@wrongstack/tools 0.297.0 → 0.298.1

package/dist/exec.js

@@ -7,6 +7,329 @@ import {
 } from "@wrongstack/core/observability";
 import { toErrorMessage as toErrorMessage2 } from "@wrongstack/core/utils/error";
 
+// src/_danger-detect.ts
+var argHas = (args, value) => args.includes(value);
+var argMatches = (args, re) => args.some((a) => re.test(a));
+var hasShortFlags = (args, letters) => {
+  const seen = /* @__PURE__ */ new Set();
+  for (const a of args) {
+    if (!a.startsWith("-") || a.startsWith("--")) continue;
+    for (const ch of a.replace(/^-+/, "")) seen.add(ch);
+  }
+  return letters.split("").every((l) => seen.has(l));
+};
+var RULES = [
+  // ----- rm / rmdir: recursive force delete (any path) -----
+  // Note: BLOCKED_ARG_PATTERNS already hard-denies root/home/glob paths,
+  // but `rm -rf ./build` is a normal dev workflow that the user might
+  // want to do intentionally. We downgrade it to 'destructive' so the
+  // confirm prompt can approve.
+  {
+    id: "rm-recursive",
+    level: "destructive",
+    test: (cmd, args) => (cmd === "rm" || cmd === "rmdir") && hasShortFlags(args, "rf"),
+    reason: "recursive force-delete"
+  },
+  // ----- Windows PowerShell Remove-Item: -Recurse -Force -----
+  {
+    id: "powershell-remove-item-recursive-force",
+    level: "destructive",
+    test: (cmd, args) => {
+      if (cmd !== "powershell" && cmd !== "pwsh") return false;
+      const hasRecurse = argMatches(args, /^-(?:R|Recurse|Recurse\s)/);
+      const hasForce = argHas(args, "-Force") || argHas(args, "-F");
+      if (argHas(args, "-WhatIf")) return false;
+      return hasRecurse && hasForce;
+    },
+    reason: "Remove-Item with -Recurse -Force"
+  },
+  // ----- find -exec / -ok / -execdir -----
+  {
+    id: "find-exec",
+    level: "destructive",
+    test: (cmd, args) => {
+      if (cmd !== "find") return false;
+      return args.some(
+        (a) => a === "-exec" || a === "-exec;" || a === "-ok" || a === "-ok;" || a === "-execdir" || a === "-execdir;" || a.startsWith("-exec=") || a.startsWith("-ok=") || a.startsWith("-execdir=")
+      );
+    },
+    reason: "find with -exec/-ok (executes arbitrary command on matches)"
+  },
+  // ----- git --exec= / --upload-pack= / --receive-pack= -----
+  // These run arbitrary commands via the git transport layer.
+  {
+    id: "git-exec",
+    level: "destructive",
+    test: (cmd, args) => cmd === "git" && args.some(
+      (a) => a.startsWith("--exec=") || a.startsWith("--upload-pack=") || a.startsWith("--receive-pack=") || a === "--exec" || a === "--upload-pack" || a === "--receive-pack"
+    ),
+    reason: "git with --exec/--upload-pack/--receive-pack (runs arbitrary code)"
+  },
+  // ----- Windows: format / diskpart / bcdedit -----
+  {
+    id: "win32-format",
+    level: "destructive",
+    test: (cmd) => cmd === "format" || cmd === "format.exe",
+    reason: "format (Windows disk format)"
+  },
+  {
+    id: "win32-diskpart",
+    level: "destructive",
+    test: (cmd) => cmd === "diskpart" || cmd === "diskpart.exe",
+    reason: "diskpart (Windows partition editor)"
+  },
+  {
+    id: "win32-bcdedit",
+    level: "destructive",
+    test: (cmd) => cmd === "bcdedit" || cmd === "bcdedit.exe",
+    reason: "bcdedit (Windows boot config editor)"
+  },
+  // ----- mkfs family -----
+  {
+    id: "mkfs",
+    level: "destructive",
+    test: (cmd) => /^mkfs(\.[a-z0-9]+)?$/.test(cmd) || cmd === "mkswap",
+    reason: "mkfs (filesystem creation \u2014 destroys existing data)"
+  },
+  // ----- dd writing to a block device -----
+  {
+    id: "dd-to-block-device",
+    level: "destructive",
+    test: (cmd, args) => {
+      if (cmd !== "dd") return false;
+      return args.some((a) => /of=\/dev\/(sd|hd|nvme|vd|mmcblk|xvd|loop|disk)/.test(a));
+    },
+    reason: "dd writing to a block device"
+  },
+  // ----- Secure-erase tools -----
+  {
+    id: "shred",
+    level: "destructive",
+    test: (cmd) => cmd === "shred" || cmd === "shred.exe",
+    reason: "shred (secure file delete)"
+  },
+  {
+    id: "wipefs",
+    level: "destructive",
+    test: (cmd) => cmd === "wipefs" || cmd === "wipefs.exe",
+    reason: "wipefs (signature wipe \u2014 destroys filesystem headers)"
+  },
+  {
+    id: "sdelete",
+    level: "destructive",
+    test: (cmd) => cmd === "sdelete" || cmd === "sdelete.exe",
+    reason: "sdelete (Sysinternals secure delete)"
+  },
+  // ----- VCS history rewrite (destructive) -----
+  // `git push --force` / `-f` rewrites remote history. `--force-with-lease`
+  // is the safer variant (checks remote hasn't moved) but still rewrites.
+  {
+    id: "git-push-force",
+    level: "destructive",
+    test: (cmd, args) => {
+      if (cmd !== "git") return false;
+      const pushIdx = args.indexOf("push");
+      if (pushIdx < 0) return false;
+      for (let i = pushIdx + 1; i < args.length; i++) {
+        const a = args[i];
+        if (a === "--force" || a === "-f" || a === "--force-with-lease") return true;
+        if (!a.startsWith("-") && !a.includes("=")) continue;
+        if (a.startsWith("--force")) return true;
+      }
+      return false;
+    },
+    reason: "git push with --force / -f (rewrites remote history)"
+  },
+  // ----- git reset --hard (destructive) -----
+  {
+    id: "git-reset-hard",
+    level: "destructive",
+    test: (cmd, args) => cmd === "git" && args.some((a) => a === "--hard" || a.startsWith("--hard=")),
+    reason: "git reset --hard (discards working tree + index)"
+  },
+  // ----- git clean -f / -fd (destructive) -----
+  {
+    id: "git-clean-force",
+    level: "destructive",
+    test: (cmd, args) => {
+      if (cmd !== "git") return false;
+      const cleanIdx = args.indexOf("clean");
+      if (cleanIdx < 0) return false;
+      return args.slice(cleanIdx + 1).some(
+        (a) => a === "-f" || a === "--force" || a.startsWith("-f") || a.startsWith("--force=")
+      );
+    },
+    reason: "git clean -f (deletes untracked files)"
+  },
+  // ----- package publish (destructive — public, irreversible) -----
+  {
+    id: "npm-publish",
+    level: "destructive",
+    test: (cmd, args) => {
+      if (!["npm", "pnpm", "yarn", "bun", "cargo"].includes(cmd)) return false;
+      return args.includes("publish") || cmd === "cargo" && args.includes("yank");
+    },
+    reason: "publishing to a public package registry (hard to reverse)"
+  },
+  // ----- k8s cluster-wide destructive ops (destructive) -----
+  {
+    id: "kubectl-delete-namespace",
+    level: "destructive",
+    test: (cmd, args) => {
+      if (cmd !== "kubectl") return false;
+      const delIdx = args.indexOf("delete");
+      if (delIdx < 0) return false;
+      const after = args.slice(delIdx + 1);
+      return after[0] === "namespace" || after[0] === "ns";
+    },
+    reason: "kubectl delete namespace (deletes all resources in the namespace)"
+  },
+  {
+    id: "kubectl-drain",
+    level: "destructive",
+    test: (cmd, args) => cmd === "kubectl" && args.includes("drain"),
+    reason: "kubectl drain (evicts pods, marks node unschedulable)"
+  },
+  // ----- inline code evaluation (caution — high false-positive) -----
+  // Common in scripts: `python -c "..."`, `node -e "..."`, `bash -c "..."`.
