@atlasharness/atlascode 0.1.78 → 0.1.79

package/dist/cli.js

@@ -26844,24 +26844,47 @@ var init_params = __esm(() => {
 });
 
 // src/modelprovider/types.ts
-var APIError2, APIConnectionError2, APIConnectionTimeoutError2;
+var APIError2, AuthenticationError2, NotFoundError2, APIConnectionError2, APIConnectionTimeoutError2, APIUserAbortError2;
 var init_types2 = __esm(() => {
   APIError2 = class APIError2 extends Error {
     status;
+    code;
+    headers;
     error;
-    constructor(message, status, error) {
-      super(message);
+    constructor(message, statusOrOpts, error) {
+      super(message ?? "API error");
       this.name = "APIError";
-      if (status !== undefined)
-        this.status = status;
-      if (error !== undefined)
-        this.error = error;
+      if (typeof statusOrOpts === "number") {
+        if (statusOrOpts !== undefined)
+          this.status = statusOrOpts;
+        if (error !== undefined)
+          this.error = error;
+      } else if (statusOrOpts) {
+        if (statusOrOpts.status !== undefined)
+          this.status = statusOrOpts.status;
+        if (statusOrOpts.code !== undefined)
+          this.code = statusOrOpts.code;
+        if (statusOrOpts.headers !== undefined)
+          this.headers = statusOrOpts.headers;
+        if (statusOrOpts.error !== undefined)
+          this.error = statusOrOpts.error;
+      }
+    }
+  };
+  AuthenticationError2 = class AuthenticationError2 extends APIError2 {
+    constructor(message, opts) {
+      super(message, opts);
+      this.name = "AuthenticationError";
     }
   };
+  NotFoundError2 = class NotFoundError2 extends APIError2 {
+  };
   APIConnectionError2 = class APIConnectionError2 extends APIError2 {
   };
   APIConnectionTimeoutError2 = class APIConnectionTimeoutError2 extends APIConnectionError2 {
   };
+  APIUserAbortError2 = class APIUserAbortError2 extends APIError2 {
+  };
 });
 
 // src/modelprovider/errorUtils.ts
@@ -28846,7 +28869,9 @@ var init_hookEvents = __esm(() => {
     "CwdChanged",
     "FileChanged",
     "PreModelSwitch",
-    "PostModelSwitch"
+    "PostModelSwitch",
+    "DirectoryAdded",
+    "MessageDisplay"
   ];
 });
 
@@ -28994,6 +29019,9 @@ async function getMatchingHooks(hookEvent, hookInput) {
     case "PostModelSwitch":
       matchQuery = hookInput.new_model;
       break;
+    case "DirectoryAdded":
+      matchQuery = hookInput.directory;
+      break;
     default:
       break;
   }
@@ -29107,6 +29135,8 @@ function interpretHookOutput(p) {
         result.output = "";
       if (json.systemMessage)
         result.systemMessage = json.systemMessage;
+      if (json.terminalSequence)
+        result.terminalSequence = json.terminalSequence;
     } catch {}
   }
   if (!p.aborted && p.code === 2 && !jsonParsed && !result.blockingError) {
@@ -29118,8 +29148,14 @@ function interpretHookOutput(p) {
   return result;
 }
 function mergeAggregated(acc, r) {
-  if (r.blockingError && !acc.blockingError)
+  if (r.terminalSequence) {
+    acc.terminalSequence = (acc.terminalSequence ?? "") + r.terminalSequence;
+  }
+  if (r.blockingError && !acc.blockingError) {
     acc.blockingError = r.blockingError;
+    if (r.continueOnBlock)
+      acc.continueOnBlock = true;
+  }
   if (r.preventContinuation)
     acc.preventContinuation = true;
   if (r.stopReason && !acc.stopReason)
@@ -29142,13 +29178,19 @@ ${r.additionalContext}` : r.additionalContext;
 function runOneHook(m, port, env, signal, options) {
   const cmd = m.hook;
   const timeoutMs = cmd.timeoutMs ?? options.timeoutMs ?? HOOK_EXECUTION_TIMEOUT_MS;
-  return port.runCommand(cmd.command, env, signal, timeoutMs).then((exec) => interpretHookOutput({
-    command: cmd.command,
-    stdout: exec.stdout,
-    stderr: exec.stderr,
-    code: exec.code,
-    aborted: exec.aborted
-  }), (e) => ({
+  return port.runCommand(cmd.command, env, signal, timeoutMs).then((exec) => {
+    const result = interpretHookOutput({
+      command: cmd.command,
+      stdout: exec.stdout,
+      stderr: exec.stderr,
+      code: exec.code,
+      aborted: exec.aborted
+    });
+    if (result.blockingError && cmd.continueOnBlock === true) {
+      result.continueOnBlock = true;
+    }
+    return result;
+  }, (e) => ({
     command: cmd.command,
     status: -1,
     succeeded: false,
@@ -29172,6 +29214,11 @@ async function runHooks(hookEvent, hookInput, options = {}) {
     results.push(result);
     mergeAggregated(aggregated, result);
   }
+  if (aggregated.terminalSequence) {
+    try {
+      process.stdout.write(aggregated.terminalSequence);
+    } catch {}
+  }
   return aggregated;
 }
 async function runPreToolUseHooks(toolName, toolInput, toolUseID, options = {}) {
@@ -29319,6 +29366,7 @@ var init_hooksSchema = __esm(() => {
     once: boolean2().optional(),
     async: boolean2().optional(),
     asyncRewake: boolean2().optional(),
+    continueOnBlock: boolean2().optional(),
     if: string2().optional()
   }).passthrough();
   PromptHookSchema = object({
@@ -29395,18 +29443,53 @@ var SettingsSchema = () => object({
   defaultShell: union([literal("bash"), literal("powershell")]).optional(),
   skipWebFetchPreflight: boolean2().optional(),
   search: object({ tavilyApiKey: string2().optional() }).optional(),
-  tui: object({ fullscreen: boolean2().optional() }).optional()
+  tui: object({ fullscreen: boolean2().optional() }).optional(),
+  skillOverrides: union([
+    literal("off"),
+    literal("user-invocable-only"),
+    literal("name-only")
+  ]).optional()
 }).passthrough();
 var init_types3 = __esm(() => {
   init_zod();
   init_hooksSchema();
 });
 
+// src/engine/config/restrictedMode.ts
+function isRestrictedMode() {
+  return restrictedOverride ?? isEnvTruthy(process.env.ATLAS_RESTRICTED);
+}
+function setRestrictedMode(enabled) {
+  restrictedOverride = enabled;
+}
+function resetRestrictedMode() {
+  restrictedOverride = undefined;
+}
+function isSettingsSourceIgnoredInRestricted(source) {
+  if (!isRestrictedMode())
+    return false;
+  return source === "userSettings" || source === "projectSettings" || source === "localSettings";
+}
+function restrictedBypassError(opts) {
+  if (!isRestrictedMode())
+    return null;
+  if (opts.permissionMode === "bypassPermissions" || opts.allowDangerouslySkipPermissions === true || opts.dangerouslySkipPermissions === true) {
+    return "--restricted mode does not allow bypassPermissions or --dangerously-skip-permissions for security reasons";
+  }
+  return null;
+}
+var restrictedOverride;
+var init_restrictedMode = __esm(() => {
+  init_shared();
+});
+
 // src/engine/config/constants.ts
 function getEnabledSettingSources() {
   const result = new Set(ALLOWED_SETTING_SOURCES);
   result.add("policySettings");
   result.add("flagSettings");
+  if (isRestrictedMode())
+    result.delete("userSettings");
   return Array.from(result);
 }
 function isSettingSourceEnabled(source) {
@@ -29415,6 +29498,7 @@ function isSettingSourceEnabled(source) {
 }
 var SETTING_SOURCES, ALLOWED_SETTING_SOURCES;
 var init_constants3 = __esm(() => {
+  init_restrictedMode();
   SETTING_SOURCES = [
     "userSettings",
     "projectSettings",
@@ -30058,7 +30142,9 @@ var init_permissionRuleParser = __esm(() => {
 
 // src/permissions/mcpRuleNames.ts
 function normalizeNameForMCP(name) {
-  return name.replace(/[^a-zA-Z0-9_-]/g, "_").replace(/_+/g, "_").replace(/^_|_$/g, "");
+  const folded = name.replace(/[^a-zA-Z0-9_-]/g, "_");
+  const normalized = folded.replace(/_+/g, "_").replace(/^_|_$/g, "");
+  return normalized === "" ? folded : normalized;
 }
 function mcpInfoFromString(toolString) {
   const parts = toolString.split("__");
@@ -31908,6 +31994,8 @@ function getSettingsForSource(source) {
   return result;
 }
 function getSettingsForSourceUncached(source) {
+  if (isSettingsSourceIgnoredInRestricted(source))
+    return null;
   if (source === "policySettings") {
     return loadManagedFileSettings().settings;
   }
@@ -31920,6 +32008,11 @@ function getPolicySettingsOrigin() {
   return settings ? "file" : null;
 }
 function updateSettingsForSource(source, settings) {
+  if (isSettingsSourceIgnoredInRestricted(source)) {
+    return {
+      error: new Error(`Settings source ${source} is ignored in restricted mode (--restricted / ATLAS_RESTRICTED)`)
+    };
+  }
   if (source === "policySettings" || source === "flagSettings") {
     return { error: null };
   }
@@ -32082,6 +32175,7 @@ var init_settings = __esm(() => {
   init_zod();
   init_configRoot();
   init_constants3();
+  init_restrictedMode();
   init_managedPath();
   init_settingsCache();
   init_types3();
@@ -32286,6 +32380,7 @@ var init_autoCompactOverrides = __esm(() => {
 var init_config = __esm(() => {
   init_types3();
   init_constants3();
+  init_restrictedMode();
   init_settingsCache();
   init_managedPath();
   init_configRoot();
@@ -36510,7 +36605,9 @@ var init_killShellTasks = __esm(() => {
 
