create-walle 0.9.25 → 0.9.26

package/template/wall-e/server.js

@@ -73,12 +73,19 @@ function startServer(options = {}) {
       return;
     }
 
-    // Task stop endpoint — must be in this process (has the child process reference)
+    // Task stop endpoint — task execution may live in a runtime worker, so ask
+    // every worker and keep the old in-process path as a recovery fallback.
     const taskStopMatch = url.pathname.match(/^\/api\/wall-e\/tasks\/([^/]+)\/stop$/);
     if (taskStopMatch && req.method === 'POST') {
       try {
+        let stopped = false;
+        try {
+          const { broadcastRuntimeWorker } = require('./lib/runtime-worker-pool');
+          const results = await broadcastRuntimeWorker('tasks.stop', { taskId: taskStopMatch[1] }, { timeoutMs: 1500 });
+          stopped = results.some((entry) => entry.ok && entry.result?.stopped);
+        } catch {}
         const { stopTask } = require('./loops/tasks');
-        const stopped = stopTask(taskStopMatch[1]);
+        stopped = stopTask(taskStopMatch[1]) || stopped;
         const body = JSON.stringify({ data: { stopped } });
         res.writeHead(200, { 'Content-Type': 'application/json', 'Content-Length': Buffer.byteLength(body) });
         res.end(body);
@@ -94,9 +101,20 @@ function startServer(options = {}) {
     const taskRunNowMatch = url.pathname.match(/^\/api\/wall-e\/tasks\/([^/]+)\/run-now$/);
     if (taskRunNowMatch && req.method === 'POST') {
       try {
-        const { runTaskById } = require('./loops/tasks');
-        // Fire and forget — respond immediately, task runs in background
-        runTaskById(taskRunNowMatch[1]).catch(e => {
+        const taskId = taskRunNowMatch[1];
+        // Fire and forget — respond immediately, task runs in the runtime
+        // worker when available, with local execution as the opt-out/failure
+        // fallback.
+        (async () => {
+          try {
+            const { requestRuntimeWorker } = require('./lib/runtime-worker-pool');
+            await requestRuntimeWorker('tasks.runById', { taskId }, { heavy: true, timeoutMs: 0 });
+          } catch (workerErr) {
+            console.warn('[wall-e] run-now worker unavailable; falling back locally:', workerErr.message);
+            const { runTaskById } = require('./loops/tasks');
+            await runTaskById(taskId);
+          }
+        })().catch(e => {
           console.error('[wall-e] run-now background error:', e.message);
         });
         const body = JSON.stringify({ data: { started: true } });
@@ -110,12 +128,19 @@ function startServer(options = {}) {
       return;
     }
 
-    // Task logs endpoint — must be in this process (in-memory buffer)
+    // Task logs endpoint — task execution may live in a runtime worker.
     const taskLogsMatch = url.pathname.match(/^\/api\/wall-e\/tasks\/([^/]+)\/logs$/);
     if (taskLogsMatch && req.method === 'GET') {
       try {
+        let logs = null;
+        try {
+          const { broadcastRuntimeWorker } = require('./lib/runtime-worker-pool');
+          const results = await broadcastRuntimeWorker('tasks.getLogs', { taskId: taskLogsMatch[1] }, { timeoutMs: 1500 });
+          const hit = results.find((entry) => entry.ok && entry.result);
+          if (hit) logs = hit.result;
+        } catch {}
         const { getTaskLogs } = require('./loops/tasks');
-        const logs = getTaskLogs(taskLogsMatch[1]);
+        logs = logs || getTaskLogs(taskLogsMatch[1]);
         const body = JSON.stringify({ data: logs || { lines: [], status: 'unknown' } });
         res.writeHead(200, { 'Content-Type': 'application/json', 'Content-Length': Buffer.byteLength(body) });
         res.end(body);

