@hncode/hncode 0.7.1 → 0.7.2

package/README.md

@@ -1,6 +1,10 @@
-# hncode — AI Coding Agent TUI
+![HNCode](imgs/HNCode.png)
 
-English | [简体中文](https://github.com/NiceHello666/hncode/blob/main/README_CN.md) | [Wiki](https://github.com/NiceHello666/hncode/blob/main/README_WIKI.md)
+# HNCode
+
+---
+
+English | [简体中文](https://github.com/NiceHello666/HNCode/blob/main/README_CN.md) | [Wiki](https://github.com/NiceHello666/HNCode/blob/main/README_WIKI.md)
 
 > **This is a product of my vibe coding session. I'm trying my best to make it perfect, so if you have any suggestions, feel free to open an issue.**
 
@@ -8,7 +12,7 @@ A cyan-blue terminal user interface (TUI) coding agent inspired by [Kimi Code](h
 
 ---
 
-## 🌟 Features
+## Features
 
 - **Cyan-blue TUI**: Raw terminal renderer for perfect Windows Terminal compatibility
 - **Dual Protocol Support**: Works with both OpenAI-compatible APIs and Anthropic
@@ -64,7 +68,7 @@ hncode control interrupt
 
 ---
 
-## 🚀 Installation
+## Installation
 
 ### Global Installation (Recommended)
 
@@ -85,27 +89,27 @@ npx @hncode/hncode
 
 ---
 
-## 📖 Documentation
+## Documentation
 
 This file is a quick overview. For the **full documentation** — every command, config option, architecture notes, and the plugin/development guide — see the Wiki:
 
-- **[Wiki (English)](https://github.com/NiceHello666/hncode/blob/main/README_WIKI.md)**
-- **[Wiki (简体中文)](https://github.com/NiceHello666/hncode/blob/main/README_WIKI_CN.md)**
+- **[Wiki (English)](https://github.com/NiceHello666/HNCode/blob/main/README_WIKI.md)**
+- **[Wiki (简体中文)](https://github.com/NiceHello666/HNCode/blob/main/README_WIKI_CN.md)**
 
 ---
 
-## 🤝 Contributing
+## Contributing
 
 **Feel free to:**
 - Submit issues for bugs or suggestions
 - Fork and create pull requests
-- Share your experience using hncode
+- Share your experience using HNCode
 
 ---
 
-## 📄 License
+## License
 
-This project is licensed under the [PolyForm Noncommercial License 1.0.0](https://github.com/NiceHello666/hncode/blob/main/LICENSE).
+This project is licensed under the [PolyForm Noncommercial License 1.0.0](https://github.com/NiceHello666/HNCode/blob/main/LICENSE).
 
 **In short:**
 1. ✅ Free for noncommercial use — personal projects, learning, research, hobby work, and noncommercial organizations
@@ -116,4 +120,4 @@ This project is licensed under the [PolyForm Noncommercial License 1.0.0](https:
 ---
 
 **NPM Package**: [@hncode/hncode](https://www.npmjs.com/package/@hncode/hncode)  
-**GitHub**: [NiceHello666/hncode](https://github.com/NiceHello666/hncode)
+**GitHub**: [NiceHello666/HNCode](https://github.com/NiceHello666/HNCode)

package/README_CN.md

@@ -1,6 +1,10 @@
-# hncode — AI 编程助手 TUI
+![HNCode](imgs/HNCode.png)
 
-[English](https://github.com/NiceHello666/hncode/blob/main/README.md) | 简体中文 | [Wiki](https://github.com/NiceHello666/hncode/blob/main/README_WIKI_CN.md)
+# HNCode
+
+---
+
+[English](https://github.com/NiceHello666/HNCode/blob/main/README.md) | 简体中文 | [Wiki](https://github.com/NiceHello666/HNCode/blob/main/README_WIKI_CN.md)
 
