jules-orchestrator-kit 0.38.0 → 0.38.2

package/src/rules_budget.mjs

@@ -1,179 +1 @@
-import { readFileSync, readdirSync, statSync } from "node:fs";
-import { join } from "node:path";
-import { createHash } from "node:crypto";
-
-const DEFAULT_MAX_CHARS = 10000; // Safe threshold below Antigravity 12k & Claude 25k limits
-const DEFAULT_MAX_LINES = 250;
-
-export const SENTINEL_BEGIN = "JULES_RULES_SENTINEL BEGIN";
-export const SENTINEL_END = "JULES_RULES_SENTINEL END";
-
-/**
- * Audit character and line counts of compiled instruction files to prevent truncation.
- *
- * @param {string} root - Project root directory
- * @param {Object} [opts] - Options (maxChars, maxLines)
- * @returns {{ ok: boolean, violations: Array<{ path: string, charCount: number, lineCount: number, reason: string }> }}
- */
-export function checkRulesBudget(root = process.cwd(), opts = {}) {
-  const maxChars = opts.maxChars ?? DEFAULT_MAX_CHARS;
-  const maxLines = opts.maxLines ?? DEFAULT_MAX_LINES;
-  const violations = [];
-
-  const candidateFiles = [
-    "AGENTS.md",
-    "CLAUDE.md",
-    "GEMINI.md",
-    ".cursorrules",
-    "JULES_RULES_TEMPLATE.md",
-  ];
-
-  // Scan .agent/rules/ directory if it exists
-  const rulesDir = join(root, ".agent", "rules");
-  try {
-    const files = readdirSync(rulesDir);
-    for (const f of files) {
-      if (f.endsWith(".md")) {
-        candidateFiles.push(join(".agent", "rules", f));
-      }
-    }
-  } catch (_) {}
-
-  for (const relPath of candidateFiles) {
-    const fullPath = join(root, relPath);
-    if (!existsSync(fullPath)) continue;
-
-    try {
-      const content = readFileSync(fullPath, "utf-8");
-      const charCount = content.length;
-      const lineCount = content.split("\n").length;
-
-      if (charCount > maxChars) {
-        violations.push({
-          path: relPath,
-          charCount,
-          lineCount,
-          reason: `Exceeds max character budget of ${maxChars} chars (${charCount} chars). Antigravity silently truncates rules > 12,000 chars.`,
-        });
-      } else if (lineCount > maxLines) {
-        violations.push({
-          path: relPath,
-          charCount,
-          lineCount,
-          reason: `Exceeds max line budget of ${maxLines} lines (${lineCount} lines). Claude Code auto-memory truncates > 200 lines.`,
-        });
-      }
-    } catch (_) {}
-  }
-
-  return {
-    ok: violations.length === 0,
-    violations,
-  };
-}
-
-/**
- * Compiles markdown/rules files into a single unified context block wrapped
- * in SHA-256 and byte-length anti-truncation sentinels.
- */
-export function compileRules(root = process.cwd(), _opts = {}) {
-  const candidateFiles = [
-    "AGENTS.md",
-    "CLAUDE.md",
-    "GEMINI.md",
-    ".cursorrules",
-    "JULES_RULES_TEMPLATE.md",
-  ];
-
-  const rulesDir = join(root, ".agent", "rules");
-  try {
-    const files = readdirSync(rulesDir);
-    for (const f of files) {
-      if (f.endsWith(".md")) {
-        candidateFiles.push(join(".agent", "rules", f));
