tsunami-code 3.12.1 → 3.12.2

package/index.js

@@ -27,7 +27,7 @@ import {
 import { listMemories, readMemory, saveMemory, deleteMemory, getMemdirPath } from './lib/memdir.js';
 import { execSync, spawn } from 'child_process';
 
-const VERSION = '3.12.1';
+const VERSION = '3.12.2';
 const CONFIG_DIR = join(os.homedir(), '.tsunami-code');
 const CONFIG_FILE = join(CONFIG_DIR, 'config.json');
 const DEFAULT_SERVER = 'https://radiometric-reita-amuck.ngrok-free.dev';
@@ -1400,22 +1400,37 @@ Output ONLY the TSUNAMI.md content, starting with "# Project: <name>"`;
 }
 
 // ── Whale Watcher — auto-update check on every startup ───────────────────────
+function waitForKeypress() {
+  return new Promise(resolve => {
+    process.stdin.setRawMode(true);
+    process.stdin.resume();
+    process.stdin.once('data', key => {
+      if (key[0] === 3) { process.stdout.write('\n'); process.exit(0); } // Ctrl+C
+      process.stdin.setRawMode(false);
+      process.stdin.pause();
+      resolve();
+    });
+  });
+}
+
 async function whaleWatcher() {
   if (!process.stdin.isTTY) return; // skip in --print / pipe mode
   const frames = ['⠋','⠙','⠹','⠸','⠼','⠴','⠦','⠧','⠇','⠏'];
   let fi = 0;
   const interval = setInterval(() => {
-    process.stdout.write(`\r  🐋 ${chalk.bold('Whale Watcher')}  ${chalk.dim(frames[fi++ % frames.length]+'  checking for updates...')}   `);
+    process.stdout.write(`\r  🐋 ${chalk.bold('Whale Watcher')}  ${chalk.dim(frames[fi++ % frames.length] + '  checking for updates...')}   `);
   }, 80);
-  const clear = () => process.stdout.write('\r' + ' '.repeat(60) + '\r');
+  const clear = () => process.stdout.write('\r' + ' '.repeat(70) + '\r');
   try {
     const res = await fetch('https://registry.npmjs.org/tsunami-code/latest',
       { signal: AbortSignal.timeout(5000) });
     const { version: latest } = await res.json();
     clearInterval(interval); clear();
     if (latest && latest !== VERSION) {
-      process.stdout.write(`  🐋 ${chalk.bold('Whale Watcher')} ${chalk.cyan(`update available`)} ${chalk.dim(`v${VERSION} → v${latest}`)}\n`);
-      process.stdout.write(chalk.dim('  Installing...\n'));
+      process.stdout.write(`  🐋 ${chalk.bold('Whale Watcher')}  ${chalk.cyan('update available')}  ${chalk.dim(`v${VERSION} → v${latest}`)}\n`);
+      process.stdout.write(chalk.dim('  Press any key to download and install...\n'));
+      await waitForKeypress();
+      process.stdout.write(chalk.dim('\n  Downloading...\n'));
       try {
         execSync(`npm install -g tsunami-code@${latest}`, { stdio: 'pipe' });
         process.stdout.write(chalk.green(`  ✓ Updated to v${latest} — restarting...\n\n`));
@@ -1425,8 +1440,9 @@ async function whaleWatcher() {
       } catch {
         process.stdout.write(chalk.yellow(`  ⚠ Auto-update failed — run: npm install -g tsunami-code\n\n`));
       }
+    } else {
+      process.stdout.write(`  🐋 ${chalk.bold('Whale Watcher')}  ${chalk.dim(`no updates found  v${VERSION}`)}\n\n`);
     }
-    // up to date — silent, proceed immediately
   } catch {
     clearInterval(interval); clear(); // network error — silent
   }

package/lib/tools.js

@@ -1,7 +1,10 @@
 import { execSync, exec } from 'child_process';
-import { readFileSync, writeFileSync, existsSync } from 'fs';
+import { readFileSync, writeFileSync, existsSync, realpathSync, appendFileSync, lstatSync, readlinkSync, statSync } from 'fs';
 import { glob } from 'glob';
 import { promisify } from 'util';
+import path from 'path';
+import os from 'os';
+import readline from 'readline';
 import { getRgPath } from './preflight.js';
 import { addFileNote, updateContext, appendDecision } from './memory.js';
 import fetch from 'node-fetch';
@@ -9,17 +12,13 @@ import fetch from 'node-fetch';
 const execAsync = promisify(exec);
 
 // ── Lines Changed Tracking ────────────────────────────────────────────────────
-// Mirrors cost-tracker.ts addToTotalLinesChanged pattern
 export const linesChanged = { added: 0, removed: 0 };
 
 // ── Undo Stack (per-turn batching) ───────────────────────────────────────────
-// Mirrors CC's multi-file undo: each turn's file changes grouped together.
-// /undo restores ALL files changed in the last turn at once.
-const _undoTurns = [];       // Array of turns: each is [{ filePath, content }]
-let _currentTurnFiles = [];  // Accumulates file snapshots for the active turn
+const _undoTurns = [];
+let _currentTurnFiles = [];
 const MAX_UNDO_TURNS = 10;
 
-/** Call before each agent turn starts to open a new undo group. */
 export function beginUndoTurn() {
   if (_currentTurnFiles.length > 0) {
     _undoTurns.push([..._currentTurnFiles]);
@@ -29,7 +28,6 @@ export function beginUndoTurn() {
 }
 
 function _pushFileSnapshot(filePath) {
-  // Only snapshot once per file per turn (first state = what to restore to)
   if (_currentTurnFiles.some(f => f.filePath === filePath)) return;
   try {
     const content = existsSync(filePath) ? readFileSync(filePath, 'utf8') : null;
@@ -37,9 +35,7 @@ function _pushFileSnapshot(filePath) {
   } catch {}
 }
 
-/** Undo all file changes from the most recent turn. Returns list of restored paths. */
 export function undo() {
-  // Commit current turn if it has anything
   if (_currentTurnFiles.length > 0) {
     _undoTurns.push([..._currentTurnFiles]);
     _currentTurnFiles = [];
@@ -50,7 +46,6 @@ export function undo() {
   for (const { filePath, content } of turn.reverse()) {
     try {
       if (content === null) {
-        // File was created this turn — remove it
         import('fs').then(({ unlinkSync }) => { try { unlinkSync(filePath); } catch {} });
       } else {
         writeFileSync(filePath, content, 'utf8');
@@ -62,7 +57,7 @@ export function undo() {
 }
 export function undoStackSize() { return _undoTurns.length + (_currentTurnFiles.length > 0 ? 1 : 0); }
 
-// ── Session Context (set by index.js at startup) ──────────────────────────────
+// ── Session Context ───────────────────────────────────────────────────────────
 let _sessionDir = null;
 let _cwd = null;
 
