jinzd-ai-cli 0.4.210 → 0.4.211

package/dist/electron-server.js

@@ -37,7 +37,7 @@ import {
   VERSION,
   buildUserIdentityPrompt,
   runTestsTool
-} from "./chunk-HZQVX7VF.js";
+} from "./chunk-ZY2N2N6T.js";
 import {
   hasSemanticIndex,
   semanticSearch
@@ -60,7 +60,7 @@ import {
 import express from "express";
 import { createServer } from "http";
 import { WebSocketServer } from "ws";
-import { join as join19, dirname as dirname6, resolve as resolve7, relative as relative4, sep as sep3 } from "path";
+import { join as join19, dirname as dirname6, resolve as resolve8, relative as relative4, sep as sep3 } from "path";
 import { existsSync as existsSync25, readFileSync as readFileSync19, readdirSync as readdirSync12, statSync as statSync10, realpathSync } from "fs";
 import { networkInterfaces } from "os";
 
@@ -213,7 +213,41 @@ var ConfigSchema = z.object({
     preToolExecution: z.string().optional(),
     postToolExecution: z.string().optional()
   }).optional(),
-  // 工具权限规则（按顺序匹配第一个生效）
+  // 网络访问治理（v0.4.211+）：默认关闭以保持兼容；开启后统一治理 web/search/MCP/shell 网络出口。
+  networkPolicy: z.object({
+    enabled: z.boolean().default(false),
+    defaultAction: z.enum(["allow", "confirm", "deny"]).default("confirm"),
+    allowDomains: z.array(z.string()).default([]),
+    denyDomains: z.array(z.string()).default([]),
+    allowPorts: z.array(z.number().int().min(1).max(65535)).default([]),
+    denyPorts: z.array(z.number().int().min(1).max(65535)).default([]),
+    allowPrivateNetwork: z.boolean().default(false),
+    tools: z.object({
+      web_fetch: z.enum(["allow", "confirm", "deny"]).optional(),
+      web_search: z.enum(["allow", "confirm", "deny"]).optional(),
+      google_search: z.enum(["allow", "confirm", "deny"]).optional(),
+      shell: z.enum(["allow", "confirm", "deny"]).optional(),
+      mcp: z.enum(["allow", "confirm", "deny"]).optional()
+    }).default({})
+  }).default({ enabled: false, defaultAction: "confirm", allowDomains: [], denyDomains: [], allowPorts: [], denyPorts: [], allowPrivateNetwork: false, tools: {} }),
+  // 权限 Profile（v0.4.211+）：legacy 保持旧行为；其余 profile 提供更清晰的安全边界。
+  defaultPermissionProfile: z.enum(["legacy", "read-only", "workspace-write", "danger-full-access"]).default("legacy"),
+  allowedPermissionProfiles: z.array(z.string()).default(["legacy", "read-only", "workspace-write", "danger-full-access"]),
+  permissionProfiles: z.record(z.object({
+    extends: z.enum(["legacy", "read-only", "workspace-write", "danger-full-access"]).optional(),
+    defaultAction: z.enum(["auto-approve", "deny", "confirm"]).optional(),
+    workspaceRoots: z.array(z.string()).optional(),
+    allowTemp: z.boolean().optional(),
+    rules: z.array(z.object({
+      tool: z.string(),
+      action: z.enum(["auto-approve", "deny", "confirm"]),
+      when: z.object({
+        dangerLevel: z.enum(["safe", "write", "destructive"]).optional(),
+        pathPattern: z.string().optional()
+      }).optional()
+    })).optional()
+  })).default({}),
+  // 工具权限规则（按顺序匹配第一个生效；作为当前权限 Profile 内的细粒度规则）
   permissionRules: z.array(z.object({
     tool: z.string(),
     action: z.enum(["auto-approve", "deny", "confirm"]),
@@ -222,7 +256,7 @@ var ConfigSchema = z.object({
       pathPattern: z.string().optional()
     }).optional()
   })).default([]),
-  // 无规则匹配时的默认权限动作
+  // 无规则匹配时的默认权限动作（legacy profile 兼容旧行为）
   defaultPermission: z.enum(["auto-approve", "deny", "confirm"]).default("confirm"),
   // 自动上下文压缩开关
   // 当对话估算 token 数超过模型 contextWindow 的 80% 时，自动触发 compact 压缩旧消息
@@ -5733,6 +5767,7 @@ import { dirname as dirname3 } from "path";
 // src/tools/executor.ts
 import chalk3 from "chalk";
 import { existsSync as existsSync7, readFileSync as readFileSync6 } from "fs";
+import { tmpdir } from "os";
 
 // src/core/readline-internal.ts
 function rlInternal(rl) {
@@ -5967,6 +6002,7 @@ function runHook(template, vars) {
 }
 
 // src/tools/permissions.ts
+import { isAbsolute, resolve as resolve3 } from "path";
 function checkPermission(toolName, args, dangerLevel, rules, defaultAction = "confirm") {
   for (const rule of rules) {
     if (rule.tool !== "*" && rule.tool !== toolName) continue;
@@ -5987,6 +6023,225 @@ function checkPermission(toolName, args, dangerLevel, rules, defaultAction = "co
   }
   return defaultAction;
 }
+var BUILTIN_PROFILE_NAMES = /* @__PURE__ */ new Set(["legacy", "read-only", "workspace-write", "danger-full-access"]);
+var READ_ONLY_TOOLS = /* @__PURE__ */ new Set([
+  "read_file",
+  "list_dir",
+  "grep_files",
+  "glob_files",
+  "find_symbol",
+  "get_outline",
+  "find_references",
+  "search_code",
+  "git_status",
+  "git_diff",
+  "git_log",
+  "task_list",
+  "web_fetch",
+  "web_search",
+  "google_search",
+  "ask_user",
+  "write_todos",
+  "recall_memory"
+]);
+function normalizePathForPermission(value) {
+  return value.replace(/\\/g, "/").replace(/\/+$/, "").toLowerCase();
+}
+function isInsidePath(root, target) {
+  const absoluteTarget = isAbsolute(target) ? target : resolve3(root, target);
+  const r = normalizePathForPermission(resolve3(root));
+  const t = normalizePathForPermission(absoluteTarget);
+  return t === r || t.startsWith(`${r}/`);
+}
+function extractPathArg(toolName, args) {
+  const raw = args["path"] ?? args["filePath"] ?? args["notebook_path"];
+  if (typeof raw === "string" && raw.trim()) return raw.trim();
+  if (toolName === "save_last_response") {
+    const output = args["outputPath"] ?? args["file"] ?? args["path"];
+    if (typeof output === "string" && output.trim()) return output.trim();
+  }
+  return null;
+}
+function isExplicitFileWriteTool(toolName) {
+  return toolName === "write_file" || toolName === "edit_file" || toolName === "notebook_edit" || toolName === "save_last_response";
+}
+function resolveProfileName(ctx) {
+  const requested = ctx?.profileName ?? "legacy";
+  if (ctx?.allowedProfiles && ctx.allowedProfiles.length > 0 && !ctx.allowedProfiles.includes(requested)) {
+    return "legacy";
+  }
+  if (BUILTIN_PROFILE_NAMES.has(requested)) return requested;
+  const ext = ctx?.profile?.extends;
