natureco-cli 5.63.0 → 5.64.0

package/CHANGELOG.md

@@ -2,6 +2,27 @@
 
 All notable changes to NatureCo CLI will be documented in this file.
 
+## [5.64.0] - 2026-07-13 — Secure unified agent and operations foundation
+
+### Added
+- Unified `AgentCore`, `ToolExecutionGateway`, single tool manifest, mandatory JSON Schema validation and standardized tool results.
+- Conflict-safe structural patching, atomic rollback, coding `/undo`, `/retry`, `/compact`, local code intelligence and LSP JSON-RPC client.
+- Provenance/confidence/TTL memory records, conflict resolution, approved skill promotion, versioning and rollback.
+- Shared channel SDK with pairing-by-default, persistent idempotent delivery queue, retries, dead letters, reconnect supervision, health and metrics.
+- macOS Keychain, Windows DPAPI, Linux Secret Service and AES-256-GCM encrypted secret fallback.
+- Encrypted multi-device sync primitives with authenticated envelopes and vector-clock conflict detection.
+- Isolated sub-agent worktrees, test-failure analysis/repair loop, startup benchmark and TR/EN catalog snapshots.
+
+### Security
+- Fixed bulk-write guardrail bypasses, protected sensitive paths across execution origins and enabled guardrail hard-stop.
+- Removed high-risk shell string interpolation from iMessage delivery, backups, plugin installation/cloning and AI-generated Git commits.
+- Added channel pairing gates, non-interactive fail-closed permission handling and process-listener cleanup.
+
+### Tests
+- 73 test files, 711 passing tests (3 skipped), zero high-severity audit findings, CLI smoke and package checks.
+- Windows `--version` median reduced from ~366 ms to ~75 ms, meeting the <100 ms target.
+- Real Windows/macOS/Linux GitHub Actions matrix with lint, tests, smoke, audit and package verification.
+
 ## [5.63.0] - 2026-07-12 — Complete English REPL localization
 
 ### Changed

package/bin/natureco.js

@@ -1,6 +1,13 @@
-#!/usr/bin/env node
-
-const { Command } = require('commander');
+#!/usr/bin/env node
+
+// Fast path: version checks are used by shells, installers and health probes.
+// Avoid loading Commander and ~100 command modules for a constant-time answer.
+if (process.argv.length === 3 && (process.argv[2] === '--version' || process.argv[2] === '-V')) {
+  process.stdout.write(require('../package.json').version + '\n');
+  process.exit(0);
+}
+
+const { Command } = require('commander');
 const chalk = require('chalk');
 const packageJson = require('../package.json');
 // Küresel çökme/EPIPE yakalayıcıları — ham Node stack yerine düzgün mesaj + audit log

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "natureco-cli",
-  "version": "5.63.0",
+  "version": "5.64.0",
   "description": "Terminal-native AI agent CLI with bilingual TR/EN UI, multi-agent orchestration, persistent memory, secure tools and messaging integrations.",
   "bin": {
     "natureco": "bin/natureco.js"
@@ -22,6 +22,7 @@
     "test:unit": "vitest run",
     "test:watch": "vitest",
     "test:coverage": "vitest run --coverage",
+    "perf:startup": "node scripts/benchmark-startup.js",
     "lint": "eslint src/ bin/ test/",
     "lint:fix": "eslint src/ bin/ test/ --fix",
     "lint:errors-only": "eslint src/ bin/ test/ --quiet",

package/scripts/benchmark-startup.js

@@ -0,0 +1,26 @@
+'use strict';
+
+const { spawnSync } = require('child_process');
+const path = require('path');
+
+const bin = path.join(__dirname, '..', 'bin', 'natureco.js');
+function measure(args, runs = 7) {
+  const samples = [];
+  for (let i = 0; i < runs; i++) {
+    const start = process.hrtime.bigint();
+    const result = spawnSync(process.execPath, [bin, ...args], { encoding: 'utf8', env: { ...process.env, NATURECO_NO_UPDATE_CHECK: '1', FORCE_COLOR: '0' } });
+    const durationMs = Number(process.hrtime.bigint() - start) / 1e6;
+    if (result.status !== 0) throw new Error(`${args.join(' ')} failed: ${result.stderr}`);
+    samples.push(durationMs);
+  }
+  samples.sort((a, b) => a - b);
+  return { min: samples[0], median: samples[Math.floor(samples.length / 2)], p95: samples[Math.min(samples.length - 1, Math.ceil(samples.length * 0.95) - 1)], samples };
+}
+
+const version = measure(['--version']);
+const report = { timestamp: new Date().toISOString(), node: process.version, platform: process.platform, version };
+console.log(JSON.stringify(report, null, 2));
+if (version.median >= 100) {
+  console.error(`--version median ${version.median.toFixed(1)}ms exceeds 100ms target`);
+  process.exitCode = 1;
+}

