deepseeker-code 1.0.58 → 1.0.59

package/dist/cli.mjs

@@ -119,13 +119,16 @@ var init_strings = __esm({
         planEditTitle: "\u270F\uFE0F \u7F16\u8F91\u65B9\u6848",
         planEditHint: "Enter \u6309\u6B64\u65B9\u6848\u6267\u884C \xB7 Esc \u53D6\u6D88\u56DE\u5230\u9009\u9879",
         planKeepPlanning: "\u270B \u5DF2\u7559\u5728\u8BA1\u5212\u6A21\u5F0F\uFF1A\u7EE7\u7EED\u8F93\u5165\u8865\u5145\u8981\u6C42\uFF0C\u6A21\u578B\u5C06\u4FEE\u8BA2\u65B9\u6848\u540E\u518D\u6B21\u63D0\u4EA4\uFF08/plan \u53EF\u9000\u51FA\uFF09\u3002",
+        planNoProposal: "\u2139\uFE0F \u672C\u8F6E\u672A\u6536\u5230\u65B9\u6848\uFF08\u6A21\u578B\u672A\u63D0\u4EA4 exit_plan_mode\uFF09\uFF0C\u4ECD\u5728\u8BA1\u5212\u6A21\u5F0F\uFF1A\u53EF\u7EE7\u7EED\u63CF\u8FF0\u9700\u6C42\uFF0C\u6216 /plan \u5173\u95ED\u8BA1\u5212\u6A21\u5F0F\u3002",
         planEditEmpty: "\u65B9\u6848\u4E0D\u80FD\u4E3A\u7A7A",
         planAutoExecute: "\u26A1 \u5DF2\u8FDB\u5165\u81EA\u52A8\u6267\u884C\uFF1A\u5B9E\u73B0\u9636\u6BB5\u5DE5\u5177\u5C06\u514D\u5BA1\u6279\u76F4\u63A5\u8FD0\u884C\u3002",
         inputBadgePlan: "plan mode on\uFF08\u53EA\u8BFB\u8C03\u7814 \u2192 \u65B9\u6848\u5BA1\u6279 \u2192 \u5B9E\u73B0\uFF09",
         inputBadgeAuto: "auto-accept edits on",
         approvalTitle: "\u{1F510} \u64CD\u4F5C\u5BA1\u6279",
         approvalPrompt: "\u2191\u2193 \u9009\u62E9\u540E Enter\uFF08Esc \u62D2\u7EDD\uFF09\uFF1A\u5141\u8BB8\u672C\u6B21 / \u603B\u662F\u5141\u8BB8\uFF08\u5199\u6301\u4E45\u89C4\u5219\uFF09/ \u62D2\u7EDD\u3002",
+        approvalFullHint: "\uFF08\u6309 f \u67E5\u770B/\u6536\u8D77\u5B8C\u6574\u5185\u5BB9\uFF09",
         approvalAllow: "\u5141\u8BB8\u672C\u6B21",
+        approvalAllowSession: "\u672C\u4F1A\u8BDD\u5185\u5141\u8BB8\uFF08\u4E0D\u843D\u76D8\uFF09",
         approvalAllowAlways: "\u603B\u662F\u5141\u8BB8\uFF08\u6B64\u9879\u76EE\uFF09",
         approvalDeny: "\u62D2\u7EDD",
         errAborted: "\u5DF2\u4E2D\u6B62\u5F53\u524D\u8F6E\u3002",
@@ -191,6 +194,17 @@ ${dim}  \u8FD0\u884C npm i -g deepseeker-code@latest \u66F4\u65B0${reset}
         forkEmpty: "\uFF08\u5F53\u524D\u4F1A\u8BDD\u6682\u65E0\u53EF\u5206\u53C9\u7684\u68C0\u67E5\u70B9\uFF09",
         forkDone: (id, roundNo) => `\u5DF2\u4ECE\u7B2C ${roundNo} \u8F6E\u5206\u53C9 \u2192 \u65B0\u4F1A\u8BDD ${id}\uFF08\u5DF2\u8F7D\u5165\uFF0C\u540E\u7EED\u5BF9\u8BDD\u5199\u5165\u65B0\u4F1A\u8BDD\uFF0C\u539F\u4F1A\u8BDD\u4E0D\u53D8\uFF09`,
         forkFailed: (e) => `\u5206\u53C9\u5931\u8D25\uFF1A${e}`,
+        cmdUndo: "\u64A4\u9500\u6700\u8FD1\u4E00\u6B21\u6587\u4EF6\u6539\u52A8\uFF08LIFO \u9010\u6B65\u56DE\u8D70\uFF1B\u56DE\u9000\u524D\u81EA\u52A8\u5907\u4EFD\uFF0C\u53EF\u9006\uFF09",
+        undoNoSession: "\u5F53\u524D\u6CA1\u6709\u6D3B\u52A8\u4F1A\u8BDD\uFF0C\u65E0\u53EF\u56DE\u9000\u9879\u3002",
+        cmdRewind: "\u6309\u68C0\u67E5\u70B9\u9009\u62E9\u56DE\u9000\u6587\u4EF6\u6539\u52A8\uFF08\u2191\u2193 \u9009\u62E9\uFF0CEnter \u56DE\u9000\uFF09",
+        rewindTitle: "\u23EA \u56DE\u9000\u6587\u4EF6\u6539\u52A8\uFF08\u2191\u2193 \u9009\u62E9 \xB7 Enter \u56DE\u9000 \xB7 Esc \u53D6\u6D88\uFF09",
+        rewindPrompt: "\u2191\u2193 \u9009\u62E9 \xB7 Enter \u56DE\u9000 \xB7 Esc \u53D6\u6D88",
+        rewindNoSession: "\u5F53\u524D\u6CA1\u6709\u6D3B\u52A8\u4F1A\u8BDD\uFF0C\u65E0\u53EF\u56DE\u9000\u9879\u3002",
+        rewindEmpty: "\u5F53\u524D\u4F1A\u8BDD\u6CA1\u6709\u53EF\u56DE\u9000\u7684\u6587\u4EF6\u6539\u52A8\u3002",
+        rewindFail: (e) => `\u56DE\u9000\u5931\u8D25\uFF1A${e}`,
+        cmdDiff: "\u672C run \u6587\u4EF6\u6539\u52A8\u7EA2\u7EFF\u6C47\u603B\uFF08\u5907\u4EFD vs \u5F53\u524D\u78C1\u76D8\u7684\u51C0\u53D8\u5316\uFF09",
+        diffTitle: "\u{1F4C4} \u672C run \u6587\u4EF6\u6539\u52A8\u6C47\u603B",
+        diffEmpty: "\u672C run \u6CA1\u6709\u6587\u4EF6\u6539\u52A8\u8BB0\u5F55\uFF08\u6539\u5B8C\u4E00\u8F6E\u540E\u518D\u8BD5 /diff\uFF09\u3002",
         modelUsage: (current) => `\u5F53\u524D\u6A21\u578B\uFF1A${current || "\u9ED8\u8BA4\uFF08DEEP_SEEK_MODEL\uFF09"}
 \u7528\u6CD5\uFF1A/model <\u6A21\u578Bid> \u76F4\u8F93\u5207\u6362\uFF0C\u6216 /switch \u5F39\u51FA\u5019\u9009\u9009\u62E9\u5668`,
         modelPickerTitle: (current) => `\u{1F9E0} \u9009\u62E9\u6A21\u578B\uFF08\u5F53\u524D\uFF1A${current || "\u9ED8\u8BA4"}\uFF09`,
@@ -263,6 +277,9 @@ ${s}`,
           "/sessions  \u2014 \u9009\u62E9\u5E76\u8F7D\u5165\u5386\u53F2\u4F1A\u8BDD\uFF08\u7EED\u63A5\u5BF9\u8BDD\uFF09",
           "/new       \u2014 \u5F00\u542F\u65B0\u4F1A\u8BDD\uFF08\u65E7\u4F1A\u8BDD\u4FDD\u7559\uFF0C/sessions \u53EF\u627E\u56DE\uFF09",
           "/fork      \u2014 \u4ECE\u5F53\u524D\u4F1A\u8BDD\u7684\u67D0\u8F6E\u56DE\u590D\u5904\u5206\u53C9\u51FA\u65B0\u4F1A\u8BDD",
+          "/undo      \u2014 \u64A4\u9500\u6700\u8FD1\u4E00\u6B21\u6587\u4EF6\u6539\u52A8\uFF08\u81EA\u52A8\u5907\u4EFD\uFF0C\u53EF\u9006\uFF09",
+          "/rewind    \u2014 \u6309\u68C0\u67E5\u70B9\u9009\u62E9\u56DE\u9000\u6587\u4EF6\u6539\u52A8\uFF08\u2191\u2193 \u9009\u62E9\uFF09",
+          "/diff      \u2014 \u672C run \u6587\u4EF6\u6539\u52A8\u7EA2\u7EFF\u6C47\u603B",
           "/trust  \u2014 \u7BA1\u7406\u5DF2\u4FE1\u4EFB\u76EE\u5F55\uFF08\u9879\u76EE\u7EA7 hooks/skills \u7B49\u4EC5\u5728\u4FE1\u4EFB\u76EE\u5F55\u52A0\u8F7D\uFF1BCI \u7528 --trust \u663E\u5F0F\u4FE1\u4EFB\uFF09",
           "Ctrl+C \u9000\u51FA \xB7 Esc \u4E2D\u6B62/\u6E05\u8F93\u5165 \xB7 Ctrl+G \u4E2D\u6B62 \xB7 Ctrl+T \u5C55\u5F00/\u6536\u8D77\u601D\u8003"
         ].join("\n"),
@@ -301,13 +318,16 @@ ${s}`,
         planEditTitle: "\u270F\uFE0F Edit plan",
         planEditHint: "Enter to implement with this plan \xB7 Esc back to options",
         planKeepPlanning: "\u270B Staying in plan mode: add feedback and the plan will be revised and resubmitted (/plan to exit).",
+        planNoProposal: "\u2139\uFE0F No plan was proposed this turn (exit_plan_mode not called) \u2014 still in plan mode: keep describing the task, or /plan to exit.",
         planEditEmpty: "Plan cannot be empty",
         planAutoExecute: "\u26A1 Auto-run: implementation tools will execute without approval.",
         inputBadgePlan: "plan mode on (read-only research \u2192 approve \u2192 implement)",
         inputBadgeAuto: "auto-accept edits on",
         approvalTitle: "\u{1F510} Action approval",
         approvalPrompt: "\u2191\u2193 then Enter (Esc to deny): allow once / always allow (persist rule) / deny.",
+        approvalFullHint: "(f to view/collapse full content)",
         approvalAllow: "Allow once",
+        approvalAllowSession: "Allow for this session (in-memory)",
         approvalAllowAlways: "Always allow (this project)",
         approvalDeny: "Deny",
         errAborted: "Aborted current turn.",
@@ -373,6 +393,17 @@ ${dim}  Run npm i -g deepseeker-code@latest to update${reset}
         forkEmpty: "(no checkpoints to fork from in this session)",
         forkDone: (id, roundNo) => `Forked from round ${roundNo} \u2192 new session ${id} (loaded; new messages go to the fork, source untouched)`,
         forkFailed: (e) => `Fork failed: ${e}`,
+        cmdUndo: "Undo the most recent file change (LIFO, repeatable; reverse-backed-up, reversible)",
+        undoNoSession: "No active session \u2014 nothing to undo.",
+        cmdRewind: "Rewind file changes \u2014 pick a checkpoint from the list",
+        rewindTitle: "\u23EA Rewind file changes (\u2191\u2193 select \xB7 Enter rewind \xB7 Esc cancel)",
+        rewindPrompt: "\u2191\u2193 select \xB7 Enter rewind \xB7 Esc cancel",
+        rewindNoSession: "No active session \u2014 nothing to rewind.",
+        rewindEmpty: "No rewindable file changes in this session.",
+        rewindFail: (e) => `Rewind failed: ${e}`,
+        cmdDiff: "Red/green summary of file changes in this run (backup vs current disk)",
+        diffTitle: "\u{1F4C4} File changes in this run",
+        diffEmpty: "No file changes recorded in this run (try /diff after a turn with edits).",
         modelUsage: (current) => `Current model: ${current || "default (DEEP_SEEK_MODEL)"}
 Usage: /model <model-id> to switch directly, or /switch for the picker`,
         modelPickerTitle: (current) => `\u{1F9E0} Pick a model (current: ${current || "default"})`,
@@ -445,6 +476,9 @@ ${s}`,
           "/sessions  \u2014 Pick a past session to resume",
           "/new       \u2014 Start a new session (old ones remain via /sessions)",
           "/fork      \u2014 Fork the current session from a past round",
+          "/undo      \u2014 Undo the most recent file change (auto-backed-up, reversible)",
+          "/rewind    \u2014 Rewind file changes \u2014 pick a checkpoint from the list",
+          "/diff      \u2014 Red/green summary of file changes in this run",
           "/trust  \u2014 Manage trusted dirs (project hooks/skills load only when trusted; CI uses --trust)",
           "Ctrl+C exit \xB7 Esc abort/clear input \xB7 Ctrl+G abort \xB7 Ctrl+T toggle thinking"
         ].join("\n"),
@@ -465,7 +499,7 @@ ${s}`,
     S = new Proxy({}, {
       get: (_t, k) => typeof k === "string" ? STRINGS[locale][k] : void 0
     });
-    LOCAL_COMMAND_NAMES = ["help", "status", "plan", "auto", "model", "switch", "thinking", "lang", "output-style", "new", "sessions", "fork", "usage", "budget", "context", "permissions", "mcp", "hooks", "trust", "debug", "clear", "exit"];
+    LOCAL_COMMAND_NAMES = ["help", "status", "plan", "auto", "model", "switch", "thinking", "lang", "output-style", "new", "sessions", "fork", "undo", "usage", "rewind", "diff", "budget", "context", "permissions", "mcp", "hooks", "trust", "debug", "clear", "exit"];
   }
 });
 
@@ -474,18 +508,31 @@ var config_exports = {};
 __export(config_exports, {
   ENGINE_OVERRIDE_KEYS: () => ENGINE_OVERRIDE_KEYS,
   ENV_SOURCES: () => ENV_SOURCES,
+  MODEL_WINDOWS: () => MODEL_WINDOWS,
   appConfig: () => appConfig,
-  configSources: () => configSources
+  configSources: () => configSources,
+  deriveWorkspaceKey: () => deriveWorkspaceKey,
+  resolveModelWindow: () => resolveModelWindow
 });
 import path3 from "path";
 import os3 from "os";
 import { readFileSync as readFileSync3 } from "fs";
 import { createHash } from "crypto";
-var _DataDir, appConfig, ENV_SOURCES, configSources, ENGINE_OVERRIDE_VALIDATORS, ENGINE_OVERRIDE_KEYS, applyEngineOverrides;
+var _DataDir, deriveWorkspaceKey, appConfig, MODEL_WINDOWS, resolveModelWindow, ENV_SOURCES, configSources, ENGINE_OVERRIDE_VALIDATORS, ENGINE_OVERRIDE_KEYS, applyEngineOverrides;
 var init_config = __esm({
   "../core/src/config/index.ts"() {
     "use strict";
     _DataDir = process.env.DEEPSEEKER_CODE_DATA_DIR ? path3.resolve(process.env.DEEPSEEKER_CODE_DATA_DIR) : path3.join(os3.homedir(), ".deepseeker-code");
+    deriveWorkspaceKey = (dir) => {
+      let cwd = path3.resolve(dir).replace(/\\/g, "/");
+      if (/^[a-z]:/i.test(cwd)) {
+        cwd = cwd.charAt(0).toUpperCase() + cwd.slice(1);
+      }
+      const currentFolder = path3.basename(cwd);
+      const parentFolder = path3.basename(path3.dirname(cwd));
+      const hash = createHash("sha256").update(cwd).digest("hex").slice(0, 8);
+      return `${parentFolder}-${currentFolder}-${hash}`;
+    };
     appConfig = {
       dataDir: _DataDir,
       maxReasoningRounds: 3,
@@ -513,16 +560,7 @@ var init_config = __esm({
        *  env RUN_COMMAND_AUTO_BG_MS 覆盖。勿把 IDLE 调到高于 DEEP_SEEK_STREAM_IDLE_TIMEOUT_MS
        *  （空闲分支到期会产出降级消息喂流，不会饿死 collectToolResult 的 idle 熔断）。 */
       runCommandAutoBgMs: Number(process.env.RUN_COMMAND_AUTO_BG_MS) || 12e4,
-      userWorkspaceDir: (() => {
-        let cwd = process.cwd().replace(/\\/g, "/");
-        if (/^[a-z]:/i.test(cwd)) {
-          cwd = cwd.charAt(0).toUpperCase() + cwd.slice(1);
-        }
-        const currentFolder = path3.basename(cwd);
-        const parentFolder = path3.basename(path3.dirname(cwd));
-        const hash = createHash("sha256").update(cwd).digest("hex").slice(0, 8);
-        return `${parentFolder}-${currentFolder}-${hash}`;
-      })(),
+      userWorkspaceDir: deriveWorkspaceKey(process.cwd()),
       traceRetentionDays: 7,
       /** Undo（文件回退）总开关：false 时跳过所有写前备份，紧急降级用。 */
       undoEnabled: true,
@@ -588,6 +626,12 @@ var init_config = __esm({
        *  行为与改造前一致。env DEEP_SEEK_HOOK_REWRITE=0 回退。 */
       hookRewrite: process.env.DEEP_SEEK_HOOK_REWRITE !== "0"
     };
+    MODEL_WINDOWS = {};
+    resolveModelWindow = (model) => {
+      const id = model?.trim();
+      const hit = id ? MODEL_WINDOWS[id] : void 0;
+      return typeof hit === "number" && hit > 0 ? hit : appConfig.MAX_HISTORY_TOKENS;
+    };
     ENV_SOURCES = {
       dataDir: "DEEPSEEKER_CODE_DATA_DIR",
       searchProvider: "SEARCH_PROVIDER",
@@ -1132,10 +1176,10 @@ var init_batchStrings = __esm({
         const money = c.costYuan !== null ? `\xA5${c.costYuan.toFixed(4)}` : "\uFF08\u65E0\u4EF7\u6A21\u578B\uFF0C\u4E0D\u8BA1\u94B1\uFF09";
         const hit = c.promptTokens > 0 ? Math.round(c.cachedTokens / c.promptTokens * 100) : 0;
         const mins = Math.round(c.durationMs / 6e3) / 10;
-        return `${c.rounds} \u8F6E \xB7 ${money} \xB7 \u7F13\u5B58\u547D\u4E2D ${hit}% \xB7 ${mins}min${c.partialPrice ? "\uFF08\u90E8\u5206\u8BB0\u5F55\u65E0\u4EF7\uFF0C\u94B1\u4E3A\u90E8\u5206\u548C\uFF09" : ""}${c.subRuns > 0 ? ` \xB7 \u5B50 run ${c.subRuns} \u4E2A\u5DF2\u8BA1\u5165` : ""}${c.toolCostYuan > 0 ? ` \xB7 \u8054\u7F51 \xA5${c.toolCostYuan.toFixed(4)}` : ""}`;
+        return `${c.rounds} \u8F6E \xB7 ${money} \xB7 \u7F13\u5B58\u547D\u4E2D ${hit}% \xB7 ${mins}min${c.partialPrice ? "\uFF08\u90E8\u5206\u8BB0\u5F55\u65E0\u4EF7\uFF0C\u94B1\u4E3A\u90E8\u5206\u548C\uFF09" : ""}${c.subRuns > 0 ? ` \xB7 \u5B50 run ${c.subRuns} \u4E2A\u5DF2\u8BA1\u5165` : ""}${c.toolCostYuan > 0 ? ` \xB7 \u8054\u7F51 \xA5${c.toolCostYuan.toFixed(4)}` : ""}${c.auxCostYuan > 0 ? ` \xB7 \u8F85\u52A9 \xA5${c.auxCostYuan.toFixed(4)}` : ""}`;
       },
       noReceipt: "\uFF08\u65E0\u7ED3\u7B97\u5355\u2014\u2014run \u672A\u5230\u6536\u5C3E\u5373\u88AB\u622A\u65AD\uFF0C\u82B1\u8D39\u4EE5\u4E0A\u65B9 usageLog \u805A\u5408\u4E3A\u51C6\uFF09",
-      receiptLine: (r) => `${r.rounds} \u8F6E \xB7 ${r.costYuan !== null ? `\xA5${r.costYuan.toFixed(4)}` : "\u65E0\u4EF7"} \xB7 \u7F13\u5B58\u547D\u4E2D ${Math.round(r.cacheHitRate * 100)}% \xB7 ${(r.durationMs / 1e3).toFixed(0)}s${r.toolCostYuan ? ` \xB7 \u8054\u7F51 \xA5${r.toolCostYuan.toFixed(4)}` : ""}`,
+      receiptLine: (r) => `${r.rounds} \u8F6E \xB7 ${r.costYuan !== null ? `\xA5${r.costYuan.toFixed(4)}` : "\u65E0\u4EF7"} \xB7 \u7F13\u5B58\u547D\u4E2D ${Math.round(r.cacheHitRate * 100)}% \xB7 ${(r.durationMs / 1e3).toFixed(0)}s${r.toolCostYuan ? ` \xB7 \u8054\u7F51 \xA5${r.toolCostYuan.toFixed(4)}` : ""}${r.auxCostYuan ? ` \xB7 \u8F85\u52A9 \xA5${r.auxCostYuan.toFixed(4)}` : ""}`,
       // —— 报告骨架 ——
       rejectedTitle: "# \u6302\u673A\u4EFB\u52A1\u88AB\u62D2",
       reportTitle: (title) => `# \u6302\u673A\u4EFB\u52A1\u62A5\u544A\uFF1A${title}`,
@@ -1232,10 +1276,10 @@ changes are harvested onto an isolated git worktree (temp branch), kept for manu
         const money = c.costYuan !== null ? `\xA5${c.costYuan.toFixed(4)}` : "(unpriced model, no money counted)";
         const hit = c.promptTokens > 0 ? Math.round(c.cachedTokens / c.promptTokens * 100) : 0;
         const mins = Math.round(c.durationMs / 6e3) / 10;
-        return `${c.rounds} rounds \xB7 ${money} \xB7 cache hit ${hit}% \xB7 ${mins}min${c.partialPrice ? " (some records unpriced; money is a partial sum)" : ""}${c.subRuns > 0 ? ` \xB7 ${c.subRuns} sub-runs included` : ""}${c.toolCostYuan > 0 ? ` \xB7 web \xA5${c.toolCostYuan.toFixed(4)}` : ""}`;
+        return `${c.rounds} rounds \xB7 ${money} \xB7 cache hit ${hit}% \xB7 ${mins}min${c.partialPrice ? " (some records unpriced; money is a partial sum)" : ""}${c.subRuns > 0 ? ` \xB7 ${c.subRuns} sub-runs included` : ""}${c.toolCostYuan > 0 ? ` \xB7 web \xA5${c.toolCostYuan.toFixed(4)}` : ""}${c.auxCostYuan > 0 ? ` \xB7 aux \xA5${c.auxCostYuan.toFixed(4)}` : ""}`;
       },
       noReceipt: "(no receipt \u2014 the run was truncated before finishing; cost per the usageLog aggregate above)",
-      receiptLine: (r) => `${r.rounds} rounds \xB7 ${r.costYuan !== null ? `\xA5${r.costYuan.toFixed(4)}` : "unpriced"} \xB7 cache hit ${Math.round(r.cacheHitRate * 100)}% \xB7 ${(r.durationMs / 1e3).toFixed(0)}s${r.toolCostYuan ? ` \xB7 web \xA5${r.toolCostYuan.toFixed(4)}` : ""}`,
+      receiptLine: (r) => `${r.rounds} rounds \xB7 ${r.costYuan !== null ? `\xA5${r.costYuan.toFixed(4)}` : "unpriced"} \xB7 cache hit ${Math.round(r.cacheHitRate * 100)}% \xB7 ${(r.durationMs / 1e3).toFixed(0)}s${r.toolCostYuan ? ` \xB7 web \xA5${r.toolCostYuan.toFixed(4)}` : ""}${r.auxCostYuan ? ` \xB7 aux \xA5${r.auxCostYuan.toFixed(4)}` : ""}`,
       rejectedTitle: "# Batch task rejected",
       reportTitle: (title) => `# Batch task report: ${title}`,
       statusEntry: (v) => `- Status: ${v}`,
@@ -1453,7 +1497,8 @@ var init_stream = __esm({
           break;
         }
       }
-      if (lastNonSystem?.role === "assistant") return messages;
+      const hasSplitToolTurn = messages.some((m, i) => i > 0 && m?.role === "assistant" && messages[i - 1]?.role === "assistant" && Array.isArray(m.tool_calls) && m.tool_calls.length > 0);
+      if (lastNonSystem?.role === "assistant" || hasSplitToolTurn) return messages;
       return messages.map((m) => {
         const wire = m;
         if (wire?.role !== "assistant" || typeof wire.reasoning_content !== "string") return m;
@@ -1565,6 +1610,10 @@ var init_deepseek = __esm({
         const completion = await getModel().chat.completions.create(requestBody, {
           signal: opts.signal
         });
+        try {
+          opts.onAuxUsage?.(completion.usage, "compact");
+        } catch {
+        }
         if (completion && "choices" in completion) return completion;
         throw new Error("API \u54CD\u5E94\u5F02\u5E38\uFF0C\u672A\u5305\u542B choices \u7ED3\u6784");
       } catch (error) {
@@ -1572,7 +1621,7 @@ var init_deepseek = __esm({
         throw error;
       }
     };
-    classifyRisk = async (toolName, args, detail, signal) => {
+    classifyRisk = async (toolName, args, detail, signal, onAuxUsage) => {
       const ac = new AbortController();
       const timer = setTimeout(() => ac.abort(), 1e4);
       if (signal) signal.addEventListener("abort", () => ac.abort(), { once: true });
@@ -1588,6 +1637,10 @@ var init_deepseek = __esm({
           thinking: { type: "disabled" },
           stream: false
         }, { signal: ac.signal });
+        try {
+          onAuxUsage?.(completion.usage, "classify");
+        } catch {
+        }
         const text = (completion.choices[0]?.message?.content ?? "").trim().toUpperCase();
         return text.startsWith("SAFE") ? "safe" : "risky";
       } catch {
@@ -1945,7 +1998,7 @@ var init_model = __esm({
     };
     activeProvider = resolveInitialProvider();
     chatWithModelWithSummary = (messages, tools, opts) => activeProvider.summarize(messages, tools, opts);
-    classifyToolRisk = (toolName, args, detail, signal) => activeProvider.classifyRisk(toolName, args, detail, signal);
+    classifyToolRisk = (toolName, args, detail, signal, onAuxUsage) => activeProvider.classifyRisk(toolName, args, detail, signal, onAuxUsage);
   }
 });
 
