codeep 3.3.3 → 3.4.1

package/dist/utils/skills.d.ts

@@ -6,6 +6,12 @@ export interface SkillStep {
     type: 'prompt' | 'command' | 'confirm' | 'notify' | 'agent';
     content: string;
     optional?: boolean;
+    /**
+     * A parameter that stands in for this step. When the user gives it, the
+     * step does not run and the parameter's value becomes the step's output —
+     * `${_prev}` for the steps after it.
+     */
+    skipIf?: string;
 }
 export interface SkillParameter {
     name: string;
@@ -41,10 +47,25 @@ export interface SkillChain {
  * Get all built-in skills
  */
 export declare function getBuiltInSkills(): Skill[];
+/** A custom skill file that could not be used, and why. */
+export interface SkippedSkillFile {
+    file: string;
+    problem: string;
+}
 /**
  * Load custom skills from disk
  */
 export declare function loadCustomSkills(): Skill[];
+/** Custom skill files the latest load could not use. */
+export declare function getSkippedCustomSkills(): SkippedSkillFile[];
+/** One line per skipped file, naming where it is and what is wrong with it. */
+export declare function formatSkippedCustomSkills(skipped: SkippedSkillFile[]): string;
+/**
+ * Whether ~/.codeep/skills/<name>.json exists, whether or not it loads. A
+ * file that fails to load is invisible to findSkill, and creating a skill of
+ * that name would write over what the user wrote by hand.
+ */
+export declare function customSkillFileExists(name: string): boolean;
 /**
  * Get all skills (built-in + custom)
  */
@@ -99,14 +120,15 @@ export interface SkillExecutionCallbacks {
 }
 /**
  * Execute a skill's steps sequentially.
- * Each step's output is available as ${_prev} in the next step's content.
+ * The latest command, prompt or agent output is available as ${_prev} in later
+ * steps' content; confirm and notify steps leave it unchanged.
  * Returns the collected results from all steps.
  */
 export declare function executeSkill(skill: Skill, params: Record<string, string>, callbacks: SkillExecutionCallbacks): Promise<SkillExecutionResult>;
 /**
  * Format skills list for display
  */
-export declare function formatSkillsList(skills: Skill[]): string;
+export declare function formatSkillsList(skills: Skill[], skipped?: SkippedSkillFile[]): string;
 /**
  * Format skill help
  */

package/dist/utils/skills.js

@@ -1,9 +1,10 @@
 /**
  * Skills System - predefined workflows and commands
  */
-import { existsSync, readFileSync, writeFileSync, mkdirSync, readdirSync } from 'fs';
-import { join } from 'path';
+import { existsSync, readFileSync, writeFileSync, mkdirSync, readdirSync, unlinkSync } from 'fs';
+import { dirname, join, resolve } from 'path';
 import { homedir } from 'os';
+import { logger } from './logger.js';
 // Skills directory
 const SKILLS_DIR = join(homedir(), '.codeep', 'skills');
 const SKILLS_HISTORY_FILE = join(homedir(), '.codeep', 'skill-history.json');
@@ -21,8 +22,8 @@ const BUILT_IN_SKILLS = [
         ],
         steps: [
             { type: 'command', content: 'git diff --cached --stat || git diff --stat' },
-            { type: 'prompt', content: 'Based on this git diff, generate ONLY a conventional commit message (no explanation, no markdown). Format: type(scope): description. Types: feat, fix, docs, style, refactor, test, chore. Be concise. One line only.\n\n${_prev}' },
-            { type: 'confirm', content: 'Commit with this message?' },
+            { type: 'prompt', content: 'Based on this git diff, generate ONLY a conventional commit message (no explanation, no markdown). Format: type(scope): description. Types: feat, fix, docs, style, refactor, test, chore. Be concise. One line only.\n\n${_prev}', skipIf: 'message' },
+            { type: 'confirm', content: 'Commit with this message? ${_prev}' },
             { type: 'command', content: 'git add -A && git commit -m "${_prev}"' },
             { type: 'notify', content: 'Changes committed successfully!' },
         ],
@@ -88,9 +89,9 @@ const BUILT_IN_SKILLS = [
             { name: 'description', description: 'What the branch is for', required: true },
         ],
         steps: [
-            { type: 'prompt', content: 'Based on the description "${description}", suggest a branch name following convention: type/short-description. Types: feature, fix, hotfix, refactor, chore.' },
