jinzd-ai-cli 0.4.210 → 0.4.212

package/dist/electron-server.js

@@ -37,7 +37,7 @@ import {
   VERSION,
   buildUserIdentityPrompt,
   runTestsTool
-} from "./chunk-HZQVX7VF.js";
+} from "./chunk-KE4B3NOQ.js";
 import {
   hasSemanticIndex,
   semanticSearch
@@ -49,8 +49,9 @@ import "./chunk-IEQAE3QG.js";
 import {
   loadChatIndex,
   redactJson,
+  scanString,
   searchChatMemory
-} from "./chunk-W7UKO3PS.js";
+} from "./chunk-OQGVGPEK.js";
 import "./chunk-JV5N65KN.js";
 import {
   atomicWriteFileSync
@@ -60,8 +61,8 @@ import {
 import express from "express";
 import { createServer } from "http";
 import { WebSocketServer } from "ws";
-import { join as join19, dirname as dirname6, resolve as resolve7, relative as relative4, sep as sep3 } from "path";
-import { existsSync as existsSync25, readFileSync as readFileSync19, readdirSync as readdirSync12, statSync as statSync10, realpathSync } from "fs";
+import { join as join20, dirname as dirname6, resolve as resolve8, relative as relative4, sep as sep3 } from "path";
+import { existsSync as existsSync26, readFileSync as readFileSync20, readdirSync as readdirSync12, statSync as statSync10, realpathSync } from "fs";
 import { networkInterfaces } from "os";
 
 // src/config/config-manager.ts
@@ -208,12 +209,69 @@ var ConfigSchema = z.object({
     env: z.record(z.string()).optional(),
     timeout: z.number().default(3e4)
   })).default({}),
-  // 工具执行钩子（shell 命令，模板变量：{tool} {dangerLevel} {args} {status}）
+  // Hooks 生命周期（v0.4.212+）：兼容旧 pre/post 字符串，同时支持 events.<EventName> 结构化 JSON hook。
   hooks: z.object({
+    enabled: z.boolean().default(true),
     preToolExecution: z.string().optional(),
-    postToolExecution: z.string().optional()
+    postToolExecution: z.string().optional(),
+    events: z.record(z.union([
+      z.string(),
+      z.object({
+        command: z.string(),
+        source: z.enum(["user", "project", "managed"]).default("user"),
+        description: z.string().optional(),
+        required: z.boolean().default(false),
+        timeoutMs: z.number().int().min(100).max(3e4).default(5e3),
+        disabled: z.boolean().default(false)
+      }),
+      z.array(z.union([
+        z.string(),
+        z.object({
+          command: z.string(),
+          source: z.enum(["user", "project", "managed"]).default("user"),
+          description: z.string().optional(),
+          required: z.boolean().default(false),
+          timeoutMs: z.number().int().min(100).max(3e4).default(5e3),
+          disabled: z.boolean().default(false)
+        })
+      ]))
+    ])).default({})
   }).optional(),
-  // 工具权限规则（按顺序匹配第一个生效）
+  // 网络访问治理（v0.4.211+）：默认关闭以保持兼容；开启后统一治理 web/search/MCP/shell 网络出口。
+  networkPolicy: z.object({
+    enabled: z.boolean().default(false),
+    defaultAction: z.enum(["allow", "confirm", "deny"]).default("confirm"),
+    allowDomains: z.array(z.string()).default([]),
+    denyDomains: z.array(z.string()).default([]),
+    allowPorts: z.array(z.number().int().min(1).max(65535)).default([]),
+    denyPorts: z.array(z.number().int().min(1).max(65535)).default([]),
+    allowPrivateNetwork: z.boolean().default(false),
+    tools: z.object({
+      web_fetch: z.enum(["allow", "confirm", "deny"]).optional(),
+      web_search: z.enum(["allow", "confirm", "deny"]).optional(),
+      google_search: z.enum(["allow", "confirm", "deny"]).optional(),
+      shell: z.enum(["allow", "confirm", "deny"]).optional(),
+      mcp: z.enum(["allow", "confirm", "deny"]).optional()
+    }).default({})
+  }).default({ enabled: false, defaultAction: "confirm", allowDomains: [], denyDomains: [], allowPorts: [], denyPorts: [], allowPrivateNetwork: false, tools: {} }),
+  // 权限 Profile（v0.4.211+）：legacy 保持旧行为；其余 profile 提供更清晰的安全边界。
+  defaultPermissionProfile: z.enum(["legacy", "read-only", "workspace-write", "danger-full-access"]).default("legacy"),
+  allowedPermissionProfiles: z.array(z.string()).default(["legacy", "read-only", "workspace-write", "danger-full-access"]),
+  permissionProfiles: z.record(z.object({
+    extends: z.enum(["legacy", "read-only", "workspace-write", "danger-full-access"]).optional(),
+    defaultAction: z.enum(["auto-approve", "deny", "confirm"]).optional(),
+    workspaceRoots: z.array(z.string()).optional(),
+    allowTemp: z.boolean().optional(),
+    rules: z.array(z.object({
+      tool: z.string(),
+      action: z.enum(["auto-approve", "deny", "confirm"]),
+      when: z.object({
+        dangerLevel: z.enum(["safe", "write", "destructive"]).optional(),
+        pathPattern: z.string().optional()
+      }).optional()
+    })).optional()
+  })).default({}),
+  // 工具权限规则（按顺序匹配第一个生效；作为当前权限 Profile 内的细粒度规则）
   permissionRules: z.array(z.object({
     tool: z.string(),
     action: z.enum(["auto-approve", "deny", "confirm"]),
@@ -222,7 +280,7 @@ var ConfigSchema = z.object({
       pathPattern: z.string().optional()
     }).optional()
   })).default([]),
-  // 无规则匹配时的默认权限动作
+  // 无规则匹配时的默认权限动作（legacy profile 兼容旧行为）
   defaultPermission: z.enum(["auto-approve", "deny", "confirm"]).default("confirm"),
   // 自动上下文压缩开关
   // 当对话估算 token 数超过模型 contextWindow 的 80% 时，自动触发 compact 压缩旧消息
@@ -5727,12 +5785,13 @@ ${content}`;
 };
 
 // src/tools/builtin/write-file.ts
-import { appendFileSync, mkdirSync as mkdirSync4 } from "fs";
+import { appendFileSync, mkdirSync as mkdirSync5 } from "fs";
 import { dirname as dirname3 } from "path";
 
 // src/tools/executor.ts
 import chalk3 from "chalk";
-import { existsSync as existsSync7, readFileSync as readFileSync6 } from "fs";
+import { existsSync as existsSync8, readFileSync as readFileSync7 } from "fs";
+import { tmpdir } from "os";
 
 // src/core/readline-internal.ts
 function rlInternal(rl) {
@@ -5939,6 +5998,139 @@ function simpleDiff(oldLines, newLines) {
 
 // src/tools/hooks.ts
 import { execSync } from "child_process";
+import { createHash } from "crypto";
+import { existsSync as existsSync6, mkdirSync as mkdirSync3, readFileSync as readFileSync5 } from "fs";
+import { join as join3 } from "path";
+var TRUST_FILE = "hooks-trust.json";
+var DEFAULT_TIMEOUT_MS = 5e3;
+function asArray(entry) {
+  if (!entry) return [];
+  const raw = Array.isArray(entry) ? entry : [entry];
+  return raw.map((item) => typeof item === "string" ? { command: item } : item);
+}
+function hookTrustPath(configDir) {
+  return join3(configDir, TRUST_FILE);
+}
+function loadHookTrustStore(configDir) {
+  const file = hookTrustPath(configDir);
+  if (!existsSync6(file)) return { records: [] };
+  try {
+    const parsed = JSON.parse(readFileSync5(file, "utf-8"));
+    return { records: Array.isArray(parsed.records) ? parsed.records : [] };
+  } catch {
+    return { records: [] };
+  }
+}
+function hashHook(event, command) {
+  return createHash("sha256").update(`${event}
+${command}`, "utf-8").digest("hex");
+}
+function isTrusted(source, event, hash, store) {
+  if (source === "user" || source === "managed") return true;
+  return store.records.some((r) => r.source === source && r.event === event && r.hash === hash);
+}
+function listHooks(config, configDir) {
+  if (!config || config.enabled === false) return [];
+  const store = loadHookTrustStore(configDir);
+  const out = [];
+  const push = (event, hook, index) => {
+    if (!hook.command) return;
+    const source = hook.source ?? "user";
+    const hash = hashHook(event, hook.command);
+    out.push({
+      id: `${event}:${index}`,
+      event,
+      command: hook.command,
+      source,
+      hash,
+      trusted: isTrusted(source, event, hash, store),
+      disabled: hook.disabled === true,
+      description: hook.description
+    });
+  };
+  if (config.preToolExecution) push("PreToolUse", { command: config.preToolExecution }, 0);
+  if (config.postToolExecution) push("PostToolUse", { command: config.postToolExecution }, 0);
+  for (const [event, entry] of Object.entries(config.events ?? {})) {
+    asArray(entry).forEach((hook, i) => push(event, hook, i));
+  }
+  return out;
+}
+function getPendingHookTrust(config, configDir) {
+  return listHooks(config, configDir).filter((h) => h.source === "project" && !h.disabled && !h.trusted);
+}
+function normalizeDecision(value, hook) {
+  if (!value || typeof value !== "object") return null;
+  const obj = value;
+  const action = obj.action;
+  if (action !== "allow" && action !== "deny" && action !== "ask") return null;
+  return {
+    action,
+    reason: typeof obj.reason === "string" ? obj.reason : void 0,
+    prompt: typeof obj.prompt === "string" ? obj.prompt : void 0,
+    contextAppend: typeof obj.contextAppend === "string" ? obj.contextAppend : void 0,
+    warning: typeof obj.warning === "string" ? obj.warning : void 0,
+    warnings: Array.isArray(obj.warnings) ? obj.warnings.filter((x) => typeof x === "string") : void 0,
+    hook
+  };
+}
+function runStructuredHook(hook, descriptor, payload) {
+  if (hook.disabled === true) return null;
+  const timeout = Math.max(100, Math.min(hook.timeoutMs ?? DEFAULT_TIMEOUT_MS, 3e4));
+  try {
+    const stdout = execSync(hook.command, {
+      timeout,
+      stdio: ["pipe", "pipe", "pipe"],
+      encoding: "utf-8",
+      env: {
+        ...process.env,
+        AICLI_HOOK_EVENT: payload.event,
+        AICLI_HOOK_EVENT_JSON: JSON.stringify(payload)
+      }
+    }).trim();
+    if (!stdout) return null;
+    return normalizeDecision(JSON.parse(stdout), descriptor);
+  } catch (err) {
+    process.stderr.write(`\u26A0 Hook failed: ${hook.command.slice(0, 100)}
+`);
+    if (hook.required) {
+      return { action: "deny", reason: err instanceof Error ? err.message : String(err), hook: descriptor };
+    }
+    return null;
+  }
+}
+function runLifecycleHooks(config, event, payload, opts) {
+  if (!config || config.enabled === false) return [];
+  const options = typeof opts === "string" ? { configDir: opts } : opts;
+  const store = loadHookTrustStore(options.configDir);
+  const hooks = asArray(config.events?.[event]);
+  const decisions = [];
+  for (let i = 0; i < hooks.length; i++) {
+    const hook = hooks[i];
+    if (!hook.command || hook.disabled) continue;
+    const source = hook.source ?? "user";
+    const hash = hashHook(event, hook.command);
+    const descriptor = {
+      id: `${event}:${i}`,
+      event,
+      command: hook.command,
+      source,
+      hash,
+      trusted: isTrusted(source, event, hash, store),
+      disabled: false,
+      description: hook.description
+    };
+    if (!descriptor.trusted) {
+      options.onSummary?.(`hook skipped: ${event} project hook requires trust (${hash.slice(0, 12)})`);
+      continue;
+    }
+    const decision = runStructuredHook(hook, descriptor, { event, ...payload });
+    if (decision) {
+      decisions.push(decision);
+      options.onSummary?.(`hook ${event}: ${decision.action}${decision.reason ? ` (${decision.reason})` : ""}`);
+    }
+  }
+  return decisions;
+}
 function rewriteTemplate(template, isWindows) {
   const ref = (name) => isWindows ? `%${name}%` : `$${name}`;
   return template.replace(/\{tool\}/g, ref("AICLI_HOOK_TOOL")).replace(/\{dangerLevel\}/g, ref("AICLI_HOOK_DANGER_LEVEL")).replace(/\{args\}/g, ref("AICLI_HOOK_ARGS")).replace(/\{status\}/g, ref("AICLI_HOOK_STATUS"));
@@ -5949,7 +6141,7 @@ function runHook(template, vars) {
   const cmd = rewriteTemplate(template, isWindows);
   try {
     execSync(cmd, {
-      timeout: 5e3,
+      timeout: DEFAULT_TIMEOUT_MS,
       stdio: ["pipe", "pipe", "pipe"],
       encoding: "utf-8",
       env: {
@@ -5967,6 +6159,7 @@ function runHook(template, vars) {
 }
 
