pitroom 0.24.0 → 0.24.1

package/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "pitroom",
   "description": "A free pit crew for your expensive coding agent: the superpowers development workflow, run by cheap workers. Delegate research, fixes, tests, reviews and whole plans from Claude Code, Codex or any agent to OpenCode, Codex or Claude Code workers, with receipts that prove the savings.",
-  "version": "0.24.0",
+  "version": "0.24.1",
   "author": {
     "name": "TahaAtas"
   },

package/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "pitroom",
-  "version": "0.24.0",
+  "version": "0.24.1",
   "description": "A free pit crew for your expensive coding agent: delegate research, fixes, tests, reviews and parallel investigations to cheap worker agents running your own models, with verified answers, exact diffs and cost receipts.",
   "author": {
     "name": "TahaAtas"

package/CHANGELOG.md

@@ -1,5 +1,10 @@
 # Changelog
 
+## 0.24.1
+
+### Workers
+- **Antigravity: a task that names files outside the project no longer stops halfway.** agy's file tools stay in the workspace, and a headless agy cannot ask for more, so a read outside it ("copy the components from /tmp/ui-source") was refused and ended the turn without an answer. The folders and files a task names by absolute path (or `~/…`) that exist outside the workspace are now granted read-only (the sandbox mounts them read-only too), with every secret-looking file in them denied (found at any depth and in every folder; a folder too big to check, with a link leading out of it or nowhere, or with a folder that cannot be read, is not granted, and a named path counts where its links lead). Never the root or a top-level folder such as `/tmp`, your home itself or a folder above it, a folder holding the workspace or the project, a dot-folder in your home (`~/.config` and the like) or `~/Library`, Pitroom's own state or a secret-looking file, and nothing on Windows (agy compares paths there without their drive letter); the secrets in your home stay denied. In a snapshot or an isolated copy the project's own paths in the task are turned into the copy's (links resolved, so `/tmp/…` and `/private/tmp/…` alike): the worker reads and edits its copy instead of being refused at the project.
+
 ## 0.24.0
 
