jinzd-ai-cli 0.4.209 → 0.4.211

package/dist/{chunk-JVLRMIHA.js → chunk-ZOPYREL5.js}

@@ -5,10 +5,10 @@ import {
 } from "./chunk-T2NL5ZIA.js";
 import {
   runTestsTool
-} from "./chunk-EN63JA7N.js";
+} from "./chunk-6NS6643Y.js";
 import {
   runTool
-} from "./chunk-STIEOOOL.js";
+} from "./chunk-JBWA73GK.js";
 import {
   getDangerLevel,
   isFileWriteTool,
@@ -26,7 +26,7 @@ import {
   SUBAGENT_ALLOWED_TOOLS,
   SUBAGENT_DEFAULT_MAX_ROUNDS,
   SUBAGENT_MAX_ROUNDS_LIMIT
-} from "./chunk-UPMBIS4T.js";
+} from "./chunk-E5XCM4A6.js";
 import {
   fileCheckpoints
 } from "./chunk-4BKXL7SM.js";
@@ -1056,6 +1056,7 @@ import { dirname as dirname2 } from "path";
 // src/tools/executor.ts
 import chalk3 from "chalk";
 import { existsSync as existsSync4, readFileSync as readFileSync3 } from "fs";
+import { tmpdir } from "os";
 
 // src/core/readline-internal.ts
 function rlInternal(rl) {
@@ -1290,6 +1291,7 @@ function runHook(template, vars) {
 }
 
