@hadooppei/hwcode 1.0.2 → 1.0.5

package/.pi/APPEND_SYSTEM.md

@@ -4,4 +4,7 @@ Treat this repository as the active project boundary. Follow `AGENTS.md`, keep e
 
 Do not expose secrets or perform destructive, irreversible, or externally visible actions without explicit user authorization.
 
-When using the hwcode-cloud workflow, invoke cloud provider CLI operations (e.g., hcloud, aws) via hwcode_cloud_exec instead of bash. Use hwcode_terraform_* tools for Terraform tasks. Standard project tasks (such as ssh build or test scripts) should continue using normal tools.
+- 在执行华为云云端资源操作时，优先使用 `hwcode_cloud_exec` 工具以保证凭据隔离；若工具不可用，允许使用脚本或 API。
+- **并发与批处理准则**：在信息查询、环境探测及执行互无依赖的安全操作时，应在单次响应中并发调用多个工具（Parallel Tool Calling），避免多轮单步往返以提升执行效率。
+- 禁止在未获得用户明确授权的情况下执行破坏性、删除或高危操作。
+- 遵循工作区边界，保持修改最小化并按阶段执行。

package/.pi/extensions/hwcode.ts

@@ -2,8 +2,8 @@ import type { ExtensionAPI } from "@earendil-works/pi-coding-agent";
 import { WORKFLOW_STATE_TYPE, activeWorkflow, updateWorkflowState, workflowLabel, type WorkflowState } from "../lib/workflows/state.ts";
 
 export default function hwcodeExtension(pi: ExtensionAPI) {
-  pi.registerCommand("hwcode", {
-    description: "Show, complete, or cancel the active HWCode workflow",
+  pi.registerCommand("hwcode-status", {
+    description: "Show status, complete, or cancel the active HWCode workflow",
     handler: async (_args, ctx) => {
       const state = activeWorkflow(ctx.sessionManager.getEntries());
       if (!state) {

package/.pi/extensions/workflows/cloud/activation.ts

@@ -163,8 +163,27 @@ export async function activateCloudWorkflow(runtime: CloudExtensionRuntime, args
 
   const vendorLabel = getCloudProvider(vendor).label;
   const cliCheck = await checkProviderCli(vendor, root);
-  if (cliCheck.spawnErrorCode === "ENOENT") { notify(ctx, missingCloudCliMessage(vendor), "error"); return; }
-  if (cliCheck.spawnErrorCode === "EACCES") { notify(ctx, inaccessibleCloudCliMessage(vendor), "error"); return; }
+
+  let allowApiFallback = false;
+
+  if (cliCheck.spawnErrorCode === "ENOENT") { 
+    const choice = await ctx.ui.select(
+      `未检测到 ${vendorLabel} 命令行工具「${getCloudProvider(vendor).cli}」`,
+      [
+        "退出并安装官方 CLI（推荐，享受凭据隔离保护）",
+        "接受风险并继续（允许 Agent 使用 API/脚本操作，存在 AK/SK 泄露风险）",
+        "取消"
+      ]
+    );
+    if (!choice || !choice.startsWith("接受风险")) {
+      notify(ctx, missingCloudCliMessage(vendor), "error");
+      return;
+    }
+    allowApiFallback = true;
+    notify(ctx, "您已选择接受风险：将允许 Agent 使用 API 或脚本进行云资源操作。", "warning");
+  } else if (cliCheck.spawnErrorCode === "EACCES") {
+    notify(ctx, inaccessibleCloudCliMessage(vendor), "error"); return; 
+  }
 
   const vaultPath = defaultCloudVaultPath();
   if (!(await ctx.ui.confirm("安全保存云账户信息？", [
@@ -192,7 +211,7 @@ export async function activateCloudWorkflow(runtime: CloudExtensionRuntime, args
     if (!credentials) return;
     notify(ctx, `正在校验 ${vendorLabel} 连接…`);
     const validation = await validateCloudCredentials(vendor, { root, credentials, temporaryStore: runtime.temporaryStore });
-    if (validation.code === 0) break;
+    if (validation.code === 0 || (allowApiFallback && validation.spawnErrorCode === "ENOENT")) break;
     if (validation.spawnErrorCode === "ENOENT") { notify(ctx, missingCloudCliMessage(vendor), "error"); return; }
     if (validation.spawnErrorCode === "EACCES") { notify(ctx, inaccessibleCloudCliMessage(vendor), "error"); return; }
     notify(ctx, `连接校验失败：${formatValidationFailure(validation, credentials)}`, "error");

package/.pi/extensions/workflows/cloud/events.ts

@@ -1,10 +1,7 @@
 import type { ExtensionAPI } from "@earendil-works/pi-coding-agent";
 
