agent-from-zero 0.39.0 → 0.39.2

package/README.md

@@ -97,6 +97,18 @@ auto 模式下，改当前项目、其他 git 仓库或临时目录里的文件
 
 也可以在确认弹窗里选 "Yes, and trust …/ for this session"，只对本次会话有效。家目录本身和 `/` 不能被信任，`settings.json` 本身永远要你确认。
 
+### prod 保护（permissions.ask）
+
+`permissions.ask` 里列的文字，只要出现在命令或文件路径里，就一定要你确认（不区分大小写，按子串匹配）。auto 审核和 `--dangerously-skip-permissions` 都不能替你放行：
+
+```json
+{
+  "permissions": { "ask": ["--context prod", "cipherowl-aws-prod", "terraform apply"] }
+}
+```
+
+排查 prod 问题时，往往一连串命令都带着同一个标记（比如每条查询都用 `AWS_PROFILE=cipherowl-aws-prod`）。auto 模式下，确认弹窗里可以选 "Yes, and let auto review handle … commands this session"：本次会话里，命中这些规则的命令不再强制找你，改为交给 auto 审核逐条判断。只读的直接执行，删除、部署这类做了就回不去的仍然会问你。这个放行只在 auto 模式下有效，关掉 auto 或用 `--dangerously-skip-permissions` 运行时都会恢复每次确认。
+
 ### 换别的模型
 
 和 API key 放在同一个地方，设置这三个变量就行，各家的 base URL 写在 [.env.example](.env.example) 里：

package/dist/agent.js

@@ -442,7 +442,7 @@ async function main() {
     // Fail closed: in a non-interactive session nobody can say yes, so the
     // answer is no. MINI_AGENT_AUTO_APPROVE=1 bypasses the QUESTION, but hard
     // denies were already enforced in permissions.ts before we get here.
-    const confirm = async (question, toolName, trustDir) => {
+    const confirm = async (question, toolName, offer) => {
         console.log(chalk.yellow(`\n⚠ approval needed — ${question}`)); // always show what is being asked
         if (!autoMode.enabled && process.env.MINI_AGENT_AUTO_APPROVE === "1") {
             console.log(chalk.dim("  auto-approved (MINI_AGENT_AUTO_APPROVE=1)")); // bypass mode — say so out loud
@@ -454,8 +454,8 @@ async function main() {
         }
         // Selecting beats typing: ↑/↓ + Enter instead of "type y/N". The middle
         // option lets the user stop being asked about this tool (or, in auto mode,
-        // this outside directory) for the session.
-        const menu = approvalMenu(autoMode.enabled, toolName, trustDir);
+        // this outside directory or these prod-guard rules) for the session.
+        const menu = approvalMenu(autoMode.enabled, toolName, offer);
         const { approved, granted } = menu.choose(await select(menu.options));
         if (granted)
             console.log(chalk.dim(`  ${granted}`));
@@ -532,6 +532,9 @@ async function main() {
         }
         apply(models[choice]); // picker is session-only too; "/model save <name>" to persist
     };
+    // The login link for /mcp auth. This REPL waits on the login, so a browser on
+    // another machine (SSH) gets its redirect here through curl, run on this one.
+    const showAuthUrl = (url) => console.log(chalk.dim(`authenticate in your browser: ${url}\n  browser on another machine (SSH)? after authorizing, run here in another terminal: curl '<the address it lands on>'`));
     // /mcp — list configured MCP servers + status, then manage one (like Claude Code).
     const mcpStatusText = (status) => status === "connected" ? chalk.green("connected") : status === "needs-auth" ? chalk.yellow("needs auth") : status === "failed" ? chalk.red("failed") : status === "pending" ? chalk.dim("connecting…") : chalk.dim("disabled");
     const handleMcpCommand = async (arg) => {
@@ -546,7 +549,7 @@ async function main() {
             const name = parts.slice(1).join(" ");
             const action = MCP_SUBCOMMANDS[parts[0]];
             try {
-                console.log(chalk.dim(await runMcpAction(name, action, (url) => console.log(chalk.dim(`authenticate in your browser: ${url}`)))));
+                console.log(chalk.dim(await runMcpAction(name, action, showAuthUrl)));
             }
             catch (err) {
                 console.log(chalk.yellow(err.message));
@@ -578,7 +581,7 @@ async function main() {
             return;
         }
         try {
-            console.log(chalk.dim(await runMcpAction(server.name, actions[actionChoice].action, (url) => console.log(chalk.dim(`authenticate in your browser: ${url}`)))));
+            console.log(chalk.dim(await runMcpAction(server.name, actions[actionChoice].action, showAuthUrl)));
         }
         catch (err) {
             console.log(chalk.yellow(err.message));

