ikie-cli 0.1.21 → 0.1.22

package/dist/agent.d.ts

@@ -68,6 +68,8 @@ export declare class Agent {
     private callModelStreaming;
     private callModelNonStreaming;
     private handleToolCall;
+    private handleSwitchMode;
+    private requestModeSwitch;
     private askUser;
     private runSubagent;
     getLastAssistantText(): string;

package/dist/agent.js

@@ -1,6 +1,6 @@
 import chalk from 'chalk';
 import * as readline from 'node:readline';
-import { TOOL_DEFS, SAFE_TOOLS, PLAN_TOOLS, formatToolArgs, executeTool } from './tools.js';
+import { TOOL_DEFS, SAFE_TOOLS, PLAN_TOOLS, formatToolArgs, executeTool, isRestrictedPath } from './tools.js';
 import { renderMarkdown, extractThinkTags } from './renderer.js';
 import { c, toolLine, permissionPrompt, toolSuccessLine, toolErrorLine, toolOutputBlock, toolDiffBlock, InlineSpinner } from './theme.js';
 export function estimateTokens(chars) {
@@ -277,7 +277,7 @@ export class Agent {
                         this.activeTurnStats.toolCalls += group.length;
                     const summary = this.formatGroupSummary(group[0].name, inputs);
                     process.stdout.write(`\n${this.indent}${toolLine(`${group[0].name} ×${group.length}`, summary).trimStart()}\n`);
-                    if (!opts.autoApprove && !this.config.autoApprove && !SAFE_TOOLS.has(group[0].name)) {
+                    if (!opts.autoApprove && !this.config.autoApprove && !SAFE_TOOLS.has(group[0].name) && group[0].name !== 'switch_mode') {
                         const allowed = await this.checkPermission(group[0].name, inputs[0]);
                         if (!allowed) {
                             for (const tc of group) {
@@ -291,26 +291,48 @@ export class Agent {
                     }
                     const t0 = Date.now();
                     let errors = 0;
+                    // Separate subagents so they can run in parallel; keep other tools sequential
+                    // to avoid races on file mutations.
+                    const spawnIndices = [];
+                    const otherIndices = [];
                     for (let i = 0; i < group.length; i++) {
+                        if (group[i].name === 'spawn_agent')
+                            spawnIndices.push(i);
+                        else
+                            otherIndices.push(i);
+                    }
+                    const results = new Map();
+                    if (spawnIndices.length > 0) {
+                        const spawnResults = await Promise.all(spawnIndices.map(i => this.runSubagent(inputs[i], opts)));
+                        spawnIndices.forEach((idx, i) => results.set(idx, spawnResults[i]));
+                    }
+                    for (const i of otherIndices) {
                         if (opts.signal?.aborted)
                             break;
                         const tc = group[i];
-                        if (tc.name === 'spawn_agent') {
-                            const result = await this.runSubagent(inputs[i], opts);
-                            this.conversation.push({ role: 'tool', tool_call_id: tc.id, content: result });
-                        }
-                        else {
-                            try {
-                                const result = await executeTool(tc.name, inputs[i]);
-                                if (result.startsWith('Error'))
-                                    errors++;
-                                this.recordChangedFile(tc.name, inputs[i], result);
-                                this.conversation.push({ role: 'tool', tool_call_id: tc.id, content: result });
+                        try {
+                            if (tc.name === 'read_file' && isRestrictedPath(String(inputs[i].path ?? ''))) {
+                                const allowed = await this.checkPermission('read_file', inputs[i]);
+                                if (!allowed) {
+                                    results.set(i, `Tool execution denied by user: read_file ${inputs[i].path}`);
+                                    continue;
+                                }
                             }
-                            catch (err) {
+                            const result = await executeTool(tc.name, inputs[i]);
+                            if (result.startsWith('Error'))
                                 errors++;
-                                this.conversation.push({ role: 'tool', tool_call_id: tc.id, content: `Tool error: ${err}` });
-                            }
+                            this.recordChangedFile(tc.name, inputs[i], result);
+                            results.set(i, result);
+                        }
+                        catch (err) {
+                            errors++;
+                            results.set(i, `Tool error: ${err}`);
+                        }
+                    }
+                    for (let i = 0; i < group.length; i++) {
+                        const result = results.get(i);
+                        if (result !== undefined) {
+                            this.conversation.push({ role: 'tool', tool_call_id: group[i].id, content: result });
                         }
                     }
                     const ms = Date.now() - t0;
@@ -338,12 +360,19 @@ export class Agent {
         let tools = this.depth >= 1
             ? TOOL_DEFS.filter(t => t.function.name !== 'spawn_agent')
             : TOOL_DEFS;
+        // Always include switch_mode so the agent can request a mode change.
+        const switchModeTool = TOOL_DEFS.find(t => t.function.name === 'switch_mode');
         // Plan mode: only offer read-only tools, and steer toward proposing a plan.
         let systemContent = this.systemPrompt;
         if (this.mode === 'plan') {
-            tools = tools.filter(t => PLAN_TOOLS.has(t.function.name));
+            tools = tools.filter(t => PLAN_TOOLS.has(t.function.name) || t.function.name === 'switch_mode');
+            if (switchModeTool && !tools.includes(switchModeTool))
+                tools.push(switchModeTool);