package/src/commands/backup.js

@@ -4,7 +4,7 @@ const { getLang: _gl } = require('../utils/i18n');
 const L = (tr, en) => (_gl() === 'en' ? en : tr);
 const path = require('path');
 const os = require('os');
-const { execSync } = require('child_process');
+const { execFileSync } = require('child_process');
 
 const NATURECO_DIR = path.join(os.homedir(), '.natureco');
 
@@ -32,7 +32,7 @@ function createBackup() {
 
   if (fs.existsSync(NATURECO_DIR)) {
     try {
-      execSync(`tar -czf "${backupFile}" -C "${path.dirname(NATURECO_DIR)}" "${path.basename(NATURECO_DIR)}"`, {
+      execFileSync('tar', ['-czf', backupFile, '-C', path.dirname(NATURECO_DIR), path.basename(NATURECO_DIR)], {
         stdio: 'pipe',
         encoding: 'utf8',
         timeout: 30000
@@ -97,7 +97,7 @@ function restoreBackup(file) {
 
   console.log(chalk.yellow(`\n  ⚠️  Restoring ${file}...\n`));
   try {
-    execSync(`tar -xzf "${backupFile}" -C "${os.homedir()}"`, { stdio: 'pipe', timeout: 15000 });
+    execFileSync('tar', ['-xzf', backupFile, '-C', os.homedir()], { stdio: 'pipe', timeout: 15000 });
     console.log(chalk.green('  ✅ Restore complete\n'));
   } catch {
     console.log(chalk.red('  ❌ Restore failed\n'));

package/src/commands/code.js

@@ -2,7 +2,7 @@ const path = require('path');
 const os = require('os');
 const fs = require('fs');
 const readline = require('readline');
-const { execSync } = require('child_process');
+const { execSync, execFileSync } = require('child_process');
 const inquirer = require('../utils/inquirer-wrapper');
 const TB = require('../utils/token-budget');
 const chalk = require('chalk');
@@ -14,7 +14,11 @@ const { getMemoryPrompt, loadMemory } = require('../utils/memory');
 const { getAgentsPrompt } = require('../utils/agents');
 const { createSession, addMessageToSession } = require('../utils/sessions');
 const { addToHistory } = require('../utils/history');
-const { getToolDefinitions, executeTool } = require('../utils/tool-runner');
+const { getToolDefinitions, executeTool } = require('../utils/tool-runner');
+const { AgentCore } = require('../utils/agent-core');
+const { CodingSession } = require('../utils/coding-session');
+
+const agentCore = new AgentCore({ maxIterations: 10 });
 
 let rl = null;
 
@@ -224,12 +228,17 @@ async function streamMessage(providerConfig, messages, tools) {
 // ── Tool execution ────────────────────────────────────────────────────────────
 const DANGEROUS = [/\brm\b/, /\brmdir\b/, /\bdelete\b/i, /\bdrop\b/i, /\btruncate\b/i];
 
-async function runToolCall(toolCall, stats, dryRun = false) {
+async function runToolCall(toolCall, stats, dryRun = false, codingSession = null) {
+  const guard = agentCore.assess({ name: toolCall.name, input: toolCall.input });
+  if (guard.blocked) return { success: false, error: guard.reason || `blocked_by_guardrails: ${toolCall.name}` };
   const inputPreview = JSON.stringify(toolCall.input).slice(0, 60);
 
-  const needsConfirm =
+  const needsConfirm =
     toolCall.name === 'write_file' ||
-    (toolCall.name === 'bash' && DANGEROUS.some(re => re.test(toolCall.input.command || '')));
+    (toolCall.name === 'bash' && DANGEROUS.some(re => re.test(toolCall.input.command || '')));
+
+  const risk = codingSession?.riskSummary(toolCall);
+  if (risk && risk.level !== 'low') console.log(chalk.gray(`  Risk: ${risk.level} (${risk.risks.join(', ')})`));
 
