indusagi-coding-agent 0.2.13 → 0.2.14

package/src/boot/runners/addon-wiring.ts

@@ -35,8 +35,82 @@ import {
   type InterceptorChain,
   createAddonHost,
 } from "../../addons/index.js";
+import { createHash } from "node:crypto";
+import { lstatSync, readFileSync, readdirSync, realpathSync } from "node:fs";
+import { join, relative, resolve } from "node:path";
+import { atomicWritePrivateFileSync, readPrivateFileSync } from "../../security/private-state.js";
 import type { BootContext } from "../contract.js";
 
+interface AddonTrustRecord {
+  readonly root: string;
+  readonly digest: string;
+  readonly approvedAt: string;
+}
+
+interface AddonTrustStore {
+  readonly version: 1;
+  readonly projects: readonly AddonTrustRecord[];
+}
+
+const TRUST_FILE = "addon-trust.json";
+
+function hashAddonTree(addonsDir: string): string | null {
+  let root: string;
+  try {
+    const rootStat = lstatSync(addonsDir);
+    if (rootStat.isSymbolicLink() || !rootStat.isDirectory()) return null;
+    root = realpathSync(addonsDir);
+  } catch (error) {
+    if ((error as NodeJS.ErrnoException).code === "ENOENT") return null;
+    throw error;
+  }
+  const files: string[] = [];
+  const visit = (dir: string): void => {
+    for (const entry of readdirSync(dir, { withFileTypes: true }).sort((a, b) => a.name.localeCompare(b.name))) {
+      const path = join(dir, entry.name);
+      const info = lstatSync(path);
+      if (info.isSymbolicLink()) throw new Error(`Refusing symlink in project addon tree: ${path}`);
+      if (info.isDirectory()) visit(path);
+      else if (info.isFile()) files.push(path);
+      else throw new Error(`Refusing special file in project addon tree: ${path}`);
+    }
+  };
+  visit(root);
+  const hash = createHash("sha256");
+  for (const file of files) {
+    hash.update(relative(root, file));
+    hash.update("\0");
+    hash.update(readFileSync(file));
+    hash.update("\0");
+  }
+  return hash.digest("hex");
+}
+
+function readTrustStore(path: string): AddonTrustStore {
+  const raw = readPrivateFileSync(path);
+  if (raw === null) return { version: 1, projects: [] };
+  try {
+    const parsed = JSON.parse(raw) as Partial<AddonTrustStore>;
+    if (parsed.version !== 1 || !Array.isArray(parsed.projects)) return { version: 1, projects: [] };
+    return {
+      version: 1,
+      projects: parsed.projects.filter((record): record is AddonTrustRecord =>
+        typeof record?.root === "string" &&
+        typeof record?.digest === "string" &&
+        typeof record?.approvedAt === "string"),
+    };
+  } catch {
+    return { version: 1, projects: [] };
+  }
+}
+
+function persistTrust(path: string, root: string, digest: string): void {
+  const store = readTrustStore(path);
+  const projects = store.projects.filter((record) => record.root !== root);
+  projects.push({ root, digest, approvedAt: new Date().toISOString() });
+  atomicWritePrivateFileSync(path, `${JSON.stringify({ version: 1, projects }, null, 2)}\n`);
+}
+
 /**
  * Build and populate the addon host for a run, returning its wired
  * {@link AddonSurfaceBundle}.
@@ -54,10 +128,44 @@ import type { BootContext } from "../contract.js";
  */
 export async function buildAddonHost(ctx: BootContext): Promise<AddonSurfaceBundle> {
   const host = createAddonHost({ handles: {} });
-  host.onFault(() => {
-    // swallow addon load faults so a broken addon cannot sink the session
+  host.onFault((fault) => {
+    process.stderr.write(`Addon ${fault.kind} fault: ${fault.message}\n`);
   });
-  return host.loadAll({ workspace: ctx.invocation.cwd ?? process.cwd() });
+  const workspace = resolve(ctx.invocation.cwd ?? process.cwd());
+  const addonsDir = join(workspace, ".indus", "addons");
+  let canonicalRoot: string;
+  let digest: string | null;
+  try {
+    canonicalRoot = realpathSync(workspace);
+    digest = hashAddonTree(addonsDir);
+  } catch (error) {
+    process.stderr.write(`Project addons blocked: ${error instanceof Error ? error.message : String(error)}\n`);
+    return host.loadAll({ explicitPaths: [] });
+  }
+  if (digest === null) return host.loadAll({ explicitPaths: [] });
+
+  const trustPath = join(ctx.workspace.profileDir, TRUST_FILE);
+  const approvedNow = ctx.invocation.flags["trust-project-addons"] === true;
+  let trusted = false;
+  try {
+    const store = readTrustStore(trustPath);
+    trusted = store.projects.some((record) => record.root === canonicalRoot && record.digest === digest);
+    if (!trusted && approvedNow) {
+      persistTrust(trustPath, canonicalRoot, digest);
+      trusted = true;
+    }
+  } catch (error) {
+    process.stderr.write(`Project addons blocked: ${error instanceof Error ? error.message : String(error)}\n`);
+    return host.loadAll({ explicitPaths: [] });
+  }
+
+  if (!trusted) {
+    process.stderr.write(
+      `Project addons are disabled until explicitly trusted for this exact content. Re-run with --trust-project-addons to approve ${canonicalRoot}.\n`,
+    );
+    return host.loadAll({ explicitPaths: [] });
+  }
+  return host.loadAll({ workspace: canonicalRoot });
 }
 
