@unlinearity/cli-wechat-bridge 1.0.4 → 1.0.6

package/dist/bridge/bridge-adapters.opencode.js

@@ -1,7 +1,7 @@
 import { spawn as spawnChildProcess } from "node:child_process";
 import { OPENCODE_SERVER_HOST, OPENCODE_SERVER_READY_TIMEOUT_MS, OPENCODE_SSE_RECONNECT_DELAY_MS, OPENCODE_SESSION_IDLE_SETTLE_MS, OPENCODE_WECHAT_WORKING_NOTICE_DELAY_MS, buildCliEnvironment, isRecord, describeUnknownError, resolveSpawnTarget, reserveLocalPort, waitForTcpPort, delay, } from "./bridge-adapters.shared.js";
 import { killProcessTreeSync } from "./bridge-process-reaper.js";
-import { buildOneTimeCode, normalizeOutput, nowIso, truncatePreview, OutputBatcher, } from "./bridge-utils.js";
+import { WECHAT_OUTBOUND_ATTACHMENT_DENY_MESSAGE, containsWechatOutboundAttachmentPath, buildOneTimeCode, isWechatOutboundAttachmentMutationTool, isWechatOutboundAttachmentWriteCommand, normalizeOutput, nowIso, truncatePreview, OutputBatcher, } from "./bridge-utils.js";
 const OPENCODE_DEBUG_ENABLED = /^(1|true|yes|on)$/i.test(process.env.WECHAT_OPENCODE_DEBUG ?? "");
 const OPENCODE_DUPLICATE_EVENT_TTL_MS = 150;
 const OPENCODE_WECHAT_MIRROR_SUPPRESSION_TTL_MS = 30_000;
@@ -801,6 +801,11 @@ export class OpenCodeServerAdapter {
             return;
         }
         this.clearWechatWorkingNotice();
+        const denyMessage = this.getWechatOutboundAttachmentPermissionDenyMessage(properties, pendingPermission);
+        if (denyMessage) {
+            this.rejectPermission(pendingPermission, denyMessage);
+            return;
+        }
         const approval = this.toPendingApproval(pendingPermission);
         this.pendingPermission = pendingPermission;
         this.state.pendingApproval = approval;
@@ -817,6 +822,57 @@ export class OpenCodeServerAdapter {
         this.state.pendingApproval = null;
         this.state.pendingApprovalOrigin = undefined;
     }
+    getWechatOutboundAttachmentPermissionDenyMessage(properties, pendingPermission) {
+        const metadata = isRecord(properties.metadata) ? properties.metadata : {};
+        const command = this.extractPermissionCommand(properties, metadata);
+        if (isWechatOutboundAttachmentWriteCommand(command)) {
+            return WECHAT_OUTBOUND_ATTACHMENT_DENY_MESSAGE;
+        }
+        const targetPath = [
+            command,
+            typeof metadata.path === "string" ? metadata.path : "",
+            typeof metadata.file === "string" ? metadata.file : "",
+            typeof metadata.filePath === "string" ? metadata.filePath : "",
+            typeof metadata.filepath === "string" ? metadata.filepath : "",
+            typeof metadata.parentDir === "string" ? metadata.parentDir : "",
+            typeof metadata.target === "string" ? metadata.target : "",
+            typeof metadata.detail === "string" ? metadata.detail : "",
+            Array.isArray(properties.patterns)
+                ? properties.patterns.filter((value) => typeof value === "string").join(" ")
+                : "",
+            typeof properties.pattern === "string" ? properties.pattern : "",
+        ].join(" ");
+        return isWechatOutboundAttachmentMutationTool(pendingPermission.request.toolName, targetPath)
+            ? WECHAT_OUTBOUND_ATTACHMENT_DENY_MESSAGE
+            : null;
+    }
+    rejectPermission(pendingPermission, denyMessage) {
+        const client = this.client;
+        if (!client) {
+            return;
+        }
+        void (async () => {
+            try {
+                const result = await client.permission.respond({
+                    sessionID: pendingPermission.sessionId,
+                    permissionID: pendingPermission.permissionId,
+                    directory: this.options.cwd,
+                    workspace: this.activeWorkspaceId ?? undefined,
+                    response: "reject",
+                });
+                if (result.error !== undefined) {
+                    throw new Error(`SDK error: ${describeUnknownError(result.error)}`);
+                }
