vigthoria-cli 1.13.18 → 1.13.22

package/dist/utils/tools.js

@@ -15,18 +15,22 @@
  */
 import * as fs from 'fs';
 import * as path from 'path';
-import { execSync, spawn } from 'child_process';
+import { execFileSync, spawn } from 'child_process';
 import { createRequire } from 'node:module';
+import { fileURLToPath } from 'node:url';
 import chalk from 'chalk';
 // ESM shim — re-create CommonJS-style `require()` so the inline
 // `require('os')` / `require('minimatch')` / `require('glob')` calls
 // inside lazy code paths continue to work unchanged in ESM mode.
 const require = createRequire(import.meta.url);
 import { CH } from './logger.js';
-import { isServerRuntime } from './api.js';
+import { assertContainedAbsolutePath } from './workspace-boundary.js';
+import { assertProcessNetworkAllowed, buildApprovalScope, hardenGitArguments, parseGitArguments, parseSupportedProcess, safeGitEnvironment, } from './process-policy.js';
+import { containsHighConfidenceSecret, isSensitivePath, safeChildProcessEnv } from './secret-policy.js';
+import { isOfflineNetworkMode } from './network-policy.js';
+import { ToolApprovalService } from './tool-approval-service.js';
+import { DelegationToolProvider, FilesystemToolProvider, NetworkBrowserToolProvider, ProcessToolProvider, RepositoryToolProvider, SearchToolProvider, SshToolProvider, ToolCapabilityRegistry, } from './tool-capability-providers.js';
 const STREAM_RESPONSE_MAX_YIELD_CHARS = 32 * 1024;
-const POWERSHELL_SAFE_PATH_PATTERN = /^[A-Za-z0-9_:\\/.\-\s]+$/;
-const POWERSHELL_SAFE_INCLUDE_PATTERN = /^[A-Za-z0-9_*?.\-]+$/;
 const SSH_SAFE_HOST_PATTERN = /^[A-Za-z0-9.-]+$/;
 function getSshAllowedHosts() {
     const configured = String(process.env.VIGTHORIA_SSH_ALLOWED_HOSTS || '')
@@ -58,6 +62,9 @@ function resolveWindowsInstallerPath() {
 export async function installUpdateWindows() {
     const installerPath = resolveWindowsInstallerPath();
     try {
+        if (isOfflineNetworkMode()) {
+            return { success: false, platform: 'windows', error: 'Offline mode prohibits launching the update installer' };
+        }
         if (!fs.existsSync(installerPath)) {
             return { success: false, platform: 'windows', error: 'ENOENT' };
         }
@@ -68,9 +75,18 @@ export async function installUpdateWindows() {
                 detached: true,
                 stdio: 'ignore',
                 windowsHide: false,
+                env: safeChildProcessEnv(),
+            });
+            const timer = setTimeout(() => {
+                child.kill();
+                reject(new Error('Windows update installer did not start within 10 seconds'));
+            }, 10_000);
+            child.once('error', (error) => {
+                clearTimeout(timer);
+                reject(error);
             });
-            child.once('error', reject);
             child.once('spawn', () => {
+                clearTimeout(timer);
                 child.unref();
                 resolve();
             });
@@ -89,7 +105,6 @@ export async function* robustifyStreamResponse(res) {
     const MAX_YIELD_CHARS = STREAM_RESPONSE_MAX_YIELD_CHARS;
     const MAX_BUFFER_CHARS = 256 * 1024;
     const body = res?.body ?? res;
-    const decoder = new TextDecoder('utf-8');
     let reader = null;
     let lineBuffer = '';
     const emitContent = async function* (type, content) {
@@ -330,6 +345,8 @@ export class AgenticTools {
     cwd;
     permissionCallback;
     autoApprove;
+    approvals;
+    capabilityRegistry;
     undoStack = [];
     maxUndoStack = 50;
     retryConfig = {
@@ -353,17 +370,6 @@ export class AgenticTools {
         }
         return `External tool call failed in ${toolName} during ${operation}: ${String(error)}`;
     }
-    externalToolFailure(toolName, operation, error, suggestion) {
-        const message = this.formatExternalToolError(toolName, operation, error);
-        this.logger.debug(message);
-        this.logger.warn(message);
-        return {
-            success: false,
-            error: message,
-            suggestion: suggestion || 'Review the command, arguments, permissions, and environment, then retry.',
-            canRetry: true,
-        };
-    }
     cleanupAfterToolError(toolName, operation, cleanup) {
         try {
             cleanup();
@@ -374,29 +380,6 @@ export class AgenticTools {
             this.logger.warn(message);
         }
     }
-    runExternalCommand(toolName, operation, command, options, cleanup) {
-        if (!this.isNonEmptyString(toolName)) {
-            throw new Error('Invalid tool execution: toolName must be a non-empty string.');
-        }
-        if (!this.isNonEmptyString(operation)) {
-            throw new Error(`Invalid external command for ${toolName}: operation must be a non-empty string.`);
-        }
-        if (!this.isNonEmptyString(command)) {
-            throw new Error(`Invalid external command for ${toolName} during ${operation}: command must be a non-empty string.`);
-        }
-        try {
-            return execSync(command, options);
-        }
-        catch (error) {
-            if (cleanup) {
-                this.cleanupAfterToolError(toolName, operation, cleanup);
-            }
-            const message = this.formatExternalToolError(toolName, operation, error);
-            const wrapped = new Error(message);
-            wrapped.cause = error;
-            throw wrapped;
-        }
-    }
     isNonEmptyString(value) {
         return typeof value === 'string' && value.trim().length > 0;
     }
@@ -422,19 +405,6 @@ export class AgenticTools {
             }
         }
     }
-    requireNonEmptyString(value, fieldName, toolName) {
-        if (!this.isNonEmptyString(value)) {
-            throw new Error(`Invalid arguments for ${toolName}: ${fieldName} is required and must be a non-empty string.`);
-        }
-        return value;
-    }
-    requireArgsObject(args, toolName) {
-        this.assertStringRecord(args, `Invalid arguments for ${toolName}: args`);
-    }
-    // Session-based tool approvals - remembers which tools user approved for this turn
-    sessionApprovedTools = new Set();
-    // Persistent permissions - tool allowlists per project
-    static permissionsFile = path.join(process.env.HOME || process.env.USERPROFILE || '~', '.vigthoria', 'permissions.json');
     constructor(logger, cwd, permissionCallback, autoApprove = false) {
         if (!logger) {
             throw new Error('AgenticTools initialization failed: logger is required.');
@@ -449,9 +419,23 @@ export class AgenticTools {
             throw new Error('AgenticTools initialization failed: autoApprove must be a boolean.');
