jinzd-ai-cli 0.4.210 → 0.4.212

package/dist/{chunk-NEPFADHX.js → chunk-N5LB3PPL.js}

@@ -5,10 +5,10 @@ import {
 } from "./chunk-T2NL5ZIA.js";
 import {
   runTestsTool
-} from "./chunk-E2ZWWE6Q.js";
+} from "./chunk-HX6N6QEY.js";
 import {
   runTool
-} from "./chunk-DJ35G5VO.js";
+} from "./chunk-IFZX26K7.js";
 import {
   getDangerLevel,
   isFileWriteTool,
@@ -26,7 +26,7 @@ import {
   SUBAGENT_ALLOWED_TOOLS,
   SUBAGENT_DEFAULT_MAX_ROUNDS,
   SUBAGENT_MAX_ROUNDS_LIMIT
-} from "./chunk-GRJNQJA5.js";
+} from "./chunk-GBBVCZ4W.js";
 import {
   fileCheckpoints
 } from "./chunk-4BKXL7SM.js";
@@ -1050,12 +1050,13 @@ ${content}`;
 };
 
 // src/tools/builtin/write-file.ts
-import { appendFileSync, mkdirSync } from "fs";
+import { appendFileSync, mkdirSync as mkdirSync2 } from "fs";
 import { dirname as dirname2 } from "path";
 
 // src/tools/executor.ts
 import chalk3 from "chalk";
-import { existsSync as existsSync4, readFileSync as readFileSync3 } from "fs";
+import { existsSync as existsSync5, readFileSync as readFileSync4 } from "fs";
+import { tmpdir } from "os";
 
 // src/core/readline-internal.ts
 function rlInternal(rl) {
@@ -1262,6 +1263,155 @@ function simpleDiff(oldLines, newLines) {
 
 // src/tools/hooks.ts
 import { execSync } from "child_process";
+import { createHash } from "crypto";
+import { existsSync as existsSync4, mkdirSync, readFileSync as readFileSync3 } from "fs";
+import { join } from "path";
+var TRUST_FILE = "hooks-trust.json";
+var DEFAULT_TIMEOUT_MS = 5e3;
+function asArray(entry) {
+  if (!entry) return [];
+  const raw = Array.isArray(entry) ? entry : [entry];
+  return raw.map((item) => typeof item === "string" ? { command: item } : item);
+}
+function hookTrustPath(configDir) {
+  return join(configDir, TRUST_FILE);
+}
+function loadHookTrustStore(configDir) {
+  const file = hookTrustPath(configDir);
+  if (!existsSync4(file)) return { records: [] };
+  try {
+    const parsed = JSON.parse(readFileSync3(file, "utf-8"));
+    return { records: Array.isArray(parsed.records) ? parsed.records : [] };
+  } catch {
+    return { records: [] };
+  }
+}
+function saveHookTrustStore(configDir, store) {
+  mkdirSync(configDir, { recursive: true });
+  atomicWriteFileSync(hookTrustPath(configDir), JSON.stringify(store, null, 2));
+}
+function hashHook(event, command) {
+  return createHash("sha256").update(`${event}
+${command}`, "utf-8").digest("hex");
+}
+function isTrusted(source, event, hash, store) {
+  if (source === "user" || source === "managed") return true;
+  return store.records.some((r) => r.source === source && r.event === event && r.hash === hash);
+}
+function listHooks(config, configDir) {
+  if (!config || config.enabled === false) return [];
+  const store = loadHookTrustStore(configDir);
+  const out = [];
+  const push = (event, hook, index) => {
+    if (!hook.command) return;
+    const source = hook.source ?? "user";
+    const hash = hashHook(event, hook.command);
+    out.push({
+      id: `${event}:${index}`,
+      event,
+      command: hook.command,
+      source,
+      hash,
+      trusted: isTrusted(source, event, hash, store),
+      disabled: hook.disabled === true,
+      description: hook.description
+    });
+  };
+  if (config.preToolExecution) push("PreToolUse", { command: config.preToolExecution }, 0);
+  if (config.postToolExecution) push("PostToolUse", { command: config.postToolExecution }, 0);
+  for (const [event, entry] of Object.entries(config.events ?? {})) {
+    asArray(entry).forEach((hook, i) => push(event, hook, i));
+  }
+  return out;
+}
+function trustHook(configDir, hook) {
+  const store = loadHookTrustStore(configDir);
+  const next = store.records.filter((r) => !(r.source === hook.source && r.event === hook.event && r.id === hook.id));
+  next.push({ id: hook.id, event: hook.event, source: hook.source, hash: hook.hash, trustedAt: (/* @__PURE__ */ new Date()).toISOString() });
+  saveHookTrustStore(configDir, { records: next });
+}
+function untrustHook(configDir, hook) {
+  const store = loadHookTrustStore(configDir);
+  saveHookTrustStore(configDir, {
+    records: store.records.filter((r) => !(r.source === hook.source && r.event === hook.event && r.hash === hook.hash))
+  });
+}
+function getPendingHookTrust(config, configDir) {
+  return listHooks(config, configDir).filter((h) => h.source === "project" && !h.disabled && !h.trusted);
+}
+function normalizeDecision(value, hook) {
+  if (!value || typeof value !== "object") return null;
+  const obj = value;
+  const action = obj.action;
+  if (action !== "allow" && action !== "deny" && action !== "ask") return null;
+  return {
+    action,
+    reason: typeof obj.reason === "string" ? obj.reason : void 0,
+    prompt: typeof obj.prompt === "string" ? obj.prompt : void 0,
+    contextAppend: typeof obj.contextAppend === "string" ? obj.contextAppend : void 0,
+    warning: typeof obj.warning === "string" ? obj.warning : void 0,
+    warnings: Array.isArray(obj.warnings) ? obj.warnings.filter((x) => typeof x === "string") : void 0,
+    hook
+  };
+}
+function runStructuredHook(hook, descriptor, payload) {
+  if (hook.disabled === true) return null;
+  const timeout = Math.max(100, Math.min(hook.timeoutMs ?? DEFAULT_TIMEOUT_MS, 3e4));
+  try {
+    const stdout = execSync(hook.command, {
+      timeout,
+      stdio: ["pipe", "pipe", "pipe"],
+      encoding: "utf-8",
+      env: {
+        ...process.env,
+        AICLI_HOOK_EVENT: payload.event,
+        AICLI_HOOK_EVENT_JSON: JSON.stringify(payload)
+      }
+    }).trim();
+    if (!stdout) return null;
+    return normalizeDecision(JSON.parse(stdout), descriptor);
+  } catch (err) {
+    process.stderr.write(`\u26A0 Hook failed: ${hook.command.slice(0, 100)}
+`);
+    if (hook.required) {
+      return { action: "deny", reason: err instanceof Error ? err.message : String(err), hook: descriptor };
+    }
+    return null;
+  }
+}
+function runLifecycleHooks(config, event, payload, opts) {
+  if (!config || config.enabled === false) return [];
+  const options = typeof opts === "string" ? { configDir: opts } : opts;
+  const store = loadHookTrustStore(options.configDir);
+  const hooks = asArray(config.events?.[event]);
+  const decisions = [];
+  for (let i = 0; i < hooks.length; i++) {
+    const hook = hooks[i];
+    if (!hook.command || hook.disabled) continue;
+    const source = hook.source ?? "user";
+    const hash = hashHook(event, hook.command);
+    const descriptor = {
+      id: `${event}:${i}`,
+      event,
+      command: hook.command,
+      source,
+      hash,
+      trusted: isTrusted(source, event, hash, store),
+      disabled: false,
+      description: hook.description
+    };
+    if (!descriptor.trusted) {
+      options.onSummary?.(`hook skipped: ${event} project hook requires trust (${hash.slice(0, 12)})`);
+      continue;
+    }
+    const decision = runStructuredHook(hook, descriptor, { event, ...payload });
+    if (decision) {
+      decisions.push(decision);
+      options.onSummary?.(`hook ${event}: ${decision.action}${decision.reason ? ` (${decision.reason})` : ""}`);
+    }
+  }
+  return decisions;
+}
 function rewriteTemplate(template, isWindows) {
   const ref = (name) => isWindows ? `%${name}%` : `$${name}`;
   return template.replace(/\{tool\}/g, ref("AICLI_HOOK_TOOL")).replace(/\{dangerLevel\}/g, ref("AICLI_HOOK_DANGER_LEVEL")).replace(/\{args\}/g, ref("AICLI_HOOK_ARGS")).replace(/\{status\}/g, ref("AICLI_HOOK_STATUS"));
@@ -1272,7 +1422,7 @@ function runHook(template, vars) {
   const cmd = rewriteTemplate(template, isWindows);
   try {
     execSync(cmd, {
-      timeout: 5e3,
+      timeout: DEFAULT_TIMEOUT_MS,
       stdio: ["pipe", "pipe", "pipe"],
       encoding: "utf-8",
       env: {
@@ -1290,6 +1440,7 @@ function runHook(template, vars) {
 }
 