 /**

package/src/boot/runners/benchmark-integrity.ts

@@ -0,0 +1,107 @@
+import { appendFileSync } from "node:fs";
+import path from "node:path";
+import type { AgentTool } from "../../addons/index.js";
+
+type BenchmarkEnv = Readonly<Record<string, string | undefined>>;
+
+const GUARDED_TOOLS = new Set(["read", "write", "edit", "grep", "find", "ls", "bash"]);
+const PATH_KEYS = new Set(["path", "file", "file_path", "directory", "dir", "cwd", "search_path"]);
+const FORBIDDEN_ABSOLUTE = [
+  "/tests",
+  "/solution",
+  "/solutions",
+  "/reference",
+  "/reference_solution",
+  "/reference-solutions",
+  "/reward.txt",
+  "/rewards",
+  "/grader",
+  "/verifier",
+];
+const FORBIDDEN_BASENAMES = new Set([
+  "solution.sh",
+  "solve.sh",
+  "reward.txt",
+  "expected_answer.txt",
+  "expected_output.txt",
+]);
+
+function normalizeCandidate(value: string, cwd: string): string {
+  return path.resolve(cwd, value);
+}
+
+function forbiddenPath(value: string, cwd: string): boolean {
+  const resolved = normalizeCandidate(value, cwd);
+  const base = path.basename(resolved).toLowerCase();
+  if (FORBIDDEN_BASENAMES.has(base)) return true;
+  return FORBIDDEN_ABSOLUTE.some((prefix) => resolved === prefix || resolved.startsWith(`${prefix}/`));
+}
+
+function pathValues(args: unknown): string[] {
+  if (args === null || typeof args !== "object" || Array.isArray(args)) return [];
+  const values: string[] = [];
+  for (const [key, value] of Object.entries(args as Record<string, unknown>)) {
+    if (PATH_KEYS.has(key) && typeof value === "string") values.push(value);
+  }
+  return values;
+}
+
+function forbiddenShell(command: string, cwd: string): boolean {
+  const lower = command.toLowerCase();
+  if ([...FORBIDDEN_BASENAMES].some((name) => lower.includes(name))) return true;
+  if (FORBIDDEN_ABSOLUTE.some((prefix) => new RegExp(`(^|[\\s'\"=])${prefix.replaceAll("/", "\\/")}(?:[/\\s'\";|&]|$)`, "i").test(command))) return true;
+  if (/(^|[\s'"=])\.\.\/(?:tests|solutions?|reference(?:[-_]solutions?)?|grader|verifier)(?:[/\s'";|&]|$)/i.test(command)) return true;
+  if (/\b(?:find|ls|grep|rg)\s+(?:-[^\s]+\s+)*\/(?:\s|$)/i.test(command)) return true;
+  const retrievesOnline = /\b(?:curl|wget|git\s+clone|gh\s+repo\s+clone)\b/i.test(command);
+  const benchmarkMaterial = /terminal[-_ ]bench|reference[-_ ]solution|solution\.sh|solve\.sh|benchmark[-_ ]solution/i.test(command);
+  if (retrievesOnline && benchmarkMaterial) return true;
+  return false;
+}
+
+function denialReason(tool: string, args: unknown, cwd: string): string | undefined {
+  if (tool === "bash") {
+    const command = typeof (args as { command?: unknown } | null)?.command === "string"
+      ? (args as { command: string }).command
+      : "";
+    if (forbiddenShell(command, cwd)) return "Terminal-Bench integrity guard blocked benchmark-owned or solution material.";
