pi-crew 0.9.16 → 0.9.17

package/src/adapters/export-util.ts

@@ -1,10 +1,10 @@
 import type { AgentConfig } from "../agents/agent-config.ts";
+import type { SkillDescriptor } from "../skills/discover-skills.ts";
 import type { TeamConfig } from "../teams/team-config.ts";
+import { resolveContainedPath } from "../utils/safe-paths.ts";
 import type { WorkflowConfig } from "../workflows/workflow-config.ts";
-import type { SkillDescriptor } from "../skills/discover-skills.ts";
-import type { ExportContent } from "./types.ts";
 import { adapterRegistry } from "./registry.ts";
-import { resolveContainedPath } from "../utils/safe-paths.ts";
+import type { ExportContent } from "./types.ts";
 
 function slugify(value: string): string {
 	return value
@@ -30,9 +30,7 @@ export function agentToExportContent(agent: AgentConfig): ExportContent {
 export function teamToExportContent(team: TeamConfig): ExportContent {
 	const category = team.routing?.category ?? "team";
 	const tags = team.routing?.triggers ?? [];
-	const rolesDesc = team.roles
-		.map((role) => `- **${role.name}**: ${role.description ?? role.agent}`)
-		.join("\n");
+	const rolesDesc = team.roles.map((role) => `- **${role.name}**: ${role.description ?? role.agent}`).join("\n");
 	const body = `${team.description}\n\n### Roles\n${rolesDesc}`;
 	return {
 		id: slugify(team.name),
@@ -46,9 +44,7 @@ export function teamToExportContent(team: TeamConfig): ExportContent {
 }
 
 export function workflowToExportContent(workflow: WorkflowConfig): ExportContent {
-	const stepsDesc = workflow.steps
-		.map((step) => `- **${step.id}** (${step.role}): ${step.task}`)
-		.join("\n");
+	const stepsDesc = workflow.steps.map((step) => `- **${step.id}** (${step.role}): ${step.task}`).join("\n");
 	const body = `${workflow.description}\n\n### Steps\n${stepsDesc}`;
 	return {
 		id: slugify(workflow.name),
@@ -105,14 +101,15 @@ export interface ToolExportResult {
 	files: Array<{ path: string; content: string }>;
 }
 
-export function generateToolExport(
-	toolId: string,
-	resources: ExportableResource[],
-	projectRoot?: string,
-): ToolExportResult {
+export function generateToolExport(toolId: string, resources: ExportableResource[], projectRoot?: string): ToolExportResult {
 	const adapter = adapterRegistry.get(toolId);
 	if (!adapter) {
-		throw new Error(`Unknown export adapter: ${toolId}. Available: ${adapterRegistry.getAll().map((a) => a.toolId).join(", ")}`);
+		throw new Error(
+			`Unknown export adapter: ${toolId}. Available: ${adapterRegistry
+				.getAll()
+				.map((a) => a.toolId)
+				.join(", ")}`,
+		);
 	}
 	const contents = resourcesToExportContent(resources);
 	const files = contents.map((content): { path: string; content: string } => {
@@ -138,6 +135,9 @@ export function generateToolExport(
 		const existing = merged.get(f.path);
 		merged.set(f.path, existing ? `${existing}\n\n${f.content}` : f.content);
 	}
-	const mergedFiles = [...merged.entries()].map(([p, content]) => ({ path: p, content }));
+	const mergedFiles = [...merged.entries()].map(([p, content]) => ({
+		path: p,
+		content,
+	}));
 	return { toolId, files: mergedFiles };
 }

package/src/adapters/index.ts

@@ -1,14 +1,14 @@
-export type { ExportContent, ExportAdapter, AdapterRegistry } from "./types.ts";
-export { createAdapterRegistry, adapterRegistry } from "./registry.ts";
 export { claudeAdapter } from "./claude-adapter.ts";
-export { cursorAdapter } from "./cursor-adapter.ts";
 export { codexAdapter } from "./codex-adapter.ts";
+export { cursorAdapter } from "./cursor-adapter.ts";
 export { generateToolExport, resourcesToExportContent } from "./export-util.ts";
+export { adapterRegistry, createAdapterRegistry } from "./registry.ts";
+export type { AdapterRegistry, ExportAdapter, ExportContent } from "./types.ts";
 