package/dist/ink/app.js

@@ -44,7 +44,7 @@ import { detailPage, summarizeActivity } from "./activity.js";
 import { useTerminalSize } from "./viewport.js";
 import { makeInkSink } from "./sink.js"; // turns the loop's output into React state
 import { runInfoCommand, mcpStatusText } from "./commands.js"; // the non-interactive slash commands + /mcp status
-import { listMcpServers, MCP_SUBCOMMANDS, mcpActionsFor, mcpProblems, mcpServerDetails, reloadMcpServers, runMcpAction } from "../mcp.js"; // /mcp: list + per-server actions
+import { listMcpServers, MCP_SUBCOMMANDS, mcpActionsFor, mcpProblems, mcpServerDetails, reloadMcpServers, runMcpAction, oauthLoginPending, cancelOAuthLogins, deliverOAuthRedirect } from "../mcp.js"; // /mcp: list + per-server actions, and the login that waits for its browser
 // Injected when plan mode turns on, so the model knows the rules it now lives in.
 const PLAN_MODE_NOTICE = `[plan mode ON] Investigate this request using only read-only tools — read_file, search, and safe read-only shell (ls, cat, git status). Do NOT write files, edit, or run mutating commands; the permission gate will block them. When you have a concrete, ordered plan, call the exit_plan_mode tool with that plan. The user reviews and approves it before you make any change.`;
 // No ✳ (U+2733): it has an emoji presentation, and terminals that honour it draw
@@ -279,8 +279,8 @@ export function App({ session, runTurn, clipboard }) {
         const hooks = {
             images: attachments,
             output: sink,
-            confirm: (question, toolName, trustDir) => new Promise((resolve) => {
-                const menu = approvalMenu(autoMode.enabled, toolName, trustDir); // same choices and session grants as the readline REPL
+            confirm: (question, toolName, offer) => new Promise((resolve) => {
+                const menu = approvalMenu(autoMode.enabled, toolName, offer); // same choices and session grants as the readline REPL
                 openSelect(`⚠ approval needed — ${question}`, menu.options, (i) => {
                     const { approved, granted } = menu.choose(i);
                     note(`${chalk.yellow("⚠ approval")} — ${question.split("\n")[0]} → ${approved ? chalk.green("✓ approved") : chalk.yellow("✗ declined")}${granted ? chalk.dim(` (${granted})`) : ""}`);
@@ -508,6 +508,16 @@ export function App({ session, runTurn, clipboard }) {
     const submitLine = async (draft, attachments = [], immediate = false) => {
         peerTurns.current = 0; // a human is here: peers may start turns again
         peerHoldNoted.current = false;
+        // An MCP login is waiting for its browser redirect: what you submit is the
+        // address the browser landed on, or nothing for the model yet.
+        if (oauthLoginPending()) {
+            const got = deliverOAuthRedirect(pastedTexts.expand(draft));
+            if (got === "delivered")
+                return note(chalk.dim("(got the authorization redirect — finishing the login…)"));
+            return note(chalk.yellow(got === "stale"
+                ? "That address belongs to another login attempt — paste the one from this login, or Esc to cancel."
+                : "An MCP login is waiting: paste the address the browser landed on (http://localhost:…/callback?code=…), or Esc to cancel."));
+        }
         // Talk mode: plain text goes to the chosen session, even while this agent works.
         if (talkTo && !pending && !draft.startsWith("/")) {
             const text = pastedTexts.expand(draft);
