skyblanket · Sep 24, 2026 · Sep 24, 2026 · Sep 24, 2026 · Sep 24, 2026 · Sep 24, 2026
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -7,6 +7,32 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+### Security
+
+- **A cloned repo's `./.swarm-code.json` is untrusted.** It may set only
+  `model`, `max_tokens`, `vision`, `chat_template_kwargs`, `llm_timeout_ms`
+  and *tighten* `permissions`; hooks, `mcpServers`, `endpoint`, `api_key`,
+  `providers`, `profiles` and `fallback_profile` in it are ignored with a
+  one-line notice. Opt a repo in with `swarm-code trust` (or `/trust`), which
+  adds it to `"trusted_projects"` in `~/.swarm-code/settings.json`;
+  `swarm-code untrust` and `swarm-code trust --list` manage the list.
+- **Network gate parses URLs properly and covers every LLM dial.** Userinfo
+  (`http://127.0.0.1@host`), uppercase schemes, name-prefix and numeric-IP
+  tricks no longer pass, and fallback / `providers` / `/profile` override
+  endpoints are checked at the point of dial. **Changed:** an API key no
+  longer bypasses the gate — remote endpoints need `SWARM_CODE_ALLOW_REMOTE=1`
+  as documented; scheme-less endpoints (`host:port`) are refused.
+- **The model can't write swarm-code's control files** (`~/.swarm-code/`
+  hooks, `schedule.json`, `.profile_override`, sessions, `settings.json`,
+  `.swarm-code.json`); `memory/` and `skills/` stay writable. Sensitive-path
+  checks are case-insensitive (`~/.SSH`).
+- **Headless no longer auto-approves an 'ask'.** A dangerous command, an
+  explicit `"ask"` permission or an MCP tool is denied in `-p` / cron /
+  `/flows` runs unless `SWARM_CODE_HEADLESS_APPROVE=1` is set.
+- **The raw request body is no longer written to
+  `/tmp/swarm-code-last-body.json`** (or refreshed in `~/.swarm-code/` on every
+  call); `SWARM_CODE_DEBUG=1` writes `~/.swarm-code/last-body.json`, mode 600.
+
 ## [1.1.0] - 2026-07-15
 
 The responsiveness release: the agent never blocks the terminal and the

diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
@@ -7,6 +7,7 @@
 | `main.sw` | CLI flags, env config, headless mode, the main loop |
 | `agent.sw` | Prompt assembly, tool-call parsing/serialising, turn loop |
 | `ToolExecutor.sw` | Shared context, hook, guardrail, and permission boundary |
+| `CommandGuard.sw` | Token-aware shell-command risk classifier (hardline / dangerous) used by the permission gate for every command-running tool |
 | `tools.sw` | Raw tool handlers (`do_bash`, `do_read`, …) and `exec_raw()` dispatch |
 | `ToolRegistry.sw` | Tool identity plus execution-context allow/block policy |
 | `ToolSchemas.sw` | OpenAI-compatible function schemas for native tool calling |

diff --git a/README.md b/README.md
@@ -30,8 +30,8 @@ search: docker compose  (3 hits)
 > recall_skill deploy-mally-otp   # pull full playbook from ~/.swarm-code/skills/
 SKILL.md loaded. Building burrito binary …
 
-> /schedule add 1h "review open PRs"   # heartbeat-driven cron
-job 3 added (every 1h)
+> /schedule "1h" "review open PRs"   # heartbeat-driven cron (or "hourly", "daily 09:00")
+✓ scheduled job 3 (1h): review open PRs
 ```
 
 ## Quickstart
@@ -78,7 +78,21 @@ Point it at any OpenAI-compatible endpoint via `~/.swarm-code/settings.json`. Pr
 }
 ```
 