+            { type: 'prompt', content: 'Based on the description "${description}", suggest a branch name following convention: type/short-description. Types: feature, fix, hotfix, refactor, chore. Reply with ONLY the branch name (no explanation, no markdown).' },
             { type: 'confirm', content: 'Create this branch?' },
-            { type: 'command', content: 'git checkout -b ${branch}' },
+            { type: 'command', content: 'git checkout -b "${_prev}"' },
         ],
     },
     {
@@ -99,8 +100,8 @@ const BUILT_IN_SKILLS = [
         category: 'git',
         requiresGit: true,
         steps: [
-            { type: 'prompt', content: 'Analyze the current changes and suggest a meaningful stash message.' },
-            { type: 'command', content: 'git stash push -m "${message}"' },
+            { type: 'prompt', content: 'Analyze the current changes and suggest a meaningful stash message. Reply with ONLY the message, one line (no explanation, no markdown).' },
+            { type: 'command', content: 'git stash push -m "${_prev}"' },
             { type: 'notify', content: 'Changes stashed!' },
         ],
     },
@@ -607,27 +608,104 @@ function ensureSkillsDir() {
 export function getBuiltInSkills() {
     return BUILT_IN_SKILLS;
 }
+function isValidCustomSkill(value) {
+    if (!value || typeof value !== 'object' || Array.isArray(value))
+        return false;
+    const s = value;
+    return typeof s.name === 'string'
+        && typeof s.description === 'string'
+        && Array.isArray(s.steps)
+        && (s.shortcut === undefined || typeof s.shortcut === 'string');
+}
+// What the latest load passed over. Kept so the places a user looks — the
+// "Unknown command" reply, /skills — can name the file; the log alone is
+// somewhere nobody reads while wondering where their skill went.
+let skippedSkillFiles = [];
+// Every lookup reloads the directory; log each bad file once, not per lookup.
+const loggedSkippedFiles = new Set();
 /**
  * Load custom skills from disk
  */
 export function loadCustomSkills() {
     ensureSkillsDir();
     const skills = [];
+    const skipped = [];
+    const skip = (file, problem) => {
+        skipped.push({ file, problem });
+        if (!loggedSkippedFiles.has(file)) {
+            loggedSkippedFiles.add(file);
+            logger.warn(`Skipping custom skill ${file}: ${problem}`);
+        }
+    };
     try {
         const files = readdirSync(SKILLS_DIR).filter(f => f.endsWith('.json'));
         for (const file of files) {
+            let content;
+            let skill;
+            try {
+                content = readFileSync(join(SKILLS_DIR, file), 'utf-8');
+            }
+            catch {
+                skip(file, 'could not be read');
+                continue;
+            }
             try {
-                const content = readFileSync(join(SKILLS_DIR, file), 'utf-8');
-                const skill = JSON.parse(content);
-                skill.category = 'custom';
-                skills.push(skill);
+                skill = JSON.parse(content);
             }
-            catch { }
+            catch {
+                skip(file, 'not valid JSON');
+                continue;
+            }
+            // These files are edited by hand. One entry without a string name
+            // would make every lookup that reaches it throw, taking down all
+            // custom skills and the "Unknown command" reply with it.
+            if (!isValidCustomSkill(skill)) {
+                skip(file, 'needs a string "name" and "description" and a "steps" array');
+                continue;
+            }
+            skill.category = 'custom';
+            skills.push(skill);
         }
     }
     catch { }
+    skippedSkillFiles = skipped;
     return skills;
 }
+/** Custom skill files the latest load could not use. */
+export function getSkippedCustomSkills() {
+    return [...skippedSkillFiles];
+}
+/** One line per skipped file, naming where it is and what is wrong with it. */
+export function formatSkippedCustomSkills(skipped) {
+    return skipped
+        .map(s => `Skipped ~/.codeep/skills/${s.file} — ${s.problem}. Fix or delete the file.`)
+        .join('\n');
+}
+/**
+ * Whether ~/.codeep/skills/<name>.json exists, whether or not it loads. A
+ * file that fails to load is invisible to findSkill, and creating a skill of
+ * that name would write over what the user wrote by hand.
