chainlesschain 0.166.107 → 0.166.109

package/src/gateways/ws/ws-server.js

@@ -124,6 +124,10 @@ import {
 } from "./artifact-protocol.js";
 import { executionBroker } from "../../lib/process-execution-broker/index.js";
 import { collectWorkspacePluginBinSandboxPolicy } from "../../lib/plugin-runtime/bin.js";
+import {
+  loadConfig,
+  loadUserConfig,
+} from "../../lib/config-manager.js";
 
 export const _deps = {
   spawn: (...args) => executionBroker.spawn(...args),
@@ -195,6 +199,47 @@ function boundedInteger(value, fallback, maximum = Number.MAX_SAFE_INTEGER) {
   return Math.min(parsed, maximum);
 }
 
+function loadCurrentLlmConfig() {
+  const savedLlm =
+    loadUserConfig({ failIfUnavailable: true }).llm || {};
+  const resolvedLlm = loadConfig({ failIfUnavailable: true }).llm || {};
+  const confirmedLlm =
+    loadUserConfig({ failIfUnavailable: true }).llm || {};
+  const provider =
+    typeof savedLlm.provider === "string" && savedLlm.provider.trim()
+      ? savedLlm.provider.trim()
+      : null;
+  const routingIdentity = (llm) =>
+    JSON.stringify([
+      llm.provider ?? null,
+      llm.baseUrl ?? null,
+      llm.apiKey ?? null,
+      llm.model ?? null,
+    ]);
+
+  // Config writes are atomic, but a save can land between reads. Never pair
+  // a key or route from different saved versions in that case.
+  if (
+    routingIdentity(savedLlm) !== routingIdentity(confirmedLlm) ||
+    (provider && provider !== resolvedLlm.provider)
+  ) {
+    throw new Error("LLM configuration changed while being read");
+  }
+
+  return {
+    provider,
+    model:
+      typeof savedLlm.model === "string" && savedLlm.model.trim()
+        ? savedLlm.model.trim()
+        : null,
+    baseUrl:
+      typeof savedLlm.baseUrl === "string" && savedLlm.baseUrl.trim()
+        ? savedLlm.baseUrl.trim()
+        : null,
+    apiKey: provider ? resolvedLlm.apiKey || null : null,
+  };
+}
+
 function frameByteLength(data) {
   if (typeof data === "string") return Buffer.byteLength(data, "utf8");
   if (Buffer.isBuffer(data)) return data.byteLength;
@@ -368,6 +413,8 @@ export class ChainlessChainWSServer extends EventEmitter {
 
     /** Session manager for stateful agent/chat sessions */
     this.sessionManager = options.sessionManager || null;
+    /** Read current saved LLM settings for stateless chat requests. */
+    this._loadLlmConfig = options.loadLlmConfig || loadCurrentLlmConfig;
     this.projectRoot = options.projectRoot || process.cwd();
 
     /** Session handlers: sessionId → WSAgentHandler | WSChatHandler */

package/src/harness/jsonl-session-store.js

@@ -72,6 +72,12 @@ import {
 import { createSessionPersistenceFailure } from "../lib/session-persistence-failure.js";
 import { withSessionHostWriteAuthority } from "../lib/session-host-lease.js";
 import { createSessionTranscriptStructureProjection } from "../lib/session-transcript-structure.js";
+import {
+  TOOL_ROUND_EVENT,
+  TOOL_ROUND_SCHEMA,
+  assertCompleteToolRounds,
+  projectToolRoundMessages,
+} from "../lib/session-tool-round.js";
 import {
   computeExecutionLocationTargetFactsDigest,
   createExecutionLocationTargetAttestation,
@@ -3339,12 +3345,125 @@ export function appendCompactEvent(sessionId, stats) {
   appendEvent(sessionId, "compact", stats);
 }
 