         }
         this.logger = logger;
-        this.cwd = cwd;
+        this.cwd = fs.realpathSync(path.resolve(cwd));
         this.permissionCallback = permissionCallback;
         this.autoApprove = autoApprove;
+        this.approvals = new ToolApprovalService(this.cwd, logger);
+        this.capabilityRegistry = new ToolCapabilityRegistry([
+            new FilesystemToolProvider({
+                read_file: (args) => this.readFile(args), write_file: (args) => this.writeFile(args),
+                edit_file: (args) => this.editFile(args), list_dir: (args) => this.listDir(args),
+                glob: (args) => this.glob(args), multi_edit: (args) => this.multiEdit(args),
+            }),
+            new ProcessToolProvider({ bash: (args) => this.bash(args) }),
+            new SearchToolProvider({ grep: (args) => this.grep(args), codebase_search: (args) => this.codebaseSearch(args) }),
+            new RepositoryToolProvider({ git: (args) => this.git(args), repo: (args) => this.repo(args) }),
+            new NetworkBrowserToolProvider({ fetch_url: (args) => this.fetchUrl(args), browser: (args) => this.browserTool(args) }),
+            new SshToolProvider({ ssh_exec: (args) => this.sshExec(args) }),
+            new DelegationToolProvider({ task: (args) => this.task(args) }),
+        ]);
     }
     getErrorMessage(error) {
         if (error instanceof Error) {
@@ -467,85 +451,17 @@ export class AgenticTools {
             return String(error);
         }
     }
-    assertToolCall(call) {
-        if (!call || typeof call !== 'object') {
-            throw new Error('Invalid tool call: call must be an object.');
-        }
-        if (typeof call.tool !== 'string' || call.tool.trim().length === 0) {
-            throw new Error('Invalid tool call: tool name must be a non-empty string.');
-        }
-        if (!call.args || typeof call.args !== 'object' || Array.isArray(call.args)) {
-            throw new Error(`Invalid tool call for ${call.tool}: args must be an object.`);
-        }
-        for (const [key, value] of Object.entries(call.args)) {
-            if (typeof key !== 'string' || key.trim().length === 0) {
-                throw new Error(`Invalid tool call for ${call.tool}: argument names must be non-empty strings.`);
-            }
-            if (typeof value !== 'string') {
-                throw new Error(`Invalid argument "${key}" for ${call.tool}: expected string, received ${typeof value}.`);
-            }
-        }
-    }
-    /**
-     * Load persistent permissions for the current project
-     */
-    loadPersistentPermissions() {
-        try {
-            if (fs.existsSync(AgenticTools.permissionsFile)) {
-                return JSON.parse(fs.readFileSync(AgenticTools.permissionsFile, 'utf-8'));
-            }
-        }
-        catch (error) {
-            const message = this.formatExternalToolError('permissions', `read ${AgenticTools.permissionsFile}`, error);
-            this.logger.debug(message);
-            this.logger.warn(message);
-        }
-        return {};
-    }
-    /**
-     * Save a persistent permission for a tool in the current project
-     */
-    savePersistentPermission(toolName) {
-        const permissions = this.loadPersistentPermissions();
-        const projectKey = this.cwd;
-        if (!permissions[projectKey]) {
-            permissions[projectKey] = { tools: [], updatedAt: new Date().toISOString() };
-        }
-        if (!permissions[projectKey].tools.includes(toolName)) {
-            permissions[projectKey].tools.push(toolName);
-            permissions[projectKey].updatedAt = new Date().toISOString();
-        }
-        try {
-            const dir = path.dirname(AgenticTools.permissionsFile);
-            if (!fs.existsSync(dir))
-                fs.mkdirSync(dir, { recursive: true });
-            fs.writeFileSync(AgenticTools.permissionsFile, JSON.stringify(permissions, null, 2), 'utf-8');
-        }
-        catch (error) {
-            const message = this.formatExternalToolError('permissions', `write ${AgenticTools.permissionsFile}`, error);
-            this.logger.debug(message);
-            this.logger.warn(message);
-        }
-    }
-    /**
-     * Check if a tool has persistent permission for the current project
-     */
-    hasPersistentPermission(toolName) {
-        const permissions = this.loadPersistentPermissions();
-        const projectKey = this.cwd;
-        return permissions[projectKey]?.tools?.includes(toolName) || false;
-    }
     /**
      * Clear session-approved tools (call this at the start of each new AI turn)
      */
     clearSessionApprovals() {
-        this.sessionApprovedTools.clear();
+        this.approvals.clearSession();
     }
     /**
      * Get currently approved tools for this session
      */
     getSessionApprovedTools() {
-        return Array.from(this.sessionApprovedTools);
+        return this.approvals.sessionKeys();
     }
     /**
      * Get the undo stack for inspection
@@ -647,7 +563,7 @@ export class AgenticTools {
             },
             {
                 name: 'bash',
-                description: 'Run a shell command',
+                description: 'Run one supported process using a parsed argument vector (no shell syntax)',
                 parameters: [
                     { name: 'command', description: 'Shell command to execute', required: true },
                     { name: 'cwd', description: 'Working directory', required: false },
@@ -835,11 +751,17 @@ export class AgenticTools {
         }
         // Check permission for dangerous/modifying actions
         if (tool.requiresPermission && !this.autoApprove) {
-            // Check persistent permissions first (project-scoped), then session
-            if (this.hasPersistentPermission(normalizedCall.tool)) {
+            let approvalScope;
+            try {
+                approvalScope = buildApprovalScope(normalizedCall.tool, normalizedCall.args, this.cwd);
+            }
+            catch (error) {
+                return this.createErrorResult(ToolErrorType.INVALID_ARGS, this.getErrorMessage(error));
+            }
+            if (this.approvals.hasPersistent(approvalScope)) {
                 this.logger.info(`${call.tool}: Auto-approved (persistent)`);
             }
-            else if (this.sessionApprovedTools.has(normalizedCall.tool)) {
+            else if (this.approvals.hasSession(approvalScope)) {
                 // Already approved - skip permission prompt
                 this.logger.info(`${call.tool}: Auto-approved (batch)`);
             }