-      }
-    }
-  } catch (_) {}
-
-  const sources = [];
-  const sections = [];
-
-  for (const relPath of candidateFiles) {
-    const fullPath = join(root, relPath);
-    if (!existsSync(fullPath)) continue;
-    try {
-      const raw = readFileSync(fullPath, "utf-8");
-      const body = raw.replace(/^\uFEFF?---\r?\n[\s\S]*?\r?\n---\r?\n?/, "").trim();
-      if (!body) continue;
-      sections.push(`<!-- source: ${relPath} -->\n${body}`);
-      sources.push(relPath);
-    } catch (_) {}
-  }
-
-  const body = sections.join("\n\n---\n\n");
-  const bodyLen = Buffer.byteLength(body, "utf-8");
-  const sha256 = createHash("sha256").update(body).digest("hex");
-
-  const header = `<!-- ${SENTINEL_BEGIN} len=${bodyLen} sha256=${sha256} -->`;
-  const footer = `<!-- ${SENTINEL_END} len=${bodyLen} sha256=${sha256} -->`;
-  const compiled = `${header}\n${body}\n${footer}\n`;
-
-  return { compiled, body, bodyLen, sha256, sources };
-}
-
-/**
- * Verifies that a compiled rule string has not been truncated or tampered with by downstream LLMs.
- */
-export function verifyRulesSentinel(compiled) {
-  const errors = [];
-  if (typeof compiled !== "string" || compiled.length === 0) {
-    return { ok: false, errors: ["empty input"] };
-  }
-
-  const beginRe = new RegExp(`<!--\\s*${SENTINEL_BEGIN.replace(/ /g, "\\s+")}\\s+len=(\\d+)\\s+sha256=([0-9a-f]{64})\\s*-->`);
-  const endRe = new RegExp(`<!--\\s*${SENTINEL_END.replace(/ /g, "\\s+")}\\s+len=(\\d+)\\s+sha256=([0-9a-f]{64})\\s*-->`);
-
-  const beginMatch = beginRe.exec(compiled);
-  const endMatch = endRe.exec(compiled);
-
-  if (!beginMatch) { errors.push("missing or malformed BEGIN sentinel"); return { ok: false, errors }; }
-  if (!endMatch) { errors.push("missing or malformed END sentinel"); return { ok: false, errors }; }
-
-  const beginLen = Number(beginMatch[1]);
-  const beginSha = beginMatch[2];
-  const endLen = Number(endMatch[1]);
-  const endSha = endMatch[2];
-
-  if (beginLen !== endLen) errors.push(`length mismatch: BEGIN=${beginLen} END=${endLen}`);
-  if (beginSha !== endSha) errors.push("checksum mismatch between BEGIN and END sentinels");
-
-  const bodyStart = beginMatch.index + beginMatch[0].length;
-  const bodyEnd = endMatch.index;
-  const body = compiled.slice(bodyStart, bodyEnd).replace(/^\r?\n/, "").replace(/\r?\n$/, "");
-  const actualLen = Buffer.byteLength(body, "utf-8");
-
-  if (actualLen !== beginLen) {
-    errors.push(`body length ${actualLen} != declared ${beginLen} (possible truncation or injection)`);
-  }
-
-  const recomputed = createHash("sha256").update(body).digest("hex");
-  if (recomputed !== beginSha) {
-    errors.push(`body checksum ${recomputed} != declared ${beginSha} (content tampered or truncated)`);
-  }
-
-  return {
-    ok: errors.length === 0,
-    errors,
-    bodyLen: actualLen,
-    sha256: recomputed,
-  };
-}
-
-function existsSync(p) {
-  try {
-    return statSync(p).isFile();
-  } catch (_) {
-    return false;
-  }
-}
-
+export * from "./rules-budget.mjs";