+    return undefined;
+  }
+  if (pathValues(args).some((candidate) => forbiddenPath(candidate, cwd))) {
+    return "Terminal-Bench integrity guard blocked benchmark-owned or solution material.";
+  }
+  return undefined;
+}
+
+function recordDenial(tool: string, callId: string, reason: string, env: BenchmarkEnv): void {
+  const auditPath = env.INDUSAGI_BENCHMARK_AUDIT_LOG ?? "/logs/agent/integrity-denials.jsonl";
+  try {
+    appendFileSync(auditPath, `${JSON.stringify({ type: "integrity_denial", tool, call_id: callId, reason })}\n`, { encoding: "utf8" });
+  } catch {
+    // Blocking must remain fail-closed even if the optional audit sink is unavailable.
+  }
+}
+
+function wrapOne(tool: AgentTool, cwd: string, env: BenchmarkEnv): AgentTool {
+  const execute = tool.execute.bind(tool);
+  return {
+    ...tool,
+    async execute(callId: string, args: unknown, signal?: AbortSignal, onUpdate?: unknown) {
+      const reason = denialReason(tool.name, args, cwd);
+      if (reason !== undefined) {
+        recordDenial(tool.name, callId, reason, env);
+        return {
+          content: [{ type: "text" as const, text: reason }],
+          details: undefined,
+          isError: true,
+        };
+      }
+      return execute(callId, args as never, signal as never, onUpdate as never);
+    },
+  };
+}
+
+/** Apply fail-closed Terminal-Bench integrity checks at every enabled tool boundary. */
+export function wrapToolsForTerminalBench(tools: AgentTool[], cwd: string, env: BenchmarkEnv = process.env): AgentTool[] {
+  if (env.INDUSAGI_BENCHMARK_PROFILE !== "terminal-bench") return tools;
+  return tools.map((tool) => GUARDED_TOOLS.has(tool.name) ? wrapOne(tool, cwd, env) : tool);
+}

package/src/boot/runners/repl-runner.ts

@@ -14,6 +14,7 @@ import { SessionLibrary } from "../../sessions/library.js";
 import { PreferenceStore } from "../../settings/manager.js";
 import { sessionScopeDir } from "./session.js";
 import { createAuthVault } from "../auth-vault.js";
+import type { SessionConductor } from "../../conductor/contract.js";
 import type { BootContext, Runner } from "../contract.js";
 import { buildSessionConductor } from "./session.js";
 import { resolveServerGatewayUrls } from "./server-mode.js";
@@ -28,7 +29,7 @@ const EXIT_OK = 0;
  * wired here from the boot-layer pieces so the conductor and the UI share one
  * credential store and one gateway-base-url mapping.
  */
-export function buildOverlayServices(ctx: BootContext, conductor: { updateGatewayBaseUrls(map: Record<string, string>): void }) {
+export function buildOverlayServices(ctx: BootContext, conductor: SessionConductor) {
   const cwd = ctx.invocation.cwd ?? process.cwd();
   const vault = createAuthVault(ctx.workspace.authPath);
   return {