@@ -71,6 +66,357 @@ export function setSession({ sessionDir, cwd }) {
   _cwd = cwd;
 }
 
+// ── TSUNAMI SECURITY LAYER ───────────────────────────────────────────────────
+
+// Permanently blocked — never executed regardless of context
+const BLOCKED_PATTERNS = [
+  /rm\s+-[^\s]*r[^\s]*\s+\/(?!\w)/,                    // rm -rf / (wipe root)
+  /:\s*\(\s*\)\s*\{.*\|.*&.*\}/,                        // fork bomb
+  /dd\s+if=.*of=\/dev\/(sd|nvme|hd)/,                   // disk wipe
+  /mkfs\./,                                              // format filesystem
+  />\s*\/dev\/(sd|nvme|hd)/,                            // write to raw disk
+  /chmod\s+-R\s+777\s+\//,                              // chmod 777 root
+  /curl[^|]*\|\s*(ba|z|da)?sh/,                         // curl pipe to shell
+  /wget[^|]*\|\s*(ba|z|da)?sh/,                         // wget pipe to shell
+  /\/dev\/tcp\//,                                        // bash TCP reverse shell
+  /\/dev\/udp\//,                                        // bash UDP reverse shell
+  /\bnc\b.*-e\s+\/bin\/(ba)?sh/,                       // netcat reverse shell
+  /\bncat\b.*-e\s+\/bin\/(ba)?sh/,                      // ncat reverse shell
+  /\bsocat\b.*exec:/i,                                   // socat reverse shell
+  /\bsudo\b/,                                            // privilege escalation
+  /chmod\s+\S*\+s\b/,                                    // SUID/SGID symbolic (u+s, g+s, a+s, etc.)
+  /chmod\s+[0-7]?[2-7][0-7]{3}\b/,                      // SUID/SGID octal (4755, 2755, 6755)
+  /\b(useradd|usermod|userdel|adduser|deluser)\b/,      // user account manipulation
+  /\bpasswd\b(?!\s+--status)/,                           // password change
+  /history\s+-[cw]/,                                     // clearing/writing bash history
+];
+
+// Destructive — require interactive confirmation
+const DESTRUCTIVE_PATTERNS = [
+  { pattern: /\brm\s+(-[^\s]*\s+)*-[^\s]*r/i,          label: 'recursive delete (rm -r)' },
+  { pattern: /git\s+reset\s+--hard/,                     label: 'git reset --hard' },
+  { pattern: /git\s+push\s+.*--force/,                   label: 'force push' },
+  { pattern: /git\s+push\s+-f\b/,                        label: 'force push (-f)' },
+  { pattern: /git\s+checkout\s+--\s+\./,                 label: 'git checkout -- . (discard all changes)' },
+  { pattern: /git\s+clean\s+-[^\s]*f/,                   label: 'git clean -f' },
+  { pattern: /git\s+branch\s+-D/,                        label: 'force delete branch' },
+  { pattern: /DROP\s+TABLE/i,                             label: 'DROP TABLE' },
+  { pattern: /DROP\s+DATABASE/i,                          label: 'DROP DATABASE' },
+  { pattern: /TRUNCATE\s+TABLE/i,                         label: 'TRUNCATE TABLE' },
+  { pattern: /pkill|killall/,                              label: 'kill processes' },
+  { pattern: /shutdown|reboot|halt/,                       label: 'system shutdown/reboot' },
+  { pattern: /^\s*(env|printenv|export\s+-p|set)\s*$/,    label: 'environment variable dump' },
+  { pattern: /\bnohup\b/,                                  label: 'background process (nohup)' },
+  { pattern: /\bdisown\b/,                                 label: 'process disown' },
+  { pattern: /(?<![&])[&]\s*$/,                            label: 'background process (&)' },
+  { pattern: /\bcrontab\s+-[^l]/,                          label: 'crontab modification (-e/-r/-u)' },
+  { pattern: /\b(at|batch)\s+/,                            label: 'scheduled command execution (at/batch)' },
+  { pattern: /\b(iptables|ip6tables|ufw|firewall-cmd)\b/,  label: 'firewall rule modification' },
+  { pattern: /\b(strace|ltrace|gdb|lldb)\b/,               label: 'process tracing/debugging' },
+  { pattern: /\b(scp|rsync)\b.*@[^:]+:/,                   label: 'outbound file transfer (scp/rsync to remote host)' },
+];
+
+// Paths always off-limits for read and write
+const BLOCKED_PATHS = [
+  '/etc/passwd', '/etc/shadow', '/etc/sudoers', '/etc/ssh',
+  '/root', '/proc', '/sys',
+  os.homedir() + '/.ssh',
+];
+const BLOCKED_EXTENSIONS = ['.pem', '.key', '.p12', '.pfx', '.cert', '.crt', '.sqlite', '.sqlite3', '.db'];
+const BLOCKED_FILENAMES = new Set([
+  '.env', '.npmrc', '.netrc', '.pgpass',
+  'id_rsa', 'id_ed25519', 'id_dsa', 'id_ecdsa',
+  'id_rsa.pub', 'id_ed25519.pub', 'id_dsa.pub', 'id_ecdsa.pub',
+  'authorized_keys', 'known_hosts',
+]);
+
+const WRITE_ROOT = process.cwd();
+const PROTECTED_DIRS = ['.git', '.vscode', '.husky', '.claude'];
+const AGENT_DIR = path.resolve(path.dirname(new URL(import.meta.url).pathname));
+
+const CREDENTIAL_PATTERNS = [
+  { pattern: /-----BEGIN (RSA |EC |OPENSSH )?PRIVATE KEY-----/i, label: 'private key' },
+  { pattern: /AKIA[0-9A-Z]{16}/,                                  label: 'AWS access key' },
+  { pattern: /ghp_[a-zA-Z0-9]{36}/,                               label: 'GitHub personal access token' },
+  { pattern: /ghs_[a-zA-Z0-9]{36}/,                               label: 'GitHub Actions token' },
+  { pattern: /sk-[a-zA-Z0-9]{48}/,                                label: 'OpenAI API key (legacy)' },
+  { pattern: /sk-proj-[a-zA-Z0-9\-_]{80,}/,                       label: 'OpenAI project API key' },
+  { pattern: /xox[baprs]-[a-zA-Z0-9\-]{10,}/,                     label: 'Slack token' },
+];
+
+const NETWORK_ALLOWLIST = [
+  /^https?:\/\/([a-z0-9-]+\.)*npmjs\.(com|org)/,
+  /^https?:\/\/([a-z0-9-]+\.)*github\.com/,
+  /^https?:\/\/([a-z0-9-]+\.)*githubusercontent\.com/,
+  /^https?:\/\/([a-z0-9-]+\.)*registry\.npmjs\.org/,
+  /^https?:\/\/([a-z0-9-]+\.)*pypi\.org/,
+  /^https?:\/\/([a-z0-9-]+\.)*python\.org/,
+  /^https?:\/\/localhost(:\d+)?(\/|$)/,
+  /^https?:\/\/127\.0\.0\.1(:\d+)?(\/|$)/,
+  /^https?:\/\/0\.0\.0\.0(:\d+)?(\/|$)/,
+];
+
+const RATE_LIMITS = {
+  Bash: 120, Write: 60, Edit: 60, Read: 200, Glob: 100, Grep: 100,
+  WebFetch: 20, WebSearch: 20, Agent: 10, Note: 100, Checkpoint: 100,
+  TodoWrite: 200, AskUser: 30, Kairos: 30,
+};
+const toolCallLog = new Map();
+
+const MAX_READ_BYTES = 10 * 1024 * 1024; // 10MB
+
+// ── Permission Mode ───────────────────────────────────────────────────────────
+// auto          — default: hard blocks + destructive prompts only
+// accept-edits  — auto-approve Write/Edit, destructive Bash still prompts
+// confirm-writes — prompt before every Write/Edit
+// confirm-all   — prompt before every Bash AND every Write/Edit
+// bypass        — skip ALL prompts; hard blocks still enforced
+// readonly      — Bash runs, Write/Edit blocked
+// plan          — Read/Glob/Grep only; Bash + Write/Edit blocked
+const TSUNAMI_MODE = (() => {
+  const m = (process.env.TSUNAMI_MODE || 'auto').toLowerCase();
