"note": "Heuristic false-green LEADS, not findings. A finding requires a demonstrated reproduction (surviving mutation via mutation-runner). Do not treat a candidate as a confirmed false green. Coverage-theater leads may include tests that delegate their assertion to a custom helper the classifier does not recognise; verify before acting.",

  "sourceDigest": "sha256:dd810dd48c5bdbc9becd7fcc01dd41a4ca2abf0b2d6f6a545907247f6e3e8361",

  "summary": {

    "filesScanned": 2434,

    "filesScanned": 2435,

    "candidateCount": 16,

    "byMode": {

      "false_green_coverage_theater": 15,

{

  "schemaVersion": "1",

  "repository": "OpenAgentsInc/openagents",

  "sourceDigest": "sha256:148589c7a0eaf2212132813961369d469f43d46e01a7ed722b0b458abb9ca63c",

  "sourceDigest": "sha256:df1ae247646ce2032b886c6ad9a2641425b70af96750dec46faa193b2ac1cba6",

  "surfaces": [

    {

      "id": "app:@openagentsinc/acceptance-runner",

      "oracles": [

        {

          "type": "test",

          "ref": "packages/openagents-cli (34 tracked test files)"

          "ref": "packages/openagents-cli (35 tracked test files)"

        },

        {

          "type": "behavior-contract",

  parseOllamaModelFlag,

} from "./coder-ollama.js";

import { openThread, ThreadUnavailable, type ThreadReplySource } from "./coder-thread.js";

import { delegateTool, openagentsTool, skillTool } from "./coder-tools.js";

import { delegateTool, openagentsTool, shellTool, skillTool } from "./coder-tools.js";

import { spawnSync } from "node:child_process";

import { rebuild, RELOAD_EXIT_CODE, sourceCheckout } from "./coder-reload.js";

      const declareTools = () => {

        const active = skills.active();

        const tools = [

          shellTool(process.cwd()),

          ...(active.length === 0 ? [] : [skillTool(active)]),

          openagentsTool(),

          ...(setup === undefined ? [] : [delegateTool(setup.delegation)]),

  if (tools.length === 0) {

    lines.push(

      "You have no tools in this session. You cannot read or write files, run commands, search " +

        "the repository, or fetch a URL. Answer from what the reader tells you, and say plainly " +

        "when something would need a tool you do not have.",

      "You have no tools in this session: you cannot read or write files, run commands, or " +

        "reach anything outside this conversation. Answer from what the reader tells you, and " +

        "say plainly when something would need a tool you do not have.",

    );

  } else {

    lines.push(

      `You have ${String(tools.length)} tool${tools.length === 1 ? "" : "s"}, and no others:`,

      ...tools.map((tool) => `- \`${tool.name}\``),

      "",

      "That list is complete. You have no file, shell, search, or web tools of your own: any " +

        "capability not on that list is one you do not have. Where a tool's description says what " +

        "a child agent can do, that is the child's capability and not yours. Never say you ran " +

        "something you did not run.",

      // Stated as a closed list rather than by naming the capabilities that are

      // absent. The absent ones change as tools are added -- this once said

      // there was no shell, and then there was one -- and a system message that

      // has to be edited when the tool list changes is one that will be wrong

      // in between.

      "That list is complete: a capability not on it is one you do not have, whatever a model " +

        "like you usually has. Read a tool's description before assuming what it covers. Where " +

        "a description says what a child agent can do, that is the child's capability and not " +

        "yours. Never say you ran something you did not run.",

    );

  }

/**

 * Running a command on this machine.

 *

 * Without this, a session that wanted `pwd` had to start a child coding agent

 * on a hosted model to run it. That is minutes and real money for a line of

 * output, and the answer arrives second-hand.

 *

 * The session runs commands directly instead, and `delegate` goes back to what

 * it is for: work that is worth a whole agent.

 *

 * ## What the refusal list is, and is not

 *

 * It stops a small number of irreversible mistakes: erasing a home directory or

 * a disk, reformatting, halting the machine. It is not a security boundary and

 * cannot be one -- a command can be assembled from variables, decoded, or

 * written to a file and run, and no list of patterns sees that. It catches the

 * accident, not the intent.

