@wrongstack/tools 0.308.7 → 0.309.1

package/dist/audit.js

@@ -138,12 +138,12 @@ function resolveWin32Command(cmd) {
   }
   return cmd;
 }
-var WIN32_SHELL_META = /[&|<>"\r\n\0]/;
+var WIN32_SHELL_META = /[&|<>"%\r\n\0]/;
 function assertSafeWin32ShellArgs(args) {
   for (const arg of args) {
     if (typeof arg === "string" && WIN32_SHELL_META.test(arg)) {
       throw new Error(
-        'win32 cmd shim spawn: argument contains a shell metacharacter (one of & | < > ", or a newline) that could enable command injection through the .cmd/.bat wrapper - refusing to run. Offending argument: ' + JSON.stringify(arg)
+        'win32 cmd shim spawn: argument contains a shell metacharacter (one of & | < > " %, or a newline) that could enable command injection through the .cmd/.bat wrapper - refusing to run. Offending argument: ' + JSON.stringify(arg)
       );
     }
   }
@@ -374,7 +374,7 @@ var SENSITIVE_FLAG_PATTERNS = [
   // redaction function. Synced with core copy.
   /(?<![-\w])-(?:password|p|a)(?:[=\s]+)?[^\s,-]+/gi,
   // env var–style secrets: TOKEN=x, API_KEY=y, etc.
-  /(?:TOKEN|API_KEY|API_SECRET|AUTH_TOKEN|GITHUB_TOKEN|GH_TOKEN|BEARER|JWT|OAUTH|CREDENTIAL|SECRET|PRIVATE_KEY|PASSWORD|PASSWD)\s*[=:]\s*[^\s,]+/gi,
+  /(?:TOKEN|API_KEY|API_SECRET|AUTH_TOKEN|GITHUB_TOKEN|GH_TOKEN|BEARER|JWT|OAUTH|CREDENTIAL|SECRET|PRIVATE_KEY|PASSWORD|PASSWD|PASSPHRASE)\s*[=:]\s*[^\s,]+/gi,
   // Generic high-entropy look: base64 strings >32 chars or hex strings >32 digits — but only
   // when preceded by a flag name (e.g. --github-token=EyJ...). Global flag so
   // every such flag in the command line is redacted, not just the first.

package/dist/bash.js

@@ -405,7 +405,7 @@ var SENSITIVE_FLAG_PATTERNS = [
   // redaction function. Synced with core copy.
   /(?<![-\w])-(?:password|p|a)(?:[=\s]+)?[^\s,-]+/gi,
   // env var–style secrets: TOKEN=x, API_KEY=y, etc.
-  /(?:TOKEN|API_KEY|API_SECRET|AUTH_TOKEN|GITHUB_TOKEN|GH_TOKEN|BEARER|JWT|OAUTH|CREDENTIAL|SECRET|PRIVATE_KEY|PASSWORD|PASSWD)\s*[=:]\s*[^\s,]+/gi,
+  /(?:TOKEN|API_KEY|API_SECRET|AUTH_TOKEN|GITHUB_TOKEN|GH_TOKEN|BEARER|JWT|OAUTH|CREDENTIAL|SECRET|PRIVATE_KEY|PASSWORD|PASSWD|PASSPHRASE)\s*[=:]\s*[^\s,]+/gi,
   // Generic high-entropy look: base64 strings >32 chars or hex strings >32 digits — but only
   // when preceded by a flag name (e.g. --github-token=EyJ...). Global flag so
   // every such flag in the command line is redacted, not just the first.

package/dist/builtin.js

@@ -169,7 +169,7 @@ function assertSafeWin32ShellArgs(args) {
   for (const arg of args) {
     if (typeof arg === "string" && WIN32_SHELL_META.test(arg)) {
       throw new Error(
-        'win32 cmd shim spawn: argument contains a shell metacharacter (one of & | < > ", or a newline) that could enable command injection through the .cmd/.bat wrapper - refusing to run. Offending argument: ' + JSON.stringify(arg)
+        'win32 cmd shim spawn: argument contains a shell metacharacter (one of & | < > " %, or a newline) that could enable command injection through the .cmd/.bat wrapper - refusing to run. Offending argument: ' + JSON.stringify(arg)
       );
     }
   }
@@ -190,7 +190,7 @@ var WIN32_SHELL_META;
 var init_win32_resolve = __esm({
   "src/_win32-resolve.ts"() {
     "use strict";
-    WIN32_SHELL_META = /[&|<>"\r\n\0]/;
+    WIN32_SHELL_META = /[&|<>"%\r\n\0]/;
   }
 });
 
