@wrongstack/tools 0.305.1 → 0.306.0

package/dist/_shell-pick.d.ts

@@ -77,11 +77,10 @@ export declare function pickShell(platform: NodeJS.Platform, command: string, en
  *     `-replace`, `-split`, `-join`, `-is`, `-as`, `-f`).
  *   - `.ps1` extension mentioned in the command.
  *   - `&` call operator followed by a `$`-variable (`& $cmd ...`).
- *   - Common PowerShell aliases that don't exist in cmd.exe: `gci`, `gi`,
- *     `gp`, `sl`, `cd` is ambiguous (cmd.exe has `cd` too — skip), `ls`
- *     ambiguous (cmd.exe does NOT have `ls`), `cat`, `cp`, `mv`, `rm`,
- *     `echo` (echo is in cmd too), `gcm`, `gci`, `gps`, `ps`, `select`,
- *     `where`, `?`, `%`.
+ *   - PowerShell-only aliases: `gci`, `gi`, `gp`, `gcm`, `gps`. Unix-style
+ *     names (`ls`, `cat`, `cp`, `mv`, `rm`, `sl`) are deliberately NOT
+ *     treated as PowerShell tells — they are Git-Bash/MSYS-normal on
+ *     Windows and their PS alias semantics differ (`rm -rf` fails in PS).
  *   - `#requires` directive at start of script.
  *   - `param()` block at start of script.
  *

package/dist/_util.d.ts

@@ -8,12 +8,19 @@ export declare function sha256hex(content: string): string;
 /** Detected package manager for a project directory. */
 export type PackageManager = 'pnpm' | 'yarn' | 'npm';
 /**
- * Detect the project's package manager by inspecting lockfiles in `cwd`.
- * Order: pnpm → yarn → npm (default). Missing or unreadable directories fall
- * back to `npm` rather than throwing, so a `safeResolve`-checked cwd that
- * happens to be empty never aborts the tool.
+ * Detect the project's package manager.
+ *
+ * Per directory, precedence is: `package.json#packageManager` (authoritative
+ * when declared) → `pnpm-lock.yaml` → `yarn.lock` → `bun.lockb`/`bun.lock`
+ * (bun is treated as npm-compatible and reported as `npm`) →
+ * `package-lock.json`/`npm-shrinkwrap.json`. When `stopAt` (usually the
+ * project root) is provided and `cwd` is nested inside it, parent directories
+ * are walked up to and including `stopAt` — monorepo packages rarely carry
+ * their own lockfile. Missing or unreadable directories fall back to `npm`
+ * rather than throwing, so a `safeResolve`-checked cwd that happens to be
+ * empty never aborts the tool.
  */
-export declare function detectPackageManager(cwd: string): Promise<PackageManager>;
+export declare function detectPackageManager(cwd: string, stopAt?: string): Promise<PackageManager>;
 export declare function resolvePath(input: string, ctx: Context): string;
 export declare function ensureInsideRoot(absPath: string, ctx: Context): string;
 export declare function safeResolve(input: string, ctx: Context): string;
@@ -62,6 +69,16 @@ export declare function resolveRealInsideRoot(absPath: string, ctx: Context): Pr
  * caller then opened.
  */
 export declare function safeResolveReal(input: string, ctx: Context): Promise<string>;
+/**
+ * Truncate a diff (or similar text payload) to `maxBytes`, cutting at a line
+ * boundary and appending an explicit marker. Used by the mutating file tools
+ * (`write`, `edit`, `replace`) so their returned diffs stay inside the tool's
+ * declared `maxOutputBytes` budget instead of relying on downstream clipping.
+ */
+export declare function truncateDiffPayload(diff: string, maxBytes: number): {
+    text: string;
+    truncated: boolean;
+};
 export declare function truncateMiddle(s: string, max: number): string;
 export declare function isBinaryBuffer(buf: Buffer): boolean;
 /** Unified byte cap for all command tool output fed to the model. */

package/dist/audit.d.ts

@@ -3,7 +3,6 @@ interface AuditInput {
     cwd?: string | undefined;
     level?: 'low' | 'moderate' | 'high' | 'critical' | undefined;
     fix?: boolean | undefined;
-    packages?: string | string[] | undefined;
 }
 interface AuditVulnerability {
     severity: string;

package/dist/audit.js

@@ -364,8 +364,11 @@ var SENSITIVE_FLAG_PATTERNS = [
   /--(?:token|password|passwd|pwd|secret|api[-_]?key|api[-_]?secret|auth|credential|private[-_]?key|access[-_]?key|github[-_]?token|gh[-_]?token|bearer|jwt|oauth|pin|pincode|passphrase|access[-_]?token)(?:[=\s,][^\s]*)?/gi,
   // -t short flag (token): attached (-tVALUE), separated (-t VALUE), or -t=VALUE.
