codeep 2.18.0 → 2.19.0

package/dist/renderer/components/MentionPicker.js

@@ -0,0 +1,111 @@
+// components/MentionPicker.ts
+// `@mention` file autocomplete — mid-sentence `@path/to/file` picker.
+//
+// Extracted from App.ts (P2 refactor) following the component convention.
+// Separate from the `/command` Autocomplete because mentions appear
+// mid-sentence (not just at the start) and insert a file path (not a slash
+// command). `atStart` is the index of the `@` in the editor value, used to
+// replace `@query` with `@selectedPath` on Tab.
+//
+// App keeps the editor mutations (setValue/setCursorPos) as side effects;
+// this module owns the state shape, navigation, selection math, and render.
+import { fg, style } from '../ansi.js';
+import { PRIMARY_COLOR } from './uiConstants.js';
+export function createMentionPickerState() {
+    return { open: false, index: 0, items: [], atStart: 0, root: '' };
+}
+/** Set the picker to a fresh query result. */
+export function openMentionPicker(state, items, atStart, root) {
+    return { open: items.length > 0, index: 0, items, atStart, root };
+}
+/** Close the picker and clear its items. */
+export function closeMentionPicker(state) {
+    return { ...state, open: false, items: [] };
+}
+/**
+ * Handle one key event while the mention picker is open. Returns the next
+ * state plus an action; `select` carries the chosen suggestion and the
+ * `@` index so App can rewrite the editor buffer.
+ */
+export function handleMentionPickerKey(state, event) {
+    switch (event.key) {
+        case 'up':
+            return {
+                state: { ...state, index: Math.max(0, state.index - 1) },
+                action: { type: 'navigate', delta: -1 },
+            };
+        case 'down':
+            return {
+                state: {
+                    ...state,
+                    index: Math.min(state.items.length - 1, state.index + 1),
+                },
+                action: { type: 'navigate', delta: 1 },
+            };
+        case 'tab':
+            if (state.items.length > 0) {
+                const suggestion = state.items[state.index];
+                return {
+                    state: closeMentionPicker(state),
+                    action: { type: 'select', suggestion, atStart: state.atStart },
+                };
+            }
+            return { state, action: { type: 'none' } };
+        default:
+            return { state, action: { type: 'none' } };
+    }
+}
+/**
+ * Compute the editor buffer after applying a mention selection. Pure:
+ * returns the next value + cursor position for App to set.
+ *
+ * `atStart` is the index OF the `@`, so the `before` slice EXCLUDES it —
+ * the sigil is re-added or the completed path is no longer a mention and
+ * the file never gets attached.
+ */
+export function applyMentionToBuffer(value, cursor, atStart, suggestion) {
+    const before = value.slice(0, atStart) + '@';
+    const after = value.slice(cursor);
+    const next = before + suggestion.insertPath + ' ' + after;
+    return { value: next, cursor: (before + suggestion.insertPath + ' ').length };
+}
+/**
+ * Paint the mention picker below the status bar. Mirrors the layout of the
+ * `/` Autocomplete (separator → title → items → footer) but shows file
+ * paths with their parent directory as the description, and an `@` prefix.
