pi-roundtable 0.7.15 → 0.7.16

package/CHANGELOG.md

@@ -5,6 +5,29 @@ The format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
 
 ## [Unreleased]
 
+## [0.7.16] - 2026-10-04
+
+### Added
+
+- `pi-roundtable/kit` owns a Jev compaction engine on pi-jev-compaction 1.0.0 (now a dependency, pinned exactly): `jevCompact(input, options)` and two adapters, `jevCompactionExtension({ logger })` for the `compaction` session tool (placed through `session.compaction.wrap`, engine `JEV_COMPACTION_ENGINE`, `pi-jev-compaction`) and `jevCompactor({ logger })` for pi-roundtable-sandbox's `compaction` option. Both log each fallback to Pi's summary with its reason and `tokensBefore`, except a missing API key, which they log once (`Jev is not configured, so compaction uses Pi's summary`) and then compact through Pi's summary quietly: the key is optional.
+  - Values: `jevCompact`, `jevCompactionExtension`, `jevCompactor`, `isRuleLoad`, `JEV_COMPACTION_ENGINE`, `JEV_GOAL`, `JEV_PREVIOUS_SUMMARY_LIMIT_TOKENS`; types: `JevCompactInput`, `JevCompactOptions`, `JevCompactOutcome`, `JevCompactor`, `JevCompactRequest`, `JevExtensionOptions`, `JevSkipReason`.
+  - Unlike pi-jev-compaction's own `compactPiSession`, a summary carries the previous summary once, not twice, so a chain of compactions no longer doubles (one session's grew from 8k to 303k characters over five compactions).
+  - A previous summary over 60,000 tokens (`previousSummaryLimitTokens`) skips Jev, so Pi's summary condenses the chain.
+  - Jev judges with a goal (`JEV_GOAL`, option `goal`) that keeps the tool results that set rules still in force, which it dropped without one, and the summary ends with the rule loads it summarized (skills, notebook system prompts, reads of SKILL.md, AGENTS.md and `.agents/skills/`; option `ruleLoad`, default `isRuleLoad`) for the agent to load again.
+
+### Changed
+
+- The shell hold rule lets more of the agents' own work run.
+  - The agents get a scratch dir, the config's new `scratchDir` (default `<os temp dir>/<discord.rootCommand>-scratch`, created with mode 0700 at startup; a symlink or another user's dir is refused), and their `bash` runs with `TMPDIR` pointing to it. Redirects, `tee`, and `write` and `edit` inside it run as inside the workspace; the rest of `/tmp` stays held. `AgentSessions.scratchDir` and `HoldContext.scratchDir` carry it, and the agents' prompt names it.
+  - `rm` is no longer always held: it runs when every operand resolves, after the line's literal variable assignments, `cd`, `..` and symlinks, inside the workspace or the scratch dir without being one of them. A command substitution, an unknown variable, a root itself, `/`, or no operand keeps it held.
+  - `git push` stays held by `shellHoldRule`; the new `shellHoldRuleFor({ ownPushOwners, heldPushRepos })` (type `PushPolicy`) lets a plain push to a GitHub repository of a listed owner run, unless it forces, deletes, pushes tags or a mirror, or the repository is in `heldPushRepos` or its remote cannot be read.
+  - A relative write target or `rm` operand resolves from the line's last `cd`, not always from the workspace.
+  - Value: `shellHoldRuleFor`; type: `PushPolicy`.
+
+### Fixed
+
+- pi-roundtable-coding frees a finished job's repository before delivering its report, so the turn that receives the report can ship it or start the next worker there instead of being refused with "still using".
+
 ## [0.7.15] - 2026-10-03
 
 ### Changed

package/docs/plugins.md

@@ -63,11 +63,19 @@ Use the kit's building blocks for a plugin that runs Pi itself, such as a coding
 - Work: `promptSlot` (how a run asks the owner while it works), `workTimeout` (a time limit that does not count the time spent waiting on the owner), `runWorkerTask`, `archiveSessions`, and `approvalCard` and `canonicalJson` for the cards of held actions.
 - Diagnostics: `scrubDiagnostic(text, max = 600)` masks credentials (URL userinfo, token shapes, secret-named assignments and JSON fields, `Authorization`/`Cookie`/`x-api-key` headers, JWTs, PEM blocks), turns control characters other than tab and newline into spaces, and cuts the result at `max` characters.
   It scans only the first `max * 4` characters (at least 4,096), in linear time, so pass it git, gh or provider error text before showing that text to a user.
-- Shell: `SHELL_TOOLS` and `shellHoldRule`, the hold rule that keeps risky host-shell commands behind the owner's approval.
+- Shell: `SHELL_TOOLS`, and `shellHoldRule` and `shellHoldRuleFor(policy)`, the hold rule that keeps risky host-shell commands behind the owner's approval; see [the shell rule](#the-shell-rule).
 - Tools: `textToolsExtension`, `requiredString`, `stringList` (with `toolText` and `toolError`) for tools that return text.