 > **这是我vibe coding的产物. 我在尽全力让它变的完美, 所以如果你有何建议, 欢迎开一个issue.**
 
@@ -8,7 +12,7 @@
 
 ---
 
-## 🌟 核心特性
+## 核心特性
 
 - **原生 TUI 渲染**: 使用原始终端序列渲染，完美兼容 Windows Terminal，解决 blessed 等库在 Windows 上的兼容性问题
 - **双协议支持**: 同时支持 OpenAI-compatible API 和 Anthropic API
@@ -20,7 +24,7 @@
 
 ---
 
-## 🚀 安装
+## 安装
 
 ### 全局安装（推荐）
 
@@ -41,27 +45,27 @@ npx @hncode/hncode
 
 ---
 
-## 📖 文档
+## 文档
 
 本文件只是简要介绍。**完整文档**（所有命令、配置项、架构说明、插件与开发指南）请见 Wiki：
 
-- **[Wiki（英文）](https://github.com/NiceHello666/hncode/blob/main/README_WIKI.md)**
-- **[Wiki（简体中文）](https://github.com/NiceHello666/hncode/blob/main/README_WIKI_CN.md)**
+- **[Wiki（英文）](https://github.com/NiceHello666/HNCode/blob/main/README_WIKI.md)**
+- **[Wiki（简体中文）](https://github.com/NiceHello666/HNCode/blob/main/README_WIKI_CN.md)**
 
 ---
 
-## 🤝 贡献
+## 贡献
 
 **欢迎：**
 - 提交问题报告 bug 或提出建议
 - Fork 并创建拉取请求
-- 分享您使用 hncode 的体验
+- 分享您使用 HNCode 的体验
 
 ---
 
-## 📄 许可证
+## 许可证
 
-本项目的许可受 [PolyForm Noncommercial License 1.0.0](https://github.com/NiceHello666/hncode/blob/main/LICENSE) 保护。
+本项目的许可受 [PolyForm Noncommercial License 1.0.0](https://github.com/NiceHello666/HNCode/blob/main/LICENSE) 保护。
 
 **简单来说:**
 1. ✅ 非商业用途免费——个人项目、学习、研究、业余爱好，以及非商业组织
@@ -72,4 +76,4 @@ npx @hncode/hncode
 ---
 
 **NPM 包**: [@hncode/hncode](https://www.npmjs.com/package/@hncode/hncode)  
-**GitHub**: [NiceHello666/hncode](https://github.com/NiceHello666/hncode)
+**GitHub**: [NiceHello666/HNCode](https://github.com/NiceHello666/HNCode)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hncode/hncode",
-  "version": "0.7.1",
+  "version": "0.7.2",
   "description": "hncode — A cyan-blue TUI AI coding agent with zero runtime dependencies.",
   "type": "module",
   "main": "src/index.js",
@@ -10,6 +10,7 @@
   "files": [
     "bin/",
     "src/",
+    "imgs/",
     "LICENSE",
     "README.md",
     "README_CN.md",

package/src/ptc.js

@@ -10,15 +10,43 @@
 import { Worker } from 'node:worker_threads';
 import path from 'node:path';
 import { fileURLToPath } from 'node:url';
+import { pluginTools } from './plugin.js';
 
 const here = path.dirname(fileURLToPath(import.meta.url));
 
-/** Tools whose results are safe and useful to hand to code, and whose invocation needs no UI. */
-const CALLABLE = new Set([
+
+/**
+ * The tools this program ships that are safe to call from generated code.
+ *
+ * A hardcoded list is right for the built-ins — whether `Write` belongs in a sandbox is a decision about THIS
+ * program, and it should be made once, here, and not by whoever writes the next tool.
+ *
+ * It is the wrong shape for a PLUGIN, though: a plugin already knows whether its own tool touches anything, and
+ * the core cannot keep a list of names it has never heard of. A plugin spec declaring `programmatic: true` joins
+ * this set at call time — see `callableTools()`.
+ */
+const BUILTIN_CALLABLE = [
   'Read', 'FileLines', 'Glob', 'Grep', 'Git', 'FetchURL', 'WebSearch',
   'TodoList', 'TaskList', 'TaskOutput', 'Memory', 'ListTeammates', 'TeamTaskList',
   'ActivateSkill', 'Goal', 'Diagnostics',
-]);
+];
+
+/**
+ * Which tools `callTool` may reach right now.
+ *
+ * Read fresh on every run rather than captured at import: a plugin loaded after this module still gets in, and a
+ * plugin that unloaded takes its tools with it.
+ */
+export function callableTools() {
+  const names = new Set(BUILTIN_CALLABLE);
+  for (const t of pluginTools) {
+    if (t && t.programmatic === true && t.name) names.add(t.name);
+  }
+  return [...names];
+}
+
+/** Kept for callers that want the built-in set only. */
+export const CALLABLE_TOOLS = [...BUILTIN_CALLABLE];
 