package/src/boot/runners/session.ts

@@ -9,7 +9,7 @@
  * is constructed until the first turn runs.
  */
 import { existsSync, readFileSync } from "node:fs";
-import { join } from "node:path";
+import { isAbsolute, join, resolve } from "node:path";
 import { homedir } from "node:os";
 import { createMCPAgentToolFactory, loadMCPConfig, MCPClientPool } from "indusagi/mcp";
 import {
@@ -61,7 +61,9 @@ import { DiskMemoryStore, memoryDirFor, loadMemoryDoc } from "./memdir.js";
 import { isReasoningEffortSupported } from "../../models.js";
 import type { CodingAgentThinkingLevel } from "../../conductor/contract.js";
 import { buildAddonHost, wrapToolsWithAddons, concatAddonTools } from "./addon-wiring.js";
+import { wrapToolsForTerminalBench } from "./benchmark-integrity.js";
 import type { BootContext, Invocation } from "../contract.js";
+import { readPrivateFileSync } from "../../security/private-state.js";
 
 interface AuthFileData {
   [provider: string]: unknown;
@@ -70,8 +72,9 @@ interface AuthFileData {
 function authenticatedProviders(ctx: BootContext): string[] {
   try {
     const path = ctx.workspace.authPath;
-    if (!existsSync(path)) return [];
-    const data = JSON.parse(readFileSync(path, "utf8")) as AuthFileData;
+    const raw = readPrivateFileSync(path);
+    if (raw === null) return [];
+    const data = JSON.parse(raw) as AuthFileData;
     return Object.keys(data).filter((id) => {
       const accounts = data[id];
       return id.length > 0 && accounts !== null && typeof accounts === "object" && Object.keys(accounts as object).length > 0;
@@ -303,8 +306,11 @@ export function composeSystem(
   skills: readonly SkillCard[] = [],
   memoryDoc?: ContextDoc,
 ): string {
+  const approvedExternalPaths = Array.isArray(inv.flags["allow-context-import"])
+    ? inv.flags["allow-context-import"].filter((path): path is string => typeof path === "string").map((path) => isAbsolute(path) ? path : resolve(cwd, path))
+    : [];
   const contextDocs = [
-    ...gatherContextDocs(cwd, homedir()),
+    ...gatherContextDocs(cwd, homedir(), { approvedExternalPaths }),
     ...memoryDoc ? [memoryDoc] : [],
   ];
   let base = inv.system !== undefined ? resolveText(inv.system) : composeBriefing({ tools, contextDocs, skills });
@@ -431,13 +437,14 @@ function lastUserTurnStart(messages: Array<{ role: string }>): number {
 
 const condenseTranscript = async (
   messages: Array<{ role: string }>,
-  opts?: { model?: unknown; apiKey?: string; signal?: AbortSignal; force?: boolean },
+  opts?: { model?: unknown; apiKey?: string; signal?: AbortSignal; force?: boolean; instructions?: string },
 ): Promise<Array<{ role: string }>> => {
   const model = opts?.model;
   const deps = model ? {
     model,
     ...opts?.apiKey !== undefined ? { apiKey: opts.apiKey } : {},
     ...opts?.signal !== undefined ? { signal: opts.signal } : {},
+    ...opts?.instructions !== undefined ? { instructions: opts.instructions } : {},
   } : {};
   const cleared = clearStaleToolResults(messages as never) as Array<{ role: string }>;
   if (opts?.force) {
@@ -475,12 +482,12 @@ function gatherPermissionRules(store: PreferenceStore): PermissionRule[] {
   return rules;
 }
 
-function resolveDefaultMode(store: PreferenceStore): PermissionMode {
+export function resolveDefaultMode(store: PreferenceStore): PermissionMode {
   for (const tier of [store.projectOverrides(), store.globalDefaults()]) {
     const mode = tier.permissions?.defaultMode;
     if (mode !== undefined && isPermissionMode(mode)) return mode;
   }
-  return "default";
+  return "acceptEdits";
 }
 
