@thegitai/cli 1.0.0-preview.15 → 1.0.0-preview.17

package/dist/src/agent-mode.js

@@ -46,7 +46,7 @@ export function nextAgentMode(mode) {
 export function agentModeAllowsTool(mode, toolName) {
     return mode !== 'plan' || PLAN_MODE_TOOL_NAMES.has(toolName);
 }
-function getUnquotedShellText(command) {
+export function getUnquotedShellText(command) {
     let quote = null;
     let escaped = false;
     let text = '';

package/dist/src/api/chat.js

@@ -248,6 +248,26 @@ async function postUserInputResult({ config, turnId, requestId, result, fetchImp
         throw await readErrorResponse(response, trace.traceId);
     }
 }
+export async function postInterjection({ config, turnId, text, messageId, fetchImpl = globalThis.fetch, traceId, }) {
+    const payload = { text, messageId };
+    const trace = createTraceContext(traceId);
+    const response = await fetchImpl(`${normalizeServerUrl(config.serverUrl)}/v1/chat/turn/${encodeURIComponent(turnId)}/interject`, {
+        method: 'POST',
+        headers: {
+            authorization: `Bearer ${config.token}`,
+            'content-type': 'application/json',
+            ...trace.headers,
+        },
+        body: JSON.stringify(payload),
+    });
+    if (response.status === 410) {
+        return 'stale';
+    }
+    if (!response.ok) {
+        throw await readErrorResponse(response, trace.traceId);
+    }
+    return 'delivered';
+}
 const turnIdOverrides = new WeakMap();
 function enterServerTurnId(session, serverSessionTurnId) {
     const active = turnIdOverrides.get(session);
@@ -309,7 +329,7 @@ async function executeAndPostToolResult({ config, projectIndex, session, event,
         }
     }
 }
-async function consumeTurnStream({ response, config, projectIndex, session, input, fetchImpl, signal, traceId, }) {
+async function consumeTurnStream({ response, config, projectIndex, session, input, fetchImpl, signal, traceId, onTurnStart, onInterjectionDelivered, }) {
     if (!response.body) {
         throw new Error('Server returned an empty chat stream.');
     }
@@ -345,6 +365,16 @@ async function consumeTurnStream({ response, config, projectIndex, session, inpu
         }
     }
     async function handleEvent(event) {
+        if (event.event === 'turn-start') {
+            const turnId = String(event.data?.turnId ?? '').trim();
+            if (turnId)
+                onTurnStart?.(turnId);
+            return;
+        }
+        if (event.event === 'interjection-delivered') {
+            onInterjectionDelivered?.(event.data);
+            return;
+        }
         if (event.event === 'status') {
             const data = event.data;
             if (data?.phase === 'analyzing_image') {
@@ -478,7 +508,7 @@ async function consumeTurnStream({ response, config, projectIndex, session, inpu
     }
     return finalResult.current;
 }
-export async function sendServerUserMessage({ config, projectIndex, session, input, imageAttachments = [], fetchImpl = globalThis.fetch, signal, }) {
+export async function sendServerUserMessage({ config, projectIndex, session, input, imageAttachments = [], fetchImpl = globalThis.fetch, signal, onTurnStart, onInterjectionDelivered, }) {
     const autoAttach = autoAttachImages(input, session.rootDir, imageAttachments);
     const requestImageAttachments = autoAttach.attachments.length > 0
         ? [...imageAttachments, ...autoAttach.attachments]
@@ -535,6 +565,8 @@ export async function sendServerUserMessage({ config, projectIndex, session, inp
             fetchImpl,
             signal,
             traceId: trace.traceId,
+            onTurnStart,
+            onInterjectionDelivered,
         });
         applySessionSnapshot(session, result.snapshot, { preserveAgentMode: true });
         return {

