killeros 2.1.26 → 2.1.27

package/killeros/goal-runtime.ts

@@ -2,7 +2,7 @@ import { type ExtensionAPI, type ExtensionCommandContext, type ExtensionContext
 import { reportError } from "./errors.ts";
 import { beginGoalTurnState, checkpointActiveGoalState, GOAL_VERSION, parseGoalState, pauseGoalState, transitionGoalState, type GoalTransitionOptions } from "./goal-state.ts";
 import { resolvePersonalInstructions } from "./personal-instructions.ts";
-import type { GoalRuntime, GoalState, GoalStatus, InitRuntime } from "./runtime.ts";
+import type { GoalRuntime, GoalState, GoalStatus } from "./runtime.ts";
 import { safeTerminalText } from "./safe-terminal-text.ts";
 
 export const GOAL_ENTRY_TYPE = "killeros-goal";
@@ -204,7 +204,6 @@ function beginGoalTurn(
 export function scheduleGoalContinuation(
   pi: ExtensionAPI,
   runtime: GoalRuntime,
-  initState: InitRuntime,
   ctx: ExtensionContext,
 ): boolean {
   if (isGoalModeSupported(ctx) && isSavedSession(ctx) && pauseGoalAtTurnLimit(pi, runtime, ctx)) return false;
@@ -214,7 +213,6 @@ export function scheduleGoalContinuation(
     || runtime.continuationScheduled
     || runtime.continuationHeld
     || runtime.goalTurnInFlight
-    || initState.active
     || !ctx.isIdle()
     || ctx.hasPendingMessages()) return false;
   runtime.continuationScheduled = true;
@@ -282,7 +280,6 @@ export function isSavedSession(ctx: ExtensionContext): boolean {
 export function registerGoalRuntime(
   pi: ExtensionAPI,
   runtime: GoalRuntime,
-  initState: InitRuntime,
 ): void {
   const restoreGoal = (ctx: ExtensionContext): void => {
     const restored = restoreGoalState(ctx);
@@ -298,7 +295,7 @@ export function registerGoalRuntime(
     runtime.lastError = undefined;
     runtime.requestRender?.();
     if (runtime.state?.status === "active") {
-      setImmediate(() => scheduleGoalContinuation(pi, runtime, initState, ctx));
+      setImmediate(() => scheduleGoalContinuation(pi, runtime, ctx));
     }
   };
 
@@ -330,7 +327,7 @@ export function registerGoalRuntime(
     runtime.continuationScheduled = false;
     if (!runtime.goalTurnInFlight && isGoalModeSupported(ctx) && isSavedSession(ctx) && pauseGoalAtTurnLimit(pi, runtime, ctx)) return;
     const current = runtime.state;
-    if (!isGoalModeSupported(ctx) || !isSavedSession(ctx) || !current || current.status !== "active" || initState.active) return;
+    if (!isGoalModeSupported(ctx) || !isSavedSession(ctx) || !current || current.status !== "active") return;
     if (runtime.goalTurnInFlight) return { systemPrompt: `${event.systemPrompt}\n\n${goalSystemPrompt(current)}` };
     const next = beginGoalTurn(pi, runtime, ctx, current);
     if (!next) return;

package/killeros/goal-settlement.ts

@@ -3,7 +3,7 @@ import type { AutoCompactionGoalHandlers } from "./auto-compaction.ts";
 import { reportError } from "./errors.ts";
 import { isGoalModeSupported, isSavedSession, pauseGoalAfterFailure, pauseGoalAtTurnLimit, scheduleGoalContinuation, syncGoalUpdateTool, transitionGoal } from "./goal-runtime.ts";
 import { pauseGoalState } from "./goal-state.ts";
-import type { GoalRuntime, InitRuntime } from "./runtime.ts";
+import type { GoalRuntime } from "./runtime.ts";
 import { safeTerminalText } from "./safe-terminal-text.ts";
 