+            }
+            catch (err) {
+                this.emit({
+                    type: "stderr",
+                    text: `${denyMessage}\nFailed to reject permission: ${describeUnknownError(err)}`,
+                    timestamp: nowIso(),
+                });
+            }
+        })();
+    }
     toPendingApproval(pendingPermission) {
         return {
             ...pendingPermission.request,
@@ -834,24 +890,14 @@ export class OpenCodeServerAdapter {
         if (!sessionId || !permissionId) {
             return null;
         }
-        const toolName = typeof properties.type === "string"
-            ? properties.type
-            : typeof properties.permission === "string"
-                ? properties.permission
-                : undefined;
+        const toolName = this.extractPermissionToolName(properties);
         const title = typeof properties.title === "string"
             ? properties.title
             : typeof properties.permission === "string"
                 ? `Permission request: ${properties.permission}`
                 : undefined;
         const metadata = isRecord(properties.metadata) ? properties.metadata : {};
-        const command = typeof metadata.command === "string"
-            ? metadata.command
-            : typeof metadata.detail === "string"
-                ? metadata.detail
-                : Array.isArray(properties.patterns)
-                    ? properties.patterns.filter((value) => typeof value === "string").join(", ")
-                    : undefined;
+        const command = this.extractPermissionCommand(properties, metadata);
         return {
             sessionId,
             permissionId,
@@ -869,6 +915,26 @@ export class OpenCodeServerAdapter {
             },
         };
     }
+    extractPermissionToolName(properties) {
+        return typeof properties.type === "string"
+            ? properties.type
+            : typeof properties.permission === "string"
+                ? properties.permission
+                : undefined;
+    }
+    extractPermissionCommand(properties, metadata) {
+        if (typeof metadata.command === "string") {
+            return metadata.command;
+        }
+        if (typeof metadata.detail === "string") {
+            return metadata.detail;
+        }
+        if (Array.isArray(properties.patterns)) {
+            const patterns = properties.patterns.filter((value) => typeof value === "string");
+            return patterns.length > 0 ? patterns.join(", ") : undefined;
+        }
+        return undefined;
+    }
     handleSessionCreated(properties) {
         if (!isRecord(properties)) {
             return;

package/dist/bridge/bridge-adapters.shared.js

@@ -7,7 +7,7 @@ import { spawn as spawnPty } from "node-pty";
 import { attachLocalCompanionMessageListener, buildLocalCompanionToken, clearLocalCompanionEndpoint, sendLocalCompanionMessage, writeLocalCompanionEndpoint, } from "../companion/local-companion-link.js";
 import { ensureWorkspaceChannelDir } from "../wechat/channel-config.js";
 import { buildClaudeFailureMessage, buildClaudeHookSettings, buildClaudePermissionDecisionHookOutput, buildClaudePermissionApprovalRequest, extractClaudeResumeConversationId, findInjectedClaudePromptIndex, normalizeClaudeAssistantMessage, parseClaudeHookPayload, } from "./claude-hooks.js";
-import { detectCliApproval, isHighRiskShellCommand, normalizeOutput, nowIso, truncatePreview, } from "./bridge-utils.js";
+import { WECHAT_OUTBOUND_ATTACHMENT_DENY_MESSAGE, containsWechatOutboundAttachmentPath, containsWechatOutboundAttachmentPathDeep, detectCliApproval, isWechatOutboundAttachmentWriteCommand, isHighRiskShellCommand, normalizeOutput, nowIso, truncatePreview, } from "./bridge-utils.js";
 import { coerceWebSocketMessageData, describeUnknownError, getCodexRpcRequestId, getLocalCompanionCommandName, getNotificationThreadId, getNotificationTurnId, getSharedSessionIdFromAdapterState, isRecentIsoTimestamp, isRecord, normalizeCodexRpcError, quotePosixCommandArg, quoteWindowsCommandArg, } from "./bridge-adapter-common.js";