+  return ext && BUILTIN_PROFILE_NAMES.has(ext) ? ext : "legacy";
+}
+function getProfileRules(ctx) {
+  return ctx?.profile?.rules ?? [];
+}
+function getProfileDefaultAction(name, ctx) {
+  if (ctx?.profile?.defaultAction) return ctx.profile.defaultAction;
+  if (name === "danger-full-access") return "auto-approve";
+  return "confirm";
+}
+function getWorkspaceRoots(ctx) {
+  const roots = [ctx?.workspaceRoot, ...ctx?.profile?.workspaceRoots ?? []].filter((v) => typeof v === "string" && v.trim().length > 0);
+  return roots;
+}
+function getAllowedWriteRoots(ctx) {
+  const roots = [...getWorkspaceRoots(ctx)];
+  const allowTemp = ctx?.profile?.allowTemp !== false;
+  if (allowTemp) roots.push(...ctx?.tempDirs ?? []);
+  return roots.filter((v) => v.trim().length > 0);
+}
+function profileHardDecision(profileName, toolName, args, dangerLevel, ctx) {
+  if (profileName === "legacy") return null;
+  if (profileName === "read-only") {
+    const mcpReadOnly = toolName.startsWith("mcp__") && dangerLevel === "safe";
+    if (dangerLevel !== "safe" || !READ_ONLY_TOOLS.has(toolName) && !mcpReadOnly) {
+      return { action: "deny", reason: "blocked by read-only permission profile", profileName };
+    }
+    return null;
+  }
+  if (profileName === "workspace-write") {
+    if (dangerLevel === "destructive") return { action: "confirm", reason: "destructive tools always require confirmation", profileName };
+    if (dangerLevel === "write" && isExplicitFileWriteTool(toolName)) {
+      const target = extractPathArg(toolName, args);
+      if (!target) return { action: "confirm", reason: "file write target is not explicit", profileName };
+      const allowedRoots = getAllowedWriteRoots(ctx);
+      if (allowedRoots.length === 0 || !allowedRoots.some((root) => isInsidePath(root, target))) {
+        return { action: "deny", reason: "file write target is outside workspace/temp roots", profileName };
+      }
+    }
+    return null;
+  }
+  if (profileName === "danger-full-access") {
+    if (dangerLevel === "destructive") return { action: "confirm", reason: "destructive tools still require confirmation", profileName };
+    return null;
+  }
+  return null;
+}
+function checkPermissionWithProfile(toolName, args, dangerLevel, rules, defaultAction = "confirm", profileContext) {
+  const profileName = resolveProfileName(profileContext);
+  const hard = profileHardDecision(profileName, toolName, args, dangerLevel, profileContext);
+  if (hard?.action === "deny") return hard;
+  const combinedRules = [...getProfileRules(profileContext), ...rules];
+  const profileDefault = profileName === "legacy" ? defaultAction : getProfileDefaultAction(profileName, profileContext);
+  const action = checkPermission(toolName, args, dangerLevel, combinedRules, profileDefault);
+  if (hard?.action === "confirm" && action === "auto-approve") return hard;
+  return { action, profileName };
+}
+function formatPermissionProfileWarning(profileName) {
+  if (profileName === "danger-full-access") {
+    return "\u26A0 danger-full-access permission profile is active. Write tools may auto-run; destructive tools still require confirmation.";
+  }
+  if (profileName === "read-only") return "Read-only permission profile is active. Write and destructive tools are blocked.";
+  if (profileName === "workspace-write") return "Workspace-write permission profile is active. Writes outside workspace/temp roots are blocked.";
+  return null;
+}
+var NETWORK_TOOL_HOSTS = {
+  web_search: ["cn.bing.com", "www.google.com"],
+  google_search: ["www.googleapis.com"]
+};
+var NETWORK_TOOL_PORTS = {
+  web_search: [443],
+  google_search: [443]
+};
+function networkActionToPermission(action) {
+  if (action === "allow") return null;
+  return action;
+}
+function domainMatches(pattern, host) {
+  const p = pattern.trim().toLowerCase().replace(/^\*\./, "");
+  const h = host.trim().toLowerCase().replace(/:\d+$/, "");
+  return h === p || h.endsWith(`.${p}`);
+}
+function isPrivateNetworkHost(host) {
+  const h = host.toLowerCase().replace(/^\[|\]$/g, "");
+  if (h === "" || h === "localhost") return true;
+  if (/^(127|10)\./.test(h)) return true;
+  if (/^192\.168\./.test(h)) return true;
+  if (/^172\.(1[6-9]|2\d|3[0-1])\./.test(h)) return true;
+  if (/^169\.254\./.test(h)) return true;
+  if (h === "::1" || h === "::") return true;
+  if (/^f[cd][0-9a-f]*:/i.test(h) || /^fe[89ab][0-9a-f]*:/i.test(h)) return true;
+  return false;
+}
+function extractNetworkHosts(toolName, args) {
+  if (toolName === "web_fetch") {
+    const raw = String(args["url"] ?? "").trim();
+    try {
+      return raw ? [new URL(raw).hostname] : [];
+    } catch {
+      return [];
+    }
+  }
+  return NETWORK_TOOL_HOSTS[toolName] ?? [];
+}
+function extractNetworkPorts(toolName, args) {
+  if (toolName === "web_fetch") {
+    const raw = String(args["url"] ?? "").trim();
+    try {
+      if (!raw) return [];
+      const url = new URL(raw);
+      if (url.port) return [Number(url.port)];
+      return [url.protocol === "http:" ? 80 : 443];
+    } catch {
+      return [];
+    }
+  }
+  return NETWORK_TOOL_PORTS[toolName] ?? [];
+}
+function isShellNetworkCommand(command) {
+  return /\b(curl|wget|aria2c|Invoke-WebRequest|Invoke-RestMethod|iwr|irm|ssh|scp|sftp|ftp|telnet|nc|ncat|netcat)\b/i.test(command) || /\b(git\s+(clone|fetch|pull|push)|npm\s+(install|publish|view)|pnpm\s+(add|install)|yarn\s+(add|install)|pip\s+install|python\s+-m\s+pip\s+install)\b/i.test(command);
+}
+function networkToolAction(toolName, policy) {
+  if (toolName === "web_fetch") return policy.tools?.web_fetch ?? policy.defaultAction ?? "confirm";
+  if (toolName === "web_search") return policy.tools?.web_search ?? policy.defaultAction ?? "confirm";
+  if (toolName === "google_search") return policy.tools?.google_search ?? policy.defaultAction ?? "confirm";
+  if (toolName.startsWith("mcp__")) return policy.tools?.mcp ?? policy.defaultAction ?? "confirm";
+  return null;
+}
+function checkNetworkPolicy(toolName, args, policy) {
+  if (!policy?.enabled) return null;
+  let action = networkToolAction(toolName, policy);