-import { adapterRegistry } from "./registry.ts";
 import { claudeAdapter } from "./claude-adapter.ts";
-import { cursorAdapter } from "./cursor-adapter.ts";
 import { codexAdapter } from "./codex-adapter.ts";
+import { cursorAdapter } from "./cursor-adapter.ts";
+import { adapterRegistry } from "./registry.ts";
 
 adapterRegistry.register(claudeAdapter);
 adapterRegistry.register(cursorAdapter);

package/src/agents/agent-config.ts

@@ -9,15 +9,7 @@ import { getToolConfig } from "../config/role-tools.ts";
  * the wildcard expansion will pick it up. The 7 names below are stable
  * across pi v0.77+ and cover read, edit, write, bash, grep, find, ls.
  */
-export const BUILTIN_TOOL_NAMES: readonly string[] = [
-	"read",
-	"edit",
-	"write",
-	"bash",
-	"grep",
-	"find",
-	"ls",
-];
+export const BUILTIN_TOOL_NAMES: readonly string[] = ["read", "edit", "write", "bash", "grep", "find", "ls"];
 
 /**
  * F1 (v0.7.9): normalize the raw `tools:` frontmatter CSV into a `string[]`.
@@ -41,7 +33,10 @@ export function parseToolsField(raw: unknown): string[] | undefined {
 	const lowered = s.toLowerCase();
 	if (lowered === "none" || lowered === "[]") return [];
 	if (lowered === "*" || lowered === "all") return [...BUILTIN_TOOL_NAMES];
-	const items = s.split(",").map((t) => t.trim()).filter(Boolean);
+	const items = s
+		.split(",")
+		.map((t) => t.trim())
+		.filter(Boolean);
 	return items;
 }
 
@@ -160,12 +155,23 @@ function uniqueToolMerge(...lists: Array<string[] | undefined>): string[] | unde
 export function resolveToolPolicy(agent: AgentConfig, role?: string): ResolvedToolPolicy {
 	const roleConfig = role ? getToolConfig(role) : {};
 	// allowlist: source-aware precedence (see doc above).
-	const explicitTools = agent.source === "builtin"
-		? (roleConfig.tools ?? agent.tools)
-		: (agent.tools ?? roleConfig.tools);
+	const explicitTools = agent.source === "builtin" ? (roleConfig.tools ?? agent.tools) : (agent.tools ?? roleConfig.tools);
+	// L5: when the agent opts into `loadMode: "lean"` AND provides a
+	// non-empty `defaultTools` list, merge that list into the resolved
+	// allowlist. The merge is additive (union, dedup, order-preserving) so
+	// the existing source-aware precedence is preserved and a lean agent
+	// gets a focused-but-non-empty tool set. Signal flow:
+	//   agent YAML frontmatter (loadMode, defaultTools)
+	//     → parsed into AgentConfig
+	//     → resolveToolPolicy(agent, role) here
+	//     → policy.tools returned to buildPiWorkerArgs
+	//     → `args.push("--tools", policy.tools.join(","))` in pi-args.ts
+	//     → child pi process sees the merged allowlist
+	const tools =
+		agent.loadMode === "lean" && agent.defaultTools?.length ? uniqueToolMerge(explicitTools, agent.defaultTools) : explicitTools;
 	// denylist: additive merge of role excludeTools + agent disallowedTools.
 	const excludeTools = uniqueToolMerge(roleConfig.excludeTools, agent.disallowedTools);
-	return { tools: explicitTools, excludeTools };
+	return { tools, excludeTools };
 }
 
 /**

package/src/agents/agent-serializer.ts

@@ -15,7 +15,7 @@ export function serializeAgent(agent: AgentConfig): string {
 		line("fallbackModels", agent.fallbackModels),
 		line("thinking", agent.thinking),
 		line("tools", agent.tools),
-		agent.extensions !== undefined ? line("extensions", agent.extensions) ?? "extensions:" : undefined,
+		agent.extensions !== undefined ? (line("extensions", agent.extensions) ?? "extensions:") : undefined,
 		line("skills", agent.skills),
 		line("systemPromptMode", agent.systemPromptMode),
 		line("inheritProjectContext", agent.inheritProjectContext),

