@wrongstack/tools 0.297.0 → 0.298.1

package/dist/index.js

@@ -148,11 +148,12 @@ function createOutputSpool(opts) {
   return {
     write(text) {
       if (finalized || !text) return;
-      totalBytes += Buffer.byteLength(text, "utf8");
+      const textBytes = Buffer.byteLength(text, "utf8");
+      totalBytes += textBytes;
       if (!stream && !failed) {
-        if (headBytes + text.length <= threshold) {
+        if (headBytes + textBytes <= threshold) {
           head += text;
-          headBytes += text.length;
+          headBytes += textBytes;
           return;
         }
         head += text;
@@ -162,7 +163,7 @@ function createOutputSpool(opts) {
       }
       if (stream) {
         if (stream.writableLength > SPOOL_WRITE_HWM_BYTES) {
-          droppedBytes += Buffer.byteLength(text, "utf8");
+          droppedBytes += textBytes;
           return;
         }
         stream.write(text);
@@ -849,8 +850,11 @@ async function* spawnStream(opts) {
   const max = opts.maxBytes ?? 2e5;
   const flushAt = opts.flushBytes ?? 4 * 1024;
   const maxQueue = opts.maxQueueSize ?? 500;
+  const maxQueueBytes = opts.maxQueueBytes ?? 1024 * 1024;
   let stdout = "";
   let stderr = "";
+  let stdoutRetainedBytes = 0;
+  let stderrRetainedBytes = 0;
   let pending2 = "";
   let error;
   const spool = createOutputSpool({ tool: opts.cmd, thresholdBytes: max });
@@ -892,6 +896,7 @@ async function* spawnStream(opts) {
     });
   }
   const queue = [];
+  let queuedBytes = 0;
   let waiter;
   let paused = false;
   const wake = () => {
@@ -902,7 +907,7 @@ async function* spawnStream(opts) {
     }
   };
   const resume = () => {
-    if (paused && queue.length < maxQueue) {
+    if (paused && queue.length <= Math.floor(maxQueue / 2) && queuedBytes <= Math.floor(maxQueueBytes / 2)) {
       paused = false;
       child.stdout?.resume();
       child.stderr?.resume();
@@ -912,11 +917,16 @@ async function* spawnStream(opts) {
     const s = c.toString();
     stdoutBytes += c.byteLength;
     emitProcessOutput({ pid, stream: "stdout", chunk: c });
-    if (stdout.length < max) stdout += s;
+    if (stdoutRetainedBytes < max) {
+      const retained = utf8Prefix(s, max - stdoutRetainedBytes);
+      stdout += retained;
+      stdoutRetainedBytes += Buffer.byteLength(retained, "utf8");
+    }
     spool.write(s);
-    queue.push({ kind: "out", data: s });
+    queue.push({ kind: "out", data: s, bytes: c.byteLength });
+    queuedBytes += c.byteLength;
     wake();
-    if (!paused && queue.length >= maxQueue) {
+    if (!paused && (queue.length >= maxQueue || queuedBytes >= maxQueueBytes)) {
       paused = true;
       child.stdout?.pause();
       child.stderr?.pause();
@@ -926,11 +936,16 @@ async function* spawnStream(opts) {
     const s = c.toString();
     stderrBytes += c.byteLength;
     emitProcessOutput({ pid, stream: "stderr", chunk: c });
-    if (stderr.length < max) stderr += s;
+    if (stderrRetainedBytes < max) {
+      const retained = utf8Prefix(s, max - stderrRetainedBytes);
+      stderr += retained;
+      stderrRetainedBytes += Buffer.byteLength(retained, "utf8");
+    }
     spool.write(s);
-    queue.push({ kind: "err", data: s });
+    queue.push({ kind: "err", data: s, bytes: c.byteLength });
+    queuedBytes += c.byteLength;
     wake();
-    if (!paused && queue.length >= maxQueue) {
+    if (!paused && (queue.length >= maxQueue || queuedBytes >= maxQueueBytes)) {
       paused = true;
       child.stdout?.pause();
       child.stderr?.pause();
@@ -940,7 +955,9 @@ async function* spawnStream(opts) {
   child.stderr?.on("data", onErr);
   child.on("error", (e) => {
     error = e.message;
-    queue.push({ kind: "error", data: e.message });
+    const bytes = Buffer.byteLength(e.message, "utf8");
+    queue.push({ kind: "error", data: e.message, bytes });
+    queuedBytes += bytes;
     wake();
   });
   const completeTelemetry = (code, signal, timedOut = false) => {
@@ -961,7 +978,13 @@ async function* spawnStream(opts) {
     if (typeof pid === "number") registry.unregister(pid);
     const exitCode2 = code ?? (signal ? 1 : 0);
     completeTelemetry(exitCode2, signal ?? void 0);
-    queue.push({ kind: "close", data: "", code: exitCode2, ...signal ? { signal } : {} });
+    queue.push({
+      kind: "close",
+      data: "",
+      bytes: 0,
+      code: exitCode2,
+      ...signal ? { signal } : {}
+    });
     wake();
   });
   const onAbort = () => {
@@ -973,7 +996,7 @@ async function* spawnStream(opts) {
       } catch {
       }
     }
-    queue.push({ kind: "close", data: "", code: 124 });
+    queue.push({ kind: "close", data: "", bytes: 0, code: 124 });
     completeTelemetry(124, "SIGKILL", true);
     wake();
   };
@@ -991,6 +1014,7 @@ async function* spawnStream(opts) {
         });
       }
       const chunk = queue.shift();
+      queuedBytes -= chunk.bytes;
       resume();
       if (chunk.kind === "close") {
         if (!spawnFailed) exitCode = chunk.code ?? 0;
@@ -1017,7 +1041,7 @@ async function* spawnStream(opts) {
       stdout: spooled ? stdout + spoolNote(spooled) : stdout,
       stderr,
       exitCode,
-      truncated: stdout.length >= max || stderr.length >= max,
+      truncated: stdoutBytes > stdoutRetainedBytes || stderrBytes > stderrRetainedBytes,
       error,
       spoolPath: spooled?.path,
       spoolBytes: spooled?.bytes
@@ -1041,13 +1065,27 @@ async function* spawnStream(opts) {
     }
   }
 }
+function utf8Prefix(text, maxBytes) {
+  if (maxBytes <= 0) return "";
+  if (Buffer.byteLength(text, "utf8") <= maxBytes) return text;
+  let low = 0;
+  let high = text.length;
+  while (low < high) {
+    const mid = Math.ceil((low + high) / 2);
+    if (Buffer.byteLength(text.slice(0, mid), "utf8") <= maxBytes) low = mid;
+    else high = mid - 1;
+  }
+  let end = low;
+  if (end > 0 && /[\uD800-\uDBFF]/.test(text[end - 1])) end--;
+  return text.slice(0, end);
+}
 var isWin;
 var init_spawn_stream = __esm({
   "src/_spawn-stream.ts"() {
     "use strict";
     init_output_spool();
-    init_process_registry();
     init_win32_resolve();
+    init_process_registry();
     isWin = process.platform === "win32";
   }
 });
@@ -1061,14 +1099,14 @@ function sha256hex(content) {
   return createHash("sha256").update(content, "utf8").digest("hex");
 }
 async function detectPackageManager(cwd) {
-  const { stat: stat18 } = await import("node:fs/promises");
+  const { stat: stat19 } = await import("node:fs/promises");
   try {
-    await stat18(`${cwd}/pnpm-lock.yaml`);
+    await stat19(`${cwd}/pnpm-lock.yaml`);
     return "pnpm";
   } catch {
   }
   try {
-    await stat18(`${cwd}/yarn.lock`);
+    await stat19(`${cwd}/yarn.lock`);
     return "yarn";
   } catch {
   }
@@ -1096,11 +1134,15 @@ function safeResolve(input, ctx) {
   return ensureInsideRoot(resolvePath(input, ctx), ctx);
 }
 async function assertRealInsideRoot(absPath, ctx) {
-  if (ctx.allowOutsideProjectRoot) return;
+  await resolveRealInsideRoot(absPath, ctx);
+}
+async function resolveRealInsideRoot(absPath, ctx) {
+  if (ctx.allowOutsideProjectRoot) return absPath;
   const realRoots = await Promise.all(
     allowedRoots(ctx).map((r) => fsp2.realpath(r).catch(() => path3.resolve(r)))
   );
   let probe2 = absPath;
+  const pendingTail = [];
   for (; ; ) {
     let real;
     try {
@@ -1108,13 +1150,16 @@ async function assertRealInsideRoot(absPath, ctx) {
     } catch (err) {
       if (err.code === "ENOENT") {
         const parent = path3.dirname(probe2);
-        if (parent === probe2) return;
+        if (parent === probe2) return absPath;
+        pendingTail.unshift(path3.basename(probe2));
         probe2 = parent;
         continue;
       }
       throw err;
     }
-    if (isInsideAny(real, realRoots)) return;
+    if (isInsideAny(real, realRoots)) {
+      return pendingTail.length > 0 ? path3.join(real, ...pendingTail) : real;
+    }
     throw new Error(
       `Path "${absPath}" resolves through a symlink outside project root "${realRoots[0]}"`
     );
@@ -1122,8 +1167,7 @@ async function assertRealInsideRoot(absPath, ctx) {
 }
 async function safeResolveReal(input, ctx) {
   const abs = safeResolve(input, ctx);
-  await assertRealInsideRoot(abs, ctx);
-  return abs;
+  return await resolveRealInsideRoot(abs, ctx);
 }
 function truncateMiddle(s, max) {
   if (Buffer.byteLength(s, "utf8") <= max) return s;
@@ -2687,8 +2731,8 @@ async function scanDirectory(directory, depth, profiles, limits, state, extraIgn
     collectFileEvidence(directory, fullPath, entry.name, profiles, state);
   }
 }
-function collectFileEvidence(directory, fullPath, basename13, profiles, state) {
-  const lower = basename13.toLowerCase();
+function collectFileEvidence(directory, fullPath, basename14, profiles, state) {
+  const lower = basename14.toLowerCase();
   const extension = path4.extname(lower);
   for (const profile of profiles) {
     const detector = profile.detectors.find(
@@ -2699,7 +2743,7 @@ function collectFileEvidence(directory, fullPath, basename13, profiles, state) {
       candidate.evidence.push({
         kind: detector.kind,
         path: fullPath,
-        value: basename13,
+        value: basename14,
         weight: detector.weight
       });
       if (detector.kind === "manifest" || detector.kind === "config") {
@@ -2827,8 +2871,8 @@ function normalizeLimits(input) {
 async function canonicalDirectory(input) {
   const resolved = path4.resolve(input);
   const real = await fs2.realpath(resolved);
-  const stat18 = await fs2.stat(real);
-  if (!stat18.isDirectory()) throw new Error(`Project root is not a directory: ${input}`);
+  const stat19 = await fs2.stat(real);
+  if (!stat19.isDirectory()) throw new Error(`Project root is not a directory: ${input}`);
   return real;
 }
 async function canonicalInside(input, root, label) {
@@ -3384,6 +3428,7 @@ import * as fs3 from "node:fs/promises";
 import * as path6 from "node:path";
 async function planLanguageOperation(options) {
   validateOperationOptions(options.operation, options.operationOptions?.packages);
+  validateFilterOption(options.operationOptions?.filter);
   const detection = await detectLanguageWorkspaces(options);
   const candidates = detection.workspaces.filter(
     (workspace) => workspace.capabilities.includes(options.operation)
@@ -3556,6 +3601,15 @@ function workspaceDepth(workspaceRoot, projectRoot) {
   const relative13 = path6.relative(path6.resolve(projectRoot), path6.resolve(workspaceRoot));
   return relative13 === "" ? 0 : relative13.split(path6.sep).length;
 }
+function validateFilterOption(filter) {
+  if (filter === void 0) return;
+  if (filter.startsWith("-") || filter.includes(" --")) {
+    throw new Error(`Invalid test filter (parsed as a runner option): "${filter}"`);
+  }
+  if (filter.length > MAX_ARGUMENT_LENGTH || /[\r\n\0]/.test(filter)) {
+    throw new Error("Invalid test filter (oversized or contains a control character)");
+  }
+}
 function validateOperationOptions(operation, packages) {
   if (!operation.startsWith("package-") || !packages) return;
   for (const value of packages) {
@@ -3597,7 +3651,7 @@ var init_plan = __esm({
     MAX_ARGUMENT_LENGTH = 4096;
     PACKAGE_NAME_RE = /^(?:@[a-z0-9._-]+\/)?[a-z0-9._-]+(?:@[a-z0-9*+._~^<>=|-]+)?$/i;
     COMPOSER_PACKAGE_RE = /^[a-z0-9_.-]+\/[a-z0-9_.-]+(?::[a-z0-9*+._~^<>=|-]+)?$/i;
-    GO_MODULE_RE = /^(?:[a-z0-9.-]+\.)+[a-z0-9.-]+\/[a-z0-9._~+/@-]+$/i;
+    GO_MODULE_RE = /^(?:[a-z0-9-]+\.)+[a-z0-9-]+\/[a-z0-9._~+/@-]+$/i;
     PYTHON_PACKAGE_RE = /^[a-z0-9._-]+(?:\[[a-z0-9._,-]+\])?==[a-z0-9*+._!~-]+$/i;
   }
 });
@@ -3717,8 +3771,8 @@ async function executeInternal(options, startedAt) {
   const target = options.plan.evidence.find((item) => item.kind === "target")?.path;
   if (!target) return unavailableResult(options, "Internal syntax plan has no target evidence.");
   const safeTarget = await assertContainedFile(target, options.projectRoot);
-  const stat18 = await fs4.stat(safeTarget);
-  if (stat18.size > MAX_INTERNAL_SOURCE_BYTES) {
+  const stat19 = await fs4.stat(safeTarget);
+  if (stat19.size > MAX_INTERNAL_SOURCE_BYTES) {
     return unavailableResult(
       options,
       `Internal syntax target exceeds ${MAX_INTERNAL_SOURCE_BYTES} bytes.`
@@ -4005,8 +4059,8 @@ async function snapshotPaths(paths) {
   const existing = [];
   for (const candidate of paths) {
     try {
-      const stat18 = await fs4.stat(candidate);
-      if (!stat18.isFile()) continue;
+      const stat19 = await fs4.stat(candidate);
+      if (!stat19.isFile()) continue;
       existing.push(candidate);
     } catch {
     }
@@ -4034,8 +4088,8 @@ async function snapshotSizes(paths) {
   const sizes = /* @__PURE__ */ new Map();
   for (const candidate of paths) {
     try {
-      const stat18 = await fs4.stat(candidate);
-      if (stat18.isFile()) sizes.set(candidate, stat18.size);
+      const stat19 = await fs4.stat(candidate);
+      if (stat19.isFile()) sizes.set(candidate, stat19.size);
     } catch {
     }
   }
@@ -4195,6 +4249,9 @@ var init_execute_tool = __esm({
         useInstead: ["language_info", "install", "audit", "outdated"]
       },
       permission: "confirm",
+      // WS-046: gives permission decisions something to key on.
+      // The action performed (build/test/lint); the cwd is where, not what.
+      subjectKey: "action",
       mutating: true,
       riskTier: "standard",
       capabilities: ["shell.restricted", "fs.write"],
@@ -4427,6 +4484,9 @@ var init_package_tool = __esm({
         useInstead: ["language_info", "language", "install", "audit", "outdated"]
       },
       permission: "confirm",
+      // WS-046: gives permission decisions something to key on.
+      // The package operation performed — install/remove are not interchangeable.
+      subjectKey: "operation",
       mutating: true,
       riskTier: "destructive",
       capabilities: ["shell.restricted", "fs.write", "net.outbound", "package.install"],
@@ -6481,9 +6541,9 @@ function parseSymbols6(opts) {
 function regexParse2(opts) {
   const { file, content, lang } = opts;
   const symbols = [];
-  const basename13 = path22.basename(file).toLowerCase();
-  const isPackageJson = basename13 === "package.json";
-  const isTsconfig = basename13 === "tsconfig.json" || basename13 === "tsconfig.build.json";
+  const basename14 = path22.basename(file).toLowerCase();
+  const isPackageJson = basename14 === "package.json";
+  const isTsconfig = basename14 === "tsconfig.json" || basename14 === "tsconfig.build.json";
   const isJsonSchema = content.includes("$schema") || content.includes("$id") || content.includes("$ref");