+  let reason = "network access requires confirmation";
+  if (toolName === "bash") {
+    const command = String(args["command"] ?? "");
+    if (!isShellNetworkCommand(command)) return null;
+    action = policy.tools?.shell ?? policy.defaultAction ?? "confirm";
+    reason = "shell command may access the network";
+  }
+  if (!action) return null;
+  const hosts = extractNetworkHosts(toolName, args);
+  for (const host of hosts) {
+    if (policy.denyDomains?.some((pattern) => domainMatches(pattern, host))) {
+      return { action: "deny", reason: `network host "${host}" is denied by networkPolicy`, profileName: "networkPolicy" };
+    }
+    if (!policy.allowPrivateNetwork && isPrivateNetworkHost(host)) {
+      return { action: "deny", reason: `network host "${host}" is private/internal`, profileName: "networkPolicy" };
+    }
+  }
+  if (hosts.length > 0 && policy.allowDomains && policy.allowDomains.length > 0) {
+    const allAllowed = hosts.every((host) => policy.allowDomains.some((pattern) => domainMatches(pattern, host)));
+    if (!allAllowed) {
+      return { action: "deny", reason: `network host is not in networkPolicy.allowDomains`, profileName: "networkPolicy" };
+    }
+  }
+  const ports = extractNetworkPorts(toolName, args);
+  for (const port of ports) {
+    if (policy.denyPorts?.includes(port)) {
+      return { action: "deny", reason: `network port ${port} is denied by networkPolicy`, profileName: "networkPolicy" };
+    }
+  }
+  if (ports.length > 0 && policy.allowPorts && policy.allowPorts.length > 0) {
+    const allPortsAllowed = ports.every((port) => policy.allowPorts.includes(port));
+    if (!allPortsAllowed) {
+      return { action: "deny", reason: `network port is not in networkPolicy.allowPorts`, profileName: "networkPolicy" };
+    }
+  }
+  const permissionAction = networkActionToPermission(action);
+  if (!permissionAction) return null;
+  return { action: permissionAction, reason, profileName: "networkPolicy" };
+}
 
 // src/tools/truncate.ts
 var DEFAULT_MAX_TOOL_OUTPUT_CHARS = 12e3;
@@ -6289,11 +6544,21 @@ var ToolExecutor = class {
   /** 权限规则（可选） */
   permissionRules = [];
   defaultPermission = "confirm";
+  permissionProfileName = "legacy";
+  permissionProfile;
+  allowedPermissionProfiles = [];
+  workspaceRoot = process.cwd();
+  networkPolicy;
   /** 注入 hooks 和 permission rules 配置 */
   setConfig(opts) {
     this.hookConfig = opts.hookConfig;
     if (opts.permissionRules) this.permissionRules = opts.permissionRules;
     if (opts.defaultPermission) this.defaultPermission = opts.defaultPermission;
+    if (opts.permissionProfileName) this.permissionProfileName = opts.permissionProfileName;
+    if (opts.permissionProfile) this.permissionProfile = opts.permissionProfile;
+    if (opts.allowedPermissionProfiles) this.allowedPermissionProfiles = opts.allowedPermissionProfiles;
+    if (opts.workspaceRoot) this.workspaceRoot = opts.workspaceRoot;
+    if (opts.networkPolicy) this.networkPolicy = opts.networkPolicy;
   }
   async execute(call) {
     return runWithSessionKey(this.sessionKey, () => this.executeInner(call));
@@ -6308,31 +6573,69 @@ var ToolExecutor = class {
       };
     }
     const dangerLevel = getDangerLevel(call.name, call.arguments);
+    let toolCallAlreadyPrinted = false;
     runHook(this.hookConfig?.preToolExecution, {
       tool: call.name,
       dangerLevel,
       args: JSON.stringify(call.arguments).slice(0, 200)
     });
-    if (this.permissionRules.length > 0) {
-      const action = checkPermission(call.name, call.arguments, dangerLevel, this.permissionRules, this.defaultPermission);
-      if (action === "deny") {
-        return { callId: call.id, content: `[Permission denied] Tool ${call.name} is blocked by permission rules. Do not retry.`, isError: true };
+    const permission = checkPermissionWithProfile(
+      call.name,
+      call.arguments,
+      dangerLevel,
+      this.permissionRules,
+      this.defaultPermission,
+      {
+        profileName: this.permissionProfileName,
+        profile: this.permissionProfile,
+        allowedProfiles: this.allowedPermissionProfiles,
+        workspaceRoot: this.workspaceRoot,
+        tempDirs: [tmpdir()]
       }
-      if (action === "auto-approve") {
-        this.printToolCall(call);
-        try {
-          const rawContent = await runTool(tool, call.arguments, call.name);
-          const content = truncateOutput(rawContent, call.name);
-          const wasTruncated = content !== rawContent;
-          this.printToolResult(call.name, rawContent, false, wasTruncated);
-          runHook(this.hookConfig?.postToolExecution, { tool: call.name, status: "ok" });
-          return { callId: call.id, content, isError: false };
-        } catch (err) {
-          const message = err instanceof Error ? err.message : String(err);
-          this.printToolResult(call.name, message, true, false);
-          runHook(this.hookConfig?.postToolExecution, { tool: call.name, status: "error" });
-          return { callId: call.id, content: message, isError: true };
-        }
+    );
+    const networkPermission = checkNetworkPolicy(call.name, call.arguments, this.networkPolicy);
+    if (networkPermission?.action === "deny") {
+      const reason = networkPermission.reason ? ` (${networkPermission.reason})` : "";
+      return {
+        callId: call.id,
+        content: `[Permission denied] Tool ${call.name} is blocked by networkPolicy${reason}. Do not retry.`,
+        isError: true
+      };
+    }
+    if (permission.action === "deny") {
+      const reason = permission.reason ? ` (${permission.reason})` : "";
+      return {
+        callId: call.id,
+        content: `[Permission denied] Tool ${call.name} is blocked by permission profile "${permission.profileName}"${reason}. Do not retry.`,
+        isError: true
+      };
+    }
+    if (permission.action === "auto-approve" && networkPermission?.action !== "confirm") {
+      this.printToolCall(call);
+      try {
+        const rawContent = await runTool(tool, call.arguments, call.name);
+        const content = truncateOutput(rawContent, call.name);