             systemContent += PLAN_MODE_ADDENDUM;
         }
+        else if (switchModeTool && !tools.includes(switchModeTool)) {
+            tools.push(switchModeTool);
+        }
         return {
             model: this.config.model,
             max_tokens: this.config.maxTokens,
@@ -528,12 +557,26 @@ export class Agent {
     }
     // ── Tool execution ────────────────────────────────────────────────────────
     async handleToolCall(name, id, input, opts) {
+        if (name === 'switch_mode') {
+            return this.handleSwitchMode(input);
+        }
         if (name === 'spawn_agent') {
             return this.runSubagent(input, opts);
         }
         if (name === 'ask_user') {
             return this.askUser(input);
         }
+        if (name === 'read_file') {
+            const path = String(input.path ?? '');
+            if (isRestrictedPath(path) && !opts.autoApprove && !this.config.autoApprove && !this.sessionAllowList.has('read_file')) {
+                if (this.sessionDenyList.has('read_file'))
+                    return `Tool execution denied by user: read_file ${path}`;
+                process.stdout.write(`${this.indent}${c.warning('⚠')} ${c.muted('Restricted file')} ${c.white(path)} ${c.muted('— asking for permission')}\n`);
+                const allowed = await this.checkPermission('read_file', input);
+                if (!allowed)
+                    return `Tool execution denied by user: read_file ${path}`;
+            }
+        }
         if (!opts.autoApprove && !this.config.autoApprove && !SAFE_TOOLS.has(name)) {
             const allowed = await this.checkPermission(name, input);
             if (!allowed)
@@ -563,6 +606,63 @@ export class Agent {
             return msg;
         }
     }
+    async handleSwitchMode(input) {
+        if (this.depth > 0) {
+            return 'Error: subagents cannot switch mode. Return your findings and let the main agent decide.';
+        }
+        const mode = input.mode;
+        const reason = (input.reason ?? '').trim();
+        if (!mode || (mode !== 'plan' && mode !== 'agent')) {
+            return 'Error: switch_mode requires mode "plan" or "agent".';
+        }
+        if (mode === this.mode) {
+            return `Already in ${mode} mode.`;
+        }
+        const allowed = await this.requestModeSwitch(mode, reason);
+        if (!allowed) {
+            return `Mode switch to ${mode} denied by user.`;
+        }
+        this.setMode(mode);
+        return `Switched to ${mode} mode.`;
+    }
+    async requestModeSwitch(mode, reason) {
+        process.stdout.write(`\n  ${c.primary('◆')} ${c.white.bold('mode switch')} ${c.muted('·')} ${c.white(`to ${mode}`)}\n` +
+            `  ${c.muted('reason:')} ${c.dim(reason)}\n` +
+            `  ${c.muted('⎿')} ${c.success.bold('y')} ${c.muted('allow')}   ${c.error.bold('n')} ${c.muted('deny')}\n` +
+            `  ${c.muted('❯')} `);
+        return new Promise((resolve) => {
+            if (!process.stdin.isTTY) {
+                process.stdout.write(chalk.dim('(non-interactive, denying)\n'));
+                resolve(false);
+                return;
+            }
+            const wasRaw = process.stdin.isRaw ?? false;
+            const savedDataListeners = process.stdin.rawListeners('data').slice();
+            const savedKeypressListeners = process.stdin.rawListeners('keypress').slice();
+            process.stdin.removeAllListeners('data');
+            process.stdin.removeAllListeners('keypress');
+            if (process.stdin.isTTY) {
+                process.stdin.setRawMode(true);
+                process.stdin.resume();
+            }
+            const onData = (data) => {
+                process.stdin.removeListener('data', onData);
+                if (process.stdin.isTTY)
+                    process.stdin.setRawMode(wasRaw);
+                restoreStdinListeners(savedDataListeners, savedKeypressListeners);
+                const key = data.toString().toLowerCase();
+                if (key === 'y' || key === '\r' || key === '\n') {
+                    process.stdout.write(chalk.green('y\n'));
+                    resolve(true);
+                }
+                else {
+                    process.stdout.write(chalk.red('n\n'));
+                    resolve(false);
+                }
+            };
+            process.stdin.on('data', onData);
+        });
+    }
     async askUser(input) {
         const question = (input.question ?? '').trim();
         if (!question)
@@ -823,14 +923,17 @@ changes they didn't ask for.
 - **Trust fetched page content over snippet summaries** — snippets can be stale; the live page is authoritative.
 - **Never state a version, date, or fact as definitive if your search results conflict** — say what
   the most recent source says and link it.
-- \`ask_user\`: Ask the user a clarifying question when you need more info to proceed.
-  The user's answer is returned as the tool result. Use sparingly — only when genuinely
-  unsure. Don't ask for confirmation on safe operations.
 - \`spawn_agent\`: Delegate a self-contained subtask to a focused sub-agent. Use this
   to parallelize or isolate work — e.g. "investigate how auth is implemented and report
   back", or "write and run tests for module X". The sub-agent has the same tools (except
   it cannot spawn further sub-agents) and returns a summary. Give it a clear, complete
-  \`task\` and any needed \`context\`, since it does not see this conversation.`,
+  \`task\` and any needed \`context\`, since it does not see this conversation.
+- \`switch_mode\`: Request permission to switch between plan and agent mode. Use when the current
+  mode is not sufficient for what you need to do next. The user must approve the switch.
+- \`ask_user\`: Ask the user a clarifying question when you need more info to proceed.
+  The user's answer is returned as the tool result. Use sparingly — only when genuinely
+  unsure. Don't ask for confirmation on safe operations.
+`,
     ];
     if (projectContext)
         parts.push(`## Project Context\n${projectContext}`);

