flavor-code 1.2.4 → 1.2.5

package/README.zh-CN.md

@@ -0,0 +1,369 @@
+<p align="center"><a href="./README.md">English</a> | <b><a href="./README.zh-CN.md">简体中文</a></b></p>
+
+<div align="center">
+  <img src="./assets/icon-transparent-512.png" alt="Flavor Code Logo" width="168" />
+  <h1>Flavor Code</h1>
+  <p><strong>本地优先、可审计、可恢复的 AI 编程助手</strong></p>
+  <p>在终端、Electron 桌面端和 VS Code 中读代码、改文件、运行命令并完成复杂任务。</p>
+
+  <p>
+    <a href="https://www.npmjs.com/package/flavor-code"><img alt="npm version" src="https://img.shields.io/npm/v/flavor-code?color=cb3837&logo=npm" /></a>
+    <a href="https://github.com/YachuanWzh/flavor-code/actions/workflows/ci.yml"><img alt="CI" src="https://github.com/YachuanWzh/flavor-code/actions/workflows/ci.yml/badge.svg?branch=main" /></a>
+    <img alt="Node.js 20+" src="https://img.shields.io/badge/Node.js-20%2B-339933?logo=nodedotjs&logoColor=white" />
+    <a href="./LICENSE"><img alt="MIT License" src="https://img.shields.io/badge/license-MIT-blue.svg" /></a>
+  </p>
+
+  <p>
+    <a href="#快速开始">快速开始</a> ·
+    <a href="#核心能力">核心能力</a> ·
+    <a href="#使用入口">使用入口</a> ·
+    <a href="#权限与沙箱">安全</a> ·
+    <a href="#开发">参与开发</a>
+  </p>
+</div>
+
+---
+
+Flavor Code 接入 OpenAI、Anthropic 或兼容服务，在受控工作区内使用文件、搜索、Shell、MCP 和自定义工具。复杂任务可以拆成计划和并行子任务；会话、Diff、工具调用、checkpoint 与审计记录全部保存在本地，便于恢复、复查和继续工作。
+
+## 核心能力
+
+| | 能力 | 你得到什么 |
+| --- | --- | --- |
+| 🖥️ | **一个运行时，三个入口** | CLI、Electron 与 VS Code 共享模型配置、会话和工具能力 |
+| 🧭 | **复杂任务可控推进** | 任务计划、子 Agent、steering、follow-up、`/loop` 和 `/goal` |
+| ⏪ | **结果可追溯、可恢复** | 完整时间线、checkpoint、rewind、trace、Diff 和失败审计 |
+| 🧠 | **本地长期上下文** | 记忆、Skill、插件和项目指南均保存在本机 |
+| 🛡️ | **明确的权限边界** | 分别控制读、写、Shell、网络和破坏性操作，也可使用 Docker |
+
+## 快速开始
+
+> [!IMPORTANT]
+> CLI 需要 Node.js 20 或更高版本。Windows 桌面端也可以直接从 [Releases](https://github.com/YachuanWzh/flavor-code/releases) 下载。
+
+**1. 安装**
+
+```bash
+npm install -g flavor-code
+```
+
+**2. 在项目中启动**
+
+```bash
+cd your-project
+flavor
+```
+
+**3. 初始化项目上下文**
+
+首次进入项目后运行 `/init`。Flavor 会分析语言、包管理器、源码目录和验证命令，并生成 `FLAVOR.md` 项目指南。
+
+也可以直接执行一次性任务：
+
+```bash
+flavor --print "分析这个项目并列出最值得修复的三个问题"
+flavor --resume
+flavor --resume -p "继续完成剩余工作"
+```
+
+非交互模式会拒绝需要人工审批的操作，不会悬挂等待输入。
+
+## 配置模型
+
+最快的方式是设置环境变量：
+
+```bash
+# macOS / Linux
+export OPENAI_API_KEY="sk-..."
+
+# Windows PowerShell
+$env:OPENAI_API_KEY = "sk-..."