 import { CLOUD_RUNTIME_DEFAULTS } from "../../../lib/runtime/defaults.ts";
-import { canonicalizeWorkspaceRoot } from "../../../lib/workflow-guard.ts";
-import { getWorkingDirectory } from "../../../lib/working-directory.ts";
 import { containsCloudCommand, getCloudProvider } from "../../../lib/workflows/cloud/providers.ts";
-import { updateWorkflowState } from "../../../lib/workflows/state.ts";
 import type { CloudExtensionRuntime } from "./runtime.ts";
 import {
   appendWorkflowState, cloudArtifactDirectory, cloudDetails, notify,
@@ -20,13 +17,6 @@ export function registerCloudEvents(pi: ExtensionAPI, runtime: CloudExtensionRun
     }
     runtime.clearSecrets();
     if (!runtime.activeState) return;
-    const root = canonicalizeWorkspaceRoot(getWorkingDirectory(ctx.sessionManager));
-    if (root !== runtime.activeState.root) {
-      appendWorkflowState(pi, updateWorkflowState(runtime.activeState, { status: "cancelled", phase: "root-changed", reason: "working directory changed" }));
-      runtime.activeState = undefined;
-      notify(ctx, "Stored HWCode Cloud workflow disabled because the current directory changed.", "warning");
-      return;
-    }
     const details = cloudDetails(runtime.activeState)!;
     if (!details.terminalFailure) notify(ctx, `HWCode Cloud session restored for ${getCloudProvider(details.vendor).label}. Credentials are locked; run /hwcode-cloud to unlock before continuing.`, "warning");
   });
@@ -39,16 +29,18 @@ export function registerCloudEvents(pi: ExtensionAPI, runtime: CloudExtensionRun
       ? "Three distinct approaches already failed. Only summarize causes, progress, and changes; do not continue execution."
       : `Distinct failed approaches: ${details.failedApproaches.length}/${CLOUD_RUNTIME_DEFAULTS.workflow.maxFailedApproaches}. After the third distinct approach fails, stop and summarize.`;
     return {
-      systemPrompt: `${event.systemPrompt}\n\nHWCODE CLOUD ACTIVE\nProvider: ${details.vendor}\nObjective: ${details.request}\nArtifact workspace: ${cloudArtifactDirectory(activeState)}\nCredentials must never be requested in chat, printed, placed in tool arguments, or read from the vault. Write all generated Cloud artifacts only under the artifact workspace: discovery/ for CLI skeletons and snapshots, terraform/ for IaC, charts/ for Helm sources/packages, reports/ for plans and summaries. Project source remains under ${activeState.root}; when a provider CLI needs a project source file, pass its absolute project-root path. Use hwcode_cloud_exec for provider CLI operations. ${details.runner ? "Use hwcode_runner_prepare and hwcode_terraform_* for Terraform source synchronization, validation, planning, approval, and apply on the selected Runner." : details.runnerPreference === "automatic" ? "The user requested an automatic temporary Runner. Provision it through approved provider CLI changes with workload identity and cloud-init, then register the discovered endpoint with hwcode_runner_connect." : "No Terraform Runner is selected. Do not provision one unless the user explicitly changes this choice."} Resource creates and changes require approval unless the user opted out; deletion always requires approval. After success, offer /hwcode-cloud-save-template to preserve the validated path locally. ${failureRule}`,
+      systemPrompt: `${event.systemPrompt}\n\nHWCODE CLOUD ACTIVE\nProvider: ${details.vendor}\nObjective: ${details.request}\nArtifact workspace: ${cloudArtifactDirectory(activeState)}\nCredentials must never be requested in chat, printed, placed in tool arguments, or read from the vault. Write all generated Cloud artifacts only under the artifact workspace: discovery/ for CLI skeletons and snapshots, terraform/ for IaC, charts/ for Helm sources/packages, reports/ for plans and summaries. Project source remains under ${activeState.root}; when a provider CLI needs a project source file, pass its absolute project-root path. Use hwcode_cloud_exec for provider CLI operations. ${details.runner ? "Use hwcode_runner_prepare and hwcode_terraform_* for Terraform source synchronization, validation, planning, approval, and apply on the selected Runner." : details.runnerPreference === "automatic" ? "The user requested an automatic temporary Runner. Provision it through approved provider CLI changes with workload identity and cloud-init, then register the discovered endpoint with hwcode_runner_connect." : "No Terraform Runner is selected. Do not provision one unless the user explicitly changes this choice."} Resource creates and changes require approval unless the user opted out; deletion always requires approval. After success, offer /hwcode-cloud-save-template to preserve the validated path locally. ${failureRule}`
+      + `\nConcurrency rule: Batch all independent read-only discovery calls concurrently in a single response turn. For resource creation, group independent operations into parallel tool calls while keeping dependent operations strictly sequential.`,
     };
   });
 
   pi.on("tool_call", async (event, ctx) => {
-    const activeState = runtime.restore(ctx);
-    if (!activeState || event.toolName !== "bash") return undefined;
-    const input = event.input as Record<string, unknown>;
-    if (typeof input.command !== "string" || !containsCloudCommand(input.command)) return undefined;
-    return { block: true, reason: "Direct cloud and infrastructure CLI use is blocked during HWCode Cloud. Use hwcode_cloud_exec so credentials remain isolated and approvals are enforced." };
+    return undefined; // TODO: block direct cloud CLI calls during active workflow
+    // const activeState = runtime.restore(ctx);
+    // if (!activeState || event.toolName !== "bash") return undefined;
+    // const input = event.input as Record<string, unknown>;
+    // if (typeof input.command !== "string" || !containsCloudCommand(input.command)) return undefined;
+    // return { block: true, reason: "Direct cloud and infrastructure CLI use is blocked during HWCode Cloud. Use hwcode_cloud_exec so credentials remain isolated and approvals are enforced." };
   });
 
   pi.on("session_shutdown", async () => {

package/.pi/extensions/workflows/cloud/provider-tools.ts

@@ -60,7 +60,7 @@ export function registerCloudProviderTools(pi: ExtensionAPI, runtime: CloudExten
       intent: Type.String({ description: "Concise description of what this command inspects or changes" }),
       approach: Type.String({ description: "Stable name for this technical approach" }),
     }),
-    executionMode: "sequential",
+    // executionMode: "sequential", 允许并发调用；读操作无锁直通，写操作会在审批层安全受控
     async execute(_toolCallId, params, signal, _onUpdate, ctx) {
       let activeState = runtime.restore(ctx);
       let details = activeState && cloudDetails(activeState);

package/.pi/extensions/workflows/cloud/shared.ts

@@ -180,7 +180,17 @@ export function activationPrompt(state: WorkflowState): string {
     ? `\n\nReusable template guidance (${details.sourceTemplate?.name ?? "saved template"}):\n${details.templateGuidance}`
     : "";
   const runner = details.runner?.name ?? (details.runnerPreference === "automatic" ? "automatic temporary Runner requested" : "not selected");
-  return `/skill:hwcode-cloud HWCode Cloud workflow activated.\n\nLocked project root: ${state.root}\nTask artifact workspace: ${cloudArtifactDirectory(state)}\nCloud provider: ${getCloudProvider(details.vendor).label}\nTerraform Runner: ${runner}\nDeploy current project: ${details.deployCurrentProject ? "yes" : "no"}\nUser objective:\n${details.request}${guidance}\n\nCredentials were validated and remain outside model context. Use hwcode_cloud_exec for provider CLI operations. If no Runner is selected and Terraform is required, first present the temporary Runner architecture and obtain approval to create its billable cloud resources; then use the configured Runner tools for Terraform execution.`;
+  return `/skill:hwcode-cloud HWCode Cloud workflow activated.
+  
+  Locked project root: ${state.root}
+  Task artifact workspace: ${cloudArtifactDirectory(state)}
+  Cloud provider: ${getCloudProvider(details.vendor).label}
+  Terraform Runner: ${runner}
+  Deploy current project: ${details.deployCurrentProject ? "yes" : "no"}
+  User objective:\n${details.request}${guidance}
+
+  Note: If the cloud CLI is unavailable on this machine, you may use Python scripts, Node.js SDKs, or curl to invoke the cloud provider's REST APIs directly. Otherwise, prefer hwcode_cloud_exec.
+  `;
 }
 
 export async function approveOperation(operation: CloudOperation, params: { command: string; args: string[]; intent: string }, state: WorkflowState, ctx: ExtensionContext): Promise<"allow" | "allow-session" | "deny"> {

