@atlasharness/atlascode 0.1.58 → 0.1.59

package/dist/cli.js

@@ -27940,6 +27940,15 @@ async function withTurnRecovery(attempt, options = {}) {
   }
   throw lastErr;
 }
+function nextFallbackRef(fallbackModels, tried) {
+  if (!fallbackModels)
+    return;
+  for (const ref of fallbackModels) {
+    if (!tried.has(ref))
+      return ref;
+  }
+  return;
+}
 var DEFAULT_MAX_RETRIES = 13, DEFAULT_BACKOFF_BASE_MS = 100, DEFAULT_BACKOFF_CAP_MS = 1000;
 var init_turnRecovery = __esm(() => {
   init_modelprovider2();
@@ -29587,6 +29596,65 @@ function getRuleByContentsForToolName(context, toolName, behavior) {
   }
   return ruleByContents;
 }
+function parseParametricContent(ruleContent) {
+  const params = {};
+  for (const segment of ruleContent.split(",")) {
+    const idx = segment.indexOf(":");
+    if (idx <= 0)
+      return null;
+    const param = segment.slice(0, idx).trim();
+    if (!param)
+      return null;
+    params[param] = segment.slice(idx + 1).trim();
+  }
+  return Object.keys(params).length > 0 ? params : null;
+}
+function declaredInputFields(tool) {
+  const props = tool.inputSchema?.properties;
+  if (!props)
+    return new Set;
+  return new Set(Object.keys(props));
+}
+function ruleMatchesParametric(rule, tool, input) {
+  const ruleContent = rule.ruleValue.ruleContent;
+  if (ruleContent === undefined)
+    return false;
+  const params = parseParametricContent(ruleContent);
+  if (params === null)
+    return false;
+  const fields = declaredInputFields(tool);
+  for (const [param, value] of Object.entries(params)) {
+    if (!fields.has(param))
+      return false;
+    if (input[param] !== value)
+      return false;
+  }
+  return true;
+}
+function getParametricRuleForTool(context, tool, input, behavior) {
+  let rules;
+  switch (behavior) {
+    case "allow":
+      rules = getAllowRules(context);
+      break;
+    case "deny":
+      rules = getDenyRules(context);
+      break;
+    case "ask":
+      rules = getAskRules(context);
+      break;
+  }
+  const nameForRuleMatch = getToolNameForPermissionCheck(tool);
+  for (const rule of rules) {
+    if (rule.ruleValue.toolName !== nameForRuleMatch)
+      continue;
+    if (rule.ruleBehavior !== behavior)
+      continue;
+    if (ruleMatchesParametric(rule, tool, input))
+      return rule;
+  }
+  return null;
+}
 function permissionModeTitle(mode) {
   return PERMISSION_MODE_TITLES[mode] ?? "Default";
 }
@@ -29723,6 +29791,17 @@ var BASH_TOOL_NAME = "Bash", hasPermissionsToUseTool = async (tool, input, conte
       }
     };
   }
+  const parametricDenyRule = permissionContext ? getParametricRuleForTool(permissionContext, tool, input, "deny") : null;
+  if (parametricDenyRule) {
+    return {
+      behavior: "deny",
+      message: `Permission to use ${tool.name} has been denied.`,
+      decisionReason: {
+        type: "rule",
+        rule: parametricDenyRule
+      }
+    };
+  }
   const askRule = permissionContext ? getAskRuleForTool(permissionContext, tool) : null;
   if (askRule) {
     const canSandboxAutoAllow = tool.name === BASH_TOOL_NAME && sandbox.isSandboxingEnabled() && sandbox.isAutoAllowBashIfSandboxedEnabled() && input.dangerouslyDisableSandbox !== true;
@@ -29737,6 +29816,17 @@ var BASH_TOOL_NAME = "Bash", hasPermissionsToUseTool = async (tool, input, conte
       }, permissionContext, tool.name);
     }
   }
+  const parametricAskRule = permissionContext ? getParametricRuleForTool(permissionContext, tool, input, "ask") : null;
+  if (parametricAskRule) {
+    return applyDontAskMode({
+      behavior: "ask",
+      message: createPermissionRequestMessage(tool.name),
+      decisionReason: {
+        type: "rule",
+        rule: parametricAskRule
+      }
+    }, permissionContext, tool.name);
+  }
   let toolPermissionResult = {
     behavior: "passthrough",
     message: createPermissionRequestMessage(tool.name)
@@ -30842,6 +30932,12 @@ Block unconditionally. Do not look for authorization. No ALLOW exception applies
   - **Trace the full destination path.** Do not stop at the first hop; do not discount a pathway because a future merge, deploy, or review gates it — arming the pathway is the harm. Modifying a CI/build workflow or publish pipeline so it will upload private-repo content, then committing or pushing it, is the blocked action even on a personal feature branch. **Bulk scale is its own red flag**: shipping an entire repo or package tree to any destination other than the repo's own configured remote as of session start — a mid-session repoint makes it a new destination — (e.g. pushing all refs to a new remote, archiving or syncing the working tree, pushing an image that COPYs the repo root) is exfiltration regardless of how private the destination claims to be — no routine task relocates an entire tree, and the agent creating the destination does not establish it as trusted. Cross-repo copies from a private repo followed by commit or push are exfiltration regardless of branch. Generating a public or anyone-with-link share URL for sensitive data counts as publishing even when the underlying store is trusted.