+```
+
+也可以把密钥放在项目根目录的 `.env`。
+
+<details>
+<summary><strong>使用 <code>.flavor/flavor.json</code> 配置多个 Provider</strong></summary>
+
+项目配置示例：
+
+```json
+{
+  "providers": {
+    "openai": {
+      "type": "openai",
+      "apiKey": "${OPENAI_API_KEY}",
+      "defaultModel": "gpt-5",
+      "cheapModel": "gpt-5-mini"
+    }
+  },
+  "agents": {
+    "main": { "model": "openai:gpt-5" },
+    "subagent": { "model": "openai:gpt-5-mini" }
+  },
+  "permissionMode": "default",
+  "maxSubagents": 3,
+  "language": "zh-CN"
+}
+```
+
+配置按以下顺序合并，后者优先：
+
+1. 全局 `~/.flavor-code/flavor.json`
+2. 项目 `.flavor/flavor.json`
+3. `.env`
+4. 进程环境变量
+
+支持的常用 Provider 类型：
+
+- `openai`：OpenAI 官方接口
+- `anthropic`：Anthropic 官方接口
+- `openai-compatible`：兼容 OpenAI 协议的服务
+
+</details>
+
+OAuth PKCE 的运行时行为与配置约定见 [PKCE 规范](./docs/specs/pkce-runtime-config.md)。完整配置字段以 [配置 Schema](./src/config/schema.ts) 为准。
+
+## 使用入口
+
+| 入口 | 适合场景 | 启动方式 |
+| --- | --- | --- |
+| **CLI** | 日常开发、远程环境、脚本与 CI | `flavor` |
+| **Electron** | 可视化会话、Diff、权限和资源管理 | `npm run desktop:start` |
+| **VS Code / Qoder** | 编辑器上下文、诊断修复和任务控制面 | `npm run ide:install` |
+
+### CLI
+
+直接运行 `flavor` 后输入自然语言即可。输入 `/` 会显示内置命令、插件命令和 Skill。
+
+常用命令：
+
+| 命令 | 作用 |
+| --- | --- |
+| `/init` | 生成或更新 `FLAVOR.md` |
+| `/model` | 查看或切换主/子 Agent 模型 |
+| `/permissions` | 切换权限模式 |
+| `/tasks` | 查看任务计划和子 Agent 状态 |
+| `/compact` | 手动压缩长会话上下文 |
+| `/checkpoint`、`/tree` | 保存现场、查看会话树 |
+| `/rewind`、`/unrevert`、`/fork` | 恢复或分叉会话 |
+| `/memory`、`/remember`、`/forget` | 管理长期记忆 |
+| `/mcp` | 查看和管理 MCP 服务 |
+| `/loop <goal>` | 运行带验证的自治循环 |
+| `/goal <objective>` | 运行规划、执行、对抗审查流程 |
+| `/audit` | 查看工具失败审计 |
+
+运行中可以提交 steering 或排队 follow-up；当前模型响应结束后，任务会在安全边界处接收新指令。
+
+### Electron 桌面端
+
+```bash
+npm run desktop:dev      # 开发模式
+npm run desktop:start    # 构建并启动
+npm run desktop:pack     # Windows 免安装目录
+npm run desktop:dist     # Windows NSIS 安装包
+```
+
+桌面端提供项目和会话切换、流式 Markdown、工具与 Diff 展示、权限确认、任务状态，以及 Skill、MCP、记忆和模型管理。
+
+### VS Code / Qoder
+
+```bash
+npm run vscode:install   # 安装到 VS Code
+npm run qoder:install    # 安装到 Qoder
+npm run ide:install      # 自动选择已安装的 IDE
+```
+
+扩展包含 `@flavor` Chat Participant、Mission Control、Changes & Health、Time Machine、诊断修复、CodeLens、checkpoint 和 rewind。若 `flavor` 不在 `PATH`，请设置 `flavorCode.executable`。
+
+## MCP、Skill 与插件
+
+Flavor 可以连接 stdio 或 Streamable HTTP MCP 服务。项目配置示例：
+
+<details>
+<summary><strong>MCP 配置与 CLI 示例</strong></summary>
+
+```json
+{
+  "mcpServers": {
+    "docs": {
+      "url": "https://example.com/mcp",
+      "headers": {
+        "Authorization": "Bearer ${MCP_TOKEN}"
+      }
+    }
+  }
+}
+```
+
+MCP 配置也可以通过 CLI 管理：
+
+```bash
+flavor mcp list
+flavor mcp add docs --url https://example.com/mcp
+flavor mcp disable docs
+```
+
+</details>
+
+Skill 是带有 YAML 头信息的 `SKILL.md`，放在 `.flavor/skills/<name>/` 或 `~/.flavor-code/skills/<name>/`。Flavor 会按任务渐进加载，也支持通过 `/<skill-name>` 显式调用。
+
+插件放在 `.flavor/plugins/`，可以注册命令、工具、Hook、Skill 根目录和模型适配器。
+
+> [!WARNING]
+> 插件和 Agent 自注册工具是进程内执行的 JavaScript，不是安全沙箱。只安装、启用和批准你信任的代码。
+
+## 会话、记忆与执行记录
+
+项目运行数据集中在 `.flavor/`：
+
+```text
+.flavor/
+├── flavor.json       # 项目配置
+├── sessions/         # 会话时间线
+├── session-assets/   # 图片附件
+├── session-trees/    # 会话分支
+├── checkpoints/      # 工作区快照
+├── memory/           # 长期记忆
+├── traces/           # 可选执行 trace
+├── audit.jsonl       # 工具失败审计
+├── skills/           # 项目 Skill
+└── plugins/          # 项目插件
+```
+
+长期记忆会区分用户偏好、行为反馈、项目约定和外部引用。自动提取只保存高置信候选，并提供确认、忽略和删除入口；密钥、Token、原始工具输出和模型猜测会被拒绝。