package/dist/src/help-text.js

@@ -47,7 +47,9 @@ const HELP_MARKDOWN = [
     '',
     '## Modes',
     '',
-    '- Default — asks before shell commands and file edits.',
+    '- Default — asks before creating, editing or deleting files and before',
+    '  running commands. Each answer can be remembered for the rest of the',
+    '  session; see Safety & approvals.',
     '- Auto-Accept — approves shell commands and file edits for the session.',
     '- Plan — read-only; the agent can inspect, ask typed questions, and plan,',
     '  with file-reading shell commands only. It will not edit files or run tests,',
@@ -59,6 +61,13 @@ const HELP_MARKDOWN = [
     '- **Enter** sends • **Shift+Tab** cycles modes • **Esc** cancels the turn •',
     '  **Ctrl+C** clears the composer or the queued message, and quits once there',
     '  is nothing left to clear. These are the same on macOS, Linux, and Windows.',
+    '- **While the agent is working**, Enter queues your message and locks the',
+    '  composer. Press **Enter** again to send it into the running turn: the agent',
+    '  picks it up at its next step instead of waiting for the turn to finish, and',
+    '  the Your messages panel tracks it from queued to delivered. **↑** brings it',
+    '  back for editing and **Esc**/**Ctrl+C** discards it; both unlock the',
+    '  composer for the next message. Messages with images cannot be sent mid-turn',
+    '  and are sent with the next prompt instead.',
     `- **Paste** into the composer with your terminal's paste shortcut (\`${PASTE_SHORTCUT}\``,
     '  on this system) or by right-clicking the composer.',
     '- **Copy** from the transcript by dragging to select; double-click copies a',
@@ -84,9 +93,28 @@ const HELP_MARKDOWN = [
     '',
     '## Safety & approvals',
     '',
-    '- TheGitAI asks before running shell commands or applying file edits.',
-    '- At each prompt: **y** approves once, **a** approves the rest of the',
-    '  session, **n** denies.',
+    '- In Default mode TheGitAI asks before it creates a file, edits an existing',
+    '  file, deletes a file, or runs a command. These are four separate',
+    '  permissions: allowing edits does not allow deletions, and allowing file',
+    '  changes does not allow commands.',
+    '- At each prompt: **↑/↓** moves between choices, **Enter** confirms the',
+    '  highlighted one, and **Esc** denies. Deny is selected by default.',
+    '  Single-letter shortcuts were removed on purpose: a prompt can appear',
+    '  while you are typing, and a stray letter must never approve anything.',
+    '- Every prompt offers Approve once, an "Always allow" for that kind of',
+    '  action, and Deny. A command also offers to remember just its prefix — for',
+    '  example approving `npm test -- --watch=false` can allow `npm test`.',
+    '- A prefix is only offered when the command shows a plain verb, as in',
+    '  `npm test` or `git status`. Commands with no verb (`ls -la`), interpreters',
+    '  and wrappers (`bash -c`, `python -c`, `env`, `timeout`, `make`), and',
+    '  destructive or network binaries (`rm`, `sudo`, `curl`) are never offered',
+    '  one — a bare binary grant would mean "anything this program can do".',
+    '  `npm run` must name its script, so the grant is `npm run build`.',
+    '- A remembered prefix never covers a command that chains, pipes, redirects,',
+    '  or substitutes, so allowing `npm test` can never green-light',
+    '  `npm test && rm -rf build`.',
+    '- Everything you allow lasts for the current session only and is forgotten',
+    '  when it ends. `/new` clears it immediately.',
     '- If an approved `sudo` command needs a password, the TUI shows the exact',
     '  command and keeps the password masked and local.',
     '- `-y` / `--yes` at startup auto-approves every shell command and file',

