omnimancer-cli 0.2.10__tar.gz → 0.2.15__tar.gz

{omnimancer_cli-0.2.10 → omnimancer_cli-0.2.15}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: omnimancer-cli
-Version: 0.2.10
+Version: 0.2.15
 Summary: A unified command-line interface for multiple AI language models
 Author-email: Kellan Strong <kellan@jite.ai>
 License: MIT

{omnimancer_cli-0.2.10 → omnimancer_cli-0.2.15}/omnimancer/cli/agent_loop.py

@@ -6,6 +6,7 @@ via the agent engine, with a continuous workflow loop for multi-step tasks.
 """
 
 import asyncio
+import ipaddress
 import logging
 import re
 import shlex
@@ -13,9 +14,98 @@ import subprocess
 from difflib import SequenceMatcher
 from pathlib import Path
 from typing import Any, Optional
+from urllib.parse import urlparse, urlunparse
 
 from ..core.agent.types import Operation, OperationType
 
+# ---------------------------------------------------------------------------
+# Web request constants and helpers
+# ---------------------------------------------------------------------------
+
+#: Maximum characters returned from a single web response.
+_MAX_WEB_RESPONSE_CHARS: int = 10_000
+
+#: Hostnames that must never be contacted – cloud/VM metadata endpoints.
+_BLOCKED_METADATA_HOSTNAMES: frozenset = frozenset(
+    {
+        "169.254.169.254",  # AWS IMDSv1/v2, GCP, Azure shared endpoint
+        "metadata.google.internal",  # GCP metadata server
+        "fd00:ec2::254",  # AWS IPv6 IMDS
+        "metadata.internal",  # Azure internal alias
+    }
+)
+
+#: Compiled patterns for web operation markers.
+_WEB_GET_PATTERN = re.compile(r"\[WEB_GET:([^\]]+)\]")
+_WEB_REQUEST_PATTERN = re.compile(r"\[WEB_REQUEST:([^\]]+)\]")
+_WEB_POST_PATTERN = re.compile(r"\[WEB_POST:([^\]]+)\]")
+
+
+def _check_url_safety(url: str) -> Optional[str]:
+    """Validate whether *url* is safe to request.
+
+    Enforces:
+    - HTTP or HTTPS schemes only.
+    - No embedded credentials (``user:pass@host``).
+    - No loopback, private, link-local, or reserved addresses.
+    - No known cloud/VM metadata endpoints.
+
+    Returns an error-message string when the URL is unsafe, ``None`` if OK.
+    """
+    try:
+        parsed = urlparse(url.strip())
+    except Exception:
+        return "Invalid URL format"
+
+    if parsed.scheme not in ("http", "https"):
+        return f"Unsupported scheme '{parsed.scheme}':" " only http/https allowed"
+
+    if parsed.username or parsed.password:
+        return "URLs with embedded credentials are not allowed"
+
+    hostname = parsed.hostname
+    if not hostname:
+        return "URL has no hostname"
+
+    hostname_lower = hostname.lower()
+
+    # Block well-known localhost names before IP parsing.
+    if hostname_lower in ("localhost", "::1", "0.0.0.0"):
+        return f"Requests to '{hostname}' are not allowed"
+
+    # Block cloud metadata hostnames.
+    if hostname_lower in _BLOCKED_METADATA_HOSTNAMES:
+        return f"Requests to cloud metadata endpoint '{hostname}' are blocked"
+
+    # Reject private/reserved IP addresses.
+    try:
+        addr = ipaddress.ip_address(hostname_lower)
+        if (
+            addr.is_private
+            or addr.is_loopback
+            or addr.is_link_local
+            or addr.is_reserved
+        ):
+            return f"Requests to private/reserved IP '{hostname}'" " are not allowed"
+    except ValueError:
+        pass  # Hostname is a domain name – that's fine.
+
+    return None  # URL passed all safety checks.
+
+
+def _sanitize_url_for_log(url: str) -> str:
+    """Return *url* with credentials and query-string stripped for safe logging."""
+    try:
+        parsed = urlparse(url)
+        netloc = parsed.hostname or ""
+        if parsed.port:
+            netloc = f"{netloc}:{parsed.port}"
+        safe = parsed._replace(netloc=netloc, query="", fragment="")
+        return urlunparse(safe)
+    except Exception:
+        return "<invalid-url>"
+
+
 logger = logging.getLogger(__name__)
 