 ### Workers

package/dist/lib.mjs

@@ -542,10 +542,10 @@ function denyCommandRules() {
     "command(eval)"
   ];
 }
-function workerSettings(workspace, workerHome3) {
+function workerSettings(workspace, workerHome3, reads = []) {
   const real = (p) => {
     try {
-      return fs6.realpathSync(p);
+      return fs6.realpathSync.native(p);
     } catch {
       return p;
     }
@@ -553,6 +553,7 @@ function workerSettings(workspace, workerHome3) {
   const both = (p) => [.../* @__PURE__ */ new Set([p, real(p)])];
   const secrets = [
     ...findSecretFiles(workspace).map((f) => path5.join(workspace, f)),
+    ...reads.flatMap((r) => r.secrets),
     ...HOME_SECRETS.map((f) => path5.join(os3.homedir(), f)).filter((p) => fs6.existsSync(p)),
     // the keychain link of the worker's own home
     path5.join(workerHome3, "Library")
@@ -565,7 +566,9 @@ function workerSettings(workspace, workerHome3) {
       allow: [
         "command(*)",
         ...both(path5.join(dataDir(workerHome3), "brain")).map((p) => `write_file(${rulePath(p)})`),
-        ...toolchains().flatMap(both).map((p) => `read_file(${rulePath(p)})`)
+        ...toolchains().flatMap(both).map((p) => `read_file(${rulePath(p)})`),
+        // what the task names outside the workspace: a headless agy cannot ask, and would end the turn unanswered
+        ...reads.map((r) => r.path).flatMap(both).map((p) => `read_file(${rulePath(p)})`)
       ],
       deny: [
         ...secrets.flatMap(both).map((p) => `read_file(${rulePath(p)})`),
@@ -588,6 +591,96 @@ function toolchains() {
   const install = (d) => path5.basename(d) === "bin" && /[\\/](versions|toolchains)[\\/]/.test(d) ? path5.dirname(d) : d;
   return [...new Set(dirs.map(install))].filter((d) => !inHome(home()) || path5.relative(home(), d).startsWith(".."));
 }
+var isDir = (p) => {
+  try {
+    return fs6.statSync(p).isDirectory();
+  } catch {
+    return false;
+  }
+};
+var MAX_READS = 20;
+function pathsIn(prompt) {
+  const out = [];
+  for (const m of prompt.matchAll(/(^|[\s"'`(\[<{=])((?:~|[A-Za-z]:)?[\\/][^\s"'`)\]>}]*)/g)) {
+    const raw = m[2].replace(/[.,;:!?]+$/, "");
+    const abs = raw.startsWith("~") ? path5.join(os3.homedir(), raw.slice(1)) : raw;
+    if (raw && path5.isAbsolute(abs)) out.push({ raw, at: m.index + m[1].length, abs });
+  }
+  return out;
+}
+var realOf = (p) => {
+  try {
+    return fs6.realpathSync.native(p);
+  } catch {
+    return void 0;
+  }
+};
+function resolved(p) {
+  let dir = path5.resolve(p);
+  const rest = [];
+  for (; ; ) {
+    const r = realOf(dir);
+    if (r) return path5.join(r, ...rest);
+    const up = path5.dirname(dir);
+    if (up === dir) return path5.resolve(p);
+    rest.unshift(path5.basename(dir));
+    dir = up;
+  }
+}
+var inside = (p, dir) => {
+  const rel = path5.relative(dir, p);
+  return !rel || !rel.startsWith("..") && !path5.isAbsolute(rel);
+};
+var MAX_SCANNED = 2e4;
+function allSecrets(dir) {
+  const root = realOf(dir) ?? dir;
+  const found = [];
+  let seen = 0;
+  const stack = [dir];
+  while (stack.length) {
+    const d = stack.pop();
+    let entries;
+    try {
+      entries = fs6.readdirSync(d, { withFileTypes: true });
+    } catch {
+      return void 0;
+    }
+    for (const e of entries) {
+      if (++seen > MAX_SCANNED) return void 0;
+      const p = path5.join(d, e.name);
+      if (e.isSymbolicLink()) {
+        const target = realOf(p);
+        if (!target || !inside(target, root)) return void 0;
+        if (looksSecret(e.name)) found.push(p);
+      } else if (e.isDirectory()) stack.push(p);
+      else if (looksSecret(e.name)) found.push(p);
+    }
+  }
+  return found;
+}
+function outsideReads(prompt, workspace, project) {
+  if (process.platform === "win32") return [];
+  const homeDir = realOf(os3.homedir()) ?? os3.homedir();
+  const ws = realOf(workspace) ?? path5.resolve(workspace);
+  const proj = project ? resolved(project) : void 0;
+  const own = realOf(home()) ?? home();
+  const found = /* @__PURE__ */ new Map();
+  for (const { abs } of pathsIn(prompt)) {
+    const p = realOf(abs);
+    if (!p || found.has(p) || inside(p, ws) || inside(p, own)) continue;
+    if (inside(homeDir, p) || inside(ws, p) || proj && inside(proj, p)) continue;
+    if (p.split(/[\\/]/).filter(Boolean).length < 2) continue;
+    if (inside(p, homeDir) && /^(\.|Library([\\/]|$))/.test(path5.relative(homeDir, p))) continue;
+    if (!isDir(p)) {
+      if (!looksSecret(path5.basename(p))) found.set(p, { path: p, secrets: [] });
+    } else {
+      const secrets = allSecrets(p);
+      if (secrets) found.set(p, { path: p, secrets });
+    }
+    if (found.size >= MAX_READS) break;
+  }
+  return [...found.values()];
+}
 function baseSettings() {
   return {
     enableTerminalSandbox: true,
@@ -598,12 +691,12 @@ function baseSettings() {
 }
 var rulePath = (p) => p.replace(/^[A-Za-z]:(?=[\\/])/, "").replace(/\\/g, "/");
 var HOMES_KEPT_DAYS = 14;
-function workerHome(workspace) {
+function workerHome(workspace, reads = []) {