 export { coerceWebSocketMessageData, describeUnknownError, getCodexRpcRequestId, getLocalCompanionCommandName, getNotificationThreadId, getNotificationTurnId, getSharedSessionIdFromAdapterState, isRecentIsoTimestamp, isRecord, normalizeCodexRpcError, quotePosixCommandArg, quoteWindowsCommandArg, } from "./bridge-adapter-common.js";
 export const DEFAULT_COLS = 120;
@@ -152,8 +152,220 @@ export function buildCodexApprovalRequest(method, params) {
             commandPreview: truncatePreview(preview, 180),
         };
     }
+    if (method === "item/permissions/requestApproval") {
+        const reason = typeof params.reason === "string" ? params.reason : "";
+        const preview = summarizeCodexPermissionsRequest(params.permissions);
+        return {
+            source: "cli",
+            summary: reason
+                ? `Codex needs approval before granting extra permissions: ${truncatePreview(reason, 160)}`
+                : "Codex needs approval before granting extra permissions.",
+            commandPreview: truncatePreview(preview, 180),
+        };
+    }
+    return null;
+}
+export function getCodexWechatOutboundAttachmentDenyMessage(method, params) {
+    if (!isRecord(params)) {
+        return null;
+    }
+    if (method === "item/commandExecution/requestApproval") {
+        return isWechatOutboundAttachmentWriteCommand(params.command) ||
+            containsWechatOutboundAttachmentPathDeep(params.additionalPermissions)
+            ? WECHAT_OUTBOUND_ATTACHMENT_DENY_MESSAGE
+            : null;
+    }
+    if (method === "item/fileChange/requestApproval") {
+        return containsWechatOutboundAttachmentPath(params.grantRoot)
+            ? WECHAT_OUTBOUND_ATTACHMENT_DENY_MESSAGE
+            : null;
+    }
+    if (method === "item/permissions/requestApproval") {
+        return containsWechatOutboundAttachmentPathDeep(params.permissions)
+            ? WECHAT_OUTBOUND_ATTACHMENT_DENY_MESSAGE
+            : null;
+    }
     return null;
 }
+function commandApprovalAllowsAccept(availableDecisions) {
+    if (!Array.isArray(availableDecisions)) {
+        return true;
+    }
+    return availableDecisions.some((decision) => decision === "accept");
+}
+function normalizePermissionPath(pathValue) {
+    const normalized = pathValue.trim().replace(/\\/g, "/").toLowerCase();
+    return normalized === "/" ? normalized : normalized.replace(/\/+$/g, "");
+}
+function isHighRiskPermissionPath(pathValue) {
+    const normalized = normalizePermissionPath(pathValue);
+    if (!normalized) {
+        return false;
+    }
+    if (normalized === "/" || /^[a-z]:$/i.test(normalized)) {
+        return true;
+    }
+    return /^[a-z]:(?:\/windows|\/program files(?: \(x86\))?|\/programdata)(?:\/|$)/i.test(normalized);
+}
+function collectPermissionPaths(value, output) {
+    if (typeof value === "string") {
+        output.push(value);
+        return;
+    }
+    if (Array.isArray(value)) {
+        for (const item of value) {
+            collectPermissionPaths(item, output);
+        }
+        return;
+    }
+    if (!isRecord(value)) {
+        return;
+    }
+    if (typeof value.path === "string") {
+        output.push(value.path);
+    }
+    if (typeof value.pattern === "string") {
+        output.push(value.pattern);
+    }
+    for (const item of Object.values(value)) {
+        collectPermissionPaths(item, output);
+    }
+}
+function hasRootSpecialPermissionPath(value) {
+    if (Array.isArray(value)) {
+        return value.some(hasRootSpecialPermissionPath);
+    }
+    if (!isRecord(value)) {
+        return false;
+    }
+    if ((value.kind === "root" || value.kind === "Root") ||
+        (value.value === "root" || value.value === "Root")) {
+        return true;
+    }
+    return Object.values(value).some(hasRootSpecialPermissionPath);
+}
+function containsHighRiskPermissionTarget(value) {