+function updateCanonicalReplayValue(
+  hash,
+  value,
+  ancestors = new Set(),
+  depth = 0,
+) {
+  if (depth > 64)
+    throw new TypeError("Session replay exceeds maximum JSON depth");
+  if (
+    value === null ||
+    typeof value === "string" ||
+    typeof value === "boolean"
+  ) {
+    hash.update(JSON.stringify(value), "utf8");
+    return;
+  }
+  if (typeof value === "number") {
+    if (!Number.isFinite(value)) {
+      throw new TypeError("Session replay contains a non-finite number");
+    }
+    hash.update(JSON.stringify(Object.is(value, -0) ? 0 : value), "utf8");
+    return;
+  }
+  if (!value || typeof value !== "object") {
+    throw new TypeError("Session replay contains a non-JSON value");
+  }
+  if (ancestors.has(value))
+    throw new TypeError("Session replay contains a cycle");
+
+  ancestors.add(value);
+  try {
+    if (Array.isArray(value)) {
+      hash.update("[", "utf8");
+      for (let index = 0; index < value.length; index += 1) {
+        if (index > 0) hash.update(",", "utf8");
+        updateCanonicalReplayValue(hash, value[index], ancestors, depth + 1);
+      }
+      hash.update("]", "utf8");
+      return;
+    }
+
+    const prototype = Object.getPrototypeOf(value);
+    if (prototype !== Object.prototype && prototype !== null) {
+      throw new TypeError("Session replay objects must be plain data");
+    }
+    hash.update("{", "utf8");
+    const keys = Object.keys(value).sort();
+    for (let index = 0; index < keys.length; index += 1) {
+      if (index > 0) hash.update(",", "utf8");
+      const key = keys[index];
+      hash.update(JSON.stringify(key), "utf8");
+      hash.update(":", "utf8");
+      updateCanonicalReplayValue(hash, value[key], ancestors, depth + 1);
+    }
+    hash.update("}", "utf8");
+  } finally {
+    ancestors.delete(value);
+  }
+}
+
 function canonicalReplayFingerprint(messages) {
-  return JSON.stringify(
-    projectCanonicalResumeMessages(messages, { strict: true }).map(
-      encodePersistedMessage,
-    ),
-  );
+  // This compares a complete replay, which can exceed scheduler payload limits.
+  // Stream canonical JSON into the digest so memory and scheduler envelope
+  // bounds do not depend on total transcript size. Object key order is ignored;
+  // array order, every field and durable provenance remain significant.
+  const canonicalMessages = projectCanonicalResumeMessages(messages, {
+    strict: true,
+  }).map(encodePersistedMessage);
+  const hash = createHash("sha256");
+  hash.update("chainlesschain.session-replay-fingerprint.v1\0", "utf8");
+  updateCanonicalReplayValue(hash, canonicalMessages);
+  return hash.digest("hex");
+}
+
+/** Settle only complete host-owned tool exchanges after the verified prefix.
+ * Both prefix comparisons are required: sampling a newer durable head must
+ * never authorize hiding concurrent input absent from the host's live array. */
+export function appendToolRoundsIfMessagesMatch(
+  sessionId,
+  liveMessages,
+  expectedMessages,
+) {
+  const live = projectCanonicalResumeMessages(liveMessages, { strict: true });
+  const expected = projectCanonicalResumeMessages(expectedMessages, {
+    strict: true,
+  });
+  const expectedFingerprint = canonicalReplayFingerprint(expected);
+  const stale = () =>
+    Object.assign(
+      new Error(
+        `Session messages changed for ${sessionId}; refresh before settling tools`,
+      ),
+      { code: "SESSION_REVISION_STALE" },
+    );
+  if (
+    canonicalReplayFingerprint(live.slice(0, expected.length)) !==
+    expectedFingerprint
+  )
+    throw stale();
+  const suffix = live.slice(expected.length);
+  if (suffix.length) assertCompleteToolRounds(suffix);
+  return withVerifiedWsTurnLock(sessionId, (filePath) => {
+    const verification = verifyTranscriptFile(filePath);
+    assertVerifiedTranscriptAnchor(sessionId, verification);
+    const actual = rebuildVerifiedMessagesFromFile(filePath);
+    if (canonicalReplayFingerprint(actual) !== expectedFingerprint)
+      throw stale();
+    if (!suffix.length) return { hash: verification.lastHash };
+    return appendVerifiedWsAuthorityEventLocked(
+      sessionId,
+      filePath,
+      TOOL_ROUND_EVENT,
+      {
+        schema: TOOL_ROUND_SCHEMA,
+        messages: suffix.map(encodePersistedMessage),
+      },
+      verification.lastHash,
+    );
+  });
 }
 