 function pauseGoalForPossibleManualCompaction(
@@ -36,12 +36,10 @@ function pauseGoalForPossibleManualCompaction(
 function recoverGoalAfterManualCompaction(
   pi: ExtensionAPI,
   runtime: GoalRuntime,
-  initState: InitRuntime,
   ctx: ExtensionContext,
 ): boolean {
   if (runtime.state?.status !== "paused"
-    || runtime.state.resumeAfterManualCompaction !== true
-    || initState.active) return false;
+    || runtime.state.resumeAfterManualCompaction !== true) return false;
   try {
     transitionGoal(pi, runtime, "resume", "active", undefined, { resetBlockedAudit: true });
   } catch (error) {
@@ -52,7 +50,7 @@ function recoverGoalAfterManualCompaction(
   runtime.continuationScheduled = false;
   runtime.automaticCompaction = undefined;
   ctx.ui.notify("Manual compaction complete. Goal resumed.", "info");
-  setImmediate(() => scheduleGoalContinuation(pi, runtime, initState, ctx));
+  setImmediate(() => scheduleGoalContinuation(pi, runtime, ctx));
   return true;
 }
 
@@ -60,7 +58,6 @@ function recoverGoalAfterManualCompaction(
 function finalizeAutomaticCompaction(
   pi: ExtensionAPI,
   runtime: GoalRuntime,
-  initState: InitRuntime,
   ctx: ExtensionContext,
 ): void {
   const recovery = runtime.automaticCompaction;
@@ -68,8 +65,7 @@ function finalizeAutomaticCompaction(
   const skipped = recovery.outcome === "skipped";
   runtime.automaticCompaction = undefined;
   if (runtime.state?.status !== "paused"
-    || runtime.state.revision !== recovery.pausedRevision
-    || initState.active) return;
+    || runtime.state.revision !== recovery.pausedRevision) return;
   try {
     transitionGoal(pi, runtime, "resume", "active", undefined, { resetBlockedAudit: true });
   } catch (error) {
@@ -80,31 +76,29 @@ function finalizeAutomaticCompaction(
     return;
   }
   runtime.continuationScheduled = false;
-  setImmediate(() => scheduleGoalContinuation(pi, runtime, initState, ctx));
+  setImmediate(() => scheduleGoalContinuation(pi, runtime, ctx));
 }
 
 /** Records Pi's successful compaction callback and attempts guarded recovery. */
 function completeAutomaticCompaction(
   pi: ExtensionAPI,
   runtime: GoalRuntime,
-  initState: InitRuntime,
   ctx: ExtensionContext,
 ): void {
   if (!runtime.automaticCompaction) return;
   runtime.automaticCompaction.outcome = "completed";
-  finalizeAutomaticCompaction(pi, runtime, initState, ctx);
+  finalizeAutomaticCompaction(pi, runtime, ctx);
 }
 
 /** Records Pi's expected session-too-small rejection and resumes without claiming compaction succeeded. */
 function skipAutomaticCompaction(
   pi: ExtensionAPI,
   runtime: GoalRuntime,
-  initState: InitRuntime,
   ctx: ExtensionContext,
 ): void {
   if (!runtime.automaticCompaction) return;
   runtime.automaticCompaction.outcome = "skipped";
-  finalizeAutomaticCompaction(pi, runtime, initState, ctx);
+  finalizeAutomaticCompaction(pi, runtime, ctx);
 }
 
 /** Consumes automatic recovery and records its failure on the eligible paused goal. */
@@ -151,7 +145,6 @@ function failAutomaticCompaction(
 export function registerGoalSettlement(
   pi: ExtensionAPI,
   runtime: GoalRuntime,
-  initState: InitRuntime,
 ): AutoCompactionGoalHandlers {
   pi.on("agent_settled", (_event, ctx) => {
     const wasGoalTurn = runtime.goalTurnInFlight;
@@ -182,15 +175,15 @@ export function registerGoalSettlement(
         return;
       }
       runtime.automaticCompaction.turnSettled = true;
-      finalizeAutomaticCompaction(pi, runtime, initState, ctx);
+      finalizeAutomaticCompaction(pi, runtime, ctx);
       return;
     }
 