 // src/tools/permissions.ts
+import { isAbsolute, resolve as resolve3 } from "path";
 function checkPermission(toolName, args, dangerLevel, rules, defaultAction = "confirm") {
   for (const rule of rules) {
     if (rule.tool !== "*" && rule.tool !== toolName) continue;
@@ -1310,6 +1312,225 @@ function checkPermission(toolName, args, dangerLevel, rules, defaultAction = "co
   }
   return defaultAction;
 }
+var BUILTIN_PROFILE_NAMES = /* @__PURE__ */ new Set(["legacy", "read-only", "workspace-write", "danger-full-access"]);
+var READ_ONLY_TOOLS = /* @__PURE__ */ new Set([
+  "read_file",
+  "list_dir",
+  "grep_files",
+  "glob_files",
+  "find_symbol",
+  "get_outline",
+  "find_references",
+  "search_code",
+  "git_status",
+  "git_diff",
+  "git_log",
+  "task_list",
+  "web_fetch",
+  "web_search",
+  "google_search",
+  "ask_user",
+  "write_todos",
+  "recall_memory"
+]);
+function normalizePathForPermission(value) {
+  return value.replace(/\\/g, "/").replace(/\/+$/, "").toLowerCase();
+}
+function isInsidePath(root, target) {
+  const absoluteTarget = isAbsolute(target) ? target : resolve3(root, target);
+  const r = normalizePathForPermission(resolve3(root));
+  const t = normalizePathForPermission(absoluteTarget);
+  return t === r || t.startsWith(`${r}/`);
+}
+function extractPathArg(toolName, args) {
+  const raw = args["path"] ?? args["filePath"] ?? args["notebook_path"];
+  if (typeof raw === "string" && raw.trim()) return raw.trim();
+  if (toolName === "save_last_response") {
+    const output = args["outputPath"] ?? args["file"] ?? args["path"];
+    if (typeof output === "string" && output.trim()) return output.trim();
+  }
+  return null;
+}
+function isExplicitFileWriteTool(toolName) {
+  return toolName === "write_file" || toolName === "edit_file" || toolName === "notebook_edit" || toolName === "save_last_response";
+}
+function resolveProfileName(ctx) {
+  const requested = ctx?.profileName ?? "legacy";
+  if (ctx?.allowedProfiles && ctx.allowedProfiles.length > 0 && !ctx.allowedProfiles.includes(requested)) {
+    return "legacy";
+  }
+  if (BUILTIN_PROFILE_NAMES.has(requested)) return requested;
+  const ext = ctx?.profile?.extends;
+  return ext && BUILTIN_PROFILE_NAMES.has(ext) ? ext : "legacy";
+}
+function getProfileRules(ctx) {
+  return ctx?.profile?.rules ?? [];
+}
+function getProfileDefaultAction(name, ctx) {
+  if (ctx?.profile?.defaultAction) return ctx.profile.defaultAction;
+  if (name === "danger-full-access") return "auto-approve";
+  return "confirm";
+}
+function getWorkspaceRoots(ctx) {
+  const roots = [ctx?.workspaceRoot, ...ctx?.profile?.workspaceRoots ?? []].filter((v) => typeof v === "string" && v.trim().length > 0);
+  return roots;
+}
+function getAllowedWriteRoots(ctx) {
+  const roots = [...getWorkspaceRoots(ctx)];
+  const allowTemp = ctx?.profile?.allowTemp !== false;
+  if (allowTemp) roots.push(...ctx?.tempDirs ?? []);
+  return roots.filter((v) => v.trim().length > 0);
+}
+function profileHardDecision(profileName, toolName, args, dangerLevel, ctx) {
+  if (profileName === "legacy") return null;
+  if (profileName === "read-only") {
+    const mcpReadOnly = toolName.startsWith("mcp__") && dangerLevel === "safe";
+    if (dangerLevel !== "safe" || !READ_ONLY_TOOLS.has(toolName) && !mcpReadOnly) {
+      return { action: "deny", reason: "blocked by read-only permission profile", profileName };
+    }
+    return null;
+  }
+  if (profileName === "workspace-write") {
+    if (dangerLevel === "destructive") return { action: "confirm", reason: "destructive tools always require confirmation", profileName };
+    if (dangerLevel === "write" && isExplicitFileWriteTool(toolName)) {
+      const target = extractPathArg(toolName, args);
+      if (!target) return { action: "confirm", reason: "file write target is not explicit", profileName };
+      const allowedRoots = getAllowedWriteRoots(ctx);
+      if (allowedRoots.length === 0 || !allowedRoots.some((root) => isInsidePath(root, target))) {
+        return { action: "deny", reason: "file write target is outside workspace/temp roots", profileName };
+      }
+    }
+    return null;
+  }
+  if (profileName === "danger-full-access") {
+    if (dangerLevel === "destructive") return { action: "confirm", reason: "destructive tools still require confirmation", profileName };
+    return null;
+  }
+  return null;
+}
+function checkPermissionWithProfile(toolName, args, dangerLevel, rules, defaultAction = "confirm", profileContext) {
+  const profileName = resolveProfileName(profileContext);
+  const hard = profileHardDecision(profileName, toolName, args, dangerLevel, profileContext);
+  if (hard?.action === "deny") return hard;
+  const combinedRules = [...getProfileRules(profileContext), ...rules];
+  const profileDefault = profileName === "legacy" ? defaultAction : getProfileDefaultAction(profileName, profileContext);
+  const action = checkPermission(toolName, args, dangerLevel, combinedRules, profileDefault);
+  if (hard?.action === "confirm" && action === "auto-approve") return hard;
+  return { action, profileName };
+}
+function formatPermissionProfileWarning(profileName) {
