create-walle 0.9.21 → 0.9.23

package/template/claude-task-manager/session-integrity.js

@@ -15,12 +15,14 @@
 
 const fs = require('fs');
 const path = require('path');
+const crypto = require('crypto');
 const claudeDesktopSessions = require('./lib/claude-desktop-sessions');
 const {
   codexRolloutIdFromPath,
   findCodexSessionFiles,
   findCodexSessionFilesByFilename,
   findCodexStateRolloutPath,
+  readCodexRolloutMetadata,
 } = require('./lib/session-history');
 
 const CLAUDE_PROJECTS_DIR = path.join(process.env.HOME, '.claude', 'projects');
@@ -64,6 +66,42 @@ function isCodexSessionRow(row) {
     || String(row?.jsonl_path || '').includes(`${path.sep}.codex${path.sep}sessions${path.sep}`);
 }
 
+function providerChildThreadFields(row = {}) {
+  const threadSource = String(row.thread_source || row.threadSource || '').trim().toLowerCase();
+  const parentAgentSessionId = String(
+    row.parent_agent_session_id
+    || row.parentAgentSessionId
+    || row.parent_thread_id
+    || row.parentThreadId
+    || ''
+  ).trim();
+  return { threadSource, parentAgentSessionId };
+}
+
+function isProviderChildAgentRow(row = {}) {
+  const provider = String(row.provider || '').trim().toLowerCase();
+  const { threadSource, parentAgentSessionId } = providerChildThreadFields(row);
+  return provider === 'codex' && threadSource === 'subagent' && !!parentAgentSessionId;
+}
+
+function addAgentRowFileIds(dbFileIds, row = {}) {
+  if (row.id) dbFileIds.add(row.id);
+  if (row.agent_session_id) dbFileIds.add(row.agent_session_id);
+  const jsonlPath = String(row.jsonl_path || '').trim();
+  if (jsonlPath) {
+    const fileId = sessionFileIdFromPath(jsonlPath);
+    if (fileId) dbFileIds.add(fileId);
+    const rolloutId = codexRolloutIdFromPath(jsonlPath);
+    if (rolloutId) dbFileIds.add(rolloutId);
+    if (isCodexSessionRow(row)) {
+      try {
+        const meta = readCodexRolloutMetadata(jsonlPath) || {};
+        if (meta.id) dbFileIds.add(String(meta.id));
+      } catch {}
+    }
+  }
+}
+
 function resolveCodexCanonicalFile(expectedFileId, fileIndex) {
   if (!expectedFileId) return null;
   if (fileIndex[expectedFileId]) return fileIndex[expectedFileId];
@@ -291,18 +329,31 @@ function detectMismatches(db, getAllSessionFiles) {
     // Check first and select accordingly.
     let hasSlugColumn = false;
     let hasProviderResumeColumn = false;
+    let hasThreadSourceColumn = false;
+    let hasParentAgentSessionColumn = false;
+    let hasAgentNicknameColumn = false;
+    let hasAgentRoleColumn = false;
     try {
       const cols = db.prepare('PRAGMA table_info(agent_sessions)').all();
       hasSlugColumn = cols.some((c) => c.name === 'slug');
       hasProviderResumeColumn = cols.some((c) => c.name === 'provider_resume_id');
+      hasThreadSourceColumn = cols.some((c) => c.name === 'thread_source');
+      hasParentAgentSessionColumn = cols.some((c) => c.name === 'parent_agent_session_id');
+      hasAgentNicknameColumn = cols.some((c) => c.name === 'agent_nickname');
+      hasAgentRoleColumn = cols.some((c) => c.name === 'agent_role');
     } catch {}
     const slugCol = hasSlugColumn ? 'a.slug' : "'' AS slug";
     const providerResumeCol = hasProviderResumeColumn ? 'a.provider_resume_id' : "'' AS provider_resume_id";
+    const threadSourceCol = hasThreadSourceColumn ? 'a.thread_source' : "'' AS thread_source";
+    const parentAgentSessionCol = hasParentAgentSessionColumn ? 'a.parent_agent_session_id' : "'' AS parent_agent_session_id";
+    const agentNicknameCol = hasAgentNicknameColumn ? 'a.agent_nickname' : "'' AS agent_nickname";
+    const agentRoleCol = hasAgentRoleColumn ? 'a.agent_role' : "'' AS agent_role";
     allSessions = db.prepare(`
       SELECT c.id, c.provider, c.title, c.user_renamed, c.starred, c.project_path, c.cwd,
         c.created_at, c.updated_at,
         a.agent_session_id, ${providerResumeCol}, a.jsonl_path, a.file_size, a.first_message,
         a.modified_at, a.hostname, a.model, a.git_branch, a.user_msg_count,
+        ${threadSourceCol}, ${parentAgentSessionCol}, ${agentNicknameCol}, ${agentRoleCol},
         ${slugCol}
       FROM ctm_sessions c
       LEFT JOIN agent_sessions a ON a.ctm_session_id = c.id
@@ -600,8 +651,7 @@ function detectMismatches(db, getAllSessionFiles) {
   // Check 6: Orphan files (on disk but not in DB)
   const dbFileIds = new Set();
   for (const row of allSessions) {
-    dbFileIds.add(row.id);
-    if (row.agent_session_id) dbFileIds.add(row.agent_session_id);
+    addAgentRowFileIds(dbFileIds, row);
     if (isCodexSessionRow(row) && row.agent_session_id) {
       try {
         for (const filePath of findCodexSessionFiles(row.agent_session_id)) {
@@ -611,6 +661,27 @@ function detectMismatches(db, getAllSessionFiles) {
       } catch {}
     }
   }
+  try {
+    const agentCols = new Set(db.prepare('PRAGMA table_info(agent_sessions)').all().map(c => c.name));
+    const threadSourceCol = agentCols.has('thread_source') ? 'thread_source' : "'' AS thread_source";
+    const parentAgentSessionCol = agentCols.has('parent_agent_session_id') ? 'parent_agent_session_id' : "'' AS parent_agent_session_id";
+    const allAgentRows = db.prepare(`
+      SELECT agent_session_id, ctm_session_id, provider, jsonl_path,
+        ${threadSourceCol}, ${parentAgentSessionCol}
+      FROM agent_sessions
+    `).all();
+    for (const row of allAgentRows) {
+      addAgentRowFileIds(dbFileIds, row);
+      if (isCodexSessionRow(row) && row.agent_session_id) {
+        try {
+          for (const filePath of findCodexSessionFiles(row.agent_session_id)) {
+            const rolloutFileId = sessionFileIdFromPath(filePath);
+            if (rolloutFileId) dbFileIds.add(rolloutFileId);
+          }
+        } catch {}
+      }
+    }
+  } catch {}
   for (const issue of issues) {
     if (issue.type === 'codex_agent_jsonl_mismatch' && issue.details?.file_agent_session_id) {
       dbFileIds.add(issue.details.file_agent_session_id);
@@ -706,25 +777,39 @@ function detectMismatches(db, getAllSessionFiles) {
     });
   }
 