-Remote endpoints are opt-in — set `SWARM_CODE_ALLOW_REMOTE=1` (local-network-only by default). Optional semantic memory recall uses `SWARM_CODE_EMBED_ENDPOINT`.
+Remote endpoints are opt-in — set `SWARM_CODE_ALLOW_REMOTE=1` (local-network-only by default; an API key alone is not an opt-in). The check applies to every URL the LLM layer dials — primary, fallback, `providers`, and `/profile` switches. Optional semantic memory recall uses `SWARM_CODE_EMBED_ENDPOINT`.
+
+A repo-local `./.swarm-code.json` is **untrusted** (it ships with whatever you cloned): it may set `model`, `max_tokens`, `vision`, `chat_template_kwargs` and `llm_timeout_ms`, and may only *tighten* `permissions`. Its hooks, MCP servers, endpoints, API keys, providers and profiles are ignored, with a one-line notice. To let a repo you trust apply its file in full, run `swarm-code trust` in it (or `/trust` in the REPL; `swarm-code untrust` reverses it, `swarm-code trust --list` shows the list). That adds the directory to `"trusted_projects"` in `~/.swarm-code/settings.json`, which you can also edit by hand.
+
+### Hooks
+
+`settings.json` can run shell commands around tool calls; a `PreToolUse` hook that exits non-zero (or times out after 60s, or cannot be started) blocks the call, and the hook's output is shown to the model:
+
+```json
+{ "hooks": {
+    "PreToolUse":  [ { "matcher": "bash",       "command": "./scripts/check-cmd.sh" } ],
+    "PostToolUse": [ { "matcher": "edit|write", "command": "make fmt" } ] } }
+```
+
+A matcher is `*` or `|`-separated, case-insensitive alternatives, each matching a tool whose name contains it — plus tool families: `bash` also fires for every other tool that runs a shell command (`background`, `bg_server`, `run_tests`, `file_watch`, `log_wait`), and `edit` also for `multi_edit`. The tool arguments arrive as JSON on the hook's **stdin** and in the private file `$SWARM_CODE_ARGS_FILE`; `$SWARM_CODE_ARGS` carries them inline only when under 100KB (else `$SWARM_CODE_ARGS_OMITTED=1`), so a hook that must see every call should read stdin. `$SWARM_CODE_EVENT` / `$SWARM_CODE_TOOL` name the event and tool. Executable scripts in `~/.swarm-code/hooks/` (`pre_tool.sh`, `post_tool.sh`, `pre_llm.sh`, `post_llm.sh`) get the same treatment via stdin / `$SWARM_HOOK_DATA_FILE` — see `src/Hooks.sw`.
 
 ## Features
 
@@ -119,8 +133,11 @@ Panel agents run under the fail-closed `council_panel` context: they may inspect
 swarm-code runs shell commands, reads and writes files, and can reach the network — so it is built fail-closed:
 
 - **Local-network-only by default**; remote endpoints require an explicit `SWARM_CODE_ALLOW_REMOTE=1`.
+- A cloned repo's `./.swarm-code.json` cannot run hooks, start MCP servers, redirect the endpoint/key, or loosen permissions unless you trust the directory (`swarm-code trust`).
+- The `write`/`edit` tools refuse swarm-code's own control files (`~/.swarm-code/` hooks, schedule, settings, sessions, profile override; `.swarm-code.json`) — only `~/.swarm-code/memory/` and `skills/` are writable — and credential dirs (`.ssh`, `.aws`, `.gnupg`, …) case-insensitively.
 - Every tool runs through one **`ToolExecutor` policy boundary** — context allow-lists, argument-rewriting hooks, guardrails, and permissions — *before* any raw handler executes, and **fails closed** on a missing or unknown execution context.
-- A **hardline command blocklist** (`rm -rf /`, `mkfs`, `dd`, fork bombs, …) cannot be bypassed by environment overrides.
+- Headless runs (`-p`, cron jobs, `/flows` children) never auto-approve a call that needs permission — a dangerous command, an explicit `"ask"` setting, or an MCP tool — unless you set `SWARM_CODE_HEADLESS_APPROVE=1`.
+- A **hardline command blocklist** (`rm -rf /`, `mkfs`, `dd` to a disk, halt/reboot, fork bombs, …) cannot be bypassed by environment overrides. It covers every tool that runs a shell command (`bash`, `background`, `bg_server`, `run_tests`), and commands are parsed like `sh` does — respellings such as `rm -fr /`, `dd of=/dev/sda if=…` or `sh -c '…'` are caught, while words inside quotes, `echo`/`grep` arguments or heredoc bodies are not flagged. Denials name the matched pattern.
 - Subagents, MCP, and council contexts run under restricted (often read-only) policies.
 - Secrets are redacted from session logs and trajectory exports.
 

