chainlesschain 0.162.175 → 0.162.177

package/src/harness/mcp-client.js

@@ -8,17 +8,19 @@
  * thin re-export shim for backwards compatibility.
  */
 
-import { spawn } from "child_process";
+import { executionBroker } from "../lib/process-execution-broker/index.js";
+import { AsyncLocalStorage } from "node:async_hooks";
 import { EventEmitter } from "events";
 import { pathToFileURL } from "url";
 import { safeJsonParse } from "../lib/safe-json.js";
+import { EventRuntimeProducer } from "../lib/event-runtime-producer.js";
 
 /**
  * Injectable dependencies — overridable from tests.
  * `fetch` defaults to the global fetch (Node 18+).
  */
 export const _deps = {
-  spawn,
+  spawn: executionBroker.spawn.bind(executionBroker),
   fetch: (...args) => globalThis.fetch(...args),
   // Backoff sleep seam (tests override with a no-op so retries don't wait).
   sleep: (ms) => new Promise((resolve) => setTimeout(resolve, ms)),
@@ -166,6 +168,178 @@ export class MCPClient extends EventEmitter {
       options && Array.isArray(options.roots) && options.roots.length > 0
         ? options.roots.map(String)
         : null;
+    // MCP elicitation (server -> client `elicitation/create`).  The handler is
+    // intentionally injected by the host (REPL, headless, or Desktop bridge)
+    // so the transport layer never reads stdin or invents an approval policy.
+    this._elicitationHandler =
+      typeof options.elicitationHandler === "function"
+        ? options.elicitationHandler
+        : null;
+    this._elicitationHandlers = new Map();
+    this._elicitationContext = new AsyncLocalStorage();
+    this._elicitationTimeoutMs =
+      Number(options.elicitationTimeoutMs) > 0
+        ? Number(options.elicitationTimeoutMs)
+        : 180000;
+    this._pendingElicitations = new Map();
+    this._runtimeProducer = options.eventRuntimeStore
+      ? new EventRuntimeProducer({ store: options.eventRuntimeStore, emitter: this })
+      : null;
+  }
+
+  /** Install or clear the host-side MCP elicitation resolver. */
+  setElicitationHandler(handler, options = {}) {
+    const sessionId = options.sessionId;
+    if (sessionId != null && sessionId !== "") {
+      const key = String(sessionId);
+      if (typeof handler === "function") this._elicitationHandlers.set(key, handler);
+      else this._elicitationHandlers.delete(key);
+    } else {
+      this._elicitationHandler =
+        typeof handler === "function" ? handler : null;
+    }
+    if (Number(options.timeoutMs) > 0) {
+      this._elicitationTimeoutMs = Number(options.timeoutMs);
+    }
+  }
+
+  /** Run an async agent turn with a session-scoped elicitation route. */
+  withElicitationContext(sessionId, fn) {
+    if (typeof fn !== "function") return Promise.resolve(undefined);
+    return this._elicitationContext.run(
+      sessionId == null ? null : String(sessionId),
+      fn,
+    );
+  }
+
+  /** Remove a session route when a WS session is closed. */
+  clearElicitationHandler(sessionId) {
+    if (sessionId == null || sessionId === "") return false;
+    return this._elicitationHandlers.delete(String(sessionId));
+  }
+
+  /** Resolve a pending server elicitation by its server/request id pair. */
+  respondElicitation(serverName, requestId, response) {
+    const key = this._elicitationKey(serverName, requestId);
+    const pending = this._pendingElicitations.get(key);
+    if (!pending) return false;
+    pending.resolve(this._normalizeElicitationResponse(response));
+    try {
+      this._runtimeProducer?.store.acknowledgeInbox(
+        `mcp-elicitation:${this._elicitationKey(serverName, requestId)}`,
+        { response: this._normalizeElicitationResponse(response) },
+      );
+    } catch {}
+    return true;
+  }
+
+  /** Cancel a pending server elicitation. */
+  cancelElicitation(serverName, requestId) {
+    return this.respondElicitation(serverName, requestId, {
+      action: "cancel",
+    });
+  }
+
+  _elicitationKey(serverName, requestId) {
+    return `${String(serverName)}:${String(requestId)}`;
+  }
+
