coding-friend-cli 1.39.0 → 1.40.0

package/dist/{chunk-WJHQUCOF.js → chunk-KTUPGMIV.js}

@@ -1,7 +1,7 @@
 import {
   ensureStatusline,
   getInstalledVersion
-} from "./chunk-4CPUWHIN.js";
+} from "./chunk-Q2QDSYQT.js";
 import {
   ensureShellCompletion
 } from "./chunk-667NMPN4.js";
@@ -9,39 +9,46 @@ import {
   isMemoryMcpRegistered,
   registerMemoryMcp,
   removeMemoryMcpEntry
-} from "./chunk-ZGIUKUL2.js";
+} from "./chunk-CZW36H3D.js";
 import {
   isPluginInstalled
-} from "./chunk-2EY7VVFT.js";
+} from "./chunk-SUYE5S2W.js";
 import {
   CODEX_MARKETPLACE_NAME,
   getCodexInstalledVersion,
+  isCodexMarketplaceLocal,
   isCodexMarketplaceRegistered
-} from "./chunk-JSH6BMVZ.js";
+} from "./chunk-RG3EMZH6.js";
 import {
+  deployAgyPlugin,
   deployOmpAgents,
+  isAgyPluginInstalled,
   isOmpAgentInstalled,
+  readAgyMcpConfig,
+  readAgyPluginVersion,
+  resolveAgyPluginSource,
+  writeAgyMcpEntry,
   writeOmpExtensionEntry
-} from "./chunk-GTOEIGDM.js";
+} from "./chunk-KCBMCHSA.js";
 import {
   resolveHostFlags,
   resolveScope
-} from "./chunk-VMODQCSL.js";
+} from "./chunk-Z5XTSF7L.js";
 import {
   detectHostsAvailable
-} from "./chunk-OFEC6OVI.js";
+} from "./chunk-OBCNHQFA.js";
+import {
+  readJson
+} from "./chunk-5UVDWG5L.js";
 import {
   commandExists,
   run,
   runWithStderr,
   sleepSync
 } from "./chunk-EVGXUDX4.js";
-import {
-  readJson
-} from "./chunk-5UVDWG5L.js";
 import {
   claudeSettingsPath
-} from "./chunk-IV5OPG34.js";
+} from "./chunk-IYBIIRH4.js";
 import {
   log,
   printBanner
@@ -114,13 +121,14 @@ function argvHasAgentFlag() {
   return process.argv.some((a) => a === "--agent" || a.startsWith("--agent="));
 }
 function hasExplicitHost(opts) {
-  if (opts.codex === true || opts.omp === true) return true;
+  if (opts.codex === true || opts.omp === true || opts.agy === true)
+    return true;
   if (argvHasAgentFlag()) return true;
   const agent = opts.agent?.trim().toLowerCase();
-  return agent === "codex" || agent === "omp";
+  return agent === "codex" || agent === "omp" || agent === "agy";
 }
 function flagsForHostResolve(opts) {
-  if (!argvHasAgentFlag() && opts.agent === "claude" && (opts.codex === true || opts.omp === true)) {
+  if (!argvHasAgentFlag() && opts.agent === "claude" && (opts.codex === true || opts.omp === true || opts.agy === true)) {
     return { ...opts, agent: void 0 };
   }
   return opts;
@@ -133,6 +141,8 @@ function isHostInstalled(host) {
       return isCodexMarketplaceRegistered();
     case "omp":
       return isOmpAgentInstalled("user") || isOmpAgentInstalled("project");
+    case "agy":
+      return isAgyPluginInstalled();
   }
 }
 function hostSectionTitle(host) {
@@ -143,11 +153,14 @@ function hostSectionTitle(host) {
       return "Codex";
     case "omp":
       return "omp";
+    case "agy":
+      return "Antigravity";
   }
 }
 async function updateHost(host, opts, mode) {
   if (host === "codex") return updateCodexCommand(opts, mode);
   if (host === "omp") return updateOmpCommand(opts, mode);
+  if (host === "agy") return updateAgyCommand(opts, mode);
   return updateClaudeCommand(opts, mode);
 }
 async function updateCommand(opts) {
@@ -310,7 +323,7 @@ async function updateClaudeCommand(opts, mode) {
   }
   let refreshMemoryAfterUpdate = null;
   if (doCli) {
-    ({ refreshMemoryAfterUpdate } = await import("./memory-CDZKWOFL.js"));
+    ({ refreshMemoryAfterUpdate } = await import("./memory-4NVLWOFS.js"));
     if (!latestCliVersion) {
       log.warn("Cannot check latest CLI version from npm.");
     } else {