+        const wasTruncated = content !== rawContent;
+        this.printToolResult(call.name, rawContent, false, wasTruncated);
+        runHook(this.hookConfig?.postToolExecution, { tool: call.name, status: "ok" });
+        return { callId: call.id, content, isError: false };
+      } catch (err) {
+        const message = err instanceof Error ? err.message : String(err);
+        this.printToolResult(call.name, message, true, false);
+        runHook(this.hookConfig?.postToolExecution, { tool: call.name, status: "error" });
+        return { callId: call.id, content: message, isError: true };
+      }
+    }
+    if (networkPermission?.action === "confirm" && dangerLevel === "safe") {
+      this.printToolCall(call);
+      toolCallAlreadyPrinted = true;
+      const confirmed = await this.confirm(call, "write");
+      if (!confirmed) {
+        return {
+          callId: call.id,
+          content: `[User cancelled] The user declined network access for ${call.name}. Do not retry without asking.`,
+          isError: true
+        };
       }
     }
     if (this.sessionAutoApprove && dangerLevel === "write") {
@@ -6422,6 +6725,9 @@ var ToolExecutor = class {
    * 然后让用户 approve all / reject all / 选择性 approve。
    */
   async executeBatchFileWrites(calls) {
+    if (this.permissionProfileName !== "legacy" || this.permissionRules.length > 0) {
+      return Promise.all(calls.map((call) => this.execute(call)));
+    }
     console.log();
     console.log(theme.heading(`\u270E Batch file writes (${calls.length} files):`));
     console.log(theme.dim("\u2500".repeat(50)));
@@ -6495,7 +6801,7 @@ var ToolExecutor = class {
     rl.resume();
     process.stdout.write(prompt);
     this.confirming = true;
-    return new Promise((resolve8) => {
+    return new Promise((resolve9) => {
       let completed = false;
       const cleanup = (result) => {
         if (completed) return;
@@ -6505,7 +6811,7 @@ var ToolExecutor = class {
         rl.pause();
         rlAny.output = savedOutput;
         this.confirming = false;
-        resolve8(result);
+        resolve9(result);
       };
       const onLine = (line) => {
         const trimmed = line.trim();
@@ -6679,7 +6985,7 @@ var ToolExecutor = class {
     rl.resume();
     process.stdout.write(color("Proceed? [y/N] (type y + Enter to confirm) "));
     this.confirming = true;
-    return new Promise((resolve8) => {
+    return new Promise((resolve9) => {
       let completed = false;
       const cleanup = (answer) => {
         if (completed) return;
@@ -6689,7 +6995,7 @@ var ToolExecutor = class {
         rl.pause();
         rlAny.output = savedOutput;
         this.confirming = false;
-        resolve8(answer === "y");
+        resolve9(answer === "y");
       };
       const onLine = (line) => {
         const trimmed = line.trim();
@@ -6717,11 +7023,11 @@ var ToolExecutor = class {
 };
 
 // src/tools/sensitive-paths.ts
-import { resolve as resolve3, sep as sep2, basename as basename2 } from "path";
+import { resolve as resolve4, sep as sep2, basename as basename2 } from "path";
 import { homedir as homedir4 } from "os";
 var home = homedir4();
 function norm(p) {
-  const abs = resolve3(p);
+  const abs = resolve4(p);
   return process.platform === "win32" ? abs.toLowerCase() : abs;
 }
 function homeRel(p) {
@@ -7938,7 +8244,7 @@ var runInteractiveTool = {
       PYTHONDONTWRITEBYTECODE: "1"
     };
     const prefixWarnings = [argsTypeWarning, stdinTypeWarning].filter(Boolean).join("");
-    return new Promise((resolve8) => {
+    return new Promise((resolve9) => {
       const child = spawn2(executable, cmdArgs.map(String), {
         cwd: process.cwd(),
         env,
@@ -7971,22 +8277,22 @@ var runInteractiveTool = {
       setTimeout(writeNextLine, 400);
       const timer = setTimeout(() => {
         child.kill();
-        resolve8(`${prefixWarnings}[Timeout after ${timeout}ms]
+        resolve9(`${prefixWarnings}[Timeout after ${timeout}ms]
 ${buildOutput(stdout, stderr)}`);
       }, timeout);
       child.on("close", (code) => {
         clearTimeout(timer);
         const output = buildOutput(stdout, stderr);
         if (code !== 0 && code !== null) {
-          resolve8(`${prefixWarnings}Exit code ${code}:
+          resolve9(`${prefixWarnings}Exit code ${code}:
 ${output}`);
         } else {
-          resolve8(`${prefixWarnings}${output || "(no output)"}`);
+          resolve9(`${prefixWarnings}${output || "(no output)"}`);
         }
       });
       child.on("error", (err) => {
         clearTimeout(timer);
-        resolve8(
+        resolve9(
           `${prefixWarnings}Failed to start process "${executable}": ${err.message}
 Hint: On Windows, use the full path to the executable, e.g.:
   C:\\Users\\Jinzd\\anaconda3\\envs\\python312\\python.exe`
@@ -8738,7 +9044,7 @@ function promptUser(rl, question) {
   console.log();
   console.log(chalk4.cyan("\u2753 ") + chalk4.bold(question));
   process.stdout.write(chalk4.cyan("> "));
-  return new Promise((resolve8) => {
+  return new Promise((resolve9) => {
     let completed = false;
     const cleanup = (answer) => {
       if (completed) return;
@@ -8748,7 +9054,7 @@ function promptUser(rl, question) {
       rl.pause();
       rlAny.output = savedOutput;
       askUserContext.prompting = false;
-      resolve8(answer);
+      resolve9(answer);
     };
     const onLine = (line) => {
       cleanup(line);
@@ -9759,7 +10065,7 @@ ${commitOutput.trim()}`;
 // src/tools/builtin/notebook-edit.ts
 import { readFileSync as readFileSync10, existsSync as existsSync14 } from "fs";
 import { writeFile } from "fs/promises";
-import { resolve as resolve4, extname as extname2 } from "path";
+import { resolve as resolve5, extname as extname2 } from "path";
 var notebookEditTool = {
   definition: {
     name: "notebook_edit",
@@ -9808,7 +10114,7 @@ var notebookEditTool = {
     if (!Number.isInteger(cellIndexRaw) || cellIndexRaw < 1) {
       throw new ToolError("notebook_edit", "cell_index must be a positive integer (1-based)");
     }
-    const absPath = resolve4(filePath);
