jules-orchestrator-kit 0.75.0 → 0.75.2

package/src/ci-templates.mjs

@@ -149,51 +149,215 @@ ${extraSteps ? extraSteps + "\n" : ""}
 }
 
 /**
- * Write the generated workflow, refusing to clobber an existing file unless
+ * Generate a workflow_run auto-merge workflow for GitHub Actions that safely
+ * merges qualifying green PRs opened by authorized automation bots.
+ *
+ * Implements a strict trust boundary:
+ * - Executes exclusively on the base branch (default `main`)
+ * - Evaluates PR commits strictly as unexecuted data (fetch + git diff)
+ * - Verifies the bot actor against authorized identities (default `google-labs-jules[bot]`)
+ * - Merges cleanly via `gh pr merge --squash --delete-branch`
+ *
+ * @param {object} opts
+ * @param {object} [opts.config]
+ * @param {string} [opts.version]
+ * @param {string[]} [opts.allowedActors]
+ * @returns {{ file: string, content: string }}
+ */
+export function buildAutoMergeWorkflow(opts = {}) {
+  const base = opts.config?.baseBranch || opts.baseBranch || "main";
+  const version = opts.version || "0";
+  const defaultActors = ["google-labs-jules[bot]", "github-actions[bot]"];
+  const allowedActors = opts.allowedActors || defaultActors;
+  const actorCases = allowedActors.map((a) => `"${a}"`).join("|");
+
+  const content = `# Generated by jules-orchestrator-kit v${version}.
+#
+# Auto-merge verified pull requests opened by authorized automation bots.
+#
+# TRUST BOUNDARY ARCHITECTURE:
+#   For pull requests from repository branches, GitHub Actions runs
+#   'on: pull_request' workflows from the PR branch head. A pull request can
+#   therefore supply its own modified workflow code.
+#
+#   This workflow runs on 'workflow_run' after 'Agent Safety Gate' completes.
+#   It executes STRICTLY from the default branch (${base}), ensuring that:
+#   1. It only runs code, scripts, and policies committed to ${base}.
+#   2. The pull request commits are fetched strictly as unexecuted data.
+#   3. Privileged write tokens are never exposed to the untrusted PR branch.
+#
+# Regenerate with: agentctl ci init --with-automerge --force
+
+name: Agent Auto-Merge
+
+on:
+  workflow_run:
+    workflows: ["Agent Safety Gate"]
+    types: [completed]
+
+permissions:
+  contents: read
+
+concurrency:
+  group: agent-automerge-\${{ github.event.workflow_run.head_sha }}
+  cancel-in-progress: false
+
+jobs:
+  automerge:
+    if: >-
+      github.event.workflow_run.conclusion == 'success' &&
+      github.event.workflow_run.event == 'pull_request' &&
+      github.event.workflow_run.head_repository.full_name == github.repository
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+      pull-requests: write
+    env:
+      GH_TOKEN: \${{ secrets.GITHUB_TOKEN }}
+      REPO: \${{ github.repository }}
+      HEAD_SHA: \${{ github.event.workflow_run.head_sha }}
+      ACTOR: \${{ github.event.workflow_run.actor.login }}
+    steps:
+      - name: Checkout base revision (${base})
+        uses: actions/checkout@v4
+        with:
+          ref: ${base}
+          fetch-depth: 0
+          persist-credentials: false
+
+      - name: Verify authorized automation actor
+        run: |
+          set -euo pipefail
+          case "$ACTOR" in
+            ${actorCases})
+              echo "Authorized automation actor: $ACTOR"
+              ;;
+            *)
+              echo "Actor '$ACTOR' is not an authorized automation bot; leaving PR for human review."
+              exit 0
+              ;;
+          esac
+
+      - id: pr
+        name: Resolve Pull Request
+        run: |
+          set -euo pipefail
+          num=$(gh pr list --repo "$REPO" --state open --base "${base}" \\
+                  --json number,headRefOid \\
+                  --jq "[.[] | select(.headRefOid == \\"$HEAD_SHA\\")] | .[0].number // empty")
+          if [ -z "$num" ]; then
+            echo "No open PR found for head SHA $HEAD_SHA; nothing to merge."
+            echo "found=false" >> "$GITHUB_OUTPUT"
+            exit 0
+          fi
+          echo "Resolved PR #$num for $HEAD_SHA"
+          echo "number=$num" >> "$GITHUB_OUTPUT"
+          echo "found=true" >> "$GITHUB_OUTPUT"
+
+      - name: Fetch PR commits as untrusted data
+        if: steps.pr.outputs.found == 'true'
+        run: |
+          set -euo pipefail
+          git fetch --no-tags origin "+$HEAD_SHA:refs/pr-head"
+          git checkout --detach refs/pr-head
+
+      - name: Set up Node.js
+        if: steps.pr.outputs.found == 'true'
+        uses: actions/setup-node@v4
+        with:
+          node-version: "20"
+
+      - name: Verify safety gate from base
+        if: steps.pr.outputs.found == 'true'
+        run: |
+          npx --yes jules-orchestrator-kit check --mode committed --base "${base}"
+
+      - name: Squash and merge pull request
+        if: steps.pr.outputs.found == 'true'
+        run: |
+          gh pr merge --squash --delete-branch "\${{ steps.pr.outputs.number }}" --repo "$REPO"
+`;
+
+  return { file: ".github/workflows/agent-automerge.yml", content };
+}
+
+/**
+ * Write the generated workflow(s), refusing to clobber existing files unless
  * asked.
  *
  * @param {string} root
- * @param {object} [opts] - see {@link buildCiWorkflow}, plus `force` and `dryRun`
- * @returns {{ ok: boolean, file?: string, written?: boolean, stack?: string, setupSummary?: string, content?: string, error?: string }}
+ * @param {object} [opts] - see {@link buildCiWorkflow}, plus `force`, `dryRun`, and `withAutomerge`
+ * @returns {{ ok: boolean, file?: string, files?: string[], written?: boolean, stack?: string, setupSummary?: string, content?: string, error?: string }}
  */
 export function writeCiWorkflow(root, opts = {}) {
+  const target = CI_TARGETS.includes(opts.target) ? opts.target : (opts.target ? opts.target : "github");
   if (opts.target && !CI_TARGETS.includes(opts.target)) {
     return { ok: false, error: `Unknown CI target '${opts.target}'. Choose one of: ${CI_TARGETS.join(", ")}` };
   }
 