+  const valid = ['auto', 'accept-edits', 'confirm-writes', 'confirm-all', 'bypass', 'readonly', 'plan'];
+  if (!valid.includes(m)) {
+    console.error(`[Tsunami Security] Unknown TSUNAMI_MODE "${m}" — defaulting to "auto". Valid: ${valid.join(', ')}`);
+    return 'auto';
+  }
+  if (m === 'bypass') console.warn('[Tsunami Security] ⚠️  BYPASS MODE — confirmations disabled. Hard blocks enforced.');
+  return m;
+})();
+
+// Commands that skip destructive confirmation: TSUNAMI_ALLOWED_COMMANDS=npm test,git log,git diff*
+const ALLOWED_COMMANDS = (process.env.TSUNAMI_ALLOWED_COMMANDS || '')
+  .split(',').map(s => s.trim()).filter(Boolean);
+
+function isCommandAllowed(command) {
+  if (ALLOWED_COMMANDS.length === 0) return false;
+  const cmd = command.trim();
+  return ALLOWED_COMMANDS.some(allowed => {
+    if (allowed.includes('*')) {
+      const re = new RegExp('^' + allowed.replace(/[.+?^${}()|[\]\\]/g, '\\$&').replace(/\*/g, '.*') + '$');
+      return re.test(cmd);
+    }
+    return cmd === allowed || cmd.startsWith(allowed + ' ') || cmd.startsWith(allowed + '\n');
+  });
+}
+
+// Restrict reads to specific roots: TSUNAMI_ALLOWED_PATHS=/path/one:/path/two
+const ALLOWED_READ_PATHS = process.env.TSUNAMI_ALLOWED_PATHS
+  ? process.env.TSUNAMI_ALLOWED_PATHS.split(':').map(p => path.resolve(p.trim())).filter(Boolean)
+  : null;
+
+// Disable tools entirely: TSUNAMI_DISABLED_TOOLS=Bash,Write
+const DISABLED_TOOLS = new Set(
+  (process.env.TSUNAMI_DISABLED_TOOLS || '').split(',').map(s => s.trim()).filter(Boolean)
+);
+
+// Circuit breaker — block Bash after N consecutive errors
+let consecutiveBashErrors = 0;
+const MAX_CONSECUTIVE_ERRORS = 5;
+
+// Audit log
+const AUDIT_LOG = path.join(os.homedir(), '.tsunami_audit.log');
+function audit(event, detail) {
+  try { appendFileSync(AUDIT_LOG, `[${new Date().toISOString()}] ${event}: ${String(detail).slice(0, 300)}\n`, 'utf8'); } catch {}
+}
+
+// Session block counter
+let sessionBlockCount = 0;
+const SESSION_BLOCK_THRESHOLD = 3;
+function recordBlock(message) {
+  sessionBlockCount++;
+  audit('BLOCKED', message);
+  if (sessionBlockCount >= SESSION_BLOCK_THRESHOLD) {
+    console.error(`[Tsunami Security] ⚠️  ALERT: ${sessionBlockCount} blocks this session. Review: ${AUDIT_LOG}`);
+  }
+  return message;
+}
+
+// Session write manifest
+const SESSION_MANIFEST = new Map();
+function recordWriteAudit(filePath, action, detail) {
+  const resolved = safeResolve(filePath);
+  SESSION_MANIFEST.set(resolved, { action, detail, timestamp: new Date().toISOString() });
+  audit('WRITE', `${action}: ${resolved}`);
+}
+export function getSessionManifest() {
+  if (SESSION_MANIFEST.size === 0) return 'No files written this session.';
+  const entries = [...SESSION_MANIFEST.entries()].map(
+    ([p, { action, detail, timestamp }]) => `  ${timestamp} [${action}] ${p} — ${detail}`
+  );
+  return `Session write manifest (${SESSION_MANIFEST.size} file(s)):\n${entries.join('\n')}`;
+}
+
+// Rate limiter
+function checkRateLimit(toolName) {
+  const now = Date.now();
+  const log = toolCallLog.get(toolName) || [];
+  const recent = log.filter(t => now - t < 60_000);
+  recent.push(now);
+  toolCallLog.set(toolName, recent);
+  const limit = RATE_LIMITS[toolName];
+  if (limit && recent.length > limit) {
+    return recordBlock(`[Tsunami Security] BLOCKED: Rate limit exceeded for ${toolName} — ${recent.length}/${limit} calls/60s.`);
+  }
+  return null;
+}
+
+// Symlink-safe path resolution
+function safeResolve(filePath) {
+  const abs = path.resolve(filePath);
+  try { return realpathSync(abs); } catch {}
+  try {
+    const s = lstatSync(abs);
+    if (s.isSymbolicLink()) return path.resolve(path.dirname(abs), readlinkSync(abs));
+  } catch {}
+  try { return path.join(realpathSync(path.dirname(abs)), path.basename(abs)); } catch {}
+  return abs;
+}
+
+function isBlockedPath(filePath) {
+  const resolved = safeResolve(filePath);
+  if (BLOCKED_PATHS.some(bp => resolved === bp || resolved.startsWith(bp + '/'))) return true;
+  if (BLOCKED_EXTENSIONS.some(ext => resolved.endsWith(ext))) return true;
+  if (BLOCKED_FILENAMES.has(path.basename(resolved))) return true;
+  return false;
+}
+
+function isOutsideWorkdir(filePath) {
+  const resolved = safeResolve(filePath);
+  return !resolved.startsWith(WRITE_ROOT + path.sep) && resolved !== WRITE_ROOT;
+}
+
+function isProtectedDir(filePath) {
+  const resolved = safeResolve(filePath);
+  const parts = path.relative(WRITE_ROOT, resolved).split(path.sep);
+  return PROTECTED_DIRS.some(d => parts[0] === d);
+}
+
+function isSelfModification(filePath) {
+  const resolved = safeResolve(filePath);
+  return resolved.startsWith(AGENT_DIR + path.sep) || resolved === AGENT_DIR;
+}
+
+function isSearchPathBlocked(searchPath) {
+  if (!searchPath) return null;
+  const resolved = safeResolve(searchPath);
+  if (resolved === '/') return 'filesystem root scan is not permitted';
+  if (BLOCKED_PATHS.some(bp => resolved === bp || resolved.startsWith(bp + '/')))
+    return `search path "${resolved}" is in a blocked directory`;
+  if (path.isAbsolute(searchPath) && !resolved.startsWith(WRITE_ROOT))
+    return `search path "${resolved}" is outside the working directory (${WRITE_ROOT})`;
+  return null;
+}
+
+function isReadPathAllowed(filePath) {
+  if (!ALLOWED_READ_PATHS) return true;
+  const resolved = safeResolve(filePath);
+  return ALLOWED_READ_PATHS.some(a => resolved === a || resolved.startsWith(a + path.sep));
+}
+
+function checkDisabled(toolName) {
+  if (DISABLED_TOOLS.has(toolName)) return recordBlock(`[Tsunami Security] BLOCKED: "${toolName}" is disabled via TSUNAMI_DISABLED_TOOLS.`);
+  return null;
+}
+
+// Redirect safety
+const SAFE_REDIRECT_TARGETS = ['/dev/null', '/dev/stderr', '/dev/stdout', '/dev/stdin'];
+function expandTilde(s) { return s.replace(/(^|(?<=[^a-zA-Z0-9]))~(?=\/|$)/g, os.homedir()); }
+
+function hasDangerousRedirect(command) {
+  const expanded = expandTilde(command);
+  for (const match of expanded.matchAll(/>>?\s*(\/[^\s"';&|)]+)/g)) {
+    const target = match[1];
+    if (SAFE_REDIRECT_TARGETS.includes(target)) continue;
+    if (!target.startsWith(WRITE_ROOT + '/') && target !== WRITE_ROOT) return target;
+  }
+  for (const match of expanded.matchAll(/\|\s*tee\s+(.*)/g)) {
+    const pathArg = match[1].trim().split(/\s+/).find(a => a.startsWith('/'));
+    if (!pathArg || SAFE_REDIRECT_TARGETS.includes(pathArg)) continue;
+    if (!pathArg.startsWith(WRITE_ROOT + '/') && pathArg !== WRITE_ROOT) return pathArg;
+  }
+  return null;
+}
+
+function hasBlockedNetworkCall(command) {
+  for (const [url] of command.matchAll(/https?:\/\/[^\s"';&|)\]]+/g)) {
+    if (!NETWORK_ALLOWLIST.some(p => p.test(url))) return url;
+  }
+  return null;
