chainlesschain 0.162.124 → 0.162.126

package/src/runtime/agent-core.js

@@ -43,10 +43,11 @@ import {
 import { createToolContext } from "../tools/tool-context.js";
 import { createToolTelemetryRecord } from "../tools/tool-telemetry.js";
 import { isAbortError, throwIfAborted } from "../lib/abort-utils.js";
+import { buildSearchCommand } from "../lib/search-command.js";
 import {
   isRetryableStreamError,
-  STREAM_RETRY_MAX,
   STREAM_RETRY_BASE_MS,
+  resolveStreamRetryMax,
 } from "../lib/stream-retry.js";
 import {
   annotateLines,
@@ -755,6 +756,27 @@ export function tokenizeShellWords(input) {
   return args;
 }
 
+/**
+ * Literal string edit shared by the edit_file preview + execution paths.
+ * Uses split/join so `old_string` and `new_string` are treated as LITERAL text
+ * (no regex / `$&` / `$1` pattern interpretation — a plain `String.replace`
+ * with a string pattern still expands `$` sequences in the replacement).
+ * Returns the occurrence count so the caller can require a UNIQUE match
+ * (Claude-Code Edit parity): replacing the first of several identical strings
+ * silently edits the wrong place.
+ *
+ * @returns {{ count:number, newContent:string }}
+ */
+function applyLiteralEdit(content, oldStr, newStr, replaceAll) {
+  const parts = content.split(oldStr);
+  const count = parts.length - 1;
+  if (count === 0) return { count: 0, newContent: content };
+  const newContent = replaceAll
+    ? parts.join(newStr)
+    : parts[0] + newStr + parts.slice(1).join(oldStr); // first occurrence only
+  return { count, newContent };
+}
+
 /**
  * Compute the content an edit tool WOULD write, without writing it — the
  * left/right sides for an IDE diff review. Mirrors the corresponding
@@ -781,15 +803,22 @@ export function computeProposedEdit(name, args = {}, cwd = process.cwd()) {
       const content = fs.readFileSync(filePath, "utf8");
       if (
         typeof args.old_string !== "string" ||
-        !content.includes(args.old_string)
+        args.old_string === "" ||
+        typeof args.new_string !== "string"
       ) {
         return null;
       }
-      return {
-        filePath,
-        newContent: content.replace(args.old_string, () => args.new_string),
-        originalText: content,
-      };
+      const replaceAll = args.replace_all === true;
+      const { count, newContent } = applyLiteralEdit(
+        content,
+        args.old_string,
+        args.new_string,
+        replaceAll,
+      );
+      // No match, or a non-unique match without replace_all → the edit will be
+      // rejected, so show no (misleading) diff and let the tool report it.
+      if (count === 0 || (count > 1 && !replaceAll)) return null;
+      return { filePath, newContent, originalText: content };
     }
     if (name === "edit_file_hashed") {
       if (!fs.existsSync(filePath)) return null;
@@ -965,7 +994,7 @@ export async function executeTool(name, args, context = {}) {
   // 1. settings deny
   if (settingsVerdict.decision === "deny") {
     return {
-      error: `[Permission] Tool "${name}" denied by settings rule: ${settingsVerdict.rule}`,
+      error: `[Permission] Tool "${name}" denied by settings rule: ${settingsVerdict.rule}. This is a configured policy — retrying won't help; tell the user if the task genuinely needs it.`,
       policy: { decision: "deny", rule: settingsVerdict.rule, via: "settings" },
     };
   }
@@ -1037,7 +1066,7 @@ export async function executeTool(name, args, context = {}) {
         : false;
     if (!ok) {
       return {
-        error: `[Permission] Tool "${name}" requires confirmation (settings rule: ${settingsVerdict.rule}) — denied.`,
+        error: `[Permission] Tool "${name}" requires confirmation (settings rule: ${settingsVerdict.rule}) but this run is non-interactive — denied. Do not retry; tell the user this action needs their approval.`,
         policy: {
           decision: "ask",
           rule: settingsVerdict.rule,
@@ -1127,14 +1156,16 @@ export async function executeTool(name, args, context = {}) {
   // customizations), this safety surface stays on under --safe-mode by design.
   if (!ruleAllowed && (name === "read_file" || name === "run_shell")) {
     const {
-      credentialFileReason,
+      credentialFileReasonResolved,
       commandReadsCredentials,
       credentialGuardDisabled,
     } = await import("../lib/credential-guard.js");
     if (!credentialGuardDisabled(process.env)) {
       let credReason = null;
       if (name === "read_file" && args?.path) {
-        credReason = credentialFileReason(args.path);
+        // Resolve symlinks: an innocent-named link to a credential file must not
+        // skip the prompt (fs.readFileSync follows the link).
+        credReason = credentialFileReasonResolved(args.path, { cwd });
       } else if (name === "run_shell" && args?.command) {
         const hit = commandReadsCredentials(args.command);
         credReason = hit ? hit.reason : null;
@@ -1592,6 +1623,47 @@ export function renderNotebook(text) {
   return lines.join("\n");
 }
 