+ */
+export function renderMentionPicker(screen, state, startY) {
+    const items = state.items;
+    const maxVisible = Math.min(items.length, 8);
+    let y = startY;
+    // Separator line
+    screen.horizontalLine(y++, '─', PRIMARY_COLOR);
+    // Title
+    screen.writeLine(y++, 'Add file to context (@mention)', PRIMARY_COLOR + style.bold);
+    // Items: `path` + directory detail
+    const visibleStart = Math.max(0, state.index - maxVisible + 1);
+    const visibleItems = items.slice(visibleStart, visibleStart + maxVisible);
+    for (let i = 0; i < visibleItems.length; i++) {
+        const item = visibleItems[i];
+        const actualIndex = visibleStart + i;
+        const isSelected = actualIndex === state.index;
+        const prefix = isSelected ? '► ' : '  ';
+        const pathText = ('@' + item.label).padEnd(40);
+        if (isSelected) {
+            screen.write(0, y, prefix, PRIMARY_COLOR);
+            screen.write(prefix.length, y, pathText, PRIMARY_COLOR + style.bold);
+            screen.write(prefix.length + pathText.length, y, item.detail, fg.white);
+        }
+        else {
+            screen.write(0, y, prefix, '');
+            screen.write(prefix.length, y, pathText, fg.cyan);
+            screen.write(prefix.length + pathText.length, y, item.detail, fg.gray);
+        }
+        y++;
+    }
+    // Footer
+    const scrollInfo = items.length > maxVisible
+        ? ` (${visibleStart + 1}-${visibleStart + visibleItems.length}/${items.length})`
+        : '';
+    screen.writeLine(y, `↑↓ navigate • Tab select • Esc cancel${scrollInfo}`, fg.gray);
+}

package/dist/renderer/components/PasteDialog.d.ts

@@ -0,0 +1,43 @@
+import type { Screen } from '../Screen';
+/** Stats + preview for the pasted text (built by layout.buildPasteInfo). */
+export interface PasteDialogInfo {
+    chars: number;
+    lines: number;
+    preview: string;
+    fullText: string;
+}
+export interface PasteDialogState {
+    open: boolean;
+    info: PasteDialogInfo | null;
+}
+export declare function createPasteDialogState(): PasteDialogState;
+/** What App should do after a key press. */
+export type PasteDialogAction = {
+    type: 'none';
+} | {
+    type: 'cancel';
+} | {
+    type: 'add-to-input';
+    text: string;
+} | {
+    type: 'send-directly';
+    text: string;
+};
+/** Minimal key shape App's KeyEvent satisfies. */
+export interface PasteDialogKeyEvent {
+    key: string;
+}
+/**
+ * Handle one key event for the paste dialog. Returns the next dialog state
+ * plus an action describing what App should perform as a side effect.
+ * The dialog closes on every recognized key.
+ */
+export declare function handlePasteDialogKey(state: PasteDialogState, event: PasteDialogKeyEvent): {
+    state: PasteDialogState;
+    action: PasteDialogAction;
+};
+/**
+ * Paint the paste dialog below the status bar. Mirrors the rendering
+ * previously inlined in App.renderInlinePasteInfo.
+ */
+export declare function renderPasteDialog(screen: Screen, state: PasteDialogState, startY: number, width: number): void;

package/dist/renderer/components/PasteDialog.js

@@ -0,0 +1,70 @@
+// components/PasteDialog.ts
+// Large-paste confirmation dialog ("Paste Detected").
+//
+// Extracted from App.ts (P2 refactor) following the component convention
+// (Settings/Export/Search/HunkPicker): a state object + key handler + render
+// function. When a large clipboard paste arrives, App stores the text here;
+// the user then picks one of three actions — add to the input buffer
+// (`y`/Enter), send directly as a message (`s`), or cancel (`n`/Esc).
+// The key handler returns `{ action, state }` so App can perform the
+// side-effectful parts (editor.insert / message submit) itself — the
+// component stays pure and testable.
+import { fg, style } from '../ansi.js';
+import { PRIMARY_COLOR } from './uiConstants.js';
+export function createPasteDialogState() {
+    return { open: false, info: null };
+}
+/**
+ * Handle one key event for the paste dialog. Returns the next dialog state
+ * plus an action describing what App should perform as a side effect.
+ * The dialog closes on every recognized key.
+ */
+export function handlePasteDialogKey(state, event) {
+    const closed = createPasteDialogState();
+    if (event.key === 'escape' || event.key === 'n') {
+        return { state: closed, action: { type: 'cancel' } };
+    }
+    if (event.key === 'enter' || event.key === 'y') {
+        const text = state.info?.fullText ?? '';
+        return { state: closed, action: { type: 'add-to-input', text } };
+    }
+    if (event.key === 's') {
+        const text = state.info?.fullText ?? '';
+        return { state: closed, action: { type: 'send-directly', text } };
+    }
+    return { state, action: { type: 'none' } };
+}
+/**
+ * Paint the paste dialog below the status bar. Mirrors the rendering
+ * previously inlined in App.renderInlinePasteInfo.
