agentlas 0.5.2 → 0.5.5

package/engine/agentlas-repl.cjs

@@ -16,6 +16,7 @@ const caps = require("./agentlas-capabilities.cjs");
 const input = require("./agentlas-input.cjs");
 const i18n = require("./agentlas-i18n.cjs");
 const style = require("./agentlas-style.cjs");
+const permissions = require("./agentlas-permissions.cjs");
 
 function runtimeLabel(rt) {
   if (!rt) return "(none)";
@@ -56,6 +57,8 @@ function makeMemoryGuard(ui, heading) {
   };
   return {
     c: ui.c,
+    lang: ui.lang,
+    t: (...a) => ui.t(...a),
     streamStart: () => ui.streamStart(),
     streamDelta: (t) => {
       if (cut) {
@@ -89,6 +92,9 @@ function makeMemoryGuard(ui, heading) {
     ok: (...a) => ui.ok(...a),
     cost: (...a) => ui.cost(...a),
     line: (...a) => ui.line(...a),
+    applyTaskTool: (...a) => ui.applyTaskTool(...a),
+    applyTaskResult: (...a) => ui.applyTaskResult(...a),
+    replaceTasks: (...a) => ui.replaceTasks(...a),
   };
 }
 
@@ -111,10 +117,13 @@ function makeStyleGuard(ui) {
   };
   return {
     c: ui.c,
+    lang: ui.lang,
+    t: (...a) => ui.t(...a),
     streamStart: () => {
       buf = "";
       inCode = false;
-      ui.streamStart();
+      // This guard emits complete lines, so the persistent turn footer can safely stay visible.
+      ui.streamStart(true);
     },
     streamDelta: (text) => {
       if (!text) return;
@@ -143,6 +152,9 @@ function makeStyleGuard(ui) {
     cost: (...a) => ui.cost(...a),
     line: (...a) => ui.line(...a),
     stopSpinner: (...a) => ui.stopSpinner(...a),
+    applyTaskTool: (...a) => ui.applyTaskTool(...a),
+    applyTaskResult: (...a) => ui.applyTaskResult(...a),
+    replaceTasks: (...a) => ui.replaceTasks(...a),
   };
 }
 
@@ -157,7 +169,7 @@ function startRepl(opts) {
   const state = {
     subject: opts.subject || null,
     runtime: opts.runtime,
-    permission: opts.permission || "write",
+    permission: opts.permission == null ? "write" : permissions.normalize(opts.permission),
     cwd: opts.cwd,
     history: [],
     native: {}, // kind → { id }
@@ -197,6 +209,7 @@ function startRepl(opts) {
   let closed = false;
   let currentAbort = null;
   let idleExitArmedUntil = 0;
+  const permissionCycle = permissions.createCycleController();
   rl.on("close", () => {
     if (handoff) return; // intentionally closed to hand stdin to the raw-mode composer
     closed = true;
@@ -235,6 +248,19 @@ function startRepl(opts) {
     return { projectPath: state.projectPath, agentId: state.subject && state.subject.id, permission: state.permission, cwd: state.cwd, lang: ui.lang };
   }
 