 // src/tools/permissions.ts
+import { isAbsolute, resolve as resolve3 } from "path";
 function checkPermission(toolName, args, dangerLevel, rules, defaultAction = "confirm") {
   for (const rule of rules) {
     if (rule.tool !== "*" && rule.tool !== toolName) continue;
@@ -1310,6 +1461,225 @@ function checkPermission(toolName, args, dangerLevel, rules, defaultAction = "co
   }
   return defaultAction;
 }
+var BUILTIN_PROFILE_NAMES = /* @__PURE__ */ new Set(["legacy", "read-only", "workspace-write", "danger-full-access"]);
+var READ_ONLY_TOOLS = /* @__PURE__ */ new Set([
+  "read_file",
+  "list_dir",
+  "grep_files",
+  "glob_files",
+  "find_symbol",
+  "get_outline",
+  "find_references",
+  "search_code",
+  "git_status",
+  "git_diff",
+  "git_log",
+  "task_list",
+  "web_fetch",
+  "web_search",
+  "google_search",
+  "ask_user",
+  "write_todos",
+  "recall_memory"
+]);
+function normalizePathForPermission(value) {
+  return value.replace(/\\/g, "/").replace(/\/+$/, "").toLowerCase();
+}
+function isInsidePath(root, target) {
+  const absoluteTarget = isAbsolute(target) ? target : resolve3(root, target);
+  const r = normalizePathForPermission(resolve3(root));
+  const t = normalizePathForPermission(absoluteTarget);
+  return t === r || t.startsWith(`${r}/`);
+}
+function extractPathArg(toolName, args) {
+  const raw = args["path"] ?? args["filePath"] ?? args["notebook_path"];
+  if (typeof raw === "string" && raw.trim()) return raw.trim();
+  if (toolName === "save_last_response") {
+    const output = args["outputPath"] ?? args["file"] ?? args["path"];
+    if (typeof output === "string" && output.trim()) return output.trim();
+  }
+  return null;
+}
+function isExplicitFileWriteTool(toolName) {
+  return toolName === "write_file" || toolName === "edit_file" || toolName === "notebook_edit" || toolName === "save_last_response";
+}
+function resolveProfileName(ctx) {
+  const requested = ctx?.profileName ?? "legacy";
+  if (ctx?.allowedProfiles && ctx.allowedProfiles.length > 0 && !ctx.allowedProfiles.includes(requested)) {
+    return "legacy";
+  }
+  if (BUILTIN_PROFILE_NAMES.has(requested)) return requested;
+  const ext = ctx?.profile?.extends;
+  return ext && BUILTIN_PROFILE_NAMES.has(ext) ? ext : "legacy";
+}
+function getProfileRules(ctx) {
+  return ctx?.profile?.rules ?? [];
+}
+function getProfileDefaultAction(name, ctx) {
+  if (ctx?.profile?.defaultAction) return ctx.profile.defaultAction;
+  if (name === "danger-full-access") return "auto-approve";
+  return "confirm";
+}
+function getWorkspaceRoots(ctx) {
+  const roots = [ctx?.workspaceRoot, ...ctx?.profile?.workspaceRoots ?? []].filter((v) => typeof v === "string" && v.trim().length > 0);
+  return roots;
+}
+function getAllowedWriteRoots(ctx) {
+  const roots = [...getWorkspaceRoots(ctx)];
+  const allowTemp = ctx?.profile?.allowTemp !== false;
+  if (allowTemp) roots.push(...ctx?.tempDirs ?? []);
+  return roots.filter((v) => v.trim().length > 0);
+}
+function profileHardDecision(profileName, toolName, args, dangerLevel, ctx) {
+  if (profileName === "legacy") return null;
+  if (profileName === "read-only") {
+    const mcpReadOnly = toolName.startsWith("mcp__") && dangerLevel === "safe";
+    if (dangerLevel !== "safe" || !READ_ONLY_TOOLS.has(toolName) && !mcpReadOnly) {
+      return { action: "deny", reason: "blocked by read-only permission profile", profileName };
+    }
+    return null;
+  }
+  if (profileName === "workspace-write") {
+    if (dangerLevel === "destructive") return { action: "confirm", reason: "destructive tools always require confirmation", profileName };
+    if (dangerLevel === "write" && isExplicitFileWriteTool(toolName)) {
+      const target = extractPathArg(toolName, args);
+      if (!target) return { action: "confirm", reason: "file write target is not explicit", profileName };
+      const allowedRoots = getAllowedWriteRoots(ctx);
+      if (allowedRoots.length === 0 || !allowedRoots.some((root) => isInsidePath(root, target))) {
+        return { action: "deny", reason: "file write target is outside workspace/temp roots", profileName };
+      }
+    }
+    return null;
+  }
+  if (profileName === "danger-full-access") {
+    if (dangerLevel === "destructive") return { action: "confirm", reason: "destructive tools still require confirmation", profileName };
+    return null;
+  }
+  return null;
+}
+function checkPermissionWithProfile(toolName, args, dangerLevel, rules, defaultAction = "confirm", profileContext) {
+  const profileName = resolveProfileName(profileContext);
+  const hard = profileHardDecision(profileName, toolName, args, dangerLevel, profileContext);
+  if (hard?.action === "deny") return hard;
+  const combinedRules = [...getProfileRules(profileContext), ...rules];
+  const profileDefault = profileName === "legacy" ? defaultAction : getProfileDefaultAction(profileName, profileContext);
+  const action = checkPermission(toolName, args, dangerLevel, combinedRules, profileDefault);
+  if (hard?.action === "confirm" && action === "auto-approve") return hard;
+  return { action, profileName };
+}
+function formatPermissionProfileWarning(profileName) {
+  if (profileName === "danger-full-access") {
+    return "\u26A0 danger-full-access permission profile is active. Write tools may auto-run; destructive tools still require confirmation.";
+  }
+  if (profileName === "read-only") return "Read-only permission profile is active. Write and destructive tools are blocked.";
+  if (profileName === "workspace-write") return "Workspace-write permission profile is active. Writes outside workspace/temp roots are blocked.";
+  return null;
+}
+var NETWORK_TOOL_HOSTS = {
+  web_search: ["cn.bing.com", "www.google.com"],
+  google_search: ["www.googleapis.com"]
+};
+var NETWORK_TOOL_PORTS = {
+  web_search: [443],
+  google_search: [443]
+};
+function networkActionToPermission(action) {
+  if (action === "allow") return null;
+  return action;
+}
+function domainMatches(pattern, host) {
+  const p = pattern.trim().toLowerCase().replace(/^\*\./, "");
+  const h = host.trim().toLowerCase().replace(/:\d+$/, "");
+  return h === p || h.endsWith(`.${p}`);
+}
+function isPrivateNetworkHost(host) {
+  const h = host.toLowerCase().replace(/^\[|\]$/g, "");
+  if (h === "" || h === "localhost") return true;
+  if (/^(127|10)\./.test(h)) return true;
+  if (/^192\.168\./.test(h)) return true;
+  if (/^172\.(1[6-9]|2\d|3[0-1])\./.test(h)) return true;
+  if (/^169\.254\./.test(h)) return true;
+  if (h === "::1" || h === "::") return true;
+  if (/^f[cd][0-9a-f]*:/i.test(h) || /^fe[89ab][0-9a-f]*:/i.test(h)) return true;
+  return false;
+}
+function extractNetworkHosts(toolName, args) {
+  if (toolName === "web_fetch") {
+    const raw = String(args["url"] ?? "").trim();
+    try {
+      return raw ? [new URL(raw).hostname] : [];
+    } catch {
+      return [];
+    }
+  }
+  return NETWORK_TOOL_HOSTS[toolName] ?? [];
+}
+function extractNetworkPorts(toolName, args) {
+  if (toolName === "web_fetch") {
+    const raw = String(args["url"] ?? "").trim();
+    try {
+      if (!raw) return [];
+      const url = new URL(raw);
+      if (url.port) return [Number(url.port)];
+      return [url.protocol === "http:" ? 80 : 443];
+    } catch {
+      return [];
+    }
+  }
+  return NETWORK_TOOL_PORTS[toolName] ?? [];
+}
+function isShellNetworkCommand(command) {
+  return /\b(curl|wget|aria2c|Invoke-WebRequest|Invoke-RestMethod|iwr|irm|ssh|scp|sftp|ftp|telnet|nc|ncat|netcat)\b/i.test(command) || /\b(git\s+(clone|fetch|pull|push)|npm\s+(install|publish|view)|pnpm\s+(add|install)|yarn\s+(add|install)|pip\s+install|python\s+-m\s+pip\s+install)\b/i.test(command);
+}
+function networkToolAction(toolName, policy) {
+  if (toolName === "web_fetch") return policy.tools?.web_fetch ?? policy.defaultAction ?? "confirm";
+  if (toolName === "web_search") return policy.tools?.web_search ?? policy.defaultAction ?? "confirm";
+  if (toolName === "google_search") return policy.tools?.google_search ?? policy.defaultAction ?? "confirm";
+  if (toolName.startsWith("mcp__")) return policy.tools?.mcp ?? policy.defaultAction ?? "confirm";
+  return null;
+}
+function checkNetworkPolicy(toolName, args, policy) {
+  if (!policy?.enabled) return null;
+  let action = networkToolAction(toolName, policy);
+  let reason = "network access requires confirmation";
+  if (toolName === "bash") {
+    const command = String(args["command"] ?? "");
+    if (!isShellNetworkCommand(command)) return null;
+    action = policy.tools?.shell ?? policy.defaultAction ?? "confirm";
+    reason = "shell command may access the network";
+  }
+  if (!action) return null;
+  const hosts = extractNetworkHosts(toolName, args);
+  for (const host of hosts) {
+    if (policy.denyDomains?.some((pattern) => domainMatches(pattern, host))) {
+      return { action: "deny", reason: `network host "${host}" is denied by networkPolicy`, profileName: "networkPolicy" };
+    }
+    if (!policy.allowPrivateNetwork && isPrivateNetworkHost(host)) {
+      return { action: "deny", reason: `network host "${host}" is private/internal`, profileName: "networkPolicy" };
+    }
+  }
+  if (hosts.length > 0 && policy.allowDomains && policy.allowDomains.length > 0) {
+    const allAllowed = hosts.every((host) => policy.allowDomains.some((pattern) => domainMatches(pattern, host)));
+    if (!allAllowed) {
+      return { action: "deny", reason: `network host is not in networkPolicy.allowDomains`, profileName: "networkPolicy" };
+    }
+  }
+  const ports = extractNetworkPorts(toolName, args);
+  for (const port of ports) {
+    if (policy.denyPorts?.includes(port)) {
+      return { action: "deny", reason: `network port ${port} is denied by networkPolicy`, profileName: "networkPolicy" };
+    }
+  }
+  if (ports.length > 0 && policy.allowPorts && policy.allowPorts.length > 0) {
+    const allPortsAllowed = ports.every((port) => policy.allowPorts.includes(port));
+    if (!allPortsAllowed) {
+      return { action: "deny", reason: `network port is not in networkPolicy.allowPorts`, profileName: "networkPolicy" };
+    }
+  }
+  const permissionAction = networkActionToPermission(action);
+  if (!permissionAction) return null;
+  return { action: permissionAction, reason, profileName: "networkPolicy" };
+}
 