+ */
+export function renderPasteDialog(screen, state, startY, width) {
+    const info = state.info;
+    if (!info)
+        return;
+    let y = startY;
+    // Separator line
+    screen.horizontalLine(y++, '─', PRIMARY_COLOR);
+    // Title with stats
+    screen.write(0, y, 'Paste Detected ', PRIMARY_COLOR + style.bold);
+    screen.write(15, y, `(${info.chars} chars, ${info.lines} lines)`, fg.cyan);
+    y++;
+    // Preview box
+    y++;
+    const previewLines = info.preview.split('\n').slice(0, 5);
+    for (const line of previewLines) {
+        const displayLine = line.length > width - 4 ? line.slice(0, width - 7) + '...' : line;
+        screen.writeLine(y++, '  ' + displayLine, fg.gray);
+    }
+    if (info.lines > 5) {
+        screen.writeLine(y++, `  ... (${info.lines - 5} more lines)`, fg.gray);
+    }
+    y++;
+    // Options
+    screen.write(0, y, '[Y/Enter] ', fg.green);
+    screen.write(10, y, 'Add to input', fg.white);
+    screen.write(25, y, '[S] ', fg.yellow);
+    screen.write(29, y, 'Send directly', fg.white);
+    screen.write(45, y, '[N/Esc] ', fg.red);
+    screen.write(53, y, 'Cancel', fg.white);
+}

package/dist/renderer/layout.js

@@ -38,6 +38,7 @@ export function bottomPanelHeight(s) {
     }
     if (s.hunkPickerOpen) {
         // Title + progress + path + header + up to 12 diff lines + more marker + legend.
+        // Kept in sync with components/HunkPicker.ts (hunkPickerPanelHeight).
         return 18;
     }
     if (s.statusOpen) {

package/dist/renderer/main.js

@@ -19,7 +19,6 @@ import { getProviderList, isNoApiKeyProvider, resolveReasoningTier } from '../co
 import { getSessionStats, getCostBreakdown, getRecordCount } from '../utils/tokenTracker.js';
 import { getGitStatus, isGitRepository } from '../utils/git.js';
 import { reportStats, syncSession, generateProjectId } from '../utils/codeepCloud.js';
-import { checkApiRateLimit } from '../utils/ratelimit.js';
 import { expandFileAndFolderMentions, expandGitMentions } from '../utils/mentions.js';
 import { expandWebMentions } from '../utils/webFetch.js';
 import { handleCommand as dispatchCommand } from './commands.js';
@@ -169,11 +168,10 @@ async function handleSubmit(message) {
         executeAgentTask(enhancedTask, dryRun, ctx);
         return;
     }
-    const rateCheck = checkApiRateLimit();
-    if (!rateCheck.allowed) {
-        app.notify(rateCheck.message || 'Rate limit exceeded', 5000);
-        return;
-    }
+    // API rate limiting now lives at the transport layer (api/index.ts chat()
+    // + utils/agentChat.ts agentChat/agentChatFallback) — the single choke
+    // point shared by TUI, ACP and sub-agents. Checking here too would count
+    // the same request against the window twice.
     // Auto agent mode
     const agentMode = config.get('agentMode') || 'off';
     if (agentMode === 'on' && projectContext && hasWriteAccess && !isAgentRunningFlag) {
@@ -275,40 +273,14 @@ async function handleSubmit(message) {
             projectId,
             messages: messagesNow,
         });
-        const sharedFields = {
-            sessionId,
-            sessionName: displayName,
-            messageCount: messagesNow.length,
-            cliVersion: getCurrentVersion(),
-            projectName: projectContext?.name,
-            projectId,
-            language: projectContext?.type,
-            isGit: isGitRepository(process.cwd()),
-        };
-        // Cloud stats are append-only events, so report only this prompt's delta.
-        // Sending the full session accumulator after every prompt makes totals grow
-        // 1× + 2× + 3× and is the source of the inflated dashboard token count.