@@ -2058,8 +2111,10 @@ var init_contextCore = __esm({
 // ../core/src/session/store.ts
 var store_exports = {};
 __export(store_exports, {
+  calibrationEntryFor: () => calibrationEntryFor,
   deleteSession: () => deleteSession,
   ensureSessionsDir: () => ensureSessionsDir,
+  getCalibration: () => getCalibration,
   getMostRecentSessionId: () => getMostRecentSessionId,
   getOrCreateSessionId: () => getOrCreateSessionId,
   getRollingState: () => getRollingState,
@@ -2088,7 +2143,9 @@ async function getRollingState(sessionId) {
     archivedMessageCount: typeof store.archivedMessageCount === "number" && store.archivedMessageCount >= 0 ? store.archivedMessageCount : 0,
     // 读取持久化的连续失败次数，若不存在则默认为 0
     consecutiveFailures: typeof store.consecutiveFailures === "number" ? store.consecutiveFailures : 0,
-    // ★ 跨 run 持久化的压缩校准状态（缺省 undefined，调用方按 ?? 回落默认）
+    // ★ 跨 run 持久化的压缩校准状态（缺省 undefined，调用方按 ?? 回落默认）。
+    //  P1-4 起这是「扁平镜像视图」：压缩主链路（runAgent/compactSessionNow）须走 getCalibration(sessionId, modelId)
+    //  按 per-model 分键读——切模型后各模型校准互不污染，扁平字段只是最近写入模型的镜像。
     calibRatio: typeof store.calibRatio === "number" ? store.calibRatio : void 0,
     lastRealPromptTokens: typeof store.lastRealPromptTokens === "number" ? store.lastRealPromptTokens : void 0,
     lastCachedTokens: typeof store.lastCachedTokens === "number" ? store.lastCachedTokens : void 0
@@ -2115,7 +2172,7 @@ async function setTodos(sessionId, todos) {
     await writeStore(sessionId, store);
   });
 }
-var getSessionsDirPath, getWorkspaceSessionsDir, getStatePath, getTranscriptPath, ensuredSessionDirs, ensureSessionsDir, migrateLegacyFiles, writeStore, storeLocks, withStoreLock, getOrCreateSessionId, readStore, updateCalibration, listSessions, getMostRecentSessionId, renameSession, deleteSession;
+var getSessionsDirPath, getWorkspaceSessionsDir, getStatePath, getTranscriptPath, ensuredSessionDirs, ensureSessionsDir, migrateLegacyFiles, writeStore, storeLocks, withStoreLock, getOrCreateSessionId, readStore, calibrationEntryFor, getCalibration, updateCalibration, listSessions, getMostRecentSessionId, renameSession, deleteSession;
 var init_store = __esm({
   "../core/src/session/store.ts"() {
     "use strict";
@@ -2222,8 +2279,11 @@ var init_store = __esm({
           // 总条数消息
           rollingSummary: "",
           // 滚动总结摘要
-          consecutiveFailures: 0
+          consecutiveFailures: 0,
           // 失败消息
+          // ★ 项目根盖章（2026-10-21）：记录会话归属项目，会话按项目分桶外的兜底元信息——
+          //   多根工作区切根修复后分桶键即跟随项目，此章供诊断/未来跨桶工具用（旧会话无此字段）。
+          projectRoot: process.cwd()
         };
         if (!isPersisted) {
           await writeStore(entry.sessionId, entry);
@@ -2250,13 +2310,41 @@ var init_store = __esm({
         throw err;
       }
     };
-    updateCalibration = async (sessionId, calib) => {
+    calibrationEntryFor = (store, modelId) => {
+      if (modelId) {
+        const byModel = store?.calibByModel;
+        const hit = byModel && typeof byModel === "object" ? byModel[modelId] : void 0;
+        if (hit && typeof hit === "object") {
+          return {
+            calibRatio: typeof hit.calibRatio === "number" ? hit.calibRatio : void 0,
+            lastRealPromptTokens: typeof hit.lastRealPromptTokens === "number" ? hit.lastRealPromptTokens : void 0,
+            lastCachedTokens: typeof hit.lastCachedTokens === "number" ? hit.lastCachedTokens : void 0
+          };
+        }
+      }
+      return {
+        calibRatio: typeof store?.calibRatio === "number" ? store.calibRatio : void 0,
+        lastRealPromptTokens: typeof store?.lastRealPromptTokens === "number" ? store.lastRealPromptTokens : void 0,
+        lastCachedTokens: typeof store?.lastCachedTokens === "number" ? store.lastCachedTokens : void 0
+      };
+    };
+    getCalibration = async (sessionId, modelId) => {
+      const store = await readStore(sessionId);
+      return calibrationEntryFor(store, modelId);
+    };
+    updateCalibration = async (sessionId, modelId, calib) => {
       return withStoreLock(sessionId, async () => {
         const store = await readStore(sessionId);
         if (!store) return;
-        if (typeof calib.calibRatio === "number" && Number.isFinite(calib.calibRatio)) store.calibRatio = calib.calibRatio;
-        if (typeof calib.lastRealPromptTokens === "number") store.lastRealPromptTokens = calib.lastRealPromptTokens;
-        if (typeof calib.lastCachedTokens === "number") store.lastCachedTokens = calib.lastCachedTokens;
+        const id = modelId?.trim() || "default";
+        const byModel = store.calibByModel && typeof store.calibByModel === "object" ? store.calibByModel : store.calibByModel = {};
+        const cur = byModel[id] && typeof byModel[id] === "object" ? byModel[id] : byModel[id] = {};
+        if (typeof calib.calibRatio === "number" && Number.isFinite(calib.calibRatio)) cur.calibRatio = calib.calibRatio;
+        if (typeof calib.lastRealPromptTokens === "number") cur.lastRealPromptTokens = calib.lastRealPromptTokens;
+        if (typeof calib.lastCachedTokens === "number") cur.lastCachedTokens = calib.lastCachedTokens;
+        if (typeof cur.calibRatio === "number") store.calibRatio = cur.calibRatio;
+        if (typeof cur.lastRealPromptTokens === "number") store.lastRealPromptTokens = cur.lastRealPromptTokens;
+        if (typeof cur.lastCachedTokens === "number") store.lastCachedTokens = cur.lastCachedTokens;
         await writeStore(sessionId, store);
       });
     };
@@ -2315,7 +2403,8 @@ var init_store = __esm({
           createAt: state?.createAt,
           updatedAt,
           messageCount,
-          preview: preview.slice(0, 80)
+          preview: preview.slice(0, 80),
+          projectRoot: typeof state?.projectRoot === "string" ? state.projectRoot : void 0
         });
       }
       summaries.sort((a, b) => (b.updatedAt ?? "").localeCompare(a.updatedAt ?? ""));
@@ -2664,6 +2753,8 @@ var init_planMode = __esm({
       type: "function",
       function: {
         name: "exit_plan_mode",
+        // ★ P1-6 终结声明：调用即提交方案并终结本轮（调度层发 plan.proposed，上层呈现审批）
+        terminal: "plan_exit",
         description: "\u8BA1\u5212\u6A21\u5F0F\u4E13\u7528\uFF1A\u5B8C\u6210\u53EA\u8BFB\u8C03\u7814\u3001\u5F62\u6210\u660E\u786E\u5B9E\u73B0\u65B9\u6848\u540E\u8C03\u7528\u672C\u5DE5\u5177\u63D0\u4EA4\u65B9\u6848\u3002\u63D0\u4EA4\u540E\u65B9\u6848\u4F1A\u5448\u73B0\u7ED9\u7528\u6237\u5BA1\u6279\uFF1B\u5BA1\u6279\u901A\u8FC7\u540E\u624D\u8FDB\u5165\u5B9E\u73B0\u9636\u6BB5\uFF08\u5C4A\u65F6\u624D\u5141\u8BB8\u4FEE\u6539\u6587\u4EF6/\u6267\u884C\u547D\u4EE4\uFF09\u3002\u5728\u8BA1\u5212\u6A21\u5F0F\u4E0B\u4F60\u53EA\u80FD\u8BFB\u53D6\u4E0E\u641C\u7D22\uFF0C\u4E0D\u80FD\u505A\u4EFB\u4F55\u4FEE\u6539\u3002",
         parameters: {
           type: "object",
@@ -2678,6 +2769,8 @@ var init_planMode = __esm({
       type: "function",
       function: {
         name: "enter_plan_mode",
+        // ★ P1-6 终结声明：调用即请求进入计划模式并终结本轮（调度层发 plan.enterRequested）
+        terminal: "plan_enter",
         description: "\u81EA\u4E3B\u8FDB\u5165\u8BA1\u5212\u6A21\u5F0F\uFF1A\u5F53\u4EFB\u52A1\u662F\u975E\u5E73\u51E1\u7684\u5B9E\u73B0\u4EFB\u52A1\uFF08\u591A\u6587\u4EF6\u6539\u52A8\u3001\u67B6\u6784\u51B3\u7B56\u3001\u4E0D\u786E\u5B9A\u8DEF\u5F84\u3001\u9AD8\u98CE\u9669\u64CD\u4F5C\uFF09\u65F6\u8C03\u7528\u3002\u8C03\u7528\u540E\u672C\u8F6E\u7ED3\u675F\u5E76\u8FDB\u5165\u53EA\u8BFB\u8C03\u7814\u9636\u6BB5\u2014\u2014\u4F60\u53EA\u80FD\u8BFB\u53D6\u4E0E\u641C\u7D22\uFF0C\u4EA7\u51FA\u5B8C\u6574\u5B9E\u73B0\u65B9\u6848\uFF08\u8981\u6539\u54EA\u4E9B\u6587\u4EF6\u3001\u600E\u4E48\u6539\u3001\u4E3A\u4F55\u3001\u98CE\u9669\uFF09\u7ECF\u7528\u6237\u5BA1\u6279\u540E\u518D\u5B9E\u73B0\u3002\u7B80\u5355\u4EFB\u52A1\u65E0\u9700\u8C03\u7528\uFF0C\u76F4\u63A5\u5B9E\u73B0\u3002",
         parameters: {
           type: "object",
@@ -2712,7 +2805,12 @@ var init_systemPrompt = __esm({
 - \u5DE5\u5177**\u6267\u884C\u5931\u8D25\u6216\u88AB\u7528\u6237\u62D2\u7EDD**\u65F6\uFF0C\u8BFB\u8FD4\u56DE\u7ED3\u679C\u5B9A\u4F4D\u539F\u56E0\uFF0C\u4FEE\u6B63\u53C2\u6570\u6216\u6362\u7B49\u6548\u65B9\u6848\u7EE7\u7EED\uFF0C\u4E0D\u8981\u9053\u6B49\u4E00\u4E24\u53E5\u5C31\u505C\u4E0B\uFF1B\u786E\u5B9E\u53D7\u963B\u9700\u8981\u7528\u6237\u51B3\u7B56\u65F6\uFF0C\u7528 ask_question \u8BF4\u660E**\u5177\u4F53**\u963B\u585E\u70B9\u3002**\u4E25\u7981**\u5728\u672A\u771F\u6B63\u6267\u884C\u6216\u672A\u9A8C\u8BC1\u7684\u60C5\u51B5\u4E0B\u58F0\u79F0"\u5DF2\u5B8C\u6210/\u5DF2\u4FEE\u6539/\u5DF2\u4FEE\u590D"\u2014\u2014\u6539\u52A8\u82E5\u53EF\u9A8C\u8BC1\uFF08\u91CD\u8BFB\u786E\u8BA4\u3001\u8DD1\u6D4B\u8BD5\u3001\u7C7B\u578B\u68C0\u67E5\uFF09\uFF0C\u5148\u9A8C\u8BC1\u518D\u6536\u5C3E\u3002
 
 \u3010\u56DE\u7B54\u5F62\u5F0F\u3011
-- **\u5148\u7ED3\u8BBA\u540E\u7EC6\u8282**\uFF1A\u5148\u76F4\u63A5\u56DE\u7B54\u6216\u6C47\u62A5\u7ED3\u679C\uFF0C\u518D\u5C55\u5F00\u5FC5\u8981\u7684\u89E3\u91CA\uFF1B\u6536\u5C3E\u603B\u7ED3\u7B80\u77ED\uFF08\u51E0\u884C\u4EE5\u5185\uFF09\uFF0C\u4E0D\u9010\u6587\u4EF6\u6D41\u6C34\u8D26\u3002
+- **\u5148\u7ED3\u8BBA\u540E\u7EC6\u8282**\uFF1A\u5148\u76F4\u63A5\u56DE\u7B54\u6216\u6C47\u62A5\u7ED3\u679C\uFF0C\u518D\u5C55\u5F00\u5FC5\u8981\u7684\u89E3\u91CA\u3002
+- **\u8BF4\u4EBA\u8BDD**\uFF1A\u6C47\u62A5\u548C\u6536\u5C3E\u7528\u901A\u4FD7\u8BED\u8A00\u2014\u2014\u5148\u8BB2\u505A\u4E86\u4EC0\u4E48\u3001\u6548\u679C\u662F\u4EC0\u4E48\uFF0C\u518D\u8BB2\u624B\u6BB5\uFF1B\u975E\u5FC5\u8981\u4E0D\u5806\u672F\u8BED\uFF0C\u7ED5\u4E0D\u5F00\u7684\u672F\u8BED\u7D27\u8DDF\u4E00\u53E5\u767D\u8BDD\u89E3\u91CA\uFF1B\u6280\u672F\u7EC6\u8282\u653E\u540E\u9762\uFF0C\u7528\u6237\u8FFD\u95EE\u518D\u5C55\u5F00\u3002
+- **\u6536\u5C3E\u81EA\u7136\u7B80\u77ED**\uFF1A\u4EFB\u52A1\u6536\u5C3E\u628A\u7ED3\u679C\u8BF4\u6E05\u695A\u5373\u53EF\u2014\u2014\u5148\u4E00\u53E5\u7ED3\u8BBA\uFF08\u505A\u5B8C\u4E86\u4EC0\u4E48\u3001\u6548\u679C\u5982\u4F55\uFF09\uFF0C\u518D\u6309\u9700\u7B80\u8FF0\u6539\u52A8\u8981\u70B9\u4E0E\u9A8C\u8BC1\u7ED3\u679C\uFF0C\u7BC7\u5E45\u4EE5\u8BF4\u6E05\u4E3A\u51C6\uFF08\u4E00\u822C\u51E0\u884C\uFF09\u3002\u4E0D\u5199\u957F\u7BC7\u7ED3\u9898\u62A5\u544A\u3001\u4E0D\u9010\u6587\u4EF6\u6D41\u6C34\u8D26\u3001\u4E0D\u590D\u8FF0\u6267\u884C\u8FC7\u7A0B\uFF1B\u7528\u6237\u8FFD\u95EE\u65F6\u518D\u5C55\u5F00\u3002\u957F\u5EA6\u53C2\u7167\u2014\u2014
+  \u5DF2\u4FEE\u590D\uFF1A\u767B\u5F55\u8FC7\u671F\u540E\u73B0\u5728\u80FD\u6B63\u786E\u8DF3\u56DE\u767B\u5F55\u9875\uFF08\u4E4B\u524D\u4F1A\u505C\u5728\u7A7A\u767D\u9875\uFF09\u3002
+  \u6539\u52A8\uFF1Asrc/auth/redirect.ts \u2014\u2014 \u8FC7\u671F\u5206\u652F\u8865\u4E0A return \u767B\u5F55\u9875\u8DEF\u5F84\u3002
+  \u9A8C\u8BC1\uFF1A\u767B\u5F55\u6A21\u5757\u6D4B\u8BD5 23 \u4F8B\u5168\u90E8\u901A\u8FC7\u3002
 - **\u4E0D\u56DE\u8D34\u5927\u6BB5\u4EE3\u7801**\uFF1A\u6539\u52A8\u5185\u5BB9\u7528\u6237\u5728\u7F16\u8F91\u5668/diff \u91CC\u770B\u5F97\u5230\uFF0C\u6B63\u6587\u53EA\u9700\u4E00\u53E5\u8BDD\u8BF4\u660E\u6539\u4E86\u4EC0\u4E48\u3001\u4E3A\u4EC0\u4E48\uFF0C\u6216\u5F15\u7528\u5173\u952E\u51E0\u884C\u3002
 
 \u3010\u5DE5\u5177\u4F7F\u7528\u51C6\u5219\u3011
@@ -3056,6 +3154,7 @@ var init_truncate = __esm({
     init_content();
     init_systemPrompt();
     init_model();
+    init_createModel();
     init_store();
     init_transcript();
     init_hooks();
@@ -3127,12 +3226,13 @@ var init_truncate = __esm({
 ${tail}`;
     };
     batchSummaryPrompt = (tailContext) => "\u6982\u62EC\u4EE5\u4E0A\u5BF9\u8BDD\u4E0E\u5DE5\u5177\u8C03\u7528\uFF0C\u6309\u300C\u5B8C\u6210\u4E86\u4EC0\u4E48 \u2192 \u6B63\u5728\u505A\u4EC0\u4E48 \u2192 \u4E0B\u4E00\u6B65/\u53D7\u963B\u300D\u7684\u987A\u5E8F\u5199\u6210\u4E00\u6BB5\u3002\u5FC5\u987B\u539F\u6837\u4FDD\u7559\u5173\u952E\u5B9E\u4F53\u540D\uFF08\u6587\u4EF6\u8DEF\u5F84\u3001\u51FD\u6570/\u7C7B\u540D\u3001\u62A5\u9519\u5173\u952E\u8BCD\uFF09\u4EE5\u4FBF\u540E\u7EED\u68C0\u7D22\uFF1B" + (tailContext ? "\u8FD9\u6279\u6458\u8981\u7D27\u90BB\u672A\u538B\u7F29\u7684\u4FDD\u7559\u533A\uFF0C\u8BF7\u989D\u5916\u5199\u660E\u5176\u4E2D\u5BF9\u7D27\u968F\u5176\u540E\u7684\u8FD1\u671F\u5DE5\u4F5C\u6709\u7528\u7684\u80CC\u666F\uFF08\u5DF2\u786E\u8BA4\u7684\u7EA6\u675F\u3001\u6570\u636E\u3001\u7ED3\u8BBA\uFF09\u3002" : "") + '\u5BF9\u8BB0\u4E0D\u51C6\u7684\u7EC6\u8282\u4E0D\u8981\u81C6\u6D4B\uFF0C\u6807\u6CE8"(\u7EC6\u8282\u5DF2\u5F52\u6863)"\u5373\u53EF\u3002\u4E0D\u8981\u8C03\u7528\u5DE5\u5177\u3002';
-    compactBatch = async (batch, signal, tailContext) => {
+    compactBatch = async (batch, signal, tailContext, onAuxUsage) => {
       const resp = await chatWithModelWithSummary(
         // ★ 辅助模型是 text-only：送前把 image part 降级为占位符——base64 绝不能进摘要批（烧钱且无意义）
         [...batch.map(degradeImagesForAux), { role: "user", content: batchSummaryPrompt(tailContext) }],
         [],
-        { signal }
+        // ★ P0-2：aux usage 回传 run 级成本账（成本信任链：摘要调用不入账则预算被压缩打穿）
+        { signal, onAuxUsage }
       );
       return `- ${resp.choices[0].message.content || ""}`;
     };
@@ -3218,7 +3318,7 @@ ${noteLine}` : noteLine : notes;
       const hasPrevious = trimmedNotes.length > 0 && trimmedNotes !== SLOT_PLACEHOLDER;
       return { index, hasPrevious };
     };
-    synthesizeSlotNarrative = async (slotContent, newLines, signal) => {
+    synthesizeSlotNarrative = async (slotContent, newLines, signal, onAuxUsage) => {
       const { index, hasPrevious } = parseSlotNarrativeState(slotContent);
       const lines = newLines.trim();
       const resp = await chatWithModelWithSummary(
@@ -3230,12 +3330,12 @@ ${lines}
 ` : ""}${checkpointPrompt(hasPrevious)}` }
         ],
         [],
-        { signal }
+        { signal, onAuxUsage }
       );
       const newNotes = (resp.choices[0].message.content || "").trim();
       return assembleSlot(index, newNotes);
     };
-    synthesizeSlotNarrativeFromBatch = async (slotContent, batch, signal) => {
+    synthesizeSlotNarrativeFromBatch = async (slotContent, batch, signal, onAuxUsage) => {
       const { index, hasPrevious } = parseSlotNarrativeState(slotContent);
       const resp = await chatWithModelWithSummary(
         [
@@ -3244,12 +3344,12 @@ ${lines}
           { role: "user", content: checkpointDirectPrompt(hasPrevious) }
         ],
         [],
-        { signal }
+        { signal, onAuxUsage }
       );
       const newNotes = (resp.choices[0].message.content || "").trim();
       return assembleSlot(index, newNotes);
     };
-    compactSlotNarrative = async (slotContent, _modelWindow, signal) => synthesizeSlotNarrative(slotContent, "", signal);
+    compactSlotNarrative = async (slotContent, _modelWindow, signal, onAuxUsage) => synthesizeSlotNarrative(slotContent, "", signal, onAuxUsage);
     MAX_BATCH_TOKENS = 16e3;
     PRETRUNCATE_FLOOR_TOKENS = 512;
     foldableTokensOf = (m) => Math.max(0, estimateTokens([m]) - 4);
@@ -3335,11 +3435,11 @@ ${lines}
       if (batch.length > 0) batches.push(batch);
       return batches;
     };
-    compactBatches = async (batches, signal, onUIEvent) => {
+    compactBatches = async (batches, signal, onUIEvent, onAuxUsage) => {
       if (onUIEvent && batches.length > 0) onUIEvent({ type: "compact.progress", done: 0, total: batches.length });
       let done = 0;
       const lines = await Promise.all(batches.map(
-        (b, i) => compactBatch(b, signal, i === batches.length - 1).then((line) => {
+        (b, i) => compactBatch(b, signal, i === batches.length - 1, onAuxUsage).then((line) => {
           done++;
           onUIEvent?.({ type: "compact.progress", done, total: batches.length });
           return line;
@@ -3409,9 +3509,9 @@ ${lines}
           if (toCompact.length > 0) {
             summaryMsg.content = mergeSummarySlot(summaryMsg?.content || "", "", extractArchiveEntities(toCompact));
             const batches = splitIntoBatches(toCompact);
-            summaryMsg.content = batches.length === 1 ? await synthesizeSlotNarrativeFromBatch(summaryMsg.content, batches[0], event.signal) : await synthesizeSlotNarrative(summaryMsg.content, await compactBatches(batches, event.signal, event.depth === 0 ? event.onUIEvent : void 0), event.signal);
+            summaryMsg.content = batches.length === 1 ? await synthesizeSlotNarrativeFromBatch(summaryMsg.content, batches[0], event.signal, event.onAuxUsage) : await synthesizeSlotNarrative(summaryMsg.content, await compactBatches(batches, event.signal, event.depth === 0 ? event.onUIEvent : void 0, event.onAuxUsage), event.signal, event.onAuxUsage);
             if (estimateTokens([summaryMsg]) > SUMMARY_SELF_COMPACT_THRESHOLD) {
-              summaryMsg.content = await compactSlotNarrative(summaryMsg.content, event.modelWindow, event.signal);
+              summaryMsg.content = await compactSlotNarrative(summaryMsg.content, event.modelWindow, event.signal, event.onAuxUsage);
             }
             const endTime = performance.now();
             event.messageArr.length = 0;
@@ -3438,7 +3538,7 @@ ${lines}
             keep--;
             continue;
           } else if (summaryMsg?.content) {
-            summaryMsg.content = await compactSlotNarrative(summaryMsg.content, event.modelWindow, event.signal);
+            summaryMsg.content = await compactSlotNarrative(summaryMsg.content, event.modelWindow, event.signal, event.onAuxUsage);
             event.messageArr.length = 0;
             event.messageArr.push(systemMsg, summaryMsg, ...keepRecent);
             const store = await getRollingState(event.sessionId);
@@ -3523,7 +3623,7 @@ ${lines}
 // ../core/src/tool/permissions.ts
 import fs10 from "fs/promises";
 import path12 from "path";
-var rules2, trustedProject, globCache, globToRegex, DANGER_COMMAND_TOOLS, compileRule, readPermissionConfig, toolNameMatches, ruleMatches, initPermissions, checkPermission, listPermissionRules, buildScopedAllowRule, resolveSettingsPath, addPermissionRule;
+var rules2, trustedProject, sessionBuckets, SESSION_BUCKET_CAP, bucketFor, clearSessionPermissionRules, globCache, globToRegex, DANGER_COMMAND_TOOLS, compileRule, readPermissionConfig, toolNameMatches, ruleMatches, initPermissions, checkPermission, listPermissionRules, buildScopedAllowRule, resolveSettingsPath, addSessionPermissionRule, addPermissionRule;
 var init_permissions = __esm({
   "../core/src/tool/permissions.ts"() {
     "use strict";
@@ -3531,6 +3631,23 @@ var init_permissions = __esm({
     init_common();
     rules2 = { allow: [], deny: [], ask: [] };
     trustedProject = false;
+    sessionBuckets = /* @__PURE__ */ new Map();
+    SESSION_BUCKET_CAP = 64;
+    bucketFor = (sessionId) => {
+      let bucket = sessionBuckets.get(sessionId);
+      if (!bucket) {
+        if (sessionBuckets.size >= SESSION_BUCKET_CAP) {
+          const oldest = sessionBuckets.keys().next().value;
+          if (oldest !== void 0) sessionBuckets.delete(oldest);
+        }
+        bucket = { allow: [], deny: [], ask: [] };
+        sessionBuckets.set(sessionId, bucket);
+      }
+      return bucket;
+    };
+    clearSessionPermissionRules = (sessionId) => {
+      sessionBuckets.delete(sessionId);
+    };
     globCache = /* @__PURE__ */ new Map();
     globToRegex = (glob) => {
       const cached2 = globCache.get(glob);
@@ -3616,6 +3733,7 @@ var init_permissions = __esm({
     };
     initPermissions = async (includeProject) => {
       trustedProject = includeProject;
+      sessionBuckets.clear();
       try {
         rules2 = await readPermissionConfig(includeProject);
         const total = rules2.allow.length + rules2.deny.length + rules2.ask.length;
@@ -3627,11 +3745,15 @@ var init_permissions = __esm({
         rules2 = { allow: [], deny: [], ask: [] };
       }
     };
-    checkPermission = (toolName, args, primaryArg) => {
+    checkPermission = (toolName, args, primaryArg, sessionId) => {
       try {
-        for (const r of rules2.deny) if (ruleMatches(r, toolName, args, primaryArg)) return "deny";
-        for (const r of rules2.ask) if (ruleMatches(r, toolName, args, primaryArg)) return "ask";
-        for (const r of rules2.allow) if (ruleMatches(r, toolName, args, primaryArg)) return "allow";
+        const bucket = sessionId ? sessionBuckets.get(sessionId) : void 0;
+        const deny = bucket ? [...rules2.deny, ...bucket.deny] : rules2.deny;
+        const ask = bucket ? [...rules2.ask, ...bucket.ask] : rules2.ask;
+        const allow = bucket ? [...rules2.allow, ...bucket.allow] : rules2.allow;
+        for (const r of deny) if (ruleMatches(r, toolName, args, primaryArg)) return "deny";
+        for (const r of ask) if (ruleMatches(r, toolName, args, primaryArg)) return "ask";
+        for (const r of allow) if (ruleMatches(r, toolName, args, primaryArg)) return "allow";
         return null;
       } catch {
         return null;
@@ -3649,7 +3771,7 @@ var init_permissions = __esm({
         const cmd = val.trim();
         return cmd ? `${toolName}(${cmd})` : null;
       }
-      if (argKey === "path" || argKey === "src") {
+      if (argKey === "path") {
         const norm = val.replace(/\\/g, "/").replace(/^\.\//, "").replace(/^[a-zA-Z]:/, "");
         const slashIdx = norm.indexOf("/");
         if (slashIdx > 0) {
@@ -3661,6 +3783,13 @@ var init_permissions = __esm({
       return `${toolName}(${val})`;
     };
     resolveSettingsPath = (scope) => scope === "global" ? path12.join(appConfig.dataDir, "settings.json") : path12.join(process.cwd(), ".deepseeker-code", "settings.json");
+    addSessionPermissionRule = (ruleStr, kind = "allow", sessionId) => {
+      const compiled2 = compileRule(ruleStr, "runtime:addSessionPermissionRule(session)", kind);
+      if (!compiled2) return false;
+      const target = sessionId ? bucketFor(sessionId) : rules2;
+      if (!target[kind].some((r) => r.raw === compiled2.raw)) target[kind].push(compiled2);
+      return true;
+    };
     addPermissionRule = async (scope, kind, ruleStr) => {
       if (scope === "project" && !trustedProject) return false;
       const compiled2 = compileRule(ruleStr, `runtime:addPermissionRule(${scope})`, kind);
@@ -3988,10 +4117,17 @@ var init_guard = __esm({
       console.log(`\u23F3 [\u5BA1\u6279\u6302\u8D77] ${toolName} | \u4F1A\u8BDD=${ctx.sessionId} | \u51ED\u8BC1=${toolCallId}\uFF08\u4EA4\u7531\u5BBF\u4E3B\u5BA1\u6279\uFF09`);
       await dispatch("PermissionRequest", { sessionId: ctx.sessionId, cwd: ctx.cwd, toolName, toolCallId, detail: safeDetail, safetyLevel, args }).catch(() => {
       });
-      const decision = await ctx.requestApproval(safeDetail, { toolName, toolCallId, sessionId: ctx.sessionId });
+      const decision = await ctx.requestApproval(safeDetail, { toolName, toolCallId, sessionId: ctx.sessionId, fullDetail: detail });
       const approved2 = decision !== "deny";
       if (!approved2) {
         ctx.onUIEvent?.({ type: "tool.denied", toolsId: toolCallId, toolName });
+      } else if (decision === "allow-session") {
+        const ruleStr = buildScopedAllowRule(toolName, args, primaryArg);
+        if (ruleStr && addSessionPermissionRule(ruleStr, "allow", ctx.sessionId)) {
+          console.log(`\u{1F4CC} [\u5BA1\u6279\u8BB0\u5FC6] \u672C\u4F1A\u8BDD\u5185\u514D\u5BA1\uFF1A${ruleStr}\uFF08\u4F1A\u8BDD\u7ED3\u675F\u81EA\u52A8\u5931\u6548\uFF0C\u4E0D\u5199\u914D\u7F6E\u6587\u4EF6\uFF09`);
+        } else {
+          console.log(`\u267B\uFE0F [\u5BA1\u6279] ${toolName} \u672C\u6B21\u653E\u884C${safetyLevel ? ` (${safetyLevel})` : ""}\uFF08\u672A\u8BB0\u5FC6\uFF1A\u65E0\u6CD5\u5B89\u5168\u751F\u6210\u4F5C\u7528\u57DF\uFF09`);
+        }
       } else if (decision === "allow-always") {
         const ruleStr = buildScopedAllowRule(toolName, args, primaryArg);
         if (ruleStr) {
@@ -4264,6 +4400,11 @@ var init_background = __esm({
           name: "run_in_background",
           primaryArg: "command",
           autoApproval: "command",
+          // ★ P1-6 声明化：命令语义（灾难命令闸门/script-runner 供应链拦截按此识别；isSync:false 使其
+          //   不享受只读免审）；后台挂起不进子 agent（父收尾成孤儿）与挂机批处理（无人盯守）
+          argKind: "command",
+          subagentAllowed: false,
+          batchAllowed: false,
           description: "\u5728\u540E\u53F0\u542F\u52A8\u4E00\u4E2A\u957F\u65F6 shell \u547D\u4EE4\u5E76\u7ACB\u5373\u8FD4\u56DE task_id\uFF0C\u4E0D\u963B\u585E\u540E\u7EED\u63A8\u7406\u3002\u9002\u7528\u4E24\u7C7B\u573A\u666F\uFF1A\u2460 \u957F\u8FDE\u63A5/\u5E38\u9A7B\u8FDB\u7A0B\uFF08dev server\u3001watch\u3001tail -f\uFF09\u2014\u2014\u5148\u8D77\u670D\u52A1\u518D\u7EE7\u7EED\u5E72\u522B\u7684\u6D3B\uFF1B\u2461 \u9884\u8BA1\u8FD0\u884C\u6570\u5206\u949F\u4EE5\u4E0A\u3001\u65E0\u9700\u5B9E\u65F6\u76EF\u770B\u7684\u6709\u9650\u957F\u4EFB\u52A1\uFF08\u5168\u91CF\u6D4B\u8BD5 / \u5927\u6784\u5EFA / \u5927\u4F53\u79EF\u5B89\u88C5\u2014\u2014\u8DD1\u5B8C\u7528 get_background_output \u5E26 wait_seconds \u7B49\u7ED3\u679C\uFF0C\u4E0D\u8981\u7528\u524D\u53F0 run_command \u5E72\u7B49\uFF09\u3002\u7528 get_background_output \u67E5\u65E5\u5FD7\u4E0E\u72B6\u6001\uFF0Cstop_background_task \u7EC8\u6B62\u3002",
           parameters: {
             type: "object",
@@ -6907,7 +7048,9 @@ ${formattedCode}${hasMore ? `
         function: {
           name: "list_dir",
           planAllowed: true,
-          primaryArg: "path",
+          // ★ 第 17 项补丁（2026-10-21）：原声明 primaryArg:'path' 系漂移——本工具参数表只有 max_depth，
+          //   根本没有 path；且 SAFE 只读工具不走审批路径，allow-always 无意义。删除后由
+          //   tool-declaration-drift 的「声明 ⊆ parameters.properties」断言钉住。
           description: "\u626B\u63CF\u5E76\u7CBE\u7B80\u5217\u51FA\u5F53\u524D\u9879\u76EE\u7684\u5DE5\u4F5C\u533A\u76EE\u5F55\u6811\u3002\u672C\u5DE5\u5177\u81EA\u52A8\u5408\u5E76\u901A\u7528\u5FFD\u7565\u89C4\u5219\u4E0E\u591A\u5C42\u5B50\u76EE\u5F55\u7EA7 .gitignore \u89C4\u8303\u3002\u2605 \u53EA\u8BFB\u5B89\u5168\uFF0C\u53EF\u4E0E\u5176\u5B83\u53EA\u8BFB\u5DE5\u5177\u5728\u540C\u4E00\u6761\u6D88\u606F\u91CC\u5E76\u884C\u8C03\u7528\u3002",
           parameters: {
             type: "object",
@@ -7095,6 +7238,9 @@ ${summaries.join("\n")}`;
           triggersUndo: "delete",
           autoApproval: "file",
           primaryArg: "path",
+          // ★ P1-6 声明化收权：递归删除不进子 agent（爆炸半径最大原语之一，SUBAGENT_DENYLIST 兜底同判）与挂机批处理
+          subagentAllowed: false,
+          batchAllowed: false,
           description: "\u4ECE\u672C\u5730\u78C1\u76D8\u5185\u6C38\u4E45\u5220\u9664\u4E00\u4E2A\u6307\u5B9A\u7684\u6587\u4EF6\u6216\u8005\u4E00\u6574\u4E2A\u6587\u4EF6\u5939\u76EE\u5F55\u3002\u5982\u679C\u662F\u76EE\u5F55\uFF0C\u5DE5\u5177\u4F1A\u81EA\u52A8\u6267\u884C\u6DF1\u5EA6\u9012\u5F52\u5F3A\u884C\u9500\u6BC1\u3002\u6B64\u64CD\u4F5C\u4E0D\u53EF\u9006\uFF0C\u8BF7\u4E07\u5206\u5C0F\u5FC3\u3002",
           parameters: {
             type: "object",
@@ -7293,7 +7439,13 @@ ${summaries.join("\n")}`;
           name: "move_file",
           // ★ #8a 策略声明：双路径都受保护路径硬规则检查（P0-3 洞的声明化收口；特判已退役）。
           //   刻意不声明 triggersUndo：move 语义可手动移回，维持「不在 Undo 回退范围」现状。
-          primaryArg: "src",
+          // ★ 第 17 项补丁（2026-10-21）：主参数名原写 'src'，与本工具实际参数 source/destination 不符
+          //   → args['src'] 恒 undefined → buildScopedAllowRule 返回 null → 恒降级 allow-once，
+          //   用户点「总是允许」对 move_file 从不生效（安全侧 fail-closed 无风险，纯功能打折）。
+          //   改为 'source' 后走 buildScopedAllowRule 末尾的【精确值】兜底分支（规则 = move_file(<精确源路径>)），
+          //   刻意不并入 path 的顶层目录作用域（argKey === 'path' 分支）：move 无 undo 兜底（见上条），
+          //   作用域宁可窄——代价是该源路径逐次授权，move_file 非高频操作，可接受。
+          primaryArg: "source",
           autoApproval: "file",
           pathArgs: ["source", "destination"],
           description: "\u79FB\u52A8\u6216\u91CD\u547D\u540D\u6587\u4EF6/\u76EE\u5F55\uFF08\u540C\u5377\u539F\u5B50\u64CD\u4F5C\uFF09\u3002\u6E90\u4E0D\u5B58\u5728\u5219\u5931\u8D25\uFF1B\u76EE\u6807\u5DF2\u5B58\u5728\u5219\u62D2\u7EDD\uFF08\u9632\u8BEF\u8986\u76D6\uFF0C\u5982\u9700\u8986\u76D6\u8BF7\u5148 delete_path \u518D move_file\uFF09\u3002\u81EA\u52A8\u521B\u5EFA\u76EE\u6807\u7236\u76EE\u5F55\u3002\u26A0\uFE0F \u672C\u64CD\u4F5C\u6682\u4E0D\u5728 Undo \u56DE\u9000\u8303\u56F4\u5185\uFF08\u4E0D\u53EF\u64A4\u9500\uFF09\u3002",
@@ -7576,6 +7728,11 @@ var init_command = __esm({
           name: "run_command",
           primaryArg: "command",
           autoApproval: "command",
+          // ★ P1-6 声明化：命令语义（灾难命令闸门/script-runner 供应链拦截/只读免审按此识别）
+          argKind: "command",
+          // ★ P1-6 声明化收权：shell 执行不进子 agent（爆炸半径最大原语，SUBAGENT_DENYLIST 兜底同判）与挂机批处理
+          subagentAllowed: false,
+          batchAllowed: false,
           description: "\u5728\u5DE5\u4F5C\u533A\u6267\u884C shell \u547D\u4EE4\uFF08\u77ED\u5E73\u5FEB\u7684\u6D4B\u8BD5 / \u6784\u5EFA / git \u7B49\uFF09\uFF0C\u6D41\u5F0F\u8FD4\u56DE stdout/stderr \u5E76\u9644\u5E26\u9000\u51FA\u7801\u3002\u5C5E\u4E8E\u9AD8\u5371\u64CD\u4F5C\uFF0C\u6BCF\u6B21\u6267\u884C\u90FD\u9700\u8981\u7528\u6237\u5BA1\u6279\u3002\u9884\u8BA1\u8FD0\u884C\u6570\u5206\u949F\u4EE5\u4E0A\u7684\u957F\u4EFB\u52A1\uFF08\u5168\u91CF\u6D4B\u8BD5 / \u5927\u6784\u5EFA / \u5927\u4F53\u79EF\u5B89\u88C5\uFF09\u8BF7\u6539\u7528 run_in_background \u540E\u53F0\u6267\u884C\uFF1B\u82E5\u672C\u5DE5\u5177\u6267\u884C\u8FC7\u4E45\u4ECD\u672A\u7ED3\u675F\uFF0C\u7CFB\u7EDF\u4F1A\u81EA\u52A8\u628A\u8FDB\u7A0B\u8F6C\u5165\u540E\u53F0\u5E76\u8FD4\u56DE task_id\uFF08\u7528 get_background_output \u67E5\u7ED3\u679C\u3001stop_background_task \u7EC8\u6B62\uFF09\u3002",
           parameters: {
             type: "object",
@@ -10270,6 +10427,8 @@ var init_ask = __esm({
         type: "function",
         function: {
           name: "ask_question",
+          // ★ P1-6 声明化：阻塞等用户作答，不参与并行调度（原 canParallelize 按名排除退役为声明否决）
+          parallelizable: false,
           description: [
             "\u5411\u7528\u6237\u63D0\u51FA\u591A\u9009\u95EE\u9898\u5E76\u7B49\u5F85\u4F5C\u7B54\uFF1A\u6280\u672F\u65B9\u6848\u4E8C\u9009\u4E00\u3001\u8DEF\u5F84\u53D6\u820D\u3001\u8303\u56F4\u786E\u8BA4\u7B49\u9700\u7528\u6237\u62CD\u677F\u7684\u51B3\u7B56\u6216\u6B67\u4E49\u6F84\u6E05\u2014\u2014\u52FF\u7528\u4E8E\u80FD\u4ECE\u4EE3\u7801/\u4E0A\u4E0B\u6587\u81EA\u884C\u786E\u5B9A\u7684\u95EE\u9898\u3002",
             "2-4 \u4E2A\u9009\u9879\uFF08label + \u53EF\u9009 description\uFF09\uFF1BmultiSelect=true \u591A\u9009\uFF08\u9ED8\u8BA4\u5355\u9009\uFF09\u3002\u7528\u6237\u53D6\u6D88\u8FD4\u56DE\u7A7A\u9009\u62E9\uFF08\u6539\u7528\u9ED8\u8BA4\u6216\u91CD\u65B0\u63D0\u95EE\uFF09\u3002",
@@ -11679,11 +11838,12 @@ var init_backgroundTool = __esm({
 