+}
+
+function hasNullByte(str) { return str.includes('\0'); }
+
+function deobfuscate(command) {
+  let decoded = command;
+  const b64 = decoded.match(/base64\s+-d\s*(?:<<<?\s*["']?([A-Za-z0-9+/=]{10,})["']?)/);
+  if (b64?.[1]) { try { decoded = Buffer.from(b64[1], 'base64').toString('utf8'); } catch {} }
+  decoded = decoded.replace(/\\x([0-9a-fA-F]{2})/g, (_, h) => String.fromCharCode(parseInt(h, 16)));
+  decoded = decoded.replace(/([a-zA-Z])'{2}([a-zA-Z])/g, '$1$2').replace(/([a-zA-Z])"{2}([a-zA-Z])/g, '$1$2');
+  return decoded;
+}
+
+function extractNestedCommands(command) {
+  const nested = [];
+  for (const m of command.matchAll(/\b(?:bash|sh|zsh|dash)\s+-c\s+(?:"((?:[^"\\]|\\.)*)"|'((?:[^'\\]|\\.)*)')/gs)) {
+    const inner = (m[1] || m[2] || '').replace(/\\(.)/g, '$1');
+    if (inner) { nested.push(inner); nested.push(deobfuscate(inner)); }
+  }
+  for (const m of command.matchAll(/\b(?:python3?|node|ruby|perl)\s+-[ce]\s+(?:"((?:[^"\\]|\\.)*)"|'((?:[^'\\]|\\.)*)')/gs)) {
+    const inner = (m[1] || m[2] || '').replace(/\\(.)/g, '$1');
+    if (inner) nested.push(inner);
+  }
+  return nested;
+}
+
+const INJECTION_PATTERNS = [
+  /ignore\s+(all\s+)?(previous|above|prior)\s+instructions/i,
+  /disregard\s+(your\s+)?system\s+prompt/i,
+  /you\s+are\s+now\s+(a\s+)?different/i,
+  /jailbreak/i,
+  /<\s*system\s*>/i,
+];
+function checkPromptInjection(text) { return INJECTION_PATTERNS.some(p => p.test(text)); }
+
+function scrubSecrets(output) {
+  let s = output;
+  for (const { pattern, label } of CREDENTIAL_PATTERNS) {
+    const gp = new RegExp(pattern.source, pattern.flags.includes('g') ? pattern.flags : pattern.flags + 'g');
+    s = s.replace(gp, `[REDACTED:${label}]`);
+  }
+  return s;
+}
+
+async function confirmDestructive(label, command) {
+  const rl = readline.createInterface({ input: process.stdin, output: process.stdout });
+  return new Promise(resolve => {
+    rl.question(
+      `\n[Tsunami Security] DESTRUCTIVE OPERATION DETECTED\nType: ${label}\nCommand: ${command.slice(0, 150)}\nAllow? (yes/no): `,
+      answer => {
+        rl.close();
+        const allowed = answer.trim().toLowerCase() === 'yes';
+        audit(allowed ? 'DESTRUCTIVE_CONFIRMED' : 'DESTRUCTIVE_DENIED', `${label} | ${command.slice(0, 200)}`);
+        resolve(allowed);
+      }
+    );
+  });
+}
+
+async function confirmAction(toolName, detail) {
+  const rl = readline.createInterface({ input: process.stdin, output: process.stdout });
+  return new Promise(resolve => {
+    rl.question(
+      `\n[Tsunami Security] Confirmation required (TSUNAMI_MODE=${TSUNAMI_MODE})\nTool: ${toolName}\nDetail: ${detail.slice(0, 150)}\nAllow? (yes/no): `,
+      answer => {
+        rl.close();
+        const allowed = answer.trim().toLowerCase() === 'yes';
+        audit(allowed ? 'CONFIRM_ALLOWED' : 'CONFIRM_DENIED', `${toolName} | ${detail.slice(0, 200)}`);
+        resolve(allowed);
+      }
+    );
+  });
+}
+
 // ── BASH ──────────────────────────────────────────────────────────────────────
 export const BashTool = {
   name: 'Bash',
@@ -91,6 +437,75 @@ IMPORTANT: Never use for grep/find/cat/head/tail/sed/awk — use Read, Grep, Glo
     required: ['command']
   },
   async run({ command, timeout = 120000 }) {
+    const rateLimitError = checkRateLimit('Bash');
+    if (rateLimitError) return rateLimitError;
+
+    const disabledError = checkDisabled('Bash');
+    if (disabledError) return disabledError;
+
+    if (TSUNAMI_MODE === 'plan') return recordBlock(`[Tsunami Security] BLOCKED: Bash is disabled in plan mode. Use Read/Glob/Grep only.`);
+
+    if (consecutiveBashErrors >= MAX_CONSECUTIVE_ERRORS) {
+      return recordBlock(`[Tsunami Security] BLOCKED: Circuit breaker tripped after ${consecutiveBashErrors} consecutive errors. Possible attack loop. Restart session to reset.`);
+    }
+
+    const MAX_CMD_LENGTH = 10 * 1024;
+    if (command.length > MAX_CMD_LENGTH) return recordBlock(`[Tsunami Security] BLOCKED: Command too long (${command.length} chars). Possible injection payload.`);
+    if (hasNullByte(command)) return recordBlock(`[Tsunami Security] BLOCKED: Null bytes in command — possible injection attempt.`);
+
+    const decoded = deobfuscate(command);
+    const isObfuscated = decoded !== command;
+    const tildeExpanded = expandTilde(command);
+    const nested = extractNestedCommands(command);
+    const variants = [...new Set([command, decoded, tildeExpanded, ...nested])].filter(Boolean);
+
+    // Pass 1: hard blocks — always rejected, no prompts
+    for (const variant of variants) {
+      for (const pattern of BLOCKED_PATTERNS) {
+        if (pattern.test(variant)) {
+          return recordBlock(`[Tsunami Security] BLOCKED: ${isObfuscated ? 'Obfuscated ' : ''}blocked command pattern.\nCommand: ${command.slice(0, 200)}`);
+        }
+      }
+      if (checkPromptInjection(variant)) {
+        return recordBlock(`[Tsunami Security] BLOCKED: Prompt injection detected${isObfuscated ? ' after deobfuscation' : ''}.`);
+      }
+    }
+
+    // confirm-all: prompt once before destructive checks
+    const skipAllConfirms = TSUNAMI_MODE === 'bypass';
+    const skipDestructiveConfirm = skipAllConfirms || isCommandAllowed(command);
+    let alreadyConfirmed = skipAllConfirms;
+
+    if (!alreadyConfirmed && TSUNAMI_MODE === 'confirm-all') {
+      const allowed = await confirmAction('Bash', command);
+      if (!allowed) return recordBlock(`[Tsunami Security] Cancelled by user (confirm-all mode).`);
+      alreadyConfirmed = true;
+    }
+
+    // Pass 2: destructive checks — prompt once across all variants
+    for (const variant of variants) {
+      for (const { pattern, label } of DESTRUCTIVE_PATTERNS) {
+        if (pattern.test(variant)) {
+          if (!alreadyConfirmed && !skipDestructiveConfirm) {
+            const allowed = await confirmDestructive(isObfuscated ? `${label} (detected after deobfuscation)` : label, command);
+            if (!allowed) return recordBlock(`[Tsunami Security] Cancelled by user: ${label}`);
+          }
+          alreadyConfirmed = true;
+          break;
+        }
+      }
+    }
+
+    const dangerousTarget = hasDangerousRedirect(command);
+    if (dangerousTarget) {
+      return recordBlock(`[Tsunami Security] BLOCKED: Redirect to path outside working directory.\nTarget: ${dangerousTarget}\nWorkdir: ${WRITE_ROOT}`);
+    }
+
+    const blockedUrl = hasBlockedNetworkCall(command);
+    if (blockedUrl) {
+      return recordBlock(`[Tsunami Security] BLOCKED: Network call to non-allowlisted domain.\nURL: ${blockedUrl}`);
+    }
+
     try {
       const shell = process.platform === 'win32' ? undefined : '/bin/bash';
       const { stdout, stderr } = await execAsync(command, {