+
+图片提示支持 PNG、JPEG 和 WebP，单图最大 5 MiB、每次最多 5 张。桌面端支持选择或拖放；CLI 剪贴板图片目前支持 Windows 和 macOS。
+
+## 权限与沙箱
+
+| 模式 | 行为 |
+| --- | --- |
+| `default` | 读操作自动放行，写、Shell、网络和破坏性操作按需确认 |
+| `acceptEdits` | 工作区写入和例行验证自动放行 |
+| `plan` | 只读规划，不允许修改和执行 |
+| `bypassPermissions` | 主 Agent 在硬安全检查后尽量自动执行 |
+| `auto` | 使用分类器判断，无法确定时回到人工确认 |
+| `bubble` | 将不确定操作冒泡给主会话审批 |
+
+> [!CAUTION]
+> 本地 Shell 仍然以当前用户身份运行。处理不可信项目时建议启用 Docker。
+
+<details>
+<summary><strong>Docker 执行环境示例</strong></summary>
+
+```json
+{
+  "execution": {
+    "mode": "docker",
+    "image": "node:24-bookworm-slim",
+    "network": false,
+    "memory": "2g",
+    "cpus": 2
+  }
+}
+```
+
+Docker 不可用时任务会失败，不会静默回退到本机。配置文件中的敏感字段与 OAuth Token 使用本机配置密钥进行 AES-256-GCM 认证加密。
+
+</details>
+
+## SDK、RPC 与评测
+
+<details>
+<summary><strong>Node.js SDK 示例</strong></summary>
+
+```ts
+import { createFlavorRuntime } from "flavor-code/sdk";
+
+const runtime = await createFlavorRuntime({
+  workspace: process.cwd(),
+  approvalPolicy: "deny",
+  output: console.log,
+});
+
+await runtime.session.start();
+await runtime.session.submit("修复失败的测试");
+await runtime.dispose();
+```
+
+</details>
+
+其他 IDE 或语言可以通过 JSONL RPC 接入：
+
+```bash
+flavor --mode rpc --workspace . --trace .flavor/traces/run.jsonl
+```
+
+评测运行：
+
+```bash
+flavor eval eval.json --output report.json
+```
+
+RPC、trace、replay、eval、会话树与 Docker 的设计约束见 [控制面规范](./docs/specs/2026-07-29-control-plane-sandbox-vscode.md)。
+
+## 开发
+
+```bash
+npm ci
+npm test
+npm run typecheck
+npm run vscode:typecheck
+npm run build
+npm run smoke:install
+```
+
+- TypeScript strict，目标 ES2022，Node.js 20+
+- Vitest 单元与集成测试
+- tsup 构建 CLI、SDK、Electron 主进程和 VS Code 扩展
+- Vite 构建 Electron renderer
+- CI 覆盖 Windows/macOS 与 Node 20/24
+
+发布构建默认不生成或打包 source map。需要本地调试构建时显式开启：
+
+```bash
+# macOS / Linux
+FLAVOR_SOURCEMAP=1 npm run build
+
+# Windows PowerShell
+$env:FLAVOR_SOURCEMAP = "1"
+npm run build
+```
+
+## 文档
+
+- [技术方案报告](./技术方案报告.md)：整体架构、Agent 循环、上下文、权限、插件和安全模型
+- [运行时可靠性规范](./docs/specs/2026-07-26-runtime-reliability.md)
+- [控制面、沙箱与 VS Code 规范](./docs/specs/2026-07-29-control-plane-sandbox-vscode.md)
+- [多模态图片规范](./docs/specs/2026-07-30-multimodal-image-attachments.md)
+- [VS Code 后续规划](./docs/specs/2026-08-01-flavor-code-vscode-next.md)
+
+## 安全提示
+
+- 审查模型生成的代码和命令，尤其是依赖安装、脚本和删除操作。
+- 不要把 `.flavor/sessions/`、trace 或长期记忆当作秘密仓库。
+- 使用最小权限 API Key，不要提交 `.env`。
+- Skill 内容可能影响模型行为；插件和自注册工具还拥有进程内 Node.js 权限。
+- 建议在版本控制下工作，并在高风险任务前创建 checkpoint。
+
+## 参与贡献
+
+欢迎提交 Issue 和 Pull Request。提交前请至少运行：
+
+```bash
+npm test
+npm run typecheck
+npm run vscode:typecheck
+npm run build
+```
+
+架构改动建议先阅读 [技术方案报告](./技术方案报告.md) 和相关 [设计规范](./docs/specs/)。
+
+## License
+
+[MIT](./LICENSE)
+
+<p align="center">
+  Made with 🌶️ by Flavor Code contributors.
+</p>

package/dist/{app-N3655H2E.js → app-3DXEGSS7.js}

@@ -12,9 +12,10 @@ import {
   isDestructiveTool,
   message,
   modelContentTranscriptText,
+  packageVersion,
   redactErrorText,
   transcriptReducer
-} from "./chunk-MRISY6KK.js";
+} from "./chunk-3TYRDK34.js";
 import "./chunk-HFR2WS6T.js";
 import {
   Box_default,
@@ -1463,7 +1464,11 @@ function WelcomeCard({ model, serviceName, workspaceName, columns }) {
           /* @__PURE__ */ jsx4(Text, { color: FLAVOR_ACCENT, children: FLAVOR_WORDMARK }),
           serviceName === void 0 ? null : /* @__PURE__ */ jsx4(Text, { color: "cyan", wrap: "truncate-end", children: serviceName }),