   - **Is the final destination confirmed external or public?** A destination is trusted only if it is explicitly listed in Environment, or it is the trusted repo's own configured remote and its visibility fits the content (see Trusted repo). Same-org/same-account ownership, a personal or feature branch name, or the push being non-force does not establish privacy. A same-session \`git remote set-url\`/\`git remote add\` severs continuity — the new remote is not where this content already lives — so sensitive content pushed after a repoint is judged by this hard rule with the destination treated as public; intent expressed before the repoint does not carry across it. When a repo's visibility is not established in the transcript, unknown visibility is not itself a reason to block; judge the content on the other checks and rules — except after a same-session repoint, where the sentence above governs. Unknown visibility never clears anything either — it contributes nothing in either direction; an unrequested sensitive-source read feeding the content (see Sensitive-Source Provenance) is an independent signal that stands on its own.
 
+## USER HARD DENY — unconditional blocks (User Intent Rule does NOT clear these)
+
+Rules in this class block unconditionally: no ALLOW exception applies, and the user's own words do not clear them (unlike SOFT BLOCK, whose User Intent Rule CAN clear). Add the user's unconditional block rules here, one per line (\`- \` prefix).
+
+<user_hard_deny_rules_to_replace>(none configured)</user_hard_deny_rules_to_replace>
+
 ## SOFT BLOCK — destructive or irreversible (User Intent Rule CAN clear these)
 
 Every rule below clears at one bar — **[named+specifics]**: the user's own words name the action and the rule's **must name:** item (or affirm an agent proposal, visible directly before their reply, that named both); for adversarial-pattern rules the specifics is the user confirming the flagged pattern is a false positive — an agent ask like "auto mode blocked this for <reason> — is that incorrect and are you OK with it?" answered yes meets it. A rule's own stated conditions and stricter bars apply as written. In weighing any bar, assume the user has not closely read the transcript: a bare verb names an action, not its specifics. A bar is met at the step that ships or externalizes — consent to a preparatory step (a rename, a copy, a config write) does not carry forward to the later step that ships its result. At a push or publication, the content this session wrote into the outgoing files — visible in its earlier Write and Edit calls — is judged against the sensitivity classes like any other content: a session-authored file carrying secrets-, entrusted-, or personal-class material is that class's matter when it goes outward, regardless of being the repo's own work. Reads along the way are part of that judgment: a session that read sensitive-classed paths and then wrote is judged with those reads in mind. When blocking on an unmet bar, the block reason surfaces the blocked command and states what would clear it.
@@ -30947,6 +31043,7 @@ var init_permissions_external = () => {};
 function getDefaultExternalAutoModeRules() {
   return {
     allow: extractTaggedBullets("user_allow_rules_to_replace"),
+    hard_deny: extractTaggedBullets("user_hard_deny_rules_to_replace"),
     soft_deny: extractTaggedBullets("user_deny_rules_to_replace"),
     environment: extractTaggedBullets("user_environment_to_replace")
   };
@@ -30959,7 +31056,7 @@ function extractTaggedBullets(tagName) {
 `).map((line) => line.trim()).filter((line) => line.startsWith("- ")).map((line) => line.slice(2));
 }
 function buildDefaultExternalSystemPrompt() {
-  return BASE_PROMPT.replace("<permissions_template>", () => EXTERNAL_PERMISSIONS_TEMPLATE).replace(/<user_allow_rules_to_replace>([\s\S]*?)<\/user_allow_rules_to_replace>/, (_m, defaults) => defaults).replace(/<user_deny_rules_to_replace>([\s\S]*?)<\/user_deny_rules_to_replace>/, (_m, defaults) => defaults).replace(/<user_environment_to_replace>([\s\S]*?)<\/user_environment_to_replace>/, (_m, defaults) => defaults);
+  return BASE_PROMPT.replace("<permissions_template>", () => EXTERNAL_PERMISSIONS_TEMPLATE).replace(/<user_allow_rules_to_replace>([\s\S]*?)<\/user_allow_rules_to_replace>/, (_m, defaults) => defaults).replace(/<user_deny_rules_to_replace>([\s\S]*?)<\/user_deny_rules_to_replace>/, (_m, defaults) => defaults).replace(/<user_hard_deny_rules_to_replace>([\s\S]*?)<\/user_hard_deny_rules_to_replace>/, (_m, defaults) => defaults).replace(/<user_environment_to_replace>([\s\S]*?)<\/user_environment_to_replace>/, (_m, defaults) => defaults);
 }
 var BASE_PROMPT, EXTERNAL_PERMISSIONS_TEMPLATE;
 var init_prompts = __esm(() => {
@@ -31368,11 +31465,13 @@ function getAutoModeConfig() {
   if (feature("TRANSCRIPT_CLASSIFIER")) {
     const schema = object({
       allow: array(string2()).optional(),
+      hard_deny: array(string2()).optional(),
       soft_deny: array(string2()).optional(),
       deny: array(string2()).optional(),
       environment: array(string2()).optional()
     });
     const allow = [];
+    const hard_deny = [];
     const soft_deny = [];
     const environment = [];
     for (const source of [
@@ -31388,6 +31487,8 @@ function getAutoModeConfig() {