+ */
+export function customSkillFileExists(name) {
+    const filepath = customSkillFile(name);
+    return filepath !== null && existsSync(filepath);
+}
+/**
+ * ~/.codeep/skills/<name>.json, or null when the name would put the file
+ * anywhere else. Names come straight from `/skill create|delete <name>`, and
+ * `../mcp_servers` would otherwise reach ~/.codeep/mcp_servers.json.
+ */
+function customSkillFile(name) {
+    if (typeof name !== 'string' || !name.trim())
+        return null;
+    if (/[\\/]/.test(name))
+        return null;
+    // eslint-disable-next-line no-control-regex
+    if (/[\x00-\x1f]/.test(name))
+        return null;
+    const filepath = join(SKILLS_DIR, `${name}.json`);
+    return dirname(resolve(filepath)) === resolve(SKILLS_DIR) ? filepath : null;
+}
 /**
  * Get all skills (built-in + custom)
  */
@@ -672,19 +750,29 @@ export function parseSkillChain(input) {
 export function parseSkillArgs(args, skill) {
     const result = {};
     // Pattern to match key=value or key="value with spaces" or just "value"
-    const keyValuePattern = /(\w+)=(?:"([^"]+)"|'([^']+)'|(\S+))/g;
+    const keyValuePattern = /(?<!\S)(\w+)=(?:"([^"]+)"|'([^']+)'|(\S+))/g;
     const quotedPattern = /^["'](.+)["']$/;
+    // A skill that declares parameters takes only those as key=value; any other
+    // `word=value` is part of the text for its first parameter — "fix: set
+    // retries=3 by default" is a commit message, not a `retries` parameter.
+    const declared = skill.parameters && skill.parameters.length > 0
+        ? new Set(skill.parameters.map(p => p.name))
+        : null;
     // First, try to parse key=value pairs
     let match;
     let remainingArgs = args;
     while ((match = keyValuePattern.exec(args)) !== null) {
         const key = match[1];
+        if (declared && !declared.has(key))
+            continue;
         const value = match[2] || match[3] || match[4];
         result[key] = value;
         remainingArgs = remainingArgs.replace(match[0], '').trim();
     }
-    // If there's remaining text and skill has parameters, use as first param
-    if (remainingArgs.trim() && skill.parameters && skill.parameters.length > 0) {
+    // If there's remaining text and skill has parameters, use as first param —
+    // unless that one was given as key=value, which is the more explicit of the two
+    if (remainingArgs.trim() && skill.parameters && skill.parameters.length > 0
+        && result[skill.parameters[0].name] === undefined) {
         const firstParam = skill.parameters[0];
         // Check if it's quoted
         const quotedMatch = remainingArgs.match(quotedPattern);
@@ -705,22 +793,53 @@ export function parseSkillArgs(args, skill) {
     }
     return result;
 }
+// Only the first line is used, and a commit message, branch name or stash
+// message never needs more than this. The cap also bounds the regexes below:
+// an unclosed fence or a run of unclosed `$(` in a long reply made them
+// quadratic.
+const SHELL_TEXT_MAX = 8192;
 /**
- * Sanitize text for safe use inside shell commands.
- * Strips markdown formatting and removes shell metacharacters to prevent
- * command injection via $(), backtick subshells, semicolons, pipes, etc.
+ * Sanitize model output for use inside a double-quoted shell string —
+ * `"${_prev}"`. Takes the first line of the reply (markdown removed), drops
+ * shell syntax and escapes it for that position.
+ *
+ * Only the double quotes make it safe. Unquoted, the result can still carry
+ * spaces, globs, redirects and (outside Windows) `&`.
  */
-function sanitizeForShell(text) {
-    const firstLine = text
-        // Strip markdown code blocks
-        .replace(/```[\s\S]*?```/g, '')
+function sanitizeForShell(text, platform = process.platform) {
+    return quoteForDoubleQuotes(modelTextForShell(text, platform), platform);
+}
+/** The part of a model reply that `"${_prev}"` hands to a command, unescaped. */
+function modelTextForShell(text, platform) {
+    const capped = text.slice(0, SHELL_TEXT_MAX);
+    const firstLine = capped
+        // Unwrap fenced code blocks, keeping their content — models often fence a
+        // one-line answer even when told not to, and dropping the block would
+        // leave nothing but the raw fallback below
+        .replace(/```[^\n]{0,100}\n?([\s\S]*?)```/g, '$1')
         // Strip inline backtick code spans (remove content too, not just markers)
         .replace(/`[^`]*`/g, '')
         // Strip bold/italic markers
         .replace(/\*{1,3}([^*]+)\*{1,3}/g, '$1')
         // Take only the first non-empty line
-        .split('\n').map(l => l.trim()).filter(Boolean)[0] || text.trim();
-    return firstLine
+        .split('\n').map(l => l.trim()).filter(Boolean)[0] || capped.trim();
+    // The escaping must hold on its own: the fallback above hands back the raw
+    // text, so nothing can rely on the markdown stripping having happened.
