@wrongstack/tools 0.305.1 → 0.306.2

package/dist/diff.js

@@ -4,8 +4,10 @@ import { statSync } from "node:fs";
 import * as fs from "node:fs/promises";
 import * as path2 from "node:path";
 import { buildChildEnv } from "@wrongstack/core/utils";
+import { ToolValidationError } from "@wrongstack/core/types";
 
 // src/_util.ts
+import * as fsp from "node:fs/promises";
 import * as path from "node:path";
 import * as Core from "@wrongstack/core/utils";
 function resolvePath(input, ctx) {
@@ -29,14 +31,48 @@ function ensureInsideRoot(absPath, ctx) {
 function safeResolve(input, ctx) {
   return ensureInsideRoot(resolvePath(input, ctx), ctx);
 }
+async function resolveRealInsideRoot(absPath, ctx) {
+  if (ctx.allowOutsideProjectRoot) return absPath;
+  const realRoots = await Promise.all(
+    allowedRoots(ctx).map((r) => fsp.realpath(r).catch(() => path.resolve(r)))
+  );
+  let probe = absPath;
+  const pendingTail = [];
+  for (; ; ) {
+    let real;
+    try {
+      real = await fsp.realpath(probe);
+    } catch (err) {
+      if (err.code === "ENOENT") {
+        const parent = path.dirname(probe);
+        if (parent === probe) return absPath;
+        pendingTail.unshift(path.basename(probe));
+        probe = parent;
+        continue;
+      }
+      throw err;
+    }
+    if (isInsideAny(real, realRoots)) {
+      return pendingTail.length > 0 ? path.join(real, ...pendingTail) : real;
+    }
+    throw new Error(
+      `Path "${absPath}" resolves through a symlink outside project root "${realRoots[0]}"`
+    );
+  }
+}
+async function safeResolveReal(input, ctx) {
+  const abs = safeResolve(input, ctx);
+  return await resolveRealInsideRoot(abs, ctx);
+}
 