@@ -856,17 +778,16 @@ export class AgenticTools {
                 // 'persist' (typed 'p') = approve permanently for this project
                 // 'y' or 'yes' = approve this single request only
                 if (approved === 'batch') {
-                    this.sessionApprovedTools.add(normalizedCall.tool);
+                    this.approvals.recordSession(approvalScope);
                 }
                 else if (approved === 'persist') {
-                    this.sessionApprovedTools.add(normalizedCall.tool);
-                    this.savePersistentPermission(normalizedCall.tool);
-                    this.logger.info(`${normalizedCall.tool}: Saved as persistent permission`);
+                    this.approvals.recordPersistent(approvalScope);
+                    this.logger.info(`${normalizedCall.tool}: Saved exact operation as persistent permission`);
                 }
             }
         }
         // Execute with retry logic for applicable operations
-        return this.executeWithRetry(normalizedCall, tool);
+        return this.executeWithRetry(normalizedCall);
     }
     normalizeToolCall(call) {
         const tool = String(call.tool || '').trim();
@@ -912,7 +833,7 @@ export class AgenticTools {
     /**
      * Execute tool with automatic retry for transient failures
      */
-    async executeWithRetry(call, tool) {
+    async executeWithRetry(call) {
         let lastError = null;
         for (let attempt = 0; attempt <= this.retryConfig.maxRetries; attempt++) {
             try {
@@ -980,40 +901,7 @@ export class AgenticTools {
                     message,
                 };
             }
-            switch (call.tool) {
-                case 'read_file':
-                    return this.readFile(call.args);
-                case 'write_file':
-                    return this.writeFile(call.args);
-                case 'edit_file':
-                    return this.editFile(call.args);
-                case 'bash':
-                    return this.bash(call.args);
-                case 'grep':
-                    return this.grep(call.args);
-                case 'list_dir':
-                    return this.listDir(call.args);
-                case 'glob':
-                    return this.glob(call.args);
-                case 'git':
-                    return this.git(call.args);
-                case 'repo':
-                    return this.repo(call.args);
-                case 'fetch_url':
-                    return this.fetchUrl(call.args);
-                case 'browser':
-                    return this.browserTool(call.args);
-                case 'ssh_exec':
-                    return this.sshExec(call.args);
-                case 'task':
-                    return this.task(call.args);
-                case 'multi_edit':
-                    return this.multiEdit(call.args);
-                case 'codebase_search':
-                    return this.codebaseSearch(call.args);
-                default:
-                    return this.createErrorResult(ToolErrorType.INVALID_ARGS, `Tool not implemented: ${call.tool}`);
-            }
+            return await this.capabilityRegistry.execute(call);
         }
         catch (error) {
             const context = `Tool '${call.tool}' failed while executing with args ${this.safeStringifyArgs(call.args)}`;
@@ -1216,7 +1104,7 @@ export class AgenticTools {
             msg += chalk.red('   The AI is requesting to execute commands on your system.\n');
         }
         // Add batch approval hint
-        msg += `\n${chalk.gray('Respond:')} ${chalk.white('[y]es')} ${chalk.gray('/')} ${chalk.white('[n]o')} ${chalk.gray('/')} ${chalk.cyan('[a]pprove all')} ${chalk.cyan(call.tool)} ${chalk.gray('for this turn')}\n`;
+        msg += `\n${chalk.gray('Respond:')} ${chalk.white('[y]es')} ${chalk.gray('/')} ${chalk.white('[n]o')} ${chalk.gray('/')} ${chalk.cyan('[a]pprove this exact operation')} ${chalk.gray('for this turn')}\n`;
         return msg;
     }
     sleep(ms) {
@@ -1227,6 +1115,9 @@ export class AgenticTools {
      * Read file with enhanced error handling and suggestions
      */
     readFile(args) {
+        if (isSensitivePath(args.path)) {
+            return this.createErrorResult(ToolErrorType.PERMISSION_DENIED, `Sensitive file is excluded from agent context: ${path.basename(args.path)}`);
+        }
         const filePath = this.resolvePath(args.path);
         if (!fs.existsSync(filePath)) {
             // Try to find similar files
@@ -1322,7 +1213,7 @@ export class AgenticTools {
             };
             this.undoStack.push(undoOp);
             // Limit undo stack size
-            if (this.undoStack.length > 50) {
+            if (this.undoStack.length > this.maxUndoStack) {
                 this.undoStack.shift();
             }
             const isNew = originalContent === null;
@@ -1395,7 +1286,7 @@ export class AgenticTools {
             };
             this.undoStack.push(undoOp);
             // Limit undo stack size
-            if (this.undoStack.length > 50) {
+            if (this.undoStack.length > this.maxUndoStack) {
                 this.undoStack.shift();
             }
             // Show syntax-highlighted diff
@@ -1459,7 +1350,7 @@ export class AgenticTools {
                 return this.formatExternalToolError('syntax_check', `write temporary file ${tempFile}`, writeError);
             }
             try {
-                this.runExternalCommand('syntax_check', `node --check ${tempFile}`, `node --check "${tempFile}"`, { stdio: 'pipe' });
+                execFileSync(process.execPath, ['--check', tempFile], { stdio: 'pipe', timeout: 10_000, windowsHide: true, env: safeChildProcessEnv() });
                 return null;
             }
             catch (error) {
@@ -1615,30 +1506,21 @@ export class AgenticTools {
         }
         try {
             const startTime = Date.now();
-            // Build exec options based on platform
+            const processRequest = parseSupportedProcess(args.command);
             const execOptions = {
                 cwd,
                 timeout,
-                encoding: 'utf-8',
+                encoding: 'utf8',
                 maxBuffer: 10 * 1024 * 1024, // 10MB
                 stdio: ['pipe', 'pipe', 'pipe'],
                 // Ensure consistent environment
-                env: {
-                    ...process.env,
-                    // Prevent locale issues
-                    LC_ALL: 'C',
-                    LANG: 'C',
-                },
+                env: safeChildProcessEnv(process.env, { LC_ALL: 'C', LANG: 'C' }),