   // Dry-run: write_file'ı engelle, diff göster
   if (dryRun && toolCall.name === 'write_file') {
@@ -261,8 +270,12 @@ async function runToolCall(toolCall, stats, dryRun = false) {
     }
   }
 
-  const spinner = startSpinner(`${toolCall.name}  ${inputPreview}`);
-  const result = await executeTool(toolCall.name, toolCall.input);
+  const spinner = startSpinner(`${toolCall.name}  ${inputPreview}`);
+  if (!dryRun && codingSession && (toolCall.name === 'write_file' || toolCall.name === 'edit_file')) {
+    codingSession.capture(toolCall.input.path);
+  }
+  const result = await executeTool(toolCall.name, toolCall.input);
+  agentCore.record({ name: toolCall.name, input: toolCall.input }, result);
   stopSpinner(spinner, toolCall.name, result.success !== false);
 
   if (result.success !== false) {
@@ -310,7 +323,8 @@ async function runTests(projectIndex, conversationMessages, tools, providerConfi
 }
 
 // ── Main ──────────────────────────────────────────────────────────────────────
-async function code(targetFile, options = {}) {
+async function code(targetFile, options = {}) {
+  const codingSession = new CodingSession();
   const workDir = options.dir || process.cwd();
   const apiKey = getApiKey();
   const config = getConfig();
@@ -507,15 +521,35 @@ ${indexPrompt}`);
             ['/run <cmd>',L('Komutu çalıştır, hata varsa düzelt', 'Run command, fix errors if any')],
             ['/test',    L('Testleri çalıştır, hata varsa düzelt', 'Run tests, fix errors if any')],
             ['/git',     L('Git durumu ve son commitler', 'Git status and recent commits')],
-            ['/commit',  L('Staged değişiklikleri AI ile commit et', 'Commit staged changes with AI')],
+            ['/commit',  L('Staged değişiklikleri AI ile commit et', 'Commit staged changes with AI')],
+            ['/undo',    L('Son dosya değişikliğini geri al', 'Undo the last file change')],
+            ['/retry',   L('Son isteği yeniden çalıştır', 'Retry the last request')],
+            ['/compact', L('Konuşma bağlamını sıkıştır', 'Compact conversation context')],
             ['/help',    L('Bu yardım', 'This help')],
           ].forEach(([c, d]) => console.log('  ' + chalk.cyan(c.padEnd(12)) + chalk.gray(d)));
           console.log(chalk.gray('  Ctrl+C'.padEnd(14) + L('Çıkış', 'Exit')));
           console.log();
           return;
-        case 'clear':
+        case 'clear':
           console.clear();
-          return;
+          return;
+        case 'undo': {
+          const undone = codingSession.undo();
+          console.log(undone.ok ? chalk.green(`  ✓ ${undone.path}`) : chalk.yellow(`  ${undone.error}`));
+          return;
+        }
+        case 'compact': {
+          const compacted = codingSession.compact(conversationMessages);
+          conversationMessages.splice(0, conversationMessages.length, ...compacted.messages);
+          console.log(chalk.green(`  ✓ Context compacted: ${compacted.before} → ${compacted.after}`));
+          return;
+        }
+        case 'retry': {
+          const previous = codingSession.retryMessage();
+          if (!previous) console.log(chalk.yellow(L('  Tekrarlanacak istek yok.', '  No request to retry.')));
+          else await handleMessage(previous);
+          return;
+        }
         case 'summary':
         case 'done': {
           const sum = await generateSummary(conversationMessages, providerConfig);
@@ -591,7 +625,7 @@ ${indexPrompt}`);
             console.log(chalk.cyan(`\n  ${L('Önerilen', 'Suggested')}: ${chalk.white(commitMsg)}\n`));
             const ok = await confirmAction(L('Commit edilsin mi?', 'Commit?'));
             if (ok) {
-              execSync(`git commit -m "${commitMsg.replace(/"/g, '\\"')}"`, { cwd: workDir, stdio: 'pipe' });
+              execFileSync('git', ['commit', '-m', commitMsg], { cwd: workDir, stdio: 'pipe' });
               console.log(chalk.green(L('  ✓ Commit yapıldı!\n', '  ✓ Committed!\n')));
             } else {
               console.log(chalk.gray(L('  İptal edildi.\n', '  Cancelled.\n')));
@@ -607,7 +641,8 @@ ${indexPrompt}`);
       }
     }
 
-    stats.messageCount++;
+    stats.messageCount++;
+    codingSession.rememberUserMessage(userMessage);
     console.log(chalk.white('You  ') + userMessage);
     conversationMessages.push({ role: 'user', content: userMessage });
 