package/src/agents/discover-agents.ts

@@ -1,11 +1,11 @@
 import * as fs from "node:fs";
 import * as path from "node:path";
-import type { AgentConfig, ResourceSource } from "./agent-config.ts";
-import { parseToolsField } from "./agent-config.ts";
-import { loadConfig, type LoadedPiTeamsConfig } from "../config/config.ts";
+import { type LoadedPiTeamsConfig, loadConfig } from "../config/config.ts";
 import { parseCsv, parseFrontmatter } from "../utils/frontmatter.ts";
 import { logInternalError } from "../utils/internal-error.ts";
-import { packageRoot, projectCrewRoot, userPiRoot, findRepoRoot } from "../utils/paths.ts";
+import { findRepoRoot, packageRoot, projectCrewRoot, userPiRoot } from "../utils/paths.ts";
+import type { AgentConfig, ResourceSource } from "./agent-config.ts";
+import { parseToolsField } from "./agent-config.ts";
 
 // ═══════════════════════════════════════════════════════════════════════════
 // SEC-001 Fix: Protected Agent Names Blocklist
@@ -21,7 +21,6 @@ import { packageRoot, projectCrewRoot, userPiRoot, findRepoRoot } from "../utils
 // See: SECURITY-ISSUES.md SEC-005
 // ═══════════════════════════════════════════════════════════════════════════
 
-
 /** Version counter for atomic cache invalidation. Incremented on every mutation. */
 let cacheVersion = 0;
 
@@ -69,14 +68,23 @@ const PROTECTED_AGENT_PATTERNS: Array<{ pattern: RegExp; example: string }> = [
 	{ pattern: /^explorer[-_]/i, example: "explorer-debug" },
 	{ pattern: /^planner[-_]/i, example: "planner-v3" },
 	// Generic prefixes that could impersonate builtins
-	{ pattern: /^(my|custom|new|local)[-_](executor|test[-_]?engineer|explorer|planner)$/i, example: "my-executor" },
-	{ pattern: /^(executor|test[-_]?engineer|explorer|planner)[-_]?(proxy|hook|override)$/i, example: "executor-override" },
+	{
+		pattern: /^(my|custom|new|local)[-_](executor|test[-_]?engineer|explorer|planner)$/i,
+		example: "my-executor",
+	},
+	{
+		pattern: /^(executor|test[-_]?engineer|explorer|planner)[-_]?(proxy|hook|override)$/i,
+		example: "executor-override",
+	},
 	// Common typosquatting patterns (intentional misspellings)
 	{ pattern: /^exec[au]t[o0]r$/i, example: "execator" },
 	{ pattern: /^expl[o0]rer$/i, example: "explorer" },
 	{ pattern: /^plann[ae]r$/i, example: "plannar" },
 	// Suffixes that indicate override意图
-	{ pattern: /^(executor|test[-_]?engineer|explorer|planner)[-_]?(override|replacement|shadow)$/i, example: "executor-override" },
+	{
+		pattern: /^(executor|test[-_]?engineer|explorer|planner)[-_]?(override|replacement|shadow)$/i,
+		example: "executor-override",
+	},
 ];
 
 /**
@@ -123,11 +131,7 @@ function logSecurityEvent(event: SecurityEvent): void {
 	}
 
 	// Log security events via structured logger
-	logInternalError(
-		`security.${event.type}`,
-		undefined,
-		`agent="${event.name}" reason="${event.reason}"`,
-	);
+	logInternalError(`security.${event.type}`, undefined, `agent="${event.name}" reason="${event.reason}"`);
 }
 
 /**
@@ -167,7 +171,7 @@ function assertAgentNameAllowed(name: string): void {
 		});
 		throw new Error(
 			`SECURITY: Cannot register agent '${name}': protected builtin name. ` +
-			`Dynamic agents cannot shadow builtin agents (executor, explorer, planner, etc.) to prevent privilege escalation.`
+				`Dynamic agents cannot shadow builtin agents (executor, explorer, planner, etc.) to prevent privilege escalation.`,
 		);
 	}
 