 
@@ -32,6 +122,113 @@ class AgentLoopMixin:
     def _show_assistant_message(self, content: str, model: str) -> None: ...
     def _show_error(self, message: str) -> None: ...
 
+    async def _execute_web_request(
+        self,
+        marker_text: str,
+        url: str,
+        http_method: str,
+        current_response: str,
+    ) -> tuple[str, bool]:
+        """Execute a single web-request marker and return the updated response.
+
+        Validates the *url* for safety, requests user approval, issues the
+        request via the agent engine, and inlines the result.
+
+        Args:
+            marker_text: The raw marker string to replace (e.g. ``[WEB_GET:…]``).
+            url: The target URL extracted from the marker.
+            http_method: HTTP verb – ``"GET"`` or ``"POST"``.
+            current_response: The response text being built up.
+
+        Returns:
+            A ``(updated_response, was_cancelled)`` tuple.  When ``was_cancelled``
+            is ``True`` the returned string already contains the
+            ``__WORKFLOW_CANCELLED__`` sentinel and the caller must return
+            immediately.
+        """
+        safe_url = _sanitize_url_for_log(url)
+
+        url_error = _check_url_safety(url)
+        if url_error:
+            return (
+                current_response.replace(
+                    marker_text,
+                    f"❌ Web request blocked: {url_error}",
+                ),
+                False,
+            )
+
+        agent_engine = getattr(self.engine, "agent_engine", None)
+        if not agent_engine:
+            return (
+                current_response.replace(
+                    marker_text,
+                    "❌ Agent engine not available"
+                    " - web requests disabled for security",
+                ),
+                False,
+            )
+
+        operation = Operation(
+            type=OperationType.WEB_REQUEST,
+            description=f"{http_method} request to: {safe_url}",
+            data={"url": url, "method": http_method},
+            requires_approval=True,
+        )
+
+        try:
+            result = await agent_engine.execute_with_approval(operation)
+
+            if result.success:
+                if isinstance(result.data, dict):
+                    content = result.data.get("content", "")
+                    if not isinstance(content, str):
+                        content = str(content)
+                else:
+                    content = str(result.data or "")
+
+                if len(content) > _MAX_WEB_RESPONSE_CHARS:
+                    content = (
+                        content[:_MAX_WEB_RESPONSE_CHARS]
+                        + "\n\n[... response truncated ...]"
+                    )
+
+                return (
+                    current_response.replace(
+                        marker_text,
+                        f"🌐 {http_method} {safe_url}\n{content}",
+                    ),
+                    False,
+                )
+            else:
+                if result.was_cancelled:
+                    updated = current_response.replace(
+                        marker_text,
+                        "🚫 Agent workflow cancelled by user",
+                    )
+                    return updated + "\n\n__WORKFLOW_CANCELLED__", True
+                else:
+                    return (
+                        current_response.replace(
+                            marker_text,
+                            f"❌ Web request failed: {result.error}",
+                        ),
+                        False,
+                    )
+
+        except Exception as e:
+            logger.error(
+                f"Web request execution failed: {e}",
+                exc_info=True,
+            )
+            return (
+                current_response.replace(
+                    marker_text,
+                    f"❌ Web request error: {str(e)}",
+                ),
+                False,
+            )
+
     async def _execute_continuous_workflow(
         self, original_message: str, initial_response: Any
     ) -> None:
@@ -68,7 +265,9 @@ class AgentLoopMixin:
                 r"\[FILE_WRITE:[^\]]+\\?\].*?\[/FILE_WRITE\]",
                 r"\[FILE_READ:[^\]]+\\?\]",
                 r"\[COMMAND_EXEC\].*?\[/COMMAND_EXEC\]",
-                r"\[WEB_REQUEST:[^\]]+\\?\]",
+                r"\[WEB_REQUEST:[^\]]+\]",
+                r"\[WEB_GET:[^\]]+\]",
+                r"\[WEB_POST:[^\]]+\]",
                 r"\[SAFE_EXEC\].*?\[/SAFE_EXEC\]",
             ]
 