 - Mirroring a built-in tool in a worker that cannot reach the host: `SCHEDULE_TOOLS`, `scheduleToolSpecs({ locale, timeZone })`, `isScheduleTool`, `callScheduleTool`, `DELEGATE_TOOL` and `DELEGATE_TOOL_SPEC`.
   The specs take the locale and time zone for their descriptions, so the worker needs no process-wide setting.
 - Compaction: `CompactionTiers` gives a session the core's compaction tiers (`settings()` for Pi's `SettingsManager`, `wrapCompactor(factory, onBypass)` to hold a compaction extension back past the ceiling, `latest()`), with `SOFT_COMPACT_TOKENS` (300,000), `HARD_COMPACT_TOKENS` (500,000), `COMPACT_HEADROOM_TOKENS` (50,000), `compactionEngine(details, engine)` and the types `CompactionEngine`, `CompactionHistory` and `LatestCompaction`.
+- Jev compaction: `jevCompact(input, options)` compacts through Jev (pi-jev-compaction 1.0.0) and returns `{ compaction }` or `{ skipped, detail? }` (a `JevSkipReason`: pi-jev-compaction's fallbacks `no_key`, `aborted`, `nothing_to_compact`, `no_candidates`, `cannot_fit`, `jev_error`, `reduction_too_small`, or `previous_summary_too_large`), for Pi's own summary to run instead.
+  Its summary carries the previous summary once, as the transcript's `[previous compaction]` message, with `estimatedTokensAfter` measured on the final text; a previous summary over `previousSummaryLimitTokens` (default `JEV_PREVIOUS_SUMMARY_LIMIT_TOKENS`, 60,000) skips without calling Jev, so Pi's summary condenses the chain.
+  Jev judges with `goal` (default `JEV_GOAL`: keep the tool results that set rules still in force, drop stale lookups, listings and finished edits), and the summary ends with a `## Rules loaded before this compaction` section naming each rule load among the summarized messages (tool name and JSON arguments cut at 200 characters) for the agent to load again; `ruleLoad(tool, args)` picks them (default `isRuleLoad`: tools ending in `invoke-skill` or `get-system-prompt`, and tools ending in `read` whose `path` is a `SKILL.md`, an `AGENTS.md` or under `.agents/skills/`).
+  `config` passes pi-jev-compaction's settings (`apiKey`, `model`, thresholds) over its config file and environment; `asker` replaces Jev's service, for tests.
+  The API key is optional: without one, `jevCompact` skips with `no_key` without calling Jev, and compaction is Pi's own summary.
+  Two adapters log each skip as `Jev leaves the compaction to Pi's summary` with `reason`, `detail` and `tokensBefore` through the `logger` they take: `jevCompactionExtension({ logger, ...options })`, the `compaction` session tool's extension, placed as `session.compaction.wrap(jevCompactionExtension({ logger }))` under the engine `JEV_COMPACTION_ENGINE` (`pi-jev-compaction`), and `jevCompactor({ logger, ...options })`, a `JevCompactor` for pi-roundtable-sandbox's `compaction` option that returns the compaction or `undefined` and logs with the `channel`.
+  A `no_key` skip is logged once per adapter, as `Jev is not configured, so compaction uses Pi's summary`, and then not again; every other skip is logged each time.
+  The types are `JevCompactInput`, `JevCompactOptions`, `JevCompactOutcome`, `JevCompactor`, `JevCompactRequest`, `JevExtensionOptions` and `JevSkipReason`.
 - Effort: `effortJudge` picks a turn's thinking level from a message with your own brief (`EffortBrief`, `JUDGE_WORK`).
 - Presentation and small helpers: `thinkingLine`, `zonedStamp(date, timeZone)`, `channelQueue()` (a queue of your own, so work does not wait behind a running turn), `checkRepoName` and `SKILL_LIST_TOOL` with `skillListExtension` for repositories and skills, and `searchTerms` for memory search.
 
@@ -505,6 +513,36 @@ A rule whose verdict depends on the input, such as one that holds only a `delete
 It is asked when the input is not known yet, as for a [precheck script](#precheck-scripts-prechecks-the-agent-writes)'s call whose arguments are computed when it runs; a rule without it is judged by `describe` with an empty input.
 A rule whose held call stands for others can answer `approvalTier(tool, input, context)`: the lowest tier that may approve it when higher than the tool's own. The held call keeps it as `minTier`, and both its card and a confirming message require it.
 
+#### The shell rule
+
+`shellHoldRule` in `pi-roundtable/kit` judges the agents' `bash`, `write` and `edit` calls; the agent server links it, and a session without a workspace has no shell.
+Its scratch roots are the shared workspace (`HoldContext.workspace`) and the scratch dir (`HoldContext.scratchDir`).
+The scratch dir is the config's `scratchDir`, by default `<os temp dir>/<discord.rootCommand>-scratch` (such as `/tmp/roundtable-scratch`); the agent server creates it with mode 0700 at startup and refuses one that is a symlink or another user's, and the agents' `bash` runs with `TMPDIR` pointing to it, so `mktemp` and tools write there.
