Remove safety feature and rename prompts to use md format.

Author: beacoder

README.md

@@ -26,26 +26,23 @@ A Python port of the Emacs [gptel-agent-harness](https://github.com/beacoder/gpt
   delivered in the original call order.
 - **Default agent prompts** — the main agent and sub-agents each get a
   distinct default system prompt bundled with the package
-  (`prompts/agent.txt`, `prompts/subagent.txt`), with YAML frontmatter
+  (`prompts/agent.md`, `prompts/subagent.md`), with YAML frontmatter
   stripped and the `{{SKILLS}}` placeholder filled from the discovered
   skill directory. The main prompt is prefixed with the project context
   files and the task-completion rules; sub-agents get only their own
   prompt. `/init` `/review` `/explain` and custom commands
-  (`prompts/commands/*.txt`) run with their own prompt for that run.
+  (`prompts/commands/*.md`) run with their own prompt for that run.
 - **Plan / Build modes** — plan mode is read-only except the per-session
   plan file; PlanExit switches back to build with an "execute the plan"
   prompt; sub-agents in plan mode receive the read-only reminder.
-- **Safety** — forbidden paths (default `/mnt/`), catastrophic/destructive/
-  dangerous bash pattern tiers, per-session allow/deny memory, 300s command
-  timeout, and a plan-mode read-only bash whitelist.
 - **Sessions** — auto-saved after every response to
   `~/.local/share/python-agent-harness/sessions/`, LLM-generated titles
   (one-shot per session, fired when the agent loop finishes; the file is
   renamed to `<title>_<TS>.md`), `/restore` (with `--latest`) and
   `/sessions` TUI commands.
 - **Commands** — `/init` (create/update AGENTS.md), `/review` (uncommitted
   changes / commit / branch / PR), `/summary`, `/explain` and custom
-  commands from `prompts/commands/*.txt` — all TUI slash commands.
+  commands from `prompts/commands/*.md` — all TUI slash commands.
   Tool availability: `/init`/`/review` may use **all
   tools except PlanExit** (the PlanExit tool is hidden for the run,
   including for spawned sub-agents); custom commands may use all tools
@@ -56,7 +53,7 @@ A Python port of the Emacs [gptel-agent-harness](https://github.com/beacoder/gpt
   (or Alt+Enter) to submit, and **Tab completion** (Tab to complete,
   Shift+Tab to cycle backwards): the first token starting with `/`
   completes against the slash commands (builtins + custom
-  `prompts/commands/*.txt`); after a slash command's space, Tab
+  `prompts/commands/*.md`); after a slash command's space, Tab
   completes paths relative to the project dir (absolute and `~` paths
   work too; directories get a trailing `/` to keep drilling).  In plain
   messages, any token containing `/` or starting with `~` (e.g.
@@ -66,8 +63,7 @@ A Python port of the Emacs [gptel-agent-harness](https://github.com/beacoder/gpt
 - **TUI** — rich live interface with a pinned status bar (mode, context
   usage, spinner), streaming assistant output, tool-result previews, a
   pinned Todos panel (sub-agent lists shown with a `sub:` label), and
-  numbered-choice questions for Bash approval / Question tool /
-  PlanExit confirmations.
+  numbered-choice questions for Question tool / PlanExit confirmations.
 - **Diff rendering** — Edit/Write tool calls capture a unified diff of
   the file change and render it inline (red/green) in the TUI, so file
   edits are visible without leaving the app.
@@ -141,7 +137,7 @@ TUI slash commands: `/plan` `/build` `/init` `/review` `/explain`
 code and `/summary` appends a conversation summary (both TUI-only);
 `/sessions` lists saved sessions and `/restore [path|title|--latest]`
 restores one (`/restore` matches sessions by title substring). Custom
-commands from `prompts/commands/*.txt` are TUI slash commands too
+commands from `prompts/commands/*.md` are TUI slash commands too
 (TUI-only — no CLI subcommand is registered for them).
 