 // src/diff.ts
 var MAX_FILE_DUMP_BYTES = 5 * 1024 * 1024;
+var MAX_GIT_DIFF_CHARS = 1e5;
 var diffTool = {
   name: "diff",
   category: "Filesystem",
   description: "Show file content with line numbers, staged/working-tree diffs via git, or commit/branch diffs. A safer and more structured alternative to raw `git diff` via shell.",
-  usageHint: 'USE FOR CODE REVIEW AND CHANGE INSPECTION:\n\n- `files` + no `a`/`b` \u2192 show file content with line numbers (NOT a unified diff; no +/- prefixes).\n- `a` and/or `b` \u2192 git-style commit/branch diff (unified format, real +/- prefixes).\n- `staged: true` \u2192 only show staged changes.\n- `mode` can be "unified", "stat", or "side-by-side" (only affects the git-diff path).\n\nNOTE: For a true file-vs-file unified diff, supply `a` and `b` so the tool delegates to `git diff`. The `files`-only path is a line-numbered dump, not a diff.\n\nThis tool has important safety guards against flag injection (see previous security findings).',
+  usageHint: 'USE FOR CODE REVIEW AND CHANGE INSPECTION:\n\n- `files` + no `a`/`b` \u2192 show file content with line numbers (NOT a unified diff; no +/- prefixes). Result `mode` is "dump".\n- `a` and/or `b` \u2192 git-style commit/branch diff (unified format, real +/- prefixes).\n- `staged: true` \u2192 only show staged changes.\n- `mode` only affects the git-diff path: "stat" runs `git diff --stat`; "side-by-side" is not supported and falls back to unified (result `mode` reports what was produced).\n- `context` sets the unified-diff context line count on the git path (`-U<n>`); the dump path has no context notion.\n\nNOTE: For a true file-vs-file unified diff, supply `a` and `b` so the tool delegates to `git diff`. The `files`-only path is a line-numbered dump, not a diff.\n\nThis tool has important safety guards against flag injection (see previous security findings).',
   permission: "auto",
   mutating: false,
   maxOutputBytes: 262144,
@@ -69,11 +105,12 @@ var diffTool = {
       mode: {
         type: "string",
         enum: ["unified", "side-by-side", "stat"],
-        description: 'Output format. "unified" is default, "stat" shows summary only.'
+        description: 'Output format for the git-diff path. "unified" is default; "stat" shows a summary only; "side-by-side" is not supported and falls back to unified. The `files`-only dump path ignores this.'
       },
       context: {
         type: "integer",
-        description: "Number of context lines for unified diffs (default: 3)."
+        minimum: 0,
+        description: "Number of context lines for git unified diffs (default: 3, passed as -U<n>). Ignored by the `files`-only dump path."
       }
     }
   },
@@ -86,16 +123,31 @@ var diffTool = {
 };
 async function gitDiff(input, ctx, signal) {
   if (input.a?.startsWith("-")) {
-    throw new Error(`diff: unsafe ref "${input.a}" \u2014 refs may not begin with '-' (flag injection)`);
+    throw new ToolValidationError({
+      message: `diff: unsafe ref "${input.a}" \u2014 refs may not begin with '-' (flag injection)`,
+      field: "a"
+    });
   }
   if (input.b?.startsWith("-")) {
-    throw new Error(`diff: unsafe ref "${input.b}" \u2014 refs may not begin with '-' (flag injection)`);
+    throw new ToolValidationError({
+      message: `diff: unsafe ref "${input.b}" \u2014 refs may not begin with '-' (flag injection)`,
+      field: "b"
+    });
   }
+  const requestedMode = input.mode ?? "unified";
+  const statMode = requestedMode === "stat";
+  const effectiveMode = statMode ? "stat" : "unified";
+  const sideBySideNote = requestedMode === "side-by-side" ? "side-by-side output is not supported; a unified diff was produced instead." : void 0;
   const gitDir = findGitDir(ctx.cwd);
   if (!gitDir) {
-    return { diff: "", files: [], truncated: false, mode: "unified" };
+    return { diff: "", files: [], truncated: false, mode: effectiveMode };
   }
   const args = ["diff", "--no-color"];
+  if (statMode) args.push("--stat");
+  if (!statMode && input.context !== void 0) {
+    const contextLines = Math.max(0, Math.floor(input.context));
+    if (Number.isFinite(contextLines)) args.push(`-U${contextLines}`);
+  }
   if (input.staged) args.push("--staged");
   if (input.a) args.push(input.a);
   if (input.b) args.push(input.b);
@@ -104,11 +156,22 @@ async function gitDiff(input, ctx, signal) {
     args.push("--", ...files.map((f) => f.trim()));
   }
   const result = await runGit(args, gitDir, signal);
+  let diff = result.stdout;
+  let truncated = false;
+  if (diff.length > MAX_GIT_DIFF_CHARS) {
+    let clipped = diff.slice(0, MAX_GIT_DIFF_CHARS);
+    const nl = clipped.lastIndexOf("\n");
+    if (nl > 0) clipped = clipped.slice(0, nl);
+    diff = `${clipped}
+\u2026[git diff truncated: ${result.stdout.length - clipped.length} of ${result.stdout.length} characters omitted]`;
+    truncated = true;
+  }
   return {
-    diff: result.stdout,
+    diff,
     files: [],
-    truncated: result.stdout.length > 1e5,
-    mode: "unified"
+    truncated,
+    mode: effectiveMode,
+    note: sideBySideNote
   };
 }
 function findGitDir(cwd) {
@@ -154,13 +217,13 @@ async function fileDiff(input, ctx, _signal) {
       diff: "No files specified",
       files: [],
       truncated: false,
-      mode: input.mode ?? "unified"
+      mode: "dump"
     };
   }
   const results = [];
   let truncated = false;
   for (const file of files) {
-    const absPath = safeResolve(file, ctx);
+    const absPath = await safeResolveReal(file, ctx);
     const stat2 = await fs.stat(absPath).catch(() => null);
     if (!stat2?.isFile()) continue;
     if (stat2.size > MAX_FILE_DUMP_BYTES) {
@@ -178,7 +241,10 @@ async function fileDiff(input, ctx, _signal) {
     diff: results.join("\n\n"),
     files,
     truncated,
-    mode: input.mode ?? "unified"
+    // Honest mode: this path always produces a line-numbered dump — it never
+    // honors `mode`, so it must not echo the requested value back.
+    mode: "dump",
+    note: input.mode !== void 0 ? "The `files`-only path is a line-numbered dump; `mode` only affects the git-diff path (`a`/`b`)." : void 0
   };
 }
 function formatWithLineNumbers(file, lines) {