+  // We tag 'caution' rather than 'destructive' because these are used in
+  // many legitimate one-liners (e.g. `python -c "print(1)"`).
+  {
+    id: "inline-eval",
+    level: "caution",
+    test: (cmd, args) => {
+      if (![
+        "python",
+        "python3",
+        "python2",
+        "node",
+        "bash",
+        "sh",
+        "zsh",
+        "ruby",
+        "perl",
+        "lua"
+      ].includes(cmd)) {
+        return false;
+      }
+      return args.some(
+        (a) => a === "-c" || a === "-e" || a === "--eval" || a === "-eval" || a === "-E"
+      );
+    },
+    reason: "inline script evaluation (-c / -e / --eval)"
+  },
+  // ----- pipe-to-shell (destructive — download-and-run pattern) -----
+  // The classic `curl https://... | sh` download-and-run vector. Detected by
+  // looking for a known fetcher piped into a shell or expression evaluator.
+  // A shell command passed through `bash -c` / `pwsh -Command` arrives as one
+  // argv string, so scan the reconstructed argv text rather than individual
+  // tokens only.
+  {
+    id: "pipe-to-shell",
+    level: "destructive",
+    test: (cmd, args) => /\b(?:curl|wget|fetch|httpie|http|irm|iwr|Invoke-WebRequest|Invoke-RestMethod)\b[\s\S]{0,300}\|\s*(?:sudo\s+)?(?:sh|bash|zsh|fish|pwsh|powershell|iex|Invoke-Expression)\b/i.test(
+      [cmd, ...args].join(" ")
+    ),
+    reason: "network fetch piped to a shell (download-and-run pattern)"
+  },
+  // ----- privilege escalation (caution) -----
+  {
+    id: "sudo",
+    level: "caution",
+    test: (cmd) => cmd === "sudo" || cmd === "doas",
+    reason: "privilege escalation (sudo / doas)"
+  },
+  {
+    id: "runas",
+    level: "caution",
+    test: (cmd) => cmd === "runas" || cmd === "runas.exe",
+    reason: "Windows runas (run as different user)"
+  },
+  // ----- world-writable permissions (caution) -----
+  // `chmod 777` is rarely correct. `chmod -R 777` is almost always wrong.
+  // We only flag octal modes; symbolic modes like `chmod o+w` are
+  // left to the operator's discretion.
+  {
+    id: "chmod-world-writable",
+    level: "caution",
+    test: (cmd, args) => {
+      if (cmd !== "chmod") return false;
+      return args.some((a) => /^[0-7]{3,4}$/.test(a) && /7/.test(a));
+    },
+    reason: "chmod with world-writable octal mode (e.g. 777)"
+  },
+  // ----- network recon / offensive scanners (caution) -----
+  // These tools are purpose-built for network reconnaissance and offensive
+  // security. They have legitimate uses in dev (security testing, infra
+  // debugging) but their presence in an agent's command stream is worth a
+  // caution banner so the user can notice an unexpected scan.
+  {
+    id: "network-scanner",
+    level: "caution",
+    test: (cmd) => cmd === "nmap" || cmd === "masscan" || cmd === "zmap" || cmd === "nuclei" || cmd === "hping3" || cmd === "naabu" || cmd === "katana" || cmd === "amass" || cmd === "subfinder" || cmd === "httpx" || cmd === "rustscan" || cmd === "zgrab",
+    reason: "network scanner / offensive reconnaissance tool"
+  },
+  // ----- process termination (caution) -----
+  // kill/killall/pkill terminate processes. The exec kill guard
+  // (exec-kill-guard.ts) hard-blocks attempts on protected WrongStack
+  // processes; this rule adds a caution banner for generic process
+  // termination so the user sees a warning even for non-protected targets.
+  {
+    id: "process-kill",
+    level: "caution",
+    test: (cmd) => cmd === "kill" || cmd === "killall" || cmd === "pkill",
+    reason: "process termination command"
+  },
+  // ----- shell/interpreter launchers (caution) -----
+  // `env bash -c '…'`, `timeout sh`, `nohup perl -e '…'` etc. wrap a child
+  // binary that bypasses the allowlist name-gate entirely (the wrapper
+  // resolves the child from PATH, not from the allowlist). We flag caution
+  // when a known launcher has a shell/interpreter as its target program.