@@ -432,7 +432,7 @@ var init_redact_command = __esm({
       // redaction function. Synced with core copy.
       /(?<![-\w])-(?:password|p|a)(?:[=\s]+)?[^\s,-]+/gi,
       // env var–style secrets: TOKEN=x, API_KEY=y, etc.
-      /(?:TOKEN|API_KEY|API_SECRET|AUTH_TOKEN|GITHUB_TOKEN|GH_TOKEN|BEARER|JWT|OAUTH|CREDENTIAL|SECRET|PRIVATE_KEY|PASSWORD|PASSWD)\s*[=:]\s*[^\s,]+/gi,
+      /(?:TOKEN|API_KEY|API_SECRET|AUTH_TOKEN|GITHUB_TOKEN|GH_TOKEN|BEARER|JWT|OAUTH|CREDENTIAL|SECRET|PRIVATE_KEY|PASSWORD|PASSWD|PASSPHRASE)\s*[=:]\s*[^\s,]+/gi,
       // Generic high-entropy look: base64 strings >32 chars or hex strings >32 digits — but only
       // when preceded by a flag name (e.g. --github-token=EyJ...). Global flag so
       // every such flag in the command line is redacted, not just the first.
@@ -23233,6 +23233,12 @@ var gitTool = {
   // The git subcommand (status/commit/push) is what a trust rule needs to
   // distinguish; `git status` and `git push --force` must not share a subject.
   subjectKey: "command",
+  // `command` is an enum subcommand, so on its own it rendered the subject
+  // `"push"` — and one "always allow" then covered every push, to any branch,
+  // with or without `--force`. These are the fields that change what the call
+  // actually does, so the stored trust rule is as specific as the invocation
+  // the user approved.
+  subjectFields: ["branch", "force", "worktreeAction", "worktreePath", "newBranch"],
   mutating: true,
   capabilities: ["fs.write", "shell.restricted"],
   timeoutMs: TIMEOUT_MS2,
@@ -25425,13 +25431,7 @@ function broadcastTodoUpdate(context, todos) {
     to: `@session:${sessionId}`,
     type: "status",
     subject: `Kanban todo list updated (${todos.length} item${todos.length === 1 ? "" : "s"})`,
-    body: JSON.stringify({
-      kind: "kanban.todos.updated",
-      sessionId,
-      revision: context.state.revision,
-      todoCount: todos.length,
-      statusCounts
-    }),
+    body: `Shared Kanban board synced this session's todo list: ${todos.length} item${todos.length === 1 ? "" : "s"} \u2014 ${statusCounts.completed} completed, ${statusCounts.inProgress} in progress, ${statusCounts.pending} pending.`,
     priority: "normal",
     senderSessionId: sessionId
   }).catch(() => {

package/dist/codebase-index/index.js

@@ -435,7 +435,7 @@ function assertSafeWin32ShellArgs(args) {
   for (const arg of args) {
     if (typeof arg === "string" && WIN32_SHELL_META.test(arg)) {
       throw new Error(
-        'win32 cmd shim spawn: argument contains a shell metacharacter (one of & | < > ", or a newline) that could enable command injection through the .cmd/.bat wrapper - refusing to run. Offending argument: ' + JSON.stringify(arg)
+        'win32 cmd shim spawn: argument contains a shell metacharacter (one of & | < > " %, or a newline) that could enable command injection through the .cmd/.bat wrapper - refusing to run. Offending argument: ' + JSON.stringify(arg)
       );
     }
   }
@@ -456,7 +456,7 @@ var WIN32_SHELL_META;
 var init_win32_resolve = __esm({
   "src/_win32-resolve.ts"() {
     "use strict";
-    WIN32_SHELL_META = /[&|<>"\r\n\0]/;
+    WIN32_SHELL_META = /[&|<>"%\r\n\0]/;
   }
 });
 
@@ -10993,7 +10993,7 @@ var SENSITIVE_FLAG_PATTERNS = [
   // redaction function. Synced with core copy.
   /(?<![-\w])-(?:password|p|a)(?:[=\s]+)?[^\s,-]+/gi,
   // env var–style secrets: TOKEN=x, API_KEY=y, etc.
-  /(?:TOKEN|API_KEY|API_SECRET|AUTH_TOKEN|GITHUB_TOKEN|GH_TOKEN|BEARER|JWT|OAUTH|CREDENTIAL|SECRET|PRIVATE_KEY|PASSWORD|PASSWD)\s*[=:]\s*[^\s,]+/gi,
+  /(?:TOKEN|API_KEY|API_SECRET|AUTH_TOKEN|GITHUB_TOKEN|GH_TOKEN|BEARER|JWT|OAUTH|CREDENTIAL|SECRET|PRIVATE_KEY|PASSWORD|PASSWD|PASSPHRASE)\s*[=:]\s*[^\s,]+/gi,
   // Generic high-entropy look: base64 strings >32 chars or hex strings >32 digits — but only
   // when preceded by a flag name (e.g. --github-token=EyJ...). Global flag so
   // every such flag in the command line is redacted, not just the first.

package/dist/exec.js

@@ -652,12 +652,12 @@ function resolveWin32Command(cmd) {
   }
   return cmd;
 }
-var WIN32_SHELL_META = /[&|<>"\r\n\0]/;
+var WIN32_SHELL_META = /[&|<>"%\r\n\0]/;
 function assertSafeWin32ShellArgs(args) {
   for (const arg of args) {
     if (typeof arg === "string" && WIN32_SHELL_META.test(arg)) {
       throw new Error(
-        'win32 cmd shim spawn: argument contains a shell metacharacter (one of & | < > ", or a newline) that could enable command injection through the .cmd/.bat wrapper - refusing to run. Offending argument: ' + JSON.stringify(arg)
+        'win32 cmd shim spawn: argument contains a shell metacharacter (one of & | < > " %, or a newline) that could enable command injection through the .cmd/.bat wrapper - refusing to run. Offending argument: ' + JSON.stringify(arg)
       );
     }
   }
@@ -898,7 +898,7 @@ var SENSITIVE_FLAG_PATTERNS = [
   // redaction function. Synced with core copy.
   /(?<![-\w])-(?:password|p|a)(?:[=\s]+)?[^\s,-]+/gi,
   // env var–style secrets: TOKEN=x, API_KEY=y, etc.
-  /(?:TOKEN|API_KEY|API_SECRET|AUTH_TOKEN|GITHUB_TOKEN|GH_TOKEN|BEARER|JWT|OAUTH|CREDENTIAL|SECRET|PRIVATE_KEY|PASSWORD|PASSWD)\s*[=:]\s*[^\s,]+/gi,
+  /(?:TOKEN|API_KEY|API_SECRET|AUTH_TOKEN|GITHUB_TOKEN|GH_TOKEN|BEARER|JWT|OAUTH|CREDENTIAL|SECRET|PRIVATE_KEY|PASSWORD|PASSWD|PASSPHRASE)\s*[=:]\s*[^\s,]+/gi,
   // Generic high-entropy look: base64 strings >32 chars or hex strings >32 digits — but only
   // when preceded by a flag name (e.g. --github-token=EyJ...). Global flag so
   // every such flag in the command line is redacted, not just the first.