@@ -98,10 +513,15 @@ IMPORTANT: Never use for grep/find/cat/head/tail/sed/awk — use Read, Grep, Glo
         maxBuffer: 10 * 1024 * 1024,
         shell
       });
-      const out = stdout || '';
-      const err = stderr ? `\nSTDERR: ${stderr}` : '';
-      return (out + err).trim() || '(no output)';
+      let result = ((stdout || '') + (stderr ? `\nSTDERR: ${stderr}` : '')).trim() || '(no output)';
+      result = scrubSecrets(result);
+      const MAX_OUTPUT = 50 * 1024;
+      if (result.length > MAX_OUTPUT) result = result.slice(0, MAX_OUTPUT) + `\n\n[Tsunami Security] Output truncated at 50KB`;
+      if (checkPromptInjection(result)) return `[Tsunami Security Warning] Output may contain prompt injection.\n\n${result}`;
+      consecutiveBashErrors = 0;
+      return result;
     } catch (e) {
+      consecutiveBashErrors++;
       if (e.killed) return `Error: Command timed out after ${timeout}ms`;
       return `Error (exit ${e.code}): ${e.message}\n${e.stderr || ''}`.trim();
     }
@@ -126,12 +546,31 @@ export const ReadTool = {
     required: ['file_path']
   },
   async run({ file_path, offset = 0, limit = 2000 }) {
+    const rateLimitError = checkRateLimit('Read');
+    if (rateLimitError) return rateLimitError;
+
+    const disabledError = checkDisabled('Read');
+    if (disabledError) return disabledError;
+
+    if (isBlockedPath(file_path)) return recordBlock(`[Tsunami Security] BLOCKED: Access to "${file_path}" is not permitted.`);
+    if (!isReadPathAllowed(file_path)) return recordBlock(`[Tsunami Security] BLOCKED: "${safeResolve(file_path)}" is outside allowed read paths.`);
     if (!existsSync(file_path)) return `Error: File not found: ${file_path}`;
+
+    try {
+      const fileStat = statSync(file_path);
+      if (fileStat.size > MAX_READ_BYTES) {
+        return `Error: File too large (${(fileStat.size / 1024 / 1024).toFixed(1)}MB, limit 10MB). Use offset/limit or Grep.`;
+      }
+    } catch {}
+
     try {
       const content = readFileSync(file_path, 'utf8');
+      if (checkPromptInjection(content)) {
+        console.error(`[Tsunami Security Warning] File "${file_path}" may contain prompt injection content.`);
+      }
       const lines = content.split('\n');
-      const slice = lines.slice(offset, offset + limit);
-      return slice.map((l, i) => `${offset + i + 1}\t${l}`).join('\n');
+      let output = lines.slice(offset, offset + limit).map((l, i) => `${offset + i + 1}\t${l}`).join('\n');
+      return scrubSecrets(output);
     } catch (e) {
       return `Error reading file: ${e.message}`;
     }
@@ -151,6 +590,26 @@ export const WriteTool = {
     required: ['file_path', 'content']
   },
   async run({ file_path, content }) {
+    const rateLimitError = checkRateLimit('Write');
+    if (rateLimitError) return rateLimitError;
+
+    const disabledError = checkDisabled('Write');
+    if (disabledError) return disabledError;
+
+    if (TSUNAMI_MODE === 'readonly' || TSUNAMI_MODE === 'plan') return recordBlock(`[Tsunami Security] BLOCKED: Write operations are disabled (TSUNAMI_MODE=${TSUNAMI_MODE}).`);
+    if (isSelfModification(file_path)) return recordBlock(`[Tsunami Security] BLOCKED: Writing to the agent security layer is not permitted.\nPath: ${safeResolve(file_path)}`);
+    if (isBlockedPath(file_path)) return recordBlock(`[Tsunami Security] BLOCKED: Writing to "${file_path}" is not permitted.`);
+    if (isOutsideWorkdir(file_path)) return recordBlock(`[Tsunami Security] BLOCKED: Writing outside working directory.\nPath: ${safeResolve(file_path)}\nWorkdir: ${WRITE_ROOT}`);
+    if (isProtectedDir(file_path)) return recordBlock(`[Tsunami Security] BLOCKED: Writing to protected directory.\nPath: ${safeResolve(file_path)}`);
+    for (const { pattern, label } of CREDENTIAL_PATTERNS) {
+      if (pattern.test(content)) return recordBlock(`[Tsunami Security] BLOCKED: Content contains a ${label}. Writing credentials to disk is not permitted.`);
+    }
+
+    if ((TSUNAMI_MODE === 'confirm-writes' || TSUNAMI_MODE === 'confirm-all') && TSUNAMI_MODE !== 'bypass') {
+      const allowed = await confirmAction('Write', file_path);
+      if (!allowed) return recordBlock(`[Tsunami Security] Cancelled by user (${TSUNAMI_MODE} mode).`);
+    }
+
     try {
       _pushFileSnapshot(file_path);
       const newLineCount = content.split('\n').length;
@@ -158,6 +617,7 @@ export const WriteTool = {
       writeFileSync(file_path, content, 'utf8');
       linesChanged.added += Math.max(0, newLineCount - oldLineCount);
       linesChanged.removed += Math.max(0, oldLineCount - newLineCount);
+      recordWriteAudit(file_path, 'Write', `${newLineCount} lines`);
       return `Written ${newLineCount} lines to ${file_path}`;
     } catch (e) {
       return `Error writing file: ${e.message}`;
@@ -184,7 +644,19 @@ export const EditTool = {
     required: ['file_path', 'old_string', 'new_string']
   },
   async run({ file_path, old_string, new_string, replace_all = false }) {
+    const rateLimitError = checkRateLimit('Edit');
+    if (rateLimitError) return rateLimitError;
+
+    const disabledError = checkDisabled('Edit');
+    if (disabledError) return disabledError;
+
+    if (TSUNAMI_MODE === 'readonly' || TSUNAMI_MODE === 'plan') return recordBlock(`[Tsunami Security] BLOCKED: Edit operations are disabled (TSUNAMI_MODE=${TSUNAMI_MODE}).`);
+    if (isSelfModification(file_path)) return recordBlock(`[Tsunami Security] BLOCKED: Editing the agent security layer is not permitted.\nPath: ${safeResolve(file_path)}`);
+    if (isBlockedPath(file_path)) return recordBlock(`[Tsunami Security] BLOCKED: Editing "${file_path}" is not permitted.`);
+    if (isOutsideWorkdir(file_path)) return recordBlock(`[Tsunami Security] BLOCKED: Editing outside working directory.\nPath: ${safeResolve(file_path)}\nWorkdir: ${WRITE_ROOT}`);
+    if (isProtectedDir(file_path)) return recordBlock(`[Tsunami Security] BLOCKED: Editing protected directory.\nPath: ${safeResolve(file_path)}`);
     if (!existsSync(file_path)) return `Error: File not found: ${file_path}`;
+
     try {
       let content = readFileSync(file_path, 'utf8');
       _pushFileSnapshot(file_path);
@@ -193,13 +665,17 @@ export const EditTool = {
         const count = content.split(old_string).length - 1;
         if (count > 1) return `Error: old_string appears ${count} times — use replace_all or add more context to make it unique`;
       }
-      const updated = replace_all
-        ? content.split(old_string).join(new_string)
-        : content.replace(old_string, new_string);
+      const updated = replace_all ? content.split(old_string).join(new_string) : content.replace(old_string, new_string);
+