+    return plainTextForShell(stripShellSyntax(firstLine, platform), platform);
+}
+/**
+ * Remove shell syntax from model output. On POSIX this is not what makes it
+ * safe — the escaping does that — but kept for templates that leave
+ * `${_prev}` unquoted, which it only partly protects.
+ *
+ * On Windows it is what makes it safe. `shell: true` runs cmd.exe there,
+ * which takes no backslash escapes: every `"` opens or closes quoting, so a
+ * reply could close the string and chain a command. Model output loses the
+ * characters cmd.exe acts on outright.
+ */
+function stripShellSyntax(text, platform) {
+    const stripped = text
+        .slice(0, SHELL_TEXT_MAX)
         // Remove $(...) subshell expansion
         .replace(/\$\([^)]*\)/g, '')
         // Remove ${...} variable/subshell expansion
@@ -729,11 +848,39 @@ function sanitizeForShell(text) {
         .replace(/\$\w+/g, '')
         // Remove command chaining operators
         .replace(/[;|]/g, '')
-        // Remove newlines and null bytes
-        .replace(/[\n\r\0]/g, ' ')
-        // Escape double quotes for safe embedding in "..." shell strings
-        .replace(/"/g, '\\"')
-        .trim();
+        // Backticks run a command even inside "..." shell strings
+        .replace(/`/g, '');
+    return platform === 'win32' ? stripped.replace(/["&|<>^%]/g, '') : stripped;
+}
+/**
+ * The text a double-quoted `"${_prev}"` passes on: one line, and on Windows
+ * without `"` and `%`. cmd.exe cannot keep those inside quotes — a `"` ends
+ * them and `%NAME%` expands even there. With no `"` left to end the quotes,
+ * the rest (`&`, `|`, `<`, `>`, `^`) is plain text to cmd.exe.
+ */
+function plainTextForShell(text, platform) {
+    const line = text.slice(0, SHELL_TEXT_MAX).replace(/[\n\r\0]/g, ' ');
+    return (platform === 'win32' ? line.replace(/["%]/g, '') : line).trim();
+}
+/** Escape text from plainTextForShell for the inside of a double-quoted shell string. */
+function quoteForDoubleQuotes(text, platform) {
+    if (platform === 'win32') {
+        // cmd.exe passes backslashes on as they are, and the program's own
+        // argument parsing reads backslashes right before the closing quote as
+        // escaping it. Doubled, they stay backslashes and the quote closes.
+        let end = text.length;
+        while (end > 0 && text[end - 1] === '\\')
+            end--;
+        return text + text.slice(end);
+    }
+    // Escape what is still special inside "..." for sh. A backslash left alone
+    // would escape the backslash added before a quote, and that quote would
+    // then close the string early.
+    return text.replace(/[\\"$`]/g, '\\$&');
+}
+/** Escape text so a double-quoted shell string holds it literally. */
+function escapeForDoubleQuotes(text, platform = process.platform) {
+    return quoteForDoubleQuotes(plainTextForShell(text, platform), platform);
 }
 /**
  * Interpolate parameters into skill step content
@@ -753,18 +900,23 @@ export function interpolateParams(content, params) {
  * Save a custom skill
  */
 export function saveCustomSkill(skill) {
+    const filepath = customSkillFile(skill.name);
+    if (!filepath) {
+        throw new Error(`Skill name "${skill.name}" is not allowed: it cannot be empty or contain "/", "\\" or control characters.`);
+    }
     ensureSkillsDir();
     skill.category = 'custom';
-    const filename = `${skill.name}.json`;
-    writeFileSync(join(SKILLS_DIR, filename), JSON.stringify(skill, null, 2));
+    writeFileSync(filepath, JSON.stringify(skill, null, 2));
 }
 /**
  * Delete a custom skill
  */
 export function deleteCustomSkill(name) {
-    const filepath = join(SKILLS_DIR, `${name}.json`);
+    const filepath = customSkillFile(name);
+    if (!filepath)
+        return false;
     if (existsSync(filepath)) {
-        require('fs').unlinkSync(filepath);
+        unlinkSync(filepath);
         return true;
     }
     return false;
@@ -802,16 +954,43 @@ export function getExecutableSteps(skill) {
 }
 /**
  * Execute a skill's steps sequentially.