+    const absPath = resolve5(filePath);
     if (extname2(absPath).toLowerCase() !== ".ipynb") {
       throw new ToolError("notebook_edit", "path must point to a .ipynb file");
     }
@@ -10587,7 +10893,7 @@ var McpClient = class {
   // 内部方法：JSON-RPC 通信
   // ══════════════════════════════════════════════════════════════════
   sendRequest(method, params) {
-    return new Promise((resolve8, reject) => {
+    return new Promise((resolve9, reject) => {
       if (!this.process?.stdin?.writable) {
         return reject(new Error(`MCP server [${this.serverId}] stdin not writable`));
       }
@@ -10611,7 +10917,7 @@ var McpClient = class {
       this.pendingRequests.set(id, {
         resolve: (result) => {
           cleanup();
-          resolve8(result);
+          resolve9(result);
         },
         reject: (error) => {
           cleanup();
@@ -10688,13 +10994,13 @@ var McpClient = class {
   }
   /** Promise 超时包装 */
   withTimeout(promise, ms, label) {
-    return new Promise((resolve8, reject) => {
+    return new Promise((resolve9, reject) => {
       const timer = setTimeout(() => {
         reject(new Error(`MCP [${this.serverId}] ${label} timed out after ${ms}ms`));
       }, ms);
       promise.then((val) => {
         clearTimeout(timer);
-        resolve8(val);
+        resolve9(val);
       }).catch((err) => {
         clearTimeout(timer);
         reject(err);
@@ -11126,6 +11432,7 @@ var SkillManager = class {
 
 // src/web/tool-executor-web.ts
 import { randomUUID as randomUUID2 } from "crypto";
+import { tmpdir as tmpdir2 } from "os";
 import { existsSync as existsSync17, readFileSync as readFileSync12 } from "fs";
 var ToolExecutorWeb = class _ToolExecutorWeb {
   constructor(registry, ws) {
@@ -11137,6 +11444,11 @@ var ToolExecutorWeb = class _ToolExecutorWeb {
   hookConfig;
   permissionRules = [];
   defaultPermission = "confirm";
+  permissionProfileName = "legacy";
+  permissionProfile;
+  allowedPermissionProfiles = [];
+  workspaceRoot = process.cwd();
+  networkPolicy;
   /** Pending confirm promises keyed by requestId */
   pendingConfirms = /* @__PURE__ */ new Map();
   /** Pending batch confirm promises */
@@ -11171,6 +11483,11 @@ var ToolExecutorWeb = class _ToolExecutorWeb {
     this.hookConfig = opts.hookConfig;
     if (opts.permissionRules) this.permissionRules = opts.permissionRules;
     if (opts.defaultPermission) this.defaultPermission = opts.defaultPermission;
+    if (opts.permissionProfileName) this.permissionProfileName = opts.permissionProfileName;
+    if (opts.permissionProfile) this.permissionProfile = opts.permissionProfile;
+    if (opts.allowedPermissionProfiles) this.allowedPermissionProfiles = opts.allowedPermissionProfiles;
+    if (opts.workspaceRoot) this.workspaceRoot = opts.workspaceRoot;
+    if (opts.networkPolicy) this.networkPolicy = opts.networkPolicy;
   }
   /** Clear M7 timeout timer for a requestId */
   clearPendingTimer(requestId) {
@@ -11182,33 +11499,33 @@ var ToolExecutorWeb = class _ToolExecutorWeb {
   }
   /** Resolve a pending confirm from client response */
   resolveConfirm(requestId, approved) {
-    const resolve8 = this.pendingConfirms.get(requestId);
-    if (resolve8) {
+    const resolve9 = this.pendingConfirms.get(requestId);
+    if (resolve9) {
       this.clearPendingTimer(requestId);
       this.pendingConfirms.delete(requestId);
       this.confirming = false;
-      resolve8(approved);
+      resolve9(approved);
     }
   }
   /** Resolve a pending batch confirm from client response */
   resolveBatchConfirm(requestId, decision) {
-    const resolve8 = this.pendingBatchConfirms.get(requestId);
-    if (resolve8) {
+    const resolve9 = this.pendingBatchConfirms.get(requestId);
+    if (resolve9) {
       this.clearPendingTimer(requestId);
       this.pendingBatchConfirms.delete(requestId);
       this.confirming = false;
       if (decision === "all" || decision === "none") {
-        resolve8(decision);
+        resolve9(decision);
       } else {
-        resolve8(new Set(decision));
+        resolve9(new Set(decision));
       }
     }
   }
   /** Cancel all pending confirms (e.g., on disconnect) */
   cancelAll() {
-    for (const resolve8 of this.pendingConfirms.values()) resolve8(false);
+    for (const resolve9 of this.pendingConfirms.values()) resolve9(false);
     this.pendingConfirms.clear();
-    for (const resolve8 of this.pendingBatchConfirms.values()) resolve8("none");
+    for (const resolve9 of this.pendingBatchConfirms.values()) resolve9("none");
     this.pendingBatchConfirms.clear();
     this.confirming = false;
   }
@@ -11219,6 +11536,7 @@ var ToolExecutorWeb = class _ToolExecutorWeb {
   }
   sendToolCallStart(call) {
     const dangerLevel = getDangerLevel(call.name, call.arguments);
+    let toolCallStarted = false;
     const startTime = Date.now();
     this.toolStartTimes.set(call.id, startTime);
     const msg = {
@@ -11284,8 +11602,8 @@ var ToolExecutorWeb = class _ToolExecutorWeb {
       diff: this.getDiffPreview(call)
     };
     this.send(msg);
-    return new Promise((resolve8) => {
-      this.pendingConfirms.set(requestId, resolve8);
+    return new Promise((resolve9) => {
+      this.pendingConfirms.set(requestId, resolve9);
       this.pendingTimers.set(requestId, setTimeout(() => {
         if (this.pendingConfirms.has(requestId)) {
           this.resolveConfirm(requestId, false);
@@ -11309,8 +11627,8 @@ var ToolExecutorWeb = class _ToolExecutorWeb {
       files
     };
     this.send(msg);
-    return new Promise((resolve8) => {
-      this.pendingBatchConfirms.set(requestId, resolve8);
+    return new Promise((resolve9) => {
+      this.pendingBatchConfirms.set(requestId, resolve9);
       this.pendingTimers.set(requestId, setTimeout(() => {
         if (this.pendingBatchConfirms.has(requestId)) {
           this.resolveBatchConfirm(requestId, "none");
@@ -11327,30 +11645,66 @@ var ToolExecutorWeb = class _ToolExecutorWeb {
       return { callId: call.id, content: `Unknown tool: ${call.name}`, isError: true };
     }
     const dangerLevel = getDangerLevel(call.name, call.arguments);