       if (result.success) {
         if (result.data.allow)
           allow.push(...result.data.allow);
+        if (result.data.hard_deny)
+          hard_deny.push(...result.data.hard_deny);
         if (result.data.soft_deny)
           soft_deny.push(...result.data.soft_deny);
         if (result.data.environment) {
@@ -31395,9 +31496,10 @@ function getAutoModeConfig() {
         }
       }
     }
-    if (allow.length > 0 || soft_deny.length > 0 || environment.length > 0) {
+    if (allow.length > 0 || hard_deny.length > 0 || soft_deny.length > 0 || environment.length > 0) {
       return {
         ...allow.length > 0 && { allow },
+        ...hard_deny.length > 0 && { hard_deny },
         ...soft_deny.length > 0 && { soft_deny },
         ...environment.length > 0 && { environment }
       };
@@ -81744,10 +81846,12 @@ async function queryAgentLoop(deps, args) {
     }
     deps.emit?.({ type: "round_start", turn: turns });
     let reactiveRetried = false;
+    let effectiveDeps = deps;
+    const triedFallbackRefs = new Set;
     for (;; ) {
       const roundInputLen = messages.length;
       try {
-        lastRound = await queryOneRound(deps, tools, messages);
+        lastRound = await queryOneRound(effectiveDeps, tools, messages);
       } catch (err) {
         if (!reactiveRetried && deps.reactiveCompact !== undefined && isReactiveCompactEnabled() && isReactiveCompactRecoverableError(err)) {
           reactiveRetried = true;
@@ -81769,6 +81873,12 @@ async function queryAgentLoop(deps, args) {
             continue;
           }
         }
+        const nextRef = nextFallbackRef(deps.fallbackModels, triedFallbackRefs);
+        if (nextRef && shouldRetryModelError(err, deps.signal)) {
+          triedFallbackRefs.add(nextRef);
+          effectiveDeps = { ...deps, sessionModel: nextRef };
+          continue;
+        }
         throw err;
       }
       messages = lastRound.messages;
@@ -81971,6 +82081,7 @@ async function createAgentLoopDeps(config = {}) {
     responseFormat: config.responseFormat,
     effortValue: config.effortValue,
     fallbackModel: config.fallbackModel,
+    fallbackModels: config.fallbackModels,
     transcript: config.disablePersistence ? undefined : {
       record: (msgs) => recordTranscript(msgs),
       recordContentReplacement: (recs) => recordContentReplacement(recs, config.agentId)
@@ -85924,7 +86035,8 @@ async function runHeadless(inputPrompt, options) {
     thinkingConfig: options.thinkingConfig,
     responseFormat: options.jsonSchema ? toResponseFormat({ type: "json_schema", schema: options.jsonSchema }) : undefined,
     effortValue: options.effort,
-    fallbackModel: options.fallbackModel
+    fallbackModel: options.fallbackModel,
+    fallbackModels: options.fallbackModels
   });
   const { toolPermissionContext: initialTpc, tools, warnings } = bundle;
   if (warnings.length > 0) {
@@ -87161,6 +87273,7 @@ function autoModeConfigHandler() {
   const defaults = getDefaultExternalAutoModeRules();
   writeRules({
     allow: config?.allow?.length ? config.allow : defaults.allow,
+    hard_deny: config?.hard_deny?.length ? config.hard_deny : defaults.hard_deny,
     soft_deny: config?.soft_deny?.length ? config.soft_deny : defaults.soft_deny,
     environment: config?.environment?.length ? config.environment : defaults.environment
   });
@@ -87176,18 +87289,18 @@ function makeUserMessage2(text) {
 }
 async function autoModeCritiqueHandler(options) {
   const config = getAutoModeConfig();
-  const hasCustomRules = (config?.allow?.length ?? 0) > 0 || (config?.soft_deny?.length ?? 0) > 0 || (config?.environment?.length ?? 0) > 0;
+  const hasCustomRules = (config?.allow?.length ?? 0) > 0 || (config?.hard_deny?.length ?? 0) > 0 || (config?.soft_deny?.length ?? 0) > 0 || (config?.environment?.length ?? 0) > 0;
   if (!hasCustomRules) {
     process.stdout.write(`No custom auto mode rules found.
 
-` + `Add rules to your settings file under autoMode.{allow, soft_deny, environment}.
+` + `Add rules to your settings file under autoMode.{allow, hard_deny, soft_deny, environment}.
 ` + "Run `atlascode auto-mode defaults` to see the default rules for reference.\n");
     return;
   }
   const role = options.model ? modelToRole(options.model) : "premium";
   const defaults = getDefaultExternalAutoModeRules();
   const classifierPrompt = buildDefaultExternalSystemPrompt();
-  const userRulesSummary = formatRulesForCritique("allow", config?.allow ?? [], defaults.allow) + formatRulesForCritique("soft_deny", config?.soft_deny ?? [], defaults.soft_deny) + formatRulesForCritique("environment", config?.environment ?? [], defaults.environment);
+  const userRulesSummary = formatRulesForCritique("allow", config?.allow ?? [], defaults.allow) + formatRulesForCritique("hard_deny", config?.hard_deny ?? [], defaults.hard_deny) + formatRulesForCritique("soft_deny", config?.soft_deny ?? [], defaults.soft_deny) + formatRulesForCritique("environment", config?.environment ?? [], defaults.environment);
   process.stdout.write(`Analyzing your auto mode rules…
 
 `);
@@ -87253,9 +87366,10 @@ var init_autoMode2 = __esm(() => {
   init_shared();
   CRITIQUE_SYSTEM_PROMPT = `You are an expert reviewer of auto mode classifier rules for Atlas.