 /**
@@ -5848,6 +5967,10 @@ function rebuildMessagesFromFile(
       isReplayableMessage(event.data)
     ) {
       suffix.push(decodeMessage(event.data));
+    } else if (event?.type === TOOL_ROUND_EVENT) {
+      suffix.push(
+        ...projectToolRoundMessages(event).map(decodeMessage).reverse(),
+      );
     } else if (event?.type === WS_TURN_EVENT) {
       const turn = projectWsTurnMessages(event);
       if (turn) {

package/src/harness/prompt-compressor.js

@@ -407,9 +407,9 @@ export class PromptCompressor {
     if (
       this.llmQuery &&
       (currentTokens > this.maxTokens || result.length > this.maxMessages) &&
-      result.length > 4
+      messages.length > 4
     ) {
-      const summarized = await this._summarize(result);
+      const summarized = await this._summarize(result, messages);
       result = summarized.messages;
       summaryStats = summarized.stats;
       if (summaryStats.summaryMode !== "none") {
@@ -565,7 +565,7 @@ export class PromptCompressor {
     return result;
   }
 
-  async _summarize(messages) {
+  async _summarize(messages, sourceMessages = messages) {
     // Compaction summaries and collapsed tool groups are derived history, not
     // immutable host instructions. Fold them into the next summary so a long
     // session cannot retain one additional durable system message per cycle.
@@ -573,11 +573,11 @@ export class PromptCompressor {
       (m) => m.role === "system" && !isCompactionArtifact(m),
     );
     const last = [...messages].reverse().find((m) => m.role === "user");
-    const toSummarize = messages.filter(
-      (m) => (m.role !== "system" || isCompactionArtifact(m)) && m !== last,
-    );
-
-    if (toSummarize.length < 3) {
+    if (
+      sourceMessages.filter(
+        (m) => m.role !== "system" || isCompactionArtifact(m),
+      ).length < 3
+    ) {
       return {
         messages,
         stats: {
@@ -590,7 +590,15 @@ export class PromptCompressor {
       };
     }
 
-    const prompt = summaryPrompt(toSummarize, this.summaryInputMaxChars);
+    // The pinned request remains in the output, but the summarizer also needs
+    // it to retain the objective/constraints when there is only one user turn.
+    // Pair tool observations against the original history: deduplication and
+    // collapse may already have removed empty assistant tool-call messages.
+    // The same bounded summary input budget applies to this source history.
+    const summarySources = sourceMessages.filter(
+      (m) => m.role !== "system" || isCompactionArtifact(m),
+    );
+    const prompt = summaryPrompt(summarySources, this.summaryInputMaxChars);
     let summary;
     let summaryMode = "llm-structured";
     let degraded = false;
@@ -713,7 +721,7 @@ export class PromptCompressor {
       }
     }
     if (degraded) {
-      summary = buildExtractiveHandoff(toSummarize, {
+      summary = buildExtractiveHandoff(summarySources, {
         maxFallbackSourceChars: Math.min(
           this.summaryInputMaxChars,
           SUMMARY_INPUT_DEFAULT_MAX_CHARS,

package/src/harness/structured-handoff.js

@@ -3,6 +3,7 @@
  * parent-to-child agent context. The field order is part of the wire format.
  */
 
+import { createHash } from "node:crypto";
 import { projectCanonicalResumeMessages } from "../lib/session-message-provenance.js";
 