package/dist/document.js

@@ -1,5 +1,6 @@
 // src/document.ts
 import * as fs from "node:fs/promises";
+import * as path2 from "node:path";
 
 // src/_util.ts
 import * as path from "node:path";
@@ -30,8 +31,8 @@ function safeResolve(input, ctx) {
 var documentTool = {
   name: "document",
   category: "Project",
-  description: "DEPRECATED \u2014 use the `auto_doc` tool with `dryRun: true` instead. This tool is a read-only preview stub that returns `skipped` candidates without generating real docstrings.",
-  usageHint: "Deprecated: prefer `auto_doc` with `dryRun: true` for previewing, or `auto_doc` without dryRun for writing. This tool only lists undocumented symbols with placeholder comments \u2014 it does not generate real JSDoc/TSDoc.",
+  description: "DEPRECATED \u2014 read-only preview stub that lists undocumented symbols as `skipped` candidates. It never writes files and does not generate real docstrings. If the auto-doc plugin is enabled, use its `auto_doc` tool (with `dry_run: true` to preview) instead.",
+  usageHint: "Deprecated: this tool only lists undocumented symbols with placeholder comments \u2014 it does not generate real JSDoc/TSDoc and writes nothing. When the auto-doc plugin is enabled, prefer its `auto_doc` tool (`dry_run: true` for previewing, without it for writing).",
   permission: "auto",
   mutating: false,
   timeoutMs: 3e4,
@@ -67,7 +68,11 @@ var documentTool = {
     const results = [];
     let filesProcessed = 0;
     let itemsDocumented = 0;
-    const fileList = input.files ? await resolveFiles(Array.isArray(input.files) ? input.files.join(",") : input.files, cwd) : input.path ? [safeResolve(input.path, ctx)] : [];
+    const fileList = input.files ? await resolveFiles(
+      Array.isArray(input.files) ? input.files.join(",") : input.files,
+      cwd,
+      ctx
+    ) : input.path ? [safeResolve(input.path, ctx)] : [];
     for (const absPath of fileList) {
       try {
         const content = await fs.readFile(absPath, "utf8");
@@ -100,11 +105,18 @@ var documentTool = {
     };
   }
 };
-async function resolveFiles(filesInput, cwd) {
-  const files = Array.isArray(filesInput) ? filesInput : filesInput.split(",");
+async function resolveFiles(filesInput, cwd, ctx) {
+  const files = filesInput.split(",");
   const resolved = [];
   for (const f of files) {
-    const absPath = f.trim().startsWith("/") ? f.trim() : `${cwd}/${f.trim()}`;
+    const entry = f.trim();
+    if (!entry) continue;
+    let absPath;
+    try {
+      absPath = ensureInsideRoot(path2.resolve(cwd, entry), ctx);
+    } catch {
+      continue;
+    }
     try {
       const stat2 = await fs.stat(absPath);
       if (stat2.isFile()) resolved.push(absPath);

