codeep 2.18.1 → 2.19.0

package/dist/utils/personalities.js

@@ -10,13 +10,21 @@
  *
  * Project shadows global shadows built-in, by name.
  *
- * File format (project / global):
+ * File format (project / global): legacy prompt-only Markdown remains valid;
+ * structured custom bots add a small versioned frontmatter block:
  *   ```
- *   # Personality: Concise Reviewer
- *   <free-form Markdown body — gets appended to system prompt verbatim>
+ *   ---
+ *   codeep: custom-bot/v1
+ *   model: automatic
+ *   tools: [files, tests, git]
+ *   scope: all
+ *   projects: []
+ *   ---
+ *   # Concise Reviewer
+ *   <behavior sections — appended to the system prompt>
  *   ```
- * (The first H1 line is parsed as the display name; everything else is
- * the prompt body.)
+ * The first H1 is the display name. Tools/model/scope are enforced only for
+ * structured files; old files stay unrestricted.
  *
  * Activation:
  *   - `config.activePersonality` holds the active name (or null/undefined
@@ -27,9 +35,196 @@
  *   - Persists across sessions until cleared with `/personality off`.
  */
 import { readFileSync, readdirSync, existsSync } from 'fs';
-import { join } from 'path';
+import { basename, join } from 'path';
 import { homedir } from 'os';
 import { config } from '../config/index.js';
+import { getProvider } from '../config/providers.js';
+const CAPABILITIES = new Set([
+    'files', 'terminal', 'tests', 'git', 'web', 'mcp',
+]);
+const FILE_TOOLS = [
+    'read_file', 'write_file', 'edit_file', 'delete_file', 'list_files',
+    'create_directory', 'search_code', 'find_files',
+];
+const WEB_TOOLS = [
+    'fetch_url', 'web_search', 'web_read', 'github_read', 'minimax_web_search',
+];
+function unquoteScalar(value) {
+    return (value ?? '').trim().replace(/^(["'])(.*)\1$/, '$2').trim();
+}
+function splitFrontmatter(raw) {
+    const normalised = raw.replace(/^\uFEFF/, '');
+    if (!normalised.startsWith('---\n') && !normalised.startsWith('---\r\n')) {
+        return { meta: {}, body: normalised, codeepDeclared: false, versioned: false };
+    }
+    const match = normalised.match(/^---\r?\n([\s\S]*?)\r?\n---(?:\r?\n|$)/);
+    if (!match)
+        return { meta: {}, body: normalised, codeepDeclared: false, versioned: false };
+    const meta = {};
+    for (const line of match[1].split(/\r?\n/)) {
+        const parsed = line.match(/^([a-zA-Z][a-zA-Z0-9_-]*)\s*:\s*(.*?)\s*$/);
+        if (parsed)
+            meta[parsed[1].toLowerCase()] = parsed[2];
+    }
+    const codeepDeclared = Object.prototype.hasOwnProperty.call(meta, 'codeep');
+    return {
+        meta,
+        body: normalised.slice(match[0].length),
+        codeepDeclared,
+        versioned: codeepDeclared && unquoteScalar(meta.codeep) === 'custom-bot/v1',
+    };
+}
+function parseInlineList(value) {
+    if (!value)
+        return [];
+    const trimmed = value.trim();
+    if (!trimmed.startsWith('[') || !trimmed.endsWith(']'))
+        return trimmed ? [trimmed] : [];
+    return trimmed.slice(1, -1).split(',').map(item => item.trim().replace(/^(["'])(.*)\1$/, '$2').trim()).filter(Boolean);
+}
+function section(body, title) {
+    const escaped = title.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+    const start = body.search(new RegExp(`^##\\s+${escaped}\\s*$`, 'im'));
+    if (start < 0)
+        return undefined;
+    const afterHeading = body.slice(start).replace(/^##[^\n]*(?:\r?\n|$)/, '');
+    const next = afterHeading.search(/^##\s+/m);
+    return (next < 0 ? afterHeading : afterHeading.slice(0, next)).trim();
+}
+function listSection(body, title) {
+    const value = section(body, title);
+    if (value === undefined)
+        return [];
+    return value.split(/\r?\n/)
+        .map(line => line.replace(/^\s*[-*]\s+/, '').trim())
+        .filter(Boolean);
+}
+function normaliseProjectScope(raw) {
+    const value = unquoteScalar(raw).toLowerCase();
