@jsonstudio/llms 0.6.1892 → 0.6.2172

package/dist/servertool/handlers/web-search.js

@@ -217,6 +217,10 @@ function isIflowWebSearchEngine(engine) {
     const key = engine.providerKey.toLowerCase();
     return key.startsWith('iflow.');
 }
+function isQwenWebSearchEngine(engine) {
+    const key = engine.providerKey.toLowerCase();
+    return key.startsWith('qwen.');
+}
 function normalizeResultCount(value) {
     if (typeof value === 'number' && Number.isFinite(value)) {
         const normalized = Math.trunc(value);
@@ -250,6 +254,18 @@ async function executeWebSearchBackend(args) {
             hits = backendResult.hits;
             ok = backendResult.ok;
         }
+        else if (isQwenWebSearchEngine(engine) && options.providerInvoker) {
+            const backendResult = await executeQwenWebSearchViaProvider({
+                options,
+                engine,
+                query,
+                count: args.resultCount,
+                requestSuffix
+            });
+            summary = backendResult.summary;
+            hits = backendResult.hits;
+            ok = backendResult.ok;
+        }
         else if (options.reenterPipeline) {
             const payload = buildWebSearchReenterPayload(engine, query, recency, args.resultCount);
             const followup = await reenterServerToolBackend({
@@ -586,6 +602,107 @@ async function executeIflowWebSearchViaProvider(args) {
         ok
     };
 }
+async function executeQwenWebSearchViaProvider(args) {
+    const { options, engine, query, count, requestSuffix } = args;
+    if (!options.providerInvoker) {
+        return {
+            summary: '',
+            hits: [],
+            ok: false
+        };
+    }
+    const payload = {
+        data: {
+            model: engine.id,
+            uq: query,
+            page: 1,
+            rows: count
+        },
+        metadata: {
+            entryEndpoint: '/api/v1/indices/plugin/web_search',
+            qwenWebSearch: true,
+            routeName: 'web_search'
+        }
+    };
+    const backend = await options.providerInvoker({
+        providerKey: engine.providerKey,
+        providerType: undefined,
+        modelId: undefined,
+        providerProtocol: options.providerProtocol,
+        payload,
+        entryEndpoint: '/api/v1/indices/plugin/web_search',
+        requestId: `${options.requestId}${requestSuffix}`,
+        routeHint: 'web_search'
+    });
+    const providerResponse = backend.providerResponse && typeof backend.providerResponse === 'object'
+        ? backend.providerResponse
+        : null;
+    if (!providerResponse) {
+        return {
+            summary: '',
+            hits: [],
+            ok: false
+        };
+    }
+    const container = providerResponse;
+    const status = typeof container.status === 'number' ? container.status : undefined;
+    const message = typeof container.message === 'string' && container.message.trim()
+        ? container.message.trim()
+        : typeof container.msg === 'string' && container.msg.trim()
+            ? container.msg.trim()
+            : '';
+    if (status !== undefined && status !== 0) {
+        throw new Error(message || `qwen web_search failed with status=${status}`);
+    }
+    const dataNode = container.data && typeof container.data === 'object' && !Array.isArray(container.data)
+        ? container.data
+        : undefined;
+    const rawDocs = Array.isArray(dataNode?.docs) ? dataNode?.docs : [];
+    const hits = [];
+    for (const item of rawDocs) {
+        if (!item || typeof item !== 'object' || Array.isArray(item))
+            continue;
+        const record = item;
+        const linkCandidate = typeof record.url === 'string' && record.url.trim()
+            ? record.url.trim()
+            : typeof record.link === 'string' && record.link.trim()
+                ? record.link.trim()
+                : '';
+        if (!linkCandidate)
+            continue;
+        const title = typeof record.title === 'string' && record.title.trim() ? record.title.trim() : undefined;
+        const content = typeof record.snippet === 'string' && record.snippet.trim()
+            ? record.snippet.trim()
+            : typeof record.content === 'string' && record.content.trim()
+                ? record.content.trim()
+                : undefined;
+        const publishDate = typeof record.timestamp_format === 'string' && record.timestamp_format.trim()
+            ? record.timestamp_format.trim()
+            : typeof record.timestamp === 'string' && record.timestamp.trim()
+                ? record.timestamp.trim()
+                : typeof record.time === 'string' && record.time.trim()
+                    ? record.time.trim()
+                    : undefined;
+        const media = typeof record.source === 'string' && record.source.trim() ? record.source.trim() : undefined;
+        hits.push({
+            title,
+            link: linkCandidate,
+            content,
+            publish_date: publishDate,
+            media
+        });
+        if (hits.length >= count) {
+            break;
+        }
+    }
+    const summary = message || (hits.length ? formatHitsSummary(hits) : '');
+    const ok = status === 0 || hits.length > 0;
+    return {
+        summary,
+        hits,
+        ok
+    };
+}
 function injectWebSearchToolResult(base, toolCall, engine, query, backendResult) {
     const cloned = cloneJson(base);
     const existingOutputs = Array.isArray(cloned.tool_outputs)