+  const withAutomerge = Boolean(opts.withAutomerge || opts["with-automerge"]);
+  if (withAutomerge && target !== "github") {
+    return { ok: false, error: "Auto-merge workflow is currently only supported for GitHub Actions." };
+  }
+
   const built = buildCiWorkflow(opts);
   const stackId = opts.stack?.stack || "unknown";
-  const abs = join(root, built.file);
+  const itemsToWrite = [built];
 
-  if (opts.dryRun) {
-    return { ok: true, file: built.file, written: false, stack: stackId, setupSummary: built.setupSummary, content: built.content };
+  if (withAutomerge) {
+    itemsToWrite.push(buildAutoMergeWorkflow(opts));
   }
 
-  if (existsSync(abs) && !opts.force) {
-    let identical = false;
-    try {
-      identical = readFileSync(abs, "utf-8") === built.content;
-    } catch (_) {
-      // Unreadable target: treat as different so the caller is told to --force
-      // rather than being told nothing changed.
-    }
+  const files = itemsToWrite.map((item) => item.file);
+
+  if (opts.dryRun) {
     return {
       ok: true,
       file: built.file,
+      files,
       written: false,
-      identical,
       stack: stackId,
       setupSummary: built.setupSummary,
       content: built.content,
+      workflows: itemsToWrite,
     };
   }
 