+  if (profileName === "danger-full-access") {
+    return "\u26A0 danger-full-access permission profile is active. Write tools may auto-run; destructive tools still require confirmation.";
+  }
+  if (profileName === "read-only") return "Read-only permission profile is active. Write and destructive tools are blocked.";
+  if (profileName === "workspace-write") return "Workspace-write permission profile is active. Writes outside workspace/temp roots are blocked.";
+  return null;
+}
+var NETWORK_TOOL_HOSTS = {
+  web_search: ["cn.bing.com", "www.google.com"],
+  google_search: ["www.googleapis.com"]
+};
+var NETWORK_TOOL_PORTS = {
+  web_search: [443],
+  google_search: [443]
+};
+function networkActionToPermission(action) {
+  if (action === "allow") return null;
+  return action;
+}
+function domainMatches(pattern, host) {
+  const p = pattern.trim().toLowerCase().replace(/^\*\./, "");
+  const h = host.trim().toLowerCase().replace(/:\d+$/, "");
+  return h === p || h.endsWith(`.${p}`);
+}
+function isPrivateNetworkHost(host) {
+  const h = host.toLowerCase().replace(/^\[|\]$/g, "");
+  if (h === "" || h === "localhost") return true;
+  if (/^(127|10)\./.test(h)) return true;
+  if (/^192\.168\./.test(h)) return true;
+  if (/^172\.(1[6-9]|2\d|3[0-1])\./.test(h)) return true;
+  if (/^169\.254\./.test(h)) return true;
+  if (h === "::1" || h === "::") return true;
+  if (/^f[cd][0-9a-f]*:/i.test(h) || /^fe[89ab][0-9a-f]*:/i.test(h)) return true;
+  return false;
+}
+function extractNetworkHosts(toolName, args) {
+  if (toolName === "web_fetch") {
+    const raw = String(args["url"] ?? "").trim();
+    try {
+      return raw ? [new URL(raw).hostname] : [];
+    } catch {
+      return [];
+    }
+  }
+  return NETWORK_TOOL_HOSTS[toolName] ?? [];
+}
+function extractNetworkPorts(toolName, args) {
+  if (toolName === "web_fetch") {
+    const raw = String(args["url"] ?? "").trim();
+    try {
+      if (!raw) return [];
+      const url = new URL(raw);
+      if (url.port) return [Number(url.port)];
+      return [url.protocol === "http:" ? 80 : 443];
+    } catch {
+      return [];
+    }
+  }
+  return NETWORK_TOOL_PORTS[toolName] ?? [];
+}
+function isShellNetworkCommand(command) {
+  return /\b(curl|wget|aria2c|Invoke-WebRequest|Invoke-RestMethod|iwr|irm|ssh|scp|sftp|ftp|telnet|nc|ncat|netcat)\b/i.test(command) || /\b(git\s+(clone|fetch|pull|push)|npm\s+(install|publish|view)|pnpm\s+(add|install)|yarn\s+(add|install)|pip\s+install|python\s+-m\s+pip\s+install)\b/i.test(command);
+}
+function networkToolAction(toolName, policy) {
+  if (toolName === "web_fetch") return policy.tools?.web_fetch ?? policy.defaultAction ?? "confirm";
+  if (toolName === "web_search") return policy.tools?.web_search ?? policy.defaultAction ?? "confirm";
+  if (toolName === "google_search") return policy.tools?.google_search ?? policy.defaultAction ?? "confirm";
+  if (toolName.startsWith("mcp__")) return policy.tools?.mcp ?? policy.defaultAction ?? "confirm";
+  return null;
+}
+function checkNetworkPolicy(toolName, args, policy) {
+  if (!policy?.enabled) return null;
+  let action = networkToolAction(toolName, policy);
+  let reason = "network access requires confirmation";
+  if (toolName === "bash") {
+    const command = String(args["command"] ?? "");
+    if (!isShellNetworkCommand(command)) return null;
+    action = policy.tools?.shell ?? policy.defaultAction ?? "confirm";
+    reason = "shell command may access the network";
+  }
+  if (!action) return null;
+  const hosts = extractNetworkHosts(toolName, args);
+  for (const host of hosts) {
+    if (policy.denyDomains?.some((pattern) => domainMatches(pattern, host))) {
+      return { action: "deny", reason: `network host "${host}" is denied by networkPolicy`, profileName: "networkPolicy" };
+    }
+    if (!policy.allowPrivateNetwork && isPrivateNetworkHost(host)) {
+      return { action: "deny", reason: `network host "${host}" is private/internal`, profileName: "networkPolicy" };
+    }
+  }
+  if (hosts.length > 0 && policy.allowDomains && policy.allowDomains.length > 0) {
+    const allAllowed = hosts.every((host) => policy.allowDomains.some((pattern) => domainMatches(pattern, host)));
+    if (!allAllowed) {
+      return { action: "deny", reason: `network host is not in networkPolicy.allowDomains`, profileName: "networkPolicy" };
+    }
+  }
+  const ports = extractNetworkPorts(toolName, args);
+  for (const port of ports) {
+    if (policy.denyPorts?.includes(port)) {
+      return { action: "deny", reason: `network port ${port} is denied by networkPolicy`, profileName: "networkPolicy" };
+    }
+  }
+  if (ports.length > 0 && policy.allowPorts && policy.allowPorts.length > 0) {
+    const allPortsAllowed = ports.every((port) => policy.allowPorts.includes(port));
+    if (!allPortsAllowed) {
+      return { action: "deny", reason: `network port is not in networkPolicy.allowPorts`, profileName: "networkPolicy" };
+    }
+  }
+  const permissionAction = networkActionToPermission(action);
+  if (!permissionAction) return null;
+  return { action: permissionAction, reason, profileName: "networkPolicy" };
+}
 