+  function setPermission(value, options = {}) {
+    const notify = options.notify !== false;
+    const persist = options.persist !== false;
+    const level = permissions.normalize(value);
+    state.permission = level;
+    if (persist) {
+      prefs.permission = level;
+      if (opts.savePrefs) opts.savePrefs(prefs);
+    }
+    if (notify) ui.ok(ui.t("permSet", level));
+    return level;
+  }
+
   // Session usage ledger — accumulate per runtime label (host advantage: no single-model CLI can show this).
   function recordCost(label, usage) {
     const e = state.cost[label] || (state.cost[label] = { turns: 0, in: 0, out: 0, cost: 0, ms: 0 });
@@ -270,22 +296,27 @@ function startRepl(opts) {
   // ── run one turn ──
   async function runTurn(prompt, runOptions = {}) {
     busy = true;
-    ui.beginTurn(); // 라이브 경과시간 스피너의 턴 시작점
     currentAbort = new AbortController();
     const signal = currentAbort.signal;
-    const recordHistoryEntry = !runOptions.side;
-    const targetLang = H.detectResponseLanguage ? H.detectResponseLanguage(prompt, ui.lang) : ui.lang;
-    const ctx = { ...ctxNow(), lang: targetLang, uiLang: ui.lang };
-    const rt = state.runtime;
-    const costLabel = runtimeLabel(rt);
-    const runEnv = H.buildChildEnv ? await H.buildChildEnv(db, { ...ctx, cwd: state.cwd }) : process.env;
-    Object.assign(process.env, runEnv);
-    ui._lastUsage = null;
-    const assistantUi = makeStyleGuard(ui);
-    const thinkingText = i18n.t(targetLang, "thinkingWith", costLabel);
-    ui.info(thinkingText);
-    ui.status(thinkingText);
     try {
+      ui.beginTurn({
+        ...composerMeta(),
+        onInterrupt: () => {
+          if (!currentAbort || currentAbort.signal.aborted) return;
+          currentAbort.abort();
+          ui.warn(ui.t("interrupted"));
+        },
+      }); // 작업 중에도 composer/status bar와 실제 runtime task 목록을 화면 하단에 유지
+      const recordHistoryEntry = !runOptions.side;
+      const targetLang = H.detectResponseLanguage ? H.detectResponseLanguage(prompt, ui.lang) : ui.lang;
+      const ctx = { ...ctxNow(), lang: targetLang, uiLang: ui.lang };
+      const rt = state.runtime;
+      const costLabel = runtimeLabel(rt);
+      const runEnv = H.buildChildEnv ? await H.buildChildEnv(db, { ...ctx, cwd: state.cwd }) : process.env;
+      ui._lastUsage = null;
+      const assistantUi = makeStyleGuard(ui);
+      const thinkingText = i18n.t(targetLang, "thinkingWith", costLabel);
+      ui.status(thinkingText);
       if (rt.mode === "cli") {
         const bin = H.which(H.RUNTIME_BIN[rt.kind]) || H.RUNTIME_BIN[rt.kind];
         const session = state.native[rt.kind] || (state.native[rt.kind] = {});
@@ -305,7 +336,7 @@ function startRepl(opts) {
           model: rt.model || null, // /model (claude --model, codex -m, gemini -m)
           effort: state.effort || null, // /effort (codex reasoning effort, claude think-keyword)
           mcpServers:
-            (state.permission === "write" || state.permission === "full") && H.mcpServers
+            state.permission === "full" && H.mcpServers
               ? H.mcpServers(db).filter((s) => s.enabled && s.transport === "stdio")
               : [],
           env: runEnv,
@@ -341,7 +372,7 @@ function startRepl(opts) {
           apiKey,
           system: sys,
           messages,
-          ctx,
+          ctx: { ...ctx, env: runEnv },
           ui: guard,
           signal,
         });
@@ -551,8 +582,8 @@ function startRepl(opts) {
 
   function printSlashSkills() {
     ui.line("");
-    ui.rule("Skills");
-    for (const entry of input.slashCommandEntries()) {
+    ui.rule(ui.t("skills.title"));
+    for (const entry of input.slashCommandEntries(ui.lang)) {
       const tag = entry.category ? ui.c.faint(entry.category.padEnd(10)) : "";
       ui.line("  " + ui.c.emerald(entry.command.padEnd(18)) + tag + ui.c.dim(entry.description));
       if (!entry.aliasOf && entry.usage) ui.line("  " + ui.c.faint(" ".repeat(18) + entry.usage));
@@ -561,14 +592,10 @@ function startRepl(opts) {
 
   function printPermissions() {
     ui.line("");
-    ui.rule("Permissions");
-    ui.line("  " + ui.c.faint("Current") + "  " + ui.c.emerald(state.permission));
-    const rows = [
-      ["read", "inspect files and answer; no file writes or shell automation"],
-      ["write", "read plus create/edit files in the current work area"],
-      ["full", "write plus shell commands and external local automation"],
-    ];
-    for (const [level, description] of rows) {
+    ui.rule(ui.t("permissions.title"));
+    ui.line("  " + ui.c.faint(ui.t("permissions.current")) + "  " + ui.c.emerald(state.permission));
+    for (const level of permissions.LEVELS) {
+      const description = permissions.copy(level, ui.lang).description;
       const mark = level === state.permission ? "› " : "  ";
       ui.line("  " + ui.c.emerald((mark + level).padEnd(10)) + ui.c.dim(description));
     }
@@ -633,7 +660,8 @@ function startRepl(opts) {
     ui.tool("$ " + cmd);
     const r = spawnSync("bash", ["-lc", cmd], { cwd: state.cwd, encoding: "utf8", timeout: 120000, maxBuffer: 8 * 1024 * 1024 });
     const out = ((r.stdout || "") + (r.stderr || "")).trim();
-    ui.toolResult(out || ("exit " + (r.status == null ? "?" : r.status)), r.status === 0 || r.status == null);
+    // `!command` is explicit user output, unlike autonomous runtime traces: keep it inspectable.
+    ui.toolResult(out || ("exit " + (r.status == null ? "?" : r.status)), r.status === 0 || r.status == null, { verbose: true });
   }
 