package/dist/edit.js

@@ -381,8 +381,35 @@ async function safeResolveReal(input, ctx) {
   const abs = safeResolve(input, ctx);
   return await resolveRealInsideRoot(abs, ctx);
 }
+function truncateDiffPayload(diff, maxBytes) {
+  const total = Buffer.byteLength(diff, "utf8");
+  if (total <= maxBytes) return { text: diff, truncated: false };
+  const MARKER_RESERVE = 96;
+  let head = takeHeadBytes(diff, Math.max(0, maxBytes - MARKER_RESERVE));
+  const nl = head.lastIndexOf("\n");
+  if (nl > 0) head = head.slice(0, nl);
+  const kept = Buffer.byteLength(head, "utf8");
+  return {
+    text: `${head}
+\u2026[diff truncated: ${total - kept} of ${total} bytes omitted]`,
+    truncated: true
+  };
+}
+function takeHeadBytes(s, maxBytes) {
+  if (maxBytes <= 0) return "";
+  if (Buffer.byteLength(s, "utf8") <= maxBytes) return s;
+  let lo = 0;
+  let hi = s.length;
+  while (lo < hi) {
+    const mid = Math.ceil((lo + hi) / 2);
+    if (Buffer.byteLength(s.slice(0, mid), "utf8") <= maxBytes) lo = mid;
+    else hi = mid - 1;
+  }
+  return s.slice(0, lo);
+}
 
 // src/edit.ts
+var MAX_DIFF_BYTES = 262144;
 var editTool = {
   name: "edit",
   category: "Filesystem",
@@ -393,17 +420,33 @@ var editTool = {
     useInstead: ["write", "patch"]
   },
   permission: "confirm",
+  // WS-046: gives permission decisions something to key on — the file being
+  // edited, so trust rules can scope by path.
+  subjectKey: "path",
   mutating: true,
   capabilities: ["fs.write"],
   icon: "edit",
   timeoutMs: 5e3,
+  maxOutputBytes: 262144,
   inputSchema: {
     type: "object",
     properties: {
-      path: { type: "string" },
-      old_string: { type: "string" },
-      new_string: { type: "string" },
-      replace_all: { type: "boolean" }
+      path: {
+        type: "string",
+        description: "Path to the file to edit \u2014 relative to the project root, or absolute inside it."
+      },
+      old_string: {
+        type: "string",
+        description: "The exact text to replace, including whitespace and indentation. Must be unique in the file unless `replace_all` is set \u2014 add surrounding lines to disambiguate."
+      },
+      new_string: {
+        type: "string",
+        description: "The exact replacement text (may be empty to delete `old_string`)."
+      },
+      replace_all: {
+        type: "boolean",
+        description: "Replace every occurrence instead of requiring a unique match. Only allowed when `old_string` matches exactly (or up to trailing whitespace) \u2014 fuzzy matches stay single-target."
+      }
     },
     required: ["path", "old_string", "new_string"]
   },
@@ -483,6 +526,9 @@ var editTool = {
     const oldLf = normalizeToLf(input.old_string);
     const newLf = normalizeToLf(input.new_string);
     if (oldLf === newLf) {
+      if (!fileLf.includes(oldLf)) {
+        throw noMatchError(input.path, fileLf, oldLf);
+      }
       if (autoRead) ctx.recordRead(absPath, updated.mtimeMs, "user", originalHash);
       return {
         path: absPath,
@@ -496,13 +542,7 @@ var editTool = {
     const ladder = findLadderMatches(fileLf, oldLf);
     if (!ladder) {
       opts?.signal?.throwIfAborted();
-      const hint = nearestMatchHint(fileLf, oldLf);
-      throw new ToolValidationError({
-        message: `edit: no match for old_string in "${input.path}".${hint ? ` Nearest match near line ${hint.line}:
-${hint.snippet}
-Compare this against your old_string and retry with the file's actual text.` : ""}`,
-        field: "old_string"
-      });
+      throw noMatchError(input.path, fileLf, oldLf);
     }
     const { tier, matches } = ladder;
     const count = matches.length;
@@ -564,16 +604,20 @@ Compare this against your old_string and retry with the file's actual text.` : "
       after: newFile
     });
     opts?.signal?.throwIfAborted();
-    const diff = unifiedDiff(original, newFile, {
-      fromFile: input.path,
-      toFile: input.path
-    });
+    const { text: diff, truncated: diffTruncated } = truncateDiffPayload(
+      unifiedDiff(original, newFile, {
+        fromFile: input.path,
+        toFile: input.path
+      }),
+      MAX_DIFF_BYTES
+    );
+    const diffNote = diffTruncated ? "Diff truncated to the 256 KiB output budget \u2014 the full edit is on disk." : void 0;
     const syntax = await checkSyntax(absPath, newFile, original).catch(() => void 0);
     let syntaxNote;
     if (syntax && syntax.errors.length > 0) {
       syntaxNote = syntax.preExisting ? `Syntax check: the file still has parse errors (they pre-date this edit) \u2014 see syntax_errors.` : `Syntax check: this edit introduced ${syntax.errors.length} parse error(s) \u2014 fix them now, see syntax_errors.`;
     }
-    const notes = [autoReadNote, tierNote, syntaxNote].filter(Boolean);
+    const notes = [autoReadNote, tierNote, diffNote, syntaxNote].filter(Boolean);
     return {
       path: absPath,
       replacements: input.replace_all ? count : 1,
@@ -584,6 +628,15 @@ Compare this against your old_string and retry with the file's actual text.` : "
     };
   }
 };
+function noMatchError(inputPath, fileLf, oldLf) {
+  const hint = nearestMatchHint(fileLf, oldLf);
+  return new ToolValidationError({
+    message: `edit: no match for old_string in "${inputPath}".${hint ? ` Nearest match near line ${hint.line}:
+${hint.snippet}
+Compare this against your old_string and retry with the file's actual text.` : ""}`,
+    field: "old_string"
+  });
+}
 export {
   editTool
 };