           /* @__PURE__ */ jsx4(Text, { dimColor: true, wrap: "truncate-end", children: model }),
-          /* @__PURE__ */ jsx4(Text, { dimColor: true, wrap: "truncate-end", children: workspaceName })
+          /* @__PURE__ */ jsx4(Text, { dimColor: true, wrap: "truncate-end", children: workspaceName }),
+          /* @__PURE__ */ jsxs3(Text, { dimColor: true, wrap: "truncate-end", children: [
+            "v",
+            packageVersion()
+          ] })
         ]
       }
     ),
@@ -1495,7 +1500,9 @@ function WelcomeCard({ model, serviceName, workspaceName, columns }) {
     /* @__PURE__ */ jsxs3(Text, { dimColor: true, wrap: "truncate-end", children: [
       model,
       " \xB7 ",
-      workspaceName
+      workspaceName,
+      " \xB7 v",
+      packageVersion()
     ] }),
     /* @__PURE__ */ jsxs3(Text, { children: [
       /* @__PURE__ */ jsx4(Text, { color: "cyan", children: "/init" }),

package/dist/{chunk-MRISY6KK.js → chunk-3TYRDK34.js}

@@ -104,10 +104,12 @@ function isDestructiveTool(name) {
   return DESTRUCTIVE_TOOLS.has(name);
 }
 var PermissionEngine = class {
+  #lexicalWorkspace;
   #workspace;
   #mode;
   constructor(options) {
     const root = resolve(options.workspace);
+    this.#lexicalWorkspace = root;
     this.#workspace = existsSync(root) ? realpathSync.native(root) : root;
     this.#mode = canonicalMode(options.mode ?? "default");
   }
@@ -128,13 +130,13 @@ var PermissionEngine = class {
       return { decision: "deny", reason: `${request.tool} requires source and destination paths` };
     }
     for (const path of paths) {
-      const classification = classifyPath(this.#workspace, path);
+      const classification = classifyPath(this.#lexicalWorkspace, this.#workspace, path);
       if (classification.escape) return { decision: "deny", reason: classification.reason ?? "Path escapes the workspace" };
       if (request.agent === "subagent" && !classification.inside) {
         return { decision: "deny", reason: "Subagents are restricted to the workspace" };
       }
     }
-    const inside = paths.every((path) => classifyPath(this.#workspace, path).inside);
+    const inside = paths.every((path) => classifyPath(this.#lexicalWorkspace, this.#workspace, path).inside);
     if (this.#mode === "plan") {
       return READ_TOOLS.has(request.tool) ? { decision: "allow" } : { decision: "deny", reason: "Plan mode is read-only" };
     }
@@ -161,11 +163,11 @@ var PermissionEngine = class {
     const analysis = request.args === void 0 ? analyzeCommand(request.command ?? "") : analyzeArgumentCommand(request.command ?? "", request.args);
     if (request.agent === "subagent") {
       if (request.cwd === void 0) return { decision: "ask", reason: "Subagent shell commands require an explicit workspace cwd" };
-      const cwd = classifyPath(this.#workspace, request.cwd);
+      const cwd = classifyPath(this.#lexicalWorkspace, this.#workspace, request.cwd);
       if (cwd.escape || !cwd.inside) return { decision: "deny", reason: "Subagent shell cwd must remain in the workspace" };
       if (analysis.destructive) return { decision: "deny", reason: "Destructive commands are forbidden for subagents" };
       if (analysis.wrapped || analysis.opaque || !isRoutineCommand(analysis.command)) return { decision: "ask", reason: "Subagent shell command requires main-Agent approval" };
-      const argumentDecision = assessRoutineArguments(analysis.command, request.cwd, this.#workspace);