package/template/wall-e/skills/script-skill-runner.js

@@ -60,7 +60,14 @@ function runScriptSkill(skill, task = {}, opts = {}) {
       for (const line of chunk.split('\n').filter(Boolean)) {
         log(line);
         if (line.startsWith('CHECKPOINT:') && typeof opts.onCheckpoint === 'function') {
-          opts.onCheckpoint(line.slice(11).trim());
+          try {
+            const maybePromise = opts.onCheckpoint(line.slice(11).trim());
+            if (maybePromise && typeof maybePromise.catch === 'function') {
+              maybePromise.catch(err => log(`[checkpoint skipped] ${err?.message || err}`));
+            }
+          } catch (err) {
+            log(`[checkpoint skipped] ${err?.message || err}`);
+          }
         }
       }
     });

package/template/wall-e/skills/skill-planner.js

@@ -16,6 +16,7 @@ try { telemetry = require('../telemetry'); } catch { telemetry = { trackError()
 
 const DECISION_TELEMETRY_MIN_INTERVAL_MS = 60 * 60 * 1000;
 const _lastDecisionTelemetry = new Map();
+const _lastBackoffRecoveryLog = new Map();
 let _slackAlertMigrationDone = false;
 
 function isBrainReady() {
@@ -54,6 +55,25 @@ function shouldTrackDecisionTelemetry(skillName, decision) {
   return true;
 }
 
+function shouldLogBackoffRecovery(skillName, decision) {
+  const details = decision?.details || {};
+  const signature = [
+    decision?.reason || '',
+    details.consecutive_failures || 0,
+    details.next_allowed_at || '',
+    details.backoff_ms || 0,
+    details.schedule_source || '',
+  ].join('|');
+  const key = String(skillName || '');
+  if (_lastBackoffRecoveryLog.get(key) === signature) return false;
+  _lastBackoffRecoveryLog.set(key, signature);
+  if (_lastBackoffRecoveryLog.size > 500) {
+    const first = _lastBackoffRecoveryLog.keys().next().value;
+    if (first) _lastBackoffRecoveryLog.delete(first);
+  }
+  return true;
+}
+
 // ── Service alerts ─────────────────────────────────────────────────────────
 // Stored in kv_store as JSON array. Surfaces auth failures, version updates, etc.
 
@@ -132,6 +152,48 @@ function clearServiceAlerts(service) {
   brain.setKv('service_alerts', JSON.stringify(alerts));
 }
 
+function _providerAlertMatches(alert, provider, model) {
+  const providerNeedle = String(provider || '').trim().toLowerCase();
+  const modelNeedle = String(model || '').trim().toLowerCase();
+  const providerError = alert?.provider_error || alert?.providerError || {};
+  const alertProvider = String(providerError.provider || alert?.provider || '').trim().toLowerCase();
+  const alertModel = String(providerError.model || alert?.model || '').trim().toLowerCase();
+  if (providerNeedle && alertProvider && alertProvider !== providerNeedle) return false;
+  if (modelNeedle && alertModel && alertModel !== modelNeedle) return false;
+  if (providerNeedle && !alertProvider && !String(alert?.type || '').toLowerCase().includes(providerNeedle)) return false;
+  return true;
+}
+
+function _isTransientProviderAlert(alert) {
+  const providerError = alert?.provider_error || alert?.providerError || {};
+  const text = [
+    alert?.service,
+    alert?.type,
+    alert?.title,
+    alert?.message,
+    providerError.type,
+    providerError.title,
+    providerError.message,
+    providerError.userMessage,
+  ].filter(Boolean).join(' ').toLowerCase();
+  if (!text.includes('ai_provider') && String(alert?.service || '') !== 'ai_provider') return false;
+  if (/auth|quota|billing|credit|insufficient|invalid|forbidden|unauthorized|permission/.test(text)) return false;
+  return /timeout|timed out|abort|aborted|network|unavailable|overloaded|rate_limit|connection|reset|econn/.test(text);
+}
+
+function clearRecoveredProviderAlerts({ provider, model } = {}) {
+  const before = getServiceAlerts();
+  const after = before.filter((alert) => {
+    if (!_isTransientProviderAlert(alert)) return true;
+    if (!_providerAlertMatches(alert, provider, model)) return true;
+    return false;
+  });
+  if (after.length !== before.length) {
+    brain.setKv('service_alerts', JSON.stringify(after));
+  }
+  return { cleared: before.length - after.length };
+}
+
 function clearResolvedSlackHealthAlerts({ authenticated = false, ownerConfigured = false } = {}) {
   if (!authenticated) return { cleared: 0 };
   const before = getServiceAlerts();
@@ -631,7 +693,7 @@ async function runDueSkills(opts = {}) {
       }
       // Recovery logger: long-form structured trace for post-incident
       // debugging (Items E + A of error-recovery deep-dive).
-      if (decision.reason === 'backed_off') {
+      if (decision.reason === 'backed_off' && shouldLogBackoffRecovery(skill.name, decision)) {
         try {
           require('../lib/recovery-logger').warn('skill-dispatch', 'backoff_applied', {
             skill: skill.name,
@@ -909,6 +971,7 @@ module.exports = {
   addServiceAlert,
   dismissServiceAlert,
   clearServiceAlerts,
+  clearRecoveredProviderAlerts,
   clearResolvedSlackHealthAlerts,
   clearResolvedGoogleWorkspaceHealthAlerts,
   _test: {