+`AgentSessions.scratchDir` carries it to a runtime, and the agents' prompt tells them to write temporary files there.
+
+- A `>`, `>>` or `tee` target, and a `write` or `edit` path, inside a scratch root run; anything else, the rest of `/tmp` included, is held.
+- An `rm` runs when every operand resolves inside a scratch root and none is a root itself or `/`. Operands resolve after the variables assigned earlier in the same command line (`NAME=value` and `export NAME=value` with literal values; `$TMPDIR` is the scratch dir and `$HOME` the service user's home), from the directory of the last `cd`, through `..` and, for paths that exist, symlinks, so a link out of a root is held. A glob is judged by its directory part. A command substitution, an unknown variable, `~user`, an `rm` without operands, and `xargs rm` are held.
+- `sudo`, `kill`, `dd`, `mkfs` and the other programs held whatever their arguments stay held, as do service, container, firewall and package changes, `git reset --hard`, and `gh` writes.
+- `git push` is held, `force-pushes` for a force push and otherwise as a push to GitHub.
+
+`shellHoldRuleFor({ ownPushOwners?, heldPushRepos? })` (its options are the type `PushPolicy`) is the same rule with plain pushes to the owner's own repositories let through; `shellHoldRule` is `shellHoldRuleFor()`, which holds every push.
+A push runs without a hold when all of these hold:
+
+- it does not force (`-f`, `--force*`, a `+` refspec), delete (`--delete`, `-d`, a `:ref` refspec), or push tags or more than its refs (`--tags`, `--follow-tags`, `--mirror`, `--all`, `--prune`), takes no other option than `-u`, `-q`, `-v`, `-n`, `--no-verify`, `--atomic`, `--porcelain`, `--progress` and `-o`, and names no `refs/tags/…` ref or local tag;
+- the repository directory is known: `git -C <dir>`, else the last `cd` in the command line, else the workspace; a line with a subshell or `||` does not follow its `cd`;
+- every push URL of the remote (the named one, default `origin`, read with `git remote get-url --push --all` with a short timeout and no shell; or a URL given in its place) is a GitHub repository, https or ssh, whose owner is in `ownPushOwners` and whose `owner/repo` is not in `heldPushRepos`.
+
+Git's `-c`, `--git-dir` and `--work-tree`, a `GIT_*` variable before `git`, and any failure to read the remote keep the push held.
+
+```ts
+import { shellHoldRuleFor } from "pi-roundtable/kit";
+
+const shell = shellHoldRuleFor({
+	ownPushOwners: ["octocat"],
+	heldPushRepos: ["octocat/deployed-app"],
+});
+```
+
 ### `prompt`: text added to every agent turn
 
 Each section's `build` gets the agent, the speaker (undefined between turns), and the turn's scope.
@@ -1001,7 +1039,7 @@ The slot is a `RuntimeFactory`: `(deps: RuntimeDeps) => AgentRuntime`, called on
 `deps` provides `logger`, `env`, `owner`, `toolTiers`, and the host's `judge`.
 Its `sessions()` gives you linked hold rules, packages, session tools, and personas from preflight onwards; call it in a turn, when those parts are available.
 `prompts(conversation, speaker)` gives you the owner's approval and question cards on the conversation's surface, or `undefined`.
-`agents` holds the agent server's per-agent settings: `workDir`, `skills(name)`, `modelOf(name)`, and `turnChannel(scope)`.
+`agents` holds the agent server's per-agent settings: `workDir`, `scratchDir` (the agents' shell's `TMPDIR`), `skills(name)`, `modelOf(name)`, and `turnChannel(scope)`.
 `confirmations` stores held actions across restarts.
 
 An `AgentRuntime` has these methods:
@@ -1489,6 +1527,22 @@ Use it for tools that `defineTool` cannot express, such as a set that changes wh
 Each extension needs a unique name; the core reserves `read-attachment`, `confirmation-gate`, `ask-user`, `self-compact-guard`, and `active-tools`.
 A runtime of your own pins the active tools the way the core does: `activeToolsExtension(() => tools)` from `pi-roundtable/kit` is the extension the core places last, so its handler runs after every other extension's.
 At most one plugin may add a `compaction` extension, and it must name the `engine` its compactions record.