package/dist/src/permissions.js

@@ -0,0 +1,243 @@
+import { getUnquotedShellText } from './agent-mode.js';
+export const PERMISSION_BUCKETS = ['create', 'edit', 'delete', 'run'];
+export function createSessionGrants() {
+    return { buckets: [], commandPrefixes: [] };
+}
+export function bucketActionLabel(bucket) {
+    if (bucket === 'create')
+        return 'create files';
+    if (bucket === 'edit')
+        return 'edit files';
+    if (bucket === 'delete')
+        return 'delete files';
+    return 'run commands';
+}
+const NO_PREFIX_GRANT_BINARIES = new Set([
+    'rm',
+    'rmdir',
+    'mv',
+    'dd',
+    'mkfs',
+    'shred',
+    'sudo',
+    'doas',
+    'su',
+    'chmod',
+    'chown',
+    'chgrp',
+    'kill',
+    'pkill',
+    'killall',
+    'shutdown',
+    'reboot',
+    'curl',
+    'wget',
+    'ssh',
+    'scp',
+    'nc',
+    'eval',
+    'exec',
+    'source',
+]);
+const INTERPRETER_OR_WRAPPER_BINARIES = new Set([
+    'bash',
+    'sh',
+    'zsh',
+    'fish',
+    'dash',
+    'ksh',
+    'csh',
+    'tcsh',
+    'python',
+    'python2',
+    'python3',
+    'node',
+    'deno',
+    'bun',
+    'ruby',
+    'perl',
+    'php',
+    'lua',
+    'osascript',
+    'awk',
+    'gawk',
+    'sed',
+    'env',
+    'timeout',
+    'xargs',
+    'nohup',
+    'setsid',
+    'watch',
+    'script',
+    'nice',
+    'ionice',
+    'stdbuf',
+    'time',
+    'sudo',
+    'doas',
+    'su',
+    'find',
+    'make',
+]);
+const SCRIPT_RUNNER_VERBS = new Set(['run', 'exec', 'run-script', 'x', 'dlx']);
+const VERB_PATTERN = /^[A-Za-z][A-Za-z0-9_:-]*$/;
+const BINARY_PATTERN = /^[A-Za-z0-9][A-Za-z0-9._+-]*$/;
+const SHELL_CONTROL_OPERATOR_PATTERN = /[&|;<>\n]/;
+const COMMAND_SUBSTITUTION_PATTERN = /`|\$\(/;
+function normalizeCommand(command) {
+    return String(command ?? '').trim().replace(/\s+/g, ' ');
+}
+function parseCommand(command) {
+    const raw = String(command ?? '');
+    if (!raw.trim())
+        return null;
+    if (COMMAND_SUBSTITUTION_PATTERN.test(raw))
+        return null;
+    if (SHELL_CONTROL_OPERATOR_PATTERN.test(getUnquotedShellText(raw)))
+        return null;
+    const all = normalizeCommand(raw).match(/\S+/g) ?? [];
+    const tokens = [];
+    for (const token of all) {
+        if (!tokens.length && /^[A-Za-z_][A-Za-z0-9_]*=/.test(token))
+            continue;
+        if (!tokens.length && token === 'command')
+            continue;
+        tokens.push(token);
+    }
+    if (!tokens.length)
+        return null;
+    const binary = (tokens[0].split('/').pop() ?? '').trim();
+    if (!binary)
+        return null;
+    tokens[0] = binary;
+    return { canonical: tokens.join(' '), tokens };
+}
+function grantPrefixFromTokens(tokens) {
+    const binary = tokens[0];
+    if (!BINARY_PATTERN.test(binary))
+        return null;
+    if (NO_PREFIX_GRANT_BINARIES.has(binary))
+        return null;
+    if (INTERPRETER_OR_WRAPPER_BINARIES.has(binary))
+        return null;
+    const verb = tokens[1];
+    if (!verb || !VERB_PATTERN.test(verb))
+        return null;
+    if (SCRIPT_RUNNER_VERBS.has(verb)) {
+        const script = tokens[2];
+        if (!script || !VERB_PATTERN.test(script))
+            return null;
+        return `${binary} ${verb} ${script}`;
+    }
+    return `${binary} ${verb}`;
+}
+export function commandGrantPrefix(command) {
+    const parsed = parseCommand(command);
+    return parsed ? grantPrefixFromTokens(parsed.tokens) : null;
+}
+export function isBucketGranted(grants, bucket) {
+    return Boolean(grants?.buckets.includes(bucket));
+}
+export function isCommandGranted(grants, command) {
+    if (!grants)
+        return false;
+    if (grants.buckets.includes('run'))
+        return true;
+    if (!grants.commandPrefixes.length)
+        return false;
+    const parsed = parseCommand(command);
+    if (!parsed)
+        return false;
+    if (grantPrefixFromTokens(parsed.tokens) === null)
+        return false;
+    return grants.commandPrefixes.some((prefix) => parsed.canonical === prefix || parsed.canonical.startsWith(`${prefix} `));
+}
+export function grantBucket(grants, bucket) {
+    if (!grants.buckets.includes(bucket))
+        grants.buckets.push(bucket);
+}
+export function grantCommandPrefix(grants, prefix) {
+    const normalized = normalizeCommand(prefix);
+    if (!normalized)
+        return;
+    if (!grants.commandPrefixes.includes(normalized)) {
+        grants.commandPrefixes.push(normalized);
+    }
+}
+export function buildPermissionOptions(bucket, command) {
+    const options = [
+        { label: 'Approve once', decision: { kind: 'once' } },
+    ];
+    const prefix = bucket === 'run' && command ? commandGrantPrefix(command) : null;
+    if (prefix) {
+        options.push({
+            label: `Always allow: ${prefix}`,
+            decision: { kind: 'always-prefix', prefix },
+        });
+    }
+    options.push({
+        label: `Always allow: ${bucketActionLabel(bucket)}`,
+        decision: { kind: 'always-bucket' },
+    });
+    options.push({ label: 'Deny', decision: { kind: 'deny' } });
+    return options;
+}
+function declinedSubject(bucket) {
+    if (bucket === 'run') {
+        return { noun: 'command', effect: 'Nothing was executed' };
+    }
+    if (bucket === 'create') {
+        return { noun: 'file creation', effect: 'Nothing was created' };
+    }
+    if (bucket === 'delete') {
+        return { noun: 'file deletion', effect: 'Nothing was deleted' };
+    }
+    return { noun: 'edit', effect: 'Nothing was changed' };
+}
+function declinedResponse(bucket, toolName, extra) {
+    const { noun, effect } = declinedSubject(bucket);
+    return {
+        ok: false,
+        skipped: true,
+        ...extra,
+        failureCategory: 'user_declined',
+        failureDetails: {
+            category: 'user_declined',
+            tool: toolName,
+            action: 'Respect the real user’s decision. Do not retry the same or an equivalent action; reconsider the approach or ask one specific question if needed.',
+        },
+        error: `The real user rejected this proposed ${noun}. ${effect}; this was not a tool failure or an automated system skip.`,
+    };
+}
+export async function ensurePermission(context, request, toolName, extra = {}) {
+    if (context.autoYes)
+        return null;
+    if (isBucketGranted(context.grants, request.bucket))
+        return null;
+    if (request.bucket === 'run' &&
+        request.command &&
+        isCommandGranted(context.grants, request.command)) {
+        return null;
+    }
+    if (!context.requestPermission) {
+        return {
+            ok: false,
+            ...extra,
+            error: `requestPermission is required when autoYes is false (${toolName})`,
+        };
+    }
+    const options = buildPermissionOptions(request.bucket, request.command);
+    const decision = await context.requestPermission({ ...request, options });
+    if (decision.kind === 'deny') {
+        return declinedResponse(request.bucket, toolName, extra);
+    }
+    if (context.grants) {
+        if (decision.kind === 'always-bucket') {
+            grantBucket(context.grants, request.bucket);
+        }
+        else if (decision.kind === 'always-prefix') {
+            grantCommandPrefix(context.grants, decision.prefix);
+        }
+    }
+    return null;
+}