+  _normalizeElicitationResponse(response) {
+    const action = String(response?.action || "decline").toLowerCase();
+    const safeAction = new Set(["accept", "decline", "cancel"]).has(action)
+      ? action
+      : "decline";
+    const normalized = { action: safeAction };
+    if (safeAction === "accept" && response?.content !== undefined) {
+      normalized.content = response.content;
+    }
+    return normalized;
+  }
+
+  async _resolveElicitation(serverName, requestId, params = {}) {
+    const key = this._elicitationKey(serverName, requestId);
+    try {
+      this._runtimeProducer?.publish(
+        { type: "mcp_elicitation", server: serverName, requestId, params },
+        { origin: "mcp", id: `mcp-elicitation:${key}` },
+      );
+    } catch (error) {
+      this.emit("elicitation-error", { server: serverName, requestId, error });
+      return { action: "cancel" };
+    }
+    const contextSessionId = this._elicitationContext.getStore();
+    const handler =
+      (contextSessionId && this._elicitationHandlers.get(contextSessionId)) ||
+      this._elicitationHandler;
+    if (handler) {
+      try {
+        const direct = await handler({
+          server: serverName,
+          requestId,
+          ...params,
+        });
+        if (direct !== undefined) {
+          const response = this._normalizeElicitationResponse(direct);
+          try {
+            this._runtimeProducer?.store.acknowledgeInbox(
+              `mcp-elicitation:${key}`,
+              { response },
+            );
+          } catch {}
+          return response;
+        }
+      } catch (error) {
+        this.emit("elicitation-error", {
+          server: serverName,
+          requestId,
+          error,
+        });
+        return { action: "cancel" };
+      }
+    }
+
+    // An event-driven host may answer later through respondElicitation().
+    // No handler/listener means fail closed with decline rather than leaving a
+    // server request hanging indefinitely.
+    if (this.listenerCount("elicitation-request") === 0) {
+      try {
+        this._runtimeProducer?.store.acknowledgeInbox(
+          `mcp-elicitation:${key}`,
+          { response: { action: "decline" } },
+        );
+      } catch {}
+      return { action: "decline" };
+    }
+    return new Promise((resolve) => {
+      const timeout = setTimeout(() => {
+        this._pendingElicitations.delete(key);
+        this.emit("elicitation-timeout", { server: serverName, requestId });
+        try {
+          this._runtimeProducer?.store.fail(
+            "inbox",
+            `mcp-elicitation:${key}`,
+            "elicitation timeout",
+            { retryDelayMs: 0, maxAttempts: 1 },
+          );
+        } catch {}
+        resolve({ action: "cancel" });
+      }, this._elicitationTimeoutMs);
+      timeout.unref?.();
+      this._pendingElicitations.set(key, {
+        resolve: (response) => {
+          clearTimeout(timeout);
+          this._pendingElicitations.delete(key);
+          resolve(this._normalizeElicitationResponse(response));
+        },
+      });
+      this.emit("elicitation-request", {
+        server: serverName,
+        requestId,
+        ...params,
+        respond: (response) => this.respondElicitation(serverName, requestId, response),
+        cancel: () => this.cancelElicitation(serverName, requestId),
+      });
+    });
   }
 
   /**
@@ -320,6 +494,13 @@ export class MCPClient extends EventEmitter {
             ...this._agentIdentityEnv(),
             ...(config.env || {}),
           },
+          origin: config.origin || `mcp:server:${name}`,
+          policy: config.policy || "allow",
+          scope: config.scope || "mcp",
+          shell: false,
+          pluginId: config.pluginId,
+          pluginVersion: config.pluginVersion,
+          pluginSource: config.pluginSource,
         });
 
         entry.process = proc;
@@ -510,6 +691,12 @@ export class MCPClient extends EventEmitter {
     const entry = this.servers.get(name);
     if (!entry) return false;
 