-  // Check 7: Orphan agent_sessions (no valid ctm_session parent)
-  // Invariant: every agent_session MUST have a ctm_session parent.
-  // Orphans indicate a bug — watcher/reconciliation should always auto-create parents.
+  // Check 7: Orphan top-level agent_sessions (no valid ctm_session parent).
+  // Provider-native child threads (Codex subagents, etc.) are deliberately
+  // indexed as agent identities without top-level CTM tabs. Promoting them here
+  // creates the one-message "ghost sessions" that pollute Recent Sessions.
   try {
+    const agentCols = new Set(db.prepare('PRAGMA table_info(agent_sessions)').all().map(c => c.name));
+    const threadSourceCol = agentCols.has('thread_source') ? 'a.thread_source' : "'' AS thread_source";
+    const parentAgentSessionCol = agentCols.has('parent_agent_session_id') ? 'a.parent_agent_session_id' : "'' AS parent_agent_session_id";
+    const agentNicknameCol = agentCols.has('agent_nickname') ? 'a.agent_nickname' : "'' AS agent_nickname";
+    const agentRoleCol = agentCols.has('agent_role') ? 'a.agent_role' : "'' AS agent_role";
     const orphanAgents = db.prepare(`
-      SELECT a.agent_session_id, a.ctm_session_id, a.project_path, a.jsonl_path, a.file_size
+      SELECT a.agent_session_id, a.ctm_session_id, a.provider, a.project_path,
+        a.jsonl_path, a.file_size,
+        ${threadSourceCol}, ${parentAgentSessionCol}, ${agentNicknameCol}, ${agentRoleCol}
       FROM agent_sessions a
       LEFT JOIN ctm_sessions c ON c.id = a.ctm_session_id
       WHERE a.ctm_session_id IS NULL OR c.id IS NULL
     `).all();
     for (const row of orphanAgents) {
+      if (isProviderChildAgentRow(row)) continue;
       issues.push({
         type: 'orphan_agent_session', severity: 'warning', sessionId: row.agent_session_id,
         details: {
           agent_session_id: row.agent_session_id,
           stale_ctm_id: row.ctm_session_id || null,
+          provider: row.provider || '',
           project_path: row.project_path || '',
           jsonl_path: row.jsonl_path || '',
           file_size: row.file_size || 0,
+          thread_source: row.thread_source || '',
+          parent_agent_session_id: row.parent_agent_session_id || '',
+          agent_nickname: row.agent_nickname || '',
+          agent_role: row.agent_role || '',
         },
         suggestion: 'agent_session has no valid ctm_session parent. Will auto-create parent.',
       });
@@ -1082,9 +1167,15 @@ function recoverMismatches(db, issues, getAllSessionFiles) {
 