@@ -182,7 +186,7 @@ function assertAgentNameAllowed(name: string): void {
 		});
 		throw new Error(
 			`SECURITY: Cannot register agent '${name}': name matches protected pattern (${matchedPattern}). ` +
-			`This pattern is blocked to prevent privilege escalation via similar-named agents.`
+				`This pattern is blocked to prevent privilege escalation via similar-named agents.`,
 		);
 	}
 }
@@ -284,7 +288,7 @@ function sourceToTrustLevel(source: ResourceSource): TrustLevel {
 		case "user":
 			return "user";
 		case "project":
-		return "project";
+			return "project";
 		default:
 			return "project";
 	}
@@ -305,10 +309,7 @@ function sourceToTrustLevel(source: ResourceSource): TrustLevel {
  * - user: Standard sanitization
  * - project: Strict sanitization (untrusted source)
  */
-export function sanitizeAgentSystemPrompt(
-	content: string,
-	source: ResourceSource
-): string {
+export function sanitizeAgentSystemPrompt(content: string, source: ResourceSource): string {
 	const trustLevel = sourceToTrustLevel(source);
 	let sanitized = content;
 
@@ -323,7 +324,7 @@ export function sanitizeAgentSystemPrompt(
 		// Strip lines that look like system directives
 		sanitized = sanitized.replace(
 			/^\s*(?:SYSTEM|INSTRUCTION|IGNORE(?:\s+ALL)?\s+(?:PREVIOUS|INSTRUCTIONS)?|OVERRIDE|YOUR\s+ROLE\s+IS|MALICIOUS|BACKDOOR)\s*:.*$/gim,
-			""
+			"",
 		);
 
 		// Strip embedded instruction patterns in brackets
@@ -357,6 +358,17 @@ export function sanitizeAgentSystemPrompt(
 	return sanitized.trim();
 }
 
+/**
+ * M4: per-process dedup set of agent filePaths for which we've already
+ * emitted the `contextMode: fork` warn-only notice. Avoids spam when
+ * the discovery cache reloads or the same agent is parsed multiple
+ * times in a session. Exported for test reset.
+ */
+const warnedForkAgents = new Set<string>();
+export function __test_resetForkWarnings(): void {
+	warnedForkAgents.clear();
+}
+
 function parseAgentFile(filePath: string, source: ResourceSource): AgentConfig | undefined {
 	try {
 		const content = fs.readFileSync(filePath, "utf-8");
@@ -373,6 +385,27 @@ function parseAgentFile(filePath: string, source: ResourceSource): AgentConfig |
 		const rawSystemPrompt = body.trim();
 		const systemPrompt = sanitizeAgentSystemPrompt(rawSystemPrompt, source);
 
+		const contextMode = parseContextMode(frontmatter.contextMode);
+
+		// M4: warn-only when contextMode=fork is configured but the
+		// runtime is the default child-process path. `contextMode: fork`
+		// is only effective in the live-session runtime (the experimental
+		// path that runs the agent IN the parent pi's session). The
+		// default child-process path (runChildPi in src/runtime/child-pi.ts)
+		// spawns a NEW pi process and has no parent session to inherit,
+		// so the agent will behave as `fresh` regardless of the setting.
+		// We warn (not throw) so existing configs that predate live-session
+		// keep working. Deduped per-filePath so we don't spam on cache
+		// reload. Use console.warn (no logger hook here yet; a future
+		// refactor could pipe through the same log channel as
+		// logInternalError below).
+		if (contextMode === "fork" && !warnedForkAgents.has(filePath)) {
+			console.warn(
+				"contextMode: 'fork' is only effective in live-session runtime; current default child-process will behave as 'fresh'. See docs/runtime-modes.md.",
+			);
+			warnedForkAgents.add(filePath);
+		}
+
 		return {
 			name,
 			description,
@@ -389,15 +422,21 @@ function parseAgentFile(filePath: string, source: ResourceSource): AgentConfig |
 			skills: parseCsv(frontmatter.skills ?? frontmatter.skill),
 			systemPromptMode: frontmatter.systemPromptMode === "append" ? "append" : "replace",
 			inheritProjectContext: frontmatter.inheritProjectContext === "true",
-		inheritSkills: frontmatter.inheritSkills === "true",
-		memory: parseMemory(frontmatter.memory),
-		loadMode: parseLoadMode(frontmatter.loadMode),
-		defaultTools: frontmatter.defaultTools !== undefined ? parseCsv(frontmatter.defaultTools) ?? null : undefined,
-		contextMode: parseContextMode(frontmatter.contextMode),
-		maxTurns: (() => { const n = Number.parseInt(frontmatter.maxTurns, 10); return Number.isFinite(n) && n > 0 ? n : undefined; })(),
-		effort: frontmatter.effort === "low" || frontmatter.effort === "medium" || frontmatter.effort === "high" ? frontmatter.effort : undefined,
-		disabled: frontmatter.disabled === "true" || frontmatter.enabled === "false",
-		routing: triggers || useWhen || avoidWhen || cost || category ? { triggers, useWhen, avoidWhen, cost, category } : undefined,
+			inheritSkills: frontmatter.inheritSkills === "true",
+			memory: parseMemory(frontmatter.memory),
+			loadMode: parseLoadMode(frontmatter.loadMode),
+			defaultTools: frontmatter.defaultTools !== undefined ? (parseCsv(frontmatter.defaultTools) ?? null) : undefined,
+			contextMode,
+			maxTurns: (() => {
+				const n = Number.parseInt(frontmatter.maxTurns, 10);
+				return Number.isFinite(n) && n > 0 ? n : undefined;
+			})(),
+			effort:
+				frontmatter.effort === "low" || frontmatter.effort === "medium" || frontmatter.effort === "high"
+					? frontmatter.effort
+					: undefined,
+			disabled: frontmatter.disabled === "true" || frontmatter.enabled === "false",
+			routing: triggers || useWhen || avoidWhen || cost || category ? { triggers, useWhen, avoidWhen, cost, category } : undefined,
 		};
 	} catch (error) {
 		logInternalError("discoverAgents.parseAgentFile", error, `filePath=${filePath}`);
@@ -407,7 +446,8 @@ function parseAgentFile(filePath: string, source: ResourceSource): AgentConfig |
 