   const root = path5.join(home(), "antigravity-home");
   const id2 = crypto3.createHash("sha256").update(path5.resolve(workspace)).digest("hex").slice(0, 16);
   const dir = path5.join(root, id2);
   fs6.mkdirSync(dataDir(dir), { recursive: true });
-  writeIfChanged(path5.join(dataDir(dir), "settings.json"), `${JSON.stringify(workerSettings(workspace, dir), null, 2)}
+  writeIfChanged(path5.join(dataDir(dir), "settings.json"), `${JSON.stringify(workerSettings(workspace, dir, reads), null, 2)}
 `);
   if (process.platform === "darwin") {
     fs6.mkdirSync(path5.join(dir, "Library"), { recursive: true });
@@ -627,11 +720,25 @@ function pruneHomes(root, keep) {
   } catch {
   }
 }
+function inCopy(prompt, project) {
+  if (!project || project.root === project.copy) return prompt;
+  const root = resolved(project.root);
+  let out = "";
+  let from = 0;
+  for (const { raw, at, abs } of pathsIn(prompt)) {
+    const p = resolved(abs);
+    if (!inside(p, root)) continue;
+    out += prompt.slice(from, at) + path5.join(project.copy, path5.relative(root, p));
+    from = at + raw.length;
+  }
+  return out + prompt.slice(from);
+}
 function invocation(req) {
+  const prompt = inCopy(req.prompt, req.project);
   const args = [
     // -p takes the prompt as its value; one that starts with "-" would be read as an option: a leading space keeps it a value.
     "-p",
-    req.prompt.startsWith("-") ? ` ${req.prompt}` : req.prompt,
+    prompt.startsWith("-") ? ` ${prompt}` : prompt,
     "--output-format",
     "stream-json",
     "--mode",
@@ -646,7 +753,7 @@ function invocation(req) {
   if (model) args.push("--model", model);
   if (effort) args.push("--effort", effort);
   const { command, prefix } = resolveCommand(binary());
-  const workerDir = workerHome(req.cwd);
+  const workerDir = workerHome(req.cwd, outsideReads(prompt, req.cwd, req.project?.root));
   const env = { HOME: workerDir };
   if (process.platform === "win32") env.USERPROFILE = workerDir;
   return { command, args: [...prefix, ...args], env };
@@ -2287,7 +2394,7 @@ function verifyRefs(refs, dirs) {
     if (!files.length) {
       if (!ref.file.includes("/") && !isFileName(ref.file)) continue;
       total++;
-      invalid.push({ ref: ref.text, reason: path12.isAbsolute(ref.file) && !inside(ref.file, roots) ? "outside the project" : "file not found" });
+      invalid.push({ ref: ref.text, reason: path12.isAbsolute(ref.file) && !inside2(ref.file, roots) ? "outside the project" : "file not found" });
       continue;
     }
     total++;
@@ -2337,16 +2444,16 @@ function indexFiles(roots) {
   return index;
 }
 function resolve(ref, roots) {
-  const candidates = path12.isAbsolute(ref) ? inside(ref, roots) ? [ref] : [] : roots.map((r) => path12.join(r, ref));
+  const candidates = path12.isAbsolute(ref) ? inside2(ref, roots) ? [ref] : [] : roots.map((r) => path12.join(r, ref));
   return candidates.find((c) => {
     try {
-      return fs12.statSync(c).isFile() && inside(c, roots);
+      return fs12.statSync(c).isFile() && inside2(c, roots);
     } catch {
       return false;
     }
   });
 }
-function inside(file, roots) {
+function inside2(file, roots) {
   return roots.some((r) => {
     const rel = path12.relative(r, path12.resolve(file));
     return rel !== "" && !rel.startsWith("..") && !path12.isAbsolute(rel);
@@ -2963,7 +3070,7 @@ function answerParts(answer) {
   const summary = s ? s[1] : text.split(/^\s*(?:DETAILS|FILES CHANGED|VERIFICATION|OPEN ISSUES):/m)[0];
   return { summary: summary.trim(), details: (d?.[1] ?? "").trim() };
 }
-function pathsIn(text) {
+function pathsIn2(text) {
   const found = text.replace(/\\/g, "/").match(/[A-Za-z0-9_.@\-/]+\.[A-Za-z0-9]{1,8}(?::\d+)?/g) ?? [];
   return [...new Set(found.map((p) => clean(p.replace(/:\d+$/, ""))))];
 }
@@ -2975,7 +3082,7 @@ function scoreAnswer(q, truth, answer, root) {
   if ("line" in truth) {
     const flat = summary.replace(/\s+/g, " ");
     if (new RegExp(`(^|[^\\w./-])\\.?/?${escape2(truth.path)}:${truth.line}(?!\\d)`).test(flat)) return { score: 1, got: `${truth.path}:${truth.line}` };
-    const named = pathsIn(flat).includes(truth.path);
+    const named = pathsIn2(flat).includes(truth.path);
     return { score: named ? 0.5 : 0, got: flat.slice(0, 120) };
   }
   if ("count" in truth) {
@@ -2983,8 +3090,8 @@ function scoreAnswer(q, truth, answer, root) {
     const got2 = n ? Number(n[0].replace(/,/g, "")) : void 0;
     return { score: got2 === truth.count ? 1 : 0, got: got2 === void 0 ? "(no number)" : String(got2) };
   }
-  let got = pathsIn(summary);
-  if (!got.length) got = pathsIn(details);
+  let got = pathsIn2(summary);
+  if (!got.length) got = pathsIn2(details);
   const hit = got.filter((p) => truth.files.includes(p)).length;
   const precision = got.length ? hit / got.length : 0;
   const recall = truth.files.length ? hit / truth.files.length : got.length ? 0 : 1;
@@ -3355,7 +3462,7 @@ export {
   parseStatus,
   parseTarget,
   parseVerdict,
-  pathsIn,
+  pathsIn2 as pathsIn,
   planName,
   planTask,
   primaryPrice,