       case 'orphan_agent_session': {
         // Auto-create a ctm_session parent for orphaned agent_sessions.
-        // This restores the invariant: every agent_session has a parent.
+        // This restores the invariant for top-level agent_sessions. Provider
+        // child threads are intentionally parentless from CTM's tab model.
         const agentId = issue.details.agent_session_id;
         if (!agentId) { result.skipped++; break; }
+        if (isProviderChildAgentRow(issue.details || {})) {
+          result.skipped++;
+          result.actions.push(`Skipped provider child agent ${agentId.slice(0, 8)}; child threads are not CTM tabs`);
+          break;
+        }
         try {
           const txn = db.transaction(() => {
             // Create a new ctm_session using the agent_session_id as the CTM id
@@ -1277,12 +1368,16 @@ function repairSafeRelinkSwaps(db, auditResult = null) {
         const projectA = rowA.project_path || stA.cwd || ctmRowA.cwd || '';
         const projectB = rowB.project_path || stB.cwd || ctmRowB.cwd || '';
         _updateColumns(db, 'startup_tasks', 'ctm_session_id', ctmA, {
+          agent_session_id: desiredA,
+          claude_session_id: desiredA,
           agent_project_dir: _dirForJsonl(rowA.jsonl_path),
           claude_project_dir: _dirForJsonl(rowA.jsonl_path),
           cwd: projectA,
           worktree_path: /\/\.(?:claude|walle)\/worktrees\//.test(projectA) ? projectA : null,
         });
         _updateColumns(db, 'startup_tasks', 'ctm_session_id', ctmB, {
+          agent_session_id: desiredB,
+          claude_session_id: desiredB,
           agent_project_dir: _dirForJsonl(rowB.jsonl_path),
           claude_project_dir: _dirForJsonl(rowB.jsonl_path),
           cwd: projectB,
@@ -1320,6 +1415,11 @@ const INTEGRITY_ISSUE_TELEMETRY_TTL_MS = 6 * 60 * 60 * 1000;
 const INTEGRITY_ISSUE_TELEMETRY_DETAIL_CAP = 5;
 const _lastIntegrityIssueTelemetry = new Map();
 
+function integrityDetailTelemetryEnabled() {
+  const value = String(process.env.CTM_SESSION_INTEGRITY_DETAIL_TELEMETRY || '').toLowerCase();
+  return value === '1' || value === 'true' || value === 'yes';
+}
+
 function integrityIssueTelemetryKey(issue) {
   const details = issue && issue.details && typeof issue.details === 'object'
     ? Object.keys(issue.details).sort().join('|')
@@ -1349,7 +1449,7 @@ function integrityIssueTelemetryDetails(issue) {
     ? issue.details
     : {};
   const detailKeys = Object.keys(details).sort();
-  const detailsHash = require('crypto')
+  const detailsHash = crypto
     .createHash('sha256')
     .update(JSON.stringify(details))
     .digest('hex')
@@ -1360,8 +1460,40 @@ function integrityIssueTelemetryDetails(issue) {
   };
 }
 