             };
-            // Set shell based on platform for consistent behavior
-            if (platform === 'win32') {
-                execOptions.shell = true; // Use default cmd.exe on Windows
-            }
-            else {
-                // Use /bin/sh on Unix-like systems (more portable than bash)
-                execOptions.shell = '/bin/sh';
-            }
-            const output = this.runExternalCommand('bash', args.command, args.command, execOptions);
+            const output = execFileSync(processRequest.executable, processRequest.args, {
+                ...execOptions,
+                encoding: 'utf8',
+                stdio: ['pipe', 'pipe', 'pipe'],
+            });
             const duration = Date.now() - startTime;
             return {
                 success: true,
@@ -1651,8 +1533,23 @@ export class AgenticTools {
         }
         catch (error) {
             // Command failed but may have output
-            const output = error.stdout || '';
-            const stderr = error.stderr || '';
+            // runExternalCommand deliberately wraps child_process failures so every
+            // external tool gets a consistent message.  Preserve the underlying
+            // ExecException here; otherwise stdout/stderr/exit status disappear and
+            // remote executors receive only the unhelpful "Command failed" wrapper.
+            const processError = error?.cause && typeof error.cause === 'object'
+                ? error.cause
+                : error;
+            const decodeProcessText = (value) => {
+                if (Buffer.isBuffer(value))
+                    return value.toString('utf8');
+                return typeof value === 'string' ? value : '';
+            };
+            const output = decodeProcessText(processError?.stdout);
+            const stderr = decodeProcessText(processError?.stderr);
+            const exitStatus = Number.isInteger(processError?.status)
+                ? ` (exit ${processError.status})`
+                : '';
             // Provide helpful error messages for common cases
             if (error.killed) {
                 return this.createErrorResult(ToolErrorType.TIMEOUT, `Command timed out after ${timeout / 1000}s`, 'Try increasing the timeout or breaking the command into smaller parts.');
@@ -1667,9 +1564,9 @@ export class AgenticTools {
             return {
                 success: false,
                 output,
-                error: stderr || error.message,
+                error: stderr || `${error.message}${exitStatus}`,
                 suggestion: 'Check command syntax and try again.',
-                canRetry: !error.killed,
+                canRetry: !processError?.killed,
             };
         }
     }
@@ -1685,7 +1582,7 @@ export class AgenticTools {
         if (platform === 'win32') {
             return this.grepWindows(args, searchPath);
         }
-        return this.grepUnix(args, searchPath, platform);
+        return this.grepUnix(args, searchPath);
     }
     /**
      * Windows grep: rg > Select-String > Node-native
@@ -1693,96 +1590,51 @@ export class AgenticTools {
     grepWindows(args, searchPath) {
         // 1. Try ripgrep (rg) first — best cross-platform search tool
         try {
-            execSync('rg --version', { encoding: 'utf-8', timeout: 5000, stdio: 'pipe' });
+            execFileSync('rg', ['--version'], { encoding: 'utf-8', timeout: 5000, stdio: 'pipe', windowsHide: true, env: safeChildProcessEnv() });
             return this.grepWithRg(args, searchPath);
         }
         catch (error) {
             this.logger.debug(this.formatExternalToolError('grep', 'checking ripgrep availability on Windows', error));
         }
-        // 2. Try PowerShell Select-String
-        try {
-            return this.grepWithSelectString(args, searchPath);
-        }
-        catch (error) {
-            this.logger.debug(this.formatExternalToolError('grep', 'running PowerShell Select-String fallback', error));
-        }
-        // 3. Fall back to Node-native recursive file scanner
+        // Fall back to the Node-native scanner. Avoid constructing a PowerShell
+        // program from model-controlled patterns.
         return this.grepNodeNative(args, searchPath);
     }
     /**
      * Unix grep: rg > system grep (BSD/GNU)
      */
-    grepUnix(args, searchPath, platform) {
+    grepUnix(args, searchPath) {
         // Try ripgrep first if available
         try {
-            this.runExternalCommand('grep', 'checking ripgrep availability on Unix', 'rg --version', { encoding: 'utf-8', timeout: 5000, stdio: 'pipe' });
+            execFileSync('rg', ['--version'], { encoding: 'utf-8', timeout: 5000, stdio: 'pipe', windowsHide: true, env: safeChildProcessEnv() });
             return this.grepWithRg(args, searchPath);
         }
         catch (error) {
             this.logger.debug(this.formatExternalToolError('grep', 'checking ripgrep availability on Unix', error));
             // rg not available, fall through to system grep
         }
-        const isMac = platform === 'darwin';
-        let cmd;
-        if (isMac) {
-            cmd = args.include
-                ? `grep -rn --include="${args.include}" "${args.pattern}" "${searchPath}"`
-                : `grep -rn "${args.pattern}" "${searchPath}"`;
-        }
-        else {
-            cmd = args.include
-                ? `grep -rn --color=never --include="${args.include}" "${args.pattern}" "${searchPath}"`
-                : `grep -rn --color=never "${args.pattern}" "${searchPath}"`;
-        }
-        try {
-            const output = this.runExternalCommand('grep', 'system grep search', cmd, {
-                cwd: this.cwd,
-                encoding: 'utf-8',
-                maxBuffer: 5 * 1024 * 1024,
-                timeout: 30000,
-                env: { ...process.env, GREP_OPTIONS: '' },
-            });
-            return {
-                success: true,
-                output: output.trim(),
-                metadata: { searchStatus: 'search_matches_found' },
-            };
-        }
-        catch (error) {
-            // Distinguish real "no matches" (exit 1 + no stderr) from command failure
-            const stderr = (error.stderr || '').toString();
-            if (error.status === 1 && !stderr.trim()) {
-                return {
-                    success: true,
-                    output: 'No matches found',
-                    metadata: { searchStatus: 'search_no_matches' },
-                };
-            }
-            // Real failure: command not found, permission denied, etc.