 Input editing: type your message, press **Enter** for a new line, and
@@ -160,7 +156,6 @@ python_agent_harness/
 ├── client.py       OpenAI-compatible streaming client (httpx)
 ├── models.py       Message / ToolCall / ToolSpec data classes
 ├── token_estimator.py  CJK-aware token estimation + calibration
-├── safety.py       path guards + bash policy tiers
 ├── planmode.py     build/plan mode + plan file lifecycle
 ├── prompts.py      prompt loading + system prompt assembly
 ├── session_store.py  session persistence + titles
@@ -187,7 +182,7 @@ Python ≥ 3.11 is required (CI runs 3.11 / 3.12 / 3.13).
 - [x] Tool-result sanitization (None → error placeholder)
 - [x] Compaction: frame, resume last request
 - [x] Plan mode: read-only + plan-file writes only
-- [x] Bash tiers: catastrophic → plan gate → destructive → dangerous → run
+- [x] Bash: Ctrl-C process-group kill
 - [x] Session metadata round-trip and title sanitization
 - [x] One-shot LLM title generation after the agent loop finishes
 - [x] Ctrl-C cancel: stale workers can't clobber the next run's history

pyproject.toml

@@ -5,7 +5,7 @@ build-backend = "setuptools.build_meta"
 [project]
 name = "python-agent-harness"
 version = "0.1.0"
-description = "Python agent execution harness: agent loop, tools, safety, cache, plan/build modes, sessions"
+description = "Python agent execution harness: agent loop, tools, cache, plan/build modes, sessions"
 readme = "README.md"
 requires-python = ">=3.11"
 dependencies = [
@@ -21,4 +21,4 @@ python-agent-harness = "python_agent_harness.cli:main"
 include = ["python_agent_harness*"]
 
 [tool.setuptools.package-data]
-python_agent_harness = ["prompts/*.txt", "prompts/commands/*.txt"]
+python_agent_harness = ["prompts/*.md", "prompts/commands/*.md"]

python_agent_harness/agent.py

@@ -168,7 +168,7 @@ def compact(self) -> bool:
             conversation = "\n\n".join(
                 f"{m.role}: {m.text()}" for m in self.messages if m.text()
             )
-            system = read_prompt_file("compact.txt")
+            system = read_prompt_file("compact.md")
             resp, _ = self.session.client.chat_sync(
                 [Message(role="user", content=conversation)], system=system
             )

python_agent_harness/agent_session.py

@@ -1,10 +1,9 @@
-"""AgentSession: the runtime hub wiring tools, safety, plan mode.
+"""AgentSession: the runtime hub wiring tools, plan mode.
 
-The session implements the ToolContext-facing API (path guards, bash
-verdicts, sub-agents, questions) and the
-agent-loop-facing API (client, calibrator, plan mode, auto-save,
-notifications).  The TUI layer subclasses it to provide interactive
-confirmations.
+The session implements the ToolContext-facing API (sub-agents,
+questions) and the agent-loop-facing API (client, calibrator, plan
+mode, auto-save, notifications).  The TUI layer subclasses it to
+provide interactive confirmations.
 """
 
 from __future__ import annotations
@@ -17,7 +16,6 @@
 from .client import Client
 from .models import AgentMode
 from .planmode import PlanMode
-from .safety import BashPolicy, SafetyViolation, check_path
 from .session_store import SessionStore
 from .subagent import run_subagent
 from .token_estimator import TokenCalibrator
@@ -96,7 +94,6 @@ def __init__(
         self.registry = registry or Registry()
         self.calibrator = TokenCalibrator()
         self.plan_mode = PlanMode(project_dir)
-        self.bash_policy = BashPolicy()
         self.tool_ctx = ToolContext(self)
         self._tool_diffs: dict[str, str] = {}
         # thread-local: parallel sub-agents each execute tools in their
@@ -145,7 +142,6 @@ def __init__(
         self.notify_fn: Callable[[str], None] | None = None
         self.confirm_fn: Callable[[str], bool] | None = None
         self.ask_fn: Callable[[list[dict]], str] | None = None
-        self.bash_approval_fn: Callable[[str], tuple[bool, str]] | None = None
 
     # ------------------------------------------------------------------
     # notifications
@@ -184,7 +180,7 @@ def tool_specs(self, exclude: tuple[str, ...] = ()) -> list:
     def execute_tool(
         self, name: str, args: dict[str, Any], call_id: str | None = None
     ) -> str:
-        """Execute a tool with safety integration.
+        """Execute a tool.
 