+function integrityIssueTelemetrySummary(issues) {
+  const byType = {};
+  const bySeverity = {};
+  const sampleHashes = [];
+  const seenHashes = new Set();
+  for (const issue of issues || []) {
+    const type = issue?.type || 'unknown';
+    const severity = issue?.severity || 'unknown';
+    byType[type] = (byType[type] || 0) + 1;
+    bySeverity[severity] = (bySeverity[severity] || 0) + 1;
+    if (sampleHashes.length < 10) {
+      const details = integrityIssueTelemetryDetails(issue);
+      const key = `${type}:${severity}:${details.details_hash}`;
+      if (!seenHashes.has(key)) {
+        seenHashes.add(key);
+        sampleHashes.push({
+          type,
+          severity,
+          detail_keys: details.detail_keys,
+          details_hash: details.details_hash,
+        });
+      }
+    }
+  }
+  return {
+    issue_count: (issues || []).length,
+    by_type: JSON.stringify(byType),
+    by_severity: JSON.stringify(bySeverity),
+    sample_hashes: JSON.stringify(sampleHashes),
+  };
+}
+
 /**
- * Report integrity check results to telemetry with full debug context.
+ * Report integrity check results to telemetry with bounded debug context.
  */
 function reportToTelemetry(telemetry, issues, recovery) {
   if (!telemetry || typeof telemetry.track !== 'function') return;
@@ -1382,16 +1514,24 @@ function reportToTelemetry(telemetry, issues, recovery) {
     recovery_skipped: recovery ? recovery.skipped : 0,
   });
 
-  // Detail events for errors and warnings (not info — too noisy)
+  // One low-cardinality issue summary keeps fleet visibility without emitting
+  // one telemetry row per mismatched session. Detailed issue rows are opt-in for
+  // local debugging because old fleets made this event type very noisy.
   const serious = issues.filter(i => i.severity === 'error' || i.severity === 'critical');
-  for (const issue of serious.filter(issue => shouldReportIntegrityIssue(issue)).slice(0, INTEGRITY_ISSUE_TELEMETRY_DETAIL_CAP)) {
-    const detailMeta = integrityIssueTelemetryDetails(issue);
-    telemetry.track('session_integrity_issue', {
-      type: issue.type,
-      severity: issue.severity,
-      session_id: issue.sessionId ? issue.sessionId.slice(0, 8) : null,
-      ...detailMeta,
-    });
+  if (serious.length > 0) {
+    telemetry.track('session_integrity_issue_summary', integrityIssueTelemetrySummary(serious));
+  }
+
+  if (integrityDetailTelemetryEnabled()) {
+    for (const issue of serious.filter(issue => shouldReportIntegrityIssue(issue)).slice(0, INTEGRITY_ISSUE_TELEMETRY_DETAIL_CAP)) {
+      const detailMeta = integrityIssueTelemetryDetails(issue);
+      telemetry.track('session_integrity_issue', {
+        type: issue.type,
+        severity: issue.severity,
+        session_id: issue.sessionId ? issue.sessionId.slice(0, 8) : null,
+        ...detailMeta,
+      });
+    }
   }
 
   // Recovery actions
@@ -1521,6 +1661,8 @@ module.exports = {
     integrityIssueTelemetryKey,
     shouldReportIntegrityIssue,
     integrityIssueTelemetryDetails,
+    integrityIssueTelemetrySummary,
+    integrityDetailTelemetryEnabled,
     resetIntegrityIssueTelemetry: () => _lastIntegrityIssueTelemetry.clear(),
   },
 };

package/template/claude-task-manager/session-search-ranking.js

@@ -59,6 +59,7 @@ function searchMatchFieldPriority(hit) {
   const field = String(hit?._matchField || '');
   if (field === 'session_id') return 100;
   if (hit?._isExactTitle) return 95;
+  if (field === 'session_reference') return 93;
   if (field === 'message' && hit?._messageStrong) return 92;
   if (field === 'title') return 90;
   if (field === 'message') return 80;

package/template/claude-task-manager/session-utils.js

@@ -61,6 +61,12 @@ function messageText(messageOrContent) {
   return walleTranscript.extractText(content);
 }
 
