minimal-agent 0.1.6 → 0.1.8

package/dist/main.js

@@ -2,7 +2,7 @@
 
 // src/main.tsx
 import { render } from "ink";
-import { existsSync as existsSync7, mkdirSync } from "fs";
+import { existsSync as existsSync9, mkdirSync } from "fs";
 import { createRequire } from "module";
 import { resolve as resolve8 } from "path";
 
@@ -360,6 +360,8 @@ ${toolList}
   "\u6211\u8BB0\u5F97"\u3001"\u6211\u4E4B\u524D\u770B\u8FC7"\u3001"\u5E94\u8BE5\u5DEE\u4E0D\u591A"\u90FD\u4E0D\u7B97\u8BFB\u8FC7\u2014\u2014\u5FC5\u987B\u5728\u672C\u8F6E\u4EFB\u52A1\u4E2D\u5B9E\u9645\u8C03\u7528 Read\u3002
   \u5C24\u5176\u5F53\u4F60\u8981\u53C2\u8003\u67D0\u4E2A\u6587\u4EF6\u7684\u5199\u6CD5\u6765\u5B9E\u73B0\u7C7B\u4F3C\u529F\u80FD\u65F6\uFF0C\u5FC5\u987B\u5148\u91CD\u8BFB\u8BE5\u6587\u4EF6\u7684\u5173\u952E\u90E8\u5206\uFF08\u51FD\u6570\u5B9E\u73B0\u3001\u5224\u65AD\u903B\u8F91\u3001\u6570\u636E\u6D41\uFF09\uFF0C\u7406\u89E3\u6E05\u695A\u540E\u518D\u52A8\u624B\u3002
 - Edit \u5DE5\u5177\u7684 old_string \u5FC5\u987B\u5728\u6587\u4EF6\u4E2D\u552F\u4E00\uFF1B\u4E0D\u552F\u4E00\u65F6\u8BF7\u6269\u5927\u4E0A\u4E0B\u6587\u6216\u663E\u5F0F replace_all=true\u3002
+- \u540C\u4E00\u6587\u4EF6\u9700\u8981\u4FEE\u6539\u591A\u5904\uFF083 \u5904\u53CA\u4EE5\u4E0A\uFF09\u65F6\u4F18\u5148\u7528 MultiEdit\uFF1A\u6240\u6709 edit \u6309\u987A\u5E8F\u5728\u5185\u5B58\u4E2D\u5E94\u7528\uFF0C**\u5168\u90E8\u6210\u529F\u624D\u843D\u76D8**\uFF1B\u4EFB\u4E00\u5931\u8D25\u78C1\u76D8\u4E0D\u52A8\uFF0C\u907F\u514D\u4E2D\u95F4\u72B6\u6001\u6C61\u67D3\u3002\u5355\u70B9\u4FEE\u6539\u7EE7\u7EED\u7528 Edit\u3002
+- Write \u8986\u76D6\u65E2\u6709\u6587\u4EF6\u524D\u540C\u6837\u5FC5\u987B\u5148 Read\uFF08\u4E0E Edit \u5BF9\u79F0\uFF0C\u672A\u5148 Read \u4F1A\u88AB\u62D2\u7EDD\u5E76\u63D0\u793A"\u8BF7\u5148 Read"\uFF09\uFF1B\u5199\u65B0\u6587\u4EF6\u65E0\u6B64\u8981\u6C42\u3002
 - \u521B\u5EFA\u65B0\u6587\u4EF6\u7528 Write\uFF0C\u6216 Edit \u65F6 old_string \u4F20\u7A7A\u5B57\u7B26\u4E32\u3002
 - \u627E\u6587\u4EF6\u7528 Glob\uFF08"**/*.ts"\uFF09\uFF0C\u627E\u6587\u4EF6\u5185\u5BB9\u7528 Grep\uFF08\u57FA\u4E8E ripgrep\uFF09\u3002