 // ../core/src/tool/autoPermission.ts
 import path35 from "path";
-var isMcpTool, BUILTIN_AUTO_DENY, matchBuiltinDeny, COMMAND_DENY, matchCommandDeny, hasShellMetachars, READONLY_HEADS, PKG_MGR, SCRIPT_RUNNER_HEADS, SCRIPT_RUNNER_READONLY, isScriptRunnerCommand, hasWriteModifier, SENSITIVE_FILE_ARG_RE, hasSensitiveFileArg, isReadOnlyCommand, isWithinWorkspace, runAutoCheck;
+var isMcpTool, BUILTIN_AUTO_DENY, matchBuiltinDeny, COMMAND_DENY, matchCommandDeny, hasShellMetachars, READONLY_HEADS, PKG_MGR, SCRIPT_RUNNER_HEADS, SCRIPT_RUNNER_READONLY, isScriptRunnerCommand, INTERP_EXE, INTERP_BARE_EXE, REPO_SCRIPT_TOKEN, isInterpreterRepoScript, hasWriteModifier, SENSITIVE_FILE_ARG_RE, hasSensitiveFileArg, isReadOnlyCommand, isWithinWorkspace, runAutoCheck;
 var init_autoPermission = __esm({
   "../core/src/tool/autoPermission.ts"() {
     "use strict";
     init_model();
+    init_type();
     isMcpTool = (name) => name.startsWith("mcp__");
     BUILTIN_AUTO_DENY = [
       /(^|[\\/])\.env(\.|$)/i,
@@ -11802,6 +11962,20 @@ var init_autoPermission = __esm({
       if (SCRIPT_RUNNER_READONLY.some((re) => re.test(c))) return false;
       return SCRIPT_RUNNER_HEADS.some((re) => re.test(c));
     };
+    INTERP_EXE = String.raw`\s*([^\s"'\`]*[\\/])?(node|deno|bun|tsx|ts-node|python3?|py|ruby|perl|php)(\.exe|\.cmd|\.bat|\.ps1)?\b`;
+    INTERP_BARE_EXE = String.raw`\s*([^\s"'\`]*[\\/])?(tsc|make|cargo|go)(\.exe|\.cmd|\.bat|\.ps1)?\b`;
+    REPO_SCRIPT_TOKEN = /^(?![A-Za-z]:)(?![\\/])(?:\.{1,2}[\\/])?(?:[^\\/: \t"']+[\\/])*[^\\/: \t"']+\.(?:js|mjs|cjs|ts|mts|cts|tsx|jsx|py|pyw|sh|bash|rb|pl|php)$/i;
+    isInterpreterRepoScript = (cmd) => {
+      const c = (cmd || "").trim();
+      if (!c || hasShellMetachars(c)) return false;
+      const head = new RegExp(`^${INTERP_EXE}`, "i");
+      const bare = new RegExp(`^${INTERP_BARE_EXE}`, "i");
+      if (bare.test(c)) return true;
+      const m = head.exec(c);
+      if (!m) return false;
+      const rest = c.slice(m[0].length);
+      return rest.split(/\s+/).filter(Boolean).some((t) => !t.startsWith("-") && REPO_SCRIPT_TOKEN.test(t));
+    };
     hasWriteModifier = (cmd) => {
       if (!cmd) return false;
       if (/^sed\b/.test(cmd) && /(^|\s)-i\b/.test(cmd)) return true;
@@ -11841,13 +12015,17 @@ var init_autoPermission = __esm({
           if (!isWithinWorkspace(s, ctx.cwd)) return "ask";
           if (matchBuiltinDeny(s)) return "deny";
         }
+        const fastPath = decl.safetyLevel !== "danger" /* DANGER */ && (decl.triggersUndo === "overwrite" || decl.triggersUndo === "create");
+        return fastPath ? "allow" : "ask";
       }
       if (decl?.autoApproval === "command") {
         const argKey = decl.primaryArg ?? "command";
         const cmd = typeof args?.[argKey] === "string" ? args[argKey] : "";
         if (matchCommandDeny(cmd)) return "deny";
       }
-      const v = await classifyToolRisk(name, args, "", ctx.abortSignal);
+      ctx.emitProgress?.("\u{1F512} \u5B89\u5168\u5224\u5B9A\u4E2D\u2026\uFF08\u8F85\u52A9\u6A21\u578B\u5206\u7C7B\uFF0C\u6700\u957F 10s\uFF09");
+      const v = await classifyToolRisk(name, args, "", ctx.abortSignal, ctx.onAuxUsage);
+      ctx.emitProgress?.(v === "safe" ? "\u{1F512} \u5B89\u5168\u5224\u5B9A\uFF1A\u653E\u884C" : "\u{1F512} \u5B89\u5168\u5224\u5B9A\uFF1A\u672A\u653E\u884C\uFF08\u8F6C\u4EBA\u5DE5\u5BA1\u6279\uFF09");
       return v === "safe" ? "allow" : "ask";
     };
   }
@@ -11855,7 +12033,7 @@ var init_autoPermission = __esm({
 