+    if (['all', 'all projects'].includes(value))
+        return 'all';
+    if (['selected', 'selected projects', 'current project only'].includes(value))
+        return 'selected';
+    if (['personal', 'personal mode', 'personal mode only'].includes(value))
+        return 'personal';
+    return 'unspecified';
+}
+function normaliseCapabilities(values) {
+    const out = new Set();
+    for (const raw of values) {
+        const value = raw.trim().toLowerCase();
+        if (CAPABILITIES.has(value))
+            out.add(value);
+    }
+    return [...out];
+}
+function exactModelPreference(preference) {
+    const value = preference?.trim() ?? '';
+    const slash = value.indexOf('/');
+    if (slash <= 0 || slash === value.length - 1)
+        return null;
+    const providerId = value.slice(0, slash).trim();
+    const model = value.slice(slash + 1).trim();
+    return providerId && model ? { providerId, model } : null;
+}
+/** Whether a structured bot's model field satisfies the portable v1 contract. */
+export function isPersonalityModelPreferenceValid(personality) {
+    if (!personality.structured)
+        return true;
+    const preference = personality.modelPreference?.trim() || 'automatic';
+    if (preference.toLowerCase() === 'automatic')
+        return true;
+    const exact = exactModelPreference(preference);
+    if (!exact)
+        return false;
+    const provider = getProvider(exact.providerId);
+    if (!provider)
+        return false;
+    return provider.dynamicModels === true || provider.models.some(item => item.id === exact.model);
+}
+/** Parse both custom-bot/v1 and the original web builder's heading format. */
+export function parsePersonalityMarkdown(raw, name, scope) {
+    const { meta, body, codeepDeclared, versioned } = splitFrontmatter(raw);
+    const h1 = body.match(/^#\s+(?:Personality:\s+)?(.+)$/m);
+    const displayName = h1?.[1].trim() ?? name;
+    const h1Start = h1 ? body.indexOf(h1[0]) : -1;
+    const h1End = h1Start >= 0 ? body.indexOf('\n', h1Start) : -1;
+    const promptBody = h1
+        ? (h1End >= 0 ? body.slice(h1End + 1) : '').trimStart()
+        : body.trimStart();
+    const responsibility = section(body, 'Responsibility');
+    const responseStyle = section(body, 'Response style');
+    const advancedInstructions = section(body, 'Advanced instructions');
+    const sectionModel = section(body, 'Model');
+    const sectionToolsPresent = /^##\s+Tools\s*$/im.test(body);
+    const sectionTools = listSection(body, 'Tools');
+    const sectionScope = section(body, 'Scope');
+    const sectionProjects = listSection(body, 'Projects');
+    // The original section-only builder format has no version marker. A single
+    // common heading is not a safe signature (`## Tools` is perfectly ordinary
+    // legacy prompt prose), so require Responsibility + another builder
+    // section. Heading presence, not content, is what matters once that strong
+    // signature is met.
+    const standardSections = [
+        'Responsibility', 'Response style', 'Always', 'Never', 'Model', 'Tools',
+        'Scope', 'Projects', 'Advanced instructions',
+    ].filter(title => section(body, title) !== undefined);
+    const sectionStructured = standardSections.includes('Responsibility') && standardSections.length >= 2;
+    // A declared schema marker owns interpretation even when unsupported. Never
+    // reinterpret a typo/future version as permissive legacy prose.
+    const structured = codeepDeclared || sectionStructured;
+    const schemaValid = !codeepDeclared || versioned;
+    const frontmatterToolsPresent = Object.prototype.hasOwnProperty.call(meta, 'tools');
+    // Portable v1 requires list syntax. Accepting a malformed scalar such as
+    // `tools: files` would silently grant a capability when the fail-closed
+    // contract says it must become conversation-only.