+function shouldSkipLegacyWalleSessionFile(file, fileSet) {
+  const sessionId = String(file || '').replace(/\.jsonl(\.bak)?$/, '');
+  if (!sessionId || sessionId.startsWith('walle-')) return false;
+  return fileSet.has(`walle-${sessionId}.jsonl`) || fileSet.has(`walle-${sessionId}.jsonl.bak`);
+}
+
 function pushWalleSessionFiles(results) {
   const sessionsDir = walleTranscript.defaultSessionsDir(process.env);
   let files;
@@ -69,6 +75,7 @@ function pushWalleSessionFiles(results) {
   for (const file of files) {
     if (!file.endsWith('.jsonl') && !file.endsWith('.jsonl.bak')) continue;
     if (file.endsWith('.jsonl.bak') && fileSet.has(file.replace(/\.bak$/, ''))) continue;
+    if (shouldSkipLegacyWalleSessionFile(file, fileSet)) continue;
     const filePath = path.join(sessionsDir, file);
     let stat;
     try { stat = fs.statSync(filePath); } catch { continue; }
@@ -123,6 +130,7 @@ async function pushWalleSessionFilesAsync(results) {
   for (const file of files) {
     if (!file.endsWith('.jsonl') && !file.endsWith('.jsonl.bak')) continue;
     if (file.endsWith('.jsonl.bak') && fileSet.has(file.replace(/\.bak$/, ''))) continue;
+    if (shouldSkipLegacyWalleSessionFile(file, fileSet)) continue;
     const filePath = path.join(sessionsDir, file);
     let stat;
     try { stat = await fsp.stat(filePath); } catch { continue; }
@@ -175,20 +183,27 @@ function parseSessionFile(filePath, projectPath, projectEntry) {
     const meta = readCodexRolloutMetadata(filePath) || {};
     const cwd = meta.cwd || projectPath || path.dirname(filePath);
     const modelId = meta.model || '';
+    const firstMessage = meta.first_user_message || meta.title || '';
+    const title = firstMessage
+      ? firstMessage.split('\n')[0].replace(/^#+\s*/, '').replace(/[*_`]/g, '').trim().slice(0, 80)
+      : '';
+    const createdAt = meta.created_at
+      ? new Date(Number(meta.created_at) * 1000).toISOString()
+      : modifiedAt;
     return {
       sessionId: meta.id || codexSessionId,
       project: cwd,
       projectEntry: 'codex',
       cwd,
-      firstMessage: '',
-      lastUserContent: '',
+      firstMessage,
+      lastUserContent: firstMessage,
       firstAssistantText: '',
       renameName: '',
-      title: '',
+      title,
       isEmpty: false,
-      userMsgCount: 0,
+      userMsgCount: firstMessage ? 1 : 0,
       modifiedAt,
-      timestamp: meta.timestamp || modifiedAt,
+      timestamp: createdAt,
       version: '',
       gitBranch: meta.git_branch || '',
       slug: '',
@@ -199,6 +214,11 @@ function parseSessionFile(filePath, projectPath, projectEntry) {
       model: modelId,
       agent: 'codex',
       jsonlPath: filePath,
+      threadSource: meta.thread_source || '',
+      parentAgentSessionId: meta.parent_agent_session_id || meta.parent_thread_id || '',
+      parentThreadId: meta.parent_thread_id || meta.parent_agent_session_id || '',
+      agentNickname: meta.agent_nickname || '',
+      agentRole: meta.agent_role || '',
     };
   }
 