+  {
+    id: "shell-launcher",
+    level: "caution",
+    test: (cmd, args) => {
+      const launchers = ["env", "timeout", "nohup", "nice", "script", "expect", "tmux", "screen", "byobu", "dtach"];
+      if (!launchers.includes(cmd)) return false;
+      const shells = ["sh", "bash", "zsh", "fish", "python", "python3", "perl", "ruby", "node", "pwsh", "powershell", "cmd"];
+      if (cmd === "env") {
+        const prog = args.find((a) => !a.includes("=") && !a.startsWith("-"));
+        return prog !== void 0 && shells.includes(prog);
+      }
+      return args.some((a) => shells.includes(a));
+    },
+    reason: "launcher wrapping a shell/interpreter (bypasses allowlist name-gate)"
+  }
+];
+function detectDanger(cmd, args, bypass) {
+  const reasons = [];
+  let level = "safe";
+  let matchedRule;
+  for (const rule of RULES) {
+    if (bypass?.has(rule.id)) continue;
+    if (!rule.test(cmd, args)) continue;
+    reasons.push(rule.reason);
+    matchedRule = rule.id;
+    if (levelRank(rule.level) > levelRank(level)) {
+      level = rule.level;
+    }
+  }
+  if (level === "safe") return { level: "safe", reasons: [] };
+  const result = { level, reasons };
+  if (matchedRule !== void 0) result.matchedRule = matchedRule;
+  return result;
+}
+function levelRank(level) {
+  switch (level) {
+    case "safe":
+      return 0;
+    case "caution":
+      return 1;
+    case "destructive":
+      return 2;
+  }
+}
+
 // src/_env.ts
 import { buildChildEnv } from "@wrongstack/core/utils";
 
@@ -81,11 +404,12 @@ function createOutputSpool(opts) {
   return {
     write(text) {
       if (finalized || !text) return;
-      totalBytes += Buffer.byteLength(text, "utf8");
+      const textBytes = Buffer.byteLength(text, "utf8");
+      totalBytes += textBytes;
       if (!stream && !failed) {
-        if (headBytes + text.length <= threshold) {
+        if (headBytes + textBytes <= threshold) {
           head += text;
-          headBytes += text.length;
+          headBytes += textBytes;
           return;
         }
         head += text;
@@ -95,7 +419,7 @@ function createOutputSpool(opts) {
       }
       if (stream) {
         if (stream.writableLength > SPOOL_WRITE_HWM_BYTES) {
-          droppedBytes += Buffer.byteLength(text, "utf8");
+          droppedBytes += textBytes;
           return;
         }
         stream.write(text);
@@ -142,12 +466,13 @@ function ensureInsideRoot(absPath, ctx) {
 function safeResolve(input, ctx) {
   return ensureInsideRoot(resolvePath(input, ctx), ctx);
 }
-async function assertRealInsideRoot(absPath, ctx) {
-  if (ctx.allowOutsideProjectRoot) return;
+async function resolveRealInsideRoot(absPath, ctx) {
+  if (ctx.allowOutsideProjectRoot) return absPath;
   const realRoots = await Promise.all(
     allowedRoots(ctx).map((r) => fsp2.realpath(r).catch(() => path2.resolve(r)))
   );
   let probe = absPath;
+  const pendingTail = [];
   for (; ; ) {
     let real;
     try {
@@ -155,13 +480,16 @@ async function assertRealInsideRoot(absPath, ctx) {
     } catch (err) {
       if (err.code === "ENOENT") {
         const parent = path2.dirname(probe);
-        if (parent === probe) return;
+        if (parent === probe) return absPath;
+        pendingTail.unshift(path2.basename(probe));
         probe = parent;
         continue;
       }
       throw err;
     }
-    if (isInsideAny(real, realRoots)) return;
+    if (isInsideAny(real, realRoots)) {
+      return pendingTail.length > 0 ? path2.join(real, ...pendingTail) : real;
+    }
     throw new Error(
       `Path "${absPath}" resolves through a symlink outside project root "${realRoots[0]}"`
     );
@@ -169,8 +497,7 @@ async function assertRealInsideRoot(absPath, ctx) {
 }
 async function safeResolveReal(input, ctx) {
   const abs = safeResolve(input, ctx);
-  await assertRealInsideRoot(abs, ctx);
-  return abs;
+  return await resolveRealInsideRoot(abs, ctx);
 }
 var COMMAND_OUTPUT_MAX_BYTES = 32768;
 var REPEAT_RUN_THRESHOLD = 3;
@@ -243,6 +570,62 @@ function normalizeCommandOutput(raw, opts = {}) {
   return truncateHeadTail(text, opts.maxBytes ?? COMMAND_OUTPUT_MAX_BYTES);
 }
 
+// src/_win32-resolve.ts
+import * as fs from "node:fs";
+import * as path3 from "node:path";
+function resolveWin32Command(cmd) {
+  if (process.platform !== "win32") return cmd;
+  if (cmd.includes("/") || cmd.includes("\\") || path3.extname(cmd.replace(/\//g, "\\"))) {
+    return cmd;
+  }
+  const pathext = (process.env["PATHEXT"] ?? ".COM;.EXE;.BAT;.CMD;.VBS;.JS;.WS;.MSC").toLowerCase().split(";");
+  const pathDirs = (process.env["PATH"] ?? "").split(path3.delimiter);
+  for (const dir of pathDirs) {
+    const base = path3.join(dir, cmd);
+    for (const ext of pathext) {
+      const full = `${base}${ext}`;
+      try {
+        fs.accessSync(full, fs.constants.X_OK);
+        return full;
+      } catch {
+      }
+    }
+  }
+  return cmd;
+}
+var WIN32_SHELL_META = /[&|<>"\r\n\0]/;
+function assertSafeWin32ShellArgs(args) {
+  for (const arg of args) {
+    if (typeof arg === "string" && WIN32_SHELL_META.test(arg)) {
+      throw new Error(
+        'win32 cmd shim spawn: argument contains a shell metacharacter (one of & | < > ", or a newline) that could enable command injection through the .cmd/.bat wrapper - refusing to run. Offending argument: ' + JSON.stringify(arg)
+      );
+    }
+  }
+}
+function buildWin32CmdShimInvocation(command, args = []) {
+  assertSafeWin32ShellArgs([command, ...args]);
+  const line = ["call", quoteWin32CmdArg(command), ...args.map(quoteWin32CmdArg)].join(" ");
+  return {
+    command: process.env["COMSPEC"] ?? "cmd.exe",
+    args: ["/d", "/c", line],
+    windowsVerbatimArguments: true
+  };
+}
+function quoteWin32CmdArg(arg) {
+  return `"${arg}"`;
+}
+
+// src/exec-kill-guard.ts
+import * as os3 from "node:os";
+import * as path5 from "node:path";
+
+// src/process-registry-persistent.ts
+import * as fs2 from "node:fs/promises";
+import * as os2 from "node:os";
+import { wstackGlobalRoot as wstackGlobalRoot3 } from "@wrongstack/core/utils";
+import * as path4 from "node:path";
+
 // src/process-registry.ts
 import { spawn } from "node:child_process";
 import * as os from "node:os";
@@ -667,542 +1050,207 @@ var ProcessRegistryImpl = class {
     }
     if (this.breaker.isEnabled && this.breaker.snapshot().state === "open") {
       this._armAutoKillReset();
-    }
-  }
-  /**
-   * Live countdown to the next auto kill/reset, or null when nothing is armed.
-   * The TUI polls this on a 1s tick while armed so the statusline decrements.
-   */
-  getBreakerCountdown() {
-    if (this.autoKillArmedAt === null || this.autoKillResetMs <= 0) return null;
-    const elapsed = Date.now() - this.autoKillArmedAt;
-    return { remainingMs: Math.max(0, this.autoKillResetMs - elapsed), totalMs: this.autoKillResetMs };
-  }
-  /**
-   * Subscribe to countdown arm/cancel events. Returns an unsubscribe function.
-   * Use {@link getBreakerCountdown} for the live ticking value between events.