+    const versionedToolsValue = meta.tools?.trim() ?? '';
+    const versionedToolsWellFormed = versionedToolsValue.startsWith('[') && versionedToolsValue.endsWith(']');
+    const declaredTools = codeepDeclared
+        ? (frontmatterToolsPresent && versionedToolsWellFormed ? parseInlineList(meta.tools) : [])
+        : (frontmatterToolsPresent ? parseInlineList(meta.tools) : sectionTools);
+    const tools = normaliseCapabilities(declaredTools);
+    const frontmatterProjectsPresent = Object.prototype.hasOwnProperty.call(meta, 'projects');
+    const versionedProjectsValue = meta.projects?.trim() ?? '';
+    const versionedProjectsWellFormed = versionedProjectsValue.startsWith('[') && versionedProjectsValue.endsWith(']');
+    const projects = codeepDeclared
+        ? (frontmatterProjectsPresent && versionedProjectsWellFormed ? parseInlineList(meta.projects) : [])
+        : (frontmatterProjectsPresent ? parseInlineList(meta.projects) : sectionProjects);
+    const descriptionFromMeta = unquoteScalar(meta.description);
+    const descriptionFromQuote = body.match(/^>\s+(.+)$/m)?.[1]?.trim();
+    const firstPara = promptBody.split(/\n\s*\n/)[0]?.replace(/^>\s*/, '').replace(/\s+/g, ' ').trim() ?? '';
+    const descriptionRaw = descriptionFromMeta || descriptionFromQuote || firstPara;
+    const description = descriptionRaw.length > 200 ? descriptionRaw.slice(0, 197) + '…' : descriptionRaw;
+    const modelPreference = unquoteScalar((codeepDeclared ? meta.model : (meta.model || sectionModel)) || 'automatic');
+    const frontmatterScopePresent = Object.prototype.hasOwnProperty.call(meta, 'scope');
+    const projectScope = normaliseProjectScope(codeepDeclared ? meta.scope : (meta.scope || sectionScope));
+    const explicitScopePresent = codeepDeclared ? frontmatterScopePresent : (frontmatterScopePresent || sectionScope !== undefined);
+    const scopeValid = !(structured && explicitScopePresent && projectScope === 'unspecified');
+    return {
+        name,
+        displayName,
+        description: description || `Custom personality from ${name}.md`,
+        prompt: '\n\n## Personality: ' + displayName + '\n\n' + promptBody,
+        scope,
+        structured,
+        schemaValid,
+        modelPreference,
+        tools,
+        declaredTools,
+        // Versioned v1 is fail-closed: missing, empty, malformed, or unknown Tools
+        // all mean no tools. Only true legacy and compatible section-only files
+        // without a Tools heading preserve unrestricted prompt-only behavior.
+        restrictTools: codeepDeclared || (sectionStructured && sectionToolsPresent),
+        projectScope,
+        scopeValid,
+        projects,
+        responsibility,
+        responseStyle,
+        always: listSection(body, 'Always'),
+        never: listSection(body, 'Never'),
+        advancedInstructions,
+    };
+}
 const BUILTIN = [
     {
         name: 'concise',
@@ -149,20 +344,7 @@ function loadFromDir(dir, scope) {
             const raw = readFileSync(join(dir, entry), 'utf8');
             if (raw.length > 64 * 1024)
                 continue; // cap at 64 KB
-            // First H1 → displayName; rest → prompt.
-            const h1 = raw.match(/^#\s+(?:Personality:\s+)?(.+)$/m);
-            const displayName = h1?.[1].trim() ?? name;
-            const body = h1 ? raw.slice(raw.indexOf('\n', raw.indexOf(h1[0])) + 1).trimStart() : raw;
-            // First paragraph (or line) → description (cap 200 chars).
-            const firstPara = body.split(/\n\s*\n/)[0]?.replace(/\s+/g, ' ').trim() ?? '';
-            const description = firstPara.length > 200 ? firstPara.slice(0, 197) + '…' : firstPara;
-            out.push({
-                name,
-                displayName,
-                description: description || `Custom personality from ${entry}`,
-                prompt: '\n\n## Personality: ' + displayName + '\n\n' + body,
-                scope,
-            });
+            out.push(parsePersonalityMarkdown(raw, name, scope));
         }
         catch {
             // Skip broken files — never crash personality loading.
@@ -170,6 +352,337 @@ function loadFromDir(dir, scope) {
     }
     return out;
 }
+function globMatchesProject(pattern, projectName) {
+    const escaped = pattern.trim().replace(/[.+^${}()|[\]\\]/g, '\\$&')
+        .replace(/\*/g, '.*')
+        .replace(/\?/g, '.');
+    if (!escaped)
+        return false;
+    return new RegExp(`^${escaped}$`, 'i').test(projectName);
+}
+/**
+ * Scope is enforced against the workspace basename only. This intentionally
+ * avoids accepting arbitrary paths from cloud-authored metadata.
