jinzd-ai-cli 0.4.212 → 0.4.213

package/dist/{chunk-N5LB3PPL.js → chunk-THNECAAY.js}

@@ -5,10 +5,10 @@ import {
 } from "./chunk-T2NL5ZIA.js";
 import {
   runTestsTool
-} from "./chunk-HX6N6QEY.js";
+} from "./chunk-UDMU4FUF.js";
 import {
   runTool
-} from "./chunk-IFZX26K7.js";
+} from "./chunk-7NTFMLJJ.js";
 import {
   getDangerLevel,
   isFileWriteTool,
@@ -26,7 +26,7 @@ import {
   SUBAGENT_ALLOWED_TOOLS,
   SUBAGENT_DEFAULT_MAX_ROUNDS,
   SUBAGENT_MAX_ROUNDS_LIMIT
-} from "./chunk-GBBVCZ4W.js";
+} from "./chunk-IWLVH32D.js";
 import {
   fileCheckpoints
 } from "./chunk-4BKXL7SM.js";
@@ -1055,7 +1055,7 @@ import { dirname as dirname2 } from "path";
 
 // src/tools/executor.ts
 import chalk3 from "chalk";
-import { existsSync as existsSync5, readFileSync as readFileSync4 } from "fs";
+import { existsSync as existsSync6, readFileSync as readFileSync5 } from "fs";
 import { tmpdir } from "os";
 
 // src/core/readline-internal.ts
@@ -1860,6 +1860,157 @@ var theme = new Proxy(DARK_THEME, {
   }
 });
 