 // src/tools/permissions.ts
+import { isAbsolute, resolve as resolve3 } from "path";
 function checkPermission(toolName, args, dangerLevel, rules, defaultAction = "confirm") {
   for (const rule of rules) {
     if (rule.tool !== "*" && rule.tool !== toolName) continue;
@@ -5987,6 +6180,225 @@ function checkPermission(toolName, args, dangerLevel, rules, defaultAction = "co
   }
   return defaultAction;
 }
+var BUILTIN_PROFILE_NAMES = /* @__PURE__ */ new Set(["legacy", "read-only", "workspace-write", "danger-full-access"]);
+var READ_ONLY_TOOLS = /* @__PURE__ */ new Set([
+  "read_file",
+  "list_dir",
+  "grep_files",
+  "glob_files",
+  "find_symbol",
+  "get_outline",
+  "find_references",
+  "search_code",
+  "git_status",
+  "git_diff",
+  "git_log",
+  "task_list",
+  "web_fetch",
+  "web_search",
+  "google_search",
+  "ask_user",
+  "write_todos",
+  "recall_memory"
+]);
+function normalizePathForPermission(value) {
+  return value.replace(/\\/g, "/").replace(/\/+$/, "").toLowerCase();
+}
+function isInsidePath(root, target) {
+  const absoluteTarget = isAbsolute(target) ? target : resolve3(root, target);
+  const r = normalizePathForPermission(resolve3(root));
+  const t = normalizePathForPermission(absoluteTarget);
+  return t === r || t.startsWith(`${r}/`);
+}
+function extractPathArg(toolName, args) {
+  const raw = args["path"] ?? args["filePath"] ?? args["notebook_path"];
+  if (typeof raw === "string" && raw.trim()) return raw.trim();
+  if (toolName === "save_last_response") {
+    const output = args["outputPath"] ?? args["file"] ?? args["path"];
+    if (typeof output === "string" && output.trim()) return output.trim();
+  }
+  return null;
+}
+function isExplicitFileWriteTool(toolName) {
+  return toolName === "write_file" || toolName === "edit_file" || toolName === "notebook_edit" || toolName === "save_last_response";
+}
+function resolveProfileName(ctx) {
+  const requested = ctx?.profileName ?? "legacy";
+  if (ctx?.allowedProfiles && ctx.allowedProfiles.length > 0 && !ctx.allowedProfiles.includes(requested)) {
+    return "legacy";
+  }
+  if (BUILTIN_PROFILE_NAMES.has(requested)) return requested;
+  const ext = ctx?.profile?.extends;
+  return ext && BUILTIN_PROFILE_NAMES.has(ext) ? ext : "legacy";
+}
+function getProfileRules(ctx) {
+  return ctx?.profile?.rules ?? [];
+}
+function getProfileDefaultAction(name, ctx) {
+  if (ctx?.profile?.defaultAction) return ctx.profile.defaultAction;
+  if (name === "danger-full-access") return "auto-approve";
+  return "confirm";
+}
+function getWorkspaceRoots(ctx) {
+  const roots = [ctx?.workspaceRoot, ...ctx?.profile?.workspaceRoots ?? []].filter((v) => typeof v === "string" && v.trim().length > 0);
+  return roots;
+}
+function getAllowedWriteRoots(ctx) {
+  const roots = [...getWorkspaceRoots(ctx)];
+  const allowTemp = ctx?.profile?.allowTemp !== false;
+  if (allowTemp) roots.push(...ctx?.tempDirs ?? []);
+  return roots.filter((v) => v.trim().length > 0);
+}
+function profileHardDecision(profileName, toolName, args, dangerLevel, ctx) {
+  if (profileName === "legacy") return null;
+  if (profileName === "read-only") {
+    const mcpReadOnly = toolName.startsWith("mcp__") && dangerLevel === "safe";
+    if (dangerLevel !== "safe" || !READ_ONLY_TOOLS.has(toolName) && !mcpReadOnly) {
+      return { action: "deny", reason: "blocked by read-only permission profile", profileName };
+    }
+    return null;
+  }
+  if (profileName === "workspace-write") {
+    if (dangerLevel === "destructive") return { action: "confirm", reason: "destructive tools always require confirmation", profileName };
+    if (dangerLevel === "write" && isExplicitFileWriteTool(toolName)) {
+      const target = extractPathArg(toolName, args);
+      if (!target) return { action: "confirm", reason: "file write target is not explicit", profileName };
+      const allowedRoots = getAllowedWriteRoots(ctx);
+      if (allowedRoots.length === 0 || !allowedRoots.some((root) => isInsidePath(root, target))) {
+        return { action: "deny", reason: "file write target is outside workspace/temp roots", profileName };
+      }
+    }
+    return null;
+  }
+  if (profileName === "danger-full-access") {
+    if (dangerLevel === "destructive") return { action: "confirm", reason: "destructive tools still require confirmation", profileName };
+    return null;
+  }
+  return null;
+}
+function checkPermissionWithProfile(toolName, args, dangerLevel, rules, defaultAction = "confirm", profileContext) {
+  const profileName = resolveProfileName(profileContext);
+  const hard = profileHardDecision(profileName, toolName, args, dangerLevel, profileContext);
+  if (hard?.action === "deny") return hard;
+  const combinedRules = [...getProfileRules(profileContext), ...rules];
+  const profileDefault = profileName === "legacy" ? defaultAction : getProfileDefaultAction(profileName, profileContext);
+  const action = checkPermission(toolName, args, dangerLevel, combinedRules, profileDefault);
+  if (hard?.action === "confirm" && action === "auto-approve") return hard;
+  return { action, profileName };
+}
+function formatPermissionProfileWarning(profileName) {
+  if (profileName === "danger-full-access") {
+    return "\u26A0 danger-full-access permission profile is active. Write tools may auto-run; destructive tools still require confirmation.";
+  }
+  if (profileName === "read-only") return "Read-only permission profile is active. Write and destructive tools are blocked.";
+  if (profileName === "workspace-write") return "Workspace-write permission profile is active. Writes outside workspace/temp roots are blocked.";
+  return null;
+}
+var NETWORK_TOOL_HOSTS = {
+  web_search: ["cn.bing.com", "www.google.com"],
+  google_search: ["www.googleapis.com"]
+};
+var NETWORK_TOOL_PORTS = {
+  web_search: [443],
+  google_search: [443]
+};
+function networkActionToPermission(action) {
+  if (action === "allow") return null;
+  return action;
+}
+function domainMatches(pattern, host) {
+  const p = pattern.trim().toLowerCase().replace(/^\*\./, "");
+  const h = host.trim().toLowerCase().replace(/:\d+$/, "");
+  return h === p || h.endsWith(`.${p}`);
+}
+function isPrivateNetworkHost(host) {
+  const h = host.toLowerCase().replace(/^\[|\]$/g, "");
+  if (h === "" || h === "localhost") return true;
+  if (/^(127|10)\./.test(h)) return true;
+  if (/^192\.168\./.test(h)) return true;
+  if (/^172\.(1[6-9]|2\d|3[0-1])\./.test(h)) return true;
+  if (/^169\.254\./.test(h)) return true;
+  if (h === "::1" || h === "::") return true;
+  if (/^f[cd][0-9a-f]*:/i.test(h) || /^fe[89ab][0-9a-f]*:/i.test(h)) return true;
+  return false;
+}
+function extractNetworkHosts(toolName, args) {
+  if (toolName === "web_fetch") {
+    const raw = String(args["url"] ?? "").trim();
+    try {
+      return raw ? [new URL(raw).hostname] : [];
+    } catch {
+      return [];
+    }
+  }
+  return NETWORK_TOOL_HOSTS[toolName] ?? [];
+}
+function extractNetworkPorts(toolName, args) {
+  if (toolName === "web_fetch") {
+    const raw = String(args["url"] ?? "").trim();
+    try {
+      if (!raw) return [];
+      const url = new URL(raw);
+      if (url.port) return [Number(url.port)];
+      return [url.protocol === "http:" ? 80 : 443];
+    } catch {
+      return [];
+    }
+  }
+  return NETWORK_TOOL_PORTS[toolName] ?? [];
+}
+function isShellNetworkCommand(command) {
+  return /\b(curl|wget|aria2c|Invoke-WebRequest|Invoke-RestMethod|iwr|irm|ssh|scp|sftp|ftp|telnet|nc|ncat|netcat)\b/i.test(command) || /\b(git\s+(clone|fetch|pull|push)|npm\s+(install|publish|view)|pnpm\s+(add|install)|yarn\s+(add|install)|pip\s+install|python\s+-m\s+pip\s+install)\b/i.test(command);
+}
+function networkToolAction(toolName, policy) {
+  if (toolName === "web_fetch") return policy.tools?.web_fetch ?? policy.defaultAction ?? "confirm";
+  if (toolName === "web_search") return policy.tools?.web_search ?? policy.defaultAction ?? "confirm";
+  if (toolName === "google_search") return policy.tools?.google_search ?? policy.defaultAction ?? "confirm";
+  if (toolName.startsWith("mcp__")) return policy.tools?.mcp ?? policy.defaultAction ?? "confirm";
+  return null;
+}
+function checkNetworkPolicy(toolName, args, policy) {
+  if (!policy?.enabled) return null;
+  let action = networkToolAction(toolName, policy);
+  let reason = "network access requires confirmation";
+  if (toolName === "bash") {
+    const command = String(args["command"] ?? "");
+    if (!isShellNetworkCommand(command)) return null;
+    action = policy.tools?.shell ?? policy.defaultAction ?? "confirm";
+    reason = "shell command may access the network";
+  }
+  if (!action) return null;
+  const hosts = extractNetworkHosts(toolName, args);
+  for (const host of hosts) {
+    if (policy.denyDomains?.some((pattern) => domainMatches(pattern, host))) {
+      return { action: "deny", reason: `network host "${host}" is denied by networkPolicy`, profileName: "networkPolicy" };
+    }
+    if (!policy.allowPrivateNetwork && isPrivateNetworkHost(host)) {
+      return { action: "deny", reason: `network host "${host}" is private/internal`, profileName: "networkPolicy" };
+    }
+  }
+  if (hosts.length > 0 && policy.allowDomains && policy.allowDomains.length > 0) {
+    const allAllowed = hosts.every((host) => policy.allowDomains.some((pattern) => domainMatches(pattern, host)));
+    if (!allAllowed) {
+      return { action: "deny", reason: `network host is not in networkPolicy.allowDomains`, profileName: "networkPolicy" };
+    }
+  }
+  const ports = extractNetworkPorts(toolName, args);
+  for (const port of ports) {
+    if (policy.denyPorts?.includes(port)) {
+      return { action: "deny", reason: `network port ${port} is denied by networkPolicy`, profileName: "networkPolicy" };
+    }
+  }
+  if (ports.length > 0 && policy.allowPorts && policy.allowPorts.length > 0) {
+    const allPortsAllowed = ports.every((port) => policy.allowPorts.includes(port));
+    if (!allPortsAllowed) {
+      return { action: "deny", reason: `network port is not in networkPolicy.allowPorts`, profileName: "networkPolicy" };
+    }
+  }
+  const permissionAction = networkActionToPermission(action);
+  if (!permissionAction) return null;
+  return { action: permissionAction, reason, profileName: "networkPolicy" };
+}
 
 // src/tools/truncate.ts
 var DEFAULT_MAX_TOOL_OUTPUT_CHARS = 12e3;
@@ -6129,8 +6541,8 @@ var theme = new Proxy(DARK_THEME, {
 });
 