package/dist/src/session-store.js

@@ -4,6 +4,7 @@ import { existsSync, mkdirSync, readFileSync, readdirSync, renameSync, rmSync, w
 import path from 'node:path';
 import { getClientStateDir } from './client-state.js';
 import { normalizeAssistantEditJournal } from './edit-journal.js';
+import { createSessionGrants } from './permissions.js';
 import { cloneSessionSafetyState, createSessionSafetyState, mergeLocalSessionSafetyState, normalizeSessionSafetyState, } from './session-safety.js';
 import { singleLinePreview } from './utils.js';
 const SESSION_STORE_VERSION = 1;
@@ -211,6 +212,7 @@ export function saveSessionState(session, env = process.env) {
 }
 export function applySessionSnapshot(session, snapshot, options = {}) {
     const currentAgentMode = session.agentMode;
+    const previousSessionId = session.sessionId;
     session.sessionId = snapshot.id;
     session.sessionName = snapshot.name;
     session.sessionCreatedAt = snapshot.createdAt;
@@ -220,6 +222,9 @@ export function applySessionSnapshot(session, snapshot, options = {}) {
     session.serverState = sanitizeOpaqueState(snapshot.serverState);
     session.agentMode = options.preserveAgentMode ? currentAgentMode : 'default';
     session.autoYes = session.agentMode === 'auto-accept';
+    if (previousSessionId !== session.sessionId) {
+        session.grants = createSessionGrants();
+    }
     session.turnState = {
         id: null,
         historyStartIndex: session.history.length,