 // src/tools/truncate.ts
 var DEFAULT_MAX_TOOL_OUTPUT_CHARS = 12e3;
@@ -1564,11 +1934,23 @@ var ToolExecutor = class {
   /** 权限规则（可选） */
   permissionRules = [];
   defaultPermission = "confirm";
+  permissionProfileName = "legacy";
+  permissionProfile;
+  allowedPermissionProfiles = [];
+  workspaceRoot = process.cwd();
+  networkPolicy;
+  hookConfigDir = process.cwd();
   /** 注入 hooks 和 permission rules 配置 */
   setConfig(opts) {
     this.hookConfig = opts.hookConfig;
     if (opts.permissionRules) this.permissionRules = opts.permissionRules;
     if (opts.defaultPermission) this.defaultPermission = opts.defaultPermission;
+    if (opts.permissionProfileName) this.permissionProfileName = opts.permissionProfileName;
+    if (opts.permissionProfile) this.permissionProfile = opts.permissionProfile;
+    if (opts.allowedPermissionProfiles) this.allowedPermissionProfiles = opts.allowedPermissionProfiles;
+    if (opts.workspaceRoot) this.workspaceRoot = opts.workspaceRoot;
+    if (opts.networkPolicy) this.networkPolicy = opts.networkPolicy;
+    if (opts.hookConfigDir) this.hookConfigDir = opts.hookConfigDir;
   }
   async execute(call) {
     return runWithSessionKey(this.sessionKey, () => this.executeInner(call));
@@ -1583,31 +1965,97 @@ var ToolExecutor = class {
       };
     }
     const dangerLevel = getDangerLevel(call.name, call.arguments);
+    let toolCallAlreadyPrinted = false;
     runHook(this.hookConfig?.preToolExecution, {
       tool: call.name,
       dangerLevel,
       args: JSON.stringify(call.arguments).slice(0, 200)
     });
-    if (this.permissionRules.length > 0) {
-      const action = checkPermission(call.name, call.arguments, dangerLevel, this.permissionRules, this.defaultPermission);
-      if (action === "deny") {
-        return { callId: call.id, content: `[Permission denied] Tool ${call.name} is blocked by permission rules. Do not retry.`, isError: true };
+    const preToolDecisions = runLifecycleHooks(
+      this.hookConfig,
+      "PreToolUse",
+      { tool: call.name, dangerLevel, args: call.arguments },
+      { configDir: this.hookConfigDir, onSummary: (msg) => console.log(theme.dim(`  [hook] ${msg}`)) }
+    );
+    const preDeny = preToolDecisions.find((d) => d.action === "deny");
+    if (preDeny) {
+      return {
+        callId: call.id,
+        content: `[Hook denied] ${preDeny.reason ?? `PreToolUse blocked ${call.name}`}. Do not retry without asking.`,
+        isError: true
+      };
+    }
+    for (const d of preToolDecisions) {
+      const warnings = [d.warning, ...d.warnings ?? []].filter(Boolean);
+      for (const w of warnings) console.log(theme.warning(`  \u26A0 Hook warning: ${w}`));
+    }
+    const permission = checkPermissionWithProfile(
+      call.name,
+      call.arguments,
+      dangerLevel,
+      this.permissionRules,
+      this.defaultPermission,
+      {
+        profileName: this.permissionProfileName,
+        profile: this.permissionProfile,
+        allowedProfiles: this.allowedPermissionProfiles,
+        workspaceRoot: this.workspaceRoot,
+        tempDirs: [tmpdir()]
       }
-      if (action === "auto-approve") {
-        this.printToolCall(call);
-        try {
-          const rawContent = await runTool(tool, call.arguments, call.name);
-          const content = truncateOutput(rawContent, call.name);
-          const wasTruncated = content !== rawContent;
-          this.printToolResult(call.name, rawContent, false, wasTruncated);
-          runHook(this.hookConfig?.postToolExecution, { tool: call.name, status: "ok" });
-          return { callId: call.id, content, isError: false };
-        } catch (err) {
-          const message = err instanceof Error ? err.message : String(err);
-          this.printToolResult(call.name, message, true, false);
-          runHook(this.hookConfig?.postToolExecution, { tool: call.name, status: "error" });
-          return { callId: call.id, content: message, isError: true };
-        }
+    );
+    const networkPermission = checkNetworkPolicy(call.name, call.arguments, this.networkPolicy);
+    if (networkPermission?.action === "confirm" || permission.action === "confirm") {
+      runLifecycleHooks(
+        this.hookConfig,
+        "PermissionRequest",
+        { tool: call.name, dangerLevel, args: call.arguments, reason: networkPermission?.reason ?? permission.reason },
+        { configDir: this.hookConfigDir, onSummary: (msg) => console.log(theme.dim("  [hook] " + msg)) }
+      );
+    }
+    if (networkPermission?.action === "deny") {
+      const reason = networkPermission.reason ? ` (${networkPermission.reason})` : "";
+      return {
+        callId: call.id,
+        content: `[Permission denied] Tool ${call.name} is blocked by networkPolicy${reason}. Do not retry.`,
+        isError: true
+      };
+    }
+    if (permission.action === "deny") {
+      const reason = permission.reason ? ` (${permission.reason})` : "";
+      return {
+        callId: call.id,
+        content: `[Permission denied] Tool ${call.name} is blocked by permission profile "${permission.profileName}"${reason}. Do not retry.`,
+        isError: true
+      };
+    }
+    if (permission.action === "auto-approve" && networkPermission?.action !== "confirm") {
+      this.printToolCall(call);
+      try {
+        const rawContent = await runTool(tool, call.arguments, call.name);
+        const content = truncateOutput(rawContent, call.name);
+        const wasTruncated = content !== rawContent;
+        this.printToolResult(call.name, rawContent, false, wasTruncated);
+        runHook(this.hookConfig?.postToolExecution, { tool: call.name, status: "ok" });
+        runLifecycleHooks(this.hookConfig, "PostToolUse", { tool: call.name, status: "ok" }, { configDir: this.hookConfigDir });
+        return { callId: call.id, content, isError: false };
