shraga 0.1.157 → 0.1.159

package/src/server/hooks.ts

@@ -10,6 +10,8 @@ import { rewriteSlackMentions } from './slack/mention-rewrite.ts';
 import { PROTECTED_DATA_MESSAGE, writesProtectedData } from './security/enforce.ts';
 import { getOffload, type OffloadSettings } from './shraga-config.ts';
 import { heavyCommandDenyMessage, heavyLocalCommand } from './offload.ts';
+import { wholeDiskSearch, wholeDiskSearchMessage } from './disk-search-guard.ts';
+import { DATA_DIR } from './paths.ts';
 
 /** Patterns that indicate a long-running script the model should background. */
 const LONG_RUNNING_PATTERNS = [
@@ -198,6 +200,24 @@ export const denyHeavyLocalMedia = (cfg: OffloadSettings): HookCallback => async
   };
 };
 
+/** Refuse searches rooted at / or the bare home dir (Bash find/grep -r/mdfind, or the Grep/Glob tools' `path`). */
+export const denyWholeDiskSearch: HookCallback = async (input) => {
+  if (input.hook_event_name !== 'PreToolUse') return {};
+  const { tool_name, tool_input } = input as PreToolUseHookInput;
+  const ti = (tool_input ?? {}) as Record<string, unknown>;
+  const what = tool_name === 'Bash' ? wholeDiskSearch(String(ti.command ?? ''))
+    : typeof ti.path === 'string' && wholeDiskSearch(`find ${ti.path}`) ? `${tool_name} ${ti.path}` : null;
+  if (!what) return {};
+  console.log(`[hooks] Denied whole-disk search: ${what}`);
+  return {
+    hookSpecificOutput: {
+      hookEventName: 'PreToolUse' as const,
+      permissionDecision: 'deny' as const,
+      permissionDecisionReason: wholeDiskSearchMessage(what, DATA_DIR),
+    },
+  };
+};
+
 /** Build the hooks map to pass into SDK query() options.
  *  `exemptBashCommand` is the one command the turn was explicitly told to run in the foreground
  *  (a `bash` schedule's command) — see forceBackgroundForScripts. */
@@ -205,6 +225,7 @@ export function buildHooks(opts?: { exemptBashCommand?: string; offload?: Offloa
   const offload = opts && 'offload' in opts ? opts.offload : getOffload();
   return {
     PreToolUse: [
+      { matcher: 'Bash|Grep|Glob', hooks: [denyWholeDiskSearch] },
       ...(offload ? [{ matcher: 'Bash', hooks: [denyHeavyLocalMedia(offload)] }] : []),
       { matcher: 'Bash', hooks: [forceBackgroundForScripts(opts?.exemptBashCommand, opts?.durableJobs), ...(opts?.durableJobs ? [denyNativeBackground] : [])] },
       { matcher: 'mcp__mcp-slack-use__post_slack_.*', hooks: [resolveSlackMentions] },

package/src/server/scheduler/runner.ts

@@ -182,6 +182,10 @@ function formatEventBlock(e: EventContext): string {
   return `An external event triggered this automation.\nSource: ${e.source}\nEvent data:\n\`\`\`json\n${body}\n\`\`\``;
 }
 
+/** Prefix of every session id a scheduled run mints — the marker that a session belongs to the scheduler. */
+export const SCHEDULED_SESSION_PREFIX = 'sched-';
+export const isScheduledSession = (sessionId: string): boolean => sessionId.startsWith(SCHEDULED_SESSION_PREFIX);
+
 export async function runSchedule(
   schedule: Schedule,
   onEvent: (ev: object) => void,
@@ -192,7 +196,7 @@ export async function runSchedule(
 ): Promise<ScheduleRunSummary> {
   const now = Date.now();
   // Resume reuses the interrupted run's session (same convo) instead of spawning a new one.
-  const sessionId = resume ? resume.sessionId : `sched-${schedule.id}-${now}`;
+  const sessionId = resume ? resume.sessionId : `${SCHEDULED_SESSION_PREFIX}${schedule.id}-${now}`;
   const abortController = new AbortController();
   registerRun(sessionId, abortController);
 
@@ -326,6 +330,7 @@ export async function runSchedule(
           abortController,
           onPermissionRequest,
           foregroundBashCommand: allowedCmd ?? undefined,
+          scheduled: true,
         })) {
           onEvent({ type: 'session_stream', sessionId, event: ev });
           if (ev.type === 'text_delta') {

package/src/server/shraga-config.ts

@@ -44,6 +44,8 @@ function isFullEntry(entry: McpEntry): entry is McpFullEntry {
 
 export interface AgentSettings {
   model?: string;
+  /** Model for scheduled (unattended) runs whose prompt names no `[model:…]`. Unset = `model`. */
+  scheduleModel?: string;
   engine?: string;
   systemPrompt?: string;
   allowedTools?: string[];

package/src/server/skills.ts

@@ -320,7 +320,9 @@ export function buildSkillIndexBlock(): string {
     const tag = defaultNames.has(name) ? ' (default)' : '';
     lines.push(`- **${name}**${tag}: ${desc}${triggers}${expiry}`);
   }
-  return `<available-skills>\nSkills available in data/skills/. Use Read to load full skill content when needed.\n${lines.join('\n')}\n</available-skills>`;
+  // ABSOLUTE: the agent's cwd is the app dir, not DATA_DIR, so a relative "data/skills/" (or a skill's own
+  // `scripts/…`) resolved nowhere and agents fell back to `find /` (3-7 min per call).
+  return `<available-skills>\nSkills live in ${SKILLS_DIR}/ — skill X is ${SKILLS_DIR}/X.md, and its bundled files (scripts/, reference/) are under ${SKILLS_DIR}/X/. A relative path in a skill lives under the data dir ${DATA_DIR}/: look in the skill's folder ${SKILLS_DIR}/X/, then ${DATA_DIR}/workspace/, then ${DATA_DIR}/ (skills/… is relative to ${DATA_DIR}/). If you must search, search inside ${DATA_DIR} only — never the whole disk. Use Read to load full skill content when needed.\n${lines.join('\n')}\n</available-skills>`;
 }
 
 /* ── Trigger matching ─────────────────────────────────────────────────────────