 // src/engine/tools/mcp.ts
 function normalizeNameForMCP2(name) {
-  return name.replace(/[^a-zA-Z0-9_-]/g, "_").replace(/_+/g, "_").replace(/^_|_$/g, "");
+  const folded = name.replace(/[^a-zA-Z0-9_-]/g, "_");
+  const normalized = folded.replace(/_+/g, "_").replace(/^_|_$/g, "");
+  return normalized === "" ? folded : normalized;
 }
 function mcpInfoFromString2(toolString) {
   const parts = toolString.split("__");
@@ -37111,14 +37208,24 @@ function isAscendToolsEnabled(env = process.env) {
 }
 function getAllBaseTools(deps = {}) {
   const env = deps.env ?? process.env;
+  const restricted = isRestrictedMode();
   const pool = [AgentTool];
   if (deps.baseTools)
     pool.push(...deps.baseTools);
-  if (deps.ascendTools && isAscendToolsEnabled(env))
+  if (deps.ascendTools && isAscendToolsEnabled(env) && !restricted) {
     pool.push(...deps.ascendTools);
+  }
   if (deps.mcpTools)
     pool.push(...deps.mcpTools);
-  return uniqByName(pool);
+  const assembled = uniqByName(pool);
+  if (!restricted)
+    return assembled;
+  const stripped = new Set([
+    ...SHELL_TOOL_NAMES,
+    WEB_FETCH_TOOL_NAME,
+    AGENT_TOOL_NAME
+  ]);
+  return assembled.filter((t) => !stripped.has(t.name));
 }
 function uniqByName(tools) {
   const seen = new Set;
@@ -37150,7 +37257,9 @@ function parseToolPreset(preset) {
 var TOOL_PRESETS;
 var init_toolRegistry = __esm(() => {
   init_permissions3();
+  init_config();
   init_AgentTool();
+  init_toolNames();
   TOOL_PRESETS = ["default"];
 });
 
@@ -78377,6 +78486,21 @@ var init_mcpFetch = __esm(() => {
 function getConnectionTimeoutMs() {
   return parseInt(process.env.MCP_TIMEOUT || "", 10) || 30000;
 }
+function getMcpConnectBackoffMs(env = process.env) {
+  const raw = env.ATLAS_MCP_CONNECT_BACKOFF_MS;
+  if (raw === undefined || raw === "")
+    return DEFAULT_MCP_CONNECT_BACKOFF_MS;
+  const parsed = Number(raw);
+  if (!Number.isFinite(parsed))
+    return DEFAULT_MCP_CONNECT_BACKOFF_MS;
+  return Math.max(0, parsed);
+}
+function mcpConnectBackoffDelayMs(failureCount, baseMs = getMcpConnectBackoffMs()) {
+  if (failureCount <= 0 || baseMs <= 0)
+    return 0;
+  const raw = baseMs * 2 ** (failureCount - 1);
+  return Math.min(raw, MAX_MCP_CONNECT_BACKOFF_MS);
+}
 function isTerminalConnectionError(msg) {
   return msg.includes("ECONNRESET") || msg.includes("ETIMEDOUT") || msg.includes("EPIPE") || msg.includes("EHOSTUNREACH") || msg.includes("ECONNREFUSED") || msg.includes("Body Timeout Error") || msg.includes("terminated") || msg.includes("SSE stream disconnected") || msg.includes("Failed to reconnect SSE stream");
 }
@@ -78425,6 +78549,7 @@ async function terminateChild(name, child) {
 function createMcpConnectionManager() {
   const connections = new Map;
   const pending = new Set;
+  const connectFailures = new Map;
   function fail(name, config, error, authFailure = false) {
     const conn = {
       name,
@@ -78529,6 +78654,7 @@ function createMcpConnectionManager() {
         }
       };
       connections.set(name, connection);
+      connectFailures.delete(name);
       return connection;
     } catch (e) {
       stderr.off("data", stderrHandler);
@@ -78539,6 +78665,8 @@ function createMcpConnectionManager() {
         stderrOutput = "";
       }
       const message = e instanceof McpJsonRpcError || e instanceof Error ? e.message : String(e);
+      const prev = connectFailures.get(name);
+      connectFailures.set(name, { count: (prev?.count ?? 0) + 1, lastFailedAt: Date.now() });
       return fail(name, config, message);
     }
   }
@@ -78546,6 +78674,14 @@ function createMcpConnectionManager() {
     const existing = connections.get(name);
     if (existing?.type === "connected")
       return existing;
+    const record = connectFailures.get(name);
+    const backoffDelayMs = record ? mcpConnectBackoffDelayMs(record.count) : 0;
+    if (record !== undefined && backoffDelayMs > 0) {
+      const sinceLastFailure = Date.now() - record.lastFailedAt;
+      if (sinceLastFailure < backoffDelayMs) {
+        return fail(name, config, `MCP server "${name}" connect deferred (backoff): ${record.count} consecutive failure(s), retry in ~${Math.ceil((backoffDelayMs - sinceLastFailure) / 1000)}s (set ATLAS_MCP_CONNECT_BACKOFF_MS=0 to disable)`);
+      }
+    }
     pending.add(name);
     try {
       const t = config.type;
@@ -78583,7 +78719,7 @@ function createMcpConnectionManager() {
 function getMcpConnectionManager() {
   return singleton ??= createMcpConnectionManager();
 }
-var MAX_ERRORS_BEFORE_RECONNECT = 3, FORWARD_SEAM_MESSAGE = "MCP transport = 前向接缝登记（§8.68 R2：非 stdio 传输真实现待 MCP 标准远程传输（M6 波）（#200 波）；G-3 ⑩ D3 型面 8→4 后 4 型 config，仅 stdio 连接支 live）", singleton;
+var DEFAULT_MCP_CONNECT_BACKOFF_MS = 1000, MAX_MCP_CONNECT_BACKOFF_MS = 30000, MAX_ERRORS_BEFORE_RECONNECT = 3, FORWARD_SEAM_MESSAGE = "MCP transport = 前向接缝登记（§8.68 R2：非 stdio 传输真实现待 MCP 标准远程传输（M6 波）（#200 波）；G-3 ⑩ D3 型面 8→4 后 4 型 config，仅 stdio 连接支 live）", singleton;
 var init_mcpConnectionManager = __esm(() => {
   init_shared();
   init_bootstrap();
@@ -78695,6 +78831,85 @@ function buildSchemaNotSentHint(tool, discoveredToolNames) {
 This tool's schema was not sent to the API — it was not in the discovered-tool set derived from message history. ` + `Without the schema in your prompt, typed parameters (arrays, numbers, booleans) get emitted as strings and the client-side parser rejects them. ` + `Re-issue the call with correctly-typed parameters (arrays/numbers/booleans, not their string forms).`;
 }
 