+    if (hasRootSpecialPermissionPath(value)) {
+        return true;
+    }
+    const paths = [];
+    collectPermissionPaths(value, paths);
+    return paths.some(isHighRiskPermissionPath);
+}
+export function getCodexApprovalAutoResponse(method, params) {
+    if (method === "item/commandExecution/requestApproval") {
+        const command = typeof params.command === "string" ? params.command : "";
+        if (!commandApprovalAllowsAccept(params.availableDecisions)) {
+            return null;
+        }
+        if (command && isHighRiskShellCommand(command)) {
+            return null;
+        }
+        if (containsHighRiskPermissionTarget(params.additionalPermissions)) {
+            return null;
+        }
+        return {
+            result: { decision: "accept" },
+            reason: command
+                ? `low-risk command ${truncatePreview(command, 120)}`
+                : "low-risk command approval",
+        };
+    }
+    if (method === "item/fileChange/requestApproval") {
+        if (containsHighRiskPermissionTarget(params.grantRoot)) {
+            return null;
+        }
+        return {
+            result: { decision: "accept" },
+            reason: "low-risk file change approval",
+        };
+    }
+    if (method === "item/permissions/requestApproval") {
+        if (containsHighRiskPermissionTarget(params.permissions)) {
+            return null;
+        }
+        return {
+            result: buildCodexPermissionsRequestApprovalResponse(params, "confirm", {
+                strictAutoReview: true,
+            }),
+            reason: "low-risk permission grant",
+        };
+    }
+    return null;
+}
+function collectStringValues(value) {
+    return Array.isArray(value)
+        ? value.filter((item) => typeof item === "string" && item.trim().length > 0)
+        : [];
+}
+function summarizeCodexPermissionsRequest(permissions) {
+    if (!isRecord(permissions)) {
+        return "Additional permissions requested.";
+    }
+    const parts = [];
+    if (isRecord(permissions.network) && permissions.network.enabled === true) {
+        parts.push("network access");
+    }
+    if (isRecord(permissions.fileSystem)) {
+        const readPaths = collectStringValues(permissions.fileSystem.read);
+        const writePaths = collectStringValues(permissions.fileSystem.write);
+        if (readPaths.length > 0) {
+            parts.push(`read: ${readPaths.join(", ")}`);
+        }
+        if (writePaths.length > 0) {
+            parts.push(`write: ${writePaths.join(", ")}`);
+        }
+        if (Array.isArray(permissions.fileSystem.entries) && permissions.fileSystem.entries.length > 0) {
+            parts.push(`filesystem entries: ${permissions.fileSystem.entries.length}`);
+        }
+    }
+    return parts.length > 0 ? parts.join("; ") : "Additional permissions requested.";
+}
+function clonePermissionObject(value) {
+    if (!isRecord(value)) {
+        return null;
+    }
+    return JSON.parse(JSON.stringify(value));
+}
+export function buildCodexPermissionsRequestApprovalResponse(params, action = "deny", options = {}) {
+    const permissions = {};
+    if (action === "confirm" && isRecord(params) && isRecord(params.permissions)) {
+        const network = clonePermissionObject(params.permissions.network);
+        const fileSystem = clonePermissionObject(params.permissions.fileSystem);
+        if (network) {
+            permissions.network = network;
+        }
+        if (fileSystem) {
+            permissions.fileSystem = fileSystem;
+        }
+    }
+    const response = {
+        permissions,
+        scope: "turn",
+    };
+    if (options.strictAutoReview) {
+        response.strictAutoReview = true;
+    }
+    return response;
+}
+export function buildCodexMcpServerElicitationDeclineResponse() {
+    return {
+        action: "decline",
+        content: null,
+        _meta: null,
+    };
+}
+export function buildCodexDynamicToolCallFailureResponse() {
+    return {