- * Each step's output is available as ${_prev} in the next step's content.
+ * The latest command, prompt or agent output is available as ${_prev} in later
+ * steps' content; confirm and notify steps leave it unchanged.
  * Returns the collected results from all steps.
  */
 export async function executeSkill(skill, params, callbacks) {
     const stepResults = [];
     let lastOutput = '';
-    for (const step of skill.steps) {
+    // Whether lastOutput is text the user typed rather than a model reply.
+    let lastOutputIsUsers = false;
+    for (let i = 0; i < skill.steps.length; i++) {
+        const step = skill.steps[i];
+        // A parameter the user gave replaces the step outright — `/commit "msg"`
+        // commits "msg" instead of asking the model for a message.
+        const standIn = step.skipIf ? params[step.skipIf] : undefined;
+        if (standIn) {
+            if (step.type === 'command' || step.type === 'prompt' || step.type === 'agent') {
+                lastOutput = standIn;
+                lastOutputIsUsers = true;
+            }
+            stepResults.push({ step, result: standIn, success: true });
+            continue;
+        }
         // Interpolate params and ${_prev} into step content
-        // For command steps, sanitize _prev for safe shell usage
-        const sanitizedPrev = step.type === 'command' ? sanitizeForShell(lastOutput) : lastOutput;
+        // For command steps, sanitize _prev for safe shell usage. The user's own
+        // text is only escaped: it is not markdown to strip, and a `$5` or a `;`
+        // in a commit message is part of the message.
+        // A confirm step right before a command that uses ${_prev} shows the text
+        // that command will be given, so what the user approves is what runs.
+        const platform = process.platform;
+        const next = skill.steps[i + 1];
+        const approvesCommand = step.type === 'confirm'
+            && next?.type === 'command' && next.content.includes('${_prev}');
+        const sanitizedPrev = step.type === 'command'
+            ? (lastOutputIsUsers ? escapeForDoubleQuotes(lastOutput, platform) : sanitizeForShell(lastOutput, platform))
+            : approvesCommand
+                ? (lastOutputIsUsers ? plainTextForShell(lastOutput, platform) : modelTextForShell(lastOutput, platform))
+                : lastOutput;
         const allParams = { ...params, _prev: sanitizedPrev };
         const content = interpolateParams(step.content, allParams);
         try {
@@ -840,7 +1019,14 @@ export async function executeSkill(skill, params, callbacks) {
                     result = 'notified';
                     break;
             }
-            lastOutput = result;
+            // Only steps that produce something feed ${_prev}. A confirm or notify
+            // in between must pass the earlier output through — otherwise
+            // "generate message → confirm → git commit -m ${_prev}" commits the
+            // word "confirmed" instead of the message the user just approved.