 // src/diagnostics/tool-stats.ts
-import { existsSync as existsSync6, readFileSync as readFileSync5, mkdirSync as mkdirSync3 } from "fs";
-import { join as join3, dirname as dirname2 } from "path";
+import { existsSync as existsSync7, readFileSync as readFileSync6, mkdirSync as mkdirSync4 } from "fs";
+import { join as join4, dirname as dirname2 } from "path";
 import { homedir as homedir3 } from "os";
 var STATS_FILE_NAME = "tool-stats.json";
 var STATS_VERSION = 1;
@@ -6140,16 +6552,16 @@ var dirty = false;
 var pendingWrites = 0;
 var configDirOverride;
 function statsFilePath() {
-  const base = configDirOverride ?? join3(homedir3(), CONFIG_DIR_NAME);
-  return join3(base, STATS_FILE_NAME);
+  const base = configDirOverride ?? join4(homedir3(), CONFIG_DIR_NAME);
+  return join4(base, STATS_FILE_NAME);
 }
 function load() {
   const path3 = statsFilePath();
-  if (!existsSync6(path3)) {
+  if (!existsSync7(path3)) {
     return { version: STATS_VERSION, startedAt: (/* @__PURE__ */ new Date()).toISOString(), entries: {} };
   }
   try {
-    const raw = JSON.parse(readFileSync5(path3, "utf-8"));
+    const raw = JSON.parse(readFileSync6(path3, "utf-8"));
     if (raw.version !== STATS_VERSION || !raw.entries) {
       return { version: STATS_VERSION, startedAt: (/* @__PURE__ */ new Date()).toISOString(), entries: {} };
     }
@@ -6207,7 +6619,7 @@ function flush() {
   if (!dirty || state === null) return;
   const path3 = statsFilePath();
   try {
-    mkdirSync3(dirname2(path3), { recursive: true });
+    mkdirSync4(dirname2(path3), { recursive: true });
     atomicWriteFileSync(path3, JSON.stringify(state, null, 2));
     dirty = false;
     pendingWrites = 0;
@@ -6289,11 +6701,23 @@ var ToolExecutor = class {
   /** 权限规则（可选） */
   permissionRules = [];
   defaultPermission = "confirm";
+  permissionProfileName = "legacy";
+  permissionProfile;
+  allowedPermissionProfiles = [];
+  workspaceRoot = process.cwd();
+  networkPolicy;
+  hookConfigDir = process.cwd();
   /** 注入 hooks 和 permission rules 配置 */
   setConfig(opts) {
     this.hookConfig = opts.hookConfig;
     if (opts.permissionRules) this.permissionRules = opts.permissionRules;
     if (opts.defaultPermission) this.defaultPermission = opts.defaultPermission;
+    if (opts.permissionProfileName) this.permissionProfileName = opts.permissionProfileName;
+    if (opts.permissionProfile) this.permissionProfile = opts.permissionProfile;
+    if (opts.allowedPermissionProfiles) this.allowedPermissionProfiles = opts.allowedPermissionProfiles;
+    if (opts.workspaceRoot) this.workspaceRoot = opts.workspaceRoot;
+    if (opts.networkPolicy) this.networkPolicy = opts.networkPolicy;
+    if (opts.hookConfigDir) this.hookConfigDir = opts.hookConfigDir;
   }
   async execute(call) {
     return runWithSessionKey(this.sessionKey, () => this.executeInner(call));
@@ -6308,31 +6732,97 @@ var ToolExecutor = class {
       };
     }
     const dangerLevel = getDangerLevel(call.name, call.arguments);
+    let toolCallAlreadyPrinted = false;
     runHook(this.hookConfig?.preToolExecution, {
       tool: call.name,
       dangerLevel,
       args: JSON.stringify(call.arguments).slice(0, 200)
     });
-    if (this.permissionRules.length > 0) {
-      const action = checkPermission(call.name, call.arguments, dangerLevel, this.permissionRules, this.defaultPermission);
-      if (action === "deny") {
-        return { callId: call.id, content: `[Permission denied] Tool ${call.name} is blocked by permission rules. Do not retry.`, isError: true };
+    const preToolDecisions = runLifecycleHooks(
+      this.hookConfig,
+      "PreToolUse",
+      { tool: call.name, dangerLevel, args: call.arguments },
+      { configDir: this.hookConfigDir, onSummary: (msg) => console.log(theme.dim(`  [hook] ${msg}`)) }
+    );
+    const preDeny = preToolDecisions.find((d) => d.action === "deny");
+    if (preDeny) {
+      return {
+        callId: call.id,
+        content: `[Hook denied] ${preDeny.reason ?? `PreToolUse blocked ${call.name}`}. Do not retry without asking.`,
+        isError: true
+      };
+    }
+    for (const d of preToolDecisions) {
+      const warnings = [d.warning, ...d.warnings ?? []].filter(Boolean);
+      for (const w of warnings) console.log(theme.warning(`  \u26A0 Hook warning: ${w}`));
+    }
+    const permission = checkPermissionWithProfile(
+      call.name,
+      call.arguments,
+      dangerLevel,
+      this.permissionRules,
+      this.defaultPermission,
+      {
+        profileName: this.permissionProfileName,
+        profile: this.permissionProfile,
+        allowedProfiles: this.allowedPermissionProfiles,
+        workspaceRoot: this.workspaceRoot,
+        tempDirs: [tmpdir()]
       }
-      if (action === "auto-approve") {
-        this.printToolCall(call);
-        try {
-          const rawContent = await runTool(tool, call.arguments, call.name);
-          const content = truncateOutput(rawContent, call.name);
-          const wasTruncated = content !== rawContent;
-          this.printToolResult(call.name, rawContent, false, wasTruncated);
-          runHook(this.hookConfig?.postToolExecution, { tool: call.name, status: "ok" });
-          return { callId: call.id, content, isError: false };
-        } catch (err) {
-          const message = err instanceof Error ? err.message : String(err);
-          this.printToolResult(call.name, message, true, false);
-          runHook(this.hookConfig?.postToolExecution, { tool: call.name, status: "error" });
-          return { callId: call.id, content: message, isError: true };
-        }
+    );
+    const networkPermission = checkNetworkPolicy(call.name, call.arguments, this.networkPolicy);
+    if (networkPermission?.action === "confirm" || permission.action === "confirm") {
+      runLifecycleHooks(
+        this.hookConfig,
+        "PermissionRequest",
+        { tool: call.name, dangerLevel, args: call.arguments, reason: networkPermission?.reason ?? permission.reason },
+        { configDir: this.hookConfigDir, onSummary: (msg) => console.log(theme.dim("  [hook] " + msg)) }
+      );
+    }
+    if (networkPermission?.action === "deny") {
+      const reason = networkPermission.reason ? ` (${networkPermission.reason})` : "";
+      return {
+        callId: call.id,
+        content: `[Permission denied] Tool ${call.name} is blocked by networkPolicy${reason}. Do not retry.`,
+        isError: true
+      };
+    }
+    if (permission.action === "deny") {
+      const reason = permission.reason ? ` (${permission.reason})` : "";
+      return {
+        callId: call.id,
+        content: `[Permission denied] Tool ${call.name} is blocked by permission profile "${permission.profileName}"${reason}. Do not retry.`,
+        isError: true
+      };
+    }
+    if (permission.action === "auto-approve" && networkPermission?.action !== "confirm") {
+      this.printToolCall(call);
+      try {
+        const rawContent = await runTool(tool, call.arguments, call.name);
+        const content = truncateOutput(rawContent, call.name);
+        const wasTruncated = content !== rawContent;
+        this.printToolResult(call.name, rawContent, false, wasTruncated);
+        runHook(this.hookConfig?.postToolExecution, { tool: call.name, status: "ok" });
+        runLifecycleHooks(this.hookConfig, "PostToolUse", { tool: call.name, status: "ok" }, { configDir: this.hookConfigDir });
+        return { callId: call.id, content, isError: false };
+      } catch (err) {
+        const message = err instanceof Error ? err.message : String(err);
+        this.printToolResult(call.name, message, true, false);
+        runHook(this.hookConfig?.postToolExecution, { tool: call.name, status: "error" });
+        runLifecycleHooks(this.hookConfig, "PostToolUse", { tool: call.name, status: "error", error: message }, { configDir: this.hookConfigDir });
+        return { callId: call.id, content: message, isError: true };
+      }
+    }
+    if (networkPermission?.action === "confirm" && dangerLevel === "safe") {
+      this.printToolCall(call);
+      toolCallAlreadyPrinted = true;
+      const confirmed = await this.confirm(call, "write");
+      if (!confirmed) {
+        return {
+          callId: call.id,
+          content: `[User cancelled] The user declined network access for ${call.name}. Do not retry without asking.`,
+          isError: true
+        };
       }
     }
     if (this.sessionAutoApprove && dangerLevel === "write") {
@@ -6345,11 +6835,13 @@ var ToolExecutor = class {
         const wasTruncated = content !== rawContent;
         this.printToolResult(call.name, rawContent, false, wasTruncated);
         runHook(this.hookConfig?.postToolExecution, { tool: call.name, status: "ok" });
+        runLifecycleHooks(this.hookConfig, "PostToolUse", { tool: call.name, status: "ok" }, { configDir: this.hookConfigDir });
         return { callId: call.id, content, isError: false };
       } catch (err) {
         const message = err instanceof Error ? err.message : String(err);
         this.printToolResult(call.name, message, true, false);
         runHook(this.hookConfig?.postToolExecution, { tool: call.name, status: "error" });
+        runLifecycleHooks(this.hookConfig, "PostToolUse", { tool: call.name, status: "error", error: message }, { configDir: this.hookConfigDir });
         return { callId: call.id, content: message, isError: true };
       }
     }
@@ -6383,11 +6875,13 @@ var ToolExecutor = class {
       const wasTruncated = content !== rawContent;
       this.printToolResult(call.name, rawContent, false, wasTruncated);
       runHook(this.hookConfig?.postToolExecution, { tool: call.name, status: "ok" });
+      runLifecycleHooks(this.hookConfig, "PostToolUse", { tool: call.name, status: "ok" }, { configDir: this.hookConfigDir });
       return { callId: call.id, content, isError: false };
     } catch (err) {
       const message = err instanceof Error ? err.message : String(err);
       this.printToolResult(call.name, message, true, false);
       runHook(this.hookConfig?.postToolExecution, { tool: call.name, status: "error" });
+      runLifecycleHooks(this.hookConfig, "PostToolUse", { tool: call.name, status: "error", error: message }, { configDir: this.hookConfigDir });
       return { callId: call.id, content: message, isError: true };
     }
   }
@@ -6422,6 +6916,9 @@ var ToolExecutor = class {
    * 然后让用户 approve all / reject all / 选择性 approve。
    */
   async executeBatchFileWrites(calls) {
+    if (this.permissionProfileName !== "legacy" || this.permissionRules.length > 0) {
+      return Promise.all(calls.map((call) => this.execute(call)));
+    }
     console.log();
     console.log(theme.heading(`\u270E Batch file writes (${calls.length} files):`));
     console.log(theme.dim("\u2500".repeat(50)));
@@ -6495,7 +6992,7 @@ var ToolExecutor = class {
     rl.resume();
     process.stdout.write(prompt);
     this.confirming = true;
-    return new Promise((resolve8) => {
+    return new Promise((resolve9) => {
       let completed = false;
       const cleanup = (result) => {
         if (completed) return;
@@ -6505,7 +7002,7 @@ var ToolExecutor = class {
         rl.pause();
         rlAny.output = savedOutput;
         this.confirming = false;
-        resolve8(result);
+        resolve9(result);
       };
       const onLine = (line) => {
         const trimmed = line.trim();
@@ -6572,10 +7069,10 @@ var ToolExecutor = class {
       const filePath = String(call.arguments["path"] ?? "");
       const newContent = String(call.arguments["content"] ?? "");
       if (!filePath) return;
-      if (existsSync7(filePath)) {
+      if (existsSync8(filePath)) {
         let oldContent;
         try {
-          oldContent = readFileSync6(filePath, "utf-8");
+          oldContent = readFileSync7(filePath, "utf-8");
         } catch {
           return;
         }
@@ -6598,7 +7095,7 @@ var ToolExecutor = class {
       }
     } else if (call.name === "edit_file") {
       const filePath = String(call.arguments["path"] ?? "");
-      if (!filePath || !existsSync7(filePath)) return;
+      if (!filePath || !existsSync8(filePath)) return;
       const oldStr = call.arguments["old_str"];
       const newStr = call.arguments["new_str"];
       if (oldStr !== void 0) {
@@ -6625,7 +7122,7 @@ var ToolExecutor = class {
         const to = Number(call.arguments["delete_to_line"] ?? from);
         let fileContent;
         try {
-          fileContent = readFileSync6(filePath, "utf-8");
+          fileContent = readFileSync7(filePath, "utf-8");
         } catch {
           return;
         }
@@ -6679,7 +7176,7 @@ var ToolExecutor = class {
     rl.resume();
     process.stdout.write(color("Proceed? [y/N] (type y + Enter to confirm) "));
     this.confirming = true;
-    return new Promise((resolve8) => {
+    return new Promise((resolve9) => {
       let completed = false;
       const cleanup = (answer) => {
         if (completed) return;
@@ -6689,7 +7186,7 @@ var ToolExecutor = class {
         rl.pause();
         rlAny.output = savedOutput;
         this.confirming = false;
-        resolve8(answer === "y");
+        resolve9(answer === "y");
       };
       const onLine = (line) => {
         const trimmed = line.trim();
@@ -6717,11 +7214,11 @@ var ToolExecutor = class {
 };
 
 // src/tools/sensitive-paths.ts
-import { resolve as resolve3, sep as sep2, basename as basename2 } from "path";
+import { resolve as resolve4, sep as sep2, basename as basename2 } from "path";
 import { homedir as homedir4 } from "os";
 var home = homedir4();
 function norm(p) {
-  const abs = resolve3(p);
+  const abs = resolve4(p);
   return process.platform === "win32" ? abs.toLowerCase() : abs;
 }
 function homeRel(p) {
@@ -6860,7 +7357,7 @@ Do NOT split a long document into many write_file(append=true) calls. That patte
     }
     undoStack.push(filePath, `write_file${appendMode ? " (append)" : ""}: ${filePath}`);
     fileCheckpoints.snapshot(filePath, ToolExecutor.currentMessageIndex);
-    mkdirSync4(dirname3(filePath), { recursive: true });
+    mkdirSync5(dirname3(filePath), { recursive: true });
     if (appendMode) {
       appendFileSync(filePath, content, encoding);
     } else {
@@ -6880,7 +7377,7 @@ Do NOT split a long document into many write_file(append=true) calls. That patte
 };
 
 // src/tools/builtin/edit-file.ts
-import { readFileSync as readFileSync7, existsSync as existsSync8 } from "fs";
+import { readFileSync as readFileSync8, existsSync as existsSync9 } from "fs";
 
 // src/tools/builtin/patch-apply.ts
 function parseUnifiedDiff(patch) {
@@ -7241,7 +7738,7 @@ Note: Path can be absolute or relative to cwd.`,
     const filePath = String(args["path"] ?? "");
     const encoding = args["encoding"] ?? "utf-8";
     if (!filePath) throw new ToolError("edit_file", "path is required");
-    if (!existsSync8(filePath)) throw new ToolError("edit_file", `File not found: ${filePath}`);
+    if (!existsSync9(filePath)) throw new ToolError("edit_file", `File not found: ${filePath}`);
     const verdict = classifyWritePath(filePath);
     if (verdict.sensitive && subAgentGuard.active) {
       throw new ToolError(
@@ -7249,7 +7746,7 @@ Note: Path can be absolute or relative to cwd.`,
         `Refused: sub-agents cannot edit sensitive paths \u2014 ${verdict.reason}. If this is genuinely needed, ask the parent agent to perform the edit so the user can approve it.`
       );
     }
-    const original = readFileSync7(filePath, encoding);
+    const original = readFileSync8(filePath, encoding);
     if (args["patch"] !== void 0) {
       const patchText = String(args["patch"] ?? "");
       const stopOnError = args["stop_on_error"] !== false;
@@ -7407,8 +7904,8 @@ function truncatePreview(str, maxLen = 80) {
 }
 
 // src/tools/builtin/list-dir.ts
-import { readdirSync as readdirSync4, statSync as statSync3, existsSync as existsSync9 } from "fs";
-import { join as join4, basename as basename3 } from "path";
+import { readdirSync as readdirSync4, statSync as statSync3, existsSync as existsSync10 } from "fs";
+import { join as join5, basename as basename3 } from "path";
 var listDirTool = {
   definition: {
     name: "list_dir",
@@ -7430,7 +7927,7 @@ var listDirTool = {
   async execute(args) {
     const dirPath = String(args["path"] ?? process.cwd());
     const recursive = Boolean(args["recursive"] ?? false);
-    if (!existsSync9(dirPath)) {
+    if (!existsSync10(dirPath)) {
       const targetName = basename3(dirPath).toLowerCase();
       const cwd = process.cwd();
       const suggestions = [];
@@ -7488,11 +7985,11 @@ function listRecursive(basePath, indent, recursive, lines) {
     if (entry.isDirectory()) {
       lines.push(`${indent}\u{1F4C1} ${entry.name}/`);
       if (recursive) {
-        listRecursive(join4(basePath, entry.name), indent + "  ", true, lines);
+        listRecursive(join5(basePath, entry.name), indent + "  ", true, lines);
       }
     } else {
       try {
-        const stat = statSync3(join4(basePath, entry.name));
+        const stat = statSync3(join5(basePath, entry.name));
         const size = formatSize(stat.size);
         lines.push(`${indent}\u{1F4C4} ${entry.name}  (${size})`);
       } catch {
@@ -7508,9 +8005,9 @@ function formatSize(bytes) {
 }
 
 // src/tools/builtin/grep-files.ts
-import { readdirSync as readdirSync5, readFileSync as readFileSync8, statSync as statSync4, existsSync as existsSync10 } from "fs";
+import { readdirSync as readdirSync5, readFileSync as readFileSync9, statSync as statSync4, existsSync as existsSync11 } from "fs";
 import { readFile } from "fs/promises";
-import { join as join5, relative } from "path";
+import { join as join6, relative } from "path";
 var grepFilesTool = {
   definition: {
     name: "grep_files",
@@ -7561,7 +8058,7 @@ Supports regex. Automatically skips node_modules, dist, .git directories.`,
     const contextLines = Math.max(0, Number(args["context_lines"] ?? 0));
     const maxResults = Math.max(1, Number(args["max_results"] ?? 50));
     if (!pattern) throw new ToolError("grep_files", "pattern is required");
-    if (!existsSync10(rootPath)) throw new ToolError("grep_files", `Path not found: ${rootPath}`);
+    if (!existsSync11(rootPath)) throw new ToolError("grep_files", `Path not found: ${rootPath}`);
     const MAX_PATTERN_LENGTH = 1e3;
     if (pattern.length > MAX_PATTERN_LENGTH) {
       throw new ToolError("grep_files", `Pattern too long (${pattern.length} chars, max ${MAX_PATTERN_LENGTH}). Use a shorter pattern.`);
@@ -7655,11 +8152,11 @@ function collectFilePaths(rootPath, filePattern, maxFiles) {
       if (paths.length >= maxFiles) return;
       if (entry.isDirectory()) {
         if (SKIP_DIRS.has(entry.name) || entry.name.startsWith(".")) continue;
-        walk(join5(dirPath, entry.name));
+        walk(join6(dirPath, entry.name));
       } else if (entry.isFile()) {
         if (isBinary(entry.name)) continue;
         if (filePattern && !matchesFilePattern(entry.name, filePattern)) continue;
-        const fullPath = join5(dirPath, entry.name);
+        const fullPath = join6(dirPath, entry.name);
         try {
           if (statSync4(fullPath).size > 1e6) continue;
         } catch {
@@ -7714,7 +8211,7 @@ function searchInFile(fullPath, displayPath2, regex, contextLines, maxResults, r
   }
   let content;
   try {
-    content = readFileSync8(fullPath, "utf-8");
+    content = readFileSync9(fullPath, "utf-8");
   } catch {
     return;
   }
@@ -7745,8 +8242,8 @@ function searchInFile(fullPath, displayPath2, regex, contextLines, maxResults, r
 }
 
