Fix major correctness, security, and data-loss issues in core + agentic crates

[davidrhodus]

Two-pass review of the core and agentic-coding crates (hi-agent, hi-tools, hi-ai, hi-cli, hi-tui, hi-lsp); the hi-mlx/hi-cuda local-inference crates were out of scope. Every finding was verified against the code before fixing. All core-crate tests pass and clippy is clean under -D warnings; regression tests were added for the highest-impact fixes.

Pass 1 — initial fixes (d895a5b)

hi-tools (security)

• Reject IPv4-mapped IPv6 ([::ffff:169.254.169.254]) in the SSRF blocklist.
• Resolve symlinks in every existing ancestor so a workspace symlink through a not-yet-existing dir can't escape the path guard.
• Block rm -r of home/root/system paths even without -f.
• Cap web_fetch body reads (8 MiB) instead of buffering the whole response.

hi-agent (correctness / data loss)

• Read-only turns no longer treat the 12k soft elision threshold as the real context window (which durably discarded whole sessions); destructive drops use the real model window.
• Clamp the persist cursor so nudge-stripping can't panic persist() with an out-of-bounds slice.
• Enforce ReadOnly/ChatOnly tool_mode at execution time so text-promoted tool calls can't bypass it (explore subagents included).
• Don't abort the explore subagent before its first model call on common verbs.
• PID-scope the memory temp file so concurrent writers can't tear it.

hi-cli

• Skip the first-run wizard (which blind-overwrites config) when profiles exist.
• Don't apply a delegate child's partial diff on a non-zero exit.
• Require a name for /provider remove; track active profile on /provider switch.
• Keep 0600 perms in the api-key migration and don't materialize env secrets to disk.
• Exclude fleet/loop sessions from hi -c.

hi-ai / hi-lsp / hi-tui

• Match LSP responses only on method-less messages (request-id collision).
• Bound the OpenAI post-finish usage grace with a total deadline (was per-chunk → could hang).
• Keep a finished Anthropic answer on an unclean mid-stream close instead of re-billing.
• Preserve cache tokens / reference-call usage in fallback and moa; saturating token math.
• Reclaim the loop single-firer lock atomically to avoid two holders double-firing.

Pass 2 — adversarial audit of pass 1 + deeper review (1a76c5e)

Regressions introduced by pass 1 (caught by an adversarial re-review)

• fallback.rs: the usage merge dropped the winner's context_occupancy / input_includes_cache, mis-counting cache tokens and tripping early auto-compaction — now preserves the winner's scalars.
• guard.rs: dropping the -f requirement over-blocked routine deep cleanup (rm -r ~/.cache/x). Tiered it — top-level roots (rm -r ~, /etc) block on -r alone; deeper paths only with -f.

New findings

• checkpoint.rs: /undo silently skipped non-ASCII filenames (git octal-quotes --name-status paths) — switched to NUL-delimited -z output. Restores the "anything is undoable" guarantee.
• hi-agent side-call errors (skeptic/curate/memory/plan/finalize/summarize) clobbered the main context_used gauge, disabling the next auto-compaction — added add_side_error_usage.
• tool_deps didn't serialize a write after an earlier read of the same path ([read X, write X] could read a torn file).
• hi-tui event_log grew unbounded (one entry per streamed chunk, never trimmed) — capped and cleared on /clear.
• loops: firings bumped at spawn, so a failed first firing reported "nothing new" against a baseline it never established — roll back on error.
• best-of/delegate/fleet children re-resolved config and a default-profile literal api_key shadowed the parent's key (silent auth failure) — pass HI_FORCE_API_KEY (env, not argv).
• provider_form: /provider edit of an Ollama profile opened focused on the hidden API-key field.

Deliberately deferred (low-severity or out of scope)

• Background-kill nanosecond-window PGID-recycle race and the loop-lock 3-process race (the real 2-process TUI+daemon threat is handled).
• Anthropic malformed-SSE frames are silently skipped (defensible resilience; hard-erroring risks failing turns on benign vendor frames).
• Per-profile migration persist, child config-flag forwarding (--compat/--tool-mode), and the hi-tui O(transcript)-per-token render cost — all worth follow-ups.

Testing

cargo test and cargo clippy --all-targets -- -D warnings pass across hi-agent, hi-ai, hi-tools, hi (hi-cli), hi-tui, hi-lsp.

🤖 Generated with Claude Code