+            if (step.type === 'command' || step.type === 'prompt' || step.type === 'agent') {
+                lastOutput = result;
+                lastOutputIsUsers = false;
+            }
             stepResults.push({ step, result, success: true });
         }
         catch (err) {
@@ -856,7 +1042,7 @@ export async function executeSkill(skill, params, callbacks) {
 /**
  * Format skills list for display
  */
-export function formatSkillsList(skills) {
+export function formatSkillsList(skills, skipped = getSkippedCustomSkills()) {
     const byCategory = new Map();
     for (const skill of skills) {
         const existing = byCategory.get(skill.category) || [];
@@ -893,6 +1079,11 @@ export function formatSkillsList(skills) {
     lines.push('## Skill Chaining');
     lines.push('Chain multiple skills with `+`: `/commit+push`, `/test+commit+push`');
     lines.push('');
+    if (skipped.length > 0) {
+        lines.push('## Not loaded');
+        lines.push(formatSkippedCustomSkills(skipped));
+        lines.push('');
+    }
     return lines.join('\n');
 }
 /**
@@ -926,7 +1117,8 @@ export function formatSkillHelp(skill) {
     lines.push('## Steps:');
     for (let i = 0; i < skill.steps.length; i++) {
         const step = skill.steps[i];
-        const optional = step.optional ? ' (optional)' : '';
+        const optional = (step.optional ? ' (optional)' : '')
+            + (step.skipIf ? ` (skipped when ${step.skipIf} is given)` : '');
         switch (step.type) {
             case 'prompt':
                 lines.push(`${i + 1}. AI Analysis${optional}`);
@@ -979,7 +1171,7 @@ export const WIZARD_STEPS = [
             if (!input.match(/^[a-z][a-z0-9-]*$/)) {
                 return 'Name must be lowercase letters, numbers, and hyphens. Must start with a letter.';
             }
-            if (findSkill(input)) {
+            if (findSkill(input) || customSkillFileExists(input)) {
                 return 'A skill with this name already exists.';
             }
             return null;
@@ -1213,7 +1405,7 @@ export function getSkillStats() {
 export function clearSkillHistory() {
     try {
         if (existsSync(SKILLS_HISTORY_FILE)) {
-            require('fs').unlinkSync(SKILLS_HISTORY_FILE);
+            unlinkSync(SKILLS_HISTORY_FILE);
         }
     }
     catch {

package/dist/utils/smartContext.js

@@ -1,13 +1,77 @@
 /**
  * Smart Context - automatically gather relevant files for better understanding
  */
-import { existsSync, readFileSync, statSync } from 'fs';
+import { existsSync, statSync, openSync, readSync, closeSync } from 'fs';
 import { join, dirname, basename, extname, relative } from 'path';
+import { StringDecoder } from 'string_decoder';
 import { loadIgnoreRules, isIgnored } from './gitignore.js';
+import { isRefusedMention, isSensitiveFile, looksLikeKeyMaterial, resolvesWithin } from './mentions.js';
 import { logger } from './logger.js';
 // Max context size (characters)
 const MAX_CONTEXT_SIZE = 50000;
 const MAX_FILES = 15;
+/**
+ * Read at most `maxBytes` of a file for the context block, or null when it
+ * isn't a regular text file or may hold secrets.
+ *
+ * statSync follows symlinks, so a repo that commits `tsconfig.json ->
+ * /dev/zero` (or a FIFO) is refused here: readFileSync on either never
+ * returns, and every agent run would freeze while memory climbs. Reading only
+ * the budget keeps a multi-MB log out of memory and out of the system prompt.
+ * The budget is in characters and a UTF-8 character is at least one byte, so
+ * the cut never overshoots it.
+ *
+ * Nothing here was named by the user as an attachment, and the result goes
+ * into the system prompt unseen. So a symlink is judged by what it points at
+ * (`.env.example -> .env`), it must stay inside the project (`tsconfig.json
+ * -> ~/.zsh_history`), and key material is refused whatever the file is called.
+ */
+function readContextFile(filePath, maxBytes, projectRoot) {
+    let fd;
+    try {
+        const stat = statSync(filePath);
+        if (!stat.isFile())
+            return null;
+        if (isSensitiveFile(filePath) || !resolvesWithin(filePath, projectRoot))
+            return null;
+        fd = openSync(filePath, 'r');
+        const buf = Buffer.alloc(Math.min(stat.size, Math.max(0, maxBytes)));
+        let read = 0;
+        while (read < buf.length) {
+            const n = readSync(fd, buf, read, buf.length - read, read);
+            if (n === 0)
+                break;
+            read += n;
+        }
+        const data = buf.subarray(0, read);
+        // Same binary sniff as @-mentions: a NUL byte in the first 8 KB.
+        if (data.subarray(0, 8192).includes(0))
+            return null;
+        // StringDecoder holds back a multi-byte character split by the cut
+        // instead of emitting a replacement character.