 *

 * So it is kept short and aimed only at what cannot be undone. `rm -rf` on a

 * build directory is ordinary work and is allowed; `rm -rf` on `/` or `~` is

 * not, because no one means it.

 */

import { spawn } from "node:child_process";

/** How much of a command's output the model is shown. */

const OUTPUT_LIMIT = 30_000;

/** The default deadline, and the longest one a caller may ask for. */

const DEFAULT_TIMEOUT_MS = 120_000;

const MAXIMUM_TIMEOUT_MS = 600_000;

/**

 * Commands that cannot be undone, and are never what was meant.

 *

 * Each is paired with what to say, because a bare refusal reads as the tool

 * being broken rather than as the command being the problem.

 */

const REFUSED: ReadonlyArray<readonly [RegExp, string]> = [

  [

    // `rm -rf` aimed at a root, a home, or everything in one. Aimed at a build

    // directory it is ordinary work, so the target is what decides.

    /\brm\s+(-[a-zA-Z]*\s+)*-?[a-zA-Z]*[rR][a-zA-Z]*f?[a-zA-Z]*\s+(-[a-zA-Z]+\s+)*(\/|~|\$HOME|\/\*|~\/\*|\$HOME\/\*)(\s|$)/,

    "That would erase a root or a home directory.",

  ],

  [/\bmkfs(\.\w+)?\b/, "That would reformat a filesystem."],

  [/\bdd\b[^\n]*\bof=\/dev\/(disk|rdisk|sd|nvme|hd)/, "That would write over a raw device."],

  [/\bdiskutil\s+(erase|reformat|partition)/, "That would erase or repartition a disk."],

  [/\b(shutdown|reboot|halt|poweroff)\b/, "That would stop this machine."],

  [/:\(\)\s*\{\s*:\|:&\s*\}\s*;\s*:/, "That is a fork bomb."],

  [

    /\bchmod\s+(-[a-zA-Z]+\s+)*(-R|--recursive)\s+[0-7]{3,4}\s+(\/|~|\$HOME)(\s|$)/,

    "That would change the permissions of a whole root or home directory.",

  ],

  [/>\s*\/dev\/(disk|rdisk|sd|nvme|hd)/, "That would write over a raw device."],

];

/** Why this command will not be run, or undefined when it will. */

export const refusalFor = (command: string): string | undefined => {

  for (const [pattern, reason] of REFUSED) {

    if (pattern.test(command)) {

      return `${reason} This session refuses it. If you meant something narrower, name the directory.`;

    }

  }

  return undefined;

};

export interface ShellResult {

  readonly output: string;

  readonly code: number | undefined;

  readonly timedOut: boolean;

}

/**

 * Run one command and report what it said.

 *

 * Both streams are collected in the order they arrive, because a command's

 * error output is usually the part worth reading and separating them loses

 * which line came before which.

 *

 * No login shell: rc files are slow, and a command whose behaviour depends on

 * an interactive profile is one that will not reproduce.

 */

export async function runShell(

  command: string,

  options: { readonly cwd: string; readonly timeoutMs?: number; readonly signal: AbortSignal },

): Promise<ShellResult> {

  const timeoutMs = Math.min(options.timeoutMs ?? DEFAULT_TIMEOUT_MS, MAXIMUM_TIMEOUT_MS);

  return await new Promise<ShellResult>((resolve) => {

    const child = spawn("/bin/sh", ["-c", command], {

      cwd: options.cwd,

      // No terminal, so a command that would prompt reads end-of-file and

      // stops rather than waiting where nobody can see it.

      stdio: ["ignore", "pipe", "pipe"],

    });

    let output = "";

    let settled = false;

    const finish = (result: ShellResult) => {

      if (settled) return;

      settled = true;

      clearTimeout(timer);

      options.signal.removeEventListener("abort", onAbort);

      resolve(result);

    };

    const timer = setTimeout(() => {

      child.kill("SIGKILL");

      finish({ output, code: undefined, timedOut: true });

    }, timeoutMs);

    const onAbort = () => {

      child.kill("SIGKILL");

      finish({ output, code: undefined, timedOut: false });

    };

    options.signal.addEventListener("abort", onAbort, { once: true });

    const collect = (chunk: Buffer) => {

      if (output.length < OUTPUT_LIMIT) output += chunk.toString("utf8");