+      if ((TSUNAMI_MODE === 'confirm-writes' || TSUNAMI_MODE === 'confirm-all') && TSUNAMI_MODE !== 'bypass') {
+        const allowed = await confirmAction('Edit', file_path);
+        if (!allowed) return recordBlock(`[Tsunami Security] Cancelled by user (${TSUNAMI_MODE} mode).`);
+      }
+
       writeFileSync(file_path, updated, 'utf8');
-      // Track lines changed: old_string lines removed, new_string lines added
       linesChanged.added += new_string.split('\n').length;
       linesChanged.removed += old_string.split('\n').length;
+      recordWriteAudit(file_path, 'Edit', replace_all ? 'replace_all' : '1 replacement');
       return `Edited ${file_path}`;
     } catch (e) {
       return `Error editing file: ${e.message}`;
@@ -223,6 +699,17 @@ export const GlobTool = {
     required: ['pattern']
   },
   async run({ pattern, path: searchPath }) {
+    const rateLimitError = checkRateLimit('Glob');
+    if (rateLimitError) return rateLimitError;
+
+    const disabledError = checkDisabled('Glob');
+    if (disabledError) return disabledError;
+
+    if (searchPath && !isReadPathAllowed(searchPath)) return recordBlock(`[Tsunami Security] BLOCKED: Glob path "${safeResolve(searchPath)}" is outside allowed read paths.`);
+
+    const pathBlock = isSearchPathBlocked(searchPath);
+    if (pathBlock) return recordBlock(`[Tsunami Security] BLOCKED: Glob search blocked — ${pathBlock}`);
+
     try {
       const cwd = searchPath || process.cwd();
       const matches = await glob(pattern, { cwd, absolute: true });
@@ -255,18 +742,31 @@ export const GrepTool = {
     required: ['pattern']
   },
   async run({ pattern, path: searchPath = '.', glob: globFilter, output_mode = 'files_with_matches', '-i': caseInsensitive, '-C': context, head_limit = 250 }) {
+    const rateLimitError = checkRateLimit('Grep');
+    if (rateLimitError) return rateLimitError;
+
+    const disabledError = checkDisabled('Grep');
+    if (disabledError) return disabledError;
+
+    if (searchPath !== '.' && !isReadPathAllowed(searchPath)) return recordBlock(`[Tsunami Security] BLOCKED: Grep path "${safeResolve(searchPath)}" is outside allowed read paths.`);
+
+    const pathBlock = isSearchPathBlocked(searchPath === '.' ? null : searchPath);
+    if (pathBlock) return recordBlock(`[Tsunami Security] BLOCKED: Grep search blocked — ${pathBlock}`);
+
+    if (hasNullByte(pattern)) return recordBlock(`[Tsunami Security] BLOCKED: Grep pattern contains null bytes.`);
+
     const rgPath = getRgPath();
     if (!rgPath) return 'Error: ripgrep not available — install with: brew install ripgrep or apt install ripgrep';
     try {
       const rgBin = JSON.stringify(rgPath);
       let cmd = rgBin;
       if (caseInsensitive) cmd += ' -i';
-      if (context) cmd += ` -C ${context}`;
+      if (context) cmd += ` -C ${Number(context)}`;
       if (globFilter) cmd += ` --glob ${JSON.stringify(globFilter)}`;
       if (output_mode === 'files_with_matches') cmd += ' -l';
       else if (output_mode === 'count') cmd += ' --count';
       else cmd += ' -n';
-      cmd += ` ${JSON.stringify(pattern)} ${JSON.stringify(searchPath)}`;
+      cmd += ` -- ${JSON.stringify(pattern)} ${JSON.stringify(searchPath)}`;
       const { stdout } = await execAsync(cmd, { maxBuffer: 10 * 1024 * 1024 });
       const lines = stdout.trim().split('\n').filter(Boolean);
       return lines.slice(0, head_limit).join('\n') || 'No matches found';
@@ -299,21 +799,14 @@ Set file_path to null for project-wide notes (written to CODEBASE.md).`,
   input_schema: {
     type: 'object',
     properties: {
-      file_path: {
-        type: ['string', 'null'],
-        description: 'Absolute path to the file this note is about. null for project-wide notes.'
-      },
-      note: {
-        type: 'string',
-        description: 'The note content. Be specific and concrete — future sessions depend on this.'
-      }
+      file_path: { type: ['string', 'null'], description: 'Absolute path to the file this note is about. null for project-wide notes.' },
+      note: { type: 'string', description: 'The note content. Be specific and concrete — future sessions depend on this.' }
     },
     required: ['note']
   },
   async run({ file_path, note }) {
     try {
       if (!_cwd) return 'Note saved (no project memory initialized yet)';
-      // Normalize: model sometimes passes "null" or "undefined" as a string
       const fp = (!file_path || file_path === 'null' || file_path === 'undefined') ? null : file_path;
       addFileNote(_cwd, fp, note);
       return `Note saved to project memory${file_path ? ` for ${file_path}` : ' (CODEBASE.md)'}.`;
@@ -347,10 +840,7 @@ EXAMPLE:
   input_schema: {
     type: 'object',
     properties: {
-      content: {
-        type: 'string',
-        description: 'Task progress summary: what was done, what is next, key context.'
-      }
+      content: { type: 'string', description: 'Task progress summary: what was done, what is next, key context.' }
     },
     required: ['content']
   },
@@ -383,29 +873,26 @@ export const WebFetchTool = {
     required: ['url']
   },
   async run({ url, prompt: _prompt }) {
+    const rateLimitError = checkRateLimit('WebFetch');
+    if (rateLimitError) return rateLimitError;
+
     try {
       const controller = new AbortController();
       const timer = setTimeout(() => controller.abort(), 15000);
       const res = await fetch(url, {
         signal: controller.signal,
-        headers: { 'User-Agent': 'Mozilla/5.0 (compatible; TsunamiCode/2.9)' }
+        headers: { 'User-Agent': 'Mozilla/5.0 (compatible; TsunamiCode/3.11)' }
       });
       clearTimeout(timer);
       if (!res.ok) return `Error: HTTP ${res.status} ${res.statusText}`;
       const raw = await res.text();
-      // Strip HTML tags, collapse whitespace
       const text = raw
         .replace(/<script[\s\S]*?<\/script>/gi, '')
         .replace(/<style[\s\S]*?<\/style>/gi, '')
         .replace(/<[^>]+>/g, ' ')
-        .replace(/&nbsp;/g, ' ')
-        .replace(/&amp;/g, '&')
-        .replace(/&lt;/g, '<')
-        .replace(/&gt;/g, '>')
-        .replace(/&quot;/g, '"')
-        .replace(/\s{3,}/g, '\n\n')
-        .trim();
-      return text.slice(0, 50000) + (text.length > 50000 ? '\n\n[truncated]' : '');
+        .replace(/&nbsp;/g, ' ').replace(/&amp;/g, '&').replace(/&lt;/g, '<').replace(/&gt;/g, '>').replace(/&quot;/g, '"')
+        .replace(/\s{3,}/g, '\n\n').trim();
+      return scrubSecrets(text.slice(0, 50000) + (text.length > 50000 ? '\n\n[truncated]' : ''));
     } catch (e) {
       if (e.name === 'AbortError') return 'Error: Request timed out after 15s';
       return `Error fetching URL: ${e.message}`;
@@ -414,7 +901,6 @@ export const WebFetchTool = {
 };
 