package/template/wall-e/tools/builtin-middleware.js

@@ -15,6 +15,69 @@ function providerId(provider) {
   return provider.type || provider.provider || provider.id || '';
 }
 
+const OLLAMA_GEMMA_CORE_TOOL_NAMES = new Set([
+  'read_file',
+  'write_file',
+  'run_shell',
+  'bg_output',
+  'bg_kill',
+  'glob',
+  'grep_files',
+  'list_directory',
+  'browser_screenshot',
+  'browser_smoke_test',
+  'check_url',
+  'web_search',
+  'web_fetch',
+  'start_static_server',
+  'stop_static_server',
+  'pdf_info',
+  'pdf_render_pages',
+  'pdf_read_pages',
+  'make_pdf',
+  'edit_file',
+  'apply_patch',
+  'multi_edit',
+  'update_todos',
+  'lsp_symbols',
+  'lsp_definition',
+  'lsp_references',
+  'lsp_diagnostics',
+  'lsp_hover',
+  'lsp_implementation',
+  'ask_user',
+]);
+
+function isGemma4Ollama(provider, model) {
+  return providerId(provider) === 'ollama' && /^gemma4:/i.test(String(model || ''));
+}
+
+function compactToolsForGemma4Ollama(ctx = {}, tools = []) {
+  if (process.env.WALLE_OLLAMA_FULL_TOOL_CATALOG === '1' || process.env.WALLE_OLLAMA_COMPACT_TOOLS === '0') {
+    return tools;
+  }
+  const provider = ctx.provider || '';
+  const model = String(ctx.model || '');
+  if (!isGemma4Ollama(provider, model)) return tools;
+  const core = tools.filter((tool) => OLLAMA_GEMMA_CORE_TOOL_NAMES.has(tool?.name));
+  if (core.length === 0) return tools;
+
+  const promptCapabilities = ctx.promptCapabilities || {};
+  const explicitSkills = Array.isArray(promptCapabilities.skills) && promptCapabilities.skills.length > 0;
+  const explicitMcp = Boolean(
+    promptCapabilities.mcp
+    && (
+      (Array.isArray(promptCapabilities.mcp.servers) && promptCapabilities.mcp.servers.length > 0)
+      || (Array.isArray(promptCapabilities.mcp.tools) && promptCapabilities.mcp.tools.length > 0)
+    )
+  );
+  const extras = tools.filter((tool) => (
+    (explicitSkills && (tool?.name === 'load_skill' || tool?.name === 'skill'))
+    || (explicitMcp && tool?.name === 'mcp_call')
+  ));
+  return [...core, ...extras];
+}
+
 function isOpenWeightReasoningModel(provider, model) {
   if (providerId(provider) !== 'ollama') return false;
   return isReasoningCapableOllamaModel(model);
@@ -178,12 +241,14 @@ Do not make any edits. Review the diff and assess quality.`);
   // -- tool.definitions: adapt per model --
   mw.use('tool.definitions', async (ctx, tools) => {
     const provider = ctx.provider || opts.provider;
-    if (provider === 'ollama') {
+    const model = String(ctx.model || opts.model || '');
+    if (providerId(provider) === 'ollama') {
       // Brief descriptions for small models
-      return tools.map(t => ({
+      const shortened = tools.map(t => ({
         ...t,
         description: t.description.split('.')[0] + '.',
       }));
+      return compactToolsForGemma4Ollama({ ...ctx, provider, model }, shortened);
     }
     return tools;
   });