@@ -622,6 +821,22 @@ class AgentLoopMixin:
                         f"❌ Command execution error: {str(e)}",
                     )
 
+            # WEB_GET, WEB_REQUEST, and WEB_POST markers – each handled via the
+            # shared _execute_web_request helper which validates safety, requests
+            # user approval, and inlines the response content.
+            for marker_pattern, http_method in (
+                (_WEB_GET_PATTERN, "GET"),
+                (_WEB_REQUEST_PATTERN, "GET"),
+                (_WEB_POST_PATTERN, "POST"),
+            ):
+                for match in marker_pattern.finditer(response_content):
+                    url = match.group(1).strip()
+                    updated_response, cancelled = await self._execute_web_request(
+                        match.group(0), url, http_method, updated_response
+                    )
+                    if cancelled:
+                        return updated_response
+
         except Exception as e:
             self._show_error(f"Error parsing operations: {e}")
             return response_content

{omnimancer_cli-0.2.10 → omnimancer_cli-0.2.15}/omnimancer/cli/command_dispatch.py

@@ -1259,7 +1259,10 @@ class CommandDispatchMixin:
 
     def _show_config_help(self) -> None:
         """Show configuration command help."""
-        help_text = """[bold]Configuration Commands:[/bold]
+        from ..providers.factory import ProviderFactory
+
+        endpoints = ", ".join(sorted(ProviderFactory.get_available_providers()))
+        help_text = f"""[bold]Configuration Commands:[/bold]
 
 [cyan]/config[/cyan]                              - Show current configuration
 [cyan]/config show[/cyan]                         - Show current configuration
@@ -1273,7 +1276,7 @@ class CommandDispatchMixin:
 [cyan]/config remove-provider <name>[/cyan]       - Remove a provider
 
 [bold]Endpoints[/bold] (each is a provider you can configure):
-  claude, openrouter, openai, digitalocean
+  {endpoints}
 
 [bold]Examples:[/bold]
   /config set-provider digitalocean --api-key $DO_KEY \\

{omnimancer_cli-0.2.10 → omnimancer_cli-0.2.15}/omnimancer/cli/completion.py

@@ -26,7 +26,19 @@ class CompletionManager:
             command = command[1:]
 
         static_completions = {
-            "mcp": {0: ["status", "reload", "connect", "disconnect", "health"]},
+            "mcp": {
+                0: [
+                    "status",
+                    "reload",
+                    "connect",
+                    "disconnect",
+                    "health",
+                    "servers",
+                    "tools",
+                    "add",
+                    "remove",
+                ]
+            },
             "history": {0: ["list", "clear", "export", "import"]},
             "config": {
                 0: [

{omnimancer_cli-0.2.10 → omnimancer_cli-0.2.15}/omnimancer/cli/headless.py

@@ -234,12 +234,57 @@ class HeadlessRunner:
         self._emitter = HeadlessOutputEmitter(output_format, session_id, verbose)
         self._tokens = TokenAccumulator()
 