 // ── TODO WRITE ────────────────────────────────────────────────────────────────
-// In-memory todo list — persists for the session, visible to the model
 const _todos = [];
 let _todoId = 0;
 
@@ -458,7 +944,6 @@ The list is shown to the user after every update.`,
       if (idx === -1) return `Error: todo #${id} not found`;
       _todos.splice(idx, 1);
     }
-    // Always return current list
     if (_todos.length === 0) return 'Todo list is empty.';
     const icons = { pending: '○', in_progress: '◉', done: '✓' };
     return _todos.map(t => `${icons[t.status] || '○'} [${t.id}] ${t.text}`).join('\n');
@@ -466,7 +951,6 @@ The list is shown to the user after every update.`,
 };
 
 // ── ASK USER ──────────────────────────────────────────────────────────────────
-// This tool is a signal — the agent loop in index.js intercepts it and prompts the user
 export const AskUserTool = {
   name: 'AskUser',
   description: `Ask the user a clarifying question and wait for their answer. Use this when you are genuinely blocked and need input that cannot be inferred.
@@ -488,8 +972,6 @@ Do NOT use for:
     required: ['question']
   },
   async run({ question }) {
-    // The agent loop intercepts this and handles the actual prompt.
-    // Return value here is fallback only.
     return `[AskUser] ${question}`;
   }
 };
@@ -509,6 +991,9 @@ Returns titles, URLs, and snippets for the top results. Follow up with WebFetch
     required: ['query']
   },
   async run({ query, num_results = 8 }) {
+    const rateLimitError = checkRateLimit('WebSearch');
+    if (rateLimitError) return rateLimitError;
+
     try {
       const n = Math.min(num_results, 20);
       const url = `https://html.duckduckgo.com/html/?q=${encodeURIComponent(query)}`;
@@ -516,37 +1001,23 @@ Returns titles, URLs, and snippets for the top results. Follow up with WebFetch
       const timer = setTimeout(() => controller.abort(), 12000);
       const res = await fetch(url, {
         signal: controller.signal,
-        headers: {
-          'User-Agent': 'Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36',
-          'Accept': 'text/html'
-        }
+        headers: { 'User-Agent': 'Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36', 'Accept': 'text/html' }
       });
       clearTimeout(timer);
       if (!res.ok) return `Error: HTTP ${res.status}`;
       const html = await res.text();
-
-      // Parse results from DuckDuckGo HTML
       const results = [];
       const resultBlocks = html.match(/<div class="result[^"]*"[\s\S]*?<\/div>\s*<\/div>/g) || [];
       for (const block of resultBlocks.slice(0, n)) {
         const titleMatch = block.match(/<a[^>]+class="result__a"[^>]*>([\s\S]*?)<\/a>/);
         const urlMatch = block.match(/href="([^"]+)"/);
         const snippetMatch = block.match(/<a[^>]+class="result__snippet"[^>]*>([\s\S]*?)<\/a>/);
-
         const title = titleMatch ? titleMatch[1].replace(/<[^>]+>/g, '').trim() : '';
         const href = urlMatch ? urlMatch[1] : '';
         const snippet = snippetMatch ? snippetMatch[1].replace(/<[^>]+>/g, '').trim() : '';
-
-        // DuckDuckGo uses redirect URLs — extract the actual URL
-        const actualUrl = href.includes('uddg=')
-          ? decodeURIComponent(href.match(/uddg=([^&]+)/)?.[1] || href)
-          : href;
-
-        if (title && actualUrl) {
-          results.push(`${results.length + 1}. ${title}\n   ${actualUrl}\n   ${snippet}`);
-        }
+        const actualUrl = href.includes('uddg=') ? decodeURIComponent(href.match(/uddg=([^&]+)/)?.[1] || href) : href;
+        if (title && actualUrl) results.push(`${results.length + 1}. ${title}\n   ${actualUrl}\n   ${snippet}`);
       }
-
       if (results.length === 0) return `No results found for: ${query}`;
       return `Search results for "${query}":\n\n${results.join('\n\n')}`;
     } catch (e) {
@@ -557,7 +1028,6 @@ Returns titles, URLs, and snippets for the top results. Follow up with WebFetch
 };
 