-            return {
-                success: false,
-                error: stderr || error.message,
-                suggestion: 'The grep command failed. Install ripgrep (rg) for best cross-platform search.',
-                canRetry: true,
-                metadata: { searchStatus: 'search_failed' },
-            };
-        }
+        return this.grepNodeNative(args, searchPath);
     }
     /**
      * Search using ripgrep (rg) — works on all platforms
      */
     grepWithRg(args, searchPath) {
-        let cmd = `rg -n --no-heading`;
-        if (args.include) {
-            cmd += ` -g "${args.include}"`;
-        }
-        cmd += ` "${args.pattern}" "${searchPath}"`;
+        const rgArgs = [
+            '-n', '--no-heading',
+            '-g', '!.git/**', '-g', '!.vigthoria/**', '-g', '!.env', '-g', '!.env.*',
+            '-g', '!**/credentials*', '-g', '!**/secrets*', '-g', '!**/*.pem', '-g', '!**/*.key',
+        ];
+        if (args.include)
+            rgArgs.push('-g', args.include);
+        rgArgs.push('--', args.pattern, searchPath);
         try {
-            const output = this.runExternalCommand('grep', 'ripgrep search', cmd, {
+            const output = execFileSync('rg', rgArgs, {
                 cwd: this.cwd,
-                encoding: 'utf-8',
+                encoding: 'utf8',
                 maxBuffer: 5 * 1024 * 1024,
                 timeout: 30000,
+                windowsHide: true,
+                env: safeChildProcessEnv(),
             });
             return {
                 success: true,
@@ -1801,56 +1653,6 @@ export class AgenticTools {
             throw error; // Let caller try next backend
         }
     }
-    /**
-     * Search using PowerShell Select-String (Windows)
-     */
-    grepWithSelectString(args, searchPath) {
-        // Normalize path for PowerShell
-        const psPath = searchPath.replace(/\//g, '\\');
-        if (!POWERSHELL_SAFE_PATH_PATTERN.test(psPath)) {
-            return this.createErrorResult(ToolErrorType.INVALID_ARGS, 'Unsafe search path for PowerShell backend', 'Use a normal workspace path containing only letters, numbers, separators, dot, dash, and spaces.');
-        }
-        const includeArg = args.include ? String(args.include) : '*';
-        if (!POWERSHELL_SAFE_INCLUDE_PATTERN.test(includeArg)) {
-            return this.createErrorResult(ToolErrorType.INVALID_ARGS, 'Unsafe include filter for PowerShell backend', 'Use simple wildcard filters like *.ts or *.py.');
-        }
-        const includeFilter = `-Include "${includeArg}"`;
-        const escapedPattern = args.pattern.replace(/'/g, "''");
-        const cmd = `powershell -NoProfile -Command "Get-ChildItem -Path '${psPath}' -Recurse -File ${includeFilter} | Select-String -Pattern '${escapedPattern}' | ForEach-Object { $_.Path + ':' + $_.LineNumber + ':' + $_.Line }"`;
-        try {
-            const output = execSync(cmd, {
-                cwd: this.cwd,
-                encoding: 'utf-8',
-                maxBuffer: 5 * 1024 * 1024,
-                timeout: 60000,
-            });
-            const trimmed = output.trim();
-            if (!trimmed) {
-                return {
-                    success: true,
-                    output: 'No matches found',
-                    metadata: { searchStatus: 'search_no_matches', backend: 'select-string' },
-                };
-            }
-            return {
-                success: true,
-                output: trimmed,
-                metadata: { searchStatus: 'search_matches_found', backend: 'select-string' },
-            };
-        }
-        catch (error) {
-            const stderr = (error.stderr || '').toString();
-            // Select-String returns exit code 1 for no matches when used in pipeline
-            if (error.status === 1 && !stderr.trim()) {
-                return {
-                    success: true,
-                    output: 'No matches found',
-                    metadata: { searchStatus: 'search_no_matches', backend: 'select-string' },
-                };
-            }
-            throw error; // Let caller try next backend
-        }
-    }
     /**
      * Pure Node.js recursive file search — reliable on all platforms, no external deps
      */
@@ -1897,6 +1699,9 @@ export class AgenticTools {
                 }
                 if (!entry.isFile())
                     continue;
+                const relativePath = path.relative(this.cwd, fullPath).replace(/\\/g, '/');
+                if (isSensitivePath(relativePath))
+                    continue;
                 // Check include pattern
                 if (includeGlob) {
                     const matches = minimatch
@@ -1915,7 +1720,6 @@ export class AgenticTools {
                     const lines = content.split('\n');
                     for (let i = 0; i < lines.length; i++) {
                         if (regex.test(lines[i])) {
-                            const relativePath = path.relative(this.cwd, fullPath).replace(/\\/g, '/');
                             results.push(`${relativePath}:${i + 1}:${lines[i]}`);
                             if (results.length >= maxResults)
                                 break;
@@ -1957,7 +1761,7 @@ export class AgenticTools {
             return { success: false, error: `Directory not found: ${args.path}` };
         }
         const entries = fs.readdirSync(dirPath, { withFileTypes: true });
-        const output = entries.map(e => {
+        const output = entries.filter((entry) => !isSensitivePath(path.join(args.path || '.', entry.name))).map(e => {
             const suffix = e.isDirectory() ? '/' : '';
             return e.name + suffix;
         }).join('\n');
@@ -1966,8 +1770,17 @@ export class AgenticTools {
     glob(args) {
         const { globSync } = require('glob');
         try {
-            const files = globSync(args.pattern, { cwd: this.cwd });
-            return { success: true, output: files.join('\n') };
+            const files = globSync(args.pattern, { cwd: this.cwd, follow: false, nodir: true });
+            const contained = files.filter((file) => {
+                try {
+                    this.resolvePath(file);
+                    return !isSensitivePath(file);
+                }
+                catch {
+                    return false;
+                }
+            });
+            return { success: true, output: contained.join('\n') };
         }
         catch (error) {
             return { success: false, error: error.message };
@@ -1975,10 +1788,13 @@ export class AgenticTools {
     }
     git(args) {
         try {
-            const output = execSync(`git ${args.args}`, {
+            const gitArgs = parseGitArguments(args.args);