+        contentItems: [
+            {
+                type: "inputText",
+                text: "Dynamic tool calls are not supported by the WeChat bridge.",
+            },
+        ],
+        success: false,
+    };
+}
 export function buildCodexUserInputRequest(params) {
     if (!isRecord(params) || !Array.isArray(params.questions)) {
         return null;
@@ -287,6 +499,7 @@ export function shouldRecoverCodexStaleBusyState(params) {
         !params.pendingTurnStart &&
         !params.hasActiveTurn &&
         !params.hasPendingApproval &&
+        !params.hasPendingUserInput &&
         !params.activeTurnId);
 }
 export function shouldAutoCompleteCodexWechatTurnAfterFinalReply(params) {
@@ -295,6 +508,7 @@ export function shouldAutoCompleteCodexWechatTurnAfterFinalReply(params) {
         params.activeTurnOrigin === "wechat" &&
         !params.pendingTurnStart &&
         !params.hasPendingApproval &&
+        !params.hasPendingUserInput &&
         params.hasFinalOutput &&
         !params.hasCompletedTurn &&
         typeof params.lastActivityAtMs === "number" &&

package/dist/bridge/bridge-controller.js

@@ -17,7 +17,9 @@ export class BridgeController {
             this.clearLocalClientEndpoint();
             return;
         }
-        const existing = readLocalCompanionEndpoint(this.cwd);
+        const existing = readLocalCompanionEndpoint(this.cwd, {
+            adapter: endpoint.kind,
+        });
         const adapterState = this.adapter.getState();
         const nextEndpoint = existing?.instanceId === endpoint.instanceId
             ? {
@@ -38,7 +40,9 @@ export class BridgeController {
         writeLocalCompanionEndpoint(nextEndpoint);
     }
     clearLocalClientEndpoint() {
-        clearLocalCompanionEndpoint(this.cwd, this.endpointInstanceId ?? undefined);
+        clearLocalCompanionEndpoint(this.cwd, this.endpointInstanceId ?? undefined, {
+            adapter: this.adapter.getState().kind,
+        });
         this.endpointInstanceId = null;
     }
 }

package/dist/bridge/bridge-utils.js

@@ -16,10 +16,12 @@ const WECHAT_ATTACHMENT_PROMPT_PREFIX = [
     "[WeChat bridge note]",
     "Your final reply will be forwarded back to a WeChat chat.",
     "If the user asks you to send a local file or media to WeChat and you know the local path, do not say that you lack a WeChat sending tool.",
-    "For a real send request, prefer locating and sending the file directly instead of opening or reading it unless the user explicitly asked for that.",
+    "For a real send request, locate the original local file path and reference that path directly in the attachment block.",
+    "Do not create, copy, move, or write files into ~/.claude/channels/wechat, ~/.cli-bridge, or any outbound-attachments directory.",
+    "Do not call Write, cp, copy, xcopy, robocopy, mv, move, or shell redirection to stage outbound files for WeChat.",
     "Put any brief visible reply text first, then end the message with exactly one trailing block like:",
     "```wechat-attachments",
-    "file C:\\Users\\name\\Desktop\\document.pdf",
+    "file C:\\Users\\name\\Desktop\\document.docx",
     "```",
     "Valid kinds: image, file, video, voice.",
     "Use `file` for PDFs and ordinary documents. Only include files you truly intend to upload.",
@@ -27,6 +29,10 @@ const WECHAT_ATTACHMENT_PROMPT_PREFIX = [
     "[User request]",
 ].join("\n");
 const WECHAT_ATTACHMENT_BLOCK_RE = /\n```wechat-attachments[ \t]*\n([\s\S]*?)\n```[ \t]*$/;
+export const WECHAT_OUTBOUND_ATTACHMENT_DENY_MESSAGE = "The WeChat bridge does not use outbound attachment directories. Do not create or copy files under .claude/channels/wechat/outbound-attachments or .cli-bridge/outbound-attachments. To send a file, put the original absolute local file path in the final ```wechat-attachments``` block.";
+const WECHAT_OUTBOUND_ATTACHMENT_PATH_RE = /(?:^|\/)(?:(?:\.claude\/channels\/wechat\/|\.cli-bridge\/)?outbound-attachments)(?:\/|$)/i;