 - \u5F53\u7528\u6237\u95EE\u5230\u8BAD\u7EC3\u622A\u6B62\u540E\u624D\u51FA\u73B0\u7684\u4FE1\u606F\uFF08\u6700\u65B0\u7248\u672C\u53F7\u3001\u8FD1\u671F\u65B0\u95FB\u3001\u7B2C\u4E09\u65B9 API \u6587\u6863\uFF09\u65F6\u7528 WebSearch\uFF1B\u4F18\u5148\u7CBE\u786E\u7684\u81EA\u7136\u8BED\u8A00\u67E5\u8BE2\u3002
@@ -369,6 +371,8 @@ ${toolList}
   Bash \u6709\u5B89\u5168\u9ED1\u540D\u5355\uFF08rm -rf /\u3001mkfs\u3001shutdown \u7B49\u5371\u9669\u547D\u4EE4\u4F1A\u88AB\u62E6\u622A\uFF09\uFF0C\u4F46\u4ECD\u9700\u8C28\u614E\uFF1A
   \u5148\u786E\u8BA4\u547D\u4EE4\u65E0\u5BB3\u518D\u6267\u884C\uFF0C\u907F\u514D\u4E0D\u53EF\u9006\u64CD\u4F5C\uFF08\u5982 git push --force\u3001git reset --hard\uFF09\u3002
   \u957F\u65F6\u95F4\u8FD0\u884C\u7684\u547D\u4EE4\uFF08npm install\u3001bun test\uFF09\u6CE8\u610F\u8D85\u65F6\u8BBE\u7F6E\uFF1B\u9700\u8981\u4EA4\u4E92\u8F93\u5165\u7684\u547D\u4EE4\u4E0D\u8981\u7528 Bash\uFF08\u7528 Write \u5199\u811A\u672C\u4EE3\u66FF\uFF09\u3002
+  Bash \u5DF2\u8BC6\u522B"\u4FE1\u606F\u6027\u9000\u51FA\u7801"\uFF1Agrep/rg/find/diff/test \u7684 exit=1\uFF08\u65E0\u5339\u914D / \u90E8\u5206\u4E0D\u53EF\u8BBF\u95EE / \u6709\u5DEE\u5F02 / \u6761\u4EF6\u5047\uFF09\u4F1A\u81EA\u52A8\u5224\u4E3A\u6210\u529F\uFF0C\u4E0D\u8981\u56E0 1 \u800C\u91CD\u8BD5\u3002
+  \u7834\u574F\u6027\u547D\u4EE4\uFF08git reset --hard / git push -f / rm -rf \u7B49\uFF09\u4F1A\u88AB Bash \u4E3B\u52A8\u5728\u8F93\u51FA\u5934\u90E8\u52A0 \u26A0\uFE0F \u8B66\u544A\uFF08\u4E0D\u62E6\u622A\uFF09\uFF0C\u770B\u5230\u65F6\u5E94\u5411\u7528\u6237\u786E\u8BA4\u610F\u56FE\u3002
 - \u5F53\u9700\u8981\u83B7\u53D6\u7F51\u9875\u9759\u6001\u6587\u672C\u5185\u5BB9\uFF08\u6293\u53D6\u6587\u6863\u3001\u8BFB\u53D6\u6587\u7AE0\uFF09\u65F6\u7528 WebFetch\u3002
   WebBrowser \u4F9D\u8D56\u53EF\u9009\u5305\uFF08playwright-core + chromium\uFF09\u2014\u2014 **\u9ED8\u8BA4\u5047\u5B9A\u672A\u5B89\u88C5**\uFF0C
   \u4EC5\u5728 WebFetch \u660E\u786E\u65E0\u6CD5\u6EE1\u8DB3\uFF08\u5982\u9700\u8981 JS \u6E32\u67D3\u540E\u7684\u5185\u5BB9\u3001\u70B9\u51FB\u6309\u94AE\u3001\u586B\u8868\u5355\u3001\u622A\u56FE\uFF09\u65F6\u518D\u5C1D\u8BD5\u3002
@@ -462,6 +466,141 @@ function toToolParameters(schema) {
   return rest;
 }
 