 ` + `
-` + 'Atlas has an "auto mode" that uses an AI classifier to decide whether ' + "tool calls should be auto-approved or require user confirmation. Users can " + `write custom rules in three categories:
+` + 'Atlas has an "auto mode" that uses an AI classifier to decide whether ' + "tool calls should be auto-approved or require user confirmation. Users can " + `write custom rules in four categories:
 ` + `
 ` + `- **allow**: Actions the classifier should auto-approve
+` + `- **hard_deny**: Actions that are blocked unconditionally (user intent does not clear these)
 ` + `- **soft_deny**: Actions the classifier should block (require user confirmation)
 ` + `- **environment**: Context about the user's setup that helps the classifier make decisions
 ` + `
@@ -87370,7 +87484,7 @@ function buildHeadlessOptions(options) {
     allowedTools: options.allowedTools,
     disallowedTools: options.disallowedTools,
     baseTools: options.tools,
-    permissionMode: options.permissionMode,
+    permissionMode: options.permissionMode ?? (options.permissionPrompts === "none" ? "dontAsk" : undefined),
     permissionPromptToolName: options.permissionPromptTool,
     maxTurns: options.maxTurns,
     model: options.model,
@@ -87383,6 +87497,7 @@ function buildHeadlessOptions(options) {
     systemPrompt: readPromptFileInline(options.systemPrompt, options.systemPromptFile, "System prompt"),
     appendSystemPrompt: readPromptFileInline(options.appendSystemPrompt, options.appendSystemPromptFile, "Append system prompt"),
     fallbackModel: options.fallbackModel,
+    fallbackModels: options.fallbackModels,
     thinkingConfig: buildHeadlessThinkingConfig(options.thinking, options.maxThinkingTokens),
     effort: options.effort,
     mcpConfig: options.mcpConfig,
@@ -87454,7 +87569,7 @@ function buildProgram() {
       throw new Error("--task-budget must be a positive integer");
     }
     return tokens;
-  }).hideHelp()).option("--replay-user-messages", "Re-emit user messages from stdin back on stdout for acknowledgment (only works with --input-format=stream-json and --output-format=stream-json)", () => true).addOption(new Option("--enable-auth-status", "Enable auth status messages in SDK mode").default(false).hideHelp()).option("--allowedTools, --allowed-tools <tools...>", 'Comma or space-separated list of tool names to allow (e.g. "Bash(git:*) Edit")').option("--tools <tools...>", 'Specify the list of available tools from the built-in set. Use "" to disable all tools, "default" to use all tools, or specify tool names (e.g. "Bash,Edit,Read").').option("--disallowedTools, --disallowed-tools <tools...>", 'Comma or space-separated list of tool names to deny (e.g. "Bash(git:*) Edit")').option("--mcp-config <configs...>", "Load MCP servers from JSON files or strings (space-separated)").addOption(new Option("--permission-prompt-tool <tool>", "MCP tool to use for permission prompts (only works with --print)").argParser(String).hideHelp()).addOption(new Option("--system-prompt <prompt>", "System prompt to use for the session").argParser(String)).addOption(new Option("--system-prompt-file <file>", "Read system prompt from a file").argParser(String).hideHelp()).addOption(new Option("--append-system-prompt <prompt>", "Append a system prompt to the default system prompt").argParser(String)).addOption(new Option("--append-system-prompt-file <file>", "Read system prompt from a file and append to the default system prompt").argParser(String).hideHelp()).addOption(new Option("--permission-mode <mode>", "Permission mode to use for the session").argParser(String).choices(PERMISSION_MODES)).option("-c, --continue", "Continue the most recent conversation in the current directory", () => true).option("-r, --resume [value]", "Resume a conversation by session ID, or open interactive picker with optional search term", (value) => value || true).option("--fork-session", "When resuming, create a new session ID instead of reusing the original (use with --resume or --continue)", () => true).addOption(new Option("--prefill <text>", "Pre-fill the prompt input with text without submitting it").hideHelp()).addOption(new Option("--deep-link-origin", "Signal that this session was launched from a deep link").hideHelp()).addOption(new Option("--deep-link-repo <slug>", "Repo slug the deep link ?repo= parameter resolved to the current cwd").hideHelp()).addOption(new Option("--deep-link-last-fetch <ms>", "FETCH_HEAD mtime in epoch ms, precomputed by the deep link trampoline").argParser((v) => {
+  }).hideHelp()).option("--replay-user-messages", "Re-emit user messages from stdin back on stdout for acknowledgment (only works with --input-format=stream-json and --output-format=stream-json)", () => true).addOption(new Option("--enable-auth-status", "Enable auth status messages in SDK mode").default(false).hideHelp()).option("--allowedTools, --allowed-tools <tools...>", 'Comma or space-separated list of tool names to allow (e.g. "Bash(git:*) Edit")').option("--tools <tools...>", 'Specify the list of available tools from the built-in set. Use "" to disable all tools, "default" to use all tools, or specify tool names (e.g. "Bash,Edit,Read").').option("--disallowedTools, --disallowed-tools <tools...>", 'Comma or space-separated list of tool names to deny (e.g. "Bash(git:*) Edit")').option("--mcp-config <configs...