-   */
-  onBreakerCountdownChange(listener) {
-    this.breakerCountdownListeners.push(listener);
-    return () => {
-      this.breakerCountdownListeners = this.breakerCountdownListeners.filter((l) => l !== listener);
-    };
-  }
-  _emitBreakerCountdown() {
-    const snap = this.getBreakerCountdown();
-    for (const l of this.breakerCountdownListeners) {
-      try {
-        l(snap);
-      } catch {
-      }
-    }
-  }
-  /**
-   * Arm the auto kill/reset countdown. Idempotent: re-arming resets the window
-   * (a fresh trip after a failed half-open probe restarts the clock). No-op
-   * when protection is off or no timeout is configured.
-   */
-  _armAutoKillReset() {
-    if (this.autoKillResetMs <= 0 || !this.breaker.isEnabled) return;
-    this._clearAutoKillTimer();
-    this.autoKillArmedAt = Date.now();
-    this.autoKillTimer = setTimeout(() => {
-      this.autoKillTimer = null;
-      this.autoKillArmedAt = null;
-      this.killAll({ force: false, preserveBackground: true });
-      this.breaker.forceReset();
-      this._emitBreakerCountdown();
-    }, this.autoKillResetMs);
-    this.autoKillTimer.unref?.();
-    this._emitBreakerCountdown();
-  }
-  _cancelAutoKillReset() {
-    const wasArmed = this.autoKillArmedAt !== null;
-    this._clearAutoKillTimer();
-    if (wasArmed) {
-      this.autoKillArmedAt = null;
-      this._emitBreakerCountdown();
-    }
-  }
-  _clearAutoKillTimer() {
-    if (this.autoKillTimer !== null) {
-      clearTimeout(this.autoKillTimer);
-      this.autoKillTimer = null;
-    }
-  }
-  /** Kill a single process by PID.
-   *
-   *  On POSIX: sends SIGTERM to the *process group* (-pid) so that
-   *  runaway grandchild processes (`sleep 9999 & disown`) are also killed.
-   *  After `graceMs` a SIGKILL is sent if the process hasn't exited.
-   *
-   *  On Windows: `child.kill()` maps to TerminateProcess — process groups
-   *  are not meaningfully supported. A second `force=true` call sends
-   *  SIGKILL (which maps to TerminateProcess again — the distinction is
-   *  in the exit code, not the signal).
-   *
-   *  Returns true if the process was found and kill was attempted.
-   */
-  kill(pid, opts = {}) {
-    this._pruneStale(pid);
-    const p = this.processes.get(pid);
-    if (!p) return false;
-    if (p.killed) return true;
-    if (p.protected) return false;
-    if (opts.preserveBackground && p.background) return false;
-    const { force = false, graceMs = DEFAULT_GRACE_MS } = opts;
-    const isWin3 = os.platform() === "win32";
-    if (isWin3) {
-      const liveRealChild = p.child.exitCode === null && typeof p.child.pid === "number";
-      const directFallback = () => {
-        if (p.child.exitCode === null) {
-          try {
-            p.child.kill("SIGKILL");
-          } catch {
-          }
-        }
-      };
-      if (liveRealChild && killWin32Tree(pid, {
-        timeoutMs: Math.max(graceMs, WIN32_TASKKILL_TIMEOUT_MS),
-        onSettled: directFallback
-      })) {
-      } else {
-        try {
-          p.child.kill(force ? "SIGKILL" : "SIGTERM");
-        } catch {
-        }
-      }
-      p.killed = true;
-      return true;
-    }
-    try {
-      if (force) {
-        this._killPosix(p, "SIGKILL");
-      } else {
-        this._killPosix(p, "SIGTERM");
-        const timer = setTimeout(() => {
-          if (this.processes.has(pid) && !p.child.killed) {
-            this._killPosix(p, "SIGKILL");
-          }
-        }, graceMs);
-        timer.unref?.();
-      }
-    } catch {
-    }
-    p.killed = true;
-    return true;
-  }
-  /**
-   * Kill all tracked processes.
-   * Returns the PIDs that were kill()ed.
-   */
-  killAll(opts = {}) {
-    const pids = Array.from(this.processes.keys());
-    const killed = [];
-    for (const pid of pids) {
-      const p = this.processes.get(pid);
-      if (p && !p.protected && this.kill(pid, opts)) killed.push(pid);
-    }
-    return killed;
-  }
-  /**
-   * Kill all processes for a specific session.
-   * Returns the PIDs that were kill()ed.
-   */
-  killSession(sessionId, opts = {}) {
-    const pids = this.bySession(sessionId).map((p) => p.pid);
-    const killed = [];
-    for (const pid of pids) {
-      if (this.kill(pid, opts)) killed.push(pid);
-    }
-    return killed;
-  }
-  /**
-   * Check whether a tracked process entry is stale — the child has exited
-   * (exitCode !== null) AND it's been in the registry long enough that the
-   * OS may have reused the PID for a new, unrelated process.
-   *
-   * P3 #24 (before-release.md): on POSIX, PIDs are reused after process
-   * exit. If a tracked process exits but its 'close' event hasn't fired yet
-   * (or was missed), the registry still holds the entry. A new process
-   * gets the same PID, and PID-based lookups (get, kill, shouldBlockKill)
-   * may incorrectly protect or target the wrong process.
-   *
-   * The 60s threshold is conservative — the OS typically waits much longer
-   * before reusing a PID, but we want to clean up before that becomes a risk.
-   */
-  _isStaleEntry(entry) {
-    return entry.child.exitCode !== null && Date.now() - entry.startedAt > 6e4;
-  }
-  /**
-   * Remove a stale entry for a specific PID before any PID-based lookup.
-   * This prevents PID reuse from causing the registry to act on a dead
-   * process that has been replaced by a new one with the same PID.
-   */
-  _pruneStale(pid) {
-    const entry = this.processes.get(pid);
-    if (entry && this._isStaleEntry(entry)) {
-      this.processes.delete(pid);
-    }
-  }
-  /**
-   * Remove every stale entry, not just one PID. `list()`/`stats()` — the
-   * surfaces the TUI status bar and `/ps` poll — must prune too: a child
-   * whose 'close' event never fires (e.g. Windows grandchildren holding stdio
-   * open) would otherwise linger in the registry until someone looks up its
-   * exact PID, and PID reuse meanwhile makes `get()`/`kill()` target the
-   * wrong process. RAM-leak audit 2026-07-31, MEDIUM.
-   */
-  _pruneAllStale() {
-    for (const [pid, entry] of this.processes) {
-      if (this._isStaleEntry(entry)) this.processes.delete(pid);
-    }
-  }
-};
-var _registry;
-function getProcessRegistry() {
-  if (!_registry) {
-    _registry = new ProcessRegistryImpl();
+    }
   }
-  return _registry;
-}
-
-// src/_win32-resolve.ts
-import * as fs from "node:fs";
-import * as path3 from "node:path";
-function resolveWin32Command(cmd) {
-  if (process.platform !== "win32") return cmd;
-  if (cmd.includes("/") || cmd.includes("\\") || path3.extname(cmd.replace(/\//g, "\\"))) {
-    return cmd;
+  /**
+   * Live countdown to the next auto kill/reset, or null when nothing is armed.