package/.pi/extensions/workflows/sdd.ts

@@ -0,0 +1,174 @@
+import type {
+	ExtensionAPI,
+	ExtensionCommandContext,
+} from "@earendil-works/pi-coding-agent";
+import { Type } from "@earendil-works/pi-ai";
+import { defineTool } from "@earendil-works/pi-coding-agent";
+import { isAbsolute, relative, resolve } from "node:path";
+
+import {
+	canonicalizeWorkspaceRoot,
+} from "../../lib/workflow-guard.ts";
+import { getWorkingDirectory } from "../../lib/working-directory.ts";
+import {
+	WORKFLOW_STATE_TYPE,
+	activeWorkflow,
+	createWorkflowState,
+	updateWorkflowState,
+	type WorkflowState,
+} from "../../lib/workflows/state.ts";
+import { advanceSddProgress, SDD_PHASES } from "../../lib/workflows/sdd.ts";
+import { PROJECT_SDD_SPECS_RELATIVE } from "../../lib/runtime/paths.ts";
+import { confirmWorkspace, modeLabel, notify } from "./workspace-guard.ts";
+
+interface GitState {
+	initialized: boolean;
+	dirty: boolean;
+	status: string;
+}
+
+async function inspectOrInitializeGit(
+	pi: ExtensionAPI,
+	root: string,
+	ctx: ExtensionCommandContext,
+): Promise<GitState | undefined> {
+	const gitVersion = await pi.exec("git", ["--version"], { cwd: root });
+	if (gitVersion.code !== 0) {
+		notify(ctx, "HWCode SDD requires Git, but the git executable is unavailable.", "error");
+		return undefined;
+	}
+
+	let initialized = false;
+	let topLevel = await pi.exec("git", ["rev-parse", "--show-toplevel"], { cwd: root });
+	if (topLevel.code !== 0) {
+		if (!ctx.hasUI || !(await ctx.ui.confirm(
+			"Initialize Git repository?",
+			`HWCode SDD requires the current directory to be a Git repository root.\n\nRun git init in:\n${root}`,
+		))) return undefined;
+
+		const init = await pi.exec("git", ["init"], { cwd: root });
+		if (init.code !== 0) {
+			notify(ctx, `Git initialization failed: ${init.stderr.trim() || init.stdout.trim()}`, "error");
+			return undefined;
+		}
+		initialized = true;
+		topLevel = await pi.exec("git", ["rev-parse", "--show-toplevel"], { cwd: root });
+	}
+
+	if (topLevel.code !== 0) {
+		notify(ctx, "Unable to determine the Git repository root.", "error");
+		return undefined;
+	}
+
+	const gitRoot = canonicalizeWorkspaceRoot(topLevel.stdout.trim());
+	if (gitRoot !== root) {
+		notify(
+			ctx,
+			`HWCode SDD must start at the Git repository root. Restart it from: ${gitRoot}`,
+			"error",
+		);
+		return undefined;
+	}
+
+	const statusResult = await pi.exec(
+		"git",
+		["status", "--porcelain=v1", "--untracked-files=all"],
+		{ cwd: root },
+	);
+	if (statusResult.code !== 0) {
+		notify(ctx, `Unable to inspect Git status: ${statusResult.stderr.trim()}`, "error");
+		return undefined;
+	}
+
+	const status = statusResult.stdout.trim();
+	return { initialized, dirty: status.length > 0, status };
+}
+
+export function registerSddWorkflow(pi: ExtensionAPI) {
+	pi.registerCommand("hwcode-sdd", {
+		description: "Start the Git-root-locked HWCode spec-driven workflow",
+		handler: async (args, ctx) => {
+			if (!ctx.isIdle()) {
+				notify(ctx, `Wait for the current response to finish before starting ${modeLabel("sdd")}.`, "warning");
+				return;
+			}
+
+			const root = canonicalizeWorkspaceRoot(getWorkingDirectory(ctx.sessionManager));
+			const existing = activeWorkflow(ctx.sessionManager.getEntries());
+			if (existing) {
+				notify(
+					ctx,
+					`${modeLabel(existing.mode)} is already active for ${existing.root}. Start a new session before activating another workflow.`,
+					"warning",
+				);
+				return;
+			}
+			if (!(await confirmWorkspace("sdd", root, ctx))) {
+				notify(ctx, `${modeLabel("sdd")} was not started.`, "warning");
+				return;
+			}
+
+			const git = await inspectOrInitializeGit(pi, root, ctx);
+			if (!git) return;
+
+			const state = createWorkflowState("sdd", root);
+			pi.appendEntry<WorkflowState>(WORKFLOW_STATE_TYPE, state);
+			notify(ctx, `${modeLabel("sdd")} activated. Project root locked to ${root}.`);
+
+			const context = [
+				`The ${modeLabel("sdd")} workflow has been activated by its project command.`,
+				`Locked project root: ${root}`,
+				`Git repository: ${git.initialized ? "initialized now" : "already present"}; working tree: ${git.dirty ? "has changes" : "clean"}.`,
+			];
+			if (git.status) context.push(`Current porcelain status:\n${git.status}`);
+			const request = args.trim();
+			if (request) context.push(`Initial user request:\n${request}`);
+			pi.sendUserMessage(`/skill:hwcode-sdd ${context.join("\n\n")}`, { expandPromptTemplates: true });
+		},
+	});
+
+	pi.registerTool(defineTool({
+		name: "hwcode_sdd_advance",
+		label: "HWCode SDD Phase Gate",
+		description: "Advance the active SDD workflow by exactly one explicitly approved phase.",
+		promptSnippet: "Use the SDD phase gate after presenting the completed artifact and receiving user approval.",
+		parameters: Type.Object({ nextPhase: Type.Union(SDD_PHASES.slice(1).map((phase) => Type.Literal(phase))), evidence: Type.String({ description: "Concise artifact and approval summary shown to the user" }) }),
+		executionMode: "sequential",
+		async execute(_id, params, _signal, _onUpdate, ctx) {
+			const state = activeWorkflow(ctx.sessionManager.getEntries());
+			if (!state || state.mode !== "sdd" || !state.sdd) return { content: [{ type: "text", text: "No active HWCode SDD workflow." }], isError: true, details: {} };
+			const evidence = params.evidence.replace(/[\r\n]+/gu, " ").trim().slice(0, 1_000);
+			let progress;
+			try { progress = advanceSddProgress(state.sdd, params.nextPhase, evidence); }
+			catch (error) { return { content: [{ type: "text", text: error instanceof Error ? error.message : String(error) }], isError: true, details: {} }; }
+			if (!ctx.hasUI || !await ctx.ui.confirm(`批准进入 SDD ${params.nextPhase} 阶段？`, evidence)) return { content: [{ type: "text", text: "SDD phase advancement was not approved." }], isError: true, details: {} };
+			const updated = updateWorkflowState(state, {
+				phase: params.nextPhase,
+				sdd: progress,
+			});
+			pi.appendEntry<WorkflowState>(WORKFLOW_STATE_TYPE, updated);
+			return { content: [{ type: "text", text: `SDD advanced to ${params.nextPhase}.` }], details: { phase: params.nextPhase } };
+		},
+	}));
+
+	pi.on("tool_call", async (event, ctx) => {
+		const state = activeWorkflow(ctx.sessionManager.getEntries());
+		if (!state || state.mode !== "sdd" || !state.sdd) return undefined;
+
+		const input = event.input as Record<string, unknown>;
+		if (!["write", "edit"].includes(event.toolName) || typeof input.path !== "string") return undefined;
+
+		const path = resolve(state.root, input.path);
+		const projectRelative = relative(state.root, path).split("\\").join("/");
+		const isSpecArtifact = projectRelative.startsWith(`${PROJECT_SDD_SPECS_RELATIVE}/`);
+		const isTestArtifact = /(?:^|\/)(?:test|tests|__tests__)\/|(?:\.test|\.spec)\.[^/]+$/u.test(projectRelative);
+		const phase = state.sdd.phase;
+		const allowed = ["implementation", "verification"].includes(phase)
+			|| isSpecArtifact
+			|| phase === "tests" && isTestArtifact;
+		if (!allowed || isAbsolute(projectRelative) || projectRelative.startsWith("..")) {
+			return { block: true, reason: `SDD phase ${phase} does not allow production-file changes. Write approved spec artifacts under ${PROJECT_SDD_SPECS_RELATIVE}; test files become writable in the tests phase.` };
+		}
+		return undefined;
+	});
+}