 function readOnlyNamesFromDeck(tools: AgentTool[]): Set<string> {
@@ -598,7 +605,10 @@ export async function buildSessionConductor(ctx: BootContext) {
       basePath: typeof inv.sarvamBasePath === "string" ? inv.sarvamBasePath : typeof inv.flags?.["sarvam-base-path"] === "string" ? inv.flags["sarvam-base-path"] : undefined,
     })),
   ];
-  const tools = wrapToolsWithAddons(concatAddonTools(deck, addons), addons);
+  const tools = wrapToolsForTerminalBench(
+    wrapToolsWithAddons(concatAddonTools(deck, addons), addons),
+    cwd,
+  );
   const skills = gatherModelSkills(cwd);
   const system = composeSystem(tools, inv, cwd, skills, memoryDoc);
   const thinking = resolveThinkingLevel(inv.thinking, modelId);

package/src/boot/server-token.ts

@@ -18,9 +18,10 @@
  * ISO timestamp, on disk) conversion, which lets {@link isServerTokenExpired}
  * decide freshness without re-deriving the clock offset.
  */
-import { mkdir, readFile, unlink, writeFile } from "node:fs/promises";
+import { unlink } from "node:fs/promises";
 import os from "node:os";
 import path from "node:path";
+import { atomicWritePrivateFileSync, readPrivateFileSync } from "../security/private-state.js";
 
 /** Root of the indus-server. Used to build the gateway base URL and the device-login endpoints. Any trailing slash(es) are stripped so callers can append paths with a single separator. */
 export const INDUS_SERVER_URL: string = process.env.INDUS_SERVER_URL?.replace(/\/+$/, "") ?? "https://indus-server.vercel.app";
@@ -29,6 +30,16 @@ export const CONFIG_DIR: string = path.join(os.homedir(), ".indusagi", "agent");
 /** Absolute path of the JSON file the session token is persisted to. */
 export const TOKEN_FILE: string = path.join(CONFIG_DIR, "server-token.json");
 
+export interface ServerTokenPaths {
+  readonly configDir?: string;
+  readonly tokenFile?: string;
+}
+
+function resolveTokenPaths(paths: ServerTokenPaths = {}): { configDir: string; tokenFile: string } {
+  const configDir = paths.configDir ?? CONFIG_DIR;
+  return { configDir, tokenFile: paths.tokenFile ?? path.join(configDir, "server-token.json") };
+}
+
 /** On-disk token shape (what {@link storeServerToken} writes / {@link getServerToken} returns). */
 export interface TokenData {
   /** The better-auth session token, used as the gateway api key in server mode. */
@@ -65,9 +76,10 @@ export interface ServerTokenInput {
  *
  * @returns the parsed {@link TokenData}, or `null` when nothing is stored.
  */
-export async function getServerToken(): Promise<TokenData | null> {
+export async function getServerToken(paths: ServerTokenPaths = {}): Promise<TokenData | null> {
   try {
-    const data = await readFile(TOKEN_FILE, "utf8");
+    const data = readPrivateFileSync(resolveTokenPaths(paths).tokenFile);
+    if (data === null) return null;
     return JSON.parse(data);
   } catch {
     return null;
@@ -83,9 +95,9 @@ export async function getServerToken(): Promise<TokenData | null> {
  * @param token the device-flow token payload.
  * @returns `true` on success, `false` if the write failed.
  */
-export async function storeServerToken(token: ServerTokenInput): Promise<boolean> {
+export async function storeServerToken(token: ServerTokenInput, paths: ServerTokenPaths = {}): Promise<boolean> {
   try {
-    await mkdir(CONFIG_DIR, { recursive: true });
+    const { tokenFile } = resolveTokenPaths(paths);
     const tokenData = {
       access_token: token.access_token,
       refresh_token: token.refresh_token,
@@ -94,10 +106,7 @@ export async function storeServerToken(token: ServerTokenInput): Promise<boolean
       expires_at: token.expires_in !== undefined ? new Date(Date.now() + token.expires_in * 1000).toISOString() : null,
       created_at: new Date().toISOString(),
     };
-    await writeFile(TOKEN_FILE, `${JSON.stringify(tokenData, null, 2)}\n`, {
-      encoding: "utf8",
-      mode: 384,
-    });
+    atomicWritePrivateFileSync(tokenFile, `${JSON.stringify(tokenData, null, 2)}\n`);
     return true;
   } catch (error) {
     console.error("Failed to store server token:", (error as Error).message);
@@ -111,9 +120,9 @@ export async function storeServerToken(token: ServerTokenInput): Promise<boolean
  *
  * @returns `true` when a file was deleted, `false` when none existed / removal failed.
  */
-export async function clearServerToken(): Promise<boolean> {
+export async function clearServerToken(paths: ServerTokenPaths = {}): Promise<boolean> {
   try {
-    await unlink(TOKEN_FILE);
+    await unlink(resolveTokenPaths(paths).tokenFile);
     return true;
   } catch {
     return false;