 // ../core/src/agent/toolExecution.ts
 import path36 from "path";
-var applyPrivacyMasking, scaleTruncBudget, processToolCall;
+var applyPrivacyMasking, scaleTruncBudget, failResult, emitValidationFailed, resolveEarlyOutcome, runSecurityGates, executeTool, finalizeOutcome, processToolCall;
 var init_toolExecution = __esm({
   "../core/src/agent/toolExecution.ts"() {
     "use strict";
@@ -11895,48 +12073,24 @@ var init_toolExecution = __esm({
       const factor = 1 - (fill - 0.5) / 0.35 * 0.6;
       return Math.max(floor, Math.floor(base * factor));
     };
-    processToolCall = async (toolCall, ctx) => {
-      const {
-        sessionId,
-        depth,
-        round,
-        startTime,
-        llmDecisionSource,
-        signal,
-        rawTools,
-        events,
-        permissionMode,
-        planMode,
-        onUIEvent,
-        requestApproval: hostRequestApproval,
-        requestQuestion: hostRequestQuestion,
-        ideAction,
-        keepRecentUnits,
-        compactRatio,
-        modelWindow,
-        parentSystemPrompt,
-        readTracker,
-        reportCost,
-        toolCostSink
-      } = ctx;
-      let calledName = "";
-      let calledArgs = {};
-      let parseFailed = false;
-      if (toolCall.type === "function") {
-        calledName = toolCall.function.name;
-        try {
-          calledArgs = JSON.parse(toolCall.function.arguments || "{}");
-        } catch {
-          parseFailed = true;
-        }
-        console.log(`\u{1F916} \u6A21\u578B\u8BF7\u6C42\u8C03\u7528\u5DE5\u5177: ${calledName}\uFF0C\u53C2\u6570:`, calledArgs);
-      }
-      if (calledName === "exit_plan_mode") {
+    failResult = (state, text, cat = "runtime") => {
+      state.result = text;
+      state.resultStatus = "failed";
+      state.errorCategory = cat;
+    };
+    emitValidationFailed = (ctx, toolCall, state) => {
+      ctx.events({ sessionId: ctx.sessionId, eventType: "tool.validation.failed", metadata: { depth: ctx.depth, decisionSource: ctx.llmDecisionSource, durationMs: performance.now() - ctx.startTime, round: ctx.round, tools_id: toolCall.id, toolName: state.calledName, toolSource: "builtin", ok: false, attempt: ctx.round }, payload: { output: state.result } });
+    };
+    resolveEarlyOutcome = (ctx, toolCall, state) => {
+      const { signal, planMode, planWriteRejections } = ctx;
+      const { calledName, calledArgs, matchedTool, parseFailed } = state;
+      const declaredTerminal = matchedTool?.function?.terminal;
+      if (declaredTerminal === "plan_exit" || !declaredTerminal && calledName === "exit_plan_mode") {
         const plan = typeof calledArgs?.plan === "string" ? calledArgs.plan : "";
         const note = "\u2705 [\u8BA1\u5212\u6A21\u5F0F] \u5B9E\u73B0\u65B9\u6848\u5DF2\u63D0\u4EA4\uFF0C\u7B49\u5F85\u7528\u6237\u5BA1\u6279\u540E\u8FDB\u5165\u5B9E\u73B0\u9636\u6BB5\u3002";
         return { toolCallId: toolCall.id, calledName, calledArgs, resultForModel: note, resultForUser: note, ok: true, terminal: { kind: "exit_plan_mode", plan } };
       }
-      if (calledName === "enter_plan_mode") {
+      if (declaredTerminal === "plan_enter" || !declaredTerminal && calledName === "enter_plan_mode") {
         if (planMode) {
           const note2 = "\uFF08\u5DF2\u5728\u8BA1\u5212\u6A21\u5F0F\u4E2D\uFF0C\u65E0\u9700\u91CD\u590D\u8FDB\u5165\u3002\u8BF7\u7EE7\u7EED\u53EA\u8BFB\u8C03\u7814\uFF0C\u5B8C\u6210\u540E\u8C03 exit_plan_mode \u63D0\u4EA4\u65B9\u6848\u3002\uFF09";
           return { toolCallId: toolCall.id, calledName, calledArgs, resultForModel: note2, resultForUser: note2, ok: true };
@@ -11949,227 +12103,294 @@ var init_toolExecution = __esm({
         const placeholder = "\uFF08\u5DF2\u4E2D\u6B62\uFF0C\u672A\u6267\u884C\uFF09";
         return { toolCallId: toolCall.id, calledName, calledArgs, resultForModel: placeholder, resultForUser: placeholder, ok: false, aborted: true };
       }
-      const matchedTool = rawTools.find((t) => t.function.name === calledName);
-      if (!parseFailed && planMode && appConfig.planEnforcement === "runtime" && calledName !== "enter_plan_mode" && calledName !== "exit_plan_mode" && matchedTool?.function?.planAllowed !== true) {
+      if (!parseFailed && planMode && appConfig.planEnforcement === "runtime" && calledName !== "enter_plan_mode" && calledName !== "exit_plan_mode" && declaredTerminal !== "plan_enter" && declaredTerminal !== "plan_exit" && matchedTool?.function?.planAllowed !== true) {
+        if (matchedTool && matchedTool.function.safetyLevel !== "safe" /* SAFE */) planWriteRejections?.(1);
         const note = `\u274C [\u8BA1\u5212\u6A21\u5F0F] \u5F53\u524D\u4E3A\u53EA\u8BFB\u8C03\u7814\u9636\u6BB5\uFF0C\u7981\u6B62 ${calledName}\u3002\u5B8C\u6210\u65B9\u6848\u8BF7\u8C03 exit_plan_mode \u63D0\u4EA4\uFF0C\u7ECF\u7528\u6237\u5BA1\u6279\u540E\u8FDB\u5165\u5B9E\u73B0\u9636\u6BB5\u3002`;
-        events({ sessionId, eventType: "tool.validation.failed", metadata: { depth, decisionSource: llmDecisionSource, durationMs: performance.now() - startTime, round, tools_id: toolCall.id, toolName: calledName, toolSource: "builtin", ok: false, attempt: round }, payload: { output: note } });
+        state.result = note;
+        emitValidationFailed(ctx, toolCall, state);
         return { toolCallId: toolCall.id, calledName, calledArgs, resultForModel: note, resultForUser: note, ok: false };
       }
-      const toolCtx = { sessionId, cwd: getActiveWorkspaceRoot(), abortSignal: signal, depth, keepRecentUnits, compactRatio, modelWindow, parentSystemPrompt, events, onUIEvent, requestApproval: hostRequestApproval, requestQuestion: hostRequestQuestion, ideAction, emitProgress: (m) => onUIEvent?.({ type: "tool.progress", toolsId: toolCall.id, toolName: calledName, message: m }), permissionMode, readTracker, reportCost, toolCostSink };
-      let result = "";
-      let resultStatus = "success";
-      let errorCategory;
-      const failResult = (text, cat = "runtime") => {
-        result = text;
-        resultStatus = "failed";
-        errorCategory = cat;
-      };
-      let postHookOverride;
-      let imageAttachments;
-      if (parseFailed) {
-        failResult(`\u53C2\u6570\u89E3\u6790\u5931\u8D25\uFF1A\u6A21\u578B\u8FD4\u56DE\u7684 arguments \u4E0D\u662F\u5408\u6CD5 JSON${JSON.stringify(toolCall).slice(0, 300)}`, "syntax");
-        events({ sessionId, eventType: "tool.validation.failed", metadata: { depth, decisionSource: llmDecisionSource, durationMs: performance.now() - startTime, round, tools_id: toolCall.id, toolName: calledName, toolSource: "builtin", ok: false, attempt: round }, payload: { output: result } });
-      } else if (matchedTool && typeof matchedTool.function.execute === "function") {
-        const level = matchedTool.function.safetyLevel;
-        let needApproval = level === "mutation" /* MUTATION */ || level === "danger" /* DANGER */;
-        let denied = false;
-        let preHooksAdvanced = false;
-        if (appConfig.hookRewrite) {
-          preHooksAdvanced = true;
-          let veto;
-          try {
-            veto = await runPreHooks(resolveMcpPermissionName(calledName, calledArgs), calledArgs, toolCtx);
-          } catch (e) {
-            veto = { deny: true, reason: `\u274C [Pre-hook \u5F02\u5E38]\uFF1A${e?.message ?? e}\u3002\u51FA\u4E8E\u5B89\u5168\u9ED8\u8BA4\u62D2\u7EDD [${calledName}] \u7684\u6267\u884C\u3002` };
-          }
-          if (veto.deny) {
-            denied = true;
-            failResult(veto.reason || `\u274C [Hook \u62E6\u622A]\uFF1Apre-hook \u62D2\u7EDD\u4E86 [${calledName}] \u7684\u6267\u884C\u3002`, "permission");
-          } else if (veto.argsOverride !== void 0 && veto.argsOverride !== null && typeof veto.argsOverride === "object" && !Array.isArray(veto.argsOverride)) {
-            console.log(`\u270F\uFE0F [Pre-hook] [${calledName}] args \u5DF2\u88AB hook \u6539\u5199`);
-            calledArgs = veto.argsOverride;
-          }
+      return null;
+    };
+    runSecurityGates = async (ctx, toolCall, state, toolCtx) => {
+      const { sessionId, permissionMode } = ctx;
+      const { calledName, calledArgs, matchedTool } = state;
+      const level = matchedTool.function.safetyLevel;
+      let needApproval = level === "mutation" /* MUTATION */ || level === "danger" /* DANGER */;
+      let autoGateAsked = false;
+      let preHooksAdvanced = false;
+      if (appConfig.hookRewrite) {
+        preHooksAdvanced = true;
+        let veto;
+        try {
+          veto = await runPreHooks(resolveMcpPermissionName(calledName, calledArgs), calledArgs, toolCtx);
+        } catch (e) {
+          veto = { deny: true, reason: `\u274C [Pre-hook \u5F02\u5E38]\uFF1A${e?.message ?? e}\u3002\u51FA\u4E8E\u5B89\u5168\u9ED8\u8BA4\u62D2\u7EDD [${calledName}] \u7684\u6267\u884C\u3002` };
         }
-        {
-          const paramsSchema = matchedTool.function.parameters;
-          if (paramsSchema && typeof paramsSchema === "object" && !Array.isArray(paramsSchema)) {
-            const verdict = validateToolArgs(paramsSchema, calledArgs);
-            if (!verdict.ok) {
-              denied = true;
-              failResult(`\u274C \u53C2\u6570\u6821\u9A8C\u5931\u8D25\uFF1A${verdict.message}\uFF1B\u8BF7\u4FEE\u6B63\u53C2\u6570\u540E\u91CD\u8BD5\uFF08schema \u8981\u6C42\u89C1\u5DE5\u5177 parameters\uFF09\u3002`, "syntax");
-              events({ sessionId, eventType: "tool.validation.failed", metadata: { depth, decisionSource: llmDecisionSource, durationMs: performance.now() - startTime, round, tools_id: toolCall.id, toolName: calledName, toolSource: "builtin", ok: false, attempt: round }, payload: { output: result } });
-            }
+        if (veto.deny) {
+          state.denied = true;
+          failResult(state, veto.reason || `\u274C [Hook \u62E6\u622A]\uFF1Apre-hook \u62D2\u7EDD\u4E86 [${calledName}] \u7684\u6267\u884C\u3002`, "permission");
+        } else if (veto.argsOverride !== void 0 && veto.argsOverride !== null && typeof veto.argsOverride === "object" && !Array.isArray(veto.argsOverride)) {
+          console.log(`\u270F\uFE0F [Pre-hook] [${calledName}] args \u5DF2\u88AB hook \u6539\u5199`);
+          state.calledArgs = veto.argsOverride;
+        }
+      }
+      {
+        const paramsSchema = matchedTool.function.parameters;
+        if (paramsSchema && typeof paramsSchema === "object" && !Array.isArray(paramsSchema)) {
+          const verdict = validateToolArgs(paramsSchema, state.calledArgs);
+          if (!verdict.ok) {
+            state.denied = true;
+            failResult(state, `\u274C \u53C2\u6570\u6821\u9A8C\u5931\u8D25\uFF1A${verdict.message}\uFF1B\u8BF7\u4FEE\u6B63\u53C2\u6570\u540E\u91CD\u8BD5\uFF08schema \u8981\u6C42\u89C1\u5DE5\u5177 parameters\uFF09\u3002`, "syntax");
+            emitValidationFailed(ctx, toolCall, state);
           }
         }
-        const pathArgs = matchedTool.function.pathArgs ?? (matchedTool.function.triggersUndo ? ["path"] : []);
-        const protectedPaths = pathArgs.map((k) => calledArgs?.[k]);
-        const hitProtected = protectedPaths.find((p) => typeof p === "string" && isProtectedWrite(p, toolCtx.cwd));
-        if (hitProtected) {
-          denied = true;
-          failResult(`\u274C [\u4FDD\u62A4\u8DEF\u5F84] \u7981\u6B62\u4FEE\u6539\u53D7\u4FDD\u62A4\u76EE\u5F55\uFF08.git/.ssh/.aws/.deepseeker-code \u7B49 VCS/\u51ED\u8BC1/\u914D\u7F6E\uFF09\uFF1A${hitProtected}\u3002`, "permission");
+      }
+      const pathArgs = matchedTool.function.pathArgs ?? (matchedTool.function.triggersUndo ? ["path"] : []);
+      const protectedPaths = pathArgs.map((k) => state.calledArgs?.[k]);
+      const hitProtected = protectedPaths.find((p) => typeof p === "string" && isProtectedWrite(p, toolCtx.cwd));
+      if (hitProtected) {
+        state.denied = true;
+        failResult(state, `\u274C [\u4FDD\u62A4\u8DEF\u5F84] \u7981\u6B62\u4FEE\u6539\u53D7\u4FDD\u62A4\u76EE\u5F55\uFF08.git/.ssh/.aws/.deepseeker-code \u7B49 VCS/\u51ED\u8BC1/\u914D\u7F6E\uFF09\uFF1A${hitProtected}\u3002`, "permission");
+      }
+      let perm = null;
+      try {
+        perm = checkPermission(resolveMcpPermissionName(calledName, state.calledArgs), state.calledArgs, matchedTool.function.primaryArg, sessionId);
+        if (perm === "deny") {
+          state.denied = true;
+          failResult(state, `\u274C [\u6743\u9650\u89C4\u5219]\uFF1A[${calledName}] \u88AB\u6743\u9650\u89C4\u5219 deny \u62D2\u7EDD\u3002`, "permission");
+        } else if (perm === "allow") {
+          needApproval = false;
+        } else if (perm === "ask") {
+          needApproval = true;
         }
-        let perm = null;
+      } catch {
+        perm = null;
+      }
+      const isCommandTool = matchedTool.function.argKind === "command";
+      const isForegroundCommand = isCommandTool && matchedTool.function.isSync !== false;
+      const cmdIsScriptRunner = isCommandTool && isScriptRunnerCommand(typeof state.calledArgs?.command === "string" ? state.calledArgs.command : "");
+      const argCwd = typeof state.calledArgs?.cwd === "string" ? state.calledArgs.cwd.trim() : "";
+      const samePath = (a, b) => {
         try {
-          perm = checkPermission(resolveMcpPermissionName(calledName, calledArgs), calledArgs, matchedTool.function.primaryArg);
-          if (perm === "deny") {
-            denied = true;
-            failResult(`\u274C [\u6743\u9650\u89C4\u5219]\uFF1A[${calledName}] \u88AB\u6743\u9650\u89C4\u5219 deny \u62D2\u7EDD\u3002`, "permission");
-          } else if (perm === "allow") {
-            needApproval = false;
-          } else if (perm === "ask") {
-            needApproval = true;
-          }
+          const ra = path36.resolve(a), rb = path36.resolve(b);
+          return process.platform === "win32" ? ra.toLowerCase() === rb.toLowerCase() : ra === rb;
         } catch {
-          perm = null;
+          return false;
         }
-        const cmdIsScriptRunner = (calledName === "run_command" || calledName === "run_in_background") && isScriptRunnerCommand(typeof calledArgs?.command === "string" ? calledArgs.command : "");
-        const argCwd = typeof calledArgs?.cwd === "string" ? calledArgs.cwd.trim() : "";
-        const samePath = (a, b) => {
-          try {
-            const ra = path36.resolve(a), rb = path36.resolve(b);
-            return process.platform === "win32" ? ra.toLowerCase() === rb.toLowerCase() : ra === rb;
-          } catch {
-            return false;
-          }
-        };
-        const scriptRunnerCwdDrift = cmdIsScriptRunner && argCwd !== "" && !samePath(argCwd, toolCtx.cwd ?? process.cwd());
-        const scriptRunnerBlocked = cmdIsScriptRunner && (perm === null || scriptRunnerCwdDrift);
-        if (scriptRunnerCwdDrift) needApproval = true;
-        if (perm === null && needApproval && !denied && !scriptRunnerBlocked && calledName === "run_command" && isReadOnlyCommand(typeof calledArgs?.command === "string" ? calledArgs.command : "")) {
+      };
+      const scriptRunnerCwdDrift = cmdIsScriptRunner && argCwd !== "" && !samePath(argCwd, toolCtx.cwd ?? process.cwd());
+      const scriptRunnerBlocked = cmdIsScriptRunner && (perm === null || scriptRunnerCwdDrift);
+      if (scriptRunnerCwdDrift) needApproval = true;
+      if (perm === null && needApproval && !state.denied && !scriptRunnerBlocked && isForegroundCommand && isReadOnlyCommand(typeof state.calledArgs?.command === "string" ? state.calledArgs.command : "")) {
+        needApproval = false;
+      }
+      if (isCommandTool && matchCommandDeny(typeof state.calledArgs?.command === "string" ? state.calledArgs.command : "")) {
+        state.denied = true;
+        failResult(state, `\u274C [\u5B89\u5168] \u707E\u96BE\u547D\u4EE4\u6E05\u5355\u62E6\u622A\uFF08\u4E0D\u53EF\u88AB allow \u89C4\u5219\u7ED5\u8FC7\uFF09\uFF1A[${calledName}] ${String(state.calledArgs?.command ?? "").slice(0, 100)}`, "permission");
+      }
+      state.isBgTool = matchedTool.function.isSync === false;
+      state.lockKey = state.isBgTool ? computeLockKey(matchedTool.function.exclusiveLock, state.calledArgs, toolCtx) : null;
+      if (state.lockKey && isLockHeld(state.lockKey)) {
+        state.denied = true;
+        failResult(state, `\u{1F512} [\u4E92\u65A5\u9501\u963B\u585E]\uFF1A\u5DF2\u6709\u540E\u53F0\u4EFB\u52A1\u6301\u6709\u9501 [${state.lockKey}]\uFF0C[${calledName}] \u8C03\u7528\u88AB\u8DF3\u8FC7\u3002`);
+      }
+      if (needApproval && !state.denied && !scriptRunnerBlocked) {
+        const auto = await runAutoCheck(
+          resolveMcpPermissionName(calledName, state.calledArgs),
+          state.calledArgs,
+          toolCtx,
+          permissionMode === "auto",
+          // ★ P0-3（裁定 B 方案）：decl 补齐 safetyLevel/triggersUndo——快路径三条件缺一不可，
+          //   两者都来自工具声明（勿在此处按名特判，名单已 #8a 声明化退役）。
+          { autoApproval: matchedTool.function.autoApproval, pathArgs: matchedTool.function.pathArgs, primaryArg: matchedTool.function.primaryArg, safetyLevel: matchedTool.function.safetyLevel, triggersUndo: matchedTool.function.triggersUndo }
+        );
+        if (auto === "allow") {
           needApproval = false;
+        } else if (auto === "deny") {
+          state.denied = true;
+          failResult(state, `\u274C [auto] \u5185\u7F6E\u9AD8\u5371\u6E05\u5355\u62E6\u622A\uFF1A[${calledName}] ${state.calledArgs?.path ?? ""}\u3002`, "permission");
+        } else {
+          autoGateAsked = true;
         }
-        if ((calledName === "run_command" || calledName === "run_in_background") && matchCommandDeny(typeof calledArgs?.command === "string" ? calledArgs.command : "")) {
-          denied = true;
-          failResult(`\u274C [\u5B89\u5168] \u707E\u96BE\u547D\u4EE4\u6E05\u5355\u62E6\u622A\uFF08\u4E0D\u53EF\u88AB allow \u89C4\u5219\u7ED5\u8FC7\uFF09\uFF1A[${calledName}] ${String(calledArgs?.command ?? "").slice(0, 100)}`, "permission");
-        }
-        const isBgTool = matchedTool.function.isSync === false;
-        const lockKey = isBgTool ? computeLockKey(matchedTool.function.exclusiveLock, calledArgs, toolCtx) : null;
-        if (lockKey && isLockHeld(lockKey)) {
-          denied = true;
-          failResult(`\u{1F512} [\u4E92\u65A5\u9501\u963B\u585E]\uFF1A\u5DF2\u6709\u540E\u53F0\u4EFB\u52A1\u6301\u6709\u9501 [${lockKey}]\uFF0C[${calledName}] \u8C03\u7528\u88AB\u8DF3\u8FC7\u3002`);
-        }
-        if (needApproval && !denied && !scriptRunnerBlocked) {
-          const auto = await runAutoCheck(
-            resolveMcpPermissionName(calledName, calledArgs),
-            calledArgs,
-            toolCtx,
-            permissionMode === "auto",
-            { autoApproval: matchedTool.function.autoApproval, pathArgs: matchedTool.function.pathArgs, primaryArg: matchedTool.function.primaryArg }
-          );
-          if (auto === "allow") {
-            needApproval = false;
-          } else if (auto === "deny") {
-            denied = true;
-            failResult(`\u274C [auto] \u5185\u7F6E\u9AD8\u5371\u6E05\u5355\u62E6\u622A\uFF1A[${calledName}] ${calledArgs?.path ?? ""}\u3002`, "permission");
-          }
+      }
+      if (needApproval && !state.denied) {
+        const ra = matchedTool.function.requireApproval;
+        let detail = `\u7533\u8BF7\u6267\u884C\u9AD8\u5371\u5DE5\u5177 [${calledName}]`;
+        try {
+          if (ra) detail = typeof ra === "function" ? await ra(state.calledArgs, toolCtx) : ra;
+        } catch (e) {
+          state.denied = true;
+          failResult(state, `\u274C [\u5BA1\u6279\u63CF\u8FF0\u751F\u6210\u5F02\u5E38]\uFF1A${e?.message ?? e}\u3002\u51FA\u4E8E\u5B89\u5168\u9ED8\u8BA4\u62D2\u7EDD [${calledName}] \u7684\u6267\u884C\u3002`, "permission");
         }
-        if (needApproval && !denied) {
-          const ra = matchedTool.function.requireApproval;
-          let detail = `\u7533\u8BF7\u6267\u884C\u9AD8\u5371\u5DE5\u5177 [${calledName}]`;
+        if (autoGateAsked) detail += `
+\uFF08\u2139\uFE0F \u8BF4\u660E\uFF1A\u672C\u8C03\u7528\u672A\u83B7\u81EA\u52A8\u653E\u884C\u2014\u2014\u4E0D\u5728\u81EA\u52A8\u653E\u884C\u8303\u56F4 / \u5B89\u5168\u5206\u7C7B\u5668\u5224 risky / \u5224\u5B9A\u8D85\u65F6\uFF08\u5206\u7C7B\u5668\u4E0A\u9650 10s\uFF09\u6216\u5F02\u5E38\uFF0C\u6309 fail-closed \u8F6C\u4EBA\u5DE5\u5BA1\u6279\u3002\uFF09`;
+        if (!state.denied) {
+          let approved2 = false;
           try {
-            if (ra) detail = typeof ra === "function" ? await ra(calledArgs, toolCtx) : ra;
+            approved2 = await requestApproval(calledName, toolCall.id, detail, toolCtx, level, state.calledArgs, matchedTool.function.primaryArg);
           } catch (e) {
-            denied = true;
-            failResult(`\u274C [\u5BA1\u6279\u63CF\u8FF0\u751F\u6210\u5F02\u5E38]\uFF1A${e?.message ?? e}\u3002\u51FA\u4E8E\u5B89\u5168\u9ED8\u8BA4\u62D2\u7EDD [${calledName}] \u7684\u6267\u884C\u3002`, "permission");
+            state.denied = true;
+            failResult(state, `\u274C [\u5BA1\u6279\u6D41\u7A0B\u5F02\u5E38]\uFF1A${e?.message ?? e}\u3002\u51FA\u4E8E\u5B89\u5168\u9ED8\u8BA4\u62D2\u7EDD [${calledName}] \u7684\u6267\u884C\u3002`, "permission");
           }
-          if (!denied) {
-            let approved2 = false;
-            try {
-              approved2 = await requestApproval(calledName, toolCall.id, detail, toolCtx, level, calledArgs, matchedTool.function.primaryArg);
-            } catch (e) {
-              denied = true;
-              failResult(`\u274C [\u5BA1\u6279\u6D41\u7A0B\u5F02\u5E38]\uFF1A${e?.message ?? e}\u3002\u51FA\u4E8E\u5B89\u5168\u9ED8\u8BA4\u62D2\u7EDD [${calledName}] \u7684\u6267\u884C\u3002`, "permission");
-            }
-            if (!approved2 && !denied) {
-              denied = true;
-              failResult(`\u274C [\u5B89\u5168\u7194\u65AD]\uFF1A\u7528\u6237\u62D2\u7EDD\u4E86 [${calledName}] \u7684\u6267\u884C\u7533\u8BF7\u3002`, "permission");
-            }
+          if (!approved2 && !state.denied) {
+            state.denied = true;
+            failResult(state, `\u274C [\u5B89\u5168\u7194\u65AD]\uFF1A\u7528\u6237\u62D2\u7EDD\u4E86 [${calledName}] \u7684\u6267\u884C\u7533\u8BF7\u3002`, "permission");
           }
         }
-        if (!denied && !preHooksAdvanced) {
-          let veto;
-          try {
-            veto = await runPreHooks(resolveMcpPermissionName(calledName, calledArgs), calledArgs, toolCtx);
-          } catch (e) {
-            veto = { deny: true, reason: `\u274C [Pre-hook \u5F02\u5E38]\uFF1A${e?.message ?? e}\u3002\u51FA\u4E8E\u5B89\u5168\u9ED8\u8BA4\u62D2\u7EDD [${calledName}] \u7684\u6267\u884C\u3002` };
-          }
-          if (veto.deny) {
-            denied = true;
-            failResult(veto.reason || `\u274C [Hook \u62E6\u622A]\uFF1Apre-hook \u62D2\u7EDD\u4E86 [${calledName}] \u7684\u6267\u884C\u3002`, "permission");
-          }
+      }
+      if (!state.denied && !preHooksAdvanced) {
+        let veto;
+        try {
+          veto = await runPreHooks(resolveMcpPermissionName(calledName, state.calledArgs), state.calledArgs, toolCtx);
+        } catch (e) {
+          veto = { deny: true, reason: `\u274C [Pre-hook \u5F02\u5E38]\uFF1A${e?.message ?? e}\u3002\u51FA\u4E8E\u5B89\u5168\u9ED8\u8BA4\u62D2\u7EDD [${calledName}] \u7684\u6267\u884C\u3002` };
         }
-        if (!denied && matchedTool.function.triggersUndo) {
-          try {
-            await beforeMutationBackup(matchedTool.function.triggersUndo, calledName, calledArgs, toolCall.id, sessionId);
-          } catch (e) {
-            denied = true;
-            failResult(`\u274C [Undo \u5907\u4EFD\u5931\u8D25\xB7\u5B89\u5168\u7194\u65AD]\uFF1A${e?.message ?? e}\u3002\u5199\u5165\u5DF2\u963B\u6B62\uFF08\u51E1\u6539\u5FC5\u53EF\u56DE\u9000\u539F\u5219\uFF09\u3002`);
-          }
+        if (veto.deny) {
+          state.denied = true;
+          failResult(state, veto.reason || `\u274C [Hook \u62E6\u622A]\uFF1Apre-hook \u62D2\u7EDD\u4E86 [${calledName}] \u7684\u6267\u884C\u3002`, "permission");
         }
-        if (!denied) {
-          try {
-            events({ sessionId, eventType: "tool.execute.start", metadata: { depth, decisionSource: llmDecisionSource, durationMs: performance.now() - startTime, round, tools_id: toolCall.id, toolName: calledName, toolSource: "builtin" }, payload: { output: JSON.stringify(calledArgs) } });
-            const execRet = matchedTool.function.execute(calledArgs, toolCtx);
-            const collected = isBgTool ? await runBackgroundTool(execRet, lockKey, calledName, signal) : await collectToolResult(execRet, (chunk) => toolCtx.emitProgress?.(chunk), signal);
-            result = collected.content;
-            resultStatus = collected.status;
-            imageAttachments = collected.images;
-            if (collected.status === "failed") errorCategory = collected.errorCategory ?? "runtime";
-            if (matchedTool.function.verifyResult) {
-              const verdict = matchedTool.function.verifyResult(result, toolCtx);
-              if (verdict.status === "failed" /* FAILED */) {
-                result = `\u3010\u7CFB\u7EDF\u5224\u5B9A\uFF1A\u6267\u884C\u5931\u8D25\u3011${verdict.summary ?? ""}
+      }
+      const denied = state.denied;
+      if (!denied && matchedTool.function.triggersUndo) {
+        try {
+          await beforeMutationBackup(matchedTool.function.triggersUndo, calledName, state.calledArgs, toolCall.id, sessionId);
+        } catch (e) {
+          state.denied = true;
+          failResult(state, `\u274C [Undo \u5907\u4EFD\u5931\u8D25\xB7\u5B89\u5168\u7194\u65AD]\uFF1A${e?.message ?? e}\u3002\u5199\u5165\u5DF2\u963B\u6B62\uFF08\u51E1\u6539\u5FC5\u53EF\u56DE\u9000\u539F\u5219\uFF09\u3002`);
+        }
+      }
+    };
+    executeTool = async (ctx, toolCall, state, toolCtx) => {
+      const { sessionId, depth, round, startTime, llmDecisionSource, signal, events } = ctx;
+      const { calledName, calledArgs, matchedTool } = state;
+      try {
+        events({ sessionId, eventType: "tool.execute.start", metadata: { depth, decisionSource: llmDecisionSource, durationMs: performance.now() - startTime, round, tools_id: toolCall.id, toolName: calledName, toolSource: "builtin" }, payload: { output: JSON.stringify(calledArgs) } });
+        const execRet = matchedTool.function.execute(calledArgs, toolCtx);
+        const collected = state.isBgTool ? await runBackgroundTool(execRet, state.lockKey, calledName, signal) : await collectToolResult(execRet, (chunk) => toolCtx.emitProgress?.(chunk), signal);
+        state.result = collected.content;
+        state.resultStatus = collected.status;
+        state.imageAttachments = collected.images;
+        if (collected.status === "failed") state.errorCategory = collected.errorCategory ?? "runtime";
+        if (matchedTool.function.verifyResult) {
+          const verdict = matchedTool.function.verifyResult(state.result, toolCtx);
+          if (verdict.status === "failed" /* FAILED */) {
+            state.result = `\u3010\u7CFB\u7EDF\u5224\u5B9A\uFF1A\u6267\u884C\u5931\u8D25\u3011${verdict.summary ?? ""}
 \u8BF7\u6B63\u89C6\u4E0B\u65B9\u8F93\u51FA\uFF0C\u4E0D\u8981\u4E50\u89C2\u5047\u8BBE\u6210\u529F\u3002
 
-${result}`;
-                resultStatus = "failed";
-                errorCategory = verdict.errorCategory ?? "unknown";
-              }
-            }
-            if (resultStatus === "success") {
-              events({ sessionId, eventType: "tool.execute.end", metadata: { depth, decisionSource: llmDecisionSource, durationMs: performance.now() - startTime, round, tools_id: toolCall.id, toolName: calledName, toolSource: "builtin", ok: true }, payload: { output: result } });
-            } else {
-              events({ sessionId, eventType: "tool.failed", metadata: { depth, decisionSource: llmDecisionSource, durationMs: performance.now() - startTime, round, tools_id: toolCall.id, toolName: calledName, toolSource: "builtin", ok: false, attempt: round, errorCategory: errorCategory ?? "unknown" }, payload: { output: result } });
-            }
-          } catch (err) {
-            console.error(`\u274C \u6267\u884C\u5DE5\u5177 ${calledName} \u65F6\u53D1\u751F\u9519\u8BEF:`, err);
-            failResult(`\u5DE5\u5177\u6267\u884C\u5931\u8D25: ${err instanceof Error ? err.message : String(err)}`);
-            events({ sessionId, eventType: "tool.failed", metadata: { depth, decisionSource: llmDecisionSource, durationMs: performance.now() - startTime, round, tools_id: toolCall.id, toolName: calledName, toolSource: "builtin", ok: false, attempt: round, errorCategory: errorCategory ?? "runtime" }, payload: { output: result } });
-          }
-          try {
-            const post = await runPostHooks(resolveMcpPermissionName(calledName, calledArgs), calledArgs, result, toolCtx);
-            postHookOverride = post?.resultOverride;
-          } catch (e) {
-            console.warn(`\u26A0\uFE0F post-hook [${calledName}] \u5F02\u5E38\uFF08\u5DF2\u5FFD\u7565\uFF09:`, e?.message ?? e);
+${state.result}`;
+            state.resultStatus = "failed";
+            state.errorCategory = verdict.errorCategory ?? "unknown";
           }
         }
-      } else {
-        failResult(`\u9519\u8BEF\uFF1A\u672A\u77E5\u5DE5\u5177 "${calledName}" \u6216\u8BE5\u5DE5\u5177\u65E0\u53EF\u6267\u884C\u51FD\u6570`, "syntax");
-        events({ sessionId, eventType: "tool.validation.failed", metadata: { depth, decisionSource: llmDecisionSource, durationMs: performance.now() - startTime, round, tools_id: toolCall.id, toolName: calledName, toolSource: "builtin", ok: false, attempt: round }, payload: { output: result } });
+        if (state.resultStatus === "success") {
+          events({ sessionId, eventType: "tool.execute.end", metadata: { depth, decisionSource: llmDecisionSource, durationMs: performance.now() - startTime, round, tools_id: toolCall.id, toolName: calledName, toolSource: "builtin", ok: true }, payload: { output: state.result } });
+        } else {
+          events({ sessionId, eventType: "tool.failed", metadata: { depth, decisionSource: llmDecisionSource, durationMs: performance.now() - startTime, round, tools_id: toolCall.id, toolName: calledName, toolSource: "builtin", ok: false, attempt: round, errorCategory: state.errorCategory ?? "unknown" }, payload: { output: state.result } });
+        }
+      } catch (err) {
+        console.error(`\u274C \u6267\u884C\u5DE5\u5177 ${calledName} \u65F6\u53D1\u751F\u9519\u8BEF:`, err);
+        failResult(state, `\u5DE5\u5177\u6267\u884C\u5931\u8D25: ${err instanceof Error ? err.message : String(err)}`);
+        events({ sessionId, eventType: "tool.failed", metadata: { depth, decisionSource: llmDecisionSource, durationMs: performance.now() - startTime, round, tools_id: toolCall.id, toolName: calledName, toolSource: "builtin", ok: false, attempt: round, errorCategory: state.errorCategory ?? "runtime" }, payload: { output: state.result } });
       }
-      result = applyPrivacyMasking(matchedTool?.function?.privacyMaskingRules, calledArgs, result);
-      const fill = ctx.contextTokensEst !== void 0 && modelWindow > 0 ? ctx.contextTokensEst / modelWindow : void 0;
+      try {
+        const post = await runPostHooks(resolveMcpPermissionName(calledName, calledArgs), calledArgs, state.result, toolCtx);
+        state.postHookOverride = post?.resultOverride;
+      } catch (e) {
+        console.warn(`\u26A0\uFE0F post-hook [${calledName}] \u5F02\u5E38\uFF08\u5DF2\u5FFD\u7565\uFF09:`, e?.message ?? e);
+      }
+    };
+    finalizeOutcome = async (ctx, toolCall, state) => {
+      const { sessionId, modelWindow, contextTokensEst } = ctx;
+      const { calledName, calledArgs, matchedTool } = state;
+      state.result = applyPrivacyMasking(matchedTool?.function?.privacyMaskingRules, calledArgs, state.result);
+      const fill = contextTokensEst !== void 0 && modelWindow > 0 ? contextTokensEst / modelWindow : void 0;
       const truncBudget = scaleTruncBudget(matchedTool?.function?.maxOutputCharacters ?? appConfig.MAX_TOOL_RESULT_CHARS, fill);
-      const sidecarNote = result.length > truncBudget ? await writeSidecarArchive(sessionId, String(toolCall.id), result) : void 0;
-      result = truncateToolResult(result, truncBudget, sidecarNote);
+      const sidecarNote = state.result.length > truncBudget ? await writeSidecarArchive(sessionId, String(toolCall.id), state.result) : void 0;
+      state.result = truncateToolResult(state.result, truncBudget, sidecarNote);
+      const resultStatus = state.resultStatus;
       const ok = resultStatus === "success";
-      let resultForModel = result;
-      let resultForUser = result;
+      let resultForModel = state.result;
+      let resultForUser = state.result;
       if (matchedTool?.function?.outputFilter) {
         try {
-          const split = matchedTool.function.outputFilter(result);
+          const split = matchedTool.function.outputFilter(state.result);
           resultForModel = split.toModel;
           resultForUser = split.toUser;
         } catch {
         }
       }
-      if (postHookOverride !== void 0) {
+      if (state.postHookOverride !== void 0) {
         console.log(`\u270F\uFE0F [Post-hook] [${calledName}] \u6A21\u578B\u89C6\u56FE\u7ED3\u679C\u5DF2\u88AB hook \u6539\u5199`);
         const overrideBudget = scaleTruncBudget(matchedTool?.function?.maxOutputCharacters ?? appConfig.MAX_TOOL_RESULT_CHARS, fill);
-        const overrideNote = postHookOverride.length > overrideBudget ? await writeSidecarArchive(sessionId, String(toolCall.id), postHookOverride) : void 0;
-        resultForModel = truncateToolResult(postHookOverride, overrideBudget, overrideNote);
+        const overrideNote = state.postHookOverride.length > overrideBudget ? await writeSidecarArchive(sessionId, String(toolCall.id), state.postHookOverride) : void 0;
+        resultForModel = truncateToolResult(state.postHookOverride, overrideBudget, overrideNote);
       }
-      return { toolCallId: toolCall.id, calledName, calledArgs, resultForModel, resultForUser, ok, imageAttachments };
+      const declaredTerminal = matchedTool?.function?.terminal;
+      if (declaredTerminal === true) {
+        return { toolCallId: toolCall.id, calledName, calledArgs, resultForModel, resultForUser, ok, imageAttachments: state.imageAttachments, terminal: { kind: "generic" } };
+      }
+      return { toolCallId: toolCall.id, calledName, calledArgs, resultForModel, resultForUser, ok, imageAttachments: state.imageAttachments };
+    };
+    processToolCall = async (toolCall, ctx) => {
+      const state = {
+        calledName: "",
+        calledArgs: {},
+        parseFailed: false,
+        matchedTool: void 0,
+        result: "",
+        resultStatus: "success",
+        errorCategory: void 0,
+        denied: false,
+        postHookOverride: void 0,
+        imageAttachments: void 0,
+        isBgTool: false,
+        lockKey: null
+      };
+      if (toolCall.type === "function") {
+        state.calledName = toolCall.function.name;
+        try {
+          state.calledArgs = JSON.parse(toolCall.function.arguments || "{}");
+        } catch {
+          state.parseFailed = true;
+        }
+        console.log(`\u{1F916} \u6A21\u578B\u8BF7\u6C42\u8C03\u7528\u5DE5\u5177: ${state.calledName}\uFF0C\u53C2\u6570:`, state.calledArgs);
+      }
+      state.matchedTool = ctx.rawTools.find((t) => t.function.name === state.calledName);
+      const early = resolveEarlyOutcome(ctx, toolCall, state);
+      if (early) return early;
+      const {
+        sessionId,
+        depth,
+        signal,
+        events,
+        permissionMode,
+        onUIEvent,
+        requestApproval: hostRequestApproval,
+        requestQuestion: hostRequestQuestion,
+        ideAction,
+        keepRecentUnits,
+        compactRatio,
+        modelWindow,
+        parentSystemPrompt,
+        readTracker,
+        reportCost,
+        toolCostSink,
+        onAuxUsage,
+        budgetCheck
+      } = ctx;
+      const toolCtx = { sessionId, cwd: getActiveWorkspaceRoot(), abortSignal: signal, depth, keepRecentUnits, compactRatio, modelWindow, parentSystemPrompt, events, onUIEvent, requestApproval: hostRequestApproval, requestQuestion: hostRequestQuestion, ideAction, emitProgress: (m) => onUIEvent?.({ type: "tool.progress", toolsId: toolCall.id, toolName: state.calledName, message: m }), permissionMode, readTracker, reportCost, toolCostSink, onAuxUsage, budgetCheck };
+      if (state.parseFailed) {
+        failResult(state, `\u53C2\u6570\u89E3\u6790\u5931\u8D25\uFF1A\u6A21\u578B\u8FD4\u56DE\u7684 arguments \u4E0D\u662F\u5408\u6CD5 JSON${JSON.stringify(toolCall).slice(0, 300)}`, "syntax");
+        emitValidationFailed(ctx, toolCall, state);
+      } else if (state.matchedTool && typeof state.matchedTool.function.execute === "function") {
+        await runSecurityGates(ctx, toolCall, state, toolCtx);
+        if (!state.denied) await executeTool(ctx, toolCall, state, toolCtx);
+      } else {
+        failResult(state, `\u9519\u8BEF\uFF1A\u672A\u77E5\u5DE5\u5177 "${state.calledName}" \u6216\u8BE5\u5DE5\u5177\u65E0\u53EF\u6267\u884C\u51FD\u6570`, "syntax");
+        emitValidationFailed(ctx, toolCall, state);
+      }
+      return await finalizeOutcome(ctx, toolCall, state);
     };
   }
 });
@@ -12208,7 +12429,7 @@ var init_toolScheduling = __esm({
       const fillRestPlaceholders = async (fromIdx) => {
         const tcs2 = assistantMessage.tool_calls;
         for (let j = fromIdx + 1; j < tcs2.length; j++) {
-          const ph = "\uFF08\u5DF2\u8DF3\u8FC7\uFF1A\u7EC8\u7ED3\u7C7B\u5DE5\u5177 enter/exit_plan_mode \u4E4B\u540E\u7684\u5E76\u884C\u8C03\u7528\u672A\u6267\u884C\uFF09";
+          const ph = "\uFF08\u5DF2\u8DF3\u8FC7\uFF1A\u7EC8\u7ED3\u7C7B\u5DE5\u5177\u4E4B\u540E\u7684\u5E76\u884C\u8C03\u7528\u672A\u6267\u884C\uFF09";
           message.push({ role: "tool", tool_call_id: tcs2[j].id, content: ph });
           await appendMessage({ sessionId, role: "tool", tool_call_id: tcs2[j].id, content: ph });
         }
@@ -12227,14 +12448,15 @@ var init_toolScheduling = __esm({
       };
       const canParallelize = (name, args, parseFailed) => {
         if (!parallelSafeToolsEnabled || parseFailed || signal?.aborted) return false;
-        if (name === "exit_plan_mode" || name === "enter_plan_mode" || name === "ask_question") return false;
         const matched = rawTools.find((t) => t.function.name === name);
         if (!matched) return false;
+        if (matched.function.terminal) return false;
+        if (matched.function.parallelizable === false) return false;
         if (matched.function.triggersUndo) return false;
         if (matched.function.safetyLevel !== "safe" /* SAFE */) return false;
         if (matched.function.isSync === false) return false;
         try {
-          const perm = checkPermission(name, args, matched.function.primaryArg);
+          const perm = checkPermission(name, args, matched.function.primaryArg, sessionId);
           if (perm === "ask" || perm === "deny") return false;
         } catch {
           return false;
@@ -12303,9 +12525,11 @@ var init_toolScheduling = __esm({
             if (oc.terminal.kind === "exit_plan_mode") {
               yield { type: "plan.proposed", plan: oc.terminal.plan || "" };
               return { kind: "terminal", terminalText: oc.terminal.plan || oc.resultForUser };
-            } else {
+            } else if (oc.terminal.kind === "enter_plan_mode") {
               yield { type: "plan.enterRequested", reason: oc.terminal.reason || "" };
               return { kind: "terminal", terminalText: oc.terminal.reason ? `\u{1F4CB} \u6A21\u578B\u8BF7\u6C42\u8FDB\u5165\u8BA1\u5212\u6A21\u5F0F\uFF1A${oc.terminal.reason}` : oc.resultForUser };
+            } else {
+              return { kind: "terminal", terminalText: oc.resultForUser };
             }
           }
           yield { type: "tool.end", toolCallId: oc.toolCallId, toolName: oc.calledName, result: oc.resultForUser, ok: oc.ok };
@@ -12518,7 +12742,8 @@ var init_streamInference = __esm({
                 depth,
                 signal,
                 toolsTokens,
-                onUIEvent: ctx.onUIEvent
+                onUIEvent: ctx.onUIEvent,
+                onAuxUsage: ctx.onAuxUsage
               });
               inferenceMessages = withNudgeTail(message, nudgeMsg);
               compactedThisRound = true;
@@ -12600,7 +12825,7 @@ var init_streamInference = __esm({
 });
 