package/dist/servertool/server-side-tools.d.ts

@@ -8,7 +8,6 @@ import './handlers/clock.js';
 import './handlers/clock-auto.js';
 import './handlers/exec-command-guard.js';
 import './handlers/apply-patch-guard.js';
-import './handlers/recursive-detection-guard.js';
 import './handlers/continue-execution.js';
 export declare function runServerSideToolEngine(options: ServerSideToolEngineOptions): Promise<ServerSideToolEngineResult>;
 export declare function extractToolCalls(chatResponse: JsonObject): ToolCall[];

package/dist/servertool/server-side-tools.js

@@ -10,7 +10,6 @@ import './handlers/clock.js';
 import './handlers/clock-auto.js';
 import './handlers/exec-command-guard.js';
 import './handlers/apply-patch-guard.js';
-import './handlers/recursive-detection-guard.js';
 import './handlers/continue-execution.js';
 import { runPreCommandHooks } from './pre-command-hooks.js';
 import { readRuntimeMetadata } from '../conversion/shared/runtime-metadata.js';
@@ -242,10 +241,12 @@ export async function runServerSideToolEngine(options) {
     if (!base) {
         return { mode: 'passthrough', finalChatResponse: options.chatResponse };
     }
-    if (isClientDisconnected(options.adapterContext)) {
+    const toolCalls = extractToolCalls(base);
+    if (isClientDisconnected(options.adapterContext) && toolCalls.length > 0) {
+        // When client is already disconnected, skip executing explicit tool_call servertools.
+        // Auto hooks (e.g. stop_message_auto) still need to run to keep session state consistent.
         return { mode: 'passthrough', finalChatResponse: base };
     }
-    const toolCalls = extractToolCalls(base);
     const contextBase = {
         base,
         toolCalls,

package/dist/sse/sse-to-json/builders/response-builder.js

@@ -831,6 +831,22 @@ export class ResponsesResponseBuilder {
                 }
                 return { success: true, response: this.response };
             }
+            // Further salvage: some upstreams end the stream without any terminal events
+            // (no output_item.done/response.completed/response.done) but still materialize
+            // output_item.added + content deltas. Use current aggregated items as completed.
+            if (this.outputItemBuilders.size > 0) {
+                this.response.status = 'completed';
+                try {
+                    const cur = this.response.output;
+                    if (!Array.isArray(cur) || cur.length === 0) {
+                        this.response.output = this.buildOutputItems();
+                    }
+                }
+                catch {
+                    this.response.output = this.buildOutputItems();
+                }
+                return { success: true, response: this.response };
+            }
         }
         catch { /* ignore */ }
         return { success: false, error: new Error('Building not completed') };