+The core's Jev compactor is one such extension:
+
+```ts
+sessionTools: [
+	{
+		name: "jev-compaction",
+		phase: "compaction",
+		engine: JEV_COMPACTION_ENGINE,
+		snapshot: () => ({
+			revision: 0,
+			factory: (session) =>
+				session.compaction.wrap(jevCompactionExtension({ logger })),
+		}),
+	},
+],
+```
 
 <!-- example: examples/session-tools.ts -->
 ```ts
@@ -2075,7 +2129,7 @@ It returns:
 |---|---|
 | `contribution` | What the plugin added, as the host would collect it: `tools`, `prompt`, `seeds`, `events`, `services`, `http`, and the rest |
 | `tools`, `tiers` | The tool names, and the table that says what tier each needs |
-| `holds` | The plugin's `holdRules` chained as the host links them (`holdChain`): `holds(tool, input, { workspace? })` returns the description of a call that must be approved first, or `undefined` |
+| `holds` | The plugin's `holdRules` chained as the host links them (`holdChain`): `holds(tool, input, { workspace?, scratchDir? })` returns the description of a call that must be approved first, or `undefined` |
 | `runTool(name, args, { speaker, channel }?)` | Runs a tool the way an agent's turn would, in the channel (default `test:1`) for the speaker, and returns the text the model reads |
 | `files` | Accepted files from `runTool`, recorded as `{ channel, file: ReplyFile }`; inject a surface with `supportsFiles: true` and pass its channel to test attachment tools |
 | `events` | The events the plugin itself reported through `context.events`, and those of `context.turns` |
@@ -2666,6 +2720,7 @@ Import from the entries listed below; source area files are internal.
 | `OwnerNotifier` | `pi-roundtable/kit` | type |
 | `PreviousTurn` | `pi-roundtable/kit` | type |
 | `PromptSlot` | `pi-roundtable/kit` | type |
+| `PushPolicy` | `pi-roundtable/kit` | type |
 | `SCHEDULE_TOOLS` | `pi-roundtable/kit` | value |
 | `SHELL_TOOLS` | `pi-roundtable/kit` | value |
 | `SKILL_LIST_TOOL` | `pi-roundtable/kit` | value |
@@ -2707,6 +2762,20 @@ Import from the entries listed below; source area files are internal.
 | `CompactionEngine` | `pi-roundtable/kit` | type |
 | `CompactionHistory` | `pi-roundtable/kit` | type |
 | `LatestCompaction` | `pi-roundtable/kit` | type |
+| `isRuleLoad` | `pi-roundtable/kit` | value |
+| `JEV_COMPACTION_ENGINE` | `pi-roundtable/kit` | value |
+| `JEV_GOAL` | `pi-roundtable/kit` | value |
+| `JEV_PREVIOUS_SUMMARY_LIMIT_TOKENS` | `pi-roundtable/kit` | value |
+| `jevCompact` | `pi-roundtable/kit` | value |
+| `jevCompactionExtension` | `pi-roundtable/kit` | value |
+| `jevCompactor` | `pi-roundtable/kit` | value |
+| `JevCompactInput` | `pi-roundtable/kit` | type |
+| `JevCompactOptions` | `pi-roundtable/kit` | type |
+| `JevCompactOutcome` | `pi-roundtable/kit` | type |
+| `JevCompactor` | `pi-roundtable/kit` | type |
+| `JevCompactRequest` | `pi-roundtable/kit` | type |
+| `JevExtensionOptions` | `pi-roundtable/kit` | type |
+| `JevSkipReason` | `pi-roundtable/kit` | type |
 | `isScheduleTool` | `pi-roundtable/kit` | value |
 | `lastAssistant` | `pi-roundtable/kit` | value |
 | `mcpAdapterExtension` | `pi-roundtable/kit` | value |
@@ -2723,6 +2792,7 @@ Import from the entries listed below; source area files are internal.
 | `searchTerms` | `pi-roundtable/kit` | value |
 | `settleTurn` | `pi-roundtable/kit` | value |
 | `shellHoldRule` | `pi-roundtable/kit` | value |
+| `shellHoldRuleFor` | `pi-roundtable/kit` | value |
 | `skillListExtension` | `pi-roundtable/kit` | value |
 | `splitReply` | `pi-roundtable/kit` | value |
 | `stringList` | `pi-roundtable/kit` | value |

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "pi-roundtable",
-	"version": "0.7.15",
+	"version": "0.7.16",
 	"description": "A plugin-driven Pi agent server for Discord",
 	"type": "module",
 	"license": "MIT",
@@ -61,6 +61,7 @@
 		"@earendil-works/pi-coding-agent": ">=0.99.2 <2",
 		"canvas": "3.2.3",
 		"discord.js": "14.27.0",
+		"pi-jev-compaction": "1.0.0",
 		"pi-mcp-adapter": "5.0.0",
 		"pino": "10.3.1",
 		"typebox": "1.3.34",

package/src/core/agents/agent-prompt.ts

@@ -18,6 +18,8 @@ export function agentSystemPrompt(input: {
 	owner: OwnerIdentity;
 	/** The host account the shell and file tools run as. */
 	shellUser: string;
+	/** The scratch dir the shell's TMPDIR points to, for temporary files. */
+	scratchDir?: string;
 	group?: { group: AgentGroup; members: readonly Agent[] };
 	/** Who the turn is for; without one, or the owner, the prompt speaks to the owner. */
 	speaker?: Speaker;
@@ -35,7 +37,7 @@ export function agentSystemPrompt(input: {
 		`You are "${agent.displayName}" (agent name \`${agent.name}\`), one of ${o.name}'s agents in ${o.his} Discord agent server. Each agent owns one channel and one conversation; you all share ${o.his} tools and ${o.his} memory.`,
