agent-from-zero 0.36.0 → 0.39.0

package/dist/permissions.js

@@ -2,7 +2,8 @@ import path from "node:path"; // used to resolve and split file paths
 import fs from "node:fs"; // resolve symlinks before auto mode grants file access
 import os from "node:os"; // `cd ~` in the recoverable-shell analyzer
 import { execFileSync } from "node:child_process"; // ask git whether a deletion target is disposable
-import { CONFIG } from "./config.js"; // user-configured allow/deny rules from settings files
+import { CONFIG, GLOBAL_SETTINGS_PATH } from "./config.js"; // user-configured allow/deny rules from settings files
+import { emit } from "./telemetry.js"; // a bypassed approval leaves an audit row, not silence
 // ---- The no-fly zone --------------------------------------------------------
 // Writes here are never OK, in any mode. .git can destroy history, shell rc
 // files inject code into every future terminal, .ssh/.env leak credentials.
@@ -215,6 +216,27 @@ export function gitWorkTree(target) {
     }
     return topLevels.get(dir);
 }
+// Trusted ground outside any work tree: autoMode.trustedDirs from global
+// settings, plus directories trusted from the approval menu this session.
+// Home and / never count, for the same reason as above. Nor does the global
+// settings file: it holds this very list, and an agent that could edit it
+// unasked could widen its own reach.
+const tooBroadToTrust = (dir) => dir === os.homedir() || dir === resolveFileTarget(os.homedir()) || dir === path.parse(dir).root;
+const settingsFile = () => resolveFileTarget(GLOBAL_SETTINGS_PATH);
+function trustedDir(target) {
+    if (target === settingsFile())
+        return false;
+    return CONFIG.autoMode.trustedDirs.some((dir) => {
+        let root;
+        try {
+            root = resolveFileTarget(dir);
+        }
+        catch {
+            return false;
+        }
+        return !tooBroadToTrust(root) && inside(root, target);
+    });
+}
 // A deletion is recoverable when the target is scratch (inside a temp dir) or
 // git calls it disposable in its own repo: ignored (build output, caches) with
 // nothing tracked beneath it. Symlinks are left to review: `rm -r link/`
@@ -442,6 +464,18 @@ export function recoverableShell(command) {
     }
     return readOnly ? { readOnly, reason: "read-only command" } : { readOnly, reason: "recoverable: git can undo it, or it only removes gitignored or temp files" };
 }
+// ---- The user's prod guard (permissions.ask) ----------------------------------
+// Text that always needs a human: a prod context, a deployment verb, a prod
+// path. Checked BEFORE auto review and BEFORE the bypass rewrite, so neither
+// can approve it. Case-insensitive substring, on the whole command or the path.
+function guardHit(text) {
+    const haystack = text.toLowerCase();
+    for (const rule of CONFIG.permissions.ask ?? []) {
+        if (rule && haystack.includes(rule.toLowerCase()))
+            return rule;
+    }
+    return null;
+}
 // Decide what a bash command deserves: deny, ask, or allow.
 function checkBash(command, auto = false) {
     const summary = command.trim(); // what the user will see in the prompt
@@ -458,6 +492,9 @@ function checkBash(command, auto = false) {
     for (const d of user.deny)
         if (command.toLowerCase().includes(d.toLowerCase()))
             return { decision: "deny", reason: `denied by your settings ("${d}")`, summary };
+    const guard = guardHit(command);
+    if (guard)
+        return { decision: "ask", requiresHuman: true, reason: `prod guard: "${guard}"`, summary };
     // node/npm/npx, git aliases and tool-wide grants can run arbitrary code.
     // Auto mode must inspect the actual command, including background commands.
     if (auto) {
@@ -539,7 +576,11 @@ export function checkPermission(toolName, argsJson, auto = false) {
             summary: base.summary,
         };
     }
-    if (CONFIG.bypassPermissions && base.decision === "ask" && toolName !== "exit_plan_mode" && toolName !== "ask_user") {
+    if (CONFIG.bypassPermissions && base.decision === "ask" && !base.requiresHuman && toolName !== "exit_plan_mode" && toolName !== "ask_user") {
+        // Bypass may skip an ordinary approval, never one the user's own guard list
+        // marked for a human. Every skip is recorded: a bypass run with no audit row
+        // is indistinguishable from a run that never checked.
+        emit("agent_permission_bypassed", { tool: toolName, reason: base.reason });
         return { decision: "allow", reason: "permission approvals bypassed for this run", summary: base.summary };
     }
     return base;
@@ -575,9 +616,13 @@ function basePermission(toolName, argsJson, auto) {
                 return { decision: "deny", reason, summary: args.path };
             const relative = path.relative(fs.realpathSync(process.cwd()), resolved);
             // Outside the start directory is still recoverable in another git work
-            // tree or a temp dir (git, /undo); anywhere else a human decides.
-            if (toolName !== "read_file" && (relative === ".." || relative.startsWith(`..${path.sep}`) || path.isAbsolute(relative)) && !inTempDir(resolved) && !gitWorkTree(resolved)) {
-                return { decision: "ask", requiresHuman: true, reason: "resolved write target is outside the project", summary: `${args.path} → ${resolved}` };
+            // tree or a temp dir (git, /undo), and a trusted directory is one the
+            // user vouched for; anywhere else a human decides, and may trust the
+            // file's directory for the session rather than approve every write.
+            if (toolName !== "read_file" && (relative === ".." || relative.startsWith(`..${path.sep}`) || path.isAbsolute(relative)) && !inTempDir(resolved) && !gitWorkTree(resolved) && !trustedDir(resolved)) {
+                const dir = path.dirname(resolved);
+                return { decision: "ask", requiresHuman: true, reason: "resolved write target is outside the project", summary: `${args.path} → ${resolved}`,
+                    ...(resolved === settingsFile() || tooBroadToTrust(dir) ? {} : { trustDir: dir }) };
             }
         }
         catch {
@@ -645,6 +690,9 @@ function basePermission(toolName, argsJson, auto) {
             const hit = noFlyHit(p); // is it in the no-fly zone?
             if (hit)
                 return { decision: "deny", reason: hit, summary: p }; // hard stop — deny always wins
+            const guard = guardHit(p); // the user's prod guard, applied to the path
+            if (guard)
+                return { decision: "ask", requiresHuman: true, reason: `prod guard: "${guard}"`, summary: p };
             // The user may pre-approve write tools ("tool:edit_file") to skip the
             // prompt — note this runs AFTER the no-fly check, so it widens "ask",
             // never "deny".
@@ -724,3 +772,30 @@ function resolveFileTarget(target) {
     }
     return path.join(fs.realpathSync(current), ...missing);
 }
+// ---- The approval menu ----------------------------------------------------------
+// Both frontends (readline and Ink) offer the same choices and apply the same
+// session grant, so the menu lives next to the rules it widens. Outside auto
+// mode the grant is "don't ask again for this tool"; in auto mode it is "trust
+// this directory", offered only for an outside write. The last option is always
+// "No", and so is -1 (Esc). `granted` is the note to show after a grant.
+export function approvalMenu(auto, toolName, trustDir) {
+    const grant = auto
+        ? (trustDir ? `Yes, and trust ${trustDir}/ for this session` : null)
+        : (toolName ? `Yes, and don't ask again for ${toolName} this session` : "Yes, and don't ask again this session");
+    const options = [auto ? "Yes, once" : "Yes", ...(grant ? [grant] : []), "No — let me tell the agent what to do instead"];
+    const choose = (i) => {
+        if (i < 0 || i >= options.length - 1)
+            return { approved: false };
+        if (i === 0)
+            return { approved: true };
+        if (auto && trustDir) {
+            CONFIG.autoMode.trustedDirs.push(trustDir);
+            return { approved: true, granted: `trusting ${trustDir}/ for this session` };
+        }
+        if (!toolName)
+            return { approved: true };
+        CONFIG.permissions.allow.push(`tool:${toolName}`); // "don't ask again" → session allowlist
+        return { approved: true, granted: `won't ask again for ${toolName} this session` };
+    };
+    return { options, choose };
+}