   // (?<![-\w]) anchors to a token start so we don't match the `-t` inside `--token`.
+  // The value must be token-like (>= 8 chars) so ordinary combined flags such
+  // as `tar -tf` / `ssh -tt` are not eaten. Global flag: EVERY occurrence is
+  // redacted, not just the first.
   // NOTE: synced with @wrongstack/core observability/redact-command.ts.
-  /(?<![-\w])-t(?:[=\s]+)?[^\s,-]+/,
+  /(?<![-\w])-t(?:[=\s]+)?[^\s,-]{8,}/g,
   // -p|-password|-a (redis auth) short flags: attached + separated + =value.
   // Same token-start anchor; over-redaction is an accepted tradeoff for a
   // redaction function. Synced with core copy.
@@ -373,8 +376,9 @@ var SENSITIVE_FLAG_PATTERNS = [
   // env var–style secrets: TOKEN=x, API_KEY=y, etc.
   /(?:TOKEN|API_KEY|API_SECRET|AUTH_TOKEN|GITHUB_TOKEN|GH_TOKEN|BEARER|JWT|OAUTH|CREDENTIAL|SECRET|PRIVATE_KEY|PASSWORD|PASSWD)\s*[=:]\s*[^\s,]+/gi,
   // Generic high-entropy look: base64 strings >32 chars or hex strings >32 digits — but only
-  // when preceded by a flag name (e.g. --github-token=EyJ...).
-  /--\w*(?:token|key|secret|password|passwd|auth|credential)\w*[=\s,][A-Za-z0-9+/=]{32,}/
+  // when preceded by a flag name (e.g. --github-token=EyJ...). Global flag so
+  // every such flag in the command line is redacted, not just the first.
+  /--\w*(?:token|key|secret|password|passwd|auth|credential)\w*[=\s,][A-Za-z0-9+/=]{32,}/g
 ];
 function redactCommand(cmd) {
   let result = cmd;
@@ -463,11 +467,15 @@ var ProcessRegistryImpl = class {
     return Number.isInteger(pid) && pid > 1 && pid !== process.pid && pid !== process.ppid;
   }
   _canSignalProcessGroup(p) {
-    return os.platform() !== "win32" && p.processGroupLeader === true && this._isSafeSignalPid(p.pid) && typeof p.child.pid === "number" && p.child.pid === p.pid;
+    return os.platform() !== "win32" && p.processGroupLeader === true && this._isSafeSignalPid(p.pid) && p.child !== null && typeof p.child.pid === "number" && p.child.pid === p.pid;
   }
   _killChildDirect(p, signal) {
     try {
-      p.child.kill(signal);
+      if (p.child) {
+        p.child.kill(signal);
+        return;
+      }
+      if (this._isSafeSignalPid(p.pid)) process.kill(p.pid, signal);
     } catch {
     }
   }
@@ -665,15 +673,15 @@ var ProcessRegistryImpl = class {
     this._pruneStale(pid);
     const p = this.processes.get(pid);
     if (!p) return false;
-    if (p.killed) return true;
+    if (p.killed && opts.force !== true) return true;
     if (p.protected && opts.includeProtected !== true) return false;
     if (opts.preserveBackground && p.background) return false;
     const { force = false, graceMs = DEFAULT_GRACE_MS } = opts;
     const isWin2 = os.platform() === "win32";
     if (isWin2) {
-      const liveRealChild = p.child.exitCode === null && typeof p.child.pid === "number";
+      const liveRealChild = p.child === null || p.child.exitCode === null && typeof p.child.pid === "number";
       const directFallback = () => {
-        if (p.child.exitCode === null) {
+        if (p.child && p.child.exitCode === null) {
           try {
             p.child.kill("SIGKILL");
           } catch {
@@ -685,10 +693,7 @@ var ProcessRegistryImpl = class {
         onSettled: directFallback
       })) {
       } else {
-        try {
-          p.child.kill(force ? "SIGKILL" : "SIGTERM");
-        } catch {
-        }
+        this._killChildDirect(p, force ? "SIGKILL" : "SIGTERM");
       }
       p.killed = true;
       return true;
@@ -699,7 +704,7 @@ var ProcessRegistryImpl = class {
       } else {
         this._killPosix(p, "SIGTERM");
         const timer = setTimeout(() => {
-          if (this.processes.has(pid) && !p.child.killed) {
+          if (this.processes.has(pid) && !p.child?.killed) {
             this._killPosix(p, "SIGKILL");
           }
         }, graceMs);
@@ -754,6 +759,16 @@ var ProcessRegistryImpl = class {
    * before reusing a PID, but we want to clean up before that becomes a risk.