@@ -617,6 +627,25 @@ export function App({ session, runTurn, clipboard }) {
         current.controller.abort();
         note(chalk.dim("(interrupting the current step to process your follow-up)"));
     };
+    // Run one /mcp action. A login waits for its browser redirect (up to 5
+    // minutes): say so on the spinner line, let Esc cancel it, and accept the
+    // redirected address pasted into the input box — the way in when the browser
+    // runs on another machine (SSH), where localhost is not this one.
+    const runMcpUi = async (name, action) => {
+        setBusy(true);
+        if (action === "authenticate")
+            setStatus(`Waiting for ${name} to authorize in the browser · paste the address it lands on here, or Esc to cancel`);
+        try {
+            note(chalk.dim(await runMcpAction(name, action, (url) => note(chalk.dim(`authenticate in your browser: ${url}\n  browser on another machine (SSH)? after authorizing, paste the address it lands on (http://localhost:…/callback?code=…) here and press Enter`)))));
+        }
+        catch (err) {
+            note(chalk.yellow(err.message));
+        }
+        finally {
+            setBusy(false);
+            setStatus(null);
+        }
+    };
     // Handle a /slash command. Returns true if the line was a command (handled).
     // /mcp — list configured servers + status, then pick one to manage it.
     const handleMcpCommand = async (arg) => {
@@ -635,19 +664,7 @@ export function App({ session, runTurn, clipboard }) {
         }
         // Direct subcommands (scriptable, matching Claude Code): /mcp reconnect|auth|enable|disable <name>
         if (parts.length >= 2 && MCP_SUBCOMMANDS[parts[0]]) {
-            const name = parts.slice(1).join(" ");
-            setBusy(true);
-            try {
-                const action = MCP_SUBCOMMANDS[parts[0]];
-                const msg = await runMcpAction(name, action, (url) => note(chalk.dim(`authenticate in your browser: ${url}`)));
-                note(chalk.dim(msg));
-            }
-            catch (err) {
-                note(chalk.yellow(err.message));
-            }
-            finally {
-                setBusy(false);
-            }
+            await runMcpUi(parts.slice(1).join(" "), MCP_SUBCOMMANDS[parts[0]]);
             return;
         }
         const servers = listMcpServers();
@@ -664,11 +681,7 @@ export function App({ session, runTurn, clipboard }) {
             openSelect(`${server.name} MCP Server`, actions.map((a) => a.label), (j) => {
                 if (j < 0)
                     return note(chalk.dim("(cancelled)"));
-                setBusy(true);
-                runMcpAction(server.name, actions[j].action, (url) => note(chalk.dim(`authenticate in your browser: ${url}`)))
-                    .then((msg) => note(chalk.dim(msg)))
-                    .catch((err) => note(chalk.yellow(err.message)))
-                    .finally(() => setBusy(false));
+                void runMcpUi(server.name, actions[j].action);
             }, mcpServerDetails(server)); // Claude Code's server screen: status, auth, protocol, URL, config, capabilities, tools
         });
     };
@@ -992,6 +1005,10 @@ export function App({ session, runTurn, clipboard }) {
             statusRequest.current.abort();
             return;
         }
+        if (key.escape && oauthLoginPending()) {
+            cancelOAuthLogins();
+            return;
+        } // a /mcp login waiting for its browser
         if (key.escape && talkTo && !pending && !input) {
             setTalkTo(null);