+    for (const [key, pending] of this._pendingElicitations) {
+      if (key.startsWith(`${String(name)}:`)) {
+        pending.resolve({ action: "cancel" });
+      }
+    }
+
     if (entry.process) {
       entry.process.kill();
     }
@@ -1125,6 +1312,12 @@ export class MCPClient extends EventEmitter {
       this._sendResponse(serverName, id, {});
       return;
     }
+    if (method === "elicitation/create") {
+      this._resolveElicitation(serverName, id, msg.params || {})
+        .then((response) => this._sendResponse(serverName, id, response))
+        .catch(() => this._sendResponse(serverName, id, { action: "cancel" }));
+      return;
+    }
     this._sendResponse(serverName, id, undefined, {
       code: -32601,
       message: `method not found: ${method}`,

package/src/harness/worktree-isolator.js

@@ -7,7 +7,6 @@
  * Feature-flag gated: WORKTREE_ISOLATION
  */
 
-import { execSync } from "node:child_process";
 import { existsSync, rmSync, symlinkSync, mkdirSync } from "node:fs";
 import { resolve, dirname } from "node:path";
 import {
@@ -93,10 +92,10 @@ export function removeWorktree(repoDir, worktreePath, options = {}) {
   let branch = null;
   if (deleteBranch) {
     try {
-      branch = execSync("git rev-parse --abbrev-ref HEAD", {
-        cwd: worktreePath,
-        encoding: "utf-8",
-      }).trim();
+      branch = gitExecArgs(
+        ["rev-parse", "--abbrev-ref", "HEAD"],
+        worktreePath,
+      ).trim();
     } catch (_e) {
       // Can't determine branch, skip branch deletion.
     }
@@ -215,11 +214,7 @@ function _worktreeCleanupState(repoDir, wt) {
 
   // Dirty state: separate tracked modifications from untracked files.
   try {
-    const porcelain = execSync("git status --porcelain", {
-      cwd: wt.path,
-      encoding: "utf-8",
-      maxBuffer: 64 * 1024 * 1024,
-    });
+    const porcelain = gitExecArgs(["status", "--porcelain"], wt.path);
     const lines = porcelain.split("\n").filter((l) => l.trim().length > 0);
     state.untracked = lines.some((l) => l.startsWith("??"));
     state.uncommitted = lines.some((l) => !l.startsWith("??"));
@@ -393,8 +388,16 @@ export function mergeWorktree(repoDir, branchName, options = {}) {
     };
   } catch (err) {
     const errMsg = err.message || String(err);
-    if (errMsg.includes("CONFLICT") || errMsg.includes("conflict")) {
-      const conflictPaths = _collectConflictFiles(repoDir);
+    // Git can report merge conflicts on stdout while execSync's Error.message
+    // contains only the failed command (and localized installations need not
+    // include the English word "conflict"). The unmerged index is the
+    // authoritative signal.
+    const conflictPaths = _collectConflictFiles(repoDir);
+    if (
+      conflictPaths.length > 0 ||
+      errMsg.includes("CONFLICT") ||
+      errMsg.includes("conflict")
+    ) {
       if (conflictPaths.length === 0) {
         conflictPaths.push(..._extractConflictPathsFromMessage(errMsg));
       }
@@ -690,15 +693,9 @@ function _fileStatus(repoDir, base, branch, filePath) {
 