+      } catch (err) {
+        const message = err instanceof Error ? err.message : String(err);
+        this.printToolResult(call.name, message, true, false);
+        runHook(this.hookConfig?.postToolExecution, { tool: call.name, status: "error" });
+        runLifecycleHooks(this.hookConfig, "PostToolUse", { tool: call.name, status: "error", error: message }, { configDir: this.hookConfigDir });
+        return { callId: call.id, content: message, isError: true };
+      }
+    }
+    if (networkPermission?.action === "confirm" && dangerLevel === "safe") {
+      this.printToolCall(call);
+      toolCallAlreadyPrinted = true;
+      const confirmed = await this.confirm(call, "write");
+      if (!confirmed) {
+        return {
+          callId: call.id,
+          content: `[User cancelled] The user declined network access for ${call.name}. Do not retry without asking.`,
+          isError: true
+        };
       }
     }
     if (this.sessionAutoApprove && dangerLevel === "write") {
@@ -1620,11 +2068,13 @@ var ToolExecutor = class {
         const wasTruncated = content !== rawContent;
         this.printToolResult(call.name, rawContent, false, wasTruncated);
         runHook(this.hookConfig?.postToolExecution, { tool: call.name, status: "ok" });
+        runLifecycleHooks(this.hookConfig, "PostToolUse", { tool: call.name, status: "ok" }, { configDir: this.hookConfigDir });
         return { callId: call.id, content, isError: false };
       } catch (err) {
         const message = err instanceof Error ? err.message : String(err);
         this.printToolResult(call.name, message, true, false);
         runHook(this.hookConfig?.postToolExecution, { tool: call.name, status: "error" });
+        runLifecycleHooks(this.hookConfig, "PostToolUse", { tool: call.name, status: "error", error: message }, { configDir: this.hookConfigDir });
         return { callId: call.id, content: message, isError: true };
       }
     }
@@ -1658,11 +2108,13 @@ var ToolExecutor = class {
       const wasTruncated = content !== rawContent;
       this.printToolResult(call.name, rawContent, false, wasTruncated);
       runHook(this.hookConfig?.postToolExecution, { tool: call.name, status: "ok" });
+      runLifecycleHooks(this.hookConfig, "PostToolUse", { tool: call.name, status: "ok" }, { configDir: this.hookConfigDir });
       return { callId: call.id, content, isError: false };
     } catch (err) {
       const message = err instanceof Error ? err.message : String(err);
       this.printToolResult(call.name, message, true, false);
       runHook(this.hookConfig?.postToolExecution, { tool: call.name, status: "error" });
+      runLifecycleHooks(this.hookConfig, "PostToolUse", { tool: call.name, status: "error", error: message }, { configDir: this.hookConfigDir });
       return { callId: call.id, content: message, isError: true };
     }
   }
@@ -1697,6 +2149,9 @@ var ToolExecutor = class {
    * 然后让用户 approve all / reject all / 选择性 approve。
    */
   async executeBatchFileWrites(calls) {
+    if (this.permissionProfileName !== "legacy" || this.permissionRules.length > 0) {
+      return Promise.all(calls.map((call) => this.execute(call)));
+    }
     console.log();
     console.log(theme.heading(`\u270E Batch file writes (${calls.length} files):`));
     console.log(theme.dim("\u2500".repeat(50)));
@@ -1770,7 +2225,7 @@ var ToolExecutor = class {
     rl.resume();
     process.stdout.write(prompt);
     this.confirming = true;
-    return new Promise((resolve5) => {
+    return new Promise((resolve6) => {
       let completed = false;
       const cleanup = (result) => {
         if (completed) return;
@@ -1780,7 +2235,7 @@ var ToolExecutor = class {
         rl.pause();
         rlAny.output = savedOutput;
         this.confirming = false;
-        resolve5(result);
+        resolve6(result);
       };
       const onLine = (line) => {
         const trimmed = line.trim();
@@ -1847,10 +2302,10 @@ var ToolExecutor = class {
       const filePath = String(call.arguments["path"] ?? "");
       const newContent = String(call.arguments["content"] ?? "");
       if (!filePath) return;
-      if (existsSync4(filePath)) {
+      if (existsSync5(filePath)) {
         let oldContent;
         try {
-          oldContent = readFileSync3(filePath, "utf-8");
+          oldContent = readFileSync4(filePath, "utf-8");
         } catch {
           return;
         }
@@ -1873,7 +2328,7 @@ var ToolExecutor = class {
       }
     } else if (call.name === "edit_file") {
       const filePath = String(call.arguments["path"] ?? "");
-      if (!filePath || !existsSync4(filePath)) return;
+      if (!filePath || !existsSync5(filePath)) return;
       const oldStr = call.arguments["old_str"];
       const newStr = call.arguments["new_str"];
       if (oldStr !== void 0) {
@@ -1900,7 +2355,7 @@ var ToolExecutor = class {
         const to = Number(call.arguments["delete_to_line"] ?? from);
         let fileContent;
         try {
-          fileContent = readFileSync3(filePath, "utf-8");
+          fileContent = readFileSync4(filePath, "utf-8");
         } catch {
           return;
         }
@@ -1954,7 +2409,7 @@ var ToolExecutor = class {
     rl.resume();
     process.stdout.write(color("Proceed? [y/N] (type y + Enter to confirm) "));
     this.confirming = true;
-    return new Promise((resolve5) => {
+    return new Promise((resolve6) => {
       let completed = false;
       const cleanup = (answer) => {
         if (completed) return;
@@ -1964,7 +2419,7 @@ var ToolExecutor = class {
         rl.pause();
         rlAny.output = savedOutput;
         this.confirming = false;
-        resolve5(answer === "y");
+        resolve6(answer === "y");
       };
       const onLine = (line) => {
         const trimmed = line.trim();
@@ -1992,11 +2447,11 @@ var ToolExecutor = class {
 };
 