 export const DEFAULT_LIMITS = {
   // A code body that orchestrates twenty calls is already unusual; five hundred is a loop that has gone wrong.
@@ -28,8 +56,6 @@ export const DEFAULT_LIMITS = {
   timeoutMs: 120000,
 };
 
-export const CALLABLE_TOOLS = [...CALLABLE];
-
 /**
  * Run `code` in a sandbox, letting it call the tools in `CALLABLE`.
  *
@@ -55,8 +81,11 @@ export function runProgrammatic(code, ctx, limits = {}) {
       resolve(result);
     };
 
+    // Resolved ONCE per run, so the list the model is told about and the list the guard enforces are the same one
+    // even if a plugin loads while the code is running.
+    const callable = new Set(callableTools());
     const worker = new Worker(path.join(here, 'ptc-worker.js'), {
-      workerData: { toolNames: [...CALLABLE], timeoutMs: lim.timeoutMs },
+      workerData: { toolNames: [...callable], timeoutMs: lim.timeoutMs },
       // The sandbox needs no stdio and no shared memory.
       stdout: true,
       stderr: true,
@@ -77,7 +106,7 @@ export function runProgrammatic(code, ctx, limits = {}) {
           return;
         }
         const name = String(m.name || '');
-        if (!CALLABLE.has(name)) {
+        if (!callable.has(name)) {
           worker.postMessage({ type: 'tool_result', id: m.id, ok: false, error: `${name} is not callable from code` });
           return;
         }

package/src/remote.js

@@ -60,7 +60,7 @@ async function tlsFetch(url, opts = {}) {
 }
 
 // The canonical source. Overridable so a fork (or a test) can point elsewhere.
-export const DEFAULT_REPO = process.env.HNCODE_REPO || 'NiceHello666/hncode';
+export const DEFAULT_REPO = process.env.HNCODE_REPO || 'NiceHello666/HNCode';
 export const DEFAULT_REF = process.env.HNCODE_REPO_REF || 'main';
 
 // Where remote plugins land. `plugin.js` loads *.js/*.mjs from this directory.

package/src/tools/glob.js

@@ -5,9 +5,26 @@
 import fs from 'node:fs';
 import path from 'node:path';
 import { resolvePath } from './utils.js';
-import { walkFiles } from './ignore.js';
+import { walkFilesAsync } from './ignore.js';
 import { globToRegexSource, expandBraces } from './matchers.js';
 
+/**
+ * Entries directly inside `dir` — no recursion.
+ *
+ * This is what a pattern with no separator asks for, and answering it with a full tree walk is how a one-line
+ * lookup turned into a 43-second scan of a drive.
+ */
+function shallowEntries(dir, includeDirs) {
+  let entries;
+  try { entries = fs.readdirSync(dir, { withFileTypes: true }); } catch { return []; }
+  const out = [];
+  for (const ent of entries) {
+    if (!includeDirs && !ent.isFile()) continue;
+    out.push(path.join(dir, ent.name));
+  }
+  return out;
+}
+
 export const spec = {
   name: 'Glob',
   description: 'Find files by glob pattern. Honors ignore files unless include_ignored. Up to 100 matches, newest first.',
@@ -46,13 +63,34 @@ const alts = expandBraces(args.pattern);
     const re = new RegExp('^(?:' + alts.map((a) => globToRegexSource(a)).join('|') + ')$');
 