-    if (!wasGoalTurn || runtime.state?.status !== "active" || initState.active) {
-      if (continuationWasScheduled && runtime.state?.status === "active" && !initState.active) {
+    if (!wasGoalTurn || runtime.state?.status !== "active") {
+      if (continuationWasScheduled && runtime.state?.status === "active") {
         pauseGoalAfterFailure(pi, runtime, ctx, "the goal continuation ended before an agent turn started");
-      } else if (runtime.state?.status === "active" && !initState.active) {
-        scheduleGoalContinuation(pi, runtime, initState, ctx);
+      } else if (runtime.state?.status === "active") {
+        scheduleGoalContinuation(pi, runtime, ctx);
       }
       return;
     }
@@ -215,20 +208,19 @@ export function registerGoalSettlement(
     runtime.lastStopReason = undefined;
     runtime.lastError = undefined;
     if (pauseGoalAtTurnLimit(pi, runtime, ctx)) return;
-    scheduleGoalContinuation(pi, runtime, initState, ctx);
+    scheduleGoalContinuation(pi, runtime, ctx);
   });
 
   pi.on("session_compact", (event, ctx) => {
     if (runtime.automaticCompaction !== undefined) return;
     if (event.reason !== "manual") return;
-    recoverGoalAfterManualCompaction(pi, runtime, initState, ctx);
+    recoverGoalAfterManualCompaction(pi, runtime, ctx);
   });
 
   return {
     isActive: (ctx: ExtensionContext): boolean => isGoalModeSupported(ctx)
       && isSavedSession(ctx)
-      && runtime.state?.status === "active"
-      && !initState.active,
+      && runtime.state?.status === "active",
     onRequested: (): void => {
       if (runtime.state?.status !== "active") return;
       try {
@@ -250,8 +242,8 @@ export function registerGoalSettlement(
         throw error;
       }
     },
-    onCompleted: (ctx: ExtensionContext): void => completeAutomaticCompaction(pi, runtime, initState, ctx),
+    onCompleted: (ctx: ExtensionContext): void => completeAutomaticCompaction(pi, runtime, ctx),
     onFailed: (ctx: ExtensionContext, error: unknown): void => failAutomaticCompaction(pi, runtime, ctx, error),
-    onSkipped: (ctx: ExtensionContext): void => skipAutomaticCompaction(pi, runtime, initState, ctx),
+    onSkipped: (ctx: ExtensionContext): void => skipAutomaticCompaction(pi, runtime, ctx),
   };
 }