package/dist/sse/sse-to-json/chat-sse-to-json-converter.d.ts

@@ -39,6 +39,7 @@ export declare class ChatSseToJsonConverter {
      * 处理chat_chunk事件
      */
     private processChatChunk;
+    private parseChatChunkPayload;
     private ensureChoiceBuilder;
     private tryProcessDeepSeekWebPatchEvent;
     private getDeepSeekPatchState;

package/dist/sse/sse-to-json/chat-sse-to-json-converter.js

@@ -110,24 +110,40 @@ export class ChatSseToJsonConverter {
     parseSseChunk(chunk) {
         const lines = chunk.trim().split('\n');
         let rawEventType;
-        let dataValue = '';
+        const dataLines = [];
         for (const line of lines) {
             if (line.startsWith('event:')) {
                 rawEventType = line.substring(6).trim();
             }
             else if (line.startsWith('data:')) {
-                dataValue = line.substring(5).trim();
+                dataLines.push(line.substring(5).trim());
             }
         }
-        const normalizeEventType = (candidate) => {
+        const dataValue = dataLines.join('\n');
+        const parsedData = (() => {
+            if (!dataValue) {
+                return undefined;
+            }
+            try {
+                const parsed = JSON.parse(dataValue);
+                if (parsed && typeof parsed === 'object' && !Array.isArray(parsed)) {
+                    return parsed;
+                }
+            }
+            catch {
+                // best effort
+            }
+            return undefined;
+        })();
+        const normalizeEventType = (candidate, payload) => {
             if (!candidate)
                 return undefined;
-            const v = candidate.trim();
+            const v = candidate.trim().toLowerCase();
             if (!v)
                 return undefined;
             // OpenAI Chat Completions SSE does not include `event:` lines; we infer types elsewhere.
             // When upstream does include `event:`, accept common aliases for compatibility.
-            if (v === 'chat_chunk' || v === 'chat_chunk'.toLowerCase())
+            if (v === 'chat_chunk')
                 return 'chat_chunk';
             if (v === 'chat.done' || v === 'chat_done')
                 return 'chat.done';
@@ -140,6 +156,16 @@ export class ChatSseToJsonConverter {
                 return 'ping';
             if (v === 'finish' || v === 'close')
                 return 'chat.done';
+            if (v === 'toast') {
+                const toastType = typeof payload?.type === 'string' ? payload.type.trim().toLowerCase() : '';
+                const finishReason = typeof payload?.finish_reason === 'string'
+                    ? payload.finish_reason.trim().toLowerCase()
+                    : '';
+                if (toastType === 'error' || finishReason === 'context_length_exceeded' || finishReason === 'rate_limit_exceeded') {
+                    return 'error';
+                }
+                return 'ping';
+            }
             // Legacy aliases
             if (v === 'chunk')
                 return 'chat_chunk';
@@ -147,7 +173,7 @@ export class ChatSseToJsonConverter {
                 return 'chat.done';
             return undefined;
         };
-        let eventType = normalizeEventType(rawEventType);
+        let eventType = normalizeEventType(rawEventType, parsedData);
         if (!eventType) {
             // OpenAI-compatible streams often omit `event:`; use `[DONE]` sentinel to mark completion.
             if (dataValue) {
@@ -240,27 +266,29 @@ export class ChatSseToJsonConverter {
     async processChatChunk(event, context) {
         try {
             const payload = typeof event.data === 'string' ? event.data : JSON.stringify(event.data ?? {});
-            const parsed = JSON.parse(payload);
-            if (this.tryProcessDeepSeekWebPatchEvent(parsed, context)) {
-                return;
-            }
-            const chunk = parsed;
-            // 验证chunk格式
-            if (context.options.validateChunks) {
-                this.validateChatChunk(chunk);
-            }
-            context.aggregatedChunks.push(chunk);
-            // 初始化响应结构（如果是第一个chunk）
-            if (!context.currentResponse.id && chunk.id) {
-                context.currentResponse.id = chunk.id;
-                context.currentResponse.object = 'chat.completion';
-                context.currentResponse.created = chunk.created;
-                context.currentResponse.model = chunk.model;
-            }
-            // 处理choices
-            if (chunk.choices && Array.isArray(chunk.choices)) {
-                for (const choice of chunk.choices) {