   const isOpenApi = content.includes("openapi") || content.includes("swagger");
   const lines = content.split("\n");
@@ -7088,6 +7148,48 @@ var RULES = [
       return args.some((a) => /^[0-7]{3,4}$/.test(a) && /7/.test(a));
     },
     reason: "chmod with world-writable octal mode (e.g. 777)"
+  },
+  // ----- network recon / offensive scanners (caution) -----
+  // These tools are purpose-built for network reconnaissance and offensive
+  // security. They have legitimate uses in dev (security testing, infra
+  // debugging) but their presence in an agent's command stream is worth a
+  // caution banner so the user can notice an unexpected scan.
+  {
+    id: "network-scanner",
+    level: "caution",
+    test: (cmd) => cmd === "nmap" || cmd === "masscan" || cmd === "zmap" || cmd === "nuclei" || cmd === "hping3" || cmd === "naabu" || cmd === "katana" || cmd === "amass" || cmd === "subfinder" || cmd === "httpx" || cmd === "rustscan" || cmd === "zgrab",
+    reason: "network scanner / offensive reconnaissance tool"
+  },
+  // ----- process termination (caution) -----
+  // kill/killall/pkill terminate processes. The exec kill guard
+  // (exec-kill-guard.ts) hard-blocks attempts on protected WrongStack
+  // processes; this rule adds a caution banner for generic process
+  // termination so the user sees a warning even for non-protected targets.
+  {
+    id: "process-kill",
+    level: "caution",
+    test: (cmd) => cmd === "kill" || cmd === "killall" || cmd === "pkill",
+    reason: "process termination command"
+  },
+  // ----- shell/interpreter launchers (caution) -----
+  // `env bash -c '…'`, `timeout sh`, `nohup perl -e '…'` etc. wrap a child
+  // binary that bypasses the allowlist name-gate entirely (the wrapper
+  // resolves the child from PATH, not from the allowlist). We flag caution
+  // when a known launcher has a shell/interpreter as its target program.
+  {
+    id: "shell-launcher",
+    level: "caution",
+    test: (cmd, args) => {
+      const launchers = ["env", "timeout", "nohup", "nice", "script", "expect", "tmux", "screen", "byobu", "dtach"];
+      if (!launchers.includes(cmd)) return false;
+      const shells = ["sh", "bash", "zsh", "fish", "python", "python3", "perl", "ruby", "node", "pwsh", "powershell", "cmd"];
+      if (cmd === "env") {
+        const prog = args.find((a) => !a.includes("=") && !a.startsWith("-"));
+        return prog !== void 0 && shells.includes(prog);
+      }
+      return args.some((a) => shells.includes(a));
+    },
+    reason: "launcher wrapping a shell/interpreter (bypasses allowlist name-gate)"
   }
 ];
 function detectDanger(cmd, args, bypass) {
@@ -8695,30 +8797,59 @@ ${hint}` : ""),
 import {
   GOVERNED_TOOL_EXECUTOR_META_KEY
 } from "@wrongstack/core/types";
+var BATCHABLE_TOOL_NAMES = [
+  "read",
+  "glob",
+  "grep",
+  "tree",
+  "codebase-stats",
+  "codebase-search",
+  "language_info",
+  "tool_search",
+  "memory_for_file",
+  "memory_for_path",
+  "memory_search"
+];
+var BATCHABLE_TOOLS = new Set(BATCHABLE_TOOL_NAMES);
+var MAX_BATCH_CALLS = 8;
+var MAX_PARALLEL_BATCH_CALLS = 3;
 var batchToolUseTool = {
   name: "batch_tool_use",
   category: "Meta",
-  description: "Execute a batch of tool calls either sequentially or in parallel. Returns structured results for every call.",
-  usageHint: "ADVANCED / POWER USER TOOL:\n\n- Useful when you have a clear list of independent operations to perform.\n- `parallel: true` (default) runs them concurrently for speed.\n- `stop_on_error: true` makes it fail fast on the first error.\nUse with care \u2014 batching many mutating operations can be risky. Prefer explicit sequential steps for important work.",
+  description: "Execute a small batch of independent, read-only discovery calls. Process, mutation, browser-action, MCP, delegation, and nested meta tools are not eligible.",
+  usageHint: `BOUNDED READ-ONLY BATCHING:
+
+- Use only for a small set of independent reads or searches that are all needed now.
+- Do not wrap normal sequential reasoning or every tool call in a batch.
+- \`parallel: true\` (default) runs at most three eligible calls concurrently.
+- \`stop_on_error: true\` makes it fail fast on the first error.
+- Eligible tools: ${BATCHABLE_TOOL_NAMES.join(", ")}.`,
   permission: "confirm",
+  // Scheduling barrier: keep the outer meta-call out of ToolExecutor's
+  // non-mutating fan-out even though every eligible inner tool is read-only.
   mutating: true,
   timeoutMs: 12e4,
-  capabilities: ["tool.mutate.any"],
+  capabilities: ["tool.meta"],
   icon: "meta",
   inputSchema: {
     type: "object",
     properties: {
       calls: {
         type: "array",
+        maxItems: MAX_BATCH_CALLS,
         items: {
           type: "object",
           properties: {
-            tool: { type: "string" },
+            tool: {
+              type: "string",
+              enum: [...BATCHABLE_TOOL_NAMES],
+              description: "An explicitly batch-safe, read-only discovery tool."
+            },
             input: { type: "object" }
           },
           required: ["tool"]
         },
-        description: "Array of tool calls to execute"
+        description: `Up to ${MAX_BATCH_CALLS} independent, batch-safe read calls.`
       },
       stop_on_error: {
         type: "boolean",
@@ -8741,6 +8872,9 @@ var batchToolUseTool = {
         stop_on_error: false
       };
     }
+    if (input.calls.length > MAX_BATCH_CALLS) {
+      throw new Error(`batch_tool_use: calls must contain at most ${MAX_BATCH_CALLS} items`);
+    }
     const governedExecute = ctx.meta[GOVERNED_TOOL_EXECUTOR_META_KEY];
     if (typeof governedExecute !== "function") {
       return {
@@ -8760,8 +8894,11 @@ var batchToolUseTool = {
     let succeeded = 0;
     let failed = 0;
     if (input.parallel !== false) {
-      const promises = input.calls.map(async (call) => executeSingle(call, ctx, governedExecute));
-      const allResults = await Promise.all(promises);
+      const allResults = await mapWithConcurrency(
+        input.calls,
+        MAX_PARALLEL_BATCH_CALLS,
+        (call) => executeSingle(call, ctx, governedExecute)
+      );
       results.push(...allResults);
       succeeded = allResults.filter((r) => r.success).length;
       failed = allResults.filter((r) => !r.success).length;
@@ -8786,8 +8923,28 @@ var batchToolUseTool = {
     };
   }
 };
+async function mapWithConcurrency(items, limit, run) {
+  const results = new Array(items.length);
+  let nextIndex = 0;
+  const worker2 = async () => {
+    while (nextIndex < items.length) {
+      const index = nextIndex++;
+      results[index] = await run(items[index]);
+    }
+  };
+  await Promise.all(Array.from({ length: Math.min(limit, items.length) }, () => worker2()));
+  return results;
+}
 async function executeSingle(call, ctx, governedExecute) {
   const start = Date.now();
+  if (call.tool === batchToolUseTool.name) {
+    return {
+      tool: call.tool,
+      success: false,
+      error: "recursive batch_tool_use execution is not allowed",
+      executionMs: Date.now() - start
+    };
+  }
   const tool = ctx.tools.find((candidate) => candidate.name === call.tool);
   if (!tool) {
     return {
@@ -8797,6 +8954,14 @@ async function executeSingle(call, ctx, governedExecute) {
       executionMs: Date.now() - start
     };
   }
+  if (!BATCHABLE_TOOLS.has(tool.name) || tool.mutating) {
+    return {
+      tool: call.tool,
+      success: false,
+      error: `tool "${call.tool}" is not eligible for batch execution; call it directly. Allowed: ${BATCHABLE_TOOL_NAMES.join(", ")}`,
+      executionMs: Date.now() - start
+    };
+  }
   try {
     const result = await governedExecute(call.tool, call.input);
     return {
@@ -8823,8 +8988,14 @@ import * as path10 from "node:path";
 import { atomicWrite, ulid } from "@wrongstack/core/utils";
 var ARTIFACT_RETENTION_MS = 7 * 24 * 60 * 60 * 1e3;
 var sweptRoots = /* @__PURE__ */ new Set();
+var MAX_SWEPT_ROOTS = 128;
 function sweepOldArtifacts(root) {
   if (sweptRoots.has(root)) return;
+  while (sweptRoots.size >= MAX_SWEPT_ROOTS) {
+    const oldest = sweptRoots.values().next().value;
+    if (oldest === void 0) break;
+    sweptRoots.delete(oldest);
+  }
   sweptRoots.add(root);
   void (async () => {
     const cutoff = Date.now() - ARTIFACT_RETENTION_MS;
@@ -8847,8 +9018,8 @@ function sweepOldArtifacts(root) {
       for (const name of names) {
         const target = path10.join(dir, name);
         try {
-          const stat18 = await fs7.stat(target);
-          if (stat18.isFile() && stat18.mtimeMs < cutoff) {
+          const stat19 = await fs7.stat(target);
+          if (stat19.isFile() && stat19.mtimeMs < cutoff) {
             await fs7.rm(target, { force: true });
             removed++;
           }
@@ -8876,14 +9047,14 @@ var BrowserArtifactStore = class {
   }
   async record(id, sessionId, kind, target, mimeType) {
     await fs7.chmod(target, 384).catch(() => void 0);
-    const [stat18, sha256] = await Promise.all([fs7.stat(target), hashFile(target)]);
+    const [stat19, sha256] = await Promise.all([fs7.stat(target), hashFile(target)]);
     const artifact = {
       id,
       kind,
       sensitivity: "sensitive",
       path: target,
       mimeType,
-      sizeBytes: stat18.size,
+      sizeBytes: stat19.size,
       sha256,
       createdAt: (/* @__PURE__ */ new Date()).toISOString()
     };
@@ -9258,7 +9429,7 @@ var BrowserSessionManager = class {
   constructor(options, launcher = defaultLauncher) {
     this.launcher = launcher;
     this.artifacts = new BrowserArtifactStore(options.artifactRoot);
-    this.allowPrivateHosts = options.allowPrivateHosts ?? true;
+    this.allowPrivateHosts = options.allowPrivateHosts ?? false;
     this.allowedPrivateOrigins = options.allowedPrivateOrigins ?? [];
     this.networkProxy = new BrowserNetworkGuardProxy({
       allowPrivateHosts: this.allowPrivateHosts,
@@ -9481,8 +9652,8 @@ var BrowserSessionManager = class {
       if (realRelative.startsWith("..") || path11.isAbsolute(realRelative)) {
         throw new Error("browser: upload files must not escape the project root through a symlink");
       }
-      const stat18 = await fs8.stat(realFile);
-      if (!stat18.isFile()) throw new Error(`browser: upload target is not a file: ${file}`);
+      const stat19 = await fs8.stat(realFile);
+      if (!stat19.isFile()) throw new Error(`browser: upload target is not a file: ${file}`);
       resolved.push(realFile);
     }
     await this.runPageOperation(
@@ -9834,6 +10005,9 @@ var browserScreenshotTool = {
   description: "Capture a page or element PNG and return sensitive artifact metadata with integrity hash.",
   usageHint: "browser_screenshot({ sessionId, fullPage?, selector? })",
   permission: "confirm",
+  // WS-046: the element/expression acted on, not the sessionId — a trust
+  // rule must distinguish clicking one control from another.
+  subjectKey: "selector",
   mutating: true,
   riskTier: "safe",
   capabilities: [ToolCapabilities.NET_OUTBOUND],
@@ -9863,6 +10037,9 @@ function selectorTool(name, description, run) {
     description,
     usageHint: `${name}({ sessionId, selector })`,
     permission: "confirm",
+    // WS-046: the element/expression acted on, not the sessionId — a trust
+    // rule must distinguish clicking one control from another.
+    subjectKey: "selector",
     mutating: true,
     riskTier: "standard",
     capabilities: [ToolCapabilities.NET_OUTBOUND],
@@ -9892,6 +10069,9 @@ var browserTypeTool = {
   description: "Fill an input in an owned browser session. Use secretEnv instead of text for credentials so values stay out of tool arguments and session audit.",
   usageHint: "browser_type({ sessionId, selector, text? | secretEnv? })",
   permission: "confirm",
+  // WS-046: the element/expression acted on, not the sessionId — a trust
+  // rule must distinguish clicking one control from another.
+  subjectKey: "selector",
   mutating: true,
   riskTier: "standard",
   capabilities: [ToolCapabilities.NET_OUTBOUND],
@@ -9926,6 +10106,9 @@ var browserSelectTool = {
   description: "Select an option in an owned browser session.",
   usageHint: "browser_select({ sessionId, selector, value })",
   permission: "confirm",
+  // WS-046: the element/expression acted on, not the sessionId — a trust
+  // rule must distinguish clicking one control from another.
+  subjectKey: "selector",
   mutating: true,
   riskTier: "standard",
   capabilities: [ToolCapabilities.NET_OUTBOUND],
@@ -9954,6 +10137,9 @@ var browserPressTool = {
   description: "Press a keyboard key in an owned browser session.",
   usageHint: "browser_press({ sessionId, key })",
   permission: "confirm",
+  // WS-046: the element/expression acted on, not the sessionId — a trust
+  // rule must distinguish clicking one control from another.
+  subjectKey: "key",
   mutating: true,
   riskTier: "standard",
   capabilities: [ToolCapabilities.NET_OUTBOUND],
@@ -9972,6 +10158,9 @@ var browserDragTool = {
   description: "Drag one element to another in an owned browser session.",
   usageHint: "browser_drag({ sessionId, from, to })",
   permission: "confirm",
+  // WS-046: the element/expression acted on, not the sessionId — a trust
+  // rule must distinguish clicking one control from another.
+  subjectKey: "from",
   mutating: true,
   riskTier: "standard",
   capabilities: [ToolCapabilities.NET_OUTBOUND],
@@ -10021,6 +10210,9 @@ var browserEvaluateTool = {
   description: "Evaluate bounded JavaScript in the page. Requires confirmation because page code is arbitrary.",
   usageHint: "browser_evaluate({ sessionId, expression })",
   permission: "confirm",
+  // WS-046: the element/expression acted on, not the sessionId — a trust
+  // rule must distinguish clicking one control from another.
+  subjectKey: "expression",
   mutating: true,
   riskTier: "destructive",
   capabilities: [ToolCapabilities.NET_OUTBOUND, ToolCapabilities.TOOL_MUTATE_ANY],
@@ -10043,6 +10235,9 @@ var browserUploadTool = {
   description: "Upload project-local files through a file input in an owned browser session.",
   usageHint: "browser_upload({ sessionId, selector, files })",
   permission: "confirm",
+  // WS-046: the element/expression acted on, not the sessionId — a trust
+  // rule must distinguish clicking one control from another.
+  subjectKey: "selector",
   mutating: true,
   riskTier: "destructive",
   capabilities: [ToolCapabilities.NET_OUTBOUND, ToolCapabilities.FS_READ],
@@ -10986,6 +11181,7 @@ var REFS_INDEX_SQL = [
 var SYMBOLS_FTS_SQL = "CREATE VIRTUAL TABLE IF NOT EXISTS symbols_fts USING fts5(text, tokenize = 'unicode61')";
 