   // @path — inline the contents of mentioned files into the prompt as fenced context.
@@ -801,16 +829,14 @@ function startRepl(opts) {
           return true;
         }
         if (!["read", "write", "full"].includes(p)) return ui.warn(ui.t("permUsage")), true;
-        state.permission = p;
-        ui.ok(ui.t("permSet", p));
+        setPermission(p);
         return true;
       }
       case "permissions":
         if (arg) {
           const p = (arg || "").toLowerCase();
           if (!["read", "write", "full"].includes(p)) return ui.warn(ui.t("permUsage")), true;
-          state.permission = p;
-          ui.ok(ui.t("permSet", p));
+          setPermission(p);
         } else {
           printPermissions();
         }
@@ -913,10 +939,7 @@ function startRepl(opts) {
         const servers = H.mcpServers ? H.mcpServers(db) : [];
         ui.line("");
         ui.rule("MCP");
-        if (!servers.length) {
-          ui.info(ui.t("mcp.none"));
-          return true;
-        }
+        ui.line("   " + ui.c.emerald(ui.t("mcp.playwright").padEnd(22)) + ui.c.blue("stdio  ") + ui.c.green("on ") + ui.c.dim("  " + ui.t("mcp.fullOnly")));
         for (const s of servers) {
           let envKeys = [];
           try { envKeys = JSON.parse(s.env_keys_json || "[]"); } catch { /* ignore */ }
@@ -925,7 +948,7 @@ function startRepl(opts) {
           const envStr = envKeys.length ? envKeys.join(", ") : "no key";
           ui.line("   " + ui.c.emerald(String(name).padEnd(22)) + ui.c.blue(String(s.transport || "").padEnd(7)) + on + ui.c.dim("  " + envStr));
         }
-        const wired = servers.filter((s) => s.enabled && s.transport === "stdio").length + 1; // +1 = playwright(항상)
+        const wired = servers.filter((s) => s.enabled && s.transport === "stdio").length + 1; // +1 = full-only Playwright
         ui.line("   " + ui.c.faint(ui.t("mcp.wired", String(wired))));
         ui.line("   " + ui.c.faint(ui.t("mcp.usage")));
         return true;
@@ -1129,21 +1152,50 @@ function startRepl(opts) {
   }
 