+ */
+export function isPersonalityAvailable(personality, workspaceRoot) {
+    if (personality.schemaValid === false)
+        return false;
+    if (!isPersonalityModelPreferenceValid(personality))
+        return false;
+    if (personality.scopeValid === false)
+        return false;
+    if (!personality.structured || personality.projectScope === 'unspecified' || personality.projectScope === 'all') {
+        return true;
+    }
+    if (personality.projectScope === 'personal') {
+        // With no workspace the caller is explicitly in personal mode. When a
+        // root is supplied, a directory without common project markers is also
+        // considered personal (the TUI always has a cwd).
+        if (!workspaceRoot)
+            return true;
+        const markers = [
+            '.git', '.hg', '.svn', '.idea',
+            'package.json', 'pnpm-workspace.yaml', 'deno.json', 'deno.jsonc',
+            'pyproject.toml', 'requirements.txt', 'setup.py',
+            'Cargo.toml', 'go.mod', 'Package.swift',
+            'pom.xml', 'build.gradle', 'build.gradle.kts', 'settings.gradle', 'settings.gradle.kts',
+            'Makefile', 'CMakeLists.txt', 'meson.build', 'WORKSPACE', 'WORKSPACE.bazel',
+            'composer.json', 'Gemfile', 'mix.exs', 'pubspec.yaml', 'flake.nix',
+            join('.codeep', 'project.json'),
+        ];
+        if (markers.some(marker => existsSync(join(workspaceRoot, marker))))
+            return false;
+        try {
+            const projectContainer = /\.(?:xcodeproj|xcworkspace|sln|code-workspace)$/i;
+            if (readdirSync(workspaceRoot).some(entry => projectContainer.test(entry)))
+                return false;
+        }
+        catch {
+            // An unreadable directory is not safe to classify as explicit personal
+            // mode, so fail closed.
+            return false;
+        }
+        return true;
+    }
+    if (personality.projectScope === 'selected') {
+        // A project-local file is inherently selected for that project even when
+        // an older file has no explicit Projects list.
+        if (personality.scope === 'project')
+            return true;
+        if (!workspaceRoot || !personality.projects?.length)
+            return false;
+        const projectName = basename(workspaceRoot);
+        return personality.projects.some(pattern => globMatchesProject(pattern, projectName));
+    }
+    return true;
+}
+/** Concrete tool names that may be advertised for a structured custom bot. */
+export function getPersonalityToolAllowlist(personality, registeredMcpToolNames = new Set()) {
+    if (!personality.restrictTools)
+        return undefined;
+    const allowed = new Set();
+    if (personality.tools?.includes('files'))
+        FILE_TOOLS.forEach(tool => allowed.add(tool));
+    if (personality.tools?.includes('terminal') || personality.tools?.includes('tests') || personality.tools?.includes('git')) {
+        allowed.add('execute_command');
+    }
+    if (personality.tools?.includes('web'))
+        WEB_TOOLS.forEach(tool => allowed.add(tool));
+    if (personality.tools?.includes('mcp'))
+        registeredMcpToolNames.forEach(tool => allowed.add(tool));
+    return [...allowed];
+}
+function commandName(toolCall) {
+    const value = String(toolCall.parameters.command ?? '').trim();
+    return basename(value.replace(/\\/g, '/')).toLowerCase().replace(/\.(exe|cmd|bat)$/i, '');
+}
+function commandArgs(toolCall) {
+    const raw = toolCall.parameters.args;
+    return Array.isArray(raw) ? raw.map(String) : [];
+}
+function isTestCommand(toolCall) {
+    const command = commandName(toolCall);
+    const args = commandArgs(toolCall).map(value => value.toLowerCase());
+    if (['pytest', 'vitest', 'jest', 'playwright', 'cypress', 'phpunit'].includes(command))
+        return true;
+    if (command === 'go')
+        return args[0] === 'test';
+    if (command === 'cargo' || command === 'swift' || command === 'dotnet')
+        return args[0] === 'test';
+    if (command === 'python' || command === 'python3')