package/dist/src/session.js

@@ -1,5 +1,6 @@
 import path from 'node:path';
 import { normalizeAgentMode, } from './agent-mode.js';
+import { createSessionGrants, } from './permissions.js';
 import { createSessionSafetyState, } from './session-safety.js';
 import { clampInteger } from './utils.js';
 const DEFAULT_MAX_TOOL_STEPS = 32;
@@ -31,7 +32,7 @@ function preserveProviderSelection(serverState) {
         : null;
     return providerSelection ? { providerSelection } : {};
 }
-export function createSession({ rootDir, autoYes = false, agentMode, modelId, maxToolSteps = DEFAULT_MAX_TOOL_STEPS, confirmCommand = null, confirmPatch = null, requestSudoPassword = null, requestUserInput = null, onStatus = null, onContextLog = null, onToolEvent = null, env = process.env, sessionId = createSessionId(), sessionName = null, history = [], serverState = null, editJournal = [], stickyFilePaths = [], editCounter = 0, safety = createSessionSafetyState(), }) {
+export function createSession({ rootDir, autoYes = false, agentMode, modelId, maxToolSteps = DEFAULT_MAX_TOOL_STEPS, requestPermission = null, requestSudoPassword = null, requestUserInput = null, onStatus = null, onContextLog = null, onToolEvent = null, env = process.env, sessionId = createSessionId(), sessionName = null, history = [], serverState = null, editJournal = [], stickyFilePaths = [], editCounter = 0, safety = createSessionSafetyState(), }) {
     const createdAt = new Date().toISOString();
     const initialAgentMode = normalizeAgentMode(agentMode ?? (autoYes ? 'auto-accept' : 'default'));
     return {
@@ -43,8 +44,8 @@ export function createSession({ rootDir, autoYes = false, agentMode, modelId, ma
         onStatus: onStatus ?? defaultStatus,
         onContextLog: onContextLog ?? defaultContextLog,
         onToolEvent,
-        confirmCommand,
-        confirmPatch,
+        grants: createSessionGrants(),
+        requestPermission,
         requestSudoPassword,
         requestUserInput,
         history: JSON.parse(JSON.stringify(history)),
@@ -80,6 +81,7 @@ export function startNewConversation(session) {
 }
 export function clearConversation(session) {
     session.history = [];
+    session.grants = createSessionGrants();
     session.serverState = preserveProviderSelection(session.serverState);
     session.turnState = {
         id: null,

package/dist/src/tool-executor.js

@@ -277,8 +277,8 @@ export async function executeLocalToolCall(toolContext, session, call) {
             sessionId: session.sessionId,
             projectIndex: toolContext.projectIndex,
             autoYes: session.autoYes,
-            confirmCommand: session.confirmCommand,
-            confirmPatch: session.confirmPatch,
+            grants: session.grants,
+            requestPermission: session.requestPermission,
             requestSudoPassword: session.requestSudoPassword,
             onStatus: session.onStatus,
             editJournal: session.clientState.editJournal,

package/dist/src/tools/delete-file.js

@@ -3,6 +3,7 @@ import { classifyProjectPath, deleteProjectFile } from '../patcher.js';
 import { isTuiMode } from '../runtime-mode.js';
 import { removeIndexFile } from '../project-index.js';
 import { invalidateShellDiagnosticsCache, runShellDiagnostics, } from './shell-diagnostics.js';
+import { ensurePermission } from '../permissions.js';
 export async function deleteFile(context, args) {
     const { rootDir, projectIndex } = context;
     const filePath = String(args.filePath ?? '').trim();
@@ -24,6 +25,19 @@ export async function deleteFile(context, args) {
         };
     }
     const scratchPath = pathKind === 'scratch';
+    if (!scratchPath) {
+        const denied = await ensurePermission(context, {
+            bucket: 'delete',
+            title: 'Approve file deletion?',
+            body: `Delete ${filePath}`,
+            filePath,
+        }, 'delete_file', { filePath });
+        if (denied) {
+            if (!isTuiMode())
+                console.log(chalk.dim(`  ⏭  Delete skipped: ${filePath}`));
+            return denied;
+        }
+    }
     const result = deleteProjectFile(rootDir, filePath);
     if (result.deleted) {
         if (!scratchPath) {