-                    await this.processChoice(choice, context);
+            const parsedEntries = this.parseChatChunkPayload(payload);
+            for (const parsed of parsedEntries) {
+                if (this.tryProcessDeepSeekWebPatchEvent(parsed, context)) {
+                    continue;
+                }
+                const chunk = parsed;
+                // 验证chunk格式
+                if (context.options.validateChunks) {
+                    this.validateChatChunk(chunk);
+                }
+                context.aggregatedChunks.push(chunk);
+                // 初始化响应结构（如果是第一个chunk）
+                if (!context.currentResponse.id && chunk.id) {
+                    context.currentResponse.id = chunk.id;
+                    context.currentResponse.object = 'chat.completion';
+                    context.currentResponse.created = chunk.created;
+                    context.currentResponse.model = chunk.model;
+                }
+                // 处理choices
+                if (chunk.choices && Array.isArray(chunk.choices)) {
+                    for (const choice of chunk.choices) {
+                        await this.processChoice(choice, context);
+                    }
                 }
             }
         }
@@ -268,6 +296,33 @@ export class ChatSseToJsonConverter {
             throw ErrorUtils.wrapError(error, 'Failed to parse chat_chunk');
         }
     }
+    parseChatChunkPayload(payload) {
+        try {
+            return [JSON.parse(payload)];
+        }
+        catch (primaryError) {
+            const segments = payload
+                .split('\n')
+                .map((entry) => entry.trim())
+                .filter((entry) => entry.length > 0);
+            if (segments.length <= 1) {
+                throw primaryError;
+            }
+            const parsed = [];
+            for (const segment of segments) {
+                try {
+                    parsed.push(JSON.parse(segment));
+                }
+                catch {
+                    // Ignore non-JSON lines so valid partial frames can still be recovered.
+                }
+            }
+            if (!parsed.length) {
+                throw primaryError;
+            }
+            return parsed;
+        }
+    }
     ensureChoiceBuilder(context, choiceIndex) {
         let choiceBuilder = context.choiceIndexMap.get(choiceIndex);
         if (!choiceBuilder) {
@@ -651,18 +706,36 @@ export class ChatSseToJsonConverter {
      * 处理error事件
      */
     async processErrorEvent(event, _context) {
+        const rawPayload = typeof event.data === 'string' ? event.data : JSON.stringify(event.data ?? {});
+        let errorData;
         try {
-            const rawPayload = typeof event.data === 'string' ? event.data : JSON.stringify(event.data ?? {});
-            const errorData = JSON.parse(rawPayload);
-            const errorMessage = typeof errorData.error === 'string' ? errorData.error : 'Unknown SSE error';
-            const code = typeof errorData.code === 'string' ? errorData.code : 'SSE_ERROR';
-            const typedError = new Error(errorMessage);
-            typedError.code = code;
-            throw ErrorUtils.createError(typedError.message, CHAT_CONVERSION_ERROR_CODES.STREAM_ERROR, { errorData, event });
-        }
-        catch (parseError) {
-            throw ErrorUtils.createError(`SSE error event: ${event.data}`, CHAT_CONVERSION_ERROR_CODES.STREAM_ERROR, { event });
+            const parsed = JSON.parse(rawPayload);
+            if (parsed && typeof parsed === 'object' && !Array.isArray(parsed)) {
+                errorData = parsed;
+            }
         }
+        catch {
+            // keep raw payload only
+        }
+        const errorMessage = errorData
+            ? (typeof errorData.error === 'string'
+                ? errorData.error
+                : typeof errorData.message === 'string'
+                    ? errorData.message
+                    : typeof errorData.content === 'string'
+                        ? errorData.content
+                        : 'Unknown SSE error')
+            : `SSE error event: ${event.data}`;
+        const code = errorData
+            ? (typeof errorData.code === 'string'
+                ? errorData.code
+                : typeof errorData.finish_reason === 'string'
+                    ? errorData.finish_reason
+                    : 'SSE_ERROR')
+            : 'SSE_ERROR';
+        const typedError = new Error(errorMessage);
+        typedError.code = code;
+        throw ErrorUtils.createError(typedError.message, CHAT_CONVERSION_ERROR_CODES.STREAM_ERROR, { errorData, event });
     }
     /**
      * 构建部分响应