+// src/tools/action-classifier.ts
+import { existsSync as existsSync5, readFileSync as readFileSync4 } from "fs";
+import { isAbsolute as isAbsolute2, join as join2, resolve as resolve4 } from "path";
+var RECENT_DENIED_LIMIT = 50;
+var recentlyDenied = [];
+function recordRecentlyDeniedAutoAction(call, classification) {
+  recentlyDenied.unshift({
+    timestamp: (/* @__PURE__ */ new Date()).toISOString(),
+    tool: call.name,
+    reason: classification.reason,
+    ruleId: classification.ruleId,
+    argsPreview: JSON.stringify(call.arguments).slice(0, 240)
+  });
+  recentlyDenied.splice(RECENT_DENIED_LIMIT);
+}
+function getRecentlyDeniedAutoActions() {
+  return [...recentlyDenied];
+}
+function clearRecentlyDeniedAutoActions() {
+  recentlyDenied.splice(0, recentlyDenied.length);
+}
+function normalizePath(value) {
+  return value.replace(/\\/g, "/").replace(/\/+$/, "").toLowerCase();
+}
+function isInside(root, target) {
+  const absoluteRoot = resolve4(root);
+  const absoluteTarget = isAbsolute2(target) ? target : resolve4(root, target);
+  const base = normalizePath(absoluteRoot);
+  const t = normalizePath(absoluteTarget);
+  return t === base || t.startsWith(base + "/");
+}
+function getPathArg(call) {
+  const raw = call.arguments.path ?? call.arguments.filePath ?? call.arguments.outputPath ?? call.arguments.file;
+  return typeof raw === "string" && raw.trim() ? raw.trim() : null;
+}
+function splitShellWords(command) {
+  const out = [];
+  const re = /"([^"]*)"|'([^']*)'|([^\s]+)/g;
+  let m;
+  while (m = re.exec(command)) out.push(m[1] ?? m[2] ?? m[3] ?? "");
+  return out.filter(Boolean);
+}
+function readPackageManifest(root) {
+  const p = join2(root, "package.json");
+  if (!existsSync5(p)) return null;
+  try {
+    return JSON.parse(readFileSync4(p, "utf-8"));
+  } catch {
+    return null;
+  }
+}
+function manifestHasDependency(root, name) {
+  const manifest = readPackageManifest(root);
+  if (!manifest) return false;
+  for (const key of ["dependencies", "devDependencies", "peerDependencies", "optionalDependencies"]) {
+    const deps = manifest[key];
+    if (deps && typeof deps === "object" && Object.prototype.hasOwnProperty.call(deps, name)) return true;
+  }
+  return false;
+}
+function lockfileMentions(root, name) {
+  for (const file of ["package-lock.json", "pnpm-lock.yaml", "yarn.lock"]) {
+    const p = join2(root, file);
+    if (!existsSync5(p)) continue;
+    try {
+      if (readFileSync4(p, "utf-8").includes(name)) return true;
+    } catch {
+    }
+  }
+  return false;
+}
+function getInstallPackages(command) {
+  const words = splitShellWords(command);
+  const cmd = words[0]?.toLowerCase();
+  const sub = words[1]?.toLowerCase();
+  if (!cmd || !sub) return [];
+  const isInstall = cmd === "npm" && (sub === "install" || sub === "i" || sub === "add") || (cmd === "pnpm" || cmd === "yarn") && (sub === "add" || sub === "install");
+  if (!isInstall) return [];
+  return words.slice(2).filter((w) => !w.startsWith("-")).filter((w) => w !== "." && w !== "./").map((w) => w.replace(/^@([^/]+)\/([^@]+)(?:@.+)?$/, "@$1/$2").replace(/^([^@]+)@.+$/, "$1"));
+}
+function isPlainGitPush(command) {
+  if (!/^\s*git\s+push\b/i.test(command)) return false;
+  if (/--force|-f\b|\+[^\s]+/i.test(command)) return false;
+  return !/[;&|`$<>\n\r]/.test(command);
+}
+function hasSecretExfiltrationShape(command) {
+  return /(?:\.env|config\.json|id_rsa|id_ed25519|AWS_SECRET|AICLI_API_KEY|OPENAI_API_KEY|ANTHROPIC_API_KEY)/i.test(command) && /\b(curl|wget|scp|rsync|nc|netcat|Invoke-WebRequest|Invoke-RestMethod)\b/i.test(command);
+}
+var RuleBasedActionClassifier = class {
+  classify(call, dangerLevel, ctx) {
+    if (call.name === "bash") return this.classifyShell(call, dangerLevel, ctx);
+    if (call.name === "web_fetch" || call.name === "web_search" || call.name === "google_search") {
+      return { decision: "auto-approve", reason: "read-only HTTP tool", ruleId: "auto.readonly-http", confidence: "high" };
+    }
+    if (dangerLevel === "safe") {
+      return { decision: "auto-approve", reason: "safe read-only tool", ruleId: "auto.safe-tool", confidence: "high" };
+    }
+    if (dangerLevel === "write") {
+      const p = getPathArg(call);
+      if (p && (isInside(ctx.workspaceRoot, p) || (ctx.tempDirs ?? []).some((root) => isInside(root, p)))) {
+        return { decision: "auto-approve", reason: "explicit write inside workspace/temp roots", ruleId: "auto.workspace-write", confidence: "high" };