+/**
+ * Ingest the raw stdout of a search_files command into the shared hit
+ * accumulator: split into lines, dedup via `seen`, redact credential-file
+ * content hits, label multi-root results, and stop at the hit cap. Pure aside
+ * from mutating the passed-in `seen`/`hits`/`redactedCreds` collectors.
+ *
+ * Shared by the success path AND the maxBuffer-overflow salvage path: a search
+ * on a large tree (especially Windows, where `findstr`/`dir /s` have no `head`
+ * cap) can exceed execSync's maxBuffer and throw ENOBUFS — but the error still
+ * carries the first maxBuffer of matches in `err.stdout`, so the same ingest is
+ * run on it instead of dropping every match as a false "no matches".
+ *
+ * @param {string} output  raw command stdout (or a truncated partial)
+ * @param {object} ctx  { isContent, root, multiRoot, seen, hits, redactedCreds,
+ *                        credentialFileReason, limit? }
+ */
+export function _ingestSearchOutput(output, ctx) {
+  const limit = ctx.limit ?? 20;
+  for (const line of String(output || "")
+    .trim()
+    .split("\n")) {
+    const v = line.trim();
+    if (!v || ctx.seen.has(v)) continue;
+    if (ctx.isContent) {
+      // content hit is `file:line:text` (findstr /n) or a bare filename
+      // (grep -l); pull the source file and redact credential matches.
+      const src = v.match(/^(.+?):\d+:/)?.[1] ?? v;
+      if (ctx.credentialFileReason(src)) {
+        ctx.redactedCreds.add(src.replace(/\\/g, "/"));
+        ctx.seen.add(v);
+        continue;
+      }
+    }
+    // Qualify with the root so multi-root results stay unambiguous.
+    const labeled = ctx.multiRoot ? `${ctx.root}: ${v}` : v;
+    ctx.seen.add(v);
+    ctx.hits.push(labeled);
+    if (ctx.hits.length >= limit) return;
+  }
+}
+
 /**
  * Inner tool execution — no hooks, no plan-mode checks.
  */
@@ -1610,6 +1682,7 @@ async function executeToolInner(
     mcpClient,
     llmOptions,
     shellPolicyOverrides,
+    classifyAllShell = false,
     approvalGate,
     shellConfirm,
     additionalDirectories,
@@ -1661,6 +1734,13 @@ async function executeToolInner(
       if (!fs.existsSync(filePath)) {
         return attachDescriptor({ error: `File not found: ${filePath}` });
       }
+      // A clear, self-correcting error beats the cryptic "EISDIR: illegal
+      // operation on a directory" that readFileSync throws on a directory.
+      if (fs.statSync(filePath).isDirectory()) {
+        return attachDescriptor({
+          error: `Path is a directory, not a file: ${filePath}. Use list_dir to see its contents.`,
+        });
+      }
       const content = fs.readFileSync(filePath, "utf8");
       // Jupyter notebooks: render a compact cell listing (index/id/type/source,
       // outputs summarized) so the model can find cells for notebook_edit
@@ -1761,20 +1841,40 @@ async function executeToolInner(
       if (!fs.existsSync(filePath)) {
         return attachDescriptor({ error: `File not found: ${filePath}` });
       }
-      const content = fs.readFileSync(filePath, "utf8");
-      if (!content.includes(args.old_string)) {
-        return attachDescriptor({ error: "old_string not found in file" });
+      if (typeof args.old_string !== "string" || args.old_string === "") {
+        return attachDescriptor({
+          error: "old_string must be a non-empty string",
+        });
+      }
+      if (typeof args.new_string !== "string") {
+        return attachDescriptor({ error: "new_string must be a string" });
       }
-      const newContent = content.replace(
+      const content = fs.readFileSync(filePath, "utf8");
+      const replaceAll = args.replace_all === true;
+      const { count, newContent } = applyLiteralEdit(
+        content,
         args.old_string,
-        () => args.new_string,
+        args.new_string,
+        replaceAll,
       );
+      if (count === 0) {
+        return attachDescriptor({ error: "old_string not found in file" });
+      }
+      // Require a UNIQUE match (Claude-Code Edit parity) — replacing the first
+      // of several identical strings silently edits the wrong occurrence.
+      if (count > 1 && !replaceAll) {
+        return attachDescriptor({
+          error: `old_string is not unique — it appears ${count} times. Add surrounding context so it matches exactly one occurrence, or pass replace_all:true to change all of them.`,
+          occurrences: count,
+        });
+      }
       const wrote = writeFileVerified(filePath, newContent);
       if (wrote.error) return attachDescriptor({ error: wrote.error });
       return attachDescriptor({
         success: true,
         path: filePath,
         size: wrote.size,
+        replaced: replaceAll ? count : 1,
       });
     }
 