package/dist/telemetry/stats-center.d.ts

@@ -8,6 +8,12 @@ export interface VirtualRouterHitEvent {
     runtimeKey?: string;
     providerType?: string;
     modelId?: string;
+    reason?: string;
+    requestTokens?: number;
+    selectionPenalty?: number;
+    stopMessageActive?: boolean;
+    stopMessageMode?: 'on' | 'off' | 'auto' | 'unset';
+    stopMessageRemaining?: number;
 }
 export interface ProviderUsageEvent {
     requestId: string;
@@ -29,6 +35,9 @@ export interface RouterStatsBucket {
     poolHitCount: Record<string, number>;
     routeHitCount: Record<string, number>;
     providerHitCount: Record<string, number>;
+    reasonHitCount: Record<string, number>;
+    penaltyHitCount: Record<string, number>;
+    stopMessageActiveCount: number;
 }
 export interface RouterStatsSnapshot {
     global: RouterStatsBucket;

package/dist/telemetry/stats-center.js

@@ -6,7 +6,10 @@ function createEmptyRouterBucket() {
         requestCount: 0,
         poolHitCount: {},
         routeHitCount: {},
-        providerHitCount: {}
+        providerHitCount: {},
+        reasonHitCount: {},
+        penaltyHitCount: {},
+        stopMessageActiveCount: 0
     };
 }
 function createEmptyProviderBucket() {
@@ -135,6 +138,17 @@ class DefaultStatsCenter {
         if (ev.providerKey) {
             bucket.providerHitCount[ev.providerKey] = (bucket.providerHitCount[ev.providerKey] || 0) + 1;
         }
+        if (typeof ev.reason === 'string' && ev.reason.trim()) {
+            const reason = ev.reason.trim();
+            bucket.reasonHitCount[reason] = (bucket.reasonHitCount[reason] || 0) + 1;
+        }
+        if (typeof ev.selectionPenalty === 'number' && Number.isFinite(ev.selectionPenalty) && ev.selectionPenalty > 0) {
+            const key = String(Math.floor(ev.selectionPenalty));
+            bucket.penaltyHitCount[key] = (bucket.penaltyHitCount[key] || 0) + 1;
+        }
+        if (ev.stopMessageActive === true) {
+            bucket.stopMessageActiveCount += 1;
+        }
     }
     applyProviderUsageToBucket(bucket, ev) {
         bucket.requestCount += 1;
@@ -187,6 +201,7 @@ function printStatsToConsole(snapshot) {
     const totalRequests = router.global.requestCount;
     const poolEntries = Object.entries(router.global.poolHitCount);
     const providerEntries = Object.entries(router.global.providerHitCount);
+    const reasonEntries = Object.entries(router.global.reasonHitCount);
     // Router summary
     // eslint-disable-next-line no-console
     console.log('[stats] Virtual Router:');
@@ -210,6 +225,19 @@ function printStatsToConsole(snapshot) {
             console.log(`    ${providerKey}: ${count}`);
         }
     }
+    if (reasonEntries.length) {
+        // eslint-disable-next-line no-console
+        console.log('  top reasons:');
+        const sortedReasons = reasonEntries.sort((a, b) => b[1] - a[1]).slice(0, 5);
+        for (const [reason, count] of sortedReasons) {
+            // eslint-disable-next-line no-console
+            console.log(`    ${reason}: ${count}`);
+        }
+    }
+    if (router.global.stopMessageActiveCount > 0) {
+        // eslint-disable-next-line no-console
+        console.log(`  stopMessage-active hits: ${router.global.stopMessageActiveCount}`);
+    }
     const globalProvider = providers.global;
     const totalProviderRequests = globalProvider.requestCount;
     const avgLatency = globalProvider.successCount > 0 ? globalProvider.latencySumMs / globalProvider.successCount : 0;