 		roleText(agent, coordinator, who),
 		`The team: agent_list shows every agent and group; agent_get and agent_update read and improve any agent's prompt, display name, model, and thinking level, yours included; agent_create adds an agent with its own channel; ${input.avatars === false ? "" : "agent_avatar redraws an avatar; "}schedule_list with agent reads another agent's schedules. A message marked as coming from another agent is that agent speaking, not ${w.name}; only ${w.name} approves held actions.`,
-		`Your shell and file tools run on ${o.his} VPS as the user ${shellUser}, in the shared workspace ${workDir}. Commands that are destructive or change the system, and writes outside the workspace, are held for ${w.his} confirmation: tell ${w.him} exactly what will run and ask ${w.him} to confirm.`,
+		`Your shell and file tools run on ${o.his} VPS as the user ${shellUser}, in the shared workspace ${workDir}.${input.scratchDir ? ` Write temporary files under the scratch dir ${input.scratchDir} ($TMPDIR), not elsewhere in /tmp.` : ""} Commands that are destructive or change the system, and writes outside the workspace${input.scratchDir ? " and the scratch dir" : ""}, are held for ${w.his} confirmation: tell ${w.him} exactly what will run and ask ${w.him} to confirm.`,
 	];
 	if (group) {
 		const others = group.members

package/src/core/agents/agent-team.ts

@@ -131,6 +131,7 @@ export class DiscordAgentTeam implements AgentOps, AgentTeam {
 			entryChannelId,
 			owner,
 			shellUser,
+			scratchDir,
 		} = this.#options;
 		const agent = store.agent(scope.name);
 		if (!agent) throw new AgentError(`no agent ${scope.name}`);
@@ -146,6 +147,7 @@ export class DiscordAgentTeam implements AgentOps, AgentTeam {
 			workDir,
 			owner,
 			shellUser,
+			...(scratchDir ? { scratchDir } : {}),
 			avatars: this.#avatars(),
 			...(group
 				? {

package/src/core/agents/team-options.ts

@@ -35,6 +35,8 @@ export interface AgentTeamOptions
 	workDir: string;
 	/** The host account the agents' shell and file tools run as. */
 	shellUser: string;
+	/** The scratch dir the agents' shell writes temporary files to. */
+	scratchDir?: string;
 	/** The prompt every persona shares, the assistant's included; each agent's starts with it. */
 	sharedPrompt: string;
 	/** The shared prompt for speakers other than the owner, when `sharedPrompt` speaks to the owner. */

package/src/core/builtin/agent-server.ts

@@ -1,3 +1,4 @@
+import { chmodSync, lstatSync, mkdirSync } from "node:fs";
 import { join } from "node:path";
 import type { ModelRuntime } from "@earendil-works/pi-coding-agent";
 import type { SQL } from "bun";
@@ -12,6 +13,7 @@ import { discordKey } from "../agents/team-keys.ts";
 import { ownerAttachmentDir } from "../attachments/attachment-dir.ts";
 import type { AgentRuntime, AgentSessions } from "../contract/runtime.ts";
 import type { ChannelKey } from "../domain/conversation.ts";
+import { ConfigError } from "../domain/errors.ts";
 import type { OwnerIdentity } from "../identity.ts";
 import { ConfirmationJudge } from "../judging/confirmation-judge.ts";
 import { AGENT_BRIEF, EffortJudge } from "../judging/effort-judge.ts";
@@ -53,6 +55,11 @@ export interface AgentServerOptions {
 	judgeThreshold: number;
 	/** The shell's shared working directory. */
 	workDir: string;
+	/**
+	 * The agents' scratch dir, created with mode 0700 when the agent server starts: their shell's
+	 * TMPDIR, where writes and removals run without a hold.
+	 */
+	scratchDir?: string;
 	/** The host account the agents' shell and file tools run as. */
 	shellUser: string;
 	/** The prompt every agent starts with, and the one for speakers other than the owner. */
@@ -178,6 +185,7 @@ export function agentServerPlugin(
 				owner: options.owner,
 				toolTiers: context.toolTiers,
 				shellUser: options.shellUser,
+				...(options.scratchDir ? { scratchDir: options.scratchDir } : {}),
 				store,
 				channels: connection.agentChannels(options.guildId),
 				studio,
@@ -227,6 +235,9 @@ export function agentServerPlugin(
 			});
 			const agentSessions: AgentSessions = {
 				workDir: options.workDir,
+				...(options.scratchDir
+					? { scratchDir: ensureScratchDir(options.scratchDir) }
+					: {}),
 				modelOf: (name) => built.modelOf(name),
 				skills: (name) => built.skillsOf(name),
 				turnChannel: (scope) => built.turnChannel(scope),
@@ -339,3 +350,18 @@ export function agentServerPlugin(
 		},
 	};
 }
+
+/**
+ * Creates the scratch dir for the service user alone. A shared temp dir lets anyone create the
+ * path first, so a symlink or a dir the service user does not own is refused.