package/src/security.mjs

@@ -14,20 +14,21 @@ export const HIGH_CONFIDENCE_PATTERNS = [
 
   /\bAKIA[0-9A-Z]{16}\b/g,
   /\bASIA[0-9A-Z]{16}\b/g,
-  /\baws_secret_access_key\s*=\s*['"]?[A-Za-z0-9\/+=]{40}['"]?/gi,
+  /\baws_secret_access_key\s*[:=]\s*['"]?[A-Za-z0-9\/+=]{40}['"]?/gi,
 
-  /-----BEGIN (?:RSA|DSA|EC|OPENSSH|PRIVATE)(?:\s+PRIVATE)? KEY-----[\s\S]*?-----END (?:RSA|DSA|EC|OPENSSH|PRIVATE)(?:\s+PRIVATE)? KEY-----/g,
+  /-----BEGIN (?:RSA|DSA|EC|OPENSSH|ENCRYPTED|PRIVATE)(?:\s+PRIVATE)? KEY-----[\s\S]*?-----END (?:RSA|DSA|EC|OPENSSH|ENCRYPTED|PRIVATE)(?:\s+PRIVATE)? KEY-----/g,
   /PuTTY-User-Key-File-[0-9]:[^\n]+/g,
 
   /\bsk_live_[0-9a-zA-Z]{24,99}\b/g,
   /\brk_live_[0-9a-zA-Z]{24,99}\b/g,
   /\bnpm_[0-9a-zA-Z]{36}\b/g,
+  /\/\/[^/\s]+\/:_authToken=[A-Za-z0-9_-]{20,}/g,
   /\bglpat-[0-9a-zA-Z_-]{20,99}\b/g,
   /\bGOCSPX-[0-9a-zA-Z_-]{28,99}\b/g,
 
   /\bAIzaSy[A-Za-z0-9_-]{33}\b/g,
   /\bya29\.[A-Za-z0-9_-]{20,255}\b/g,
-  /\b(?:sk-ant-api03-|sk-proj-)[A-Za-z0-9_-]{32,255}\b/g,
+  /\b(?:sk-ant-api03-|sk-proj-|sk-)[A-Za-z0-9_-]{20,255}\b/g,
 
   /https:\/\/hooks\.slack\.com\/services\/T[A-Za-z0-9_]{8,}\/B[A-Za-z0-9_]{8,}\/[A-Za-z0-9_]{24,}/g,
   /\bxox[baprs]-[0-9a-zA-Z-]{10,48}\b/g,
@@ -39,21 +40,35 @@ export const LOW_CONFIDENCE_PATTERNS = [
   /Bearer\s+[A-Za-z0-9._~+/-]{10,255}/gi,
   /Authorization:\s*Bearer\s+[A-Za-z0-9._~+/-]{10,255}/gi,
   /\bsk_test_[0-9a-zA-Z]{24,99}\b/g,
-  /(?:api[_-]?key|secret|password|passwd|token|auth[_-]?token)\s*[:=]\s*['"]([^'"]{8,128})['"]/gi,
+  /(?:api[_-]?key|secret|password|passwd|token|auth[_-]?token)\s*[:=]\s*(?:['"`]([^'"`\n]{8,128})['"`]|([A-Za-z0-9._~+/-]{16,128}))/gi,
 ];
 
+export function safeRenameSync(src, dst) {
+  try {
+    renameSync(src, dst);
+  } catch (err) {
+    if (process.platform === "win32" && (err.code === "EEXIST" || err.code === "EPERM")) {
+      try { unlinkSync(dst); } catch (_) {}
+      renameSync(src, dst);
+    } else {
+      throw err;
+    }
+  }
+}
+
 /**
  * TOCTOU-safe atomic file write using O_CREAT|O_EXCL|O_WRONLY temp file in target dir.
  */
 export function safeAtomicWrite(filePath, content, options = {}) {
   const mode = options.mode || 0o644;
   const encoding = options.encoding || "utf-8";
+  const rejectSymlinks = options.rejectSymlinks !== false;
 
   if (existsSync(filePath)) {
     const stat = lstatSync(filePath);
     if (stat.isSymbolicLink()) {
       const realPath = realpathSync(filePath);
-      if (options.rejectSymlinks) {
+      if (rejectSymlinks) {
         throw new Error(`TOCTOU Guard: Refusing to write to symlink ${filePath} -> ${realPath}`);
       }
     }
@@ -71,7 +86,7 @@ export function safeAtomicWrite(filePath, content, options = {}) {
     }
     closeSync(fd);
     fd = undefined;
-    renameSync(tempFile, filePath);
+    safeRenameSync(tempFile, filePath);
     return true;
   } catch (err) {
     if (fd !== undefined) {
@@ -381,52 +396,69 @@ const INVISIBLE_CHARS = /[\u00AD\u200B-\u200F\u2028\u2029\u202A-\u202E\u2060-\u2
 // A credential split across a source-level string concatenation is invisible to
 // a line-oriented scanner. This is not only an evasion technique — formatters
 // wrap long string literals exactly this way, so it also happens by accident.
-const STRING_CONCAT_JOIN = /(["'`])\s*\+\s*(["'`])/g;
+const STRING_CONCAT_JOIN = /(["'`])\s*(?:\/\*[\s\S]*?\*\/)?\s*\+\s*(?:\/\*[\s\S]*?\*\/)?\s*(["'`])/g;
+
+function tryHexDecodeTokens(str) {
+  return str.replace(/\b([0-9a-fA-F]{24,})\b/g, (match) => {
+    if (match.length % 2 !== 0) return match;
+    try {
+      const decoded = Buffer.from(match, "hex").toString("utf-8");
+      if (printableRatio(decoded) >= 0.9) return decoded;
+    } catch (_) {}
+    return match;
+  });
+}
+
+function tryPercentDecode(str) {
+  try {
+    return decodeURIComponent(str);
+  } catch (_) {
+    return str.replace(/%([0-9a-fA-F]{2})/g, (_, hex) => {
+      try {
+        return String.fromCharCode(parseInt(hex, 16));
+      } catch (_) {
+        return _;
+      }
+    });
+  }
+}
 