package/dist/format.js

@@ -138,12 +138,12 @@ function resolveWin32Command(cmd) {
   }
   return cmd;
 }
-var WIN32_SHELL_META = /[&|<>"\r\n\0]/;
+var WIN32_SHELL_META = /[&|<>"%\r\n\0]/;
 function assertSafeWin32ShellArgs(args) {
   for (const arg of args) {
     if (typeof arg === "string" && WIN32_SHELL_META.test(arg)) {
       throw new Error(
-        'win32 cmd shim spawn: argument contains a shell metacharacter (one of & | < > ", or a newline) that could enable command injection through the .cmd/.bat wrapper - refusing to run. Offending argument: ' + JSON.stringify(arg)
+        'win32 cmd shim spawn: argument contains a shell metacharacter (one of & | < > " %, or a newline) that could enable command injection through the .cmd/.bat wrapper - refusing to run. Offending argument: ' + JSON.stringify(arg)
       );
     }
   }
@@ -374,7 +374,7 @@ var SENSITIVE_FLAG_PATTERNS = [
   // redaction function. Synced with core copy.
   /(?<![-\w])-(?:password|p|a)(?:[=\s]+)?[^\s,-]+/gi,
   // env var–style secrets: TOKEN=x, API_KEY=y, etc.
-  /(?:TOKEN|API_KEY|API_SECRET|AUTH_TOKEN|GITHUB_TOKEN|GH_TOKEN|BEARER|JWT|OAUTH|CREDENTIAL|SECRET|PRIVATE_KEY|PASSWORD|PASSWD)\s*[=:]\s*[^\s,]+/gi,
+  /(?:TOKEN|API_KEY|API_SECRET|AUTH_TOKEN|GITHUB_TOKEN|GH_TOKEN|BEARER|JWT|OAUTH|CREDENTIAL|SECRET|PRIVATE_KEY|PASSWORD|PASSWD|PASSPHRASE)\s*[=:]\s*[^\s,]+/gi,
   // Generic high-entropy look: base64 strings >32 chars or hex strings >32 digits — but only
   // when preceded by a flag name (e.g. --github-token=EyJ...). Global flag so
   // every such flag in the command line is redacted, not just the first.

package/dist/git.js

@@ -95,6 +95,12 @@ var gitTool = {
   // The git subcommand (status/commit/push) is what a trust rule needs to
   // distinguish; `git status` and `git push --force` must not share a subject.
   subjectKey: "command",
+  // `command` is an enum subcommand, so on its own it rendered the subject
+  // `"push"` — and one "always allow" then covered every push, to any branch,
+  // with or without `--force`. These are the fields that change what the call
+  // actually does, so the stored trust rule is as specific as the invocation
+  // the user approved.
+  subjectFields: ["branch", "force", "worktreeAction", "worktreePath", "newBranch"],
   mutating: true,
   capabilities: ["fs.write", "shell.restricted"],
   timeoutMs: TIMEOUT_MS,

package/dist/index.js

@@ -55,7 +55,7 @@ function assertSafeWin32ShellArgs(args) {
   for (const arg of args) {
     if (typeof arg === "string" && WIN32_SHELL_META.test(arg)) {
       throw new Error(
-        'win32 cmd shim spawn: argument contains a shell metacharacter (one of & | < > ", or a newline) that could enable command injection through the .cmd/.bat wrapper - refusing to run. Offending argument: ' + JSON.stringify(arg)
+        'win32 cmd shim spawn: argument contains a shell metacharacter (one of & | < > " %, or a newline) that could enable command injection through the .cmd/.bat wrapper - refusing to run. Offending argument: ' + JSON.stringify(arg)
       );
     }
   }
@@ -76,7 +76,7 @@ var WIN32_SHELL_META;
 var init_win32_resolve = __esm({
   "src/_win32-resolve.ts"() {
     "use strict";
-    WIN32_SHELL_META = /[&|<>"\r\n\0]/;
+    WIN32_SHELL_META = /[&|<>"%\r\n\0]/;
   }
 });
 