package/src/briefing/context-docs.ts

@@ -1,19 +1,151 @@
-import { existsSync, readFileSync, realpathSync } from "node:fs";
-import { dirname, extname, isAbsolute, join, parse, resolve } from "node:path";
+import { closeSync, constants, fstatSync, lstatSync, openSync, readFileSync, realpathSync } from "node:fs";
+import { basename, dirname, extname, isAbsolute, join, parse, resolve, sep } from "node:path";
 import type { ContextDoc } from "./contract.js";
 
-export interface GatherContextDocsOptions { readonly maxImportDepth?: number; readonly maxBytesPerDoc?: number; }
+export interface GatherContextDocsOptions {
+  readonly maxImportDepth?: number;
+  readonly maxBytesPerDoc?: number;
+  /** Exact external files the user explicitly approved for this run. */
+  readonly approvedExternalPaths?: readonly string[];
+}
+
 export const DEFAULT_MAX_IMPORT_DEPTH = 5;
 export const DEFAULT_MAX_BYTES_PER_DOC = 40_000;
 export const CANDIDATE_FILES = ["AGENTS.md", "CLAUDE.md", "INDUSAGI.md", "CLAUDE.local.md", "AGENTS.local.md", join(".indusagi", "CLAUDE.md"), join(".claude", "CLAUDE.md")];
-export const TEXT_FILE_EXTENSIONS = new Set([".md", ".markdown", ".txt", ".text", ".json", ".jsonc", ".yaml", ".yml", ".toml", ".xml", ".csv", ".html", ".htm", ".css", ".js", ".ts", ".tsx", ".jsx", ".mjs", ".cjs", ".mts", ".cts", ".py", ".rb", ".go", ".rs", ".sh", ".env"]);
+export const TEXT_FILE_EXTENSIONS = new Set([".md", ".markdown", ".txt", ".text", ".json", ".jsonc", ".yaml", ".yml", ".toml", ".xml", ".csv", ".html", ".htm", ".css", ".js", ".ts", ".tsx", ".jsx", ".mjs", ".cjs", ".mts", ".cts", ".py", ".rb", ".go", ".rs", ".sh"]);
 export const IMPORT_REGEX = /(?:^|\s)@((?:[^\s\\]|\\ )+)/g;
 