 /**
  * Produces the variants of the added-line text that secret patterns are run
  * against: as-written, with invisible characters stripped, and with
  * source-level string concatenation collapsed.
  *
- * `normalized` is the last of those — every normalisation applied. It is
- * returned separately for checks that are too expensive to run three times and
- * gain nothing from the intermediate forms.
- *
  * @param {string} addedLines
  * @returns {{ all: string[], normalized: string }}
  */
 function secretScanVariants(addedLines) {
   const stripped = addedLines.replace(INVISIBLE_CHARS, "");
   // Collapse `"AAA" +\n  "BBB"` into `"AAABBB"` before matching.
-  const dejoined = stripped.replace(/\s*\n\s*/g, " ").replace(STRING_CONCAT_JOIN, "");
-  return { all: [...new Set([addedLines, stripped, dejoined])], normalized: dejoined };
+  let dejoined = stripped.replace(/\s*\n\s*/g, " ").replace(STRING_CONCAT_JOIN, "");
+  // Collapse template literal empty expressions `${""}` and `${"VALUE"}`
+  dejoined = dejoined.replace(/\$\{\s*["'`]{2}\s*\}/g, "").replace(/\$\{\s*["'`]([^"'`]+)["'`]\s*\}/g, "$1");
+  // Collapse method concatenations like .concat("...") or .join("")
+  dejoined = dejoined.replace(/\.concat\(\s*["'`]/g, "").replace(/\.join\(\s*["'`]{2}\s*\)/g, "");
+
+  const hexDecoded = tryHexDecodeTokens(dejoined);
+  const pctDecoded = tryPercentDecode(dejoined);
+
+  return {
+    all: [...new Set([addedLines, stripped, dejoined, hexDecoded, pctDecoded])],
+    normalized: dejoined,
+  };
 }
 
 // Base64 is less an evasion technique than a file format. Every value in a
 // Kubernetes Secret manifest is base64 by specification, and whole `.env` files
-// get encoded into a single CI variable. A credential arriving that way is
-// ordinary rather than adversarial — and a line-oriented scanner walks straight
-// past it, which makes this the encoding most likely to carry a live key
-// through the gate.
-const BASE64_CANDIDATE = /[A-Za-z0-9+/]{24,}={0,2}/g;
-
-// Decoding is cheap per blob and ruinous per diff if left unbounded. A patch
-// that checks in a binary, a source map or a bundled font is otherwise enough
-// to turn one scan into a memory event, so both the number of candidates and
-// the total decoded size are capped. Exceeding a cap skips the remainder; it
-// does not fail the scan, because a large diff is not evidence of a leak.
+// get encoded into a single CI variable.
+const BASE64_CANDIDATE = /[A-Za-z0-9+/\-_]{20,}={0,2}/g;
+
 const BASE64_MAX_CANDIDATES = 64;
 const BASE64_MAX_DECODED_BYTES = 64 * 1024;
 