 // src/tools/sensitive-paths.ts
-import { resolve as resolve3, sep as sep2, basename as basename2 } from "path";
+import { resolve as resolve4, sep as sep2, basename as basename2 } from "path";
 import { homedir as homedir2 } from "os";
 var home = homedir2();
 function norm(p) {
-  const abs = resolve3(p);
+  const abs = resolve4(p);
   return process.platform === "win32" ? abs.toLowerCase() : abs;
 }
 function homeRel(p) {
@@ -2135,7 +2590,7 @@ Do NOT split a long document into many write_file(append=true) calls. That patte
     }
     undoStack.push(filePath, `write_file${appendMode ? " (append)" : ""}: ${filePath}`);
     fileCheckpoints.snapshot(filePath, ToolExecutor.currentMessageIndex);
-    mkdirSync(dirname2(filePath), { recursive: true });
+    mkdirSync2(dirname2(filePath), { recursive: true });
     if (appendMode) {
       appendFileSync(filePath, content, encoding);
     } else {
@@ -2155,7 +2610,7 @@ Do NOT split a long document into many write_file(append=true) calls. That patte
 };
 
 // src/tools/builtin/edit-file.ts
-import { readFileSync as readFileSync4, existsSync as existsSync5 } from "fs";
+import { readFileSync as readFileSync5, existsSync as existsSync6 } from "fs";
 