package/dist/src/tools/patch-file.js

@@ -7,9 +7,10 @@ import { repairFilePath } from './path-suggest.js';
 import { isTuiMode } from '../runtime-mode.js';
 import { getCurrentFileHash, resolveRedactionTokens } from '../session-safety.js';
 import { invalidateShellDiagnosticsCache, runShellDiagnostics, } from './shell-diagnostics.js';
+import { ensurePermission } from '../permissions.js';
 const DOCUMENT_EXTENSIONS = new Set(['.pdf', '.xlsx', '.docx']);
 export async function patchFile(context, args) {
-    const { rootDir, projectIndex, autoYes, confirmPatch } = context;
+    const { rootDir, projectIndex } = context;
     const filePath = repairFilePath(rootDir, String(args.filePath ?? '').trim());
     let patch = typeof args.patch === 'string' ? args.patch : '';
     if (!filePath) {
@@ -74,23 +75,18 @@ export async function patchFile(context, args) {
         };
     }
     renderDiffPreview(filePath, patch);
-    if (!autoYes && confirmPatch) {
-        const confirmed = await confirmPatch(filePath, patch);
-        if (!confirmed) {
+    if (!scratchPath) {
+        const denied = await ensurePermission(context, {
+            bucket: getCurrentFileHash(rootDir, filePath) === null ? 'create' : 'edit',
+            title: 'Approve patch?',
+            body: 'Review changes before applying.',
+            filePath,
+            diff: patch,
+        }, 'patch_file', { filePath });
+        if (denied) {
             if (!isTuiMode())
                 console.log(chalk.dim(`  ⏭  Patch skipped: ${filePath}`));
-            return {
-                ok: false,
-                skipped: true,
-                filePath,
-                failureCategory: 'user_declined',
-                failureDetails: {
-                    category: 'user_declined',
-                    tool: 'patch_file',
-                    action: 'Respect the real user’s decision. Do not retry the same or an equivalent edit; reconsider the approach or ask one specific question if needed.',
-                },
-                error: 'The real user rejected this proposed patch. Nothing was changed; this was not a tool failure or an automated system skip.',
-            };
+            return denied;
         }
     }
     const { changed } = writeProjectFile(rootDir, filePath, patchedContent);