>", "Load MCP servers from JSON files or strings (space-separated)").addOption(new Option("--permission-prompt-tool <tool>", "MCP tool to use for permission prompts (only works with --print)").argParser(String).hideHelp()).addOption(new Option("--system-prompt <prompt>", "System prompt to use for the session").argParser(String)).addOption(new Option("--system-prompt-file <file>", "Read system prompt from a file").argParser(String).hideHelp()).addOption(new Option("--append-system-prompt <prompt>", "Append a system prompt to the default system prompt").argParser(String)).addOption(new Option("--append-system-prompt-file <file>", "Read system prompt from a file and append to the default system prompt").argParser(String).hideHelp()).addOption(new Option("--permission-mode <mode>", "Permission mode to use for the session").argParser(String).choices(PERMISSION_MODES)).addOption(new Option("--permission-prompts <mode>", "Permission prompt policy; 'none' auto-denies prompts that would otherwise ask").argParser(String).choices(["none"])).option("-c, --continue", "Continue the most recent conversation in the current directory", () => true).option("-r, --resume [value]", "Resume a conversation by session ID, or open interactive picker with optional search term", (value) => value || true).option("--fork-session", "When resuming, create a new session ID instead of reusing the original (use with --resume or --continue)", () => true).addOption(new Option("--prefill <text>", "Pre-fill the prompt input with text without submitting it").hideHelp()).addOption(new Option("--deep-link-origin", "Signal that this session was launched from a deep link").hideHelp()).addOption(new Option("--deep-link-repo <slug>", "Repo slug the deep link ?repo= parameter resolved to the current cwd").hideHelp()).addOption(new Option("--deep-link-last-fetch <ms>", "FETCH_HEAD mtime in epoch ms, precomputed by the deep link trampoline").argParser((v) => {
     const n = Number(v);
     return Number.isFinite(n) ? n : undefined;
   }).hideHelp()).option("--from-pr [value]", "Resume a session linked to a PR by PR number/URL, or open interactive picker with optional search term", (value) => value || true).option("--no-session-persistence", "Disable session persistence - sessions will not be saved to disk and cannot be resumed (only works with --print)").addOption(new Option("--resume-session-at <message id>", "When resuming, only messages up to and including the assistant message with <message.id> (use with --resume in print mode)").argParser(String).hideHelp()).addOption(new Option("--rewind-files <user-message-id>", "Restore files to state at the specified user message and exit (requires --resume)").hideHelp()).option("--model <model>", "Model for the current session. Provide a role alias (e.g. 'small' or 'premium') or a provider/model reference (e.g. 'bailian/qwen38-27b').").addOption(new Option("--effort <level>", "Effort level for the current session (low, medium, high, xhigh, max)").argParser((rawValue) => {
@@ -87464,7 +87579,7 @@ function buildProgram() {
       throw new InvalidArgumentError(`It must be one of: ${allowed.join(", ")}`);
     }
     return value;
-  })).option("--agent <agent>", "Agent for the current session. Overrides the 'agent' setting.").option("--betas <betas...>", "Beta headers to include in API requests (API key users only)").option("--fallback-model <model>", "Enable automatic fallback to specified model when default model is overloaded (only works with --print)").addOption(new Option("--workload <tag>", "Workload tag for billing-header attribution (cc_workload). Process-scoped; set by SDK daemon callers that spawn subprocesses for cron work. (only works with --print)").hideHelp()).option("--settings <file-or-json>", "Path to a settings JSON file or a JSON string to load additional settings from").option("--add-dir <directories...>", "Additional directories to allow tool access to").option("--ide", "Automatically connect to IDE on startup if exactly one valid IDE is available", () => true).option("--strict-mcp-config", "Only use MCP servers from --mcp-config, ignoring all other MCP configurations", () => true).option("--session-id <uuid>", "Use a specific session ID for the conversation (must be a valid UUID)").option("-n, --name <name>", "Set a display name for this session (shown in /resume and terminal title)").option("--agents <json>", `JSON object defining custom agents (e.g. '{"reviewer": {"description": "Reviews code", "prompt": "You are a code reviewer"}}')`).option("--setting-sources <sources>", "Comma-separated list of setting sources to load (user, project, local).").option("--plugin-dir <path>", "Load plugins from a directory for this session only (repeatable: --plugin-dir A --plugin-dir B)", (val, prev) => [...prev, val], []).option("--disable-slash-commands", "Disable all skills", () => true).option("--chrome", "Enable AtlasCode in Chrome integration").option("--no-chrome", "Disable AtlasCode in Chrome integration").option("--file <specs...>", "File resources to download at startup. Format: file_id:relative_path (e.g., --file file_abc:doc.txt file_def:img.png)").action(mainActionSeam).version(`${resolveCliVersion()} (AtlasCode)`, "-v, --version", "Output the version number");