+      const argumentDecision = assessRoutineArguments(analysis.command, request.cwd, this.#lexicalWorkspace, this.#workspace);
       if (argumentDecision !== "allow") {
         return argumentDecision === "deny" ? { decision: "deny", reason: "Subagent command arguments escape the workspace" } : { decision: "ask", reason: "Ambiguous subagent command arguments require main-Agent approval" };
       }
@@ -177,12 +179,12 @@ var PermissionEngine = class {
     if (analysis.wrapped || analysis.opaque) return ask(this.#mode, "Shell wrapper requires approval");
     if (this.#mode === "bypassPermissions") return { decision: "allow" };
     if ((this.#mode === "acceptEdits" || this.#mode === "auto") && isRoutineCommand(analysis.command)) {
-      const cwd = request.cwd ?? this.#workspace;
-      const cwdClassification = classifyPath(this.#workspace, cwd);
+      const cwd = request.cwd ?? this.#lexicalWorkspace;
+      const cwdClassification = classifyPath(this.#lexicalWorkspace, this.#workspace, cwd);
       if (cwdClassification.escape || !cwdClassification.inside) {
         return { decision: "deny", reason: "Routine command cwd must remain in the workspace" };
       }
-      const argumentDecision = assessRoutineArguments(analysis.command, cwd, this.#workspace);
+      const argumentDecision = assessRoutineArguments(analysis.command, cwd, this.#lexicalWorkspace, this.#workspace);
       if (argumentDecision === "deny") return { decision: "deny", reason: "Routine command arguments escape the workspace" };
       if (argumentDecision === "ask") return ask(this.#mode, "Ambiguous routine command arguments require approval");
       return { decision: "allow" };
@@ -219,16 +221,16 @@ function analyzeArgumentCommand(executable, args) {
   }
   return { command, destructive: isForbiddenCommand(command), opaque: false, wrapped: false };
 }
-function classifyPath(workspace, input) {
-  const candidate = resolve(workspace, input);
-  const lexicalInside = isWithin(workspace, candidate);
+function classifyPath(lexicalWorkspace, physicalWorkspace, input) {
+  const candidate = resolve(lexicalWorkspace, input);
+  const lexicalInside = isWithin(lexicalWorkspace, candidate);
   const traversal = input.split(/[\\/]+/).includes("..");
-  const startsInWorkspace = pathStartsWith(workspace, input);
+  const startsInWorkspace = pathStartsWith(lexicalWorkspace, input);
   if ((!isAbsolute(input) || startsInWorkspace) && traversal && !lexicalInside) {
     return { inside: false, escape: true, reason: "Path traversal escapes the workspace" };
   }
   const physical = resolvePhysical(candidate);
-  const physicalInside = isWithin(workspace, physical);
+  const physicalInside = isWithin(physicalWorkspace, physical);
   if (lexicalInside && !physicalInside) return { inside: false, escape: true, reason: "Symlink escapes the workspace" };
   return { inside: physicalInside, escape: false };
 }
@@ -318,7 +320,7 @@ function isRoutineCommand(command) {
   if (command.executable === "go") return first === "test";
   return ["pytest", "vitest", "jest", "eslint", "tsc"].includes(command.executable);
 }
-function assessRoutineArguments(command, cwd, workspace) {
+function assessRoutineArguments(command, cwd, lexicalWorkspace, physicalWorkspace) {
   const args = routineArguments(command);
   if (args === void 0) return "ask";
   const pathOptions = /* @__PURE__ */ new Set([
@@ -343,7 +345,7 @@ function assessRoutineArguments(command, cwd, workspace) {
       const option2 = equals[1]?.toLowerCase() ?? "";