package/dist/prompt.js

@@ -21,7 +21,7 @@ Behavior rules:
 - You support SKILLS — reusable, named procedures saved as Markdown under .mini-agent/skills/ in the project (or ~/.config/mini-agent/skills/ globally). When a request matches one of the skills listed in the \`skill\` tool, call \`skill\` with its name to load the steps, then carry them out. If there is no \`skill\` tool in this session, none are loaded in this project yet — the capability still exists: the user adds one at .mini-agent/skills/<name>/SKILL.md, runs any with "/skill <name>", and lists them with "/skills". So when asked whether you support skills, the answer is yes — describe this mechanism (and which skills, if any, are currently loaded); never claim your toolset is fixed.
 - Report results accurately. If a test fails, say it failed. Don't claim success when you're not sure. Don't be overly self-doubting either — distinguish "verified working" from "I think it works".
 - Never add comments to code you did not change. Never reformat code you did not change.
-- Keep final answers under 150 words unless the task genuinely requires more.
+- End every turn with a final message the user can take in at a glance. First line: the outcome (done, failed, found X, nothing to report). If that says it all, stop there, e.g. "No alerts — all normal." Otherwise follow it with short sections, each a bold label over bullet points: what you did, what you found (each problem: what, where, impact), what needs the user's decision. One fact per bullet; no filler, no restating the request. Under 150 words unless the task genuinely requires more. Write in the language the user writes in.
 - Between tool calls, write at most one short sentence — usually nothing.
 - A [permission] denial is a hard boundary. Do not attempt workarounds — explain and ask the user.
 - If the task is ambiguous, ask one clarifying question instead of guessing.`;