+            const output = execFileSync('git', hardenGitArguments(gitArgs), {
                 cwd: this.cwd,
                 encoding: 'utf-8',
                 timeout: 60000,
+                windowsHide: true,
+                env: safeChildProcessEnv(safeGitEnvironment()),
             });
             return { success: true, output: output.trim() };
         }
@@ -1997,158 +1813,39 @@ export class AgenticTools {
         const targetPath = args.path || this.cwd;
         const description = args.description || '';
         try {
-            // Push action uses direct API call to Community server (bypasses interactive CLI)
-            if (action === 'push') {
-                if (!project) {
-                    return {
-                        success: false,
-                        error: 'Project name is required for push',
-                        suggestion: 'Provide a project name, e.g., repo action=push project=my-project'
-                    };
-                }
-                // Load auth config
-                const configPath = path.join(process.env.HOME || '/root', '.config', 'vigthoria-cli', 'config.json');
-                if (!fs.existsSync(configPath)) {
-                    return { success: false, error: 'Not logged in. Run vigthoria login first.' };
-                }
-                const config = JSON.parse(fs.readFileSync(configPath, 'utf-8'));
-                const authToken = config.authToken;
-                const apiBase = config.apiUrl || 'https://coder.vigthoria.io';
-                if (!authToken) {
-                    return { success: false, error: 'No auth token found. Run vigthoria login first.' };
-                }
-                // Build files array
-                let filesArray = [];
-                if (args.files) {
-                    // AI passed files directly
-                    let filesInput;
-                    if (typeof args.files === 'string') {
-                        try {
-                            filesInput = JSON.parse(args.files);
-                        }
-                        catch {
-                            filesInput = args.files;
-                        }
-                    }
-                    else {
-                        filesInput = args.files;
-                    }
-                    if (Array.isArray(filesInput)) {
-                        // Already in [{path, content}] format
-                        filesArray = filesInput.map((f) => ({ path: f.path || f.name || 'file', content: String(f.content || '') }));
-                    }
-                    else if (typeof filesInput === 'object' && filesInput !== null) {
-                        // {filename: content} format - convert
-                        for (const [filePath, content] of Object.entries(filesInput)) {
-                            filesArray.push({ path: filePath, content: String(content) });
-                        }
-                    }
-                }
-                // If no files from AI, read from disk
-                if (filesArray.length === 0 && fs.existsSync(targetPath)) {
-                    const readDir = (dir, base) => {
-                        const entries = fs.readdirSync(dir, { withFileTypes: true });
-                        for (const entry of entries) {
-                            const fullPath = path.join(dir, entry.name);
-                            const relPath = path.relative(base, fullPath);
-                            // Skip hidden dirs, node_modules, common non-essential dirs
-                            if (entry.name.startsWith('.') || entry.name === 'node_modules' || entry.name === '__pycache__')
-                                continue;
-                            if (entry.isDirectory()) {
-                                readDir(fullPath, base);
-                            }
-                            else if (entry.isFile()) {
-                                try {
-                                    const content = fs.readFileSync(fullPath, 'utf-8');
-                                    filesArray.push({ path: relPath, content });
-                                }
-                                catch { /* skip binary/unreadable files */ }
-                            }
-                        }
-                    };
-                    const stat = fs.statSync(targetPath);
-                    if (stat.isDirectory()) {
-                        readDir(targetPath, targetPath);
-                    }
-                    else {
-                        filesArray.push({ path: path.basename(targetPath), content: fs.readFileSync(targetPath, 'utf-8') });
+            // Every repository action invokes the canonical CLI route through an
+            // argument vector. This prevents the agent tool from developing a second
+            // credential, containment, mutation-retry, and payload policy.
+            // Project,
+            // user, permission, and destination values never enter a shell string.
+            let cliArgs;
+            const validRepoIdentifier = (value) => /^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$/.test(value);
+            if (project && !validRepoIdentifier(project)) {
+                return { success: false, error: 'Project name contains unsupported characters' };
+            }
+            switch (action) {
+                case 'push':
+                    if (!project) {
+                        return {
+                            success: false,
+                            error: 'Project name is required for push',
+                            suggestion: 'Provide a project name, e.g., repo action=push project=my-project',
+                        };
                     }
-                }
-                if (filesArray.length === 0) {
-                    return { success: false, error: 'No files to push. Provide files parameter or a valid path.' };
-                }
-                // POST to Community API via Coder proxy (fallback to direct Community server)
-                const body = JSON.stringify({
-                    projectName: project,
-                    description: description || `${project} - pushed via Vigthoria AI`,
-                    visibility,
-                    files: filesArray,
-                    commitMessage: `Push from Vigthoria AI: ${filesArray.length} file(s)`
-                });
-                const headers = {
-                    'Authorization': `Bearer ${authToken}`,
-                    'Content-Type': 'application/json'
-                };
-                // Try proxy first; direct Community server is only reachable when running on the
-                // Vigthoria backend itself (isServerRuntime), never expose this fallback to remote users.