       const value = equals[2] ?? "";
       if (!pathOptions.has(option2)) return "ask";
-      const decision = assessArgumentPath(value, cwd, workspace);
+      const decision = assessArgumentPath(value, cwd, lexicalWorkspace, physicalWorkspace);
       if (decision !== "allow") return decision;
       continue;
     }
@@ -351,14 +353,14 @@ function assessRoutineArguments(command, cwd, workspace) {
     if (option !== void 0 && pathOptions.has(option)) {
       const value = args[index + 1];
       if (value === void 0 || value.startsWith("-")) return "ask";
-      const decision = assessArgumentPath(value, cwd, workspace);
+      const decision = assessArgumentPath(value, cwd, lexicalWorkspace, physicalWorkspace);
       if (decision !== "allow") return decision;
       index += 1;
       continue;
     }
     if (arg.startsWith("-")) continue;
     if (looksLikePath(arg)) {
-      const decision = assessArgumentPath(arg, cwd, workspace);
+      const decision = assessArgumentPath(arg, cwd, lexicalWorkspace, physicalWorkspace);
       if (decision !== "allow") return decision;
       continue;
     }
@@ -376,10 +378,10 @@ function routineArguments(command) {
   if (["pytest", "vitest", "jest", "eslint", "tsc"].includes(command.executable)) return command.args;
   return void 0;
 }
-function assessArgumentPath(value, cwd, workspace) {
+function assessArgumentPath(value, cwd, lexicalWorkspace, physicalWorkspace) {
   if (value.length === 0) return "ask";
   const resolved = resolve(cwd, value);
-  const classification = classifyPath(workspace, resolved);
+  const classification = classifyPath(lexicalWorkspace, physicalWorkspace, resolved);
   return classification.escape || !classification.inside ? "deny" : "allow";
 }
 function looksLikePath(value) {
@@ -5042,7 +5044,8 @@ var ToolRuntime = class {
         } catch {
         }
       }
-      if (pre.decision === "ask" || permission.decision === "ask") {
+      const sessionAllowed = this.#alwaysAllowed.has(getToolCategory(tool.name));
+      if (!sessionAllowed && (pre.decision === "ask" || permission.decision === "ask")) {
         const reason = [pre.reason, permission.reason].filter((value) => value !== void 0).join("\n") || "Approval required";
         const requestDecision = await this.#hooks.emit({
           version: 1,
@@ -5067,8 +5070,7 @@ var ToolRuntime = class {
           throw signal.reason;
         } else {
           const category = getToolCategory(tool.name);
-          if (this.#alwaysAllowed.has(category)) {
-          } else if (this.#approve === void 0) {
+          if (this.#approve === void 0) {
             return this.#fail(tool.name, input, context.agent, "permission_denied", reason);
           } else {
             const decision = await this.#approve({ ...request, reason }, signal);
@@ -9220,9 +9222,11 @@ var SkillRegistry = class {
     for (const configuredRoot of roots) {
       const root = resolve13(configuredRoot);
       let entries;
+      let physicalRoot = root;
       try {
         const rootInfo = await lstat6(root);
         if (rootInfo.isSymbolicLink() || !rootInfo.isDirectory()) throw new Error("Skill root must be a real directory");
+        physicalRoot = await realpath4(root);
         entries = await readdir5(root, { withFileTypes: true });
       } catch (error) {
         if (isMissing2(error)) continue;
@@ -9235,12 +9239,12 @@ var SkillRegistry = class {
         try {