 // src/tools/truncate.ts
 var DEFAULT_MAX_TOOL_OUTPUT_CHARS = 12e3;
@@ -1564,11 +1785,21 @@ var ToolExecutor = class {
   /** 权限规则（可选） */
   permissionRules = [];
   defaultPermission = "confirm";
+  permissionProfileName = "legacy";
+  permissionProfile;
+  allowedPermissionProfiles = [];
+  workspaceRoot = process.cwd();
+  networkPolicy;
   /** 注入 hooks 和 permission rules 配置 */
   setConfig(opts) {
     this.hookConfig = opts.hookConfig;
     if (opts.permissionRules) this.permissionRules = opts.permissionRules;
     if (opts.defaultPermission) this.defaultPermission = opts.defaultPermission;
+    if (opts.permissionProfileName) this.permissionProfileName = opts.permissionProfileName;
+    if (opts.permissionProfile) this.permissionProfile = opts.permissionProfile;
+    if (opts.allowedPermissionProfiles) this.allowedPermissionProfiles = opts.allowedPermissionProfiles;
+    if (opts.workspaceRoot) this.workspaceRoot = opts.workspaceRoot;
+    if (opts.networkPolicy) this.networkPolicy = opts.networkPolicy;
   }
   async execute(call) {
     return runWithSessionKey(this.sessionKey, () => this.executeInner(call));
@@ -1583,31 +1814,69 @@ var ToolExecutor = class {
       };
     }
     const dangerLevel = getDangerLevel(call.name, call.arguments);
+    let toolCallAlreadyPrinted = false;
     runHook(this.hookConfig?.preToolExecution, {
       tool: call.name,
       dangerLevel,
       args: JSON.stringify(call.arguments).slice(0, 200)
     });
-    if (this.permissionRules.length > 0) {
-      const action = checkPermission(call.name, call.arguments, dangerLevel, this.permissionRules, this.defaultPermission);
-      if (action === "deny") {
-        return { callId: call.id, content: `[Permission denied] Tool ${call.name} is blocked by permission rules. Do not retry.`, isError: true };
+    const permission = checkPermissionWithProfile(
+      call.name,
+      call.arguments,
+      dangerLevel,
+      this.permissionRules,
+      this.defaultPermission,
+      {
+        profileName: this.permissionProfileName,
+        profile: this.permissionProfile,
+        allowedProfiles: this.allowedPermissionProfiles,
+        workspaceRoot: this.workspaceRoot,
+        tempDirs: [tmpdir()]
       }
-      if (action === "auto-approve") {
-        this.printToolCall(call);
-        try {
-          const rawContent = await runTool(tool, call.arguments, call.name);
-          const content = truncateOutput(rawContent, call.name);
-          const wasTruncated = content !== rawContent;
-          this.printToolResult(call.name, rawContent, false, wasTruncated);
-          runHook(this.hookConfig?.postToolExecution, { tool: call.name, status: "ok" });
-          return { callId: call.id, content, isError: false };
-        } catch (err) {
-          const message = err instanceof Error ? err.message : String(err);
-          this.printToolResult(call.name, message, true, false);
-          runHook(this.hookConfig?.postToolExecution, { tool: call.name, status: "error" });
-          return { callId: call.id, content: message, isError: true };
-        }
+    );
+    const networkPermission = checkNetworkPolicy(call.name, call.arguments, this.networkPolicy);
+    if (networkPermission?.action === "deny") {
+      const reason = networkPermission.reason ? ` (${networkPermission.reason})` : "";
+      return {
+        callId: call.id,
+        content: `[Permission denied] Tool ${call.name} is blocked by networkPolicy${reason}. Do not retry.`,
+        isError: true
+      };
+    }
+    if (permission.action === "deny") {
+      const reason = permission.reason ? ` (${permission.reason})` : "";
+      return {
+        callId: call.id,
+        content: `[Permission denied] Tool ${call.name} is blocked by permission profile "${permission.profileName}"${reason}. Do not retry.`,
+        isError: true
+      };
+    }
+    if (permission.action === "auto-approve" && networkPermission?.action !== "confirm") {
+      this.printToolCall(call);
+      try {
+        const rawContent = await runTool(tool, call.arguments, call.name);
+        const content = truncateOutput(rawContent, call.name);
+        const wasTruncated = content !== rawContent;
+        this.printToolResult(call.name, rawContent, false, wasTruncated);
+        runHook(this.hookConfig?.postToolExecution, { tool: call.name, status: "ok" });
+        return { callId: call.id, content, isError: false };
+      } catch (err) {
+        const message = err instanceof Error ? err.message : String(err);
+        this.printToolResult(call.name, message, true, false);
+        runHook(this.hookConfig?.postToolExecution, { tool: call.name, status: "error" });
+        return { callId: call.id, content: message, isError: true };
+      }
+    }
+    if (networkPermission?.action === "confirm" && dangerLevel === "safe") {
+      this.printToolCall(call);
+      toolCallAlreadyPrinted = true;
+      const confirmed = await this.confirm(call, "write");
+      if (!confirmed) {
+        return {
+          callId: call.id,
+          content: `[User cancelled] The user declined network access for ${call.name}. Do not retry without asking.`,
+          isError: true
+        };
       }
     }
     if (this.sessionAutoApprove && dangerLevel === "write") {
@@ -1697,6 +1966,9 @@ var ToolExecutor = class {
    * 然后让用户 approve all / reject all / 选择性 approve。
    */
   async executeBatchFileWrites(calls) {
+    if (this.permissionProfileName !== "legacy" || this.permissionRules.length > 0) {
+      return Promise.all(calls.map((call) => this.execute(call)));
+    }
     console.log();
     console.log(theme.heading(`\u270E Batch file writes (${calls.length} files):`));
     console.log(theme.dim("\u2500".repeat(50)));
@@ -1770,7 +2042,7 @@ var ToolExecutor = class {
     rl.resume();
     process.stdout.write(prompt);
     this.confirming = true;
-    return new Promise((resolve5) => {
+    return new Promise((resolve6) => {
       let completed = false;
       const cleanup = (result) => {
         if (completed) return;
@@ -1780,7 +2052,7 @@ var ToolExecutor = class {
         rl.pause();
         rlAny.output = savedOutput;
         this.confirming = false;
-        resolve5(result);
+        resolve6(result);
       };
       const onLine = (line) => {
         const trimmed = line.trim();
@@ -1954,7 +2226,7 @@ var ToolExecutor = class {
     rl.resume();
     process.stdout.write(color("Proceed? [y/N] (type y + Enter to confirm) "));
     this.confirming = true;
-    return new Promise((resolve5) => {
+    return new Promise((resolve6) => {
       let completed = false;
       const cleanup = (answer) => {
         if (completed) return;
@@ -1964,7 +2236,7 @@ var ToolExecutor = class {
         rl.pause();
         rlAny.output = savedOutput;
         this.confirming = false;
-        resolve5(answer === "y");
+        resolve6(answer === "y");
       };
       const onLine = (line) => {
         const trimmed = line.trim();
@@ -1992,11 +2264,11 @@ var ToolExecutor = class {
 };
 