    */
   _isStaleEntry(entry) {
+    if (entry.child === null) {
+      if (Date.now() - entry.startedAt <= 6e4) return false;
+      if (os.platform() === "win32") return false;
+      try {
+        process.kill(entry.pid, 0);
+        return false;
+      } catch (err) {
+        return err.code !== "EPERM";
+      }
+    }
     return entry.child.exitCode !== null && Date.now() - entry.startedAt > 6e4;
   }
   /**
@@ -1028,19 +1043,48 @@ function utf8Prefix(text, maxBytes) {
 // src/_util.ts
 import * as path3 from "node:path";
 import * as Core from "@wrongstack/core/utils";
-async function detectPackageManager(cwd) {
-  const { stat: stat5 } = await import("node:fs/promises");
-  try {
-    await stat5(`${cwd}/pnpm-lock.yaml`);
-    return "pnpm";
-  } catch {
+async function detectPackageManager(cwd, stopAt) {
+  let dir = path3.resolve(cwd);
+  const stop = stopAt ? path3.resolve(stopAt) : dir;
+  for (; ; ) {
+    const found = await detectPackageManagerInDir(dir);
+    if (found) return found;
+    if (dir === stop) break;
+    const parent = path3.dirname(dir);
+    const relParent = path3.relative(stop, parent);
+    if (parent === dir || relParent.startsWith("..") || path3.isAbsolute(relParent)) break;
+    dir = parent;
   }
+  return "npm";
+}
+async function detectPackageManagerInDir(dir) {
+  const fs6 = await import("node:fs/promises");
   try {
-    await stat5(`${cwd}/yarn.lock`);
-    return "yarn";
+    const raw = await fs6.readFile(path3.join(dir, "package.json"), "utf8");
+    const declared = JSON.parse(raw).packageManager;
+    if (typeof declared === "string") {
+      const name = declared.split("@")[0] ?? "";
+      if (name === "pnpm" || name === "yarn") return name;
+      if (name === "npm" || name === "bun") return "npm";
+    }
   } catch {
   }
-  return "npm";
+  const lockfiles = [
+    ["pnpm-lock.yaml", "pnpm"],
+    ["yarn.lock", "yarn"],
+    ["bun.lockb", "npm"],
+    ["bun.lock", "npm"],
+    ["package-lock.json", "npm"],
+    ["npm-shrinkwrap.json", "npm"]
+  ];
+  for (const [file, manager] of lockfiles) {
+    try {
+      await fs6.stat(`${dir}/${file}`);
+      return manager;
+    } catch {
+    }
+  }
+  return null;
 }
 function resolvePath(input, ctx) {
   return path3.isAbsolute(input) ? path3.normalize(input) : path3.resolve(ctx.workingDir ?? ctx.cwd, input);
@@ -3798,11 +3842,18 @@ async function tryLegacyPackageOperation(operation, ctx, packages = []) {
 }
 
 // src/audit.ts
+var SEVERITY_RANK = {
+  info: 0,
+  low: 1,
+  moderate: 2,
+  high: 3,
+  critical: 4
+};
 var auditTool = {
   name: "audit",
   category: "Package Management",
   description: "Run a security audit against project dependencies (using pnpm/npm audit). Reports known vulnerabilities with severity.",
-  usageHint: "CRITICAL SECURITY TOOL:\n\n- Run regularly and especially before any release.\n- Use `level` to focus on high/critical issues.\n- `fix` can attempt automatic remediation for some vulnerabilities.\nThis is one of the most important tools for supply chain security.",
+  usageHint: "CRITICAL SECURITY TOOL:\n\n- Run regularly and especially before any release.\n- Use `level` to focus on high/critical issues.\n- This tool is read-only: to remediate, use `install` (or `language_package`) to upgrade the affected packages.\nThis is one of the most important tools for supply chain security.",
   permission: "confirm",
   mutating: false,
   capabilities: ["shell.restricted"],
@@ -3817,8 +3868,10 @@ var auditTool = {
         enum: ["low", "moderate", "high", "critical"],
         description: "Minimum severity level to report"
       },
-      fix: { type: "boolean", description: "Attempt to fix vulnerabilities (default: false)" },
-      packages: { type: "string", description: "Specific package(s) to audit (comma-separated)" }
+      fix: {
+        type: "boolean",
+        description: "Deprecated and rejected \u2014 this tool is read-only and never modifies dependencies. Use `install` (or `language_package`) to remediate vulnerabilities."