+      }
+      return { decision: "confirm", reason: "write action is not proven low-risk", ruleId: "auto.write-confirm", confidence: "medium" };
+    }
+    return { decision: "confirm", reason: "destructive actions require confirmation", ruleId: "auto.destructive-confirm", confidence: "high" };
+  }
+  classifyShell(call, dangerLevel, ctx) {
+    const command = String(call.arguments.command ?? "");
+    if (/\bcurl\b[^\n|;&]*\|\s*(?:sudo\s+)?(?:bash|sh|zsh)\b/i.test(command)) {
+      return { decision: "deny", reason: "curl pipe shell execution is blocked in auto mode", ruleId: "deny.curl-pipe-shell", confidence: "high" };
+    }
+    if (/\bgit\s+push\b/i.test(command) && /--force|-f\b|\+[^\s]+/i.test(command)) {
+      return { decision: "deny", reason: "force push is blocked in auto mode", ruleId: "deny.force-push", confidence: "high" };
+    }
+    if (hasSecretExfiltrationShape(command)) {
+      return { decision: "deny", reason: "possible secret exfiltration is blocked in auto mode", ruleId: "deny.secret-exfiltration", confidence: "high" };
+    }
+    if (/\b(terraform|tofu)\s+destroy\b|\bkubectl\s+delete\b|\bcdk\s+destroy\b/i.test(command)) {
+      return { decision: "confirm", reason: "infrastructure destroy requires confirmation", ruleId: "confirm.iac-destroy", confidence: "high" };
+    }
+    if (/\b(prisma|sequelize|knex|typeorm)\b[^\n]*\b(migrate|migration)\b|\bdb:migrate\b/i.test(command)) {
+      return { decision: "confirm", reason: "database migration requires confirmation", ruleId: "confirm.database-migration", confidence: "high" };
+    }
+    if (/\b(vercel|netlify|flyctl|railway|wrangler|serverless|firebase)\b[^\n]*\bdeploy\b|\bdeploy\b[^\n]*\b(prod|production)\b/i.test(command)) {
+      return { decision: "confirm", reason: "production deployment requires confirmation", ruleId: "confirm.production-deploy", confidence: "high" };
+    }
+    if (/\b(iam|policy|token|secret|api[-_]?key|credential|permission|role)\b/i.test(command)) {
+      return { decision: "confirm", reason: "credential or permission change requires confirmation", ruleId: "confirm.credentials-permissions", confidence: "medium" };
+    }
+    if (/\b(npx|pnpm\s+dlx|yarn\s+dlx)\s+(claude|codex|aider|cursor-agent|gemini)\b/i.test(command)) {
+      return { decision: "confirm", reason: "third-party agent loop requires confirmation", ruleId: "confirm.third-party-agent", confidence: "high" };
+    }
+    if (isPlainGitPush(command)) {
+      return { decision: "auto-approve", reason: "plain git push without force", ruleId: "auto.git-push", confidence: "high" };
+    }
+    const pkgs = getInstallPackages(command);
+    if (pkgs.length > 0) {
+      const allDeclared = pkgs.every((p) => manifestHasDependency(ctx.workspaceRoot, p) || lockfileMentions(ctx.workspaceRoot, p));
+      return allDeclared ? { decision: "auto-approve", reason: "installing dependencies already declared in manifest/lockfile", ruleId: "auto.declared-dependency-install", confidence: "medium" } : { decision: "confirm", reason: "dependency install includes undeclared packages", ruleId: "confirm.undeclared-dependency-install", confidence: "medium" };
+    }
+    if (/\b(curl|wget|Invoke-WebRequest|Invoke-RestMethod)\b/i.test(command) && !/[>|;&`$]/.test(command)) {
+      return { decision: "auto-approve", reason: "read-only HTTP shell command", ruleId: "auto.readonly-http-shell", confidence: "medium" };
+    }
+    if (dangerLevel === "safe") {
+      return { decision: "auto-approve", reason: "safe shell action", ruleId: "auto.safe-shell", confidence: "medium" };
+    }
+    return { decision: "confirm", reason: "shell action is not proven low-risk", ruleId: "confirm.shell-default", confidence: "medium" };
+  }
+};
+var defaultActionClassifier = new RuleBasedActionClassifier();
+
 // src/tools/executor.ts
 function buildErrorPreview(content) {
   const meaningful = content.split("\n").filter(
@@ -1899,6 +2050,8 @@ var ToolExecutor = class {
    * destructive 操作仍然必须逐次确认。
    */
   sessionAutoApprove = false;
+  /** Session-level Auto Mode: rule-based low-risk auto approval. */
+  sessionAutoMode = false;
   /**
    * Logical session key used to scope per-session state in stateful tools
    * (currently only `bash`'s persistent cwd). Web mode sets this per-tab so
@@ -2058,6 +2211,40 @@ var ToolExecutor = class {
         };
       }
     }
+    if (this.sessionAutoMode && networkPermission?.action !== "confirm") {