             note(chalk.dim(`(back to this agent — no longer talking to "${talkTo.name}")`));
@@ -1136,6 +1153,16 @@ export function App({ session, runTurn, clipboard }) {
         }
         // Ink 5 strips the leading ESC from CSI-u / modifyOtherKeys sequences.
         if (key.return || modifiedReturn) {
+            // A /mcp login waits for its browser redirect: the UI is busy, but what
+            // you submit is the address the browser landed on (submitLine takes it).
+            if (oauthLoginPending()) {
+                const text = input.trim();
+                setInput("");
+                setCursor(0);
+                if (text)
+                    void submitLine(text);
+                return;
+            }
             if (submitting.current || (busy && !turn.current))
                 return;
             const immediate = key.ctrl || modifiedReturn;
@@ -1348,5 +1375,5 @@ export function App({ session, runTurn, clipboard }) {
                                 }
                                 return (_jsxs(Box, { children: [i === 0 && _jsx(Text, { color: promptColor, children: prompt }), _jsx(Text, { children: paint(line, lineStarts[i] ?? 0, "l") })] }, i));
                             });
-                        })() })), completion.view, rows >= 20 && busy && !details && !selectedAgent && !pending && _jsx(Text, { dimColor: true, wrap: "truncate-end", children: "Enter queue follow-up \u00B7 Ctrl+Enter interrupt and send now" }), rows >= 20 && !details && !selectedAgent && !pending && !completion.visible && _jsx(AgentList, { agents: agents, focus: subAgentFocus, viewing: subAgentDetail, mainBusy: busy, maxRows: Math.max(2, Math.min(3, rows - 24)) }), _jsxs(Box, { justifyContent: "space-between", children: [_jsx(Box, { flexShrink: 1, children: _jsx(StatusBar, { model: CONFIG.model, dir: dir, branch: branch, status: getStatus() }) }), _jsx(McpBadge, {})] }), (planMode || autoEnabled || CONFIG.bypassPermissions) && (_jsxs(Text, { wrap: "truncate-end", children: [_jsx(Text, { color: planMode ? "magenta" : CONFIG.bypassPermissions ? "red" : "yellow", children: planMode ? "⏸ plan mode on" : CONFIG.bypassPermissions ? "▶▶ bypass permissions on" : "▶▶ auto mode on" }), _jsx(Text, { dimColor: true, children: planMode ? " (/plan to toggle)" : CONFIG.bypassPermissions ? " (this run)" : " (/auto to toggle)" })] }))] })] }));
+                        })() })), completion.view, rows >= 20 && busy && !details && !selectedAgent && !pending && !oauthLoginPending() && _jsx(Text, { dimColor: true, wrap: "truncate-end", children: "Enter queue follow-up \u00B7 Ctrl+Enter interrupt and send now" }), rows >= 20 && !details && !selectedAgent && !pending && !completion.visible && _jsx(AgentList, { agents: agents, focus: subAgentFocus, viewing: subAgentDetail, mainBusy: busy, maxRows: Math.max(2, Math.min(3, rows - 24)) }), _jsxs(Box, { justifyContent: "space-between", children: [_jsx(Box, { flexShrink: 1, children: _jsx(StatusBar, { model: CONFIG.model, dir: dir, branch: branch, status: getStatus() }) }), _jsx(McpBadge, {})] }), (planMode || autoEnabled || CONFIG.bypassPermissions) && (_jsxs(Text, { wrap: "truncate-end", children: [_jsx(Text, { color: planMode ? "magenta" : CONFIG.bypassPermissions ? "red" : "yellow", children: planMode ? "⏸ plan mode on" : CONFIG.bypassPermissions ? "▶▶ bypass permissions on" : "▶▶ auto mode on" }), _jsx(Text, { dimColor: true, children: planMode ? " (/plan to toggle)" : CONFIG.bypassPermissions ? " (this run)" : " (/auto to toggle)" })] }))] })] }));
 }