+      }
     }
   },
   async execute(input, ctx, opts) {
@@ -3832,6 +3885,11 @@ var auditTool = {
     return final;
   },
   async *executeStream(input, ctx, opts) {
+    if (input.fix === true) {
+      throw new Error(
+        "audit: `fix: true` is not supported \u2014 this tool is read-only (mutating: false). To remediate vulnerabilities, upgrade the affected packages with the `install` tool (or `language_package` for non-JS ecosystems)."
+      );
+    }
     const cwd = input.cwd ? safeResolve(input.cwd, ctx) : ctx.cwd;
     const bridge = await tryLegacyPackageOperation("package-audit", {
       cwd,
@@ -3861,13 +3919,11 @@ var auditTool = {
       };
       return;
     }
-    const manager = await detectPackageManager(cwd);
+    const manager = await detectPackageManager(cwd, ctx.projectRoot);
     yield { type: "log", text: `Auditing with ${manager}\u2026`, data: { manager } };
     const args = ["audit", "--json"];
-    if (input.fix) args.push("--fix");
-    if (input.packages) {
-      const pkgs = Array.isArray(input.packages) ? input.packages : input.packages.split(",");
-      args.push(...pkgs.map((p) => p.trim()));
+    if (input.level && (manager === "npm" || manager === "pnpm")) {
+      args.push(`--audit-level=${input.level}`);
     }
     const result = yield* spawnStream({
       cmd: manager,
@@ -3876,10 +3932,16 @@ var auditTool = {
       signal: opts.signal,
       maxBytes: 1e5
     });
-    yield { type: "final", output: parseAuditOutput(result.stdout, result.exitCode) };
+    yield {
+      type: "final",
+      output: parseAuditOutput(result.stdout, result.exitCode, {
+        level: input.level,
+        spawnTruncated: result.truncated
+      })
+    };
   }
 };
-function parseAuditOutput(json, exitCode) {
+function parseAuditOutput(json, exitCode, opts = {}) {
   if (!json) {
     return {
       exit_code: exitCode,
@@ -3890,18 +3952,14 @@ function parseAuditOutput(json, exitCode) {
       truncated: false
     };
   }
+  const cappedOutput = normalizeCommandOutput(json);
+  const truncated = opts.spawnTruncated === true || Buffer.byteLength(json, "utf8") > COMMAND_OUTPUT_MAX_BYTES;
   try {
     const data = JSON.parse(json);
-    const advisories = [];
-    const ads = data.advisories ?? {};
-    for (const id of Object.keys(ads)) {
-      const adv = ads[id];
-      advisories.push({
-        severity: adv.severity ?? "unknown",
-        package: adv.module_name ?? id,
-        title: adv.title ?? "Unknown vulnerability",
-        url: adv.url ?? ""
-      });
+    let advisories = extractAdvisories(data);
+    const minRank = opts.level ? SEVERITY_RANK[opts.level] ?? 0 : 0;
+    if (minRank > 0) {
+      advisories = advisories.filter((a) => (SEVERITY_RANK[a.severity] ?? 0) >= minRank);
     }
     const total = advisories.length;
     const summary = total === 0 ? "No vulnerabilities found" : `Found ${total} vulnerabilities: ${advisories.filter((a) => a.severity === "critical").length} critical, ${advisories.filter((a) => a.severity === "high").length} high`;
@@ -3910,8 +3968,8 @@ function parseAuditOutput(json, exitCode) {
       vulnerabilities: advisories,
       total,
       summary,
-      output: json,
-      truncated: json.length > 1e5
+      output: cappedOutput,
+      truncated
     };