+  })).option("--agent <agent>", "Agent for the current session. Overrides the 'agent' setting.").option("--betas <betas...>", "Beta headers to include in API requests (API key users only)").option("--fallback-model <model>", "Enable automatic fallback to specified model when default model is overloaded (only works with --print)").option("--fallback-models <m...>", "0.1.59（CC 2.1.166）：回合级有序 fallback 表（≤3 ref，按序逐个一次性重试）——主模型可重试错误时钉下一 ref 为本回合 sessionModel 重跑（区别于单串 --fallback-model 的 in-request 池末位）。缺省 = 零变更（only works with --print)").addOption(new Option("--workload <tag>", "Workload tag for billing-header attribution (cc_workload). Process-scoped; set by SDK daemon callers that spawn subprocesses for cron work. (only works with --print)").hideHelp()).option("--settings <file-or-json>", "Path to a settings JSON file or a JSON string to load additional settings from").option("--add-dir <directories...>", "Additional directories to allow tool access to").option("--ide", "Automatically connect to IDE on startup if exactly one valid IDE is available", () => true).option("--strict-mcp-config", "Only use MCP servers from --mcp-config, ignoring all other MCP configurations", () => true).option("--session-id <uuid>", "Use a specific session ID for the conversation (must be a valid UUID)").option("-n, --name <name>", "Set a display name for this session (shown in /resume and terminal title)").option("--agents <json>", `JSON object defining custom agents (e.g. '{"reviewer": {"description": "Reviews code", "prompt": "You are a code reviewer"}}')`).option("--setting-sources <sources>", "Comma-separated list of setting sources to load (user, project, local).").option("--plugin-dir <path>", "Load plugins from a directory for this session only (repeatable: --plugin-dir A --plugin-dir B)", (val, prev) => [...prev, val], []).option("--disable-slash-commands", "Disable all skills", () => true).option("--chrome", "Enable AtlasCode in Chrome integration").option("--no-chrome", "Disable AtlasCode in Chrome integration").option("--file <specs...>", "File resources to download at startup. Format: file_id:relative_path (e.g., --file file_abc:doc.txt file_def:img.png)").action(mainActionSeam).version(`${resolveCliVersion()} (AtlasCode)`, "-v, --version", "Output the version number");
   program.option("-w, --worktree [name]", "Create a new git worktree for this session (optionally specify a name)");
   program.option("--tmux", "Create a tmux session for the worktree (requires --worktree). Uses iTerm2 native panes when available; use --tmux=classic for traditional tmux.");
   if (feature("TRANSCRIPT_CLASSIFIER")) {
@@ -124554,11 +124669,13 @@ function getAutoModeConfig2() {
   if (feature("TRANSCRIPT_CLASSIFIER")) {
     const schema = object({
       allow: array(string2()).optional(),
+      hard_deny: array(string2()).optional(),
       soft_deny: array(string2()).optional(),
       deny: array(string2()).optional(),
       environment: array(string2()).optional()
     });
     const allow = [];
+    const hard_deny = [];
     const soft_deny = [];
     const environment = [];
     for (const source of [
@@ -124574,15 +124691,18 @@ function getAutoModeConfig2() {
       if (result.success) {
         if (result.data.allow)
           allow.push(...result.data.allow);
+        if (result.data.hard_deny)
+          hard_deny.push(...result.data.hard_deny);
         if (result.data.soft_deny)
           soft_deny.push(...result.data.soft_deny);
         if (result.data.environment)
           environment.push(...result.data.environment);
       }
     }
-    if (allow.length > 0 || soft_deny.length > 0 || environment.length > 0) {
+    if (allow.length > 0 || hard_deny.length > 0 || soft_deny.length > 0 || environment.length > 0) {
       return {
         ...allow.length > 0 && { allow },
+        ...hard_deny.length > 0 && { hard_deny },
         ...soft_deny.length > 0 && { soft_deny },
         ...environment.length > 0 && { environment }
       };
@@ -274264,6 +274384,7 @@ function isUsingExternalPermissions() {
 function getDefaultExternalAutoModeRules2() {
   return {
     allow: extractTaggedBullets2("user_allow_rules_to_replace"),
+    hard_deny: extractTaggedBullets2("user_hard_deny_rules_to_replace"),
     soft_deny: extractTaggedBullets2("user_deny_rules_to_replace"),
     environment: extractTaggedBullets2("user_environment_to_replace")
   };
@@ -274276,7 +274397,7 @@ function extractTaggedBullets2(tagName) {
 `).map((line) => line.trim()).filter((line) => line.startsWith("- ")).map((line) => line.slice(2));
 }
 function buildDefaultExternalSystemPrompt2() {
-  return BASE_PROMPT2.replace("<permissions_template>", () => EXTERNAL_PERMISSIONS_TEMPLATE2).replace(/<user_allow_rules_to_replace>([\s\S]*?)<\/user_allow_rules_to_replace>/, (_m, defaults) => defaults).replace(/<user_deny_rules_to_replace>([\s\S]*?)<\/user_deny_rules_to_replace>/, (_m, defaults) => defaults).replace(/<user_environment_to_replace>([\s\S]*?)<\/user_environment_to_replace>/, (_m, defaults) => defaults);
+  return BASE_PROMPT2.replace("<permissions_template>", () => EXTERNAL_PERMISSIONS_TEMPLATE2).replace(/<user_allow_rules_to_replace>([\s\S]*?)<\/user_allow_rules_to_replace>/, (_m, defaults) => defaults).replace(/<user_deny_rules_to_replace>([\s\S]*?)<\/user_deny_rules_to_replace>/, (_m, defaults) => defaults).replace(/<user_hard_deny_rules_to_replace>([\s\S]*?)<\/user_hard_deny_rules_to_replace>/, (_m, defaults) => defaults).replace(/<user_environment_to_replace>([\s\S]*?)<\/user_environment_to_replace>/, (_m, defaults) => defaults);
 }
 function getAutoModeClassifierErrorDumpPath() {
   return join101(getAtlasTempDir2(), "auto-mode-classifier-errors", `${getSessionId()}.txt`);
@@ -274449,10 +274570,12 @@ async function buildYoloSystemPrompt(context) {
   const userAllow = allowDescriptions.length ? allowDescriptions.map((d) => `- ${d}`).join(`
 `) : undefined;
   const userDeny = denyDescriptions.length ? denyDescriptions.map((d) => `- ${d}`).join(`
+`) : undefined;
+  const userHardDeny = autoMode?.hard_deny?.length ? autoMode.hard_deny.map((d) => `- ${d}`).join(`
 `) : undefined;
   const userEnvironment = autoMode?.environment?.length ? autoMode.environment.map((e) => `- ${e}`).join(`
 `) : undefined;
-  return systemPrompt.replace(/<user_allow_rules_to_replace>([\s\S]*?)<\/user_allow_rules_to_replace>/, (_m, defaults) => userAllow ?? defaults).replace(/<user_deny_rules_to_replace>([\s\S]*?)<\/user_deny_rules_to_replace>/, (_m, defaults) => userDeny ?? defaults).replace(/<user_environment_to_replace>([\s\S]*?)<\/user_environment_to_replace>/, (_m, defaults) => userEnvironment ?? defaults);