@@ -432,7 +432,7 @@ var init_redact_command = __esm({
       // redaction function. Synced with core copy.
       /(?<![-\w])-(?:password|p|a)(?:[=\s]+)?[^\s,-]+/gi,
       // env var–style secrets: TOKEN=x, API_KEY=y, etc.
-      /(?:TOKEN|API_KEY|API_SECRET|AUTH_TOKEN|GITHUB_TOKEN|GH_TOKEN|BEARER|JWT|OAUTH|CREDENTIAL|SECRET|PRIVATE_KEY|PASSWORD|PASSWD)\s*[=:]\s*[^\s,]+/gi,
+      /(?:TOKEN|API_KEY|API_SECRET|AUTH_TOKEN|GITHUB_TOKEN|GH_TOKEN|BEARER|JWT|OAUTH|CREDENTIAL|SECRET|PRIVATE_KEY|PASSWORD|PASSWD|PASSPHRASE)\s*[=:]\s*[^\s,]+/gi,
       // Generic high-entropy look: base64 strings >32 chars or hex strings >32 digits — but only
       // when preceded by a flag name (e.g. --github-token=EyJ...). Global flag so
       // every such flag in the command line is redacted, not just the first.
@@ -23400,6 +23400,12 @@ var gitTool = {
   // The git subcommand (status/commit/push) is what a trust rule needs to
   // distinguish; `git status` and `git push --force` must not share a subject.
   subjectKey: "command",
+  // `command` is an enum subcommand, so on its own it rendered the subject
+  // `"push"` — and one "always allow" then covered every push, to any branch,
+  // with or without `--force`. These are the fields that change what the call
+  // actually does, so the stored trust rule is as specific as the invocation
+  // the user approved.
+  subjectFields: ["branch", "force", "worktreeAction", "worktreePath", "newBranch"],
   mutating: true,
   capabilities: ["fs.write", "shell.restricted"],
   timeoutMs: TIMEOUT_MS2,
@@ -25594,13 +25600,7 @@ function broadcastTodoUpdate(context, todos) {
     to: `@session:${sessionId}`,
     type: "status",
     subject: `Kanban todo list updated (${todos.length} item${todos.length === 1 ? "" : "s"})`,
-    body: JSON.stringify({
-      kind: "kanban.todos.updated",
-      sessionId,
-      revision: context.state.revision,
-      todoCount: todos.length,
-      statusCounts
-    }),
+    body: `Shared Kanban board synced this session's todo list: ${todos.length} item${todos.length === 1 ? "" : "s"} \u2014 ${statusCounts.completed} completed, ${statusCounts.inProgress} in progress, ${statusCounts.pending} pending.`,
     priority: "normal",
     senderSessionId: sessionId
   }).catch(() => {

package/dist/install.js

@@ -145,12 +145,12 @@ function resolveWin32Command(cmd) {
   }
   return cmd;
 }
-var WIN32_SHELL_META = /[&|<>"\r\n\0]/;
+var WIN32_SHELL_META = /[&|<>"%\r\n\0]/;
 function assertSafeWin32ShellArgs(args) {
   for (const arg of args) {
     if (typeof arg === "string" && WIN32_SHELL_META.test(arg)) {
       throw new Error(
-        'win32 cmd shim spawn: argument contains a shell metacharacter (one of & | < > ", or a newline) that could enable command injection through the .cmd/.bat wrapper - refusing to run. Offending argument: ' + JSON.stringify(arg)
+        'win32 cmd shim spawn: argument contains a shell metacharacter (one of & | < > " %, or a newline) that could enable command injection through the .cmd/.bat wrapper - refusing to run. Offending argument: ' + JSON.stringify(arg)
       );
     }
   }
@@ -381,7 +381,7 @@ var SENSITIVE_FLAG_PATTERNS = [
   // redaction function. Synced with core copy.
   /(?<![-\w])-(?:password|p|a)(?:[=\s]+)?[^\s,-]+/gi,
   // env var–style secrets: TOKEN=x, API_KEY=y, etc.
-  /(?:TOKEN|API_KEY|API_SECRET|AUTH_TOKEN|GITHUB_TOKEN|GH_TOKEN|BEARER|JWT|OAUTH|CREDENTIAL|SECRET|PRIVATE_KEY|PASSWORD|PASSWD)\s*[=:]\s*[^\s,]+/gi,
+  /(?:TOKEN|API_KEY|API_SECRET|AUTH_TOKEN|GITHUB_TOKEN|GH_TOKEN|BEARER|JWT|OAUTH|CREDENTIAL|SECRET|PRIVATE_KEY|PASSWORD|PASSWD|PASSPHRASE)\s*[=:]\s*[^\s,]+/gi,
   // Generic high-entropy look: base64 strings >32 chars or hex strings >32 digits — but only
   // when preceded by a flag name (e.g. --github-token=EyJ...). Global flag so
   // every such flag in the command line is redacted, not just the first.

package/dist/languages/index.js

@@ -2266,12 +2266,12 @@ function resolveWin32Command(cmd) {
   }
   return cmd;
 }
-var WIN32_SHELL_META = /[&|<>"\r\n\0]/;
+var WIN32_SHELL_META = /[&|<>"%\r\n\0]/;
 function assertSafeWin32ShellArgs(args) {
   for (const arg of args) {
     if (typeof arg === "string" && WIN32_SHELL_META.test(arg)) {
       throw new Error(
-        'win32 cmd shim spawn: argument contains a shell metacharacter (one of & | < > ", or a newline) that could enable command injection through the .cmd/.bat wrapper - refusing to run. Offending argument: ' + JSON.stringify(arg)
+        'win32 cmd shim spawn: argument contains a shell metacharacter (one of & | < > " %, or a newline) that could enable command injection through the .cmd/.bat wrapper - refusing to run. Offending argument: ' + JSON.stringify(arg)
       );
     }
   }
@@ -2502,7 +2502,7 @@ var SENSITIVE_FLAG_PATTERNS = [
   // redaction function. Synced with core copy.
   /(?<![-\w])-(?:password|p|a)(?:[=\s]+)?[^\s,-]+/gi,
   // env var–style secrets: TOKEN=x, API_KEY=y, etc.
-  /(?:TOKEN|API_KEY|API_SECRET|AUTH_TOKEN|GITHUB_TOKEN|GH_TOKEN|BEARER|JWT|OAUTH|CREDENTIAL|SECRET|PRIVATE_KEY|PASSWORD|PASSWD)\s*[=:]\s*[^\s,]+/gi,
+  /(?:TOKEN|API_KEY|API_SECRET|AUTH_TOKEN|GITHUB_TOKEN|GH_TOKEN|BEARER|JWT|OAUTH|CREDENTIAL|SECRET|PRIVATE_KEY|PASSWORD|PASSWD|PASSPHRASE)\s*[=:]\s*[^\s,]+/gi,
   // Generic high-entropy look: base64 strings >32 chars or hex strings >32 digits — but only
   // when preceded by a flag name (e.g. --github-token=EyJ...). Global flag so
   // every such flag in the command line is redacted, not just the first.