+    @staticmethod
+    def _enable_auto_approval(agent_engine: Any) -> None:
+        """Approve every operation, honoring --dangerously-skip-permissions.
+
+        Headless runs are unattended: no approval callback is ever installed,
+        and both approval managers deny by default without one, so a headless
+        agent could never write a file or run a command regardless of the
+        flag. Config-driven permission DENY rules and hooks still apply — they
+        are checked before the approval step.
+        """
+
+        async def _approve(_request: Any) -> bool:
+            return True
+
+        approval = getattr(agent_engine, "approval", None)
+        if approval is not None:
+            approval.set_approval_callback(_approve)
+        enhanced = getattr(agent_engine, "enhanced_approval", None)
+        if enhanced is not None:
+            enhanced.set_approval_callback(_approve)
+
+    @staticmethod
+    def _enable_full_trust(agent_engine: Any) -> None:
+        """Relax the hard security layers for unattended full-trust runs.
+
+        Auto-approval alone is not enough: the command argument sanitizer
+        (pipes, &&, redirects), the forbidden-command list, the sensitive
+        filename patterns (*key*, *token*, .env, ...), and the 30s default
+        command timeout all block operations before/outside the approval
+        step, so a --dangerously-skip-permissions run still could not do real
+        work. The caller (e.g. a CI or agent container) is the security
+        boundary; hard-restricted system paths (~/.ssh, /etc, ...) stay
+        blocked.
+        """
+        executor = getattr(agent_engine, "executor", None)
+        if executor is not None and hasattr(executor, "set_full_trust"):
+            executor.set_full_trust(True)
+        file_system = getattr(agent_engine, "file_system", None)
+        if file_system is not None and hasattr(file_system, "set_full_trust"):
+            file_system.set_full_trust(True)
+
     async def run(self, prompt: str) -> int:
         agent_engine = getattr(self._engine, "agent_engine", None)
         if not agent_engine:
             self._emitter.emit_error("Agent engine not available.")
             return 1
 
+        if self._no_approval:
+            self._enable_auto_approval(agent_engine)
+            self._enable_full_trust(agent_engine)
+
         model = self._engine.config_manager.get_config().default_provider or "unknown"
         self._emitter.emit_init(model)
 

{omnimancer_cli-0.2.10 → omnimancer_cli-0.2.15}/omnimancer/cli/system_prompts.py

@@ -5,7 +5,173 @@ This module contains the system prompts used to guide the AI agent's behavior,
 including capability descriptions, operation markers, and execution patterns.
 """
 