-export function shortenPath(path: string, cwd: string, home: string): string { if (cwd && path.startsWith(cwd)) { const rest = path.slice(cwd.length).replace(/^[/\\]+/, ""); return rest ? `./${rest}` : "."; } return home && path.startsWith(home) ? `~${path.slice(home.length)}` : path; }
-export function dirChain(cwd: string): string[] { const chain: string[] = []; let current = cwd; for (let i = 0; i < 256; i++) { chain.push(current); const parent = dirname(current); if (parent === current || current === parse(current).root) break; current = parent; } return chain.reverse(); }
-export function safeRealpath(path: string): string { try { return realpathSync(path); } catch { return path; } }
-export function isTextFile(path: string): boolean { const extension = extname(path).toLowerCase(); return !extension || TEXT_FILE_EXTENSIONS.has(extension); }
-export function readFileBody(path: string): string | null { if (!existsSync(path)) return null; try { const body = readFileSync(path, "utf8").trim(); return body || null; } catch { return null; } }
-export function extractImports(body: string, baseDir: string, home: string): string[] { const out: string[] = []; IMPORT_REGEX.lastIndex = 0; let match: RegExpExecArray | null; while ((match = IMPORT_REGEX.exec(body))) { let spec = match[1]; if (!spec) continue; const hash = spec.indexOf("#"); if (hash >= 0) spec = spec.slice(0, hash); spec = spec.replace(/\\ /g, " ").trim(); if (!spec) continue; const absolute = spec.startsWith("~/") ? join(home, spec.slice(2)) : isAbsolute(spec) ? spec : resolve(baseDir, spec); if (isTextFile(absolute)) out.push(absolute); } return out; }
-export function loadDocTree(path: string, cwd: string, home: string, seen: Set<string>, depth: number, maxDepth: number, maxBytes: number, out: ContextDoc[]): void { const real = safeRealpath(path); if (seen.has(real)) return; seen.add(real); const body = readFileBody(path); if (body === null) return; out.push({ path: shortenPath(path, cwd, home), body: body.length > maxBytes ? body.slice(0, maxBytes) : body }); if (depth >= maxDepth) return; for (const child of extractImports(body, dirname(path), home)) loadDocTree(child, cwd, home, seen, depth + 1, maxDepth, maxBytes, out); }
-export function gatherContextDocs(cwd: string, home: string, opts?: GatherContextDocsOptions): readonly ContextDoc[] { const out: ContextDoc[] = []; try { const seen = new Set<string>(); const roots = dirChain(cwd); if (home) roots.push(home); for (const dir of roots) for (const name of CANDIDATE_FILES) loadDocTree(join(dir, name), cwd, home, seen, 0, opts?.maxImportDepth ?? DEFAULT_MAX_IMPORT_DEPTH, opts?.maxBytesPerDoc ?? DEFAULT_MAX_BYTES_PER_DOC, out); } catch { return out; } return out; }
+const NO_FOLLOW = constants.O_NOFOLLOW ?? 0;
+const SECRET_BASENAMES = new Set([
+  ".env", "credentials", "credentials.json", "id_rsa", "id_dsa", "id_ecdsa", "id_ed25519",
+]);
+const SECRET_EXTENSIONS = new Set([".key", ".pem", ".p12", ".pfx"]);
+
+export function shortenPath(path: string, cwd: string, home: string): string {
+  if (cwd && (path === cwd || path.startsWith(`${cwd}${sep}`))) {
+    const rest = path.slice(cwd.length).replace(/^[/\\]+/, "");
+    return rest ? `./${rest}` : ".";
+  }
+  return home && (path === home || path.startsWith(`${home}${sep}`)) ? `~${path.slice(home.length)}` : path;
+}
+
+/** Retained for API compatibility; context discovery no longer walks this chain. */
+export function dirChain(cwd: string): string[] {
+  const chain: string[] = [];
+  let current = cwd;
+  for (let i = 0; i < 256; i++) {
+    chain.push(current);
+    const parent = dirname(current);
+    if (parent === current || current === parse(current).root) break;
+    current = parent;
+  }
+  return chain.reverse();
+}
+
+export function safeRealpath(path: string): string {
+  try { return realpathSync(path); } catch { return path; }
+}
+
+export function isTextFile(path: string): boolean {
+  const extension = extname(path).toLowerCase();
+  return !extension || TEXT_FILE_EXTENSIONS.has(extension);
+}
+
+export function isLikelySecretFile(path: string): boolean {
+  const name = basename(path).toLowerCase();
+  return SECRET_BASENAMES.has(name) || name.startsWith(".env.") || SECRET_EXTENSIONS.has(extname(name));
+}
+
+export function readFileBody(path: string): string | null {
+  let fd: number | undefined;
+  try {
+    const before = lstatSync(path);