-        const costBreakdown = getCostBreakdown(tokenReportStart);
-        if (costBreakdown.length > 0) {
-            for (const entry of costBreakdown) {
-                reportStats({
-                    ...sharedFields,
-                    model: entry.model,
-                    provider: entry.provider,
-                    inputTokens: entry.promptTokens || undefined,
-                    outputTokens: entry.completionTokens || undefined,
-                    cacheCreationTokens: entry.cacheCreationTokens || undefined,
-                    cacheReadTokens: entry.cacheReadTokens || undefined,
-                    estimatedCost: entry.estimatedCost || undefined,
-                });
-            }
-        }
-        else {
-            reportStats({ ...sharedFields, model: config.get('model'), provider: config.get('provider') });
-        }
+        reportTurnStats(true);
     }
     catch (error) {
         app.endStreaming();
+        // The turn still consumed tokens even though it failed or was aborted, so
+        // report the delta before returning — gracefulShutdown no longer sends a
+        // cumulative catch-all that would have swept them up later.
+        reportTurnStats(false);
         const err = error;
         if (err.name === 'AbortError')
             return;
@@ -569,11 +541,15 @@ Commands (in chat):
                 console.log('  Cloud key sync is off — skipping API keys. Enable with: /keysync on');
             }
             // Also pull portable personal config — personalities + custom commands +
-            // the user profile. Additive merge (never clobbers local files).
-            const { pullPersonalities, pullCommands, pullUserProfile } = await import('../utils/codeepCloud.js');
+            // the user profile. Web-edited personalities replace their local copy
+            // after a safety backup; commands/profile retain additive merge rules.
+            const { pullPersonalities, pullCommands, pullUserProfile, getLastPersonalityPullBackupCount } = await import('../utils/codeepCloud.js');
             const pCount = await pullPersonalities();
             if (typeof pCount === 'number' && pCount > 0) {
                 console.log(`  Pulled ${pCount} personalit${pCount === 1 ? 'y' : 'ies'}.`);
+                const backups = getLastPersonalityPullBackupCount();
+                if (backups > 0)
+                    console.log(`  Backed up ${backups} replaced local cop${backups === 1 ? 'y' : 'ies'} in ~/.codeep/backups/personalities/.`);
             }
             const cCount = await pullCommands();
             if (typeof cCount === 'number' && cCount > 0) {

package/dist/utils/agent.js

@@ -14,6 +14,7 @@ const debug = (...args) => {
 import { agentChat, getAgentSystemPrompt, getFallbackSystemPrompt, loadProjectRules, loadProgressLog, writeProgressLog, formatChatHistoryForAgent, summarizeEarlierHistory, } from './agentChat.js';
 import { ApiError } from '../api/index.js';
 import { loadUserProfilePrompt } from './userProfile.js';
+import { getActivePersonality, getPersonalityToolAllowlist, isPersonalityToolCallAllowed, resolvePersonalityRuntimeModel, } from './personalities.js';
 export { loadProjectRules, loadProgressLog, writeProgressLog, formatChatHistoryForAgent };
 /**
  * Calculate dynamic timeout based on task complexity
@@ -187,6 +188,20 @@ export async function runAgent(prompt, projectContext, options = {}) {
     const startTime = Date.now();
     const actions = [];
     const messages = [];
+    // A structured custom bot is resolved once per run. This keeps a cloud sync
+    // or file edit from changing policy halfway through an in-flight request.
+    const activePersonality = getActivePersonality(projectContext.root);
+    const currentRuntime = {
+        providerId: String(config.get('provider')),
+        model: String(config.get('model')),
+        protocol: config.get('protocol'),
+    };
+    const personalityModel = activePersonality
+        ? resolvePersonalityRuntimeModel(activePersonality, currentRuntime)
+        : null;
+    const chatRuntime = {
+        ...(personalityModel ?? currentRuntime),
+    };
     // Start history session for undo support. Skipped for nested (delegated)
     // runs so we don't reset the parent's currentSession singleton — the
     // sub-agent's actions still record into the parent's open session.