-                const pushUrls = [`${apiBase}/api/community-repo/push`];
-                if (isServerRuntime()) {
-                    const directHost = ['local', 'host'].join('');
-                    pushUrls.push(`http://${directHost}:9000/api/repo/push`);
-                }
-                let result;
-                let lastError = '';
-                for (const pushUrl of pushUrls) {
-                    try {
-                        const response = await fetch(pushUrl, { method: 'POST', headers, body });
-                        result = await response.json();
-                        if (response.ok && result.success)
-                            break;
-                        if (result.code === 'REPOSITORY_SECURITY_REVIEW') {
-                            return {
-                                success: false,
-                                error: result.error || 'Repository security review required',
-                                metadata: {
-                                    code: result.code,
-                                    review: {
-                                        reviewId: result.reviewId,
-                                        status: result.status,
-                                        riskScore: result.riskScore,
-                                        findings: result.findings || [],
-                                        actionItems: result.actionItems || [],
-                                        retryCommand: result.retryCommand,
-                                    },
-                                },
-                                suggestion: `Inspect with "vigthoria repo review ${result.reviewId}" and retry corrected content with "${result.retryCommand || `vigthoria repo push --retry ${result.reviewId}`}".`,
-                            };
-                        }
-                        lastError = result.error || result.message || `Status ${response.status}`;
-                        result = null;
+                    if (args.files) {
+                        return {
+                            success: false,
+                            error: 'Inline repository payloads are prohibited. Write approved files inside the workspace before pushing.',
+                            suggestion: 'Use write_file for each approved workspace file, then call repo action=push with path.',
+                        };
                     }
-                    catch (e) {
-                        lastError = e.message;
-                        result = null;
+                    if (!['private', 'restricted', 'public'].includes(visibility)) {
+                        return { success: false, error: 'Repository visibility is invalid' };
                     }
-                }
-                if (!result || !result.success) {
-                    return {
-                        success: false,
-                        error: lastError || 'Push failed on all endpoints',
-                        suggestion: 'Check your authentication and try again. Run vigthoria login to refresh your token.'
-                    };
-                }
-                return {
-                    success: true,
-                    output: `Successfully pushed "${project}" to Vigthoria Community!\n` +
-                        `Action: ${result.action || 'created'}\n` +
-                        `Files: ${result.filesWritten || filesArray.length}\n` +
-                        `URL: ${result.url || `https://community.vigthoria.io/showcase/${result.projectId}`}`,
-                    metadata: { action: 'push', project, filesWritten: result.filesWritten || filesArray.length, url: result.url }
-                };
-            }
-            // All other actions use CLI commands
-            let command;
-            switch (action) {
+                    cliArgs = ['repo', 'push', this.resolvePath(targetPath), '--name', project, '--visibility', visibility, '--yes'];
+                    if (description)
+                        cliArgs.push('--description', description);
+                    break;
                 case 'pull':
                     if (!project) {
                         return {
@@ -2157,10 +1854,10 @@ export class AgenticTools {
                             suggestion: 'Provide a project name, e.g., repo action=pull project=my-project'
                         };
                     }
-                    command = `vigthoria repo pull "${project}"`;
+                    cliArgs = ['repo', 'pull', project];
                     break;
                 case 'list':
-                    command = 'vigthoria repo list';
+                    cliArgs = ['repo', 'list'];
                     break;
                 case 'status':
                     if (!project) {
@@ -2170,7 +1867,7 @@ export class AgenticTools {
                             suggestion: 'Provide a project name, e.g., repo action=status project=my-project'
                         };
                     }
-                    command = `vigthoria repo status "${project}"`;
+                    cliArgs = ['repo', 'status', project];
                     break;
                 case 'share':
                     if (!project || !args.username) {
@@ -2181,7 +1878,10 @@ export class AgenticTools {
                         };
                     }
                     const permission = args.permission || 'read';
-                    command = `vigthoria repo share "${project}" "${args.username}" --permission ${permission}`;
+                    if (!validRepoIdentifier(args.username) || !['read', 'write', 'admin'].includes(permission)) {
+                        return { success: false, error: 'Repository username or permission is invalid' };
+                    }
+                    cliArgs = ['repo', 'share', project, args.username, '--permission', permission];
                     break;
                 case 'delete':
                     if (!project) {
@@ -2191,7 +1891,7 @@ export class AgenticTools {
                             suggestion: 'Provide a project name, e.g., repo action=delete project=my-project'
                         };
                     }
-                    command = `vigthoria repo delete "${project}" --force`;
+                    cliArgs = ['repo', 'delete', project, '--force'];
                     break;
                 case 'clone':
                     if (!project) {
@@ -2201,7 +1901,7 @@ export class AgenticTools {
                             suggestion: 'Provide a project name, e.g., repo action=clone project=my-project path=/path/to/target'
                         };
                     }
-                    command = `vigthoria repo clone "${project}" "${targetPath}"`;
+                    cliArgs = ['repo', 'clone', project, this.resolvePath(targetPath)];
                     break;
                 default:
                     return {
@@ -2210,11 +1910,12 @@ export class AgenticTools {
                         suggestion: 'Available actions: push, pull, list, status, share, delete, clone'
                     };
             }
-            const output = execSync(command, {
+            const cliEntry = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..', 'index.js');
+            const output = execFileSync(process.execPath, [cliEntry, ...cliArgs], {
                 cwd: this.cwd,
                 encoding: 'utf-8',
                 timeout: 120000,
-                env: { ...process.env, FORCE_COLOR: '0' }
+                env: safeChildProcessEnv(process.env, { FORCE_COLOR: '0' })