package/dist/exec.js

@@ -829,8 +829,11 @@ var SENSITIVE_FLAG_PATTERNS = [
   /--(?:token|password|passwd|pwd|secret|api[-_]?key|api[-_]?secret|auth|credential|private[-_]?key|access[-_]?key|github[-_]?token|gh[-_]?token|bearer|jwt|oauth|pin|pincode|passphrase|access[-_]?token)(?:[=\s,][^\s]*)?/gi,
   // -t short flag (token): attached (-tVALUE), separated (-t VALUE), or -t=VALUE.
   // (?<![-\w]) anchors to a token start so we don't match the `-t` inside `--token`.
+  // The value must be token-like (>= 8 chars) so ordinary combined flags such
+  // as `tar -tf` / `ssh -tt` are not eaten. Global flag: EVERY occurrence is
+  // redacted, not just the first.
   // NOTE: synced with @wrongstack/core observability/redact-command.ts.
-  /(?<![-\w])-t(?:[=\s]+)?[^\s,-]+/,
+  /(?<![-\w])-t(?:[=\s]+)?[^\s,-]{8,}/g,
   // -p|-password|-a (redis auth) short flags: attached + separated + =value.
   // Same token-start anchor; over-redaction is an accepted tradeoff for a
   // redaction function. Synced with core copy.
@@ -838,8 +841,9 @@ var SENSITIVE_FLAG_PATTERNS = [
   // env var–style secrets: TOKEN=x, API_KEY=y, etc.
   /(?:TOKEN|API_KEY|API_SECRET|AUTH_TOKEN|GITHUB_TOKEN|GH_TOKEN|BEARER|JWT|OAUTH|CREDENTIAL|SECRET|PRIVATE_KEY|PASSWORD|PASSWD)\s*[=:]\s*[^\s,]+/gi,
   // Generic high-entropy look: base64 strings >32 chars or hex strings >32 digits — but only
-  // when preceded by a flag name (e.g. --github-token=EyJ...).
-  /--\w*(?:token|key|secret|password|passwd|auth|credential)\w*[=\s,][A-Za-z0-9+/=]{32,}/
+  // when preceded by a flag name (e.g. --github-token=EyJ...). Global flag so
+  // every such flag in the command line is redacted, not just the first.
+  /--\w*(?:token|key|secret|password|passwd|auth|credential)\w*[=\s,][A-Za-z0-9+/=]{32,}/g
 ];
 function redactCommand(cmd) {
   let result = cmd;
@@ -928,11 +932,15 @@ var ProcessRegistryImpl = class {
     return Number.isInteger(pid) && pid > 1 && pid !== process.pid && pid !== process.ppid;
   }
   _canSignalProcessGroup(p) {
-    return os.platform() !== "win32" && p.processGroupLeader === true && this._isSafeSignalPid(p.pid) && typeof p.child.pid === "number" && p.child.pid === p.pid;
+    return os.platform() !== "win32" && p.processGroupLeader === true && this._isSafeSignalPid(p.pid) && p.child !== null && typeof p.child.pid === "number" && p.child.pid === p.pid;
   }
   _killChildDirect(p, signal) {
     try {
-      p.child.kill(signal);
+      if (p.child) {
+        p.child.kill(signal);
+        return;
+      }
+      if (this._isSafeSignalPid(p.pid)) process.kill(p.pid, signal);
     } catch {
     }
   }
@@ -1130,15 +1138,15 @@ var ProcessRegistryImpl = class {
     this._pruneStale(pid);
     const p = this.processes.get(pid);
     if (!p) return false;
-    if (p.killed) return true;
+    if (p.killed && opts.force !== true) return true;
     if (p.protected && opts.includeProtected !== true) return false;
     if (opts.preserveBackground && p.background) return false;
     const { force = false, graceMs = DEFAULT_GRACE_MS } = opts;
     const isWin3 = os.platform() === "win32";
     if (isWin3) {
-      const liveRealChild = p.child.exitCode === null && typeof p.child.pid === "number";
+      const liveRealChild = p.child === null || p.child.exitCode === null && typeof p.child.pid === "number";
       const directFallback = () => {
-        if (p.child.exitCode === null) {
+        if (p.child && p.child.exitCode === null) {
           try {