@@ -204,7 +219,7 @@ export async function runAgent(prompt, projectContext, options = {}) {
                 name: projectContext.name,
                 type: projectContext.type,
                 structure: projectContext.structure,
-            });
+            }, chatRuntime);
             if (taskPlan.tasks.length > 1) {
                 opts.onTaskPlan?.(taskPlan);
                 // Mark first task as in_progress
@@ -224,8 +239,8 @@ export async function runAgent(prompt, projectContext, options = {}) {
     const smartContext = gatherSmartContext(targetFile, projectContext, prompt);
     const smartContextStr = formatSmartContext(smartContext);
     // Check if provider supports native tools
-    const protocol = config.get('protocol');
-    const providerId = config.get('provider');
+    const protocol = chatRuntime.protocol ?? config.get('protocol');
+    const providerId = chatRuntime.providerId ?? config.get('provider');
     const useNativeTools = supportsNativeTools(providerId, protocol);
     // Fetch the MCP tool catalog once per agent run. The session id keys into
     // mcpRegistry; if no MCP servers are registered (or mcpSessionId is unset,
@@ -239,6 +254,7 @@ export async function runAgent(prompt, projectContext, options = {}) {
     // read <uri>` manually. Servers that don't expose resources or prompts
     // get no virtual tools — the wrappers are only emitted where useful.
     let mcpToolDefs = [];
+    const registeredMcpToolNames = new Set();
     if (opts.mcpSessionId) {
         try {
             const { getSessionTools, getSessionVirtualTools } = await import('./mcpRegistry.js');
@@ -251,6 +267,7 @@ export async function runAgent(prompt, projectContext, options = {}) {
                 description: t.description,
                 inputSchema: t.inputSchema,
             }));
+            mcpToolDefs.forEach(tool => registeredMcpToolNames.add(tool.name));
         }
         catch {
             // Don't let a registry blip kill the whole agent run.
@@ -312,10 +329,31 @@ export async function runAgent(prompt, projectContext, options = {}) {
             // Agent loading must never block the run.
         }
     }
+    const updateRuntimeToolAllowlist = () => {
+        const personalityToolAllowlist = activePersonality
+            ? getPersonalityToolAllowlist(activePersonality, registeredMcpToolNames)
+            : undefined;
+        let effectiveToolAllowlist;
+        if (!personalityToolAllowlist && !opts.allowedTools)
+            effectiveToolAllowlist = undefined;
+        else if (!personalityToolAllowlist)
+            effectiveToolAllowlist = [...(opts.allowedTools ?? [])];
+        else if (!opts.allowedTools)
+            effectiveToolAllowlist = personalityToolAllowlist;
+        else {
+            const delegated = new Set(opts.allowedTools);
+            effectiveToolAllowlist = personalityToolAllowlist.filter(tool => delegated.has(tool));
+        }
+        if (effectiveToolAllowlist)
+            chatRuntime.allowedToolNames = effectiveToolAllowlist;
+        else
+            delete chatRuntime.allowedToolNames;
+    };
+    updateRuntimeToolAllowlist();
     // Build system prompt - use fallback format if native tools not supported
     let systemPrompt = useNativeTools
-        ? getAgentSystemPrompt(projectContext)
-        : getFallbackSystemPrompt(projectContext, mcpToolDefs);
+        ? getAgentSystemPrompt(projectContext, chatRuntime)
+        : getFallbackSystemPrompt(projectContext, mcpToolDefs, chatRuntime);
     // Delegated sub-agent role — its defining instruction. Injected right after
     // the base prompt so it frames everything that follows. Empty for normal runs.
     if (opts.roleAddendum) {
@@ -371,16 +409,16 @@ export async function runAgent(prompt, projectContext, options = {}) {
     // Active personality goes LAST — appended after skills / project rules /
     // smart context so its tone overrides earlier conventions. Set via
     // `/personality <name>`; empty when no personality is active.
