "GITLAB_TOKEN",
+  "SLACK_TOKEN",
+  "STRIPE_SECRET_KEY",
+  "TELEGRAM_BOT_TOKEN",
+  "WRONGSTACK_VAULT_PASSPHRASE"
+]);
+function attachesWellKnownCredential(input) {
+  if (!input || typeof input !== "object") return false;
+  const envVars = input["envVars"];
+  if (!Array.isArray(envVars)) return false;
+  return envVars.some(
+    (name) => typeof name === "string" && WELL_KNOWN_CREDENTIAL_ENV_VARS.has(name.toUpperCase())
+  );
+}
 
 // src/security/permission-helpers.ts
 function matchesTrust(patterns, subject2) {
@@ -68834,7 +69225,7 @@ function hasShellSubject(tool) {
   ]);
 }
 function alwaysAllowUnavailableReason(tool, input) {
-  const subject2 = subjectForToolInput(tool.name, input, tool.subjectKey);
+  const subject2 = subjectForToolInput(tool.name, input, tool.subjectKey, tool.subjectFields);
   if (subject2 !== void 0) return void 0;
   return `"always allow" needs a subject to remember, and ${tool.name} calls do not carry one (no subjectKey, and no path/url/name input). Recording it would store a rule that can never match. Approve this call, or set a trust rule for ${tool.name} explicitly.`;
 }
@@ -68894,8 +69285,18 @@ var AGENT_STATE_SENSITIVE_BASENAMES = /^(?:config\.json|config\.local\.json|trus
 function unescapeGlobSubject(value) {
   return value.replace(/\\([*?[\]])/g, "$1");
 }
+function stripAdsSuffix(forwardSlashPath) {
+  const cut = forwardSlashPath.lastIndexOf("/");
+  const dir = cut === -1 ? "" : forwardSlashPath.slice(0, cut + 1);
+  const base = cut === -1 ? forwardSlashPath : forwardSlashPath.slice(cut + 1);
+  const colon = base.indexOf(":");
+  if (colon === -1 || cut === -1 && colon === 1 && base.length <= 2) return forwardSlashPath;
+  return dir + base.slice(0, colon);
+}
 function normalizeForCompare(value) {
-  const forward = unescapeGlobSubject(value).replace(/\\/g, "/").replace(/\/+$/, "");
+  const forward = stripAdsSuffix(
+    unescapeGlobSubject(value).replace(/\\/g, "/").replace(/\/+$/, "")
+  );
   return process.platform === "win32" ? forward.toLowerCase() : forward;
 }
 function realpathOfNearestExisting(p) {
@@ -68932,7 +69333,7 @@ function isProtectedAgentStatePath(absPath) {
   return AGENT_STATE_SENSITIVE_BASENAMES.test(path90.basename(normalizeForCompare(absPath)));
 }
 function pathLooksSensitive(rawPath) {
-  const normalized = stripShellQuotes(rawPath).replace(/\\/g, "/");
+  const normalized = stripAdsSuffix(stripShellQuotes(rawPath).replace(/\\/g, "/"));
   if (SENSITIVE_READ_PATHS.some((pattern) => pattern.test(normalized))) return true;
   return isProtectedAgentStatePath(normalized);
 }
@@ -68956,10 +69357,24 @@ function shellCommandReadsSensitivePath(command) {
   }
   return false;
 }
+function isSensitiveReadCall(tool, input) {
+  const isReadTool = hasCapability(tool, ToolCapabilities.FS_READ) || tool.name === "read" || tool.name === "grep" || tool.name === "glob" || tool.name === "tree";
+  if (isReadTool && inputPathLooksSensitive(input)) return true;
+  const hasShellCap = hasCapability(tool, [
+    ToolCapabilities.SHELL_ARBITRARY,
+    ToolCapabilities.SHELL_RESTRICTED,
+    ToolCapabilities.SHELL_EXEC
+  ]);
+  if (!hasShellCap && tool.name !== "bash" && tool.name !== "shell" && tool.name !== "exec") {
+    return false;
+  }
+  const command = shellCommandLineFromInput(input);
+  return command ? shellCommandReadsSensitivePath(command) : false;
+}
 
 // src/security/permission-explain.ts
 function explainPermissionTrace(state, tool, input, ctx) {
-  const subject2 = subjectForToolInput(tool.name, input, tool.subjectKey);
+  const subject2 = subjectForToolInput(tool.name, input, tool.subjectKey, tool.subjectFields);
   const steps = [];
   let winnerIndex = -1;
   const add = (rule, matched, decision, source, detail) => {
@@ -69180,13 +69595,7 @@ function explainPermissionTrace(state, tool, input, ctx) {
         }
       };
     }
-    add(
-      "yolo",
-      true,
-      "auto",
-      "yolo",
-      "YOLO mode is active \u2014 auto-approving every non-denied call"
-    );
+    add("yolo", true, "auto", "yolo", "YOLO mode is active \u2014 auto-approving every non-denied call");
     winnerIndex = steps.length - 1;
     return {
       toolName: tool.name,
@@ -69458,7 +69867,14 @@ var AutoApprovePermissionPolicy = class _AutoApprovePermissionPolicy {
   static isMcpTool(name) {
     return name.startsWith("mcp__");
   }
-  async evaluate(tool) {
+  async evaluate(tool, input) {
+    if (input !== void 0 && isSensitiveReadCall(tool, input)) {
+      return {
+        permission: "deny",
+        source: "subagent_guard",