@@ -383,6 +396,19 @@ async function updateCodexCommand(opts, mode) {
     );
     if (!commandExists("codex")) {
       log.error("Codex CLI not found. Cannot update Codex plugin.");
+    } else if (isCodexMarketplaceLocal()) {
+      if (beforeVersion) {
+        log.info(
+          "Codex marketplace is a local dev source \u2014 skipping git upgrade (it only works on git marketplaces)."
+        );
+        log.dim(
+          `Codex runs a cached copy at v${beforeVersion}; to pick up working-tree changes, reinstall via Codex \u2192 /plugins.`
+        );
+      } else {
+        log.warn(
+          "Codex marketplace is a local dev source, but coding-friend is not installed yet. Open Codex and run /plugins to install it."
+        );
+      }
     } else {
       log.step("Updating Codex marketplace...");
       const result = runWithStderr("codex", [
@@ -516,6 +542,76 @@ async function updateOmpCommand(opts, mode) {
   console.log();
   log.dim("Restart omp (or start a new session) to see changes.");
 }
+function restoreAgyExtraMcpServers(previous) {
+  if (!previous) return;
+  const current = readAgyMcpConfig();
+  const currentServers = current?.mcpServers ?? {};
+  for (const [name, server] of Object.entries(previous.mcpServers)) {
+    if (!(name in currentServers)) {
+      writeAgyMcpEntry(name, server);
+    }
+  }
+}
+async function updateAgyCommand(opts, mode) {
+  const updateAll = !opts.cli && !opts.plugin && !opts.statusline;
+  const doCli = (updateAll || !!opts.cli) && !mode?.skipCli;
+  const doPlugin = updateAll || !!opts.plugin;
+  if (!mode?.skipBanner) {
+    printBanner("\u2728 Coding Friend Antigravity Update (beta) \u2728");
+    console.log();
+  }
+  if (doPlugin) {
+    try {
+      const previousMcp = readAgyMcpConfig();
+      const beforeVersion = readAgyPluginVersion();
+      console.log(
+        `  Plugin      ${beforeVersion ? beforeVersion : chalk.dim("not installed")}`
+      );
+      const source = resolveAgyPluginSource();
+      log.step(`Updating Antigravity plugin (${source.kind} source)...`);
+      const { files } = deployAgyPlugin(source.path);
+      registerMemoryMcp("agy");
+      restoreAgyExtraMcpServers(previousMcp);
+      const afterVersion = readAgyPluginVersion();
+      const versionPart = afterVersion ? `, v${afterVersion}` : "";
+      log.success(`Antigravity plugin updated (${files} files${versionPart}).`);
+    } catch (error) {
+      const detail = error instanceof Error ? error.message : String(error);
+      log.error(detail);
+    }
+  }
+  if (doCli) {
+    const cliVersion = getCliVersion();
+    const latestCliVersion = getLatestCliVersion();
+    if (!latestCliVersion) {
+      log.warn("Cannot check latest CLI version from npm.");
+    } else {
+      const cmp = semverCompare(cliVersion, latestCliVersion);
+      if (cmp < 0) {
+        log.step(
+          `CLI update available: ${chalk.yellow(`v${cliVersion}`)} \u2192 ${chalk.green(`v${latestCliVersion}`)}`
+        );
+        const result = run("npm", [
+          "install",
+          "-g",
+          "coding-friend-cli@latest"
+        ]);
+        if (result === null) {
+          log.error(
+            "CLI update failed. Try manually: npm install -g coding-friend-cli@latest"
+          );
+        } else {
+          log.success(`CLI updated to ${chalk.green(`v${latestCliVersion}`)}`);
+        }
+      }
+    }
+  }
+  if (opts.statusline) {
+    log.warn("Antigravity does not use the Claude statusline. Skipping.");
+  }
+  console.log();
+  log.dim("Restart Antigravity (or start a new `agy` session) to see changes.");
+}
 