    };

    child.stdout.on("data", collect);

    child.stderr.on("data", collect);

    child.on("error", (cause) => {

      finish({ output: `The command could not be started: ${cause.message}`, code: undefined, timedOut: false });

    });

    child.on("close", (code) => {

      finish({ output, code: code ?? undefined, timedOut: false });

    });

  });

}

/** What the model is shown for one run. */

export const renderShell = (result: ShellResult, timeoutMs: number): string => {

  const bounded =

    result.output.length > OUTPUT_LIMIT

      ? `${result.output.slice(0, OUTPUT_LIMIT)}\n\n[truncated; narrow the command or write to a file and read part of it]`

      : result.output;

  const body = bounded.trim();

  if (result.timedOut) {

    return `The command did not finish within ${String(Math.round(timeoutMs / 1000))}s and was stopped.\n\n${body}`;

  }

  if (result.code === undefined) return body.length === 0 ? "The command was interrupted." : body;

  // The exit code is reported on failure because an empty failure reads as an

  // empty success, and a command that fails silently is the one that misleads.

  if (result.code !== 0) {

    return `The command exited with code ${String(result.code)}.\n\n${body}`;

  }

  return body.length === 0 ? "The command succeeded and printed nothing." : body;

};

export { DEFAULT_TIMEOUT_MS, MAXIMUM_TIMEOUT_MS, OUTPUT_LIMIT };

import { fileURLToPath } from "node:url";

import type { CoderDelegation } from "./coder-session.js";

import {

  DEFAULT_TIMEOUT_MS,

  MAXIMUM_TIMEOUT_MS,

  refusalFor as shellRefusalFor,

  renderShell,

  runShell,

} from "./coder-shell.js";

import { catalogEntry, renderSkill, type CoderSkill } from "./coder-skills.js";

import { describePrompt, MAX_DELEGATE_COUNT } from "./coder-delegate.js";

import type { DelegationOutcome } from "./coder-delegate.js";

    },

  };

}

/**

 * The shell tool: run a command on this machine.

 *

 * The session had no way to look at anything. Asked for its working directory

 * it started a child coding agent on a hosted model to run `pwd` -- minutes and

 * real money for one line, reported second-hand. Reading a file, listing a

 * directory, running the tests: all of it went through a whole agent or through

 * the reader.

 *

 * So `delegate` goes back to what it is for. A fan-out is worth an agent each;

 * `pwd` is worth a process.

 */

export function shellTool(cwd: string): CoderTool {

  return {

    name: "shell",

    description:

      "Run a shell command on this machine, in the session's working directory, and return what " +

      "it printed. Use it for anything you would type at a terminal: reading files, listing " +

      "directories, searching, git, running builds and tests. Prefer it over `delegate` for " +

      "single commands -- a child agent is for work worth a whole agent, not for one line of " +

      "output. Both output streams come back together with the exit code. There is no terminal, " +

      "so a command that would prompt gets end-of-file instead of waiting; pass a flag that " +

      "answers the prompt. A few commands that cannot be undone are refused, such as erasing a " +

      "root or a home directory, reformatting a disk, or halting the machine.",

    parameters: {

      type: "object",

      properties: {

        command: {

          type: "string",

          description: "The command line, as you would type it. Runs through `/bin/sh -c`.",

        },

        timeout_seconds: {

          type: "integer",

          minimum: 1,

          maximum: MAXIMUM_TIMEOUT_MS / 1000,

          description: `How long to wait. Defaults to ${String(DEFAULT_TIMEOUT_MS / 1000)}; raise it for a build or a test run.`,

        },

      },

      required: ["command"],

      additionalProperties: false,

    },

    run: async (args, signal) => {

      const command = typeof args["command"] === "string" ? args["command"].trim() : "";

      if (command.length === 0) {

        return "No command was run: `command` is required and must say what to run.";

      }

      const refusal = shellRefusalFor(command);

      if (refusal !== undefined) return refusal;

      const asked = typeof args["timeout_seconds"] === "number" ? args["timeout_seconds"] : undefined;

      const timeoutMs = Math.min(

        asked === undefined ? DEFAULT_TIMEOUT_MS : Math.max(1, Math.trunc(asked)) * 1000,

