2 Commits

Author	SHA1	Message	Date
Teknium	d4cec15b47	refactor(tools): first-wave simplification of tools/ (file ops split, lazy_deps, code_exec, approval, browser, delegate, mcp, skills, terminal, voice, media) ... Behavior-neutral structural pass over tools/*: god-file extractions into sibling modules (file_operations_common/lint/search, file_tools_paths/ read_tracking/write, code_execution_env/rpc, tool_search_catalog/names/ validation, tts_command_provider, ...), duplicate helper unification, if/elif -> dispatch tables, dead-code removal, docstring compaction. Tool schemas (get_tool_definitions) verified byte-identical to base.	2026-09-02 14:43:45 -07:00
Teknium	005dfcbfcc	fix(tools): symlink-safe exclusive creation for all spill/cache writers ... Spill files (terminal overflow, hook context, web_extract full text, subagent summaries) were written with plain open()/write_text into predictable directories. A pre-planted symlink at any of those paths redirected the write onto an arbitrary user-owned file, and raw pre-redaction terminal/hook spills landed world-readable under the default umask. New tools/spill_safety.py helpers create files with O_CREAT|O_EXCL|O_NOFOLLOW (a link-shaped path fails the write instead of following it) and overwrite via lstat-checked unlink + exclusive re-create, so even the redaction rewrite cannot be diverted. Private tier (0o700 dir / 0o600 file) covers raw terminal and hook spills; cache/web and cache/delegation keep umask perms because those dirs are bind-mounted into remote backends that must read them. Pattern borrowed from DeepSeek Harness dsh-spill-local (MIT): private root + exclusive owner-only opens for spill artifacts.	2026-08-13 11:09:51 -07:00