-  try {
-    mkdirSync(dirname(abs), { recursive: true });
-    writeFileSync(abs, built.content, "utf-8");
-  } catch (err) {
-    return { ok: false, error: `Could not write ${built.file}: ${err.message}` };
+  let allWritten = true;
+  let allIdentical = true;
+  for (const item of itemsToWrite) {
+    const abs = join(root, item.file);
+    if (existsSync(abs) && !opts.force) {
+      let identical = false;
+      try {
+        identical = readFileSync(abs, "utf-8") === item.content;
+      } catch (_) {
+        // Unreadable target: treat as different so the caller is told to --force
+        // rather than being told nothing changed.
+      }
+      if (!identical) {
+        allIdentical = false;
+      }
+      allWritten = false;
+      continue;
+    }
+
+    try {
+      mkdirSync(dirname(abs), { recursive: true });
+      writeFileSync(abs, item.content, "utf-8");
+    } catch (err) {
+      return { ok: false, error: `Could not write ${item.file}: ${err.message}` };
+    }
   }
 
-  return { ok: true, file: built.file, written: true, stack: stackId, setupSummary: built.setupSummary, content: built.content };
+  return {
+    ok: true,
+    file: built.file,
+    files,
+    written: allWritten,
+    identical: allWritten ? false : allIdentical,
+    stack: stackId,
+    setupSummary: built.setupSummary,
+    content: built.content,
+  };
 }

package/src/engine.mjs

@@ -2,7 +2,7 @@ import { loadConfig, resolveTrustedPolicy, normalizePath } from "./config.mjs";
 import { isTestPath } from "./test-paths.mjs";
 import { isPlaceholderTestScript, isSrcLayout } from "./stack-detector.mjs";
 import { checkCollectionFloor } from "./ops/test-collection.mjs";
-import { checkScope, scanDiff, scanBinaryPayloads, redactSecrets } from "./security.mjs";
+import { checkScope, scanDiff, scanBinaryPayloads, redactSecrets, hasHighConfidenceSecret } from "./security.mjs";
 import { changedFiles, diffBytes, diffText, binaryDiffEntries, symlinkChanges, showFromOrigin, runCmd, materializeSnapshot } from "./git.mjs";
 import { createProvider, ProviderRateLimitError, ProviderUnavailableError } from "./provider.mjs";
 import { resolveRoutedProvider } from "./router.mjs";
@@ -306,7 +306,7 @@ export async function gate(opts = {}) {
   let snapshot = { cwd: root, cleanup: () => {}, mode };
   try {
     if (mode === "staged" || mode === "committed") {
-      snapshot = materializeSnapshot(root, mode, base);
+      snapshot = materializeSnapshot(root, mode, opts.head || "HEAD");
     }
   } catch (snapErr) {
     phases.push({ phase: "verify", ok: false, error: snapErr.message });
@@ -947,6 +947,11 @@ export async function repair(failure, opts = {}) {
         dryRun: opts.dryRun,
         pollIntervalMs: opts.pollIntervalMs,
         maxPollAttempts: opts.maxPollAttempts,
+        autoApprovePlan: opts.autoApprovePlan || opts.autoApprove,
+        autoReply: opts.autoReply,
+        maxAutoReplies: opts.maxAutoReplies,
+        autoReplyFn: opts.autoReplyFn,
+        task: opts.task || { id: `repair-${n}`, title: `OODA Auto-Repair Attempt ${n}`, prompt: repairPrompt },
       });
 
       // The gate below is the authority on whether the change works, so it runs
@@ -1139,6 +1144,54 @@ export const TERMINAL_SESSION_STATES = new Set(["COMPLETED", "FAILED"]);
  */
 export const BLOCKING_SESSION_STATES = new Set(["AWAITING_PLAN_APPROVAL", "AWAITING_USER_FEEDBACK", "PAUSED"]);
 