package/dist/pitroom.mjs

@@ -558,10 +558,10 @@ function denyCommandRules() {
     "command(eval)"
   ];
 }
-function workerSettings(workspace, workerHome3) {
+function workerSettings(workspace, workerHome3, reads = []) {
   const real = (p) => {
     try {
-      return fs6.realpathSync(p);
+      return fs6.realpathSync.native(p);
     } catch {
       return p;
     }
@@ -569,6 +569,7 @@ function workerSettings(workspace, workerHome3) {
   const both = (p) => [.../* @__PURE__ */ new Set([p, real(p)])];
   const secrets = [
     ...findSecretFiles(workspace).map((f) => path5.join(workspace, f)),
+    ...reads.flatMap((r) => r.secrets),
     ...HOME_SECRETS.map((f) => path5.join(os3.homedir(), f)).filter((p) => fs6.existsSync(p)),
     // the keychain link of the worker's own home
     path5.join(workerHome3, "Library")
@@ -581,7 +582,9 @@ function workerSettings(workspace, workerHome3) {
       allow: [
         "command(*)",
         ...both(path5.join(dataDir(workerHome3), "brain")).map((p) => `write_file(${rulePath(p)})`),
-        ...toolchains().flatMap(both).map((p) => `read_file(${rulePath(p)})`)
+        ...toolchains().flatMap(both).map((p) => `read_file(${rulePath(p)})`),
+        // what the task names outside the workspace: a headless agy cannot ask, and would end the turn unanswered
+        ...reads.map((r) => r.path).flatMap(both).map((p) => `read_file(${rulePath(p)})`)
       ],
       deny: [
         ...secrets.flatMap(both).map((p) => `read_file(${rulePath(p)})`),
@@ -604,6 +607,96 @@ function toolchains() {
   const install2 = (d) => path5.basename(d) === "bin" && /[\\/](versions|toolchains)[\\/]/.test(d) ? path5.dirname(d) : d;
   return [...new Set(dirs.map(install2))].filter((d) => !inHome(home()) || path5.relative(home(), d).startsWith(".."));
 }
+var isDir = (p) => {
+  try {
+    return fs6.statSync(p).isDirectory();
+  } catch {
+    return false;
+  }
+};
+var MAX_READS = 20;
+function pathsIn(prompt) {
+  const out = [];
+  for (const m of prompt.matchAll(/(^|[\s"'`(\[<{=])((?:~|[A-Za-z]:)?[\\/][^\s"'`)\]>}]*)/g)) {
+    const raw = m[2].replace(/[.,;:!?]+$/, "");
+    const abs = raw.startsWith("~") ? path5.join(os3.homedir(), raw.slice(1)) : raw;
+    if (raw && path5.isAbsolute(abs)) out.push({ raw, at: m.index + m[1].length, abs });
+  }
+  return out;
+}
+var realOf = (p) => {
+  try {
+    return fs6.realpathSync.native(p);
+  } catch {
+    return void 0;
+  }
+};
+function resolved(p) {
+  let dir = path5.resolve(p);
+  const rest = [];
+  for (; ; ) {
+    const r = realOf(dir);
+    if (r) return path5.join(r, ...rest);
+    const up = path5.dirname(dir);
+    if (up === dir) return path5.resolve(p);
+    rest.unshift(path5.basename(dir));
+    dir = up;
+  }
+}
+var inside = (p, dir) => {
+  const rel = path5.relative(dir, p);
+  return !rel || !rel.startsWith("..") && !path5.isAbsolute(rel);
+};
+var MAX_SCANNED = 2e4;
+function allSecrets(dir) {
+  const root = realOf(dir) ?? dir;
+  const found = [];
+  let seen = 0;
+  const stack = [dir];
+  while (stack.length) {
+    const d = stack.pop();
+    let entries;
+    try {
+      entries = fs6.readdirSync(d, { withFileTypes: true });
+    } catch {
+      return void 0;
+    }
+    for (const e of entries) {
+      if (++seen > MAX_SCANNED) return void 0;
+      const p = path5.join(d, e.name);
+      if (e.isSymbolicLink()) {
+        const target = realOf(p);
+        if (!target || !inside(target, root)) return void 0;
+        if (looksSecret(e.name)) found.push(p);
+      } else if (e.isDirectory()) stack.push(p);
+      else if (looksSecret(e.name)) found.push(p);
+    }
+  }
+  return found;
+}
+function outsideReads(prompt, workspace, project) {
+  if (process.platform === "win32") return [];
+  const homeDir = realOf(os3.homedir()) ?? os3.homedir();
+  const ws = realOf(workspace) ?? path5.resolve(workspace);
+  const proj = project ? resolved(project) : void 0;
+  const own = realOf(home()) ?? home();
+  const found = /* @__PURE__ */ new Map();
+  for (const { abs } of pathsIn(prompt)) {
+    const p = realOf(abs);
+    if (!p || found.has(p) || inside(p, ws) || inside(p, own)) continue;
+    if (inside(homeDir, p) || inside(ws, p) || proj && inside(proj, p)) continue;