 // src/tools/builtin/patch-apply.ts
 function parseUnifiedDiff(patch) {
@@ -2516,7 +2971,7 @@ Note: Path can be absolute or relative to cwd.`,
     const filePath = String(args["path"] ?? "");
     const encoding = args["encoding"] ?? "utf-8";
     if (!filePath) throw new ToolError("edit_file", "path is required");
-    if (!existsSync5(filePath)) throw new ToolError("edit_file", `File not found: ${filePath}`);
+    if (!existsSync6(filePath)) throw new ToolError("edit_file", `File not found: ${filePath}`);
     const verdict = classifyWritePath(filePath);
     if (verdict.sensitive && subAgentGuard.active) {
       throw new ToolError(
@@ -2524,7 +2979,7 @@ Note: Path can be absolute or relative to cwd.`,
         `Refused: sub-agents cannot edit sensitive paths \u2014 ${verdict.reason}. If this is genuinely needed, ask the parent agent to perform the edit so the user can approve it.`
       );
     }
-    const original = readFileSync4(filePath, encoding);
+    const original = readFileSync5(filePath, encoding);
     if (args["patch"] !== void 0) {
       const patchText = String(args["patch"] ?? "");
       const stopOnError = args["stop_on_error"] !== false;
@@ -2682,8 +3137,8 @@ function truncatePreview(str, maxLen = 80) {
 }
 
 // src/tools/builtin/list-dir.ts
-import { readdirSync as readdirSync3, statSync as statSync3, existsSync as existsSync6 } from "fs";
-import { join, basename as basename3 } from "path";
+import { readdirSync as readdirSync3, statSync as statSync3, existsSync as existsSync7 } from "fs";
+import { join as join2, basename as basename3 } from "path";
 var listDirTool = {
   definition: {
     name: "list_dir",
@@ -2705,7 +3160,7 @@ var listDirTool = {
   async execute(args) {
     const dirPath = String(args["path"] ?? process.cwd());
     const recursive = Boolean(args["recursive"] ?? false);
-    if (!existsSync6(dirPath)) {
+    if (!existsSync7(dirPath)) {
       const targetName = basename3(dirPath).toLowerCase();
       const cwd = process.cwd();
       const suggestions = [];
@@ -2763,11 +3218,11 @@ function listRecursive(basePath, indent, recursive, lines) {
     if (entry.isDirectory()) {
       lines.push(`${indent}\u{1F4C1} ${entry.name}/`);
       if (recursive) {
-        listRecursive(join(basePath, entry.name), indent + "  ", true, lines);
+        listRecursive(join2(basePath, entry.name), indent + "  ", true, lines);
       }
     } else {
       try {
-        const stat = statSync3(join(basePath, entry.name));
+        const stat = statSync3(join2(basePath, entry.name));
         const size = formatSize(stat.size);
         lines.push(`${indent}\u{1F4C4} ${entry.name}  (${size})`);
       } catch {
@@ -2783,9 +3238,9 @@ function formatSize(bytes) {
 }
 
 // src/tools/builtin/grep-files.ts
-import { readdirSync as readdirSync4, readFileSync as readFileSync5, statSync as statSync4, existsSync as existsSync7 } from "fs";
+import { readdirSync as readdirSync4, readFileSync as readFileSync6, statSync as statSync4, existsSync as existsSync8 } from "fs";
 import { readFile } from "fs/promises";
-import { join as join2, relative } from "path";
+import { join as join3, relative } from "path";
 var grepFilesTool = {
   definition: {
     name: "grep_files",
@@ -2836,7 +3291,7 @@ Supports regex. Automatically skips node_modules, dist, .git directories.`,
     const contextLines = Math.max(0, Number(args["context_lines"] ?? 0));
     const maxResults = Math.max(1, Number(args["max_results"] ?? 50));
     if (!pattern) throw new ToolError("grep_files", "pattern is required");
-    if (!existsSync7(rootPath)) throw new ToolError("grep_files", `Path not found: ${rootPath}`);
+    if (!existsSync8(rootPath)) throw new ToolError("grep_files", `Path not found: ${rootPath}`);
     const MAX_PATTERN_LENGTH = 1e3;
     if (pattern.length > MAX_PATTERN_LENGTH) {
       throw new ToolError("grep_files", `Pattern too long (${pattern.length} chars, max ${MAX_PATTERN_LENGTH}). Use a shorter pattern.`);
@@ -2930,11 +3385,11 @@ function collectFilePaths(rootPath, filePattern, maxFiles) {
       if (paths.length >= maxFiles) return;
       if (entry.isDirectory()) {
         if (SKIP_DIRS.has(entry.name) || entry.name.startsWith(".")) continue;
-        walk(join2(dirPath, entry.name));
+        walk(join3(dirPath, entry.name));
       } else if (entry.isFile()) {
         if (isBinary(entry.name)) continue;
         if (filePattern && !matchesFilePattern(entry.name, filePattern)) continue;
-        const fullPath = join2(dirPath, entry.name);
+        const fullPath = join3(dirPath, entry.name);
         try {
           if (statSync4(fullPath).size > 1e6) continue;
         } catch {
@@ -2989,7 +3444,7 @@ function searchInFile(fullPath, displayPath, regex, contextLines, maxResults, re
   }
   let content;
   try {
-    content = readFileSync5(fullPath, "utf-8");
+    content = readFileSync6(fullPath, "utf-8");
   } catch {
     return;
   }
@@ -3020,8 +3475,8 @@ function searchInFile(fullPath, displayPath, regex, contextLines, maxResults, re
 }
 