package/dist/tools/apply-patch/structured/coercion.js

@@ -8,14 +8,7 @@ const resolveTopLevelFile = (record) => {
         asString(record.filename);
     if (direct)
         return direct;
-    const targetAlias = asString(record.target);
-    if (!targetAlias)
-        return undefined;
-    if (targetAlias.includes('\n') || targetAlias.includes('\r'))
-        return undefined;
-    if (!/[./\\]/.test(targetAlias))
-        return undefined;
-    return targetAlias;
+    return undefined;
 };
 const buildSingleChangePayload = (record) => {
     const kindRaw = asString(record.kind);
@@ -33,12 +26,11 @@ const buildSingleChangePayload = (record) => {
     const changeFile = asString(record.file) ??
         asString(record.path) ??
         asString(record.filepath) ??
-        asString(record.filename) ??
-        resolveTopLevelFile(record);
+        asString(record.filename);
     if (changeFile) {
         change.file = changeFile;
     }
-    return { file: changeFile, changes: [change] };
+    return { ...(changeFile ? { file: changeFile } : {}), changes: [change] };
 };
 const coerceChangesArray = (value) => {
     const parsed = tryParseJson(value);

package/dist/tools/exec-command/validator.d.ts

@@ -1,6 +1,7 @@
 export type ExecCommandValidationResult = {
     ok: boolean;
     reason?: string;
+    message?: string;
     normalizedArgs?: string;
 };
 export declare function validateExecCommandArgs(argsString: string, rawArgs: unknown): ExecCommandValidationResult;