+        return args[0] === '-m' && ['pytest', 'unittest'].includes(args[1] ?? '');
+    if (['npm', 'pnpm', 'yarn', 'bun'].includes(command)) {
+        return args[0] === 'test' || (args[0] === 'run' && /^(test|check)(:|$)/.test(args[1] ?? ''));
+    }
+    if (command === 'npx')
+        return ['vitest', 'jest', 'playwright', 'cypress'].includes(args[0] ?? '');
+    if (command === 'mvn' || command === 'mvnw')
+        return args.some(arg => ['test', 'verify'].includes(arg));
+    if (command === 'gradle' || command === 'gradlew')
+        return args.some(arg => /(^|:)test$/.test(arg));
+    if (command === 'xcodebuild')
+        return args.includes('test');
+    return false;
+}
+const SAFE_GIT_SUBCOMMANDS = new Set([
+    'add', 'am', 'apply', 'blame', 'branch', 'cat-file', 'check-attr',
+    'check-ignore', 'checkout', 'cherry-pick', 'clean', 'commit',
+    'count-objects', 'describe', 'diff', 'fetch', 'for-each-ref',
+    'format-patch', 'fsck', 'grep', 'init', 'log', 'ls-files', 'ls-remote',
+    'ls-tree', 'merge', 'merge-base', 'mv', 'name-rev', 'pull', 'push',
+    'range-diff', 'rebase', 'reflog', 'remote', 'reset', 'restore', 'revert',
+    'rev-list', 'rev-parse', 'rm', 'shortlog', 'show', 'show-branch',
+    'sparse-checkout', 'stash', 'status', 'switch', 'symbolic-ref', 'tag',
+    'update-index', 'update-ref', 'whatchanged',
+]);
+function hasOption(args, ...options) {
+    return args.some(arg => options.some(option => arg === option || arg.startsWith(option + '=')));
+}
+function hasInlineOption(args, ...options) {
+    return args.some(arg => options.some(option => arg.startsWith(option + '=')));
+}
+function hasAttachedShortOption(args, option) {
+    return args.some(arg => arg.startsWith(option) && arg.length > option.length);
+}
+/**
+ * Git can dispatch arbitrary `git-<name>` executables and has several options
+ * that deliberately execute shell commands. A Git-only bot therefore uses a
+ * conservative built-in allowlist instead of trusting the executable name.
+ */
+function isRestrictedGitCommandAllowed(toolCall) {
+    const executable = commandName(toolCall);
+    const args = commandArgs(toolCall);
+    if (executable !== 'git')
+        return false;
+    if (args.length === 0)
+        return false;
+    // Global config/dispatch controls. `-C` is also denied: it can move Git
+    // outside the workspace before any subcommand runs.
+    if (args.some(arg => arg === '-c' || (arg.startsWith('-c') && arg.length > 2)
+        || arg === '-C' || (arg.startsWith('-C') && arg.length > 2)
+        || hasOption([arg], '--config-env', '--exec-path', '--git-dir', '--work-tree', '--namespace')))
+        return false;
+    // Only harmless global flags may precede the subcommand. Everything else
+    // fails closed so an unknown global option cannot change executable lookup.
+    let index = 0;
+    const safeGlobal = new Set([
+        '--no-pager', '--no-replace-objects', '--literal-pathspecs',
+        '--glob-pathspecs', '--noglob-pathspecs', '--icase-pathspecs',
+    ]);
+    while (index < args.length && args[index].startsWith('-')) {
+        if (args[index] === '--version' && args.length === 1)
+            return true;
+        if (!safeGlobal.has(args[index]))
+            return false;
+        index++;
+    }
+    const subcommand = args[index]?.toLowerCase();
+    if (!subcommand)
+        return false;
+    const rest = args.slice(index + 1);
+    const restLower = rest.map(arg => arg.toLowerCase());
+    // Custom aliases and helpers are executable programs. Unknown subcommands
+    // are denied by the allowlist below; these explicit names document the
+    // high-risk surfaces and guard future allowlist expansion.
+    if (['config', 'alias', 'difftool', 'mergetool', 'filter-branch', 'credential', 'help', 'web--browse', 'instaweb'].includes(subcommand)) {
+        return false;
+    }
+    // Reject flags that launch a shell/helper/editor/signing program or replace
+    // the remote-side Git binary. `ext::` and unknown `scheme::` URLs dispatch
+    // remote-helper executables, so they are denied too.