 // src/codebase-index/writer-search-helpers.ts
+var SEARCH_CANDIDATE_SCAN_CAP = 5e3;
 function normalizeSearchLimit(limit) {
   return typeof limit === "number" && Number.isFinite(limit) ? Math.max(0, Math.trunc(limit)) : void 0;
 }
@@ -11015,8 +11211,8 @@ function buildWriterSearchWhere(query, filter) {
   }
   if (query.trim()) {
     const tokens = query.toLowerCase().split(/\s+/).filter(Boolean);
-    conditions.push(`(${tokens.map(() => "text LIKE ?").join(" OR ")})`);
-    for (const token of tokens) values.push(`%${token}%`);
+    conditions.push(`(${tokens.map(() => "text LIKE ? ESCAPE '\\'").join(" OR ")})`);
+    for (const token of tokens) values.push(`%${escapeLike(token)}%`);
   }
   return { where: conditions.length ? `WHERE ${conditions.join(" AND ")}` : "", values };
 }
@@ -11125,6 +11321,7 @@ var StorePool = class {
 
 // src/codebase-index/writer.ts
 var DB_FILE2 = "index.db";
+var MAX_STATEMENT_CACHE = 128;
 var IndexStore = class _IndexStore {
   db;
   /** Absolute path to this project's index directory. */
@@ -11162,12 +11359,31 @@ var IndexStore = class _IndexStore {
   // Dirty on open so the first getOrBuildBm25() rebuilds against current rows;
   // an empty or pre-existing corpus makes a stale IDF table meaningless.
   bm25Dirty = true;
-  /** Prepare-once helper: compile `sql` on first use, reuse thereafter. */
+  /**
+   * Prepare-once helper: compile `sql` on first use, reuse thereafter.
+   *
+   * Bounded LRU rather than an open Map. The cache is keyed by SQL TEXT, and
+   * the fallback search builder emits one `text LIKE ?` clause per query token
+   * — so the SQL varies with the token count and a stream of differently-sized
+   * queries grew the cache without limit. Sage's store already bounds its
+   * equivalent at 128 (WS-096).
+   *
+   * Re-inserting on a hit keeps the hot fixed-SQL statements (upsertFile,
+   * insertRefs, …) at the young end, so a burst of one-off search SQL evicts
+   * itself rather than the reindex hot path.
+   */
   stmt(sql) {
-    let s = this.stmtCache.get(sql);
-    if (s === void 0) {
-      s = this.db.prepare(sql);
-      this.stmtCache.set(sql, s);
+    const cached = this.stmtCache.get(sql);
+    if (cached !== void 0) {
+      this.stmtCache.delete(sql);
+      this.stmtCache.set(sql, cached);
+      return cached;
+    }
+    const s = this.db.prepare(sql);
+    this.stmtCache.set(sql, s);
+    if (this.stmtCache.size > MAX_STATEMENT_CACHE) {
+      const oldest = this.stmtCache.keys().next();
+      if (!oldest.done) this.stmtCache.delete(oldest.value);
     }
     return s;
   }
@@ -11440,7 +11656,7 @@ var IndexStore = class _IndexStore {
     const { where, values } = built;
     const limit = normalizeSearchLimit(opts?.limit);
     const limitSql = limit !== void 0 ? " LIMIT ?" : "";
-    const sql = `SELECT id, lang, kind, name, file, line, col, signature, doc_comment, text FROM symbols ${where}${limitSql}`;
+    const sql = `SELECT id, lang, kind, name, file, line, col, signature, doc_comment FROM symbols ${where}${limitSql}`;
     const binds = limit !== void 0 ? [...values, limit] : values;
     const rows = this.stmt(sql).all(
       ...binds
@@ -11569,11 +11785,13 @@ var IndexStore = class _IndexStore {
   /** Legacy ranked path: LIKE candidates + in-process BM25 + JS snippets. */
   searchRankedFallback(query, filter, limit) {
     if (!query.trim()) {
-      const total = this.countSearch(query, filter);
-      if (total === 0) return { results: [], total: 0 };
-      return { results: this.search(query, filter, { limit }), total };
+      const total2 = this.countSearch(query, filter);
+      if (total2 === 0) return { results: [], total: 0 };
+      return { results: this.search(query, filter, { limit }), total: total2 };
     }
-    const candidates = this.search(query, filter);
+    const total = this.countSearch(query, filter);
+    if (total === 0) return { results: [], total: 0 };
+    const candidates = this.search(query, filter, { limit: SEARCH_CANDIDATE_SCAN_CAP });
     if (candidates.length === 0) return { results: [], total: 0 };
     const candidateById = new Map(candidates.map((c) => [c.id, c]));
     const bm25 = this.getOrBuildBm25();
@@ -11599,7 +11817,7 @@ var IndexStore = class _IndexStore {
       const c = expectDefined2(candidateById.get(id));
       return { ...c, score, snippet: bm25.extractSnippet(id, qTokens) };
     });
-    return { results, total: candidates.length };
+    return { results, total };
   }
   getAllIndexable() {
     return getAllIndexableWithStatement((sql) => this.stmt(sql));
@@ -12018,12 +12236,12 @@ var buildIdCache;
 function projectIndexServerBuildId(entrypoint) {
   const file = entrypoint instanceof URL || entrypoint.startsWith("file:") ? fileURLToPath(entrypoint) : path16.resolve(entrypoint);
   try {
-    const stat18 = fs11.statSync(file);
-    if (buildIdCache?.file === file && buildIdCache.mtimeMs === stat18.mtimeMs && buildIdCache.size === stat18.size) {
+    const stat19 = fs11.statSync(file);
+    if (buildIdCache?.file === file && buildIdCache.mtimeMs === stat19.mtimeMs && buildIdCache.size === stat19.size) {
       return buildIdCache.buildId;
     }
     const buildId = createHash4("sha256").update(fs11.readFileSync(file)).digest("hex").slice(0, 24);
-    buildIdCache = { file, mtimeMs: stat18.mtimeMs, size: stat18.size, buildId };
+    buildIdCache = { file, mtimeMs: stat19.mtimeMs, size: stat19.size, buildId };
     return buildId;
   } catch {
     return `unreadable:${path16.basename(file)}`;
@@ -12193,6 +12411,8 @@ var ProjectServerConnection = class {
   connectResolve = null;
   connectReject = null;
   nextId = 1;
+  /** WS-027: read from the owner-only metadata file — see currentAuthToken. */
+  authToken;
   pending = /* @__PURE__ */ new Map();
   transition(status, options = {}) {
     const previous = connectionStates.get(this.endpoint);
@@ -12329,6 +12549,31 @@ var ProjectServerConnection = class {
     this.transition("offline");
     maybeStopHeartbeatLoop();
   }
+  /**
+   * WS-027: the per-process token, read from the daemon's owner-only metadata
+   * file — never from the `hello` frame, which the daemon sends to every
+   * socket that connects (the mistake WS-028 found in the SAGE daemon).
+   *
+   * Read lazily and re-read while unknown: the daemon starts listening before
+   * it writes metadata (endpoint ownership has to be won first), and a
+   * respawned daemon mints a new token, so a cached wrong one would be sticky.
+   */
+  currentAuthToken() {
+    if (this.authToken === void 0) {
+      try {
+        const raw = fs12.readFileSync(
+          projectIndexServerMetadataPath(this.projectRoot, this.indexDir),
+          "utf8"
+        );
+        const parsed = JSON.parse(raw);
+        if (typeof parsed.authToken === "string" && parsed.authToken.length > 0) {
+          this.authToken = parsed.authToken;
+        }
+      } catch {
+      }
+    }
+    return this.authToken;
+  }
   request(message, options) {
     const socket = this.socket;
     if (!socket || socket.destroyed) {
@@ -12372,7 +12617,7 @@ var ProjectServerConnection = class {
           return;
         }
       }
-      this.write({ ...message, id });
+      this.write({ ...message, id, authToken: this.currentAuthToken() });
     });
   }
   async ensureConnected(spawnIfMissing) {
@@ -12419,6 +12664,7 @@ var ProjectServerConnection = class {
   connectOnce() {
     this.socket?.destroy();
     this.socket = null;
+    this.authToken = void 0;
     this.info = null;
     this.activity = null;
     this.health = null;
@@ -13062,9 +13308,9 @@ async function runIndexerWithStore(store, opts) {
     const statReadParse = await Promise.allSettled(
       batchFiles.map(
         async (file) => {
-          let stat18;
+          let stat19;
           try {
-            stat18 = await fs17.stat(file, statOpts);
+            stat19 = await fs17.stat(file, statOpts);
           } catch (e) {
             if (isAbortError(e)) throw e;
             return {
@@ -13076,21 +13322,21 @@ async function runIndexerWithStore(store, opts) {
               missing: isMissingPathError(e)
             };
           }
-          if (!stat18.isFile()) return { file, stat: stat18, lang: "", parsed: null };
+          if (!stat19.isFile()) return { file, stat: stat19, lang: "", parsed: null };
           const lang = detectLang(file);
-          if (!lang) return { file, stat: stat18, lang: "", parsed: null };
-          if (stat18.size > MAX_INDEX_FILE_BYTES) {
+          if (!lang) return { file, stat: stat19, lang: "", parsed: null };
+          if (stat19.size > MAX_INDEX_FILE_BYTES) {
             return {
               file,
-              stat: stat18,
+              stat: stat19,
               lang,
               parsed: null,
-              error: `file too large (${stat18.size} bytes; max ${MAX_INDEX_FILE_BYTES})`
+              error: `file too large (${stat19.size} bytes; max ${MAX_INDEX_FILE_BYTES})`
             };
           }
           const meta = existingMeta.get(file);
-          if (!force && meta && meta.mtimeMs === Math.floor(stat18.mtimeMs)) {
-            return { file, stat: stat18, lang, parsed: null, skippedMeta: meta };
+          if (!force && meta && meta.mtimeMs === Math.floor(stat19.mtimeMs)) {
+            return { file, stat: stat19, lang, parsed: null, skippedMeta: meta };
           }
           let content;
           try {
@@ -13099,7 +13345,7 @@ async function runIndexerWithStore(store, opts) {
             if (isAbortError(e)) throw e;
             return {
               file,
-              stat: stat18,
+              stat: stat19,
               lang,
               parsed: null,
               error: `read error: ${e instanceof Error ? e.message : String(e)}`
@@ -13111,13 +13357,13 @@ async function runIndexerWithStore(store, opts) {
           } catch (e) {
             return {
               file,
-              stat: stat18,
+              stat: stat19,
               lang,
               parsed: null,
               error: `parse error: ${e instanceof Error ? e.message : String(e)}`
             };
           }
-          return { file, stat: stat18, lang, parsed, content };
+          return { file, stat: stat19, lang, parsed, content };
         }
       )
     );
@@ -13138,7 +13384,7 @@ async function runIndexerWithStore(store, opts) {
         errors.push(`${file}: ${result.error}`);
         continue;
       }
-      const { stat: stat18, lang, parsed } = result;
+      const { stat: stat19, lang, parsed } = result;
       if (result.skippedMeta) {
         langStats[lang] = (langStats[lang] ?? 0) + result.skippedMeta.symbolCount;
         symbolsIndexed += result.skippedMeta.symbolCount;
@@ -13150,7 +13396,7 @@ async function runIndexerWithStore(store, opts) {
           store.upsertFile({
             file,
             lang,
-            mtimeMs: Math.floor(stat18.mtimeMs),
+            mtimeMs: Math.floor(stat19.mtimeMs),
             symbolCount: 0,
             lastIndexed: Date.now()
           });
@@ -13162,7 +13408,7 @@ async function runIndexerWithStore(store, opts) {
         store.replaceEmptyFile({
           file,
           lang,
-          mtimeMs: Math.floor(stat18.mtimeMs),
+          mtimeMs: Math.floor(stat19.mtimeMs),
           symbolCount: 0,
           lastIndexed: Date.now()
         });
@@ -13174,7 +13420,7 @@ async function runIndexerWithStore(store, opts) {
         lang,
         symbols: parsed.symbols,
         refs: parsed.refs ?? [],
-        mtimeMs: Math.floor(stat18.mtimeMs),
+        mtimeMs: Math.floor(stat19.mtimeMs),
         symbolCount: parsed.symbols.length
       });
       deleteForFiles.push(file);
@@ -14370,8 +14616,9 @@ function runDeadCodeScan(projectRoot, opts = {}) {
         const content = fs19.readFileSync(epFile, "utf8");
         const strippedContent = content.replace(/\/\*[\s\S]*?\*\//g, (m) => " ".repeat(m.length)).replace(/\/\/[^\n]*/g, (m) => " ".repeat(m.length));
         const reExportRe = /export\s+(?:(?:type\s+)?\{[\s\S]*?\}\s+from|\*\s+as\s+\w+\s+from|\*\s+from)\s+['"]([^'"]+)['"]/g;
-        let match;
-        while ((match = reExportRe.exec(strippedContent)) !== null) {
+        for (; ; ) {
+          const match = reExportRe.exec(strippedContent);
+          if (match === null) break;
           const moduleSpec = match[1];
           const resolvedFiles = resolveModulePath(epFile, moduleSpec, indexedFiles);
           for (const rf of resolvedFiles) {
@@ -14577,6 +14824,9 @@ var designTool = {
   description: 'Browse, load, customize, and enforce curated frontend/mobile UI design kits. Use BEFORE writing UI code to commit to one coherent, modern, responsive, dark/light, accessible design. Actions: "list" (menu), "use" (load+pin a kit for a stack), "foundations" (baseline), "set" (override kit colors/tokens), "materialize" (write the tokens to a real theme file \u2014 CSS @theme/OKLCH or native), "verify" (scan UI files for off-palette colors).',
   usageHint: 'Flow: `design {action:"use", kit:"minimal-clarity", stack:"web"}` \u2192 optionally `design {action:"set", set:{primary:"oklch(62% 0.2 25)"}}` \u2192 `design {action:"materialize"}` to write tokens to disk \u2192 implement against them \u2192 `design {action:"verify"}`.',
   permission: "confirm",
+  // WS-046: gives permission decisions something to key on.
+  // The action performed; `out` is optional so it cannot be the subject.
+  subjectKey: "action",
   mutating: true,
   capabilities: ["fs.write"],
   timeoutMs: 15e3,
@@ -14757,9 +15007,7 @@ Run \`design {action:"materialize"}\` to write the tuned tokens to your theme fi
       const abs = path25.join(absParent, path25.basename(absResolved));
       const rel = path25.relative(root, abs);
       if (rel.startsWith("..") || path25.isAbsolute(rel)) {
-        throw new Error(
-          `design: materialize path "${result.path}" would escape the project root`
-        );
+        throw new Error(`design: materialize path "${result.path}" would escape the project root`);
       }
       let exists = false;
       try {
@@ -14834,6 +15082,7 @@ import { statSync as statSync3 } from "node:fs";
 import * as fs21 from "node:fs/promises";
 import * as path26 from "node:path";
 import { buildChildEnv as buildChildEnv3 } from "@wrongstack/core/utils";
+var MAX_FILE_DUMP_BYTES = 5 * 1024 * 1024;
 var diffTool = {
   name: "diff",
   category: "Filesystem",
@@ -14841,6 +15090,7 @@ var diffTool = {
   usageHint: 'USE FOR CODE REVIEW AND CHANGE INSPECTION:\n\n- `files` + no `a`/`b` \u2192 show file content with line numbers (NOT a unified diff; no +/- prefixes).\n- `a` and/or `b` \u2192 git-style commit/branch diff (unified format, real +/- prefixes).\n- `staged: true` \u2192 only show staged changes.\n- `mode` can be "unified", "stat", or "side-by-side" (only affects the git-diff path).\n\nNOTE: For a true file-vs-file unified diff, supply `a` and `b` so the tool delegates to `git diff`. The `files`-only path is a line-numbered dump, not a diff.\n\nThis tool has important safety guards against flag injection (see previous security findings).',
   permission: "auto",
   mutating: false,
+  maxOutputBytes: 262144,
   capabilities: ["fs.read"],
   icon: "diff",
   timeoutMs: 1e4,
@@ -14916,8 +15166,8 @@ function findGitDir(cwd) {
   let dir = cwd;
   for (let i = 0; i < 20; i++) {
     try {
-      const stat18 = statSync3(path26.join(dir, ".git"));
-      if (stat18.isDirectory()) return dir;
+      const stat19 = statSync3(path26.join(dir, ".git"));
+      if (stat19.isDirectory()) return dir;
     } catch {
     }
     const parent = path26.dirname(dir);
@@ -14959,10 +15209,18 @@ async function fileDiff(input, ctx, _signal) {
     };
   }
   const results = [];
+  let truncated = false;
   for (const file of files) {
     const absPath = safeResolve(file, ctx);
-    const stat18 = await fs21.stat(absPath).catch(() => null);
-    if (!stat18?.isFile()) continue;
+    const stat19 = await fs21.stat(absPath).catch(() => null);
+    if (!stat19?.isFile()) continue;
+    if (stat19.size > MAX_FILE_DUMP_BYTES) {
+      truncated = true;
+      results.push(
+        `--- ${file} (skipped: ${stat19.size} bytes exceeds the ${MAX_FILE_DUMP_BYTES} limit; use the read tool with offset/limit) ---`
+      );
+      continue;
+    }
     const content = await fs21.readFile(absPath, "utf8");
     const lines = content.split(/\r?\n/);
     results.push(formatWithLineNumbers(file, lines));
@@ -14970,7 +15228,7 @@ async function fileDiff(input, ctx, _signal) {
   return {
     diff: results.join("\n\n"),
     files,
-    truncated: false,
+    truncated,
     mode: input.mode ?? "unified"
   };
 }
@@ -15063,8 +15321,8 @@ async function resolveFiles(filesInput, cwd) {
   for (const f of files) {
     const absPath = f.trim().startsWith("/") ? f.trim() : `${cwd}/${f.trim()}`;
     try {
-      const stat18 = await fs22.stat(absPath);
-      if (stat18.isFile()) resolved.push(absPath);
+      const stat19 = await fs22.stat(absPath);
+      if (stat19.isFile()) resolved.push(absPath);
     } catch {
     }
   }
@@ -15917,7 +16175,7 @@ var editTool = {
       });
     }
     const absPath = await safeResolveReal(input.path, ctx);
-    const stat18 = await fs23.stat(absPath).catch((err) => {
+    const stat19 = await fs23.stat(absPath).catch((err) => {
       if (err.code === "ENOENT") {
         throw new ToolValidationError({
           message: `edit: file "${input.path}" does not exist. Use \`write\` instead.`,
@@ -15927,7 +16185,7 @@ var editTool = {
       }
       throw err;
     });
-    if (!stat18.isFile()) {
+    if (!stat19.isFile()) {
       throw new ToolValidationError({
         message: `edit: "${input.path}" is not a regular file`,
         field: "path"
@@ -15957,7 +16215,7 @@ var editTool = {
         });
       }
     }
-    if (autoRead && updated.mtimeMs > stat18.mtimeMs + mtimeTolerance) {
+    if (autoRead && updated.mtimeMs > stat19.mtimeMs + mtimeTolerance) {
       throw new ToolValidationError({
         message: `edit: file "${input.path}" changed while being auto-read. Retry the edit.`,
         field: "path",
@@ -16082,7 +16340,6 @@ import {
 import { toErrorMessage as toErrorMessage3 } from "@wrongstack/core/utils/error";
 init_output_spool();
 init_util();
-init_process_registry();
 init_win32_resolve();
 