package/template/claude-task-manager/workers/approval-blocklist.js

@@ -46,6 +46,14 @@ const PATTERNS = [
   { re: />\s*\/dev\/[sh]d[a-z]/,                            reason: 'direct write to block device',            category: 'destruction' },
   { re: />\s*\/etc\//,                                      reason: 'direct overwrite of /etc/',               category: 'destruction' },
   { re: />\s*\/boot\//,                                     reason: 'direct overwrite of /boot/',              category: 'destruction' },
+  { re: />\s*\/usr\//,                                      reason: 'direct overwrite of /usr/',               category: 'destruction' },
+  { re: />\s*\/var\//,                                      reason: 'direct overwrite of /var/',               category: 'destruction' },
+
+  // --- Irreversible data / history loss (seeded so allow-by-default can't run them) ---
+  { re: /\bdrop\s+(table|database|schema)\b/i,             reason: 'SQL drop table/database',                 category: 'destruction' },
+  { re: /\btruncate\s+table\b/i,                           reason: 'SQL truncate table',                      category: 'destruction' },
+  { re: /\bgit\s+push\b[^\n]*\s(--force|-f)\b/,            reason: 'git push --force (history overwrite)',    category: 'destruction' },
+  { re: /\bchmod\s+[0-7]*777\b[^\n]*(\/(?:etc|usr|var|boot|bin|sbin|lib)\b|\s\/(?:\s|$)|~)/, reason: 'chmod 777 on a system path', category: 'perms' },
 
   // --- Credential exfiltration / secret leakage ---
   { re: /\b(curl|wget|nc|ncat|netcat)\b.*\.(ssh|gnupg|aws|kube|config)\b/i, reason: 'credential exfil via network tool', category: 'exfiltration' },
@@ -58,6 +66,7 @@ const PATTERNS = [
   { re: /\beval\s+.*`/,                                     reason: 'eval with backtick substitution',         category: 'exec' },
   { re: /\b(curl|wget)\s+.*\|\s*(bash|sh|zsh|source)\b/,    reason: 'curl|bash (remote code exec)',            category: 'exec' },
   { re: /\b(bash|sh|zsh)\s+<\s*\(.*\b(curl|wget)\b/,        reason: 'process substitution remote exec',        category: 'exec' },
+  { re: /\bfind\b[\s\S]*\s-exec\s+(rm|rmdir|unlink|shred|dd|mkfs|sh|bash|zsh|chmod|chown|mv|truncate)\b/, reason: 'find -exec running a destructive command', category: 'exec' },
 
   // --- Recursive permission / ownership on sensitive paths ---
   { re: /\bchmod\s+-[a-zA-Z]*R[a-zA-Z]*\s+\S+\s+(\/(?:\s|$)|~\/|\/etc(?:\s|\/|$)|\/var(?:\s|\/|$)|\/home(?:\s|\/|$))/, reason: 'recursive chmod on sensitive path', category: 'perms' },
@@ -101,29 +110,108 @@ function _normalizeCommand(input) {
   try { return String(input); } catch { return ''; }
 }
 