+    if (hasOption(rest, '--exec', '--config-env', '--ext-diff', '--textconv', '--upload-pack', '--receive-pack', '--open-files-in-pager', '--show-signature', '--gpg-sign', '--local-user', '--edit-description', 
+    // These embed filesystem paths in an option token. The generic command
+    // validator deliberately skips option-shaped args, so a restricted Git
+    // bot must reject them here rather than accidentally writing outside the
+    // workspace (for example `diff --output=/tmp/result`).
+    '--unsafe-paths', '--separate-git-dir', '--output', '--output-directory', '--directory', '--pathspec-from-file', '--template', '--index-output', '--object-directory', '--alternate-refs-command', '--contents', '--build-fake-ancestor', '--mailmap-file', '--signature-file'))
+        return false;
+    // Long `--file=/outside` and attached short path/editor variants bypass the
+    // generic shell path check because the entire argument begins with `-`.
+    if (hasInlineOption(rest, '--file'))
+        return false;
+    if (subcommand === 'format-patch' && (rest.includes('-o') || hasAttachedShortOption(rest, '-o')))
+        return false;
+    if (subcommand === 'init' && (rest.includes('-t') || hasAttachedShortOption(rest, '-t')))
+        return false;
+    if (['fetch', 'pull', 'ls-remote'].includes(subcommand) && (rest.includes('-u') || hasAttachedShortOption(rest, '-u')))
+        return false;
+    if (subcommand === 'grep' && (rest.includes('-O') || hasAttachedShortOption(rest, '-O')
+        || hasAttachedShortOption(rest, '-f')))
+        return false;
+    if (rest.some(arg => /^-[S]($|.)/.test(arg)))
+        return false;
+    if (rest.some(arg => {
+        const match = arg.match(/^([a-z][a-z0-9+.-]*)::/i);
+        return match ? !['http', 'https', 'ssh', 'git', 'file'].includes(match[1].toLowerCase()) : false;
+    }))
+        return false;
+    if (subcommand === 'submodule') {
+        const operation = restLower.find(arg => !arg.startsWith('-'));
+        return operation === undefined || operation === 'status' || operation === 'summary';
+    }
+    if (subcommand === 'bisect') {
+        const operation = restLower.find(arg => !arg.startsWith('-'));
+        return operation !== 'run' && ['start', 'bad', 'good', 'new', 'old', 'reset', 'log', 'terms'].includes(operation ?? '');
+    }
+    if (subcommand === 'rebase') {
+        if (rest.some(arg => arg === '-x' || arg.startsWith('-x') || arg === '-i'))
+            return false;
+        if (hasOption(rest, '--exec', '--interactive', '--edit-todo', '--strategy'))
+            return false;
+        if (rest.includes('-s'))
+            return false;
+        if (rest.includes('--continue'))
+            return false; // may launch the configured editor
+    }
+    if (['merge', 'cherry-pick', 'revert'].includes(subcommand)) {
+        if (hasOption(rest, '--strategy'))
+            return false;
+        if (rest.includes('-s'))
+            return false;
+        if (hasOption(rest, '--edit') || rest.includes('-e'))
+            return false;
+    }
+    if (subcommand === 'merge') {
+        const avoidsEditor = hasOption(rest, '--no-edit', '--message')
+            || rest.some(arg => arg === '-m' || arg.startsWith('-m'))
+            || rest.some(arg => ['--ff-only', '--squash', '--no-commit', '--abort', '--quit'].includes(arg));
+        if (!avoidsEditor)
+            return false;
+    }
+    if (subcommand === 'pull') {
+        if (hasOption(rest, '--edit') || rest.includes('-e') || rest.includes('--rebase=interactive'))
+            return false;
+        const avoidsEditor = hasOption(rest, '--no-edit')
+            || rest.includes('--ff-only')
+            || rest.includes('--rebase')
+            || rest.includes('-r')
+            || rest.some(arg => ['--rebase=true', '--rebase=merges', '--rebase=preserve'].includes(arg));
+        if (!avoidsEditor)
+            return false;
+    }
+    if (subcommand === 'revert') {
+        const avoidsEditor = hasOption(rest, '--no-edit', '--no-commit')
+            || rest.includes('-n')
+            || rest.some(arg => ['--abort', '--quit'].includes(arg));
+        if (!avoidsEditor)
+            return false;
+    }
+    if (subcommand === 'commit') {
+        if (rest.includes('-e') || rest.includes('--edit'))
+            return false;
+        if (hasOption(rest, '--reedit-message'))
+            return false;
+        // A bare commit launches core.editor, which may itself be an arbitrary
+        // shell command. Git-only bots must supply a message (or reuse one).