+    if (p.split(/[\\/]/).filter(Boolean).length < 2) continue;
+    if (inside(p, homeDir) && /^(\.|Library([\\/]|$))/.test(path5.relative(homeDir, p))) continue;
+    if (!isDir(p)) {
+      if (!looksSecret(path5.basename(p))) found.set(p, { path: p, secrets: [] });
+    } else {
+      const secrets = allSecrets(p);
+      if (secrets) found.set(p, { path: p, secrets });
+    }
+    if (found.size >= MAX_READS) break;
+  }
+  return [...found.values()];
+}
 function baseSettings() {
   return {
     enableTerminalSandbox: true,
@@ -614,12 +707,12 @@ function baseSettings() {
 }
 var rulePath = (p) => p.replace(/^[A-Za-z]:(?=[\\/])/, "").replace(/\\/g, "/");
 var HOMES_KEPT_DAYS = 14;
-function workerHome(workspace) {
+function workerHome(workspace, reads = []) {
   const root = path5.join(home(), "antigravity-home");
   const id2 = crypto3.createHash("sha256").update(path5.resolve(workspace)).digest("hex").slice(0, 16);
   const dir = path5.join(root, id2);
   fs6.mkdirSync(dataDir(dir), { recursive: true });
-  writeIfChanged(path5.join(dataDir(dir), "settings.json"), `${JSON.stringify(workerSettings(workspace, dir), null, 2)}
+  writeIfChanged(path5.join(dataDir(dir), "settings.json"), `${JSON.stringify(workerSettings(workspace, dir, reads), null, 2)}
 `);
   if (process.platform === "darwin") {
     fs6.mkdirSync(path5.join(dir, "Library"), { recursive: true });
@@ -643,11 +736,25 @@ function pruneHomes(root, keep) {
   } catch {
   }
 }
+function inCopy(prompt, project) {
+  if (!project || project.root === project.copy) return prompt;
+  const root = resolved(project.root);
+  let out = "";
+  let from = 0;
+  for (const { raw, at, abs } of pathsIn(prompt)) {
+    const p = resolved(abs);
+    if (!inside(p, root)) continue;
+    out += prompt.slice(from, at) + path5.join(project.copy, path5.relative(root, p));
+    from = at + raw.length;
+  }
+  return out + prompt.slice(from);
+}
 function invocation(req) {
+  const prompt = inCopy(req.prompt, req.project);
   const args = [
     // -p takes the prompt as its value; one that starts with "-" would be read as an option: a leading space keeps it a value.
     "-p",
-    req.prompt.startsWith("-") ? ` ${req.prompt}` : req.prompt,
+    prompt.startsWith("-") ? ` ${prompt}` : prompt,
     "--output-format",
     "stream-json",
     "--mode",
@@ -662,7 +769,7 @@ function invocation(req) {
   if (model) args.push("--model", model);
   if (effort) args.push("--effort", effort);
   const { command, prefix } = resolveCommand(binary());
-  const workerDir = workerHome(req.cwd);
+  const workerDir = workerHome(req.cwd, outsideReads(prompt, req.cwd, req.project?.root));
   const env = { HOME: workerDir };
   if (process.platform === "win32") env.USERPROFILE = workerDir;
   return { command, args: [...prefix, ...args], env };
@@ -4986,7 +5093,7 @@ function verifyRefs(refs, dirs) {
     if (!files.length) {
       if (!ref.file.includes("/") && !isFileName(ref.file)) continue;
       total++;
-      invalid.push({ ref: ref.text, reason: path26.isAbsolute(ref.file) && !inside(ref.file, roots) ? "outside the project" : "file not found" });
+      invalid.push({ ref: ref.text, reason: path26.isAbsolute(ref.file) && !inside2(ref.file, roots) ? "outside the project" : "file not found" });
       continue;
     }
     total++;
@@ -5036,16 +5143,16 @@ function indexFiles(roots) {
   return index;
 }
 function resolve(ref, roots) {
-  const candidates = path26.isAbsolute(ref) ? inside(ref, roots) ? [ref] : [] : roots.map((r) => path26.join(r, ref));
+  const candidates = path26.isAbsolute(ref) ? inside2(ref, roots) ? [ref] : [] : roots.map((r) => path26.join(r, ref));
   return candidates.find((c) => {
     try {
-      return fs30.statSync(c).isFile() && inside(c, roots);
+      return fs30.statSync(c).isFile() && inside2(c, roots);
     } catch {
       return false;
     }
   });
 }
-function inside(file2, roots) {
+function inside2(file2, roots) {
   return roots.some((r) => {
     const rel = path26.relative(r, path26.resolve(file2));
     return rel !== "" && !rel.startsWith("..") && !path26.isAbsolute(rel);
@@ -5054,7 +5161,7 @@ function inside(file2, roots) {
 var escape = (s) => s.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
 