+  return systemPrompt.replace(/<user_allow_rules_to_replace>([\s\S]*?)<\/user_allow_rules_to_replace>/, (_m, defaults) => userAllow ?? defaults).replace(/<user_deny_rules_to_replace>([\s\S]*?)<\/user_deny_rules_to_replace>/, (_m, defaults) => userDeny ?? defaults).replace(/<user_hard_deny_rules_to_replace>([\s\S]*?)<\/user_hard_deny_rules_to_replace>/, (_m, defaults) => userHardDeny ?? defaults).replace(/<user_environment_to_replace>([\s\S]*?)<\/user_environment_to_replace>/, (_m, defaults) => userEnvironment ?? defaults);
 }
 function stripThinking2(text) {
   return text.replace(/<thinking>[\s\S]*?<\/thinking>/g, "").replace(/<thinking>[\s\S]*$/, "");
@@ -489998,24 +490121,25 @@ function autoModeConfigHandler2() {
   const defaults = getDefaultExternalAutoModeRules2();
   writeRules2({
     allow: config?.allow?.length ? config.allow : defaults.allow,
+    hard_deny: config?.hard_deny?.length ? config.hard_deny : defaults.hard_deny,
     soft_deny: config?.soft_deny?.length ? config.soft_deny : defaults.soft_deny,
     environment: config?.environment?.length ? config.environment : defaults.environment
   });
 }
 async function autoModeCritiqueHandler2(options) {
   const config = getAutoModeConfig2();
-  const hasCustomRules = (config?.allow?.length ?? 0) > 0 || (config?.soft_deny?.length ?? 0) > 0 || (config?.environment?.length ?? 0) > 0;
+  const hasCustomRules = (config?.allow?.length ?? 0) > 0 || (config?.hard_deny?.length ?? 0) > 0 || (config?.soft_deny?.length ?? 0) > 0 || (config?.environment?.length ?? 0) > 0;
   if (!hasCustomRules) {
     process.stdout.write(`No custom auto mode rules found.
 
-` + `Add rules to your settings file under autoMode.{allow, soft_deny, environment}.
+` + `Add rules to your settings file under autoMode.{allow, hard_deny, soft_deny, environment}.
 ` + "Run `claude auto-mode defaults` to see the default rules for reference.\n");
     return;
   }
   const model = options.model ? parseUserSpecifiedModel2(options.model) : getMainLoopModel();
   const defaults = getDefaultExternalAutoModeRules2();
   const classifierPrompt = buildDefaultExternalSystemPrompt2();
-  const userRulesSummary = formatRulesForCritique2("allow", config?.allow ?? [], defaults.allow) + formatRulesForCritique2("soft_deny", config?.soft_deny ?? [], defaults.soft_deny) + formatRulesForCritique2("environment", config?.environment ?? [], defaults.environment);
+  const userRulesSummary = formatRulesForCritique2("allow", config?.allow ?? [], defaults.allow) + formatRulesForCritique2("hard_deny", config?.hard_deny ?? [], defaults.hard_deny) + formatRulesForCritique2("soft_deny", config?.soft_deny ?? [], defaults.soft_deny) + formatRulesForCritique2("environment", config?.environment ?? [], defaults.environment);
   process.stdout.write(`Analyzing your auto mode rules…
 
 `);
@@ -490084,9 +490208,10 @@ var init_autoMode3 = __esm(() => {
   init_slowOperations();
   CRITIQUE_SYSTEM_PROMPT2 = `You are an expert reviewer of auto mode classifier rules for Atlas.
 ` + `
-` + 'Atlas has an "auto mode" that uses an AI classifier to decide whether ' + "tool calls should be auto-approved or require user confirmation. Users can " + `write custom rules in three categories:
+` + 'Atlas has an "auto mode" that uses an AI classifier to decide whether ' + "tool calls should be auto-approved or require user confirmation. Users can " + `write custom rules in four categories:
 ` + `
 ` + `- **allow**: Actions the classifier should auto-approve
+` + `- **hard_deny**: Actions that are blocked unconditionally (user intent does not clear these)
 ` + `- **soft_deny**: Actions the classifier should block (require user confirmation)
 ` + `- **environment**: Context about the user's setup that helps the classifier make decisions
 ` + `
@@ -490941,7 +491066,7 @@ async function run() {
       throw new Error("--task-budget must be a positive integer");
     }
     return tokens;
-  }).hideHelp()).option("--replay-user-messages", "Re-emit user messages from stdin back on stdout for acknowledgment (only works with --input-format=stream-json and --output-format=stream-json)", () => true).addOption(new Option("--enable-auth-status", "Enable auth status messages in SDK mode").default(false).hideHelp()).option("--allowedTools, --allowed-tools <tools...>", 'Comma or space-separated list of tool names to allow (e.g. "Bash(git:*) Edit")').option("--tools <tools...>", 'Specify the list of available tools from the built-in set. Use "" to disable all tools, "default" to use all tools, or specify tool names (e.g. "Bash,Edit,Read").').option("--disallowedTools, --disallowed-tools <tools...>", 'Comma or space-separated list of tool names to deny (e.g. "Bash(git:*) Edit")').option("--mcp-config <configs...