+ */
+export function ensureScratchDir(dir: string): string {
+	mkdirSync(dir, { recursive: true, mode: 0o700 });
+	const stat = lstatSync(dir);
+	if (!stat.isDirectory() || stat.uid !== process.getuid?.())
+		throw new ConfigError(
+			`the scratch dir ${dir} is not a directory of this service's user. Remove it or set scratchDir to another path.`,
+		);
+	chmodSync(dir, 0o700);
+	return dir;
+}

package/src/core/config/config.ts

@@ -1,3 +1,5 @@
+import { tmpdir } from "node:os";
+import { join } from "node:path";
 import type { AgentSeed } from "../agents/agent-rules.ts";
 import { ConfigError } from "../domain/errors.ts";
 import { isLocale, type Locale } from "../i18n/index.ts";
@@ -103,6 +105,11 @@ export interface RoundtableConfig {
 	avatar?: string;
 	/** The agents' shared working directory; default `<dataDir>/work`. */
 	workDir?: string;
+	/**
+	 * The agents' scratch dir: their shell runs with TMPDIR pointing to it, and writes and removals
+	 * inside it run without a hold. Default `<os temp dir>/<discord.rootCommand>-scratch`.
+	 */
+	scratchDir?: string;
 	/**
 	 * Where the skill registry reads built-in skills and keeps linked repositories. `false` leaves
 	 * the `skills` addon out: agents carry no skills, and no skill tools exist. Stored skills stay
@@ -191,6 +198,7 @@ const schema = shape({
 	}),
 	avatar: optional(text),
 	workDir: optional(text),
+	scratchDir: optional(text),
 	skills: optional(
 		orOff(shape({ builtinDir: optional(text), reposDir: optional(text) })),
 	),
@@ -243,6 +251,7 @@ export interface ResolvedConfig {
 	};
 	avatar?: string;
 	workDir: string;
+	scratchDir: string;
 	/** `false` when the skills addon is off. */
 	skills: false | { builtinDir?: string; reposDir?: string };
 	memory: boolean;
@@ -265,6 +274,9 @@ export function resolveConfig(input: unknown): ResolvedConfig {
 	const name = config.name ?? "Roundtable";
 	const model = modelOf(config.model, "model");
 	const thinking = config.thinking ?? "medium";
+	const rootCommand =
+		config.discord.rootCommand ??
+		name.toLowerCase().replace(/[^a-z0-9-]+/g, "-");
 	return {
 		name,
 		owner: {
@@ -276,9 +288,7 @@ export function resolveConfig(input: unknown): ResolvedConfig {
 			token: config.discord.token,
 			guild: config.discord.guild,
 			entryChannel: config.discord.entryChannel,
-			rootCommand:
-				config.discord.rootCommand ??
-				name.toLowerCase().replace(/[^a-z0-9-]+/g, "-"),
+			rootCommand,
 			admin: config.discord.admin ?? true,
 			...(config.discord.refusalHint === undefined
 				? {}
@@ -321,6 +331,7 @@ export function resolveConfig(input: unknown): ResolvedConfig {
 		},
 		...(config.avatar ? { avatar: config.avatar } : {}),
 		workDir: config.workDir ?? `${config.dataDir}/work`,
+		scratchDir: config.scratchDir ?? join(tmpdir(), `${rootCommand}-scratch`),
 		skills: config.skills ?? {},
 		memory: config.memory ?? true,
 		...(config.ops ? { ops: config.ops } : {}),

package/src/core/contract/runtime.ts

@@ -82,6 +82,11 @@ export interface LoadedSkill {
 export interface AgentSessions {
 	/** The shell's working directory, shared by every agent; writes outside it are held. */
 	workDir: string;
+	/**
+	 * The host's scratch dir: the agents' shell runs with TMPDIR pointing to it, and writes and
+	 * removals inside it run without a hold, like the workspace's.
+	 */
+	scratchDir?: string;
 	/**
 	 * The skills the agent carries, read at the start of every run; a change rebuilds its
 	 * sessions, keeping their history.