 // src/core/run.ts
-var VERSION2 = true ? "0.24.0" : "0.0.0-dev";
+var VERSION2 = true ? "0.24.1" : "0.0.0-dev";
 function planWork(o) {
   if (!o.plan) return { task: o.task.trim(), tier: o.tier };
   if (o.continueFrom) throw new UserError("a follow-up continues its parent's task; drop --plan/--step");
@@ -5471,7 +5578,8 @@ function attempt(meta, backend, target) {
     sessionId: meta.sessionId,
     files: meta.files,
     web: !!meta.web,
-    title: `pitroom ${meta.mode}: ${meta.task.replace(/\s+/g, " ").slice(0, 60)}`
+    title: `pitroom ${meta.mode}: ${meta.task.replace(/\s+/g, " ").slice(0, 60)}`,
+    project: meta.repoRoot && (meta.snapshot?.dir ?? meta.worktree) && meta.cwd !== meta.dir ? { root: meta.repoRoot, copy: meta.snapshot?.dir ?? meta.worktree } : void 0
   });
   return spawnWorker(inv, {
     cwd: meta.cwd,
@@ -7696,7 +7804,7 @@ function answerParts(answer) {
   const summary = s ? s[1] : text.split(/^\s*(?:DETAILS|FILES CHANGED|VERIFICATION|OPEN ISSUES):/m)[0];
   return { summary: summary.trim(), details: (d?.[1] ?? "").trim() };
 }
-function pathsIn(text) {
+function pathsIn2(text) {
   const found = text.replace(/\\/g, "/").match(/[A-Za-z0-9_.@\-/]+\.[A-Za-z0-9]{1,8}(?::\d+)?/g) ?? [];
   return [...new Set(found.map((p) => clean(p.replace(/:\d+$/, ""))))];
 }
@@ -7708,7 +7816,7 @@ function scoreAnswer(q, truth, answer, root) {
   if ("line" in truth) {
     const flat = summary.replace(/\s+/g, " ");
     if (new RegExp(`(^|[^\\w./-])\\.?/?${escape2(truth.path)}:${truth.line}(?!\\d)`).test(flat)) return { score: 1, got: `${truth.path}:${truth.line}` };
-    const named = pathsIn(flat).includes(truth.path);
+    const named = pathsIn2(flat).includes(truth.path);
     return { score: named ? 0.5 : 0, got: flat.slice(0, 120) };
   }
   if ("count" in truth) {
@@ -7716,8 +7824,8 @@ function scoreAnswer(q, truth, answer, root) {
     const got2 = n ? Number(n[0].replace(/,/g, "")) : void 0;
     return { score: got2 === truth.count ? 1 : 0, got: got2 === void 0 ? "(no number)" : String(got2) };
   }
-  let got = pathsIn(summary);
-  if (!got.length) got = pathsIn(details);
+  let got = pathsIn2(summary);
+  if (!got.length) got = pathsIn2(details);
   const hit = got.filter((p) => truth.files.includes(p)).length;
   const precision = got.length ? hit / got.length : 0;
   const recall = truth.files.length ? hit / truth.files.length : got.length ? 0 : 1;
@@ -7880,9 +7988,9 @@ function writePackage(job) {
   const root = repoRoot(job.dir);
   if (!g || !root) throw new UserError(`not a git repository: ${job.dir}`);
   const name = `review-${crypto13.randomBytes(4).toString("hex")}.md`;
-  const inside2 = !path35.relative(fs40.realpathSync(root), fs40.realpathSync(g)).startsWith("..");
-  const file2 = inside2 ? path35.join(g, "pitroom", name) : path35.join(root, ".pitroom", name);
-  if (!inside2) ignoreInGit(root, "/.pitroom/");
+  const inside3 = !path35.relative(fs40.realpathSync(root), fs40.realpathSync(g)).startsWith("..");
+  const file2 = inside3 ? path35.join(g, "pitroom", name) : path35.join(root, ".pitroom", name);
+  if (!inside3) ignoreInGit(root, "/.pitroom/");
   fs40.mkdirSync(path35.dirname(file2), { recursive: true });
   fs40.writeFileSync(file2, job.package);
   return file2;
@@ -8615,9 +8723,9 @@ function doctor8(probe2) {
   section2("Worker chain");
   const chain = [];
   try {
-    const resolved = resolveChain();
-    chain.push(resolved.worker, ...resolved.fallback);
-    for (const w of resolved.warnings) add2("warn", w);
+    const resolved2 = resolveChain();
+    chain.push(resolved2.worker, ...resolved2.fallback);
+    for (const w of resolved2.warnings) add2("warn", w);
   } catch (e) {
     add2("fail", e.message);
   }