+/**
+ * Synthesizes an autonomous, envelope-grounded reply directive when Jules halts
+ * in AWAITING_USER_FEEDBACK during unattended execution.
+ *
+ * @param {object|null} task - Task envelope or task definition object.
+ * @param {string} [question] - Extracted question text from the agent.
+ * @returns {string} Deterministic directive for the agent to continue.
+ */
+export function buildAutoReplyPrompt(task = null, question = "") {
+  const parts = [];
+  parts.push("Autonomous execution directive:");
+
+  if (task && typeof task === "object") {
+    const scope = task.scope?.allow || task.allowedFiles || task.targetFiles;
+    if (Array.isArray(scope) && scope.length > 0) {
+      parts.push(`- Scope constraint: modify only files matching ${scope.join(", ")}.`);
+    }
+
+    const invariants = Array.isArray(task.invariants) ? task.invariants : [];
+    if (invariants.length > 0) {
+      parts.push(`- Invariants: ${invariants.slice(0, 5).join("; ")}.`);
+    }
+
+    if (task.title || task.objective) {
+      parts.push(`- Objective: ${task.title || task.objective}.`);
+    }
+
+    if (task.clarifications && typeof task.clarifications === "object") {
+      const entries = Object.entries(task.clarifications);
+      if (entries.length > 0) {
+        const qLower = String(question || "").toLowerCase();
+        for (const [k, v] of entries) {
+          if (qLower.includes(k.toLowerCase())) {
+            parts.push(`- Pre-approved clarification (${k}): ${v}`);
+          }
+        }
+      }
+    }
+  }
+
+  parts.push(
+    "- Decision rule: Make reasonable engineering assumptions that satisfy tests and maintain existing API contracts.",
+    "- Do not pause for human confirmation or additional feedback. Proceed with implementation, verification, and completion."
+  );
+
+  return parts.join("\n");
+}
+
 /**
  * Polls the provider until the session reaches a terminal state, blocks on an
  * actor, or the poll budget runs out.
@@ -1180,6 +1233,8 @@ export async function pollSessionState(provider, session, opts = {}) {
   const startTime = Date.now();
   let lastStatus = "";
   let polls = 0;
+  const repliedActivityIds = new Set();
+  let autoRepliesCount = 0;
 
   for (let attempt = 0; attempt < maxAttempts; attempt++) {
     if (Date.now() - startTime > timeoutMs) break;
@@ -1235,6 +1290,102 @@ export async function pollSessionState(provider, session, opts = {}) {
         }
       }
 
+      // Autonomously answer clarifying questions if requested
+      const isUserFeedback = status === "AWAITING_USER_FEEDBACK";
+      const wantsAutoReply = Boolean(opts.autoReply || session.autoReply);
+      const canSend = provider && (typeof provider.sendMessage === "function" || typeof provider.resume === "function");
+      if (isUserFeedback && wantsAutoReply && canSend) {
+        const maxAutoReplies = Number(opts.maxAutoReplies ?? session.maxAutoReplies ?? 3);
+        if (autoRepliesCount >= maxAutoReplies) {
+          return {
+            ...currentSession,
+            status,
+            terminal: false,
+            blockedOn: status,
+            autoReplyLimitExceeded: true,
+            autoReplies: autoRepliesCount,
+            polls,
+          };
+        }
+
+        let question = "";
+        let activityId = null;
+        if (typeof provider.listActivities === "function") {
+          try {
+            const actRes = await provider.listActivities(session.id, opts);
+            const activities = Array.isArray(actRes?.activities) ? actRes.activities : [];
+            for (let i = activities.length - 1; i >= 0; i--) {
+              const act = activities[i];
+              const msg = act.agentMessaged?.agentMessage || act.message;
+              if (msg) {
+                question = String(msg).trim();
+                activityId = act.name || act.id || null;
+                break;
+              }
+            }
+          } catch (_) {}
+        }
+
+        // Idempotency: If this activity was already answered, wait for the agent to advance rather than duplicate
+        if (activityId && repliedActivityIds.has(activityId)) {
+          await new Promise((resolve) => setTimeout(resolve, pollIntervalMs));
+          continue;
+        }
+
+        let reply = "";
+        const taskContext = opts.task || session.task || null;
+        if (typeof opts.autoReplyFn === "function") {
+          try {
+            reply = await opts.autoReplyFn({ session: currentSession, question, activityId, task: taskContext });
+          } catch (err) {
+            return {
+              ...currentSession,
+              status,
+              terminal: false,
+              blockedOn: status,
+              autoReplyError: `autoReplyFn failed: ${err.message}`,
+              autoReplies: autoRepliesCount,
+              polls,
+            };
+          }
+        } else {
+          reply = buildAutoReplyPrompt(taskContext, question);
+        }
+
+        if (activityId) {
+          repliedActivityIds.add(activityId);
+        }
+
+        try {
+          const sendFn = typeof provider.sendMessage === "function"
+            ? provider.sendMessage.bind(provider)
+            : provider.resume.bind(provider);
+          await sendFn(session.id, reply, opts);
+          autoRepliesCount += 1;
+          if (opts.root) {
+            appendTelemetry(opts.root, "session_auto_reply", {
+              sessionId: session.id,
+              question: question ? question.slice(0, 300) : null,
+              reply: reply ? reply.slice(0, 300) : null,
+              replyCount: autoRepliesCount,
+              activityId,
+            });
+          }
+          await new Promise((resolve) => setTimeout(resolve, pollIntervalMs));
+          continue;
+        } catch (err) {
+          return {
+            ...currentSession,
+            status,
+            terminal: false,
+            blockedOn: status,
+            autoReplyError: err && err.message ? err.message : String(err),
+            autoReplies: autoRepliesCount,
+            polls,
+          };
+        }
+      }
+
       return { ...currentSession, status, terminal: false, blockedOn: status, polls };
     }
 