package/killeros/goal-state.ts

@@ -242,6 +242,45 @@ export async function captureGoalFileBaseline(
   }
 }
 
+const GOAL_URL_PATTERN = /(?:https?|file):\/\/[^\s"'`]+/giu;
+const GOAL_QUOTED_PATTERN = /`([^`\r\n]+)`|"([^"\r\n]+)"|'([^'\r\n]+)'/gu;
+const GOAL_ABSOLUTE_PATTERN = /(?:^|[\s"'`(\[{,;])([A-Za-z]:[\\/][^\s,;'"`]+|\/[^\s,;'"`]+)/gu;
+const GOAL_LIST_FILE_PATTERN = /(?:\band\b|\bor\b|[,;&+])\s*(?:`([^`\r\n]+)`|"([^"\r\n]+)"|'([^'\r\n]+)'|([A-Za-z0-9_][A-Za-z0-9_.-]*(?:[\\/][A-Za-z0-9_.-]+)*\.[A-Za-z0-9]{1,12})\b)/giu;
+
+function isQuotedGoalFileMention(raw: string): boolean {
+  const value = raw.trim();
+  if (!value || /[\s\p{Cc}]/u.test(value) || /^(?:https?|file):\/\//iu.test(value) || /[\\/]$/u.test(value)) return false;
+  return /[\/\\.:]/u.test(value);
+}
+
+function normalizeGoalFileMention(raw: string, cwd: string): string | undefined {
+  const value = raw.trim().replace(/[.,;:!?)\]}]+$/u, "");
+  if (!value || /[\s\p{Cc}]/u.test(value)) return undefined;
+  const absolute = path.isAbsolute(value) || path.win32.isAbsolute(value) ? value : path.resolve(cwd, value);
+  if (!isAbsoluteFilePath(absolute)) return undefined;
+  return process.platform === "win32" ? absolute.toLowerCase() : absolute;
+}
+
+/** Counts distinct path-shaped mentions so several files cannot bind proof to one. */
+function countGoalTargetFiles(objective: string, cwd: string, target: string): number {
+  const prose = objective.replace(GOAL_URL_PATTERN, " ");
+  const mentions = new Set<string>();
+  const add = (raw: string): void => {
+    const normalized = normalizeGoalFileMention(raw, cwd);
+    if (normalized) mentions.add(normalized);
+  };
+  add(target);
+  for (const match of prose.matchAll(GOAL_QUOTED_PATTERN)) {
+    const raw = match[1] ?? match[2] ?? match[3] ?? "";
+    if (isQuotedGoalFileMention(raw)) add(raw);
+  }
+  for (const match of prose.matchAll(GOAL_ABSOLUTE_PATTERN)) {
+    if (match[1]) add(stripUnquotedPathPunctuation(match[1].trim()));
+  }
+  for (const match of prose.matchAll(GOAL_LIST_FILE_PATTERN)) add(match[1] ?? match[2] ?? match[3] ?? match[4] ?? "");
+  return mentions.size;
+}
+
 /** Captures one explicit output path so goal completion can verify its creation or modification. */
 export async function inferGoalVerification(objective: string, cwd: string): Promise<GoalFileVerification | undefined> {
   const candidates: string[] = [];
@@ -262,8 +301,12 @@ export async function inferGoalVerification(objective: string, cwd: string): Pro
     if (isAbsoluteFilePath(absolute)) resolved.push(absolute);
   }
   const unique = [...new Set(resolved)];
-  const filePath = unique.length === 1 ? unique[0] : undefined;
-  return filePath ? { kind: "file", path: filePath, baseline: await captureGoalFileBaseline(filePath) } : undefined;
+  if (unique.length !== 1) return undefined;
+  // A goal that names several files must not verify from one file alone.
+  // Repeated references to the same file count as one target.
+  const filePath = unique[0];
+  if (countGoalTargetFiles(objective, cwd, filePath) > 1) return undefined;
+  return { kind: "file", path: filePath, baseline: await captureGoalFileBaseline(filePath) };
 }
 
 export async function verifyGoalDeliverable(verification: GoalFileVerification): Promise<void> {

package/killeros/handoff.ts

@@ -104,6 +104,33 @@ function hasRequiredHandoffContent(document: string, focus: string): boolean {
   });
 }
 
+function handoffAvailable(ctx: ExtensionCommandContext, goalRuntime: GoalRuntime): boolean {
+  return ctx.isIdle() && !ctx.hasPendingMessages() && goalRuntime.state?.status !== "active";
+}
+
+function sourceHandoffAvailable(
+  ctx: ExtensionCommandContext,
+  goalRuntime: GoalRuntime,
+  sourceSession: string,
+  sourceLeaf: string | undefined,
+): boolean {
+  try {
+    return ctx.sessionManager.getSessionFile() === sourceSession
+      && handoffAvailable(ctx, goalRuntime)
+      && ctx.sessionManager.buildContextEntries().at(-1)?.id === sourceLeaf;
+  } catch {
+    return false;
+  }
+}
+
+function notifyHandoffUnavailable(ctx: ExtensionCommandContext): void {
+  try {
+    ctx.ui.notify(HANDOFF_UNAVAILABLE, "error");
+  } catch {
+    // A session replaced during generation has no valid source UI to notify.
+  }
+}
+
 function assertHandoffContextReserve(ctx: ExtensionCommandContext, maxTokens: number): void {
   let usage: ReturnType<ExtensionCommandContext["getContextUsage"]>;
   try {
@@ -160,8 +187,8 @@ export function registerHandoff(pi: ExtensionAPI, goalRuntime: GoalRuntime, hand
   pi.registerCommand("handoff", {
     description: "Create a fresh session with a continuation handoff",
     handler: async (args, ctx) => {
-      if (!ctx.isIdle() || ctx.hasPendingMessages() || goalRuntime.state?.status === "active") {
-        ctx.ui.notify(HANDOFF_UNAVAILABLE, "error");
+      if (!handoffAvailable(ctx, goalRuntime)) {
+        notifyHandoffUnavailable(ctx);
         return;
       }
 