 // src/exec-kill-guard.ts
@@ -16320,8 +16577,7 @@ async function checkKillTarget(target) {
   return { blocked: false };
 }
 
-// src/exec.ts
-var isWin4 = process.platform === "win32";
+// src/exec-allowlist.ts
 var DEFAULT_ALLOWED_COMMANDS = /* @__PURE__ */ new Set([
   // JS / TS toolchain
   "node",
@@ -16400,7 +16656,11 @@ var DEFAULT_ALLOWED_COMMANDS = /* @__PURE__ */ new Set([
   "docker",
   "podman",
   "kubectl",
-  // network (read-only intent; destructive ops still blocked by BLOCKED_ARG_PATTERNS)
+  // network fetch tools. Per-arg safety is NOT enforced by BLOCKED_ARG_PATTERNS
+  // (no curl/wget entries) — the real boundary is the per-call `confirm`
+  // permission gate (exec.ts permission:'confirm', subjectKey:'command'),
+  // the `pipe-to-shell` danger rule, and the kill guard. The allowlist is a
+  // guidance layer, not a security boundary on its own.
   "curl",
   "wget",
   // common POSIX file/text utilities
@@ -16453,9 +16713,15 @@ var DEFAULT_ALLOWED_COMMANDS = /* @__PURE__ */ new Set([
   "powershell.exe",
   "pwsh",
   "pwsh.exe",
-  // [core] Extended default allowlist (added 4b3d18d1 + this commit). All
-  // non-destructive, broadly-used dev binaries. Per-arg safety is still
-  // enforced by BLOCKED_ARG_PATTERNS + bash-kill-guard.ts.
+  // [core] Extended default allowlist (added 4b3d18d1 + this commit). Broadly
+  // used dev binaries — NOT all non-destructive: this section contains
+  // process/system tools (kill, chown, mount, userdel), network scanners
+  // (nmap, masscan, zmap, nuclei), and launchers (env, perl, timeout, tmux).
+  // The real safety boundary for these is the per-call `confirm` permission
+  // gate (exec.ts permission:'confirm', subjectKey:'command' renders the full
+  // invocation) plus the danger rules in _danger-detect.ts. Per-arg hard-deny
+  // is still enforced by BLOCKED_ARG_PATTERNS + bash-kill-guard.ts, but only
+  // for the commands that have entries there (git, find, rm).
   // --- Archives & compression ---
   "7z",
   "7za",
@@ -16627,10 +16893,7 @@ var DEFAULT_ALLOWED_COMMANDS = /* @__PURE__ */ new Set([
   "git-lfs",
   "tig",
   "lazygit",
-  // --- POSIX text utilities (extended; duplicates of pwd/ls/cat/head/tail/wc/
-  //     grep/find/echo/awk/mkdir/cp/mv/rm/touch from the base list above are
-  //     omitted — the Set is de-duplicated at runtime but a clean literal is
-  //     easier to maintain) ---
+  // --- POSIX text utilities (extended) ---
   "gawk",
   "tr",
   "cut",
@@ -16663,39 +16926,16 @@ var DEFAULT_ALLOWED_COMMANDS = /* @__PURE__ */ new Set([
   "locate",
   "which",
   "whereis",
-  "type",
-  "hash",
-  "pushd",
-  "popd",
-  "dirs",
-  "history",
-  "fc",
-  "jobs",
-  "bg",
-  "fg",
-  "wait",
-  "ulimit",
-  "umask",
+  // NOTE: shell builtins with no standalone binary (type, hash, pushd,
+  // popd, dirs, history, fc, jobs, bg, fg, wait, ulimit, umask, trap,
+  // exit, return, source, ., alias, unalias, set, unset, export, readonly,
+  // typeset, declare, local, eval, exec) are intentionally excluded —
+  // spawn() would fail with ENOENT on every platform because they only
+  // exist inside a shell process. Use the `bash` tool for builtins.
   "nice",
   "nohup",
   "timeout",
   "time",
-  "trap",
-  "exit",
-  "return",
-  "source",
-  ".",
-  "alias",
-  "unalias",
-  "set",
-  "unset",
-  "export",
-  "readonly",
-  "typeset",
-  "declare",
-  "local",
-  "eval",
-  "exec",
   // --- Process / system inspection ---
   "htop",
   "top",
@@ -16926,6 +17166,10 @@ var DEFAULT_ALLOWED_COMMANDS = /* @__PURE__ */ new Set([
   "sublert",
   "chaos"
 ]);
+
+// src/exec.ts
+init_process_registry();
+var isWin4 = process.platform === "win32";
 var allowedCommands = new Set(DEFAULT_ALLOWED_COMMANDS);
 var normalizeCmd = (c) => c.trim();
 function configureExecPolicy(opts = {}) {
@@ -16986,7 +17230,17 @@ var BLOCKED_ARG_PATTERNS = {
   bun: [],
   docker: [],
   // find -exec/-ok/-execdir execute arbitrary commands
-  find: [/^-exec$/, /^-exec;$/, /^-ok$/, /^-ok;$/, /^-execdir$/, /^-execdir;$/, /^-exec=/, /^-ok=/, /^-execdir=/],
+  find: [
+    /^-exec$/,
+    /^-exec;$/,
+    /^-ok$/,
+    /^-ok;$/,
+    /^-execdir$/,
+    /^-execdir;$/,
+    /^-exec=/,
+    /^-ok=/,
+    /^-execdir=/
+  ],
   // rm -rf / is catastrophic — block absolute paths, home, dot-dirs,
   // and glob patterns that could expand to dangerous targets.
   // `rm -rf ./src/*` expands to project files; `rm -rf ../../` escapes upward;
@@ -17057,6 +17311,14 @@ var execTool = {
     useInstead: ["bash"]
   },
   permission: "confirm",
+  // WS-046: without this, every exec call collapsed onto the bare tool name.
+  // Three consequences followed: "always allow" stored a rule that could never
+  // match, pressing "no" once blocked ALL exec for the session, and the
+  // permission cache keyed one decision for every command. `subjectKey:
+  // 'command'` renders the FULL invocation (`command` + `args`) — using the
+  // program alone would make `exec git status` and `exec git push --force` the
+  // same subject, so trusting one would silently authorize the other.
+  subjectKey: "command",
   mutating: true,
   riskTier: "standard",
   timeoutMs: DEFAULT_TIMEOUT_MS3,
@@ -17273,7 +17535,14 @@ function runCommand(cmd, args, cwd, timeout, signal, sessionId, danger) {
     const pid = child.pid;
     if (typeof pid === "number") {
       const fullCommand = `${cmd} ${args.join(" ")}`;
-      registry.register({ pid, name: "exec", command: redactCommand(fullCommand), startedAt: Date.now(), sessionId, child });
+      registry.register({
+        pid,
+        name: "exec",
+        command: redactCommand(fullCommand),
+        startedAt: Date.now(),
+        sessionId,
+        child
+      });
     }
     const timer = setTimeout(() => {
       killed = true;
@@ -17713,6 +17982,9 @@ var formatTool = {
   description: "Format source files according to project style (Biome). Can also run in check-only mode.",
   usageHint: "RUN REGULARLY:\n\n- Use on changed files before committing.\n- `check: true` verifies formatting without making changes (useful in CI-like flows).\nThis project has very consistent formatting expectations. Always ensure your changes are formatted.",
   permission: "confirm",
+  // WS-046: gives permission decisions something to key on.
+  // The files being rewritten are the subject; the fixer is how, not what.
+  subjectKey: "files",
   mutating: true,
   capabilities: ["fs.write", "shell.restricted"],
   icon: "code",
@@ -17817,13 +18089,13 @@ var formatTool = {
   }
 };
 async function detectFixer(cwd) {
-  const { stat: stat18 } = await import("node:fs/promises");
+  const { stat: stat19 } = await import("node:fs/promises");
   try {
-    await stat18(`${cwd}/biome.json`);
+    await stat19(`${cwd}/biome.json`);
     return "biome";
   } catch {
     try {
-      await stat18(`${cwd}/.prettierrc`);
+      await stat19(`${cwd}/.prettierrc`);
       return "prettier";
     } catch {
       return "biome";
@@ -17850,6 +18122,10 @@ var gitTool = {
   // Conservative: any of these may mutate. The non-mutating commands
   // (status/log/diff/branch/fetch) are still gated on `permission: 'confirm'`
   // and `MUTATING_SUBCOMMANDS` is consulted at runtime for per-call checks.
+  // WS-046: gives permission decisions something to key on.
+  // The git subcommand (status/commit/push) is what a trust rule needs to
+  // distinguish; `git status` and `git push --force` must not share a subject.
+  subjectKey: "command",
   mutating: true,
   capabilities: ["fs.write", "shell.restricted"],
   timeoutMs: TIMEOUT_MS2,
@@ -17918,6 +18194,8 @@ var gitTool = {
         truncated: false
       };
     }
+    const branchGuard = validateBranchInput(input);
+    if (branchGuard) return branchGuard;
     if (input.command === "worktree") {
       const guard = validateWorktreeInput(input, ctx.projectRoot);
       if (guard) return guard;
@@ -17966,6 +18244,18 @@ var gitTool = {
     return result;
   }
 };
+function validateBranchInput(input) {
+  const branch = input.branch;
+  if (branch === void 0) return null;
+  if (!branch.startsWith("-") && !branch.includes(" --")) return null;
+  return {
+    command: input.command,
+    stdout: "",
+    stderr: `unsafe branch name (parsed as a git option): ${branch}`,
+    exitCode: 1,
+    truncated: false
+  };
+}
 function validateWorktreeInput(input, projectRoot) {
   const reject = (stderr) => ({
     command: "worktree",
@@ -17974,7 +18264,6 @@ function validateWorktreeInput(input, projectRoot) {
     exitCode: 1,
     truncated: false
   });
-  if (input.branch?.startsWith("-")) return reject(`unsafe branch name: ${input.branch}`);
   if (input.worktreePath?.startsWith("-")) {
     return reject(`unsafe worktree path: ${input.worktreePath}`);
   }
@@ -17992,8 +18281,8 @@ function findGitDir2(cwd, projectRoot) {
   let dir = cwd;
   for (let i = 0; i < 20; i++) {
     try {
-      const stat18 = statSync4(`${dir}/.git`);
-      if (stat18.isDirectory() || stat18.isFile()) return dir;
+      const stat19 = statSync4(`${dir}/.git`);
+      if (stat19.isDirectory() || stat19.isFile()) return dir;
     } catch {
     }
     if (dir === root) break;
@@ -18028,7 +18317,10 @@ function buildArgs(input) {
         ...files.length ? ["--", ...files] : []
       ];
     case "branch":
-      return input.branch ? ["branch", ...input.branch.startsWith("-") || input.branch.includes(" --") ? [] : [input.branch]] : ["branch"];
+      return input.branch ? [
+        "branch",
+        ...input.branch.startsWith("-") || input.branch.includes(" --") ? [] : [input.branch]
+      ] : ["branch"];
     case "checkout":
       return [
         "checkout",
@@ -18121,7 +18413,7 @@ import * as path30 from "node:path";
 import { compileGlob as compileGlob2, DEFAULT_WALK_IGNORE_DIRS as DEFAULT_WALK_IGNORE_DIRS2 } from "@wrongstack/core/utils";
 