+      const classification = defaultActionClassifier.classify(call, dangerLevel, {
+        workspaceRoot: this.workspaceRoot,
+        tempDirs: [tmpdir()]
+      });
+      if (classification.decision === "deny") {
+        recordRecentlyDeniedAutoAction(call, classification);
+        return {
+          callId: call.id,
+          content: `[Auto denied] ${classification.reason}. Do not retry without asking.`,
+          isError: true
+        };
+      }
+      if (classification.decision === "auto-approve") {
+        this.printToolCall(call);
+        if (dangerLevel === "write") this.printDiffPreview(call);
+        console.log(theme.warning(`  \u26A1 Auto-approved (/auto: ${classification.ruleId})`));
+        try {
+          const rawContent = await runTool(tool, call.arguments, call.name);
+          const content = truncateOutput(rawContent, call.name);
+          const wasTruncated = content !== rawContent;
+          this.printToolResult(call.name, rawContent, false, wasTruncated);
+          runHook(this.hookConfig?.postToolExecution, { tool: call.name, status: "ok" });
+          runLifecycleHooks(this.hookConfig, "PostToolUse", { tool: call.name, status: "ok" }, { configDir: this.hookConfigDir });
+          return { callId: call.id, content, isError: false };
+        } catch (err) {
+          const message = err instanceof Error ? err.message : String(err);
+          this.printToolResult(call.name, message, true, false);
+          runHook(this.hookConfig?.postToolExecution, { tool: call.name, status: "error" });
+          runLifecycleHooks(this.hookConfig, "PostToolUse", { tool: call.name, status: "error", error: message }, { configDir: this.hookConfigDir });
+          return { callId: call.id, content: message, isError: true };
+        }
+      }
+    }
     if (this.sessionAutoApprove && dangerLevel === "write") {
       this.printToolCall(call);
       if (dangerLevel === "write") this.printDiffPreview(call);
@@ -2225,7 +2412,7 @@ var ToolExecutor = class {
     rl.resume();
     process.stdout.write(prompt);
     this.confirming = true;
-    return new Promise((resolve6) => {
+    return new Promise((resolve7) => {
       let completed = false;
       const cleanup = (result) => {
         if (completed) return;
@@ -2235,7 +2422,7 @@ var ToolExecutor = class {
         rl.pause();
         rlAny.output = savedOutput;
         this.confirming = false;
-        resolve6(result);
+        resolve7(result);
       };
       const onLine = (line) => {
         const trimmed = line.trim();
@@ -2302,10 +2489,10 @@ var ToolExecutor = class {
       const filePath = String(call.arguments["path"] ?? "");
       const newContent = String(call.arguments["content"] ?? "");
       if (!filePath) return;
-      if (existsSync5(filePath)) {
+      if (existsSync6(filePath)) {
         let oldContent;
         try {
-          oldContent = readFileSync4(filePath, "utf-8");
+          oldContent = readFileSync5(filePath, "utf-8");
         } catch {
           return;
         }
@@ -2328,7 +2515,7 @@ var ToolExecutor = class {
       }
     } else if (call.name === "edit_file") {
       const filePath = String(call.arguments["path"] ?? "");
-      if (!filePath || !existsSync5(filePath)) return;
+      if (!filePath || !existsSync6(filePath)) return;
       const oldStr = call.arguments["old_str"];
       const newStr = call.arguments["new_str"];
       if (oldStr !== void 0) {
@@ -2355,7 +2542,7 @@ var ToolExecutor = class {
         const to = Number(call.arguments["delete_to_line"] ?? from);
         let fileContent;
         try {
-          fileContent = readFileSync4(filePath, "utf-8");
+          fileContent = readFileSync5(filePath, "utf-8");
         } catch {
           return;
         }
@@ -2409,7 +2596,7 @@ var ToolExecutor = class {
     rl.resume();
     process.stdout.write(color("Proceed? [y/N] (type y + Enter to confirm) "));
     this.confirming = true;
-    return new Promise((resolve6) => {
+    return new Promise((resolve7) => {
       let completed = false;
       const cleanup = (answer) => {
         if (completed) return;
@@ -2419,7 +2606,7 @@ var ToolExecutor = class {
         rl.pause();
         rlAny.output = savedOutput;
         this.confirming = false;
-        resolve6(answer === "y");
+        resolve7(answer === "y");
       };
       const onLine = (line) => {
         const trimmed = line.trim();
@@ -2447,11 +2634,11 @@ var ToolExecutor = class {
 };
 