@@ -175,8 +202,9 @@ export function registerHandoff(pi: ExtensionAPI, goalRuntime: GoalRuntime, hand
       let document: string;
       let focus: string;
       try {
-        const messages = ctx.sessionManager.buildContextEntries().flatMap(sessionEntryToContextMessages);
-        const conversation = serializeConversation(convertToLlm(messages));
+        const entries = ctx.sessionManager.buildContextEntries();
+        const sourceLeaf = entries.at(-1)?.id;
+        const conversation = serializeConversation(convertToLlm(entries.flatMap(sessionEntryToContextMessages)));
         if (!conversation.trim()) throw new Error("No usable session context is available");
         focus = safeTerminalText(args).trim();
         let maxTokens = handoffMaxTokens;
@@ -215,6 +243,10 @@ export function registerHandoff(pi: ExtensionAPI, goalRuntime: GoalRuntime, hand
         if (!hasRequiredHandoffContent(document, focus)) {
           throw new Error("The handoff summary did not contain every required section");
         }
+        if (!sourceHandoffAvailable(ctx, goalRuntime, sourceSession, sourceLeaf)) {
+          notifyHandoffUnavailable(ctx);
+          return;
+        }
       } catch (error) {
         reportError(ctx, "Handoff failed", error);
         return;

package/killeros/passive-git-status.ts

@@ -0,0 +1,206 @@
+import { accessSync, constants, existsSync, realpathSync, statSync } from "node:fs";
+import path from "node:path";
+
+// Passive Git inspection disables fsmonitor, known clean/process filters,
+// promisor fetches, and repository-supplied Git executables. Config discovery
+// and status run in separate Git processes, so a filter configured between
+// them would be absent from the safety overrides. Automatic Git children run
+// without PATH resolution, and each scan rejects results when the effective
+// filter set changed. Absolute filter commands remain possible, so product
+// callers run these scans only after project trust is granted.
+//
+// Executable discovery itself is passive: it never starts a command shell,
+// locator process, or other helper executable, and never executes a bare
+// program name. It scans absolute search-path entries for an absolute Git
+// path outside the inspected repository and fails closed when none exists.
+export const PASSIVE_GIT_CONFIG_ARGS = ["config", "--includes", "--null", "--name-only", "--list"] as const;
+
+const SAFE_FILTER_NAME = /^[A-Za-z0-9][A-Za-z0-9._-]*$/u;
+
+function searchPathEntries(env: NodeJS.ProcessEnv): string[] {
+  const values: string[] = [];
+  for (const [key, value] of Object.entries(env)) {
+    if (key.toLowerCase() === "path" && typeof value === "string") values.push(value);
+  }
+  const entries: string[] = [];
+  for (const value of values) entries.push(...value.split(path.delimiter));
+  return entries;
+}
+
+function pathExtensionEntries(env: NodeJS.ProcessEnv): string[] {
+  let raw: string | undefined;
+  for (const [key, value] of Object.entries(env)) {
+    if (key.toLowerCase() === "pathext" && typeof value === "string") {
+      raw = value;
+      break;
+    }
+  }
+  raw ??= ".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.CPL";
+  return raw.split(";").map((entry) => entry.trim()).filter(Boolean).map((entry) => entry.startsWith(".") ? entry : `.${entry}`);
+}
+
+function unquoted(entry: string): string {
+  if (entry.length >= 2) {
+    const first = entry[0];
+    const last = entry[entry.length - 1];
+    if ((first === '"' && last === '"') || (first === "'" && last === "'")) return entry.slice(1, -1);
+  }
+  return entry;
+}
+
+function inspectedRoot(cwd: string): string | undefined {
+  if (!cwd || typeof cwd !== "string") return undefined;
+  let start: string;
+  try {
+    start = path.resolve(cwd);
+  } catch {
+    return undefined;
+  }
+  let base: string;
+  try {
+    base = realpathSync(start);
+  } catch {
+    base = start;
+  }
+  let current = base;
+  for (;;) {
+    try {
+      if (existsSync(path.join(current, ".git"))) {
+        try {
+          return realpathSync(current);
+        } catch {
+          return current;
+        }
+      }
+    } catch {
+      // Unreadable directory: keep walking toward the filesystem root.
+    }
+    const parent = path.dirname(current);
+    if (parent === current) break;
+    current = parent;
+  }
+  return base;
+}
+
+function insideInspected(candidate: string, root: string): boolean {
+  if (process.platform === "win32") {
+    const normalizedCandidate = path.win32.normalize(candidate).toLowerCase();
+    const normalizedRoot = path.win32.normalize(root).toLowerCase();
+    const trimmed = normalizedRoot.length > 3 && normalizedRoot.endsWith(path.win32.sep)
+      ? normalizedRoot.slice(0, -1)