 // ── AGENT TOOL ────────────────────────────────────────────────────────────────
-// Circular import prevention — agentLoop is injected at runtime by loop.js
 let _agentLoopRef = null;
 export function injectAgentLoop(fn) { _agentLoopRef = fn; }
 
@@ -582,6 +1052,9 @@ IMPORTANT: You can call Agent multiple times in one response to run tasks truly
     required: ['task']
   },
   async run({ task, serverUrl }) {
+    const rateLimitError = checkRateLimit('Agent');
+    if (rateLimitError) return rateLimitError;
+
     if (!_agentLoopRef) return 'Error: AgentTool not initialized (no agent loop reference)';
     if (!_currentServerUrl) return 'Error: AgentTool not initialized (no server URL)';
 
@@ -592,30 +1065,18 @@ IMPORTANT: You can call Agent multiple times in one response to run tasks truly
     ];
 
     const outputTokens = [];
-    let done = false;
     try {
-      await _agentLoopRef(
-        url,
-        subMessages,
-        (token) => { outputTokens.push(token); },
-        () => {}, // tool call display — silent in sub-agent
-        null, // no session info for sub-agents
-        null, // no confirm callback
-        10    // max iterations
-      );
-      done = true;
+      await _agentLoopRef(url, subMessages, (token) => { outputTokens.push(token); }, () => {}, null, null, 10);
     } catch (e) {
       return `Sub-agent error: ${e.message}`;
     }
 
-    // Find the last assistant message as the result
     const lastAssistant = [...subMessages].reverse().find(m => m.role === 'assistant');
     const result = lastAssistant?.content || outputTokens.join('');
     return `[Sub-agent result]\n${String(result).slice(0, 6000)}`;
   }
 };
 
-// Server URL + system prompt injected by loop.js at startup
 let _currentServerUrl = null;
 let _agentSystemPrompt = null;
 export function injectServerContext(serverUrl, systemPrompt) {
@@ -624,8 +1085,6 @@ export function injectServerContext(serverUrl, systemPrompt) {
 }
 
 // ── SNIP TOOL ─────────────────────────────────────────────────────────────────
-// The model calls this to surgically remove specific turns from context
-// loop.js handles the actual splice — this is a signal tool
 export const SnipTool = {
   name: 'Snip',
   description: `Remove specific conversation turns from context to free up space, without losing the whole conversation like /compact does.
@@ -640,17 +1099,12 @@ Use /status to see current message count, then pick which to snip.`,
   input_schema: {
     type: 'object',
     properties: {
-      indices: {
-        type: 'array',
-        items: { type: 'number' },
-        description: 'Array of 0-based message indices to remove from context'
-      },
+      indices: { type: 'array', items: { type: 'number' }, description: 'Array of 0-based message indices to remove from context' },
       reason: { type: 'string', description: 'Why you are snipping these (logged for transparency)' }
     },
     required: ['indices']
   },
   async run({ indices, reason }) {
-    // Actual snipping happens in agentLoop — this signals intent
     return JSON.stringify({ __snip__: true, indices, reason: reason || 'context management' });
   }
 };
@@ -674,7 +1128,6 @@ Example:
   async run({ content }) {
     try {
       if (!_sessionDir) return 'Brief recorded (no session initialized)';
-      // Reuse checkpoint mechanism — both go to session context
       updateContext(_sessionDir, `[BRIEF]\n${content}`);
       return 'Brief saved to working memory.';
     } catch (e) {
@@ -722,13 +1175,8 @@ export const ALL_TOOLS = [
   KairosTool
 ];
 
-/**
- * Register MCP tool objects into the live tool list.
- * Called after MCP servers connect so the agent loop sees them immediately.
- */
 export function registerMcpTools(mcpToolObjects) {
   for (const tool of mcpToolObjects) {
-    // Don't double-register if reconnecting
     if (!ALL_TOOLS.find(t => t.name === tool.name)) {
       ALL_TOOLS.push(tool);
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "tsunami-code",
-  "version": "3.12.1",
+  "version": "3.12.2",
   "description": "Tsunami Code CLI — AI coding agent by Keystone World Management Navy Seal Unit XI3",
   "type": "module",
   "bin": {