+// src/engine/pipeline/mcpAutoBackground.ts
+function getMcpAutoBackgroundMs(env = process.env) {
+  const raw = env.ATLAS_MCP_AUTO_BACKGROUND_MS;
+  if (!raw)
+    return DEFAULT_MCP_AUTO_BACKGROUND_MS;
+  const parsed = Number(raw);
+  if (!Number.isFinite(parsed))
+    return DEFAULT_MCP_AUTO_BACKGROUND_MS;
+  return Math.max(MIN_MCP_AUTO_BACKGROUND_MS, parsed);
+}
+async function callWithMcpAutoBackground(opts, fn) {
+  let settled = false;
+  return new Promise((resolve, reject) => {
+    const pending = fn();
+    const timer = setTimeout(() => {
+      if (settled)
+        return;
+      settled = true;
+      resolve({ backgrounded: true });
+      pending.then((data) => {
+        opts.onBackgrounded({
+          toolUseId: opts.toolUseId,
+          toolName: opts.toolName,
+          outcome: { ok: true, data }
+        });
+      }).catch((error) => {
+        opts.onBackgrounded({
+          toolUseId: opts.toolUseId,
+          toolName: opts.toolName,
+          outcome: { ok: false, error: String(error?.message ?? error) }
+        });
+      });
+    }, opts.backgroundAfterMs);
+    timer.unref?.();
+    pending.then((result) => {
+      if (settled)
+        return;
+      settled = true;
+      clearTimeout(timer);
+      resolve({ backgrounded: false, result });
+    }, (error) => {
+      if (settled)
+        return;
+      settled = true;
+      clearTimeout(timer);
+      reject(error);
+    });
+  });
+}
+var DEFAULT_MCP_AUTO_BACKGROUND_MS = 120000, MIN_MCP_AUTO_BACKGROUND_MS = 1000;
+
+// src/engine/pipeline/toolHeartbeat.ts
+function getToolHeartbeatIntervalMs(env = process.env) {
+  const raw = env.ATLAS_TOOL_HEARTBEAT_MS;
+  if (!raw)
+    return DEFAULT_TOOL_HEARTBEAT_INTERVAL_MS;
+  const parsed = Number(raw);
+  if (!Number.isFinite(parsed))
+    return DEFAULT_TOOL_HEARTBEAT_INTERVAL_MS;
+  return Math.max(MIN_TOOL_HEARTBEAT_INTERVAL_MS, parsed);
+}
+async function runWithToolHeartbeat(opts, fn) {
+  const start = Date.now();
+  const timer = setInterval(() => {
+    opts.onHeartbeat({
+      toolUseId: opts.toolUseId,
+      toolName: opts.toolName,
+      elapsedMs: Date.now() - start
+    });
+  }, opts.intervalMs);
+  timer.unref?.();
+  try {
+    return await fn();
+  } finally {
+    clearInterval(timer);
+  }
+}
+var DEFAULT_TOOL_HEARTBEAT_INTERVAL_MS = 30000, MIN_TOOL_HEARTBEAT_INTERVAL_MS = 100;
+
 // src/engine/pipeline/toolExecution.ts
 function mergeHookPermission(hookBehavior, gate, hookReason) {
   if (hookBehavior === "defer") {
@@ -78806,8 +79021,40 @@ async function executeToolUse(tu, assistantMsg, deps) {
   let block;
   let isError = false;
   let toolUseResult;
+  const mcpAutoBackgroundArmed = deps.onMcpToolBackgrounded !== undefined && tool.isMcp === true;
   try {
-    const res = await tool.call(callInput, toolCallContext, undefined, assistantMsg);
+    const callTool = () => tool.call(callInput, toolCallContext, undefined, assistantMsg);
+    const withHeartbeat = () => deps.onToolHeartbeat ? runWithToolHeartbeat({
+      toolUseId: tu.id,
+      toolName: tool.name,
+      intervalMs: getToolHeartbeatIntervalMs(),
+      onHeartbeat: deps.onToolHeartbeat
+    }, callTool) : callTool();
+    let res;
+    if (mcpAutoBackgroundArmed) {
+      const raced = await callWithMcpAutoBackground({
+        toolUseId: tu.id,
+        toolName: tool.name,
+        backgroundAfterMs: deps.mcpAutoBackgroundMs ?? getMcpAutoBackgroundMs(),
+        onBackgrounded: deps.onMcpToolBackgrounded
+      }, withHeartbeat);
+      if (raced.backgrounded === true) {
+        const backgroundedContent = `[mcp tool ${tool.name} is still running after exceeding the auto-background threshold; ` + "it has been moved to the background and will keep running. " + "The result will be delivered later as a task notification — do not call this tool again for the same purpose.";
+        return {
+          block: {
+            type: "tool_result",
+            tool_use_id: tu.id,
+            content: backgroundedContent,
+            is_error: false
+          },
+          isError: false,
+          toolUseResult: backgroundedContent
+        };
+      }
+      res = raced.result;
+    } else {
+      res = await withHeartbeat();
+    }
     block = tool.mapToolResultToToolResultBlockParam(res.data, tu.id);
     toolUseResult = res.data;
   } catch (error) {
@@ -78826,6 +79073,17 @@ async function executeToolUse(tu, assistantMsg, deps) {
     block = { ...block, content: postOutcome.updatedToolOutput };
     toolUseResult = postOutcome.updatedToolOutput;
   }
+  if (postOutcome?.blockingError !== undefined) {
+    const hookDenyText = `<tool_use_error>blocked by PostToolUse hook: ${postOutcome.blockingError}</tool_use_error>`;
+    block = {
+      type: "tool_result",
+      tool_use_id: tu.id,
+      content: hookDenyText,
+      is_error: true
+    };
+    isError = true;
+    toolUseResult = hookDenyText;
+  }
   return { block, isError, toolUseResult };
 }
 var init_toolExecution = () => {};
@@ -82340,7 +82598,9 @@ async function queryOneRound(deps, tools, messages) {
     signal: deps.signal,
     checkPermission: deps.checkPermission,
     hooks: deps.hooks?.toolHooks,
-    toolContext: deps.toolContext
+    toolContext: deps.toolContext,
+    onToolHeartbeat: deps.emit ? (info) => deps.emit({ type: "tool_heartbeat", ...info }) : undefined,
+    onMcpToolBackgrounded: deps.onMcpToolBackgrounded
   });
   const deferredOutcome = outcomes.find((o) => o.deferred);
   const deferredPayload = deferredOutcome ? {
@@ -82655,7 +82915,8 @@ function createToolHooks(opts = {}) {
       const r = await runPostToolUseHooks(tool.name, input, block, toolUseId, { ...base, toolUseID: toolUseId });
       const outcome = {
         additionalContext: r.additionalContext,
-        updatedToolOutput: r.updatedToolOutput
+        updatedToolOutput: r.updatedToolOutput,
+        blockingError: r.blockingError && r.continueOnBlock ? r.blockingError.blockingError : undefined
       };
       return outcome;
     }
@@ -85339,6 +85600,15 @@ To attach: tmux attach -t ${tmuxSessionName}
   if (!bare) {
     getCommands(getProjectRoot()).catch(() => {});
   }
+  const restrictedBypassErr = restrictedBypassError({
+    permissionMode: options.permissionMode,
+    allowDangerouslySkipPermissions: options.allowDangerouslySkipPermissions === true
+  });
+  if (restrictedBypassErr) {
+    process.stderr.write(`Error: ${restrictedBypassErr}
+`);
+    process.exit(1);
+  }
   if (options.permissionMode === "bypassPermissions" || options.allowDangerouslySkipPermissions) {
     if (process.platform !== "win32" && typeof process.getuid === "function" && process.getuid() === 0 && process.env.IS_SANDBOX !== "1" && !isEnvTruthy(process.env.ATLAS_BUBBLEWRAP)) {
       process.stderr.write(`--dangerously-skip-permissions cannot be used with root/sudo privileges for security reasons
@@ -88343,6 +88613,19 @@ function buildHeadlessOptions(options) {
   };
 }
 async function mainActionSeam(prompt, options) {
+  if (options.restricted === true) {
+    setRestrictedMode(true);
+    const bypassErr = restrictedBypassError({
+      permissionMode: options.permissionMode,
+      allowDangerouslySkipPermissions: options.allowDangerouslySkipPermissions === true,
+      dangerouslySkipPermissions: options.dangerouslySkipPermissions === true
+    });
+    if (bypassErr) {
+      process.stderr.write(`Error: ${bypassErr}
+`);
+      process.exit(1);
+    }
+  }
   if (options.initOnly) {
     await runCliSetup({
       permissionMode: options.permissionMode,
@@ -88407,7 +88690,7 @@ function buildProgram() {
       throw new Error("--task-budget must be a positive integer");
     }
     return tokens;
-  }).hideHelp()).option("--replay-user-messages", "Re-emit user messages from stdin back on stdout for acknowledgment (only works with --input-format=stream-json and --output-format=stream-json)", () => true).addOption(new Option("--enable-auth-status", "Enable auth status messages in SDK mode").default(false).hideHelp()).option("--allowedTools, --allowed-tools <tools...>", 'Comma or space-separated list of tool names to allow (e.g. "Bash(git:*) Edit")').option("--tools <tools...>", 'Specify the list of available tools from the built-in set. Use "" to disable all tools, "default" to use all tools, or specify tool names (e.g. "Bash,Edit,Read").').option("--disallowedTools, --disallowed-tools <tools...>", 'Comma or space-separated list of tool names to deny (e.g. "Bash(git:*) Edit")').option("--mcp-config <configs...>", "Load MCP servers from JSON files or strings (space-separated)").addOption(new Option("--permission-prompt-tool <tool>", "MCP tool to use for permission prompts (only works with --print)").argParser(String).hideHelp()).addOption(new Option("--system-prompt <prompt>", "System prompt to use for the session").argParser(String)).addOption(new Option("--system-prompt-file <file>", "Read system prompt from a file").argParser(String).hideHelp()).addOption(new Option("--append-system-prompt <prompt>", "Append a system prompt to the default system prompt").argParser(String)).addOption(new Option("--append-system-prompt-file <file>", "Read system prompt from a file and append to the default system prompt").argParser(String).hideHelp()).addOption(new Option("--permission-mode <mode>", "Permission mode to use for the session").argParser(String).choices(PERMISSION_MODES)).addOption(new Option("--permission-prompts <mode>", "Permission prompt policy; 'none' auto-denies prompts that would otherwise ask").argParser(String).choices(["none"])).option("-c, --continue", "Continue the most recent conversation in the current directory", () => true).option("-r, --resume [value]", "Resume a conversation by session ID, or open interactive picker with optional search term", (value) => value || true).option("--fork-session", "When resuming, create a new session ID instead of reusing the original (use with --resume or --continue)", () => true).addOption(new Option("--prefill <text>", "Pre-fill the prompt input with text without submitting it").hideHelp()).addOption(new Option("--deep-link-origin", "Signal that this session was launched from a deep link").hideHelp()).addOption(new Option("--deep-link-repo <slug>", "Repo slug the deep link ?repo= parameter resolved to the current cwd").hideHelp()).addOption(new Option("--deep-link-last-fetch <ms>", "FETCH_HEAD mtime in epoch ms, precomputed by the deep link trampoline").argParser((v) => {
+  }).hideHelp()).option("--replay-user-messages", "Re-emit user messages from stdin back on stdout for acknowledgment (only works with --input-format=stream-json and --output-format=stream-json)", () => true).addOption(new Option("--enable-auth-status", "Enable auth status messages in SDK mode").default(false).hideHelp()).option("--allowedTools, --allowed-tools <tools...>", 'Comma or space-separated list of tool names to allow (e.g. "Bash(git:*) Edit")').option("--tools <tools...>", 'Specify the list of available tools from the built-in set. Use "" to disable all tools, "default" to use all tools, or specify tool names (e.g. "Bash,Edit,Read").').option("--disallowedTools, --disallowed-tools <tools...>", 'Comma or space-separated list of tool names to deny (e.g. "Bash(git:*) Edit")').option("--restricted", "Run in restricted mode: strips command-execution tools (Bash/PowerShell), WebFetch, and Agent; rejects bypassPermissions and --dangerously-skip-permissions; ignores user/project/local settings (env: ATLAS_RESTRICTED)").option("--mcp-config <configs...>", "Load MCP servers from JSON files or strings (space-separated)").addOption(new Option("--permission-prompt-tool <tool>", "MCP tool to use for permission prompts (only works with --print)").argParser(String).hideHelp()).addOption(new Option("--system-prompt <prompt>", "System prompt to use for the session").argParser(String)).addOption(new Option("--system-prompt-file <file>", "Read system prompt from a file").argParser(String).hideHelp()).addOption(new Option("--append-system-prompt <prompt>", "Append a system prompt to the default system prompt").argParser(String)).addOption(new Option("--append-system-prompt-file <file>", "Read system prompt from a file and append to the default system prompt").argParser(String).hideHelp()).addOption(new Option("--permission-mode <mode>", "Permission mode to use for the session").argParser(String).choices(PERMISSION_MODES)).addOption(new Option("--permission-prompts <mode>", "Permission prompt policy; 'none' auto-denies prompts that would otherwise ask").argParser(String).choices(["none"])).option("-c, --continue", "Continue the most recent conversation in the current directory", () => true).option("-r, --resume [value]", "Resume a conversation by session ID, or open interactive picker with optional search term", (value) => value || true).option("--fork-session", "When resuming, create a new session ID instead of reusing the original (use with --resume or --continue)", () => true).addOption(new Option("--prefill <text>", "Pre-fill the prompt input with text without submitting it").hideHelp()).addOption(new Option("--deep-link-origin", "Signal that this session was launched from a deep link").hideHelp()).addOption(new Option("--deep-link-repo <slug>", "Repo slug the deep link ?repo= parameter resolved to the current cwd").hideHelp()).addOption(new Option("--deep-link-last-fetch <ms>", "FETCH_HEAD mtime in epoch ms, precomputed by the deep link trampoline").argParser((v) => {
     const n = Number(v);
     return Number.isFinite(n) ? n : undefined;
   }).hideHelp()).option("--from-pr [value]", "Resume a session linked to a PR by PR number/URL, or open interactive picker with optional search term", (value) => value || true).option("--no-session-persistence", "Disable session persistence - sessions will not be saved to disk and cannot be resumed (only works with --print)").addOption(new Option("--resume-session-at <message id>", "When resuming, only messages up to and including the assistant message with <message.id> (use with --resume in print mode)").argParser(String).hideHelp()).addOption(new Option("--rewind-files <user-message-id>", "Restore files to state at the specified user message and exit (requires --resume)").hideHelp()).option("--model <model>", "Model for the current session. Provide a role alias (e.g. 'small' or 'premium') or a provider/model reference (e.g. 'bailian/qwen38-27b').").addOption(new Option("--effort <level>", "Effort level for the current session (low, medium, high, xhigh, max)").argParser((rawValue) => {
@@ -88513,6 +88796,7 @@ async function runCli() {
 var init_parse4 = __esm(() => {
   init_extra_typings();
   init_bootstrap();
+  init_engine();
   init_permissions3();
   init_shared();
   init_remote();
@@ -96691,34 +96975,8 @@ var init_envUtils2 = __esm(() => {
 });
 