+   * The TUI polls this on a 1s tick while armed so the statusline decrements.
+   */
+  getBreakerCountdown() {
+    if (this.autoKillArmedAt === null || this.autoKillResetMs <= 0) return null;
+    const elapsed = Date.now() - this.autoKillArmedAt;
+    return { remainingMs: Math.max(0, this.autoKillResetMs - elapsed), totalMs: this.autoKillResetMs };
   }
-  const pathext = (process.env["PATHEXT"] ?? ".COM;.EXE;.BAT;.CMD;.VBS;.JS;.WS;.MSC").toLowerCase().split(";");
-  const pathDirs = (process.env["PATH"] ?? "").split(path3.delimiter);
-  for (const dir of pathDirs) {
-    const base = path3.join(dir, cmd);
-    for (const ext of pathext) {
-      const full = `${base}${ext}`;
+  /**
+   * Subscribe to countdown arm/cancel events. Returns an unsubscribe function.
+   * Use {@link getBreakerCountdown} for the live ticking value between events.
+   */
+  onBreakerCountdownChange(listener) {
+    this.breakerCountdownListeners.push(listener);
+    return () => {
+      this.breakerCountdownListeners = this.breakerCountdownListeners.filter((l) => l !== listener);
+    };
+  }
+  _emitBreakerCountdown() {
+    const snap = this.getBreakerCountdown();
+    for (const l of this.breakerCountdownListeners) {
       try {
-        fs.accessSync(full, fs.constants.X_OK);
-        return full;
+        l(snap);
       } catch {
       }
     }
   }
-  return cmd;
-}
-var WIN32_SHELL_META = /[&|<>"\r\n\0]/;
-function assertSafeWin32ShellArgs(args) {
-  for (const arg of args) {
-    if (typeof arg === "string" && WIN32_SHELL_META.test(arg)) {
-      throw new Error(
-        'win32 cmd shim spawn: argument contains a shell metacharacter (one of & | < > ", or a newline) that could enable command injection through the .cmd/.bat wrapper - refusing to run. Offending argument: ' + JSON.stringify(arg)
-      );
+  /**
+   * Arm the auto kill/reset countdown. Idempotent: re-arming resets the window
+   * (a fresh trip after a failed half-open probe restarts the clock). No-op
+   * when protection is off or no timeout is configured.
+   */
+  _armAutoKillReset() {
+    if (this.autoKillResetMs <= 0 || !this.breaker.isEnabled) return;
+    this._clearAutoKillTimer();
+    this.autoKillArmedAt = Date.now();
+    this.autoKillTimer = setTimeout(() => {
+      this.autoKillTimer = null;
+      this.autoKillArmedAt = null;
+      this.killAll({ force: false, preserveBackground: true });
+      this.breaker.forceReset();
+      this._emitBreakerCountdown();
+    }, this.autoKillResetMs);
+    this.autoKillTimer.unref?.();
+    this._emitBreakerCountdown();
+  }
+  _cancelAutoKillReset() {
+    const wasArmed = this.autoKillArmedAt !== null;
+    this._clearAutoKillTimer();
+    if (wasArmed) {
+      this.autoKillArmedAt = null;
+      this._emitBreakerCountdown();
     }
   }
-}
-function buildWin32CmdShimInvocation(command, args = []) {
-  assertSafeWin32ShellArgs([command, ...args]);
-  const line = ["call", quoteWin32CmdArg(command), ...args.map(quoteWin32CmdArg)].join(" ");
-  return {
-    command: process.env["COMSPEC"] ?? "cmd.exe",
-    args: ["/d", "/c", line],
-    windowsVerbatimArguments: true
-  };
-}
-function quoteWin32CmdArg(arg) {
-  return `"${arg}"`;
-}
-
-// src/_danger-detect.ts
-var argHas = (args, value) => args.includes(value);
-var argMatches = (args, re) => args.some((a) => re.test(a));
-var hasShortFlags = (args, letters) => {
-  const seen = /* @__PURE__ */ new Set();
-  for (const a of args) {
-    if (!a.startsWith("-") || a.startsWith("--")) continue;
-    for (const ch of a.replace(/^-+/, "")) seen.add(ch);
+  _clearAutoKillTimer() {
+    if (this.autoKillTimer !== null) {
+      clearTimeout(this.autoKillTimer);
+      this.autoKillTimer = null;
+    }
   }
-  return letters.split("").every((l) => seen.has(l));
-};
-var RULES = [
-  // ----- rm / rmdir: recursive force delete (any path) -----
-  // Note: BLOCKED_ARG_PATTERNS already hard-denies root/home/glob paths,
-  // but `rm -rf ./build` is a normal dev workflow that the user might
-  // want to do intentionally. We downgrade it to 'destructive' so the
-  // confirm prompt can approve.
-  {
-    id: "rm-recursive",
-    level: "destructive",
-    test: (cmd, args) => (cmd === "rm" || cmd === "rmdir") && hasShortFlags(args, "rf"),
-    reason: "recursive force-delete"
-  },
-  // ----- Windows PowerShell Remove-Item: -Recurse -Force -----
-  {
-    id: "powershell-remove-item-recursive-force",
-    level: "destructive",
-    test: (cmd, args) => {
-      if (cmd !== "powershell" && cmd !== "pwsh") return false;
-      const hasRecurse = argMatches(args, /^-(?:R|Recurse|Recurse\s)/);
-      const hasForce = argHas(args, "-Force") || argHas(args, "-F");
-      if (argHas(args, "-WhatIf")) return false;
-      return hasRecurse && hasForce;
-    },
-    reason: "Remove-Item with -Recurse -Force"
-  },
-  // ----- find -exec / -ok / -execdir -----
-  {
-    id: "find-exec",
-    level: "destructive",
-    test: (cmd, args) => {
-      if (cmd !== "find") return false;
-      return args.some(
-        (a) => a === "-exec" || a === "-exec;" || a === "-ok" || a === "-ok;" || a === "-execdir" || a === "-execdir;" || a.startsWith("-exec=") || a.startsWith("-ok=") || a.startsWith("-execdir=")
-      );
-    },
-    reason: "find with -exec/-ok (executes arbitrary command on matches)"
-  },
-  // ----- git --exec= / --upload-pack= / --receive-pack= -----
-  // These run arbitrary commands via the git transport layer.