package/template/wall-e/tools/local-tools.js

@@ -10,8 +10,29 @@ const https = require('https');
 const execFileAsync = promisify(execFile);
 const execAsync = promisify(exec);
 const { SHELL_ALLOWLIST, SHELL_DENYLIST } = require('./shell-policy');
+const shellSandbox = require('../coding/shell-sandbox');
 
 const HOME = process.env.HOME || '/tmp';
+
+// When WALLE_SHELL_SANDBOX is on and an OS sandbox backend exists, return the
+// sandbox-wrapped argv for a run_shell command (Seatbelt/bubblewrap; writes contained to
+// cwd+tmp, network allowed). Returns null to run un-sandboxed (flag off, no backend, or a
+// hard-denylisted head — those keep going through the normal allowlist gate and are denied
+// there). Under the sandbox the OS is the safety boundary, so the allowlist requirement is
+// skipped for the command; the destructive denylist is still honored here as a floor.
+function maybeSandboxShellArgv(commandStr, cwd) {
+  if (!shellSandbox.shellSandboxEnabled() || !shellSandbox.sandboxAvailable()) return null;
+  // Defense-in-depth floor: never sandbox a command whose ANY clause head is on the hard
+  // denylist (sudo/dd/mkfs/…). Split on shell operators so `echo x && sudo y` is caught too.
+  // Returning null routes it through the normal allowlist gate, which denies it. The OS
+  // sandbox is still the real boundary for everything that does run.
+  const clauses = String(commandStr || '').split(/&&|\|\||[|;\n]/);
+  for (const clause of clauses) {
+    const head = path.basename(clause.trim().split(/\s+/)[0] || '');
+    if (head && SHELL_DENYLIST.has(head)) return null;
+  }
+  return shellSandbox.wrapShellArgv({ command: commandStr, cwd });
+}
 const MAIL_AUTOMATION_LOCK_PATH = process.env.WALLE_MAIL_LOCK_PATH ||
   path.join(os.tmpdir(), 'wall-e-mail-appleevent.lock');
 const MAIL_AUTOMATION_COOLDOWN_PATH = process.env.WALLE_MAIL_COOLDOWN_PATH ||
@@ -1527,9 +1548,14 @@ async function runShell(commandOrOpts, legacyArgs, legacyOpts) {
   let background = false;
   let sessionId = '';
   let persist = false;
+  // signal: aborts the child when the turn is cancelled (user Stop). onProgress:
+  // a heartbeat callback so a long-running command shows live motion instead of a
+  // frozen "Running run_shell" card. Both are best-effort and optional.
+  let signal = null;
+  let onProgress = null;
   if (typeof commandOrOpts === 'object' && commandOrOpts !== null) {
-    // New format: runShell({ command, args, timeout_ms, cwd, background })
-    ({ command, args, timeout_ms = 30000, cwd, background = false, sessionId = '', persist = false } = commandOrOpts);
+    // New format: runShell({ command, args, timeout_ms, cwd, background, signal, onProgress })
+    ({ command, args, timeout_ms = 30000, cwd, background = false, sessionId = '', persist = false, signal = null, onProgress = null } = commandOrOpts);
   } else {
     // Legacy format: runShell(command, args, { timeout_ms })
     command = commandOrOpts;
@@ -1562,28 +1588,84 @@ async function runShell(commandOrOpts, legacyArgs, legacyOpts) {
     return runShellBackground({ command: commandStr, cwd, sessionId, persist });
   }
 
-  // Tree-sitter analysis gates execution
-  const analysis = await analyzeShellCommand(commandStr, cwd || process.cwd());
-  if (!analysis.allowed) {
-    throw new Error(analysis.reason);
+  // Run contained in the OS sandbox when enabled; otherwise gate on the static
+  // allowlist via tree-sitter analysis.
+  const sandboxArgv = maybeSandboxShellArgv(commandStr, cwd);
+  if (!sandboxArgv) {
+    const analysis = await analyzeShellCommand(commandStr, cwd || process.cwd());
+    if (!analysis.allowed) {
+      throw new Error(analysis.reason);
+    }
   }
 