package/dist/theme.d.ts

@@ -1,4 +1,4 @@
-export declare const VERSION = "0.1.21";
+export declare const VERSION = "0.1.22";
 export interface Theme {
     name: string;
     description: string;

package/dist/theme.js

@@ -3,7 +3,7 @@ import os from 'os';
 import { join as pathJoin, basename } from 'path';
 import { existsSync, readFileSync } from 'fs';
 import { loadConfig, saveConfig } from './config.js';
-export const VERSION = '0.1.21';
+export const VERSION = '0.1.22';
 const IKIE_BANNER = [
     ' ██╗██╗  ██╗██╗███████╗',
     ' ██║██║ ██╔╝██║██╔════╝',
@@ -354,6 +354,7 @@ function toolMeta(rawName) {
         case 'search_files': return { verb: 'Search', tint: c.info };
         case 'memory_write': return { verb: 'Remember', tint: c.secondary };
         case 'spawn_agent': return { verb: 'Agent', tint: c.secondary };
+        case 'switch_mode': return { verb: 'SwitchMode', tint: c.warning };
         case 'ask_user': return { verb: 'Ask', tint: c.info };
         case 'fetch_url': return { verb: 'Fetch', tint: c.info };
         case 'web_search': return { verb: 'WebSearch', tint: c.info };

package/dist/tools.d.ts

@@ -2,5 +2,6 @@ import type OpenAI from 'openai';
 export declare const TOOL_DEFS: OpenAI.Chat.ChatCompletionTool[];
 export declare const SAFE_TOOLS: Set<string>;
 export declare const PLAN_TOOLS: Set<string>;
+export declare function isRestrictedPath(path: string): boolean;
 export declare function formatToolArgs(name: string, input: Record<string, unknown>): string;
 export declare function executeTool(name: string, input: Record<string, unknown>): Promise<string>;