+      : normalizedRoot;
+    if (normalizedCandidate === trimmed) return true;
+    return normalizedCandidate.startsWith(`${trimmed}${path.win32.sep}`);
+  }
+  const normalizedCandidate = path.normalize(candidate);
+  const normalizedRoot = path.normalize(root);
+  const trimmed = normalizedRoot.length > 1 && normalizedRoot.endsWith(path.sep)
+    ? normalizedRoot.slice(0, -1)
+    : normalizedRoot;
+  if (normalizedCandidate === trimmed) return true;
+  return normalizedCandidate.startsWith(`${trimmed}${path.sep}`);
+}
+
+// Absolute Git binary outside the inspected repository, or undefined when
+// no safe candidate exists. Never starts a helper process and never
+// returns a bare command name, so opening a repository cannot execute a
+// repository-local locator or Git executable. Empty and relative
+// search-path entries are ignored because they can resolve against the
+// current directory. A candidate that resolves through a link returns its
+// final path only when that path is also outside the repository.
+export function passiveGitCommand(cwd: string, env: NodeJS.ProcessEnv = process.env): string | undefined {
+  const root = inspectedRoot(cwd);
+  if (!root) return undefined;
+  const entries = searchPathEntries(env);
+  if (entries.length === 0) return undefined;
+  const windows = process.platform === "win32";
+  const baseNames = windows ? ["git", ...pathExtensionEntries(env).map((extension) => `git${extension}`)] : ["git"];
+  for (const raw of entries) {
+    if (raw === "" || raw.trim() === "") continue;
+    const directory = unquoted(raw);
+    if (directory === "" || directory.trim() === "") continue;
+    if (!path.isAbsolute(directory)) continue;
+    for (const base of baseNames) {
+      const candidate = path.join(directory, base);
+      try {
+        if (!statSync(candidate).isFile()) continue;
+      } catch {
+        continue;
+      }
+      if (!windows) {
+        try {
+          accessSync(candidate, constants.X_OK);
+        } catch {
+          continue;
+        }
+      }
+      let resolved: string;
+      try {
+        resolved = realpathSync(candidate);
+      } catch {
+        continue;
+      }
+      if (!path.isAbsolute(resolved)) continue;
+      if (insideInspected(resolved, root)) continue;
+      return resolved;
+    }
+  }
+  return undefined;
+}
+
+// Lists effective clean/process filter drivers in discovery order, or
+// undefined when discovery output is incomplete or names a driver the
+// safety overrides cannot represent.
+export function passiveFilterNames(config: string): string[] | undefined {
+  const records = config.split("\0");
+  if (records.at(-1) !== "") return undefined;
+  const names = new Set<string>();
+  for (const key of records) {
+    if (!key) continue;
+    const name = /^filter\.(.*)\.(?:clean|process)$/us.exec(key)?.[1];
+    if (name === undefined) continue;
+    if (!SAFE_FILTER_NAME.test(name)) return undefined;
+    names.add(name);
+  }
+  return [...names];
+}
+
+// Builds safe overrides from null-delimited `git config --name-only --list`
+// output. Returns undefined when output is incomplete or names an unsafe
+// filter, so the caller skips the status call.
+export function passiveStatusSafetyArgs(config: string): string[] | undefined {
+  const names = passiveFilterNames(config);
+  if (!names) return undefined;
+  return ["-c", "core.fsmonitor=false", ...names.flatMap((name) => ["-c", `filter.${name}.clean=`, "-c", `filter.${name}.process=`, "-c", `filter.${name}.required=false`])];
+}
+
+export function samePassiveFilters(before: string, after: string): boolean {
+  const earlier = passiveFilterNames(before);
+  const later = passiveFilterNames(after);
+  if (!earlier || !later) return false;
+  if (earlier.length !== later.length) return false;
+  const ordered = [...later].sort();
+  return [...earlier].sort().every((name, index) => name === ordered[index]);
+}
+
+// Environment for automatic Git children: no optional locks, no lazy fetch
+// from a promisor remote, and no PATH so a filter command that becomes
+// effective after discovery cannot resolve a bare command name. Absolute
+// filter paths are still possible; trusted-project callers detect mid-scan
+// config changes with samePassiveFilters and skip those results.
+export function passiveGitEnv(base: NodeJS.ProcessEnv = process.env): NodeJS.ProcessEnv {
+  const env: NodeJS.ProcessEnv = {
+    ...base,
+    GIT_OPTIONAL_LOCKS: "0",
+    GIT_NO_LAZY_FETCH: "1",
+  };
+  let hasPath = false;
+  for (const key of Object.keys(env)) {
+    if (key.toLowerCase() === "path") {
+      env[key] = "";
+      hasPath = true;
+    }
+  }
+  if (!hasPath) env.PATH = "";
+  return env;
+}