>", "Load MCP servers from JSON files or strings (space-separated)").addOption(new Option("--permission-prompt-tool <tool>", "MCP tool to use for permission prompts (only works with --print)").argParser(String).hideHelp()).addOption(new Option("--system-prompt <prompt>", "System prompt to use for the session").argParser(String)).addOption(new Option("--system-prompt-file <file>", "Read system prompt from a file").argParser(String).hideHelp()).addOption(new Option("--append-system-prompt <prompt>", "Append a system prompt to the default system prompt").argParser(String)).addOption(new Option("--append-system-prompt-file <file>", "Read system prompt from a file and append to the default system prompt").argParser(String).hideHelp()).addOption(new Option("--permission-mode <mode>", "Permission mode to use for the session").argParser(String).choices(PERMISSION_MODES2)).option("-c, --continue", "Continue the most recent conversation in the current directory", () => true).option("-r, --resume [value]", "Resume a conversation by session ID, or open interactive picker with optional search term", (value) => value || true).option("--fork-session", "When resuming, create a new session ID instead of reusing the original (use with --resume or --continue)", () => true).addOption(new Option("--prefill <text>", "Pre-fill the prompt input with text without submitting it").hideHelp()).addOption(new Option("--deep-link-origin", "Signal that this session was launched from a deep link").hideHelp()).addOption(new Option("--deep-link-repo <slug>", "Repo slug the deep link ?repo= parameter resolved to the current cwd").hideHelp()).addOption(new Option("--deep-link-last-fetch <ms>", "FETCH_HEAD mtime in epoch ms, precomputed by the deep link trampoline").argParser((v) => {
+  }).hideHelp()).option("--replay-user-messages", "Re-emit user messages from stdin back on stdout for acknowledgment (only works with --input-format=stream-json and --output-format=stream-json)", () => true).addOption(new Option("--enable-auth-status", "Enable auth status messages in SDK mode").default(false).hideHelp()).option("--allowedTools, --allowed-tools <tools...>", 'Comma or space-separated list of tool names to allow (e.g. "Bash(git:*) Edit")').option("--tools <tools...>", 'Specify the list of available tools from the built-in set. Use "" to disable all tools, "default" to use all tools, or specify tool names (e.g. "Bash,Edit,Read").').option("--disallowedTools, --disallowed-tools <tools...>", 'Comma or space-separated list of tool names to deny (e.g. "Bash(git:*) Edit")').option("--mcp-config <configs...>", "Load MCP servers from JSON files or strings (space-separated)").addOption(new Option("--permission-prompt-tool <tool>", "MCP tool to use for permission prompts (only works with --print)").argParser(String).hideHelp()).addOption(new Option("--system-prompt <prompt>", "System prompt to use for the session").argParser(String)).addOption(new Option("--system-prompt-file <file>", "Read system prompt from a file").argParser(String).hideHelp()).addOption(new Option("--append-system-prompt <prompt>", "Append a system prompt to the default system prompt").argParser(String)).addOption(new Option("--append-system-prompt-file <file>", "Read system prompt from a file and append to the default system prompt").argParser(String).hideHelp()).addOption(new Option("--permission-mode <mode>", "Permission mode to use for the session").argParser(String).choices(PERMISSION_MODES2)).addOption(new Option("--permission-prompts <mode>", "Permission prompt policy; 'none' auto-denies prompts that would otherwise ask").argParser(String).choices(["none"])).option("-c, --continue", "Continue the most recent conversation in the current directory", () => true).option("-r, --resume [value]", "Resume a conversation by session ID, or open interactive picker with optional search term", (value) => value || true).option("--fork-session", "When resuming, create a new session ID instead of reusing the original (use with --resume or --continue)", () => true).addOption(new Option("--prefill <text>", "Pre-fill the prompt input with text without submitting it").hideHelp()).addOption(new Option("--deep-link-origin", "Signal that this session was launched from a deep link").hideHelp()).addOption(new Option("--deep-link-repo <slug>", "Repo slug the deep link ?repo= parameter resolved to the current cwd").hideHelp()).addOption(new Option("--deep-link-last-fetch <ms>", "FETCH_HEAD mtime in epoch ms, precomputed by the deep link trampoline").argParser((v) => {
     const n = Number(v);
     return Number.isFinite(n) ? n : undefined;
   }).hideHelp()).option("--from-pr [value]", "Resume a session linked to a PR by PR number/URL, or open interactive picker with optional search term", (value) => value || true).option("--no-session-persistence", "Disable session persistence - sessions will not be saved to disk and cannot be resumed (only works with --print)").addOption(new Option("--resume-session-at <message id>", "When resuming, only messages up to and including the assistant message with <message.id> (use with --resume in print mode)").argParser(String).hideHelp()).addOption(new Option("--rewind-files <user-message-id>", "Restore files to state at the specified user message and exit (requires --resume)").hideHelp()).option("--model <model>", `Model for the current session. Provide a role alias (e.g. 'small' or 'premium') or a provider/model reference (e.g. 'bailian/qwen38-27b').`).addOption(new Option("--effort <level>", `Effort level for the current session (low, medium, high, xhigh, max)`).argParser((rawValue) => {
@@ -490970,7 +491095,8 @@ async function run() {
       allowedTools = [],
       disallowedTools = [],
       mcpConfig = [],
-      permissionMode: permissionModeCli,
+      permissionMode: permissionModeCliRaw,
+      permissionPrompts,
       addDir = [],
       fallbackModel,
       betas = [],
@@ -490979,6 +491105,7 @@ async function run() {
       includeHookEvents,
       includePartialMessages
     } = options;
+    const permissionModeCli = permissionModeCliRaw ?? (permissionPrompts === "none" ? "dontAsk" : undefined);
     if (options.prefill) {
       seedEarlyInput(options.prefill);
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@atlasharness/atlascode",
-  "version": "0.1.58",
+  "version": "0.1.59",
   "description": "AtlasCode \u2014 Coding Agent for the domestic computing ecosystem (Ascend NPU + domestic LLM backends)",
   "bin": {
     "atlas": "dist/cli.js",