 // src/tools/sensitive-paths.ts
-import { resolve as resolve4, sep as sep2, basename as basename2 } from "path";
+import { resolve as resolve5, sep as sep2, basename as basename2 } from "path";
 import { homedir as homedir2 } from "os";
 var home = homedir2();
 function norm(p) {
-  const abs = resolve4(p);
+  const abs = resolve5(p);
   return process.platform === "win32" ? abs.toLowerCase() : abs;
 }
 function homeRel(p) {
@@ -2610,7 +2797,7 @@ Do NOT split a long document into many write_file(append=true) calls. That patte
 };
 
 // src/tools/builtin/edit-file.ts
-import { readFileSync as readFileSync5, existsSync as existsSync6 } from "fs";
+import { readFileSync as readFileSync6, existsSync as existsSync7 } from "fs";
 
 // src/tools/builtin/patch-apply.ts
 function parseUnifiedDiff(patch) {
@@ -2971,7 +3158,7 @@ Note: Path can be absolute or relative to cwd.`,
     const filePath = String(args["path"] ?? "");
     const encoding = args["encoding"] ?? "utf-8";
     if (!filePath) throw new ToolError("edit_file", "path is required");
-    if (!existsSync6(filePath)) throw new ToolError("edit_file", `File not found: ${filePath}`);
+    if (!existsSync7(filePath)) throw new ToolError("edit_file", `File not found: ${filePath}`);
     const verdict = classifyWritePath(filePath);
     if (verdict.sensitive && subAgentGuard.active) {
       throw new ToolError(
@@ -2979,7 +3166,7 @@ Note: Path can be absolute or relative to cwd.`,
         `Refused: sub-agents cannot edit sensitive paths \u2014 ${verdict.reason}. If this is genuinely needed, ask the parent agent to perform the edit so the user can approve it.`
       );
     }
-    const original = readFileSync5(filePath, encoding);
+    const original = readFileSync6(filePath, encoding);
     if (args["patch"] !== void 0) {
       const patchText = String(args["patch"] ?? "");
       const stopOnError = args["stop_on_error"] !== false;
@@ -3137,8 +3324,8 @@ function truncatePreview(str, maxLen = 80) {
 }
 
 // src/tools/builtin/list-dir.ts
-import { readdirSync as readdirSync3, statSync as statSync3, existsSync as existsSync7 } from "fs";
-import { join as join2, basename as basename3 } from "path";
+import { readdirSync as readdirSync3, statSync as statSync3, existsSync as existsSync8 } from "fs";
+import { join as join3, basename as basename3 } from "path";
 var listDirTool = {
   definition: {
     name: "list_dir",
@@ -3160,7 +3347,7 @@ var listDirTool = {
   async execute(args) {
     const dirPath = String(args["path"] ?? process.cwd());
     const recursive = Boolean(args["recursive"] ?? false);
-    if (!existsSync7(dirPath)) {
+    if (!existsSync8(dirPath)) {
       const targetName = basename3(dirPath).toLowerCase();
       const cwd = process.cwd();
       const suggestions = [];
@@ -3218,11 +3405,11 @@ function listRecursive(basePath, indent, recursive, lines) {
     if (entry.isDirectory()) {
       lines.push(`${indent}\u{1F4C1} ${entry.name}/`);
       if (recursive) {
-        listRecursive(join2(basePath, entry.name), indent + "  ", true, lines);
+        listRecursive(join3(basePath, entry.name), indent + "  ", true, lines);
       }
     } else {
       try {
-        const stat = statSync3(join2(basePath, entry.name));
+        const stat = statSync3(join3(basePath, entry.name));
         const size = formatSize(stat.size);
         lines.push(`${indent}\u{1F4C4} ${entry.name}  (${size})`);
       } catch {
@@ -3238,9 +3425,9 @@ function formatSize(bytes) {
 }
 
 // src/tools/builtin/grep-files.ts
-import { readdirSync as readdirSync4, readFileSync as readFileSync6, statSync as statSync4, existsSync as existsSync8 } from "fs";
+import { readdirSync as readdirSync4, readFileSync as readFileSync7, statSync as statSync4, existsSync as existsSync9 } from "fs";
 import { readFile } from "fs/promises";
-import { join as join3, relative } from "path";
+import { join as join4, relative } from "path";
 var grepFilesTool = {
   definition: {
     name: "grep_files",
@@ -3291,7 +3478,7 @@ Supports regex. Automatically skips node_modules, dist, .git directories.`,
     const contextLines = Math.max(0, Number(args["context_lines"] ?? 0));
     const maxResults = Math.max(1, Number(args["max_results"] ?? 50));
     if (!pattern) throw new ToolError("grep_files", "pattern is required");
-    if (!existsSync8(rootPath)) throw new ToolError("grep_files", `Path not found: ${rootPath}`);
+    if (!existsSync9(rootPath)) throw new ToolError("grep_files", `Path not found: ${rootPath}`);
     const MAX_PATTERN_LENGTH = 1e3;
     if (pattern.length > MAX_PATTERN_LENGTH) {
       throw new ToolError("grep_files", `Pattern too long (${pattern.length} chars, max ${MAX_PATTERN_LENGTH}). Use a shorter pattern.`);
@@ -3385,11 +3572,11 @@ function collectFilePaths(rootPath, filePattern, maxFiles) {
       if (paths.length >= maxFiles) return;
       if (entry.isDirectory()) {
         if (SKIP_DIRS.has(entry.name) || entry.name.startsWith(".")) continue;
-        walk(join3(dirPath, entry.name));
+        walk(join4(dirPath, entry.name));
       } else if (entry.isFile()) {
         if (isBinary(entry.name)) continue;
         if (filePattern && !matchesFilePattern(entry.name, filePattern)) continue;
-        const fullPath = join3(dirPath, entry.name);
+        const fullPath = join4(dirPath, entry.name);
         try {
           if (statSync4(fullPath).size > 1e6) continue;
         } catch {
@@ -3444,7 +3631,7 @@ function searchInFile(fullPath, displayPath, regex, contextLines, maxResults, re
   }
   let content;
   try {
-    content = readFileSync6(fullPath, "utf-8");
+    content = readFileSync7(fullPath, "utf-8");
   } catch {
     return;
   }
@@ -3475,8 +3662,8 @@ function searchInFile(fullPath, displayPath, regex, contextLines, maxResults, re
 }
 