package/killeros/personal-instructions.ts

@@ -3,7 +3,6 @@ import os from "node:os";
 import path from "node:path";
 import { StringDecoder } from "node:string_decoder";
 import { getAgentDir, type ExtensionAPI } from "@earendil-works/pi-coding-agent";
-import type { InitRuntime } from "./runtime.ts";
 
 const PERSONAL_INSTRUCTIONS_FILE = "AGENTS.local.md";
 const PERSONAL_INSTRUCTIONS_LIMIT = 32 * 1024;
@@ -107,9 +106,9 @@ export function resolvePersonalInstructions(cwd: string): string | undefined {
   return `<personal_instructions>\n${content}\n</personal_instructions>`;
 }
 
-export function registerPersonalInstructions(pi: ExtensionAPI, initState: InitRuntime): void {
+export function registerPersonalInstructions(pi: ExtensionAPI): void {
   pi.on("before_agent_start", (event, ctx) => {
-    if (initState.active || !ctx.isProjectTrusted()) return;
+    if (!ctx.isProjectTrusted()) return;
     const personal = resolvePersonalInstructions(ctx.cwd);
     if (!personal) return;
     return {

package/killeros/runtime.ts

@@ -1,25 +1,3 @@
-import type { InitEvidenceIndex } from "./init-evidence.ts";
-import type { InitTargetBaseline } from "./init-target.ts";
-
-export type InitOutcome =
-  | { kind: "pending" }
-  | { kind: "written"; recoveryPath?: string }
-  | { kind: "policy-conflict"; reason: string }
-  | { kind: "cancelled" }
-  | { kind: "no-outcome" };
-
-export interface InitRuntime {
-  active: boolean;
-  starting?: symbol;
-  targetPath?: string;
-  projectRoot?: string;
-  activeTools?: string[];
-  evidence?: InitEvidenceIndex;
-  baseline?: InitTargetBaseline;
-  outcome: InitOutcome;
-  settle?: (outcome: InitOutcome) => void;
-}
-
 export type GoalStatus = "active" | "paused" | "blocked" | "complete";
 
 export interface GoalBlockerAudit {
@@ -106,10 +84,6 @@ export interface GoalRuntime {
   requestRender?: () => void;
 }
 