package/dist/loop.js

@@ -772,7 +772,7 @@ async function authorizeCall(call, opts) {
             if (preview)
                 sink(opts).note(preview.replace(/^/gm, agentIndent(opts)));
         }
-        const ok = autoAllowed || (!(auto && opts.canPrompt === false) && await opts.confirm(`${call.name} (${v.reason}):\n   ${v.summary}${reviewReason ? `\n   ${reviewReason}` : ""}`, call.name, v.trustDir));
+        const ok = autoAllowed || (!(auto && opts.canPrompt === false) && await opts.confirm(`${call.name} (${v.reason}):\n   ${v.summary}${reviewReason ? `\n   ${reviewReason}` : ""}`, call.name, { trustDir: v.trustDir, guardRules: v.guardRules }));
         // Every human prompt in auto mode is an interruption worth counting, with
         // where it came from: the reviewer asked ("review", joinable by reviewId),
         // a doubt outlived the agent's retries ("escalated"), or a rule required a

package/dist/mcp.js

@@ -37,6 +37,10 @@ import { emit } from "./telemetry.js"; // observability
 const INIT_TIMEOUT_MS = 15_000; // a server that doesn't initialize in 15s is skipped
 const CALL_TIMEOUT_MS = 60_000; // a single tool call may take this long
 const OAUTH_CALLBACK_TIMEOUT_MS = 5 * 60_000; // how long the local callback waits for the browser
+// A startup connect that dies on the network (a dropped TLS handshake through a
+// proxy, a timeout, a blip) is retried after these pauses before the server is
+// marked failed; it shows as "connecting…" meanwhile. Mutable for the tests.
+export const MCP_CONNECT_RETRY = { delaysMs: [2_000, 5_000, 10_000] };
 const PROTOCOL_VERSION = "2024-11-05"; // the MCP revision we speak in the handshake
 const CLIENT_INFO = { name: "mini-agent", version: "0" }; // who we say we are in the handshake
 // Thrown when an HTTP MCP server answers 401 — the caller marks the server as
@@ -59,6 +63,15 @@ export class NeedsAuthError extends Error {
         }
     }
 }
+// The request never reached the server or its answer never came back: no
+// connection, a dropped TLS handshake, a timeout. Unlike an error the server
+// returns, trying again later can succeed.
+export class McpNetworkError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = "McpNetworkError";
+    }
+}
 // ---- stdio transport: one JSON object per line, to a subprocess --------------
 class StdioTransport {
     child;
@@ -268,7 +281,11 @@ class HttpTransport {
         catch (err) {
             if (err instanceof NeedsAuthError)
                 throw err; // propagate so the registry can mark needs-auth
-            return { id: payload.id, error: { message: `MCP HTTP request '${payload.method}' failed: ${err.message}` } };
+            // fetch says only "fetch failed"; the reason (UND_ERR_CONNECT_TIMEOUT,
+            // ECONNRESET, ENOTFOUND…) is on its cause, and it is what you need to know.
+            const cause = err.cause;
+            const why = cause?.code ?? cause?.message;
+            return { id: payload.id, error: { message: `MCP HTTP request '${payload.method}' failed: ${err.message}${why ? ` (${why})` : ""}`, network: true } };
         }
     }
     notify(method, params) {
@@ -312,7 +329,7 @@ class McpClient {
     async start() {
         const init = await this.request("initialize", { protocolVersion: PROTOCOL_VERSION, capabilities: {}, clientInfo: CLIENT_INFO }, INIT_TIMEOUT_MS);
         if (init.error)
-            throw new Error(init.error.message); // server refused to initialize
+            throw init.error.network ? new McpNetworkError(init.error.message) : new Error(init.error.message); // unreachable, or the server refused to initialize
         this.protocolVersion = init.result?.protocolVersion;
         this.capabilities = Object.keys(init.result?.capabilities ?? {});
         this.transport.notify("notifications/initialized", {}); // tell the server we're ready
@@ -325,7 +342,7 @@ class McpClient {
     async listTools() {
         const list = await this.request("tools/list", {}, INIT_TIMEOUT_MS);
         if (list.error)
-            throw new Error(list.error.message);