 // src/tui/types/atlas.ts
-var APIError3, AuthenticationError2, NotFoundError2, APIConnectionError3, APIUserAbortError3;
 var init_atlas = __esm(() => {
-  APIError3 = class APIError3 extends Error {
-    status;
-    code;
-    headers;
-    constructor(message, opts) {
-      super(message ?? "API error");
-      this.name = "APIError";
-      if (opts) {
-        this.status = opts.status;
-        this.code = opts.code;
-        this.headers = opts.headers;
-      }
-    }
-  };
-  AuthenticationError2 = class AuthenticationError2 extends APIError3 {
-    constructor(message, opts) {
-      super(message, opts);
-      this.name = "AuthenticationError";
-    }
-  };
-  NotFoundError2 = class NotFoundError2 extends APIError3 {
-  };
-  APIConnectionError3 = class APIConnectionError3 extends APIError3 {
-  };
-  APIUserAbortError3 = class APIUserAbortError3 extends APIError3 {
-  };
+  init_types2();
 });
 
 // src/tui/utils/errors.ts
@@ -124104,7 +124362,12 @@ var isMcpServerCommandEntry = () => ({}), isMcpServerNameEntry = () => ({}), isM
   xaaIdp: any().optional(),
   agent: any().optional(),
   local: any().optional(),
-  worktree: any().optional()
+  worktree: any().optional(),
+  skillOverrides: union([
+    literal("off"),
+    literal("user-invocable-only"),
+    literal("name-only")
+  ]).optional()
 }).passthrough(), CUSTOMIZATION_SURFACES;
 var init_types7 = __esm(() => {
   init_zod();
@@ -124232,7 +124495,9 @@ var init_stringUtils2 = __esm(() => {
 
 // src/tui/services/mcp/normalization.ts
 function normalizeNameForMCP3(name) {
-  return name.replace(/[^a-zA-Z0-9_-]/g, "_").replace(/_+/g, "_").replace(/^_|_$/g, "");
+  const folded = name.replace(/[^a-zA-Z0-9_-]/g, "_");
+  const normalized = folded.replace(/_+/g, "_").replace(/^_|_$/g, "");
+  return normalized === "" ? folded : normalized;
 }
 
 // src/tui/services/mcp/mcpStringUtils.ts
@@ -151026,28 +151291,28 @@ function getEventPriority(eventType) {
     case "focus":
     case "blur":
     case "paste":
-      return import_constants53.DiscreteEventPriority;
+      return import_constants54.DiscreteEventPriority;
     case "resize":
     case "scroll":
     case "mousemove":
-      return import_constants53.ContinuousEventPriority;
+      return import_constants54.ContinuousEventPriority;
     default:
-      return import_constants53.DefaultEventPriority;
+      return import_constants54.DefaultEventPriority;
   }
 }
 
 class Dispatcher {
   currentEvent = null;
-  currentUpdatePriority = import_constants53.DefaultEventPriority;
+  currentUpdatePriority = import_constants54.DefaultEventPriority;
   discreteUpdates = null;
   resolveEventPriority() {
-    if (this.currentUpdatePriority !== import_constants53.NoEventPriority) {
+    if (this.currentUpdatePriority !== import_constants54.NoEventPriority) {
       return this.currentUpdatePriority;
     }
     if (this.currentEvent) {
       return getEventPriority(this.currentEvent.type);
     }
-    return import_constants53.DefaultEventPriority;
+    return import_constants54.DefaultEventPriority;
   }
   dispatch(target, event) {
     const previousEvent = this.currentEvent;
@@ -151072,18 +151337,18 @@ class Dispatcher {
   dispatchContinuous(target, event) {
     const previousPriority = this.currentUpdatePriority;
     try {
-      this.currentUpdatePriority = import_constants53.ContinuousEventPriority;
+      this.currentUpdatePriority = import_constants54.ContinuousEventPriority;
       return this.dispatch(target, event);
     } finally {
       this.currentUpdatePriority = previousPriority;
     }
   }
 }
-var import_constants53;
+var import_constants54;
 var init_dispatcher = __esm(() => {
   init_log5();
   init_event_handlers();
-  import_constants53 = __toESM(require_constants2(), 1);
+  import_constants54 = __toESM(require_constants2(), 1);
 });
 
 // src/tui/ink/events/terminal-event.ts
@@ -159890,7 +160155,7 @@ function applyPositionedHighlight(screen, stylePool, positions, rowOffset, curre
   }
   return true;
 }
-var import_constants55, timing;
+var import_constants56, timing;
 var init_render_to_screen = __esm(() => {
   init_debug();
   init_dom();
@@ -159899,7 +160164,7 @@ var init_render_to_screen = __esm(() => {
   init_reconciler();
   init_render_node_to_output();
   init_screen();
-  import_constants55 = __toESM(require_constants2(), 1);
+  import_constants56 = __toESM(require_constants2(), 1);
   timing = { reconcile: 0, yoga: 0, paint: 0, scan: 0, calls: 0 };
 });
 
@@ -160205,7 +160470,7 @@ class Ink {
         };
       }
     };
-    this.container = reconciler_default.createContainer(this.rootNode, import_constants56.ConcurrentRoot, null, false, null, "id", noop_default, noop_default, noop_default, noop_default);
+    this.container = reconciler_default.createContainer(this.rootNode, import_constants57.ConcurrentRoot, null, false, null, "id", noop_default, noop_default, noop_default, noop_default);
     if (false) {}
   }
   handleResume = () => {
@@ -161018,7 +161283,7 @@ function drainStdin(stdin = process.stdin) {
     }
   }
 }
-var import_constants56, jsx_dev_runtime8, ALT_SCREEN_ANCHOR_CURSOR, CURSOR_HOME_PATCH, ERASE_THEN_HOME_PATCH, CONSOLE_STDOUT_METHODS, CONSOLE_STDERR_METHODS;
+var import_constants57, jsx_dev_runtime8, ALT_SCREEN_ANCHOR_CURSOR, CURSOR_HOME_PATCH, ERASE_THEN_HOME_PATCH, CONSOLE_STDOUT_METHODS, CONSOLE_STDERR_METHODS;
 var init_ink = __esm(() => {
   init_noop();
   init_throttle2();
@@ -161051,7 +161316,7 @@ var init_ink = __esm(() => {
   init_dec();
   init_osc();
   init_useTerminalNotification();
-  import_constants56 = __toESM(require_constants2(), 1);
+  import_constants57 = __toESM(require_constants2(), 1);
   jsx_dev_runtime8 = __toESM(require_jsx_dev_runtime(), 1);
   ALT_SCREEN_ANCHOR_CURSOR = Object.freeze({
     x: 0,
@@ -166814,7 +167079,7 @@ var init_addDirPluginSettings = __esm(() => {
 });
 