 function _hasUncommittedChanges(worktreePath) {
   try {
-    const output = execSync("git status --porcelain", {
-      cwd: worktreePath,
-      encoding: "utf-8",
-      // A worktree with many dirty files produces >1 MB of porcelain output and
-      // would ENOBUFS on the default cap — the catch below then reports "clean"
-      // (fail-OPEN), which could let a caller discard a worktree full of
-      // uncommitted work. Give it the same 64 MB headroom as gitExec.
-      maxBuffer: 64 * 1024 * 1024,
-    });
+    // gitExecArgs carries the shared 64 MB maxBuffer, avoiding a fail-open
+    // "clean" result when a large worktree exceeds Node's default output cap.
+    const output = gitExecArgs(["status", "--porcelain"], worktreePath);
     return output.trim().length > 0;
   } catch (_e) {
     return false;

package/src/lib/__tests__/personal-data-hub-aichat-wizard.test.js

@@ -91,6 +91,21 @@ describe("createVendorAdapterBridge (cli)", () => {
     expect(r.userId).toBe("userToken");
   });
 
+  it("attaches a validated session to the registry runtime adapter", async () => {
+    const runtimeAdapter = { setSession: vi.fn() };
+    const bridge = createVendorAdapterBridge({
+      specs: [fakeSpec("deepseek", async () => ({ ok: true }))],
+      runtimeAdapter,
+      _httpClientFactory: () => ({}),
+    });
+
+    await bridge.registerVendor("deepseek", { userToken: "abc" });
+
+    expect(runtimeAdapter.setSession).toHaveBeenCalledOnce();
+    expect(runtimeAdapter.setSession.mock.calls[0][0]).toBe("deepseek");
+    expect(runtimeAdapter.setSession.mock.calls[0][1].get("userToken")).toBe("abc");
+  });
+
   it("UNKNOWN_VENDOR for unrecognized", async () => {
     const bridge = createVendorAdapterBridge({
       specs: [fakeSpec("deepseek", async () => ({ ok: true }))],

package/src/lib/agent-coordinator.js

@@ -281,6 +281,8 @@ export const ROLE_TOOL_WHITELIST = {
     "read_file",
     "write_file",
     "edit_file",
+    "delete_file",
+    "move_file",
     "run_shell",
     "search_files",
     "list_dir",
@@ -297,6 +299,8 @@ export const ROLE_TOOL_WHITELIST = {
     "read_file",
     "write_file",
     "edit_file",
+    "delete_file",
+    "move_file",
     "run_shell",
     "search_files",
     "list_dir",

package/src/lib/agent-core.js

@@ -13,6 +13,8 @@ export {
   getAgentToolDescriptors,
   getCachedPython,
   getEnvironmentInfo,
+  _environmentProcessDeps,
+  _agentToolProcessDeps,
   getBaseSystemPrompt,
   buildSystemPrompt,
   executeTool,
@@ -29,6 +31,9 @@ export {
   killBackgroundShellTask,
   killAllBackgroundShellTasks,
   killAllBackgroundShellTasksSync,
+  _backgroundProcessDeps,
+  _runBackgroundTaskkill,
+  _gitProcessDeps,
   reapIdleBackgroundShellTasks,
   _ingestSearchOutput,
   writeFileVerified,

package/src/lib/agent-ipc-bus.js

@@ -11,6 +11,13 @@
 
 import { EventEmitter } from "node:events";
 import crypto from "node:crypto";
+import { EventRuntimeProducer } from "./event-runtime-producer.js";
+import { EventRuntimeStore } from "./event-runtime-store.js";
+import executionBroker from "./process-execution-broker/index.js";
+
+export const _deps = {
+  spawn: executionBroker.spawn.bind(executionBroker),
+};
 
 /**
  * @typedef {Object} InteractionRequest
@@ -27,8 +34,11 @@ import crypto from "node:crypto";
  */
 
 class AgentIPCBus extends EventEmitter {
-  constructor() {
+  constructor({ runtimeStore = null } = {}) {
     super();
+    this._runtimeProducer = runtimeStore
+      ? new EventRuntimeProducer({ store: runtimeStore, emitter: this })
+      : null;
     /** @type {Map<string, {req: InteractionRequest, resolve: Function, reject: Function, timer?: NodeJS.Timeout}>} */
     this._pendingRequests = new Map();
     /** @type {Map<string, Function>} resolvers by agentId */
@@ -58,6 +68,10 @@ class AgentIPCBus extends EventEmitter {
     this.emit("agent:unregistered", { agentId });
   }
 