+import logging
+import re
 from pathlib import Path
+from typing import List, Optional, Tuple
+
+logger = logging.getLogger(__name__)
+
+# Maximum bytes read from any single instruction file.  Prevents memory
+# exhaustion if a file is unexpectedly large (accidental or malicious).
+_MAX_INSTRUCTION_FILE_BYTES: int = 100_000  # 100 KB
+
+# Regex that matches fenced code blocks (``` … ``` or ~~~ … ~~~).
+# These are stripped before insertion to prevent an attacker from embedding
+# shell commands that the model might treat as executable instructions.
+_FENCED_CODE_BLOCK_RE = re.compile(
+    r"^(?:```|~~~)[^\n]*\n.*?^(?:```|~~~)\s*$",
+    re.MULTILINE | re.DOTALL,
+)
+
+# Regex for control characters that are not ordinary whitespace.
+# Null bytes and C0/C1 control characters can confuse tokenisers or be used
+# to smuggle hidden instructions.
+_CONTROL_CHAR_RE = re.compile(r"[\x00-\x08\x0b\x0c\x0e-\x1f\x7f-\x9f]")
+
+
+def _sanitize_instruction_content(raw: str) -> str:
+    """Sanitize raw text loaded from an instruction file.
+
+    Applies the following transforms in order:
+
+    1. **Strip fenced code blocks** – removes triple-backtick / triple-tilde
+       blocks so embedded shell snippets are not mistaken for executable
+       commands by the model.
+
+    2. **Remove control characters** – null bytes and non-printable C0/C1
+       control characters are deleted; ordinary whitespace (\\n, \\r, \\t,
+       space) is preserved.
+
+    3. **Collapse excess blank lines** – more than two consecutive blank lines
+       are collapsed to two, keeping the text readable without allowing
+       unlimited vertical padding.
+
+    4. **Truncate to length limit** – content is capped at
+       ``_MAX_INSTRUCTION_FILE_BYTES`` characters (which is already enforced
+       at the read stage, but this acts as a belt-and-suspenders guard).
+
+    Args:
+        raw: The raw string read from an instruction file.
+
+    Returns:
+        Sanitized string (may be empty if everything was stripped).
+    """
+    # 1. Remove fenced code blocks
+    text = _FENCED_CODE_BLOCK_RE.sub("", raw)
+
+    # 2. Remove dangerous control characters (keep \n \r \t and space)
+    text = _CONTROL_CHAR_RE.sub("", text)
+
+    # 3. Collapse excessive blank lines
+    text = re.sub(r"\n{3,}", "\n\n", text)
+
+    # 4. Belt-and-suspenders length cap (file read is already capped)
+    text = text[:_MAX_INSTRUCTION_FILE_BYTES]
+
+    return text.strip()
+
+
+def _read_instruction_file(path: Path) -> Optional[str]:
+    """Read and sanitize an instruction file, enforcing a size cap.
+
+    Returns sanitized content string, or ``None`` if the file is unreadable,
+    empty, or the sanitized result is empty.
+    """
+    try:
+        # Read only up to the byte cap; do not load the entire file first.
+        with path.open("r", encoding="utf-8", errors="replace") as fh:
+            raw = fh.read(_MAX_INSTRUCTION_FILE_BYTES)
+    except OSError as exc:
+        logger.debug("Failed to read instruction file %s: %s", path, exc)
+        return None
+
+    sanitized = _sanitize_instruction_content(raw)
+    return sanitized if sanitized else None
+
+
+def load_project_instructions() -> str:
+    """Load user-defined instructions from OMNIMANCER.md or CLAUDE.md files.
+
+    Searches for instruction files and combines them in priority order
+    (later entries are more specific and appear last in the prompt):
+
+    1. Global persona: ``~/.omnimancer/OMNIMANCER.md``
+       User-level defaults and persona definitions, always loaded if present.
+
+    2. Project ``CLAUDE.md``: nearest ancestor of CWD (Claude Code compatibility).
+       Useful when a project already ships a CLAUDE.md for Claude Code users.
+
+    3. Project ``OMNIMANCER.md``: nearest ancestor of CWD (highest priority).
+       Omnimancer-specific instructions that override everything else.
+
+    The upward walk stops at the first ``.git`` directory so instructions
+    stay scoped to the project.  Files above the git root are ignored as
+    project files (only the global config is loaded from ``~/.omnimancer/``).
+
+    Files that are empty, unreadable, or exceed the size limit are silently
+    skipped.  Content is sanitised before insertion (see
+    :func:`_sanitize_instruction_content`).
+
+    Returns:
+        Formatted instruction block string, or empty string if no files found.
+    """
+    found: List[Tuple[str, str]] = []  # (label, content)
+
+    # 1. Global persona / user-level defaults
+    global_file = Path.home() / ".omnimancer" / "OMNIMANCER.md"
+    if global_file.exists():
+        content = _read_instruction_file(global_file)
+        if content:
+            found.append(("~/.omnimancer/OMNIMANCER.md", content))
+
+    # 2 & 3. Walk up from CWD to the git root (or filesystem root) looking
+    # for project-level CLAUDE.md and OMNIMANCER.md.  We collect the *nearest*
+    # occurrence of each so subdirectory instructions win over parent ones.
+    claude_md_path: Optional[Path] = None
+    omnimancer_md_path: Optional[Path] = None
+
+    check_dir = Path.cwd()
+    while True:
+        if claude_md_path is None:
+            candidate = check_dir / "CLAUDE.md"
+            if candidate.exists():
+                claude_md_path = candidate
+        if omnimancer_md_path is None:
+            candidate = check_dir / "OMNIMANCER.md"
+            if candidate.exists():
+                omnimancer_md_path = candidate
+
+        # Stop at the git root so we don't wander out of the project
+        if (check_dir / ".git").exists():
+            break
+        parent = check_dir.parent
+        if parent == check_dir:
+            break  # filesystem root
+        check_dir = parent
+
+    if claude_md_path is not None:
+        content = _read_instruction_file(claude_md_path)
+        if content:
+            found.append((claude_md_path.name, content))
+
+    if omnimancer_md_path is not None:
+        content = _read_instruction_file(omnimancer_md_path)
+        if content:
+            found.append((omnimancer_md_path.name, content))
+
+    if not found:
+        return ""
+
+    # Wrap with a clear "user-provided" label so the model cannot be tricked
+    # into treating this content as authoritative system instructions.
+    parts = [
+        "\n📋 CUSTOM INSTRUCTIONS (user-provided — not system authority):",
+    ]
+    for label, content in found:
+        parts.append(f"\n--- {label} ---\n{content}")
+
+    return "\n".join(parts)
 