 // src/tui/entrypoints/sdk/coreSchemas.ts
-var ModelUsageSchema, OutputFormatTypeSchema, BaseOutputFormatSchema, JsonSchemaOutputFormatSchema, OutputFormatSchema, ApiKeySourceSchema, ConfigScopeSchema2, SdkBetaSchema, ThinkingAdaptiveSchema, ThinkingEnabledSchema, ThinkingDisabledSchema, ThinkingConfigSchema, McpStdioServerConfigSchema2, McpSSEServerConfigSchema2, McpHttpServerConfigSchema, McpSdkServerConfigSchema, McpServerConfigForProcessTransportSchema, McpServerStatusConfigSchema, McpServerStatusSchema, McpSetServersResultSchema, PermissionUpdateDestinationSchema, PermissionBehaviorSchema, PreToolUsePermissionDecisionSchema, PermissionRuleValueSchema, PermissionUpdateSchema, PermissionDecisionClassificationSchema, PermissionResultSchema, PermissionModeSchema2, HOOK_EVENTS2, HookEventSchema, BaseHookInputSchema, PreToolUseHookInputSchema, PermissionRequestHookInputSchema, PostToolUseHookInputSchema, PostToolUseFailureHookInputSchema, PermissionDeniedHookInputSchema, NotificationHookInputSchema, UserPromptSubmitHookInputSchema, SessionStartHookInputSchema, PreModelSwitchHookInputSchema, PostModelSwitchHookInputSchema, SetupHookInputSchema, StopHookInputSchema, StopFailureHookInputSchema, SubagentStartHookInputSchema, SubagentStopHookInputSchema, PreCompactHookInputSchema, PostCompactHookInputSchema, TeammateIdleHookInputSchema, TaskCreatedHookInputSchema, TaskCompletedHookInputSchema, ElicitationHookInputSchema, ElicitationResultHookInputSchema, CONFIG_CHANGE_SOURCES, ConfigChangeHookInputSchema, INSTRUCTIONS_LOAD_REASONS, INSTRUCTIONS_MEMORY_TYPES, InstructionsLoadedHookInputSchema, WorktreeCreateHookInputSchema, WorktreeRemoveHookInputSchema, CwdChangedHookInputSchema, FileChangedHookInputSchema, EXIT_REASONS, ExitReasonSchema, SessionEndHookInputSchema, HookInputSchema, AsyncHookJSONOutputSchema, PreToolUseHookSpecificOutputSchema, UserPromptSubmitHookSpecificOutputSchema, SessionStartHookSpecificOutputSchema, SetupHookSpecificOutputSchema, SubagentStartHookSpecificOutputSchema, PostToolUseHookSpecificOutputSchema, PostToolUseFailureHookSpecificOutputSchema, PermissionDeniedHookSpecificOutputSchema, NotificationHookSpecificOutputSchema, PermissionRequestHookSpecificOutputSchema, CwdChangedHookSpecificOutputSchema, FileChangedHookSpecificOutputSchema, SyncHookJSONOutputSchema, ElicitationHookSpecificOutputSchema, ElicitationResultHookSpecificOutputSchema, WorktreeCreateHookSpecificOutputSchema, HookJSONOutputSchema, PromptRequestOptionSchema, PromptRequestSchema, PromptResponseSchema, SlashCommandSchema, AgentInfoSchema, ModelInfoSchema, AccountInfoSchema, AgentMcpServerSpecSchema, AgentDefinitionSchema, SettingSourceSchema, SdkPluginConfigSchema, RewindFilesResultSchema, APIUserMessagePlaceholder, APIAssistantMessagePlaceholder, RawMessageStreamEventPlaceholder, UUIDPlaceholder, NonNullableUsagePlaceholder, SDKAssistantMessageErrorSchema, SDKStatusSchema, SDKUserMessageContentSchema, SDKUserMessageSchema, SDKUserMessageReplaySchema, SDKRateLimitInfoSchema, SDKAssistantMessageSchema, SDKRateLimitEventSchema, SDKStreamlinedTextMessageSchema, SDKStreamlinedToolUseSummaryMessageSchema, SDKPermissionDenialSchema, SDKResultSuccessSchema, SDKResultErrorSchema, SDKResultMessageSchema, SDKSystemMessageSchema, SDKPartialAssistantMessageSchema, SDKCompactBoundaryMessageSchema, SDKStatusMessageSchema, SDKPostTurnSummaryMessageSchema, SDKAPIRetryMessageSchema, SDKLocalCommandOutputMessageSchema, SDKHookStartedMessageSchema, SDKHookProgressMessageSchema, SDKHookResponseMessageSchema, SDKToolProgressMessageSchema, SDKAuthStatusMessageSchema, SDKFilesPersistedEventSchema, SDKTaskNotificationMessageSchema, SDKTaskStartedMessageSchema, SDKSessionStateChangedMessageSchema, SDKTaskProgressMessageSchema, SDKToolUseSummaryMessageSchema, SDKElicitationCompleteMessageSchema, SDKPromptSuggestionMessageSchema, SDKSessionInfoSchema, SDKMessageSchema, FastModeStateSchema;
+var ModelUsageSchema, OutputFormatTypeSchema, BaseOutputFormatSchema, JsonSchemaOutputFormatSchema, OutputFormatSchema, ApiKeySourceSchema, ConfigScopeSchema2, SdkBetaSchema, ThinkingAdaptiveSchema, ThinkingEnabledSchema, ThinkingDisabledSchema, ThinkingConfigSchema, McpStdioServerConfigSchema2, McpSSEServerConfigSchema2, McpHttpServerConfigSchema, McpSdkServerConfigSchema, McpServerConfigForProcessTransportSchema, McpServerStatusConfigSchema, McpServerStatusSchema, McpSetServersResultSchema, PermissionUpdateDestinationSchema, PermissionBehaviorSchema, PreToolUsePermissionDecisionSchema, PermissionRuleValueSchema, PermissionUpdateSchema, PermissionDecisionClassificationSchema, PermissionResultSchema, PermissionModeSchema2, HOOK_EVENTS2, HookEventSchema, BaseHookInputSchema, PreToolUseHookInputSchema, PermissionRequestHookInputSchema, PostToolUseHookInputSchema, PostToolUseFailureHookInputSchema, PermissionDeniedHookInputSchema, NotificationHookInputSchema, UserPromptSubmitHookInputSchema, SessionStartHookInputSchema, PreModelSwitchHookInputSchema, PostModelSwitchHookInputSchema, DirectoryAddedHookInputSchema, MessageDisplayHookInputSchema, SetupHookInputSchema, StopHookInputSchema, StopFailureHookInputSchema, SubagentStartHookInputSchema, SubagentStopHookInputSchema, PreCompactHookInputSchema, PostCompactHookInputSchema, TeammateIdleHookInputSchema, TaskCreatedHookInputSchema, TaskCompletedHookInputSchema, ElicitationHookInputSchema, ElicitationResultHookInputSchema, CONFIG_CHANGE_SOURCES, ConfigChangeHookInputSchema, INSTRUCTIONS_LOAD_REASONS, INSTRUCTIONS_MEMORY_TYPES, InstructionsLoadedHookInputSchema, WorktreeCreateHookInputSchema, WorktreeRemoveHookInputSchema, CwdChangedHookInputSchema, FileChangedHookInputSchema, EXIT_REASONS, ExitReasonSchema, SessionEndHookInputSchema, HookInputSchema, AsyncHookJSONOutputSchema, PreToolUseHookSpecificOutputSchema, UserPromptSubmitHookSpecificOutputSchema, SessionStartHookSpecificOutputSchema, SetupHookSpecificOutputSchema, SubagentStartHookSpecificOutputSchema, PostToolUseHookSpecificOutputSchema, PostToolUseFailureHookSpecificOutputSchema, PermissionDeniedHookSpecificOutputSchema, NotificationHookSpecificOutputSchema, PermissionRequestHookSpecificOutputSchema, CwdChangedHookSpecificOutputSchema, FileChangedHookSpecificOutputSchema, SyncHookJSONOutputSchema, ElicitationHookSpecificOutputSchema, ElicitationResultHookSpecificOutputSchema, WorktreeCreateHookSpecificOutputSchema, HookJSONOutputSchema, PromptRequestOptionSchema, PromptRequestSchema, PromptResponseSchema, SlashCommandSchema, AgentInfoSchema, ModelInfoSchema, AccountInfoSchema, AgentMcpServerSpecSchema, AgentDefinitionSchema, SettingSourceSchema, SdkPluginConfigSchema, RewindFilesResultSchema, APIUserMessagePlaceholder, APIAssistantMessagePlaceholder, RawMessageStreamEventPlaceholder, UUIDPlaceholder, NonNullableUsagePlaceholder, SDKAssistantMessageErrorSchema, SDKStatusSchema, SDKUserMessageContentSchema, SDKUserMessageSchema, SDKUserMessageReplaySchema, SDKRateLimitInfoSchema, SDKAssistantMessageSchema, SDKRateLimitEventSchema, SDKStreamlinedTextMessageSchema, SDKStreamlinedToolUseSummaryMessageSchema, SDKPermissionDenialSchema, SDKResultSuccessSchema, SDKResultErrorSchema, SDKResultMessageSchema, SDKSystemMessageSchema, SDKPartialAssistantMessageSchema, SDKCompactBoundaryMessageSchema, SDKStatusMessageSchema, SDKPostTurnSummaryMessageSchema, SDKAPIRetryMessageSchema, SDKLocalCommandOutputMessageSchema, SDKHookStartedMessageSchema, SDKHookProgressMessageSchema, SDKHookResponseMessageSchema, SDKToolProgressMessageSchema, SDKAuthStatusMessageSchema, SDKFilesPersistedEventSchema, SDKTaskNotificationMessageSchema, SDKTaskStartedMessageSchema, SDKSessionStateChangedMessageSchema, SDKTaskProgressMessageSchema, SDKToolUseSummaryMessageSchema, SDKElicitationCompleteMessageSchema, SDKPromptSuggestionMessageSchema, SDKSessionInfoSchema, SDKMessageSchema, FastModeStateSchema;
 var init_coreSchemas = __esm(() => {
   init_v4();
   ModelUsageSchema = lazySchema2(() => object({
@@ -167003,7 +167268,9 @@ var init_coreSchemas = __esm(() => {
     "CwdChanged",
     "FileChanged",
     "PreModelSwitch",
-    "PostModelSwitch"
+    "PostModelSwitch",
+    "DirectoryAdded",
+    "MessageDisplay"
   ];
   HookEventSchema = lazySchema2(() => _enum(HOOK_EVENTS2));
   BaseHookInputSchema = lazySchema2(() => object({
@@ -167076,6 +167343,15 @@ var init_coreSchemas = __esm(() => {
     new_model: string2(),
     source: string2()
   })));
+  DirectoryAddedHookInputSchema = lazySchema2(() => BaseHookInputSchema().and(object({
+    hook_event_name: literal("DirectoryAdded"),
+    directory: string2(),
+    source: string2()
+  })));
+  MessageDisplayHookInputSchema = lazySchema2(() => BaseHookInputSchema().and(object({
+    hook_event_name: literal("MessageDisplay"),
+    message: string2()
+  })));
   SetupHookInputSchema = lazySchema2(() => BaseHookInputSchema().and(object({
     hook_event_name: literal("Setup"),
     trigger: _enum(["init", "maintenance"])
@@ -180714,6 +180990,7 @@ __export(exports_engineCompat, {
   getLastSummarizedMessageId: () => getLastSummarizedMessageId,
   getManagedSettingsDir: () => getManagedSettingsDir,
   getManagedSettingsDropInDir: () => getManagedSettingsDropInDir,
+  getMcpAutoBackgroundMs: () => getMcpAutoBackgroundMs,
   getMcpClientRegistry: () => getMcpClientRegistry,
   getMcpPrefix: () => getMcpPrefix2,
   getMcpSkillCommands: () => getMcpSkillCommands,
@@ -180833,11 +181110,13 @@ __export(exports_engineCompat, {
   isReactiveCompactRecoverableError: () => isReactiveCompactRecoverableError,
   isReactiveOnlyMode: () => isReactiveOnlyMode,
   isRecurringTaskAged: () => isRecurringTaskAged,
+  isRestrictedMode: () => isRestrictedMode,
   isSafeRefName: () => isSafeRefName,
   isSandboxPermissionRequest: () => isSandboxPermissionRequest,
   isSandboxPermissionResponse: () => isSandboxPermissionResponse,
   isSessionMemoryInitialized: () => isSessionMemoryInitialized,
   isSettingSourceEnabled: () => isSettingSourceEnabled,
+  isSettingsSourceIgnoredInRestricted: () => isSettingsSourceIgnoredInRestricted,
   isShutdownApproved: () => isShutdownApproved,
   isShutdownRejected: () => isShutdownRejected,
   isShutdownRequest: () => isShutdownRequest,
@@ -180983,6 +181262,7 @@ __export(exports_engineCompat, {
   resetPendingNotifications: () => resetPendingNotifications,
   resetProjectFlushStateForTesting: () => resetProjectFlushStateForTesting,
   resetProjectForTesting: () => resetProjectForTesting,
+  resetRestrictedMode: () => resetRestrictedMode,
   resetSchedulerEnv: () => resetSchedulerEnv,
   resetSdkEventQueueForTesting: () => resetSdkEventQueueForTesting,
   resetSessionContextPort: () => resetSessionContextPort,
@@ -181005,6 +181285,7 @@ __export(exports_engineCompat, {
   restoreGoalState: () => restoreGoalState,
   restoreSessionMetadata: () => restoreSessionMetadata,
   restoreWorktreeSession: () => restoreWorktreeSession,
+  restrictedBypassError: () => restrictedBypassError,
   resumeGoal: () => resumeGoal,
   roughTokenCountEstimation: () => roughTokenCountEstimation2,
   roughTokenCountEstimationForContent: () => roughTokenCountEstimationForContent,
@@ -181041,6 +181322,7 @@ __export(exports_engineCompat, {
   setPartialCompactPort: () => setPartialCompactPort,
   setPluginSettingsBase: () => setPluginSettingsBase,
   setReactiveCompactPort: () => setReactiveCompactPort,
+  setRestrictedMode: () => setRestrictedMode,
   setSchedulerEnv: () => setSchedulerEnv,
   setSessionContextPort: () => setSessionContextPort,
   setSessionEnv: () => setSessionEnv,
@@ -256424,6 +256706,8 @@ async function* queryEngineLoopStream(params) {
         pending.push(event.messages[0]);
       } else if (event.type === "stream_delta") {
         pending.push(event);
+      } else if (event.type === "tool_heartbeat") {
+        pending.push(event);
       }
       notify();
     }
@@ -274444,7 +274728,7 @@ var init_apiErrors = __esm(() => {
       });
     },
     resolveAuthErrorMessaging: (error, _model) => {
-      if (error instanceof APIError3 && error.status === 400 && error.message.toLowerCase().includes("organization has been disabled")) {
+      if (error instanceof APIError2 && error.status === 400 && error.message.toLowerCase().includes("organization has been disabled")) {
         const { source } = getAtlasApiKeyWithSource();
         if (source === "OPENAI_API_KEY" && process.env.OPENAI_API_KEY) {
           const hasStoredOAuth = getOAuthTokens()?.accessToken != null;
@@ -274469,13 +274753,13 @@ var init_apiErrors = __esm(() => {
           content: isExternalSource ? INVALID_API_KEY_ERROR_MESSAGE_EXTERNAL : INVALID_API_KEY_ERROR_MESSAGE
         });
       }
-      if (error instanceof APIError3 && error.status === 403 && error.message.includes("OAuth token has been revoked")) {
+      if (error instanceof APIError2 && error.status === 403 && error.message.includes("OAuth token has been revoked")) {
         return createAssistantAPIErrorMessage2({
           error: "authentication_failed",
           content: getTokenRevokedErrorMessage()
         });
       }
-      if (error instanceof APIError3 && (error.status === 401 || error.status === 403) && error.message.includes("OAuth authentication is currently not allowed for this organization")) {
+      if (error instanceof APIError2 && (error.status === 401 || error.status === 403) && error.message.includes("OAuth authentication is currently not allowed for this organization")) {
         return createAssistantAPIErrorMessage2({
           error: "authentication_failed",
           content: getOauthOrgNotAllowedErrorMessage()
@@ -274495,7 +274779,7 @@ var init_apiErrors = __esm(() => {
           content: getIsNonInteractiveSession() ? `${API_ERROR_MESSAGE_PREFIX}: provider quota exhausted (403). Top up your provider quota, or switch provider/model via --model, then retry.` : `${API_ERROR_MESSAGE_PREFIX}: provider quota exhausted (403). Top up your provider quota, or run /model to switch provider/model, then retry.`
         });
       }
-      if (error instanceof APIError3 && (error.status === 401 || error.status === 403)) {
+      if (error instanceof APIError2 && (error.status === 401 || error.status === 403)) {
         if (isCCRMode()) {
           return createAssistantAPIErrorMessage2({
             error: "authentication_failed",
@@ -299518,14 +299802,14 @@ function handleValidationError(error, modelName) {
       error: `Model '${modelName}' not found`
     };
   }
-  if (error instanceof APIError3) {
+  if (error instanceof APIError2) {
     if (error instanceof AuthenticationError2) {
       return {
         valid: false,
         error: "Authentication failed. Please check your API credentials."
       };
     }
-    if (error instanceof APIConnectionError3) {
+    if (error instanceof APIConnectionError2) {
       return {
         valid: false,
         error: "Network error. Please check your internet connection."
@@ -308884,7 +309168,7 @@ async function executeAsyncClassifierCheck2(pendingCheck, signal, isNonInteracti
   try {
     classifierResult = speculativeResult ? await speculativeResult : await classifyBashCommand2(command, cwd, descriptions, "allow", signal, isNonInteractiveSession);
   } catch (error) {
-    if (error instanceof APIUserAbortError3 || error instanceof AbortError2) {
+    if (error instanceof APIUserAbortError2 || error instanceof AbortError2) {
       callbacks.onComplete?.();
       return;
     }
@@ -335371,6 +335655,22 @@ ${EXPLANATORY_FEATURE_PROMPT}`
   });
 });
 