+// --- User-configurable patterns (Permission tab) -------------------------
+// The built-in PATTERNS above are sensible DEFAULTS shipped with CTM. The user
+// can, in the Permission tab: (a) DISABLE specific defaults (by id), and (b) ADD
+// their own custom patterns. Both live in the `approval_blocklist_config` setting
+// and are passed into checkBlocklist() by the approval agent. Custom regexes are
+// user-authored on their own machine — still, we validate + ReDoS-guard them so a
+// fat-fingered pattern can't wedge the approval path.
+const CUSTOM_FLAGS_ALLOWED = 'imsu';
+const CUSTOM_SOURCE_MAX = 200;
+const CUSTOM_PATTERNS_MAX = 200;
+
+// ReDoS guard — same shape as approval-agent's isSafeRegex (nested quantifiers
+// are the main catastrophic-backtracking vector). Kept local so the worker has
+// no cross-module dependency.
+function _isSafeRegexSource(source) {
+  if (/(\+|\*|\{)\)?(\+|\*|\?)/.test(source)) return false;       // nested quantifiers
+  if ((source.match(/\|/g) || []).length > 20) return false;       // excessive alternation
+  if (/\|\||^\||\|$/.test(source)) return false;                   // empty alternation → matches all
+  return true;
+}
+
+// Validate one user pattern. Returns { ok, re?, normalized?, error? }. Pure — the
+// API layer uses it to reject bad input with a message; checkBlocklist uses it to
+// skip (not throw on) a stored pattern that somehow became invalid.
+function validateUserPattern(p) {
+  if (!p || typeof p !== 'object') return { ok: false, error: 'pattern must be an object' };
+  const source = typeof p.source === 'string' ? p.source.trim() : '';
+  if (!source) return { ok: false, error: 'regex is required' };
+  if (source.length > CUSTOM_SOURCE_MAX) return { ok: false, error: `regex too long (max ${CUSTOM_SOURCE_MAX} chars)` };
+  const flags = typeof p.flags === 'string' ? p.flags : '';
+  for (const f of flags) if (!CUSTOM_FLAGS_ALLOWED.includes(f)) return { ok: false, error: `unsupported flag "${f}" (allowed: ${CUSTOM_FLAGS_ALLOWED})` };
+  if (new Set(flags).size !== flags.length) return { ok: false, error: 'duplicate regex flag' };
+  if (!_isSafeRegexSource(source)) return { ok: false, error: 'regex rejected (nested quantifiers / excessive alternation — possible ReDoS)' };
+  let re;
+  try { re = new RegExp(source, flags); } catch (e) { return { ok: false, error: `invalid regex: ${e.message}` }; }
+  return {
+    ok: true,
+    re,
+    normalized: {
+      source,
+      flags,
+      reason: String(p.reason || '').slice(0, 200).trim() || 'Custom blocklist pattern',
+      category: (String(p.category || 'custom').slice(0, 40).trim() || 'custom'),
+    },
+  };
+}
+
+// Coerce a raw config object into the shape checkBlocklist expects, dropping
+// anything malformed. Returns { disabledIds: Set<number>, customPatterns: [{re, reason, category, id}] }.
+function _resolveConfig(config) {
+  const disabledIds = new Set();
+  const customPatterns = [];
+  if (config && typeof config === 'object') {
+    const raw = Array.isArray(config.disabledIds) ? config.disabledIds : [];
+    for (const id of raw) { const n = Number(id); if (Number.isInteger(n) && n >= 0 && n < PATTERNS.length) disabledIds.add(n); }
+    const customs = Array.isArray(config.customPatterns) ? config.customPatterns.slice(0, CUSTOM_PATTERNS_MAX) : [];
+    customs.forEach((p, i) => {
+      const v = validateUserPattern(p);
+      if (v.ok) customPatterns.push({ re: v.re, reason: v.normalized.reason, category: v.normalized.category, id: (p && p.id != null) ? p.id : `c${i}` });
+    });
+  }
+  return { disabledIds, customPatterns };
+}
+
 // Check a command against the blocklist.
 // Returns { blocked: true, reason, category, patternId } on first match,
 // or { blocked: false } otherwise.
 //
-// This is synchronous and O(N patterns). All patterns are anchored on
-// literal keywords (\brm, \bmkfs, etc.) so there's no catastrophic backtracking
-// concern even on adversarial input.
-function checkBlocklist(command) {
+// Optional `config` ({ disabledIds, customPatterns }) layers the user's Permission
+// tab edits on top of the defaults: disabled default ids are skipped, and custom
+// patterns are checked after the defaults. Omitting `config` evaluates the defaults
+// only (back-compat). Default matches carry a numeric `patternId`; custom matches
+// carry `custom: true` + `customId` and `patternId: null`.
+//
+// This is synchronous and O(N patterns). The built-in patterns are anchored on
+// literal keywords (\brm, \bmkfs, etc.) and custom patterns are ReDoS-guarded, so
+// there's no catastrophic backtracking concern even on adversarial input.
+function checkBlocklist(command, config) {
   const cmd = _normalizeCommand(command);
   if (!cmd) return { blocked: false };
+  const { disabledIds, customPatterns } = _resolveConfig(config);
+  // 1) Built-in defaults (skip user-disabled ids).
   for (let i = 0; i < PATTERNS.length; i++) {
+    if (disabledIds.has(i)) continue;
     const p = PATTERNS[i];
     if (p.re.test(cmd)) {
       return { blocked: true, reason: p.reason, category: p.category, patternId: i };
     }
   }
+  // 2) User custom patterns.
+  for (const c of customPatterns) {
+    if (c.re.test(cmd)) {
+      return { blocked: true, reason: c.reason, category: c.category, patternId: null, custom: true, customId: c.id };
+    }
+  }
   return { blocked: false };
 }
 