 // src/_concurrency.ts
-async function mapWithConcurrency(items, limit, fn) {
+async function mapWithConcurrency2(items, limit, fn) {
   if (items.length === 0) return [];
   const effectiveLimit = Math.max(1, Math.min(limit | 0, items.length));
   const results = new Array(items.length);
@@ -18256,10 +18548,10 @@ var globTool = {
         }
         if (truncated) return;
       }
-      await mapWithConcurrency(matchedFiles, WALK_CONCURRENCY, pushResult);
+      await mapWithConcurrency2(matchedFiles, WALK_CONCURRENCY, pushResult);
       if (truncated) return;
       const remainingSubdirs = truncated ? [] : subdirs;
-      await mapWithConcurrency(remainingSubdirs, WALK_CONCURRENCY, ({ full, rel }) => walk2(full, rel));
+      await mapWithConcurrency2(remainingSubdirs, WALK_CONCURRENCY, ({ full, rel }) => walk2(full, rel));
     };
     await walk2(base, "");
     results.sort((a, b) => b.mtime - a.mtime);
@@ -18268,12 +18560,16 @@ var globTool = {
 };
 
 // src/grep.ts
-import { expectDefined as expectDefined7 } from "@wrongstack/core/utils";
 import { spawn as spawn11 } from "node:child_process";
 import * as fs25 from "node:fs/promises";
 import * as path31 from "node:path";
 import { ToolValidationError as ToolValidationError4 } from "@wrongstack/core/types";
-import { buildChildEnv as buildChildEnv5, compileGlob as compileGlob3, DEFAULT_WALK_IGNORE_DIRS as DEFAULT_WALK_IGNORE_DIRS3 } from "@wrongstack/core/utils";
+import {
+  buildChildEnv as buildChildEnv5,
+  compileGlob as compileGlob3,
+  DEFAULT_WALK_IGNORE_DIRS as DEFAULT_WALK_IGNORE_DIRS3,
+  expectDefined as expectDefined7
+} from "@wrongstack/core/utils";
 
 // src/_regex.ts
 var MAX_PATTERN_LEN = 256;
@@ -18326,6 +18622,8 @@ var DEFAULT_IGNORE3 = DEFAULT_WALK_IGNORE_DIRS3;
 var NATIVE_SCAN_CONCURRENCY = 32;
 var NATIVE_READ_CHUNK_BYTES = 64 * 1024;
 var NATIVE_MAX_FILE_BYTES = 1e6;
+var RG_MAX_QUEUE_CHUNKS = 128;
+var RG_MAX_QUEUE_CHARS = 8 * 1024 * 1024;
 var grepTool = {
   name: "grep",
   category: "Search",
@@ -18453,9 +18751,19 @@ async function* runRgStream(input, base, mode, limit, signal) {
   const FLUSH_AT = 16;
   const MAX_BUF_BYTES = 1e6;
   let bufOverflow = false;
-  const child = spawn11("rg", args, { signal, env: buildChildEnv5(), stdio: ["ignore", "pipe", "pipe"], windowsHide: true });
+  const child = spawn11("rg", args, {
+    signal,
+    env: buildChildEnv5(),
+    // rg diagnostics are not part of the tool result. Ignoring stderr avoids
+    // an unread pipe filling up and pinning the child when rg reports many
+    // filesystem errors.
+    stdio: ["ignore", "pipe", "ignore"],
+    windowsHide: true
+  });
   const queue = [];
+  let queuedChars = 0;
   let waiter;
+  let paused = false;
   const wake = () => {
     if (waiter) {
       const w = waiter;
@@ -18463,93 +18771,133 @@ async function* runRgStream(input, base, mode, limit, signal) {
       w();
     }
   };
-  child.stdout?.on("data", (c) => {
-    queue.push({ kind: "out", data: c.toString() });
+  const pauseIfFlooded = () => {
+    if (paused || queue.length < RG_MAX_QUEUE_CHUNKS && queuedChars < RG_MAX_QUEUE_CHARS)
+      return;
+    paused = true;
+    child.stdout?.pause();
+  };
+  const resumeIfDrained = () => {
+    if (!paused || queue.length >= RG_MAX_QUEUE_CHUNKS || queuedChars >= RG_MAX_QUEUE_CHARS)
+      return;
+    paused = false;
+    child.stdout?.resume();
+  };
+  const onStdoutData = (c) => {
+    const data = c.toString();
+    queue.push({ kind: "out", data });
+    queuedChars += data.length;
     wake();
-  });
-  child.on("error", (e) => {
+    pauseIfFlooded();
+  };
+  const onError = (e) => {
     queue.push({ kind: "error", data: e.message });
     wake();
-  });
-  child.on("close", () => {
+  };
+  const onClose = () => {
     queue.push({ kind: "close", data: "" });
     wake();
-  });
+  };
+  child.stdout?.on("data", onStdoutData);
+  child.on("error", onError);
+  child.on("close", onClose);
   let pendingBatch = [];
   let errored = false;
-  for (; ; ) {
-    while (queue.length === 0) {
-      await new Promise((r) => {
-        waiter = r;
-      });
-    }
-    const c = expectDefined7(queue.shift());
-    if (c.kind === "error") {
-      errored = true;
-      continue;
-    }
-    if (c.kind === "close") break;
-    buf += c.data;
-    if (buf.length > MAX_BUF_BYTES && !bufOverflow) {
-      bufOverflow = true;
-      buf = buf.slice(-MAX_BUF_BYTES);
-      try {
-        child.kill("SIGTERM");
-      } catch {
+  let closed = false;
+  try {
+    for (; ; ) {
+      while (queue.length === 0) {
+        await new Promise((r) => {
+          waiter = r;
+        });
       }
-    }
-    const idx = buf.lastIndexOf("\n");
-    if (idx === -1) continue;
-    const ready = buf.slice(0, idx);
-    buf = buf.slice(idx + 1);
-    for (const line of ready.split("\n")) {
-      if (!line) continue;
-      totalLines++;
-      if (mode === "count") totalCount += parseRgCountLine(line);
-      if (matches.length < limit) {
-        matches.push(line);
-        pendingBatch.push(line);
-        batchSinceFlush++;
+      const c = expectDefined7(queue.shift());
+      queuedChars = Math.max(0, queuedChars - c.data.length);
+      resumeIfDrained();
+      if (c.kind === "error") {
+        errored = true;
+        continue;
+      }
+      if (c.kind === "close") {
+        closed = true;
+        break;
+      }
+      buf += c.data;
+      if (buf.length > MAX_BUF_BYTES && !bufOverflow) {
+        bufOverflow = true;
+        buf = buf.slice(-MAX_BUF_BYTES);
+        try {
+          child.kill("SIGTERM");
+        } catch {
+        }
+      }
+      const idx = buf.lastIndexOf("\n");
+      if (idx === -1) continue;
+      const ready = buf.slice(0, idx);
+      buf = buf.slice(idx + 1);
+      for (const line of ready.split("\n")) {
+        if (!line) continue;
+        totalLines++;
+        if (mode === "count") totalCount += parseRgCountLine(line);
+        if (matches.length < limit) {
+          matches.push(line);
+          pendingBatch.push(line);
+          batchSinceFlush++;
+        }
+      }
+      if (batchSinceFlush >= FLUSH_AT) {
+        yield {
+          type: "partial_output",
+          text: pendingBatch.join("\n"),
+          data: { matches_so_far: matches.length }
+        };
+        pendingBatch = [];
+        batchSinceFlush = 0;
+      }
+    }
+    if (buf.trim()) {
+      for (const line of buf.split("\n")) {
+        if (!line) continue;
+        totalLines++;
+        if (mode === "count") totalCount += parseRgCountLine(line);
+        if (matches.length < limit) {
+          matches.push(line);
+          pendingBatch.push(line);
+        }
       }
     }
-    if (batchSinceFlush >= FLUSH_AT) {
+    if (pendingBatch.length > 0) {
       yield {
         type: "partial_output",
         text: pendingBatch.join("\n"),
         data: { matches_so_far: matches.length }
       };
-      pendingBatch = [];
-      batchSinceFlush = 0;
-    }
-  }
-  if (buf.trim()) {
-    for (const line of buf.split("\n")) {
-      if (!line) continue;
-      totalLines++;
-      if (mode === "count") totalCount += parseRgCountLine(line);
-      if (matches.length < limit) {
-        matches.push(line);
-        pendingBatch.push(line);
-      }
     }
-  }
-  if (pendingBatch.length > 0) {
+    if (errored) throw new Error("rg: spawn error");
     yield {
-      type: "partial_output",
-      text: pendingBatch.join("\n"),
-      data: { matches_so_far: matches.length }
+      type: "final",
+      output: {
+        matches,
+        count: mode === "count" ? totalCount : totalLines,
+        truncated: totalLines > limit || bufOverflow,
+        used: "rg"
+      }
     };
-  }
-  if (errored) throw new Error("rg: spawn error");
-  yield {
-    type: "final",
-    output: {
-      matches,
-      count: mode === "count" ? totalCount : totalLines,
-      truncated: totalLines > limit || bufOverflow,
-      used: "rg"
+  } finally {
+    child.stdout?.off("data", onStdoutData);
+    child.off("error", onError);
+    child.off("close", onClose);
+    child.stdout?.destroy();
+    queue.length = 0;
+    queuedChars = 0;
+    waiter = void 0;
+    if (!closed && child.exitCode === null) {
+      try {
+        child.kill("SIGTERM");
+      } catch {
+      }
     }
-  };
+  }
 }
 function parseRgCountLine(line) {
   const idx = line.lastIndexOf(":");
@@ -18579,8 +18927,8 @@ async function runNative(input, base, mode, limit, signal) {
     if (globRe && !globRe.test(name) && !globRe.test(full)) return;
     if (globRe) globRe.lastIndex = 0;
     try {
-      const stat18 = await fs25.stat(full);
-      if (!stat18.isFile() || stat18.size > maxBytes || stopped || signal.aborted) return;
+      const stat19 = await fs25.stat(full);
+      if (!stat19.isFile() || stat19.size > maxBytes || stopped || signal.aborted) return;
       const file = await fs25.open(full, "r");
       try {
         let bytesReadTotal = 0;
@@ -18680,8 +19028,8 @@ async function runNative(input, base, mode, limit, signal) {
         files.push({ full, name: e.name });
       }
     }
-    await mapWithConcurrency(files, NATIVE_SCAN_CONCURRENCY, ({ full, name }) => scanFile(full, name));
-    await mapWithConcurrency(
+    await mapWithConcurrency2(files, NATIVE_SCAN_CONCURRENCY, ({ full, name }) => scanFile(full, name));
+    await mapWithConcurrency2(
       subdirs,
       Math.min(16, NATIVE_SCAN_CONCURRENCY),
       ({ full, rel }) => walk2(full, rel)
@@ -18700,7 +19048,7 @@ async function runNative(input, base, mode, limit, signal) {
 init_spawn_stream();
 init_util();
 init_legacy_bridge();
-import { join as join24 } from "node:path";
+import { join as join25 } from "node:path";
 import {
   detectEcosystem as detectPackageEcosystem,
   recordPackageAction
@@ -18711,6 +19059,10 @@ var installTool = {
   description: "Install, update or manage packages using the detected package manager (pnpm/npm/yarn). Strongly preferred over raw shell commands for dependency management because it is structured and safer.",
   usageHint: "ALWAYS USE THIS INSTEAD OF BASH FOR PACKAGE WORK:\n\n- Empty `packages` \u2192 normal `install` (respects lockfile).\n- Provide names \u2192 adds/updates specific packages.\n- `dry_run: true` for safe preview.\n- Set `save` appropriately.\nThis tool has proper capability declaration and is heavily recommended in the security posture of the project.",
   permission: "confirm",
+  // WS-046: gives permission decisions something to key on.
+  // What gets installed is the subject — installing a package runs its
+  // lifecycle scripts, so `express` and `evil-pkg` must not be interchangeable.
+  subjectKey: "packages",
   mutating: true,
   riskTier: "standard",
   icon: "package",
@@ -18880,10 +19232,10 @@ function resolveManifestPath(cwd, pkgManager) {
     case "pnpm":
     case "yarn":
     case "npm":
-      return join24(cwd, "package.json");
+      return join25(cwd, "package.json");
     /* v8 ignore next 2 -- pkgManager is always pnpm/yarn/npm; the default is defensive. */
     default:
-      return join24(cwd, "package.json");
+      return join25(cwd, "package.json");
   }
 }
 