 export {
   semverCompare,

package/dist/{chunk-7JQZRMOG.js → chunk-NIMO4VJW.js}

@@ -1,32 +1,52 @@
 import {
+  readAgyMcpConfig,
   readOmpMcpJson,
+  removeAgyMcpEntry,
   removeOmpMcpEntry,
+  writeAgyMcpEntry,
   writeOmpMcpEntry
-} from "./chunk-GTOEIGDM.js";
+} from "./chunk-KCBMCHSA.js";
 import {
   runWithStderr
 } from "./chunk-EVGXUDX4.js";
 import {
   resolvePath
-} from "./chunk-IV5OPG34.js";
+} from "./chunk-IYBIIRH4.js";
 import {
   log
 } from "./chunk-NREZK463.js";
 
 // src/lib/learn-prompts.ts
 var MCP_NAME = "coding-friend-learn";
+function learnServer(resolvedDir) {
+  return {
+    command: "npx",
+    args: ["-y", "coding-friend-cli", "mcp-serve-learn", resolvedDir]
+  };
+}
 function hasOmpLearnEntry() {
   const data = readOmpMcpJson();
   return data !== null && MCP_NAME in data.mcpServers;
 }
+function hasAgyLearnEntry() {
+  const data = readAgyMcpConfig();
+  return data !== null && MCP_NAME in data.mcpServers;
+}
 function registerLearnMcp(learnDir, host = "claude") {
   const resolved = resolvePath(learnDir);
   if (host === "omp") {
     try {
-      writeOmpMcpEntry(MCP_NAME, {
-        command: "npx",
-        args: ["-y", "coding-friend-cli", "mcp-serve-learn", resolved]
-      });
+      writeOmpMcpEntry(MCP_NAME, learnServer(resolved));
+      return true;
+    } catch (error) {
+      const detail = error instanceof Error ? error.message : "unknown error";
+      log.warn(`Could not register MCP: ${detail}`);
+      return false;
+    }
+  }
+  if (host === "agy") {
+    try {
+      writeAgyMcpEntry(MCP_NAME, learnServer(resolved));
       return true;
     } catch (error) {
       const detail = error instanceof Error ? error.message : "unknown error";
@@ -63,6 +83,7 @@ function registerLearnMcp(learnDir, host = "claude") {
 }
 function isLearnMcpRegistered(host = "claude") {
   if (host === "omp") return hasOmpLearnEntry();
+  if (host === "agy") return hasAgyLearnEntry();
   const result = runWithStderr("claude", ["mcp", "get", MCP_NAME]);
   return result.exitCode === 0;
 }
@@ -77,6 +98,16 @@ function unregisterLearnMcp(host = "claude") {
       return false;
     }
   }
+  if (host === "agy") {
+    try {
+      removeAgyMcpEntry(MCP_NAME);
+      return !hasAgyLearnEntry();
+    } catch (error) {
+      const detail = error instanceof Error ? error.message : "unknown error";
+      log.warn(`Could not unregister MCP: ${detail}`);
+      return false;
+    }
+  }
   const result = runWithStderr("claude", [
     "mcp",
     "remove",