package/dist/lint.js

@@ -138,12 +138,12 @@ function resolveWin32Command(cmd) {
   }
   return cmd;
 }
-var WIN32_SHELL_META = /[&|<>"\r\n\0]/;
+var WIN32_SHELL_META = /[&|<>"%\r\n\0]/;
 function assertSafeWin32ShellArgs(args) {
   for (const arg of args) {
     if (typeof arg === "string" && WIN32_SHELL_META.test(arg)) {
       throw new Error(
-        'win32 cmd shim spawn: argument contains a shell metacharacter (one of & | < > ", or a newline) that could enable command injection through the .cmd/.bat wrapper - refusing to run. Offending argument: ' + JSON.stringify(arg)
+        'win32 cmd shim spawn: argument contains a shell metacharacter (one of & | < > " %, or a newline) that could enable command injection through the .cmd/.bat wrapper - refusing to run. Offending argument: ' + JSON.stringify(arg)
       );
     }
   }
@@ -374,7 +374,7 @@ var SENSITIVE_FLAG_PATTERNS = [
   // redaction function. Synced with core copy.
   /(?<![-\w])-(?:password|p|a)(?:[=\s]+)?[^\s,-]+/gi,
   // env var–style secrets: TOKEN=x, API_KEY=y, etc.
-  /(?:TOKEN|API_KEY|API_SECRET|AUTH_TOKEN|GITHUB_TOKEN|GH_TOKEN|BEARER|JWT|OAUTH|CREDENTIAL|SECRET|PRIVATE_KEY|PASSWORD|PASSWD)\s*[=:]\s*[^\s,]+/gi,
+  /(?:TOKEN|API_KEY|API_SECRET|AUTH_TOKEN|GITHUB_TOKEN|GH_TOKEN|BEARER|JWT|OAUTH|CREDENTIAL|SECRET|PRIVATE_KEY|PASSWORD|PASSWD|PASSPHRASE)\s*[=:]\s*[^\s,]+/gi,
   // Generic high-entropy look: base64 strings >32 chars or hex strings >32 digits — but only
   // when preceded by a flag name (e.g. --github-token=EyJ...). Global flag so
   // every such flag in the command line is redacted, not just the first.

package/dist/outdated.js

@@ -219,7 +219,7 @@ function assertSafeWin32ShellArgs(args) {
   for (const arg of args) {
     if (typeof arg === "string" && WIN32_SHELL_META.test(arg)) {
       throw new Error(
-        'win32 cmd shim spawn: argument contains a shell metacharacter (one of & | < > ", or a newline) that could enable command injection through the .cmd/.bat wrapper - refusing to run. Offending argument: ' + JSON.stringify(arg)
+        'win32 cmd shim spawn: argument contains a shell metacharacter (one of & | < > " %, or a newline) that could enable command injection through the .cmd/.bat wrapper - refusing to run. Offending argument: ' + JSON.stringify(arg)
       );
     }
   }
@@ -240,7 +240,7 @@ var WIN32_SHELL_META;
 var init_win32_resolve = __esm({
   "src/_win32-resolve.ts"() {
     "use strict";
-    WIN32_SHELL_META = /[&|<>"\r\n\0]/;
+    WIN32_SHELL_META = /[&|<>"%\r\n\0]/;
   }
 });
 
@@ -2759,7 +2759,7 @@ var init_redact_command = __esm({
       // redaction function. Synced with core copy.
       /(?<![-\w])-(?:password|p|a)(?:[=\s]+)?[^\s,-]+/gi,
       // env var–style secrets: TOKEN=x, API_KEY=y, etc.
-      /(?:TOKEN|API_KEY|API_SECRET|AUTH_TOKEN|GITHUB_TOKEN|GH_TOKEN|BEARER|JWT|OAUTH|CREDENTIAL|SECRET|PRIVATE_KEY|PASSWORD|PASSWD)\s*[=:]\s*[^\s,]+/gi,
+      /(?:TOKEN|API_KEY|API_SECRET|AUTH_TOKEN|GITHUB_TOKEN|GH_TOKEN|BEARER|JWT|OAUTH|CREDENTIAL|SECRET|PRIVATE_KEY|PASSWORD|PASSWD|PASSPHRASE)\s*[=:]\s*[^\s,]+/gi,
       // Generic high-entropy look: base64 strings >32 chars or hex strings >32 digits — but only
       // when preceded by a flag name (e.g. --github-token=EyJ...). Global flag so
       // every such flag in the command line is redacted, not just the first.

package/dist/pack.js

@@ -169,7 +169,7 @@ function assertSafeWin32ShellArgs(args) {
   for (const arg of args) {
     if (typeof arg === "string" && WIN32_SHELL_META.test(arg)) {
       throw new Error(
-        'win32 cmd shim spawn: argument contains a shell metacharacter (one of & | < > ", or a newline) that could enable command injection through the .cmd/.bat wrapper - refusing to run. Offending argument: ' + JSON.stringify(arg)
+        'win32 cmd shim spawn: argument contains a shell metacharacter (one of & | < > " %, or a newline) that could enable command injection through the .cmd/.bat wrapper - refusing to run. Offending argument: ' + JSON.stringify(arg)
       );
     }
   }
@@ -190,7 +190,7 @@ var WIN32_SHELL_META;
 var init_win32_resolve = __esm({
   "src/_win32-resolve.ts"() {
     "use strict";
-    WIN32_SHELL_META = /[&|<>"\r\n\0]/;
+    WIN32_SHELL_META = /[&|<>"%\r\n\0]/;
   }
 });
 