@@ -18891,6 +19243,24 @@ function resolveManifestPath(cwd, pkgManager) {
 init_util();
 import * as fs26 from "node:fs/promises";
 import { deepMerge as deepMergeCore } from "@wrongstack/core/utils";
+var MAX_JSON_FILE_BYTES = 16 * 1024 * 1024;
+var MAX_JSON_FILE_BYTES_HUMAN = "16 MiB";
+var JsonFileTooLargeError = class extends Error {
+  constructor(filePath, size) {
+    super(
+      `json: "${filePath}" is ${size} bytes \u2014 exceeds the ${MAX_JSON_FILE_BYTES_HUMAN} file-size limit. Extract the relevant portion into a smaller file first, or use a shell tool to query it directly.`
+    );
+    this.name = "JsonFileTooLargeError";
+  }
+};
+async function readJsonFileBounded(filePath, ctx) {
+  const resolved = await safeResolveReal(filePath, ctx);
+  const stat19 = await fs26.stat(resolved);
+  if (stat19.size > MAX_JSON_FILE_BYTES) {
+    throw new JsonFileTooLargeError(filePath, stat19.size);
+  }
+  return fs26.readFile(resolved, "utf8");
+}
 var jsonTool = {
   name: "json",
   category: "Data",
@@ -18898,6 +19268,7 @@ var jsonTool = {
   usageHint: 'VERY USEFUL FOR DATA INSPECTION:\n\n- `action: "parse"` (default): read/pretty-print/convert JSON, JSON5, or YAML from `file` or `data`.\n- `action: "query"`: JMESPath-like query (`a.b[0].c`, `items[*].name`, filters, functions).\n- `action: "validate"`: validate data against a JSON Schema (`schema` param).\n- `action: "transform"`: chain multiple JMESPath transforms (`transforms` param).\n- `action: "merge"`: deep merge `base` and `patch` objects (`conflictResolution` param).\nPrefer this over raw `read` + manual parsing when dealing with configuration or data files.',
   permission: "auto",
   mutating: false,
+  maxOutputBytes: 262144,
   timeoutMs: 5e3,
   capabilities: ["fs.read"],
   icon: "json",
@@ -18964,9 +19335,15 @@ async function executeParse(input, ctx) {
   let raw;
   if (input.file) {
     try {
-      raw = await fs26.readFile(await safeResolveReal(input.file, ctx), "utf8");
-    } catch {
-      return { data: null, formatted: "", type: "unknown", action: "parse", error: "Could not read file" };
+      raw = await readJsonFileBounded(input.file, ctx);
+    } catch (error) {
+      return {
+        data: null,
+        formatted: "",
+        type: "unknown",
+        action: "parse",
+        error: error instanceof JsonFileTooLargeError ? error.message : "Could not read file"
+      };
     }
   } else if (input.data) {
     raw = input.data;
@@ -19022,10 +19399,16 @@ async function executeQuery(input, ctx) {
   let parsed;
   if (input.file) {
     try {
-      const raw = await fs26.readFile(await safeResolveReal(input.file, ctx), "utf8");
+      const raw = await readJsonFileBounded(input.file, ctx);
       parsed = JSON.parse(raw);
-    } catch {
-      return { data: null, formatted: "", type: "unknown", action: "query", error: "Could not read/parse file" };
+    } catch (error) {
+      return {
+        data: null,
+        formatted: "",
+        type: "unknown",
+        action: "query",
+        error: error instanceof JsonFileTooLargeError ? error.message : "Could not read/parse file"
+      };
     }
   } else if (input.data) {
     try {
@@ -19064,10 +19447,16 @@ async function executeValidate(input, ctx) {
   let parsed;
   if (input.file) {
     try {
-      const raw = await fs26.readFile(await safeResolveReal(input.file, ctx), "utf8");
+      const raw = await readJsonFileBounded(input.file, ctx);
       parsed = JSON.parse(raw);
-    } catch {
-      return { data: null, formatted: "", type: "unknown", action: "validate", error: "Could not read/parse file" };
+    } catch (error) {
+      return {
+        data: null,
+        formatted: "",
+        type: "unknown",
+        action: "validate",
+        error: error instanceof JsonFileTooLargeError ? error.message : "Could not read/parse file"
+      };
     }
   } else if (input.data) {
     try {
@@ -19106,10 +19495,16 @@ async function executeTransform(input, ctx) {
   let parsed;
   if (input.file) {
     try {
-      const raw = await fs26.readFile(await safeResolveReal(input.file, ctx), "utf8");
+      const raw = await readJsonFileBounded(input.file, ctx);
       parsed = JSON.parse(raw);
-    } catch {
-      return { data: null, formatted: "", type: "unknown", action: "transform", error: "Could not read/parse file" };
+    } catch (error) {
+      return {
+        data: null,
+        formatted: "",
+        type: "unknown",
+        action: "transform",
+        error: error instanceof JsonFileTooLargeError ? error.message : "Could not read/parse file"
+      };
     }
   } else if (input.data) {
     try {
@@ -19713,6 +20108,10 @@ async function handleKanbanDetailAction(projectRoot, input) {
 }
 
 // src/kanban-board-inputs.ts
+function agentSettableGate(enforcement) {
+  if (enforcement === void 0 || enforcement === "off") return {};
+  return { completionGate: { enforcement } };
+}
 function boardCreateInput(input, title) {
   return {
     title,
@@ -19725,7 +20124,7 @@ function boardCreateInput(input, title) {
         decomposition: input.atomicityDecomposition ?? "propose"
       }
     } : {},
-    ...input.gateEnforcement !== void 0 ? { completionGate: { enforcement: input.gateEnforcement } } : {}
+    ...agentSettableGate(input.gateEnforcement)
   };
 }
 function boardUpdatePatch(input) {
@@ -19739,7 +20138,7 @@ function boardUpdatePatch(input) {
         decomposition: input.atomicityDecomposition ?? "propose"
       }
     } : {},
-    ...input.gateEnforcement !== void 0 ? { completionGate: { enforcement: input.gateEnforcement } } : {}
+    ...agentSettableGate(input.gateEnforcement)
   };
 }
 function duplicateBoardOptions(input) {
@@ -19754,6 +20153,7 @@ function duplicateBoardOptions(input) {
 
 // src/kanban-task-inputs.ts
 import { randomUUID } from "node:crypto";
+import { clampSubagentCapabilities } from "@wrongstack/core/security";
 function taskInput(input) {
   const assignment = hasAssignmentInput(input) ? assignmentForTaskCreate(input) : void 0;
   return {
@@ -19851,6 +20251,10 @@ function taskPatch(input) {
     ...input.actualHours !== void 0 ? { actualHours: input.actualHours } : {}
   };
 }
+function clampRequestedCapabilities(requested) {
+  if (requested === void 0) return void 0;
+  return clampSubagentCapabilities(requested).granted;
+}
 function assignmentInput(input) {
   return {
     agentId: input.agentId,
@@ -19861,7 +20265,7 @@ function assignmentInput(input) {
     fallbackProfile: input.fallbackProfile,
     fallbackModels: input.fallbackModels,
     tools: input.tools,
-    allowedCapabilities: input.allowedCapabilities,
+    allowedCapabilities: clampRequestedCapabilities(input.allowedCapabilities),
     assignee: input.assignee,
     leaseId: input.leaseId,
     claimedAt: input.claimedAt,
@@ -19888,7 +20292,7 @@ function assignmentForTaskCreate(input) {
     ...input.fallbackProfile !== void 0 ? { fallbackProfile: input.fallbackProfile } : {},
     ...input.fallbackModels !== void 0 ? { fallbackModels: input.fallbackModels } : {},
     ...input.tools !== void 0 ? { tools: input.tools } : {},
-    ...input.allowedCapabilities !== void 0 ? { allowedCapabilities: input.allowedCapabilities } : {},
+    ...input.allowedCapabilities !== void 0 ? { allowedCapabilities: clampRequestedCapabilities(input.allowedCapabilities) } : {},
     ...input.leaseId !== void 0 ? { leaseId: input.leaseId } : {},
     ...input.claimedAt !== void 0 ? { claimedAt: input.claimedAt } : {},
     ...input.heartbeatAt !== void 0 ? { heartbeatAt: input.heartbeatAt } : {},
@@ -20099,7 +20503,13 @@ var KANBAN_INPUT_SCHEMA = {
     moveTasksToColumnId: { type: "string" },
     atomicityMode: { type: "string", enum: ["off", "assess", "enforce"] },
     atomicityDecomposition: { type: "string", enum: ["auto", "propose"] },
-    gateEnforcement: { type: "string", enum: ["strict", "soft", "off"] },
+    gateEnforcement: {
+      type: "string",
+      // WS-023: `'off'` is deliberately absent. The agent whose work this gate
+      // checks must not be able to switch it off; it may only tighten. Turning
+      // a gate off stays a human decision, made through board config.
+      enum: ["strict", "soft"]
+    },
     subtasks: {
       type: "array",
       minItems: 2,
@@ -20141,7 +20551,7 @@ function createKanbanPresenceWrapper(projectRoot, input, ctx) {
 
 // src/session-kanban.ts
 import { watch } from "node:fs";
-import { basename as basename12, dirname as dirname15 } from "node:path";
+import { basename as basename13, dirname as dirname15 } from "node:path";
 import { getSharedProjectMailbox } from "@wrongstack/core/coordination";
 import {
   loadPlan,
@@ -20231,7 +20641,9 @@ async function ensureSessionKanbanBoard(projectRoot, sessionId) {
         description: "Live session work: todos, tasks, and plan items.",
         tags: sessionBoardTags(sessionId),
         columns: SESSION_KANBAN_COLUMNS,
-        generatedBy: `session-kanban:${sessionId}`
+        generatedBy: `session-kanban:${sessionId}`,
+        kind: "session_mirror",
+        retention: { mode: "archive_after_ttl", ttlMs: 7 * 24 * 60 * 60 * 1e3 }
       });
     }
     if (!sameColumns(board.columns) || !board.tags?.includes(SESSION_BOARD_TAG)) {
@@ -20466,12 +20878,26 @@ function projectSessionPlanToKanban(projectRoot, items, sessionId) {
 function fireAndForget(context, work) {
   void work.catch((err) => {
     const message = err instanceof Error ? err.message : String(err);
-    console.warn(JSON.stringify({ level: "warn", event: "session-kanban", context, message, timestamp: (/* @__PURE__ */ new Date()).toISOString() }));
+    console.warn(
+      JSON.stringify({
+        level: "warn",
+        event: "session-kanban",
+        context,
+        message,
+        timestamp: (/* @__PURE__ */ new Date()).toISOString()
+      })
+    );
   });
 }
 function broadcastTodoUpdate(context, todos) {
   const sessionId = context.session?.id ?? "";
   if (!context.agentId || !sessionId) return;
+  const statusCounts = { pending: 0, inProgress: 0, completed: 0 };
+  for (const todo of todos) {
+    if (todo.status === "completed") statusCounts.completed++;
+    else if (todo.status === "in_progress") statusCounts.inProgress++;
+    else statusCounts.pending++;
+  }
   const projectDir = resolveWstackPaths3({ projectRoot: context.projectRoot }).projectDir;
   const mailbox = getSharedProjectMailbox(projectDir);
   void mailbox.send({
@@ -20483,11 +20909,11 @@ function broadcastTodoUpdate(context, todos) {
       kind: "kanban.todos.updated",
       sessionId,
       revision: context.state.revision,
-      todos
+      todoCount: todos.length,
+      statusCounts
     }),
     priority: "normal",
-    senderSessionId: sessionId,
-    ttlMs: 6 * 60 * 60 * 1e3
+    senderSessionId: sessionId
   }).catch(() => {
   });
 }
@@ -20623,8 +21049,8 @@ function attachSessionKanbanMirror(context) {
         const name = filename?.toString();
         const currentPlanPath = context.meta["plan.path"];
         const currentTaskPath = context.meta["task.path"];
-        const planName = typeof currentPlanPath === "string" ? basename12(currentPlanPath) : "";
-        const taskName = typeof currentTaskPath === "string" ? basename12(currentTaskPath) : "";
+        const planName = typeof currentPlanPath === "string" ? basename13(currentPlanPath) : "";
+        const taskName = typeof currentTaskPath === "string" ? basename13(currentTaskPath) : "";
         if (name && name !== planName && name !== taskName) return;
         if (timer) clearTimeout(timer);
         timer = setTimeout(() => fireAndForget("refresh-files", refreshFiles()), 60);
@@ -21640,11 +22066,11 @@ var lintTool = {
   }
 };
 async function detectLinter(cwd) {
-  const { stat: stat18 } = await import("node:fs/promises");
+  const { stat: stat19 } = await import("node:fs/promises");
   const checks = ["biome.json", ".eslintrc.json", "tslint.json", ".eslintrc.js", "tsconfig.json"];
   for (const f of checks) {
     try {
-      await stat18(`${cwd}/${f}`);
+      await stat19(`${cwd}/${f}`);
       if (f.includes("biome")) return "biome";
       if (f.includes("eslint")) return "eslint";
       if (f.includes("tslint")) return "tslint";
@@ -21888,6 +22314,9 @@ var outdatedTool = {
   // tool.confirm_needed flow on every invocation. M-1 originally
   // fixed four sibling tools (mcp_control, shellcheck, shellcheck (scan mode),
   // search) but missed this one; applying the same contract here.
+  // WS-046: gives permission decisions something to key on.
+  // The working directory scanned.
+  subjectKey: "cwd",
   mutating: true,
   // Capability is outbound network — the tool only hits the package
   // registry over HTTP, never touches the filesystem or runs shell.
@@ -22069,6 +22498,10 @@ var patchTool = {
     useInstead: ["edit"]
   },
   permission: "confirm",
+  // WS-046: gives permission decisions something to key on.
+  // The target directory. The patch body itself is unstable (every diff
+  // differs), so it could never re-match its own stored rule.
+  subjectKey: "directory",
   mutating: true,
   capabilities: ["fs.write"],
   icon: "edit",
@@ -22135,8 +22568,8 @@ var patchTool = {
           const before = beforeContents.get(target) ?? null;
           const after = await readTextForTracking(target);
           if (after === null || after === before) continue;
-          const stat18 = await fs27.stat(target).catch(() => null);
-          if (stat18) ctx.recordRead?.(target, stat18.mtimeMs, "write", sha256hex(after));
+          const stat19 = await fs27.stat(target).catch(() => null);
+          if (stat19) ctx.recordRead?.(target, stat19.mtimeMs, "write", sha256hex(after));
           ctx.session?.recordFileChange?.({
             path: target,
             action: before === null ? "created" : "modified",
@@ -22161,8 +22594,8 @@ var patchTool = {
 var MAX_TRACKING_BYTES = 5 * 1024 * 1024;
 async function readTextForTracking(absPath) {
   try {
-    const stat18 = await fs27.stat(absPath);
-    if (!stat18.isFile() || stat18.size > MAX_TRACKING_BYTES) return null;
+    const stat19 = await fs27.stat(absPath);
+    if (!stat19.isFile() || stat19.size > MAX_TRACKING_BYTES) return null;
     const buf = await fs27.readFile(absPath);
     if (buf.includes(0)) return null;
     return buf.toString("utf8");
@@ -22192,7 +22625,13 @@ function runPatch(args, cwd, signal) {
     let stdout = "";
     let stderr = "";
     const env = { ...buildChildEnv8(), LANG: "C", LC_ALL: "C" };
-    const child = spawn14("patch", args, { cwd, signal, env, stdio: ["pipe", "pipe", "pipe"], windowsHide: true });
+    const child = spawn14("patch", args, {
+      cwd,
+      signal,
+      env,
+      stdio: ["pipe", "pipe", "pipe"],
+      windowsHide: true
+    });
     child.stdout?.on("data", (c) => {
       stdout += c.toString();
     });
@@ -22213,6 +22652,7 @@ function extractPatchedFiles(output) {
 }
 