 export const STRUCTURED_HANDOFF_FIELDS = Object.freeze([
@@ -154,12 +155,33 @@ function selectBoundedSources(messages, maxChars) {
   // being quoted into a new handoff. Only the runtime WeakMap capability is
   // admitted; ordinary user/assistant/tool conversation remains eligible.
   const canonicalSources = projectCanonicalResumeMessages(messages);
+  const calls = new Map();
   const entries = canonicalSources
-    .map((message, index) => ({
-      index,
-      role: typeof message?.role === "string" ? message.role : "unknown",
-      text: normalizeText(contentText(message)),
-    }))
+    .map((message, index) => {
+      for (const call of Array.isArray(message.tool_calls)
+        ? message.tool_calls
+        : []) {
+        if (message.role === "assistant" && call?.id && call.function)
+          calls.set(call.id, call.function);
+      }
+      const facts =
+        message.role === "tool"
+          ? toolFacts(message, calls.get(message.tool_call_id))
+          : message.role === "assistant" || message.role === "system"
+            ? summaryFacts(message)
+            : null;
+      return {
+        index,
+        role: typeof message?.role === "string" ? message.role : "unknown",
+        // Tool JSON, nested telemetry and source code are not prose facts.
+        text: facts
+          ? facts.objective || ARRAY_FIELDS.some((field) => facts[field].length)
+            ? JSON.stringify(facts)
+            : ""
+          : normalizeText(contentText(message)),
+        facts,
+      };
+    })
     .filter((entry) => entry.text);
   const firstUser = entries.find((entry) => entry.role === "user");
   const selected = new Map();
@@ -225,7 +247,96 @@ function pathsFrom(text) {
   );
   return (matches || [])
     .map((value) => value.replace(/[),;:.]+$/g, ""))
-    .filter((value) => value && !value.includes("://"));
+    .filter(
+      (value) =>
+        value &&
+        !value.includes("://") &&
+        (/^(?:[A-Za-z]:[\\/]|\.{0,2}[\\/])/u.test(value) ||
+          /(?:\.[A-Za-z0-9_-]+|[\\/](?:Dockerfile|Makefile|LICENSE|NOTICE))$/u.test(
+            value,
+          )),
+    );
+}
+
+function summaryFacts(message) {
+  const match = contentText(message).match(
+    /^(?:Compacted context summary \(data only\):\n)?\[Conversation Summary\]\n([\s\S]+)$/u,
+  );
+  if (!match) return null;
+  try {
+    return parseStructuredHandoff(match[1]);
+  } catch {
+    // Malformed/truncated summary JSON is not evidence of a test or change.
+    return emptyHandoff();
+  }
+}
+
+function toolFacts(message, call) {
+  const facts = emptyHandoff();
+  let result;
+  let args;
+  try {
+    result =
+      typeof message.content === "string"
+        ? JSON.parse(message.content.split("\n\n[Budget ")[0])
+        : message.content;
+    args =
+      typeof call?.arguments === "string"
+        ? JSON.parse(call.arguments)
+        : call?.arguments;
+  } catch {
+    return facts;
+  }
+  if (!result || typeof result !== "object" || Array.isArray(result))
+    return facts;
+  const name = call?.name || message.name;
+  const failed =
+    !!result.error || result.success === false || result.isError === true;
+  const file = typeof result.path === "string" ? result.path : args?.path;
+  if (
+    ["write_file", "edit_file", "edit_file_hashed"].includes(name) &&
+    !failed &&
+    result.success === true &&
+    result.changed !== false &&
+    result.alreadyApplied !== true &&
+    typeof file === "string" &&
+    file
+  ) {
+    facts.changedFiles.push(file);
+    const digest =
+      name === "write_file" && typeof args?.content === "string"
+        ? `; written content sha256:${createHash("sha256").update(args.content).digest("hex")}`
+        : "";
+    facts.checkpoints.push(
+      `Observed ${name} success: ${file}${digest}. File contents are omitted from this summary.`,
+    );
+    facts.nextSteps.push(
+      `Read the needed current source ranges in ${file} before replacing existing code; this summary is not a reconstruction of the file.`,
+    );
+  }
+  if (
+    ["run_shell", "run_code"].includes(name) &&
+    Number.isInteger(result.exitCode)
+  ) {
+    const command =
+      name === "run_shell" && typeof args?.command === "string"
+        ? truncateText(args.command, 300)
+        : name;
+    facts.checkpoints.push(
+      `Observed ${name}: ${command}; exitCode=${result.exitCode}.`,
+    );
+    if (
+      name === "run_shell" &&
+      /\b(?:vitest|jest|pytest|playwright|npm\s+(?:run\s+)?test|node\s+--test)\b/u.test(
+        command,
+      )
+    ) {
+      facts.tests.push(
+        `Observed command ${command}; exitCode=${result.exitCode}.`,
+      );
+    }
+  }
+  return facts;
 }
 
 function emptyHandoff(objective = "") {
@@ -313,12 +424,40 @@ export function buildExtractiveHandoff(messages, options = {}) {
   const sources = selectBoundedSources(messages, maxFallbackSourceChars);
   const firstUser = sources.find((entry) => entry.role === "user");
   const candidates = emptyHandoff(
-    truncateText(firstUser?.text || "", maxItemChars),
+    truncateText(
+      firstUser?.text ||
+        sources.find((entry) => entry.facts?.objective)?.facts.objective ||
+        "",
+      maxItemChars,
+    ),
   );
 