package/dist/{chunk-OFEC6OVI.js → chunk-OBCNHQFA.js}

@@ -6,37 +6,63 @@ import {
 // src/lib/host.ts
 var CODEX_MIN_VERSION = "0.130.0";
 var OMP_MIN_VERSION = "0.1.0";
+var AGY_MIN_VERSION = "1.1.0";
 function detectHostsAvailable() {
   const hosts = [];
   if (commandExists("claude")) hosts.push("claude");
   if (commandExists("codex")) hosts.push("codex");
   if (commandExists("omp")) hosts.push("omp");
+  if (commandExists("agy")) hosts.push("agy");
   return hosts;
 }
 function resolveHost(opts = {}) {
   const agent = opts.agent?.trim().toLowerCase();
   const codexAlias = opts.codex === true;
   const ompAlias = opts.omp === true;
-  if (agent && agent !== "claude" && agent !== "codex" && agent !== "omp") {
+  const agyAlias = opts.agy === true;
+  if (agent && agent !== "claude" && agent !== "codex" && agent !== "omp" && agent !== "agy") {
     throw new Error(
-      `Unsupported agent "${opts.agent}". Use "claude", "codex", or "omp".`
+      `Unsupported agent "${opts.agent}". Use "claude", "codex", "omp", or "agy".`
     );
   }
   if (codexAlias && ompAlias) {
     throw new Error("Use either --codex or --omp, not both.");
   }
+  if (agyAlias && codexAlias) {
+    throw new Error("Use either --agy or --codex, not both.");
+  }
+  if (agyAlias && ompAlias) {
+    throw new Error("Use either --agy or --omp, not both.");
+  }
   if (codexAlias && agent === "claude") {
     throw new Error("Use either --agent claude or --codex, not both.");
   }
   if (ompAlias && agent === "claude") {
     throw new Error("Use either --agent claude or --omp, not both.");
   }
+  if (agyAlias && agent === "claude") {
+    throw new Error("Use either --agent claude or --agy, not both.");
+  }
   if (ompAlias && agent === "codex") {
     throw new Error("Use either --agent codex or --omp, not both.");
   }
+  if (agyAlias && agent === "codex") {
+    throw new Error("Use either --agent codex or --agy, not both.");
+  }
   if (codexAlias && agent === "omp") {
     throw new Error("Use either --agent omp or --codex, not both.");
   }
+  if (agyAlias && agent === "omp") {
+    throw new Error("Use either --agent omp or --agy, not both.");
+  }
+  if (codexAlias && agent === "agy") {
+    throw new Error("Use either --agent agy or --codex, not both.");
+  }
+  if (ompAlias && agent === "agy") {
+    throw new Error("Use either --agent agy or --omp, not both.");
+  }
+  if (agyAlias) return "agy";
+  if (agent === "agy") return "agy";
   if (ompAlias) return "omp";
   if (agent === "omp") return "omp";
   if (codexAlias) return "codex";
@@ -49,6 +75,9 @@ function getCodexMinVersion() {
 function getOmpMinVersion() {
   return OMP_MIN_VERSION;
 }
+function getAgyMinVersion() {
+  return AGY_MIN_VERSION;
+}
 function checkCodexVersion() {
   const min = getCodexMinVersion();
   const output = run("codex", ["--version"]);
@@ -69,6 +98,16 @@ function checkOmpVersion() {
     min
   };
 }
+function checkAgyVersion() {
+  const min = getAgyMinVersion();
+  const output = run("agy", ["--version"]);
+  const actual = output ? extractVersion(output) : void 0;
+  return {
+    ok: actual ? compareVersions(actual, min) >= 0 : false,
+    actual,
+    min
+  };
+}
 function extractVersion(input) {
   return input.match(/\b(\d+\.\d+\.\d+)\b/)?.[1];
 }
@@ -95,5 +134,6 @@ export {
   resolveHost,
   checkCodexVersion,
   checkOmpVersion,
+  checkAgyVersion,
   compareVersions
 };

package/dist/{chunk-4CPUWHIN.js → chunk-Q2QDSYQT.js}

@@ -12,7 +12,7 @@ import {
   globalConfigPath,
   installedPluginsPath,
   pluginCachePath
-} from "./chunk-IV5OPG34.js";
+} from "./chunk-IYBIIRH4.js";
 
 // src/lib/statusline.ts
 import { existsSync, readdirSync } from "fs";

package/dist/{chunk-JSH6BMVZ.js → chunk-RG3EMZH6.js}

@@ -2,7 +2,7 @@ import {
   codexAgentsDir,
   codexConfigTomlPath,
   codexInstalledPluginsPath
-} from "./chunk-IV5OPG34.js";
+} from "./chunk-IYBIIRH4.js";
 
 // src/lib/codex-config.ts
 import {
@@ -97,6 +97,15 @@ function isCodexMarketplaceRegistered(configPath = codexConfigTomlPath()) {
     (line) => line.trim() === tableHeader(`marketplaces.${CODEX_MARKETPLACE_NAME}`)
   );
 }
+function isCodexMarketplaceLocal(configPath = codexConfigTomlPath()) {
+  const table = getTable(
+    readToml(configPath),
+    `marketplaces.${CODEX_MARKETPLACE_NAME}`
+  );
+  return table.some(
+    (line) => /^\s*source_type\s*=\s*["']local["']\s*(?:#.*)?$/.test(line)
+  );
+}
 function setCodexPluginEnabled(enabled, configPath = codexConfigTomlPath()) {
   const content = readToml(configPath);
   writeToml(
@@ -225,6 +234,7 @@ function deployCodexAgents(sourceDir, targetDir = codexAgentsDir()) {
 export {
   CODEX_MARKETPLACE_NAME,
   isCodexMarketplaceRegistered,
+  isCodexMarketplaceLocal,
   setCodexPluginEnabled,
   isCodexPluginDisabled,
   removeCodexMemoryMcpConfig,

package/dist/{chunk-2EY7VVFT.js → chunk-SUYE5S2W.js}

@@ -8,7 +8,7 @@ import {
   claudeSettingsPath,
   installedPluginsPath,
   knownMarketplacesPath
-} from "./chunk-IV5OPG34.js";
+} from "./chunk-IYBIIRH4.js";
 