 /**
  * Share of characters that are printable ASCII (plus tab/newline/return).
- *
- * `Buffer.from(str, "base64")` never throws — it discards what it cannot parse
- * and returns whatever it managed to decode. So a hex digest or a random
- * identifier of the right length "decodes" successfully into bytes that mean
- * nothing. A wrapped credential, on the other hand, decodes to text: keys,
- * PEM blocks and `.env` bodies are all ASCII. This ratio is what separates the
- * two, and it removes nearly all of the noise before any pattern runs.
  */
 function printableRatio(str) {
   if (!str) return 0;
@@ -443,33 +475,36 @@ function printableRatio(str) {
  *
  * @param {string} text
  * @param {(plain: string, blob: string) => void} [onDecoded] - Called per blob.
- * @returns {string[]}
+ * @returns {{ decoded: string[], capped: boolean }}
  */
 function decodeBase64Blobs(text, onDecoded) {
-  if (!text) return [];
+  if (!text) return { decoded: [], capped: false };
   const decoded = [];
   let candidates = 0;
   let bytes = 0;
+  let capped = false;
 
   BASE64_CANDIDATE.lastIndex = 0;
   let match;
   while ((match = BASE64_CANDIDATE.exec(text)) !== null) {
-    if (candidates++ >= BASE64_MAX_CANDIDATES) break;
-    const blob = match[0];
-    // Valid base64 is a multiple of four characters including padding. This
-    // costs nothing and rejects three quarters of the alphanumeric runs — commit
-    // hashes, minified identifiers — that would otherwise be decoded for nothing.
-    if (blob.length % 4 !== 0) continue;
-    // Check the budget against what this blob *would* cost, not against what
-    // has already been spent — otherwise the first candidate decodes in full
-    // however large it is, and a single checked-in binary costs more than the
-    // cap was meant to allow. `continue`, not `break`: one oversized blob must
-    // not hide the smaller ones after it.
-    if (bytes + (blob.length * 3) / 4 > BASE64_MAX_DECODED_BYTES) continue;
+    if (candidates++ >= BASE64_MAX_CANDIDATES) {
+      capped = true;
+      break;
+    }
+    const rawBlob = match[0].replace(/[\s\r\n]+/g, "");
+    let stdBlob = rawBlob.replace(/-/g, "+").replace(/_/g, "/");
+    while (stdBlob.length % 4 !== 0) {
+      stdBlob += "=";
+    }
+
+    if (bytes + (stdBlob.length * 3) / 4 > BASE64_MAX_DECODED_BYTES) {
+      capped = true;
+      continue;
+    }
 
     let plain;
     try {
-      plain = Buffer.from(blob, "base64").toString("utf-8");
+      plain = Buffer.from(stdBlob, "base64").toString("utf-8");
     } catch (_) {
       continue;
     }
@@ -477,28 +512,35 @@ function decodeBase64Blobs(text, onDecoded) {
     if (printableRatio(plain) < 0.9) continue;
 
     decoded.push(plain);
-    if (onDecoded) onDecoded(plain, blob);
+    if (onDecoded) onDecoded(plain, rawBlob);
+
+    // Try 1 level of nested base64 decoding if printable
+    if (/[A-Za-z0-9+/\-_]{20,}={0,2}/.test(plain)) {
+      try {
+        let nestedStd = plain.trim().replace(/-/g, "+").replace(/_/g, "/");
+        while (nestedStd.length % 4 !== 0) nestedStd += "=";
+        const nestedPlain = Buffer.from(nestedStd, "base64").toString("utf-8");
+        if (printableRatio(nestedPlain) >= 0.9) {
+          decoded.push(nestedPlain);
+        }
+      } catch (_) {}
+    }
   }
   BASE64_CANDIDATE.lastIndex = 0;
-  return decoded;
+  return { decoded, capped };
 }
 
 /**
  * True when a base64-encoded value on an added line decodes to a structured
  * credential.
  *
- * Deliberately runs the high-confidence patterns *only*. The low-confidence set
- * is entropy- and keyword-driven, and decoded bytes are high-entropy by
- * construction — pointing it at this output would flag close to every encoded
- * blob in every repository. `AKIA[0-9A-Z]{16}` cannot match decoded noise;
- * "looks secret-ish" always can. That asymmetry is the whole reason this check
- * is safe to enable by default.
- *
  * @param {string} text
  * @returns {boolean}
  */
 export function hasEncodedSecret(text) {
-  return decodeBase64Blobs(text).some((plain) => hasHighConfidenceSecret(plain));
+  const result = decodeBase64Blobs(text);
+  if (result.capped) return true; // Fail closed if cap exceeded
+  return result.decoded.some((plain) => hasHighConfidenceSecret(plain));
 }
 