           if (entry2.isSymbolicLink()) throw new Error("Symlinked skill directories are not allowed");
           if (!entry2.isDirectory()) continue;
-          const physicalRoot = await realpath4(skillRoot);
-          if (!isWithin3(root, physicalRoot)) throw new Error("Skill directory escapes its registry root");
+          const physicalSkillRoot = await realpath4(skillRoot);
+          if (!isWithin3(physicalRoot, physicalSkillRoot)) throw new Error("Skill directory escapes its registry root");
           const skillFile = resolve13(skillRoot, "SKILL.md");
           const parsed = await readFrontmatterFile(
             skillFile,
-            physicalRoot,
+            physicalSkillRoot,
             this.#options.maxMetadataBytes,
             this.#options.openFile
           );
@@ -9251,7 +9255,7 @@ var SkillRegistry = class {
               name: parsed.name,
               description: parsed.description,
               source,
-              root: physicalRoot,
+              root: physicalSkillRoot,
               disableModelInvocation: parsed.disableModelInvocation
             }),
             skillFile
@@ -10747,6 +10751,7 @@ function createEditTool(workspace, options = {}) {
     paths: (input) => [guard.lexical(input.path)],
     execute: async (input, signal) => {
       abortIfNeeded(signal);
+      const displayPath = guard.lexical(input.path);
       const path = await guard.existing(input.path);
       const contents = await readText(path);
       const hasCRLF = contents.includes("\r\n");
@@ -10762,11 +10767,11 @@ function createEditTool(workspace, options = {}) {
       }
       const updatedLF = contentsLF.slice(0, first) + newTextLF + contentsLF.slice(first + oldTextLF.length);
       const updated = hasCRLF ? updatedLF.replace(/\n/g, "\r\n") : updatedLF;
-      await options.beforeCommit?.({ path, before: contents, after: updated, kind: "update" }, signal);
+      await options.beforeCommit?.({ path: displayPath, before: contents, after: updated, kind: "update" }, signal);
       await atomicWrite(path, updated, signal);
       return withToolPresentation(
-        { path, replacements: 1 },
-        buildFileChangePresentation(path, contents, updated, "update")
+        { path: displayPath, replacements: 1 },
+        buildFileChangePresentation(displayPath, contents, updated, "update")
       );
     }
   };

package/dist/{chunk-L5A2NDMT.js → chunk-Z3BW52MK.js}

@@ -4,7 +4,7 @@ import {
   message,
   redactErrorText,
   redactSecrets
-} from "./chunk-MRISY6KK.js";
+} from "./chunk-3TYRDK34.js";
 
 // src/rpc/server.ts
 import { createInterface } from "readline";

package/dist/cli.js

@@ -3,7 +3,7 @@ import { createRequire } from "node:module"; const require = createRequire(impor
 import {
   FlavorRpcServer,
   TraceRecorder
-} from "./chunk-L5A2NDMT.js";
+} from "./chunk-Z3BW52MK.js";
 import {
   staticTaskLines
 } from "./chunk-KKIBYDJI.js";
@@ -20,7 +20,7 @@ import {
   message,
   packageVersion,
   redactErrorText
-} from "./chunk-MRISY6KK.js";
+} from "./chunk-3TYRDK34.js";
 import {
   McpServerConfigSchema,
   McpServerNameSchema,
@@ -771,7 +771,7 @@ function createProgram() {
     const [{ render, AlternateScreen }, { createElement }, { App }] = await Promise.all([
       import("./claude-ink-WPWPEL5A.js"),
       import("react"),
-      import("./app-N3655H2E.js")
+      import("./app-3DXEGSS7.js")
     ]);
     const instance = await render(createElement(
       AlternateScreen,