+        const content = new StringDecoder('utf8').write(data);
+        if (looksLikeKeyMaterial(content))
+            return null;
+        return {
+            content,
+            size: stat.size,
+            truncated: stat.size > read,
+        };
+    }
+    catch (err) {
+        logger.debug('smartContext: failed to read context file', { path: filePath, err: String(err) });
+        return null;
+    }
+    finally {
+        if (fd !== undefined) {
+            try {
+                closeSync(fd);
+            }
+            catch { /* already closed */ }
+        }
+    }
+}
+const TRUNCATED_MARKER = '\n... (truncated)';
 // File extensions we care about
 /**
  * Extract imports/requires from file content
@@ -280,14 +344,22 @@ export function gatherSmartContext(targetFile, projectContext, taskDescription)
     const projectRoot = projectContext.root || process.cwd();
     const ignoreRules = loadIgnoreRules(projectRoot);
     const allRelated = new Map();
+    let targetTruncated = false;
     // If we have a target file, analyze it
     if (targetFile) {
         const targetPath = join(projectRoot, targetFile);
-        if (existsSync(targetPath)) {
+        // A secrets file is never pulled in implicitly, not even read for its
+        // imports. The target is any path-like word in the prompt, including one
+        // left behind after the @-mention guard refused it, so `.env.local` would
+        // otherwise reach the provider without the user ever seeing it.
+        const target = existsSync(targetPath) && !isRefusedMention(targetPath)
+            ? readContextFile(targetPath, MAX_CONTEXT_SIZE, projectRoot)
+            : null;
+        if (target) {
             try {
-                const content = readFileSync(targetPath, 'utf-8');
+                const content = target.truncated ? target.content + TRUNCATED_MARKER : target.content;
                 const ext = extname(targetPath);
-                const stat = statSync(targetPath);
+                targetTruncated = target.truncated;
                 // Add the target file itself
                 allRelated.set(targetPath, {
                     path: targetPath,
@@ -295,13 +367,13 @@ export function gatherSmartContext(targetFile, projectContext, taskDescription)
                     reason: 'target file',
                     priority: 10,
                     content,
-                    size: stat.size,
+                    size: target.size,
                 });
                 // Extract and resolve imports
                 const imports = extractImports(content, ext);
                 for (const imp of imports) {
                     const resolved = resolveImportPath(imp, targetPath, projectRoot);
-                    if (resolved && !allRelated.has(resolved)) {
+                    if (resolved && !allRelated.has(resolved) && !isSensitiveFile(resolved)) {
                         try {
                             const impStat = statSync(resolved);
                             allRelated.set(resolved, {
@@ -365,31 +437,33 @@ export function gatherSmartContext(targetFile, projectContext, taskDescription)
         .slice(0, MAX_FILES);
     // Load content for files that don't have it
     let totalSize = 0;
-    let truncated = false;
+    let truncated = targetTruncated;
+    const unreadable = new Set();
     for (const file of files) {
         if (!file.content && totalSize < MAX_CONTEXT_SIZE) {
-            try {
-                const content = readFileSync(file.path, 'utf-8');
-                if (totalSize + content.length <= MAX_CONTEXT_SIZE) {
-                    file.content = content;
-                    totalSize += content.length;
-                }
-                else {
-                    // Truncate this file
-                    const remaining = MAX_CONTEXT_SIZE - totalSize;
-                    file.content = content.slice(0, remaining) + '\n... (truncated)';
-                    totalSize = MAX_CONTEXT_SIZE;
-                    truncated = true;
-                }
+            const read = readContextFile(file.path, MAX_CONTEXT_SIZE - totalSize, projectRoot);
+            if (!read) {
+                unreadable.add(file);
             }
-            catch (err) {
-                logger.debug('smartContext: readFileSync failed for context file', { path: file.path, err: String(err) });
+            else if (!read.truncated) {
+                file.content = read.content;
+                totalSize += read.content.length;
+            }
+            else {
+                // Truncate this file
+                file.content = read.content + TRUNCATED_MARKER;
+                totalSize = MAX_CONTEXT_SIZE;
+                truncated = true;
             }
         }
         else if (file.content) {
             totalSize += file.content.length;
         }
     }
+    // Devices, FIFOs and binaries were never readable context
+    if (unreadable.size > 0) {
+        files = files.filter(f => !unreadable.has(f));
+    }
     // Remove files without content if we're at limit
     if (truncated) {
         files = files.filter(f => f.content);
@@ -411,7 +485,7 @@ function extractMentionedFiles(task, projectRoot) {
     for (const match of matches) {
         const filePath = match[1];
         const fullPath = join(projectRoot, filePath);
-        if (existsSync(fullPath)) {
+        if (existsSync(fullPath) && !isRefusedMention(fullPath)) {
             try {
                 const stat = statSync(fullPath);
                 if (stat.isFile()) {