-    try {
-        const { getActivePersonalityPrompt } = await import('./personalities.js');
-        const personalityPrompt = getActivePersonalityPrompt(projectContext.root);
-        if (personalityPrompt) {
-            systemPrompt += personalityPrompt;
+    if (activePersonality?.prompt) {
+        systemPrompt += activePersonality.prompt;
+        if (activePersonality.restrictTools) {
+            const capabilities = activePersonality.tools?.join(', ') || '(none recognised)';
+            systemPrompt += `\n\n## Enforced custom-bot capabilities\nThis run is restricted to: ${capabilities}. `
+                + 'The runtime enforces this policy even if other prompt text asks for a disallowed tool. '
+                + 'Tests permit matching test runners; Git permits a conservative set of built-in git commands. '
+                + 'Broader executables (including gh) require Terminal.';
         }
     }
-    catch {
-        // Personality loading must never block an agent run.
-    }
     // Initial user message with optional task plan
     let initialPrompt = prompt;
     if (taskPlan) {
@@ -551,16 +589,24 @@ export async function runAgent(prompt, projectContext, options = {}) {
             // requiring a session restart to see new tools.
             if (opts.mcpSessionId) {
                 try {
-                    const { consumeSessionCatalogChanges, getSessionTools } = await import('./mcpRegistry.js');
+                    const { consumeSessionCatalogChanges, getSessionTools, getSessionVirtualTools } = await import('./mcpRegistry.js');
                     const dirty = consumeSessionCatalogChanges(opts.mcpSessionId);
                     if (dirty.has('tools')) {
-                        const refreshed = await getSessionTools(opts.mcpSessionId);
-                        mcpToolDefs = refreshed.map(t => ({
+                        const [refreshed, refreshedVirtuals] = await Promise.all([
+                            getSessionTools(opts.mcpSessionId),
+                            getSessionVirtualTools(opts.mcpSessionId),
+                        ]);
+                        const localToolDefs = mcpToolDefs.filter(tool => tool.name === 'invoke_skill' || tool.name === 'delegate');
+                        const refreshedMcpDefs = [...refreshed, ...refreshedVirtuals].map(t => ({
                             name: t.agentName,
                             description: t.description,
                             inputSchema: t.inputSchema,
                         }));
-                        debug(`MCP tool catalog refreshed mid-run: ${mcpToolDefs.length} tool(s)`);
+                        mcpToolDefs = [...refreshedMcpDefs, ...localToolDefs];
+                        registeredMcpToolNames.clear();
+                        refreshedMcpDefs.forEach(tool => registeredMcpToolNames.add(tool.name));
+                        updateRuntimeToolAllowlist();
+                        debug(`MCP tool catalog refreshed mid-run: ${refreshedMcpDefs.length} tool(s)`);
                     }
                 }
                 catch {
@@ -573,7 +619,7 @@ export async function runAgent(prompt, projectContext, options = {}) {
             while (true) {
                 try {
                     chatResponse = await agentChat(messages, systemPrompt, opts.onChunk, opts.abortSignal, dynamicTimeout * (1 + retryCount * 0.5), // Increase timeout on retry
-                    mcpToolDefs);
+                    mcpToolDefs, chatRuntime);
                     consecutiveTimeouts = 0; // Reset consecutive count on success
                     consecutiveRateLimits = 0;
                     break;
@@ -772,6 +818,24 @@ export async function runAgent(prompt, projectContext, options = {}) {
             const toolResults = [];
             for (const toolCall of toolCalls) {
                 opts.onToolCall?.(toolCall);
+                // Structured custom-bot policy is a runtime security boundary, not a
+                // prompt suggestion. It runs before permission UI or external ACP
+                // terminal delegation, so disallowed commands cannot escape via a
+                // different execution surface.