+    let toolCallStarted = false;
     runHook(this.hookConfig?.preToolExecution, {
       tool: call.name,
       dangerLevel,
       args: JSON.stringify(call.arguments).slice(0, 200)
     });
-    if (this.permissionRules.length > 0) {
-      const action = checkPermission(call.name, call.arguments, dangerLevel, this.permissionRules, this.defaultPermission);
-      if (action === "deny") {
-        return { callId: call.id, content: `[Permission denied] Tool ${call.name} is blocked by permission rules. Do not retry.`, isError: true };
+    const permission = checkPermissionWithProfile(
+      call.name,
+      call.arguments,
+      dangerLevel,
+      this.permissionRules,
+      this.defaultPermission,
+      {
+        profileName: this.permissionProfileName,
+        profile: this.permissionProfile,
+        allowedProfiles: this.allowedPermissionProfiles,
+        workspaceRoot: this.workspaceRoot,
+        tempDirs: [tmpdir2()]
       }
-      if (action === "auto-approve") {
-        this.sendToolCallStart(call);
-        try {
-          const rawContent = await runTool(tool, call.arguments, call.name);
-          const content = truncateOutput(rawContent, call.name);
-          this.sendToolCallResult(call, rawContent, false);
-          runHook(this.hookConfig?.postToolExecution, { tool: call.name, status: "ok" });
-          return { callId: call.id, content, isError: false };
-        } catch (err) {
-          const message = err instanceof Error ? err.message : String(err);
-          this.sendToolCallResult(call, message, true);
-          runHook(this.hookConfig?.postToolExecution, { tool: call.name, status: "error" });
-          return { callId: call.id, content: message, isError: true };
-        }
+    );
+    const networkPermission = checkNetworkPolicy(call.name, call.arguments, this.networkPolicy);
+    if (networkPermission?.action === "deny") {
+      const reason = networkPermission.reason ? ` (${networkPermission.reason})` : "";
+      return {
+        callId: call.id,
+        content: `[Permission denied] Tool ${call.name} is blocked by networkPolicy${reason}. Do not retry.`,
+        isError: true
+      };
+    }
+    if (permission.action === "deny") {
+      const reason = permission.reason ? ` (${permission.reason})` : "";
+      return {
+        callId: call.id,
+        content: `[Permission denied] Tool ${call.name} is blocked by permission profile "${permission.profileName}"${reason}. Do not retry.`,
+        isError: true
+      };
+    }
+    if (permission.action === "auto-approve" && networkPermission?.action !== "confirm") {
+      this.sendToolCallStart(call);
+      try {
+        const rawContent = await runTool(tool, call.arguments, call.name);
+        const content = truncateOutput(rawContent, call.name);
+        this.sendToolCallResult(call, rawContent, false);
+        runHook(this.hookConfig?.postToolExecution, { tool: call.name, status: "ok" });
+        return { callId: call.id, content, isError: false };
+      } catch (err) {
+        const message = err instanceof Error ? err.message : String(err);
+        this.sendToolCallResult(call, message, true);
+        runHook(this.hookConfig?.postToolExecution, { tool: call.name, status: "error" });
+        return { callId: call.id, content: message, isError: true };
+      }
+    }
+    if (networkPermission?.action === "confirm" && dangerLevel === "safe") {
+      this.sendToolCallStart(call);
+      toolCallStarted = true;
+      const confirmed = await this.confirm(call, "write");
+      if (!confirmed) {
+        const rejectionMsg = `[User cancelled] The user declined network access for ${call.name}. Do not retry without asking.`;
+        this.sendToolCallResult(call, rejectionMsg, true);
+        return { callId: call.id, content: rejectionMsg, isError: true };
       }
     }
     this.sendToolCallStart(call);
@@ -11409,6 +11763,9 @@ var ToolExecutorWeb = class _ToolExecutorWeb {
     return results;
   }
   async executeBatchFileWrites(items) {
+    if (this.permissionProfileName !== "legacy" || this.permissionRules.length > 0) {
+      return Promise.all(items.map(({ call }) => this.execute(call)));
+    }
     const calls = items.map((i) => i.call);
     const decision = this.sessionAutoApprove ? "all" : await this.batchConfirm(calls);
     const results = new Array(calls.length);
@@ -11737,7 +12094,7 @@ function autoTrimSessionIfNeeded(session, sizeLimit = SESSION_SIZE_LIMIT) {
 
 // src/core/context-files.ts
 import { existsSync as existsSync20, readFileSync as readFileSync15 } from "fs";
-import { join as join13, relative as relative3, resolve as resolve5 } from "path";
+import { join as join13, relative as relative3, resolve as resolve6 } from "path";
 function uniqueNonEmpty(values) {
   const seen = /* @__PURE__ */ new Set();
   const out = [];
@@ -11760,7 +12117,7 @@ function displayPath(filePath, cwd) {
   return filePath;
 }
 function isInsideOrEqual(parent, child) {
-  const rel = relative3(resolve5(parent), resolve5(child));
+  const rel = relative3(resolve6(parent), resolve6(child));
   return rel === "" || !!rel && !rel.startsWith("..") && !rel.startsWith("/") && !rel.startsWith("\\");
 }
 function readContextFile(level, filePath, cwd, maxBytes) {
@@ -11823,7 +12180,7 @@ function findFirstContextFile(level, dir, cwd, candidates, maxBytes) {
   return { layer: null, skipped };
 }
 function loadContextFiles(options) {
-  const cwd = resolve5(options.cwd);
+  const cwd = resolve6(options.cwd);
   const maxBytes = options.maxBytes ?? CONTEXT_FILE_MAX_BYTES;
   const candidates = options.candidates ?? buildContextFileCandidates(options.fallbackFilenames);
   const skipped = [];
@@ -11831,7 +12188,7 @@ function loadContextFiles(options) {
     return { layers: [], mergedContent: "", skipped, totalChars: 0, totalBytes: 0, maxBytes, candidates };
   }
   if (options.setting && options.setting !== "auto") {
-    const filePath = resolve5(cwd, String(options.setting));
+    const filePath = resolve6(cwd, String(options.setting));
     if (!isInsideOrEqual(cwd, filePath)) {