 // src/tools/sensitive-paths.ts
-import { resolve as resolve3, sep as sep2, basename as basename2 } from "path";
+import { resolve as resolve4, sep as sep2, basename as basename2 } from "path";
 import { homedir as homedir2 } from "os";
 var home = homedir2();
 function norm(p) {
-  const abs = resolve3(p);
+  const abs = resolve4(p);
   return process.platform === "win32" ? abs.toLowerCase() : abs;
 }
 function homeRel(p) {
@@ -3213,7 +3485,7 @@ var runInteractiveTool = {
       PYTHONDONTWRITEBYTECODE: "1"
     };
     const prefixWarnings = [argsTypeWarning, stdinTypeWarning].filter(Boolean).join("");
-    return new Promise((resolve5) => {
+    return new Promise((resolve6) => {
       const child = spawn2(executable, cmdArgs.map(String), {
         cwd: process.cwd(),
         env,
@@ -3246,22 +3518,22 @@ var runInteractiveTool = {
       setTimeout(writeNextLine, 400);
       const timer = setTimeout(() => {
         child.kill();
-        resolve5(`${prefixWarnings}[Timeout after ${timeout}ms]
+        resolve6(`${prefixWarnings}[Timeout after ${timeout}ms]
 ${buildOutput(stdout, stderr)}`);
       }, timeout);
       child.on("close", (code) => {
         clearTimeout(timer);
         const output = buildOutput(stdout, stderr);
         if (code !== 0 && code !== null) {
-          resolve5(`${prefixWarnings}Exit code ${code}:
+          resolve6(`${prefixWarnings}Exit code ${code}:
 ${output}`);
         } else {
-          resolve5(`${prefixWarnings}${output || "(no output)"}`);
+          resolve6(`${prefixWarnings}${output || "(no output)"}`);
         }
       });
       child.on("error", (err) => {
         clearTimeout(timer);
-        resolve5(
+        resolve6(
           `${prefixWarnings}Failed to start process "${executable}": ${err.message}
 Hint: On Windows, use the full path to the executable, e.g.:
   C:\\Users\\Jinzd\\anaconda3\\envs\\python312\\python.exe`
@@ -4013,7 +4285,7 @@ function promptUser(rl, question) {
   console.log();
   console.log(chalk4.cyan("\u2753 ") + chalk4.bold(question));
   process.stdout.write(chalk4.cyan("> "));
-  return new Promise((resolve5) => {
+  return new Promise((resolve6) => {
     let completed = false;
     const cleanup = (answer) => {
       if (completed) return;
@@ -4023,7 +4295,7 @@ function promptUser(rl, question) {
       rl.pause();
       rlAny.output = savedOutput;
       askUserContext.prompting = false;
-      resolve5(answer);
+      resolve6(answer);
     };
     const onLine = (line) => {
       cleanup(line);
@@ -5034,7 +5306,7 @@ ${commitOutput.trim()}`;
 // src/tools/builtin/notebook-edit.ts
 import { readFileSync as readFileSync7, existsSync as existsSync11 } from "fs";
 import { writeFile } from "fs/promises";
-import { resolve as resolve4, extname as extname2 } from "path";
+import { resolve as resolve5, extname as extname2 } from "path";
 var notebookEditTool = {
   definition: {
     name: "notebook_edit",
@@ -5083,7 +5355,7 @@ var notebookEditTool = {
     if (!Number.isInteger(cellIndexRaw) || cellIndexRaw < 1) {
       throw new ToolError("notebook_edit", "cell_index must be a positive integer (1-based)");
     }
-    const absPath = resolve4(filePath);
+    const absPath = resolve5(filePath);
     if (extname2(absPath).toLowerCase() !== ".ipynb") {
       throw new ToolError("notebook_edit", "path must point to a .ipynb file");
     }
@@ -5740,7 +6012,9 @@ export {
   groupCallsByPhase,
   runSafePhases,
   runHook,
-  checkPermission,
+  checkPermissionWithProfile,
+  formatPermissionProfileWarning,
+  checkNetworkPolicy,
   setMaxOutputCap,
   setContextWindow,
   truncateForPersist,