package/dist/src/tools/replace-document-text.js

@@ -6,6 +6,8 @@ import { readCliAuthConfig } from '../api/auth.js';
 import { resolveProjectPath, writeProjectFileBuffer } from '../patcher.js';
 import { repairFilePath, suggestClosestPath } from './path-suggest.js';
 import { isTuiMode } from '../runtime-mode.js';
+import { ensurePermission } from '../permissions.js';
+import { getCurrentFileHash } from '../session-safety.js';
 function normalizeReplacements(value) {
     if (!Array.isArray(value))
         return [];
@@ -178,27 +180,35 @@ export async function replaceDocumentText(context, args) {
     }
     const preview = String(serverResult.preview ?? '');
     renderPreview(targetPath, preview);
-    if (!context.autoYes && context.confirmPatch) {
-        const confirmed = await context.confirmPatch(targetPath, preview);
-        if (!confirmed) {
-            if (!isTuiMode()) {
-                console.log(chalk.dim(`  replace_document_text skipped: ${targetPath}`));
-            }
-            return {
-                ok: false,
-                skipped: true,
-                filePath: targetPath,
-                failureCategory: 'user_declined',
-                failureDetails: {
-                    category: 'user_declined',
-                    tool: 'replace_document_text',
-                    action: 'Respect the real user’s decision. Do not retry the same or an equivalent edit; reconsider the approach or ask one specific question if needed.',
-                },
-                error: 'The real user rejected this proposed document edit. Nothing was changed; this was not a tool failure or an automated system skip.',
-            };
+    const targetHashBeforeApproval = getCurrentFileHash(context.rootDir, targetPath);
+    const documentIsNew = targetHashBeforeApproval === null;
+    const denied = await ensurePermission(context, {
+        bucket: documentIsNew ? 'create' : 'edit',
+        title: documentIsNew ? 'Approve new document?' : 'Approve document edit?',
+        body: 'Review changes before applying.',
+        filePath: targetPath,
+        diff: preview,
+    }, 'replace_document_text', { filePath: targetPath });
+    if (denied) {
+        if (!isTuiMode()) {
+            console.log(chalk.dim(`  replace_document_text skipped: ${targetPath}`));
         }
+        return denied;
     }
     const fileData = String(serverResult.fileData ?? '');
+    if (getCurrentFileHash(context.rootDir, targetPath) !== targetHashBeforeApproval) {
+        return {
+            ok: false,
+            filePath: targetPath,
+            failureCategory: 'conflict',
+            error: `replace_document_text refused: ${targetPath} changed on disk while the approval prompt was open.`,
+            failureDetails: {
+                category: 'conflict',
+                tool: 'replace_document_text',
+                action: 'Re-read the document to see its current contents, then rebuild the replacements against it and retry.',
+            },
+        };
+    }
     const nextData = Buffer.from(fileData, 'base64');
     const write = writeProjectFileBuffer(context.rootDir, targetPath, nextData);
     const failedCount = Number(serverResult.failedCount ?? 0);

package/dist/src/tools/run-command.js

@@ -2,13 +2,14 @@ import chalk from '../colors.js';
 import { startBackgroundJob } from '../background-jobs.js';
 import { getBlockedCommandReason, runCommand, } from '../executor.js';
 import { syncIndexFromDisk } from '../project-index.js';
+import { ensurePermission } from '../permissions.js';
 import { isTuiMode } from '../runtime-mode.js';
 import { redactConnectionStringCredentials } from '../secret-preview.js';
 import { buildNestedGitHint } from '../session-safety.js';
 import { buildDeferredShellDiagnostics, invalidateShellDiagnosticsCache, } from './shell-diagnostics.js';
 const MAX_OUTPUT_CHARS = 4000;
 export async function runShellCommand(context, args) {
-    const { rootDir, projectIndex, autoYes, confirmCommand, requestSudoPassword, onStatus, } = context;
+    const { rootDir, projectIndex, requestSudoPassword, onStatus, } = context;
     const command = String(args.command ?? '').trim();
     if (!command) {
         return { ok: false, error: 'command is required' };
@@ -31,33 +32,18 @@ export async function runShellCommand(context, args) {
     }
     if (!isTuiMode())
         console.log(chalk.bold.yellow(`\n  ⚡ Command: ${command}`));
-    if (!autoYes) {
-        if (confirmCommand == null) {
-            return {
-                ok: false,
-                command,
-                error: 'confirmCommand is required when autoYes is false',
-            };
-        }
-        const approved = await confirmCommand(runInBackground
+    const denied = await ensurePermission(context, {
+        bucket: 'run',
+        title: 'Approve command?',
+        body: runInBackground
             ? `${command}\n\nRuns as a managed background job until it exits or is killed.`
-            : command);
-        if (!approved) {
-            if (!isTuiMode())
-                console.log(chalk.dim(`  ⏭  Skipped: ${command}`));
-            return {
-                ok: false,
-                skipped: true,
-                command,
-                failureCategory: 'user_declined',
-                failureDetails: {
-                    category: 'user_declined',
-                    tool: 'run_command',
-                    action: 'Respect the real user’s decision. Do not retry the same or an equivalent action; reconsider the approach or ask one specific question if needed.',
-                },
-                error: 'The real user rejected this proposed command. Nothing was executed; this was not a tool failure or an automated system skip.',
-            };
-        }
+            : command,
+        command,
+    }, 'run_command', { command });
+    if (denied) {
+        if (!isTuiMode())
+            console.log(chalk.dim(`  ⏭  Skipped: ${command}`));
+        return denied;
     }
     if (runInBackground) {
         return runBackgroundCommand(context, command, args.timeout_ms, repoHint);