package/docs/backends.md

@@ -182,6 +182,7 @@ How a worker is started, and why:
 - **Read runs read a snapshot of their own** (`readOnly: 'snapshot'`). agy has no read-only mode for `-p` runs (issue 45 of google-antigravity/antigravity-cli), and `--mode plan` is reported to still write in them (issue 1181: the file is created in the same turn). So the core never lets Antigravity read the project: right before its attempt it makes the run a snapshot of its own (`snapshots/<tree>-<run id>`, made like the shared clean snapshot: from git objects, uncommitted and untracked files included, secret-looking and ignored files left out, files read-only), whatever `readIn` says. Not the shared one: directories there stay writable, so a new or replaced file would be seen by every later read run on the same state. Its follow-ups read the same snapshot. After the attempt, whatever git sees newly changed there is reported as `READ-ONLY VIOLATION` (the stream need not mention it; a follow-up is not blamed for its parent's writes), and the answer is not cached. A worker after it in the chain reads where it was meant to (the project or the shared snapshot), never Antigravity's, and a second Antigravity target gets a fresh snapshot if the first wrote in its own. As a fallback it costs nothing until it runs. These snapshots are full checkouts: pruning keeps the newest few of them apart from the shared ones, so a burst of Antigravity runs does not push those out, and a follow-up whose snapshot was pruned gets it made again from the same tree. If the snapshot cannot be made, Antigravity is skipped like a failed attempt (the next worker runs, or the run fails: as the worker before it failed, a rate limit staying one, or, when no worker ran at all, without counting against any worker's record); it never falls back to the project. `--in-place`, reviews (whose package lives in the git folder) and folders outside git read the directory itself, with a warning. `pitroom doctor --probe` runs it in an empty temporary folder. `--mode plan` is passed anyway; write and isolate use `--mode accept-edits`. Never `--dangerously-skip-permissions` (the contract tests reject it).
 - **`--sandbox`** in every mode: shell commands run in agy's terminal sandbox (the workspace writable, its `.git` read-only, `.env` and `~/.ssh` unreadable, no network). The sandbox and the permission rules are for macOS and Linux; on Windows agy still uses its previous permission system, and `doctor` says to use `-i` there.
 - **A home of its own per workspace.** agy reads its settings only from `~/.gemini/antigravity-cli/settings.json` (and its permissions from `~/.gemini/config`); `ANTIGRAVITY_APP_DATA_DIR` and every other variable tried leave its data folder where it is (its log says `CLI app data directory: …`). So a worker runs with `HOME` set to `<pitroom home>/antigravity-home/<id>`, one per workspace (the run's snapshot, its isolated copy, or the project for `-w`), where Pitroom writes `settings.json` (atomically: a parallel worker never reads half a file). The sign-in is linked in: on macOS agy finds it in the login keychain through `$HOME/Library/Keychains`, which is linked to yours; elsewhere it is the file `antigravity-oauth-token`, linked from `~/.gemini/antigravity-cli` (and a dangling link is repaired). Conversations stay in that home, so a follow-up, which runs in the same workspace, finds its own; homes not used for two weeks are removed. The worker's commands see that home too: your dotfiles are out of their reach, your own agy settings, plugins and MCP servers do not apply, and agy picks its default model unless `-W antigravity:<model>` names one. The settings: `enableTerminalSandbox`, `toolPermission: proceed-in-sandbox` and the grant `command(*)` (a headless run cannot answer a prompt: an ungranted command is refused, and the turn may end without an answer), `artifactReviewPolicy: always-proceed`, `allowNonWorkspaceAccess: false`, `write_file` for its own `brain` folder (plan mode writes its plan there, outside the workspace), `read_file` for the folders of your PATH under your home (the sandbox sees only the system and what is granted: without it an nvm `node` is `Operation not permitted`; a `bin` in a versioned install brings the install along, other folders only themselves, as `~/.cargo` holds credentials), and deny rules (deny beats allow): the workspace's secret-looking files and the secrets in your home (`.ssh`, `.aws`, `.gnupg`, `.netrc`, `.config/gh`, …) by absolute path, the shared forbidden commands (`src/backends/deny.ts`), `mcp(*)`, `read_url(*)` and `execute_url(*)`.