@@ -655,7 +690,7 @@ ${indexPrompt}`);
 
       for (let ti = 0; ti < streamResult.toolCalls.length; ti++) {
         const toolCall = streamResult.toolCalls[ti];
-        const result = await runToolCall(toolCall, stats, options.dryRun);
+        const result = await runToolCall(toolCall, stats, options.dryRun, codingSession);
         const resultStr = result.success !== false
           ? (result.output || JSON.stringify(result))
           : `${L('Hata', 'Error')}: ${result.error}`;

package/src/commands/code_v5.js

@@ -33,6 +33,9 @@ const { getFallbackChain } = require("../utils/fallback-chain");
 const { getTaskManager } = require("../utils/tasks");
 const { buildTiers, assemble, discoverProjectRules } = require("../utils/system-prompt");
 const { buildSkillIndex } = require("../utils/skill-index");
+const { AgentCore } = require("../utils/agent-core");
+
+const agentCore = new AgentCore({ maxIterations: 10 });
 
 const IS_MAC = os.platform() === "darwin";
 const MAX_ITERATIONS = 10;
@@ -624,9 +627,16 @@ async function codeV5(targetPath) {
 const PARALLEL_SAFE_TOOLS = new Set(['read_file', 'file_search', 'grep_search', 'web_search', 'web_readability', 'duckduckgo_search', 'exa_search', 'searxng_search', 'firecrawl', 'memory_search', 'memory']);
 
 async function processToolCalls(reply, config, toolDefs, messages, onToolResult) {
+  agentCore.startIteration();
+  const coreBlocked = new Map();
   for (const tc of reply.tool_calls) {
     let args = {};
     try { args = JSON.parse(tc.function.arguments || "{}"); } catch {}
+    const guard = agentCore.assess({ name: tc.function.name, input: args });
+    if (guard.blocked) {
+      coreBlocked.set(tc.id, guard.reason || "blocked_by_guardrails");
+      continue;
+    }
     const risk = assessRisk(tc.function.name, args);
 
     // Built-in risk assessment
@@ -687,7 +697,11 @@ async function processToolCalls(reply, config, toolDefs, messages, onToolResult)
 
   messages.push({ role: "assistant", content: reply.content || null, tool_calls: reply.tool_calls });
 
-  const parsed = reply.tool_calls.map(tc => {
+  for (const [id, reason] of coreBlocked) {
+    messages.push({ role: "tool", tool_call_id: id, content: "ERROR: " + reason });
+  }
+
+  const parsed = reply.tool_calls.filter(tc => !coreBlocked.has(tc.id)).map(tc => {
     let args = {};
     try { args = JSON.parse(tc.function.arguments || "{}"); } catch {}
     return { name: tc.function.name, args, id: tc.id };

package/src/commands/gateway-server.js

@@ -2,13 +2,75 @@ const chalk = require('chalk');
 const fs = require('fs');
 const path = require('path');
 const os = require('os');
-const { spawn, execSync } = require('child_process');
+const { spawn, execSync, execFileSync } = require('child_process');
 const pino = require('pino');
 const { loadBaileys } = require('../utils/baileys');
 const { ApiError } = require('../utils/errors');
+const { ensurePendingPairing, isPaired } = require('../utils/pairing-store');
+const { ChannelAdapter, ChannelDeliveryManager } = require('../utils/channel-sdk');
+const { DeliveryStore } = require('../utils/delivery-store');
 