+const WECHAT_OUTBOUND_ATTACHMENT_WRITE_COMMAND_RE = /\b(cp|copy|copy-item|xcopy|robocopy|mv|move|move-item|mkdir|md|new-item|ni|set-content|add-content|out-file|write-output|touch)\b|>\s*["']?[^&|]*outbound-attachments/i;
+const WECHAT_OUTBOUND_ATTACHMENT_MUTATION_TOOL_RE = /^(?:write|edit|multiedit|notebookedit|patch|create|mkdir|move|copy|file[_-]?change|external_directory)$/i;
 const WECHAT_ATTACHMENT_KINDS = ["image", "file", "video", "voice"];
 const INLINE_IMAGE_EXTENSIONS = new Set([
     ".png",
@@ -211,15 +217,88 @@ export function shouldInjectWechatAttachmentPrompt(text) {
         mentionsLocalPath ||
         looksLikeShortSendCommand);
 }
-export function buildWechatInboundPrompt(text) {
-    if (!shouldInjectWechatAttachmentPrompt(text)) {
-        return text;
+export function containsWechatOutboundAttachmentPath(value) {
+    if (typeof value !== "string") {
+        return false;
     }
-    const normalized = normalizeOutput(text).trim();
-    if (!normalized) {
-        return text;
+    const normalized = value.trim().replace(/\\/g, "/");
+    return WECHAT_OUTBOUND_ATTACHMENT_PATH_RE.test(normalized);
+}
+export function containsWechatOutboundAttachmentPathDeep(value) {
+    const seen = new WeakSet();
+    const visit = (candidate) => {
+        if (containsWechatOutboundAttachmentPath(candidate)) {
+            return true;
+        }
+        if (!candidate || typeof candidate !== "object") {
+            return false;
+        }
+        if (seen.has(candidate)) {
+            return false;
+        }
+        seen.add(candidate);
+        if (Array.isArray(candidate)) {
+            return candidate.some((item) => visit(item));
+        }
+        return Object.values(candidate).some((item) => visit(item));
+    };
+    return visit(value);
+}
+export function isWechatOutboundAttachmentWriteCommand(command) {
+    return (typeof command === "string" &&
+        containsWechatOutboundAttachmentPath(command) &&
+        WECHAT_OUTBOUND_ATTACHMENT_WRITE_COMMAND_RE.test(command));
+}
+export function isWechatOutboundAttachmentMutationTool(toolName, targetPath) {
+    return (typeof toolName === "string" &&
+        WECHAT_OUTBOUND_ATTACHMENT_MUTATION_TOOL_RE.test(toolName.trim()) &&
+        containsWechatOutboundAttachmentPath(targetPath));
+}
+function formatPromptByteSize(bytes) {
+    if (bytes === undefined || !Number.isFinite(bytes) || bytes < 0) {
+        return null;
+    }
+    if (bytes >= 1024 * 1024) {
+        return `${(bytes / (1024 * 1024)).toFixed(bytes >= 100 * 1024 * 1024 ? 0 : 1)} MB`;
+    }
+    if (bytes >= 1024) {
+        return `${(bytes / 1024).toFixed(bytes >= 100 * 1024 ? 0 : 1)} KB`;
+    }
+    return `${bytes} B`;
+}
+function formatWechatInboundAttachmentPrompt(attachments) {
+    const lines = [
+        "[WeChat inbound attachments]",
+        "The user sent attachment files through WeChat. They have been saved locally. Read the local paths directly if the user's request requires inspecting them.",
+    ];
+    attachments.forEach((attachment, index) => {
+        const sizeText = formatPromptByteSize(attachment.sizeBytes);
+        const metadata = [
+            `kind=${attachment.kind}`,
+            attachment.fileName ? `name=${attachment.fileName}` : "",
+            sizeText ? `size=${sizeText}` : "",
+        ].filter(Boolean);
+        lines.push(`${index + 1}. ${metadata.join(" ")} path=${attachment.path}`);
+    });
+    return lines.join("\n");
+}
+export function buildWechatInboundPrompt(text, attachments = []) {
+    const trimmedAttachments = attachments.filter((attachment) => attachment.path.trim());
+    if (!trimmedAttachments.length) {
+        if (!shouldInjectWechatAttachmentPrompt(text)) {
+            return text;
+        }
+        const normalized = normalizeOutput(text).trim();
+        if (!normalized) {
+            return text;
+        }
+        return `${WECHAT_ATTACHMENT_PROMPT_PREFIX}\n${normalized}`;
     }
-    return `${WECHAT_ATTACHMENT_PROMPT_PREFIX}\n${normalized}`;