-  {
-    id: "git-exec",
-    level: "destructive",
-    test: (cmd, args) => cmd === "git" && args.some(
-      (a) => a.startsWith("--exec=") || a.startsWith("--upload-pack=") || a.startsWith("--receive-pack=") || a === "--exec" || a === "--upload-pack" || a === "--receive-pack"
-    ),
-    reason: "git with --exec/--upload-pack/--receive-pack (runs arbitrary code)"
-  },
-  // ----- Windows: format / diskpart / bcdedit -----
-  {
-    id: "win32-format",
-    level: "destructive",
-    test: (cmd) => cmd === "format" || cmd === "format.exe",
-    reason: "format (Windows disk format)"
-  },
-  {
-    id: "win32-diskpart",
-    level: "destructive",
-    test: (cmd) => cmd === "diskpart" || cmd === "diskpart.exe",
-    reason: "diskpart (Windows partition editor)"
-  },
-  {
-    id: "win32-bcdedit",
-    level: "destructive",
-    test: (cmd) => cmd === "bcdedit" || cmd === "bcdedit.exe",
-    reason: "bcdedit (Windows boot config editor)"
-  },
-  // ----- mkfs family -----
-  {
-    id: "mkfs",
-    level: "destructive",
-    test: (cmd) => /^mkfs(\.[a-z0-9]+)?$/.test(cmd) || cmd === "mkswap",
-    reason: "mkfs (filesystem creation \u2014 destroys existing data)"
-  },
-  // ----- dd writing to a block device -----
-  {
-    id: "dd-to-block-device",
-    level: "destructive",
-    test: (cmd, args) => {
-      if (cmd !== "dd") return false;
-      return args.some((a) => /of=\/dev\/(sd|hd|nvme|vd|mmcblk|xvd|loop|disk)/.test(a));
-    },
-    reason: "dd writing to a block device"
-  },
-  // ----- Secure-erase tools -----
-  {
-    id: "shred",
-    level: "destructive",
-    test: (cmd) => cmd === "shred" || cmd === "shred.exe",
-    reason: "shred (secure file delete)"
-  },
-  {
-    id: "wipefs",
-    level: "destructive",
-    test: (cmd) => cmd === "wipefs" || cmd === "wipefs.exe",
-    reason: "wipefs (signature wipe \u2014 destroys filesystem headers)"
-  },
-  {
-    id: "sdelete",
-    level: "destructive",
-    test: (cmd) => cmd === "sdelete" || cmd === "sdelete.exe",
-    reason: "sdelete (Sysinternals secure delete)"
-  },
-  // ----- VCS history rewrite (destructive) -----
-  // `git push --force` / `-f` rewrites remote history. `--force-with-lease`
-  // is the safer variant (checks remote hasn't moved) but still rewrites.
-  {
-    id: "git-push-force",
-    level: "destructive",
-    test: (cmd, args) => {
-      if (cmd !== "git") return false;
-      const pushIdx = args.indexOf("push");
-      if (pushIdx < 0) return false;
-      for (let i = pushIdx + 1; i < args.length; i++) {
-        const a = args[i];
-        if (a === "--force" || a === "-f" || a === "--force-with-lease") return true;
-        if (!a.startsWith("-") && !a.includes("=")) continue;
-        if (a.startsWith("--force")) return true;
+  /** Kill a single process by PID.
+   *
+   *  On POSIX: sends SIGTERM to the *process group* (-pid) so that
+   *  runaway grandchild processes (`sleep 9999 & disown`) are also killed.
+   *  After `graceMs` a SIGKILL is sent if the process hasn't exited.
+   *
+   *  On Windows: `child.kill()` maps to TerminateProcess — process groups
+   *  are not meaningfully supported. A second `force=true` call sends
+   *  SIGKILL (which maps to TerminateProcess again — the distinction is
+   *  in the exit code, not the signal).
+   *
+   *  Returns true if the process was found and kill was attempted.
+   */
+  kill(pid, opts = {}) {
+    this._pruneStale(pid);
+    const p = this.processes.get(pid);
+    if (!p) return false;
+    if (p.killed) return true;
+    if (p.protected) return false;
+    if (opts.preserveBackground && p.background) return false;
+    const { force = false, graceMs = DEFAULT_GRACE_MS } = opts;
+    const isWin3 = os.platform() === "win32";
+    if (isWin3) {
+      const liveRealChild = p.child.exitCode === null && typeof p.child.pid === "number";
+      const directFallback = () => {
+        if (p.child.exitCode === null) {
+          try {
+            p.child.kill("SIGKILL");
+          } catch {
+          }
+        }
+      };
+      if (liveRealChild && killWin32Tree(pid, {
+        timeoutMs: Math.max(graceMs, WIN32_TASKKILL_TIMEOUT_MS),
+        onSettled: directFallback
+      })) {
+      } else {
+        try {
+          p.child.kill(force ? "SIGKILL" : "SIGTERM");
+        } catch {
+        }
       }
-      return false;
-    },
-    reason: "git push with --force / -f (rewrites remote history)"
-  },
-  // ----- git reset --hard (destructive) -----
-  {
-    id: "git-reset-hard",
-    level: "destructive",
-    test: (cmd, args) => cmd === "git" && args.some((a) => a === "--hard" || a.startsWith("--hard=")),
-    reason: "git reset --hard (discards working tree + index)"
-  },
-  // ----- git clean -f / -fd (destructive) -----
-  {
-    id: "git-clean-force",
-    level: "destructive",
-    test: (cmd, args) => {
-      if (cmd !== "git") return false;
-      const cleanIdx = args.indexOf("clean");
-      if (cleanIdx < 0) return false;
-      return args.slice(cleanIdx + 1).some(
-        (a) => a === "-f" || a === "--force" || a.startsWith("-f") || a.startsWith("--force=")
-      );
-    },
-    reason: "git clean -f (deletes untracked files)"
-  },
-  // ----- package publish (destructive — public, irreversible) -----
-  {
-    id: "npm-publish",
-    level: "destructive",
-    test: (cmd, args) => {
-      if (!["npm", "pnpm", "yarn", "bun", "cargo"].includes(cmd)) return false;
-      return args.includes("publish") || cmd === "cargo" && args.includes("yank");
-    },
-    reason: "publishing to a public package registry (hard to reverse)"
-  },
-  // ----- k8s cluster-wide destructive ops (destructive) -----
-  {
-    id: "kubectl-delete-namespace",
-    level: "destructive",
-    test: (cmd, args) => {
-      if (cmd !== "kubectl") return false;
-      const delIdx = args.indexOf("delete");
-      if (delIdx < 0) return false;
-      const after = args.slice(delIdx + 1);
-      return after[0] === "namespace" || after[0] === "ns";
-    },
-    reason: "kubectl delete namespace (deletes all resources in the namespace)"
-  },
-  {
-    id: "kubectl-drain",
-    level: "destructive",
-    test: (cmd, args) => cmd === "kubectl" && args.includes("drain"),
-    reason: "kubectl drain (evicts pods, marks node unschedulable)"
-  },
-  // ----- inline code evaluation (caution — high false-positive) -----
-  // Common in scripts: `python -c "..."`, `node -e "..."`, `bash -c "..."`.
-  // We tag 'caution' rather than 'destructive' because these are used in
-  // many legitimate one-liners (e.g. `python -c "print(1)"`).