 function readAgentDir(dir: string, source: ResourceSource): AgentConfig[] {
 	if (!fs.existsSync(dir)) return [];
-	const agents = fs.readdirSync(dir)
+	const agents = fs
+		.readdirSync(dir)
 		.filter((entry) => entry.endsWith(".md") && !entry.endsWith(".team.md") && !entry.endsWith(".workflow.md"))
 		.map((entry) => parseAgentFile(path.join(dir, entry), source))
 		.filter((agent): agent is AgentConfig => agent !== undefined)
@@ -436,11 +476,11 @@ function applyAgentOverrides(agents: AgentConfig[], cwd: string, loadedConfig?:
 			return {
 				...agent,
 				disabled: override.disabled ?? agent.disabled,
-				model: override.model === false ? undefined : override.model ?? agent.model,
-				fallbackModels: override.fallbackModels === false ? undefined : override.fallbackModels ?? agent.fallbackModels,
-				thinking: override.thinking === false ? undefined : override.thinking ?? agent.thinking,
-				tools: override.tools === false ? undefined : override.tools ?? agent.tools,
-				skills: override.skills === false ? undefined : override.skills ?? agent.skills,
+				model: override.model === false ? undefined : (override.model ?? agent.model),
+				fallbackModels: override.fallbackModels === false ? undefined : (override.fallbackModels ?? agent.fallbackModels),
+				thinking: override.thinking === false ? undefined : (override.thinking ?? agent.thinking),
+				tools: override.tools === false ? undefined : (override.tools ?? agent.tools),
+				skills: override.skills === false ? undefined : (override.skills ?? agent.skills),
 				override: { source: "config", path: loaded.path },
 			};
 		});
@@ -454,7 +494,7 @@ const DISCOVERY_CACHE_TTL_MS = 500;
 interface CachedDiscoveryEntry {
 	result: AgentDiscoveryResult;
 	expiresAt: number;
-	cacheVersion: number;  // SEC-005: Version stamp for atomic invalidation
+	cacheVersion: number; // SEC-005: Version stamp for atomic invalidation
 }
 const discoveryCache = new Map<string, CachedDiscoveryEntry>();
 const DISCOVERY_CACHE_MAX_ENTRIES = 32;
@@ -500,7 +540,11 @@ export function discoverAgents(cwd: string): AgentDiscoveryResult {
 		projectPi: applyAgentOverrides(readAgentDir(path.join(findRepoRoot(cwd) ?? cwd, ".pi", "agents"), "project-pi"), cwd, loaded),
 	};
 	// SEC-005: Store with current version stamp
-	discoveryCache.set(cwd, { result, expiresAt: Date.now() + DISCOVERY_CACHE_TTL_MS, cacheVersion: currentVersion });
+	discoveryCache.set(cwd, {
+		result,
+		expiresAt: Date.now() + DISCOVERY_CACHE_TTL_MS,
+		cacheVersion: currentVersion,
+	});
 	while (discoveryCache.size > DISCOVERY_CACHE_MAX_ENTRIES) {
 		const oldest = discoveryCache.keys().next().value;
 		if (oldest !== undefined) discoveryCache.delete(oldest);
@@ -522,7 +566,7 @@ export function registerDynamicAgent(config: AgentConfig): void {
 	if (dynamicAgents.has(key)) {
 		throw new Error(`Agent already registered: ${config.name}`);
 	}
-	dynamicAgents.set(key, { ...config, source: "dynamic" });  // Always "dynamic" — cannot be spoofed
+	dynamicAgents.set(key, { ...config, source: "dynamic" }); // Always "dynamic" — cannot be spoofed
 	invalidateAgentDiscoveryCache();
 }
 