       skipped.push({
         level: "single",
@@ -11875,7 +12232,7 @@ function loadContextFiles(options) {
     skipped.push(...result.skipped);
     if (result.layer) layers.push(result.layer);
   }
-  if (resolve5(options.cwd) !== resolve5(options.projectRoot)) {
+  if (resolve6(options.cwd) !== resolve6(options.projectRoot)) {
     const result = findFirstContextFile("local", options.cwd, cwd, candidates, maxBytes);
     skipped.push(...result.skipped);
     if (result.layer) layers.push(result.layer);
@@ -11894,7 +12251,7 @@ function loadContextFiles(options) {
 
 // src/web/session-handler.ts
 import { existsSync as existsSync23, readFileSync as readFileSync17, writeFileSync as writeFileSync2, mkdirSync as mkdirSync10, readdirSync as readdirSync10, statSync as statSync9, createWriteStream } from "fs";
-import { join as join17, resolve as resolve6, dirname as dirname5 } from "path";
+import { join as join17, resolve as resolve7, dirname as dirname5 } from "path";
 
 // src/tools/git-context.ts
 import { execSync as execSync2 } from "child_process";
@@ -12953,7 +13310,22 @@ var SessionHandler = class {
     const hooks = this.config.get("hooks");
     const permissionRules = this.config.get("permissionRules");
     const defaultPermission = this.config.get("defaultPermission");
-    this.toolExecutor.setConfig({ hookConfig: hooks, permissionRules, defaultPermission });
+    const permissionProfileName = this.config.get("defaultPermissionProfile") ?? "legacy";
+    const permissionProfiles = this.config.get("permissionProfiles") ?? {};
+    this.toolExecutor.setConfig({
+      hookConfig: hooks,
+      permissionRules,
+      defaultPermission,
+      permissionProfileName,
+      permissionProfile: permissionProfiles[permissionProfileName],
+      allowedPermissionProfiles: this.config.get("allowedPermissionProfiles") ?? [],
+      workspaceRoot: process.cwd(),
+      networkPolicy: this.config.get("networkPolicy")
+    });
+    const permissionProfileWarning = formatPermissionProfileWarning(permissionProfileName);
+    if (permissionProfileWarning) {
+      this.send({ type: "info", message: permissionProfileWarning });
+    }
     this.sendStatus();
     askUserContext.rl = null;
     askUserContext.prompting = false;
@@ -12988,6 +13360,7 @@ var SessionHandler = class {
       messageCount: this.sessions.current?.messages.length ?? 0,
       planMode: this.planMode,
       thinkingMode: this.runtimeThinking ?? false,
+      permissionProfile: this.config.get("defaultPermissionProfile") ?? "legacy",
       tokenUsage: { ...this.sessionTokenUsage },
       costUsd,
       providers: providerList,
@@ -13016,10 +13389,10 @@ var SessionHandler = class {
         return;
       }
       case "ask_user_response": {
-        const resolve8 = this.pendingAskUser.get(msg.requestId);
-        if (resolve8) {
+        const resolve9 = this.pendingAskUser.get(msg.requestId);
+        if (resolve9) {
           this.pendingAskUser.delete(msg.requestId);
-          resolve8(msg.answer);
+          resolve9(msg.answer);
         }
         return;
       }
@@ -13030,10 +13403,10 @@ var SessionHandler = class {
       case "memory_rebuild":
         return this.handleMemoryRebuild(Boolean(msg.full));
       case "auto_pause_response": {
-        const resolve8 = this.pendingAutoPause.get(msg.requestId);
-        if (resolve8) {
+        const resolve9 = this.pendingAutoPause.get(msg.requestId);
+        if (resolve9) {
           this.pendingAutoPause.delete(msg.requestId);
-          resolve8({ action: msg.action, message: msg.message });
+          resolve9({ action: msg.action, message: msg.message });
         }
         return;
       }
@@ -13048,10 +13421,10 @@ var SessionHandler = class {
         this.hubOrchestrator?.abort();
         return;
       case "hub_steer": {
-        const resolve8 = this.pendingHubReview.get(msg.requestId);
-        if (resolve8) {
+        const resolve9 = this.pendingHubReview.get(msg.requestId);
+        if (resolve9) {
           this.pendingHubReview.delete(msg.requestId);
-          resolve8({ action: msg.action, message: msg.message });
+          resolve9({ action: msg.action, message: msg.message });
         }
         return;
       }
@@ -13063,9 +13436,9 @@ var SessionHandler = class {
   onDisconnect() {
     this.toolExecutor.cancelAll();
     if (this.abortController) this.abortController.abort();
-    for (const resolve8 of this.pendingAskUser.values()) resolve8(null);
+    for (const resolve9 of this.pendingAskUser.values()) resolve9(null);
     this.pendingAskUser.clear();
-    for (const resolve8 of this.pendingAutoPause.values()) resolve8({ action: "stop" });
+    for (const resolve9 of this.pendingAutoPause.values()) resolve9({ action: "stop" });
     this.pendingAutoPause.clear();
     this.saveIfNeeded();
   }
@@ -13199,9 +13572,9 @@ var SessionHandler = class {
     this.hubOrchestrator = orchestrator;
     orchestrator.onEvent = (event) => this.send({ type: "hub_event", event });
     if (config.humanSteer) {
-      orchestrator.onRoundReview = ({ round, maxRounds }) => new Promise((resolve8) => {
+      orchestrator.onRoundReview = ({ round, maxRounds }) => new Promise((resolve9) => {
         const requestId = `hubrev_${Date.now()}_${Math.random().toString(36).slice(2, 8)}`;
-        this.pendingHubReview.set(requestId, resolve8);
+        this.pendingHubReview.set(requestId, resolve9);
         this.send({ type: "hub_review", requestId, round, maxRounds });
       });
     }
@@ -13538,8 +13911,8 @@ Try: /compact to reduce context, /clear to reset, or switch to a larger-context
         onMcpToolUsed: (name) => this.usedMcpToolNames.add(name),
         requestAutoPause: async ({ effectiveRound, maxToolRounds: totalRounds, toolSummary }) => {
           const requestId = `pause_${Date.now()}_${Math.random().toString(36).slice(2, 8)}`;
-          const pauseResp = await new Promise((resolve8) => {
-            this.pendingAutoPause.set(requestId, resolve8);
+          const pauseResp = await new Promise((resolve9) => {