 // src/tools/builtin/glob-files.ts
-import { readdirSync as readdirSync6, statSync as statSync5, existsSync as existsSync11 } from "fs";
-import { join as join6, relative as relative2, basename as basename4 } from "path";
+import { readdirSync as readdirSync6, statSync as statSync5, existsSync as existsSync12 } from "fs";
+import { join as join7, relative as relative2, basename as basename4 } from "path";
 var globFilesTool = {
   definition: {
     name: "glob_files",
@@ -7779,7 +8276,7 @@ Results sorted by most recent modification time. Automatically skips node_module
     const rootPath = String(args["path"] ?? process.cwd());
     const maxResults = Math.max(1, Number(args["max_results"] ?? 100));
     if (!pattern) throw new ToolError("glob_files", "pattern is required");
-    if (!existsSync11(rootPath)) throw new ToolError("glob_files", `Path not found: ${rootPath}`);
+    if (!existsSync12(rootPath)) throw new ToolError("glob_files", `Path not found: ${rootPath}`);
     const regex = globToRegex(pattern);
     const matches = [];
     collectMatchingFiles(rootPath, rootPath, regex, matches, maxResults);
@@ -7856,7 +8353,7 @@ function collectMatchingFiles(dirPath, rootPath, regex, results, maxResults) {
   }
   for (const entry of entries) {
     if (results.length >= maxResults) break;
-    const fullPath = join6(dirPath, entry.name);
+    const fullPath = join7(dirPath, entry.name);
     if (entry.isDirectory()) {
       if (SKIP_DIRS2.has(entry.name) || entry.name.startsWith(".")) continue;
       collectMatchingFiles(fullPath, rootPath, regex, results, maxResults);
@@ -7938,7 +8435,7 @@ var runInteractiveTool = {
       PYTHONDONTWRITEBYTECODE: "1"
     };
     const prefixWarnings = [argsTypeWarning, stdinTypeWarning].filter(Boolean).join("");
-    return new Promise((resolve8) => {
+    return new Promise((resolve9) => {
       const child = spawn2(executable, cmdArgs.map(String), {
         cwd: process.cwd(),
         env,
@@ -7971,22 +8468,22 @@ var runInteractiveTool = {
       setTimeout(writeNextLine, 400);
       const timer = setTimeout(() => {
         child.kill();
-        resolve8(`${prefixWarnings}[Timeout after ${timeout}ms]
+        resolve9(`${prefixWarnings}[Timeout after ${timeout}ms]
 ${buildOutput(stdout, stderr)}`);
       }, timeout);
       child.on("close", (code) => {
         clearTimeout(timer);
         const output = buildOutput(stdout, stderr);
         if (code !== 0 && code !== null) {
-          resolve8(`${prefixWarnings}Exit code ${code}:
+          resolve9(`${prefixWarnings}Exit code ${code}:
 ${output}`);
         } else {
-          resolve8(`${prefixWarnings}${output || "(no output)"}`);
+          resolve9(`${prefixWarnings}${output || "(no output)"}`);
         }
       });
       child.on("error", (err) => {
         clearTimeout(timer);
-        resolve8(
+        resolve9(
           `${prefixWarnings}Failed to start process "${executable}": ${err.message}
 Hint: On Windows, use the full path to the executable, e.g.:
   C:\\Users\\Jinzd\\anaconda3\\envs\\python312\\python.exe`
@@ -8596,7 +9093,7 @@ ${preamble}`;
 }
 
 // src/tools/builtin/save-last-response.ts
-import { mkdirSync as mkdirSync5, unlinkSync as unlinkSync3, rmdirSync as rmdirSync2 } from "fs";
+import { mkdirSync as mkdirSync6, unlinkSync as unlinkSync3, rmdirSync as rmdirSync2 } from "fs";
 import { dirname as dirname4 } from "path";
 var lastResponseStore = { content: "" };
 function cleanupRejectedTeeFile(filePath) {
@@ -8646,7 +9143,7 @@ Any of these triggers means use save_last_response, NOT write_file:
       throw new ToolError("save_last_response", "No content to save: AI has not produced any response yet, or the last response was empty.");
     }
     undoStack.push(filePath, `save_last_response: ${filePath}`);
-    mkdirSync5(dirname4(filePath), { recursive: true });
+    mkdirSync6(dirname4(filePath), { recursive: true });
     atomicWriteFileSync(filePath, content);
     const lines = content.split("\n").length;
     return `File saved: ${filePath} (${lines} lines, ${content.length} bytes)`;
@@ -8654,11 +9151,11 @@ Any of these triggers means use save_last_response, NOT write_file:
 };
 
 // src/tools/builtin/save-memory.ts
-import { existsSync as existsSync12, readFileSync as readFileSync9, statSync as statSync6, mkdirSync as mkdirSync6 } from "fs";
-import { join as join7 } from "path";
+import { existsSync as existsSync13, readFileSync as readFileSync10, statSync as statSync6, mkdirSync as mkdirSync7 } from "fs";
+import { join as join8 } from "path";
 import { homedir as homedir5 } from "os";
 function getMemoryFilePath() {
-  return join7(homedir5(), CONFIG_DIR_NAME, MEMORY_FILE_NAME);
+  return join8(homedir5(), CONFIG_DIR_NAME, MEMORY_FILE_NAME);
 }
 function formatTimestamp() {
   const now = /* @__PURE__ */ new Date();
@@ -8682,16 +9179,16 @@ var saveMemoryTool = {
     const content = String(args["content"] ?? "").trim();
     if (!content) throw new ToolError("save_memory", "content is required");
     const memoryPath = getMemoryFilePath();
-    const configDir = join7(homedir5(), CONFIG_DIR_NAME);
-    if (!existsSync12(configDir)) {
-      mkdirSync6(configDir, { recursive: true });
+    const configDir = join8(homedir5(), CONFIG_DIR_NAME);
+    if (!existsSync13(configDir)) {
+      mkdirSync7(configDir, { recursive: true });
     }
     const timestamp = formatTimestamp();
     const entry = `
 ## ${timestamp}
 ${content}
 `;
-    const previous = existsSync12(memoryPath) ? readFileSync9(memoryPath, "utf-8") : "";
+    const previous = existsSync13(memoryPath) ? readFileSync10(memoryPath, "utf-8") : "";
     atomicWriteFileSync(memoryPath, previous + entry);
     const byteSize = statSync6(memoryPath).size;
     return `Memory saved successfully. File size: ${byteSize} bytes in ${MEMORY_FILE_NAME}`;
@@ -8738,7 +9235,7 @@ function promptUser(rl, question) {
   console.log();
   console.log(chalk4.cyan("\u2753 ") + chalk4.bold(question));
   process.stdout.write(chalk4.cyan("> "));
-  return new Promise((resolve8) => {
+  return new Promise((resolve9) => {
     let completed = false;
     const cleanup = (answer) => {
       if (completed) return;
@@ -8748,7 +9245,7 @@ function promptUser(rl, question) {
       rl.pause();
       rlAny.output = savedOutput;
       askUserContext.prompting = false;
-      resolve8(answer);
+      resolve9(answer);
     };
     const onLine = (line) => {
       cleanup(line);
@@ -9228,11 +9725,27 @@ var spawnAgentTool = {
     if (!ctx.provider) {
       throw new ToolError("spawn_agent", "provider not initialized (context not injected)");
     }
+    const hookConfig = ctx.configManager?.get("hooks") ?? void 0;
+    const hookConfigDir = ctx.configManager?.getConfigDir() ?? process.cwd();
+    const taskCount = singleTask ? 1 : tasksArr.length;
+    const hookPayload = {
+      task: singleTask || void 0,
+      tasks: tasksArr.length > 0 ? tasksArr : void 0,
+      taskCount,
+      maxRounds
+    };
+    const startDecisions = runLifecycleHooks(hookConfig, "SubagentStart", hookPayload, hookConfigDir);
+    const startDeny = startDecisions.find((d) => d.action === "deny");
+    if (startDeny) {
+      throw new ToolError("spawn_agent", "SubagentStart hook denied: " + (startDeny.reason ?? "denied"));
+    }
+    let subagentStatus = "error";
     const guardWasActive = subAgentGuard.active;
     subAgentGuard.active = true;
     try {
       if (singleTask) {
         const { content, usage } = await runSubAgent(singleTask, maxRounds, null, ctx);
+        subagentStatus = "ok";
         return [
           "## Sub-Agent Result",
           "",
@@ -9261,8 +9774,10 @@ var spawnAgentTool = {
       });
       lines.push("---");
       lines.push(`Total token usage: ${totalIn} input, ${totalOut} output`);
+      subagentStatus = "ok";
       return lines.join("\n");
     } finally {
+      runLifecycleHooks(hookConfig, "SubagentStop", { ...hookPayload, status: subagentStatus }, hookConfigDir);
       subAgentGuard.active = guardWasActive;
     }
   }
@@ -9485,14 +10000,14 @@ var taskStopTool = {
 
 // src/tools/builtin/git-tools.ts
 import { execFileSync as execFileSync2 } from "child_process";
-import { existsSync as existsSync13 } from "fs";
-import { join as join8 } from "path";
+import { existsSync as existsSync14 } from "fs";
+import { join as join9 } from "path";
 function assertGitRepo(cwd) {
   let dir = cwd;
   const root = dir.split(/[\\/]/)[0] + (dir.includes("\\") ? "\\" : "/");
   while (dir && dir !== root) {
-    if (existsSync13(join8(dir, ".git"))) return;
-    const parent = join8(dir, "..");
+    if (existsSync14(join9(dir, ".git"))) return;
+    const parent = join9(dir, "..");
     if (parent === dir) break;
     dir = parent;
   }
@@ -9757,9 +10272,9 @@ ${commitOutput.trim()}`;
 };
 
 // src/tools/builtin/notebook-edit.ts
-import { readFileSync as readFileSync10, existsSync as existsSync14 } from "fs";
+import { readFileSync as readFileSync11, existsSync as existsSync15 } from "fs";
 import { writeFile } from "fs/promises";
-import { resolve as resolve4, extname as extname2 } from "path";
+import { resolve as resolve5, extname as extname2 } from "path";
 var notebookEditTool = {
   definition: {
     name: "notebook_edit",
@@ -9808,14 +10323,14 @@ var notebookEditTool = {
     if (!Number.isInteger(cellIndexRaw) || cellIndexRaw < 1) {
       throw new ToolError("notebook_edit", "cell_index must be a positive integer (1-based)");
     }
-    const absPath = resolve4(filePath);
+    const absPath = resolve5(filePath);
     if (extname2(absPath).toLowerCase() !== ".ipynb") {
       throw new ToolError("notebook_edit", "path must point to a .ipynb file");
     }
-    if (!existsSync14(absPath)) {
+    if (!existsSync15(absPath)) {
       throw new ToolError("notebook_edit", `Notebook not found: ${filePath}`);
     }
-    const raw = readFileSync10(absPath, "utf-8");
+    const raw = readFileSync11(absPath, "utf-8");
     const nb = parseNotebook(raw);
     const cellIdx0 = cellIndexRaw - 1;
     undoStack.push(absPath, `notebook_edit (${action}): ${filePath}`);
@@ -10232,8 +10747,8 @@ function estimateToolDefinitionTokens(def) {
 
 // src/tools/registry.ts
 import { pathToFileURL } from "url";
-import { existsSync as existsSync15, mkdirSync as mkdirSync7, readdirSync as readdirSync7 } from "fs";
-import { join as join9 } from "path";
+import { existsSync as existsSync16, mkdirSync as mkdirSync8, readdirSync as readdirSync7 } from "fs";
+import { join as join10 } from "path";
 var ToolRegistry = class {
   tools = /* @__PURE__ */ new Map();
   pluginToolNames = /* @__PURE__ */ new Set();
@@ -10394,9 +10909,9 @@ var ToolRegistry = class {
    * Returns the number of successfully loaded plugins.
    */
   async loadPlugins(pluginsDir, allowPlugins = false) {
-    if (!existsSync15(pluginsDir)) {
+    if (!existsSync16(pluginsDir)) {
       try {
-        mkdirSync7(pluginsDir, { recursive: true });
+        mkdirSync8(pluginsDir, { recursive: true });
       } catch {
       }
       return 0;
@@ -10420,12 +10935,12 @@ var ToolRegistry = class {
     process.stderr.write(
       `
 [plugins] \u26A0 Loading ${files.length} plugin(s) with FULL system privileges:
-` + files.map((f) => `  + ${join9(pluginsDir, f)}`).join("\n") + "\n\n"
+` + files.map((f) => `  + ${join10(pluginsDir, f)}`).join("\n") + "\n\n"
     );
     let loaded = 0;
     for (const file of files) {
       try {
-        const fileUrl = pathToFileURL(join9(pluginsDir, file)).href;
+        const fileUrl = pathToFileURL(join10(pluginsDir, file)).href;
         const mod = await import(fileUrl);
         const tool = mod.tool ?? mod.default?.tool ?? mod.default;
         if (!tool || typeof tool.execute !== "function" || !tool.definition?.name) {
@@ -10587,7 +11102,7 @@ var McpClient = class {
   // 内部方法：JSON-RPC 通信
   // ══════════════════════════════════════════════════════════════════
   sendRequest(method, params) {
-    return new Promise((resolve8, reject) => {
+    return new Promise((resolve9, reject) => {
       if (!this.process?.stdin?.writable) {
         return reject(new Error(`MCP server [${this.serverId}] stdin not writable`));
       }
@@ -10611,7 +11126,7 @@ var McpClient = class {
       this.pendingRequests.set(id, {
         resolve: (result) => {
           cleanup();
-          resolve8(result);
+          resolve9(result);
         },
         reject: (error) => {
           cleanup();
@@ -10688,13 +11203,13 @@ var McpClient = class {
   }
   /** Promise 超时包装 */
   withTimeout(promise, ms, label) {
-    return new Promise((resolve8, reject) => {
+    return new Promise((resolve9, reject) => {
       const timer = setTimeout(() => {
         reject(new Error(`MCP [${this.serverId}] ${label} timed out after ${ms}ms`));
       }, ms);
       promise.then((val) => {
         clearTimeout(timer);
-        resolve8(val);
+        resolve9(val);
       }).catch((err) => {
         clearTimeout(timer);
         reject(err);
@@ -10971,11 +11486,11 @@ var McpManager = class {
 };
 
 // src/skills/manager.ts
-import { existsSync as existsSync16, readdirSync as readdirSync8, mkdirSync as mkdirSync8, statSync as statSync7 } from "fs";
-import { join as join10 } from "path";
+import { existsSync as existsSync17, readdirSync as readdirSync8, mkdirSync as mkdirSync9, statSync as statSync7 } from "fs";
+import { join as join11 } from "path";
 