+  isAgentRegistered(agentId) {
+    return this._agentResolvers.has(agentId);
+  }
+
   /**
    * Child agent calls this to request human interaction
    * @param {string} agentId
@@ -91,6 +105,19 @@ class AgentIPCBus extends EventEmitter {
       }, fullReq.timeoutMs);
 
       this._pendingRequests.set(requestId, { req: fullReq, resolve, reject, timer });
+      try {
+        this._runtimeProducer?.publish(
+          { type: "interaction_request", request: fullReq },
+          { origin: "agent-ipc", id: `interaction:${requestId}` },
+        );
+      } catch (error) {
+        // Durable publication is fail-closed for configured runtime mode: do
+        // not leave a request that cannot be recovered after a crash.
+        this._pendingRequests.delete(requestId);
+        clearTimeout(timer);
+        reject(error);
+        return;
+      }
       this.emit("request", fullReq);
     });
   }
@@ -106,6 +133,10 @@ class AgentIPCBus extends EventEmitter {
     if (entry.timer) clearTimeout(entry.timer);
     this._pendingRequests.delete(requestId);
     entry.resolve(response);
+    try {
+      const id = `interaction:${requestId}`;
+      this._runtimeProducer?.store.acknowledgeInbox(id, { response });
+    } catch {}
     this.emit("request:resolved", { requestId, response });
     return true;
   }
@@ -144,12 +175,12 @@ class AgentIPCBus extends EventEmitter {
    * @returns {Promise<{process: ChildProcess, agentId: string}>}
    */
   async spawnAgentProcess(command, args = [], options = {}) {
-    const { spawn } = await import("node:child_process");
     const agentId = options.agentId || crypto.randomUUID();
     const heartbeatMs = options.heartbeatMs || 30000;
 
     return new Promise((resolve, reject) => {
-      const child = spawn(command, args, {
+      const spawnOptions = options.spawnOptions || {};
+      const child = _deps.spawn(command, args, {
         stdio: ["pipe", "pipe", "pipe"],
         env: {
           ...process.env,
@@ -158,7 +189,11 @@ class AgentIPCBus extends EventEmitter {
           CHAINLESSCHAIN_IPC_PROTOCOL: "jsonrpc-stdio-v1",
           ...options.env,
         },
-        ...options.spawnOptions,
+        ...spawnOptions,
+        origin: spawnOptions.origin || "agent-ipc:subagent",
+        policy: spawnOptions.policy || "allow",
+        scope: spawnOptions.scope || "agent-ipc",
+        shell: spawnOptions.shell === true,
       });
 
       let buffer = "";
@@ -326,6 +361,10 @@ class AgentIPCBus extends EventEmitter {
 }
 
 // Singleton
-const ipcBus = new AgentIPCBus();
+const ipcBus = new AgentIPCBus(
+  process.env.CC_EVENT_RUNTIME_DURABLE === "1"
+    ? { runtimeStore: new EventRuntimeStore() }
+    : {},
+);
 export default ipcBus;
 export { AgentIPCBus };

package/src/lib/agent-sandbox.js

@@ -1,10 +1,12 @@
 /** OS-isolated shell execution for the coding agent. */
-import { spawnSync } from "node:child_process";
 import path from "node:path";
 import { proxyEnv } from "./sandbox-egress-proxy.js";
+import executionBroker from "./process-execution-broker/index.js";
 
 export const DEFAULT_SANDBOX_IMAGE = "node:22-bookworm-slim";
-export const _deps = { spawnSync };
+export const _deps = {
+  spawnSync: (...args) => executionBroker.spawnSync(...args),
+};
 