+// src/tui/utils/messageDisplayHooks.ts
+function fireMessageDisplayHooks(message) {
+  (async () => {
+    try {
+      for await (const _hookResult of executeMessageDisplayHooks(message, undefined, MESSAGE_DISPLAY_HOOK_TIMEOUT_MS)) {}
+    } catch (e) {
+      logForDebugging3(`MessageDisplay hook execution failed: ${e instanceof Error ? e.message : String(e)}`);
+    }
+  })();
+}
+var MESSAGE_DISPLAY_HOOK_TIMEOUT_MS = 15000;
+var init_messageDisplayHooks = __esm(() => {
+  init_debug();
+  init_hooks7();
+});
+
 // src/tui/utils/messages.ts
 import { randomUUID as randomUUID36 } from "crypto";
 function isFeatureOn(name) {
@@ -336787,8 +337087,8 @@ function getContentText(content) {
   }
   return null;
 }
-function handleMessageFromStream(message, onMessage, onUpdateLength, onSetStreamMode, onStreamingToolUses, onTombstone, onStreamingThinking, onApiMetrics, onStreamingText) {
-  if (message.type !== "stream_event" && message.type !== "stream_request_start" && message.type !== "stream_delta") {
+function handleMessageFromStream(message, onMessage, onUpdateLength, onSetStreamMode, onStreamingToolUses, onTombstone, onStreamingThinking, onApiMetrics, onStreamingText, onToolHeartbeat) {
+  if (message.type !== "stream_event" && message.type !== "stream_request_start" && message.type !== "stream_delta" && message.type !== "tool_heartbeat") {
     if (message.type === "tombstone") {
       onTombstone?.(message.message);
       return;
@@ -336805,6 +337105,9 @@ function handleMessageFromStream(message, onMessage, onUpdateLength, onSetStream
           streamingEndedAt: Date.now()
         }));
       }
+      const displayText = getContentText(message.message.content);
+      if (displayText)
+        fireMessageDisplayHooks(displayText);
     }
     onStreamingText?.(() => null);
     onMessage(message);
@@ -336814,6 +337117,10 @@ function handleMessageFromStream(message, onMessage, onUpdateLength, onSetStream
     onSetStreamMode("requesting");
     return;
   }
+  if (message.type === "tool_heartbeat") {
+    onToolHeartbeat?.({ toolName: message.toolName, elapsedMs: message.elapsedMs });
+    return;
+  }
   if (message.type === "stream_delta") {
     if (message.delta.type === "text_delta") {
       onSetStreamMode("responding");
@@ -338269,6 +338576,7 @@ var init_messages3 = __esm(() => {
   init_shared();
   init_last();
   init_outputStyles();
+  init_messageDisplayHooks();
   init_paths3();
   init_growthbook();
   init_modelprovider2();
@@ -339510,7 +339818,7 @@ async function checkRuleBasedPermissions(tool, input, context) {
     const parsedInput = tool.inputSchema.parse(input);
     toolPermissionResult = await tool.checkPermissions(parsedInput, context);
   } catch (e) {
-    if (e instanceof AbortError2 || e instanceof APIUserAbortError3) {
+    if (e instanceof AbortError2 || e instanceof APIUserAbortError2) {
       throw e;
     }
     logError3(e);
@@ -339564,7 +339872,7 @@ async function hasPermissionsToUseToolInner(tool, input, context) {
     const parsedInput = tool.inputSchema.parse(input);
     toolPermissionResult = await tool.checkPermissions(parsedInput, context);
   } catch (e) {
-    if (e instanceof AbortError2 || e instanceof APIUserAbortError3) {
+    if (e instanceof AbortError2 || e instanceof APIUserAbortError2) {
       throw e;
     }
     logError3(e);
@@ -339798,7 +340106,7 @@ var classifierDecisionModule, autoModeStateModule3, CLASSIFIER_FAIL_CLOSED_REFRE
             };
           }
         } catch (e) {
-          if (e instanceof AbortError2 || e instanceof APIUserAbortError3) {
+          if (e instanceof AbortError2 || e instanceof APIUserAbortError2) {
             throw e;
           }
         }
@@ -345033,6 +345341,22 @@ var init_AddWorkspaceDirectory = __esm(() => {
   }];
 });
 