 // src/skills/types.ts
-import { readFileSync as readFileSync11 } from "fs";
+import { readFileSync as readFileSync12 } from "fs";
 import { basename as basename5 } from "path";
 function parseSimpleYaml(yaml) {
   const result = {};
@@ -10997,7 +11512,7 @@ function parseYamlArray(value) {
 function parseSkillFile(filePath) {
   let raw;
   try {
-    raw = readFileSync11(filePath, "utf-8");
+    raw = readFileSync12(filePath, "utf-8");
   } catch {
     return null;
   }
@@ -11040,9 +11555,9 @@ var SkillManager = class {
   /** 发现并加载 skillsDir 下所有 .md 文件，返回加载数量 */
   loadSkills() {
     this.skills.clear();
-    if (!existsSync16(this.skillsDir)) {
+    if (!existsSync17(this.skillsDir)) {
       try {
-        mkdirSync8(this.skillsDir, { recursive: true });
+        mkdirSync9(this.skillsDir, { recursive: true });
       } catch {
       }
       return 0;
@@ -11055,14 +11570,14 @@ var SkillManager = class {
     }
     for (const entry of entries) {
       let filePath;
-      const fullPath = join10(this.skillsDir, entry);
+      const fullPath = join11(this.skillsDir, entry);
       if (entry.endsWith(".md")) {
         filePath = fullPath;
       } else {
         try {
           if (statSync7(fullPath).isDirectory()) {
-            const skillMd = join10(fullPath, "SKILL.md");
-            if (existsSync16(skillMd)) {
+            const skillMd = join11(fullPath, "SKILL.md");
+            if (existsSync17(skillMd)) {
               filePath = skillMd;
             } else {
               continue;
@@ -11126,7 +11641,8 @@ var SkillManager = class {
 
 // src/web/tool-executor-web.ts
 import { randomUUID as randomUUID2 } from "crypto";
-import { existsSync as existsSync17, readFileSync as readFileSync12 } from "fs";
+import { tmpdir as tmpdir2 } from "os";
+import { existsSync as existsSync18, readFileSync as readFileSync13 } from "fs";
 var ToolExecutorWeb = class _ToolExecutorWeb {
   constructor(registry, ws) {
     this.registry = registry;
@@ -11137,6 +11653,12 @@ var ToolExecutorWeb = class _ToolExecutorWeb {
   hookConfig;
   permissionRules = [];
   defaultPermission = "confirm";
+  permissionProfileName = "legacy";
+  permissionProfile;
+  allowedPermissionProfiles = [];
+  workspaceRoot = process.cwd();
+  networkPolicy;
+  hookConfigDir = process.cwd();
   /** Pending confirm promises keyed by requestId */
   pendingConfirms = /* @__PURE__ */ new Map();
   /** Pending batch confirm promises */
@@ -11171,6 +11693,12 @@ var ToolExecutorWeb = class _ToolExecutorWeb {
     this.hookConfig = opts.hookConfig;
     if (opts.permissionRules) this.permissionRules = opts.permissionRules;
     if (opts.defaultPermission) this.defaultPermission = opts.defaultPermission;
+    if (opts.permissionProfileName) this.permissionProfileName = opts.permissionProfileName;
+    if (opts.permissionProfile) this.permissionProfile = opts.permissionProfile;
+    if (opts.allowedPermissionProfiles) this.allowedPermissionProfiles = opts.allowedPermissionProfiles;
+    if (opts.workspaceRoot) this.workspaceRoot = opts.workspaceRoot;
+    if (opts.networkPolicy) this.networkPolicy = opts.networkPolicy;
+    if (opts.hookConfigDir) this.hookConfigDir = opts.hookConfigDir;
   }
   /** Clear M7 timeout timer for a requestId */
   clearPendingTimer(requestId) {
@@ -11182,33 +11710,33 @@ var ToolExecutorWeb = class _ToolExecutorWeb {
   }
   /** Resolve a pending confirm from client response */
   resolveConfirm(requestId, approved) {
-    const resolve8 = this.pendingConfirms.get(requestId);
-    if (resolve8) {
+    const resolve9 = this.pendingConfirms.get(requestId);
+    if (resolve9) {
       this.clearPendingTimer(requestId);
       this.pendingConfirms.delete(requestId);
       this.confirming = false;
-      resolve8(approved);
+      resolve9(approved);
     }
   }
   /** Resolve a pending batch confirm from client response */
   resolveBatchConfirm(requestId, decision) {
-    const resolve8 = this.pendingBatchConfirms.get(requestId);
-    if (resolve8) {
+    const resolve9 = this.pendingBatchConfirms.get(requestId);
+    if (resolve9) {
       this.clearPendingTimer(requestId);
       this.pendingBatchConfirms.delete(requestId);
       this.confirming = false;
       if (decision === "all" || decision === "none") {
-        resolve8(decision);
+        resolve9(decision);
       } else {
-        resolve8(new Set(decision));
+        resolve9(new Set(decision));
       }
     }
   }
   /** Cancel all pending confirms (e.g., on disconnect) */
   cancelAll() {
-    for (const resolve8 of this.pendingConfirms.values()) resolve8(false);
+    for (const resolve9 of this.pendingConfirms.values()) resolve9(false);
     this.pendingConfirms.clear();
-    for (const resolve8 of this.pendingBatchConfirms.values()) resolve8("none");
+    for (const resolve9 of this.pendingBatchConfirms.values()) resolve9("none");
     this.pendingBatchConfirms.clear();
     this.confirming = false;
   }
@@ -11251,9 +11779,9 @@ var ToolExecutorWeb = class _ToolExecutorWeb {
     if (call.name === "write_file") {
       const filePath = String(call.arguments["path"] ?? "");
       const newContent = String(call.arguments["content"] ?? "");
-      if (filePath && existsSync17(filePath)) {
+      if (filePath && existsSync18(filePath)) {
         try {
-          const old = readFileSync12(filePath, "utf-8");
+          const old = readFileSync13(filePath, "utf-8");
           return renderDiff(old, newContent, { filePath });
         } catch {
         }
@@ -11284,8 +11812,8 @@ var ToolExecutorWeb = class _ToolExecutorWeb {
       diff: this.getDiffPreview(call)
     };
     this.send(msg);
-    return new Promise((resolve8) => {
-      this.pendingConfirms.set(requestId, resolve8);
+    return new Promise((resolve9) => {
+      this.pendingConfirms.set(requestId, resolve9);
       this.pendingTimers.set(requestId, setTimeout(() => {
         if (this.pendingConfirms.has(requestId)) {
           this.resolveConfirm(requestId, false);
@@ -11309,8 +11837,8 @@ var ToolExecutorWeb = class _ToolExecutorWeb {
       files
     };
     this.send(msg);
-    return new Promise((resolve8) => {
-      this.pendingBatchConfirms.set(requestId, resolve8);
+    return new Promise((resolve9) => {
+      this.pendingBatchConfirms.set(requestId, resolve9);
       this.pendingTimers.set(requestId, setTimeout(() => {
         if (this.pendingBatchConfirms.has(requestId)) {
           this.resolveBatchConfirm(requestId, "none");
@@ -11327,30 +11855,96 @@ var ToolExecutorWeb = class _ToolExecutorWeb {
       return { callId: call.id, content: `Unknown tool: ${call.name}`, isError: true };
     }
     const dangerLevel = getDangerLevel(call.name, call.arguments);
+    let toolCallStarted = false;
     runHook(this.hookConfig?.preToolExecution, {
       tool: call.name,
       dangerLevel,
       args: JSON.stringify(call.arguments).slice(0, 200)
     });
-    if (this.permissionRules.length > 0) {
-      const action = checkPermission(call.name, call.arguments, dangerLevel, this.permissionRules, this.defaultPermission);
-      if (action === "deny") {
-        return { callId: call.id, content: `[Permission denied] Tool ${call.name} is blocked by permission rules. Do not retry.`, isError: true };
+    const preToolDecisions = runLifecycleHooks(
+      this.hookConfig,
+      "PreToolUse",
+      { tool: call.name, dangerLevel, args: call.arguments },
+      { configDir: this.hookConfigDir, onSummary: (message) => this.send({ type: "info", message: `[hook] ${message}` }) }
+    );
+    const preDeny = preToolDecisions.find((d) => d.action === "deny");
+    if (preDeny) {
+      const result = {
+        callId: call.id,
+        content: `[Hook denied] ${preDeny.reason ?? `PreToolUse blocked ${call.name}`}. Do not retry without asking.`,
+        isError: true
+      };
+      this.sendToolCallResult(call, result.content, true);
+      return result;
+    }
+    for (const d of preToolDecisions) {
+      const warnings = [d.warning, ...d.warnings ?? []].filter(Boolean);
+      for (const warning of warnings) this.send({ type: "info", message: `[hook] ${warning}` });
+    }
+    const permission = checkPermissionWithProfile(
+      call.name,
+      call.arguments,
+      dangerLevel,
+      this.permissionRules,
+      this.defaultPermission,
+      {
+        profileName: this.permissionProfileName,
+        profile: this.permissionProfile,
+        allowedProfiles: this.allowedPermissionProfiles,
+        workspaceRoot: this.workspaceRoot,
+        tempDirs: [tmpdir2()]
       }
-      if (action === "auto-approve") {
-        this.sendToolCallStart(call);
-        try {
-          const rawContent = await runTool(tool, call.arguments, call.name);
-          const content = truncateOutput(rawContent, call.name);
-          this.sendToolCallResult(call, rawContent, false);
-          runHook(this.hookConfig?.postToolExecution, { tool: call.name, status: "ok" });
-          return { callId: call.id, content, isError: false };
-        } catch (err) {
-          const message = err instanceof Error ? err.message : String(err);
-          this.sendToolCallResult(call, message, true);
-          runHook(this.hookConfig?.postToolExecution, { tool: call.name, status: "error" });
-          return { callId: call.id, content: message, isError: true };
-        }
+    );
+    const networkPermission = checkNetworkPolicy(call.name, call.arguments, this.networkPolicy);
+    if (networkPermission?.action === "confirm" || permission.action === "confirm") {
+      runLifecycleHooks(
+        this.hookConfig,
+        "PermissionRequest",
+        { tool: call.name, dangerLevel, args: call.arguments, reason: networkPermission?.reason ?? permission.reason },
+        { configDir: this.hookConfigDir, onSummary: (message) => this.send({ type: "info", message: "[hook] " + message }) }
+      );
+    }
+    if (networkPermission?.action === "deny") {
+      const reason = networkPermission.reason ? ` (${networkPermission.reason})` : "";
+      return {
+        callId: call.id,
+        content: `[Permission denied] Tool ${call.name} is blocked by networkPolicy${reason}. Do not retry.`,
+        isError: true
+      };
+    }
+    if (permission.action === "deny") {
+      const reason = permission.reason ? ` (${permission.reason})` : "";
+      return {
+        callId: call.id,
+        content: `[Permission denied] Tool ${call.name} is blocked by permission profile "${permission.profileName}"${reason}. Do not retry.`,
+        isError: true
+      };
+    }
+    if (permission.action === "auto-approve" && networkPermission?.action !== "confirm") {
+      this.sendToolCallStart(call);
+      try {
+        const rawContent = await runTool(tool, call.arguments, call.name);
+        const content = truncateOutput(rawContent, call.name);
+        this.sendToolCallResult(call, rawContent, false);
+        runHook(this.hookConfig?.postToolExecution, { tool: call.name, status: "ok" });
+        runLifecycleHooks(this.hookConfig, "PostToolUse", { tool: call.name, status: "ok" }, { configDir: this.hookConfigDir });
+        return { callId: call.id, content, isError: false };
+      } catch (err) {
+        const message = err instanceof Error ? err.message : String(err);
+        this.sendToolCallResult(call, message, true);
+        runHook(this.hookConfig?.postToolExecution, { tool: call.name, status: "error" });
+        runLifecycleHooks(this.hookConfig, "PostToolUse", { tool: call.name, status: "error", error: message }, { configDir: this.hookConfigDir });
+        return { callId: call.id, content: message, isError: true };
+      }
+    }
+    if (networkPermission?.action === "confirm" && dangerLevel === "safe") {
+      this.sendToolCallStart(call);
+      toolCallStarted = true;
+      const confirmed = await this.confirm(call, "write");
+      if (!confirmed) {
+        const rejectionMsg = `[User cancelled] The user declined network access for ${call.name}. Do not retry without asking.`;
+        this.sendToolCallResult(call, rejectionMsg, true);
+        return { callId: call.id, content: rejectionMsg, isError: true };
       }
     }
     this.sendToolCallStart(call);
@@ -11360,11 +11954,13 @@ var ToolExecutorWeb = class _ToolExecutorWeb {
         const content = truncateOutput(rawContent, call.name);
         this.sendToolCallResult(call, rawContent, false);
         runHook(this.hookConfig?.postToolExecution, { tool: call.name, status: "ok" });
+        runLifecycleHooks(this.hookConfig, "PostToolUse", { tool: call.name, status: "ok" }, { configDir: this.hookConfigDir });
         return { callId: call.id, content, isError: false };
       } catch (err) {
         const message = err instanceof Error ? err.message : String(err);
         this.sendToolCallResult(call, message, true);
         runHook(this.hookConfig?.postToolExecution, { tool: call.name, status: "error" });
+        runLifecycleHooks(this.hookConfig, "PostToolUse", { tool: call.name, status: "error", error: message }, { configDir: this.hookConfigDir });
         return { callId: call.id, content: message, isError: true };
       }
     }
@@ -11382,11 +11978,13 @@ var ToolExecutorWeb = class _ToolExecutorWeb {
       const content = truncateOutput(rawContent, call.name);
       this.sendToolCallResult(call, rawContent, false);
       runHook(this.hookConfig?.postToolExecution, { tool: call.name, status: "ok" });
+      runLifecycleHooks(this.hookConfig, "PostToolUse", { tool: call.name, status: "ok" }, { configDir: this.hookConfigDir });
       return { callId: call.id, content, isError: false };
     } catch (err) {
       const message = err instanceof Error ? err.message : String(err);
       this.sendToolCallResult(call, message, true);
       runHook(this.hookConfig?.postToolExecution, { tool: call.name, status: "error" });
+      runLifecycleHooks(this.hookConfig, "PostToolUse", { tool: call.name, status: "error", error: message }, { configDir: this.hookConfigDir });
       return { callId: call.id, content: message, isError: true };
     }
   }
@@ -11409,6 +12007,9 @@ var ToolExecutorWeb = class _ToolExecutorWeb {
     return results;
   }
   async executeBatchFileWrites(items) {
+    if (this.permissionProfileName !== "legacy" || this.permissionRules.length > 0) {
+      return Promise.all(items.map(({ call }) => this.execute(call)));
+    }
     const calls = items.map((i) => i.call);
     const decision = this.sessionAutoApprove ? "all" : await this.batchConfirm(calls);
     const results = new Array(calls.length);
@@ -11454,20 +12055,20 @@ var ToolExecutorWeb = class _ToolExecutorWeb {
 };
 