 function stringList(value) {
   if (!Array.isArray(value)) return [];
@@ -126,6 +128,10 @@ export function executeSandboxedShell(command, sandbox, options = {}) {
   }
   args.push(sandbox.image, "sh", "-lc", String(command || ""));
   const result = _deps.spawnSync("docker", args, {
+    origin: "agent-sandbox:docker",
+    scope: "sandbox",
+    policy: "allow",
+    shell: false,
     encoding: "utf8",
     timeout: options.timeout,
     maxBuffer: options.maxBuffer,
@@ -189,6 +195,10 @@ function executeBubblewrapShell(command, sandbox, options, hostCwd, policy) {
       ? { ...(options.env || {}), ...proxyEnv(egress.port, "127.0.0.1") }
       : options.env;
   const result = _deps.spawnSync("bwrap", args, {
+    origin: "agent-sandbox:bubblewrap",
+    scope: "sandbox",
+    policy: "allow",
+    shell: false,
     cwd: hostCwd,
     env: bwrapEnv,
     encoding: "utf8",
@@ -244,6 +254,10 @@ export function probeSandboxAvailability(sandbox, deps = _deps) {
       ? ["bwrap", ["--version"]]
       : ["docker", ["version", "--format", "{{.Server.Version}}"]];
   const result = deps.spawnSync(probeArgs[0], probeArgs[1], {
+    origin: "agent-sandbox:probe",
+    scope: "sandbox",
+    policy: "allow",
+    shell: false,
     encoding: "utf8",
     timeout: 10000,
     windowsHide: true,

package/src/lib/agent-schedule-store.js

@@ -27,6 +27,7 @@ import { isEntryExpired, effectiveFireAt } from "./schedule-planner.js";
 import { SUBAGENT_PERMISSION_MODES } from "./subagent-contract.js";
 import { parseGoalCondition } from "./goal-condition-engine.js";
 import { normalizeActionClass } from "./unattended-action-policy.js";
+import { withFileLock } from "./with-file-lock.js";
 
 export const SCHEDULE_KINDS = Object.freeze(["wakeup", "cron", "monitor"]);
 
@@ -155,6 +156,10 @@ function isSchedulableStatus(entry) {
     : entry.status === "active";
 }
 
+function hasLiveExecutionLease(entry, now) {
+  return Number(entry.executionLease?.expiresAt) > Number(now);
+}
+
 /** Statuses an entry can never leave — safe to prune. */
 export const TERMINAL_STATUSES = Object.freeze([
   "fired",
@@ -487,6 +492,7 @@ export class AgentScheduleStore {
       // (defense-in-depth: retireExpired need not have run first).
       if (isEntryExpired(entry, now)) return false;
       if (!isSchedulableStatus(entry)) return false;
+      if (hasLiveExecutionLease(entry, now)) return false;
       // The effective fire time applies the entry's OWN deterministic jitter
       // (`entry.jitterMs`, default 0 → base fire time, byte-identical to the
       // prior `dueAt`/`nextAt` comparison). A jittered entry fires slightly
@@ -496,6 +502,52 @@ export class AgentScheduleStore {
     });
   }
 