 // src/tools/builtin/glob-files.ts
-import { readdirSync as readdirSync5, statSync as statSync5, existsSync as existsSync8 } from "fs";
-import { join as join3, relative as relative2, basename as basename4 } from "path";
+import { readdirSync as readdirSync5, statSync as statSync5, existsSync as existsSync9 } from "fs";
+import { join as join4, relative as relative2, basename as basename4 } from "path";
 var globFilesTool = {
   definition: {
     name: "glob_files",
@@ -3054,7 +3509,7 @@ Results sorted by most recent modification time. Automatically skips node_module
     const rootPath = String(args["path"] ?? process.cwd());
     const maxResults = Math.max(1, Number(args["max_results"] ?? 100));
     if (!pattern) throw new ToolError("glob_files", "pattern is required");
-    if (!existsSync8(rootPath)) throw new ToolError("glob_files", `Path not found: ${rootPath}`);
+    if (!existsSync9(rootPath)) throw new ToolError("glob_files", `Path not found: ${rootPath}`);
     const regex = globToRegex(pattern);
     const matches = [];
     collectMatchingFiles(rootPath, rootPath, regex, matches, maxResults);
@@ -3131,7 +3586,7 @@ function collectMatchingFiles(dirPath, rootPath, regex, results, maxResults) {
   }
   for (const entry of entries) {
     if (results.length >= maxResults) break;
-    const fullPath = join3(dirPath, entry.name);
+    const fullPath = join4(dirPath, entry.name);
     if (entry.isDirectory()) {
       if (SKIP_DIRS2.has(entry.name) || entry.name.startsWith(".")) continue;
       collectMatchingFiles(fullPath, rootPath, regex, results, maxResults);
@@ -3213,7 +3668,7 @@ var runInteractiveTool = {
       PYTHONDONTWRITEBYTECODE: "1"
     };
     const prefixWarnings = [argsTypeWarning, stdinTypeWarning].filter(Boolean).join("");
-    return new Promise((resolve5) => {
+    return new Promise((resolve6) => {
       const child = spawn2(executable, cmdArgs.map(String), {
         cwd: process.cwd(),
         env,
@@ -3246,22 +3701,22 @@ var runInteractiveTool = {
       setTimeout(writeNextLine, 400);
       const timer = setTimeout(() => {
         child.kill();
-        resolve5(`${prefixWarnings}[Timeout after ${timeout}ms]
+        resolve6(`${prefixWarnings}[Timeout after ${timeout}ms]
 ${buildOutput(stdout, stderr)}`);
       }, timeout);
       child.on("close", (code) => {
         clearTimeout(timer);
         const output = buildOutput(stdout, stderr);
         if (code !== 0 && code !== null) {
-          resolve5(`${prefixWarnings}Exit code ${code}:
+          resolve6(`${prefixWarnings}Exit code ${code}:
 ${output}`);
         } else {
-          resolve5(`${prefixWarnings}${output || "(no output)"}`);
+          resolve6(`${prefixWarnings}${output || "(no output)"}`);
         }
       });
       child.on("error", (err) => {
         clearTimeout(timer);
-        resolve5(
+        resolve6(
           `${prefixWarnings}Failed to start process "${executable}": ${err.message}
 Hint: On Windows, use the full path to the executable, e.g.:
   C:\\Users\\Jinzd\\anaconda3\\envs\\python312\\python.exe`
@@ -3871,7 +4326,7 @@ ${preamble}`;
 }
 
 // src/tools/builtin/save-last-response.ts
-import { mkdirSync as mkdirSync2, unlinkSync as unlinkSync2, rmdirSync as rmdirSync2 } from "fs";
+import { mkdirSync as mkdirSync3, unlinkSync as unlinkSync2, rmdirSync as rmdirSync2 } from "fs";
 import { dirname as dirname3 } from "path";
 var lastResponseStore = { content: "" };
 function cleanupRejectedTeeFile(filePath) {
@@ -3921,7 +4376,7 @@ Any of these triggers means use save_last_response, NOT write_file:
       throw new ToolError("save_last_response", "No content to save: AI has not produced any response yet, or the last response was empty.");
     }
     undoStack.push(filePath, `save_last_response: ${filePath}`);
-    mkdirSync2(dirname3(filePath), { recursive: true });
+    mkdirSync3(dirname3(filePath), { recursive: true });
     atomicWriteFileSync(filePath, content);
     const lines = content.split("\n").length;
     return `File saved: ${filePath} (${lines} lines, ${content.length} bytes)`;
@@ -3929,11 +4384,11 @@ Any of these triggers means use save_last_response, NOT write_file:
 };
 
 // src/tools/builtin/save-memory.ts
-import { existsSync as existsSync9, readFileSync as readFileSync6, statSync as statSync6, mkdirSync as mkdirSync3 } from "fs";
-import { join as join4 } from "path";
+import { existsSync as existsSync10, readFileSync as readFileSync7, statSync as statSync6, mkdirSync as mkdirSync4 } from "fs";
+import { join as join5 } from "path";
 import { homedir as homedir3 } from "os";
 function getMemoryFilePath() {
-  return join4(homedir3(), CONFIG_DIR_NAME, MEMORY_FILE_NAME);
+  return join5(homedir3(), CONFIG_DIR_NAME, MEMORY_FILE_NAME);
 }
 function formatTimestamp() {
   const now = /* @__PURE__ */ new Date();
@@ -3957,16 +4412,16 @@ var saveMemoryTool = {
     const content = String(args["content"] ?? "").trim();
     if (!content) throw new ToolError("save_memory", "content is required");
     const memoryPath = getMemoryFilePath();
-    const configDir = join4(homedir3(), CONFIG_DIR_NAME);
-    if (!existsSync9(configDir)) {
-      mkdirSync3(configDir, { recursive: true });
+    const configDir = join5(homedir3(), CONFIG_DIR_NAME);
+    if (!existsSync10(configDir)) {
+      mkdirSync4(configDir, { recursive: true });
     }
     const timestamp = formatTimestamp();
     const entry = `
 ## ${timestamp}
 ${content}
 `;
-    const previous = existsSync9(memoryPath) ? readFileSync6(memoryPath, "utf-8") : "";
+    const previous = existsSync10(memoryPath) ? readFileSync7(memoryPath, "utf-8") : "";
     atomicWriteFileSync(memoryPath, previous + entry);
     const byteSize = statSync6(memoryPath).size;
     return `Memory saved successfully. File size: ${byteSize} bytes in ${MEMORY_FILE_NAME}`;
@@ -4013,7 +4468,7 @@ function promptUser(rl, question) {
   console.log();
   console.log(chalk4.cyan("\u2753 ") + chalk4.bold(question));
   process.stdout.write(chalk4.cyan("> "));
-  return new Promise((resolve5) => {
+  return new Promise((resolve6) => {
     let completed = false;
     const cleanup = (answer) => {
       if (completed) return;
@@ -4023,7 +4478,7 @@ function promptUser(rl, question) {
       rl.pause();
       rlAny.output = savedOutput;
       askUserContext.prompting = false;
-      resolve5(answer);
+      resolve6(answer);
     };
     const onLine = (line) => {
       cleanup(line);
@@ -4503,11 +4958,27 @@ var spawnAgentTool = {
     if (!ctx.provider) {
       throw new ToolError("spawn_agent", "provider not initialized (context not injected)");
     }
+    const hookConfig = ctx.configManager?.get("hooks") ?? void 0;
+    const hookConfigDir = ctx.configManager?.getConfigDir() ?? process.cwd();
+    const taskCount = singleTask ? 1 : tasksArr.length;
+    const hookPayload = {
+      task: singleTask || void 0,
+      tasks: tasksArr.length > 0 ? tasksArr : void 0,
+      taskCount,
+      maxRounds
+    };
+    const startDecisions = runLifecycleHooks(hookConfig, "SubagentStart", hookPayload, hookConfigDir);
+    const startDeny = startDecisions.find((d) => d.action === "deny");
+    if (startDeny) {
+      throw new ToolError("spawn_agent", "SubagentStart hook denied: " + (startDeny.reason ?? "denied"));
+    }
+    let subagentStatus = "error";
     const guardWasActive = subAgentGuard.active;
     subAgentGuard.active = true;
     try {
       if (singleTask) {
         const { content, usage } = await runSubAgent(singleTask, maxRounds, null, ctx);
+        subagentStatus = "ok";
         return [
           "## Sub-Agent Result",
           "",
@@ -4536,8 +5007,10 @@ var spawnAgentTool = {
       });
       lines.push("---");
       lines.push(`Total token usage: ${totalIn} input, ${totalOut} output`);
+      subagentStatus = "ok";
       return lines.join("\n");
     } finally {
+      runLifecycleHooks(hookConfig, "SubagentStop", { ...hookPayload, status: subagentStatus }, hookConfigDir);
       subAgentGuard.active = guardWasActive;
     }
   }
@@ -4760,14 +5233,14 @@ var taskStopTool = {
 