 const PID_FILE = path.join(os.homedir(), '.natureco', 'gateway.pid');
 const LOG_FILE = path.join(os.homedir(), '.natureco', 'gateway.log');
+const gatewayStartedAt = Date.now();
+const gatewayDeliveryManager = new ChannelDeliveryManager({ store: new DeliveryStore() });
+
+async function buildGatewayHealth(config = {}, manager = gatewayDeliveryManager) {
+  const configuredChannels = ['whatsapp', 'telegram', 'signal', 'discord', 'slack', 'irc', 'mattermost', 'imessage', 'sms']
+    .filter(name => Object.keys(config).some(key => key.toLowerCase().startsWith(name) && !!config[key]));
+  const adapterHealth = await manager.health();
+  const channelStates = Object.fromEntries(configuredChannels.map(name => {
+    const adapter = adapterHealth.find(item => item.channel === name);
+    return [name, adapter || { channel: name, state: 'configured', ok: null }];
+  }));
+  const metrics = manager.snapshotMetrics();
+  return {
+    ok: metrics.failed === 0 || metrics.delivered > 0,
+    status: metrics.failed > 0 ? 'degraded' : 'healthy',
+    uptimeSeconds: Math.floor((Date.now() - gatewayStartedAt) / 1000),
+    pid: process.pid,
+    channels: channelStates,
+    delivery: { ...metrics, deadLetters: manager.deadLetters.length },
+    timestamp: new Date().toISOString(),
+  };
+}
+
+function registerGatewayDeliveryAdapters(config, manager = gatewayDeliveryManager) {
+  const register = (name, send, health) => {
+    if (manager.adapters.has(name)) return;
+    manager.register(new ChannelAdapter({ name, send, health }));
+  };
+  register('whatsapp', async item => {
+    if (!global.whatsappSock) throw new Error('WhatsApp not connected');
+    const jid = `${String(item.target).replace(/[^\d]/g, '')}@s.whatsapp.net`;
+    return global.whatsappSock.sendMessage(jid, { text: String(item.payload.message) });
+  }, async () => ({ ok: !!global.whatsappSock }));
+  register('telegram', async item => {
+    if (!global.telegramBot) throw new Error('Telegram not connected');
+    return global.telegramBot.sendMessage(String(item.target), String(item.payload.message));
+  }, async () => ({ ok: !!global.telegramBot }));
+  register('signal', item => sendSignalMessage(config, item.target, item.payload.message), async () => ({ ok: !!global.signalProvider || !!config.signalHttpUrl }));
+  register('irc', async item => {
+    if (!global.ircClient?.isReady()) throw new Error('IRC not connected');
+    return sendIrcMessage(global.ircClient, item.target, item.payload.message);
+  }, async () => ({ ok: !!global.ircClient?.isReady() }));
+  register('mattermost', item => sendMattermostMessage(config, item.target, item.payload.message), async () => ({ ok: !!global.mattermostProvider }));
+  register('imessage', async item => {
+    if (!global.imessageProvider) throw new Error('iMessage not connected');
+    return sendImessage(global.imessageProvider.imsgPath, item.target, item.payload.message);
+  }, async () => ({ ok: !!global.imessageProvider }));
+  register('sms', item => sendSmsMessage(config, item.target, item.payload.message), async () => ({ ok: !!global.smsProvider }));
+  register('discord', async item => {
+    if (!global.discordClient) throw new Error('Discord not connected');
+    const channel = await global.discordClient.channels.fetch(String(item.target));
+    return channel.send(String(item.payload.message));
+  }, async () => ({ ok: !!global.discordClient }));
+  register('slack', async item => {
+    if (!global.slackClient) throw new Error('Slack not connected');
+    return global.slackClient.chat.postMessage({ channel: String(item.target), text: String(item.payload.message) });
+  }, async () => ({ ok: !!global.slackClient }));
+  return manager;
+}
 
 // `https` is used in the webhook delivery path (~line 570). The require was
 // missing; the module only worked because Node's CommonJS cache happens to
@@ -408,9 +470,14 @@ async function startWhatsAppProvider(sessionDir, config) {
         // Log incoming number
         log('whatsapp', `Incoming from: +${sender}, allowed: ${JSON.stringify(allowedNumbers)}`, 'gray');
         
-        // Access control - skip if fromMe + LID (own conversation)
-        if (!(msg.key.fromMe && isLID) && allowedNumbers.length > 0 && !allowedNumbers.some(n => numberMatches(n, sender))) {
-          log('whatsapp', `blocked message from +${sender} (not in allowed list)`, 'yellow');
+        // Pairing is the default. The owner's own LID conversation is trusted;
+        // every other sender must be allowlisted or explicitly paired.
+        const ownConversation = msg.key.fromMe && isLID;
+        const gate = ownConversation
+          ? { allowed: true, trusted: true, reason: 'owner' }
+          : channelGate(config, 'whatsapp', sender);
+        if (!gate.allowed) {
+          log('whatsapp', `blocked message from +${sender} (${gate.reason})`, 'yellow');
           continue;
         }
         