 export function scanDiff(diffTextStr = "", options = {}) {

package/src/state.mjs

@@ -9,12 +9,13 @@ import {
   closeSync,
   fsyncSync,
   unlinkSync,
+  lstatSync,
 } from "node:fs";
 import { join, basename } from "node:path";
 import { createHash, randomUUID } from "node:crypto";
 import { hostname } from "node:os";
 import { execFileSync } from "node:child_process";
-import { resolveRoot } from "./config.mjs";
+import { resolveRoot, normalizePath } from "./config.mjs";
 import { redactSecrets } from "./security.mjs";
 
 function scrubStateValue(value) {
@@ -38,14 +39,14 @@ export function ensureDir(dirPath) {
 
 export function getQueueDir(rootOrOpts = resolveRoot()) {
   const root = typeof rootOrOpts === "string" ? rootOrOpts : resolveRoot();
-  const dir = join(root, ".agent/jules-queue");
+  const dir = normalizePath(root).endsWith(".agent/jules-queue") ? root : join(root, ".agent/jules-queue");
   ensureDir(dir);
   return dir;
 }
 
 export function getStateDir(rootOrOpts = resolveRoot()) {
   const root = typeof rootOrOpts === "string" ? rootOrOpts : resolveRoot();
-  const dir = root.endsWith(".agent/state") ? root : join(root, ".agent/state");
+  const dir = normalizePath(root).endsWith(".agent/state") ? root : join(root, ".agent/state");
   ensureDir(dir);
   return dir;
 }
@@ -247,6 +248,10 @@ export function appendLedger(entry, rootOrOpts = resolveRoot()) {
     const hash = createHash("sha256").update(JSON.stringify(rawPayload)).digest("hex");
     const payload = { ...rawPayload, hash };
 
+    if (existsSync(filePath) && lstatSync(filePath).isSymbolicLink()) {
+      throw new Error(`Refusing to append to symbolic link: ${filePath}`);
+    }
+
     const fd = openSync(filePath, "a");
     try {
       writeSync(fd, JSON.stringify(payload) + "\n", "utf-8");
@@ -330,8 +335,8 @@ export function checkDailyBudget(arg1 = resolveRoot(), arg2 = 300, opts = {}) {
       remaining: Math.max(0, limit - scan.used),
       windowStart: scan.windowStart,
     };
-  } catch (_) {
-    return { ok: true, used: 0, budget: limit, remaining: limit };
+  } catch (err) {
+    return { ok: false, used: limit, budget: limit, remaining: 0, error: err.message };
   }
 }
 
@@ -385,7 +390,7 @@ export function reserveBudgetAtomic(stateDirOrRoot = resolveRoot(), limit = 300,
     }
 
     const timestamp = new Date(now).toISOString();
-    const reservationId = `res-${now}-${Math.random().toString(36).substring(2, 8)}`;
+    const reservationId = `res-${now}-${randomUUID().slice(0, 8)}`;
     const rawPayload = { timestamp, event: "budget_reserved", reservationId, budget: limit, prevHash };
     const hash = createHash("sha256").update(JSON.stringify(rawPayload)).digest("hex");
     const payload = { ...rawPayload, hash };

package/src/task-optimizer.mjs

@@ -3,6 +3,7 @@ import { join, relative, resolve } from "node:path";
 import { checkScope } from "./security.mjs";
 import { detectStackOracles } from "./wizard-oracle.mjs";
 import { loadConfig } from "./config.mjs";
+import { sanitizePromptVocabulary } from "./prompt-guard.mjs";
 
 /**
  * Calculates Levenshtein distance between two strings.
@@ -243,7 +244,14 @@ export function scorePromptFalsifiability(promptText, options = {}) {
     suggestions.push(`Web domain detected (${webIntent.categories.join(", ")}). Consider incorporating exploration budget and critic agent checks.`);
   }
 