@@ -432,7 +432,7 @@ var init_redact_command = __esm({
       // redaction function. Synced with core copy.
       /(?<![-\w])-(?:password|p|a)(?:[=\s]+)?[^\s,-]+/gi,
       // env var–style secrets: TOKEN=x, API_KEY=y, etc.
-      /(?:TOKEN|API_KEY|API_SECRET|AUTH_TOKEN|GITHUB_TOKEN|GH_TOKEN|BEARER|JWT|OAUTH|CREDENTIAL|SECRET|PRIVATE_KEY|PASSWORD|PASSWD)\s*[=:]\s*[^\s,]+/gi,
+      /(?:TOKEN|API_KEY|API_SECRET|AUTH_TOKEN|GITHUB_TOKEN|GH_TOKEN|BEARER|JWT|OAUTH|CREDENTIAL|SECRET|PRIVATE_KEY|PASSWORD|PASSWD|PASSPHRASE)\s*[=:]\s*[^\s,]+/gi,
       // Generic high-entropy look: base64 strings >32 chars or hex strings >32 digits — but only
       // when preceded by a flag name (e.g. --github-token=EyJ...). Global flag so
       // every such flag in the command line is redacted, not just the first.
@@ -23233,6 +23233,12 @@ var gitTool = {
   // The git subcommand (status/commit/push) is what a trust rule needs to
   // distinguish; `git status` and `git push --force` must not share a subject.
   subjectKey: "command",
+  // `command` is an enum subcommand, so on its own it rendered the subject
+  // `"push"` — and one "always allow" then covered every push, to any branch,
+  // with or without `--force`. These are the fields that change what the call
+  // actually does, so the stored trust rule is as specific as the invocation
+  // the user approved.
+  subjectFields: ["branch", "force", "worktreeAction", "worktreePath", "newBranch"],
   mutating: true,
   capabilities: ["fs.write", "shell.restricted"],
   timeoutMs: TIMEOUT_MS2,
@@ -25425,13 +25431,7 @@ function broadcastTodoUpdate(context, todos) {
     to: `@session:${sessionId}`,
     type: "status",
     subject: `Kanban todo list updated (${todos.length} item${todos.length === 1 ? "" : "s"})`,
-    body: JSON.stringify({
-      kind: "kanban.todos.updated",
-      sessionId,
-      revision: context.state.revision,
-      todoCount: todos.length,
-      statusCounts
-    }),
+    body: `Shared Kanban board synced this session's todo list: ${todos.length} item${todos.length === 1 ? "" : "s"} \u2014 ${statusCounts.completed} completed, ${statusCounts.inProgress} in progress, ${statusCounts.pending} pending.`,
     priority: "normal",
     senderSessionId: sessionId
   }).catch(() => {

package/dist/plan.js

@@ -226,13 +226,7 @@ function broadcastTodoUpdate(context, todos) {
     to: `@session:${sessionId}`,
     type: "status",
     subject: `Kanban todo list updated (${todos.length} item${todos.length === 1 ? "" : "s"})`,
-    body: JSON.stringify({
-      kind: "kanban.todos.updated",
-      sessionId,
-      revision: context.state.revision,
-      todoCount: todos.length,
-      statusCounts
-    }),
+    body: `Shared Kanban board synced this session's todo list: ${todos.length} item${todos.length === 1 ? "" : "s"} \u2014 ${statusCounts.completed} completed, ${statusCounts.inProgress} in progress, ${statusCounts.pending} pending.`,
     priority: "normal",
     senderSessionId: sessionId
   }).catch(() => {

package/dist/process-registry.js

@@ -211,7 +211,7 @@ var SENSITIVE_FLAG_PATTERNS = [
   // redaction function. Synced with core copy.
   /(?<![-\w])-(?:password|p|a)(?:[=\s]+)?[^\s,-]+/gi,
   // env var–style secrets: TOKEN=x, API_KEY=y, etc.
-  /(?:TOKEN|API_KEY|API_SECRET|AUTH_TOKEN|GITHUB_TOKEN|GH_TOKEN|BEARER|JWT|OAUTH|CREDENTIAL|SECRET|PRIVATE_KEY|PASSWORD|PASSWD)\s*[=:]\s*[^\s,]+/gi,
+  /(?:TOKEN|API_KEY|API_SECRET|AUTH_TOKEN|GITHUB_TOKEN|GH_TOKEN|BEARER|JWT|OAUTH|CREDENTIAL|SECRET|PRIVATE_KEY|PASSWORD|PASSWD|PASSPHRASE)\s*[=:]\s*[^\s,]+/gi,
   // Generic high-entropy look: base64 strings >32 chars or hex strings >32 digits — but only
   // when preceded by a flag name (e.g. --github-token=EyJ...). Global flag so
   // every such flag in the command line is redacted, not just the first.

package/dist/session-kanban.js

@@ -213,13 +213,7 @@ function broadcastTodoUpdate(context, todos) {
     to: `@session:${sessionId}`,
     type: "status",
     subject: `Kanban todo list updated (${todos.length} item${todos.length === 1 ? "" : "s"})`,
-    body: JSON.stringify({
-      kind: "kanban.todos.updated",
-      sessionId,
-      revision: context.state.revision,
-      todoCount: todos.length,
-      statusCounts
-    }),
+    body: `Shared Kanban board synced this session's todo list: ${todos.length} item${todos.length === 1 ? "" : "s"} \u2014 ${statusCounts.completed} completed, ${statusCounts.inProgress} in progress, ${statusCounts.pending} pending.`,
     priority: "normal",
     senderSessionId: sessionId
   }).catch(() => {