         ``call_id`` (when given) lets Edit/Write attach a unified diff
         for the TUI to render; retrieve it afterwards with
@@ -196,14 +192,6 @@ def execute_tool(
             if blocked:
                 return blocked
 
-        if name in ("Write", "Edit", "Insert", "Mkdir"):
-            path = self._tool_path(name, args)
-            if path:
-                try:
-                    check_path(path, name)
-                except SafetyViolation as e:
-                    return str(e)
-
         self._active_call.call_id = call_id
         try:
             result = self.registry.execute(name, args, self.tool_ctx)
@@ -225,7 +213,10 @@ def take_diff(self, call_id: str) -> str | None:
 
     def _plan_blocked(self, name: str, args: dict[str, Any]) -> str | None:
         if name == "Bash":
-            return None  # handled by bash policy below
+            return (
+                "Error: blocked by plan mode (read-only phase); "
+                "Bash is disabled — use Read/Glob/Grep for read-only access"
+            )
         path = self._tool_path(name, args)
         if path and path != self.plan_mode.plan_file:
             return (
@@ -248,54 +239,6 @@ def _tool_path(self, name: str, args: dict[str, Any]) -> str | None:
     # ------------------------------------------------------------------
     # ToolContext-facing API
     # ------------------------------------------------------------------
-    def guard_path(self, path: str, tool_name: str) -> None:
-        check_path(path, tool_name)
-
-    def verify_bash(self, command: str) -> str | None:
-        """Return an error string to deliver, or None to run.
-
-        The interactive approval prompt is serialized: parallel tool
-        rounds may reach CONFIRM simultaneously, but the user can only
-        answer one question at a time.  Command *execution* stays
-        parallel — the lock is released before the process starts.
-        """
-        with self._interactive_lock:
-            self.bash_policy.plan_mode = self.plan_mode.is_plan
-            verdict = self.bash_policy.verdict(command)
-            if verdict != "CONFIRM":
-                return verdict
-            if self.bash_approval_fn:
-                run, answer = self.bash_approval_fn(command)
-            else:
-                run, answer = self._ask_via_tui(command)
-            if answer == "allow":
-                self.bash_policy.record(command, "allow")
-                return None
-            if answer == "deny":
-                self.bash_policy.record(command, "deny")
-                return "Error: Bash command rejected by user approval (denied for this session)."
-            if run:
-                return None
-            return "Error: Bash command rejected by user approval."
-
-    def _ask_via_tui(self, command: str) -> tuple[bool, str]:
-        prompt = (
-            "Dangerous Bash command:\n\n"
-            f"{command}\n\n"
-            "Run it? [y]es / [n]o / [a]lways allow (session) / [d]eny (session)"
-        )
-        if self.ask_fn is None:
-            # headless fallback: run once (matches confirm-tool-calls opt-out)
-            return True, "run"
-        answer = self.ask_fn([{"question": prompt}])
-        if answer.startswith("a"):
-            return True, "allow"
-        if answer.startswith("d"):
-            return False, "deny"
-        if answer.startswith("y") or "Yes" in answer:
-            return True, "run"
-        return False, "run"
-
     def update_todos(self, todos: list[dict]) -> None:
         """Store TODOS so the pinned TUI panel shows the current list."""
         self.todos = list(todos)
@@ -376,9 +319,9 @@ def _mode_prompts(self) -> dict[str, str]:
         from .prompts import read_prompt_file
 
         return {
-            "plan": read_prompt_file("plan.txt"),
-            "plan-mode": read_prompt_file("plan-mode.txt"),
-            "build-switch": read_prompt_file("build-switch.txt"),
+            "plan": read_prompt_file("plan.md"),
+            "plan-mode": read_prompt_file("plan-mode.md"),
+            "build-switch": read_prompt_file("build-switch.md"),
         }
 