@@ -1829,9 +1929,12 @@ async function executeToolInner(
     }
 
     case "run_shell": {
-      const shellPolicyOpts = shellPolicyOverrides
-        ? { overrideRuleIds: shellPolicyOverrides }
-        : {};
+      const shellPolicyOpts = {
+        ...(shellPolicyOverrides
+          ? { overrideRuleIds: shellPolicyOverrides }
+          : {}),
+        ...(classifyAllShell ? { classifyAllShell: true } : {}),
+      };
       const override = getRuntimeToolDescriptorByCommand(args.command);
       let shellPolicy;
       let approvalOutcome = null;
@@ -1855,12 +1958,18 @@ async function executeToolInner(
           policy: gated.policy,
         };
         if (!gated.allowed) {
+          // Make a policy denial ACTIONABLE for the model (Claude-Code 2.1.193
+          // "denial reasons to transcripts"): tell it this won't change on
+          // retry and to involve the user, so it stops re-issuing the same
+          // blocked command (which otherwise just burns turns + tokens).
+          const tierLabel =
+            typeof gated.policy === "string" ? `"${gated.policy}" ` : "";
           return attachDescriptor(
             {
               error:
                 gated.via === "shell-policy"
-                  ? `[Shell Policy] ${gated.reason}`
-                  : `[ApprovalGate] command denied (${gated.via})`,
+                  ? `[Shell Policy] ${gated.reason} This command is blocked by policy and will not run — do not retry it; find another approach.`
+                  : `[ApprovalGate] command denied by the ${tierLabel}approval policy (via ${gated.via}). Retrying the same command will not help — it needs user approval. Tell the user (they can run it themselves, approve it, or relax the policy) and continue with other work.`,
               shellCommandPolicy: shellPolicy,
               approval: approvalOutcome,
             },
@@ -1872,7 +1981,7 @@ async function executeToolInner(
         if (!shellPolicy.allowed) {
           return attachDescriptor(
             {
-              error: `[Shell Policy] ${shellPolicy.reason}`,
+              error: `[Shell Policy] ${shellPolicy.reason} This command is blocked by policy and will not run — do not retry it; find another approach.`,
               shellCommandPolicy: shellPolicy,
             },
             override || runtimeDescriptor,
@@ -2135,12 +2244,17 @@ async function executeToolInner(
           args: { language: args.language },
         });
         if (gate.decision !== APPROVAL_DECISION.ALLOW) {
+          // Actionable denial (matches run_shell, Claude-Code 2.1.193): tell the
+          // model retrying won't help and to involve the user.
+          const tierLabel =
+            typeof gate.policy === "string" ? `"${gate.policy}" ` : "";
           return attachDescriptor({
-            error: `[ApprovalGate] run_code denied (${gate.via})`,
+            error: `[ApprovalGate] run_code denied by the ${tierLabel}approval policy (via ${gate.via}). Retrying won't help — running arbitrary code needs user approval. Tell the user (they can approve it or relax the policy) and continue with other work.`,
             approval: {
               decision: gate.decision,
               via: gate.via,
               riskLevel: "high",
+              policy: gate.policy,
             },
           });
         }
@@ -2301,13 +2415,14 @@ async function executeToolInner(
         ? [path.resolve(cwd, args.directory)]