package/dist/{chunk-EYID2AIR.js → chunk-ZY2N2N6T.js}

@@ -6,7 +6,7 @@ import { platform } from "os";
 import chalk from "chalk";
 
 // src/core/constants.ts
-var VERSION = "0.4.209";
+var VERSION = "0.4.211";
 var APP_NAME = "ai-cli";
 var CONFIG_DIR_NAME = ".aicli";
 var CONFIG_FILE_NAME = "config.json";
@@ -14,7 +14,8 @@ var HISTORY_DIR_NAME = "history";
 var PLUGINS_DIR_NAME = "plugins";
 var SKILLS_DIR_NAME = "skills";
 var CUSTOM_COMMANDS_DIR_NAME = "commands";
-var CONTEXT_FILE_CANDIDATES = ["AICLI.md", "CLAUDE.md"];
+var CONTEXT_FILE_CANDIDATES = ["AICLI.override.md", "AGENTS.override.md", "AICLI.md", "CLAUDE.md", "AGENTS.md"];
+var CONTEXT_FILE_MAX_BYTES = 32 * 1024;
 var MEMORY_FILE_NAME = "memory.md";
 var MEMORY_MAX_CHARS = 1e4;
 var DEV_STATE_FILE_NAME = "dev-state.md";
@@ -96,7 +97,7 @@ var AGENTIC_BEHAVIOR_GUIDELINE = `# Important Behavioral Guidelines
 - Only begin using write/execute tools when the user **explicitly requests** an action (e.g., "generate", "create", "modify", "run", "start", etc.).
 - **Stop when the explicit task is done \u2014 do NOT autonomously test, verify, or run what you just created.** If the user asks "write/create/save file X", finish writing the file and STOP. Do not run it, do not test it, do not "verify it works" with bash/run_interactive. The user will run it themselves and tell you if anything is wrong. Only run/test when the user explicitly says "run", "test", "execute", "try it", "verify", "make sure it works", etc.
 - **Do NOT retry the same failing command with variants.** If a command fails (exit code non-zero), report the failure to the user with a brief diagnosis and STOP. Do not loop through alternate shells, alternate quoting, alternate paths, or alternate Python invocations. The user can decide whether to retry.
-- Project context files (CLAUDE.md, AICLI.md) provide background information about the project. They are NOT instructions to start working. Only use them as reference when the user asks a project-related question or task.
+- Project context files (AICLI.md, CLAUDE.md, AGENTS.md, and override variants) provide background information about the project. They are NOT instructions to start working. Only use them as reference when the user asks a project-related question or task.
 - If you are unsure about the user's intent, use the ask_user tool to confirm with the user, rather than assuming and executing on your own.
 - **Do NOT abuse ask_user for redundant confirmations**: When the user has already given a clear, explicit instruction (e.g., "write lesson 142", "generate file X", "create the report"), execute it immediately. Do NOT ask "are you sure?" or request details that can be found in project documents. Repeatedly asking the user to confirm wastes their time and is extremely frustrating. Only use ask_user when critical information is genuinely missing and cannot be inferred from context files.`;
 function buildUserIdentityPrompt(profile) {
@@ -549,6 +550,7 @@ export {
   SKILLS_DIR_NAME,
   CUSTOM_COMMANDS_DIR_NAME,
   CONTEXT_FILE_CANDIDATES,
+  CONTEXT_FILE_MAX_BYTES,
   MEMORY_FILE_NAME,
   MEMORY_MAX_CHARS,
   DEV_STATE_FILE_NAME,