 // src/core/system-prompt-builder.ts
-import { existsSync as existsSync19, readFileSync as readFileSync14 } from "fs";
-import { join as join12 } from "path";
+import { existsSync as existsSync20, readFileSync as readFileSync15 } from "fs";
+import { join as join13 } from "path";
 
 // src/repl/dev-state.ts
-import { existsSync as existsSync18, readFileSync as readFileSync13, unlinkSync as unlinkSync4, mkdirSync as mkdirSync9 } from "fs";
-import { join as join11 } from "path";
+import { existsSync as existsSync19, readFileSync as readFileSync14, unlinkSync as unlinkSync4, mkdirSync as mkdirSync10 } from "fs";
+import { join as join12 } from "path";
 import { homedir as homedir6 } from "os";
 function getDevStatePath() {
-  return join11(homedir6(), CONFIG_DIR_NAME, DEV_STATE_FILE_NAME);
+  return join12(homedir6(), CONFIG_DIR_NAME, DEV_STATE_FILE_NAME);
 }
 function loadDevState() {
   const path3 = getDevStatePath();
-  if (!existsSync18(path3)) return null;
-  const content = readFileSync13(path3, "utf-8").trim();
+  if (!existsSync19(path3)) return null;
+  const content = readFileSync14(path3, "utf-8").trim();
   return content || null;
 }
 
@@ -11525,9 +12126,9 @@ ${ctx.activeSkill.content}`);
   return { stable: stableParts.join("\n\n---\n\n"), volatile };
 }
 function loadMemoryContent(configDir) {
-  const memoryPath = join12(configDir, MEMORY_FILE_NAME);
-  if (!existsSync19(memoryPath)) return null;
-  let content = readFileSync14(memoryPath, "utf-8").trim();
+  const memoryPath = join13(configDir, MEMORY_FILE_NAME);
+  if (!existsSync20(memoryPath)) return null;
+  let content = readFileSync15(memoryPath, "utf-8").trim();
   if (!content) return null;
   if (content.length > MEMORY_MAX_CHARS) {
     content = content.slice(-MEMORY_MAX_CHARS);
@@ -11736,8 +12337,8 @@ function autoTrimSessionIfNeeded(session, sizeLimit = SESSION_SIZE_LIMIT) {
 }
 
 // src/core/context-files.ts
-import { existsSync as existsSync20, readFileSync as readFileSync15 } from "fs";
-import { join as join13, relative as relative3, resolve as resolve5 } from "path";
+import { existsSync as existsSync21, readFileSync as readFileSync16 } from "fs";
+import { join as join14, relative as relative3, resolve as resolve6 } from "path";
 function uniqueNonEmpty(values) {
   const seen = /* @__PURE__ */ new Set();
   const out = [];
@@ -11760,14 +12361,14 @@ function displayPath(filePath, cwd) {
   return filePath;
 }
 function isInsideOrEqual(parent, child) {
-  const rel = relative3(resolve5(parent), resolve5(child));
+  const rel = relative3(resolve6(parent), resolve6(child));
   return rel === "" || !!rel && !rel.startsWith("..") && !rel.startsWith("/") && !rel.startsWith("\\");
 }
 function readContextFile(level, filePath, cwd, maxBytes) {
   const name = filePath.split(/[\\/]/).pop() ?? filePath;
   const shown = displayPath(filePath, cwd);
   try {
-    const raw = readFileSync15(filePath);
+    const raw = readFileSync16(filePath);
     const byteCount = raw.byteLength;
     if (byteCount === 0) {
       return {
@@ -11814,8 +12415,8 @@ function readContextFile(level, filePath, cwd, maxBytes) {
 function findFirstContextFile(level, dir, cwd, candidates, maxBytes) {
   const skipped = [];
   for (const candidate of candidates) {
-    const filePath = join13(dir, candidate);
-    if (!existsSync20(filePath)) continue;
+    const filePath = join14(dir, candidate);
+    if (!existsSync21(filePath)) continue;
     const result = readContextFile(level, filePath, cwd, maxBytes);
     if (result.skipped) skipped.push(result.skipped);
     if (result.layer) return { layer: result.layer, skipped };
@@ -11823,7 +12424,7 @@ function findFirstContextFile(level, dir, cwd, candidates, maxBytes) {
   return { layer: null, skipped };
 }
 function loadContextFiles(options) {
-  const cwd = resolve5(options.cwd);
+  const cwd = resolve6(options.cwd);
   const maxBytes = options.maxBytes ?? CONTEXT_FILE_MAX_BYTES;
   const candidates = options.candidates ?? buildContextFileCandidates(options.fallbackFilenames);
   const skipped = [];
@@ -11831,7 +12432,7 @@ function loadContextFiles(options) {
     return { layers: [], mergedContent: "", skipped, totalChars: 0, totalBytes: 0, maxBytes, candidates };
   }
   if (options.setting && options.setting !== "auto") {
-    const filePath = resolve5(cwd, String(options.setting));
+    const filePath = resolve6(cwd, String(options.setting));
     if (!isInsideOrEqual(cwd, filePath)) {
       skipped.push({
         level: "single",
@@ -11842,7 +12443,7 @@ function loadContextFiles(options) {
       });
       return { layers: [], mergedContent: "", skipped, totalChars: 0, totalBytes: 0, maxBytes, candidates };
     }
-    if (!existsSync20(filePath)) {
+    if (!existsSync21(filePath)) {
       skipped.push({
         level: "single",
         filePath,
@@ -11875,7 +12476,7 @@ function loadContextFiles(options) {
     skipped.push(...result.skipped);
     if (result.layer) layers.push(result.layer);
   }
-  if (resolve5(options.cwd) !== resolve5(options.projectRoot)) {
+  if (resolve6(options.cwd) !== resolve6(options.projectRoot)) {
     const result = findFirstContextFile("local", options.cwd, cwd, candidates, maxBytes);
     skipped.push(...result.skipped);
     if (result.layer) layers.push(result.layer);
@@ -11893,13 +12494,13 @@ function loadContextFiles(options) {
 }
 
 // src/web/session-handler.ts
-import { existsSync as existsSync23, readFileSync as readFileSync17, writeFileSync as writeFileSync2, mkdirSync as mkdirSync10, readdirSync as readdirSync10, statSync as statSync9, createWriteStream } from "fs";
-import { join as join17, resolve as resolve6, dirname as dirname5 } from "path";
+import { existsSync as existsSync24, readFileSync as readFileSync18, writeFileSync as writeFileSync2, mkdirSync as mkdirSync11, readdirSync as readdirSync10, statSync as statSync9, createWriteStream } from "fs";
+import { join as join18, resolve as resolve7, dirname as dirname5 } from "path";
 
 // src/tools/git-context.ts
 import { execSync as execSync2 } from "child_process";
-import { existsSync as existsSync21 } from "fs";
-import { join as join14 } from "path";
+import { existsSync as existsSync22 } from "fs";
+import { join as join15 } from "path";
 function runGit2(cmd, cwd) {
   try {
     return execSync2(`git ${cmd}`, {
@@ -11916,7 +12517,7 @@ function getGitRoot(cwd = process.cwd()) {
   return runGit2("rev-parse --show-toplevel", cwd);
 }
 function getGitContext(cwd = process.cwd()) {
-  if (!existsSync21(join14(cwd, ".git"))) {
+  if (!existsSync22(join15(cwd, ".git"))) {
     const result = runGit2("rev-parse --git-dir", cwd);
     if (!result) return null;
   }
@@ -12045,8 +12646,8 @@ If no security issues found, state "\u2705 No security vulnerabilities detected"
 }
 
 // src/repl/commands/project-init.ts
-import { existsSync as existsSync22, readFileSync as readFileSync16, readdirSync as readdirSync9, statSync as statSync8 } from "fs";
-import { join as join15 } from "path";
+import { existsSync as existsSync23, readFileSync as readFileSync17, readdirSync as readdirSync9, statSync as statSync8 } from "fs";
+import { join as join16 } from "path";
 var SCAN_SKIP_DIRS = /* @__PURE__ */ new Set([
   "node_modules",
   ".git",
@@ -12090,11 +12691,11 @@ function scanDirTree(dir, maxDepth = 2, maxEntries = 80) {
     const sorted = filtered.sort((a, b) => {
       let aIsDir = false, bIsDir = false;
       try {
-        aIsDir = statSync8(join15(d, a)).isDirectory();
+        aIsDir = statSync8(join16(d, a)).isDirectory();
       } catch {
       }
       try {
-        bIsDir = statSync8(join15(d, b)).isDirectory();
+        bIsDir = statSync8(join16(d, b)).isDirectory();
       } catch {
       }
       if (aIsDir !== bIsDir) return aIsDir ? -1 : 1;
@@ -12102,7 +12703,7 @@ function scanDirTree(dir, maxDepth = 2, maxEntries = 80) {
     });
     for (let i = 0; i < sorted.length && count < maxEntries; i++) {
       const name = sorted[i];
-      const fullPath = join15(d, name);
+      const fullPath = join16(d, name);
       const isLast = i === sorted.length - 1;
       const connector = isLast ? "+-- " : "|-- ";
       let isDir;
@@ -12129,7 +12730,7 @@ function scanProject(cwd) {
     configFiles: [],
     directoryStructure: ""
   };
-  const check = (file) => existsSync22(join15(cwd, file));
+  const check = (file) => existsSync23(join16(cwd, file));
   const configCandidates = [
     "package.json",
     "tsconfig.json",
@@ -12156,7 +12757,7 @@ function scanProject(cwd) {
     info.type = "node";
     info.language = check("tsconfig.json") ? "TypeScript" : "JavaScript";
     try {
-      const pkg = JSON.parse(readFileSync16(join15(cwd, "package.json"), "utf-8"));
+      const pkg = JSON.parse(readFileSync17(join16(cwd, "package.json"), "utf-8"));
       const scripts = pkg.scripts ?? {};
       info.buildCommand = scripts.build ? "npm run build" : void 0;
       info.testCommand = scripts.test ? "npm test" : void 0;
@@ -12816,7 +13417,7 @@ function resolveRoleProviders(roles, lookup, defaultProvider, defaultModel, avai
 }
 
 // src/hub/persist.ts
-import { join as join16 } from "path";
+import { join as join17 } from "path";
 function discussionToMessages(state2) {
   const out = [];
   const t0 = state2.messages[0]?.timestamp ?? /* @__PURE__ */ new Date();
@@ -12854,7 +13455,7 @@ async function persistDiscussion(state2, config, defaultProvider, defaultModel)
   session.title = `[Hub] ${state2.topic.slice(0, 48)}`.replace(/\n/g, " ");
   session.titleAiGenerated = true;
   await sm.save();
-  return { id: session.id, path: join16(config.getHistoryDir(), `${session.id}.json`) };
+  return { id: session.id, path: join17(config.getHistoryDir(), `${session.id}.json`) };
 }
 