+            throw list.error.network ? new McpNetworkError(list.error.message) : new Error(list.error.message);
         return list.result?.tools ?? [];
     }
     // Invoke one tool and flatten its content into plain text for the model.
@@ -355,9 +372,17 @@ const registry = new Map();
 // scratch path so a fake server's tokens never land in the real store).
 const OAUTH_STORE_PATH = process.env.MINI_AGENT_OAUTH_STORE || path.join(os.homedir(), ".config", "mini-agent", "mcp-oauth.json");
 const expiryFrom = (t) => (typeof t.expires_in === "number" ? Date.now() + t.expires_in * 1000 : undefined);
+// The file holds bearer tokens, so only its owner may read it (0600): set on
+// every write, and tightened on read for a store created before this rule or
+// copied over from another machine.
 function readOAuthStore() {
     try {
-        return JSON.parse(fs.readFileSync(OAUTH_STORE_PATH, "utf8"));
+        const store = JSON.parse(fs.readFileSync(OAUTH_STORE_PATH, "utf8"));
+        try {
+            fs.chmodSync(OAUTH_STORE_PATH, 0o600);
+        }
+        catch { /* not ours to fix (read-only mount) — still usable */ }
+        return store;
     }
     catch {
         return {};
@@ -365,7 +390,8 @@ function readOAuthStore() {
 }
 function writeOAuthStore(store) {
     fs.mkdirSync(path.dirname(OAUTH_STORE_PATH), { recursive: true });
-    fs.writeFileSync(OAUTH_STORE_PATH, JSON.stringify(store, null, 2) + "\n");
+    fs.writeFileSync(OAUTH_STORE_PATH, JSON.stringify(store, null, 2) + "\n", { mode: 0o600 });
+    fs.chmodSync(OAUTH_STORE_PATH, 0o600); // mode applies only when the file is created
 }
 const oauthStore = readOAuthStore();
 function base64url(input) {
@@ -475,8 +501,48 @@ export async function discoverOAuth(serverUrl, challenge = {}) {
 // DCR case, where we register whatever we got); a fixed port is what a
 // pre-registered client demands. The code promise is armed on creation, BEFORE
 // the browser opens, so a fast callback can't race us.
+// Logins waiting for their browser redirect, by OAuth state. The loopback
+// listener is one way in; a pasted redirect address is the other, for a browser
+// on another machine (SSH, a remote box) whose "localhost" is not this one.
+const waitingLogins = new Map();
+export const oauthLoginPending = () => waitingLogins.size > 0;
+// Esc while a login waits: give up on it (the flow rejects, its listener closes).
+export function cancelOAuthLogins() {
+    for (const login of [...waitingLogins.values()])
+        login.cancel();
+}
+// The user pasted the address the browser landed on — on its own, or inside a
+// sentence ("curl this: http://localhost:37831/callback?code=…"). Hand it to the
+// login waiting for its state, exactly as if the browser had reached us.
+// "stale": a callback address no waiting login owns (an older attempt, a typo);
+// "none": no callback address in the text at all.
+export function deliverOAuthRedirect(text) {
+    const found = /(?:https?:\/\/)?(?:localhost|127\.0\.0\.1|\[::1\])(?::\d+)?\/callback\?[^\s"'<>]+/.exec(text);
+    if (!found)
+        return "none";
+    let url;
+    try {
+        url = new URL(found[0].replace(/[)\]}。，、；,;!！?？]+$/, "").replace(/^(?!https?:\/\/)/, "http://")); // trailing sentence punctuation is not part of it
+    }
+    catch {
+        return "none";
+    }
+    const login = waitingLogins.get(url.searchParams.get("state") ?? "");
+    if (!login)
+        return "stale";
+    login.accept(url);
+    return "delivered";
+}
 async function listenForCallback(port, state) {
     let settle;
+    // The redirect's verdict, however it arrives (the browser, or a pasted address).
+    const accept = (url) => {
+        const code = url.searchParams.get("code");
+        if (code)
+            settle?.resolve(code);
+        else
+            settle?.reject(new Error(`OAuth callback did not include a code: ${url.searchParams.get("error_description") ?? url.searchParams.get("error") ?? "unknown error"}`));
+    };
     const handler = (req, res) => {
         const url = new URL(req.url ?? "/", "http://localhost");