 // ../core/src/agent/agentNudges.ts
-var NUDGE_EVERY, NUDGE_FENCE, PHANTOM_FENCE, PHANTOM_RETRY_MAX, EARLY_FINAL_FENCE, EARLY_FINAL_TURN_THRESHOLD, EARLY_FINAL_MAX, TOOL_DIGEST_FENCE, TOOL_DIGEST_MAX, TOOL_DIGEST_WINDOW, TOOL_DIGEST_TEXT_MAX_LEN, PLAN_FIRST_FENCE, REPEAT_FENCE, READ_REPEAT_THRESHOLD, GREP_REPEAT_THRESHOLD, REPEAT_NUDGE_MAX, TODO_INCOMPLETE_FENCE, TODO_INCOMPLETE_MAX, BUDGET_FENCE, BUDGET_SOFT_TEXT, PHANTOM_TEXT, EARLY_FINAL_TEXT, TOOL_DIGEST_TEXT, usageNoteText, NUDGE_TEXT, COMPLEX_VERBS, COMPLEX_OBJECTS, COMPLEX_MARKERS, QUERY_LEAD, looksComplex, PLAN_FIRST_TEXT, looksComplete, parseToolCall, normPath, normQuery, REPEAT_READ_TEXT, REPEAT_GREP_TEXT, TODO_INCOMPLETE_TEXT, createNudgeScheduler;
+var NUDGE_EVERY, NUDGE_FENCE, PHANTOM_FENCE, PHANTOM_RETRY_MAX, EARLY_FINAL_FENCE, EARLY_FINAL_TURN_THRESHOLD, EARLY_FINAL_MAX, TOOL_DIGEST_FENCE, TOOL_DIGEST_MAX, TOOL_DIGEST_WINDOW, TOOL_DIGEST_TEXT_MAX_LEN, PLAN_FIRST_FENCE, REPEAT_FENCE, READ_REPEAT_THRESHOLD, GREP_REPEAT_THRESHOLD, REPEAT_NUDGE_MAX, TODO_INCOMPLETE_FENCE, TODO_INCOMPLETE_MAX, BUDGET_FENCE, BUDGET_SOFT_TEXT, PLAN_REJECT_FENCE, PLAN_REJECT_NUDGE_AT, PLAN_REJECT_FORCE_AT, PLAN_REJECT_TEXT, PLAN_REJECT_FORCE_FINAL_TEXT, PHANTOM_TEXT, EARLY_FINAL_TEXT, TOOL_DIGEST_TEXT, usageNoteText, NUDGE_TEXT, COMPLEX_VERBS, COMPLEX_OBJECTS, COMPLEX_MARKERS, QUERY_LEAD, looksComplex, PLAN_FIRST_TEXT, looksComplete, parseToolCall, normPath, normQuery, REPEAT_READ_TEXT, REPEAT_GREP_TEXT, TODO_INCOMPLETE_TEXT, createNudgeScheduler;
 var init_agentNudges = __esm({
   "../core/src/agent/agentNudges.ts"() {
     "use strict";
@@ -12627,9 +12852,14 @@ var init_agentNudges = __esm({
       const pct = budget > 0 ? Math.round(spent / budget * 100) : 100;
       return `\u5DF2\u82B1\u8D39 \xA5${spent.toFixed(3)} / \u9884\u7B97 \xA5${budget.toFixed(3)}\uFF08${pct}%\uFF09\uFF1A\u8BF7\u6536\u655B\u6536\u5C3E\uFF0C\u4E0D\u518D\u5C55\u5F00\u65B0\u63A2\u7D22\uFF1B\u82E5\u786E\u9700\u7EE7\u7EED\uFF0C\u7528\u4E00\u6BB5\u8BF4\u660E\u5269\u4F59\u5DE5\u4F5C\u540E\u5373\u6B62\u3002`;
     };
+    PLAN_REJECT_FENCE = "\u27E6DSC:PLAN_REJECT\u27E7";
+    PLAN_REJECT_NUDGE_AT = 2;
+    PLAN_REJECT_FORCE_AT = 4;
+    PLAN_REJECT_TEXT = (n) => `\u8BA1\u5212\u6A21\u5F0F\u4E0B\u4F60\u8C03\u7528\u5199\u7C7B\u5DE5\u5177\u5DF2\u88AB\u62D2\u7EDD ${n} \u6B21\uFF1A\u8BA1\u5212\u6A21\u5F0F\u53EA\u5141\u8BB8\u53EA\u8BFB\u8C03\u7814\uFF0C\u5199\u7C7B\u64CD\u4F5C\u987B\u5F85\u65B9\u6848\u7ECF\u7528\u6237\u6279\u51C6\u540E\u624D\u80FD\u6267\u884C\uFF0C\u7EE7\u7EED\u91CD\u8BD5\u53EA\u4F1A\u88AB\u518D\u6B21\u62D2\u7EDD\u3002\u8BF7\u505C\u6B62\u5199\u64CD\u4F5C\uFF0C\u6539\u7528\u53EA\u8BFB\u5DE5\u5177\uFF08read_file / search_grep / web_fetch \u7B49\uFF09\u7EE7\u7EED\u5B8C\u5584\u8C03\u7814\uFF0C\u6216\u6574\u7406\u5DF2\u6709\u53D1\u73B0\uFF0C\u7528 exit_plan_mode \u63D0\u4EA4\u5B9E\u73B0\u65B9\u6848\u3002`;
+    PLAN_REJECT_FORCE_FINAL_TEXT = (n) => `\u5DF2\u4E2D\u6B62\uFF1A\u8BA1\u5212\u6A21\u5F0F\u4E0B\u8FDE\u7EED ${n} \u6B21\u5199\u7C7B\u5DE5\u5177\u8C03\u7528\u88AB\u62D2\u7EDD\uFF0C\u6A21\u578B\u672A\u80FD\u4EA7\u51FA\u5B9E\u73B0\u65B9\u6848\u3002\u8BA1\u5212\u9636\u6BB5\u5230\u6B64\u4E3A\u6B62\uFF0C\u5DF2\u67E5\u660E\u7684\u4E8B\u5B9E\u4E0E\u8C03\u7814\u8BB0\u5F55\u4FDD\u7559\u5728\u4E0A\u4E0B\u6587\u4E2D\u2014\u2014\u4F60\u53EF\u4EE5\uFF1A\u2460\u8865\u5145\u8BF4\u660E\u9700\u6C42\u6216\u653E\u5BBD\u7EA6\u675F\u540E\u91CD\u8BD5\uFF1B\u2461\u8BA9 agent \u8DF3\u8FC7\u8BA1\u5212\u6A21\u5F0F\u76F4\u63A5\u5B9E\u73B0\uFF08\u9700\u81EA\u884C\u786E\u8BA4\u98CE\u9669\uFF09\uFF1B\u2462\u4EBA\u5DE5\u63A5\u624B\u5B8C\u6210\u5269\u4F59\u8C03\u7814\u3002`;
     PHANTOM_TEXT = "\u4F60\u7684\u4E0A\u4E00\u6761\u56DE\u590D\u6CA1\u6709\u4EFB\u4F55\u5185\u5BB9\u3001\u4E5F\u6CA1\u6709\u8C03\u7528\u4EFB\u4F55\u5DE5\u5177\uFF0C\u4F46\u4EFB\u52A1\u5C1A\u672A\u5B8C\u6210\u3002\u8BF7\u7EE7\u7EED\u63A8\u8FDB\uFF08\u8C03\u7528\u5DE5\u5177\u6216\u7ED9\u51FA\u5B9E\u8D28\u56DE\u7B54\uFF09\uFF1B\u82E5\u786E\u5B9E\u53D7\u963B\u3001\u9700\u8981\u7528\u6237\u51B3\u7B56\uFF0C\u7528 ask_question \u8BF4\u660E\u5177\u4F53\u963B\u585E\u70B9\u3002\u4E0D\u8981\u8FD4\u56DE\u7A7A\u56DE\u590D\u3002";
-    EARLY_FINAL_TEXT = (round) => `\u4F60\u4EC5 ${round} \u8F6E\u5C31\u51C6\u5907\u6536\u5C3E\uFF0C\u4E14\u56DE\u7B54\u4E2D\u6CA1\u6709\u660E\u786E\u7684\u5B8C\u6210\u58F0\u660E\u3002\u8BF7\u81EA\u68C0\uFF1A\u82E5\u7528\u6237\u8F93\u5165\u672C\u5C31\u65E0\u9700\u5DE5\u5177\uFF08\u5BD2\u6684/\u95F2\u804A/\u7EAF\u95EE\u7B54\uFF09\u3001\u6216\u4F60\u5728\u7B49\u7528\u6237\u6F84\u6E05\u51B3\u7B56\uFF0C\u76F4\u63A5\u6B63\u5E38\u56DE\u5E94\u5373\u53EF\uFF0C\u5FFD\u7565\u672C\u81EA\u68C0\u3001\u4E0D\u8981\u8F93\u51FA\u4EFB\u4F55\u81EA\u68C0\u8BF4\u660E\uFF1B\u82E5\u786E\u6709\u4EFB\u52A1\u672A\u843D\u5730\uFF08\u6240\u9700\u4FE1\u606F\u672A\u83B7\u53D6\u9F50 / \u8BE5\u6539\u7684\u6587\u4EF6\u672A\u6539\u5B8C / \u672A\u9A8C\u8BC1\uFF09\uFF0C\u7ACB\u5373\u7EE7\u7EED\u8C03\u7528\u5DE5\u5177\u63A8\u8FDB\uFF0C\u4E0D\u8981\u8349\u7387\u603B\u7ED3\u6536\u5C3E\uFF1B\u82E5\u786E\u5DF2\u5168\u90E8\u5B8C\u6210\uFF0C\u8BF7\u660E\u786E\u56DE\u590D\u300C\u5DF2\u5B8C\u6210\u300D\u5E76\u7B80\u8FF0\u6210\u679C\u3002`;
-    TOOL_DIGEST_TEXT = "\u4F60\u521A\u6267\u884C\u5B8C\u5DE5\u5177\u62FF\u5230\u7ED3\u679C\uFF0C\u5374\u672A\u57FA\u4E8E\u8BE5\u7ED3\u679C\u7ED9\u51FA\u5B9E\u8D28\u56DE\u5E94\u5C31\u51C6\u5907\u6536\u5C3E\u3002\u8BF7\u7ED3\u5408\u5DE5\u5177\u8FD4\u56DE\u7ED3\u679C\u7EE7\u7EED\u63A8\u8FDB\uFF1B\u82E5\u7ED3\u679C\u8868\u660E\u4EFB\u52A1\u5C1A\u672A\u5B8C\u6210\uFF08\u5982\u4ECD\u5728\u7F16\u8BD1/\u8FD0\u884C\u3001\u9700\u7EE7\u7EED\u8F6E\u8BE2\uFF09\uFF0C\u7ACB\u5373\u91C7\u53D6\u4E0B\u4E00\u6B65\u884C\u52A8\uFF0C\u4E0D\u8981\u7A7A\u624B\u6536\u5C3E\u3002\u82E5\u786E\u5DF2\u5168\u90E8\u5B8C\u6210\uFF0C\u8BF7\u660E\u786E\u56DE\u590D\u300C\u5DF2\u5B8C\u6210\u300D\u5E76\u7B80\u8FF0\u6210\u679C\u3002";
+    EARLY_FINAL_TEXT = (round) => `\u4F60\u4EC5 ${round} \u8F6E\u5C31\u51C6\u5907\u6536\u5C3E\uFF0C\u4E14\u56DE\u7B54\u4E2D\u6CA1\u6709\u660E\u786E\u7684\u5B8C\u6210\u58F0\u660E\u3002\u8BF7\u81EA\u68C0\uFF1A\u82E5\u7528\u6237\u8F93\u5165\u672C\u5C31\u65E0\u9700\u5DE5\u5177\uFF08\u5BD2\u6684/\u95F2\u804A/\u7EAF\u95EE\u7B54\uFF09\u3001\u6216\u4F60\u5728\u7B49\u7528\u6237\u6F84\u6E05\u51B3\u7B56\uFF0C\u76F4\u63A5\u6B63\u5E38\u56DE\u5E94\u5373\u53EF\uFF0C\u5FFD\u7565\u672C\u81EA\u68C0\u3001\u4E0D\u8981\u8F93\u51FA\u4EFB\u4F55\u81EA\u68C0\u8BF4\u660E\uFF1B\u82E5\u786E\u6709\u4EFB\u52A1\u672A\u843D\u5730\uFF08\u6240\u9700\u4FE1\u606F\u672A\u83B7\u53D6\u9F50 / \u8BE5\u6539\u7684\u6587\u4EF6\u672A\u6539\u5B8C / \u672A\u9A8C\u8BC1\uFF09\uFF0C\u7ACB\u5373\u7EE7\u7EED\u8C03\u7528\u5DE5\u5177\u63A8\u8FDB\uFF0C\u4E0D\u8981\u8349\u7387\u603B\u7ED3\u6536\u5C3E\uFF1B\u82E5\u786E\u5DF2\u5168\u90E8\u5B8C\u6210\uFF0C\u8BF7\u660E\u786E\u56DE\u590D\u300C\u5DF2\u5B8C\u6210\u300D\u5E76\u7528\u7B80\u77ED\u81EA\u7136\u7684\u603B\u7ED3\u4EA4\u4EE3\u6210\u679C\uFF08\u7ED3\u8BBA\u4E00\u53E5 + \u6539\u52A8\u4E0E\u9A8C\u8BC1\u8981\u70B9\uFF09\uFF0C\u52FF\u5199\u957F\u7BC7\u62A5\u544A\u3002`;
+    TOOL_DIGEST_TEXT = "\u4F60\u521A\u6267\u884C\u5B8C\u5DE5\u5177\u62FF\u5230\u7ED3\u679C\uFF0C\u5374\u672A\u57FA\u4E8E\u8BE5\u7ED3\u679C\u7ED9\u51FA\u5B9E\u8D28\u56DE\u5E94\u5C31\u51C6\u5907\u6536\u5C3E\u3002\u8BF7\u7ED3\u5408\u5DE5\u5177\u8FD4\u56DE\u7ED3\u679C\u7EE7\u7EED\u63A8\u8FDB\uFF1B\u82E5\u7ED3\u679C\u8868\u660E\u4EFB\u52A1\u5C1A\u672A\u5B8C\u6210\uFF08\u5982\u4ECD\u5728\u7F16\u8BD1/\u8FD0\u884C\u3001\u9700\u7EE7\u7EED\u8F6E\u8BE2\uFF09\uFF0C\u7ACB\u5373\u91C7\u53D6\u4E0B\u4E00\u6B65\u884C\u52A8\uFF0C\u4E0D\u8981\u7A7A\u624B\u6536\u5C3E\u3002\u82E5\u786E\u5DF2\u5168\u90E8\u5B8C\u6210\uFF0C\u8BF7\u660E\u786E\u56DE\u590D\u300C\u5DF2\u5B8C\u6210\u300D\u5E76\u7528\u7B80\u77ED\u81EA\u7136\u7684\u603B\u7ED3\u4EA4\u4EE3\u6210\u679C\uFF08\u7ED3\u8BBA\u4E00\u53E5 + \u6539\u52A8\u4E0E\u9A8C\u8BC1\u8981\u70B9\uFF09\uFF0C\u52FF\u5199\u957F\u7BC7\u62A5\u544A\u3002";
     usageNoteText = (usage) => {
       const pct = usage.windowTokens > 0 ? Math.min(100, Math.max(0, Math.round(usage.usedTokens / usage.windowTokens * 100))) : 0;
       return `\u5F53\u524D\u4E0A\u4E0B\u6587\u5DF2\u7528\u7EA6 ${pct}%\uFF08\u4F30\u7B97 \u2248${usage.usedTokens}/${usage.windowTokens} token\uFF09\u3002\u82E5\u5360\u6BD4\u5DF2\u9AD8\uFF08>70%\uFF09\uFF1A\u4F18\u5148\u6536\u655B\u6536\u5C3E\u3001\u51CF\u5C0F\u5355\u6B21\u8BFB\u53D6\u91CF\uFF08search_grep \u5B9A\u4F4D\u540E\u5C40\u90E8\u8BFB\u53D6\uFF09\uFF0C\u907F\u514D\u89E6\u53D1\u5F3A\u5236\u538B\u7F29\u3002`;
@@ -12692,8 +12922,16 @@ var init_agentNudges = __esm({
       let todoNudges = 0;
       let todoPending = null;
       let budgetSoftSent = false;
+      let planRejectCount = 0;
+      let planRejectNudged = false;
+      let planRejectPending = null;
       return {
         pickNudge(round) {
+          if (planRejectPending) {
+            const m = planRejectPending;
+            planRejectPending = null;
+            return m;
+          }
           if (!planFirstSent && round === 1 && !planMode && looksComplex(firstPrompt)) {
             planFirstSent = true;
             return { role: "system", content: `${PLAN_FIRST_FENCE}
@@ -12819,6 +13057,45 @@ ${REPEAT_GREP_TEXT(q, n)}` };
               continue;
             }
           }
+        },
+        notePlanWriteRejected(total) {
+          planRejectCount = Math.max(planRejectCount, Math.floor(total) || 0);
+          if (!planRejectNudged && planRejectCount >= PLAN_REJECT_NUDGE_AT) {
+            planRejectNudged = true;
+            planRejectPending = { role: "system", content: `${PLAN_REJECT_FENCE}
+${PLAN_REJECT_TEXT(planRejectCount)}` };
+          }
+        },
+        planWriteRejections() {
+          return planRejectCount;
+        }
+      };
+    };
+  }
+});
+
+// ../core/src/agent/costRelay.ts
+var createCostRelay;
+var init_costRelay = __esm({
+  "../core/src/agent/costRelay.ts"() {
+    "use strict";
+    createCostRelay = (sink) => {
+      let reported = 0;
+      return {
+        /** 上报当前累计总额，向 sink 递送相对上次上报的正增量。 */
+        flush(total) {
+          if (!sink) return;
+          if (!Number.isFinite(total)) return;
+          const delta = total - reported;
+          if (delta <= 1e-9) return;
+          const r = Math.round(delta * 1e6) / 1e6;
+          if (r <= 0) return;
+          reported += r;
+          sink(r);
+        },
+        /** 已累计上报给 sink 的金额（元），父级/调试可读。 */
+        get reported() {
+          return reported;
         }
       };
     };
@@ -13015,18 +13292,16 @@ async function* runAgent(message, options) {
   const keepRecentUnits = options.keepRecentUnits;
   const compactRatio = options.compactRatio;
   const parentSystemPrompt = options.parentSystemPrompt;
+  const effectiveModel = options.model?.trim() || MODEL_NAME;
   const { rawTools, cleanedToolSchemas, toolsTokens } = await prepareToolsAndInjections(message, options, events);
   let round = 0;
   let lastContent = "";
   let stopReason = "normal";
   let budgetTruncated = false;
   const MAX_AGENT_ROUNDS = 500;
-  const firstPrompt = (() => {
-    if (depth !== 0) return "";
-    const m = message.find((x) => x?.role === "user");
-    return msgText(m?.content);
-  })();
+  const firstPrompt = resolveFirstPrompt(message, options);
   let budgetSpentYuan = 0;
+  let subCostYuanAcc = 0;
   let runCompactCount = 0;
   const nudges = createNudgeScheduler({
     firstPrompt,
@@ -13050,13 +13325,12 @@ async function* runAgent(message, options) {
     });
   };
   const startTime = performance.now();
-  const persistedCalib = await getRollingState(sessionId);
+  const persistedCalib = await getCalibration(sessionId, effectiveModel);
   let calibRatio = persistedCalib.calibRatio ?? 1.4;
   let lastRealPromptTokens = persistedCalib.lastRealPromptTokens;
   let lastCachedTokens = persistedCalib.lastCachedTokens;
   const breaker = createRepeatBreaker({ sessionId, depth, llmDecisionSource, startTime, events });
   let usageSum;
-  const effectiveModel = options.model?.trim() || MODEL_NAME;
   let costYuanAcc = 0;
   let costKnown = true;
   const addUsage = (u) => {
@@ -13081,6 +13355,23 @@ async function* runAgent(message, options) {
     budgetSpentYuan += yuan;
   };
   const toolCostSink = process.env.DEEP_SEEK_TOOL_COST === "0" ? void 0 : addToolCost;
+  let auxCostYuanAcc = 0;
+  const reportAuxUsage = (usage, kind) => {
+    if (usage) {
+      const cost = calcCostYuan(AUX_MODEL_NAME, { promptTokens: usage.prompt_tokens, completionTokens: usage.completion_tokens, cachedTokens: usage.cached_tokens });
+      if (cost != null && Number.isFinite(cost) && cost > 0) {
+        auxCostYuanAcc += cost;
+        budgetSpentYuan += cost;
+      }
+    }
+    try {
+      options.onAuxUsage?.(usage, kind);
+    } catch {
+    }
+  };
+  const costRelay = createCostRelay(options.costSink);
+  const inheritedBudgetCheck = options.budgetCheck ?? (depth === 0 && options.budgetYuan != null && options.budgetYuan > 0 ? () => budgetSpentYuan >= options.budgetYuan * 1.2 : void 0);
+  let planWriteRej = 0;
   const toolCounts = {};
   await appendEvent(sessionId, { dscEvent: "run.start", runId, depth });
   try {
@@ -13117,6 +13408,12 @@ async function* runAgent(message, options) {
 \uFF08\u{1F4B0} \u9884\u7B97\u622A\u65AD\uFF1A\u672C run \u5DF2\u82B1\u8D39 \xA5${budgetSpentYuan.toFixed(3)} / \u9884\u7B97 \xA5${options.budgetYuan.toFixed(3)}\u3002/budget \u8C03\u6574\u9884\u7B97\u540E\u56DE\u590D"\u7EE7\u7EED"\u5373\u53EF\u63A5\u7EED\u3002\uFF09` };
         return;
       }
+      if (depth > 0 && options.budgetCheck?.()) {
+        stopReason = "limit";
+        yield { type: "final", text: (lastContent || "") + `
+\uFF08\u{1F4B0} \u9884\u7B97\u4E2D\u6B62\uFF1A\u7236\u7EA7\u9884\u7B97\u5DF2\u8017\u5C3D\uFF0C\u672C\u5B50\u4EFB\u52A1\u5728\u8F6E\u8FB9\u754C\u88AB\u7194\u65AD\u6536\u5C3E\uFF0C\u4EFB\u52A1\u672A\u5B8C\u6210\u3002\u5DF2\u5B8C\u6210\u8FDB\u5C55\u5982\u4E0A\uFF1B\u8BF7\u52FF\u91CD\u8BD5\u6216\u7EE7\u7EED\u6D3E\u751F\u5B50\u4EFB\u52A1\u3002\uFF09` };
+        return;
+      }
       const inboxTexts = claimSessionInbox(sessionId);
       if (inboxTexts.length > 0) {
         for (const t of inboxTexts) {
@@ -13141,6 +13438,8 @@ async function* runAgent(message, options) {
             lastRealPromptTokens,
             lastCachedTokens,
             toolsTokens,
+            // ★ P0-2：压缩摘要（summarize）的 aux usage 回传计价（见 reportAuxUsage 声明处）
+            onAuxUsage: reportAuxUsage,
             // ★ H1：旁路数 compact.done 供 context.usage.compactCount（透传不拦截）
             onUIEvent: (evt) => {
               if (evt.type === "compact.done") runCompactCount++;
@@ -13179,7 +13478,8 @@ async function* runAgent(message, options) {
         compactRatio,
         modelWindow,
         toolsTokens,
-        onUIEvent: options.onUIEvent
+        onUIEvent: options.onUIEvent,
+        onAuxUsage: reportAuxUsage
       });
       if (infResult.kind === "aborted") {
         yield { type: "final", text: infResult.partialText || lastContent || "\uFF08\u5DF2\u4E2D\u6B62\uFF09" };
@@ -13209,6 +13509,7 @@ async function* runAgent(message, options) {
       if (!assistantMessage.tool_calls || assistantMessage.tool_calls.length === 0) {
         await appendEvent(sessionId, { dscEvent: "round.end", runId, round, usage: infResult.usage });
         emitContextUsage();
+        costRelay.flush(budgetSpentYuan);
         const finalText = (typeof assistantMessage.content === "string" ? assistantMessage.content : "") || "";
         const intercepted = nudges.interceptFinal(finalText, round);
         if (intercepted) continue;
@@ -13261,11 +13562,23 @@ async function* runAgent(message, options) {
         // ★ 子 run 成本回灌（成本信任链第二环 E1）：runSubagent 经 toolCtx.reportCost 拿到闭包，
         //   子 run 结束时把总花费记进本 run 预算累计器——父预算自动继承约束（子花费计入父 spent）。
         reportCost: (yuan) => {
-          if (Number.isFinite(yuan) && yuan > 0) budgetSpentYuan += yuan;
+          if (Number.isFinite(yuan) && yuan > 0) {
+            budgetSpentYuan += yuan;
+            subCostYuanAcc += yuan;
+          }
         },
         // ★ 按次计费工具成本上报（DeepSeek Search/Fetch）：web 工具经 toolCtx.toolCostSink 拿到闭包，
         //   成功调用后按次上报进本 run 累计器。
-        toolCostSink
+        toolCostSink,
+        // ★ P0-2：auto 档风险分类器（classifyToolRisk）的 aux usage 回传计价（见 reportAuxUsage 声明处）
+        onAuxUsage: reportAuxUsage,
+        // ★ P1-7 计划拒绝熔断：计划期非 SAFE 工具被拒增量回传（计数 + 通知 nudge 调度器发转向文案）
+        planWriteRejections: (delta) => {
+          planWriteRej += delta;
+          nudges.notePlanWriteRejected(planWriteRej);
+        },
+        // ★ P1-5 子任务预算熔断：runSubagent 经 toolCtx.budgetCheck 拿到探测闭包，子 runAgent 每轮边界自检
+        budgetCheck: inheritedBudgetCheck
       };
       const scheduleResult = yield* scheduleToolCalls(assistantMessage, message, toolCallCtx);
       if (scheduleResult.kind === "aborted") {
@@ -13278,6 +13591,12 @@ async function* runAgent(message, options) {
       }
       await appendEvent(sessionId, { dscEvent: "round.end", runId, round, usage: infResult.usage });
       emitContextUsage();
+      costRelay.flush(budgetSpentYuan);
+      if (options.planMode && planWriteRej >= PLAN_REJECT_FORCE_AT) {
+        stopReason = "limit";
+        yield { type: "final", text: PLAN_REJECT_FORCE_FINAL_TEXT(planWriteRej) };
+        return;
+      }
     }
   } catch (toolErr) {
     if (signal?.aborted) {
@@ -13317,13 +13636,14 @@ async function* runAgent(message, options) {
         costYuan: costKnown ? Math.round(costYuanAcc * 1e6) / 1e6 : void 0,
         toolCostYuan: toolCostYuanAcc > 0 ? Math.round(toolCostYuanAcc * 1e6) / 1e6 : void 0,
         // 按次计费工具花费（Search/Fetch）
+        auxCostYuan: auxCostYuanAcc > 0 ? Math.round(auxCostYuanAcc * 1e6) / 1e6 : void 0,
+        // 辅助模型花费（压缩摘要+风险分类器，P0-2）
         tools: toolCounts
       });
     } catch {
     }
     try {
-      const spentTotal = costYuanAcc + toolCostYuanAcc;
-      if (options.costSink && spentTotal > 0) options.costSink(Math.round(spentTotal * 1e6) / 1e6);
+      costRelay.flush(budgetSpentYuan);
     } catch {
     }
     try {
@@ -13339,6 +13659,10 @@ async function* runAgent(message, options) {
           costYuan: costKnown ? Math.round(costYuanAcc * 1e6) / 1e6 : null,
           toolCostYuan: toolCostYuanAcc > 0 ? Math.round(toolCostYuanAcc * 1e6) / 1e6 : void 0,
           // 按次计费工具花费（undefined 自动省略）
+          auxCostYuan: auxCostYuanAcc > 0 ? Math.round(auxCostYuanAcc * 1e6) / 1e6 : void 0,
+          // 辅助模型花费（压缩摘要+风险分类器；undefined 自动省略）
+          subCostYuan: subCostYuanAcc > 0 ? Math.round(subCostYuanAcc * 1e6) / 1e6 : void 0,
+          // ★ Q12：子 run 花费并列展示（展示层补偿；undefined 自动省略）
           durationMs: Math.round(performance.now() - startTime),
           budgetTruncated: budgetTruncated || void 0
           // 预算截断标注（E2；undefined 自动省略）
@@ -13353,12 +13677,13 @@ async function* runAgent(message, options) {
       console.warn("\u26A0\uFE0F Stop hook \u5916\u5C42\u515C\u5E95\uFF08dispatch \u5185\u90E8\u5BB9\u9519\u5931\u6548\uFF0C\u5C5E\u5F02\u5E38\u4FE1\u53F7\uFF09:", e instanceof Error ? e.message : e);
     }
     try {
-      await updateCalibration(sessionId, { calibRatio, lastRealPromptTokens, lastCachedTokens });
+      await updateCalibration(sessionId, effectiveModel, { calibRatio, lastRealPromptTokens, lastCachedTokens });
     } catch (e) {
       console.warn("\u26A0\uFE0F \u538B\u7F29\u6821\u51C6\u72B6\u6001\u843D\u76D8\u5931\u8D25\uFF08\u4E0B run \u6821\u51C6\u91CD\u96F6\uFF0C\u7F13\u5B58\u611F\u77E5\u538B\u7F29\u9000\u5316\u56DE\u7F3A\u7701 1.4\uFF09:", e instanceof Error ? e.message : e);
     }
   }
 }
+var resolveFirstPrompt;
 var init_runAgent = __esm({
   "../core/src/agent/runAgent.ts"() {
     "use strict";
@@ -13375,9 +13700,23 @@ var init_runAgent = __esm({
     init_toolScheduling();
     init_streamInference();
     init_agentNudges();
+    init_costRelay();
     init_usageLog();
     init_prices();
     init_createModel();
+    init_client();
+    resolveFirstPrompt = (message, options) => {
+      if ((options.depth ?? 0) !== 0) return "";
+      const explicit = options.currentUserText?.trim();
+      if (explicit) return explicit;
+      const arr = message;
+      for (let i = arr.length - 1; i >= 0; i--) {
+        if (arr[i]?.role !== "user") continue;
+        const t = msgText(arr[i]?.content);
+        if (t.trim()) return t;
+      }
+      return "";
+    };
   }
 });
 