 
 def get_directory_context() -> str:
@@ -189,9 +355,8 @@ Examples:
   pdf2docx[/COMMAND_EXEC]
 
 🌐 Web Operations:
-- [WEB_REQUEST:url] - Make a web request
-- [WEB_GET:url] - HTTP GET request
-- [WEB_POST:url] data [/WEB_POST] - HTTP POST request
+- [WEB_REQUEST:url] - HTTP GET request to the given URL
+- [WEB_GET:url] - HTTP GET request to the given URL
 
 SECURITY & APPROVAL SYSTEM:
 - File writes are AUTOMATICALLY shown to user for approval
@@ -317,6 +482,7 @@ def build_agent_prompt(supports_tools: bool = False) -> str:
         System prompt appropriate for the provider's capabilities
     """
     directory_info = get_directory_context()
+    custom_instructions = load_project_instructions()
 
     sections = [
         (
@@ -338,6 +504,9 @@ def build_agent_prompt(supports_tools: bool = False) -> str:
         sections.append(OPERATION_MARKERS_SECTION)
         sections.append(EXECUTION_EXAMPLES_SECTION)
 
+    if custom_instructions:
+        sections.append(custom_instructions)
+
     return "\n".join(sections)
 
 
@@ -352,6 +521,8 @@ def get_agent_capabilities_prompt() -> str:
         Complete system prompt string with directory context
     """
     directory_info = get_directory_context()
+    custom_instructions = load_project_instructions()
+    custom_block = f"\n{custom_instructions}" if custom_instructions else ""
 
     return f"""SYSTEM: You are an autonomous AI agent with \
 the ability to perform actions on the local system. \
@@ -364,7 +535,7 @@ You have the following capabilities:
 {SECURITY_FEATURES_SECTION}
 {AGENT_EXECUTION_PATTERN_SECTION}
 {OPERATION_MARKERS_SECTION}
-{EXECUTION_EXAMPLES_SECTION}"""
+{EXECUTION_EXAMPLES_SECTION}{custom_block}"""
 
 
 def get_minimal_prompt() -> str:
@@ -378,6 +549,8 @@ def get_minimal_prompt() -> str:
         Minimal system prompt string
     """
     directory_info = get_directory_context()
+    custom_instructions = load_project_instructions()
+    custom_block = f"\n{custom_instructions}" if custom_instructions else ""
 
     return f"""SYSTEM: You are an autonomous AI agent with \
 the ability to perform actions on the local system.
@@ -386,7 +559,7 @@ the ability to perform actions on the local system.
 {COMMAND_EXECUTION_SECTION}
 {WEB_OPERATIONS_SECTION}
 {SECURITY_FEATURES_SECTION}
-{OPERATION_MARKERS_SECTION}"""
+{OPERATION_MARKERS_SECTION}{custom_block}"""
 
 
 def get_custom_prompt(
@@ -406,6 +579,7 @@ def get_custom_prompt(
         Custom system prompt string
     """
     directory_info = get_directory_context()
+    custom_instructions = load_project_instructions()
 
     sections = [
         (
@@ -432,4 +606,7 @@ def get_custom_prompt(
     if include_examples:
         sections.append(EXECUTION_EXAMPLES_SECTION)
 