+// src/tui/utils/directoryAddedHooks.ts
+function fireDirectoryAddedHooks(directory, source) {
+  (async () => {
+    try {
+      for await (const _hookResult of executeDirectoryAddedHooks(directory, source, undefined, DIRECTORY_ADDED_HOOK_TIMEOUT_MS)) {}
+    } catch (e) {
+      logForDebugging3(`DirectoryAdded hook execution failed: ${e instanceof Error ? e.message : String(e)}`);
+    }
+  })();
+}
+var DIRECTORY_ADDED_HOOK_TIMEOUT_MS = 15000;
+var init_directoryAddedHooks = __esm(() => {
+  init_debug();
+  init_hooks7();
+});
+
 // src/tui/commands/add-dir/add-dir.tsx
 var exports_add_dir = {};
 __export(exports_add_dir, {
@@ -345138,6 +345462,7 @@ async function call2(onDone, context, args) {
       message = `Added ${source_default.bold(path)} as a working directory for this session`;
     }
     const messageWithHint = `${message} ${source_default.dim("· /permissions to manage")}`;
+    fireDirectoryAddedHooks(path, destination);
     onDone(messageWithHint);
   };
   if (!directoryPath) {
@@ -345178,6 +345503,7 @@ var init_add_dir = __esm(() => {
   init_PermissionUpdate();
   init_sandboxCompat();
   init_validation4();
+  init_directoryAddedHooks();
   import_compiler_runtime110 = __toESM(require_compiler_runtime(), 1);
   import_react77 = __toESM(require_react(), 1);
   jsx_dev_runtime132 = __toESM(require_jsx_dev_runtime(), 1);
@@ -398925,7 +399251,7 @@ function GenerateStep() {
       });
       goToStep(6);
     } catch (err) {
-      if (err instanceof APIUserAbortError3) {} else if (err instanceof Error && !err.message.includes("No assistant message found")) {
+      if (err instanceof APIUserAbortError2) {} else if (err instanceof Error && !err.message.includes("No assistant message found")) {
         setError(err.message || "Failed to generate agent");
       }
       updateWizardData({
@@ -427439,6 +427765,7 @@ var init_hooks6 = __esm(() => {
     decision: _enum(["approve", "block"]).optional(),
     reason: string2().describe("Explanation for the decision").optional(),
     systemMessage: string2().describe("Warning message shown to the user").optional(),
+    terminalSequence: string2().optional(),
     hookSpecificOutput: union([
       object({
         hookEventName: literal("PreToolUse"),
@@ -428447,6 +428774,9 @@ function processHookJSONOutput({
   if (json.systemMessage) {
     result.systemMessage = json.systemMessage;
   }
+  if (json.terminalSequence) {
+    result.terminalSequence = json.terminalSequence;
+  }
   if (json.hookSpecificOutput?.hookEventName === "PreToolUse" && json.hookSpecificOutput.permissionDecision) {
     switch (json.hookSpecificOutput.permissionDecision) {
       case "allow":
@@ -429087,6 +429417,9 @@ async function getMatchingHooks2(appState, sessionId, hookEvent, hookInput, tool
       case "PostModelSwitch":
         matchQuery = hookInput.new_model;
         break;
+      case "DirectoryAdded":
+        matchQuery = hookInput.directory;
+        break;
       default:
         break;
     }
@@ -429764,6 +430097,11 @@ async function* executeHooks({
   let permissionBehavior;
   for await (const result of all2(hookPromises)) {
     outcomes[result.outcome]++;
+    if (result.terminalSequence) {
+      try {
+        process.stdout.write(result.terminalSequence);
+      } catch {}
+    }
     if (result.preventContinuation) {
       logForDebugging3(`Hook ${hookEvent} (${getHookDisplayText(result.hook)}) requested preventContinuation`);
       yield {
@@ -430259,6 +430597,35 @@ async function* executePostModelSwitchHooks(oldModel, newModel, source, signal,
     timeoutMs
   });
 }
+async function* executeDirectoryAddedHooks(directory, source, signal, timeoutMs = TOOL_HOOK_EXECUTION_TIMEOUT_MS) {
+  const hookInput = {
+    ...createBaseHookInput2(undefined),
+    hook_event_name: "DirectoryAdded",
+    directory,
+    source
+  };
+  yield* executeHooks({
+    hookInput,
+    toolUseID: randomUUID43(),
+    matchQuery: directory,
+    signal,
+    timeoutMs
+  });
+}
+async function* executeMessageDisplayHooks(message, signal, timeoutMs = TOOL_HOOK_EXECUTION_TIMEOUT_MS) {
+  const hookInput = {
+    ...createBaseHookInput2(undefined),
+    hook_event_name: "MessageDisplay",
+    message
+  };
+  yield* executeHooks({
+    hookInput,
+    toolUseID: randomUUID43(),
+    matchQuery: undefined,
+    signal,
+    timeoutMs
+  });
+}
 async function* executeSetupHooks(trigger, signal, timeoutMs = TOOL_HOOK_EXECUTION_TIMEOUT_MS, forceSyncExecution) {
   const hookInput = {
     ...createBaseHookInput2(undefined),
@@ -431922,7 +432289,7 @@ async function streamCompactSummary({
       }
       if (attempt < maxAttempts) {
         await sleep9(getRetryDelay(attempt), context.abortController.signal, {
-          abortError: () => new APIUserAbortError3
+          abortError: () => new APIUserAbortError2
         });
         continue;
       }
@@ -433174,13 +433541,17 @@ function truncateEntrypointContent(raw) {
   const byteCount = trimmed.length;
   const wasLineTruncated = lineCount > MAX_ENTRYPOINT_LINES;
   const wasByteTruncated = byteCount > MAX_ENTRYPOINT_BYTES;
+  const nearLimit = (lineCount >= NEAR_LIMIT_LINES || byteCount >= NEAR_LIMIT_BYTES) && !wasLineTruncated && !wasByteTruncated;
   if (!wasLineTruncated && !wasByteTruncated) {
     return {
-      content: trimmed,
+      content: nearLimit ? trimmed + `
+
+> NOTE: ${ENTRYPOINT_NAME} is close to the read limit (${lineCount} lines / ${formatFileSize3(byteCount)}; limits: ${MAX_ENTRYPOINT_LINES} lines / ${formatFileSize3(MAX_ENTRYPOINT_BYTES)}). ${COMPACT_NOW_DIRECTIVE}` : trimmed,
       lineCount,
       byteCount,
       wasLineTruncated,
-      wasByteTruncated
+      wasByteTruncated,
+      nearLimit
     };
   }
   let truncated = wasLineTruncated ? contentLines.slice(0, MAX_ENTRYPOINT_LINES).join(`
@@ -433194,11 +433565,12 @@ function truncateEntrypointContent(raw) {
   return {
     content: truncated + `
 
-> WARNING: ${ENTRYPOINT_NAME} is ${reason}. Only part of it was loaded. Keep index entries to one line under ~200 chars; move detail into topic files.`,
+> WARNING: ${ENTRYPOINT_NAME} is ${reason}. Only part of it was loaded. Keep index entries to one line under ~200 chars; move detail into topic files. ${COMPACT_NOW_DIRECTIVE}`,
     lineCount,
     byteCount,
     wasLineTruncated,
-    wasByteTruncated
+    wasByteTruncated,
+    nearLimit: true
   };
 }
 async function ensureMemoryDirExists(memoryDir, store) {
@@ -433342,7 +433714,7 @@ async function loadMemoryPrompt(store) {
   if (getFeatureValue_CACHED_MAY_BE_STALE("atlas_herring_clock", false)) {}
   return null;
 }
-var teamMemPaths5, ENTRYPOINT_NAME = "MEMORY.md", MAX_ENTRYPOINT_LINES = 200, MAX_ENTRYPOINT_BYTES = 25000, teamMemPrompts, DIR_EXISTS_GUIDANCE = "This directory already exists — write to it directly with the Write tool (do not run mkdir or check for its existence).", DIRS_EXIST_GUIDANCE = "Both directories already exist — write to them directly with the Write tool (do not run mkdir or check for their existence).";
+var teamMemPaths5, ENTRYPOINT_NAME = "MEMORY.md", MAX_ENTRYPOINT_LINES = 200, MAX_ENTRYPOINT_BYTES = 25000, NEAR_LIMIT_FRACTION = 0.8, NEAR_LIMIT_LINES, NEAR_LIMIT_BYTES, COMPACT_NOW_DIRECTIVE = "Compact it now: merge duplicate entries and prune stale ones before adding new lines.", teamMemPrompts, DIR_EXISTS_GUIDANCE = "This directory already exists — write to it directly with the Write tool (do not run mkdir or check for its existence).", DIRS_EXIST_GUIDANCE = "Both directories already exist — write to them directly with the Write tool (do not run mkdir or check for their existence).";
 var init_memdir = __esm(() => {
   init_shared();
   init_memory();
@@ -433360,6 +433732,8 @@ var init_memdir = __esm(() => {
   init_sessionStorage();
   init_memoryTypes2();
   teamMemPaths5 = feature("TEAMMEM") ? (init_teamMemPaths(), __toCommonJS(exports_teamMemPaths)) : null;
+  NEAR_LIMIT_LINES = Math.floor(MAX_ENTRYPOINT_LINES * NEAR_LIMIT_FRACTION);
+  NEAR_LIMIT_BYTES = Math.floor(MAX_ENTRYPOINT_BYTES * NEAR_LIMIT_FRACTION);
   teamMemPrompts = feature("TEAMMEM") ? (init_teamMemPrompts(), __toCommonJS(exports_teamMemPrompts)) : null;
 });
 