@@ -437,8 +504,7 @@ async function startWhatsAppProvider(sessionDir, config) {
         try {
           // v5.47 TEK BEYIN: allow-list'teki gonderen (veya sahibin kendi cihazi) =
           // guvenilir → terminaldekiyle ayni ajan. Aksi halde hafizasiz hafif yol.
-          const trusted = (msg.key.fromMe && isLID) ||
-            (allowedNumbers.length > 0 && allowedNumbers.some(n => numberMatches(n, sender)));
+          const trusted = gate.trusted;
           let reply = '';
 
           if (trusted) {
@@ -516,8 +582,11 @@ async function startDiscordProvider(config) {
     client.on(Events.MessageCreate, async (message) => {
       if (message.author.bot) return;
       const chatId = message.channel.id;
-      const allowedChats = config.discordAllowedChats || [];
-      if (allowedChats.length > 0 && !allowedChats.includes(chatId)) return;
+      const gate = channelGate(config, 'discord', String(message.author.id || chatId));
+      if (!gate.allowed) {
+        log('discord', `blocked message from ${message.author.id} (${gate.reason})`, 'yellow');
+        return;
+      }
 
       try {
         const response = await callProviderForGateway(config, message.content, {
@@ -546,13 +615,19 @@ async function startDiscordProvider(config) {
 // yetkisiz/yabancı gönderene kişisel hafıza sızabiliyordu. channelGate: (1) allow-list
 // kuruluysa yetkisiz göndereni ENGELLE; (2) allow-list kurulu DEĞİLSE yanıt ver ama
 // kişisel hafızayı ENJEKTE ETME (trusted=false) — böylece anonim kanaldan hafıza sızmaz.
-function channelGate(config, channel, senderId) {
+function channelGate(config, channel, senderId, pairing = { isPaired, ensurePendingPairing }) {
   const allow = config[`${channel}AllowedChats`] || config[`${channel}AllowedNumbers`] || config[`${channel}AllowedUsers`] || [];
-  if (!Array.isArray(allow) || allow.length === 0) {
-    return { allowed: true, trusted: false };
+  const allowlisted = Array.isArray(allow) && allow.map(String).includes(String(senderId));
+  if (allowlisted) return { allowed: true, trusted: true, reason: 'allowlist' };
+
+  const policy = config[`${channel}DmPolicy`] || 'pairing';
+  if (policy === 'open') return { allowed: true, trusted: false, reason: 'open' };
+  if (policy === 'disabled' || policy === 'allowlist') {
+    return { allowed: false, trusted: false, reason: policy };
   }
-  const ok = allow.map(String).includes(String(senderId));
-  return { allowed: ok, trusted: ok };
+  if (pairing.isPaired(channel, senderId)) return { allowed: true, trusted: true, reason: 'paired' };
+  const pending = pairing.ensurePendingPairing(channel, senderId);
+  return { allowed: false, trusted: false, reason: 'pairing-required', pairingId: pending.id };
 }
 
 async function startSlackProvider(config) {
@@ -1500,7 +1575,7 @@ function startImessagePollingFallback(imsgPath, config) {
     try {
       const args = ['history', '--format', 'json', '--limit', '10'];
       if (lastRowId) args.push('--since-rowid', String(lastRowId));
-      const result = execSync(`"${imsgPath}" ${args.join(' ')} 2>/dev/null`, {
+      const result = execFileSync(imsgPath, args, {
         encoding: 'utf-8', timeout: 10000, stdio: 'pipe',
       });
       const lines = result.trim().split('\n').filter(Boolean);
@@ -1519,6 +1594,13 @@ function startImessagePollingFallback(imsgPath, config) {
   log('imessage', 'polling started (15s interval, history fallback)', 'green');
 }
 
+function sendImessage(imsgPath, target, text) {
+  return execFileSync(imsgPath, ['send', '--to', String(target), '--text', String(text)], {
+    timeout: 15000,
+    stdio: 'pipe',
+  });
+}
+
 function findImsgBin() {
   const config = require('../utils/config').getConfig();
   if (config.imessageCliPath && fs.existsSync(config.imessageCliPath)) return config.imessageCliPath;
@@ -1601,9 +1683,7 @@ async function processImessageMessage(msg, config) {
     }
 
     if (reply) {
-      execSync(`${global.imessageProvider.imsgPath} send --to "${sender}" --text "${reply.replace(/"/g, '\\"')}" 2>/dev/null`, {
-        timeout: 15000, stdio: 'pipe',
-      });
+      sendImessage(global.imessageProvider.imsgPath, sender, reply);
       log('imessage', `Reply sent to ${sender} (${reply.length} chars)`, 'green');
 