 
-    const files = walkFiles(base, { includeIgnored: !!args.include_ignored, includeDirs: !!args.include_dirs });
+    // HOW DEEP TO WALK IS DECIDED BY THE PATTERN, not by the matcher.
+    //
+    // `*.java` contains no slash, so it describes entries DIRECTLY inside `path`. Matching it against every
+    // file's basename made it hit the whole subtree — which is why one call over a drive root took 43 seconds and
+    // still reported "no files matched", having walked hundreds of thousands of entries to reject them all.
+    //
+    // A pattern with a separator (`src/**/*.ts`, `**/*.java`) is asking to descend, and gets the full walk. A bare
+    // one is answered by a single readdir.
+    const wantsDeep = alts.some((a) => a.includes('/') || a.includes(path.sep));
+    let candidates;
+    if (wantsDeep) {
+      // ASYNC: a synchronous walk over a large tree freezes the loop it runs on — no paint, no keystroke, no
+      // timer, for as long as it takes.
+      candidates = await walkFilesAsync(base, {
+        includeIgnored: !!args.include_ignored,
+        includeDirs: !!args.include_dirs,
+      });
+    } else {
+      candidates = shallowEntries(base, !!args.include_dirs);
+    }
+
     const matches = [];
-    for (const abs of files) {
+    for (const abs of candidates) {
       const rel = path.relative(base, abs).split(path.sep).join('/');
-      const winRel = abs.replace(/\\/g, '/');
-      const base_ = path.basename(abs);
-      if (re.test(rel) || re.test(winRel) || re.test(base_)) matches.push(abs);
+      // Match the RELATIVE PATH only. The absolute path and the bare basename were both accepted before, and
+      // both were wrong: an absolute path lets `tmp/*.log` match a directory that merely appears in the middle of
+      // it, and the basename turns a pattern that names no directory into a recursive search.
+      if (re.test(rel)) matches.push(abs);
     }
     if (matches.length > 100) matches.length = 100;
     if (matches.length === 0) return `No files matched \`${args.pattern}\` in ${fromDir}`;

package/src/tools/grep.js

@@ -6,7 +6,7 @@ import fs from 'node:fs';
 import path from 'node:path';
 import cp from 'node:child_process';
 import { isProbablyTextFile, truncateBuf, resolvePath } from './utils.js';
-import { walkFiles } from './ignore.js';
+import { walkFilesAsync } from './ignore.js';
 import { matchGlob } from './matchers.js';
 
 export const spec = {
@@ -40,7 +40,7 @@ export const spec = {
     try { base = resolvePath(args.path || '.', ctx); } catch (e) { return `Error: ${e.message}`; }
     if (!fs.existsSync(base)) return `Error: path does not exist: ${args.path}`;
     if (!args.multiline && hasRg()) return await grepRg(args, base, ctx);
-    return grepJs(args, base, ctx);
+    return await grepJs(args, base, ctx);
   },
 };
 
@@ -90,7 +90,7 @@ function grepRg(args, base, ctx) {
     try {
       child = cp.spawn('rg', buildRgArgs(args, base), { cwd: ctx.cwd || ctx.workspace });
     } catch {
-      resolve(grepJs(args, base, ctx));
+      grepJs(args, base, ctx).then((r) => resolve(r), (e) => resolve(`Error: ${e.message}`));
       return;
     }
     let stdout = '';
@@ -103,7 +103,7 @@ function grepRg(args, base, ctx) {
     child.stderr.on('data', (d) => { stderr += d; });
     // spawn failure (ENOENT, etc.): fall back to the JS walker rather than
     // reporting an empty result as "No matches found".
-    child.on('error', () => done(() => resolve(grepJs(args, base, ctx))));
+    child.on('error', () => done(() => grepJs(args, base, ctx).then((r) => resolve(r), (e) => resolve(`Error: ${e.message}`))));
     child.on('close', (code) => done(() => {
       if (code > 1 && stderr) resolve(`rg error: ${stderr.trim()}`);
       else if (!stdout.trim() && args.pattern.includes('$')) {
@@ -111,7 +111,7 @@ function grepRg(args, base, ctx) {
         // which rg cannot treat as line breaks at all. The JS walker handles every
         // ending, so it gets the final word — only for `$` patterns that found
         // nothing, so ordinary searches never pay for the extra pass.
-        resolve(grepJs(args, base, ctx));
+        grepJs(args, base, ctx).then((r) => resolve(r), (e) => resolve(`Error: ${e.message}`));
       }
       else resolve(paginate(stdout, args));
     }));
@@ -124,10 +124,12 @@ function grepRg(args, base, ctx) {
   });
 }
 