package/dist/title.js

@@ -41,8 +41,9 @@ export function setTerminalTitle(title) {
 }
 export const refreshTerminalTitle = () => setTerminalTitle(lastTitle);
 // "Which window is this?" — another session asked. Ring the bell and blink the
-// tab title for a few seconds, then put the real title back.
-export function flashTerminalTitle(ms = 6000) {
+// tab title for a few seconds, then put the real title back. A finished cron run
+// uses it too, blinking its own label ("⏰ cron_1 done") instead.
+export function flashTerminalTitle(ms = 6000, label) {
     if (!process.stdout.isTTY)
         return;
     process.stdout.write("\x07");
@@ -59,7 +60,7 @@ export function flashTerminalTitle(ms = 6000) {
             process.stdout.write(terminalTitleSequence(tabTitle(lastTitle)));
             return;
         }
-        process.stdout.write(terminalTitleSequence(on ? `👋 ${name} — HERE 👋` : tabTitle(lastTitle)));
+        process.stdout.write(terminalTitleSequence(on ? label ?? `👋 ${name} — HERE 👋` : tabTitle(lastTitle)));
     }, 500);
     flashing.unref();
 }

package/dist/tools.js

@@ -23,7 +23,8 @@ const TOOL_RESULT_LIMIT = 4000; // cap (chars) for a normal tool result entering
 const READ_LIMIT = 16000; // read_file gets a larger cap of its own
 const SEARCH_MAX_MATCHES = 50; // max matches returned by search
 const SKIP_DIRS = new Set(["node_modules", ".git", "dist", "build"]); // directories search never enters
-const BASH_TIMEOUT_MS = 30_000; // a single command may run this long before we kill it
+const BASH_TIMEOUT_MS = 120_000; // a single command may run this long before we kill it (Claude Code's 2 minutes)
+const BASH_MAX_TIMEOUT_MS = 600_000; // the most a command may ask for; anything longer belongs in the background
 const BASH_OUTPUT_LIMIT = 8_000; // chars of command output kept inline; beyond this we spill to a file
 const SPILL_NOTE_SLACK = 400; // room for the "[...saved to FILE]" note so dispatch's cap never eats it
 // Errors are not exceptions — they are text that tells the model what to do next.
@@ -189,17 +190,27 @@ function spillIfHuge(out, what) {
     const head = out.slice(0, BASH_OUTPUT_LIMIT); // a generous preview
     return `${head}\n\n[...${what} truncated: ${out.length} chars total. Full output saved to ${file} — use read_file to inspect more.]`;
 }
+// The watchdog for one run_bash call: the model may ask for more (or less) than
+// the default, never past the maximum. Anything that isn't a positive number of
+// seconds — missing, "", garbage — gets the default.
+export function bashTimeoutMs(seconds) {
+    const s = Number(seconds);
+    return Number.isFinite(s) && s > 0 ? Math.min(Math.round(s * 1000), BASH_MAX_TIMEOUT_MS) : BASH_TIMEOUT_MS;
+}
 const runBash = {
-    definition: def("run_bash", `Run a bash command on the user's machine (30s timeout) and return its output.
+    definition: def("run_bash", `Run a bash command on the user's machine and return its output. It is killed after 2 minutes unless you pass a longer timeout (up to 600 seconds) — set one when you expect a slow command (a full test suite, a build). Longer, or work you don't need to wait for: run_bash_background.
 Boundaries: only for things that truly need execution — installing dependencies, running tests/scripts, git operations.
 To read files use read_file (not cat), to search use search (not grep/find), to edit files use edit_file (not sed/redirection).
 Dangerous commands require user approval; some are denied outright. A [permission] result is a hard boundary — never try to work around it.
-On error: failures return the error output — analyze it and try a different approach; do not resend the same command unchanged.`, { command: { type: "string", description: "The bash command to run" } }, ["command"]),
+On error: failures return the error output — analyze it and try a different approach; do not resend the same command unchanged.`, {
+        command: { type: "string", description: "The bash command to run" },
+        timeout: { type: "number", description: "Optional: seconds before the command is killed (default 120, max 600)" },
+    }, ["command"]),
     // Async + spawn: the event loop stays responsive while the command runs, so
     // the spinner keeps spinning and Ctrl+C is heard. execSync would freeze
     // everything — the whole process, the UI, the signal handler — until it
     // returned. The AbortSignal lets the loop kill the child on interruption
-    // instead of waiting out the 30s timeout.