 // src/tools/builtin/glob-files.ts
-import { readdirSync as readdirSync5, statSync as statSync5, existsSync as existsSync9 } from "fs";
-import { join as join4, relative as relative2, basename as basename4 } from "path";
+import { readdirSync as readdirSync5, statSync as statSync5, existsSync as existsSync10 } from "fs";
+import { join as join5, relative as relative2, basename as basename4 } from "path";
 var globFilesTool = {
   definition: {
     name: "glob_files",
@@ -3509,7 +3696,7 @@ Results sorted by most recent modification time. Automatically skips node_module
     const rootPath = String(args["path"] ?? process.cwd());
     const maxResults = Math.max(1, Number(args["max_results"] ?? 100));
     if (!pattern) throw new ToolError("glob_files", "pattern is required");
-    if (!existsSync9(rootPath)) throw new ToolError("glob_files", `Path not found: ${rootPath}`);
+    if (!existsSync10(rootPath)) throw new ToolError("glob_files", `Path not found: ${rootPath}`);
     const regex = globToRegex(pattern);
     const matches = [];
     collectMatchingFiles(rootPath, rootPath, regex, matches, maxResults);
@@ -3586,7 +3773,7 @@ function collectMatchingFiles(dirPath, rootPath, regex, results, maxResults) {
   }
   for (const entry of entries) {
     if (results.length >= maxResults) break;
-    const fullPath = join4(dirPath, entry.name);
+    const fullPath = join5(dirPath, entry.name);
     if (entry.isDirectory()) {
       if (SKIP_DIRS2.has(entry.name) || entry.name.startsWith(".")) continue;
       collectMatchingFiles(fullPath, rootPath, regex, results, maxResults);
@@ -3668,7 +3855,7 @@ var runInteractiveTool = {
       PYTHONDONTWRITEBYTECODE: "1"
     };
     const prefixWarnings = [argsTypeWarning, stdinTypeWarning].filter(Boolean).join("");
-    return new Promise((resolve6) => {
+    return new Promise((resolve7) => {
       const child = spawn2(executable, cmdArgs.map(String), {
         cwd: process.cwd(),
         env,
@@ -3701,22 +3888,22 @@ var runInteractiveTool = {
       setTimeout(writeNextLine, 400);
       const timer = setTimeout(() => {
         child.kill();
-        resolve6(`${prefixWarnings}[Timeout after ${timeout}ms]
+        resolve7(`${prefixWarnings}[Timeout after ${timeout}ms]
 ${buildOutput(stdout, stderr)}`);
       }, timeout);
       child.on("close", (code) => {
         clearTimeout(timer);
         const output = buildOutput(stdout, stderr);
         if (code !== 0 && code !== null) {
-          resolve6(`${prefixWarnings}Exit code ${code}:
+          resolve7(`${prefixWarnings}Exit code ${code}:
 ${output}`);
         } else {
-          resolve6(`${prefixWarnings}${output || "(no output)"}`);
+          resolve7(`${prefixWarnings}${output || "(no output)"}`);
         }
       });
       child.on("error", (err) => {
         clearTimeout(timer);
-        resolve6(
+        resolve7(
           `${prefixWarnings}Failed to start process "${executable}": ${err.message}
 Hint: On Windows, use the full path to the executable, e.g.:
   C:\\Users\\Jinzd\\anaconda3\\envs\\python312\\python.exe`
@@ -4384,11 +4571,11 @@ Any of these triggers means use save_last_response, NOT write_file:
 };
 