+            this.pendingAutoPause.set(requestId, resolve9);
             this.send({
               type: "auto_pause_request",
               requestId,
@@ -13718,8 +14091,8 @@ ${summaryContent}`,
         }
         if (chunk.done) break;
       }
-      await new Promise((resolve8, reject) => {
-        fileStream.end((err) => err ? reject(err) : resolve8());
+      await new Promise((resolve9, reject) => {
+        fileStream.end((err) => err ? reject(err) : resolve9());
       });
       const verdict = evaluateTeeContent(fullContent, saveToFile, priorContent);
       if (verdict.kind === "reject") {
@@ -13745,7 +14118,7 @@ ${summaryContent}`,
     } catch (err) {
       if (fileStream) {
         try {
-          await new Promise((resolve8) => fileStream.end(() => resolve8()));
+          await new Promise((resolve9) => fileStream.end(() => resolve9()));
         } catch {
         }
       }
@@ -14378,7 +14751,7 @@ ${undoResults.map((r) => `  \u2022 ${r}`).join("\n")}` });
           break;
         }
         const sub = args[0]?.toLowerCase();
-        const resolve8 = (ref) => {
+        const resolve9 = (ref) => {
           const r = session.resolveBranchRef(ref);
           if (r.ok) return r.id;
           if (r.reason === "ambiguous") {
@@ -14432,7 +14805,7 @@ ${undoResults.map((r) => `  \u2022 ${r}`).join("\n")}` });
             this.send({ type: "error", message: "Usage: /branch switch <id|title>" });
             break;
           }
-          const id = resolve8(ref);
+          const id = resolve9(ref);
           if (!id) break;
           const ok = session.switchBranch(id);
           if (ok) {
@@ -14452,7 +14825,7 @@ ${undoResults.map((r) => `  \u2022 ${r}`).join("\n")}` });
             this.send({ type: "error", message: "Usage: /branch delete <id|title>" });
             break;
           }
-          const id = resolve8(ref);
+          const id = resolve9(ref);
           if (!id) break;
           const ok = session.deleteBranch(id);
           if (ok) {
@@ -14471,7 +14844,7 @@ ${undoResults.map((r) => `  \u2022 ${r}`).join("\n")}` });
             this.send({ type: "error", message: "Usage: /branch rename <id|title> <new title>" });
             break;
           }
-          const id = resolve8(ref);
+          const id = resolve9(ref);
           if (!id) break;
           const ok = session.renameBranch(id, title);
           if (ok) {
@@ -14489,7 +14862,7 @@ ${undoResults.map((r) => `  \u2022 ${r}`).join("\n")}` });
             this.send({ type: "error", message: "Usage: /branch diff <id|title>" });
             break;
           }
-          const id = resolve8(ref);
+          const id = resolve9(ref);
           if (!id) break;
           const d = session.diffBranches(id);
           if (!d) {
@@ -14531,7 +14904,7 @@ ${undoResults.map((r) => `  \u2022 ${r}`).join("\n")}` });
             this.send({ type: "error", message: "Usage: /branch cherry-pick <source-id|title> <msg-index>" });
             break;
           }
-          const id = resolve8(ref);
+          const id = resolve9(ref);
           if (!id) break;
           const idx = parseInt(idxStr, 10);
           if (Number.isNaN(idx)) {
@@ -14793,7 +15166,7 @@ ${undoResults.map((r) => `  \u2022 ${r}`).join("\n")}` });
       case "test": {
         this.send({ type: "info", message: "\u{1F9EA} Running tests..." });
         try {
-          const { executeTests } = await import("./run-tests-NT2UIUVB.js");
+          const { executeTests } = await import("./run-tests-PACN4UYX.js");
           const argStr = args.join(" ").trim();
           let testArgs = {};
           if (argStr) {
@@ -15044,7 +15417,7 @@ Use /add-dir remove to clear.` : "No directories added.\nUsage: /add-dir <path>
           this.send({ type: "info", message: "\u2713 All added directories removed from context." });
           break;
         }
-        const dirPath = resolve6(sub);
+        const dirPath = resolve7(sub);
         if (!existsSync23(dirPath)) {
           this.send({ type: "error", message: `Directory not found: ${dirPath}` });
           break;
@@ -15816,7 +16189,7 @@ function getModuleDir() {
     }
   } catch {
   }
-  return resolve7(".");
+  return resolve8(".");
 }
 async function startWebServer(options = {}) {
   const port = options.port ?? 3e3;
@@ -16033,8 +16406,8 @@ async function startWebServer(options = {}) {
     const prefix = req.query.prefix || "";
     const targetDir = join19(cwd, prefix);
     try {
-      const canonicalTarget = realpathSync(resolve7(targetDir));
-      const canonicalCwd = realpathSync(resolve7(cwd));
+      const canonicalTarget = realpathSync(resolve8(targetDir));
+      const canonicalCwd = realpathSync(resolve8(cwd));
       if (!canonicalTarget.startsWith(canonicalCwd + sep3) && canonicalTarget !== canonicalCwd) {
         res.json({ files: [] });
         return;
@@ -16113,10 +16486,10 @@ async function startWebServer(options = {}) {
       return;
     }
     const cwd = process.cwd();
-    const fullPath = resolve7(join19(cwd, filePath));
+    const fullPath = resolve8(join19(cwd, filePath));
     try {
       const canonicalFull = realpathSync(fullPath);
-      const canonicalCwd = realpathSync(resolve7(cwd));
+      const canonicalCwd = realpathSync(resolve8(cwd));
       if (!canonicalFull.startsWith(canonicalCwd + sep3) && canonicalFull !== canonicalCwd) {
         res.json({ error: "Access denied" });
         return;
@@ -16335,7 +16708,7 @@ async function startWebServer(options = {}) {
   });
   const MAX_PORT_ATTEMPTS = 10;
   let actualPort = port;
-  const result = await new Promise((resolve8, reject) => {
+  const result = await new Promise((resolve9, reject) => {
     const tryListen = (attempt) => {
       server.once("error", (err) => {
         if (err.code === "EADDRINUSE" && attempt < MAX_PORT_ATTEMPTS) {
@@ -16366,7 +16739,7 @@ async function startWebServer(options = {}) {
         }
         console.log(`   Press Ctrl+C to stop
 `);
-        resolve8({ port: actualPort, host, url });
+        resolve9({ port: actualPort, host, url });
       });
     };
     tryListen(1);