 // src/lib/plugin-state.ts
 var MARKETPLACE_NAME = "coding-friend-marketplace";

package/dist/{chunk-YPW67OGP.js → chunk-TFF47F7P.js}

@@ -1,6 +1,6 @@
 import {
   isMemoryMcpRegistered
-} from "./chunk-ZGIUKUL2.js";
+} from "./chunk-CZW36H3D.js";
 import {
   readJson
 } from "./chunk-5UVDWG5L.js";

package/dist/{chunk-ZZNTNIM4.js → chunk-TN3Y75WG.js}

@@ -1,9 +1,9 @@
 import {
   compareVersions
-} from "./chunk-OFEC6OVI.js";
+} from "./chunk-OBCNHQFA.js";
 import {
   pluginCachePath
-} from "./chunk-IV5OPG34.js";
+} from "./chunk-IYBIIRH4.js";
 
 // src/lib/lib-path.ts
 import { existsSync, readdirSync } from "fs";

package/dist/{chunk-VMODQCSL.js → chunk-Z5XTSF7L.js}

@@ -1,16 +1,16 @@
 import {
   resolveHost
-} from "./chunk-OFEC6OVI.js";
-import {
-  run
-} from "./chunk-EVGXUDX4.js";
+} from "./chunk-OBCNHQFA.js";
 import {
   readJson
 } from "./chunk-5UVDWG5L.js";
+import {
+  run
+} from "./chunk-EVGXUDX4.js";
 import {
   globalConfigPath,
   localConfigPath
-} from "./chunk-IV5OPG34.js";
+} from "./chunk-IYBIIRH4.js";
 import {
   log
 } from "./chunk-NREZK463.js";

package/dist/{clean-LPWEBJJ5.js → clean-PKSSS662.js}

@@ -1,13 +1,13 @@
 import {
   loadConfig,
   resolveMemoryDir
-} from "./chunk-FQUIO5BW.js";
+} from "./chunk-E4NBTQXR.js";
 import "./chunk-3WIZA5OZ.js";
-import "./chunk-EVGXUDX4.js";
 import "./chunk-5UVDWG5L.js";
+import "./chunk-EVGXUDX4.js";
 import {
   resolvePath
-} from "./chunk-IV5OPG34.js";
+} from "./chunk-IYBIIRH4.js";
 import {
   log,
   printBanner