@@ -1331,8 +1482,14 @@ export async function dispatch(task = {}, opts = {}) {
     };
   }
 
+  // Pre-dispatch secret leak prevention (unless explicitly allowed)
+  const rawPrompt = task.prompt || "";
+  if (!opts.allowSecrets && hasHighConfidenceSecret(rawPrompt)) {
+    throw new Error("Pre-Dispatch Secret Leak Blocked: Task prompt contains unredacted high-confidence credentials.");
+  }
+
   // Redact secrets in prompt before dispatching
-  let cleanPrompt = redactSecrets(task.prompt || "");
+  let cleanPrompt = redactSecrets(rawPrompt);
 
   // Specialist Role resolution (if role is set and not already present in prompt)
   if (task.role) {
@@ -1745,7 +1902,13 @@ export async function probeDevServer(serverConfig = {}, root = process.cwd()) {
         if (isWin) {
           spawn("taskkill", ["/pid", String(child.pid), "/T", "/F"], { stdio: "ignore" });
         } else {
-          process.kill(-child.pid, "SIGTERM");
+          const pgid = -child.pid;
+          process.kill(pgid, "SIGTERM");
+          setTimeout(() => {
+            try {
+              process.kill(pgid, "SIGKILL");
+            } catch (_) {}
+          }, 2000).unref();
         }
       } catch (_) {}
     }

package/src/envelope.mjs

@@ -1,5 +1,5 @@
 import { git, runCmd, resolveBase } from "./git.mjs";
-import { checkScope } from "./security.mjs";
+import { checkScope, scanDiff } from "./security.mjs";
 import { normalizeScope } from "./config.mjs";
 import { existsSync } from "node:fs";
 import { resolve, relative, isAbsolute } from "node:path";
@@ -185,6 +185,22 @@ export function validateEnvelope(envelope = {}, opts = {}) {
     }
   }
 
+  // 11. Secret Leak Scrubbing Preflight
+  const textToScan = [
+    typeof envelope.prompt === "string" ? envelope.prompt : "",
+    typeof envelope.intent === "string" ? envelope.intent : (envelope.intent?.outcome || ""),
+    typeof envelope.instructions === "string" ? envelope.instructions : "",
+  ].filter(Boolean).join("\n");
+
+  if (textToScan && !opts.allowSecrets) {
+    const multilineDiff = textToScan.split("\n").map((line) => `+${line}`).join("\n");
+    const secretScan = scanDiff(multilineDiff);
+    if (!secretScan.ok && secretScan.findings.length > 0) {
+      const types = secretScan.findings.map((f) => f.type || "SECRET_DETECTED").join(", ");
+      errors.push(`Secret leak detected in envelope prompt/intent (${types}). Scrub credentials before validation.`);
+    }
+  }
+
   return {
     ok: errors.length === 0,
     code: errors.length === 0 ? 0 : 1,