+        reason: "subagents may not read credential-bearing paths \u2014 the leader must perform this read so the user can approve it"
+      };
+    }
     const caps = tool.capabilities ?? [];
     const hasAllowedCap = caps.some((c) => this.allowedCapabilities.includes(c));
     const isMcp = _AutoApprovePermissionPolicy.isMcpTool(tool.name);
@@ -69485,8 +69901,8 @@ var AutoApprovePermissionPolicy = class _AutoApprovePermissionPolicy {
   }
   allowOnce() {
   }
-  async explain(tool) {
-    const decision = await this.evaluate(tool);
+  async explain(tool, input) {
+    const decision = await this.evaluate(tool, input);
     return {
       toolName: tool.name,
       subject: null,
@@ -69536,6 +69952,17 @@ function fsWriteTargetPaths(input) {
   }
   return out;
 }
+function mergeTrustEntries(exact, wildcard) {
+  if (!exact) return wildcard;
+  if (!wildcard) return exact;
+  const deny = [...wildcard.deny ?? [], ...exact.deny ?? []];
+  const merged = {
+    ...wildcard,
+    ...exact
+  };
+  if (deny.length > 0) merged.deny = [...new Set(deny)];
+  return merged;
+}
 var DefaultPermissionPolicy = class {
   policy = {};
   loaded = false;
@@ -69574,6 +70001,7 @@ var DefaultPermissionPolicy = class {
   yoloBlockedAsDestructive(tool, input, ctx) {
     if (!this.yolo || this.yoloDestructive) return false;
     if (this.hasAgentStateWriteTarget(tool, input, ctx)) return true;
+    if (attachesWellKnownCredential(input)) return true;
     const isShellSurface = tool.name === "bash" || tool.name === "exec" || (tool.capabilities ?? []).includes("shell.arbitrary");
     if (!isShellSurface) return false;
     const command = getInputString(input, "command") ?? shellCommandLineFromInput(input);
@@ -69667,8 +70095,8 @@ var DefaultPermissionPolicy = class {
       };
     }
     const namespaceEntry = this.findNamespaceEntry(tool.name);
-    const entry = this.policy[tool.name] ?? namespaceEntry;
-    const subject2 = subjectForToolInput(tool.name, input, tool.subjectKey);
+    const entry = mergeTrustEntries(this.policy[tool.name], namespaceEntry);
+    const subject2 = subjectForToolInput(tool.name, input, tool.subjectKey, tool.subjectFields);
     const cacheKey = `${tool.name}::${subject2 ?? tool.name}`;
     const evalKey = `${cacheKey}::${permissionFingerprint(tool)}`;
     if (tool.name !== "write" && !this.hasAgentStateWriteTarget(tool, input, ctx)) {
@@ -69685,15 +70113,6 @@ var DefaultPermissionPolicy = class {
       this._evalCache.set(evalKey, decision);
       return decision;
     }
-    if (this.sessionAllowed.has(cacheKey)) {
-      this.sessionAllowed.delete(cacheKey);
-      const decision = {
-        permission: "auto",
-        source: "trust",
-        reason: "session one-shot allow (user pressed yes)"
-      };
-      return decision;
-    }
     if (entry?.deny && subject2 && matchesTrust(entry.deny, subject2)) {
       this._logDeny(tool.name, subject2, "matched deny pattern");
       const decision = {
@@ -69704,6 +70123,15 @@ var DefaultPermissionPolicy = class {
       this._evalCache.set(evalKey, decision);
       return decision;
     }
+    if (this.sessionAllowed.has(cacheKey)) {
+      this.sessionAllowed.delete(cacheKey);
+      const decision = {
+        permission: "auto",
+        source: "trust",
+        reason: "session one-shot allow (user pressed yes)"
+      };
+      return decision;
+    }
     if (tool.permission === "deny") {
       this._logDeny(tool.name, subject2, "tool default deny");
       const decision = {
@@ -69714,6 +70142,7 @@ var DefaultPermissionPolicy = class {
       this._evalCache.set(evalKey, decision);
       return decision;
     }
+    const denyUnevaluated = Boolean(entry?.deny?.length) && subject2 === void 0;
     const allowMatches = hasShellSubject(tool) ? matchesCommandTrust : matchesTrust;
     if (entry?.allow && subject2 && allowMatches(entry.allow, subject2)) {
       const decision = {
@@ -69724,7 +70153,7 @@ var DefaultPermissionPolicy = class {
       this._evalCache.set(evalKey, decision);
       return decision;
     }
-    if (entry?.auto) {
+    if (entry?.auto && !denyUnevaluated) {
       const decision = { permission: "auto", source: "trust" };
       this._evalCache.set(evalKey, decision);
       return decision;
@@ -69824,19 +70253,10 @@ var DefaultPermissionPolicy = class {
     }
     return { permission: "confirm", source: "default" };
   }
+  // Delegates to the shared helper so the subagent policy applies the exact
+  // same rule — see `isSensitiveReadCall` in ./permission-helpers.ts.