+        if (hasAttachedShortOption(rest, '-F') || rest.includes('-t') || hasAttachedShortOption(rest, '-t'))
+            return false;
+        const hasMessage = rest.some(arg => arg === '-m' || arg.startsWith('-m') || arg === '-F')
+            || hasOption(rest, '--message', '--file', '--reuse-message')
+            || rest.includes('--no-edit');
+        if (!hasMessage)
+            return false;
+    }
+    if (subcommand === 'tag') {
+        if (hasOption(rest, '--sign') || rest.includes('-s') || rest.includes('-u') || hasAttachedShortOption(rest, '-u'))
+            return false;
+        const annotated = rest.includes('-a') || rest.includes('--annotate');
+        if (hasAttachedShortOption(rest, '-F'))
+            return false;
+        const hasMessage = rest.some(arg => arg === '-m' || arg.startsWith('-m') || arg === '-F')
+            || hasOption(rest, '--message', '--file');
+        if (annotated && !hasMessage)
+            return false; // otherwise Git launches an editor
+    }
+    return SAFE_GIT_SUBCOMMANDS.has(subcommand);
+}
+/** Runtime gate. It is deliberately stricter than the prompt/tool catalog. */
+export function isPersonalityToolCallAllowed(personality, toolCall, registeredMcpToolNames = new Set()) {
+    if (!personality.restrictTools)
+        return true;
+    const tool = toolCall.tool.toLowerCase().replace(/-/g, '_');
+    if (FILE_TOOLS.includes(tool))
+        return personality.tools?.includes('files') === true;
+    if (WEB_TOOLS.includes(tool))
+        return personality.tools?.includes('web') === true;
+    if (tool === 'execute_command') {
+        if (personality.tools?.includes('terminal'))
+            return true;
+        const command = commandName(toolCall);
+        if (personality.tools?.includes('git') && isRestrictedGitCommandAllowed(toolCall))
+            return true;
+        if (personality.tools?.includes('tests') && isTestCommand(toolCall))
+            return true;
+        return false;
+    }
+    if (registeredMcpToolNames.has(toolCall.tool))
+        return personality.tools?.includes('mcp') === true;
+    // Skills, delegation, vision, and future tools are denied until a portable
+    // schema adds a capability that can classify them without guessing.
+    return false;
+}
+/** Resolve an exact provider/model preference without mutating global config. */
+export function resolvePersonalityRuntimeModel(personality, current) {
+    const preference = personality.modelPreference?.trim();
+    if (!personality.structured || !preference || preference.toLowerCase() === 'automatic')
+        return null;
+    // v1 deliberately requires an exact provider/model pair. Invalid bots are
+    // unavailable at activation time; keep this guard for callers holding a
+    // stale parsed object from before a file changed.
+    if (!isPersonalityModelPreferenceValid(personality))
+        return null;
+    const exact = exactModelPreference(preference);
+    if (!exact)
+        return null;
+    const { providerId, model } = exact;
+    const provider = getProvider(providerId);
+    if (!provider)
+        return null;
+    const protocol = providerId === current.providerId && provider.protocols[current.protocol]
+        ? current.protocol
+        : provider.defaultProtocol;
+    return { providerId, model, protocol };
+}
 export function loadAllPersonalities(workspaceRoot) {
     const project = workspaceRoot
         ? loadFromDir(join(workspaceRoot, '.codeep', 'personalities'), 'project')
@@ -187,7 +700,12 @@ export function loadAllPersonalities(workspaceRoot) {
 }
 export function findPersonality(name, workspaceRoot) {
     const lower = name.toLowerCase();
-    return loadAllPersonalities(workspaceRoot).find((p) => p.name === lower) ?? null;
+    const personality = loadAllPersonalities(workspaceRoot).find((p) => p.name === lower) ?? null;
+    return personality && isPersonalityAvailable(personality, workspaceRoot) ? personality : null;
+}
+export function getActivePersonality(workspaceRoot) {
+    const name = config.get('activePersonality');
+    return name ? findPersonality(name, workspaceRoot) : null;
 }
 /**
  * Returns the prompt addendum for the currently active personality, or
@@ -196,29 +714,63 @@ export function findPersonality(name, workspaceRoot) {
  * project rules conflict.