package/dist/task.js

@@ -186,13 +186,7 @@ function broadcastTodoUpdate(context, todos) {
     to: `@session:${sessionId}`,
     type: "status",
     subject: `Kanban todo list updated (${todos.length} item${todos.length === 1 ? "" : "s"})`,
-    body: JSON.stringify({
-      kind: "kanban.todos.updated",
-      sessionId,
-      revision: context.state.revision,
-      todoCount: todos.length,
-      statusCounts
-    }),
+    body: `Shared Kanban board synced this session's todo list: ${todos.length} item${todos.length === 1 ? "" : "s"} \u2014 ${statusCounts.completed} completed, ${statusCounts.inProgress} in progress, ${statusCounts.pending} pending.`,
     priority: "normal",
     senderSessionId: sessionId
   }).catch(() => {

package/dist/test.js

@@ -141,12 +141,12 @@ function resolveWin32Command(cmd) {
   }
   return cmd;
 }
-var WIN32_SHELL_META = /[&|<>"\r\n\0]/;
+var WIN32_SHELL_META = /[&|<>"%\r\n\0]/;
 function assertSafeWin32ShellArgs(args) {
   for (const arg of args) {
     if (typeof arg === "string" && WIN32_SHELL_META.test(arg)) {
       throw new Error(
-        'win32 cmd shim spawn: argument contains a shell metacharacter (one of & | < > ", or a newline) that could enable command injection through the .cmd/.bat wrapper - refusing to run. Offending argument: ' + JSON.stringify(arg)
+        'win32 cmd shim spawn: argument contains a shell metacharacter (one of & | < > " %, or a newline) that could enable command injection through the .cmd/.bat wrapper - refusing to run. Offending argument: ' + JSON.stringify(arg)
       );
     }
   }
@@ -377,7 +377,7 @@ var SENSITIVE_FLAG_PATTERNS = [
   // redaction function. Synced with core copy.
   /(?<![-\w])-(?:password|p|a)(?:[=\s]+)?[^\s,-]+/gi,
   // env var–style secrets: TOKEN=x, API_KEY=y, etc.
-  /(?:TOKEN|API_KEY|API_SECRET|AUTH_TOKEN|GITHUB_TOKEN|GH_TOKEN|BEARER|JWT|OAUTH|CREDENTIAL|SECRET|PRIVATE_KEY|PASSWORD|PASSWD)\s*[=:]\s*[^\s,]+/gi,
+  /(?:TOKEN|API_KEY|API_SECRET|AUTH_TOKEN|GITHUB_TOKEN|GH_TOKEN|BEARER|JWT|OAUTH|CREDENTIAL|SECRET|PRIVATE_KEY|PASSWORD|PASSWD|PASSPHRASE)\s*[=:]\s*[^\s,]+/gi,
   // Generic high-entropy look: base64 strings >32 chars or hex strings >32 digits — but only
   // when preceded by a flag name (e.g. --github-token=EyJ...). Global flag so
   // every such flag in the command line is redacted, not just the first.

package/dist/todo.js

@@ -335,13 +335,7 @@ function broadcastTodoUpdate(context, todos) {
     to: `@session:${sessionId}`,
     type: "status",
     subject: `Kanban todo list updated (${todos.length} item${todos.length === 1 ? "" : "s"})`,
-    body: JSON.stringify({
-      kind: "kanban.todos.updated",
-      sessionId,
-      revision: context.state.revision,
-      todoCount: todos.length,
-      statusCounts
-    }),
+    body: `Shared Kanban board synced this session's todo list: ${todos.length} item${todos.length === 1 ? "" : "s"} \u2014 ${statusCounts.completed} completed, ${statusCounts.inProgress} in progress, ${statusCounts.pending} pending.`,
     priority: "normal",
     senderSessionId: sessionId
   }).catch(() => {

package/dist/tool-tier.js

@@ -169,7 +169,7 @@ function assertSafeWin32ShellArgs(args) {
   for (const arg of args) {
     if (typeof arg === "string" && WIN32_SHELL_META.test(arg)) {
       throw new Error(
-        'win32 cmd shim spawn: argument contains a shell metacharacter (one of & | < > ", or a newline) that could enable command injection through the .cmd/.bat wrapper - refusing to run. Offending argument: ' + JSON.stringify(arg)
+        'win32 cmd shim spawn: argument contains a shell metacharacter (one of & | < > " %, or a newline) that could enable command injection through the .cmd/.bat wrapper - refusing to run. Offending argument: ' + JSON.stringify(arg)
       );
     }
   }
@@ -190,7 +190,7 @@ var WIN32_SHELL_META;
 var init_win32_resolve = __esm({
   "src/_win32-resolve.ts"() {
     "use strict";
-    WIN32_SHELL_META = /[&|<>"\r\n\0]/;
+    WIN32_SHELL_META = /[&|<>"%\r\n\0]/;
   }
 });
 