-  // 5. Stack Oracle Detection
+  // 5. Positive Boundary / Negative Restriction Linting ("Pink Elephant" Principle)
+  const negativeMatches = rawPrompt.match(/\b(do not|never|don't|forbidden|must not)\b/gi) || [];
+  const positiveScopeMatch = /\b(only modify|strictly scoped to|scoped to|confined to)\b/i.test(rawPrompt);
+  if (negativeMatches.length >= 3 && !positiveScopeMatch) {
+    suggestions.push("Multiple negative constraints detected. Consider defining Airtight Positive Enclosures (e.g. 'ONLY modify [Target]') to prevent attention-drift.");
+  }
+
+  // 6. Stack Oracle Detection
   let verifyCmd = options.verifyCmd || null;
   let autoDetected = false;
   let isTrivial = false;
@@ -317,7 +325,7 @@ export function optimizeTaskPrompt(promptText, options = {}) {
     };
   }
 
-  let promptBody = rawPrompt;
+  let promptBody = sanitizePromptVocabulary(rawPrompt);
 
   // Apply suggestions & path corrections to prompt body if requested
   for (const pathInfo of analysis.paths.found) {

package/src/tui.mjs

@@ -27,7 +27,7 @@ export const ANSI = {
  * @returns {boolean}
  */
 export function isTTY(stream = process.stdin) {
-  return Boolean(stream && (stream.isTTY || isatty(stream.fd)));
+  return Boolean(stream && (stream.isTTY || (typeof stream.fd === "number" && isatty(stream.fd))));
 }
 
 /**

package/src/webhook.mjs

@@ -587,11 +587,11 @@ export function routeWebhookEvent(eventType, payload, handlers = {}) {
  * @param {function} [config.log]
  * @returns {import("node:http").Server}
  */
-export function createWebhookServer({ _port = 8787, secret = process.env.JULES_WEBHOOK_SECRET, handlers = {}, log = console.log } = {}) {
+export function createWebhookServer({ port = 8787, secret = process.env.JULES_WEBHOOK_SECRET, handlers = {}, log = console.log } = {}) {
   const server = createServer((req, res) => {
     if (req.method === "GET" && req.url === "/health") {
       res.writeHead(200, { "Content-Type": "application/json" });
-      res.end(JSON.stringify({ status: "ok", timestamp: new Date().toISOString() }));
+      res.end(JSON.stringify({ status: "ok", port, timestamp: new Date().toISOString() }));
       return;
     }
 

package/src/wizard-task.mjs

@@ -1,5 +1,5 @@
-import { writeFileSync, readFileSync, readdirSync, mkdirSync, existsSync } from "node:fs";
-import { resolve, join } from "node:path";
+import { writeFileSync, mkdirSync, existsSync } from "node:fs";
+import { resolve } from "node:path";
 import { loadConfig } from "./config.mjs";
 import { gate } from "./engine.mjs";
 import { scanDiff, shannonEntropy } from "./security.mjs";
@@ -21,34 +21,8 @@ HARD CONSTRAINTS:
 
 const TRIVIAL_ORACLES = new Set(["true", "echo", ":", "false", "exit 0", "exit 1", "echo ok"]);
 
-/**
- * Resolves specialist agent role markdown prompt from .agent/prompts/
- * @param {string} [root=process.cwd()]
- * @param {string} [roleName=""]
- * @returns {{ role: string, path: string, content: string } | null}
- */
-export function resolveRolePrompt(root = process.cwd(), roleName = "") {
-  if (!roleName || typeof roleName !== "string") return null;
-  const cleanName = roleName.trim().toLowerCase();
-  const promptsDir = join(root, ".agent", "prompts");
-  if (!existsSync(promptsDir)) return null;
-
-  try {
-    const files = readdirSync(promptsDir);
-    const matched = files.find(
-      (f) => f.toLowerCase() === `${cleanName}.md` || f.toLowerCase() === cleanName
-    );
-    if (matched) {
-      const fullPath = join(promptsDir, matched);
-      return {
-        role: matched.replace(/\.md$/i, ""),
-        path: fullPath,
-        content: readFileSync(fullPath, "utf-8").trim(),
-      };
-    }
-  } catch (_) {}
-  return null;
-}
+export { resolveRolePrompt } from "./role-resolver.mjs";
+import { resolveRolePrompt } from "./role-resolver.mjs";
 
 /**
  * Pure planning core for task creation & envelope synthesis.