     # ------------------------------------------------------------------
@@ -408,7 +351,7 @@ def auto_save(self, messages: list, system: str | None) -> None:
             self.log(f"auto-save failed: {e}")
 
     def generate_session_title(self) -> None:
-        """Generate a title from the first real user message (title.txt).
+        """Generate a title from the first real user message (title.md).
 
         Mirrors gptel-agent-harness--generate-session-title: one-shot per
         session (guarded by store.title / title_pending); on success the
@@ -432,7 +375,7 @@ def generate_session_title(self) -> None:
             from .prompts import read_prompt_file
             from .models import Message as Msg
 
-            system = read_prompt_file("title.txt")
+            system = read_prompt_file("title.md")
             resp, _ = self.client.chat_sync(
                 [Msg(role="user", content=first)],
                 system=system,
@@ -523,7 +466,7 @@ def compact_conversation(self) -> tuple[bool, str]:
         self.compacting = True
         try:
             conversation = self._conversation_text(messages)
-            system = read_prompt_file("compact.txt")
+            system = read_prompt_file("compact.md")
             resp, _ = self.client.chat_sync(
                 [Msg(role="user", content=conversation)], system=system
             )
@@ -562,7 +505,7 @@ def summarize_conversation(self) -> str:
         if not messages:
             return "Nothing to summarize."
         conversation = self._conversation_text(messages)
-        system = read_prompt_file("summary.txt")
+        system = read_prompt_file("summary.md")
         try:
             resp, _ = self.client.chat_sync(
                 [Msg(role="user", content=conversation)], system=system

python_agent_harness/cli.py

@@ -4,7 +4,7 @@
   run [project]            interactive TUI agent session (default)
   config [--init]          show effective LLM config / write a template file
 
-Custom commands (prompts/commands/*.txt) — like init, review,
+Custom commands (prompts/commands/*.md) — like init, review,
 sessions, restore and summary/explain — are TUI slash commands only;
 they are NOT registered as CLI subcommands.
 

python_agent_harness/commands.py

@@ -9,7 +9,7 @@
 Tool availability per command:
 - init/review: all tools EXCEPT PlanExit (they are one-shot runs that
   must not end in a plan/build handoff)
-- custom commands (prompts/commands/*.txt): all tools, incl. PlanExit
+- custom commands (prompts/commands/*.md): all tools, incl. PlanExit
 - compact/summary: no tools at all (direct chat_sync calls, like the
   session-title generation)
 """
@@ -89,7 +89,7 @@ def prepare(
 def initialize_command() -> SessionCommand:
     return SessionCommand(
         name="initialize",
-        prompt_file="initialize.txt",
+        prompt_file="initialize.md",
         kickoff="Analyze the repository at ${path} and create/update AGENTS.md.\n",
         buffer_name="*gptel-agent-init:*",
         status=" Initializing...",
@@ -101,7 +101,7 @@ def initialize_command() -> SessionCommand:
 def review_command() -> SessionCommand:
     return SessionCommand(
         name="review",
-        prompt_file="review.txt",
+        prompt_file="review.md",
         kickoff="Review the requested code changes.",
         buffer_name="*gptel-agent-review*",
         status=" Reviewing...",
@@ -144,7 +144,7 @@ def load_custom_commands() -> list[SessionCommand]:
     if not COMMANDS_DIR.is_dir():
         return []
     commands = []
-    for f in sorted(COMMANDS_DIR.glob("*.txt")):
+    for f in sorted(COMMANDS_DIR.glob("*.md")):
         name = custom_name(f.name)
         if not name:
             continue