   // ── composer (raw-mode bottom box) main loop ──
-  function composerStatus() {
+  function composerMeta() {
     const rt = runtimeLabel(state.runtime);
     const subj = state.subject ? state.subject.label : ui.t("composer.autoroute");
     const eff = state.effort ? " · " + state.effort : "";
-    return `${rt} · ${state.permission}${eff} · ${subj} · ${ui.t("composer.hint")}`;
+    const permissionLabel = permissions.copy(state.permission, ui.lang).label;
+    return {
+      lang: ui.lang,
+      permission: state.permission,
+      permissionLabel,
+      status: `${rt}${eff} · ${subj} · ${ui.t("permCycleHint")} · ${ui.t("composer.hint")} · ↑↓ history`,
+      onCyclePermission: () => {
+        const cycle = permissionCycle.step(state.permission);
+        if (cycle.armed) {
+          return {
+            ...composerMeta(),
+            confirmation: ui.t("permFullArm"),
+            confirmationTone: "danger",
+          };
+        }
+        const level = setPermission(cycle.level, { notify: false, persist: false });
+        return {
+          ...composerMeta(),
+          confirmation: cycle.enteredFull
+            ? ui.t("permFullConfirm")
+            : ui.t("permCycleConfirm", permissions.copy(level, ui.lang).label),
+          confirmationTone: cycle.enteredFull ? "danger" : "normal",
+        };
+      },
+      onPermissionCycleCancel: () => {
+        permissionCycle.cancel();
+        return { ...composerMeta(), confirmation: null, confirmationTone: null };
+      },
+    };
   }
   async function composerLoop() {
     let buffer = "";
     while (!closed) {
       let r;
       try {
+        const meta = composerMeta();
         r = await composer.read({
           glyph: buffer ? "…" : "›",
-          status: composerStatus(),
-          suggest: (l) => input.slashCommandSuggestions(l),
+          ...meta,
+          suggest: (l) => input.slashCommandSuggestions(l, 12, ui.lang),
           complete: completer,
         });
       } catch (e) {
@@ -1236,10 +1288,10 @@ function startRepl(opts) {
 function printHelp(ui) {
   const c = ui.c;
   ui.line("");
-  ui.rule("Help");
-  ui.line("  " + c.bold(c.text("Agentlas runs local agents from this terminal, with runtime, permission, files, shell, and history controls.")));
+  ui.rule(ui.t("help.title"));
+  ui.line("  " + c.bold(c.text(ui.t("help.intro"))));
   ui.line("");
-  ui.line("  " + c.faint("Commands"));
+  ui.line("  " + c.faint(ui.t("help.commands")));
   const rows = [
     [ui.t("help.talkKey"), ui.t("help.talk")],
     ["/skills", ui.t("help.skills")],
@@ -1297,10 +1349,12 @@ function printKeybindings(ui) {
     ["!cmd", ui.t("help.bang")],
     ["\\ + Enter", ui.t("help.multiline")],
     ["Tab", ui.t("help.tab")],
+    ["Shift-Tab", ui.t("help.shiftTab")],
+    ["Ctrl-T", ui.t("help.ctrlT")],
     ["Up / Down", ui.t("help.arrows")],
     ["Ctrl-C", ui.t("help.ctrlc")],
   ];
   for (const [k, v] of tips) ui.line("  " + c.emerald(k.padEnd(24)) + c.dim(v));
 }
 
-module.exports = { startRepl, runtimeLabel };
+module.exports = { startRepl, runtimeLabel, makeMemoryGuard, makeStyleGuard };