   } catch {
     return {
@@ -3919,11 +3977,42 @@ function parseAuditOutput(json, exitCode) {
       vulnerabilities: [],
       total: 0,
       summary: "Could not parse audit output",
-      output: json,
-      truncated: false
+      output: cappedOutput,
+      truncated
     };
   }
 }
+function extractAdvisories(data) {
+  const advisories = [];
+  const ads = data["advisories"];
+  if (ads && typeof ads === "object") {
+    for (const [id, value] of Object.entries(ads)) {
+      const adv = value ?? {};
+      advisories.push({
+        severity: typeof adv["severity"] === "string" ? adv["severity"] : "unknown",
+        package: typeof adv["module_name"] === "string" ? adv["module_name"] : id,
+        title: typeof adv["title"] === "string" ? adv["title"] : "Unknown vulnerability",
+        url: typeof adv["url"] === "string" ? adv["url"] : ""
+      });
+    }
+    return advisories;
+  }
+  const vulns = data["vulnerabilities"];
+  if (vulns && typeof vulns === "object") {
+    for (const [pkg, value] of Object.entries(vulns)) {
+      const vuln = value ?? {};
+      const via = Array.isArray(vuln["via"]) ? vuln["via"] : [];
+      const detail = via.find((v) => !!v && typeof v === "object");
+      advisories.push({
+        severity: typeof vuln["severity"] === "string" ? vuln["severity"] : "unknown",
+        package: pkg,
+        title: detail && typeof detail["title"] === "string" ? detail["title"] : "Unknown vulnerability",
+        url: detail && typeof detail["url"] === "string" ? detail["url"] : ""
+      });
+    }
+  }
+  return advisories;
+}
 export {
   auditTool
 };

package/dist/bash.js

@@ -1,6 +1,7 @@
 // src/bash.ts
 import { spawn as spawn2 } from "node:child_process";
 import * as os4 from "node:os";
+import { StringDecoder } from "node:string_decoder";
 import {
   emitProcessCompleted,
   emitProcessOutput,
@@ -394,8 +395,11 @@ var SENSITIVE_FLAG_PATTERNS = [
   /--(?:token|password|passwd|pwd|secret|api[-_]?key|api[-_]?secret|auth|credential|private[-_]?key|access[-_]?key|github[-_]?token|gh[-_]?token|bearer|jwt|oauth|pin|pincode|passphrase|access[-_]?token)(?:[=\s,][^\s]*)?/gi,
   // -t short flag (token): attached (-tVALUE), separated (-t VALUE), or -t=VALUE.
   // (?<![-\w]) anchors to a token start so we don't match the `-t` inside `--token`.
+  // The value must be token-like (>= 8 chars) so ordinary combined flags such
+  // as `tar -tf` / `ssh -tt` are not eaten. Global flag: EVERY occurrence is
+  // redacted, not just the first.
   // NOTE: synced with @wrongstack/core observability/redact-command.ts.
-  /(?<![-\w])-t(?:[=\s]+)?[^\s,-]+/,
+  /(?<![-\w])-t(?:[=\s]+)?[^\s,-]{8,}/g,
   // -p|-password|-a (redis auth) short flags: attached + separated + =value.
   // Same token-start anchor; over-redaction is an accepted tradeoff for a
   // redaction function. Synced with core copy.
@@ -403,8 +407,9 @@ var SENSITIVE_FLAG_PATTERNS = [
   // env var–style secrets: TOKEN=x, API_KEY=y, etc.
   /(?:TOKEN|API_KEY|API_SECRET|AUTH_TOKEN|GITHUB_TOKEN|GH_TOKEN|BEARER|JWT|OAUTH|CREDENTIAL|SECRET|PRIVATE_KEY|PASSWORD|PASSWD)\s*[=:]\s*[^\s,]+/gi,
   // Generic high-entropy look: base64 strings >32 chars or hex strings >32 digits — but only
-  // when preceded by a flag name (e.g. --github-token=EyJ...).