-  {
-    id: "inline-eval",
-    level: "caution",
-    test: (cmd, args) => {
-      if (![
-        "python",
-        "python3",
-        "python2",
-        "node",
-        "bash",
-        "sh",
-        "zsh",
-        "ruby",
-        "perl",
-        "lua"
-      ].includes(cmd)) {
-        return false;
+      p.killed = true;
+      return true;
+    }
+    try {
+      if (force) {
+        this._killPosix(p, "SIGKILL");
+      } else {
+        this._killPosix(p, "SIGTERM");
+        const timer = setTimeout(() => {
+          if (this.processes.has(pid) && !p.child.killed) {
+            this._killPosix(p, "SIGKILL");
+          }
+        }, graceMs);
+        timer.unref?.();
       }
-      return args.some(
-        (a) => a === "-c" || a === "-e" || a === "--eval" || a === "-eval" || a === "-E"
-      );
-    },
-    reason: "inline script evaluation (-c / -e / --eval)"
-  },
-  // ----- pipe-to-shell (destructive — download-and-run pattern) -----
-  // The classic `curl https://... | sh` download-and-run vector. Detected by
-  // looking for a known fetcher piped into a shell or expression evaluator.
-  // A shell command passed through `bash -c` / `pwsh -Command` arrives as one
-  // argv string, so scan the reconstructed argv text rather than individual
-  // tokens only.
-  {
-    id: "pipe-to-shell",
-    level: "destructive",
-    test: (cmd, args) => /\b(?:curl|wget|fetch|httpie|http|irm|iwr|Invoke-WebRequest|Invoke-RestMethod)\b[\s\S]{0,300}\|\s*(?:sudo\s+)?(?:sh|bash|zsh|fish|pwsh|powershell|iex|Invoke-Expression)\b/i.test(
-      [cmd, ...args].join(" ")
-    ),
-    reason: "network fetch piped to a shell (download-and-run pattern)"
-  },
-  // ----- privilege escalation (caution) -----
-  {
-    id: "sudo",
-    level: "caution",
-    test: (cmd) => cmd === "sudo" || cmd === "doas",
-    reason: "privilege escalation (sudo / doas)"
-  },
-  {
-    id: "runas",
-    level: "caution",
-    test: (cmd) => cmd === "runas" || cmd === "runas.exe",
-    reason: "Windows runas (run as different user)"
-  },
-  // ----- world-writable permissions (caution) -----
-  // `chmod 777` is rarely correct. `chmod -R 777` is almost always wrong.
-  // We only flag octal modes; symbolic modes like `chmod o+w` are
-  // left to the operator's discretion.
-  {
-    id: "chmod-world-writable",
-    level: "caution",
-    test: (cmd, args) => {
-      if (cmd !== "chmod") return false;
-      return args.some((a) => /^[0-7]{3,4}$/.test(a) && /7/.test(a));
-    },
-    reason: "chmod with world-writable octal mode (e.g. 777)"
+    } catch {
+    }
+    p.killed = true;
+    return true;
   }
-];
-function detectDanger(cmd, args, bypass) {
-  const reasons = [];
-  let level = "safe";
-  let matchedRule;
-  for (const rule of RULES) {
-    if (bypass?.has(rule.id)) continue;
-    if (!rule.test(cmd, args)) continue;
-    reasons.push(rule.reason);
-    matchedRule = rule.id;
-    if (levelRank(rule.level) > levelRank(level)) {
-      level = rule.level;
+  /**
+   * Kill all tracked processes.
+   * Returns the PIDs that were kill()ed.
+   */
+  killAll(opts = {}) {
+    const pids = Array.from(this.processes.keys());
+    const killed = [];
+    for (const pid of pids) {
+      const p = this.processes.get(pid);
+      if (p && !p.protected && this.kill(pid, opts)) killed.push(pid);
     }
+    return killed;
   }
-  if (level === "safe") return { level: "safe", reasons: [] };
-  const result = { level, reasons };
-  if (matchedRule !== void 0) result.matchedRule = matchedRule;
-  return result;
-}
-function levelRank(level) {
-  switch (level) {
-    case "safe":
-      return 0;
-    case "caution":
-      return 1;
-    case "destructive":
-      return 2;
+  /**
+   * Kill all processes for a specific session.
+   * Returns the PIDs that were kill()ed.
+   */
+  killSession(sessionId, opts = {}) {
+    const pids = this.bySession(sessionId).map((p) => p.pid);
+    const killed = [];
+    for (const pid of pids) {
+      if (this.kill(pid, opts)) killed.push(pid);
+    }
+    return killed;
+  }
+  /**
+   * Check whether a tracked process entry is stale — the child has exited
+   * (exitCode !== null) AND it's been in the registry long enough that the
+   * OS may have reused the PID for a new, unrelated process.
+   *
+   * P3 #24 (before-release.md): on POSIX, PIDs are reused after process
+   * exit. If a tracked process exits but its 'close' event hasn't fired yet
+   * (or was missed), the registry still holds the entry. A new process
+   * gets the same PID, and PID-based lookups (get, kill, shouldBlockKill)
+   * may incorrectly protect or target the wrong process.
+   *
+   * The 60s threshold is conservative — the OS typically waits much longer
+   * before reusing a PID, but we want to clean up before that becomes a risk.
+   */
+  _isStaleEntry(entry) {
+    return entry.child.exitCode !== null && Date.now() - entry.startedAt > 6e4;
+  }
+  /**
+   * Remove a stale entry for a specific PID before any PID-based lookup.
+   * This prevents PID reuse from causing the registry to act on a dead
+   * process that has been replaced by a new one with the same PID.
+   */
+  _pruneStale(pid) {
+    const entry = this.processes.get(pid);
+    if (entry && this._isStaleEntry(entry)) {
+      this.processes.delete(pid);
+    }
+  }
+  /**
+   * Remove every stale entry, not just one PID. `list()`/`stats()` — the
+   * surfaces the TUI status bar and `/ps` poll — must prune too: a child
+   * whose 'close' event never fires (e.g. Windows grandchildren holding stdio
+   * open) would otherwise linger in the registry until someone looks up its
+   * exact PID, and PID reuse meanwhile makes `get()`/`kill()` target the
+   * wrong process. RAM-leak audit 2026-07-31, MEDIUM.