@@ -468545,7 +468919,7 @@ function useCanUseTool(setToolUseConfirmQueue, setToolPermissionContext) {
           }
         }
       }).catch((error) => {
-        if (error instanceof AbortError2 || error instanceof APIUserAbortError3) {
+        if (error instanceof AbortError2 || error instanceof APIUserAbortError2) {
           logForDebugging3(`Permission check threw ${error.constructor.name} for tool=${tool.name}: ${error.message}`);
           ctx.logCancelled();
           resolve(ctx.cancelAndAbort(undefined, true));
@@ -471807,7 +472181,7 @@ async function generateAwaySummary(messages, signal) {
     });
     return getAssistantMessageText2(response);
   } catch (err) {
-    if (err instanceof APIUserAbortError3 || signal.aborted) {
+    if (err instanceof APIUserAbortError2 || signal.aborted) {
       return null;
     }
     logForDebugging3(`[awaySummary] generation failed: ${err}`);
@@ -479447,6 +479821,9 @@ Error: sandbox required but unavailable: ${reason}
     onBackgroundQuery: handleBackgroundQuery
   });
   const onQueryEvent = import_react282.useCallback((event) => {
+    if (event.type === "stream_request_start") {
+      setAppState((prev) => ({ ...prev, spinnerTip: undefined }));
+    }
     handleMessageFromStream(event, (newMessage) => {
       if (isCompactBoundaryMessage2(newMessage)) {
         if (isFullscreenEnvEnabled()) {
@@ -479485,8 +479862,13 @@ Error: sandbox required but unavailable: ${reason}
         responseLengthBaseline: baseline,
         endResponseLength: baseline
       });
-    }, onStreamingText);
-  }, [setMessages, setResponseLength, setStreamMode, setStreamingToolUses, setStreamingThinking, onStreamingText]);
+    }, onStreamingText, (info) => {
+      setAppState((prev) => ({
+        ...prev,
+        spinnerTip: `${info.toolName} 仍在运行 · ${Math.round(info.elapsedMs / 1000)}s`
+      }));
+    });
+  }, [setMessages, setResponseLength, setStreamMode, setStreamingToolUses, setStreamingThinking, onStreamingText, setAppState]);
   const onQueryImpl = import_react282.useCallback(async (messagesIncludingNewMessages, newMessages, abortController, shouldQuery, additionalAllowedTools, mainLoopModelParam, effort) => {
     if (shouldQuery) {
       const freshClients = mergeClients(initialMcpClients, store.getState().mcp.clients);
@@ -479602,8 +479984,30 @@ Error: sandbox required but unavailable: ${reason}
       toolUseContext,
       querySource: getQuerySourceForREPL()
     });
+    const controller = abortController;
+    const handleMcpToolBackgrounded = (info) => {
+      if (controller.signal.aborted)
+        return;
+      let text;
+      if (info.outcome.ok === true) {
+        let serialized;
+        try {
+          serialized = typeof info.outcome.data === "string" ? info.outcome.data : JSON.stringify(info.outcome.data, null, 2);
+        } catch {
+          serialized = String(info.outcome.data);
+        }
+        if (serialized.length > 1e4)
+          serialized = `${serialized.slice(0, 1e4)}
+…（结果过长已截断）`;
+        text = `【后台 MCP 工具完成】${info.toolName}（后台运行）已完成，结果如下：
+${serialized}`;
+      } else {
+        text = `【后台 MCP 工具失败】${info.toolName}（后台运行）失败：${info.outcome.error}`;
+      }
+      enqueuePendingNotification2({ value: text, mode: "task-notification" });
+    };
     const loopGen = queryEngineLoopStream({
-      deps: loopDeps,
+      deps: { ...loopDeps, onMcpToolBackgrounded: handleMcpToolBackgrounded },
       args: loopArgs
     });
     let loopResult;
@@ -488968,6 +489372,14 @@ To attach: ${source_default.bold(`tmux attach -t ${tmuxSessionName}`)}`));
       await getRecentActivity();
     }
   }
+  const restrictedBypassErr = restrictedBypassError({
+    permissionMode,
+    allowDangerouslySkipPermissions
+  });
+  if (restrictedBypassErr) {
+    console.error(`Error: ${restrictedBypassErr}`);
+    process.exit(1);
+  }
   if (permissionMode === "bypassPermissions" || allowDangerouslySkipPermissions) {
     if (process.platform !== "win32" && typeof process.getuid === "function" && process.getuid() === 0 && process.env.IS_SANDBOX !== "1" && !isEnvTruthy2(process.env.ATLAS_BUBBLEWRAP)) {
       console.error(`--dangerously-skip-permissions cannot be used with root/sudo privileges for security reasons`);
@@ -488986,6 +489398,7 @@ var init_setup4 = __esm(() => {
   init_Shell2();
   init_sinks();
   init_bootstrap();
+  init_engine();
   init_commands5();
   init_sessionMemory2();
   init_ids();
@@ -492572,7 +492985,7 @@ async function run() {
       throw new Error("--task-budget must be a positive integer");
     }
     return tokens;
-  }).hideHelp()).option("--replay-user-messages", "Re-emit user messages from stdin back on stdout for acknowledgment (only works with --input-format=stream-json and --output-format=stream-json)", () => true).addOption(new Option("--enable-auth-status", "Enable auth status messages in SDK mode").default(false).hideHelp()).option("--allowedTools, --allowed-tools <tools...>", 'Comma or space-separated list of tool names to allow (e.g. "Bash(git:*) Edit")').option("--tools <tools...>", 'Specify the list of available tools from the built-in set. Use "" to disable all tools, "default" to use all tools, or specify tool names (e.g. "Bash,Edit,Read").').option("--disallowedTools, --disallowed-tools <tools...>", 'Comma or space-separated list of tool names to deny (e.g. "Bash(git:*) Edit")').option("--mcp-config <configs...>", "Load MCP servers from JSON files or strings (space-separated)").addOption(new Option("--permission-prompt-tool <tool>", "MCP tool to use for permission prompts (only works with --print)").argParser(String).hideHelp()).addOption(new Option("--system-prompt <prompt>", "System prompt to use for the session").argParser(String)).addOption(new Option("--system-prompt-file <file>", "Read system prompt from a file").argParser(String).hideHelp()).addOption(new Option("--append-system-prompt <prompt>", "Append a system prompt to the default system prompt").argParser(String)).addOption(new Option("--append-system-prompt-file <file>", "Read system prompt from a file and append to the default system prompt").argParser(String).hideHelp()).addOption(new Option("--permission-mode <mode>", "Permission mode to use for the session").argParser(String).choices(PERMISSION_MODES2)).addOption(new Option("--permission-prompts <mode>", "Permission prompt policy; 'none' auto-denies prompts that would otherwise ask").argParser(String).choices(["none"])).option("-c, --continue", "Continue the most recent conversation in the current directory", () => true).option("-r, --resume [value]", "Resume a conversation by session ID, or open interactive picker with optional search term", (value) => value || true).option("--fork-session", "When resuming, create a new session ID instead of reusing the original (use with --resume or --continue)", () => true).addOption(new Option("--prefill <text>", "Pre-fill the prompt input with text without submitting it").hideHelp()).addOption(new Option("--deep-link-origin", "Signal that this session was launched from a deep link").hideHelp()).addOption(new Option("--deep-link-repo <slug>", "Repo slug the deep link ?repo= parameter resolved to the current cwd").hideHelp()).addOption(new Option("--deep-link-last-fetch <ms>", "FETCH_HEAD mtime in epoch ms, precomputed by the deep link trampoline").argParser((v) => {
+  }).hideHelp()).option("--replay-user-messages", "Re-emit user messages from stdin back on stdout for acknowledgment (only works with --input-format=stream-json and --output-format=stream-json)", () => true).addOption(new Option("--enable-auth-status", "Enable auth status messages in SDK mode").default(false).hideHelp()).option("--allowedTools, --allowed-tools <tools...>", 'Comma or space-separated list of tool names to allow (e.g. "Bash(git:*) Edit")').option("--tools <tools...>", 'Specify the list of available tools from the built-in set. Use "" to disable all tools, "default" to use all tools, or specify tool names (e.g. "Bash,Edit,Read").').option("--disallowedTools, --disallowed-tools <tools...>", 'Comma or space-separated list of tool names to deny (e.g. "Bash(git:*) Edit")').option("--mcp-config <configs...>", "Load MCP servers from JSON files or strings (space-separated)").addOption(new Option("--permission-prompt-tool <tool>", "MCP tool to use for permission prompts (only works with --print)").argParser(String).hideHelp()).addOption(new Option("--system-prompt <prompt>", "System prompt to use for the session").argParser(String)).addOption(new Option("--system-prompt-file <file>", "Read system prompt from a file").argParser(String).hideHelp()).addOption(new Option("--append-system-prompt <prompt>", "Append a system prompt to the default system prompt").argParser(String)).addOption(new Option("--append-system-prompt-file <file>", "Read system prompt from a file and append to the default system prompt").argParser(String).hideHelp()).addOption(new Option("--permission-mode <mode>", "Permission mode to use for the session").argParser(String).choices(PERMISSION_MODES2)).addOption(new Option("--permission-prompts <mode>", "Permission prompt policy; 'none' auto-denies prompts that would otherwise ask").argParser(String).choices(["none"])).option("--restricted", "Run in restricted mode: strips command-execution tools (Bash/PowerShell), WebFetch, and Agent; rejects bypassPermissions and --dangerously-skip-permissions; ignores user/project/local settings (env: ATLAS_RESTRICTED)", () => true).option("-c, --continue", "Continue the most recent conversation in the current directory", () => true).option("-r, --resume [value]", "Resume a conversation by session ID, or open interactive picker with optional search term", (value) => value || true).option("--fork-session", "When resuming, create a new session ID instead of reusing the original (use with --resume or --continue)", () => true).addOption(new Option("--prefill <text>", "Pre-fill the prompt input with text without submitting it").hideHelp()).addOption(new Option("--deep-link-origin", "Signal that this session was launched from a deep link").hideHelp()).addOption(new Option("--deep-link-repo <slug>", "Repo slug the deep link ?repo= parameter resolved to the current cwd").hideHelp()).addOption(new Option("--deep-link-last-fetch <ms>", "FETCH_HEAD mtime in epoch ms, precomputed by the deep link trampoline").argParser((v) => {
     const n = Number(v);
     return Number.isFinite(n) ? n : undefined;
   }).hideHelp()).option("--from-pr [value]", "Resume a session linked to a PR by PR number/URL, or open interactive picker with optional search term", (value) => value || true).option("--no-session-persistence", "Disable session persistence - sessions will not be saved to disk and cannot be resumed (only works with --print)").addOption(new Option("--resume-session-at <message id>", "When resuming, only messages up to and including the assistant message with <message.id> (use with --resume in print mode)").argParser(String).hideHelp()).addOption(new Option("--rewind-files <user-message-id>", "Restore files to state at the specified user message and exit (requires --resume)").hideHelp()).option("--model <model>", `Model for the current session. Provide a role alias (e.g. 'small' or 'premium') or a provider/model reference (e.g. 'bailian/qwen38-27b').`).addOption(new Option("--effort <level>", `Effort level for the current session (low, medium, high, xhigh, max)`).argParser((rawValue) => {
@@ -492612,6 +493025,18 @@ async function run() {
       includePartialMessages
     } = options;
     const permissionModeCli = permissionModeCliRaw ?? (permissionPrompts === "none" ? "dontAsk" : undefined);
+    if (options.restricted === true) {
+      setRestrictedMode(true);
+      const restrictedBypassErr = restrictedBypassError({
+        permissionMode: permissionModeCliRaw,
+        allowDangerouslySkipPermissions,
+        dangerouslySkipPermissions
+      });
+      if (restrictedBypassErr) {
+        console.error(`Error: ${restrictedBypassErr}`);
+        process.exit(1);
+      }
+    }
     if (options.prefill) {
       seedEarlyInput(options.prefill);
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@atlasharness/atlascode",
-  "version": "0.1.78",
+  "version": "0.1.79",
   "description": "AtlasCode \u2014 Coding Agent for the domestic computing ecosystem (Ascend NPU + domestic LLM backends)",
   "bin": {
     "atlas": "dist/cli.js",