 // src/web/session-handler.ts
@@ -12953,7 +13554,28 @@ var SessionHandler = class {
     const hooks = this.config.get("hooks");
     const permissionRules = this.config.get("permissionRules");
     const defaultPermission = this.config.get("defaultPermission");
-    this.toolExecutor.setConfig({ hookConfig: hooks, permissionRules, defaultPermission });
+    const permissionProfileName = this.config.get("defaultPermissionProfile") ?? "legacy";
+    const permissionProfiles = this.config.get("permissionProfiles") ?? {};
+    this.toolExecutor.setConfig({
+      hookConfig: hooks,
+      hookConfigDir: this.config.getConfigDir(),
+      permissionRules,
+      defaultPermission,
+      permissionProfileName,
+      permissionProfile: permissionProfiles[permissionProfileName],
+      allowedPermissionProfiles: this.config.get("allowedPermissionProfiles") ?? [],
+      workspaceRoot: process.cwd(),
+      networkPolicy: this.config.get("networkPolicy")
+    });
+    const permissionProfileWarning = formatPermissionProfileWarning(permissionProfileName);
+    if (permissionProfileWarning) {
+      this.send({ type: "info", message: permissionProfileWarning });
+    }
+    const pendingHooks = getPendingHookTrust(hooks, this.config.getConfigDir());
+    if (pendingHooks.length > 0) {
+      this.send({ type: "info", message: `${pendingHooks.length} project hook(s) require trust. Use /hooks list and /hooks trust <id>.` });
+    }
+    runLifecycleHooks(hooks, "SessionStart", { source: "web" }, { configDir: this.config.getConfigDir() });
     this.sendStatus();
     askUserContext.rl = null;
     askUserContext.prompting = false;
@@ -12988,6 +13610,7 @@ var SessionHandler = class {
       messageCount: this.sessions.current?.messages.length ?? 0,
       planMode: this.planMode,
       thinkingMode: this.runtimeThinking ?? false,
+      permissionProfile: this.config.get("defaultPermissionProfile") ?? "legacy",
       tokenUsage: { ...this.sessionTokenUsage },
       costUsd,
       providers: providerList,
@@ -13016,10 +13639,10 @@ var SessionHandler = class {
         return;
       }
       case "ask_user_response": {
-        const resolve8 = this.pendingAskUser.get(msg.requestId);
-        if (resolve8) {
+        const resolve9 = this.pendingAskUser.get(msg.requestId);
+        if (resolve9) {
           this.pendingAskUser.delete(msg.requestId);
-          resolve8(msg.answer);
+          resolve9(msg.answer);
         }
         return;
       }
@@ -13030,10 +13653,10 @@ var SessionHandler = class {
       case "memory_rebuild":
         return this.handleMemoryRebuild(Boolean(msg.full));
       case "auto_pause_response": {
-        const resolve8 = this.pendingAutoPause.get(msg.requestId);
-        if (resolve8) {
+        const resolve9 = this.pendingAutoPause.get(msg.requestId);
+        if (resolve9) {
           this.pendingAutoPause.delete(msg.requestId);
-          resolve8({ action: msg.action, message: msg.message });
+          resolve9({ action: msg.action, message: msg.message });
         }
         return;
       }
@@ -13048,10 +13671,10 @@ var SessionHandler = class {
         this.hubOrchestrator?.abort();
         return;
       case "hub_steer": {
-        const resolve8 = this.pendingHubReview.get(msg.requestId);
-        if (resolve8) {
+        const resolve9 = this.pendingHubReview.get(msg.requestId);
+        if (resolve9) {
           this.pendingHubReview.delete(msg.requestId);
-          resolve8({ action: msg.action, message: msg.message });
+          resolve9({ action: msg.action, message: msg.message });
         }
         return;
       }
@@ -13061,11 +13684,12 @@ var SessionHandler = class {
     }
   }
   onDisconnect() {
+    runLifecycleHooks(this.config.get("hooks") ?? void 0, "Stop", { sessionId: this.sessions.current?.id }, { configDir: this.config.getConfigDir() });
     this.toolExecutor.cancelAll();
     if (this.abortController) this.abortController.abort();
-    for (const resolve8 of this.pendingAskUser.values()) resolve8(null);
+    for (const resolve9 of this.pendingAskUser.values()) resolve9(null);
     this.pendingAskUser.clear();
-    for (const resolve8 of this.pendingAutoPause.values()) resolve8({ action: "stop" });
+    for (const resolve9 of this.pendingAutoPause.values()) resolve9({ action: "stop" });
     this.pendingAutoPause.clear();
     this.saveIfNeeded();
   }
@@ -13199,9 +13823,9 @@ var SessionHandler = class {
     this.hubOrchestrator = orchestrator;
     orchestrator.onEvent = (event) => this.send({ type: "hub_event", event });
     if (config.humanSteer) {
-      orchestrator.onRoundReview = ({ round, maxRounds }) => new Promise((resolve8) => {
+      orchestrator.onRoundReview = ({ round, maxRounds }) => new Promise((resolve9) => {
         const requestId = `hubrev_${Date.now()}_${Math.random().toString(36).slice(2, 8)}`;
-        this.pendingHubReview.set(requestId, resolve8);
+        this.pendingHubReview.set(requestId, resolve9);
         this.send({ type: "hub_review", requestId, round, maxRounds });
       });
     }
@@ -13238,6 +13862,26 @@ var SessionHandler = class {
     try {
       this.ensureSession();
       const session = this.sessions.current;
+      const promptDecisions = runLifecycleHooks(
+        this.config.get("hooks") ?? void 0,
+        "UserPromptSubmit",
+        { sessionId: session.id, prompt: content },
+        { configDir: this.config.getConfigDir(), onSummary: (message) => this.send({ type: "info", message: "[hook] " + message }) }
+      );
+      const promptDeny = promptDecisions.find((d) => d.action === "deny");
+      if (promptDeny) {
+        this.send({ type: "error", message: "Prompt blocked by hook: " + (promptDeny.reason ?? "UserPromptSubmit denied") });
+        return;
+      }
+      for (const d of promptDecisions) {
+        const warnings = [d.warning, ...d.warnings ?? []].filter(Boolean);
+        for (const warning of warnings) this.send({ type: "info", message: "[hook] " + warning });
+      }
+      const secretHits = scanString(content, { customRegexes: [] });
+      if (secretHits.length > 0) {
+        const kinds = [...new Set(secretHits.map((h) => h.kind))].join(", ");
+        this.send({ type: "info", message: "Possible secret in prompt (" + kinds + ")." });
+      }
       const ALLOWED_IMAGE_MIMES = /* @__PURE__ */ new Set(["image/png", "image/jpeg", "image/gif", "image/webp", "image/svg+xml"]);
       const MAX_IMAGE_SIZE = 10 * 1024 * 1024;
       let msgContent;
@@ -13513,7 +14157,7 @@ Try: /compact to reduce context, /clear to reset, or switch to a larger-context
           this.send({ type: "response_done", content, usage });
           if (pendingTeeSave && isCleanDocumentBody(content)) {
             try {
-              mkdirSync10(dirname5(pendingTeeSave), { recursive: true });
+              mkdirSync11(dirname5(pendingTeeSave), { recursive: true });
               const bodyToSave = stripOuterCodeFence(content);
               atomicWriteFileSync(pendingTeeSave, bodyToSave);
               undoStack.push(pendingTeeSave, `save_last_response (deferred): ${pendingTeeSave}`);
@@ -13538,8 +14182,8 @@ Try: /compact to reduce context, /clear to reset, or switch to a larger-context
         onMcpToolUsed: (name) => this.usedMcpToolNames.add(name),
         requestAutoPause: async ({ effectiveRound, maxToolRounds: totalRounds, toolSummary }) => {
           const requestId = `pause_${Date.now()}_${Math.random().toString(36).slice(2, 8)}`;
-          const pauseResp = await new Promise((resolve8) => {
-            this.pendingAutoPause.set(requestId, resolve8);
+          const pauseResp = await new Promise((resolve9) => {
+            this.pendingAutoPause.set(requestId, resolve9);
             this.send({
               type: "auto_pause_request",
               requestId,
@@ -13689,7 +14333,7 @@ ${summaryContent}`,
     let isError = false;
     let summary;
     try {
-      mkdirSync10(dirname5(saveToFile), { recursive: true });
+      mkdirSync11(dirname5(saveToFile), { recursive: true });
       fileStream = createWriteStream(saveToFile);
       const teeSystemPrompt = stripToolCallReminder(systemPrompt ?? "") + CONTENT_ONLY_STREAM_REMINDER;
       const teeExtraMessages = extraMessages.length > 0 ? [...extraMessages, { role: "user", content: TEE_FINAL_USER_NUDGE }] : [{ role: "user", content: TEE_FINAL_USER_NUDGE }];
@@ -13718,8 +14362,8 @@ ${summaryContent}`,
         }
         if (chunk.done) break;
       }
-      await new Promise((resolve8, reject) => {
-        fileStream.end((err) => err ? reject(err) : resolve8());
+      await new Promise((resolve9, reject) => {
+        fileStream.end((err) => err ? reject(err) : resolve9());
       });
       const verdict = evaluateTeeContent(fullContent, saveToFile, priorContent);
       if (verdict.kind === "reject") {
@@ -13745,7 +14389,7 @@ ${summaryContent}`,
     } catch (err) {
       if (fileStream) {
         try {
-          await new Promise((resolve8) => fileStream.end(() => resolve8()));
+          await new Promise((resolve9) => fileStream.end(() => resolve9()));
         } catch {
         }
       }
@@ -14275,9 +14919,9 @@ ${undoResults.map((r) => `  \u2022 ${r}`).join("\n")}` });
         let modifiedFiles = 0;
         const diffLines2 = [];
         for (const [filePath, { earliest }] of fileMap) {
-          const currentContent = existsSync23(filePath) ? (() => {
+          const currentContent = existsSync24(filePath) ? (() => {
             try {
-              return readFileSync17(filePath, "utf-8");
+              return readFileSync18(filePath, "utf-8");
             } catch {
               return null;
             }
@@ -14378,7 +15022,7 @@ ${undoResults.map((r) => `  \u2022 ${r}`).join("\n")}` });
           break;
         }
         const sub = args[0]?.toLowerCase();
-        const resolve8 = (ref) => {
+        const resolve9 = (ref) => {
           const r = session.resolveBranchRef(ref);
           if (r.ok) return r.id;
           if (r.reason === "ambiguous") {
@@ -14432,7 +15076,7 @@ ${undoResults.map((r) => `  \u2022 ${r}`).join("\n")}` });
             this.send({ type: "error", message: "Usage: /branch switch <id|title>" });
             break;
           }
-          const id = resolve8(ref);
+          const id = resolve9(ref);
           if (!id) break;
           const ok = session.switchBranch(id);
           if (ok) {
@@ -14452,7 +15096,7 @@ ${undoResults.map((r) => `  \u2022 ${r}`).join("\n")}` });
             this.send({ type: "error", message: "Usage: /branch delete <id|title>" });
             break;
           }
-          const id = resolve8(ref);
+          const id = resolve9(ref);
           if (!id) break;
           const ok = session.deleteBranch(id);
           if (ok) {
@@ -14471,7 +15115,7 @@ ${undoResults.map((r) => `  \u2022 ${r}`).join("\n")}` });
             this.send({ type: "error", message: "Usage: /branch rename <id|title> <new title>" });
             break;
           }
-          const id = resolve8(ref);
+          const id = resolve9(ref);
           if (!id) break;
           const ok = session.renameBranch(id, title);
           if (ok) {
@@ -14489,7 +15133,7 @@ ${undoResults.map((r) => `  \u2022 ${r}`).join("\n")}` });
             this.send({ type: "error", message: "Usage: /branch diff <id|title>" });
             break;
           }
-          const id = resolve8(ref);
+          const id = resolve9(ref);
           if (!id) break;
           const d = session.diffBranches(id);
           if (!d) {
@@ -14531,7 +15175,7 @@ ${undoResults.map((r) => `  \u2022 ${r}`).join("\n")}` });
             this.send({ type: "error", message: "Usage: /branch cherry-pick <source-id|title> <msg-index>" });
             break;
           }
-          const id = resolve8(ref);
+          const id = resolve9(ref);
           if (!id) break;
           const idx = parseInt(idxStr, 10);
           if (Number.isNaN(idx)) {
@@ -14793,7 +15437,7 @@ ${undoResults.map((r) => `  \u2022 ${r}`).join("\n")}` });
       case "test": {
         this.send({ type: "info", message: "\u{1F9EA} Running tests..." });
         try {
-          const { executeTests } = await import("./run-tests-NT2UIUVB.js");
+          const { executeTests } = await import("./run-tests-D7YBY4XB.js");
           const argStr = args.join(" ").trim();
           let testArgs = {};
           if (argStr) {
@@ -14810,9 +15454,9 @@ ${undoResults.map((r) => `  \u2022 ${r}`).join("\n")}` });
       // ── /init ───────────────────────────────────────────────────────
       case "init": {
         const cwd = process.cwd();
-        const targetPath = join17(cwd, "AICLI.md");
+        const targetPath = join18(cwd, "AICLI.md");
         const force = args.includes("--force");
-        if (existsSync23(targetPath) && !force) {
+        if (existsSync24(targetPath) && !force) {
           this.send({ type: "info", message: `AICLI.md already exists at ${targetPath}
 Use /init --force to overwrite.` });
           break;
@@ -14845,7 +15489,7 @@ Use /context reload to load it.` });
         lines.push("**Config Files:**");
         lines.push(`  Dir: ${configDir}`);
         const checkFile = (label, filePath) => {
-          const exists = existsSync23(filePath);
+          const exists = existsSync24(filePath);
           let extra = "";
           if (exists) {
             try {
@@ -14855,9 +15499,9 @@ Use /context reload to load it.` });
           }
           lines.push(`  ${exists ? "\u2713" : "\u2013"}  ${label.padEnd(14)} ${exists ? filePath + extra : "(not found)"}`);
         };
-        checkFile("config.json", join17(configDir, "config.json"));
-        checkFile("memory.md", join17(configDir, MEMORY_FILE_NAME));
-        checkFile("dev-state.md", join17(configDir, "dev-state.md"));
+        checkFile("config.json", join18(configDir, "config.json"));
+        checkFile("memory.md", join18(configDir, MEMORY_FILE_NAME));
+        checkFile("dev-state.md", join18(configDir, "dev-state.md"));
         lines.push("");
         if (this.mcpManager) {
           lines.push("**MCP Servers:**");
@@ -15044,8 +15688,8 @@ Use /add-dir remove to clear.` : "No directories added.\nUsage: /add-dir <path>
           this.send({ type: "info", message: "\u2713 All added directories removed from context." });
           break;
         }
-        const dirPath = resolve6(sub);
-        if (!existsSync23(dirPath)) {
+        const dirPath = resolve7(sub);
+        if (!existsSync24(dirPath)) {
           this.send({ type: "error", message: `Directory not found: ${dirPath}` });
           break;
         }
@@ -15061,8 +15705,8 @@ It will be included in AI context for subsequent messages.` });
       // ── /commands ───────────────────────────────────────────────────
       case "commands": {
         const configDir = this.config.getConfigDir();
-        const commandsDir = join17(configDir, CUSTOM_COMMANDS_DIR_NAME);
-        if (!existsSync23(commandsDir)) {
+        const commandsDir = join18(configDir, CUSTOM_COMMANDS_DIR_NAME);
+        if (!existsSync24(commandsDir)) {
           this.send({ type: "info", message: `No custom commands directory.
 Create: ${commandsDir}/ with .md files.` });
           break;
@@ -15088,7 +15732,7 @@ Add .md files to create commands.` });
       // ── /plugins ────────────────────────────────────────────────────
       case "plugins": {
         const configDir = this.config.getConfigDir();
-        const pluginsDir = join17(configDir, PLUGINS_DIR_NAME);
+        const pluginsDir = join18(configDir, PLUGINS_DIR_NAME);
         const pluginTools = this.toolRegistry.listPluginTools();
         const lines = [`\u{1F50C} **Plugins:**`, `Dir: ${pluginsDir}`, ""];
         if (pluginTools.length === 0) {
@@ -15143,6 +15787,21 @@ Add .md files to create commands.` });
       this.send({ type: "info", message: "Not enough messages to compact." });
       return;
     }
+    const preDecisions = runLifecycleHooks(
+      this.config.get("hooks") ?? void 0,
+      "PreCompact",
+      { sessionId: session.id, messageCount: session.messages.length, instruction },
+      { configDir: this.config.getConfigDir(), onSummary: (message) => this.send({ type: "info", message: "[hook] " + message }) }
+    );
+    const preDeny = preDecisions.find((d) => d.action === "deny");
+    if (preDeny) {
+      this.send({ type: "error", message: "Compact blocked by hook: " + (preDeny.reason ?? "PreCompact denied") });
+      return;
+    }
+    for (const d of preDecisions) {
+      const warnings = [d.warning, ...d.warnings ?? []].filter(Boolean);
+      for (const warning of warnings) this.send({ type: "info", message: "[hook] " + warning });
+    }
     const provider = this.providers.get(this.currentProvider);
     if (!provider) return;
     this.send({ type: "info", message: "Compacting conversation..." });
@@ -15162,7 +15821,15 @@ Add .md files to create commands.` });
       });
       const summaryMsg = { role: "user", content: "[Conversation summary]", timestamp: /* @__PURE__ */ new Date() };
       const ackMsg = { role: "assistant", content: response.content, timestamp: /* @__PURE__ */ new Date() };
-      session.compact(summaryMsg, ackMsg, keepLast);
+      const beforeCount = session.messages.length;
+      const removedCount = session.compact(summaryMsg, ackMsg, keepLast);
+      const afterCount = session.messages.length;
+      runLifecycleHooks(
+        this.config.get("hooks") ?? void 0,
+        "PostCompact",
+        { sessionId: session.id, beforeCount, afterCount, removedCount, keepLast, instruction },
+        { configDir: this.config.getConfigDir(), onSummary: (message) => this.send({ type: "info", message: "[hook] " + message }) }
+      );
       this.send({ type: "info", message: `Compacted: removed ${toSummarize.length} messages, kept last ${keepLast}.` });
       this.sendStatus();
     } catch (err) {
@@ -15262,11 +15929,11 @@ Add .md files to create commands.` });
   }
   memoryShow() {
     const configDir = this.config.getConfigDir();
-    const memPath = join17(configDir, MEMORY_FILE_NAME);
+    const memPath = join18(configDir, MEMORY_FILE_NAME);
     let content = "";
     try {
-      if (existsSync23(memPath)) {
-        content = readFileSync17(memPath, "utf-8");
+      if (existsSync24(memPath)) {
+        content = readFileSync18(memPath, "utf-8");
       }
     } catch (err) {
       process.stderr.write(`[web] Failed to read memory file: ${err instanceof Error ? err.message : err}
@@ -15280,11 +15947,11 @@ Add .md files to create commands.` });
   }
   memoryAdd(text) {
     const configDir = this.config.getConfigDir();
-    const memPath = join17(configDir, MEMORY_FILE_NAME);
+    const memPath = join18(configDir, MEMORY_FILE_NAME);
     try {
-      mkdirSync10(configDir, { recursive: true });
+      mkdirSync11(configDir, { recursive: true });
       const timestamp = (/* @__PURE__ */ new Date()).toISOString().slice(0, 19).replace("T", " ");
-      const previous = existsSync23(memPath) ? readFileSync17(memPath, "utf-8") : "";
+      const previous = existsSync24(memPath) ? readFileSync18(memPath, "utf-8") : "";
       const entry = `
 - [${timestamp}] ${text}
 `;
@@ -15296,7 +15963,7 @@ Add .md files to create commands.` });
   }
   memoryClear() {
     const configDir = this.config.getConfigDir();
-    const memPath = join17(configDir, MEMORY_FILE_NAME);
+    const memPath = join18(configDir, MEMORY_FILE_NAME);
     try {
       atomicWriteFileSync(memPath, "");
       this.send({ type: "info", message: "\u{1F5D1}\uFE0F Persistent memory cleared." });
@@ -15314,7 +15981,7 @@ Add .md files to create commands.` });
       return;
     }
     try {
-      const { searchChatMemory: searchChatMemory2, loadChatIndex: loadChatIndex2 } = await import("./chat-index-UBCWHBLR.js");
+      const { searchChatMemory: searchChatMemory2, loadChatIndex: loadChatIndex2 } = await import("./chat-index-R2E27VXN.js");
       const loaded = loadChatIndex2();
       if (!loaded || loaded.idx.chunks.length === 0) {
         this.send({ type: "memory_hits", query: q, hits: [], indexMissing: true });
@@ -15350,7 +16017,7 @@ Add .md files to create commands.` });
   }
   async handleMemoryStatus() {
     try {
-      const { getChatIndexStatus } = await import("./chat-index-UBCWHBLR.js");
+      const { getChatIndexStatus } = await import("./chat-index-R2E27VXN.js");
       const s = getChatIndexStatus();
       this.send({
         type: "memory_status",
@@ -15375,7 +16042,7 @@ Add .md files to create commands.` });
         type: "info",
         message: full ? "\u{1F9E0} Rebuilding chat memory index (this may take a while on first run \u2014 ~117 MB embedder)." : "\u{1F9E0} Refreshing chat memory index (incremental)\u2026"
       });
-      const { buildChatIndex } = await import("./chat-index-UBCWHBLR.js");
+      const { buildChatIndex } = await import("./chat-index-R2E27VXN.js");
       const stats = await buildChatIndex({
         full,
         onProgress: (p) => {
@@ -15530,8 +16197,8 @@ async function setupProxy(configProxy) {
 }
 