        MAXIMUM_TIMEOUT_MS,

      );

      const result = await runShell(command, { cwd, timeoutMs, signal });

      return renderShell(result, timeoutMs);

    },

  };

}

    expect(system.content).toContain("`delegate`");

    // The failure this exists to stop: the model answering with the tools a

    // coding agent usually has rather than the ones it was given.

    expect(system.content).toContain("no file, shell, search, or web tools of your own");

    // Stated as a closed list, not by naming what is absent: this once said

    // there was no shell, and then a shell tool was added.

    expect(system.content).toContain("a capability not on it is one you do not have");

    expect(system.content).not.toMatch(/no file, shell/);

    // A tool description says what a child can do. That is not the model's.

    expect(system.content).toContain("that is the child's capability and not yours");

  });

import { mkdtempSync, writeFileSync } from "node:fs";

import { tmpdir } from "node:os";

import { join } from "node:path";

import { describe, expect, it } from "vitest";

import { refusalFor } from "../src/coder-shell.js";

import { shellTool } from "../src/coder-tools.js";

const run = (command: string, timeout_seconds?: number) =>

  shellTool(process.cwd()).run(

    { command, ...(timeout_seconds === undefined ? {} : { timeout_seconds }) },

    new AbortController().signal,

  );

describe("what the shell refuses", () => {

  const refused = [

    "rm -rf /",

    "rm -rf ~",

    "sudo rm -rf /",

    "rm -rf $HOME",

    "rm -fr /",

    "rm -rf /*",

    "mkfs.ext4 /dev/disk2",

    "dd if=/dev/zero of=/dev/disk0",

    "diskutil eraseDisk JHFS+ X disk2",

    "sudo shutdown -h now",

    ":(){ :|:& };:",

    "chmod -R 777 /",

    "echo hi > /dev/disk0",

  ];

  it.each(refused)("refuses %s", (command) => {

    expect(refusalFor(command)).toBeDefined();

  });

  const allowed = [

    // The one that matters: cleaning a build directory is ordinary work, and a

    // list that stopped it would be turned off within a day.

    "rm -rf node_modules",

    "rm -rf _build deps",

    "rm -rf ./dist",

    "rm file.txt",

    "git status",

    "mix test",

    "grep -rn foo src/",

    "find . -name '*.ex' -delete",

  ];

  it.each(allowed)("allows %s", (command) => {

    expect(refusalFor(command)).toBeUndefined();

  });

  it("says what was wrong with it, not just that it was refused", async () => {

    const output = await run("rm -rf /");

    // A bare refusal reads as the tool being broken rather than as the command

    // being the problem.

    expect(output).toContain("erase a root or a home directory");

    expect(output).toContain("name the directory");

  });

});

describe("running a command", () => {

  it("returns what it printed", async () => {

    await expect(run("echo hello")).resolves.toBe("hello");

  });

  it("keeps both streams, in the order they arrived", async () => {

    const output = await run("echo first; echo second >&2");

    // The error output is usually the part worth reading, and separating the

    // streams loses which line came before which.

    expect(output).toContain("first");

    expect(output).toContain("second");

  });

  it("reports a failing command by its exit code", async () => {

    // An empty failure reads as an empty success.

    await expect(run("exit 3")).resolves.toContain("exited with code 3");

  });

  it("says a silent success was a success", async () => {

    await expect(run("true")).resolves.toContain("succeeded and printed nothing");

  });

  it("runs in the working directory it was given", async () => {

    const directory = mkdtempSync(join(tmpdir(), "coder-shell-"));

    writeFileSync(join(directory, "marker.txt"), "here");

    const output = await shellTool(directory).run(

      { command: "ls" },

      new AbortController().signal,

    );

    expect(output).toContain("marker.txt");

  });

  it("stops a command that runs too long, and says so", async () => {

    await expect(run("sleep 5", 1)).resolves.toContain("did not finish within 1s");

  });

  it("does not wait on a command that would prompt", async () => {

    // No terminal, so the read gets end-of-file rather than waiting where

    // nobody can see it.

    await expect(run("read x", 5)).resolves.toContain("exited with code");

  });

  it("asks for a command rather than running nothing", async () => {

    await expect(run("   ")).resolves.toContain("`command` is required");

  });

});