 // src/plan.ts
+import { randomUUID as randomUUID2 } from "node:crypto";
 import {
   addPlanItem,
   clearPlan,
@@ -22220,20 +22660,20 @@ import {
   formatPlan,
   getPlanTemplate,
   mutatePlan as mutatePlan2,
+  mutateTasks as mutateTasks2,
   removePlanItem,
   setPlanItemStatus
 } from "@wrongstack/core/storage";
-import {
-  mutateTasks as mutateTasks2
-} from "@wrongstack/core/storage";
 import { formatTaskList } from "@wrongstack/core/utils";
-import { randomUUID as randomUUID2 } from "node:crypto";
 var planTool = {
   name: "plan",
   category: "Session",
   description: 'Manage a session-persistent strategic plan. The plan is written to disk and survives conversation resumptions within the same session, but is isolated to this session \u2014 other sessions have their own separate plans. Unlike todos (which are per-turn and lost on restart), a plan tracks high-level progress across multiple turns. Use this to outline big-picture work, then promote concrete items into the todo list when ready to execute. By default plans are isolated to this session; use `scope: "project"` to store the plan in a shared project-level file visible to all sessions.',
   usageHint: 'RECOMMENDED FOR COMPLEX, MULTI-PHASE WORK:\n\n- Start by creating a high-level plan with `action: "add"` or using templates (`template_use`).\n- Use `promote` to turn a plan item into actionable todos.\n- Use `taskify` to convert a plan item into a structured task (with type/priority/deps).\n- Keep plans at the "why and what" level, and todos at the "how and next step" level.\n- Common templates: "new-feature", "bug-fix", "refactor", "release", "security-audit".\n\nThis tool is excellent for maintaining long-term direction across many turns within a session. Plans survive resume but are not shared across separate sessions.\nUse `scope: "project"` to use a shared project-level plan file.',
   permission: "confirm",
+  // WS-046: gives permission decisions something to key on.
+  // The action performed; plan has no single file or path subject.
+  subjectKey: "action",
   mutating: true,
   capabilities: ["fs.write"],
   icon: "plan",
@@ -22290,7 +22730,10 @@ var planTool = {
     let planPath;
     if (input.scope === "project") {
       if (typeof sessionPlanPath === "string") {
-        const lastSep = Math.max(sessionPlanPath.lastIndexOf("/"), sessionPlanPath.lastIndexOf("\\"));
+        const lastSep = Math.max(
+          sessionPlanPath.lastIndexOf("/"),
+          sessionPlanPath.lastIndexOf("\\")
+        );
         planPath = lastSep >= 0 ? sessionPlanPath.slice(0, lastSep + 1) + "backlog.plan.json" : "backlog.plan.json";
       }
     } else {
@@ -22327,7 +22770,11 @@ var planTool = {
           case "start":
           case "done": {
             if (!input.target) {
-              early = mkResult(p, false, `${input.action} requires \`target\` (id|index|substring).`);
+              early = mkResult(
+                p,
+                false,
+                `${input.action} requires \`target\` (id|index|substring).`
+              );
               return p;
             }
             const next = setPlanItemStatus(
@@ -22355,7 +22802,11 @@ var planTool = {
           }
           case "promote": {
             if (!input.target) {
-              early = mkResult(p, false, `${input.action} requires \`target\` (id|index|substring).`);
+              early = mkResult(
+                p,
+                false,
+                `${input.action} requires \`target\` (id|index|substring).`
+              );
               return p;
             }
             const derived = deriveTodosFromPlanItem(p, input.target, input.subtasks);
@@ -22398,7 +22849,11 @@ var planTool = {
             return clearPlan(p);
           case "taskify": {
             if (!input.target) {
-              early = mkResult(p, false, "taskify requires `target` (plan item id|index|substring).");
+              early = mkResult(
+                p,
+                false,
+                "taskify requires `target` (plan item id|index|substring)."
+              );
               return p;
             }
             let itemIdx = -1;
@@ -22471,7 +22926,11 @@ var planTool = {
 ${formatTaskList(taskFile.tasks)}`
         );
       } catch (err) {
-        return mkResult(plan, false, `taskify: task not saved \u2014 ${err instanceof Error ? err.message : String(err)}`);
+        return mkResult(
+          plan,
+          false,
+          `taskify: task not saved \u2014 ${err instanceof Error ? err.message : String(err)}`
+        );
       }
     }
     return mkResult(plan, true, `Plan ${input.action} ok.`);
@@ -22548,9 +23007,9 @@ var readTool = {
     }
     const absPath = await safeResolveReal(input.path, ctx);
     const shouldIncludeSymbols = input.includeSymbols === true || input.includeSymbols !== false && ctx.meta[ADVANCED_MODE_META_KEY] === true;
-    let stat18;
+    let stat19;
     try {
-      stat18 = await fs28.stat(absPath);
+      stat19 = await fs28.stat(absPath);
     } catch (err) {
       const code = err.code;
       if (code === "ENOENT") {
@@ -22569,7 +23028,7 @@ var readTool = {
         cause: err
       });
     }
-    if (!stat18.isFile()) {
+    if (!stat19.isFile()) {
       throw new FsError({
         message: `read: "${input.path}" is not a regular file`,
         code: "FS_READ_FAILED",
@@ -22577,23 +23036,23 @@ var readTool = {
         context: { reason: "not-a-regular-file" }
       });
     }
-    if (stat18.size > MAX_BYTES2) {
+    if (stat19.size > MAX_BYTES2) {
       throw new FsError({
-        message: `read: file too large (${stat18.size} bytes, limit ${MAX_BYTES2})`,
+        message: `read: file too large (${stat19.size} bytes, limit ${MAX_BYTES2})`,
         code: "FS_READ_FAILED",
         path: absPath,
-        context: { size: stat18.size, limit: MAX_BYTES2, reason: "too-large" }
+        context: { size: stat19.size, limit: MAX_BYTES2, reason: "too-large" }
       });
     }
     const offset = Math.max(1, input.offset ?? 1);
     const limit = Math.max(0, Math.min(input.limit ?? 2e3, 5e3));
     const prior = getReadRangeRecord(ctx, absPath);
     const requestedEnd = prior ? Math.min(offset + limit - 1, prior.totalLines) : offset + limit - 1;
-    if (input.mode !== "summary" && limit > 0 && prior && coversRange(prior, stat18.mtimeMs, offset, requestedEnd)) {
-      ctx.recordRead(absPath, stat18.mtimeMs);
+    if (input.mode !== "summary" && limit > 0 && prior && coversRange(prior, stat19.mtimeMs, offset, requestedEnd)) {
+      ctx.recordRead(absPath, stat19.mtimeMs);
       const symResult2 = shouldIncludeSymbols ? await fetchSymbolsForFile(absPath, ctx, execOpts?.signal) : void 0;
       return {
-        text: `[unchanged since previous read: "${input.path}" mtime=${Math.round(stat18.mtimeMs)}; requested lines ${offset}-${requestedEnd} were already shown. Use offset/limit for a new range if needed.]`,
+        text: `[unchanged since previous read: "${input.path}" mtime=${Math.round(stat19.mtimeMs)}; requested lines ${offset}-${requestedEnd} were already shown. Use offset/limit for a new range if needed.]`,
         total_lines: prior.totalLines,
         encoding: "utf8",
         truncated: requestedEnd < prior.totalLines,
@@ -22611,11 +23070,11 @@ var readTool = {
     const allLines = text.split(/\r\n|\r|\n/);
     const total = allLines.length;
     if (input.mode === "summary") {
-      ctx.recordRead(absPath, stat18.mtimeMs, "user", contentHash);
-      rememberReadRange(ctx, absPath, stat18.mtimeMs, total, 1, Math.min(total, 200));
+      ctx.recordRead(absPath, stat19.mtimeMs, "user", contentHash);
+      rememberReadRange(ctx, absPath, stat19.mtimeMs, total, 1, Math.min(total, 200));
       const symResult2 = shouldIncludeSymbols ? await fetchSymbolsForFile(absPath, ctx, execOpts?.signal) : void 0;
       return {
-        text: summarizeFile(input.path, stat18.size, allLines),
+        text: summarizeFile(input.path, stat19.size, allLines),
         total_lines: total,
         encoding: "utf8",
         truncated: total > 200,
@@ -22627,8 +23086,8 @@ var readTool = {
       };
     }
     if (limit === 0) {
-      ctx.recordRead(absPath, stat18.mtimeMs, "user", contentHash);
-      rememberReadRange(ctx, absPath, stat18.mtimeMs, total, 1, 0);
+      ctx.recordRead(absPath, stat19.mtimeMs, "user", contentHash);
+      rememberReadRange(ctx, absPath, stat19.mtimeMs, total, 1, 0);
       const symResult2 = shouldIncludeSymbols ? await fetchSymbolsForFile(absPath, ctx, execOpts?.signal) : void 0;
       return {
         text: "",
@@ -22640,8 +23099,8 @@ var readTool = {
       };
     }
     if (offset > total) {
-      ctx.recordRead(absPath, stat18.mtimeMs, "user", contentHash);
-      rememberReadRange(ctx, absPath, stat18.mtimeMs, total, total + 1, total + 1);
+      ctx.recordRead(absPath, stat19.mtimeMs, "user", contentHash);
+      rememberReadRange(ctx, absPath, stat19.mtimeMs, total, total + 1, total + 1);
       const symResult2 = shouldIncludeSymbols ? await fetchSymbolsForFile(absPath, ctx, execOpts?.signal) : void 0;
       return {
         text: `[offset ${offset} is past end of file "${input.path}" \u2014 file has ${total} line(s). Do not retry this offset.]`,
@@ -22656,8 +23115,8 @@ var readTool = {
     const truncated = offset - 1 + slice.length < total;
     const width = String(offset + slice.length - 1).length;
     const numbered = slice.map((line, i) => `${String(offset + i).padStart(width, " ")}\u2192${line}`).join("\n");
-    ctx.recordRead(absPath, stat18.mtimeMs, "user", contentHash);
-    rememberReadRange(ctx, absPath, stat18.mtimeMs, total, offset, offset + slice.length - 1);
+    ctx.recordRead(absPath, stat19.mtimeMs, "user", contentHash);
+    rememberReadRange(ctx, absPath, stat19.mtimeMs, total, offset, offset + slice.length - 1);
     const symResult = shouldIncludeSymbols ? await fetchSymbolsForFile(absPath, ctx, execOpts?.signal) : void 0;
     return {
       text: numbered,
@@ -22763,20 +23222,20 @@ ${interesting.join("\n")}` : "symbols/imports: (none detected)"
 }
 