-  /--\w*(?:token|key|secret|password|passwd|auth|credential)\w*[=\s,][A-Za-z0-9+/=]{32,}/
+  // when preceded by a flag name (e.g. --github-token=EyJ...). Global flag so
+  // every such flag in the command line is redacted, not just the first.
+  /--\w*(?:token|key|secret|password|passwd|auth|credential)\w*[=\s,][A-Za-z0-9+/=]{32,}/g
 ];
 function redactCommand(cmd) {
   let result = cmd;
@@ -493,11 +498,15 @@ var ProcessRegistryImpl = class {
     return Number.isInteger(pid) && pid > 1 && pid !== process.pid && pid !== process.ppid;
   }
   _canSignalProcessGroup(p) {
-    return os.platform() !== "win32" && p.processGroupLeader === true && this._isSafeSignalPid(p.pid) && typeof p.child.pid === "number" && p.child.pid === p.pid;
+    return os.platform() !== "win32" && p.processGroupLeader === true && this._isSafeSignalPid(p.pid) && p.child !== null && typeof p.child.pid === "number" && p.child.pid === p.pid;
   }
   _killChildDirect(p, signal) {
     try {
-      p.child.kill(signal);
+      if (p.child) {
+        p.child.kill(signal);
+        return;
+      }
+      if (this._isSafeSignalPid(p.pid)) process.kill(p.pid, signal);
     } catch {
     }
   }
@@ -695,15 +704,15 @@ var ProcessRegistryImpl = class {
     this._pruneStale(pid);
     const p = this.processes.get(pid);
     if (!p) return false;
-    if (p.killed) return true;
+    if (p.killed && opts.force !== true) return true;
     if (p.protected && opts.includeProtected !== true) return false;
     if (opts.preserveBackground && p.background) return false;
     const { force = false, graceMs = DEFAULT_GRACE_MS } = opts;
     const isWin2 = os.platform() === "win32";
     if (isWin2) {
-      const liveRealChild = p.child.exitCode === null && typeof p.child.pid === "number";
+      const liveRealChild = p.child === null || p.child.exitCode === null && typeof p.child.pid === "number";
       const directFallback = () => {
-        if (p.child.exitCode === null) {
+        if (p.child && p.child.exitCode === null) {
           try {
             p.child.kill("SIGKILL");
           } catch {
@@ -715,10 +724,7 @@ var ProcessRegistryImpl = class {
         onSettled: directFallback
       })) {
       } else {
-        try {
-          p.child.kill(force ? "SIGKILL" : "SIGTERM");
-        } catch {
-        }
+        this._killChildDirect(p, force ? "SIGKILL" : "SIGTERM");
       }
       p.killed = true;
       return true;
@@ -729,7 +735,7 @@ var ProcessRegistryImpl = class {
       } else {
         this._killPosix(p, "SIGTERM");
         const timer = setTimeout(() => {
-          if (this.processes.has(pid) && !p.child.killed) {
+          if (this.processes.has(pid) && !p.child?.killed) {
             this._killPosix(p, "SIGKILL");
           }
         }, graceMs);
@@ -784,6 +790,16 @@ var ProcessRegistryImpl = class {
    * before reusing a PID, but we want to clean up before that becomes a risk.