diff --git a/SECURITY.md b/SECURITY.md
@@ -23,22 +23,53 @@ backported.
 ## Security model
 
 - **Network isolation by default.** Only local-network endpoints are allowed
-  unless you explicitly set `SWARM_CODE_ALLOW_REMOTE=1`.
+  unless you explicitly set `SWARM_CODE_ALLOW_REMOTE=1` (an API key is not an
+  opt-in). The check runs on every URL the LLM layer dials — primary,
+  fallback, `providers`, and the `/profile` override — and parses it the way
+  curl does: http(s) only, no `user@` credentials, IP literals only as strict
+  dotted quads or bracketed IPv6.
+- **Untrusted project config.** A repository's `./.swarm-code.json` can only
+  set harmless keys (`model`, `max_tokens`, …) and *tighten* permissions. Its
+  hooks, MCP servers, endpoint / API key / providers / profiles, and any
+  permission loosening are ignored (with a notice) unless the directory is
+  listed under `trusted_projects` in `~/.swarm-code/settings.json` —
+  `swarm-code trust` (or `/trust`) adds the current directory for you.
+  Trust only repos you control: a trusted repo's hooks and MCP servers run
+  commands on your machine.
 - **Single policy boundary.** Every tool call — from the main agent, subagents,
   the council, and the MCP server — passes through `ToolExecutor`: context
   allow-lists, argument-rewriting hooks, guardrails, and permissions are applied
   *before* any raw handler runs. Execution **fails closed** when the execution
   context is missing or unknown.
+- **No unattended approvals.** In headless mode (`-p`, scheduled jobs, `/flows`
+  children) there is nobody to answer a permission prompt, so a call that
+  needs one — a dangerous command, a tool you set to `"ask"`, an MCP tool —
+  is denied. `SWARM_CODE_HEADLESS_APPROVE=1` opts back into auto-approval
+  (`/flows` children still hard-deny dangerous commands).
 - **Hardline command blocklist.** Destructive commands (`rm -rf /`, `mkfs`, `dd`
   to a device, fork bombs, and similar) are blocked and **cannot be bypassed by
-  environment overrides**.
+  environment overrides**. The check covers every tool that runs a shell
+  command (`bash`, `background`, `bg_server`, `run_tests`) and parses the
+  command like `sh` (quotes, separators, `$(…)`, `sh -c`, wrappers such as
+  `sudo`/`env`/`xargs`), so respellings are caught; it is a floor against
+  accidents, not a sandbox — a command assembled at runtime can't be judged.
+- **Protected paths.** The `write` / `edit` / `multi_edit` tools refuse
+  credential locations (`.ssh`, `.gnupg`, `.aws`, `/etc`, …) and swarm-code's
+  own control files — everything under `~/.swarm-code/` except the `memory/`
+  and `skills/` data dirs (hooks there run on every tool call), plus
+  `.swarm-code.json`. Matching is case-insensitive (macOS filesystems are).
+  `SWARM_CODE_UNSAFE_WRITES=1` lifts these guards.
 - **Restricted contexts.** Subagents, MCP-server, and council-panel contexts run
   under narrowed, often read-only, tool policies.
 - **Secret redaction.** Known secret patterns are redacted from session logs and
-  trajectory exports.
+  trajectory exports. The raw LLM request body is written to disk only with
+  `SWARM_CODE_DEBUG=1`, to `~/.swarm-code/last-body.json` with mode 600.
 
 ## Known limitations
 
+- Protected paths are enforced by the file tools (`write`, `edit`,
+  `multi_edit`, `browser_screenshot`), not by the shell: a `bash` command can
+  still write anywhere your user can, so review the commands you approve.
 - The council panel's read-only isolation is **tool-level**, not yet a filesystem
   sandbox — panelists inherit the read tool's filesystem visibility.
 - swarm-code runs the commands you (or a model you configured) direct it to. Run