 // src/replace.ts
-import { expectDefined as expectDefined8 } from "@wrongstack/core/utils";
 import { spawn as spawn15 } from "node:child_process";
 import * as fs29 from "node:fs/promises";
 import * as path33 from "node:path";
+import { ToolValidationError as ToolValidationError6 } from "@wrongstack/core/types";
 import {
   atomicWrite as atomicWrite3,
   buildChildEnv as buildChildEnv9,
   compileGlob as compileGlob4,
   detectNewlineStyle as detectNewlineStyle2,
+  expectDefined as expectDefined8,
   normalizeToLf as normalizeToLf2,
   toStyle as toStyle2,
   unifiedDiff as unifiedDiff2
 } from "@wrongstack/core/utils";
-import { ToolValidationError as ToolValidationError6 } from "@wrongstack/core/types";
 init_util();
 var DEFAULT_IGNORE4 = ["node_modules", ".git", "dist", "build", ".next", "coverage"];
 var replaceTool = {
@@ -22785,6 +23244,10 @@ var replaceTool = {
   description: "Perform a search-and-replace across multiple files using a regex pattern. This is a powerful bulk transformation tool. Dry-run is ON by default \u2014 set `dry_run: false` to apply changes.",
   usageHint: "DANGEROUS IF USED CARELESSLY \u2014 review the diff output carefully.\n\nRecommended workflow:\n1. Run without `dry_run: false` first to see exactly what would change (dry-run is the default).\n2. Review the diff output, then re-run with `dry_run: false` to apply.\n3. Use a specific enough `pattern` (and `glob` / `files`) to avoid accidental broad changes.\n4. `replace_all` controls whether only the first match per file or all matches are replaced.\nThis tool is excellent for large-scale refactors (renaming, import updates, etc.) but must be used with caution.",
   permission: "confirm",
+  // WS-046: gives permission decisions something to key on.
+  // The file scope being rewritten, not the pattern: a trust rule should say
+  // where a bulk replace may run.
+  subjectKey: "files",
   mutating: true,
   capabilities: ["fs.write"],
   icon: "edit",
@@ -22857,8 +23320,8 @@ var replaceTool = {
       }
       const rel = path33.relative(realRoot, realPath);
       if (rel.startsWith("..") || path33.isAbsolute(rel)) continue;
-      const stat18 = await fs29.stat(realPath).catch(() => null);
-      if (!stat18?.isFile()) continue;
+      const stat19 = await fs29.stat(realPath).catch(() => null);
+      if (!stat19?.isFile()) continue;
       let content;
       try {
         const buf = await fs29.readFile(realPath);
@@ -22883,7 +23346,7 @@ var replaceTool = {
       totalReplacements += count;
       if (!dryRun) {
         const newContent = toStyle2(newContentLf, style);
-        await atomicWrite3(realPath, newContent, { mode: stat18.mode & 511 });
+        await atomicWrite3(realPath, newContent, { mode: stat19.mode & 511 });
         const written = await fs29.stat(realPath).catch(() => null);
         if (written) {
           ctx.recordRead?.(realPath, written.mtimeMs, "write", sha256hex(newContent));
@@ -22923,8 +23386,8 @@ async function resolveFiles2(filesInput, ctx, extraGlob) {
   const resolved = [];
   for (const p of parts) {
     const absPath = safeResolve(p, ctx);
-    const stat18 = await fs29.stat(absPath).catch(() => null);
-    if (stat18?.isFile()) {
+    const stat19 = await fs29.stat(absPath).catch(() => null);
+    if (stat19?.isFile()) {
       resolved.push(absPath);
     }
   }
@@ -22944,7 +23407,11 @@ async function globFiles(pattern, base, extraGlob) {
 function checkRg() {
   return new Promise((resolve17) => {
     try {
-      const p = spawn15("rg", ["--version"], { env: buildChildEnv9(), stdio: "ignore", windowsHide: true });
+      const p = spawn15("rg", ["--version"], {
+        env: buildChildEnv9(),
+        stdio: "ignore",
+        windowsHide: true
+      });
       p.on("error", () => resolve17(false));
       p.on("close", (code) => resolve17(code === 0));
     } catch {
@@ -22995,8 +23462,8 @@ async function globNative(pattern, base, extraGlob) {
       if (DEFAULT_IGNORE4.includes(e.name)) continue;
       const full = path33.join(dir, e.name);
       try {
-        const stat18 = await fs29.lstat(full);
-        if (stat18.isSymbolicLink()) continue;
+        const stat19 = await fs29.lstat(full);
+        if (stat19.isSymbolicLink()) continue;
       } catch {
         continue;
       }
@@ -23120,6 +23587,7 @@ var scaffoldTool = {
   usageHint: "PREFERRED FOR SCAFFOLDING:\n\n- Use built-in templates when they match your needs (e.g. react-component, npm-package).\n- Supports `dry_run` so you can preview exactly what will be created.\n- Has the powerful `fs.write.outside-project` capability \u2014 review paths carefully.\nMuch cleaner and safer than manually writing multiple files.",
   permission: "confirm",
   mutating: true,
+  subjectKey: "name",
   capabilities: ["fs.write.outside-project", "fs.write"],
   icon: "scaffold",
   timeoutMs: 3e4,
@@ -23194,15 +23662,17 @@ async function handleBuiltIn(name, templateFiles, cwd, ctx, dryRun, vars) {
     output: dryRun ? `Would create ${filesCreated} files: ${files.join(", ")}` : `Created ${filesCreated} files: ${files.join(", ")}`
   };
 }
+function escapeRegexLiteral(value) {
+  return value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
 function substituteVars(content, name, vars) {
+  const kebab = name.toLowerCase().replace(/\s+/g, "-");
+  const pascal = name.replace(/(?:^|[-_\s]+)([a-z])/g, (_, c) => c.toUpperCase());
   let result = content;
-  result = result.replace(/\{\{name\}\}/g, name.toLowerCase().replace(/\s+/g, "-"));
-  result = result.replace(
-    /\{\{Name\}\}/g,
-    name.replace(/(?:^|[-_\s]+)([a-z])/g, (_, c) => c.toUpperCase())
-  );
+  result = result.replace(/\{\{name\}\}/g, () => kebab);
+  result = result.replace(/\{\{Name\}\}/g, () => pascal);
   for (const [k, v] of Object.entries(vars)) {
-    result = result.replace(new RegExp(`\\{\\{${k}\\}\\}`, "g"), v);
+    result = result.replace(new RegExp(`\\{\\{${escapeRegexLiteral(k)}\\}\\}`, "g"), () => v);
   }
   return result;
 }
@@ -24138,11 +24608,11 @@ var testTool = {
   }
 };
 async function detectRunner(cwd) {
-  const { stat: stat18 } = await import("node:fs/promises");
+  const { stat: stat19 } = await import("node:fs/promises");
   const candidates = ["vitest.config.ts", "jest.config.js", ".mocharc.json"];
   for (const f of candidates) {
     try {
-      await stat18(path35.join(cwd, f));
+      await stat19(path35.join(cwd, f));
       if (f.includes("vitest")) return "vitest";
       if (f.includes("jest")) return "jest";
       if (f.includes("mocha")) return "mocha";
@@ -24539,12 +25009,19 @@ var toolSearchTool = {
 };
 
 // src/tool-use.ts
+import {
+  GOVERNED_TOOL_EXECUTOR_META_KEY as GOVERNED_TOOL_EXECUTOR_META_KEY2
+} from "@wrongstack/core/types";
 var toolUseTool = {
   name: "tool_use",
   category: "Meta",
   description: "Directly execute any registered tool by its exact name, bypassing normal discovery. This is a powerful meta-tool intended for cases where the agent has a clear plan and knows precisely which tool to invoke.",
   usageHint: "ADVANCED META TOOL \u2014 USE WITH CARE:\n\n- Only use when you are certain of the exact tool name and its expected input shape.\n- Prefer using the normal tool calling mechanism when possible.\n- Very useful in batch-tool-use or when orchestrating complex workflows programmatically.\n- The call still goes through full permission checks and capability validation.",
   permission: "confirm",
+  // WS-046: gives permission decisions something to key on.
+  // The tool being invoked through this indirection — the whole point of a
+  // permission decision here is WHICH tool is being reached.
+  subjectKey: "tool",
   mutating: true,
   timeoutMs: 6e4,
   capabilities: ["tool.mutate.any"],
@@ -24563,7 +25040,7 @@ var toolUseTool = {
     },
     required: ["tool"]
   },
-  async execute(input, ctx, opts) {
+  async execute(input, ctx) {
     const start = Date.now();
     if (!input?.tool) {
       return {
@@ -24582,6 +25059,14 @@ var toolUseTool = {
         executionMs: Date.now() - start
       };
     }
+    if (tool.name === toolUseTool.name) {
+      return {
+        tool: input.tool,
+        success: false,
+        error: "tool_use: recursive meta-tool execution is not allowed",
+        executionMs: Date.now() - start
+      };
+    }
     if (tool.permission === "deny") {
       return {
         tool: input.tool,
@@ -24590,12 +25075,21 @@ var toolUseTool = {
         executionMs: Date.now() - start
       };
     }
+    const governedExecute = ctx.meta[GOVERNED_TOOL_EXECUTOR_META_KEY2];
+    if (typeof governedExecute !== "function") {
+      return {
+        tool: input.tool,
+        success: false,
+        error: "tool_use: governed nested execution is unavailable; call the tool directly",
+        executionMs: Date.now() - start
+      };
+    }
     try {
-      const result = await tool.execute(input.input, ctx, opts);
+      const result = await governedExecute(input.tool, input.input ?? {});
       return {
         tool: input.tool,
-        success: true,
-        result,
+        success: result.success,
+        ...result.success ? { result: result.result } : { error: result.error ?? "nested tool failed" },
         executionMs: Date.now() - start
       };
     } catch (e) {
@@ -24611,10 +25105,12 @@ var toolUseTool = {
 
 // src/tree.ts
 init_util();
-import { DEFAULT_WALK_IGNORE_DIRS as DEFAULT_WALK_IGNORE_DIRS4, expectDefined as expectDefined10 } from "@wrongstack/core/utils";
 import * as fs32 from "node:fs/promises";
 import * as path36 from "node:path";
+import { DEFAULT_WALK_IGNORE_DIRS as DEFAULT_WALK_IGNORE_DIRS4, expectDefined as expectDefined10 } from "@wrongstack/core/utils";
 var DEFAULT_IGNORE5 = [...DEFAULT_WALK_IGNORE_DIRS4, ".wrongstack", ".ssh", ".gnupg", ".aws"];
+var DEFAULT_MAX_ENTRIES2 = 5e3;
+var MAX_TREE_OUTPUT_BYTES = 256 * 1024;
 var treeTool = {
   name: "tree",
   category: "Filesystem",
@@ -24658,6 +25154,12 @@ var treeTool = {
       show_hidden: {
         type: "boolean",
         description: "Show hidden files starting with . (default: false)"
+      },
+      max_entries: {
+        type: "integer",
+        description: `Maximum entries retained in the rendered tree (default ${DEFAULT_MAX_ENTRIES2}).`,
+        minimum: 1,
+        maximum: 5e4
       }
     }
   },
@@ -24671,7 +25173,7 @@ var treeTool = {
     if (!final) throw new Error("tree: stream ended without final event");
     return final;
   },
-  async *executeStream(input, ctx) {
+  async *executeStream(input, ctx, opts) {
     const basePath = input.path ? safeResolve(input.path, ctx) : ctx.cwd;
     const maxDepth = input.depth ?? 3;
     const showFiles = input.show_files ?? true;
@@ -24679,8 +25181,17 @@ var treeTool = {
     const showHidden = input.show_hidden ?? false;
     const exclude = /* @__PURE__ */ new Set([...DEFAULT_IGNORE5, ...input.exclude ?? []]);
     const filterGlob = input.glob;
+    const maxEntries = input.max_entries ?? DEFAULT_MAX_ENTRIES2;
+    const signal = opts?.signal ?? ctx.signal ?? new AbortController().signal;
     const lines = [basePath];
     const totals = { totalFiles: { value: 0 }, totalDirs: { value: 0 } };
+    const retention = {
+      entries: 0,
+      outputBytes: Buffer.byteLength(basePath, "utf8"),
+      maxEntries,
+      maxOutputBytes: MAX_TREE_OUTPUT_BYTES,
+      truncated: false
+    };
     const queue = [];
     const FLUSH_EVERY = 200;
     let lastEmittedTotal = 0;
@@ -24707,12 +25218,19 @@ var treeTool = {
       isLast: true,
       totalFiles: totals.totalFiles,
       totalDirs: totals.totalDirs,
-      onProgress: tickProgress
+      onProgress: tickProgress,
+      retention,
+      signal
     });
     let walkDone = false;
-    walkPromise.finally(() => {
-      walkDone = true;
-    });
+    void walkPromise.then(
+      () => {
+        walkDone = true;
+      },
+      () => {
+        walkDone = true;
+      }
+    );
     while (!walkDone || queue.length > 0) {
       if (queue.length > 0) {
         yield expectDefined10(queue.shift());
@@ -24735,13 +25253,15 @@ var treeTool = {
         tree: lines.join("\n"),
         total_files: totals.totalFiles.value,
         total_dirs: totals.totalDirs.value,
-        truncated: false,
+        truncated: retention.truncated,
         path: basePath
       }
     };
   }
 };
 async function walkDir(dir, depth, opts) {
+  opts.signal.throwIfAborted();
+  if (opts.retention.truncated) return;
   const entries = await fs32.readdir(dir, { withFileTypes: true }).catch(() => []);
   const filtered = entries.filter((e) => {
     if (!opts.showHidden && e.name.startsWith(".")) return false;
@@ -24761,6 +25281,8 @@ async function walkDir(dir, depth, opts) {
     return a.name.localeCompare(b.name);
   });
   for (let i = 0; i < items.length; i++) {
+    opts.signal.throwIfAborted();
+    if (opts.retention.truncated) return;
     const entry = items[i];
     if (!entry) continue;
     const isLast = i === items.length - 1;
@@ -24769,7 +25291,15 @@ async function walkDir(dir, depth, opts) {
     const displayName = entry.name + (entry.isDirectory() ? "/" : "");
     if (!opts.showDirs && entry.isDirectory()) continue;
     if (!opts.showFiles && entry.isFile()) continue;
-    opts.lines.push(opts.prefix + branch + displayName);
+    const line = opts.prefix + branch + displayName;
+    const lineBytes = Buffer.byteLength(line, "utf8") + 1;
+    if (opts.retention.entries >= opts.retention.maxEntries || opts.retention.outputBytes + lineBytes > opts.retention.maxOutputBytes) {
+      opts.retention.truncated = true;
+      return;
+    }
+    opts.lines.push(line);
+    opts.retention.entries++;
+    opts.retention.outputBytes += lineBytes;
     if (entry.isDirectory() && (opts.maxDepth === 0 || depth < opts.maxDepth)) {
       const childPrefix = opts.prefix + connector;
       await walkDir(path36.join(dir, entry.name), depth + 1, {
@@ -24884,11 +25414,11 @@ var typecheckTool = {
   }
 };
 async function findTsConfig(cwd) {
-  const { stat: stat18 } = await import("node:fs/promises");
+  const { stat: stat19 } = await import("node:fs/promises");
   const candidates = ["tsconfig.json", "tsconfig.base.json"];
   for (const f of candidates) {
     try {
-      const s = await stat18(path37.join(cwd, f));
+      const s = await stat19(path37.join(cwd, f));
       if (s.isFile()) return path37.join(cwd, f);
     } catch {
     }
@@ -24963,12 +25493,12 @@ async function prepareWrite(input, ctx) {
   let existed = false;
   let prev = "";
   try {
-    const stat18 = await fs33.stat(absPath);
-    existed = stat18.isFile();
+    const stat19 = await fs33.stat(absPath);
+    existed = stat19.isFile();
     if (existed) {
       if (!ctx.hasRead(absPath)) {
         prev = await fs33.readFile(absPath, "utf8");
-        ctx.recordRead(absPath, stat18.mtimeMs, "write", sha256hex(prev));
+        ctx.recordRead(absPath, stat19.mtimeMs, "write", sha256hex(prev));
       } else {
         prev = await fs33.readFile(absPath, "utf8");
       }
@@ -24985,8 +25515,8 @@ async function finishWrite(input, ctx, prepared, signal) {
   await atomicWrite5(prepared.absPath, input.content);
   const diff = prepared.existed ? unifiedDiff3(prepared.prev, input.content, { fromFile: input.path, toFile: input.path }) : `+++ ${input.path}
 + (new file, ${input.content.split("\n").length} lines)`;
-  const stat18 = await fs33.stat(prepared.absPath);
-  ctx.recordRead(prepared.absPath, stat18.mtimeMs, "write", sha256hex(input.content));
+  const stat19 = await fs33.stat(prepared.absPath);
+  ctx.recordRead(prepared.absPath, stat19.mtimeMs, "write", sha256hex(input.content));
   ctx.session.recordFileChange({
     path: prepared.absPath,
     action: prepared.existed ? "modified" : "created",
@@ -26174,9 +26704,9 @@ async function walk(root, dir, out) {
     } else if (e.isFile()) {
       if (e.name === "SKILL.md" || e.name === "SKILL.save.md") continue;
       try {
-        const stat18 = await fs34.stat(fullPath);
+        const stat19 = await fs34.stat(fullPath);
         const rel = path38.relative(root, fullPath).split(path38.sep).join("/");
-        out.push({ path: rel, bytes: stat18.size });
+        out.push({ path: rel, bytes: stat19.size });
       } catch {
       }
     }