+                if (activePersonality && !isPersonalityToolCallAllowed(activePersonality, toolCall, registeredMcpToolNames)) {
+                    const allowed = activePersonality.declaredTools?.join(', ') || 'none';
+                    const denied = {
+                        success: false,
+                        output: '',
+                        error: `Tool "${toolCall.tool}" is blocked by custom bot "${activePersonality.displayName}".`,
+                        tool: toolCall.tool,
+                        parameters: toolCall.parameters,
+                    };
+                    opts.onToolResult?.(denied, toolCall);
+                    actions.push(createActionLog(toolCall, denied));
+                    toolResults.push(`Tool ${toolCall.tool} is blocked by the active custom bot. Allowed capabilities: ${allowed}.`);
+                    continue;
+                }
                 // Tool scoping for delegated sub-agents: reject any tool outside the
                 // agent's allowlist up front — no permission prompt, no execution.
                 if (opts.allowedTools && !opts.allowedTools.includes(toolCall.tool)) {
@@ -949,7 +1013,16 @@ export async function runAgent(prompt, projectContext, options = {}) {
         // Support legacy boolean values: true -> 'all', false -> 'off'
         const autoVerify = autoVerifyRaw === true ? 'all' : autoVerifyRaw === false ? 'off' : autoVerifyRaw;
         const maxFixAttempts = opts.maxFixAttempts ?? config.get('agentMaxFixAttempts');
-        if (autoVerify !== 'off' && !opts.dryRun) {
+        const botAllowsTerminal = !activePersonality?.restrictTools || activePersonality.tools?.includes('terminal') === true;
+        const botAllowsTests = botAllowsTerminal || activePersonality?.tools?.includes('tests') === true;
+        const verificationPolicy = {
+            runBuild: (autoVerify === 'all' || autoVerify === 'build') && botAllowsTerminal,
+            runTest: (autoVerify === 'all' || autoVerify === 'test') && botAllowsTests,
+            runTypecheck: (autoVerify === 'all' || autoVerify === 'typecheck') && botAllowsTerminal,
+            runLint: false,
+        };
+        const hasPermittedVerification = verificationPolicy.runBuild || verificationPolicy.runTest || verificationPolicy.runTypecheck;
+        if (autoVerify !== 'off' && !opts.dryRun && hasPermittedVerification) {
             // Check if we made any file changes worth verifying
             const hasFileChanges = actions.some(a => a.type === 'write' || a.type === 'edit' || a.type === 'delete');
             if (hasFileChanges) {
@@ -962,12 +1035,7 @@ export async function runAgent(prompt, projectContext, options = {}) {
                     }
                     opts.onIteration?.(iteration, `Verification attempt ${fixAttempt + 1}/${maxFixAttempts}`);
                     // Run verifications based on selected mode
-                    const verifyResults = await runAllVerifications(projectContext.root || process.cwd(), {
-                        runBuild: autoVerify === 'all' || autoVerify === 'build',
-                        runTest: autoVerify === 'all' || autoVerify === 'test',
-                        runTypecheck: autoVerify === 'all' || autoVerify === 'typecheck',
-                        runLint: false,
-                    });
+                    const verifyResults = await runAllVerifications(projectContext.root || process.cwd(), verificationPolicy);
                     opts.onVerification?.(verifyResults);
                     // Filter errors: only keep those related to files the agent touched
                     const touchedFiles = new Set(actions
@@ -1031,7 +1099,7 @@ export async function runAgent(prompt, projectContext, options = {}) {
                     }
                     // Get AI response to fix errors
                     try {
-                        const fixResponse = await agentChat(messages, systemPrompt, opts.onChunk, opts.abortSignal, undefined, mcpToolDefs);
+                        const fixResponse = await agentChat(messages, systemPrompt, opts.onChunk, opts.abortSignal, undefined, mcpToolDefs, chatRuntime);
                         const { content: fixContent, toolCalls: fixToolCalls } = fixResponse;
                         if (fixToolCalls.length === 0) {
                             // Agent gave up or thinks it's fixed
@@ -1043,6 +1111,32 @@ export async function runAgent(prompt, projectContext, options = {}) {
                         const fixResults = [];
                         for (const toolCall of fixToolCalls) {
                             opts.onToolCall?.(toolCall);