   for (const source of sources) {
-    for (const fragment of fragments(source.text)) {
-      candidates.changedFiles.push(...pathsFrom(fragment));
+    if (source.facts) {
+      // Extract typed observations before budgeting, never regex-match a
+      // serialized tool payload (which may contain arbitrary source text).
+      for (const field of ARRAY_FIELDS)
+        candidates[field].push(...source.facts[field]);
+      continue;
+    }
+    // Quoted implementation examples are source data, not executed outcomes.
+    const prose = source.text.replace(
+      /```[\s\S]*?(?:```|$)|~~~[\s\S]*?(?:~~~|$)/gu,
+      "",
+    );
+    for (const fragment of fragments(prose)) {
+      const statusNarrative =
+        source.role !== "user" &&
+        !/^(?:must|must not|do not|don't|only|next|todo|remaining|then|we will|will|need to)\b/iu.test(
+          fragment,
+        );
+      if (
+        statusNarrative &&
+        /^(?:changed|modified|updated|created|deleted|wrote|edited)\b/iu.test(
+          fragment,
+        )
+      )
+        candidates.changedFiles.push(...pathsFrom(fragment));
       if (
         /^(?:constraint|constraints|requirement|requirements|must|must not|do not|don't|only|约束|必须|不要|只能|仅限)\b/iu.test(
           fragment,
@@ -326,10 +465,7 @@ export function buildExtractiveHandoff(messages, options = {}) {
         /\bwithout\s+(?:widening|changing|removing|losing)\b/iu.test(fragment)
       ) {
         candidates.constraints.push(
-          stripLabel(
-            fragment,
-            "constraint(?:s)?|requirement(?:s)?|must(?: not)?|do not|don't|only|约束|必须|不要|只能|仅限",
-          ),
+          stripLabel(fragment, "constraint(?:s)?|requirement(?:s)?|约束"),
         );
       }
       if (
@@ -345,6 +481,7 @@ export function buildExtractiveHandoff(messages, options = {}) {
         );
       }
       if (
+        statusNarrative &&
         /\b(?:test|tests|vitest|jest|pytest|playwright|lint|typecheck|build)\b/iu.test(
           fragment,
         ) &&
@@ -367,6 +504,7 @@ export function buildExtractiveHandoff(messages, options = {}) {
         );
       }
       if (
+        statusNarrative &&
         /\b(?:checkpoint|commit\s+[0-9a-f]{7,40}|implemented|completed|done|verified|checkpoint|检查点|已完成|已实现)\b/iu.test(
           fragment,
         )

package/src/lib/agent-session-export.js

@@ -1,3 +1,4 @@
+import { projectToolRoundMessages } from "./session-tool-round.js";
 /**
  * Agent-session Markdown export — Claude-Code `/export` parity for the JSONL
  * headless/agent session store (`~/.../sessions/<id>.jsonl`, the `--resume`
@@ -63,6 +64,25 @@ export function renderAgentSessionMarkdown(sessionId, events, opts = {}) {
   for (const ev of events) {
     if (!ev || typeof ev !== "object") continue;
     switch (ev.type) {
+      case "tool_round":
+        for (const message of projectToolRoundMessages(ev)) {
+          L.push(
+            message.role === "assistant"
+              ? "## Assistant tool calls"
+              : `### Tool result ${message.tool_call_id}`,
+          );
+          L.push(
+            "",
+            fence(
+              message.role === "assistant"
+                ? message.tool_calls
+                : message.content,
+              "json",
+            ),
+            "",
+          );
+        }
+        break;
       case "user_message":
         users += 1;
         L.push("## 👤 User");

package/src/lib/background-agent-supervisor.js

@@ -1394,6 +1394,60 @@ export function mutateBackgroundAgentState(id, updater, options = {}) {
   );
 }
 