         res.setHeader("connection", "close"); // one-shot listener: a kept-alive socket would deliver a LATER flow's callback (same fixed port) to this dead handler
@@ -486,13 +552,7 @@ async function listenForCallback(port, state) {
         res.end("<h1>Connected</h1><p>You can close this window and return to the terminal.</p>");
         // Settle only once the page has been flushed: settling tears the servers
         // down, and tearing down before the write lands would blank the browser tab.
-        res.once("finish", () => {
-            const code = url.searchParams.get("code");
-            if (code)
-                settle?.resolve(code);
-            else
-                settle?.reject(new Error(`OAuth callback did not include a code: ${url.searchParams.get("error_description") ?? url.searchParams.get("error") ?? "unknown error"}`));
-        });
+        res.once("finish", () => accept(url));
     };
     const v4 = createServer(handler);
     const bound = await new Promise((resolve, reject) => {
@@ -508,6 +568,7 @@ async function listenForCallback(port, state) {
         v6.listen(bound, "::1", () => resolve());
     });
     const close = () => {
+        waitingLogins.delete(state);
         // Release the port for real: close() alone leaves open sockets alive, and a
         // pre-registered client's next flow needs the SAME port back immediately.
         for (const s of [v4, v6]) {
@@ -525,6 +586,7 @@ async function listenForCallback(port, state) {
             reject: (e) => (clearTimeout(timer), close(), reject(e)),
         };
     });
+    waitingLogins.set(state, { accept, cancel: () => settle?.reject(new Error("Authorization cancelled")) });
     return { port: bound, close, code };
 }
 // Run the OAuth authorization-code flow for an HTTP server: PKCE always;
@@ -688,8 +750,10 @@ function markNeedsAuth(name, challenge) {
 }
 // Connect a single configured server and register its tools. Updates the
 // registry with the live status. Used by connectMcpServers() at startup and by
-// /mcp reconnect / enable / auth.
-async function connectOne(name, retried = false, quiet = false) {
+// /mcp reconnect / enable / auth. `retryDelays`: pauses before retrying a
+// network failure (background startup only — an explicit /mcp action answers
+// at once, and its user can simply run it again).
+async function connectOne(name, retried = false, quiet = false, retryDelays = []) {
     const entry = entryFor(name);
     const attempt = {}; // this connect's identity (see the guard after the handshake)
     entry.attempt = attempt;
@@ -735,6 +799,17 @@ async function connectOne(name, retried = false, quiet = false) {
                 return connectOne(name, true, quiet);
             markNeedsAuth(name, err);
         }
+        else if (err instanceof McpNetworkError && retryDelays.length) {
+            // Unreachable this time: stay "connecting" and try again shortly, unless
+            // the user disabled or reconnected it meanwhile (a newer attempt).
+            entry.status = "pending";
+            entry.error = err.message;
+            await new Promise((resolve) => setTimeout(resolve, retryDelays[0]).unref());
+            const now = registry.get(name); // re-read: /mcp may have changed it while we waited
+            if (now !== entry || now.attempt !== attempt || now.status === "disabled")
+                return;
+            return connectOne(name, retried, quiet, retryDelays.slice(1));
+        }
         else {
             entry.status = "failed";
             entry.error = err.message;
@@ -800,7 +875,7 @@ export async function connectMcpServers(options = {}) {
         for (const name of entries)
             entryFor(name).status = "pending";
         for (const name of entries)
-            void connectOne(name, false, true); // fire and forget; connectOne never throws
+            void connectOne(name, false, true, MCP_CONNECT_RETRY.delaysMs); // fire and forget; connectOne never throws
     }
     else {
         for (const name of entries)