-function grepJs(args, base, ctx) {
+async function grepJs(args, base, ctx) {
   const flags = 'g' + (args['-i'] ? 'i' : '') + (args.multiline ? 's' : '');
   const re = new RegExp(args.pattern, flags);
-  const files = walkFiles(base, { includeIgnored: !!args.include_ignored, includeDirs: false, limit: 0 });
+  // ASYNC, for the same reason as Glob: a synchronous walk over a large tree freezes everything else that shares
+  // the process.
+  const files = await walkFilesAsync(base, { includeIgnored: !!args.include_ignored, includeDirs: false, limit: 0 });
   const filtered = files.filter((abs) => {
     if (args.glob) {
       const rel = path.relative(base, abs).split(path.sep).join('/');

package/src/tools/ignore.js

@@ -135,3 +135,72 @@ function _walk(dir, relPrefix, parentPatterns, found, opts) {
     }
   }
 }
+
+/**
+ * The same walk, WITHOUT freezing the process it runs in.
+ *
+ * `walkFiles` is synchronous end to end (`readdirSync`, `statSync`). That is fine for a script with nothing else
+ * to do, and fatal for an editor: the event loop cannot paint, read a keystroke or answer a timer while the walk
+ * holds it. Measured on a drive root, one Glob took 43 seconds — during which the interface was simply dead,
+ * because nothing else could run.
+ *
+ * This version uses `fs.promises` and yields every so often, so the loop stays alive. The RESULT is identical;
+ * only the schedule differs.
+ *
+ * @param {string} base
+ * @param {{includeIgnored?: boolean, includeDirs?: boolean, limit?: number}} [opts]
+ */
+export async function walkFilesAsync(base, opts = {}) {
+  const { includeIgnored = false, includeDirs = false, limit = 1000 } = opts;
+  const baseAbs = path.resolve(base);
+  const found = [];
+  // A counter, not a timer: yielding on a chunk of FILES keeps the pause proportional to the work rather than to
+  // wall-clock, so a fast directory costs nothing and a slow one still yields regularly.
+  const state = { sinceYield: 0 };
+  await _walkAsync(baseAbs, '', [], found, { includeIgnored, includeDirs }, state);
+  found.sort((a, b) => b.mtime - a.mtime);
+  if (limit > 0 && found.length > limit) found.length = limit;
+  return found.filter((e) => includeDirs || e.isFile).map((e) => e.path);
+}
+
+const YIELD_EVERY = 200;
+
+async function _walkAsync(dir, relPrefix, parentPatterns, found, opts, state) {
+  const { includeIgnored, includeDirs } = opts;
+  let entries;
+  try { entries = await fs.promises.readdir(dir, { withFileTypes: true }); } catch { return; }
+  const acc = parentPatterns.concat(ignorePatternsFor(dir));
+  for (const ent of entries) {
+    const rel = relPrefix ? relPrefix + '/' + ent.name : ent.name;
+    const abs = path.join(dir, ent.name);
+    let isDir = !!ent.isDirectory();
+    if (isDir && (PRUNED_DIRS.has(ent.name)
+      || (!includeIgnored && PRUNED_UNLESS_IGNORED.has(ent.name)))) continue;
+    let ignored = false;
+    for (const pat of acc) {
+      if (matchPattern(pat, rel, isDir)) ignored = !pat.negate;
+    }
+    if (ignored && !includeIgnored) continue;
+
+    if (isDir) {
+      if (includeDirs) {
+        let mtime = 0;
+        try { mtime = (await fs.promises.stat(abs)).mtimeMs; } catch { /* keep 0 */ }
+        found.push({ path: abs, mtime, isFile: false });
+      }
+      await _walkAsync(abs, rel, acc, found, opts, state);
+    } else {
+      let mtime = 0;
+      try { mtime = (await fs.promises.stat(abs)).mtimeMs; } catch { /* keep 0 */ }
+      found.push({ path: abs, mtime, isFile: true });
+    }
+
+    state.sinceYield++;
+    if (state.sinceYield >= YIELD_EVERY) {
+      state.sinceYield = 0;
+      // Hand the loop a turn. `setImmediate` rather than `setTimeout(0)`: it keeps the walk's own ordering and
+      // does not add a timer per chunk.
+      await new Promise((r) => setImmediate(r));
+    }
+  }
+}