       // v5.6.40: Track outgoing message for loop prevention
@@ -1805,7 +1885,7 @@ function startHttpServer() {
   const server = http.createServer(async (req, res) => {
     // CORS headers
     res.setHeader('Access-Control-Allow-Origin', '*');
-    res.setHeader('Access-Control-Allow-Methods', 'POST, OPTIONS');
+    res.setHeader('Access-Control-Allow-Methods', 'GET, POST, OPTIONS');
     res.setHeader('Access-Control-Allow-Headers', 'Content-Type');
     
     if (req.method === 'OPTIONS') {
@@ -1813,6 +1893,14 @@ function startHttpServer() {
       res.end();
       return;
     }
+
+    if (req.method === 'GET' && (req.url === '/health' || req.url === '/metrics')) {
+      const { getConfig } = require('../utils/config');
+      const snapshot = await buildGatewayHealth(getConfig(), gatewayDeliveryManager);
+      res.writeHead(snapshot.status === 'healthy' ? 200 : 503, { 'Content-Type': 'application/json', 'Cache-Control': 'no-store' });
+      res.end(JSON.stringify(req.url === '/health' ? snapshot : snapshot.delivery));
+      return;
+    }
     
     if (req.method === 'POST' && req.url === '/webhooks/sms') {
       // Twilio SMS webhook handler
@@ -1857,6 +1945,23 @@ function startHttpServer() {
             res.end(JSON.stringify({ error: 'Missing required fields: channel, target, message' }));
             return;
           }
+
+          const cfg = require('../utils/config').getConfig();
+          registerGatewayDeliveryAdapters(cfg, gatewayDeliveryManager);
+          if (gatewayDeliveryManager.adapters.has(channel)) {
+            const queued = gatewayDeliveryManager.enqueue(channel, target, { message }, { idempotencyKey: req.headers['idempotency-key'] });
+            if (queued.duplicate) {
+              res.writeHead(200, { 'Content-Type': 'application/json' });
+              res.end(JSON.stringify({ success: true, duplicate: true, deliveryId: queued.id }));
+              return;
+            }
+            const [delivery] = await gatewayDeliveryManager.drain();
+            res.writeHead(delivery.ok ? 200 : 503, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify(delivery.ok
+              ? { success: true, channel, target, deliveryId: delivery.id, attempts: delivery.attempts }
+              : { success: false, channel, target, deliveryId: delivery.id, error: delivery.error }));
+            return;
+          }
           
           if (channel === 'whatsapp') {
             if (!global.whatsappSock) {
@@ -1938,9 +2043,7 @@ function startHttpServer() {
               return;
             }
             try {
-              execSync(`${global.imessageProvider.imsgPath} send --to "${target.replace(/"/g, '\\"')}" --text "${message.replace(/"/g, '\\"')}" 2>/dev/null`, {
-                timeout: 15000, stdio: 'pipe',
-              });
+              sendImessage(global.imessageProvider.imsgPath, target, message);
               log('http', `iMessage sent to ${target}`, 'green');
               res.writeHead(200, { 'Content-Type': 'application/json' });
               res.end(JSON.stringify({ success: true, channel: 'imessage', target }));
@@ -2133,9 +2236,7 @@ function startCronJobs(config) {
                 log('cron', 'iMessage not connected, skipping', 'red');
                 return;
               }
-              execSync(`${global.imessageProvider.imsgPath} send --to "${cronJob.target.replace(/"/g, '\\"')}" --text "${reply.replace(/"/g, '\\"')}" 2>/dev/null`, {
-                timeout: 15000, stdio: 'pipe',
-              });
+              sendImessage(global.imessageProvider.imsgPath, cronJob.target, reply);
               log('cron', `Sent to iMessage: ${cronJob.target}`, 'green');
             } else if (cronJob.action === 'sms') {
               if (!global.smsProvider) {
@@ -2267,3 +2368,6 @@ if (require.main === module || process.argv.includes('--gateway-worker')) {
 module.exports = gatewayServer;
 // v5.43: test için — kanal gönderen doğrulaması + hafıza izolasyonu (Madde 7)
 module.exports.channelGate = channelGate;
+module.exports.buildGatewayHealth = buildGatewayHealth;
+module.exports.gatewayDeliveryManager = gatewayDeliveryManager;
+module.exports.registerGatewayDeliveryAdapters = registerGatewayDeliveryAdapters;