         : [cwd, ...extraRoots];
       const isContent = Boolean(args.content_search);
-      const cmd = isContent
-        ? process.platform === "win32"
-          ? `findstr /s /i /n "${args.pattern}" *`
-          : `grep -r -l -i "${args.pattern}" . --include="*" 2>/dev/null | head -20`
-        : process.platform === "win32"
-          ? `dir /s /b *${args.pattern}* 2>NUL`
-          : `find . -name "*${args.pattern}*" -type f 2>/dev/null | head -20`;
+      // Pattern is model/user-supplied and flows into a shell — build the
+      // command with it SAFELY quoted (see search-command.js). Raw interpolation
+      // here was a command-injection bypass of the run_shell guards.
+      const built = buildSearchCommand({ pattern: args.pattern, isContent });
+      if (built.error) {
+        return attachDescriptor({ error: built.error });
+      }
+      const cmd = built.cmd;
 
       // Credential guard (Claude-Code 2.1.189 parity): a CONTENT search must not
       // become a side channel that exfils secrets the read_file / run_shell
@@ -2324,34 +2439,34 @@ async function executeToolInner(
       const redactedCreds = new Set();
       for (const root of roots) {
         if (hits.length >= 20) break;
+        const ictx = {
+          isContent,
+          root,
+          multiRoot: roots.length > 1,
+          seen,
+          hits,
+          redactedCreds,
+          credentialFileReason,
+        };
         try {
           if (!fs.existsSync(root)) continue;
           const output = execSync(cmd, {
             cwd: root,
             encoding: "utf8",
             timeout: 10000,
+            // Windows `findstr`/`dir /s` have no `head` cap (unlike the POSIX
+            // `| head -20`), so a large tree can blow past execSync's 1 MB
+            // default and throw ENOBUFS. Give it real headroom AND salvage the
+            // partial below — otherwise a busy repo silently reports "no matches".
+            maxBuffer: 8 * 1024 * 1024,
           });
-          for (const line of output.trim().split("\n")) {
-            const v = line.trim();
-            if (!v || seen.has(v)) continue;
-            if (isContent) {
-              // content hit is `file:line:text` (findstr /n) or a bare filename
-              // (grep -l); pull the source file and redact credential matches.
-              const src = v.match(/^(.+?):\d+:/)?.[1] ?? v;
-              if (credentialFileReason(src)) {
-                redactedCreds.add(src.replace(/\\/g, "/"));
-                seen.add(v);
-                continue;
-              }
-            }
-            // Qualify with the root so multi-root results stay unambiguous.
-            const labeled = roots.length > 1 ? `${root}: ${v}` : v;
-            seen.add(v);
-            hits.push(labeled);
-            if (hits.length >= 20) break;
-          }
-        } catch {
-          // No matches in this root — continue to the next.
+          _ingestSearchOutput(output, ictx);
+        } catch (err) {
+          // A maxBuffer overflow still carries the first 8 MB of matches in
+          // err.stdout — ingest those rather than dropping every hit as a false
+          // "No matches found". A genuine no-match / command failure leaves
+          // err.stdout empty, so hits stay unchanged (same as before).
+          if (err && err.stdout) _ingestSearchOutput(err.stdout, ictx);
         }
       }
 