+                            if (activePersonality && !isPersonalityToolCallAllowed(activePersonality, toolCall, registeredMcpToolNames)) {
+                                const denied = {
+                                    success: false,
+                                    output: '',
+                                    error: `Tool "${toolCall.tool}" is blocked by custom bot "${activePersonality.displayName}".`,
+                                    tool: toolCall.tool,
+                                    parameters: toolCall.parameters,
+                                };
+                                opts.onToolResult?.(denied, toolCall);
+                                actions.push(createActionLog(toolCall, denied));
+                                fixResults.push(`Tool ${toolCall.tool} blocked by the active custom bot.`);
+                                continue;
+                            }
+                            if (opts.allowedTools && !opts.allowedTools.includes(toolCall.tool)) {
+                                const denied = {
+                                    success: false,
+                                    output: '',
+                                    error: `Tool "${toolCall.tool}" is not available to this sub-agent.`,
+                                    tool: toolCall.tool,
+                                    parameters: toolCall.parameters,
+                                };
+                                opts.onToolResult?.(denied, toolCall);
+                                actions.push(createActionLog(toolCall, denied));
+                                fixResults.push(`Tool ${toolCall.tool} is not allowed for this sub-agent.`);
+                                continue;
+                            }
                             const toolResult = await executeTool(toolCall, projectContext.root || process.cwd(), opts.fs, opts.mcpSessionId);
                             opts.onToolResult?.(toolResult, toolCall);
                             const actionLog = createActionLog(toolCall, toolResult);
@@ -1074,6 +1168,7 @@ export async function runAgent(prompt, projectContext, options = {}) {
         if (!opts.nested
             && (opts.depth ?? 0) === 0
             && !opts.dryRun
+            && !activePersonality?.restrictTools
             && config.get('agentAutoReview') === true
             && !opts.abortSignal?.aborted
             && actions.some(a => a.type === 'write' || a.type === 'edit' || a.type === 'delete')) {

package/dist/utils/agentChat.d.ts

@@ -16,6 +16,13 @@ import { Message } from '../config/index';
 import { AdditionalToolDef } from './tools';
 import type { AgentChatResponse } from './agentStream';
 export type { AgentChatResponse };
+/** Per-run overrides used by structured custom bots. They never mutate config. */
+export interface AgentChatRuntime {
+    providerId?: string;
+    model?: string;
+    protocol?: 'openai' | 'anthropic';
+    allowedToolNames?: string[];
+}
 /**
  * Custom error class for timeout
  */
@@ -67,8 +74,8 @@ export declare function summarizeEarlierHistory(history?: Array<{
     role: 'user' | 'assistant';
     content: string;
 }>, maxChars?: number): Promise<string>;
-export declare function getAgentSystemPrompt(projectContext: ProjectContext): string;
-export declare function getFallbackSystemPrompt(projectContext: ProjectContext, additionalTools?: AdditionalToolDef[]): string;
+export declare function getAgentSystemPrompt(projectContext: ProjectContext, runtime?: AgentChatRuntime): string;
+export declare function getFallbackSystemPrompt(projectContext: ProjectContext, additionalTools?: AdditionalToolDef[], runtime?: AgentChatRuntime): string;
 /**
  * Make a chat API call for agent mode with native tool support.
  * Falls back to agentChatFallback() if provider doesn't support tools.
@@ -80,8 +87,8 @@ export declare function agentChat(messages: Message[], systemPrompt: string, onC
  * invoke). Optional — built-in tools work the same whether this is
  * omitted or an empty array.
  */
-additionalTools?: AdditionalToolDef[]): Promise<AgentChatResponse>;
+additionalTools?: AdditionalToolDef[], runtime?: AgentChatRuntime): Promise<AgentChatResponse>;
 /**
  * Fallback chat without native tools (text-based tool format)
  */
-export declare function agentChatFallback(messages: Message[], systemPrompt: string, onChunk?: (chunk: string) => void, abortSignal?: AbortSignal, dynamicTimeout?: number): Promise<AgentChatResponse>;
+export declare function agentChatFallback(messages: Message[], systemPrompt: string, onChunk?: (chunk: string) => void, abortSignal?: AbortSignal, dynamicTimeout?: number, additionalTools?: AdditionalToolDef[], runtime?: AgentChatRuntime): Promise<AgentChatResponse>;