+  // Per-command timeout: honor the caller's value (the controller defaults it from
+  // WALLE_SHELL_TIMEOUT_MS) but clamp to a hard ceiling so a single command can
+  // never wedge a turn indefinitely.
+  const SHELL_HARD_TIMEOUT_CAP_MS = 600000; // 10 min
+  const SHELL_PROGRESS_AFTER_MS = Number(process.env.WALLE_SHELL_PROGRESS_AFTER_MS) || 8000;
+  let effectiveTimeout = Number(timeout_ms) > 0 ? Number(timeout_ms) : (Number(process.env.WALLE_SHELL_TIMEOUT_MS) || 30000);
+  effectiveTimeout = Math.min(effectiveTimeout, SHELL_HARD_TIMEOUT_CAP_MS);
+
+  // Heartbeat: surface a "still running (Ns)" progress beat for long commands so a
+  // multi-second shell step doesn't read as a frozen card. Gated by WALLE_SHELL_PROGRESS.
+  const startedAt = Date.now();
+  const progressEnabled = typeof onProgress === 'function' && process.env.WALLE_SHELL_PROGRESS !== '0';
+  let hbTimer = null;
+  if (progressEnabled) {
+    hbTimer = setInterval(() => {
+      const elapsedMs = Date.now() - startedAt;
+      try {
+        onProgress({
+          type: 'shell_progress',
+          message: `run_shell still running (${Math.round(elapsedMs / 1000)}s): ${commandStr.slice(0, 80)}`,
+          elapsedMs,
+          command: commandStr.slice(0, 200),
+        });
+      } catch { /* progress is best-effort */ }
+    }, SHELL_PROGRESS_AFTER_MS);
+    if (hbTimer.unref) hbTimer.unref();
+  }
+
+  // Serial loops (for…do…done / while…do…done) of separate sub-commands are the
+  // classic budget sink — nudge the model toward one batched command or background.
+  const looksLikeSerialLoop = /\bfor\b[\s\S]*\bdo\b[\s\S]*\bdone\b/.test(commandStr) || /\bwhile\b[\s\S]*\bdo\b[\s\S]*\bdone\b/.test(commandStr);
+
   try {
-    const { stdout, stderr } = await execAsync(commandStr, {
-      timeout: timeout_ms,
-      maxBuffer: 1024 * 1024, // 1MB
-      cwd: cwd || undefined,
-      env: { ...process.env, HOME },
-      shell: '/bin/bash',
-    });
-    return {
+    const { stdout, stderr } = sandboxArgv
+      ? await execFileAsync(sandboxArgv[0], sandboxArgv.slice(1), {
+        timeout: effectiveTimeout,
+        maxBuffer: 1024 * 1024, // 1MB
+        cwd: cwd || undefined,
+        env: { ...process.env, HOME },
+        signal: signal || undefined,
+      })
+      : await execAsync(commandStr, {
+        timeout: effectiveTimeout,
+        maxBuffer: 1024 * 1024, // 1MB
+        cwd: cwd || undefined,
+        env: { ...process.env, HOME },
+        shell: '/bin/bash',
+        signal: signal || undefined,
+      });
+    const elapsedMs = Date.now() - startedAt;
+    const result = {
       stdout: stdout.slice(0, 50000),
       stderr: stderr.slice(0, 5000),
     };
+    if (looksLikeSerialLoop && elapsedMs >= SHELL_PROGRESS_AFTER_MS) {
+      result.hint = `This serial loop took ${Math.round(elapsedMs / 1000)}s. For many similar operations, prefer ONE batched command (most CLIs accept multiple paths) or run it with background:true and poll bg_output, instead of a loop of separate run_shell calls.`;
+    }
+    return result;
   } catch (err) {
-    // Timeout / killed: re-throw so callers see the failure
+    // User Stop / turn abort: the child was killed via the AbortSignal. Return a
+    // clean cancelled result rather than a confusing "Command failed: SIGTERM".
+    if (signal?.aborted || err.code === 'ABORT_ERR' || err.name === 'AbortError') {
+      return { stdout: (err.stdout || '').slice(0, 50000), stderr: (err.stderr || '').slice(0, 5000), cancelled: true, error: 'Command cancelled' };
+    }
+    // Timeout / killed: re-throw so callers see the failure, with a route forward.
     if (err.killed || err.signal) {
-      throw new Error(`Command failed: ${err.signal || 'timed out'}`);
+      const why = err.signal === 'SIGTERM' ? `timed out after ${effectiveTimeout}ms` : (err.signal || 'killed');
+      throw new Error(`Command failed: ${why}. For long-running work, pass background:true and poll bg_output, or raise timeout_ms (cap ${SHELL_HARD_TIMEOUT_CAP_MS}ms).`);
     }
     // Non-zero exit code: return output as result, not as error
     // This is important for test runners that exit 1 on test failure
@@ -1595,6 +1677,8 @@ async function runShell(commandOrOpts, legacyArgs, legacyOpts) {
       };
     }
     throw err; // Re-throw actual errors (spawn failure, etc.)
+  } finally {
+    if (hbTimer) clearInterval(hbTimer);
   }
 }
 