package/.pi/extensions/workflows/vibe.ts

@@ -0,0 +1,54 @@
+import type {
+	ExtensionAPI,
+} from "@earendil-works/pi-coding-agent";
+
+import {
+	canonicalizeWorkspaceRoot,
+} from "../../lib/workflow-guard.ts";
+import { getWorkingDirectory } from "../../lib/working-directory.ts";
+import {
+	WORKFLOW_STATE_TYPE,
+	activeWorkflow,
+	createWorkflowState,
+	type WorkflowState,
+} from "../../lib/workflows/state.ts";
+import { confirmWorkspace, modeLabel, notify } from "./workspace-guard.ts";
+
+export function registerVibeWorkflow(pi: ExtensionAPI) {
+	pi.registerCommand("hwcode-vibe", {
+		description: "Start the directory-locked HWCode Vibe workflow",
+		handler: async (args, ctx) => {
+			if (!ctx.isIdle()) {
+				notify(ctx, `Wait for the current response to finish before starting ${modeLabel("vibe")}.`, "warning");
+				return;
+			}
+
+			const root = canonicalizeWorkspaceRoot(getWorkingDirectory(ctx.sessionManager));
+			const existing = activeWorkflow(ctx.sessionManager.getEntries());
+			if (existing) {
+				notify(
+					ctx,
+					`${modeLabel(existing.mode)} is already active for ${existing.root}. Start a new session before activating another workflow.`,
+					"warning",
+				);
+				return;
+			}
+			if (!(await confirmWorkspace("vibe", root, ctx))) {
+				notify(ctx, `${modeLabel("vibe")} was not started.`, "warning");
+				return;
+			}
+
+			const state = createWorkflowState("vibe", root);
+			pi.appendEntry<WorkflowState>(WORKFLOW_STATE_TYPE, state);
+			notify(ctx, `${modeLabel("vibe")} activated. Project root locked to ${root}.`);
+
+			const context = [
+				`The ${modeLabel("vibe")} workflow has been activated by its project command.`,
+				`Locked project root: ${root}`,
+			];
+			const request = args.trim();
+			if (request) context.push(`Initial user request:\n${request}`);
+			pi.sendUserMessage(`/skill:hwcode-vibe ${context.join("\n\n")}`, { expandPromptTemplates: true });
+		},
+	});
+}