    */
   _isStaleEntry(entry) {
+    if (entry.child === null) {
+      if (Date.now() - entry.startedAt <= 6e4) return false;
+      if (os.platform() === "win32") return false;
+      try {
+        process.kill(entry.pid, 0);
+        return false;
+      } catch (err) {
+        return err.code !== "EPERM";
+      }
+    }
     return entry.child.exitCode !== null && Date.now() - entry.startedAt > 6e4;
   }
   /**
@@ -1084,7 +1100,6 @@ var PersistentProcessRegistry = class {
     try {
       const data = await readRegistryFile(this.registryPath);
       data.instances.set(String(entry.pid), entry);
-      const child = null;
       this.baseRegistry.register({
         pid: entry.pid,
         name: entry.name,
@@ -1092,7 +1107,7 @@ var PersistentProcessRegistry = class {
         startedAt: entry.startedAt,
         sessionId: entry.sessionId,
         protected: entry.protected,
-        child
+        child: null
       });
       await writeRegistryFile(this.registryPath, data);
     } finally {
@@ -1652,7 +1667,7 @@ function looksLikePowerShell(command) {
     return true;
   }
   if (PS_VERB_RE.test(trimmed)) return true;
-  if (/(?:^|[\s;&|])(gci|gi|gp|gcm|gps|sl|rm|cat|cp|mv)\b/i.test(trimmed)) {
+  if (/(?:^|[\s;&|])(gci|gi|gp|gcm|gps)\b/i.test(trimmed)) {
     return true;
   }
   if (looksLikePowerShellExtended(command)) return true;
@@ -1782,7 +1797,7 @@ var bashTool = {
   name: "bash",
   category: "Shell",
   description: "Execute an arbitrary command in the user's default shell (bash/zsh/pwsh/cmd). stdout and stderr are merged into one stream. This is the most powerful and dangerous tool \u2014 it gives the model full access to the developer's machine. Prefer specialized tools whenever possible.",
-  usageHint: "SECURITY WARNING: This tool runs with the full privileges of the current user.\n\nBest practices for the model:\n- Strongly prefer `exec` for known safe commands (node, npm, pnpm, tsc, git, etc.).\n- Use bash only when you genuinely need shell features (pipes, redirection, complex one-liners).\n- Prefer single focused commands over huge `&&` chains.\n- Use `background: true` only for long-running processes (dev servers, watchers).\n- The working directory is the project root.\n- Output may be truncated in the middle for very large results.",
+  usageHint: "SECURITY WARNING: This tool runs with the full privileges of the current user.\n\nBest practices for the model:\n- Strongly prefer `exec` for known safe commands (node, npm, pnpm, tsc, git, etc.).\n- Use bash only when you genuinely need shell features (pipes, redirection, complex one-liners).\n- Prefer single focused commands over huge `&&` chains.\n- Use `background: true` only for long-running processes (dev servers, watchers).\n- The working directory is the session working dir (changed via `set_working_dir`), defaulting to the project root.\n- Output may be truncated in the middle for very large results.",
   selection: {
     doNotUseWhen: "the command is allowlisted and does not require pipes, redirection, or shell expansion.",
     useInstead: ["exec"]
@@ -1796,7 +1811,14 @@ var bashTool = {
   // explicitly removes the implicit cross-tool aliasing.
   subjectKey: "command",
   capabilities: ["shell.arbitrary"],
-  timeoutMs: 3e5,
+  // Executor-level abort ceiling. Must sit ABOVE the per-call `timeout_ms`
+  // ceiling (600_000): the tool's own timer tree-kills and returns a
+  // structured `timed_out: true` result, while the executor's
+  // AbortSignal.timeout is a blunt abort. The old value (300_000) meant any
+  // timeout_ms > 5min was silently cut short by the executor. The 10s margin
+  // covers the kill/teardown window. (The executor additionally clamps to
+  // config `tools.maxToolTimeoutMs`.)
+  timeoutMs: 61e4,
   maxOutputBytes: MAX_OUTPUT,
   estimatedDurationMs: 3e4,
   inputSchema: {
@@ -1808,7 +1830,7 @@ var bashTool = {
       },
       timeout_ms: {
         type: "integer",
-        description: "Optional timeout for this specific command in milliseconds."
+        description: "Optional timeout for this specific command in milliseconds (default 300000, max 600000)."
       },
       background: {
         type: "boolean",
@@ -1859,16 +1881,7 @@ var bashTool = {
       return;
     }
     const PIPE_TO_SHELL_PATTERN = /\|\s*(sh|bash|ksh|zsh|fish|cmd|powershell|pwsh)/i;
-    if (PIPE_TO_SHELL_PATTERN.test(input.command)) {
-      console.warn(JSON.stringify({
-        level: "warn",
-        event: "bash.pipe_to_shell_detected",
-        message: "Detected pipe-to-shell pattern. Consider reviewing the full command before confirming.",
-        command_prefix: input.command.slice(0, 100),
-        // Log first 100 chars for review
-        timestamp: (/* @__PURE__ */ new Date()).toISOString()
-      }));
-    }
+    const pipeToShellNote = PIPE_TO_SHELL_PATTERN.test(input.command) ? "\n\n[wrongstack] Caution: this command pipes output into a shell interpreter (pipe-to-shell). Piped content executes as arbitrary code \u2014 review the source before trusting the result, and prefer downloading to a file and inspecting it first." : "";
     const timeoutMs = Math.max(1, Math.min(input.timeout_ms ?? DEFAULT_TIMEOUT_MS, 6e5));
     const isWin2 = os4.platform() === "win32";
     let plan;
@@ -1902,11 +1915,12 @@ var bashTool = {
     const shell = plan.bin;
     const args = plan.useStdin ? [...plan.argv] : [...plan.argv, input.command];
     const env = buildChildEnv(ctx.session?.id);
+    const spawnCwd = ctx.workingDir ?? ctx.projectRoot;
     const detached = !isWin2;
     const startedAt = Date.now();
     if (input.background) {
       const child2 = spawn2(shell, args, {
-        cwd: ctx.projectRoot,
+        cwd: spawnCwd,
         env,
         // PowerShell takes the script on stdin (no argv quoting); cmd.exe
         // and POSIX shells ignore stdin when given the command inline.