@@ -13435,11 +13774,12 @@ var init_lineage = __esm({
 });
 
 // ../core/src/agent/subagent.ts
-var SUBAGENT_DENYLIST, activeSubagents, failText, RESUME_NOTE, createProgressThrottler, runSubagent;
+var SUBAGENT_DENYLIST, filterToolsForSubagent, activeSubagents, failText, RESUME_NOTE, createProgressThrottler, runSubagent;
 var init_subagent = __esm({
   "../core/src/agent/subagent.ts"() {
     "use strict";
     init_runAgent();
+    init_config();
     init_content();
     init_transcript();
     init_common();
@@ -13447,7 +13787,14 @@ var init_subagent = __esm({
     init_registry4();
     init_hooks();
     init_lineage();
-    SUBAGENT_DENYLIST = /* @__PURE__ */ new Set(["run_command", "delete_path"]);
+    SUBAGENT_DENYLIST = /* @__PURE__ */ new Set(["run_command", "delete_path", "run_in_background"]);
+    filterToolsForSubagent = (allTools, manifest) => {
+      if (manifest && manifest.tools.length > 0) {
+        const wantsMcp = manifest.tools.some((t) => t === "mcp_call" || t === "mcp_list_tools" || t.startsWith("mcp__"));
+        return allTools.filter((t) => manifest.tools.includes(t.function.name) || wantsMcp && (t.function.name === "mcp_call" || t.function.name === "mcp_list_tools"));
+      }
+      return allTools.filter((t) => t.function.subagentAllowed !== false && !SUBAGENT_DENYLIST.has(t.function.name));
+    };
     activeSubagents = /* @__PURE__ */ new Set();
     failText = (msg) => toolFailure(msg).content;
     RESUME_NOTE = [
@@ -13551,8 +13898,7 @@ var init_subagent = __esm({
         ...resuming ? [RESUME_NOTE] : []
       ].filter(Boolean).join("\n\n");
       const allTools = getGlobalTools();
-      const wantsMcp = manifest?.tools.some((t) => t === "mcp_call" || t === "mcp_list_tools" || t.startsWith("mcp__")) ?? false;
-      const toolSchemas = manifest && manifest.tools.length > 0 ? allTools.filter((t) => manifest.tools.includes(t.function.name) || wantsMcp && (t.function.name === "mcp_call" || t.function.name === "mcp_list_tools")) : allTools.filter((t) => !SUBAGENT_DENYLIST.has(t.function.name));
+      const toolSchemas = filterToolsForSubagent(allTools, manifest);
       console.log(`${resuming ? "\u{1F501} \u7EED\u8DD1" : "\u{1F423} \u6D3E\u751F"}\u5B50 Agent [\u6DF1\u5EA6: ${ctx.depth + 1}/${MAX_AGENT_DEPTH}][${subSessionId}]${manifest ? ` \u58F0\u660E\u5F0F=${manifest.name}` : ""} \u4EFB\u52A1: "${task.slice(0, 50)}..."`);
       activeSubagents.add(subSessionId);
       ctx.onUIEvent?.({ type: "subagent.count", running: activeSubagents.size, phase: "start", name: manifest?.name, depth: ctx.depth + 1 });
@@ -13567,7 +13913,9 @@ var init_subagent = __esm({
           // ★ 透传父级工作目录，子 agent 的 hook/工具相对路径与父级一致
           toolSchemas,
           abortSignal: ctx.abortSignal,
-          modelWindow: ctx.modelWindow,
+          // ★ P1-4：manifest.model 覆盖时窗口按该模型解析（MODEL_WINDOWS 表 / 全局回退）；
+          //   未覆盖（与父同模型）直接继承父窗口，行为不变。
+          modelWindow: manifest?.model ? resolveModelWindow(manifest.model) : ctx.modelWindow,
           depth: ctx.depth + 1,
           keepRecentUnits: ctx.keepRecentUnits,
           compactRatio: ctx.compactRatio,
@@ -13585,13 +13933,15 @@ var init_subagent = __esm({
           // ★ 子 agent final 是交付父级的汇报，EARLY_FINAL 误推一轮纯浪费；父可经续跑纠错
           model: manifest?.model,
           // ★ per-agent 模型覆盖；undefined 时 model.ts 回退全局 MODEL_NAME
-          costSink: ctx.reportCost
+          costSink: ctx.reportCost,
           // ★ 子 run 成本回灌父累计器（成本信任链第二环 E1）：父预算自动继承约束
+          budgetCheck: ctx.budgetCheck
+          // ★ P1-5 预算熔断链式透传：子 runAgent 轮边界探测父预算，超支即收尾（不等烧完）
         };
         const startCtx = { sessionId: subSessionId, parentSessionId: ctx.sessionId, task, depth: ctx.depth + 1, name: manifest?.name, cwd: ctx.cwd };
         await dispatch("SubagentStart", startCtx);
         let result;
-        const progress = createProgressThrottler((line) => ctx.onUIEvent?.({ type: "subagent.progress", text: line }));
+        const progress = createProgressThrottler((line) => ctx.onUIEvent?.({ type: "subagent.progress", text: line, agentKey: subSessionId, name: manifest?.name }));
         try {
           for await (const e of runAgent(subMessages, subOptions)) {
             if (ctx.abortSignal?.aborted) {
@@ -13615,7 +13965,7 @@ var init_subagent = __esm({
           result = { ok: false, output: failText(`[\u5B50Agent\u5D29\u6E83]\uFF1A\u5B50 Agent \u5728\u8FED\u4EE3\u63A8\u7406\u4E3B\u5FAA\u73AF\u65F6\u906D\u9047\u5E95\u5C42\u5F02\u5E38: ${streamError.message}`), sessionId: subSessionId, manifestName: manifest?.name };
         } finally {
           try {
-            ctx.onUIEvent?.({ type: "subagent.progress", text: "", done: true });
+            ctx.onUIEvent?.({ type: "subagent.progress", text: "", done: true, agentKey: subSessionId });
           } catch {
           }
           if (result) {
@@ -14861,14 +15211,15 @@ var createWebRequestApproval;
 var init_webHost = __esm({
   "../core/src/host/webHost.ts"() {
     "use strict";
-    createWebRequestApproval = (onUIEvent, abortSignal) => {
+    createWebRequestApproval = (onUIEvent, abortSignal, opts) => {
       return async (detail, meta) => {
         onUIEvent?.({
           type: "approval_request",
           sessionId: meta.sessionId,
           toolsId: meta.toolCallId,
           toolName: meta.toolName,
-          detail
+          detail,
+          ...opts?.includeFullDetail && meta.fullDetail ? { fullDetail: meta.fullDetail } : {}
         });
         const { waitForUserApproval: waitForUserApproval2 } = await Promise.resolve().then(() => (init_approvalGate(), approvalGate_exports));
         return waitForUserApproval2(meta.sessionId, meta.toolCallId, abortSignal);
@@ -15012,7 +15363,8 @@ ${envLines.join("\n")}`;
           // 宿主可按需裁剪（挂机批处理）；缺省全量，行为不变
           abortSignal,
           // ← 透传中止信号
-          modelWindow: appConfig.MAX_HISTORY_TOKENS,
+          modelWindow: resolveModelWindow(opts?.model),
+          // ★ P1-4：窗口按本轮模型解析（MODEL_WINDOWS 表 / 全局回退）
           keepRecentUnits: appConfig.KEEP_RECENT_UNITS,
           compactRatio: appConfig.COMPACT_RATIO,
           parentSystemPrompt: sysPrompt,
@@ -15031,8 +15383,11 @@ ${envLines.join("\n")}`;
           thinkingLevel: opts?.thinkingLevel,
           locale: opts?.locale,
           outputStyle: opts?.outputStyle,
-          budgetYuan: opts?.budgetYuan
+          budgetYuan: opts?.budgetYuan,
           // ★ 预算制运行（成本信任链第二环 E1）：主 run 传入，子 run 经 costSink 回灌
+          // ★ P0-1：本轮用户输入原文（inbound.content 已过 slash 展开与 hook 注入定型），供 firstPrompt
+          //   判定取「当前轮」而非消息数组首条（首条复杂 + 本轮寒暄曾误触发 PLAN_FIRST/EARLY_FINAL）。
+          currentUserText: inbound.content
         };
         await runWithSessionContext(sessionId, async () => {
           try {
@@ -15263,13 +15618,153 @@ ${s.slice(-half)}`;
   }
 });
 
+// src/lineDiff.ts
+var splitLines, lineDiff, collapseContext;
+var init_lineDiff = __esm({
+  "src/lineDiff.ts"() {
+    "use strict";
+    splitLines = (s) => {
+      const t = String(s ?? "").replace(/\r\n/g, "\n");
+      return t === "" ? [] : t.split("\n");
+    };
+    lineDiff = (oldStr, newStr) => {
+      const a = splitLines(oldStr);
+      const b = splitLines(newStr);
+      let s = 0;
+      while (s < a.length && s < b.length && a[s] === b[s]) s++;
+      let e = 0;
+      while (e < a.length - s && e < b.length - s && a[a.length - 1 - e] === b[b.length - 1 - e]) e++;
+      const m1 = a.slice(s, a.length - e);
+      const m2 = b.slice(s, b.length - e);
+      const rows = [];
+      for (let i = 0; i < s; i++) rows.push({ t: "ctx", s: a[i] });
+      const n = m1.length, m = m2.length;
+      if (n === 0 && m === 0) {
+      } else if (n * m > 4e6) {
+        for (const l of m1) rows.push({ t: "del", s: l });
+        for (const l of m2) rows.push({ t: "add", s: l });
+      } else {
+        const w = m + 1;
+        const dp = new Uint32Array((n + 1) * w);
+        for (let i2 = n - 1; i2 >= 0; i2--) {
+          for (let j2 = m - 1; j2 >= 0; j2--) {
+            dp[i2 * w + j2] = m1[i2] === m2[j2] ? dp[(i2 + 1) * w + j2 + 1] + 1 : Math.max(dp[(i2 + 1) * w + j2], dp[i2 * w + j2 + 1]);
+          }
+        }
+        let i = 0, j = 0;
+        while (i < n && j < m) {
+          if (m1[i] === m2[j]) {
+            rows.push({ t: "ctx", s: m1[i] });
+            i++;
+            j++;
+          } else if (dp[(i + 1) * w + j] >= dp[i * w + j + 1]) {
+            rows.push({ t: "del", s: m1[i] });
+            i++;
+          } else {
+            rows.push({ t: "add", s: m2[j] });
+            j++;
+          }
+        }
+        while (i < n) {
+          rows.push({ t: "del", s: m1[i] });
+          i++;
+        }
+        while (j < m) {
+          rows.push({ t: "add", s: m2[j] });
+          j++;
+        }
+      }
+      for (let k = 0; k < e; k++) rows.push({ t: "ctx", s: a[a.length - e + k] });
+      return rows;
+    };
+    collapseContext = (rows, keep = 2) => {
+      const out = [];
+      let i = 0;
+      while (i < rows.length) {
+        if (rows[i].t !== "ctx") {
+          out.push(rows[i]);
+          i++;
+          continue;
+        }
+        let j = i;
+        while (j < rows.length && rows[j].t === "ctx") j++;
+        const run = j - i;
+        if (run > keep * 2 + 1) {
+          for (let k = 0; k < keep; k++) out.push(rows[i + k]);
+          out.push({ t: "ellip", n: run - keep * 2 });
+          for (let k = run - keep; k < run; k++) out.push(rows[i + k]);
+        } else {
+          for (let k = 0; k < run; k++) out.push(rows[i + k]);
+        }
+        i = j;
+      }
+      return out;
+    };
+  }
+});
+
+// src/diffSummary.ts
+import fs48 from "fs/promises";
+import path49 from "path";
+var readTextIfExists, buildRunDiff;
+var init_diffSummary = __esm({
+  "src/diffSummary.ts"() {
+    "use strict";
+    init_lineDiff();
+    init_store2();
+    readTextIfExists = async (p) => {
+      try {
+        return await fs48.readFile(p, "utf-8");
+      } catch {
+        return null;
+      }
+    };
+    buildRunDiff = async (sessionId, records) => {
+      const byPath = /* @__PURE__ */ new Map();
+      for (const r of records) {
+        if (r.restored) continue;
+        const prev = byPath.get(r.relativePath);
+        if (!prev || (r.timestamp || "") < (prev.timestamp || "")) byPath.set(r.relativePath, r);
+      }
+      const root = process.env.WORKSPACE_ROOT ?? process.cwd();
+      const out = [];
+      for (const r of [...byPath.values()].sort((a, b) => a.relativePath.localeCompare(b.relativePath))) {
+        const abs = path49.join(root, ...r.relativePath.split("/"));
+        if (r.backupKind === "directory_tree") {
+          out.push({ path: r.relativePath, note: "\u25A4 \u76EE\u5F55\u6811\u6539\u52A8\uFF08\u5185\u5BB9 diff \u7565\uFF0C\u53EF /rewind \u56DE\u9000\uFF09", rows: null });
+          continue;
+        }
+        const disk = await readTextIfExists(abs);
+        if (disk === null) {
+          out.push({ path: r.relativePath, note: "\uFF08\u6587\u4EF6\u5DF2\u4E0D\u5728\u78C1\u76D8\u2014\u2014\u5DF2\u88AB\u56DE\u9000\u6216\u624B\u52A8\u5220\u9664\uFF09", rows: null });
+          continue;
+        }
+        let before;
+        if (r.backupKind === "creation_marker") {
+          before = "";
+        } else {
+          before = await readTextIfExists(path49.join(getUndoBackupRoot(sessionId), r.undoId, "content"));
+        }
+        if (before === null) {
+          out.push({ path: r.relativePath, note: "\uFF08\u5907\u4EFD\u5DF2\u88AB\u6E05\u7406\uFF0C\u65E0\u6CD5\u751F\u6210\u7EA2\u7EFF\u5BF9\u6BD4\uFF09", rows: null });
+          continue;
+        }
+        const rows = collapseContext(lineDiff(before, disk));
+        if (!rows.some((c) => c.t === "add" || c.t === "del")) continue;
+        out.push({ path: r.relativePath, rows });
+      }
+      return out;
+    };
+  }
+});
+
 // src/cliHost.ts
 var createCliRequestApproval, createCliRequestQuestion;
 var init_cliHost = __esm({
   "src/cliHost.ts"() {
     "use strict";
     createCliRequestApproval = (askApproval) => {
-      return async (detail, meta) => askApproval(detail, meta.toolName);
+      return async (detail, meta) => askApproval(detail, meta.toolName, meta.fullDetail);
     };
     createCliRequestQuestion = (askQuestion) => {
       return async (req) => askQuestion(req);
@@ -15461,6 +15956,9 @@ var init_useChatState = __esm({
     init_guard();
     init_createModel();
     init_tool();
+    init_permissions();
+    init_restore();
+    init_diffSummary();
     init_cliHost();
     init_prefs();
     init_strings();
@@ -15486,6 +15984,7 @@ var init_useChatState = __esm({
       const [pendingSessions, setPendingSessions] = useState(null);
       const [pendingFork, setPendingFork] = useState(null);
       const [pendingModel, setPendingModel] = useState(null);
+      const [pendingRewind, setPendingRewind] = useState(null);
       const nextId = useRef(1);
       const assistantStreamingId = useRef(null);
       const thinkingStreamingId = useRef(null);
@@ -15513,6 +16012,7 @@ var init_useChatState = __esm({
       const budgetYuanRef = useRef(void 0);
       const lastRunCacheHitRef = useRef(void 0);
       const contextUsageRef = useRef(void 0);
+      const lastSubmitAtRef = useRef(0);
       const compactProgressIdRef = useRef(null);
       const dropCompactProgressRow = useCallback(() => {
         const pid = compactProgressIdRef.current;
@@ -15520,12 +16020,20 @@ var init_useChatState = __esm({
         compactProgressIdRef.current = null;
         setRows((prev) => prev.filter((r) => r.id !== pid));
       }, []);
-      const subagentProgressIdRef = useRef(null);
-      const dropSubagentProgressRow = useCallback(() => {
-        const pid = subagentProgressIdRef.current;
-        if (pid == null) return;
-        subagentProgressIdRef.current = null;
-        setRows((prev) => prev.filter((r) => r.id !== pid));
+      const subagentProgressRowsRef = useRef(/* @__PURE__ */ new Map());
+      const dropSubagentProgressRow = useCallback((key) => {
+        const m = subagentProgressRowsRef.current;
+        if (key) {
+          const rid = m.get(key);
+          if (rid == null) return;
+          m.delete(key);
+          setRows((prev) => prev.filter((r) => r.id !== rid));
+          return;
+        }
+        if (m.size === 0) return;
+        const ids = new Set(m.values());
+        m.clear();
+        setRows((prev) => prev.filter((r) => !ids.has(r.id)));
       }, []);
       const outputStyleRef = useRef(void 0);
       const lastUsageRef = useRef(null);
@@ -15631,6 +16139,24 @@ var init_useChatState = __esm({
             scheduleFlush();
             break;
           }
+          case "text.reset": {
+            if (flushTimer.current) {
+              clearTimeout(flushTimer.current);
+              flushTimer.current = null;
+            }
+            textBuffer.current = "";
+            thinkingBuffer.current = "";
+            const raId = assistantStreamingId.current;
+            const rthId = thinkingStreamingId.current;
+            if (raId != null || rthId != null) {
+              setRows((prev) => prev.map((row) => {
+                if (row.id === raId && row.kind === "assistant") return { ...row, text: "" };
+                if (row.id === rthId && row.kind === "thinking") return { ...row, text: "" };
+                return row;
+              }));
+            }
+            break;
+          }
           case "tool.start": {
             closeStreaming();
             const id = newRowId();
@@ -15700,16 +16226,19 @@ var init_useChatState = __esm({
             const durText = durMs >= 6e4 ? `${Math.floor(durMs / 6e4)}m${Math.round(durMs % 6e4 / 1e3)}s` : `${(durMs / 1e3).toFixed(1)}s`;
             const cost = obj.costYuan;
             const toolCost = typeof obj.toolCostYuan === "number" && obj.toolCostYuan > 0 ? obj.toolCostYuan : null;
+            const auxCost = typeof obj.auxCostYuan === "number" && obj.auxCostYuan > 0 ? obj.auxCostYuan : null;
+            const subCost = typeof obj.subCostYuan === "number" && obj.subCostYuan > 0 ? obj.subCostYuan : null;
             const tokTotal = promptT + completionT;
             const tokText = tokTotal >= 1e4 ? `${(tokTotal / 1e3).toFixed(1)}k` : String(tokTotal);
             const costText = typeof cost === "number" ? `\xA5${cost.toFixed(cost < 5e-3 ? 4 : 3)}` : `${tokText} tok`;
             setRows((prev) => [...prev, {
               id: newRowId(),
               kind: "meta",
-              text: `\u{1F4B0} \u672C\u6B21 ${rounds} \u8F6E \xB7 ${costText}${toolCost != null ? ` \xB7 \u8054\u7F51 \xA5${toolCost.toFixed(3)}` : ""} \xB7 \u7F13\u5B58\u547D\u4E2D ${hitPct}% \xB7 ${durText}${obj.budgetTruncated ? " \xB7 \u9884\u7B97\u622A\u65AD" : ""}`
+              text: `\u{1F4B0} \u672C\u6B21 ${rounds} \u8F6E \xB7 ${costText}${toolCost != null ? ` \xB7 \u8054\u7F51 \xA5${toolCost.toFixed(3)}` : ""}${auxCost != null ? ` \xB7 \u8F85\u52A9 \xA5${auxCost.toFixed(3)}` : ""}${subCost != null ? ` \xB7 \u5B50\u4EFB\u52A1 \xA5${subCost.toFixed(3)}` : ""} \xB7 \u7F13\u5B58\u547D\u4E2D ${hitPct}% \xB7 ${durText}${obj.budgetTruncated ? " \xB7 \u9884\u7B97\u622A\u65AD" : ""}`
             }]);
-            lastRunCostRef.current = typeof cost === "number" ? cost : void 0;
+            lastRunCostRef.current = typeof cost === "number" ? cost + (auxCost ?? 0) : auxCost != null ? auxCost : void 0;
             sessionCostRef.current = typeof cost === "number" ? (sessionCostRef.current ?? 0) + cost : sessionCostRef.current;
+            if (auxCost != null) sessionCostRef.current = (sessionCostRef.current ?? 0) + auxCost;
             lastRunCacheHitRef.current = typeof obj.cacheHitRate === "number" ? obj.cacheHitRate : void 0;
             break;
           }
@@ -15738,19 +16267,23 @@ var init_useChatState = __esm({
           }
           case "subagent.progress": {
             flush();
+            const agentKey = typeof obj.agentKey === "string" && obj.agentKey ? obj.agentKey : "__default__";
             if (obj.done) {
-              dropSubagentProgressRow();
+              dropSubagentProgressRow(agentKey);
               break;
             }
             const ptext = String(obj.text ?? "").slice(0, 160);
             if (!ptext) break;
-            if (subagentProgressIdRef.current == null) {
+            const agentName = typeof obj.name === "string" && obj.name ? `\u27E8${obj.name}\u27E9 ` : "";
+            const pline = `${agentName}${ptext}`;
+            const rowMap = subagentProgressRowsRef.current;
+            const existingId = rowMap.get(agentKey);
+            if (existingId == null) {
               const id = newRowId();
-              subagentProgressIdRef.current = id;
-              setRows((prev) => [...prev, { id, kind: "subagent-progress", text: ptext }]);
+              rowMap.set(agentKey, id);
+              setRows((prev) => [...prev, { id, kind: "subagent-progress", text: pline }]);
             } else {
-              const pid = subagentProgressIdRef.current;
-              setRows((prev) => prev.map((r) => r.id === pid && r.kind === "subagent-progress" ? { ...r, text: ptext } : r));
+              setRows((prev) => prev.map((r) => r.id === existingId && r.kind === "subagent-progress" ? { ...r, text: pline } : r));
             }
             break;
           }
@@ -15830,7 +16363,7 @@ var init_useChatState = __esm({
             break;
         }
       }, [closeStreaming, flush, scheduleFlush, pushInfo]);
-      const askApproval = useCallback((detail, toolName) => new Promise((resolve) => setPendingApproval({ detail, toolName, resolve })), []);
+      const askApproval = useCallback((detail, toolName, fullDetail) => new Promise((resolve) => setPendingApproval({ detail, toolName, fullDetail, resolve })), []);
       const resolveApproval = useCallback((v) => {
         setPendingApproval((prev) => {
           prev?.resolve(v);
@@ -15839,7 +16372,7 @@ var init_useChatState = __esm({
       }, []);
       const autoRequestApproval = useCallback(async (_detail, meta) => {
         const t = findTool(meta.toolName);
-        if (!t || t.function.safetyLevel === "danger" /* DANGER */) return askApproval(_detail, meta.toolName);
+        if (!t || t.function.safetyLevel === "danger" /* DANGER */) return askApproval(_detail, meta.toolName, meta.fullDetail);
         return "allow-once";
       }, [askApproval]);
       const askQuestion = useCallback((req) => new Promise((resolve) => setPendingQuestion({ req, resolve })), []);
@@ -15935,9 +16468,12 @@ ${finalPlan}`, false, res.autoExecute);
       const runPlanStage = useCallback(async (sid, researchPrompt) => {
         await runOnce(sid, researchPrompt, true);
         const plan = takeProposedPlan();
-        if (plan == null) return false;
+        if (plan == null) {
+          pushInfo(S.planNoProposal);
+          return false;
+        }
         return await approveAndImplement(sid, plan);
-      }, [runOnce, takeProposedPlan, approveAndImplement]);
+      }, [runOnce, takeProposedPlan, approveAndImplement, pushInfo]);
       const queueInput = useCallback((content) => {
         const text = content.trim();
         const sid = sessionIdRef.current;
@@ -15952,6 +16488,7 @@ ${finalPlan}`, false, res.autoExecute);
         if (!text || busy) return;
         setBusy(true);
         const myGen = ++turnGenRef.current;
+        lastSubmitAtRef.current = Date.now();
         try {
           if (sessionIdRef.current == null) {
             sessionIdRef.current = await getOrCreateSessionId(initialSessionId ?? void 0);
@@ -16022,6 +16559,8 @@ ${r.output.trim() || S.bangNoOutput}`);
         toolRowByCallId.current.clear();
       }, [flush]);
       const loadSession = useCallback(async (id) => {
+        const prev = sessionIdRef.current;
+        if (prev && prev !== id) clearSessionPermissionRules(prev);
         sessionIdRef.current = id;
         lastRunCostRef.current = void 0;
         sessionCostRef.current = void 0;
@@ -16052,6 +16591,8 @@ ${r.output.trim() || S.bangNoOutput}`);
         if (picked) await loadSession(picked);
       }, [pushInfo, loadSession]);
       const newSession = useCallback(async () => {
+        const prev = sessionIdRef.current;
+        if (prev) clearSessionPermissionRules(prev);
         sessionIdRef.current = await getOrCreateSessionId(void 0);
         lastRunCostRef.current = void 0;
         sessionCostRef.current = void 0;
@@ -16109,6 +16650,60 @@ ${r.output.trim() || S.bangNoOutput}`);
         }
         return picked;
       }, [pushInfo, setModelOverride]);
+      const resolveRewind = useCallback((undoId) => {
+        setPendingRewind((prev) => {
+          prev?.resolve(undoId);
+          return null;
+        });
+      }, []);
+      const openRewindPicker = useCallback(async () => {
+        const sid = sessionIdRef.current;
+        if (!sid) {
+          pushInfo(S.rewindNoSession);
+          return;
+        }
+        let records = [];
+        try {
+          records = await listUndoable(sid);
+        } catch {
+        }
+        if (records.length === 0) {
+          pushInfo(S.rewindEmpty);
+          return;
+        }
+        const picked = await new Promise((resolve) => setPendingRewind({ records, resolve }));
+        if (!picked) return;
+        try {
+          pushInfo(await restoreByUndoId(picked, sid));
+        } catch (e) {
+          pushInfo(S.rewindFail(e?.message ?? String(e)));
+        }
+      }, [pushInfo]);
+      const openDiff = useCallback(async () => {
+        const sid = sessionIdRef.current;
+        const sinceMs = lastSubmitAtRef.current;
+        if (!sid || !sinceMs) {
+          pushInfo(S.diffEmpty);
+          return;
+        }
+        let records = [];
+        try {
+          records = await listUndoable(sid);
+        } catch {
+        }
+        const sinceIso = new Date(sinceMs).toISOString();
+        const runRecords = records.filter((r) => (r.timestamp || "") >= sinceIso);
+        if (runRecords.length === 0) {
+          pushInfo(S.diffEmpty);
+          return;
+        }
+        const files = await buildRunDiff(sid, runRecords);
+        if (files.length === 0) {
+          pushInfo(S.diffEmpty);
+          return;
+        }
+        setRows((prev) => [...prev, { id: newRowId(), kind: "diff-summary", title: S.diffTitle, files }]);
+      }, [pushInfo]);
       const setPlanMode = useCallback((on) => {
         planModeRef.current = on;
       }, []);
@@ -16147,6 +16742,7 @@ ${r.output.trim() || S.bangNoOutput}`);
         pendingSessions,
         pendingFork,
         pendingModel,
+        pendingRewind,
         sessionIdRef,
         // 动作
         submit,
@@ -16186,7 +16782,10 @@ ${r.output.trim() || S.bangNoOutput}`);
         resolveFork,
         newSession,
         openModelPicker,
-        resolveModel
+        resolveModel,
+        openRewindPicker,
+        resolveRewind,
+        openDiff
       };
     };
   }
@@ -16569,91 +17168,6 @@ var init_ThinkingBlock = __esm({
   }
 });
 