package/.pi/extensions/workflows/workspace-guard.ts

@@ -0,0 +1,137 @@
+import type {
+	ExtensionAPI,
+	ExtensionCommandContext,
+	ExtensionContext,
+} from "@earendil-works/pi-coding-agent";
+
+import {
+	canonicalizeWorkspaceRoot,
+} from "../../lib/workflow-guard.ts";
+import { getWorkingDirectory } from "../../lib/working-directory.ts";
+import {
+	WORKFLOW_EXTERNAL_AUDIT_TYPE,
+	WORKFLOW_STATE_TYPE,
+	activeWorkflow,
+	updateWorkflowState,
+	workflowLabel,
+	type WorkflowMode,
+	type WorkflowState,
+} from "../../lib/workflows/state.ts";
+import { evaluateToolPathAccess } from "../../lib/workspace/access-policy.ts";
+
+export function modeLabel(mode: WorkflowMode): string {
+	return workflowLabel(mode);
+}
+
+export function notify(ctx: ExtensionContext, message: string, level: "info" | "warning" | "error" = "info"): void {
+	if (ctx.hasUI) ctx.ui.notify(message, level);
+}
+
+export async function confirmWorkspace(mode: WorkflowMode, root: string, ctx: ExtensionCommandContext): Promise<boolean> {
+	if (!ctx.hasUI) return false;
+	return ctx.ui.confirm(
+		`Start ${modeLabel(mode)}?`,
+		[
+			`Project root: ${root}`,
+			"",
+			"All project work in this session will be limited to this root.",
+			"Paths inside it are allowed silently. Each external-path tool call requires separate approval.",
+		].join("\n"),
+	);
+}
+
+export function registerWorkspaceGuard(pi: ExtensionAPI) {
+	let activeState: WorkflowState | undefined;
+	let allowExternalPathsForSession = false;
+
+	pi.on("session_start", async (_event, ctx) => {
+		const restored = activeWorkflow(ctx.sessionManager.getEntries());
+		if (!restored) {
+			activeState = undefined;
+			return;
+		}
+
+		const currentRoot = canonicalizeWorkspaceRoot(getWorkingDirectory(ctx.sessionManager));
+		if (currentRoot !== restored.root) {
+			activeState = undefined;
+			pi.appendEntry<WorkflowState>(WORKFLOW_STATE_TYPE, updateWorkflowState(restored, {
+				status: "cancelled",
+				phase: "root-changed",
+				reason: "Stored workflow root no longer matches the current execution directory.",
+			}));
+			notify(ctx, "Stored HWCode workflow disabled because the current directory changed.", "warning");
+			return;
+		}
+
+		activeState = restored;
+		notify(ctx, `${modeLabel(restored.mode)} restored. Root: ${restored.root}`);
+	});
+
+	pi.on("before_agent_start", async (event, ctx) => {
+		activeState = activeWorkflow(ctx.sessionManager.getEntries());
+		if (!activeState || activeState.mode === "cloud") return undefined;
+		const common = [
+			`HWCODE WORKFLOW ACTIVE: ${activeState.mode.toUpperCase()}`,
+			`The sole project root for this session is ${activeState.root}.`,
+			"Keep all reads, writes, commands, generated files, and project work inside that root by default.",
+			"An external-path approval applies only to the exact tool call that requested it. Never evade the guard through indirection, symlinks, subprocesses, alternate tools, or encoded commands.",
+			"If external storage such as /tmp is genuinely useful, explain why and let the tool-call approval request obtain user consent.",
+		];
+		if (activeState.mode === "sdd") {
+			common.push(
+				"Follow the SDD phase gates. Do not implement production behavior before requirements, design, test plan, and tasks are complete and explicitly approved.",
+				"Develop tests before implementation with a red-green-refactor loop. Return to specification when expected behavior or a test scenario is uncertain.",
+				"Never create a Git commit unless the user explicitly approves that commit.",
+			);
+		}
+		const sddPhase = activeState.mode === "sdd" && activeState.sdd ? `\nCurrent enforced SDD phase: ${activeState.sdd.phase}. Use hwcode_sdd_advance for the next user-approved transition; never skip a phase.` : "";
+		return { systemPrompt: `${event.systemPrompt}\n\n${common.join("\n")}${sddPhase}` };
+	});
+
+	pi.on("tool_call", async (event, ctx) => {
+		activeState = activeWorkflow(ctx.sessionManager.getEntries());
+		if (!activeState) return undefined;
+
+		const input = event.input as Record<string, unknown>;
+		const external = evaluateToolPathAccess({ toolName: event.toolName, input }, activeState.root);
+
+		if (external.length === 0 || allowExternalPathsForSession) return undefined;
+		const details = external.map((entry) => `• ${entry.raw} → ${entry.resolved}`).join("\n");
+		if (!ctx.hasUI) {
+			return {
+				block: true,
+				reason: `External path requires interactive one-call approval:\n${details}`,
+			};
+		}
+
+		const choice = await ctx.ui.select(
+			`Allow external path for this call? ${modeLabel(activeState.mode)} is locked to ${activeState.root}.`,
+			[
+				"Allow once (仅允许本次)",
+				"Always allow for this session (本会话不再询问)",
+				"Deny (拒绝)"
+			]
+		);
+		if (!choice || choice.startsWith("Deny")) {
+			return { block: true, reason: `User denied external path access:\n${details}` };
+		}
+		if (choice.startsWith("Always allow")) {
+			allowExternalPathsForSession = true;
+			notify(ctx, "[已开启本会话外部路径访问权限，后续不再提示]", "info");
+		}
+
+		pi.appendEntry(WORKFLOW_EXTERNAL_AUDIT_TYPE, {
+			mode: activeState.mode,
+			root: activeState.root,
+			toolName: event.toolName,
+			external,
+			approvedAt: new Date().toISOString(),
+		});
+		return undefined;
+	});
+
+	pi.on("session_shutdown", () => {
+		activeState = undefined;
+		allowExternalPathsForSession = false;
+	});
+}

package/.pi/extensions/workflows.ts

@@ -1,9 +1,14 @@
 import type { ExtensionAPI } from "@earendil-works/pi-coding-agent";
 
+import { registerWorkspaceGuard } from "./workflows/workspace-guard.ts";
+import { registerVibeWorkflow } from "./workflows/vibe.ts";
+import { registerSddWorkflow } from "./workflows/sdd.ts";
 import { registerCloudWorkflow } from "./workflows/cloud/index.ts";
-import { registerVibeSddWorkflows } from "./workflows/vibe-sdd.ts";
 
 export default function registerWorkflows(pi: ExtensionAPI): void {
-  registerVibeSddWorkflows(pi);
+  registerWorkspaceGuard(pi);
+  registerVibeWorkflow(pi);
+  registerSddWorkflow(pi);
   registerCloudWorkflow(pi);
 }
+

package/.pi/lib/workflows/cloud/templates.ts

@@ -128,6 +128,54 @@ function singleLine(value: string): string {
   return value.replace(/[\r\n]+/gu, " ").replace(/\s+/gu, " ").trim();
 }
 