+    const baseText = normalizeOutput(text).trim() || "Received WeChat attachment(s).";
+    const userPrompt = shouldInjectWechatAttachmentPrompt(baseText)
+        ? `${WECHAT_ATTACHMENT_PROMPT_PREFIX}\n${baseText.trim()}`
+        : baseText;
+    return `${userPrompt.trim()}\n\n${formatWechatInboundAttachmentPrompt(trimmedAttachments)}`;
 }
 export function parseWechatFinalReply(text) {
     const normalized = normalizeOutput(text);
@@ -320,7 +399,11 @@ const HIGH_RISK_PATTERNS = [
     /\b(?:invoke-expression|iex)\b/i,
     /\bcurl\b.*\|\s*(?:iex|powershell)\b/i,
     /\binvoke-webrequest\b.*\|\s*(?:iex|powershell)\b/i,
+    /\brm\b\s+/i,
     /\brm\b\s+-[A-Za-z-]*r[A-Za-z-]*/i,
+    /\bfind\b[^\r\n]*\s-delete\b/i,
+    /\bfind\b[^\r\n]*\s-exec\s+(?:rm|rmdir|del|erase|remove-item)\b/i,
+    /\bxargs\b[^\r\n]*\b(?:rm|rmdir|del|erase|remove-item)\b/i,
     /\bsudo\b/i,
     /\bmkfs(?:\.\w+)?\b/i,
     /\bdd\b/i,

package/dist/bridge/claude-hooks.js

@@ -1,4 +1,19 @@
-import { normalizeOutput, truncatePreview } from "./bridge-utils.js";
+import { WECHAT_OUTBOUND_ATTACHMENT_DENY_MESSAGE, containsWechatOutboundAttachmentPath, isHighRiskShellCommand, isWechatOutboundAttachmentWriteCommand, normalizeOutput, truncatePreview, } from "./bridge-utils.js";
+export const CLAUDE_WECHAT_OUTBOUND_ATTACHMENT_DENY_MESSAGE = WECHAT_OUTBOUND_ATTACHMENT_DENY_MESSAGE;
+const FILE_MUTATION_TOOL_NAMES = new Set([
+    "Write",
+    "Edit",
+    "MultiEdit",
+    "NotebookEdit",
+]);
+const LOW_RISK_READ_TOOL_NAMES = new Set([
+    "Glob",
+    "Grep",
+    "LS",
+    "NotebookRead",
+    "Read",
+    "TodoRead",
+]);
 function quoteWindowsCommandArg(value) {
     return `"${value.replace(/"/g, '""')}"`;
 }
@@ -166,14 +181,60 @@ export function buildClaudePermissionApprovalRequest(payload) {
         detailPreview,
     };
 }
-export function buildClaudePermissionDecisionHookOutput(action) {
+function getClaudeToolInputString(payload, key) {
+    const value = payload.tool_input?.[key];
+    return typeof value === "string" ? value : "";
+}
+export function getClaudeWechatOutboundAttachmentDenyMessage(payload) {
+    const toolName = typeof payload.tool_name === "string" ? payload.tool_name.trim() : "";
+    if (!toolName) {
+        return null;
+    }
+    if (FILE_MUTATION_TOOL_NAMES.has(toolName)) {
+        const filePath = getClaudeToolInputString(payload, "file_path");
+        return containsWechatOutboundAttachmentPath(filePath)
+            ? CLAUDE_WECHAT_OUTBOUND_ATTACHMENT_DENY_MESSAGE
+            : null;
+    }
+    if (toolName === "Bash") {
+        const command = getClaudeToolInputString(payload, "command");
+        if (isWechatOutboundAttachmentWriteCommand(command)) {
+            return CLAUDE_WECHAT_OUTBOUND_ATTACHMENT_DENY_MESSAGE;
+        }
+    }
+    return null;
+}
+export function getClaudePermissionAutoResponse(payload) {
+    const toolName = typeof payload.tool_name === "string" ? payload.tool_name.trim() : "";
+    if (!toolName) {
+        return null;
+    }
+    if (LOW_RISK_READ_TOOL_NAMES.has(toolName)) {
+        return {
+            action: "confirm",
+            reason: `low-risk ${toolName} permission`,
+        };
+    }
+    if (toolName !== "Bash") {
+        return null;
+    }
+    const command = getClaudeToolInputString(payload, "command").trim();
+    if (!command || isHighRiskShellCommand(command)) {
+        return null;
+    }
+    return {
+        action: "confirm",
+        reason: `low-risk command ${truncatePreview(command, 120)}`,
+    };
+}
+export function buildClaudePermissionDecisionHookOutput(action, denyMessage = "Permission denied from WeChat bridge.") {
     const decision = action === "confirm"
         ? {
             behavior: "allow",
         }
         : {
             behavior: "deny",
-            message: "Permission denied from WeChat bridge.",
+            message: denyMessage,
             interrupt: false,
         };
     return JSON.stringify({