package/src/tools/ptc.js

@@ -13,7 +13,7 @@
  * and the code can only reach the ones on the allowlist. See src/ptc.js for that list, and ptc-worker.js for the
  * sandbox itself.
  */
-import { runProgrammatic, CALLABLE_TOOLS } from '../ptc.js';
+import { runProgrammatic, callableTools } from '../ptc.js';
 
 const DESCRIPTION = [
   'Orchestrate tools with JavaScript instead of calling them one at a time.',
@@ -41,13 +41,18 @@ const DESCRIPTION = [
   'print(hits.join(\'\\n\'));',
   '```',
   '',
-  `CALLABLE TOOLS: ${CALLABLE_TOOLS.join(', ')}.`,
-  'Anything else is refused — a shell or a write would escape the sandbox\'s purpose.',
-].join('\n');
+  // NOT a fixed list: a plugin can contribute tools at any time, and a description built once at import would
+  // name a set the model cannot call. `description` is a getter for that reason.
+];
+const BASE_DESCRIPTION = DESCRIPTION.join('\n');
 
 export const spec = {
   name: 'ProgrammaticToolCall',
-  description: DESCRIPTION,
+  // Built per read so a plugin that loaded after this module is named in the list the model is given.
+  get description() {
+    return BASE_DESCRIPTION + '\n\nCALLABLE TOOLS: ' + callableTools().join(', ') + '.'
+      + '\nAnything else is refused — a shell or a write would escape the sandbox\'s purpose.';
+  },
   parameters: {
     type: 'object',
     properties: {