 // src/tools/builtin/save-memory.ts
-import { existsSync as existsSync10, readFileSync as readFileSync7, statSync as statSync6, mkdirSync as mkdirSync4 } from "fs";
-import { join as join5 } from "path";
+import { existsSync as existsSync11, readFileSync as readFileSync8, statSync as statSync6, mkdirSync as mkdirSync4 } from "fs";
+import { join as join6 } from "path";
 import { homedir as homedir3 } from "os";
 function getMemoryFilePath() {
-  return join5(homedir3(), CONFIG_DIR_NAME, MEMORY_FILE_NAME);
+  return join6(homedir3(), CONFIG_DIR_NAME, MEMORY_FILE_NAME);
 }
 function formatTimestamp() {
   const now = /* @__PURE__ */ new Date();
@@ -4412,8 +4599,8 @@ var saveMemoryTool = {
     const content = String(args["content"] ?? "").trim();
     if (!content) throw new ToolError("save_memory", "content is required");
     const memoryPath = getMemoryFilePath();
-    const configDir = join5(homedir3(), CONFIG_DIR_NAME);
-    if (!existsSync10(configDir)) {
+    const configDir = join6(homedir3(), CONFIG_DIR_NAME);
+    if (!existsSync11(configDir)) {
       mkdirSync4(configDir, { recursive: true });
     }
     const timestamp = formatTimestamp();
@@ -4421,7 +4608,7 @@ var saveMemoryTool = {
 ## ${timestamp}
 ${content}
 `;
-    const previous = existsSync10(memoryPath) ? readFileSync7(memoryPath, "utf-8") : "";
+    const previous = existsSync11(memoryPath) ? readFileSync8(memoryPath, "utf-8") : "";
     atomicWriteFileSync(memoryPath, previous + entry);
     const byteSize = statSync6(memoryPath).size;
     return `Memory saved successfully. File size: ${byteSize} bytes in ${MEMORY_FILE_NAME}`;
@@ -4468,7 +4655,7 @@ function promptUser(rl, question) {
   console.log();
   console.log(chalk4.cyan("\u2753 ") + chalk4.bold(question));
   process.stdout.write(chalk4.cyan("> "));
-  return new Promise((resolve6) => {
+  return new Promise((resolve7) => {
     let completed = false;
     const cleanup = (answer) => {
       if (completed) return;
@@ -4478,7 +4665,7 @@ function promptUser(rl, question) {
       rl.pause();
       rlAny.output = savedOutput;
       askUserContext.prompting = false;
-      resolve6(answer);
+      resolve7(answer);
     };
     const onLine = (line) => {
       cleanup(line);
@@ -5233,14 +5420,14 @@ var taskStopTool = {
 
 // src/tools/builtin/git-tools.ts
 import { execFileSync as execFileSync2 } from "child_process";
-import { existsSync as existsSync11 } from "fs";
-import { join as join6 } from "path";
+import { existsSync as existsSync12 } from "fs";
+import { join as join7 } from "path";
 function assertGitRepo(cwd) {
   let dir = cwd;
   const root = dir.split(/[\\/]/)[0] + (dir.includes("\\") ? "\\" : "/");
   while (dir && dir !== root) {
-    if (existsSync11(join6(dir, ".git"))) return;
-    const parent = join6(dir, "..");
+    if (existsSync12(join7(dir, ".git"))) return;
+    const parent = join7(dir, "..");
     if (parent === dir) break;
     dir = parent;
   }
@@ -5505,9 +5692,9 @@ ${commitOutput.trim()}`;
 };
 