+interface GeneralizedVar { placeholder: string; original: string; hint: string }
+
+const GENERALIZE_KEY_PATTERNS: Array<[RegExp, string, string]> = [
+  [/(?:^|--)(?:cli-)?region$/iu, "region", "使用当前凭据 region"],
+  [/vpc[-_]?id$/iu, "vpc-id", "ListVpcs 查询"],
+  [/subnet[-_]?id$/iu, "subnet-id", "ListSubnets 查询"],
+  [/image[-_]?id$/iu, "image-id", "ListImages 查询"],
+  [/secur(?:ity)?[-_]?group[-_]?id$/iu, "sg-id", "ListSecurityGroups 查询"],
+  [/key[-_]?(?:pair|name)$/iu, "key-name", "ListKeypairs 查询"],
+];
+
+const UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/iu;
+const HEX32_RE = /^[0-9a-f]{32}$/iu;
+
+function generalizeArgs(args: readonly string[]): { args: string[]; vars: GeneralizedVar[] } {
+  const vars: GeneralizedVar[] = [];
+  const seen = new Set<string>();
+  const result = args.map((arg) => {
+    const eq = arg.indexOf("=");
+    if (eq > 0) {
+      const key = arg.slice(0, eq);
+      const val = arg.slice(eq + 1);
+      for (const [pattern, name, hint] of GENERALIZE_KEY_PATTERNS) {
+        if (pattern.test(key) && !seen.has(name)) {
+          seen.add(name);
+          vars.push({ placeholder: `<${name}>`, original: val, hint });
+          return `${key}=<${name}>`;
+        }
+      }
+      if (/id$/iu.test(key) && (UUID_RE.test(val) || HEX32_RE.test(val))) {
+        const name = key.replace(/^--(?:cli-)?/u, "").replace(/[_=]/gu, "-");
+        if (!seen.has(name)) {
+          seen.add(name);
+          vars.push({ placeholder: `<${name}>`, original: val, hint: "执行前通过只读查询获取" });
+          return `${key}=<${name}>`;
+        }
+      }
+    }
+    if ((UUID_RE.test(arg) || HEX32_RE.test(arg)) && !seen.has("resource-id")) {
+      seen.add("resource-id");
+      vars.push({ placeholder: "<resource-id>", original: arg, hint: "执行前通过只读查询获取" });
+      return "<resource-id>";
+    }
+    return arg;
+  });
+  return { args: result, vars };
+}
+
 export function renderCloudPromptTemplate(state: WorkflowState, notes = ""): string {
   if (state.mode !== "cloud" || !state.details) throw new Error("Cloud workflow state is required");
   const details = state.details;
@@ -135,11 +183,16 @@ export function renderCloudPromptTemplate(state: WorkflowState, notes = ""): str
     throw new Error("No successful Cloud execution steps are available to summarize");
   }
   const provider = getCloudProvider(details.vendor);
-  const steps = details.successfulSteps.map((step, index) => (
-    `${index + 1}. [${step.operation}] ${singleLine(step.intent)}\n`
+  const allVars: GeneralizedVar[] = [];
+  const steps = details.successfulSteps.map((step, index) => {
+    const gen = generalizeArgs(step.args);
+    for (const v of gen.vars) {
+      if (!allVars.some((e) => e.placeholder === v.placeholder)) allVars.push(v);
+    }
+    return `${index + 1}. [${step.operation}] ${singleLine(step.intent)}\n`
       + `   - Validated approach: ${singleLine(step.approach)}\n`
-      + `   - Known-good command and path: \`${inlineCode([step.command, ...step.args].join(" "))}\``
-  )).join("\n");
+      + `   - Known-good command: \`${inlineCode([step.command, ...gen.args].join(" "))}\``;
+  }).join("\n");
   const failedPaths = details.failedApproaches.length > 0
     ? details.failedApproaches.map((failure, index) => (
       `${index + 1}. **DO NOT RETRY:** ${singleLine(failure.approach)}\n`
@@ -161,10 +214,15 @@ export function renderCloudPromptTemplate(state: WorkflowState, notes = ""): str
     "",
     "Start with read-only discovery. Re-check the active account, region, project, resource state, tool versions, and workspace paths before making changes.",
     ...(notes ? ["", "Validated prerequisites, lessons, and expensive pitfalls:", notes] : []),
+    ...(allVars.length > 0 ? [
+      "",
+      "Environment-specific values (resolve via read-only discovery before executing):",
+      ...allVars.map((v) => `  ${v.placeholder.padEnd(20)} 原值: ${v.original}  → ${v.hint}`),
+    ] : []),
     "",
     "## Layer 3 — Preferred validated execution path",
     "",
-    "Use this path first and preserve its order unless read-only evidence requires an adaptation. The commands and paths below are the known-good reference; do not replace them with speculative alternatives.",
+    "Use this path first and preserve its order. Replace <placeholder> values with discovered IDs from the current environment before executing. The command structure is the known-good reference; do not replace it with speculative alternatives.",
     "",
     steps,
     "",

package/.pi/skills/hwcode-cloud/SKILL.md

@@ -20,6 +20,9 @@ Use this skill only after `/hwcode-cloud` has activated the workflow. The activa
 
 The command already collected the provider, deployment choice, objective, and validated account connection. Do not repeat those questions unless the activation context is contradictory.
 
+### Batch Discovery Policy
+- **Parallel Read Queries**: When inspecting the cloud environment, emit all independent read-only `hwcode_cloud_exec` calls concurrently in a SINGLE turn (e.g. query VPCs, subnets, security groups, images, and flavors together). Do NOT probe sequentially across multiple conversational turns.
+
 ## Artifact workspace
 
 The activation context includes a task artifact workspace inside the locked project root. Keep all generated Cloud-task artifacts there; never write them to the project root or invent top-level task directories.
@@ -54,6 +57,10 @@ Before modifying account resources, present a plan containing:
 5. rollout, verification, observability, rollback, and estimated cost drivers;
 6. ordered commands and their expected resource impact.
 
+When presenting the execution plan, explicitly organize steps into **Execution Stages**:
+- Mark independent steps as **[Parallel Group N]** to indicate they will be executed concurrently.
+- Mark dependent steps with their prerequisite dependencies (e.g. `Requires: Step 1 VPC ID`).
+
 Prefer declarative, reviewable, idempotent infrastructure as code. Use a plan/dry-run command before apply when the selected tooling supports it. Pin important versions and avoid provider defaults that materially affect cost or exposure.
 
 ### Terraform Runner
@@ -71,6 +78,10 @@ If an existing SSH host is selected, reuse it. Only ask for SSH information when
 
 ## Phase 3: Execute with approval gates
 
+- **Independent Mutations**: For operations within the same `[Parallel Group]` (e.g., creating multiple independent security group rules or non-dependent subnets), invoke them concurrently in a single turn.
+- **Sequential Dependencies**: Never guess resource IDs. If Step B requires an ID generated by Step A, wait for Step A's tool result before emitting Step B.
+- **Deletions**: Never batch destructive deletions silently; each delete operation requires separate review.
+
 For every `hwcode_cloud_exec` call:
 
 - set `operation` to `read`, `change`, or `delete` honestly;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hadooppei/hwcode",
-  "version": "1.0.2",
+  "version": "1.0.5",
   "description": "A customizable terminal coding agent with local-model support and HWCode workflows.",
   "type": "module",
   "bin": {