package/src/tui.js

@@ -259,7 +259,7 @@ export const COMMANDS = [
   { name: 'reload-config', desc: 'Reload config.toml settings only', priority: 60 },
   { name: 'plugins', desc: 'Open the plugin manager (installed + available in the repo)', priority: 60, argumentHint: '[install <name> | remove <name> | reload]' },
   { name: 'skills', desc: 'Open the skill manager (installed + available in the repo)', priority: 60, argumentHint: '[install <name> | remove <name>]' },
-  { name: 'import-skill', desc: 'Add a skill from a Markdown file, or install every skill in a GitHub repository (owner/repo)', cooldown: false },
+  { name: 'import-skill', desc: 'Add a skill from a Markdown file, or install every skill in a GitHub repository (owner/repo)', cooldown: false },
   { name: 'hooks', desc: 'Show configured shell hooks, or test one', priority: 60, argumentHint: '[list | test <event>]' },
   { name: 'git', desc: 'Show repository status (branch, changes, remote)', priority: 62 },
   { name: 'commit', desc: 'Stage and commit with a message (or let the agent draft one)', priority: 62, argumentHint: '[message]' },
@@ -2332,34 +2332,28 @@ export function formatToolLine(msg, workspace, spin, pulseStart, shimmerEdge, ex
 // Renders above the input box: a rule, a "Todo" heading, up to 5 rows, and a
 // "+N more · ctrl+t to expand" hint. Ctrl+T expands the full list.
 const TODO_MAX_VISIBLE = 5;
-export function selectVisibleTodos(todos) {
-  if (todos.length <= TODO_MAX_VISIBLE) return { rows: todos, hidden: 0, counts: {} };
-  const inProgress = [], pending = [], done = [];
-  todos.forEach((t, i) => {
-    if (t.status === 'in_progress') inProgress.push(i);
-    else if (t.status === 'pending') pending.push(i);
-    else done.push(i);
-  });
-  const picked = new Set(inProgress.slice(0, TODO_MAX_VISIBLE));
-  if (picked.size < TODO_MAX_VISIBLE) {
-    const doneC = [...done].reverse();
-    const pendC = pending;
-    const remaining = TODO_MAX_VISIBLE - picked.size;
-    let doneCount, pendCount;
-    if (!doneC.length) { doneCount = 0; pendCount = Math.min(remaining, pendC.length); }
-    else if (!pendC.length) { pendCount = 0; doneCount = Math.min(remaining, doneC.length); }
-    else {
-      doneCount = 1;
-      pendCount = Math.min(remaining - 1, pendC.length);
-      if (pendCount < remaining - 1) doneCount = Math.min(doneC.length, remaining - pendCount);
-    }
-    for (let i = 0; i < doneCount; i++) picked.add(doneC[i]);
-    for (let i = 0; i < pendCount; i++) picked.add(pendC[i]);
-  }
-  const idx = [...picked].sort((a, b) => a - b);
+
+/**
+ * The first `max` entries, in the order they were written.
+ *
+ * This used to RANK: in-progress first, then one done item, then pending. On a status change the panel therefore
+ * reshuffled — the item being worked on jumped to the top and a finished one followed it — and the list stopped
+ * describing the order the work was planned in. A task list is a sequence; a view that reorders it is showing
+ * something other than what was written.
+ *
+ * `counts` still reports what the window is hiding, so the "+N more" hint stays informative.
+ */
+export function selectVisibleTodos(todos, max = TODO_MAX_VISIBLE) {
+  const list = Array.isArray(todos) ? todos : [];
+  const limit = Number.isFinite(max) ? Math.max(0, Math.round(max)) : TODO_MAX_VISIBLE;
+  if (list.length <= limit) return { rows: list, hidden: 0, counts: {} };
+  const rows = list.slice(0, limit);
   const counts = { done: 0, in_progress: 0, pending: 0 };
-  todos.forEach((t, i) => { if (!picked.has(i)) counts[t.status] = (counts[t.status] || 0) + 1; });
-  return { rows: idx.map((i) => todos[i]), hidden: todos.length - idx.length, counts };
+  for (let i = limit; i < list.length; i++) {
+    const s = list[i] && list[i].status;
+    counts[s] = (counts[s] || 0) + 1;
+  }
+  return { rows, hidden: list.length - rows.length, counts };
 }
 