 // src/web/auth.ts
-import { existsSync as existsSync24, readFileSync as readFileSync18, writeFileSync as writeFileSync3, mkdirSync as mkdirSync11, readdirSync as readdirSync11, copyFileSync } from "fs";
-import { join as join18 } from "path";
+import { existsSync as existsSync25, readFileSync as readFileSync19, writeFileSync as writeFileSync3, mkdirSync as mkdirSync12, readdirSync as readdirSync11, copyFileSync } from "fs";
+import { join as join19 } from "path";
 import { createHmac, randomBytes, timingSafeEqual, pbkdf2Sync } from "crypto";
 var USERS_FILE = "users.json";
 var TOKEN_EXPIRY_HOURS = 24;
@@ -15546,7 +16213,7 @@ var AuthManager = class {
   db;
   constructor(baseDir) {
     this.baseDir = baseDir;
-    this.usersFile = join18(baseDir, USERS_FILE);
+    this.usersFile = join19(baseDir, USERS_FILE);
     this.db = this.loadOrCreate();
   }
   // ── Public API ─────────────────────────────────────────────────
@@ -15575,9 +16242,9 @@ var AuthManager = class {
     }
     const salt = randomBytes(16).toString("hex");
     const passwordHash = this.hashPassword(password, salt);
-    const dataDir = join18(USERS_DIR, username);
-    const fullDataDir = join18(this.baseDir, dataDir);
-    mkdirSync11(join18(fullDataDir, "history"), { recursive: true });
+    const dataDir = join19(USERS_DIR, username);
+    const fullDataDir = join19(this.baseDir, dataDir);
+    mkdirSync12(join19(fullDataDir, "history"), { recursive: true });
     const user = {
       username,
       passwordHash,
@@ -15692,7 +16359,7 @@ var AuthManager = class {
   getUserDataDir(username) {
     const user = this.db.users.find((u) => u.username === username);
     if (!user) throw new Error(`User not found: ${username}`);
-    return join18(this.baseDir, user.dataDir);
+    return join19(this.baseDir, user.dataDir);
   }
   /** List all usernames */
   listUsers() {
@@ -15728,30 +16395,30 @@ var AuthManager = class {
     const err = this.register(username, password);
     if (err) return err;
     const userDir = this.getUserDataDir(username);
-    const globalConfig = join18(this.baseDir, "config.json");
-    if (existsSync24(globalConfig)) {
+    const globalConfig = join19(this.baseDir, "config.json");
+    if (existsSync25(globalConfig)) {
       try {
-        const content = readFileSync18(globalConfig, "utf-8");
-        writeFileSync3(join18(userDir, "config.json"), content, "utf-8");
+        const content = readFileSync19(globalConfig, "utf-8");
+        writeFileSync3(join19(userDir, "config.json"), content, "utf-8");
       } catch {
       }
     }
-    const globalMemory = join18(this.baseDir, "memory.md");
-    if (existsSync24(globalMemory)) {
+    const globalMemory = join19(this.baseDir, "memory.md");
+    if (existsSync25(globalMemory)) {
       try {
-        const content = readFileSync18(globalMemory, "utf-8");
-        writeFileSync3(join18(userDir, "memory.md"), content, "utf-8");
+        const content = readFileSync19(globalMemory, "utf-8");
+        writeFileSync3(join19(userDir, "memory.md"), content, "utf-8");
       } catch {
       }
     }
-    const globalHistory = join18(this.baseDir, "history");
-    if (existsSync24(globalHistory)) {
+    const globalHistory = join19(this.baseDir, "history");
+    if (existsSync25(globalHistory)) {
       try {
         const files = readdirSync11(globalHistory).filter((f) => f.endsWith(".json"));
-        const userHistory = join18(userDir, "history");
+        const userHistory = join19(userDir, "history");
         for (const f of files) {
           try {
-            copyFileSync(join18(globalHistory, f), join18(userHistory, f));
+            copyFileSync(join19(globalHistory, f), join19(userHistory, f));
           } catch {
           }
         }
@@ -15762,9 +16429,9 @@ var AuthManager = class {
   }
   // ── Private methods ────────────────────────────────────────────
   loadOrCreate() {
-    if (existsSync24(this.usersFile)) {
+    if (existsSync25(this.usersFile)) {
       try {
-        return JSON.parse(readFileSync18(this.usersFile, "utf-8"));
+        return JSON.parse(readFileSync19(this.usersFile, "utf-8"));
       } catch {
       }
     }
@@ -15780,7 +16447,7 @@ var AuthManager = class {
     this.saveDB(this.db);
   }
   saveDB(db) {
-    mkdirSync11(this.baseDir, { recursive: true });
+    mkdirSync12(this.baseDir, { recursive: true });
     atomicWriteFileSync(this.usersFile, JSON.stringify(db, null, 2));
   }
   /** Legacy hash — kept only for migrating old users (v0.2.x) */
@@ -15816,7 +16483,7 @@ function getModuleDir() {
     }
   } catch {
   }
-  return resolve7(".");
+  return resolve8(".");
 }
 async function startWebServer(options = {}) {
   const port = options.port ?? 3e3;
@@ -15881,8 +16548,8 @@ async function startWebServer(options = {}) {
     }
   }
   let skillManager = null;
-  const skillsDir = join19(config.getConfigDir(), SKILLS_DIR_NAME);
-  if (existsSync25(skillsDir)) {
+  const skillsDir = join20(config.getConfigDir(), SKILLS_DIR_NAME);
+  if (existsSync26(skillsDir)) {
     skillManager = new SkillManager(skillsDir, config.get("ui").skillSizeWarn);
     skillManager.loadSkills();
     const count = skillManager.listSkills().length;
@@ -15953,18 +16620,18 @@ async function startWebServer(options = {}) {
     next();
   };
   const moduleDir = getModuleDir();
-  let clientDir = join19(moduleDir, "web", "client");
-  if (!existsSync25(clientDir)) {
-    clientDir = join19(moduleDir, "client");
+  let clientDir = join20(moduleDir, "web", "client");
+  if (!existsSync26(clientDir)) {
+    clientDir = join20(moduleDir, "client");
   }
-  if (!existsSync25(clientDir)) {
-    clientDir = join19(moduleDir, "..", "..", "src", "web", "client");
+  if (!existsSync26(clientDir)) {
+    clientDir = join20(moduleDir, "..", "..", "src", "web", "client");
   }
-  if (!existsSync25(clientDir)) {
-    clientDir = join19(process.cwd(), "src", "web", "client");
+  if (!existsSync26(clientDir)) {
+    clientDir = join20(process.cwd(), "src", "web", "client");
   }
   console.log(`   Static files: ${clientDir}`);
-  app.use("/vendor", express.static(join19(clientDir, "vendor"), { maxAge: "1y", immutable: true }));
+  app.use("/vendor", express.static(join20(clientDir, "vendor"), { maxAge: "1y", immutable: true }));
   app.use(express.static(clientDir));
   app.get("/api/status", (_req, res) => {
     res.json({
@@ -16031,10 +16698,10 @@ async function startWebServer(options = {}) {
   app.get("/api/files", requireAuth, (req, res) => {
     const cwd = process.cwd();
     const prefix = req.query.prefix || "";
-    const targetDir = join19(cwd, prefix);
+    const targetDir = join20(cwd, prefix);
     try {
-      const canonicalTarget = realpathSync(resolve7(targetDir));
-      const canonicalCwd = realpathSync(resolve7(cwd));
+      const canonicalTarget = realpathSync(resolve8(targetDir));
+      const canonicalCwd = realpathSync(resolve8(cwd));
       if (!canonicalTarget.startsWith(canonicalCwd + sep3) && canonicalTarget !== canonicalCwd) {
         res.json({ files: [] });
         return;
@@ -16048,7 +16715,7 @@ async function startWebServer(options = {}) {
       const entries = readdirSync12(targetDir, { withFileTypes: true });
       const files = entries.filter((e) => !SKIP.has(e.name) && !e.name.startsWith(".")).slice(0, 50).map((e) => ({
         name: e.name,
-        path: relative4(cwd, join19(targetDir, e.name)).replace(/\\/g, "/"),
+        path: relative4(cwd, join20(targetDir, e.name)).replace(/\\/g, "/"),
         isDir: e.isDirectory()
       }));
       res.json({ files });
@@ -16084,8 +16751,8 @@ async function startWebServer(options = {}) {
     try {
       const authUser = req._authUser;
       const histDir = authUser ? getUserShared(authUser).config.getHistoryDir() : config.getHistoryDir();
-      const filePath = join19(histDir, `${id}.json`);
-      if (!existsSync25(filePath)) {
+      const filePath = join20(histDir, `${id}.json`);
+      if (!existsSync26(filePath)) {
         res.status(404).json({ error: "Session not found" });
         return;
       }
@@ -16100,7 +16767,7 @@ async function startWebServer(options = {}) {
         res.status(404).json({ error: "Session not found" });
         return;
       }
-      const data = JSON.parse(readFileSync19(filePath, "utf-8"));
+      const data = JSON.parse(readFileSync20(filePath, "utf-8"));
       res.json({ session: data });
     } catch (err) {
       res.status(500).json({ error: err instanceof Error ? err.message : String(err) });
@@ -16113,10 +16780,10 @@ async function startWebServer(options = {}) {
       return;
     }
     const cwd = process.cwd();
-    const fullPath = resolve7(join19(cwd, filePath));
+    const fullPath = resolve8(join20(cwd, filePath));
     try {
       const canonicalFull = realpathSync(fullPath);
-      const canonicalCwd = realpathSync(resolve7(cwd));
+      const canonicalCwd = realpathSync(resolve8(cwd));
       if (!canonicalFull.startsWith(canonicalCwd + sep3) && canonicalFull !== canonicalCwd) {
         res.json({ error: "Access denied" });
         return;
@@ -16131,7 +16798,7 @@ async function startWebServer(options = {}) {
         res.json({ error: `File too large (${(stat.size / 1024).toFixed(0)} KB, max 512 KB)` });
         return;
       }
-      const content = readFileSync19(fullPath, "utf-8");
+      const content = readFileSync20(fullPath, "utf-8");
       res.json({ content, size: stat.size });
     } catch {
       res.json({ error: "Cannot read file" });
@@ -16335,7 +17002,7 @@ async function startWebServer(options = {}) {
   });
   const MAX_PORT_ATTEMPTS = 10;
   let actualPort = port;
-  const result = await new Promise((resolve8, reject) => {
+  const result = await new Promise((resolve9, reject) => {
     const tryListen = (attempt) => {
       server.once("error", (err) => {
         if (err.code === "EADDRINUSE" && attempt < MAX_PORT_ATTEMPTS) {
@@ -16366,7 +17033,7 @@ async function startWebServer(options = {}) {
         }
         console.log(`   Press Ctrl+C to stop
 `);
-        resolve8({ port: actualPort, host, url });
+        resolve9({ port: actualPort, host, url });
       });
     };
     tryListen(1);
@@ -16386,17 +17053,17 @@ function resolveProjectMcpPath() {
   const cwd = process.cwd();
   const gitRoot = getGitRoot(cwd);
   const projectRoot = gitRoot ?? cwd;
-  const configPath = join19(projectRoot, MCP_PROJECT_CONFIG_NAME);
-  return existsSync25(configPath) ? configPath : null;
+  const configPath = join20(projectRoot, MCP_PROJECT_CONFIG_NAME);
+  return existsSync26(configPath) ? configPath : null;
 }
 function loadProjectMcpConfig() {
   const cwd = process.cwd();
   const gitRoot = getGitRoot(cwd);
   const projectRoot = gitRoot ?? cwd;
-  const configPath = join19(projectRoot, MCP_PROJECT_CONFIG_NAME);
-  if (!existsSync25(configPath)) return null;
+  const configPath = join20(projectRoot, MCP_PROJECT_CONFIG_NAME);
+  if (!existsSync26(configPath)) return null;
   try {
-    const raw = JSON.parse(readFileSync19(configPath, "utf-8"));
+    const raw = JSON.parse(readFileSync20(configPath, "utf-8"));
     return raw.mcpServers ?? raw;
   } catch {
     return null;