package/.pi/extensions/workflows/vibe-sdd.ts

@@ -1,303 +0,0 @@
-import type {
-	ExtensionAPI,
-	ExtensionCommandContext,
-	ExtensionContext,
-} from "@earendil-works/pi-coding-agent";
-import { Type } from "@earendil-works/pi-ai";
-import { defineTool } from "@earendil-works/pi-coding-agent";
-import { isAbsolute, relative, resolve } from "node:path";
-
-import {
-	canonicalizeWorkspaceRoot,
-} from "../../lib/workflow-guard.ts";
-import { getWorkingDirectory } from "../../lib/working-directory.ts";
-import {
-	WORKFLOW_EXTERNAL_AUDIT_TYPE,
-	WORKFLOW_STATE_TYPE,
-	activeWorkflow,
-	createWorkflowState,
-	updateWorkflowState,
-	workflowLabel,
-	type WorkflowMode,
-	type WorkflowState,
-} from "../../lib/workflows/state.ts";
-import { advanceSddProgress, SDD_PHASES } from "../../lib/workflows/sdd.ts";
-import { evaluateToolPathAccess } from "../../lib/workspace/access-policy.ts";
-import { PROJECT_SDD_SPECS_RELATIVE } from "../../lib/runtime/paths.ts";
-
-interface GitState {
-	initialized: boolean;
-	dirty: boolean;
-	status: string;
-}
-
-function modeLabel(mode: WorkflowMode): string {
-	return workflowLabel(mode);
-}
-
-function notify(ctx: ExtensionContext, message: string, level: "info" | "warning" | "error" = "info"): void {
-	if (ctx.hasUI) ctx.ui.notify(message, level);
-}
-
-async function confirmWorkspace(mode: WorkflowMode, root: string, ctx: ExtensionCommandContext): Promise<boolean> {
-	if (!ctx.hasUI) return false;
-	return ctx.ui.confirm(
-		`Start ${modeLabel(mode)}?`,
-		[
-			`Project root: ${root}`,
-			"",
-			"All project work in this session will be limited to this root.",
-			"Paths inside it are allowed silently. Each external-path tool call requires separate approval.",
-		].join("\n"),
-	);
-}
-
-async function inspectOrInitializeGit(
-	pi: ExtensionAPI,
-	root: string,
-	ctx: ExtensionCommandContext,
-): Promise<GitState | undefined> {
-	const gitVersion = await pi.exec("git", ["--version"], { cwd: root });
-	if (gitVersion.code !== 0) {
-		notify(ctx, "HWCode SDD requires Git, but the git executable is unavailable.", "error");
-		return undefined;
-	}
-
-	let initialized = false;
-	let topLevel = await pi.exec("git", ["rev-parse", "--show-toplevel"], { cwd: root });
-	if (topLevel.code !== 0) {
-		if (!ctx.hasUI || !(await ctx.ui.confirm(
-			"Initialize Git repository?",
-			`HWCode SDD requires the current directory to be a Git repository root.\n\nRun git init in:\n${root}`,
-		))) return undefined;
-
-		const init = await pi.exec("git", ["init"], { cwd: root });
-		if (init.code !== 0) {
-			notify(ctx, `Git initialization failed: ${init.stderr.trim() || init.stdout.trim()}`, "error");
-			return undefined;
-		}
-		initialized = true;
-		topLevel = await pi.exec("git", ["rev-parse", "--show-toplevel"], { cwd: root });
-	}
-
-	if (topLevel.code !== 0) {
-		notify(ctx, "Unable to determine the Git repository root.", "error");
-		return undefined;
-	}
-
-	const gitRoot = canonicalizeWorkspaceRoot(topLevel.stdout.trim());
-	if (gitRoot !== root) {
-		notify(
-			ctx,
-			`HWCode SDD must start at the Git repository root. Restart it from: ${gitRoot}`,
-			"error",
-		);
-		return undefined;
-	}
-
-	const statusResult = await pi.exec(
-		"git",
-		["status", "--porcelain=v1", "--untracked-files=all"],
-		{ cwd: root },
-	);
-	if (statusResult.code !== 0) {
-		notify(ctx, `Unable to inspect Git status: ${statusResult.stderr.trim()}`, "error");
-		return undefined;
-	}
-
-	const status = statusResult.stdout.trim();
-	return { initialized, dirty: status.length > 0, status };
-}
-
-function activationPrompt(mode: WorkflowMode, root: string, git: GitState | undefined, request: string): string {
-	const context = [
-		`The ${modeLabel(mode)} workflow has been activated by its project command.`,
-		`Locked project root: ${root}`,
-	];
-	if (git) {
-		context.push(
-			`Git repository: ${git.initialized ? "initialized now" : "already present"}; working tree: ${git.dirty ? "has changes" : "clean"}.`,
-		);
-		if (git.status) context.push(`Current porcelain status:\n${git.status}`);
-	}
-	if (request) context.push(`Initial user request:\n${request}`);
-	return `/skill:hwcode-${mode} ${context.join("\n\n")}`;
-}
-
-function workflowSystemPrompt(state: WorkflowState): string {
-	const common = [
-		`HWCODE WORKFLOW ACTIVE: ${state.mode.toUpperCase()}`,
-		`The sole project root for this session is ${state.root}.`,
-		"Keep all reads, writes, commands, generated files, and project work inside that root by default.",
-		"An external-path approval applies only to the exact tool call that requested it. Never evade the guard through indirection, symlinks, subprocesses, alternate tools, or encoded commands.",
-		"If external storage such as /tmp is genuinely useful, explain why and let the tool-call approval request obtain user consent.",
-	];
-	if (state.mode === "sdd") {
-		common.push(
-			"Follow the SDD phase gates. Do not implement production behavior before requirements, design, test plan, and tasks are complete and explicitly approved.",
-			"Develop tests before implementation with a red-green-refactor loop. Return to specification when expected behavior or a test scenario is uncertain.",
-			"Never create a Git commit unless the user explicitly approves that commit.",
-		);
-	}
-	return common.join("\n");
-}
-
-export function registerVibeSddWorkflows(pi: ExtensionAPI) {
-	let activeState: WorkflowState | undefined;
-	let allowExternalPathsForSession = false;
-
-	async function activate(mode: WorkflowMode, args: string, ctx: ExtensionCommandContext): Promise<void> {
-		if (!ctx.isIdle()) {
-			notify(ctx, `Wait for the current response to finish before starting ${modeLabel(mode)}.`, "warning");
-			return;
-		}
-
-		const root = canonicalizeWorkspaceRoot(getWorkingDirectory(ctx.sessionManager));
-		const existing = activeWorkflow(ctx.sessionManager.getEntries());
-		if (existing) {
-			notify(
-				ctx,
-				`${workflowLabel(existing.mode)} is already active for ${existing.root}. Start a new session before activating another workflow.`,
-				"warning",
-			);
-			return;
-		}
-		if (!(await confirmWorkspace(mode, root, ctx))) {
-			notify(ctx, `${modeLabel(mode)} was not started.`, "warning");
-			return;
-		}
-