+  /**
+   * Atomically claim due entries for one agenda runner. The lease is retained
+   * on the durable entry, so a second process cannot fire the same item while
+   * the first is working; an abandoned process becomes reclaimable after the
+   * lease expires. This is deliberately separate from `due()` for backwards
+   * compatibility with read-only callers and injected test stores.
+   */
+  claimDue(atMs = null, leaseMs = 120000) {
+    const now = atMs != null ? Number(atMs) : this._now();
+    const ttl = Math.max(1000, Number(leaseMs) || 120000);
+    this._ensureDir();
+    return withFileLock(path.join(this.dir, ".agenda-claims"), () => {
+      const claimed = [];
+      for (const kind of SCHEDULE_KINDS) {
+        const entries = this._readAll(kind);
+        let changed = false;
+        for (const entry of entries) {
+          if (!isSchedulableStatus(entry) || isEntryExpired(entry, now)) continue;
+          if (hasLiveExecutionLease(entry, now)) continue;
+          const fireAt = effectiveFireAt(entry);
+          if (fireAt == null || fireAt > now) continue;
+          entry.executionLease = {
+            owner: `${process.pid}:${randomUUID()}`,
+            claimedAt: now,
+            expiresAt: now + ttl,
+          };
+          claimed.push({ ...entry, executionLease: { ...entry.executionLease } });
+          changed = true;
+        }
+        if (changed) this._writeAll(kind, entries);
+      }
+      return claimed;
+    }, { failIfUnavailable: true });
+  }
+
+  /** Release a failed/aborted claim so a later runner can retry it. */
+  releaseClaim(id) {
+    for (const kind of SCHEDULE_KINDS) {
+      const updated = this._mutate(kind, id, (entry) => {
+        delete entry.executionLease;
+      });
+      if (updated) return updated;
+    }
+    return null;
+  }
+
   /**
    * Retire every schedulable entry whose `expiresAt` has passed (status →
    * "expired", stamping `expiredAt`), across all kinds, so it never fires again.
@@ -632,6 +684,9 @@ export class AgentScheduleStore {
     const entry = entries.find((e) => e.id === id);
     if (!entry) return null;
     fn(entry);
+    // Every lifecycle mutation settles the claim before the write becomes
+    // visible, including a recurring cron/monitor entry that remains active.
+    delete entry.executionLease;
     this._writeAll(kind, entries);
     return entry;
   }

package/src/lib/agent-team/team-worktree.js

@@ -23,7 +23,12 @@ import {
 } from "../../harness/worktree-isolator.js";
 import { isGitRepo as _isGitRepo } from "../../lib/git-integration.js";
 import { normalizeSparsePaths } from "../../lib/worktree-sparse.js";
-import { execFileSync, spawn } from "node:child_process";
+import executionBroker from "../../lib/process-execution-broker/index.js";
+
+export const _processDeps = {
+  spawn: executionBroker.spawn.bind(executionBroker),
+  execFileSync: executionBroker.execFileSync.bind(executionBroker),
+};
 
 /**
  * Resolve the sparse-checkout / dependency-symlink options for a task, letting a
@@ -49,7 +54,14 @@ function resolveWorktreeOptions(task, defaults) {
 
 function defaultRunShell(command, cwd) {
   return new Promise((resolve, reject) => {
-    const child = spawn(command, { cwd, shell: true, env: process.env });
+    const child = _processDeps.spawn(command, [], {
+      cwd,
+      shell: true,
+      env: process.env,
+      origin: "team-worktree:task-command",
+      policy: "allow",
+      scope: "team-worktree",
+    });
     let err = "";
     child.stderr?.on("data", (d) => (err += d.toString("utf8")));
     child.on("error", (e) => reject(new Error(e.message)));
@@ -61,12 +73,22 @@ function defaultRunShell(command, cwd) {
   });
 }
 
+function runTeamGit(args, cwd) {
+  return _processDeps.execFileSync("git", args, {
+    cwd,
+    stdio: "ignore",
+    origin: "team-worktree:commit",
+    policy: "allow",
+    scope: "team-worktree",
+    shell: false,
+  });
+}
+
 /** Stage + commit everything in a worktree. Returns true if a commit was made. */
 function defaultCommit(worktreePath, message) {
-  execFileSync("git", ["add", "-A"], { cwd: worktreePath, stdio: "ignore" });
+  runTeamGit(["add", "-A"], worktreePath);
   try {
-    execFileSync(
-      "git",
+    runTeamGit(
       [
         "-c",
         "user.email=team@chainlesschain.local",
@@ -76,7 +98,7 @@ function defaultCommit(worktreePath, message) {
         "-m",
         message,
       ],
-      { cwd: worktreePath, stdio: "ignore" },
+      worktreePath,
     );
     return true;
   } catch {