+    if custom_instructions:
+        sections.append(custom_instructions)
+
     return "\n".join(sections)

{omnimancer_cli-0.2.10 → omnimancer_cli-0.2.15}/omnimancer/core/agent/file_system_manager.py

@@ -79,6 +79,14 @@ class FileSystemManager:
         # Operation tracking
         self.active_operations: Dict[str, Dict[str, Any]] = {}
 
+    def set_full_trust(self, enabled: bool) -> None:
+        """Enable/disable full-trust mode on the underlying security manager.
+
+        In full trust, sensitive name patterns (.env, *key*, *token*, ...)
+        stop blocking reads/writes; hard-restricted system paths still deny.
+        """
+        self.security.set_full_trust(enabled)
+
     async def _request_approval_if_needed(self, operation: Operation) -> bool:
         """Request approval for operation if approval manager is configured."""
         if not self.require_approval or not self.approval_manager:
@@ -375,13 +383,22 @@ class FileSystemManager:
         path: Union[str, Path],
         encoding: str = "utf-8",
         binary: bool = False,
+        allow_sensitive: bool = False,
     ) -> Union[str, bytes]:
-        """Read file content with security validation and error handling."""
+        """Read file content with security validation and error handling.
+
+        ``allow_sensitive`` permits reading sensitive project-local files (e.g.
+        ``.env``). It is set for internal reads that are part of an already
+        approved operation — such as the read-before-write diff/backup step —
+        so the existing content can be shown and preserved.
+        """
 
         path = Path(path).resolve()
 
         # Security validation
-        result = await self.security.secure_file_access(str(path), "read")
+        result = await self.security.secure_file_access(
+            str(path), "read", allow_sensitive=allow_sensitive
+        )
         if not result["success"]:
             raise FileOperationError(f"Security check failed: {result['error']}")
 
@@ -1284,7 +1301,11 @@ class FileSystemManager:
 
             if file_exists:
                 try:
-                    current_content = await self.read_file(path, encoding=encoding)
+                    # This read is part of an approved write; allow sensitive
+                    # files (e.g. .env) so the diff and backup still work.
+                    current_content = await self.read_file(
+                        path, encoding=encoding, allow_sensitive=True
+                    )
                 except Exception as e:
                     # Handle file read error
                     read_error = FileReadError(str(path), e)

{omnimancer_cli-0.2.10 → omnimancer_cli-0.2.15}/omnimancer/core/agent/program_executor.py

@@ -86,6 +86,10 @@ class CommandValidator:
     """Validates commands against security policies."""
 
     def __init__(self) -> None:
+        # Full-trust mode (unattended headless runs where an outer sandbox is
+        # the security boundary): argument sanitization is skipped so shell
+        # constructs (pipes, &&, redirects) reach the shell executor intact.
+        self.full_trust = False
         self.command_categories = {
             CommandCategory.SAFE_READ: {
                 "ls",
@@ -295,6 +299,11 @@ class CommandValidator:
 
     def validate_command_args(self, command: str, args: List[str]) -> List[str]:
         """Validate and sanitize command arguments."""
+        # Full trust: commands run via the shell on purpose — pipes, &&, and
+        # redirects are legitimate agent usage there.
+        if self.full_trust:
+            return list(args)
+
         import re
 
         # Define dangerous shell metacharacters and patterns