package/dist/{ci-PUE3MQ7J.js → ci-XMUEX526.js}

@@ -10,11 +10,11 @@ import {
 import "./chunk-XPBEJB27.js";
 import {
   ConfigManager
-} from "./chunk-DUZRQXIP.js";
+} from "./chunk-UOROWTGG.js";
 import "./chunk-TZQHYZKT.js";
 import {
   VERSION
-} from "./chunk-UPMBIS4T.js";
+} from "./chunk-E5XCM4A6.js";
 import "./chunk-IW3Q7AE5.js";
 
 // src/cli/ci.ts

package/dist/{constants-VTZLKDAG.js → constants-AWTIQIWG.js}

@@ -7,6 +7,7 @@ import {
   CONFIG_DIR_NAME,
   CONFIG_FILE_NAME,
   CONTEXT_FILE_CANDIDATES,
+  CONTEXT_FILE_MAX_BYTES,
   CONTEXT_PRESSURE_THRESHOLD,
   CONTEXT_WARNING_THRESHOLD,
   CUSTOM_COMMANDS_DIR_NAME,
@@ -36,7 +37,7 @@ import {
   TEST_TIMEOUT,
   VERSION,
   buildUserIdentityPrompt
-} from "./chunk-UPMBIS4T.js";
+} from "./chunk-E5XCM4A6.js";
 export {
   AGENTIC_BEHAVIOR_GUIDELINE,
   APP_NAME,
@@ -45,6 +46,7 @@ export {
   CONFIG_DIR_NAME,
   CONFIG_FILE_NAME,
   CONTEXT_FILE_CANDIDATES,
+  CONTEXT_FILE_MAX_BYTES,
   CONTEXT_PRESSURE_THRESHOLD,
   CONTEXT_WARNING_THRESHOLD,
   CUSTOM_COMMANDS_DIR_NAME,

package/dist/{doctor-cli-IU6FSVLF.js → doctor-cli-SSI6ETFT.js}

@@ -2,7 +2,7 @@
 import {
   getConfigDirUsage,
   listRecentCrashes
-} from "./chunk-D6M4E7SH.js";
+} from "./chunk-BE6ERF7M.js";
 import {
   ProviderRegistry
 } from "./chunk-QMXC327F.js";
@@ -11,17 +11,17 @@ import {
   getTopFailingTools,
   getTopUsedTools,
   resetStats
-} from "./chunk-STIEOOOL.js";
+} from "./chunk-JBWA73GK.js";
 import "./chunk-XPBEJB27.js";
 import {
   ConfigManager
-} from "./chunk-DUZRQXIP.js";
+} from "./chunk-UOROWTGG.js";
 import "./chunk-TZQHYZKT.js";
 import {
   DEV_STATE_FILE_NAME,
   MEMORY_FILE_NAME,
   VERSION
-} from "./chunk-UPMBIS4T.js";
+} from "./chunk-E5XCM4A6.js";
 import "./chunk-IW3Q7AE5.js";
 
 // src/diagnostics/doctor-cli.ts