@@ -2374,6 +2489,12 @@ async function executeToolInner(
       if (!fs.existsSync(dirPath)) {
         return attachDescriptor({ error: `Directory not found: ${dirPath}` });
       }
+      // Clear error instead of the cryptic "ENOTDIR" readdirSync throws on a file.
+      if (!fs.statSync(dirPath).isDirectory()) {
+        return attachDescriptor({
+          error: `Path is a file, not a directory: ${dirPath}. Use read_file to read it.`,
+        });
+      }
       const entries = fs.readdirSync(dirPath, { withFileTypes: true });
       return attachDescriptor({
         entries: entries.map((e) => ({
@@ -3683,7 +3804,9 @@ const _STREAM_STALL = Symbol("stream-stall");
  * @param {object} opts  { signal?, retries?, baseDelayMs?, onRetry?, sleep? }
  */
 export async function _retryStreamingChat(streamFn, opts = {}) {
-  const retries = opts.retries ?? STREAM_RETRY_MAX;
+  // Default budget honors CC_MAX_RETRIES / CLAUDE_CODE_MAX_RETRIES (capped 15);
+  // an explicit opts.retries still wins (tests / callers that pin it).
+  const retries = opts.retries ?? resolveStreamRetryMax();
   const base = opts.baseDelayMs ?? STREAM_RETRY_BASE_MS;
   const signal = opts.signal;
   const sleep = opts.sleep || ((ms) => new Promise((r) => setTimeout(r, ms)));
@@ -4499,6 +4622,10 @@ export async function* agentLoop(messages, options) {
     parentMessages: messages, // pass parent messages for sub-agent auto-condensation
     interaction: options.interaction || null,
     shellPolicyOverrides: options.shellPolicyOverrides || null,
+    // autoMode.classifyAllShell (Claude-Code 2.1.193): when true, the built-in
+    // verification allowlist (npm test / rg / …) is classified through the
+    // ApprovalGate instead of fast-pathed, so no shell command auto-runs.
+    classifyAllShell: options.classifyAllShell || false,
     approvalGate: options.approvalGate || null,
     shellConfirm: options.shellConfirm || null,
     // Interactive sessions (the REPL) set this so run_code is gated through the

package/src/runtime/coding-agent-contract-shared.cjs

@@ -141,19 +141,26 @@ const CODING_AGENT_TOOL_CONTRACTS = Object.freeze([
     title: "Edit File",
     kind: "filesystem",
     tier: "mvp",
-    description: "Replace a specific string in a file with new content",
+    description:
+      "Replace a string in a file. old_string must match EXACTLY ONE place — include enough surrounding context to make it unique, or the edit is rejected. Pass replace_all:true to change every occurrence instead.",
     inputSchema: {
       type: "object",
       properties: {
         path: { type: "string", description: "File path" },
         old_string: {
           type: "string",
-          description: "Exact string to find and replace",
+          description:
+            "Exact string to replace; must be unique in the file unless replace_all is true",
         },
         new_string: {
           type: "string",
           description: "Replacement string",
         },
+        replace_all: {
+          type: "boolean",
+          description:
+            "Replace every occurrence of old_string instead of requiring a unique match (default false)",
+        },
       },
       required: ["path", "old_string", "new_string"],
     },

package/src/runtime/coding-agent-shell-policy.cjs

@@ -288,7 +288,7 @@ const DECISION_SEVERITY = Object.freeze({
 });
 