-		const git = mode === "sdd" ? await inspectOrInitializeGit(pi, root, ctx) : undefined;
-		if (mode === "sdd" && !git) return;
-
-		activeState = createWorkflowState(mode as "vibe" | "sdd", root);
-		pi.appendEntry<WorkflowState>(WORKFLOW_STATE_TYPE, activeState);
-		notify(ctx, `${modeLabel(mode)} activated. Project root locked to ${root}.`);
-		pi.sendUserMessage(activationPrompt(mode, root, git, args.trim()), { expandPromptTemplates: true });
-	}
-
-	pi.registerCommand("hwcode-vibe", {
-		description: "Start the directory-locked HWCode Vibe workflow",
-		handler: async (args, ctx) => activate("vibe", args, ctx),
-	});
-
-	pi.registerCommand("hwcode-sdd", {
-		description: "Start the Git-root-locked HWCode spec-driven workflow",
-		handler: async (args, ctx) => activate("sdd", args, ctx),
-	});
-
-	pi.registerTool(defineTool({
-		name: "hwcode_sdd_advance",
-		label: "HWCode SDD Phase Gate",
-		description: "Advance the active SDD workflow by exactly one explicitly approved phase.",
-		promptSnippet: "Use the SDD phase gate after presenting the completed artifact and receiving user approval.",
-		parameters: Type.Object({ nextPhase: Type.Union(SDD_PHASES.slice(1).map((phase) => Type.Literal(phase))), evidence: Type.String({ description: "Concise artifact and approval summary shown to the user" }) }),
-		executionMode: "sequential",
-		async execute(_id, params, _signal, _onUpdate, ctx) {
-			const state = activeWorkflow(ctx.sessionManager.getEntries());
-			if (!state || state.mode !== "sdd" || !state.sdd) return { content: [{ type: "text", text: "No active HWCode SDD workflow." }], isError: true, details: {} };
-			const evidence = params.evidence.replace(/[\r\n]+/gu, " ").trim().slice(0, 1_000);
-			let progress;
-			try { progress = advanceSddProgress(state.sdd, params.nextPhase, evidence); }
-			catch (error) { return { content: [{ type: "text", text: error instanceof Error ? error.message : String(error) }], isError: true, details: {} }; }
-			if (!ctx.hasUI || !await ctx.ui.confirm(`批准进入 SDD ${params.nextPhase} 阶段？`, evidence)) return { content: [{ type: "text", text: "SDD phase advancement was not approved." }], isError: true, details: {} };
-			const updated = updateWorkflowState(state, {
-				phase: params.nextPhase,
-				sdd: progress,
-			});
-			activeState = updated;
-			pi.appendEntry<WorkflowState>(WORKFLOW_STATE_TYPE, updated);
-			return { content: [{ type: "text", text: `SDD advanced to ${params.nextPhase}.` }], details: { phase: params.nextPhase } };
-		},
-	}));
-
-	pi.on("session_start", async (_event, ctx) => {
-		const restored = activeWorkflow(ctx.sessionManager.getEntries());
-		if (!restored) {
-			activeState = undefined;
-			return;
-		}
-
-		const currentRoot = canonicalizeWorkspaceRoot(getWorkingDirectory(ctx.sessionManager));
-		if (currentRoot !== restored.root) {
-			activeState = undefined;
-			pi.appendEntry<WorkflowState>(WORKFLOW_STATE_TYPE, updateWorkflowState(restored, {
-				status: "failed",
-				phase: "invalid-root",
-				reason: "Stored workflow root no longer matches the current execution directory.",
-			}));
-			notify(ctx, "Stored HWCode workflow disabled because the current directory changed.", "warning");
-			return;
-		}
-
-		activeState = restored;
-		notify(ctx, `${modeLabel(restored.mode)} restored. Root: ${restored.root}`);
-	});
-
-	pi.on("before_agent_start", async (event, ctx) => {
-		activeState = activeWorkflow(ctx.sessionManager.getEntries());
-		if (!activeState) return undefined;
-		const sddPhase = activeState.mode === "sdd" && activeState.sdd ? `\nCurrent enforced SDD phase: ${activeState.sdd.phase}. Use hwcode_sdd_advance for the next user-approved transition; never skip a phase.` : "";
-		return { systemPrompt: `${event.systemPrompt}\n\n${workflowSystemPrompt(activeState)}${sddPhase}` };
-	});
-
-	pi.on("tool_call", async (event, ctx) => {
-		activeState = activeWorkflow(ctx.sessionManager.getEntries());
-		if (!activeState) return undefined;
-
-		const input = event.input as Record<string, unknown>;
-		if (activeState.mode === "sdd" && activeState.sdd && ["write", "edit"].includes(event.toolName) && typeof input.path === "string") {
-			const path = resolve(activeState.root, input.path);
-			const projectRelative = relative(activeState.root, path).split("\\").join("/");
-			const isSpecArtifact = projectRelative.startsWith(`${PROJECT_SDD_SPECS_RELATIVE}/`);
-			const isTestArtifact = /(?:^|\/)(?:test|tests|__tests__)\/|(?:\.test|\.spec)\.[^/]+$/u.test(projectRelative);
-			const phase = activeState.sdd.phase;
-			const allowed = ["implementation", "verification"].includes(phase)
-				|| isSpecArtifact
-				|| phase === "tests" && isTestArtifact;
-			if (!allowed || isAbsolute(projectRelative) || projectRelative.startsWith("..")) {
-				return { block: true, reason: `SDD phase ${phase} does not allow production-file changes. Write approved spec artifacts under ${PROJECT_SDD_SPECS_RELATIVE}; test files become writable in the tests phase.` };
-			}
-		}
-		const external = evaluateToolPathAccess({ toolName: event.toolName, input }, activeState.root);
-
-		if (external.length === 0 || allowExternalPathsForSession) return undefined;
-		const details = external.map((entry) => `• ${entry.raw} → ${entry.resolved}`).join("\n");
-		if (!ctx.hasUI) {
-			return {
-				block: true,
-				reason: `External path requires interactive one-call approval:\n${details}`,
-			};
-		}
-
-		const choice = await ctx.ui.select(
-			"Allow external path for this call? `${modeLabel(activeState.mode)} is locked to ${activeState.root}.`",
-			[
-				"Allow once (仅允许本次)",
-				"Always allow for this session (本会话不再询问)",
-				"Deny (拒绝)"
-			]
-		);
-		if (!choice || choice.startsWith("Deny")) {
-			return { block: true, reason: `User denied external path access:\n${details}` };
-		}
-		if (choice.startsWith("Always allow")) {
-			allowExternalPathsForSession = true;
-			notify(ctx, "[已开启本会话外部路径访问权限，后续不再提示]", "info");
-		}
-
-		pi.appendEntry(WORKFLOW_EXTERNAL_AUDIT_TYPE, {
-			mode: activeState.mode,
-			root: activeState.root,
-			toolName: event.toolName,
-			external,
-			approvedAt: new Date().toISOString(),
-		});
-		return undefined;
-	});
-
-	pi.on("session_shutdown", () => {
-		activeState = undefined;
-		allowExternalPathsForSession = false; 
-	});
-}