package/engine/agentlas-tasks.cjs

@@ -0,0 +1,111 @@
+"use strict";
+
+/* Normalize only task/todo events emitted by the native runtimes.
+ * Ordinary tool activity is intentionally excluded: a command is not a fabricated plan item.
+ */
+
+function statusOf(value, completed) {
+  if (completed === true) return "completed";
+  const status = String(value || "pending").trim().toLowerCase().replace(/[ -]+/g, "_");
+  if (["completed", "complete", "done", "success", "succeeded"].includes(status)) return "completed";
+  if (["in_progress", "active", "running", "started"].includes(status)) return "in_progress";
+  if (["failed", "error", "blocked", "cancelled", "canceled"].includes(status)) return "failed";
+  return "pending";
+}
+
+function listFrom(payload) {
+  if (Array.isArray(payload)) return payload;
+  if (!payload || typeof payload !== "object") return [];
+  for (const key of ["todos", "items", "tasks"]) {
+    if (Array.isArray(payload[key])) return payload[key];
+  }
+  return [];
+}
+
+function hasExplicitList(payload) {
+  if (Array.isArray(payload)) return true;
+  if (!payload || typeof payload !== "object") return false;
+  return ["todos", "items", "tasks"].some((key) => Array.isArray(payload[key]));
+}
+
+function sanitizeLabel(value, max = 500) {
+  let text = String(value || "");
+  // Runtime task text is untrusted terminal content. Strip OSC/CSI/escape controls,
+  // flatten line breaks, then cap it before it reaches footer row accounting.
+  text = text
+    .replace(/\x1b\][^\x07]*(?:\x07|\x1b\\)/g, "")
+    .replace(/\x1b\[[0-?]*[ -/]*[@-~]/g, "")
+    .replace(/\x1b./g, "")
+    .replace(/[\r\n\t]+/g, " ")
+    .replace(/[\x00-\x1f\x7f-\x9f]/g, "")
+    .replace(/\s+/g, " ")
+    .trim();
+  return Array.from(text).slice(0, max).join("");
+}
+
+function normalizeTaskList(payload, source = "runtime") {
+  return listFrom(payload).flatMap((raw, index) => {
+    if (!raw || typeof raw !== "object") return [];
+    const label = sanitizeLabel(raw.content || raw.subject || raw.description || raw.text || raw.title || raw.activeForm);
+    if (!label) return [];
+    return [{
+      id: String(raw.id || raw.taskId || `${source}:${index}`),
+      label,
+      status: statusOf(raw.status, raw.completed),
+      source,
+    }];
+  });
+}
+
+function applyTaskTool(current, name, payload, toolId) {
+  const tool = String(name || "").toLowerCase();
+  if (tool === "todowrite" || tool === "write_todos") {
+    return normalizeTaskList(payload, tool);
+  }
+
+  if (tool !== "taskcreate" && tool !== "taskupdate") return current;
+
+  const next = Array.isArray(current) ? current.map((task) => ({ ...task })) : [];
+  if (tool === "taskcreate") {
+    const label = sanitizeLabel(payload?.subject || payload?.description || payload?.activeForm);
+    if (!label) return next;
+    next.push({ id: String(payload?.taskId || toolId || `taskcreate:${next.length}`), label, status: "pending", source: "taskcreate" });
+    return next;
+  }
+  if (tool === "taskupdate") {
+    const id = String(payload?.taskId || toolId || "");
+    if (!id) return next;
+    if (String(payload?.status || "").toLowerCase() === "deleted") return next.filter((task) => task.id !== id);
+    const index = next.findIndex((task) => task.id === id);
+    const label = sanitizeLabel(payload?.subject || payload?.description || payload?.activeForm || (index >= 0 && next[index].label) || id);
+    const task = { id, label, status: statusOf(payload?.status), source: "taskupdate" };
+    if (index >= 0) next[index] = { ...next[index], ...task };
+    else next.push(task);
+  }
+  return next;
+}
+
+function applyTaskResult(current, name, payload, toolId) {
+  const tool = String(name || "").toLowerCase();
+  if (!["taskcreate", "taskupdate", "tasklist"].includes(tool)) return current;
+  if (!payload || typeof payload !== "object") return current;
+  if (tool === "tasklist") {
+    return hasExplicitList(payload) ? normalizeTaskList(payload, "tasklist") : current;
+  }
+  const record = payload.task && typeof payload.task === "object" ? payload.task : payload;
+  const id = String(record.id || record.taskId || payload.taskId || "");
+  if (!id) return current;
+  const next = Array.isArray(current) ? current.map((task) => ({ ...task })) : [];
+  const provisional = next.findIndex((task) => task.id === String(toolId || ""));
+  const existing = next.findIndex((task) => task.id === id);
+  const index = existing >= 0 ? existing : provisional;
+  const prior = index >= 0 ? next[index] : null;
+  const label = sanitizeLabel(record.content || record.subject || record.description || record.text || record.title || prior?.label || id);
+  const task = { id, label, status: statusOf(record.status || prior?.status), source: tool || "task-result" };
+  if (index >= 0) next[index] = { ...prior, ...task };
+  else next.push(task);
+  if (existing >= 0 && provisional >= 0 && provisional !== existing) next.splice(provisional, 1);
+  return next;
+}
+
+module.exports = { statusOf, sanitizeLabel, normalizeTaskList, applyTaskTool, applyTaskResult };

package/engine/agentlas-tools.cjs

@@ -13,9 +13,171 @@ const { spawnSync } = require("node:child_process");
 
 const PERM_RANK = { read: 0, write: 1, full: 2 };
 