package/src/core/define-roundtable.ts

@@ -211,6 +211,7 @@ export async function defineRoundtable(
 				thinking: config.thinking,
 				judgeThreshold: config.judge.threshold,
 				workDir: config.workDir,
+				scratchDir: config.scratchDir,
 				shellUser: userInfo().username,
 				prompts: { shared, guest },
 				avatarListener: "public",

package/src/core/holds.ts

@@ -5,6 +5,8 @@ import { type Tier, tierAtLeast } from "./speakers.ts";
 export interface HoldContext {
 	/** The shared workspace of a session with a shell; calls reaching outside it may be held. */
 	workspace?: string;
+	/** The session's scratch dir, where its shell's TMPDIR points; writes and removals inside it run. */
+	scratchDir?: string;
 }
 
 /**

package/src/core/modules/host-shell/git-push.ts

@@ -0,0 +1,112 @@
+import { execFileSync } from "node:child_process";
+import { type LineState, resolvePath } from "./shell-paths.ts";
+
+/** Which pushes run without the owner's approval; see `shellHoldRuleFor`. */
+export interface PushPolicy {
+	/** GitHub owners whose repositories take a plain push without a hold. */
+	ownPushOwners?: readonly string[];
+	/** `owner/repo` names that stay held although their owner is listed. */
+	heldPushRepos?: readonly string[];
+}
+
+const GIT_TIMEOUT_MS = 3_000;
+
+/** Push options that neither force, delete, nor push tags or more than the named refs. */
+const PLAIN_FLAGS = new Set([
+	"-u",
+	"--set-upstream",
+	"-q",
+	"--quiet",
+	"-v",
+	"--verbose",
+	"-n",
+	"--dry-run",
+	"--no-verify",
+	"--verify",
+	"--atomic",
+	"--porcelain",
+	"--progress",
+	"--no-progress",
+]);
+
+/** `owner/repo` of a GitHub remote URL, https or ssh, or undefined. */
+export function githubRepo(url: string): string | undefined {
+	const match =
+		/^(?:https:\/\/(?:[^@/]+@)?github\.com\/|ssh:\/\/git@github\.com(?::\d+)?\/|git@github\.com:)([A-Za-z0-9-]+)\/([A-Za-z0-9._-]+?)(?:\.git)?\/?$/i.exec(
+			url.trim(),
+		);
+	return match ? `${match[1]}/${match[2]}`.toLowerCase() : undefined;
+}
+
+function git(dir: string, args: readonly string[]): string | undefined {
+	try {
+		return execFileSync("git", ["-C", dir, ...args], {
+			encoding: "utf8",
+			timeout: GIT_TIMEOUT_MS,
+			stdio: ["ignore", "pipe", "ignore"],
+		});
+	} catch {
+		return undefined;
+	}
+}
+
+/**
+ * Whether `git <global> push <args>` is a plain push to one of the owner's own GitHub repositories:
+ * no force, deletion, tags or mirror, and a remote whose push URLs all belong to a listed owner.
+ */
+export function ownPush(
+	globals: readonly string[],
+	args: readonly string[],
+	state: LineState,
+	policy: PushPolicy,
+): boolean {
+	const owners = (policy.ownPushOwners ?? []).map((o) => o.toLowerCase());
+	if (owners.length === 0) return false;
+	let dir = state.cwd;
+	for (let i = 0; i < globals.length; i++) {
+		// `-c`, `--git-dir` and the like can point the push elsewhere.
+		if (globals[i] !== "-C") return false;
+		const next = globals[++i];
+		if (next === undefined || dir === undefined) return false;
+		dir = resolvePath(next, { ...state, cwd: dir });
+	}
+	if (dir === undefined) return false;
+	const positional: string[] = [];
+	for (let i = 0; i < args.length; i++) {
+		const arg = args[i] as string;
+		if (arg === "-o" || arg === "--push-option") i++;
+		else if (arg.startsWith("--push-option=")) continue;
+		else if (arg.startsWith("-")) {
+			if (!PLAIN_FLAGS.has(arg)) return false;
+		} else positional.push(arg);
+	}
+	const [remote = "origin", ...refspecs] = positional;
+	for (const refspec of refspecs) {
+		if (refspec.startsWith("+") || refspec.startsWith(":")) return false;
+		if (refspec.includes("refs/tags/")) return false;
+		for (const ref of refspec.split(":"))
+			if (
+				ref &&
+				git(dir, ["show-ref", "--verify", "--quiet", `refs/tags/${ref}`]) !==
+					undefined
+			)
+				return false;
+	}
+	const urls = /[:/]/.test(remote)
+		? [remote]
+		: git(dir, ["remote", "get-url", "--push", "--all", remote])
+				?.split("\n")
+				.filter(Boolean);
+	if (!urls || urls.length === 0) return false;
+	const held = new Set(
+		(policy.heldPushRepos ?? []).map((r) => r.toLowerCase()),
+	);
+	return urls.every((url) => {
+		const repo = githubRepo(url);
+		return (
+			repo !== undefined &&
+			owners.includes(repo.split("/")[0] as string) &&
+			!held.has(repo)
+		);
+	});
+}

package/src/core/modules/host-shell/shell-paths.ts

@@ -0,0 +1,160 @@
+import { existsSync, realpathSync } from "node:fs";
+import { homedir } from "node:os";
+import {
+	basename,
+	dirname,
+	isAbsolute,
+	join,
+	relative,
+	resolve,
+} from "node:path";
+
+/**
+ * What the commands of one command line know as they are read in order: the variables assigned
+ * earlier with literal values, and the directory the last `cd` moved to.