+   */
+  _pruneAllStale() {
+    for (const [pid, entry] of this.processes) {
+      if (this._isStaleEntry(entry)) this.processes.delete(pid);
+    }
   }
+};
+var _registry;
+function getProcessRegistry() {
+  if (!_registry) {
+    _registry = new ProcessRegistryImpl();
+  }
+  return _registry;
 }
 
-// src/exec-kill-guard.ts
-import * as os3 from "node:os";
-import * as path5 from "node:path";
-
 // src/process-registry-persistent.ts
-import * as fs2 from "node:fs/promises";
-import * as os2 from "node:os";
-import { wstackGlobalRoot as wstackGlobalRoot3 } from "@wrongstack/core/utils";
-import * as path4 from "node:path";
 var REGISTRY_FILE = "process-registry.json";
 function toErrorMessage(err) {
   return err instanceof Error ? err.message : String(err);
@@ -1916,8 +1964,7 @@ async function checkKillTarget(target) {
   return { blocked: false };
 }
 
-// src/exec.ts
-var isWin2 = process.platform === "win32";
+// src/exec-allowlist.ts
 var DEFAULT_ALLOWED_COMMANDS = /* @__PURE__ */ new Set([
   // JS / TS toolchain
   "node",
@@ -1996,7 +2043,11 @@ var DEFAULT_ALLOWED_COMMANDS = /* @__PURE__ */ new Set([
   "docker",
   "podman",
   "kubectl",
-  // network (read-only intent; destructive ops still blocked by BLOCKED_ARG_PATTERNS)
+  // network fetch tools. Per-arg safety is NOT enforced by BLOCKED_ARG_PATTERNS
+  // (no curl/wget entries) — the real boundary is the per-call `confirm`
+  // permission gate (exec.ts permission:'confirm', subjectKey:'command'),
+  // the `pipe-to-shell` danger rule, and the kill guard. The allowlist is a
+  // guidance layer, not a security boundary on its own.
   "curl",
   "wget",
   // common POSIX file/text utilities
@@ -2049,9 +2100,15 @@ var DEFAULT_ALLOWED_COMMANDS = /* @__PURE__ */ new Set([
   "powershell.exe",
   "pwsh",
   "pwsh.exe",
-  // [core] Extended default allowlist (added 4b3d18d1 + this commit). All
-  // non-destructive, broadly-used dev binaries. Per-arg safety is still
-  // enforced by BLOCKED_ARG_PATTERNS + bash-kill-guard.ts.
+  // [core] Extended default allowlist (added 4b3d18d1 + this commit). Broadly
+  // used dev binaries — NOT all non-destructive: this section contains
+  // process/system tools (kill, chown, mount, userdel), network scanners
+  // (nmap, masscan, zmap, nuclei), and launchers (env, perl, timeout, tmux).
+  // The real safety boundary for these is the per-call `confirm` permission
+  // gate (exec.ts permission:'confirm', subjectKey:'command' renders the full
+  // invocation) plus the danger rules in _danger-detect.ts. Per-arg hard-deny
+  // is still enforced by BLOCKED_ARG_PATTERNS + bash-kill-guard.ts, but only
+  // for the commands that have entries there (git, find, rm).
   // --- Archives & compression ---
   "7z",
   "7za",
@@ -2223,10 +2280,7 @@ var DEFAULT_ALLOWED_COMMANDS = /* @__PURE__ */ new Set([
   "git-lfs",
   "tig",
   "lazygit",
-  // --- POSIX text utilities (extended; duplicates of pwd/ls/cat/head/tail/wc/
-  //     grep/find/echo/awk/mkdir/cp/mv/rm/touch from the base list above are
-  //     omitted — the Set is de-duplicated at runtime but a clean literal is
-  //     easier to maintain) ---
+  // --- POSIX text utilities (extended) ---
   "gawk",
   "tr",
   "cut",
@@ -2259,39 +2313,16 @@ var DEFAULT_ALLOWED_COMMANDS = /* @__PURE__ */ new Set([
   "locate",
   "which",
   "whereis",
-  "type",
-  "hash",
-  "pushd",
-  "popd",
-  "dirs",
-  "history",
-  "fc",
-  "jobs",
-  "bg",
-  "fg",
-  "wait",
-  "ulimit",
-  "umask",
+  // NOTE: shell builtins with no standalone binary (type, hash, pushd,
+  // popd, dirs, history, fc, jobs, bg, fg, wait, ulimit, umask, trap,
+  // exit, return, source, ., alias, unalias, set, unset, export, readonly,
+  // typeset, declare, local, eval, exec) are intentionally excluded —
+  // spawn() would fail with ENOENT on every platform because they only
+  // exist inside a shell process. Use the `bash` tool for builtins.
   "nice",
   "nohup",
   "timeout",
   "time",
-  "trap",
-  "exit",
-  "return",
-  "source",
-  ".",
-  "alias",
-  "unalias",
-  "set",
-  "unset",
-  "export",
-  "readonly",
-  "typeset",
-  "declare",
-  "local",
-  "eval",
-  "exec",
   // --- Process / system inspection ---
   "htop",
   "top",
@@ -2522,6 +2553,9 @@ var DEFAULT_ALLOWED_COMMANDS = /* @__PURE__ */ new Set([
   "sublert",
   "chaos"
 ]);
+
+// src/exec.ts
+var isWin2 = process.platform === "win32";
 var allowedCommands = new Set(DEFAULT_ALLOWED_COMMANDS);
 var normalizeCmd = (c) => c.trim();
 function configureExecPolicy(opts = {}) {
@@ -2582,7 +2616,17 @@ var BLOCKED_ARG_PATTERNS = {
   bun: [],
   docker: [],
   // find -exec/-ok/-execdir execute arbitrary commands
-  find: [/^-exec$/, /^-exec;$/, /^-ok$/, /^-ok;$/, /^-execdir$/, /^-execdir;$/, /^-exec=/, /^-ok=/, /^-execdir=/],
+  find: [
+    /^-exec$/,
+    /^-exec;$/,
+    /^-ok$/,
+    /^-ok;$/,
+    /^-execdir$/,
+    /^-execdir;$/,
+    /^-exec=/,
+    /^-ok=/,
+    /^-execdir=/
+  ],
   // rm -rf / is catastrophic — block absolute paths, home, dot-dirs,
   // and glob patterns that could expand to dangerous targets.
   // `rm -rf ./src/*` expands to project files; `rm -rf ../../` escapes upward;
@@ -2653,6 +2697,14 @@ var execTool = {
     useInstead: ["bash"]
   },
   permission: "confirm",
+  // WS-046: without this, every exec call collapsed onto the bare tool name.
+  // Three consequences followed: "always allow" stored a rule that could never
+  // match, pressing "no" once blocked ALL exec for the session, and the
+  // permission cache keyed one decision for every command. `subjectKey:
+  // 'command'` renders the FULL invocation (`command` + `args`) — using the
+  // program alone would make `exec git status` and `exec git push --force` the
+  // same subject, so trusting one would silently authorize the other.
+  subjectKey: "command",
   mutating: true,
   riskTier: "standard",
   timeoutMs: DEFAULT_TIMEOUT_MS,
@@ -2869,7 +2921,14 @@ function runCommand(cmd, args, cwd, timeout, signal, sessionId, danger) {
     const pid = child.pid;
     if (typeof pid === "number") {
       const fullCommand = `${cmd} ${args.join(" ")}`;
-      registry.register({ pid, name: "exec", command: redactCommand(fullCommand), startedAt: Date.now(), sessionId, child });
+      registry.register({
+        pid,
+        name: "exec",
+        command: redactCommand(fullCommand),
+        startedAt: Date.now(),
+        sessionId,
+        child
+      });
     }
     const timer = setTimeout(() => {
       killed = true;