             p.child.kill("SIGKILL");
           } catch {
@@ -1150,10 +1158,7 @@ var ProcessRegistryImpl = class {
         onSettled: directFallback
       })) {
       } else {
-        try {
-          p.child.kill(force ? "SIGKILL" : "SIGTERM");
-        } catch {
-        }
+        this._killChildDirect(p, force ? "SIGKILL" : "SIGTERM");
       }
       p.killed = true;
       return true;
@@ -1164,7 +1169,7 @@ var ProcessRegistryImpl = class {
       } else {
         this._killPosix(p, "SIGTERM");
         const timer = setTimeout(() => {
-          if (this.processes.has(pid) && !p.child.killed) {
+          if (this.processes.has(pid) && !p.child?.killed) {
             this._killPosix(p, "SIGKILL");
           }
         }, graceMs);
@@ -1219,6 +1224,16 @@ var ProcessRegistryImpl = class {
    * before reusing a PID, but we want to clean up before that becomes a risk.
    */
   _isStaleEntry(entry) {
+    if (entry.child === null) {
+      if (Date.now() - entry.startedAt <= 6e4) return false;
+      if (os.platform() === "win32") return false;
+      try {
+        process.kill(entry.pid, 0);
+        return false;
+      } catch (err) {
+        return err.code !== "EPERM";
+      }
+    }
     return entry.child.exitCode !== null && Date.now() - entry.startedAt > 6e4;
   }
   /**
@@ -1512,7 +1527,6 @@ var PersistentProcessRegistry = class {
     try {
       const data = await readRegistryFile(this.registryPath);
       data.instances.set(String(entry.pid), entry);
-      const child = null;
       this.baseRegistry.register({
         pid: entry.pid,
         name: entry.name,
@@ -1520,7 +1534,7 @@ var PersistentProcessRegistry = class {
         startedAt: entry.startedAt,
         sessionId: entry.sessionId,
         protected: entry.protected,
-        child
+        child: null
       });
       await writeRegistryFile(this.registryPath, data);
     } finally {
@@ -2602,6 +2616,7 @@ function getExecAllowlist() {
 var MAX_ARGS = 20;
 var MAX_OUTPUT = 2e5;
 var DEFAULT_TIMEOUT_MS = 3e4;
+var MAX_TIMEOUT_MS = 6e5;
 var BLOCKED_ARG_PATTERNS = {
   python: [],
   // git --exec=<cmd> runs arbitrary commands via upload-pack/receive-pack;
@@ -2727,8 +2742,8 @@ var SAFE_DANGER = { level: "safe", reasons: [] };
 var execTool = {
   name: "exec",
   category: "Shell",
-  description: "Execute a **whitelisted, restricted set of commands** with strict argument validation. This is the **preferred and safer** alternative to the `bash` tool for running development tools (node, npm, pnpm, tsc, git, tests, linters, etc.). It prevents arbitrary command injection and limits what the model can do.",
-  usageHint: "PREFERRED SHELL TOOL for most cases.\n\nUse this instead of `bash` whenever possible.\n- `command` must be in the allowlist. Defaults cover JS (node/npm/pnpm/yarn/bun/deno/tsc/vitest/eslint/biome), Go (`go build`/`go test`), Rust (cargo), Python (python/pip), Ruby (gem/bundle), JVM (java/mvn/gradle), .NET (dotnet), native (make/cmake), and git. Users can extend it via `tools.exec.allow` in config.\n- Arguments are passed as a clean array (no shell interpretation).\n- `cwd` is validated to stay inside the project.\n- If a command is not allowlisted, the error explains how to add it; for one-off arbitrary commands, fall back to `bash` (with strong justification).\nThis tool significantly reduces the risk compared to full shell access.",