@@ -3075,19 +3159,25 @@ async function runShellBackground({ command, cwd, sessionId = '', persist = fals
   if (!command || typeof command !== 'string') return { ok: false, error: 'command is required' };
   const { analyzeShellCommand, initParser } = require('./shell-analyzer');
   await initParser();
-  const analysis = await analyzeShellCommand(command, cwd || process.cwd());
-  if (!analysis.allowed) return { ok: false, error: analysis.reason };
+  const sandboxArgv = maybeSandboxShellArgv(command, cwd);
+  if (!sandboxArgv) {
+    const analysis = await analyzeShellCommand(command, cwd || process.cwd());
+    if (!analysis.allowed) return { ok: false, error: analysis.reason };
+  }
 
   const logFile = path.join(os.tmpdir(), `walle-bg-${Date.now()}-${Math.random().toString(36).slice(2)}.log`);
   const logFd = fs.openSync(logFile, 'a');
   let child;
   try {
-    child = require('child_process').spawn('/bin/bash', ['-c', command], {
-      cwd: cwd || undefined,
-      env: { ...process.env, HOME },
-      stdio: ['ignore', logFd, logFd],
-      detached: true, // own process group so bg_kill can stop child trees
-    });
+    child = require('child_process').spawn(
+      sandboxArgv ? sandboxArgv[0] : '/bin/bash',
+      sandboxArgv ? sandboxArgv.slice(1) : ['-c', command],
+      {
+        cwd: cwd || undefined,
+        env: { ...process.env, HOME },
+        stdio: ['ignore', logFd, logFd],
+        detached: true, // own process group so bg_kill can stop child trees
+      });
   } catch (err) {
     fs.closeSync(logFd);
     return { ok: false, error: err.message };
@@ -4801,14 +4891,14 @@ function getLspManager() { return _lspManager; }
 
 // ── Tool executor dispatch ──
 
-async function executeLocalTool(name, input) {
+async function executeLocalTool(name, input, ctx = {}) {
   // LSP tools (SP5) — language-aware code intelligence
   if (name.startsWith('lsp_')) {
     return _executeLspTool(name, input);
   }
 
   switch (name) {
-    case 'run_shell': return runShell({ command: input.command, args: input.args, timeout_ms: input.timeout_ms, cwd: input.cwd, background: input.background, sessionId: input.sessionId || input.session_id, persist: input.persist });
+    case 'run_shell': return runShell({ command: input.command, args: input.args, timeout_ms: input.timeout_ms, cwd: input.cwd, background: input.background, sessionId: input.sessionId || input.session_id, persist: input.persist, signal: ctx?.signal || undefined, onProgress: ctx?.onProgress || undefined });
     case 'bg_output': return bgOutput(input);
     case 'bg_kill': return bgKill(input);
     case 'read_file': return readFile(input.file_path, { max_bytes: input.max_bytes, offset: input.offset, limit: input.limit, sessionId: input.sessionId, projectRoot: input.projectRoot });

package/template/wall-e/tools/permission-checker.js

@@ -69,6 +69,15 @@ let _ctmBaseUrl = null;
 let _ctmToken = null;
 let _userRulesCache = null;
 