 // src/tools/builtin/notebook-edit.ts
-import { readFileSync as readFileSync8, existsSync as existsSync12 } from "fs";
+import { readFileSync as readFileSync9, existsSync as existsSync13 } from "fs";
 import { writeFile } from "fs/promises";
-import { resolve as resolve5, extname as extname2 } from "path";
+import { resolve as resolve6, extname as extname2 } from "path";
 var notebookEditTool = {
   definition: {
     name: "notebook_edit",
@@ -5556,14 +5743,14 @@ var notebookEditTool = {
     if (!Number.isInteger(cellIndexRaw) || cellIndexRaw < 1) {
       throw new ToolError("notebook_edit", "cell_index must be a positive integer (1-based)");
     }
-    const absPath = resolve5(filePath);
+    const absPath = resolve6(filePath);
     if (extname2(absPath).toLowerCase() !== ".ipynb") {
       throw new ToolError("notebook_edit", "path must point to a .ipynb file");
     }
-    if (!existsSync12(absPath)) {
+    if (!existsSync13(absPath)) {
       throw new ToolError("notebook_edit", `Notebook not found: ${filePath}`);
     }
-    const raw = readFileSync8(absPath, "utf-8");
+    const raw = readFileSync9(absPath, "utf-8");
     const nb = parseNotebook(raw);
     const cellIdx0 = cellIndexRaw - 1;
     undoStack.push(absPath, `notebook_edit (${action}): ${filePath}`);
@@ -5980,8 +6167,8 @@ function estimateToolDefinitionTokens(def) {
 
 // src/tools/registry.ts
 import { pathToFileURL } from "url";
-import { existsSync as existsSync13, mkdirSync as mkdirSync5, readdirSync as readdirSync6 } from "fs";
-import { join as join7 } from "path";
+import { existsSync as existsSync14, mkdirSync as mkdirSync5, readdirSync as readdirSync6 } from "fs";
+import { join as join8 } from "path";
 var ToolRegistry = class {
   tools = /* @__PURE__ */ new Map();
   pluginToolNames = /* @__PURE__ */ new Set();
@@ -6142,7 +6329,7 @@ var ToolRegistry = class {
    * Returns the number of successfully loaded plugins.
    */
   async loadPlugins(pluginsDir, allowPlugins = false) {
-    if (!existsSync13(pluginsDir)) {
+    if (!existsSync14(pluginsDir)) {
       try {
         mkdirSync5(pluginsDir, { recursive: true });
       } catch {
@@ -6168,12 +6355,12 @@ var ToolRegistry = class {
     process.stderr.write(
       `
 [plugins] \u26A0 Loading ${files.length} plugin(s) with FULL system privileges:
-` + files.map((f) => `  + ${join7(pluginsDir, f)}`).join("\n") + "\n\n"
+` + files.map((f) => `  + ${join8(pluginsDir, f)}`).join("\n") + "\n\n"
     );
     let loaded = 0;
     for (const file of files) {
       try {
-        const fileUrl = pathToFileURL(join7(pluginsDir, file)).href;
+        const fileUrl = pathToFileURL(join8(pluginsDir, file)).href;
         const mod = await import(fileUrl);
         const tool = mod.tool ?? mod.default?.tool ?? mod.default;
         if (!tool || typeof tool.execute !== "function" || !tool.definition?.name) {
@@ -6211,6 +6398,10 @@ export {
   getPendingHookTrust,
   runLifecycleHooks,
   runHook,
+  recordRecentlyDeniedAutoAction,
+  getRecentlyDeniedAutoActions,
+  clearRecentlyDeniedAutoActions,
+  defaultActionClassifier,
   isInterrupted,
   requestInterrupt,
   resetInterrupt,

package/dist/{chunk-HX6N6QEY.js → chunk-UDMU4FUF.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import {
   TEST_TIMEOUT
-} from "./chunk-GBBVCZ4W.js";
+} from "./chunk-IWLVH32D.js";
 
 // src/tools/builtin/run-tests.ts
 import { execSync, spawnSync } from "child_process";

package/dist/{ci-X3LNUFZV.js → ci-HBZ6CIW5.js}

@@ -10,11 +10,11 @@ import {
 import "./chunk-XPBEJB27.js";
 import {
   ConfigManager
-} from "./chunk-NYCBOVNF.js";
+} from "./chunk-MRGWPCFQ.js";
 import "./chunk-TZQHYZKT.js";
 import {
   VERSION
-} from "./chunk-GBBVCZ4W.js";
+} from "./chunk-IWLVH32D.js";
 import "./chunk-IW3Q7AE5.js";
 
 // src/cli/ci.ts

package/dist/{constants-KDWG4KR4.js → constants-CAUBTSFW.js}

@@ -37,7 +37,7 @@ import {
   TEST_TIMEOUT,
   VERSION,
   buildUserIdentityPrompt
-} from "./chunk-GBBVCZ4W.js";
+} from "./chunk-IWLVH32D.js";
 export {
   AGENTIC_BEHAVIOR_GUIDELINE,
   APP_NAME,