package/src/commands/git.js

@@ -1,4 +1,4 @@
-const { execSync } = require('child_process');
+const { execSync, execFileSync } = require('child_process');
 const inquirer = require('../utils/inquirer-wrapper');
 const chalk = require('chalk');
 const { getApiKey } = require('../utils/config');
@@ -111,7 +111,7 @@ async function gitCommit() {
     
     if (answer.confirm) {
       try {
-        execSync(`git commit -m "${commitMessage.replace(/"/g, '\\"')}"`, { stdio: 'inherit' });
+        execFileSync('git', ['commit', '-m', commitMessage], { stdio: 'inherit' });
         console.log(chalk.green('\n✅ Committed successfully\n'));
       } catch (err) {
         console.log(chalk.red('\n❌ Commit failed\n'));

package/src/commands/pairing.js

@@ -1,25 +1,5 @@
 const chalk = require('chalk');
-const fs = require('fs');
-const path = require('path');
-const os = require('os');
-
-const PAIRINGS_FILE = path.join(os.homedir(), '.natureco', 'pairings.json');
-
-function loadPairings() {
-  if (!fs.existsSync(PAIRINGS_FILE)) return [];
-  try { return JSON.parse(fs.readFileSync(PAIRINGS_FILE, 'utf8')); }
-  catch { return []; }
-}
-
-function savePairings(pairings) {
-  const dir = path.dirname(PAIRINGS_FILE);
-  if (!fs.existsSync(dir)) fs.mkdirSync(dir, { recursive: true });
-  fs.writeFileSync(PAIRINGS_FILE, JSON.stringify(pairings, null, 2), 'utf8');
-}
-
-function genId() {
-  return Date.now().toString(36) + Math.random().toString(36).slice(2, 8).toUpperCase();
-}
+const { loadPairings, savePairings, genCode } = require('../utils/pairing-store');
 
 function pairing(args) {
   const [action, ...params] = args || [];
@@ -84,7 +64,7 @@ function cmdReject(id) {
 }
 
 function cmdGenerate() {
-  const code = genId();
+  const code = genCode();
   const pairings = loadPairings();
 
   const entry = {

package/src/commands/repl.js

@@ -56,7 +56,7 @@ const { createPasteSafeInput, createOutputFilter, enableBracketedPaste, disableB
 const { getMemoryStore } = require('../utils/memory-store');
 const { buildSkillIndex } = require('../utils/skill-index');
 const { buildTiers, assemble, discoverProjectRules } = require('../utils/system-prompt');
-const { ToolGuardrails } = require('../utils/tool-guardrails');
+const { AgentCore } = require('../utils/agent-core');
 
 // v5.4.6: Model adi sizintisini engelle — global'e ata, callback'lerden erisebilir olsun
 const MODEL_NAMES_TO_HIDE = ['MiniMax-M2.5', 'MiniMaxM2.5', 'minimaxm25', 'Claude-3', 'GPT-4', 'ChatGPT'];
@@ -128,7 +128,8 @@ function rebuildSystemPrompt(opts) {
 }
 
 // ── Tool Guardrails instance (Hermes-style) ─────────────────────────────
-const guardrails = new ToolGuardrails();
+const agentCore = new AgentCore({ maxIterations: 10 });
+const guardrails = agentCore.guardrails;
 
 // CLI komutları (REPL içinden çalıştırılabilir)
 const CLI_COMMANDS = {
@@ -835,8 +836,9 @@ async function processToolCalls(toolCalls, onToolCall, onAsk) {
   const results = [];
 
   // Parse all tool calls first
-  const parsed = toolCalls.map(tc => {
-    const name = tc.function?.name || tc.name;
+  const parsed = agentCore.parseToolCalls(toolCalls).map(call => {
+    const tc = call.original;
+    const name = tc.function?.name || tc.name;
     const argsStr = tc.function?.arguments || tc.args || '{}';
     const id = tc.id || `call_${Date.now()}_${Math.random().toString(36).slice(2, 6)}`;
     let args;
@@ -845,11 +847,11 @@ async function processToolCalls(toolCalls, onToolCall, onAsk) {
     } catch (e) {
       args = { _parse_error: e.message, _raw: argsStr };
     }
-    return { name, args, id };
+    return { name, args, id, parseError: call.parseError };
   });
 
   // Filter out blocked tools via guardrails
-  guardrails.startIteration();
+  agentCore.startIteration();
   const blocked = parsed.filter(p => {
     const check = guardrails.check(p.name, p.args);
     if (check.blocked) {