+    if (before.isSymbolicLink() || !before.isFile()) return null;
+    fd = openSync(path, constants.O_RDONLY | NO_FOLLOW);
+    if (!fstatSync(fd).isFile()) return null;
+    const body = readFileSync(fd, "utf8").trim();
+    return body || null;
+  } catch {
+    return null;
+  } finally {
+    if (fd !== undefined) closeSync(fd);
+  }
+}
+
+export function extractImports(body: string, baseDir: string, home: string): string[] {
+  const out: string[] = [];
+  IMPORT_REGEX.lastIndex = 0;
+  let match: RegExpExecArray | null;
+  while ((match = IMPORT_REGEX.exec(body))) {
+    let spec = match[1];
+    if (!spec) continue;
+    const hash = spec.indexOf("#");
+    if (hash >= 0) spec = spec.slice(0, hash);
+    spec = spec.replace(/\\ /g, " ").trim();
+    if (!spec) continue;
+    const absolute = spec.startsWith("~/") ? join(home, spec.slice(2)) : isAbsolute(spec) ? spec : resolve(baseDir, spec);
+    if (isTextFile(absolute)) out.push(absolute);
+  }
+  return out;
+}
+
+function canonicalExistingFile(path: string): string | null {
+  try {
+    const before = lstatSync(path);
+    if (before.isSymbolicLink() || !before.isFile()) return null;
+    return realpathSync(path);
+  } catch {
+    return null;
+  }
+}
+
+function isWithin(root: string, candidate: string): boolean {
+  return candidate === root || candidate.startsWith(`${root}${sep}`);
+}
+
+interface LoadPolicy {
+  readonly root: string;
+  readonly approvedExternal: ReadonlySet<string>;
+}
+
+function loadTrustedDocTree(path: string, cwd: string, home: string, seen: Set<string>, depth: number, maxDepth: number, maxBytes: number, out: ContextDoc[], policy: LoadPolicy): void {
+  if (isLikelySecretFile(path)) return;
+  const real = canonicalExistingFile(path);
+  if (real === null || seen.has(real) || isLikelySecretFile(real)) return;
+  if (!isWithin(policy.root, real) && !policy.approvedExternal.has(real)) return;
+  seen.add(real);
+  const body = readFileBody(real);
+  if (body === null) return;
+  out.push({ path: shortenPath(real, cwd, home), body: body.length > maxBytes ? body.slice(0, maxBytes) : body });
+  if (depth >= maxDepth) return;
+  for (const child of extractImports(body, dirname(real), home)) {
+    loadTrustedDocTree(child, cwd, home, seen, depth + 1, maxDepth, maxBytes, out, policy);
+  }
+}
+
+/** Compatibility wrapper with secure default confinement to cwd. */
+export function loadDocTree(path: string, cwd: string, home: string, seen: Set<string>, depth: number, maxDepth: number, maxBytes: number, out: ContextDoc[]): void {
+  let root: string;
+  try { root = realpathSync(cwd); } catch { return; }
+  loadTrustedDocTree(path, root, home, seen, depth, maxDepth, maxBytes, out, { root, approvedExternal: new Set() });
+}
+
+export function gatherContextDocs(cwd: string, home: string, opts: GatherContextDocsOptions = {}): readonly ContextDoc[] {
+  const out: ContextDoc[] = [];
+  try {
+    const root = realpathSync(cwd);
+    const approvedExternal = new Set<string>();
+    for (const path of opts.approvedExternalPaths ?? []) {
+      const real = canonicalExistingFile(path);
+      if (real !== null && !isLikelySecretFile(real)) approvedExternal.add(real);
+    }
+    const policy = { root, approvedExternal };
+    const seen = new Set<string>();
+    for (const name of CANDIDATE_FILES) {
+      loadTrustedDocTree(join(root, name), root, home, seen, 0, opts.maxImportDepth ?? DEFAULT_MAX_IMPORT_DEPTH, opts.maxBytesPerDoc ?? DEFAULT_MAX_BYTES_PER_DOC, out, policy);
+    }
+  } catch {
+    return out;
+  }
+  return out;
+}

package/src/channels/oneshot.ts

@@ -49,6 +49,12 @@ function ndjsonStrategy(): OneshotStrategy {
     },
     onSignal(signal: unknown, ctx: ChannelContext): void {
       const s = signal as { kind: string };
+      // Running shell commands can emit thousands of rolling progress snapshots,
+      // each containing the same bounded output tail. Serializing every snapshot
+      // ignores stdout backpressure and can retain hundreds of megabytes. The
+      // terminal tool result is emitted in full by tool_end, which is the durable
+      // event required by one-shot consumers and benchmark trajectory conversion.
+      if (s.kind === "tool_update") return;
       ctx.out.write(ctx.framer.encodeLine({ type: "signal", name: s.kind, body: s }));
     },
     finish(state: ConductorState, ctx: ChannelContext): number {