+  description: "Execute a command from a **curated command roster** with argument validation and confirm gating. This is the **preferred** alternative to the `bash` tool for running development tools (node, npm, pnpm, tsc, git, tests, linters, etc.). It is NOT a sandbox \u2014 several rostered commands (node, python, powershell, \u2026) can run arbitrary code \u2014 so prefer least-privilege commands.",
+  usageHint: "PREFERRED SHELL TOOL for most cases.\n\nUse this instead of `bash` whenever possible.\n- `command` must be in the allowlist. Defaults cover JS (node/npm/pnpm/yarn/bun/deno/tsc/vitest/eslint/biome), Go (`go build`/`go test`), Rust (cargo), Python (python/pip), Ruby (gem/bundle), JVM (java/mvn/gradle), .NET (dotnet), native (make/cmake), and git. Users can extend it via `tools.exec.allow` in config.\n- Arguments are passed as a clean array (no shell interpretation).\n- `cwd` is validated to stay inside the project.\n- If a command is not allowlisted, the error explains how to add it; for one-off arbitrary commands, fall back to `bash` (with strong justification).\nThe curated roster + confirm gating narrows the surface compared to full shell access, but this is not a sandbox \u2014 prefer least-privilege commands.",
   selection: {
     doNotUseWhen: "the operation requires pipes, redirection, shell expansion, or a non-allowlisted command.",
     useInstead: ["bash"]
@@ -2744,7 +2759,13 @@ var execTool = {
   subjectKey: "command",
   mutating: true,
   riskTier: "standard",
-  timeoutMs: DEFAULT_TIMEOUT_MS,
+  // Executor-level abort ceiling. Must sit ABOVE the per-call timeout ceiling
+  // (MAX_TIMEOUT_MS): the tool's own timer resolves with exit 124 + registry
+  // tree-kill; the executor's AbortSignal.timeout is a blunt abort that would
+  // otherwise fire first and discard the structured timeout result. The 10s
+  // margin covers the kill/teardown window. (The executor additionally clamps
+  // to config `tools.maxToolTimeoutMs`.)
+  timeoutMs: MAX_TIMEOUT_MS + 1e4,
   capabilities: ["shell.restricted"],
   icon: "terminal",
   inputSchema: {
@@ -2765,7 +2786,7 @@ var execTool = {
       },
       timeout: {
         type: "integer",
-        description: "Per-command timeout in milliseconds."
+        description: "Per-command timeout in milliseconds (default 30000, max 600000)."
       }
     },
     required: ["command"]
@@ -2809,7 +2830,7 @@ var execTool = {
       };
     }
     const args = (input.args ?? []).slice(0, MAX_ARGS);
-    const timeout = Math.max(1, Math.min(input.timeout ?? DEFAULT_TIMEOUT_MS, DEFAULT_TIMEOUT_MS));
+    const timeout = Math.max(1, Math.min(input.timeout ?? DEFAULT_TIMEOUT_MS, MAX_TIMEOUT_MS));
     const danger = detectDanger(cmd, args, dangerBypass);
     const killCheck = await checkExecKillCommand(cmd, args);
     if (killCheck.blocked) {
@@ -2837,15 +2858,16 @@ var execTool = {
         danger
       };
     }
+    const defaultCwd = ctx.workingDir ?? ctx.cwd;
     let cwd;
     try {
-      cwd = input.cwd ? await safeResolveReal(input.cwd, ctx) : await safeResolveReal(ctx.cwd, ctx);
+      cwd = input.cwd ? await safeResolveReal(input.cwd, ctx) : await safeResolveReal(defaultCwd, ctx);
     } catch {
       return {
         command: cmd,
         args,
         stdout: "",
-        stderr: `cwd "${input.cwd ?? ctx.cwd}" resolves outside project root`,
+        stderr: `cwd "${input.cwd ?? defaultCwd}" resolves outside project root`,
         exitCode: 1,
         truncated: false,
         allowed: false,