 /** Classify ONE command segment (no separators). */
-function evaluateSegmentPolicy(segment, overrideRuleIds) {
+function evaluateSegmentPolicy(segment, overrideRuleIds, classifyAllShell) {
   const normalized = normalizeShellCommand(segment);
   const tokens = tokenizeShellCommand(normalized);
   const firstToken = (tokens[0] || "").toLowerCase();
@@ -326,6 +326,20 @@ function evaluateSegmentPolicy(segment, overrideRuleIds) {
     rule.test(context),
   );
   if (allowlistedRule) {
+    // `classifyAllShell` (Claude-Code 2.1.193 `autoMode.classifyAllShell`):
+    // don't fast-path the built-in verification allowlist to ALLOW (risk LOW,
+    // auto-approved). Downgrade to WARN so EVERY shell command is classified
+    // and routed through the ApprovalGate confirm — the allowlist still
+    // documents intent, but the agent can't silently run even `npm test`.
+    if (classifyAllShell) {
+      return {
+        allowed: true,
+        decision: SHELL_POLICY_DECISIONS.WARN,
+        reason: `${allowlistedRule.reason} (classifyAllShell: confirm required)`,
+        ruleId: allowlistedRule.id,
+        normalizedCommand: normalized,
+      };
+    }
     return {
       allowed: true,
       decision: SHELL_POLICY_DECISIONS.ALLOW,
@@ -350,6 +364,9 @@ function evaluateShellCommandPolicy(command, options = {}) {
   const overrideRuleIds = Array.isArray(options.overrideRuleIds)
     ? new Set(options.overrideRuleIds)
     : new Set();
+  // When set, allowlisted commands are classified (WARN) instead of fast-pathed
+  // (ALLOW) — see evaluateSegmentPolicy.
+  const classifyAllShell = options.classifyAllShell === true;
 
   // Inspect EVERY segment of a compound command, not just the first — a
   // dangerous segment after `&&` / `;` / `|` must still be caught. The most
@@ -368,7 +385,11 @@ function evaluateShellCommandPolicy(command, options = {}) {
 
   let worst = null;
   for (const segment of segments) {
-    const result = evaluateSegmentPolicy(segment, overrideRuleIds);
+    const result = evaluateSegmentPolicy(
+      segment,
+      overrideRuleIds,
+      classifyAllShell,
+    );
     const sev = DECISION_SEVERITY[result.decision] ?? 1;
     const worstSev = worst ? (DECISION_SEVERITY[worst.decision] ?? 1) : -1;
     if (sev > worstSev) worst = result;

package/src/runtime/file-ref-expander.js

@@ -24,6 +24,10 @@
 
 import fsDefault from "fs";
 import pathDefault from "path";
+import {
+  credentialFileReasonResolved,
+  credentialGuardDisabled,
+} from "../lib/credential-guard.js";
 