+export async function mutateBackgroundAgentStateWithLockRetry(
+  id,
+  updater,
+  options = {},
+) {
+  const now = options.now || Date.now;
+  const sleep =
+    options.sleep ||
+    ((milliseconds) =>
+      new Promise((resolvePromise) =>
+        setTimeout(resolvePromise, milliseconds),
+      ));
+  const mutate = options.mutate || mutateBackgroundAgentState;
+  const numericOption = (value, fallback, minimum) => {
+    const number = Number(value);
+    return Number.isFinite(number) ? Math.max(minimum, number) : fallback;
+  };
+  const timeoutMs = numericOption(options.timeoutMs ?? 30_000, 30_000, 0);
+  const lockTimeoutMs = numericOption(
+    options.lockTimeoutMs ?? 10_000,
+    10_000,
+    0,
+  );
+  const initialRetryMs = numericOption(options.initialRetryMs ?? 100, 100, 1);
+  const maxRetryMs = Math.max(
+    initialRetryMs,
+    numericOption(options.maxRetryMs ?? 1_000, 1_000, 1),
+  );
+  const deadline = now() + timeoutMs;
+  let attempts = 0;
+
+  for (;;) {
+    attempts += 1;
+    try {
+      return mutate(id, updater, {
+        timeoutMs: Math.min(lockTimeoutMs, Math.max(0, deadline - now())),
+      });
+    } catch (error) {
+      if (error?.code !== "STATE_LOCK_UNAVAILABLE") throw error;
+      const remainingMs = deadline - now();
+      if (remainingMs <= 0) {
+        error.attempts = attempts;
+        throw error;
+      }
+      const retryMs = Math.min(
+        maxRetryMs,
+        initialRetryMs * 2 ** Math.min(attempts - 1, 4),
+        remainingMs,
+      );
+      await sleep(retryMs);
+    }
+  }
+}
+
 export function writeBackgroundAgentState(state, options = {}) {
   return mutateBackgroundAgentState(state.id, () => state, {
     createIfMissing: options.createIfMissing === true,

package/src/lib/coding-task-guidance.js

@@ -5,8 +5,9 @@ export const CODING_TASK_QUALITY_GUIDANCE = `Coding task quality:
 - Resolve each relative import from the destination file's directory. Read back the completed file and fix newDiagnostics from write/edit results before finishing. A successful write confirms persistence, not syntax, test execution or acceptance.
 - Regression tests need a working positive control and a negative control that exercises the requested behavior through the real production entry point. Assert observable effects; avoid mocks or alternate calls that bypass the behavior under test. Complete the current worker/request when testing cancellation and replacement.
 - For boundary regressions, derive expected defaults, computed values and rejection rules from the implementation or the explicit requested contract. Inject mismatched, tampered or stale input through the real entry point while keeping other prerequisites valid; verify that the fixture reaches the intended check rather than failing during setup. Compare observable results with independent expected values or authoritative state, not a helper that merely recomputes the same result.
+- Trace rejection before asserting its aftermath: a request can be rejected before registration or persistence. Check whether state stays unchanged, a failed record is saved, or an event is emitted; do not assume every rejection creates a failed task. When testing attribution, verify independently recorded identities and provenance as well as message contents; identical text can still be attributed to the wrong source.
 - Use available execution tools for a focused check when permitted. When execution tools are unavailable, inspect imports, API contracts and fixtures using the available file tools, and clearly say that tests were not run. Never describe a read-back or static check as a passing test or end-to-end verification.
-- Finish requested file changes before the final response. Reserve output and remaining requests for writing, read-back and focused validation. For large files, aim for a few thousand characters of new content per call: write a small complete section, then extend it with edit_file using a unique existing anchor and a replacement containing that anchor plus the next complete section. Keep each tool call complete and wait for its result before extending the file again; do not repeatedly rewrite the growing file. State what was delivered, what was checked and what remains unverified.`;
+- Finish requested file changes before the final response. Reserve output and remaining requests for writing, read-back and focused validation. For large files, aim for a few thousand characters of new content per call: write a small complete section, then extend it with edit_file using a unique existing anchor and a replacement containing that anchor plus the next complete section. A list of available tool names is not a limit on the number of tool calls; use further calls within the actual request budget to finish and inspect the file. Keep each tool call complete and wait for its result before extending the file again; do not repeatedly rewrite the growing file. State what was delivered, what was checked and what remains unverified, without repeating that account in multiple drafts.`;
 
 export const HERMETIC_CODING_SYSTEM_PROMPT = `You are a hermetic coding assistant. The exposed file tools are the complete tool surface. Inspect and mutate only the exact paths authorized by the user request. Do not invoke hidden tools, commands, language servers or other execution paths.