package/dist/tools.js

@@ -156,7 +156,7 @@ export const TOOL_DEFS = [
         type: 'function',
         function: {
             name: 'spawn_agent',
-            description: 'Delegate a self-contained subtask to a focused, autonomous sub-agent that has the same tools (it cannot spawn further sub-agents). The sub-agent does NOT see the current conversation, so the task and context must be self-contained. It returns a concise summary of what it did. Use for isolating research or parallelizable chunks of work.',
+            description: 'Delegate a self-contained subtask to a focused, autonomous sub-agent that has the same tools (it cannot spawn further sub-agents). The sub-agent does NOT see the current conversation, so the task and context must be self-contained. It returns a concise summary of what it did. Use for isolating research or parallelizable chunks of work. Multiple subagents can run in parallel.',
             parameters: {
                 type: 'object',
                 properties: {
@@ -167,6 +167,21 @@ export const TOOL_DEFS = [
             },
         },
     },
+    {
+        type: 'function',
+        function: {
+            name: 'switch_mode',
+            description: 'Request permission to switch between plan and agent mode. Use when the current mode is not sufficient — for example, when you are in plan mode and need to make changes, or when you are in agent mode and want to step back to read-only planning. The user must approve the switch.',
+            parameters: {
+                type: 'object',
+                properties: {
+                    mode: { type: 'string', enum: ['plan', 'agent'], description: 'The mode to switch to.' },
+                    reason: { type: 'string', description: 'Brief reason why the switch is needed.' },
+                },
+                required: ['mode', 'reason'],
+            },
+        },
+    },
     {
         type: 'function',
         function: {
@@ -279,6 +294,35 @@ export const SAFE_TOOLS = new Set(['read_file', 'list_dir', 'search_files', 'gre
 // Everything that mutates the filesystem or runs commands (write_file, edit_file,
 // bash, memory_write) is intentionally excluded so plan mode can only research.
 export const PLAN_TOOLS = new Set(['read_file', 'list_dir', 'search_files', 'grep', 'spawn_agent', 'ask_user', 'fetch_url', 'web_search', 'git_status', 'git_diff', 'git_log', 'git_branch']);
+// Paths that may contain secrets, credentials, or system configuration.
+// Reading these requires explicit user permission even though read_file is normally safe.
+const RESTRICTED_PATTERNS = [
+    /^\.env(\.|$)/i, // .env, .env.local, .env.production, etc.
+    /\/(\.env(\.|$)|\.env$)/i, // any directory's .env files
+    /\b\.ssh\b/i, // .ssh directories
+    /\b\.aws\b/i, // AWS credentials/config
+    /\b\.docker\b/i, // Docker config
+    /\b\.npmrc\b/i, // npm auth tokens
+    /\b\.pypirc\b/i, // PyPI credentials
+    /\b\.git-credentials\b/i, // git credentials
+    /\bid_(rsa|ed25519|ecdsa|dsa)\b/i, // SSH private keys
+    /\b.*\.pem\b/i, // PEM certs/keys
+    /\b.*\.key\b/i, // key files
+    /\b.*\.p12\b/i, /\b.*\.pfx\b/i, // PKCS#12 bundles
+    /\b\.bashrc\b/i, /\b\.zshrc\b/i, /\b\.profile\b/i, /\b\.bash_profile\b/i,
+    /\b\.netrc\b/i, /\b\.pgpass\b/i, /\b\.mylogin\.cnf\b/i,
+    /\/etc\b/i, // system config
+    /\/proc\b/i, /\/sys\b/i, // Linux system dirs
+    /\/var\/(run|spool|lib|db)\b/i, // system state
+    /\bshadow\b/i, /\bpasswd\b/i, /\bhtpasswd\b/i, /\bsudoers\b/i,
+];
+export function isRestrictedPath(path) {
+    const normalized = path.replace(/\\/g, '/').toLowerCase();
+    const basename = normalized.split('/').pop() ?? '';
+    if (RESTRICTED_PATTERNS.some(p => p.test(basename)))
+        return true;
+    return RESTRICTED_PATTERNS.some(p => p.test(normalized));
+}
 // ─── Display helpers ──────────────────────────────────────────────────────────
 export function formatToolArgs(name, input) {
     const p = (v) => v != null && v !== 'undefined' ? String(v) : '(missing)';
@@ -779,6 +823,7 @@ function formatSearchResults(query, results) {
 export async function executeTool(name, input) {
     switch (name) {
         case 'read_file': return readFile(input);
+        case 'switch_mode': return 'Error: switch_mode is handled by the agent, not the tool executor.';
         case 'write_file': return writeFile(input);
         case 'edit_file': return editFile(input);
         case 'bash': return bash(input);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ikie-cli",
-  "version": "0.1.21",
+  "version": "0.1.22",
   "description": "Agentic coding CLI — your terminal AI pair programmer",
   "type": "module",
   "bin": {