 export const DEFAULT_MAX_BYTES = 100 * 1024; // 100 KB per referenced file
 export const DEFAULT_MAX_DIR_ENTRIES = 200;
@@ -181,6 +185,27 @@ function resolveRef(raw, { cwd, fs, path, maxBytes, maxDirEntries }) {
       };
     }
     if (stat.isFile()) {
+      // Refuse to inline a credential / secret file. `@file` expansion pulls
+      // file contents straight into the (possibly cloud) LLM prompt, so it is a
+      // second channel for file→LLM exfiltration that must honour the same guard
+      // as read_file / run_shell / the project-memory @import path. Checked on
+      // the RESOLVED path (the read follows symlinks, so a notes.txt → id_rsa
+      // link would otherwise leak the key) and BEFORE any read, so the secret
+      // bytes are never loaded. CC_CREDENTIAL_GUARD=0 opts out.
+      if (!credentialGuardDisabled()) {
+        const credReason = credentialFileReasonResolved(abs, {
+          cwd,
+          deps: { realpathSync: fs.realpathSync, resolve: path.resolve },
+        });
+        if (credReason) {
+          return {
+            kind: "blocked",
+            raw: cand,
+            rel: fsPath,
+            reason: credReason,
+          };
+        }
+      }
       // PDFs (pdf-parse needs the bytes) and line ranges (must reach the end
       // line) need the whole file; a plain inline only ever shows the first
       // maxBytes, so cap the read there instead of slurping the entire file.
@@ -222,7 +247,12 @@ function resolveRef(raw, { cwd, fs, path, maxBytes, maxDirEntries }) {
       }
       if (range) {
         // Slice the requested lines (clamped to the file), then byte-cap them.
-        const sl = sliceLines(buf.toString("utf-8"), range.start, range.end, maxBytes);
+        const sl = sliceLines(
+          buf.toString("utf-8"),
+          range.start,
+          range.end,
+          maxBytes,
+        );
         return {
           kind: "file",
           raw: cand,
@@ -296,7 +326,9 @@ function renderBlock(refs) {
     } else if (ref.kind === "pdf") {
       if (typeof ref.content === "string") {
         const pageAttr =
-          ref.pageStart != null ? ` pages="${ref.pageStart}-${ref.pageEnd}"` : "";
+          ref.pageStart != null
+            ? ` pages="${ref.pageStart}-${ref.pageEnd}"`
+            : "";
         const attrs =
           `path="${escapeAttr(ref.rel)}" bytes="${ref.bytes}" type="pdf"` +
           pageAttr +
@@ -306,7 +338,9 @@ function renderBlock(refs) {
         parts.push(`<file ${attrs}>`);
         parts.push(ref.content);
         if (ref.truncated) {
-          parts.push(`\n… [truncated — PDF text exceeds ${DEFAULT_MAX_BYTES} bytes]`);
+          parts.push(
+            `\n… [truncated — PDF text exceeds ${DEFAULT_MAX_BYTES} bytes]`,
+          );
         }
         parts.push("</file>");
       } else {
@@ -369,6 +403,13 @@ function _resolveAllRefs(text, opts) {
       warnings.push(`@${ref.raw} — ${ref.message} (left as-is)`);
       continue;
     }
+    if (ref.kind === "blocked") {
+      // Credential/secret file — never read or injected; only a visible warning.
+      warnings.push(
+        `@${ref.raw} — refused: ${ref.reason}; not injected into the prompt`,
+      );
+      continue;
+    }
     refs.push(ref);
   }
   return { refs, warnings, maxBytes };
@@ -440,7 +481,10 @@ export async function expandFileRefsAsync(prompt, opts = {}) {
  * when those are null), byte-capped at maxBytes. Throws code `PDF_LIB_MISSING`
  * when the optional dependency is not installed.
  */
-async function _extractPdfPages(buffer, { firstPage, lastPage, maxBytes } = {}) {
+async function _extractPdfPages(
+  buffer,
+  { firstPage, lastPage, maxBytes } = {},
+) {
   let pdfParse;
   try {
     // pdf-parse's index.js runs debug code under ESM (no module.parent), so
@@ -459,9 +503,9 @@ async function _extractPdfPages(buffer, { firstPage, lastPage, maxBytes } = {})
         if (firstPage && n < firstPage) return "";
         if (lastPage && n > lastPage) return "";
       }
-      return pageData.getTextContent().then((tc) =>
-        (tc.items || []).map((it) => it.str).join(" "),
-      );
+      return pageData
+        .getTextContent()
+        .then((tc) => (tc.items || []).map((it) => it.str).join(" "));
     },
   });
   let out = String(data?.text || "").trim();