@@ -432,7 +432,7 @@ var init_redact_command = __esm({
       // redaction function. Synced with core copy.
       /(?<![-\w])-(?:password|p|a)(?:[=\s]+)?[^\s,-]+/gi,
       // env var–style secrets: TOKEN=x, API_KEY=y, etc.
-      /(?:TOKEN|API_KEY|API_SECRET|AUTH_TOKEN|GITHUB_TOKEN|GH_TOKEN|BEARER|JWT|OAUTH|CREDENTIAL|SECRET|PRIVATE_KEY|PASSWORD|PASSWD)\s*[=:]\s*[^\s,]+/gi,
+      /(?:TOKEN|API_KEY|API_SECRET|AUTH_TOKEN|GITHUB_TOKEN|GH_TOKEN|BEARER|JWT|OAUTH|CREDENTIAL|SECRET|PRIVATE_KEY|PASSWORD|PASSWD|PASSPHRASE)\s*[=:]\s*[^\s,]+/gi,
       // Generic high-entropy look: base64 strings >32 chars or hex strings >32 digits — but only
       // when preceded by a flag name (e.g. --github-token=EyJ...). Global flag so
       // every such flag in the command line is redacted, not just the first.
@@ -23233,6 +23233,12 @@ var gitTool = {
   // The git subcommand (status/commit/push) is what a trust rule needs to
   // distinguish; `git status` and `git push --force` must not share a subject.
   subjectKey: "command",
+  // `command` is an enum subcommand, so on its own it rendered the subject
+  // `"push"` — and one "always allow" then covered every push, to any branch,
+  // with or without `--force`. These are the fields that change what the call
+  // actually does, so the stored trust rule is as specific as the invocation
+  // the user approved.
+  subjectFields: ["branch", "force", "worktreeAction", "worktreePath", "newBranch"],
   mutating: true,
   capabilities: ["fs.write", "shell.restricted"],
   timeoutMs: TIMEOUT_MS2,
@@ -25425,13 +25431,7 @@ function broadcastTodoUpdate(context, todos) {
     to: `@session:${sessionId}`,
     type: "status",
     subject: `Kanban todo list updated (${todos.length} item${todos.length === 1 ? "" : "s"})`,
-    body: JSON.stringify({
-      kind: "kanban.todos.updated",
-      sessionId,
-      revision: context.state.revision,
-      todoCount: todos.length,
-      statusCounts
-    }),
+    body: `Shared Kanban board synced this session's todo list: ${todos.length} item${todos.length === 1 ? "" : "s"} \u2014 ${statusCounts.completed} completed, ${statusCounts.inProgress} in progress, ${statusCounts.pending} pending.`,
     priority: "normal",
     senderSessionId: sessionId
   }).catch(() => {

package/dist/typecheck.js

@@ -141,12 +141,12 @@ function resolveWin32Command(cmd) {
   }
   return cmd;
 }
-var WIN32_SHELL_META = /[&|<>"\r\n\0]/;
+var WIN32_SHELL_META = /[&|<>"%\r\n\0]/;
 function assertSafeWin32ShellArgs(args) {
   for (const arg of args) {
     if (typeof arg === "string" && WIN32_SHELL_META.test(arg)) {
       throw new Error(
-        'win32 cmd shim spawn: argument contains a shell metacharacter (one of & | < > ", or a newline) that could enable command injection through the .cmd/.bat wrapper - refusing to run. Offending argument: ' + JSON.stringify(arg)
+        'win32 cmd shim spawn: argument contains a shell metacharacter (one of & | < > " %, or a newline) that could enable command injection through the .cmd/.bat wrapper - refusing to run. Offending argument: ' + JSON.stringify(arg)
       );
     }
   }
@@ -377,7 +377,7 @@ var SENSITIVE_FLAG_PATTERNS = [
   // redaction function. Synced with core copy.
   /(?<![-\w])-(?:password|p|a)(?:[=\s]+)?[^\s,-]+/gi,
   // env var–style secrets: TOKEN=x, API_KEY=y, etc.
-  /(?:TOKEN|API_KEY|API_SECRET|AUTH_TOKEN|GITHUB_TOKEN|GH_TOKEN|BEARER|JWT|OAUTH|CREDENTIAL|SECRET|PRIVATE_KEY|PASSWORD|PASSWD)\s*[=:]\s*[^\s,]+/gi,
+  /(?:TOKEN|API_KEY|API_SECRET|AUTH_TOKEN|GITHUB_TOKEN|GH_TOKEN|BEARER|JWT|OAUTH|CREDENTIAL|SECRET|PRIVATE_KEY|PASSWORD|PASSWD|PASSPHRASE)\s*[=:]\s*[^\s,]+/gi,
   // Generic high-entropy look: base64 strings >32 chars or hex strings >32 digits — but only
   // when preceded by a flag name (e.g. --github-token=EyJ...). Global flag so
   // every such flag in the command line is redacted, not just the first.

package/dist/win32.js

@@ -36,12 +36,12 @@ function resolvePowerShell(cmd) {
   }
   return resolved;
 }
-var WIN32_SHELL_META = /[&|<>"\r\n\0]/;
+var WIN32_SHELL_META = /[&|<>"%\r\n\0]/;
 function assertSafeWin32ShellArgs(args) {
   for (const arg of args) {
     if (typeof arg === "string" && WIN32_SHELL_META.test(arg)) {
       throw new Error(
-        'win32 cmd shim spawn: argument contains a shell metacharacter (one of & | < > ", or a newline) that could enable command injection through the .cmd/.bat wrapper - refusing to run. Offending argument: ' + JSON.stringify(arg)
+        'win32 cmd shim spawn: argument contains a shell metacharacter (one of & | < > " %, or a newline) that could enable command injection through the .cmd/.bat wrapper - refusing to run. Offending argument: ' + JSON.stringify(arg)
       );
     }
   }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wrongstack/tools",
-  "version": "0.308.7",
+  "version": "0.309.1",
   "license": "MIT",
   "description": "WrongStack built-in tools: read/write/edit, bash/exec, grep/glob, git, fetch, test, lint, and more.",
   "repository": {
@@ -253,9 +253,9 @@
     "turndown": "^7.2.4",
     "undici": "^8.10.0",
     "web-tree-sitter": "0.26.12",
-    "@wrongstack/core": "0.308.7",
-    "@wrongstack/persistence": "0.308.7",
-    "@wrongstack/kanban": "0.308.7"
+    "@wrongstack/core": "0.309.1",
+    "@wrongstack/kanban": "0.309.1",
+    "@wrongstack/persistence": "0.309.1"
   },
   "devDependencies": {
     "@types/node": "^26.2.0",