@@ -1937,7 +1951,7 @@ var bashTool = {
         parentPid: process.pid,
         command: redactCommand(`${shell} ${args.join(" ")}`),
         args: redactCommand(args.join(" ")).split(" ").filter(Boolean),
-        cwd: ctx.projectRoot,
+        cwd: spawnCwd,
         background: true,
         startedAt: new Date(startedAt).toISOString()
       });
@@ -1981,7 +1995,9 @@ var bashTool = {
       yield {
         type: "final",
         output: {
-          output: "",
+          // Background runs have no captured output; the pipe-to-shell caution
+          // (when present) is the only thing worth surfacing.
+          output: pipeToShellNote.trim(),
           exit_code: null,
           timed_out: false,
           pid: pid2
@@ -1998,7 +2014,7 @@ var bashTool = {
       return;
     }
     const child = spawn2(shell, args, {
-      cwd: ctx.projectRoot,
+      cwd: spawnCwd,
       env,
       // PowerShell takes the script on stdin (no argv quoting); cmd.exe
       // and POSIX shells ignore stdin when given the command inline.
@@ -2023,7 +2039,7 @@ var bashTool = {
       parentPid: process.pid,
       command: redactCommand(`${shell} ${args.join(" ")}`),
       args: redactCommand(args.join(" ")).split(" ").filter(Boolean),
-      cwd: ctx.projectRoot,
+      cwd: spawnCwd,
       background: false,
       startedAt: new Date(startedAt).toISOString()
     });
@@ -2142,8 +2158,10 @@ var bashTool = {
         child.stderr?.resume();
       }
     };
+    const stdoutDecoder = new StringDecoder("utf8");
+    const stderrDecoder = new StringDecoder("utf8");
     const onData = (chunk, stream) => {
-      const text = chunk.toString();
+      const text = (stream === "stdout" ? stdoutDecoder : stderrDecoder).write(chunk);
       if (stream === "stdout") stdoutBytes += chunk.byteLength;
       else stderrBytes += chunk.byteLength;
       emitProcessOutput({ pid, stream, chunk });
@@ -2170,6 +2188,12 @@ var bashTool = {
       if (typeof pid === "number") registry.unregister(pid);
       registry.afterCall(Date.now() - startedAt, code !== 0 && code !== null);
       completeForeground(timedOut ? 124 : code ?? (signal ? 1 : 0), signal ?? void 0);
+      const tail = stdoutDecoder.end() + stderrDecoder.end();
+      if (tail) {
+        if (buf.length < MAX_OUTPUT) buf += tail.slice(0, MAX_OUTPUT - buf.length);
+        spool.write(tail);
+        pending += tail;
+      }
       push({ kind: "end", code });
     });
     try {
@@ -2189,7 +2213,7 @@ var bashTool = {
             output: {
               output: normalizeCommandOutput(buf) + (spooled ? spoolNote(spooled) : "") + (hint ? `
 
-${hint}` : ""),
+${hint}` : "") + pipeToShellNote,
               exit_code: c.code,
               timed_out: timedOut
             }
@@ -2251,7 +2275,7 @@ ${hint}` : ""),
     if (!sessionId) return;
     for (const entry of registry.bySession(sessionId)) {
       if (entry.name !== "bash") continue;
-      if (entry.child.exitCode !== null) continue;
+      if (entry.child && entry.child.exitCode !== null) continue;
       if (entry.background) continue;
       if (entry.protected) continue;
       registry.kill(entry.pid, { force: true });