package/dist/fetch.js

@@ -102,6 +102,10 @@ async function guardedFetch(url, maxRedirects, signal, headers = {
     if (res.status < 300 || res.status > 399) {
       return res;
     }
+    try {
+      await res.body?.cancel();
+    } catch {
+    }
     redirectCount++;
     if (redirectCount > maxRedirects) {
       throw new FetchError({
@@ -184,6 +188,8 @@ TD.addRule("stripDangerousElements", {
   filter: ["script", "style", "noscript"],
   replacement: () => ""
 });
+var PRUNED_BOILERPLATE_TAGS = /* @__PURE__ */ new Set(["nav", "header", "footer", "aside", "svg", "iframe"]);
+TD.remove((node) => PRUNED_BOILERPLATE_TAGS.has(node.nodeName.toLowerCase()));
 var MAX_BYTES = 131072;
 var TIMEOUT_MS = 2e4;
 var combineSignals = (signals) => AbortSignal.any(signals);
@@ -213,7 +219,7 @@ var fetchTool = {
       format: {
         type: "string",
         enum: ["markdown", "text", "raw"],
-        description: 'Output format. "markdown" is recommended for HTML pages.'
+        description: 'Output format. "markdown" is recommended for HTML pages; for non-HTML content types it falls back to plain text (JSON is pretty-printed).'
       }
     },
     required: ["url"]
@@ -248,6 +254,12 @@ var fetchTool = {
       });
     }
     const u = new URL(input.url);
+    if (u.username || u.password) {
+      throw new ToolValidationError2({
+        message: "fetch: URLs with embedded credentials (user:pass@host) are not allowed",
+        field: "url"
+      });
+    }
     if (u.protocol !== "https:" && u.protocol !== "http:") {
       throw new ToolValidationError2({
         message: `fetch: unsupported protocol "${u.protocol}"`,

package/dist/format.d.ts

@@ -7,8 +7,10 @@ interface FormatInput {
 }
 interface FormatOutput {
     fixer: string;
-    files_checked: number;
-    files_changed: number;
+    /** Parsed from formatter output when confidently available; undefined otherwise. */
+    files_checked: number | undefined;
+    /** Parsed from formatter output when confidently available; undefined otherwise. */
+    files_changed: number | undefined;
     output: string;
     truncated: boolean;
 }