   isSensitiveReadCall(tool, input) {
-    const isReadTool = hasCapability(tool, ToolCapabilities.FS_READ) || tool.name === "read" || tool.name === "grep" || tool.name === "glob" || tool.name === "tree";
-    if (isReadTool && inputPathLooksSensitive(input)) return true;
-    const hasShellCap = hasCapability(tool, [
-      ToolCapabilities.SHELL_ARBITRARY,
-      ToolCapabilities.SHELL_RESTRICTED,
-      ToolCapabilities.SHELL_EXEC
-    ]);
-    if (!hasShellCap && tool.name !== "bash" && tool.name !== "shell" && tool.name !== "exec") {
-      return false;
-    }
-    const command = shellCommandLineFromInput(input);
-    return command ? shellCommandReadsSensitivePath(command) : false;
+    return isSensitiveReadCall(tool, input);
   }
   async trust(rule) {
     if (!this.loaded) await this.reload();
@@ -78870,6 +79290,15 @@ function deriveSessionStatus(agents) {
     (a) => a.status === "running" || a.status === "streaming" || a.status === "waiting_user"
   ) ? "active" : "idle";
 }
+function downgradeStaleAgentStatuses(agents, nowMs) {
+  const cutoff = nowMs - HQ_STALE_SNAPSHOT_WINDOW_MS;
+  return agents.map((agent) => {
+    if (agent.status !== "running" && agent.status !== "streaming") return agent;
+    const lastActivityAt = Date.parse(agent.lastActivityAt);
+    if (!Number.isFinite(lastActivityAt) || lastActivityAt >= cutoff) return agent;
+    return { ...agent, status: "idle" };
+  });
+}
 function startSessionTelemetryBridge(opts) {
   const now = opts.now ?? (() => (/* @__PURE__ */ new Date()).toISOString());
   const publisher = opts.publisher;
@@ -78890,6 +79319,7 @@ function startSessionTelemetryBridge(opts) {
   let lastPublishedAtMs = Date.now();
   let disposed = false;
   function buildSnapshot() {
+    const effectiveAgents = downgradeStaleAgentStatuses(agents, Date.parse(now()));
     return {
       sessionId: opts.sessionId,
       clientKind: identity2.kind,
@@ -78897,11 +79327,11 @@ function startSessionTelemetryBridge(opts) {
       projectId: project2.projectId,
       projectName: opts.projectName ?? project2.projectName,
       projectRoot: opts.projectRoot,
-      status: deriveSessionStatus(agents),
+      status: deriveSessionStatus(effectiveAgents),
       startedAt,
       lastActivityAt,
-      agentCount: agents.length,
-      agents,
+      agentCount: effectiveAgents.length,
+      agents: effectiveAgents,
       ...identity2.hostname !== void 0 ? { hostname: identity2.hostname } : {},
       ...identity2.pid !== void 0 ? { pid: identity2.pid } : {},
       ...opts.gitBranch !== void 0 ? { gitBranch: opts.gitBranch } : {}
@@ -82282,18 +82712,88 @@ var DefaultPluginAPI = class {
       list: () => tr.list()
     };
     const pr = init.providerRegistry;
+    const providerTypesIOwn = /* @__PURE__ */ new Set();
+    const assertCanMutateProvider = (type, op) => {
+      if (isOfficial) return;
+      if (providerTypesIOwn.has(type)) return;
+      if (!pr.has(type)) return;
+      throw new Error(
+        `Plugin "${owner}" may not ${op} provider "${type}" \u2014 it was not registered by this plugin. Replacing an existing provider would route prompts and credentials through plugin code.`
+      );
+    };
     this.providers = {
-      register: (f) => pr.register(f),
-      unregister: (type) => pr.unregister(type),
+      register: (f) => {
+        assertCanMutateProvider(f.type, "replace");
+        pr.register(f);
+        providerTypesIOwn.add(f.type);
+      },
+      unregister: (type) => {
+        assertCanMutateProvider(type, "unregister");
+        providerTypesIOwn.delete(type);
+        return pr.unregister(type);
+      },
       create: (cfg) => pr.create(cfg),
       list: () => pr.list()
     };
-    this.mcp = init.mcpRegistry ?? noopMcp;