+ */
+export interface LineState {
+	/** The shared workspace, where a command line starts. */
+	workspace: string;
+	/** Directories a command writes and removes in without a hold: the workspace and the scratch dir. */
+	roots: readonly string[];
+	/** Variables with known values; a name mapped to undefined was assigned something unknown. */
+	vars: Map<string, string | undefined>;
+	/** The working directory, or undefined once a `cd` went somewhere unknown. */
+	cwd: string | undefined;
+	/** Whether `cd` can be followed: false in a line with subshells or `||`, where the last `cd` may not apply. */
+	followsCd: boolean;
+}
+
+export function lineState(
+	command: string,
+	workspace: string,
+	scratchDir: string | undefined,
+): LineState {
+	const vars = new Map<string, string | undefined>([["HOME", homedir()]]);
+	if (scratchDir !== undefined) vars.set("TMPDIR", scratchDir);
+	return {
+		workspace,
+		roots: scratchDir === undefined ? [workspace] : [workspace, scratchDir],
+		vars,
+		cwd: workspace,
+		followsCd: !/(^|[^$])\(|\|\|/.test(command),
+	};
+}
+
+const ASSIGNMENT = /^([A-Za-z_][A-Za-z0-9_]*)=(.*)$/s;
+
+/**
+ * The word with the line's variables substituted and `~` expanded, or undefined when it holds a
+ * command substitution, an unknown variable or `~user`.
+ */
+export function expand(word: string, state: LineState): string | undefined {
+	if (word.includes("`") || word.includes("$(")) return undefined;
+	let unknown = false;
+	const substituted = word.replace(
+		/\$(?:\{([A-Za-z_][A-Za-z0-9_]*)\}|([A-Za-z_][A-Za-z0-9_]*))/g,
+		(_, braced: string | undefined, plain: string | undefined) => {
+			const value = state.vars.get((braced ?? plain) as string);
+			if (value === undefined) unknown = true;
+			return value ?? "";
+		},
+	);
+	if (unknown || substituted.includes("$")) return undefined;
+	if (substituted === "~" || substituted.startsWith("~/"))
+		return `${homedir()}${substituted.slice(1)}`;
+	return substituted.startsWith("~") ? undefined : substituted;
+}
+
+/** The absolute path a word names, from the line's working directory; undefined when unknown. */
+export function resolvePath(
+	word: string,
+	state: LineState,
+): string | undefined {
+	const path = expand(word, state);
+	if (path === undefined) return undefined;
+	if (isAbsolute(path)) return resolve(path);
+	return state.cwd === undefined ? undefined : resolve(state.cwd, path);
+}
+
+/** Records a simple command's effect on the line: an assignment, an `export`, or a `cd`. */
+export function follow(argv: readonly string[], state: LineState): void {
+	const [head, ...args] = argv;
+	if (head === undefined) return;
+	const assignments =
+		head === "export"
+			? args
+			: argv.every((w) => ASSIGNMENT.test(w))
+				? argv
+				: [];
+	for (const word of assignments) {
+		const match = ASSIGNMENT.exec(word);
+		if (match)
+			state.vars.set(match[1] as string, expand(match[2] as string, state));
+	}
+	if (head === "cd" || head === "pushd" || head === "popd") {
+		const target = args.find((a) => !a.startsWith("-"));
+		state.cwd =
+			state.followsCd && head === "cd" && target !== undefined
+				? resolvePath(target, state)
+				: undefined;
+	}
+}
+
+/** Whether `path` is `root` or under it, comparing the paths as written. */
+export function under(path: string, root: string): boolean {
+	const rel = relative(resolve(root), resolve(path));
+	return rel === "" || (!rel.startsWith("..") && !isAbsolute(rel));
+}
+
+/** The real path of `path`: its nearest existing ancestor's real path, joined with the rest. */
+function realPath(path: string): string {
+	let existing = path;
+	while (!existsSync(existing) && dirname(existing) !== existing)
+		existing = dirname(existing);
+	try {
+		return join(realpathSync(existing), relative(existing, path));
+	} catch {
+		return path;
+	}
+}
+
+/** Whether a write to `path` stays inside a root, as written. */
+export function insideRoots(path: string, state: LineState): boolean {
+	return state.roots.some((root) => under(path, root));
+}
+
+/**
+ * Why an `rm` is held, or undefined when every operand resolves, through symlinks, under a scratch
+ * root without being one; a glob is judged by its directory part.
+ */
+export function rmHeld(
+	args: readonly string[],
+	state: LineState,
+): string | undefined {
+	const operands: string[] = [];
+	let options = true;
+	for (const arg of args) {
+		if (options && arg === "--") options = false;
+		else if (options && arg.startsWith("-") && arg !== "-") continue;
+		else operands.push(arg);
+	}
+	if (operands.length === 0) return "rm";
+	const roots = state.roots.map(realPath);
+	for (const operand of operands) {
+		const glob = /[*?[]/.exec(operand);
+		const pattern = glob ? operand : undefined;
+		const word = glob
+			? operand.slice(0, operand.lastIndexOf("/", glob.index) + 1) || "."
+			: operand;
+		// `.*` once matched `..`; a glob of hidden names is held.
+		if (pattern && basename(pattern).startsWith(".")) return "rm";
+		const path = resolvePath(word, state);
+		if (path === undefined || path === "/") return "rm";
+		const real = realPath(path);
+		const inside = roots.some((root) =>
+			pattern ? under(real, root) : under(real, root) && real !== root,
+		);
+		if (!inside) return "rm";
+	}
+	return undefined;
+}