 // Legacy helper — check multiple strings at once (e.g. tool name + command).
-function checkBlocklistMulti(fields) {
+function checkBlocklistMulti(fields, config) {
   for (const v of fields) {
-    const res = checkBlocklist(v);
+    const res = checkBlocklist(v, config);
     if (res.blocked) return res;
   }
   return { blocked: false };
@@ -132,7 +220,9 @@ function checkBlocklistMulti(fields) {
 module.exports = {
   checkBlocklist,
   checkBlocklistMulti,
+  validateUserPattern,
   PATTERN_META,
+  DEFAULT_PATTERN_COUNT: PATTERNS.length,
   // Exposed for tests — callers should not mutate.
   _PATTERNS: PATTERNS,
 };

package/template/claude-task-manager/workers/approval-widget-validator.js

@@ -26,7 +26,8 @@ const ABOVE_ANCHOR_DEPTH = 40;
 
 // Footer anchor that real widgets render at the bottom of the prompt.
 // Claude Code: "Esc to cancel". Codex: "Press enter to confirm or esc to cancel".
-const ANCHOR_RE = /Esc to cancel|esc to cancel|Press enter to confirm/;
+// Cursor Agent: "Skip (esc or n)".
+const ANCHOR_RE = /Esc to cancel|esc to cancel|Press enter to confirm|\(esc or n\)/;
 
 // Approval-option pattern. Accepts an optional selection-arrow prefix in any of
 // the forms different CLIs use: ❯ (Claude Code), ›/▶/▸ (Cursor/others), or
@@ -35,6 +36,11 @@ const ANCHOR_RE = /Esc to cancel|esc to cancel|Press enter to confirm/;
 // — which is unstyled in Codex's renderer and trips no-widget-formatting.
 const YES_RE = /^\s*(?:[❯›▶▸>]\s*)?\d+\.\s*(?:Yes|Allow)\b/i;
 
+// Cursor Agent's "Run this command?" widget has no numbered options — the
+// confirm row is a hotkey: "→ Run (once) (y)". Recognize it as the structural
+// "Yes" row so the validator accepts Cursor prompts.
+const CURSOR_RUN_RE = /^\s*(?:[▸❯›▶→>-]+\s*)?Run\s*\(once\)\s*\(y\)/i;
+
 /**
  * Check if the terminal is currently displaying an active approval widget.
  *
@@ -108,7 +114,7 @@ function validateWidget(term, opts = {}) {
     const line = buf.getLine(buf.viewportY + i);
     if (!line) continue;
     const text = line.translateToString(true);
-    if (YES_RE.test(text)) { yesRow = i; break; }
+    if (YES_RE.test(text) || CURSOR_RUN_RE.test(text)) { yesRow = i; break; }
   }
   if (yesRow < 0) {
     return { valid: false, reason: 'yes-not-at-bottom' };
@@ -140,7 +146,7 @@ function _hasWidgetFormatting(buf, yesRow, totalRows) {
   const yesLine = buf.getLine(buf.viewportY + yesRow);
   if (!yesLine) return false;
   const yesText = yesLine.translateToString(true);
-  if (/[❯›▶▸]/.test(yesText)) return true;
+  if (/[❯›▶▸→]/.test(yesText)) return true;
 
   // Check for a selection marker near the approval options. Codex MCP forms can
   // select option 2 ("Allow for this session"), while option 1 is the first
@@ -149,17 +155,17 @@ function _hasWidgetFormatting(buf, yesRow, totalRows) {
     const line = buf.getLine(buf.viewportY + row);
     if (!line) continue;
     const text = line.translateToString(true);
-    // "❯" (U+276F), "›" (U+203A), "▶" (U+25B6), ">" surrounded by spaces
-    if (/[❯›▶▸]/.test(text)) return true;
+    // "❯" (U+276F), "›" (U+203A), "▶" (U+25B6), "→" (U+2192, Cursor), ">" spaced
+    if (/[❯›▶▸→]/.test(text)) return true;
   }
 
-  // Check for "❯" marker anywhere in bottom 5 rows for prompts whose option
-  // block is pushed down by long wrapped content.
+  // Check for a selection marker anywhere in bottom 5 rows for prompts whose
+  // option block is pushed down by long wrapped content.
   for (let row = Math.max(0, totalRows - 5); row < totalRows; row++) {
     const line = buf.getLine(buf.viewportY + row);
     if (!line) continue;
     const text = line.translateToString(true);
-    if (/[❯›▶▸]/.test(text)) return true;
+    if (/[❯›▶▸→]/.test(text)) return true;
   }
 
   // Check for ANSI foreground color on the Yes-option line.