 // src/tools/builtin/git-tools.ts
 import { execFileSync as execFileSync2 } from "child_process";
-import { existsSync as existsSync10 } from "fs";
-import { join as join5 } from "path";
+import { existsSync as existsSync11 } from "fs";
+import { join as join6 } from "path";
 function assertGitRepo(cwd) {
   let dir = cwd;
   const root = dir.split(/[\\/]/)[0] + (dir.includes("\\") ? "\\" : "/");
   while (dir && dir !== root) {
-    if (existsSync10(join5(dir, ".git"))) return;
-    const parent = join5(dir, "..");
+    if (existsSync11(join6(dir, ".git"))) return;
+    const parent = join6(dir, "..");
     if (parent === dir) break;
     dir = parent;
   }
@@ -5032,9 +5505,9 @@ ${commitOutput.trim()}`;
 };
 
 // src/tools/builtin/notebook-edit.ts
-import { readFileSync as readFileSync7, existsSync as existsSync11 } from "fs";
+import { readFileSync as readFileSync8, existsSync as existsSync12 } from "fs";
 import { writeFile } from "fs/promises";
-import { resolve as resolve4, extname as extname2 } from "path";
+import { resolve as resolve5, extname as extname2 } from "path";
 var notebookEditTool = {
   definition: {
     name: "notebook_edit",
@@ -5083,14 +5556,14 @@ var notebookEditTool = {
     if (!Number.isInteger(cellIndexRaw) || cellIndexRaw < 1) {
       throw new ToolError("notebook_edit", "cell_index must be a positive integer (1-based)");
     }
-    const absPath = resolve4(filePath);
+    const absPath = resolve5(filePath);
     if (extname2(absPath).toLowerCase() !== ".ipynb") {
       throw new ToolError("notebook_edit", "path must point to a .ipynb file");
     }
-    if (!existsSync11(absPath)) {
+    if (!existsSync12(absPath)) {
       throw new ToolError("notebook_edit", `Notebook not found: ${filePath}`);
     }
-    const raw = readFileSync7(absPath, "utf-8");
+    const raw = readFileSync8(absPath, "utf-8");
     const nb = parseNotebook(raw);
     const cellIdx0 = cellIndexRaw - 1;
     undoStack.push(absPath, `notebook_edit (${action}): ${filePath}`);
@@ -5507,8 +5980,8 @@ function estimateToolDefinitionTokens(def) {
 
 // src/tools/registry.ts
 import { pathToFileURL } from "url";
-import { existsSync as existsSync12, mkdirSync as mkdirSync4, readdirSync as readdirSync6 } from "fs";
-import { join as join6 } from "path";
+import { existsSync as existsSync13, mkdirSync as mkdirSync5, readdirSync as readdirSync6 } from "fs";
+import { join as join7 } from "path";
 var ToolRegistry = class {
   tools = /* @__PURE__ */ new Map();
   pluginToolNames = /* @__PURE__ */ new Set();
@@ -5669,9 +6142,9 @@ var ToolRegistry = class {
    * Returns the number of successfully loaded plugins.
    */
   async loadPlugins(pluginsDir, allowPlugins = false) {
-    if (!existsSync12(pluginsDir)) {
+    if (!existsSync13(pluginsDir)) {
       try {
-        mkdirSync4(pluginsDir, { recursive: true });
+        mkdirSync5(pluginsDir, { recursive: true });
       } catch {
       }
       return 0;
@@ -5695,12 +6168,12 @@ var ToolRegistry = class {
     process.stderr.write(
       `
 [plugins] \u26A0 Loading ${files.length} plugin(s) with FULL system privileges:
-` + files.map((f) => `  + ${join6(pluginsDir, f)}`).join("\n") + "\n\n"
+` + files.map((f) => `  + ${join7(pluginsDir, f)}`).join("\n") + "\n\n"
     );
     let loaded = 0;
     for (const file of files) {
       try {
-        const fileUrl = pathToFileURL(join6(pluginsDir, file)).href;
+        const fileUrl = pathToFileURL(join7(pluginsDir, file)).href;
         const mod = await import(fileUrl);
         const tool = mod.tool ?? mod.default?.tool ?? mod.default;
         if (!tool || typeof tool.execute !== "function" || !tool.definition?.name) {
@@ -5732,6 +6205,12 @@ export {
   theme,
   undoStack,
   renderDiff,
+  listHooks,
+  trustHook,
+  untrustHook,
+  getPendingHookTrust,
+  runLifecycleHooks,
+  runHook,
   isInterrupted,
   requestInterrupt,
   resetInterrupt,
@@ -5739,8 +6218,9 @@ export {
   rlInternal,
   groupCallsByPhase,
   runSafePhases,
-  runHook,
-  checkPermission,
+  checkPermissionWithProfile,
+  formatPermissionProfileWarning,
+  checkNetworkPolicy,
   setMaxOutputCap,
   setContextWindow,
   truncateForPersist,