package/src/evidence.mjs

@@ -135,14 +135,21 @@ export function computeDirectoryHash(root, options = {}) {
     // The named directories stay as a fast path; when they yield nothing, walk
     // the repository and let the shared predicate decide. The walk already
     // skips node_modules, vendor, target and the build caches.
-    const targetDirs = options.directories || ["test", "tests", "__tests__", "spec", "specs", "src"];
+    const targetDirs = options.directories || ["test", "tests", "__tests__", "spec", "specs", "src", "scripts", "bin"];
     for (const dirName of targetDirs) {
       const dirPath = join(root, dirName);
       if (existsSync(dirPath)) {
-        const found = findFilesRecursively(dirPath, root);
-        fileList.push(...found);
+        if (statSync(dirPath).isFile()) {
+          fileList.push(normalizePath(dirName));
+        } else {
+          const found = findFilesRecursively(dirPath, root);
+          fileList.push(...found);
+        }
       }
     }
+    if (existsSync(join(root, "package.json"))) {
+      fileList.push("package.json");
+    }
     if (options.testOnly && !fileList.some((f) => isTestPath(f))) {
       for (const f of findFilesRecursively(root, root)) {
         if (isTestPath(f)) fileList.push(f);
@@ -191,7 +198,8 @@ export function computeDirectoryHash(root, options = {}) {
     }
   }
 
-  const treeHash = "sha256:" + sha256(hashLines.join("\n"));
+  // Join with null byte to prevent path delimiter injection (F-03)
+  const treeHash = "sha256:" + sha256(hashLines.join("\0"));
   return {
     treeHash,
     fileCount: hashLines.length,
@@ -511,9 +519,18 @@ export function verifyEvidenceManifest(root = process.cwd(), manifestOrPath = "m
     return { ok: false, reason: "Evidence manifest hash signature mismatch (tampered file)" };
   }
 
+  // 1.5 Verify recorded execution outcome (F-08)
+  if (manifest.status && !["passed", "success", "ok"].includes(manifest.status)) {
+    return { ok: false, reason: `Evidence manifest records failed execution outcome: ${manifest.status}` };
+  }
+
   // 2. Verify test integrity / No test weakening
   const currentTestState = computeDirectoryHash(root, { testOnly: true });
-  if (manifest.testIntegrity?.tamperDetected) {
+  if (!manifest.testIntegrity?.postTestHash) {
+    return { ok: false, reason: "Evidence manifest is missing test integrity baseline (empty shell)" };
+  }
+
+  if (manifest.testIntegrity.tamperDetected) {
     return {
       ok: false,
       reason: "Test suite tampering detected in evidence manifest",

package/src/ops/command-registry.mjs

@@ -373,9 +373,10 @@ export const COMMAND_REGISTRY = [
     risk: "low",
     interactive: "always",
     requiresRepository: true,
-    shortcuts: ["tui", "ui"],
+    shortcuts: ["hub", "tui", "ui"],
     examples: [
       "agentctl menu",
+      "agentctl hub",
       "agentctl tui",
     ],
     flags: [],
@@ -1210,6 +1211,7 @@ export const COMMAND_REGISTRY = [
     shortcuts: ["ci-init"],
     examples: [
       "agentctl ci init",
+      "agentctl ci init --with-automerge",
       "agentctl ci init --target gitlab --force",
       "agentctl ci init --dry-run --json",
     ],
@@ -1218,6 +1220,7 @@ export const COMMAND_REGISTRY = [
       { name: "force", type: "boolean", description: "Overwrite existing workflow file (-f)" },
       { name: "dry-run", type: "boolean", description: "Report what would be written (-d)" },
       { name: "json", type: "boolean", description: "Output structured JSON result (-j)" },
+      { name: "with-automerge", type: "boolean", description: "Also generate a workflow_run auto-merge workflow" },
     ],
   },
   {

package/src/ops/tui-menu.mjs

@@ -27,9 +27,11 @@ export async function runTuiMenu(root = process.cwd(), options = {}) {
   const stdin = options.stdin || process.stdin;
   const stdout = options.stdout || process.stdout;
 