+// src/tools/bash/semantics.ts
+var DEFAULT_SEMANTIC = (exitCode) => ({
+  isError: exitCode !== 0,
+  message: exitCode !== 0 ? `Command failed with exit code ${exitCode}` : void 0
+});
+var COMMAND_SEMANTICS = /* @__PURE__ */ new Map([
+  // grep: 0=找到匹配, 1=无匹配（非错误）, 2+=真错误
+  ["grep", (exitCode) => ({
+    isError: exitCode >= 2,
+    message: exitCode === 1 ? "No matches found" : void 0
+  })],
+  // ripgrep 与 grep 同义
+  ["rg", (exitCode) => ({
+    isError: exitCode >= 2,
+    message: exitCode === 1 ? "No matches found" : void 0
+  })],
+  // find: 1=部分目录不可达（仍有结果，非致命）, 2+=错误
+  ["find", (exitCode) => ({
+    isError: exitCode >= 2,
+    message: exitCode === 1 ? "Some directories were inaccessible" : void 0
+  })],
+  // diff: 0=相同, 1=有差异（非错误）, 2+=错误
+  ["diff", (exitCode) => ({
+    isError: exitCode >= 2,
+    message: exitCode === 1 ? "Files differ" : void 0
+  })],
+  // test: 0=真, 1=假（非错误）, 2+=错误
+  ["test", (exitCode) => ({
+    isError: exitCode >= 2,
+    message: exitCode === 1 ? "Condition is false" : void 0
+  })],
+  // [ 是 test 的别名
+  ["[", (exitCode) => ({
+    isError: exitCode >= 2,
+    message: exitCode === 1 ? "Condition is false" : void 0
+  })]
+]);
+function extractPrimaryCommand(command) {
+  let cmd = command.trim();
+  const wrapMatch = cmd.match(/^(?:bash|sh|zsh|dash)\s+-c\s+(['"])(.+)\1\s*$/s);
+  if (wrapMatch) cmd = wrapMatch[2].trim();
+  const segments = cmd.split(/\s*(?:\|\||&&|;|\|)\s*/).filter((s) => s.length > 0);
+  let last = segments[segments.length - 1] ?? cmd;
+  last = last.trim();
+  const tokens = last.split(/\s+/);
+  let i = 0;
+  if (tokens[i] === "env") i++;
+  while (i < tokens.length && /^[A-Za-z_][A-Za-z0-9_]*=/.test(tokens[i])) i++;
+  return tokens[i] ?? "";
+}
+function interpretCommandResult(command, exitCode, stdout, stderr) {
+  const base = extractPrimaryCommand(command);
+  const fn = COMMAND_SEMANTICS.get(base) ?? DEFAULT_SEMANTIC;
+  return fn(exitCode, stdout, stderr);
+}
+
+// src/tools/bash/warnings.ts
+var DESTRUCTIVE_PATTERNS = [
+  // Git —— 数据丢失 / 难回退
+  {
+    pattern: /\bgit\s+reset\s+--hard\b/,
+    warning: "Note: may discard uncommitted changes"
+  },
+  {
+    pattern: /\bgit\s+push\b[^;&|\n]*[ \t](--force|--force-with-lease|-f)\b/,
+    warning: "Note: may overwrite remote history"
+  },
+  {
+    pattern: /\bgit\s+clean\b(?![^;&|\n]*(?:-[a-zA-Z]*n|--dry-run))[^;&|\n]*-[a-zA-Z]*f/,
+    warning: "Note: may permanently delete untracked files"
+  },
+  {
+    pattern: /\bgit\s+checkout\s+(--\s+)?\.[ \t]*($|[;&|\n])/,
+    warning: "Note: may discard all working tree changes"
+  },
+  {
+    pattern: /\bgit\s+restore\s+(--\s+)?\.[ \t]*($|[;&|\n])/,
+    warning: "Note: may discard all working tree changes"
+  },
+  {
+    pattern: /\bgit\s+stash[ \t]+(drop|clear)\b/,
+    warning: "Note: may permanently remove stashed changes"
+  },
+  {
+    pattern: /\bgit\s+branch\s+(-D[ \t]|--delete\s+--force|--force\s+--delete)\b/,
+    warning: "Note: may force-delete a branch"
+  },
+  // Git —— 安全绕过
+  {
+    pattern: /\bgit\s+(commit|push|merge)\b[^;&|\n]*--no-verify\b/,
+    warning: "Note: may skip safety hooks"
+  },
+  {
+    pattern: /\bgit\s+commit\b[^;&|\n]*--amend\b/,
+    warning: "Note: may rewrite the last commit"
+  },
+  // 文件删除（rm -rf / 之类的致命形式由 bash.ts 黑名单处理；这里只做"未到致命"的提醒）
+  {
+    pattern: /(^|[;&|\n]\s*)rm\s+-[a-zA-Z]*[rR][a-zA-Z]*f|(^|[;&|\n]\s*)rm\s+-[a-zA-Z]*f[a-zA-Z]*[rR]/,
+    warning: "Note: may recursively force-remove files"
+  },
+  {
+    pattern: /(^|[;&|\n]\s*)rm\s+-[a-zA-Z]*[rR]/,
+    warning: "Note: may recursively remove files"
+  },
+  {
+    pattern: /(^|[;&|\n]\s*)rm\s+-[a-zA-Z]*f/,
+    warning: "Note: may force-remove files"
+  },
+  // 数据库
+  {
+    pattern: /\b(DROP|TRUNCATE)\s+(TABLE|DATABASE|SCHEMA)\b/i,
+    warning: "Note: may drop or truncate database objects"
+  },
+  {
+    pattern: /\bDELETE\s+FROM\s+\w+[ \t]*(;|"|'|\n|$)/i,
+    warning: "Note: may delete all rows from a database table"
+  },
+  // 基础设施
+  {
+    pattern: /\bkubectl\s+delete\b/,
+    warning: "Note: may delete Kubernetes resources"
+  },
+  {
+    pattern: /\bterraform\s+destroy\b/,
+    warning: "Note: may destroy Terraform infrastructure"
+  }
+];
+function scanDestructiveCommand(command) {
+  for (const { pattern, warning } of DESTRUCTIVE_PATTERNS) {
+    if (pattern.test(command)) return warning;
+  }
+  return null;
+}
+
 // src/tools/bash/bash.ts
 var DEFAULT_TIMEOUT_MS = 12e4;
 var MAX_TIMEOUT_MS = 6e5;
@@ -578,6 +717,14 @@ While the Bash tool can do similar things, it's better to use the built-in tools
   - Never skip hooks (--no-verify) or bypass signing (--no-gpg-sign, -c commit.gpgsign=false) unless the user has explicitly asked for it. If a hook fails, investigate and fix the underlying issue.
  - Avoid unnecessary \`sleep\` commands; do not retry failing commands in a sleep loop \u2014 diagnose the root cause.
 