  */
 export function getActivePersonalityPrompt(workspaceRoot) {
-    const name = config.get('activePersonality');
-    if (!name)
-        return '';
-    const p = findPersonality(name, workspaceRoot);
-    return p?.prompt ?? '';
+    return getActivePersonality(workspaceRoot)?.prompt ?? '';
+}
+export function formatPersonalityActivation(personality) {
+    const lines = [
+        `Active personality: **${personality.displayName}** (\`${personality.name}\`, ${personality.scope})`,
+        '',
+        `_${personality.description}_`,
+    ];
+    if (personality.structured) {
+        const model = personality.modelPreference?.toLowerCase() === 'automatic'
+            ? 'Automatic (inherits the current model)'
+            : personality.modelPreference || 'Automatic';
+        const tools = personality.restrictTools
+            ? (personality.declaredTools?.join(', ') || 'none')
+            : 'Unrestricted';
+        lines.push('', `**Model:** ${model} · **Tools:** ${tools} · **Availability:** ${personality.projectScope ?? 'unspecified'}`);
+        // Granting Git without Files still exposes committed file contents:
+        // `git show HEAD:secrets.env` is functionally `cat secrets.env`, and
+        // history inspection cannot be separated from the content it inspects.
+        // Say so where the capability is shown, rather than implying otherwise.
+        if (personality.restrictTools
+            && personality.tools?.includes('git')
+            && !personality.tools.includes('files')) {
+            lines.push('', '_Note: Git is not read-only. It reads committed file contents (`git show HEAD:file`) and can stage, commit and push changes (`git rm`, `git commit`, `git push`). Grant it only if this bot may do both._');
+        }
+    }
+    lines.push('', 'Clear with `/personality off`.');
+    return lines.join('\n');
 }
 export function formatPersonalityList(workspaceRoot) {
     const list = loadAllPersonalities(workspaceRoot);
     const active = config.get('activePersonality');
     const lines = ['## Personalities', ''];
-    if (active) {
+    const activeEntry = active ? list.find(personality => personality.name === active) : undefined;
+    const activeAvailable = activeEntry ? isPersonalityAvailable(activeEntry, workspaceRoot) : false;
+    if (active && activeAvailable) {
         lines.push(`**Active:** \`${active}\` — switch with \`/personality <name>\` or clear with \`/personality off\`.`);
     }
+    else if (active) {
+        lines.push(`**Configured:** \`${active}\` is not available in this workspace, so the agent uses default behavior here.`);
+    }
     else {
         lines.push('**Active:** _(none — agent uses default tone)_');
     }
     lines.push('');
-    lines.push('| Name | Scope | Description |');
-    lines.push('|---|---|---|');
+    lines.push('| Name | Scope | Model | Tools | Description |');
+    lines.push('|---|---|---|---|---|');
+    const cell = (value) => value.replace(/\r?\n/g, ' ').replace(/\|/g, '\\|');
     for (const p of list) {
         const tag = p.scope === 'builtin' ? 'built-in' : p.scope;
-        const marker = active === p.name ? ' ✓' : '';
-        lines.push(`| \`${p.name}\`${marker} | ${tag} | ${p.description} |`);
+        const marker = active === p.name && activeAvailable ? ' ✓' : '';
+        const available = isPersonalityAvailable(p, workspaceRoot);
+        const scopeLabel = p.projectScope && p.projectScope !== 'unspecified' ? ` · ${p.projectScope}` : '';
+        const availability = available ? '' : ' _(not available here)_';
+        const model = p.structured ? (p.modelPreference || 'automatic') : 'inherit';
+        const tools = p.restrictTools ? (p.declaredTools?.join(', ') || 'none') : 'unrestricted';
+        lines.push(`| \`${p.name}\`${marker} | ${cell(tag + scopeLabel)} | ${cell(model)} | ${cell(tools)} | ${cell(p.description)}${availability} |`);
     }
     lines.push('');
     lines.push('Drop a `<name>.md` file into `.codeep/personalities/` (project) or `~/.codeep/personalities/` (global) to add your own — first `#` line becomes the display name, body becomes the prompt addendum.');