package/dist/tools/exec-command/validator.js

@@ -9,6 +9,133 @@ const toJson = (value) => {
         return '{}';
     }
 };
+const GIT_RESET_HARD_PATTERN = /\bgit\s+reset\s+--hard(?:\s|$)/i;
+const GIT_CHECKOUT_PATTERN = /\bgit\s+checkout\b/i;
+const SHELL_SEPARATORS = new Set([';', '&&', '||', '|', '&']);
+function splitShellTokens(command) {
+    const tokens = [];
+    let current = '';
+    let quote = null;
+    let escaped = false;
+    const pushCurrent = () => {
+        if (current.length > 0) {
+            tokens.push(current);
+            current = '';
+        }
+    };
+    for (let i = 0; i < command.length; i += 1) {
+        const ch = command[i];
+        if (escaped) {
+            current += ch;
+            escaped = false;
+            continue;
+        }
+        if (ch === '\\') {
+            escaped = true;
+            continue;
+        }
+        if (quote) {
+            if (ch === quote) {
+                quote = null;
+            }
+            else {
+                current += ch;
+            }
+            continue;
+        }
+        if (ch === '"' || ch === "'") {
+            quote = ch;
+            continue;
+        }
+        if (/\s/.test(ch)) {
+            pushCurrent();
+            continue;
+        }
+        if (ch === ';') {
+            pushCurrent();
+            tokens.push(';');
+            continue;
+        }
+        if (ch === '|' || ch === '&') {
+            pushCurrent();
+            const next = command[i + 1];
+            if ((ch === '|' || ch === '&') && next === ch) {
+                tokens.push(ch + next);
+                i += 1;
+            }
+            else {
+                tokens.push(ch);
+            }
+            continue;
+        }
+        current += ch;
+    }
+    pushCurrent();
+    return tokens;
+}
+function evaluateGitCheckoutScope(command) {
+    const match = GIT_CHECKOUT_PATTERN.exec(command);
+    if (!match) {
+        return null;
+    }
+    const checkoutText = command.slice(match.index);
+    const tokens = splitShellTokens(checkoutText);
+    if (tokens.length < 3 || tokens[0]?.toLowerCase() !== 'git' || tokens[1]?.toLowerCase() !== 'checkout') {
+        return {
+            reason: 'forbidden_git_checkout_scope',
+            message: 'Command blocked: git checkout is restricted to a single file path. Use `git checkout -- <file>` or `git checkout <ref> -- <file>`.'
+        };
+    }
+    const separatorIdx = tokens.findIndex((token, idx) => idx >= 2 && SHELL_SEPARATORS.has(token));
+    if (separatorIdx >= 0) {
+        return {
+            reason: 'forbidden_git_checkout_scope',
+            message: 'Command blocked: git checkout must be a standalone single-file command (no chained commands).'
+        };
+    }
+    const checkoutTokens = separatorIdx >= 0 ? tokens.slice(0, separatorIdx) : tokens;
+    const dashDashIdx = checkoutTokens.indexOf('--', 2);
+    if (dashDashIdx < 0) {
+        return {
+            reason: 'forbidden_git_checkout_scope',
+            message: 'Command blocked: git checkout is restricted to a single file path. Use `git checkout -- <file>` or `git checkout <ref> -- <file>`.'
+        };
+    }
+    const beforeDashDash = checkoutTokens.slice(2, dashDashIdx);
+    if (beforeDashDash.length > 1 || beforeDashDash.some((token) => token.startsWith('-'))) {
+        return {
+            reason: 'forbidden_git_checkout_scope',
+            message: 'Command blocked: git checkout is restricted to a single file path. Use `git checkout -- <file>` or `git checkout <ref> -- <file>`.'
+        };
+    }
+    const paths = checkoutTokens.slice(dashDashIdx + 1);
+    if (paths.length !== 1) {
+        return {
+            reason: 'forbidden_git_checkout_scope',
+            message: 'Command blocked: git checkout is restricted to a single file path. Use `git checkout -- <file>` or `git checkout <ref> -- <file>`.'
+        };
+    }
+    const path = paths[0];
+    if (!path || path === '.' || path === '/' || path === '*' || path.endsWith('/')) {
+        return {
+            reason: 'forbidden_git_checkout_scope',
+            message: 'Command blocked: git checkout is restricted to one concrete file path (directory/pathset restore is not allowed).'
+        };
+    }
+    return null;
+}
+function detectPolicyViolation(command) {
+    if (!command || !command.trim()) {
+        return null;
+    }
+    if (GIT_RESET_HARD_PATTERN.test(command)) {
+        return {
+            reason: 'forbidden_git_reset_hard',
+            message: 'Command blocked: `git reset --hard` is destructive. Use `git reset --mixed <ref>` or file-scoped restore commands instead.'
+        };
+    }
+    return evaluateGitCheckoutScope(command);
+}
 export function validateExecCommandArgs(argsString, rawArgs) {
     const raw = typeof argsString === 'string' ? argsString : String(argsString ?? '');
     const parsed = isRecord(rawArgs) && Object.keys(rawArgs).length > 0
@@ -18,5 +145,10 @@ export function validateExecCommandArgs(argsString, rawArgs) {
     if (normalized.ok === false) {
         return { ok: false, reason: normalized.reason };
     }
+    const command = typeof normalized.normalized.cmd === 'string' ? normalized.normalized.cmd : '';
+    const violation = detectPolicyViolation(command);
+    if (violation) {
+        return { ok: false, reason: violation.reason, message: violation.message };
+    }
     return { ok: true, normalizedArgs: toJson(normalized.normalized) };
 }