 function todoRow(todo, w) {
@@ -2386,16 +2380,16 @@ function renderTodoPanel(state, w, hoverTop, dragTop) {
   out.push(col('─'.repeat(w), ruleColor));
   out.push(col('  Todo', C.cyan + C.bold));
   const want = todoRowCount(state);
-  // Keep the automatic pick ORDER (so the in-progress item keeps its priority) and
-  // top it up from the remaining items until `want` rows are shown.
-  const ordered = [];
-  const seen = new Set();
-  for (const t of selectVisibleTodos(todos).rows) { ordered.push(t); seen.add(t); }
-  for (const t of todos) {
-    if (ordered.length >= want) break;
-    if (!seen.has(t)) { ordered.push(t); seen.add(t); }
-  }
-  const rows = ordered.slice(0, want);
+  // CREATION ORDER, ALWAYS.
+  //
+  // The panel used to draw `selectVisibleTodos` first — which ranks in-progress ahead of pending and pulls done
+  // items up — and then top up from the original list. The result read as a reshuffle on every status change: the
+  // item being worked on jumped to the top and a finished one followed it, so the list no longer described the
+  // order the work was planned in. A task list is a SEQUENCE; showing it in a different sequence than it was
+  // written in is what made it hard to follow.
+  //
+  // Which rows fit is still the panel's decision — it takes the first `want` in order.
+  const rows = todos.slice(0, want);
   for (const t of rows) out.push(todoRow(t, w));
   const hidden = todos.length - rows.length;
   if (hidden > 0) {
@@ -12988,7 +12982,7 @@ export async function dispatch(cmdRaw, arg, state, cfg, session, h, submit, stdo
       // The body is EXACTLY what the user typed. Nothing is appended — a report
       // the user did not write (an environment footer, a template) reads as noise
       // in the issue form and has to be deleted before submitting.
-      const url = 'https://github.com/NiceHello666/hncode/issues/new'
+      const url = 'https://github.com/NiceHello666/HNCode/issues/new'
         + `?title=${encodeURIComponent(title)}`
         + (body ? `&body=${encodeURIComponent(body)}` : '');
       sayPanel(`Open a GitHub issue:\n  ${url}`);
@@ -14191,6 +14185,16 @@ const agents = readAgentsMd(state.cwd || state.workspace || cfg.workspace, state
       // Tools that act ONLY inside the session: the roster, the mailbox, the task list, the memories.
       // `isInsideWorkspace` answers `false` for any tool it does not know, so without this they all asked for
       // approval in yolo — the one mode whose point is not asking.
+      // A PLUGIN'S TOOL ANSWERS FOR ITSELF.
+      //
+      // The list below covers the tools this program ships. A plugin's tools cannot be added to it from outside,
+      // and `isInsideWorkspace` does not know them — so every one of them asked for approval whatever it did. A
+      // spec declaring `autoApprove: true` now says so itself, which is the only place that knows whether the
+      // tool touches anything.
+      if (rule !== 'ask') {
+        const own = getTool(toolName);
+        if (own && own.autoApprove === true) return true;
+      }
       const safeTools = ['Read', 'Grep', 'Glob', 'FetchURL', 'WebSearch', 'TaskOutput', 'TaskList', 'TaskStop', 'TaskWait', 'TodoList', 'Goal', 'ActivateSkill', 'ProgrammaticToolCall', 'FileLines', 'AgentList', 'AgentMessage', 'AgentInterrupt', 'AgentClose', 'TaskInput', 'SendMessage', 'TeamTaskCreate', 'TeamTaskUpdate', 'TeamTaskList', 'ListTeammates', 'Memory', 'AskUserQuestion'];
       if (rule !== 'ask' && safeTools.includes(toolName)) return true;
       // A read-only SHELL COMMAND (ls/git status/rg/cat …) is as safe as a
@@ -14203,27 +14207,33 @@ const agents = readAgentsMd(state.cwd || state.workspace || cfg.workspace, state
       }
 
 
-      // Yolo: anything that stays INSIDE the workspace runs
-      // without asking — edits, writes and commands alike. Only work that touches
-      // a path OUTSIDE the workspace (or a command whose target we cannot prove is
-      // inside) needs the user.
+      // ASK: an ordinary action runs, anything with a consequence asks.
       //
-      // BASH is the exception: a shell command's paths cannot be proven either way
-      // (variables, pipes, subshells), so the old path heuristic flagged ordinary
-      // commands like `ls /tmp` and asked about them. In yolo the user has already
-      // said "run routine work", so Bash runs without the workspace test — only an
-      // obviously destructive command still asks.
+      // This is the only mode that gates FILE work, which is the point of it — the other two exist for people who
+      // have decided not to be asked.
+      if (cur === 'ask' && rule !== 'ask') {
+        // A read-only shell command is as safe as a read-only tool: there is no decision to make about `git log`.
+        if (toolName === 'Bash') {
+          const c = String((args && (args.command || args.cmd)) || '');
+          if (isReadOnlyCommand(c) && !isDestructiveCommand(c)) return true;
+        }
+      }
+
+      // YOLO: routine work runs. FILES ARE NOT A REASON TO ASK.
+      //
+      // A user in yolo has said they do not want to confirm edits, and a path outside the workspace is still just a
+      // path. What still asks is DESTRUCTION — a command that deletes, rewrites history or kills a process — because
+      // that is the one class of action nobody means to authorise wholesale.
       if (cur === 'yolo' && rule !== 'ask') {
         if (toolName === 'Bash') {
           const cmd = String((args && (args.command || args.cmd)) || '');
           if (!isDestructiveCommand(cmd)) return true;
-        } else if (isInsideWorkspace(state, toolName, args)) {
+        } else {
+          // Every non-shell tool: no path test. `isInsideWorkspace` was the thing asking about `/goal` and about a
+          // Read elsewhere, neither of which is a decision.
           return true;
         }
       }
-
-
-
       return new Promise((resolve) => {
         let desc = '';
         if (args && typeof args === 'object') {