-// src/lineDiff.ts
-var splitLines, lineDiff, collapseContext;
-var init_lineDiff = __esm({
-  "src/lineDiff.ts"() {
-    "use strict";
-    splitLines = (s) => {
-      const t = String(s ?? "").replace(/\r\n/g, "\n");
-      return t === "" ? [] : t.split("\n");
-    };
-    lineDiff = (oldStr, newStr) => {
-      const a = splitLines(oldStr);
-      const b = splitLines(newStr);
-      let s = 0;
-      while (s < a.length && s < b.length && a[s] === b[s]) s++;
-      let e = 0;
-      while (e < a.length - s && e < b.length - s && a[a.length - 1 - e] === b[b.length - 1 - e]) e++;
-      const m1 = a.slice(s, a.length - e);
-      const m2 = b.slice(s, b.length - e);
-      const rows = [];
-      for (let i = 0; i < s; i++) rows.push({ t: "ctx", s: a[i] });
-      const n = m1.length, m = m2.length;
-      if (n === 0 && m === 0) {
-      } else if (n * m > 4e6) {
-        for (const l of m1) rows.push({ t: "del", s: l });
-        for (const l of m2) rows.push({ t: "add", s: l });
-      } else {
-        const w = m + 1;
-        const dp = new Uint32Array((n + 1) * w);
-        for (let i2 = n - 1; i2 >= 0; i2--) {
-          for (let j2 = m - 1; j2 >= 0; j2--) {
-            dp[i2 * w + j2] = m1[i2] === m2[j2] ? dp[(i2 + 1) * w + j2 + 1] + 1 : Math.max(dp[(i2 + 1) * w + j2], dp[i2 * w + j2 + 1]);
-          }
-        }
-        let i = 0, j = 0;
-        while (i < n && j < m) {
-          if (m1[i] === m2[j]) {
-            rows.push({ t: "ctx", s: m1[i] });
-            i++;
-            j++;
-          } else if (dp[(i + 1) * w + j] >= dp[i * w + j + 1]) {
-            rows.push({ t: "del", s: m1[i] });
-            i++;
-          } else {
-            rows.push({ t: "add", s: m2[j] });
-            j++;
-          }
-        }
-        while (i < n) {
-          rows.push({ t: "del", s: m1[i] });
-          i++;
-        }
-        while (j < m) {
-          rows.push({ t: "add", s: m2[j] });
-          j++;
-        }
-      }
-      for (let k = 0; k < e; k++) rows.push({ t: "ctx", s: a[a.length - e + k] });
-      return rows;
-    };
-    collapseContext = (rows, keep = 2) => {
-      const out = [];
-      let i = 0;
-      while (i < rows.length) {
-        if (rows[i].t !== "ctx") {
-          out.push(rows[i]);
-          i++;
-          continue;
-        }
-        let j = i;
-        while (j < rows.length && rows[j].t === "ctx") j++;
-        const run = j - i;
-        if (run > keep * 2 + 1) {
-          for (let k = 0; k < keep; k++) out.push(rows[i + k]);
-          out.push({ t: "ellip", n: run - keep * 2 });
-          for (let k = run - keep; k < run; k++) out.push(rows[i + k]);
-        } else {
-          for (let k = 0; k < run; k++) out.push(rows[i + k]);
-        }
-        i = j;
-      }
-      return out;
-    };
-  }
-});
-
 // src/diffView.ts
 var EDIT_TOOL_NAMES, extractEditPairs, pairsToDisplayRows, parseApprovalDiff;
 var init_diffView = __esm({
@@ -16812,7 +17326,7 @@ var init_TodosPanel = __esm({
 // src/components/ApprovalModal.tsx
 import { Box as Box5, Text as Text7 } from "ink";
 import { Fragment as Fragment2, jsx as jsx7, jsxs as jsxs5 } from "react/jsx-runtime";
-var OPTIONS, MAX_DIFF_LINES, ApprovalModal;
+var OPTIONS, MAX_DIFF_LINES, MAX_FULL_LINES, ApprovalModal;
 var init_ApprovalModal = __esm({
   "src/components/ApprovalModal.tsx"() {
     "use strict";
@@ -16822,14 +17336,20 @@ var init_ApprovalModal = __esm({
     init_diffView();
     OPTIONS = [
       { label: S.approvalAllow, value: "allow-once", color: THEME.ok },
+      // ★ I-4：会话级记忆（对标 CC「本会话不再询问」）——纯内存，会话结束失效
+      { label: S.approvalAllowSession, value: "allow-session", color: THEME.ok },
       { label: S.approvalAllowAlways, value: "allow-always", color: THEME.warn },
       { label: S.approvalDeny, value: "deny", color: THEME.danger }
     ];
     MAX_DIFF_LINES = 18;
-    ApprovalModal = ({ toolName, detail, selectedIndex, wrapW }) => {
+    MAX_FULL_LINES = 400;
+    ApprovalModal = ({ toolName, detail, fullDetail, expanded, selectedIndex, wrapW }) => {
       const contentW = Math.max(16, wrapW);
-      const parsed = parseApprovalDiff(detail, toolName);
+      const showFull = expanded && !!fullDetail;
+      const sourceText = showFull ? fullDetail : detail;
+      const parsed = parseApprovalDiff(sourceText, toolName);
       const diffRows = parsed ? pairsToDisplayRows(parsed.sections) : null;
+      const cap = showFull ? MAX_FULL_LINES : MAX_DIFF_LINES;
       return /* @__PURE__ */ jsxs5(Box5, { flexDirection: "column", borderStyle: "round", borderColor: THEME.warn, paddingX: 1, paddingY: 1, marginTop: 1, children: [
         /* @__PURE__ */ jsxs5(Text7, { color: THEME.warn, bold: true, children: [
           S.approvalTitle,
@@ -16838,9 +17358,10 @@ var init_ApprovalModal = __esm({
         ] }),
         /* @__PURE__ */ jsx7(Box5, { flexDirection: "column", marginTop: 0.5, marginBottom: 0.5, children: parsed && diffRows ? /* @__PURE__ */ jsxs5(Fragment2, { children: [
           wrapText(parsed.header, contentW).map((line, j) => /* @__PURE__ */ jsx7(Text7, { color: THEME.white, children: line }, `h-${j}`)),
-          diffRows.slice(0, MAX_DIFF_LINES).map((r, i) => /* @__PURE__ */ jsx7(Text7, { color: r.t === "del" ? THEME.danger : r.t === "add" ? THEME.ok : THEME.grayDim, children: r.t === "ellip" ? r.n > 0 ? `  \u22EF ${r.n} \u884C\u672A\u53D8` : "  \u22EF" : `${r.t === "del" ? "- " : r.t === "add" ? "+ " : "  "}${truncateMiddle(r.s, Math.max(20, contentW - 2))}` }, `d-${i}`)),
-          diffRows.length > MAX_DIFF_LINES ? /* @__PURE__ */ jsx7(Text7, { color: THEME.grayDim, children: `  \u2026\uFF08\u53E6\u6709 ${diffRows.length - MAX_DIFF_LINES} \u884C\u672A\u663E\u793A\uFF09` }) : null
-        ] }) : wrapText(detail || "(\u65E0\u8BF4\u660E)", contentW).map((line, j) => /* @__PURE__ */ jsx7(Text7, { color: THEME.white, children: line }, j)) }),
+          diffRows.slice(0, cap).map((r, i) => /* @__PURE__ */ jsx7(Text7, { color: r.t === "del" ? THEME.danger : r.t === "add" ? THEME.ok : THEME.grayDim, children: r.t === "ellip" ? r.n > 0 ? `  \u22EF ${r.n} \u884C\u672A\u53D8` : "  \u22EF" : `${r.t === "del" ? "- " : r.t === "add" ? "+ " : "  "}${truncateMiddle(r.s, Math.max(20, contentW - 2))}` }, `d-${i}`)),
+          diffRows.length > cap ? /* @__PURE__ */ jsx7(Text7, { color: THEME.grayDim, children: `  \u2026\uFF08\u53E6\u6709 ${diffRows.length - cap} \u884C\u672A\u663E\u793A${showFull ? "" : "\uFF0C\u6309 f \u67E5\u770B\u5B8C\u6574\u5185\u5BB9"}\uFF09` }) : null
+        ] }) : wrapText(sourceText || "(\u65E0\u8BF4\u660E)", contentW).map((line, j) => /* @__PURE__ */ jsx7(Text7, { color: THEME.white, children: line }, j)) }),
+        fullDetail ? /* @__PURE__ */ jsx7(Text7, { color: THEME.grayDim, children: S.approvalFullHint }) : null,
         /* @__PURE__ */ jsx7(Text7, { color: THEME.grayDim, children: S.approvalPrompt }),
         OPTIONS.map((opt, i) => {
           const active = i === selectedIndex;
@@ -17157,9 +17678,74 @@ var init_ModelPicker = __esm({
   }
 });
 
-// src/components/SlashMenu.tsx
+// src/components/RewindPicker.tsx
 import { Box as Box13, Text as Text15 } from "ink";
 import { jsx as jsx15, jsxs as jsxs13 } from "react/jsx-runtime";
+var PAGE_SIZE4, kindMark, RewindPicker;
+var init_RewindPicker = __esm({
+  "src/components/RewindPicker.tsx"() {
+    "use strict";
+    init_theme();
+    init_strings();
+    init_util();
+    PAGE_SIZE4 = 8;
+    kindMark = (k) => k === "creation_marker" ? "\uFF0B" : k === "directory_tree" ? "\u25A4" : "~";
+    RewindPicker = ({ records, selectedIndex, wrapW }) => {
+      const start = Math.floor(Math.max(0, selectedIndex) / PAGE_SIZE4) * PAGE_SIZE4;
+      const visible = records.slice(start, start + PAGE_SIZE4);
+      const contentW = Math.max(24, wrapW);
+      const metaSample = "  \xB7 edit_file \xB7 59 \u5206\u949F\u524D";
+      const pathW = Math.max(16, contentW - strWidth(metaSample) - 4);
+      return /* @__PURE__ */ jsxs13(Box13, { flexDirection: "column", borderStyle: "round", borderColor: THEME.warn, paddingX: 1, paddingY: 1, marginTop: 1, children: [
+        /* @__PURE__ */ jsx15(Text15, { color: THEME.warn, bold: true, children: S.rewindTitle }),
+        /* @__PURE__ */ jsx15(Text15, { color: THEME.grayDim, children: S.rewindPrompt }),
+        /* @__PURE__ */ jsx15(Box13, { flexDirection: "column", marginTop: 0.5, children: visible.map((r, i) => {
+          const idx = start + i;
+          const active = idx === selectedIndex;
+          return /* @__PURE__ */ jsxs13(Box13, { flexDirection: "row", children: [
+            /* @__PURE__ */ jsx15(Text15, { color: active ? THEME.coralBright : void 0, bold: true, children: active ? "\u203A " : "  " }),
+            /* @__PURE__ */ jsxs13(Text15, { color: THEME.grayDim, children: [
+              kindMark(r.backupKind),
+              " "
+            ] }),
+            /* @__PURE__ */ jsx15(Text15, { color: active ? THEME.white : THEME.gray, bold: active, children: truncateMiddle(r.relativePath, pathW) }),
+            /* @__PURE__ */ jsx15(Text15, { color: THEME.grayDim, children: `  \xB7 ${truncateMiddle(r.operationType, 20)} \xB7 ${S.relTime(r.timestamp)}` })
+          ] }, r.undoId);
+        }) })
+      ] });
+    };
+  }
+});
+
+// src/components/DiffSummaryCard.tsx
+import { Box as Box14, Text as Text16 } from "ink";
+import { Fragment as Fragment3, jsx as jsx16, jsxs as jsxs14 } from "react/jsx-runtime";
+var MAX_ROWS_PER_FILE, DiffSummaryCard;
+var init_DiffSummaryCard = __esm({
+  "src/components/DiffSummaryCard.tsx"() {
+    "use strict";
+    init_theme();
+    init_util();
+    MAX_ROWS_PER_FILE = 40;
+    DiffSummaryCard = ({ title, files, wrapW }) => {
+      const contentW = Math.max(16, wrapW);
+      return /* @__PURE__ */ jsxs14(Box14, { flexDirection: "column", marginTop: 1, children: [
+        /* @__PURE__ */ jsx16(Text16, { color: THEME.grayDim, bold: true, children: title }),
+        files.map((f) => /* @__PURE__ */ jsxs14(Box14, { flexDirection: "column", marginTop: 0.5, children: [
+          /* @__PURE__ */ jsx16(Text16, { color: THEME.white, bold: true, children: truncateMiddle(f.path, Math.max(20, contentW)) }),
+          f.note ? /* @__PURE__ */ jsx16(Text16, { color: THEME.grayDim, children: `  ${f.note}` }) : f.rows ? /* @__PURE__ */ jsxs14(Fragment3, { children: [
+            f.rows.slice(0, MAX_ROWS_PER_FILE).map((r, i) => /* @__PURE__ */ jsx16(Text16, { color: r.t === "del" ? THEME.danger : r.t === "add" ? THEME.ok : THEME.grayDim, children: r.t === "ellip" ? r.n > 0 ? `  \u22EF ${r.n} \u884C\u672A\u53D8` : "  \u22EF" : `${r.t === "del" ? "- " : r.t === "add" ? "+ " : "  "}${truncateMiddle(r.s, Math.max(20, contentW - 2))}` }, i)),
+            f.rows.length > MAX_ROWS_PER_FILE ? /* @__PURE__ */ jsx16(Text16, { color: THEME.grayDim, children: `  \u2026\uFF08\u53E6\u6709 ${f.rows.length - MAX_ROWS_PER_FILE} \u884C\u672A\u663E\u793A\uFF09` }) : null
+          ] }) : null
+        ] }, f.path))
+      ] });
+    };
+  }
+});
+
+// src/components/SlashMenu.tsx
+import { Box as Box15, Text as Text17 } from "ink";
+import { jsx as jsx17, jsxs as jsxs15 } from "react/jsx-runtime";
 var MAX_ROWS, SlashMenu;
 var init_SlashMenu = __esm({
   "src/components/SlashMenu.tsx"() {
@@ -17171,22 +17757,22 @@ var init_SlashMenu = __esm({
       const visible = entries.slice(start, start + MAX_ROWS);
       const cmdW = Math.min(22, Math.max(8, ...visible.map((e) => e.name.length)) + 1);
       const descMax = Math.max(12, cols - cmdW - 6);
-      return /* @__PURE__ */ jsxs13(Box13, { flexDirection: "column", borderStyle: "round", borderColor: THEME.coral, paddingX: 1, paddingY: 0, marginTop: 1, children: [
+      return /* @__PURE__ */ jsxs15(Box15, { flexDirection: "column", borderStyle: "round", borderColor: THEME.coral, paddingX: 1, paddingY: 0, marginTop: 1, children: [
         visible.map((e, i) => {
           const active = i + start === selectedIndex;
           const desc = e.description.length > descMax ? `${e.description.slice(0, descMax - 1)}\u2026` : e.description;
           const gap = Math.max(1, cmdW - e.name.length);
-          return /* @__PURE__ */ jsxs13(Box13, { flexDirection: "row", children: [
-            /* @__PURE__ */ jsx15(Text15, { color: active ? THEME.coralBright : void 0, bold: true, children: active ? "\u276F " : "  " }),
-            /* @__PURE__ */ jsxs13(Text15, { color: active ? THEME.white : THEME.gray, bold: active, children: [
+          return /* @__PURE__ */ jsxs15(Box15, { flexDirection: "row", children: [
+            /* @__PURE__ */ jsx17(Text17, { color: active ? THEME.coralBright : void 0, bold: true, children: active ? "\u276F " : "  " }),
+            /* @__PURE__ */ jsxs15(Text17, { color: active ? THEME.white : THEME.gray, bold: active, children: [
               "/",
               e.name
             ] }),
-            /* @__PURE__ */ jsx15(Text15, { color: THEME.grayDim, children: " ".repeat(gap) }),
-            /* @__PURE__ */ jsx15(Text15, { color: active ? THEME.gray : THEME.grayDim, children: desc })
+            /* @__PURE__ */ jsx17(Text17, { color: THEME.grayDim, children: " ".repeat(gap) }),
+            /* @__PURE__ */ jsx17(Text17, { color: active ? THEME.gray : THEME.grayDim, children: desc })
           ] }, e.name);
         }),
-        entries.length > MAX_ROWS ? /* @__PURE__ */ jsxs13(Text15, { color: THEME.coralMuted, children: [
+        entries.length > MAX_ROWS ? /* @__PURE__ */ jsxs15(Text17, { color: THEME.coralMuted, children: [
           "\u2191\u2193 \u6EDA\u52A8 \xB7 ",
           selectedIndex + 1,
           "/",
@@ -17199,8 +17785,8 @@ var init_SlashMenu = __esm({
 });
 
 // src/components/StatusStrip.tsx
-import { Box as Box14, Text as Text16 } from "ink";
-import { jsx as jsx16, jsxs as jsxs14 } from "react/jsx-runtime";
+import { Box as Box16, Text as Text18 } from "ink";
+import { jsx as jsx18, jsxs as jsxs16 } from "react/jsx-runtime";
 var StatusStrip;
 var init_StatusStrip = __esm({
   "src/components/StatusStrip.tsx"() {
@@ -17217,18 +17803,18 @@ var init_StatusStrip = __esm({
         `state: ${stateText}`,
         sessionShort ? `session: ${sessionShort}` : ""
       ].filter(Boolean);
-      return /* @__PURE__ */ jsxs14(Box14, { flexDirection: "column", flexShrink: 0, children: [
-        /* @__PURE__ */ jsx16(Text16, { color: THEME.coralMuted, children: customLine && customLine.trim() ? customLine : bits.join("   \xB7   ") }),
-        /* @__PURE__ */ jsx16(Text16, { color: stateColor, children: "" }),
-        /* @__PURE__ */ jsx16(Text16, { color: THEME.grayDim, children: S.cmdHint })
+      return /* @__PURE__ */ jsxs16(Box16, { flexDirection: "column", flexShrink: 0, children: [
+        /* @__PURE__ */ jsx18(Text18, { color: THEME.coralMuted, children: customLine && customLine.trim() ? customLine : bits.join("   \xB7   ") }),
+        /* @__PURE__ */ jsx18(Text18, { color: stateColor, children: "" }),
+        /* @__PURE__ */ jsx18(Text18, { color: THEME.grayDim, children: S.cmdHint })
       ] });
     };
   }
 });
 
 // src/components/TopPanel.tsx
-import { Box as Box15, Text as Text17 } from "ink";
-import { jsx as jsx17, jsxs as jsxs15 } from "react/jsx-runtime";
+import { Box as Box17, Text as Text19 } from "ink";
+import { jsx as jsx19, jsxs as jsxs17 } from "react/jsx-runtime";
 var ROBOT, INNER_H, TopPanel;
 var init_TopPanel = __esm({
   "src/components/TopPanel.tsx"() {
@@ -17248,36 +17834,36 @@ var init_TopPanel = __esm({
       const leftW = Math.floor(innerW * 0.33);
       const rightW = innerW - leftW - 1;
       const ruleLen = Math.max(8, rightW - 2);
-      const VDivider = /* @__PURE__ */ jsx17(Box15, { flexDirection: "column", width: 1, flexShrink: 0, children: Array.from({ length: INNER_H }).map((_, i) => /* @__PURE__ */ jsx17(Text17, { color: THEME.coral, children: "\u2502" }, i)) });
-      return /* @__PURE__ */ jsxs15(Box15, { flexDirection: "column", width: panelW, marginBottom: 1, children: [
-        /* @__PURE__ */ jsxs15(Text17, { children: [
-          /* @__PURE__ */ jsx17(Text17, { color: THEME.coralBright, bold: true, children: "* Welcome to " }),
-          /* @__PURE__ */ jsx17(Text17, { bold: true, color: THEME.white, children: "deep" }),
-          /* @__PURE__ */ jsx17(Text17, { bold: true, color: THEME.coralBright, children: "Seek" }),
-          /* @__PURE__ */ jsx17(Text17, { bold: true, color: THEME.white, children: "Code" }),
-          /* @__PURE__ */ jsxs15(Text17, { color: THEME.coralMuted, children: [
+      const VDivider = /* @__PURE__ */ jsx19(Box17, { flexDirection: "column", width: 1, flexShrink: 0, children: Array.from({ length: INNER_H }).map((_, i) => /* @__PURE__ */ jsx19(Text19, { color: THEME.coral, children: "\u2502" }, i)) });
+      return /* @__PURE__ */ jsxs17(Box17, { flexDirection: "column", width: panelW, marginBottom: 1, children: [
+        /* @__PURE__ */ jsxs17(Text19, { children: [
+          /* @__PURE__ */ jsx19(Text19, { color: THEME.coralBright, bold: true, children: "* Welcome to " }),
+          /* @__PURE__ */ jsx19(Text19, { bold: true, color: THEME.white, children: "deep" }),
+          /* @__PURE__ */ jsx19(Text19, { bold: true, color: THEME.coralBright, children: "Seek" }),
+          /* @__PURE__ */ jsx19(Text19, { bold: true, color: THEME.white, children: "Code" }),
+          /* @__PURE__ */ jsxs17(Text19, { color: THEME.coralMuted, children: [
             "  ",
             VERSION
           ] })
         ] }),
-        /* @__PURE__ */ jsx17(Text17, { color: THEME.grayDim, children: cwd }),
-        /* @__PURE__ */ jsxs15(Box15, { flexDirection: "row", borderStyle: "round", borderColor: THEME.coral, marginTop: 1, paddingX: 0, paddingY: 0, children: [
-          /* @__PURE__ */ jsxs15(Box15, { flexDirection: "column", width: leftW, height: INNER_H, alignItems: "center", justifyContent: "center", children: [
-            /* @__PURE__ */ jsx17(Text17, { color: THEME.white, bold: true, children: "Welcome back!" }),
-            ROBOT.map((l, i) => /* @__PURE__ */ jsx17(Text17, { color: THEME.coralBright, children: l }, i)),
-            /* @__PURE__ */ jsx17(Text17, { color: THEME.grayDim, children: "Ctrl+C \u9000\u51FA \xB7 Esc \u4E2D\u6B62" }),
-            /* @__PURE__ */ jsx17(Text17, { color: THEME.grayDim, children: "\u8F93\u5165 / \u67E5\u770B\u547D\u4EE4" })
+        /* @__PURE__ */ jsx19(Text19, { color: THEME.grayDim, children: cwd }),
+        /* @__PURE__ */ jsxs17(Box17, { flexDirection: "row", borderStyle: "round", borderColor: THEME.coral, marginTop: 1, paddingX: 0, paddingY: 0, children: [
+          /* @__PURE__ */ jsxs17(Box17, { flexDirection: "column", width: leftW, height: INNER_H, alignItems: "center", justifyContent: "center", children: [
+            /* @__PURE__ */ jsx19(Text19, { color: THEME.white, bold: true, children: "Welcome back!" }),
+            ROBOT.map((l, i) => /* @__PURE__ */ jsx19(Text19, { color: THEME.coralBright, children: l }, i)),
+            /* @__PURE__ */ jsx19(Text19, { color: THEME.grayDim, children: "Ctrl+C \u9000\u51FA \xB7 Esc \u4E2D\u6B62" }),
+            /* @__PURE__ */ jsx19(Text19, { color: THEME.grayDim, children: "\u8F93\u5165 / \u67E5\u770B\u547D\u4EE4" })
           ] }),
           VDivider,
-          /* @__PURE__ */ jsxs15(Box15, { flexDirection: "column", width: rightW, height: INNER_H, justifyContent: "space-between", paddingX: 1, children: [
-            /* @__PURE__ */ jsxs15(Box15, { flexDirection: "column", children: [
-              /* @__PURE__ */ jsx17(Text17, { color: THEME.coralBright, bold: true, children: "Tips for getting started" }),
-              /* @__PURE__ */ jsx17(Text17, { color: THEME.white, children: "\u8F93\u5165\u9700\u6C42\u5F00\u59CB\uFF0C\u8F93\u5165 / \u5524\u51FA\u547D\u4EE4\u3002" })
+          /* @__PURE__ */ jsxs17(Box17, { flexDirection: "column", width: rightW, height: INNER_H, justifyContent: "space-between", paddingX: 1, children: [
+            /* @__PURE__ */ jsxs17(Box17, { flexDirection: "column", children: [
+              /* @__PURE__ */ jsx19(Text19, { color: THEME.coralBright, bold: true, children: "Tips for getting started" }),
+              /* @__PURE__ */ jsx19(Text19, { color: THEME.white, children: "\u8F93\u5165\u9700\u6C42\u5F00\u59CB\uFF0C\u8F93\u5165 / \u5524\u51FA\u547D\u4EE4\u3002" })
             ] }),
-            /* @__PURE__ */ jsx17(Text17, { color: THEME.grayDim, children: "\u2500".repeat(ruleLen) }),
-            /* @__PURE__ */ jsxs15(Box15, { flexDirection: "column", children: [
-              /* @__PURE__ */ jsx17(Text17, { color: THEME.coralBright, bold: true, children: "What's new" }),
-              /* @__PURE__ */ jsx17(Text17, { color: THEME.white, children: "\u5DF2\u5BF9\u63A5\u672C\u5730 Tool Call \u667A\u80FD\u51FD\u6570\u8C03\u7528\u3002" })
+            /* @__PURE__ */ jsx19(Text19, { color: THEME.grayDim, children: "\u2500".repeat(ruleLen) }),
+            /* @__PURE__ */ jsxs17(Box17, { flexDirection: "column", children: [
+              /* @__PURE__ */ jsx19(Text19, { color: THEME.coralBright, bold: true, children: "What's new" }),
+              /* @__PURE__ */ jsx19(Text19, { color: THEME.white, children: "\u5DF2\u5BF9\u63A5\u672C\u5730 Tool Call \u667A\u80FD\u51FD\u6570\u8C03\u7528\u3002" })
             ] })
           ] })
         ] })
@@ -17287,7 +17873,7 @@ var init_TopPanel = __esm({
 });
 