+    const mcpRegistry = init.mcpRegistry;
+    if (!mcpRegistry) {
+      this.mcp = noopMcp;
+    } else {
+      const mcpServersIStarted = /* @__PURE__ */ new Set();
+      const assertOwnsMcpServer = (name, op) => {
+        if (isOfficial) return;
+        if (mcpServersIStarted.has(name)) return;
+        if (!mcpRegistry.list().some((s) => s.name === name)) return;
+        throw new Error(
+          `Plugin "${owner}" may not ${op} MCP server "${name}" \u2014 it was not started by this plugin.`
+        );
+      };
+      this.mcp = {
+        start: async (cfg) => {
+          const name = cfg?.name;
+          if (typeof name === "string" && mcpRegistry.list().some((s) => s.name === name)) {
+            assertOwnsMcpServer(name, "start");
+          }
+          await mcpRegistry.start(cfg);
+          if (typeof name === "string") mcpServersIStarted.add(name);
+        },
+        stop: async (name) => {
+          assertOwnsMcpServer(name, "stop");
+          await mcpRegistry.stop(name);
+        },
+        restart: async (name) => {
+          assertOwnsMcpServer(name, "restart");
+          await mcpRegistry.restart(name);
+        },
+        list: () => mcpRegistry.list()
+      };
+    }
     const scr = init.slashCommandRegistry;
     const official = init.official === true;
+    const commandsIOwn = /* @__PURE__ */ new Set();
     this.slashCommands = scr ? {
-      register: (cmd) => scr.register(cmd, owner, { official }),
-      unregister: (name) => scr.unregister(name),
+      register: (cmd) => {
+        scr.register(cmd, owner, { official });
+        for (const key of [cmd.name, ...cmd.aliases ?? []]) {
+          commandsIOwn.add(key);
+          commandsIOwn.add(`${owner}:${key}`);
+        }
+      },
+      unregister: (name) => {
+        if (!official && !commandsIOwn.has(name) && scr.get(name) !== void 0) {
+          throw new Error(
+            `Plugin "${owner}" may not unregister slash command "${name}" \u2014 it was not registered by this plugin.`
+          );
+        }
+        for (const key of [
+          name,
+          `${owner}:${name}`,
+          name.startsWith(`${owner}:`) ? name.slice(owner.length + 1) : name
+        ]) {
+          commandsIOwn.delete(key);
+        }
+        return scr.unregister(name);
+      },
       get: (name) => scr.get(name),
       list: () => scr.list()
     } : noopSlashCommands;
@@ -86898,14 +87398,21 @@ async function openInEditor(filePath, env = process.env) {
       context: { filePath }
     });
   }
-  const child = spawn12(parts[0], [...parts.slice(1), filePath], {
+  const editorArgs = [...parts.slice(1), filePath];
+  const child = shell ? (() => {
+    const inv = buildWin32CmdShimInvocation(parts[0], editorArgs);
+    return spawn12(inv.command, inv.args, {
+      stdio: "ignore",
+      detached: true,
+      windowsVerbatimArguments: inv.windowsVerbatimArguments,
+      // Suppresses the console flash the cmd.exe wrapper would otherwise
+      // show before the editor appears. Repo convention — see
+      // `core/tests/architecture/spawn-convention.test.ts`.
+      windowsHide: true
+    });
+  })() : spawn12(parts[0], editorArgs, {
     stdio: "ignore",
     detached: true,
-    shell,
-    // `shell` routes through cmd.exe on win32, which flashes a console window
-    // before the editor appears. A GUI editor is unaffected by the flag; the
-    // shell wrapper is what it suppresses. Repo convention — see
-    // `core/tests/architecture/spawn-convention.test.ts`.
     windowsHide: true
   });
   child.unref();
@@ -99293,6 +99800,8 @@ export {
   sanitizeModel,
   sanitizeNodeOptions,
   sanitizeRequest,
+  sanitizeTerminalPreview,
+  sanitizeTerminalText,
   sanitizeWireToolName,
   saveCompletedWorkCheckpoint,
   saveGoal,