package/src/benchmark/benchmark-runner.ts

@@ -41,42 +41,42 @@ export interface BenchmarkResult {
  * Uses comprehensive shell metacharacter blocking similar to safe-bash.ts.
  */
 function validateCommand(command: string): void {
-  // Basic allowlist - must start with an allowed command.
-  // SECURITY (H-7): `npx`/`node` were removed because they enable arbitrary code
-  // execution without any shell metacharacter (e.g. `npx --yes evil-package`
-  // or `node -e "require('fs')…"`). Use `npm test`/`npm run …` instead of raw
-  // `node`/`npx` in benchmark task definitions.
-  // `echo` is allowed because the metachar blocker (validateGateCommand) rejects
-  // command substitution (`$(...)`, backticks), so `echo $(evil)` cannot run;
-  // bare `echo …` only prints. It's the canonical exit-0 command used in
-  // benchmark fixtures across Linux/macOS/Windows(sh).
-  const allowlist = /^(pytest|grep|npm test|cargo test|cargo clippy|echo) /;
-  if (!allowlist.test(command)) {
-    throw new Error(`Command not allowed: ${command}. Only pytest, grep, npm test, cargo test/clippy, echo allowed.`);
-  }
-  
-  // Block shell metacharacters after command name
-  const afterCommand = command.substring(command.indexOf(" ") + 1);
-  
-  // Block dangerous shell metacharacters
-  const dangerousPatterns = [
-    /[;&|`$(){}[\]<>\\]/,                    // Shell metacharacters
-    /\$\([^)]*\)/,                            // Command substitution $(...)
-    /`[^`]*`/,                                // Backtick command substitution
-    /\|/,                                     // Pipe
-    /&&/,                                     // And
-    /\|\|/,                                   // Or
-    />>/,                                     // Append redirect
-    /2>&1/,                                   // stderr redirect
-    />/,                                      // Output redirect
-    /</,                                      // Input redirect
-  ];
-  
-  for (const pattern of dangerousPatterns) {
-    if (pattern.test(afterCommand)) {
-      throw new Error(`Shell metacharacters not allowed in command arguments`);
-    }
-  }
+	// Basic allowlist - must start with an allowed command.
+	// SECURITY (H-7): `npx`/`node` were removed because they enable arbitrary code
+	// execution without any shell metacharacter (e.g. `npx --yes evil-package`
+	// or `node -e "require('fs')…"`). Use `npm test`/`npm run …` instead of raw
+	// `node`/`npx` in benchmark task definitions.
+	// `echo` is allowed because the metachar blocker (validateGateCommand) rejects
+	// command substitution (`$(...)`, backticks), so `echo $(evil)` cannot run;
+	// bare `echo …` only prints. It's the canonical exit-0 command used in
+	// benchmark fixtures across Linux/macOS/Windows(sh).
+	const allowlist = /^(pytest|grep|npm test|cargo test|cargo clippy|echo) /;
+	if (!allowlist.test(command)) {
+		throw new Error(`Command not allowed: ${command}. Only pytest, grep, npm test, cargo test/clippy, echo allowed.`);
+	}
+
+	// Block shell metacharacters after command name
+	const afterCommand = command.substring(command.indexOf(" ") + 1);
+
+	// Block dangerous shell metacharacters
+	const dangerousPatterns = [
+		/[;&|`$(){}[\]<>\\]/, // Shell metacharacters
+		/\$\([^)]*\)/, // Command substitution $(...)
+		/`[^`]*`/, // Backtick command substitution
+		/\|/, // Pipe
+		/&&/, // And
+		/\|\|/, // Or
+		/>>/, // Append redirect
+		/2>&1/, // stderr redirect
+		/>/, // Output redirect
+		/</, // Input redirect
+	];
+
+	for (const pattern of dangerousPatterns) {
+		if (pattern.test(afterCommand)) {
+			throw new Error(`Shell metacharacters not allowed in command arguments`);
+		}
+	}
 }
 