package/dist/{config-VNSC2NAY.js → config-2CH4GI2L.js}

@@ -1,13 +1,14 @@
 import {
+  afterAutoApproveEnabled,
   getAllRules,
   getExistingRules
-} from "./chunk-463QKRBN.js";
+} from "./chunk-KG6HYBGD.js";
 import {
   listMdFilesRecursive
 } from "./chunk-2DTXVMPQ.js";
 import {
   resolveLearnDir
-} from "./chunk-FQUIO5BW.js";
+} from "./chunk-E4NBTQXR.js";
 import {
   findStatuslineHookPath,
   getCurrentAccountEmail,
@@ -18,7 +19,7 @@ import {
   saveStatuslineConfig,
   selectStatuslineComponents,
   writeStatuslineSettings
-} from "./chunk-4CPUWHIN.js";
+} from "./chunk-Q2QDSYQT.js";
 import {
   ALL_COMPONENT_IDS,
   DEFAULT_CONFIG
@@ -26,7 +27,7 @@ import {
 import {
   registerLearnMcp,
   unregisterLearnMcp
-} from "./chunk-7JQZRMOG.js";
+} from "./chunk-NIMO4VJW.js";
 import {
   ensureShellCompletion,
   hasShellCompletion,
@@ -34,8 +35,8 @@ import {
 } from "./chunk-667NMPN4.js";
 import {
   memoryConfigMenu
-} from "./chunk-ZGIUKUL2.js";
-import "./chunk-GTOEIGDM.js";
+} from "./chunk-CZW36H3D.js";
+import "./chunk-KCBMCHSA.js";
 import {
   BACK,
   applyDocsDirChange,
@@ -45,22 +46,21 @@ import {
   getScopeLabel,
   injectBackChoice,
   showConfigHint
-} from "./chunk-VMODQCSL.js";
-import "./chunk-ZZNTNIM4.js";
-import "./chunk-OFEC6OVI.js";
-import "./chunk-EVGXUDX4.js";
+} from "./chunk-Z5XTSF7L.js";
+import "./chunk-TN3Y75WG.js";
+import "./chunk-OBCNHQFA.js";
 import {
   mergeJson,
   readJson
 } from "./chunk-5UVDWG5L.js";
+import "./chunk-EVGXUDX4.js";
 import {
   claudeLocalSettingsPath,
-  claudeProjectSettingsPath,
   claudeSettingsPath,
   globalConfigPath,
   localConfigPath,
   resolvePath
-} from "./chunk-IV5OPG34.js";
+} from "./chunk-IYBIIRH4.js";
 import {
   log,
   printBanner
@@ -536,29 +536,32 @@ async function editAutoApprove(globalCfg, localCfg) {
     log.dim(`Current: ${currentValue}`);
   }
   const value = await confirm({
-    message: "Enable auto-approve? (auto-approves read-only tools + working-dir file edits, LLM classifier for unknowns)",
+    message: "Enable auto-approve? (Claude: LLM classifier; Antigravity/Codex: deterministic rules, no LLM)",
     default: currentValue ?? false
   });
   const scope = await askScope();
   if (scope === "back") return;
   writeToScope(scope, { autoApprove: value });
   if (value) {
-    const { runDangerousRulesAudit } = await import("./permissions-HZYUVKCY.js");
-    await runDangerousRulesAudit(
-      [
-        claudeProjectSettingsPath(),
-        claudeLocalSettingsPath(),
-        claudeSettingsPath()
-      ],
+    await afterAutoApproveEnabled(
       log,
       (message) => confirm({ message, default: true })
     );
-    log.dim(
-      "Tip: Fine-tune with autoApproveAllowExtra / autoApproveIgnore in config.json"
-    );
-    log.dim("Docs: https://cf.dinhanhthi.com/docs/reference/auto-approve/");
   }
 }
+async function editPrivacyBlock(globalCfg, localCfg) {
+  const currentValue = getMergedValue("privacyBlock", globalCfg, localCfg);
+  if (currentValue !== void 0) {
+    log.dim(`Current: ${currentValue}`);
+  }
+  const value = await confirm({
+    message: "Keep privacy-block enabled? (deny .env / credentials / keys)",
+    default: currentValue !== false
+  });
+  const scope = await askScope();
+  if (scope === "back") return;
+  writeToScope(scope, { privacyBlock: value });
+}
 async function editStatusline() {
   const hookResult = findStatuslineHookPath();
   if (!hookResult) {
@@ -739,7 +742,7 @@ async function editPermissions() {
     )
   });
   if (choice === BACK) return;
-  const { permissionCommand } = await import("./permission-DPKPA2HU.js");
+  const { permissionCommand } = await import("./permission-L5QMNMID.js");
   switch (choice) {
     case "interactive":
       await permissionCommand({});
@@ -774,6 +777,16 @@ async function configCommand() {
       globalCfg,
       localCfg
     );
+    const privacyBlockScope = getScopeLabel(
+      "privacyBlock",
+      globalCfg,
+      localCfg
+    );
+    const privacyBlockVal = getMergedValue(
+      "privacyBlock",
+      globalCfg,
+      localCfg
+    );
     const reviewScope = getScopeLabel("review", globalCfg, localCfg);
     const withCodexVal = getMergedValue("review", globalCfg, localCfg)?.withCodex;
     const planDocsScope = getScopeLabel("disableGUIPlan", globalCfg, localCfg);
@@ -820,7 +833,12 @@ async function configCommand() {
           {
             name: `Auto-approve ${formatScopeLabel(autoApproveScope)}${autoApproveVal !== void 0 ? ` (${autoApproveVal})` : ""}`,
             value: "autoApprove",
-            description: "  Auto-approve safe tool calls, block destructive ones, prompt for ambiguous"
+            description: "  Claude: LLM classifier; Antigravity/Codex: deterministic rules"
+          },
+          {
+            name: `Privacy-block ${formatScopeLabel(privacyBlockScope)}${privacyBlockVal !== void 0 ? ` (${privacyBlockVal})` : ""}`,
+            value: "privacyBlock",
+            description: "  Block reads of .env, keys, and similar secrets (all hosts)"
           },
           {
             name: `Codex dual-review ${formatScopeLabel(reviewScope)}${withCodexVal !== void 0 ? ` (${withCodexVal})` : ""}`,
@@ -878,6 +896,9 @@ async function configCommand() {
       case "autoApprove":
         await editAutoApprove(globalCfg, localCfg);
         break;
+      case "privacyBlock":
+        await editPrivacyBlock(globalCfg, localCfg);
+        break;
       case "review":
         await editReviewWithCodex(globalCfg, localCfg);
         break;