-export function createInitRuntime(): InitRuntime {
-  return { active: false, outcome: { kind: "pending" } };
-}
-
 export function createGoalRuntime(): GoalRuntime {
   return {
     continuationScheduled: false,
@@ -120,15 +94,3 @@ export function createGoalRuntime(): GoalRuntime {
     persistenceRetryNeeded: false,
   };
 }
-
-export function resetInitRuntime(state: InitRuntime): void {
-  state.active = false;
-  state.starting = undefined;
-  state.targetPath = undefined;
-  state.projectRoot = undefined;
-  state.activeTools = undefined;
-  state.evidence = undefined;
-  state.baseline = undefined;
-  state.outcome = { kind: "pending" };
-  state.settle = undefined;
-}

package/killeros/shell-ui.ts

@@ -24,6 +24,7 @@ import {
   type SlashCommandResolver,
 } from "./commands.ts";
 import { reportError } from "./errors.ts";
+import { passiveGitCommand, passiveGitEnv } from "./passive-git-status.ts";
 
 function readPackageVersion(path: string | URL): string | undefined {
   try {
@@ -47,7 +48,6 @@ const STARTUP_TIPS = [
   "Type / to browse every command available in this session.",
   "Run /notification to enable a terminal bell when work settles.",
   "Run /goal <objective> to keep long-running work moving across turns.",
-  "Run /init to generate root AGENTS.md from bounded repository evidence.",
   "Run /handoff [focus] to continue work in a fresh linked session.",
   "Run /codex-fast to toggle priority requests for Codex models.",
   "Run /clear to start a fresh session after confirmation.",
@@ -67,13 +67,22 @@ const EDITOR_SUGGESTIONS = [
   'Try "draft an implementation plan for <feature>"',
 ] as const;
 
-export function resolveGitBranch(cwd: string): Promise<string | undefined> {
+export function resolveGitBranch(cwd: string, trusted = true): Promise<string | undefined> {
+  if (!trusted) return Promise.resolve(undefined);
+  let gitCommand: string | undefined;
+  try {
+    gitCommand = passiveGitCommand(cwd);
+  } catch {
+    return Promise.resolve(undefined);
+  }
+  if (!gitCommand) return Promise.resolve(undefined);
   return new Promise((resolve) => {
     execFile(
-      "git",
+      gitCommand,
       ["-C", cwd, "rev-parse", "--abbrev-ref", "HEAD"],
       {
         encoding: "utf8",
+        env: passiveGitEnv(),
         maxBuffer: 64 * 1024,
         timeout: 500,
         windowsHide: true,
@@ -132,7 +141,7 @@ class PiStartupHeader {
     this.ctx = ctx;
     this.tip = tip;
     this.tui = tui;
-    void resolveGitBranch(ctx.cwd).then((branch) => {
+    void resolveGitBranch(ctx.cwd, ctx.isProjectTrusted()).then((branch) => {
       if (this.disposed) return;
       this.branch = branch;
       this.tui.requestRender();

package/killeros/worked-for.ts

@@ -142,7 +142,8 @@ function parseV4(data: Record<string, unknown>): WorkedForEntryDataV4 | undefine
   const checks: CheckAttempt[] = [];
   for (const check of data.checks) {
     if (!record(check) || check.outcome !== "passed" && check.outcome !== "failed") return undefined;
-    const label = CHECK_LABELS.find((candidate) => candidate === check.label);
+    const label = CHECK_LABELS.find((candidate) => candidate === check.label)
+      ?? (check.label === "node --test (focused)" ? "node --test (focused)" : undefined);
     if (!label) return undefined;
     checks.push({ label, outcome: check.outcome });
   }
@@ -337,7 +338,7 @@ export function registerWorkedFor(
   });
 
   pi.on("agent_start", async (_event, ctx) => {
-    if (ctx.mode !== "tui" || active) return;
+    if (ctx.mode !== "tui" || active || !ctx.isProjectTrusted()) return;
     const state: ActiveReceipt = {
       startedAt: now(),
       startedTokens: sessionTokenTotal(ctx),