+// How long to wait for CTM's auto-approver (/api/permissions/walle-check) before
+// giving up and falling through to the local static rules. Must comfortably cover
+// the goal-aligned LLM verifier, whose own budget is BUILTIN_TIMEOUT_MS = 20s in
+// claude-task-manager/lib/auto-approval-verifier.js. The previous 2s cut the
+// verifier off for EVERY medium+ command (anything with a loop, an unknown binary,
+// etc.) → the bridge aborted → the agent parked on a static "ask" for routine local
+// commands. 25s = 20s verifier cap + network/parse overhead. Env-overridable.
+const CTM_APPROVAL_TIMEOUT_MS = Number(process.env.WALLE_CTM_APPROVAL_TIMEOUT_MS) || 25000;
+
 function configure({ ctmUrl, ctmToken } = {}) {
   _ctmBaseUrl = ctmUrl || null;
   _ctmToken = ctmToken || null;
@@ -154,7 +163,7 @@ function listTrustedDirectories() {
  *
  * Returns: { decision: 'allow'|'deny'|'ask', source, reason, ruleId? }
  */
-async function checkPermission({ tool, command, commandTokens, commandClauses, args, projectPath, sessionId, mode }) {
+async function checkPermission({ tool, command, commandTokens, commandClauses, args, projectPath, sessionId, mode, goal }) {
   // Layer 1: Hardcoded denylist (safety floor — never overridable)
   if (tool === 'run_shell') {
     // Extract first command token for denylist check
@@ -180,13 +189,16 @@ async function checkPermission({ tool, command, commandTokens, commandClauses, a
   // so coding never hard-breaks offline.
   if (_ctmBaseUrl && tool === 'run_shell') {
     try {
-      const body = { tool, command: command || '', args: args || [], project_path: projectPath || '', session_id: sessionId || '', agent: 'walle' };
+      // `goal` (the coding task) lets CTM's goal-aligned verifier judge by
+      // goal-alignment instead of its weaker no-goal path; best-effort, a missing
+      // goal degrades to the prior behaviour.
+      const body = { tool, command: command || '', args: args || [], project_path: projectPath || '', session_id: sessionId || '', goal: goal || '', agent: 'walle' };
       const url = `${_ctmBaseUrl}/api/permissions/walle-check${_ctmToken ? '?token=' + encodeURIComponent(_ctmToken) : ''}`;
       const resp = await fetch(url, {
         method: 'POST',
         headers: { 'Content-Type': 'application/json' },
         body: JSON.stringify(body),
-        signal: AbortSignal.timeout(2000),
+        signal: AbortSignal.timeout(CTM_APPROVAL_TIMEOUT_MS),
       });
       if (resp.ok) {
         const result = await resp.json();
@@ -269,6 +281,42 @@ async function checkPermission({ tool, command, commandTokens, commandClauses, a
   return { decision: 'allow', source: 'default', reason: 'No restrictions' };
 }
 
+/**
+ * Register a parked approval with CTM so it surfaces in the shared "Pending" tab
+ * and survives a page reload. Best-effort: when CTM is unreachable the local ask
+ * still stands on its own (durable transcript card + WORK bar), so a failure here
+ * must never block the turn. Returns the CTM row id, or null.
+ */
+async function registerEscalation({ requestId, tool, command, pattern, projectPath, sessionId, reason, riskLevel }) {
+  if (!_ctmBaseUrl || !requestId) return null;
+  try {
+    const url = `${_ctmBaseUrl}/api/permissions/walle-register${_ctmToken ? '?token=' + encodeURIComponent(_ctmToken) : ''}`;
+    const resp = await fetch(url, {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/json' },
+      body: JSON.stringify({
+        request_id: requestId,
+        tool: tool || '',
+        command: command || '',
+        pattern: pattern || '',
+        project_path: projectPath || '',
+        session_id: sessionId || '',
+        reason: reason || '',
+        risk_level: riskLevel || 'medium',
+        agent: 'walle',
+      }),
+      signal: AbortSignal.timeout(4000),
+    });
+    if (resp.ok) {
+      const result = await resp.json();
+      return result && result.rowId != null ? result.rowId : null;
+    }
+  } catch {
+    // CTM unavailable — the local ask still surfaces; nothing to do.
+  }
+  return null;
+}
+
 /**
  * Record a permission decision (for learning)
  */
@@ -286,7 +334,7 @@ async function recordDecision({ tool, command, args, decision, sessionId, projec
 }
 