+- **What the task names outside the workspace** is granted read-only: the folders and files it gives by absolute path (or `~/…`) that exist, with every secret-looking file in them denied (looked for at any depth and in every folder; a folder of more than 20,000 entries, with a link leading out of it or nowhere, or with a folder that cannot be read, is not granted, as its secrets could not all be found; a named path counts where its links lead); without a grant a headless agy refuses the read and ends the turn without an answer. Never the root or a top-level folder (`/tmp`), your home itself or a folder above it, a folder holding the workspace or the project (it would open the project around a snapshot, secrets included), a dot-folder in your home (`~/.config`, `~/.npmrc`) or `~/Library` (apps keep session tokens there), Pitroom's own state or a secret-looking file; and nothing on Windows, where agy compares paths without their drive letter, so a grant would open the same path on every drive. In a snapshot or an isolated copy, the project's own paths in the task are rewritten to the copy's (compared with links resolved), so the worker works on its copy rather than being refused at the project, which it may not read or write.
 - **How agy matches the rules**, as seen in 1.3.5 (its docs say only "prefix, word by word"): `read_file` takes an absolute path or one relative to the workspace, as a folder prefix, and no pattern; a `regex:` target is not read, and a relative path breaks the sandbox (`sandbox configuration error: … non-absolute file path`) without denying anything, so secret files are listed one by one. A `command` rule is compared word by word with the start of each command in the line, after agy has split it at `;`, `&&`, `||` and `|` and taken off wrappers such as `env -i` and `timeout 60` (but not `xargs`, and not what find runs with `-exec`). A `regex:` command rule is split at spaces too, each word a regex for one word (`.*` is exactly one word), and backslashes are dropped. A line with `{}` in it is not split: a rule is matched against the whole line, start to end. The rules are built for that: each forbidden command as it is and by path, git behind its global options, a recursive `rm` wherever its option stands, `sh -c` and `eval`, find with `-exec`, `-ok` or `-delete` refused outright (a rule for what it runs only holds when it spans the whole line), xargs running a forbidden command, and, for lines with `{}`, `git <subcommand>`, `rm -r`, xargs and find anywhere in them. `test/backends.test.mjs` checks them with that matching; they remain pattern rules, **a layer on top, not a guarantee**: other spellings of a command can get past them. The git guard is what holds for git whatever the spelling (`.git` is read-only in the sandbox too), and a read run's snapshot or an isolated copy is what holds for your files: use `-i` for changes rather than `-w`, which lets a worker write (and delete) in the project itself. One settings file serves every mode, since a follow-up may run in another: so **`--web` does not apply** to Antigravity workers.
 - **`--print-timeout 24h`**: agy's docs give its own limit as 5 minutes (1.3.5's help says none), and a run that hits it ends with partial output; Pitroom's timeout governs instead.
 - **Model**: `-W antigravity:<model>` passes `--model` (`agy models` lists yours), and `#level` passes `--effort`. Without one, agy picks. Its quota is per Google account and can run out for hours: give it a fallback.

package/gemini-extension.json

@@ -1,6 +1,6 @@
 {
   "name": "pitroom",
-  "version": "0.24.0",
+  "version": "0.24.1",
   "description": "A free pit crew for your expensive coding agent: hand reading, fixes, tests and reviews to cheap worker agents and get back the answer, the exact diff and a receipt. Fourteen skills adapt a full development workflow. Needs the pitroom command (npm i -g pitroom).",
   "contextFileName": "gemini-context.md"
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pitroom",
-  "version": "0.24.0",
+  "version": "0.24.1",
   "mcpName": "io.github.ATASTECH/pitroom",
   "description": "A free pit crew for your expensive coding agent: the superpowers development workflow, run by cheap workers. Delegate research, fixes, tests, reviews and whole plans from Claude Code, Codex or any agent to OpenCode, Codex, Claude Code or Gemini CLI workers, with receipts that prove the savings.",
   "type": "module",