-  if (!isTTY(stdin) && !options.allowHeadless) {
+  const hasCustomStreams = Boolean(options.stdin || options.stdout);
+  const isInteractive = isTTY(stdin) && isTTY(stdout) && (!process.env.CI || hasCustomStreams || options.allowInteractive);
+  if (!isInteractive && !options.allowHeadless) {
     stdout.write("Interactive terminal menu requires a TTY terminal. Use 'agentctl --help' for CLI commands.\n");
-    return { ok: true, headless: true };
+    return { ok: true, headless: true, code: 1 };
   }
 
   while (true) {

package/src/prompt-guard.mjs

@@ -5,6 +5,10 @@
  * Strips zero-width unicode, bidi control characters, and ANSI escape sequences, normalizes UTF-8,
  * neutralizes LLM control role markers and prompt injection patterns, and wraps inputs in strict tags.
  */
+import { BIDI_CONTROL_REGEX, INVISIBLE_OBFUSCATION_REGEX } from "./bidi-guard.mjs";
+import { CONFUSABLE_TO_ASCII } from "./secret-scanner.mjs";
+
+const CONFUSABLE_REGEX = new RegExp([...CONFUSABLE_TO_ASCII.keys()].join("|"), "g");
 
 const ZERO_WIDTH_AND_BIDI_REGEX = /[\u200B-\u200F\u202A-\u202E\u2060-\u206F\uFEFF]|[\u{E0000}-\u{E007F}]/gu;
 const ANSI_ESCAPE_REGEX = /\u001B(?:[@-Z\\-_]|\[[0-?]*[ -/]*[@-~])/g;
@@ -100,8 +104,13 @@ export function sanitizeUntrustedData(input, sourceName = "untrusted") {
   // 1. Normalize UTF-8 string (NFKC)
   let text = input.normalize("NFKC");
 
+  // 1.5 Convert confusables to ASCII (transliterate Cyrillic/Greek lookalikes)
+  text = text.replace(CONFUSABLE_REGEX, (m) => CONFUSABLE_TO_ASCII.get(m));
+
   // 2. Strip zero-width Unicode and bidi control characters
   text = text.replace(ZERO_WIDTH_AND_BIDI_REGEX, "");
+  text = text.replace(BIDI_CONTROL_REGEX, "");
+  text = text.replace(INVISIBLE_OBFUSCATION_REGEX, "");
 
   // 3. Strip ANSI terminal control sequences
   text = text.replace(ANSI_ESCAPE_REGEX, "");

package/src/provider.mjs

@@ -716,6 +716,10 @@ export function createProvider(spec = "jules", config = {}) {
       throw new Error(`Unsupported provider type: ${providerSpec.type}`);
     },
 
+    async sendMessage(sessionId, prompt = "", ctx = {}, task = null) {
+      return this.resume(sessionId, prompt, ctx, task);
+    },
+
     async getSession(sessionId, ctx = {}) {
       if (!ctx || typeof ctx !== "object") ctx = {};
       // `listSources()` reuses this method purely as an authenticated GET, and
@@ -1126,6 +1130,10 @@ export function createFailoverProvider(providers = ["jules"], config = {}) {
       }
     },
 
+    async sendMessage(sessionId, prompt, ctx = {}, task = null) {
+      return this.resume(sessionId, prompt, ctx, task);
+    },
+
     async getSession(sessionId, ctx = {}) {
       const errors = [];
       for (let i = 0; i < providerList.length; i++) {
@@ -1263,6 +1271,12 @@ export function createSyntaxVerifiedProvider(fastProvider, complexProvider, conf
       return fastProvider.resume(...args);
     },
 
+    sendMessage(...args) {
+      return typeof fastProvider.sendMessage === "function"
+        ? fastProvider.sendMessage(...args)
+        : fastProvider.resume(...args);
+    },
+
     getSession(...args) {
       return fastProvider.getSession(...args);
     },