 module.exports = {
-  checkPermission, recordDecision, configure,
+  checkPermission, recordDecision, registerEscalation, configure,
   evaluateBashClauses,
   DENYLIST, ALWAYS_ASK_TOOLS, NAVIGATION_BUILTINS,
   isDirectoryTrusted, trustDirectory, untrustDirectory, listTrustedDirectories,

package/template/wall-e/tools/permission-rules.js

@@ -145,6 +145,42 @@ const DEFAULT_RULES = [
   { permission: 'bash', pattern: 'sed *', action: 'allow' },
   { permission: 'bash', pattern: 'jq *', action: 'allow' },
   { permission: 'bash', pattern: 'diff *', action: 'allow' },
+  // More read-only inspection commands: allow. These only READ files/metadata or
+  // print derived info — they never write, delete, or execute another binary — so
+  // they should never park a coding turn awaiting approval. (`du` was the trailing
+  // clause that parked the live `cd … && find … | du -sh` turn for ~24 min: the
+  // per-clause most-restrictive evaluator returned `ask` because `du` had no rule.)
+  { permission: 'bash', pattern: 'du *', action: 'allow' },
+  { permission: 'bash', pattern: 'df *', action: 'allow' },
+  { permission: 'bash', pattern: 'stat *', action: 'allow' },
+  { permission: 'bash', pattern: 'file *', action: 'allow' },
+  { permission: 'bash', pattern: 'tree *', action: 'allow' },
+  { permission: 'bash', pattern: 'realpath *', action: 'allow' },
+  { permission: 'bash', pattern: 'readlink *', action: 'allow' },
+  { permission: 'bash', pattern: 'basename *', action: 'allow' },
+  { permission: 'bash', pattern: 'dirname *', action: 'allow' },
+  { permission: 'bash', pattern: 'which *', action: 'allow' },
+  { permission: 'bash', pattern: 'type *', action: 'allow' },
+  { permission: 'bash', pattern: 'whoami *', action: 'allow' },
+  { permission: 'bash', pattern: 'id *', action: 'allow' },
+  { permission: 'bash', pattern: 'hostname *', action: 'allow' },
+  { permission: 'bash', pattern: 'uname *', action: 'allow' },
+  { permission: 'bash', pattern: 'printf *', action: 'allow' },
+  { permission: 'bash', pattern: 'seq *', action: 'allow' },
+  { permission: 'bash', pattern: 'nl *', action: 'allow' },
+  { permission: 'bash', pattern: 'column *', action: 'allow' },
+  { permission: 'bash', pattern: 'tac *', action: 'allow' },
+  { permission: 'bash', pattern: 'rev *', action: 'allow' },
+  { permission: 'bash', pattern: 'fold *', action: 'allow' },
+  { permission: 'bash', pattern: 'comm *', action: 'allow' },
+  { permission: 'bash', pattern: 'cksum *', action: 'allow' },
+  { permission: 'bash', pattern: 'shasum *', action: 'allow' },
+  { permission: 'bash', pattern: 'md5sum *', action: 'allow' },
+  { permission: 'bash', pattern: 'sha256sum *', action: 'allow' },
+  { permission: 'bash', pattern: 'xxd *', action: 'allow' },
+  { permission: 'bash', pattern: 'od *', action: 'allow' },
+  { permission: 'bash', pattern: 'hexdump *', action: 'allow' },
+  { permission: 'bash', pattern: 'strings *', action: 'allow' },
   { permission: 'bash', pattern: 'git status *', action: 'allow' },
   { permission: 'bash', pattern: 'git log *', action: 'allow' },
   { permission: 'bash', pattern: 'git diff *', action: 'allow' },