             });
             return {
                 success: true,
@@ -2508,25 +2209,26 @@ export class AgenticTools {
             }
         }
         try {
-            const os = require('os');
-            const platform = os.platform();
-            let sshCommand;
-            let execOptions = {
-                encoding: 'utf-8',
+            const processRequest = parseSupportedProcess(command);
+            const remoteExecutable = path.basename(processRequest.executable);
+            const sshArgs = [
+                '-o', 'BatchMode=yes',
+                '-o', 'StrictHostKeyChecking=accept-new',
+                '-o', 'ConnectTimeout=10',
+                normalizedHost,
+                '--',
+                remoteExecutable,
+                ...processRequest.args,
+            ];
+            assertProcessNetworkAllowed('ssh', sshArgs);
+            const execOptions = {
+                encoding: 'utf8',
                 timeout,
                 maxBuffer: 10 * 1024 * 1024,
+                windowsHide: true,
+                env: safeChildProcessEnv(),
             };
-            if (platform === 'win32') {
-                // On Windows, use the ssh command from OpenSSH
-                sshCommand = `ssh -o BatchMode=yes -o StrictHostKeyChecking=accept-new -o ConnectTimeout=10 ${host} "${command.replace(/"/g, '\\"')}"`;
-                execOptions.shell = true;
-            }
-            else {
-                // On Unix-like systems
-                sshCommand = `ssh -o BatchMode=yes -o StrictHostKeyChecking=accept-new -o ConnectTimeout=10 ${host} '${command.replace(/'/g, "'\\''")}'`;
-                execOptions.shell = '/bin/sh';
-            }
-            const output = execSync(sshCommand, execOptions);
+            const output = execFileSync('ssh', sshArgs, execOptions);
             return {
                 success: true,
                 output: output.trim(),
@@ -2610,23 +2312,25 @@ export class AgenticTools {
         else {
             resolvedPath = path.normalize(path.join(this.cwd, safeInput));
         }
-        // SECURITY CHECK: Ensure path is within workspace
-        if (!resolvedPath.startsWith(workspaceRoot + path.sep) && resolvedPath !== workspaceRoot) {
-            // Path is outside workspace - force it back to workspace
-            this.logger.warn(`Security: Blocked access to path outside workspace: ${p}`);
-            // Return the sanitized relative path within workspace
-            const basename = path.basename(stripWorkspacePrefix(normalizedInput) || normalizedInput);
-            return path.join(this.cwd, basename);
-        }
-        return resolvedPath;
+        return assertContainedAbsolutePath(workspaceRoot, resolvedPath, {
+            allowMissing: true,
+            allowRoot: true,
+        });
     }
     /**
      * Check if a path is within the allowed workspace
      */
     isPathWithinWorkspace(p) {
-        const resolvedPath = path.normalize(path.isAbsolute(p) ? p : path.join(this.cwd, p));
-        const workspaceRoot = path.normalize(this.cwd);
-        return resolvedPath.startsWith(workspaceRoot + path.sep) || resolvedPath === workspaceRoot;
+        try {
+            assertContainedAbsolutePath(this.cwd, path.isAbsolute(p) ? p : path.join(this.cwd, p), {
+                allowMissing: true,
+                allowRoot: true,
+            });
+            return true;
+        }
+        catch {
+            return false;
+        }
     }
     // ═══════════════════════════════════════════════════════════════
     // TASK (Sub-Agent) Tool
@@ -2660,10 +2364,10 @@ export class AgenticTools {
         try {
             for (let turn = 0; turn < maxSubTurns; turn++) {
                 // Import api dynamically to avoid circular dependency
-                const { APIClient } = await import('./api.js');
+                const { createAPIClient } = await import('./api-client-factory.js');
                 const { Config } = await import('./config.js');
                 const config = new Config();
-                const api = new APIClient(config, this.logger);
+                const api = createAPIClient(config, this.logger);
                 const response = await api.chat(messages, 'code');
                 const assistantMessage = response.message || '';
                 messages.push({ role: 'assistant', content: assistantMessage });
@@ -2822,6 +2526,9 @@ export class AgenticTools {
                     if (ignorePatterns.includes(entry.name) || entry.name.startsWith('.'))
                         continue;
                     const fullPath = path.join(currentDir, entry.name);
+                    const relativePath = path.relative(this.cwd, fullPath).replace(/\\/g, '/');
+                    if (isSensitivePath(relativePath))
+                        continue;
                     if (entry.isDirectory()) {
                         walk(fullPath, depth + 1);
                     }
@@ -2830,13 +2537,15 @@ export class AgenticTools {
                             const basename = entry.name;
                             // Simple glob matching for extension patterns like *.ts, *.js
                             const globPattern = pattern.replace(/\*\*\//g, '(.*/)?').replace(/\*/g, '[^/]*').replace(/\?/g, '.');
-                            if (new RegExp(globPattern, 'i').test(basename) || fullPath.includes(pattern.replace(/\*/g, ''))) {
-                                files.push(fullPath);
-                            }
+                            if (!new RegExp(globPattern, 'i').test(basename) && !fullPath.includes(pattern.replace(/\*/g, '')))
+                                continue;
                         }
-                        else {
-                            files.push(fullPath);
+                        try {
+                            const content = fs.readFileSync(fullPath, 'utf8');
+                            if (!containsHighConfidenceSecret(content))
+                                files.push(fullPath);
                         }
+                        catch { /* unreadable files are excluded from agent context */ }
                     }
                 }
             };
@@ -2913,12 +2622,12 @@ export class AgenticTools {
                     if (includePattern)
                         rgArgs.push('-g', includePattern);
                     rgArgs.push('--', query, this.cwd);
-                    const isWin = process.platform === 'win32';
-                    const quote = (s) => isWin ? `"${s}"` : `'${s}'`;
-                    const rgOutput = execSync(`rg ${rgArgs.map(a => quote(a)).join(' ')}`, {
+                    const rgOutput = execFileSync('rg', rgArgs, {
                         encoding: 'utf-8',
                         timeout: 15000,
                         maxBuffer: 5 * 1024 * 1024,
+                        windowsHide: true,
+                        env: safeChildProcessEnv(),
                     }).trim();
                     for (const line of rgOutput.split('\n').slice(0, maxResults - results.length)) {
                         if (!line.trim())
@@ -3032,7 +2741,6 @@ export class AgenticTools {
                 .replace(/\t/g, '\\t'); // Escape tabs
             // Escape literal newlines inside strings (but not \n which is already escaped)
             // We need to be careful - only escape newlines that are inside quoted strings
-            const parts = [];
             let inString = false;
             let currentPart = '';
             for (let i = 0; i < fixed.length; i++) {