-function resolveIn(cwd, p) {
-  if (!p) return cwd;
-  return path.isAbsolute(p) ? p : path.resolve(cwd, p);
+function pathDenied(reason) {
+  throw new Error(`workspace path denied: ${reason}`);
+}
+
+function contained(root, target) {
+  const relative = path.relative(root, target);
+  return relative === "" || (relative !== ".." && !relative.startsWith(`..${path.sep}`) && !path.isAbsolute(relative));
+}
+
+function getWorkspaceRoot(cwd) {
+  if (typeof cwd !== "string" || cwd.length === 0 || cwd.includes("\0")) {
+    pathDenied("working folder is invalid");
+  }
+  const root = fs.realpathSync(path.resolve(cwd));
+  if (!fs.statSync(root).isDirectory()) pathDenied("working folder is not a directory");
+  return root;
+}
+
+function validateRelativePath(input) {
+  if (typeof input !== "string" || input.length === 0 || input.includes("\0")) {
+    pathDenied("path must be a non-empty string");
+  }
+  // Check both dialects. A Windows absolute/UNC path must remain invalid even
+  // when a request is prepared or tested on a POSIX host (and vice versa).
+  if (
+    path.isAbsolute(input) ||
+    path.posix.isAbsolute(input) ||
+    path.win32.isAbsolute(input) ||
+    /^[A-Za-z]:/.test(input)
+  ) {
+    pathDenied("absolute paths are not allowed");
+  }
+  // Reject traversal before path.resolve() normalizes it away. This deliberately
+  // denies `safe/../file`, not only traversal that currently lands outside.
+  if (input.split(/[\\/]+/u).some((segment) => segment === "..")) {
+    pathDenied("parent traversal is not allowed");
+  }
+  return input;
+}
+
+function lexicalPath(root, input) {
+  const candidate = path.resolve(root, validateRelativePath(input));
+  if (!contained(root, candidate)) pathDenied("path leaves the working folder");
+  return candidate;
+}
+
+function resolveExistingIn(cwd, input) {
+  const root = getWorkspaceRoot(cwd);
+  const candidate = lexicalPath(root, input);
+  const real = fs.realpathSync(candidate);
+  if (!contained(root, real)) pathDenied("symbolic link leaves the working folder");
+  return real;
+}
+
+function resolveWritableIn(cwd, input) {
+  const root = getWorkspaceRoot(cwd);
+  const candidate = lexicalPath(root, input);
+  const missing = [];
+  let cursor = candidate;
+
+  // lstat (rather than existsSync) notices broken symlinks and makes them fail
+  // closed. Resolve the nearest existing ancestor before mkdir can have any
+  // side effect outside the workspace.
+  while (true) {
+    try {
+      fs.lstatSync(cursor);
+      break;
+    } catch (error) {
+      if (!error || error.code !== "ENOENT") throw error;
+      const parent = path.dirname(cursor);
+      if (parent === cursor) pathDenied("no existing workspace ancestor");
+      missing.unshift(path.basename(cursor));
+      cursor = parent;
+    }
+  }
+
+  let realAncestor;
+  try {
+    realAncestor = fs.realpathSync(cursor);
+  } catch (error) {
+    if (fs.lstatSync(cursor).isSymbolicLink()) pathDenied("symbolic link target is unavailable");
+    throw error;
+  }
+  if (!contained(root, realAncestor)) pathDenied("symbolic link leaves the working folder");
+  const ancestorStat = fs.statSync(realAncestor);
+  if (missing.length === 0 && !ancestorStat.isFile()) pathDenied("only regular files may be written");
+  if (missing.length > 0 && !ancestorStat.isDirectory()) pathDenied("write parent is not a directory");
+  const destination = path.join(realAncestor, ...missing);
+  if (!contained(root, destination)) pathDenied("path leaves the working folder");
+  return destination;
+}
+
+function safeOpenFlags() {
+  if (process.platform === "win32") return 0;
+  const noFollow = typeof fs.constants.O_NOFOLLOW === "number" ? fs.constants.O_NOFOLLOW : 0;
+  // Avoid blocking forever if a special file is swapped into place between
+  // canonicalization and open; fstat below will then reject it.
+  const nonBlock = typeof fs.constants.O_NONBLOCK === "number" ? fs.constants.O_NONBLOCK : 0;
+  return noFollow | nonBlock;
+}
+
+function openRegularFile(file, flags, mode) {
+  const fd = fs.openSync(file, flags | safeOpenFlags(), mode);
+  try {
+    if (!fs.fstatSync(fd).isFile()) pathDenied("only regular files are allowed");
+    return fd;
+  } catch (error) {
+    fs.closeSync(fd);
+    throw error;
+  }
+}
+
+function readUtf8File(file) {
+  if (!fs.statSync(file).isFile()) pathDenied("only regular files may be read");
+  const fd = openRegularFile(file, fs.constants.O_RDONLY);