package/dist/permissions.js

@@ -468,14 +468,27 @@ export function recoverableShell(command) {
 // Text that always needs a human: a prod context, a deployment verb, a prod
 // path. Checked BEFORE auto review and BEFORE the bypass rewrite, so neither
 // can approve it. Case-insensitive substring, on the whole command or the path.
-function guardHit(text) {
+//
+// Investigating prod means many commands carrying the same marker (every query
+// under AWS_PROFILE=cipherowl-aws-prod), so in auto mode the human may release
+// the rules a command matched, for the rest of the session. A released rule no
+// longer forces a human: its commands go to auto review one by one, which
+// still asks for anything irreversible. Only auto mode honours a release: the
+// default mode has no reviewer behind it, and bypass has nothing at all.
+const releasedGuards = new Set();
+export function releaseGuards(rules) {
+    for (const rule of rules)
+        releasedGuards.add(rule.toLowerCase());
+    emit("agent_guard_released", { rules: rules.join(",") });
+}
+// Every rule the text matches that still needs a human (all of them, so one
+// approval can release them together rather than one prompt per rule).
+function guardHits(text, auto) {
     const haystack = text.toLowerCase();
-    for (const rule of CONFIG.permissions.ask ?? []) {
-        if (rule && haystack.includes(rule.toLowerCase()))
-            return rule;
-    }
-    return null;
+    const honourReleases = auto && !CONFIG.bypassPermissions;
+    return (CONFIG.permissions.ask ?? []).filter((rule) => rule && haystack.includes(rule.toLowerCase()) && !(honourReleases && releasedGuards.has(rule.toLowerCase())));
 }
+const guardVerdict = (rules, summary) => ({ decision: "ask", requiresHuman: true, reason: `prod guard: ${rules.map((r) => `"${r}"`).join(", ")}`, summary, guardRules: rules });
 // Decide what a bash command deserves: deny, ask, or allow.
 function checkBash(command, auto = false) {
     const summary = command.trim(); // what the user will see in the prompt
@@ -492,9 +505,9 @@ function checkBash(command, auto = false) {
     for (const d of user.deny)
         if (command.toLowerCase().includes(d.toLowerCase()))
             return { decision: "deny", reason: `denied by your settings ("${d}")`, summary };
-    const guard = guardHit(command);
-    if (guard)
-        return { decision: "ask", requiresHuman: true, reason: `prod guard: "${guard}"`, summary };
+    const guards = guardHits(command, auto);
+    if (guards.length)
+        return guardVerdict(guards, summary);
     // node/npm/npx, git aliases and tool-wide grants can run arbitrary code.
     // Auto mode must inspect the actual command, including background commands.
     if (auto) {
@@ -690,9 +703,9 @@ function basePermission(toolName, argsJson, auto) {
             const hit = noFlyHit(p); // is it in the no-fly zone?
             if (hit)
                 return { decision: "deny", reason: hit, summary: p }; // hard stop — deny always wins
-            const guard = guardHit(p); // the user's prod guard, applied to the path
-            if (guard)
-                return { decision: "ask", requiresHuman: true, reason: `prod guard: "${guard}"`, summary: p };
+            const guards = guardHits(p, auto); // the user's prod guard, applied to the path
+            if (guards.length)
+                return guardVerdict(guards, p);
             // The user may pre-approve write tools ("tool:edit_file") to skip the
             // prompt — note this runs AFTER the no-fly check, so it widens "ask",
             // never "deny".
@@ -717,7 +730,8 @@ function basePermission(toolName, argsJson, auto) {
             // upgrades an ASK to ALLOW — but a hard DENY (rm -rf /, .git, .env…) always
             // stands. Convenience never overrides the no-fly rules. A grant for either
             // shell tool covers the other: the command is what was vouched for.
-            if (!auto && verdict.decision === "ask" && (CONFIG.permissions.allow.includes(`tool:${toolName}`) || CONFIG.permissions.allow.includes("tool:run_bash"))) {
+            // Nor a prod-guard ask: that one needs a human every time, grant or not.
+            if (!auto && verdict.decision === "ask" && !verdict.requiresHuman && (CONFIG.permissions.allow.includes(`tool:${toolName}`) || CONFIG.permissions.allow.includes("tool:run_bash"))) {
                 return { decision: "allow", reason: "bash pre-approved for this session", summary: verdict.summary };
             }
             return verdict;
@@ -772,15 +786,11 @@ function resolveFileTarget(target) {
     }
     return path.join(fs.realpathSync(current), ...missing);
 }
-// ---- The approval menu ----------------------------------------------------------
-// Both frontends (readline and Ink) offer the same choices and apply the same
-// session grant, so the menu lives next to the rules it widens. Outside auto
-// mode the grant is "don't ask again for this tool"; in auto mode it is "trust
-// this directory", offered only for an outside write. The last option is always
-// "No", and so is -1 (Esc). `granted` is the note to show after a grant.
-export function approvalMenu(auto, toolName, trustDir) {
+export function approvalMenu(auto, toolName, offer = {}) {
+    const { trustDir, guardRules } = offer;
+    const rules = guardRules?.map((r) => `"${r}"`).join(", ");
     const grant = auto
-        ? (trustDir ? `Yes, and trust ${trustDir}/ for this session` : null)
+        ? (trustDir ? `Yes, and trust ${trustDir}/ for this session` : rules ? `Yes, and let auto review handle ${rules} commands this session` : null)
         : (toolName ? `Yes, and don't ask again for ${toolName} this session` : "Yes, and don't ask again this session");
     const options = [auto ? "Yes, once" : "Yes", ...(grant ? [grant] : []), "No — let me tell the agent what to do instead"];
     const choose = (i) => {
@@ -792,6 +802,10 @@ export function approvalMenu(auto, toolName, trustDir) {
             CONFIG.autoMode.trustedDirs.push(trustDir);
             return { approved: true, granted: `trusting ${trustDir}/ for this session` };
         }
+        if (auto && guardRules?.length) {
+            releaseGuards(guardRules);
+            return { approved: true, granted: `${rules} commands go to auto review for the rest of this session` };
+        }
         if (!toolName)
             return { approved: true };
         CONFIG.permissions.allow.push(`tool:${toolName}`); // "don't ask again" → session allowlist

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "agent-from-zero",
-  "version": "0.39.0",
+  "version": "0.39.2",
   "type": "module",
   "bin": {
     "mini-agent": "dist/agent.js"