 // ../core/src/observability/inspect.ts
-import fs48 from "fs";
+import fs49 from "fs";
 var OBS, obsT, CWD, fmt, readTrace, fmtK, inspectUsage, inspectContext, inspectPermissions, inspectMcp, inspectHooks, inspectDebug;
 var init_inspect = __esm({
   "../core/src/observability/inspect.ts"() {
@@ -17410,7 +17996,7 @@ var init_inspect = __esm({
       if (!sessionId) return [];
       try {
         const p = await getTraceStorePath(sessionId);
-        const text = await fs48.promises.readFile(p, "utf8");
+        const text = await fs49.promises.readFile(p, "utf8");
         const out = [];
         for (const line of text.split("\n")) {
           if (!line.trim()) continue;
@@ -17519,7 +18105,7 @@ var init_inspect = __esm({
       }
       let sidecarCount = 0;
       try {
-        sidecarCount = (await fs48.promises.readdir(getToolOutputSidecarDir(sessionId))).filter((f) => f.endsWith(".txt")).length;
+        sidecarCount = (await fs49.promises.readdir(getToolOutputSidecarDir(sessionId))).filter((f) => f.endsWith(".txt")).length;
       } catch {
       }
       const window = appConfig.MAX_HISTORY_TOKENS;
@@ -17594,8 +18180,8 @@ __export(App_exports, {
   App: () => App
 });
 import { useCallback as useCallback2, useEffect as useEffect4, useMemo, useRef as useRef2, useState as useState4 } from "react";
-import { Box as Box16, Static, Text as Text18, useApp, useInput as useInput2, useStdout } from "ink";
-import { Fragment as Fragment3, jsx as jsx18, jsxs as jsxs16 } from "react/jsx-runtime";
+import { Box as Box18, Static, Text as Text20, useApp, useInput as useInput2, useStdout } from "ink";
+import { Fragment as Fragment4, jsx as jsx20, jsxs as jsxs18 } from "react/jsx-runtime";
 var CWD2, RowView, isDynamicRow, SPINNER_FRAMES, App;
 var init_App = __esm({
   "src/App.tsx"() {
@@ -17622,23 +18208,27 @@ var init_App = __esm({
     init_SessionPicker();
     init_ForkPicker();
     init_ModelPicker();
+    init_RewindPicker();
+    init_DiffSummaryCard();
     init_SlashMenu();
     init_MultilineInput();
     init_StatusStrip();
     init_TopPanel();
     init_inspect();
+    init_restore();
     CWD2 = process.cwd();
     RowView = ({ row, wrapW, streamTail, showThinking }) => {
-      if (row.kind === "todos") return /* @__PURE__ */ jsx18(TodosPanel, { todos: row.todos, wrapW });
-      if (row.kind === "tool") return /* @__PURE__ */ jsx18(ToolCard, { toolName: row.toolName, args: row.args, result: row.result, ok: row.ok, status: row.status, progress: row.progress, wrapW });
-      if (row.kind === "thinking") return /* @__PURE__ */ jsx18(ThinkingBlock, { streaming: row.streaming ?? false, startedAt: row.startedAt, durationMs: row.durationMs, tokens: row.tokens, text: row.text, expanded: showThinking, wrapW });
+      if (row.kind === "todos") return /* @__PURE__ */ jsx20(TodosPanel, { todos: row.todos, wrapW });
+      if (row.kind === "tool") return /* @__PURE__ */ jsx20(ToolCard, { toolName: row.toolName, args: row.args, result: row.result, ok: row.ok, status: row.status, progress: row.progress, wrapW });
+      if (row.kind === "diff-summary") return /* @__PURE__ */ jsx20(DiffSummaryCard, { title: row.title, files: row.files, wrapW });
+      if (row.kind === "thinking") return /* @__PURE__ */ jsx20(ThinkingBlock, { streaming: row.streaming ?? false, startedAt: row.startedAt, durationMs: row.durationMs, tokens: row.tokens, text: row.text, expanded: showThinking, wrapW });
       if (row.kind === "user") {
-        return /* @__PURE__ */ jsxs16(Box16, { flexDirection: "column", marginTop: 1, children: [
-          /* @__PURE__ */ jsx18(Text18, { color: THEME.grayDim, children: "\u2500".repeat(Math.max(8, wrapW)) }),
-          /* @__PURE__ */ jsx18(MessageBlock, { row, wrapW, streamTail })
+        return /* @__PURE__ */ jsxs18(Box18, { flexDirection: "column", marginTop: 1, children: [
+          /* @__PURE__ */ jsx20(Text20, { color: THEME.grayDim, children: "\u2500".repeat(Math.max(8, wrapW)) }),
+          /* @__PURE__ */ jsx20(MessageBlock, { row, wrapW, streamTail })
         ] });
       }
-      return /* @__PURE__ */ jsx18(MessageBlock, { row, wrapW, streamTail });
+      return /* @__PURE__ */ jsx20(MessageBlock, { row, wrapW, streamTail });
     };
     isDynamicRow = (r) => r.kind === "assistant" && !!r.streaming || r.kind === "thinking" && !!r.streaming || r.kind === "tool" && r.status === "running" || r.kind === "todos" && !!r.active || r.kind === "compact-progress" || r.kind === "subagent-progress";
     SPINNER_FRAMES = ["\u280B", "\u2819", "\u2839", "\u2838", "\u283C", "\u2834", "\u2826", "\u2827", "\u2807", "\u280F"];
@@ -17667,6 +18257,7 @@ var init_App = __esm({
       const [planEditing, setPlanEditing] = useState4(false);
       const [planDraft, setPlanDraft] = useState4("");
       const [planCursor, setPlanCursor] = useState4(0);
+      const [approvalFull, setApprovalFull] = useState4(false);
       const [qCursor, setQCursor] = useState4(0);
       const [qChecked, setQChecked] = useState4(/* @__PURE__ */ new Set());
       const [qEditing, setQEditing] = useState4(false);
@@ -17778,8 +18369,14 @@ var init_App = __esm({
               return S.cmdSessions;
             case "fork":
               return S.cmdFork;
+            case "undo":
+              return S.cmdUndo;
             case "usage":
               return S.cmdUsage;
+            case "rewind":
+              return S.cmdRewind;
+            case "diff":
+              return S.cmdDiff;
             case "budget":
               return S.cmdBudget;
             case "context":
@@ -17812,7 +18409,7 @@ var init_App = __esm({
         const q = input.slice(1).toLowerCase();
         return menuEntries.filter((c) => c.name.toLowerCase().startsWith(q));
       }, [input, menuEntries]);
-      const menuActive = state.pendingApproval != null || state.pendingQuestion != null || state.pendingPlan != null || state.pendingSessions != null || state.pendingFork != null || state.pendingModel != null;
+      const menuActive = state.pendingApproval != null || state.pendingQuestion != null || state.pendingPlan != null || state.pendingSessions != null || state.pendingFork != null || state.pendingModel != null || state.pendingRewind != null;
       const [busyClock, setBusyClock] = useState4({ frame: 0, sec: 0 });
       const busyStartRef = useRef2(0);
       useEffect4(() => {
@@ -17836,7 +18433,8 @@ var init_App = __esm({
       useEffect4(() => {
         setSelectIdx(0);
         setPlanEditing(false);
-      }, [state.pendingApproval, state.pendingQuestion, state.pendingPlan, state.pendingSessions, state.pendingFork, state.pendingModel, slashVisible, filteredCommands.length]);
+        setApprovalFull(false);
+      }, [state.pendingApproval, state.pendingQuestion, state.pendingPlan, state.pendingSessions, state.pendingFork, state.pendingModel, state.pendingRewind, slashVisible, filteredCommands.length]);
       useEffect4(() => {
         setQCursor(0);
         setQChecked(/* @__PURE__ */ new Set());
@@ -17874,6 +18472,21 @@ var init_App = __esm({
           case "/fork":
             void state.openForkPicker();
             return true;
+          case "/undo": {
+            const sid = state.sessionIdRef.current;
+            if (!sid) {
+              state.pushInfo(S.undoNoSession);
+              return true;
+            }
+            state.pushInfo(await restoreLast(sid));
+            return true;
+          }
+          case "/rewind":
+            void state.openRewindPicker();
+            return true;
+          case "/diff":
+            void state.openDiff();
+            return true;
           case "/help":
             state.pushInfo(S.helpText(modelDisplay, state.getThinkingLevel(), getLocale()));
             return true;
@@ -18096,7 +18709,11 @@ ${listText}`);
           return;
         }
         if (state.pendingApproval) {
-          const APPROVAL_DECISIONS = ["allow-once", "allow-always", "deny"];
+          const APPROVAL_DECISIONS = ["allow-once", "allow-session", "allow-always", "deny"];
+          if (ch === "f" || ch === "F") {
+            setApprovalFull((v) => !v);
+            return;
+          }
           if (key.upArrow) setSelectIdx((i) => (i - 1 + APPROVAL_DECISIONS.length) % APPROVAL_DECISIONS.length);
           else if (key.downArrow) setSelectIdx((i) => (i + 1) % APPROVAL_DECISIONS.length);
           else if (key.return) state.resolveApproval(APPROVAL_DECISIONS[selectIdxRef.current] ?? "deny");
@@ -18190,6 +18807,16 @@ ${listText}`);
           } else if (key.escape || key.ctrl && ch === "g") state.resolveModel(null);
           return;
         }
+        if (state.pendingRewind) {
+          const list = state.pendingRewind.records;
+          if (key.upArrow) setSelectIdx((i) => (i - 1 + list.length) % list.length);
+          else if (key.downArrow) setSelectIdx((i) => (i + 1) % list.length);
+          else if (key.return) {
+            const sel = list[Math.min(selectIdxRef.current, list.length - 1)];
+            state.resolveRewind(sel?.undoId ?? null);
+          } else if (key.escape || key.ctrl && ch === "g") state.resolveRewind(null);
+          return;
+        }
         if (key.ctrl && ch === "t") {
           state.toggleShowThinking();
           return;
@@ -18230,14 +18857,14 @@ ${listText}`);
         }
       });
       const sessionShort = state.sessionIdRef.current ? truncateMiddle(state.sessionIdRef.current, 12) : "";
-      return /* @__PURE__ */ jsxs16(Box16, { flexDirection: "column", width: cols, children: [
-        /* @__PURE__ */ jsx18(Static, { items: staticItems, children: (item) => item.kind === "__header" ? /* @__PURE__ */ jsx18(TopPanel, { cwd: CWD2, cols }, "header") : /* @__PURE__ */ jsx18(RowView, { row: item, wrapW, streamTail, showThinking: state.showThinkingText }, item.id) }),
-        /* @__PURE__ */ jsxs16(Box16, { flexDirection: "column", width: cols, children: [
-          menuActive ? null : /* @__PURE__ */ jsxs16(Box16, { flexDirection: "column", paddingX: 1, children: [
-            dynamicRows.map((row) => /* @__PURE__ */ jsx18(RowView, { row, wrapW, streamTail, showThinking: state.showThinkingText }, row.id)),
-            state.busy ? /* @__PURE__ */ jsx18(Box16, { marginTop: 0.5, children: /* @__PURE__ */ jsxs16(Text18, { color: THEME.coralBright, children: [
+      return /* @__PURE__ */ jsxs18(Box18, { flexDirection: "column", width: cols, children: [
+        /* @__PURE__ */ jsx20(Static, { items: staticItems, children: (item) => item.kind === "__header" ? /* @__PURE__ */ jsx20(TopPanel, { cwd: CWD2, cols }, "header") : /* @__PURE__ */ jsx20(RowView, { row: item, wrapW, streamTail, showThinking: state.showThinkingText }, item.id) }),
+        /* @__PURE__ */ jsxs18(Box18, { flexDirection: "column", width: cols, children: [
+          menuActive ? null : /* @__PURE__ */ jsxs18(Box18, { flexDirection: "column", paddingX: 1, children: [
+            dynamicRows.map((row) => /* @__PURE__ */ jsx20(RowView, { row, wrapW, streamTail, showThinking: state.showThinkingText }, row.id)),
+            state.busy ? /* @__PURE__ */ jsx20(Box18, { marginTop: 0.5, children: /* @__PURE__ */ jsxs18(Text20, { color: THEME.coralBright, children: [
               `${SPINNER_FRAMES[busyClock.frame]} ${S.thinkVerbs[Math.floor(busyClock.sec / 3) % S.thinkVerbs.length]}\u2026 (${busyClock.sec}s \xB7 ${S.escInterrupt})`,
-              state.runningAgents > 0 ? /* @__PURE__ */ jsxs16(Text18, { color: "green", children: [
+              state.runningAgents > 0 ? /* @__PURE__ */ jsxs18(Text20, { color: "green", children: [
                 " \xB7 \u25CF ",
                 state.runningAgents,
                 " agent",
@@ -18245,9 +18872,9 @@ ${listText}`);
               ] }) : null
             ] }) }) : null
           ] }),
-          /* @__PURE__ */ jsxs16(Box16, { flexDirection: "column", paddingX: 1, flexShrink: 0, children: [
-            state.pendingApproval ? /* @__PURE__ */ jsx18(ApprovalModal, { toolName: state.pendingApproval.toolName, detail: state.pendingApproval.detail, selectedIndex: selectIdx, wrapW }) : null,
-            state.pendingQuestion ? /* @__PURE__ */ jsx18(
+          /* @__PURE__ */ jsxs18(Box18, { flexDirection: "column", paddingX: 1, flexShrink: 0, children: [
+            state.pendingApproval ? /* @__PURE__ */ jsx20(ApprovalModal, { toolName: state.pendingApproval.toolName, detail: state.pendingApproval.detail, fullDetail: state.pendingApproval.fullDetail, expanded: approvalFull, selectedIndex: selectIdx, wrapW }) : null,
+            state.pendingQuestion ? /* @__PURE__ */ jsx20(
               QuestionModal,
               {
                 question: state.pendingQuestion.req.question,
@@ -18266,7 +18893,7 @@ ${listText}`);
                 onDraftSubmit: confirmQuestionDraft
               }
             ) : null,
-            state.pendingPlan ? planEditing ? /* @__PURE__ */ jsx18(
+            state.pendingPlan ? planEditing ? /* @__PURE__ */ jsx20(
               PlanEditor,
               {
                 value: planDraft,
@@ -18277,16 +18904,17 @@ ${listText}`);
                 },
                 onSubmit: confirmPlanEdit
               }
-            ) : /* @__PURE__ */ jsx18(PlanModal, { selectedIndex: selectIdx }) : null,
-            state.pendingSessions ? /* @__PURE__ */ jsx18(SessionPicker, { sessions: state.pendingSessions.sessions, selectedIndex: selectIdx, wrapW }) : null,
-            state.pendingFork ? /* @__PURE__ */ jsx18(ForkPicker, { anchors: state.pendingFork.anchors, selectedIndex: selectIdx, wrapW }) : null,
-            state.pendingModel ? /* @__PURE__ */ jsx18(ModelPicker, { models: state.pendingModel.models, currentModel: modelDisplay, selectedIndex: selectIdx, wrapW }) : null,
-            slashVisible ? /* @__PURE__ */ jsx18(SlashMenu, { entries: filteredCommands, selectedIndex: selectIdx, cols }) : null
+            ) : /* @__PURE__ */ jsx20(PlanModal, { selectedIndex: selectIdx }) : null,
+            state.pendingSessions ? /* @__PURE__ */ jsx20(SessionPicker, { sessions: state.pendingSessions.sessions, selectedIndex: selectIdx, wrapW }) : null,
+            state.pendingFork ? /* @__PURE__ */ jsx20(ForkPicker, { anchors: state.pendingFork.anchors, selectedIndex: selectIdx, wrapW }) : null,
+            state.pendingModel ? /* @__PURE__ */ jsx20(ModelPicker, { models: state.pendingModel.models, currentModel: modelDisplay, selectedIndex: selectIdx, wrapW }) : null,
+            state.pendingRewind ? /* @__PURE__ */ jsx20(RewindPicker, { records: state.pendingRewind.records, selectedIndex: selectIdx, wrapW }) : null,
+            slashVisible ? /* @__PURE__ */ jsx20(SlashMenu, { entries: filteredCommands, selectedIndex: selectIdx, cols }) : null
           ] }),
-          /* @__PURE__ */ jsx18(Box16, { flexDirection: "column", paddingX: 1, marginTop: 1, flexShrink: 0, children: (() => {
+          /* @__PURE__ */ jsx20(Box18, { flexDirection: "column", paddingX: 1, marginTop: 1, flexShrink: 0, children: (() => {
             const planOn = state.getPlanMode();
             const autoOn = !planOn && state.getAutoMode();
-            const inputEl = /* @__PURE__ */ jsx18(
+            const inputEl = /* @__PURE__ */ jsx20(
               MultilineInput,
               {
                 value: input,
@@ -18304,17 +18932,17 @@ ${listText}`);
               }
             );
             if (planOn || autoOn) {
-              return /* @__PURE__ */ jsxs16(Box16, { flexDirection: "column", borderStyle: "round", borderColor: planOn ? THEME.thinking : THEME.warn, paddingX: 1, children: [
-                /* @__PURE__ */ jsx18(Text18, { color: planOn ? THEME.thinking : THEME.warn, children: planOn ? S.inputBadgePlan : S.inputBadgeAuto }),
+              return /* @__PURE__ */ jsxs18(Box18, { flexDirection: "column", borderStyle: "round", borderColor: planOn ? THEME.thinking : THEME.warn, paddingX: 1, children: [
+                /* @__PURE__ */ jsx20(Text20, { color: planOn ? THEME.thinking : THEME.warn, children: planOn ? S.inputBadgePlan : S.inputBadgeAuto }),
                 inputEl
               ] });
             }
-            return /* @__PURE__ */ jsxs16(Fragment3, { children: [
-              /* @__PURE__ */ jsx18(Text18, { dimColor: true, color: THEME.gray, children: dimRule(cols) }),
+            return /* @__PURE__ */ jsxs18(Fragment4, { children: [
+              /* @__PURE__ */ jsx20(Text20, { dimColor: true, color: THEME.gray, children: dimRule(cols) }),
               inputEl
             ] });
           })() }),
-          /* @__PURE__ */ jsx18(Box16, { paddingX: 1, marginTop: 1, flexShrink: 0, children: /* @__PURE__ */ jsx18(StatusStrip, { model: modelDisplay, busy: state.busy, aborting: state.aborting, planMode: state.getPlanMode(), autoMode: state.getAutoMode(), sessionShort, cols, customLine: statusLineText }) })
+          /* @__PURE__ */ jsx20(Box18, { paddingX: 1, marginTop: 1, flexShrink: 0, children: /* @__PURE__ */ jsx20(StatusStrip, { model: modelDisplay, busy: state.busy, aborting: state.aborting, planMode: state.getPlanMode(), autoMode: state.getAutoMode(), sessionShort, cols, customLine: statusLineText }) })
         ] })
       ] });
     };
@@ -18327,7 +18955,7 @@ __export(batchRunner_exports, {
   parseWaitWindow: () => parseWaitWindow,
   runBatchQueue: () => runBatchQueue
 });
-import fs49 from "fs";
+import fs50 from "fs";
 import { spawn as spawn6 } from "child_process";
 var BATCH_EDIT_TOOLS, BATCH_DEFAULT_DENYLIST, ACCEPT_TIMEOUT_MIN, ACCEPT_TAIL_LINES, emit2, ts, runAcceptCommand, collectSessionCost, buildReport, runOneTask, parseWaitWindow, nowMinutes, sleep, waitUntilWindow, runBatchQueue;
 var init_batchRunner = __esm({
@@ -18335,6 +18963,7 @@ var init_batchRunner = __esm({
     "use strict";
     init_chatProcessing();
     init_tool();
+    init_autoPermission();
     init_manager();
     init_sessionRegistry();
     init_background();
@@ -18346,7 +18975,7 @@ var init_batchRunner = __esm({
     init_batchStrings();
     init_strings();
     BATCH_EDIT_TOOLS = /* @__PURE__ */ new Set(["edit_file", "create_file", "write_file", "move_file", "notebook_edit"]);
-    BATCH_DEFAULT_DENYLIST = /* @__PURE__ */ new Set(["run_command", "delete_path"]);
+    BATCH_DEFAULT_DENYLIST = /* @__PURE__ */ new Set(["run_command", "delete_path", "run_in_background"]);
     ACCEPT_TIMEOUT_MIN = 10;
     ACCEPT_TAIL_LINES = 60;
     emit2 = (s = "") => {
@@ -18396,8 +19025,8 @@ ${lines.slice(-ACCEPT_TAIL_LINES).join("\n")}` : text;
       });
     };
     collectSessionCost = async (sessionId) => {
-      const recs = (await readUsageRecords(2)).filter((r) => r.sessionId === sessionId);
-      const c = { rounds: 0, mainRounds: 0, subRuns: 0, promptTokens: 0, completionTokens: 0, cachedTokens: 0, costYuan: null, toolCostYuan: 0, partialPrice: false, durationMs: 0 };
+      const recs = (await readUsageRecords(2)).filter((r) => r.sessionId === sessionId || r.sessionId.startsWith(sessionId + "__sub__"));
+      const c = { rounds: 0, mainRounds: 0, subRuns: 0, promptTokens: 0, completionTokens: 0, cachedTokens: 0, costYuan: null, toolCostYuan: 0, auxCostYuan: 0, partialPrice: false, durationMs: 0 };
       for (const r of recs) {
         c.rounds += r.rounds || 0;
         if (r.depth === 0) c.mainRounds += r.rounds || 0;
@@ -18407,6 +19036,7 @@ ${lines.slice(-ACCEPT_TAIL_LINES).join("\n")}` : text;
         c.cachedTokens += r.cachedTokens ?? 0;
         c.durationMs += r.durationMs || 0;
         c.toolCostYuan += r.toolCostYuan ?? 0;
+        c.auxCostYuan += r.auxCostYuan ?? 0;
         if (typeof r.costYuan === "number") c.costYuan = (c.costYuan ?? 0) + r.costYuan;
         else c.partialPrice = true;
       }
@@ -18469,10 +19099,10 @@ ${diff}
     };
     runOneTask = async (task) => {
       const T = batchT(getLocale());
-      const source = await fs49.promises.readFile(task.path, "utf-8");
+      const source = await fs50.promises.readFile(task.path, "utf-8");
       const parsed = parseBatchTicket(source, getLocale());
       if (!parsed.ok) {
-        const cost2 = { rounds: 0, mainRounds: 0, subRuns: 0, promptTokens: 0, completionTokens: 0, cachedTokens: 0, costYuan: 0, toolCostYuan: 0, partialPrice: false, durationMs: 0 };
+        const cost2 = { rounds: 0, mainRounds: 0, subRuns: 0, promptTokens: 0, completionTokens: 0, cachedTokens: 0, costYuan: 0, toolCostYuan: 0, auxCostYuan: 0, partialPrice: false, durationMs: 0 };
         await finishTicket(task.id, `---
 id: ${task.id}
 title: ${task.id}
@@ -18491,10 +19121,31 @@ ${parsed.error}`);
       emit2(`\u25B6 [${task.id}] ${t.title}`);
       emit2(T.taskMeta(t.budgetYuan, timeoutMin, t.accept));
       const unlocked = new Set(t.tools ?? []);
-      const denySchemas = new Set([...BATCH_DEFAULT_DENYLIST].filter((n) => !unlocked.has(n)));
-      const toolSchemas = agentTools.filter((x) => !denySchemas.has(x?.function?.name));
+      const toolSchemas = agentTools.filter((x) => unlocked.has(x?.function?.name) || x?.function?.batchAllowed !== false && !BATCH_DEFAULT_DENYLIST.has(x?.function?.name));
       const allowApproval = /* @__PURE__ */ new Set([...BATCH_EDIT_TOOLS, ...unlocked]);
       const deniedTools = [];
+      const wrapInterpreterGate = (x) => {
+        const name = x?.function?.name;
+        if (name !== "run_command" && name !== "run_in_background") return x;
+        const innerExecute = x.function.execute.bind(x.function);
+        return {
+          ...x,
+          function: {
+            ...x.function,
+            execute: async (args, ctx) => {
+              const cmd = typeof args?.command === "string" ? args.command : "";
+              if (cmd && isInterpreterRepoScript(cmd) && !unlocked.has("interpreter")) {
+                const why = `\u{1F6AB} [batch \u4F9B\u5E94\u94FE\u95F8\u95E8] \u89E3\u91CA\u5668\u76F4\u8DD1\u4ED3\u5E93\u5185\u811A\u672C\u5DF2\u62E6\u622A\uFF1A${cmd.slice(0, 120)}\u3002\u6267\u884C\u4ED3\u5E93\u4F5C\u8005\u63D0\u4EA4\u7684\u4EE3\u7801\u4E0E npm \u65CF\u540C\u6E90\u98CE\u9669\uFF0C\u6302\u673A\u573A\u666F\u9ED8\u8BA4\u62D2\u7EDD\uFF1B\u786E\u9700\u6267\u884C\u8BF7\u5728\u672C\u5DE5\u5355 tools: \u4E2D\u52A0 "interpreter" \u89E3\u9501\u3002`;
+                deniedTools.push({ tool: name, detail: why.replace(/\n+/g, " ").slice(0, 140) });
+                emit2(`\u{1F6AB} [${task.id}] \u62E6\u622A\u89E3\u91CA\u5668\u811A\u672C\uFF1A${cmd.slice(0, 80)}`);
+                return why;
+              }
+              return innerExecute(args, ctx);
+            }
+          }
+        };
+      };
+      const gatedSchemas = toolSchemas.map(wrapInterpreterGate);
       let wt = null;
       try {
         wt = await createWorktree(sessionId, task.id);
@@ -18576,7 +19227,7 @@ ${s.output}
               if (evt.type === "run.receipt") receipt = evt;
             },
             budgetYuan: t.budgetYuan,
-            toolSchemas
+            toolSchemas: gatedSchemas
           }
         );
       } catch (e) {
@@ -18756,9 +19407,9 @@ init_updateCheck();
 init_trust();
 import { render } from "ink";
 import os5 from "os";
-import path49 from "path";
+import path50 from "path";
 import { emitKeypressEvents } from "node:readline";
-import { jsx as jsx19 } from "react/jsx-runtime";
+import { jsx as jsx21 } from "react/jsx-runtime";
 var parseArgs = (argv) => {
   const out = {};
   for (let i = 0; i < argv.length; i++) {
@@ -18905,7 +19556,7 @@ var main = async () => {
   process.stdout.write("\x1B[2J\x1B[3J\x1B[1;1H");
   const cwdIsHome = () => {
     try {
-      return path49.resolve(cwd).toLowerCase() === path49.resolve(os5.homedir()).toLowerCase();
+      return path50.resolve(cwd).toLowerCase() === path50.resolve(os5.homedir()).toLowerCase();
     } catch {
       return false;
     }
@@ -18924,7 +19575,7 @@ var main = async () => {
     resumeId = await getMostRecentSessionId2() ?? void 0;
   }
   const { waitUntilExit } = render(
-    /* @__PURE__ */ jsx19(App2, { resumeSessionId: resumeId, initialPlanMode: args.plan, initialAutoMode: args.auto, initialIncludeProject: includeProject, engineReady }),
+    /* @__PURE__ */ jsx21(App2, { resumeSessionId: resumeId, initialPlanMode: args.plan, initialAutoMode: args.auto, initialIncludeProject: includeProject, engineReady }),
     // exitOnCtrlC:false：Ctrl+C 交由 App useInput 处理（统一退出/中止语义）；
     // patchConsole:false：避免 console 劫持与全屏重绘叠加闪屏。
     { exitOnCtrlC: false, patchConsole: false }