 /**
@@ -143,10 +143,18 @@ export async function runBenchmark(task: BenchmarkTask): Promise<BenchmarkResult
 				passed = true; // Command succeeded = pass
 			}
 
-			judgeResults.push({ description: judge.description, passed: passed ?? false, output });
+			judgeResults.push({
+				description: judge.description,
+				passed: passed ?? false,
+				output,
+			});
 		} catch (e: unknown) {
 			const error = e as { message?: string };
-			judgeResults.push({ description: judge.description, passed: false, output: error.message ?? String(e) });
+			judgeResults.push({
+				description: judge.description,
+				passed: false,
+				output: error.message ?? String(e),
+			});
 		}
 	}
 
@@ -200,9 +208,7 @@ export async function runBenchmarkSuite(
 	totalDurationMs: number;
 	totalCost: number;
 }> {
-	const filtered = taskTypes
-		? tasks.filter((t) => t.taskType && taskTypes.includes(t.taskType))
-		: tasks;
+	const filtered = taskTypes ? tasks.filter((t) => t.taskType && taskTypes.includes(t.taskType)) : tasks;
 
 	const results: BenchmarkResult[] = [];
 
@@ -241,8 +247,7 @@ export function aggregateBenchmarkMetrics(results: BenchmarkResult[]): Aggregate
 		const totalTasks = group.length;
 		const passedTasks = group.filter((r) => r.passed).length;
 		const passRate = totalTasks > 0 ? passedTasks / totalTasks : 0;
-		const avgTimeMs =
-			totalTasks > 0 ? group.reduce((s, r) => s + r.durationMs, 0) / totalTasks : 0;
+		const avgTimeMs = totalTasks > 0 ? group.reduce((s, r) => s + r.durationMs, 0) / totalTasks : 0;
 		const totalCost = group.reduce((s, r) => s + r.cost, 0);
 		const avgCost = totalTasks > 0 ? totalCost / totalTasks : 0;
 
@@ -266,10 +271,7 @@ export function aggregateBenchmarkMetrics(results: BenchmarkResult[]): Aggregate
  * @param results - Benchmark results to report.
  * @param includeTaskTypeComparison - When true (default), appends a per-task-type aggregate table.
  */
-export function generateBenchmarkReport(
-	results: BenchmarkResult[],
-	includeTaskTypeComparison = true,
-): string {
+export function generateBenchmarkReport(results: BenchmarkResult[], includeTaskTypeComparison = true): string {
 	const lines: string[] = ["# Benchmark Results", ""];
 
 	lines.push("| Task | Type | Status | Duration | Cost |");
@@ -298,9 +300,7 @@ export function generateBenchmarkReport(
 				const m = metrics[t];
 				const passRatePct = `${(m.passRate * 100).toFixed(1)}%`;
 				const avgCostStr = m.avgCost > 0 ? `$${m.avgCost.toFixed(4)}` : "—";
-				lines.push(
-					`| ${m.taskType} | ${m.totalTasks} | ${m.passedTasks} | ${passRatePct} | ${m.avgTimeMs}ms | ${avgCostStr} |`,
-				);
+				lines.push(`| ${m.taskType} | ${m.totalTasks} | ${m.passedTasks} | ${passRatePct} | ${m.avgTimeMs}ms | ${avgCostStr} |`);
 			}
 		}
 	}
@@ -310,4 +310,4 @@ export function generateBenchmarkReport(
 	lines.push(`**Total: ${passed}/${results.length} passed**`);
 
 	return lines.join("\n");
-}
+}

package/src/benchmark/feedback-loop.ts

@@ -70,4 +70,4 @@ class FeedbackLoop {
 	clear(): void {
 		this.runs = [];
 	}
-}
+}