+  try {
+    return fs.readFileSync(fd, "utf8");
+  } finally {
+    fs.closeSync(fd);
+  }
+}
+
+function writeUtf8File(file, content) {
+  // Replace through a fresh inode instead of truncating an existing one. If the
+  // workspace entry is a hard link to a file elsewhere, this updates only the
+  // workspace path and cannot mutate the other link's inode.
+  const temp = path.join(path.dirname(file), `.${path.basename(file)}.agentlas-${process.pid}-${crypto.randomUUID()}.tmp`);
+  let targetMode = 0o600;
+  let targetOwner = null;
+  try {
+    const existing = fs.statSync(file);
+    if (existing.isFile()) {
+      targetMode = existing.mode & 0o777;
+      targetOwner = { uid: existing.uid, gid: existing.gid };
+    }
+  } catch (error) {
+    if (!error || error.code !== "ENOENT") throw error;
+  }
+  let fd;
+  try {
+    fd = openRegularFile(
+      temp,
+      fs.constants.O_WRONLY | fs.constants.O_CREAT | fs.constants.O_EXCL,
+      0o600,
+    );
+    fs.writeFileSync(fd, content, "utf8");
+    if (targetOwner) {
+      try { fs.fchownSync(fd, targetOwner.uid, targetOwner.gid); } catch { /* best-effort ownership preservation */ }
+    }
+    try { fs.fchmodSync(fd, targetMode); } catch { /* Windows/best-effort */ }
+    try { fs.fsyncSync(fd); } catch { /* best-effort durability */ }
+    fs.closeSync(fd);
+    fd = null;
+    try {
+      fs.renameSync(temp, file);
+    } catch (error) {
+      // Windows does not replace an existing destination with renameSync.
+      if (!error || !["EEXIST", "EPERM"].includes(error.code)) throw error;
+      fs.rmSync(file, { force: true });
+      fs.renameSync(temp, file);
+    }
+  } finally {
+    if (fd != null) fs.closeSync(fd);
+    try { fs.rmSync(temp, { force: true }); } catch { /* best-effort cleanup */ }
+  }
 }
 function truncate(s, n) {
   s = String(s);
@@ -32,7 +194,7 @@ const TOOLS = [
       properties: { path: { type: "string", description: "Directory path (default: working folder)" } },
     },
     run(args, ctx) {
-      const dir = resolveIn(ctx.cwd, args.path || ".");
+      const dir = resolveExistingIn(ctx.cwd, args.path || ".");
       const entries = fs.readdirSync(dir, { withFileTypes: true });
       const lines = entries
         .slice(0, 400)
@@ -55,8 +217,8 @@ const TOOLS = [
       required: ["path"],
     },
     run(args, ctx) {
-      const file = resolveIn(ctx.cwd, args.path);
-      let content = fs.readFileSync(file, "utf8");
+      const file = resolveExistingIn(ctx.cwd, args.path);
+      let content = readUtf8File(file);
       if (args.offset || args.limit) {
         const lines = content.split("\n");
         const start = Math.max(0, (args.offset || 1) - 1);
@@ -76,10 +238,10 @@ const TOOLS = [
       required: ["path", "content"],
     },
     run(args, ctx) {
-      const file = resolveIn(ctx.cwd, args.path);
+      const file = resolveWritableIn(ctx.cwd, args.path);
       fs.mkdirSync(path.dirname(file), { recursive: true });
       const existed = fs.existsSync(file);
-      fs.writeFileSync(file, args.content, "utf8");
+      writeUtf8File(file, args.content);
       return `${existed ? "overwrote" : "created"} ${file} (${args.content.length} bytes)`;
     },
   },
@@ -100,15 +262,15 @@ const TOOLS = [
     },
     run(args, ctx) {
       if (args.old_string === "") throw new Error("old_string must be non-empty");
-      const file = resolveIn(ctx.cwd, args.path);
-      const src = fs.readFileSync(file, "utf8");
+      const file = resolveExistingIn(ctx.cwd, args.path);
+      const src = readUtf8File(file);
       if (!src.includes(args.old_string)) throw new Error("old_string not found");
       const count = src.split(args.old_string).length - 1;
       if (!args.replace_all && count > 1) throw new Error(`old_string occurs ${count}× (use replace_all or add context)`);
       const out = args.replace_all
         ? src.split(args.old_string).join(args.new_string)
         : src.replace(args.old_string, args.new_string);
-      fs.writeFileSync(file, out, "utf8");
+      writeUtf8File(file, out);
       return `edited ${file} (${count} replacement${count > 1 ? "s" : ""})`;
     },
   },
@@ -129,7 +291,7 @@ const TOOLS = [
         encoding: "utf8",
         timeout,
         maxBuffer: 8 * 1024 * 1024,
-        env: process.env,
+        env: ctx.env || process.env,
       });
       const parts = [];
       if (res.stdout) parts.push(res.stdout);