+    // instead of waiting out the timeout.
     run: (args, signal) => new Promise((resolve) => {
         const child = spawn(args.command, { shell: true, stdio: ["ignore", "pipe", "pipe"], env: childEnv() }); // shell:true → bash semantics
         let stdout = ""; // captured stdout
@@ -214,10 +225,12 @@ On error: failures return the error output — analyze it and try a different ap
             resolve(text); // hand the result back
         };
         // Hard timeout: SIGKILL the whole process group, never hang the agent.
+        const timeoutMs = bashTimeoutMs(args.timeout);
         const timer = setTimeout(() => {
             child.kill("SIGKILL");
-            done(fail(`Command timed out after ${BASH_TIMEOUT_MS / 1000}s and was killed.${stdout ? `\npartial stdout:\n${stdout.slice(0, 2000)}` : ""}`));
-        }, BASH_TIMEOUT_MS);
+            const hint = timeoutMs < BASH_MAX_TIMEOUT_MS ? ` If it needs longer, rerun with a larger timeout (max ${BASH_MAX_TIMEOUT_MS / 1000}) or use run_bash_background.` : " Use run_bash_background for anything this long.";
+            done(fail(`Command timed out after ${timeoutMs / 1000}s and was killed.${hint}${stdout ? `\npartial stdout:\n${stdout.slice(0, 2000)}` : ""}`));
+        }, timeoutMs);
         // Ctrl+C while a command runs: kill the child immediately.
         const onAbort = () => {
             child.kill("SIGKILL");
@@ -240,17 +253,19 @@ On error: failures return the error output — analyze it and try a different ap
     }),
 };
 // ============ run_bash_background (Day 37) ============
-// run_bash blocks and dies at its 30s watchdog — useless for anything truly
-// slow. This is its asynchronous twin: it spawns the command and returns a task
-// id IMMEDIATELY, so the agent keeps reasoning while the work happens. The loop
-// injects a <task_notification> when the command finishes (background.ts). Use
-// it for installs, builds, full test runs, or servers that never exit — exactly
-// the keywords that signal a slow operation. The command goes through the SAME
-// permission gate as run_bash (see permissions.ts), so the danger rules are
-// identical; only the blocking behavior differs.
+// run_bash blocks, and dies at its watchdog (2 minutes, 10 at most) — useless
+// for anything truly slow. This is its asynchronous twin: it spawns the command
+// and returns a task id IMMEDIATELY, so the agent keeps reasoning while the work
+// happens. The loop injects a <task_notification> when the command finishes
+// (background.ts); if the agent is idle by then, the frontend wakes it with one
+// (loop.ts, takeFinishedWork). Use it for installs, builds, full test runs, or
+// servers that never exit — exactly the keywords that signal a slow operation.
+// The command goes through the SAME permission gate as run_bash (see
+// permissions.ts), so the danger rules are identical; only the blocking
+// behavior differs.
 const runBashBackground = {
     definition: def("run_bash_background", `Run a slow bash command in the BACKGROUND and return immediately with a task id (e.g. bg_1) — do NOT wait for it.
-When to use: anything that would exceed run_bash's 30s limit or block you — installing dependencies (npm/pip install), builds (npm run build, cargo build, make), full test suites (pytest, npm test), deploys, or long-running servers (npm run dev) that never exit.
+When to use: anything that could outlast run_bash's timeout (10 minutes at most) or that you don't need to wait for — installing dependencies (npm/pip install), builds (npm run build, cargo build, make), full test suites (pytest, npm test), deploys, or long-running servers (npm run dev) that never exit.
 What you get back: just the task id. The command keeps running. When it finishes you'll receive a <task_notification> with its status and output tail — react to that. For a server or a job still running, poll it with bash_output.
 Boundaries & permissions are identical to run_bash (dangerous commands are still gated or denied). For quick commands use run_bash instead — waiting on a one-off background job wastes a turn.`, { command: { type: "string", description: "The bash command to run in the background" } }, ["command"]),
     // Fire-and-return: start the process, hand back the id. The output is captured

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "agent-from-zero",
-  "version": "0.36.0",
+  "version": "0.39.0",
   "type": "module",
   "bin": {
     "mini-agent": "dist/agent.js"