+# Exit code semantics
+Some commands return non-zero exit codes for informational (non-error) reasons. Bash recognizes these and reports them as success (ok=true) \u2014 do NOT retry just because exit code is 1:
+ - \`grep\` / \`rg\` exit 1 \u2192 no match found (not an error)
+ - \`find\` exit 1 \u2192 some directories inaccessible (non-fatal, partial results still returned)
+ - \`diff\` / \`cmp\` exit 1 \u2192 files differ (informational, not an error)
+ - \`test\` / \`[\` exit 1 \u2192 condition is false (the answer to a question, not a failure)
+Only exit codes \u2265 2 from these commands indicate a real failure. For all other commands, non-zero exit codes are treated as failures normally.
+
 # Safety
 The following command patterns are blocked at the tool level and will fail before execution (no need to try them):
  - \`rm -rf /\` and variants targeting root, $HOME, ~, or system directories (/etc, /usr, /bin, /Windows, /Users, /home, ...)
@@ -587,7 +734,9 @@ The following command patterns are blocked at the tool level and will fail befor
  - Pipe-to-shell from network: \`curl ... | sh\`, \`wget ... | bash\`, etc.
  - \`chmod 777 /\`, Windows full-disk \`del /s\` / \`rmdir /s\`, \`diskpart\`
 
-If you have a legitimate use case that requires one of the above patterns, ask the user to run the command themselves in their terminal \u2014 do not try to bypass the check.`;
+If you have a legitimate use case that requires one of the above patterns, ask the user to run the command themselves in their terminal \u2014 do not try to bypass the check.
+
+Separately, Bash scans for common destructive-but-recoverable patterns (\`git reset --hard\`, \`git push -f\` / \`--force\` / \`--force-with-lease\`, \`git checkout .\`, \`git restore .\`, \`git clean -f\`, \`git stash drop/clear\`, \`git branch -D\`, \`git commit --amend\` / \`--no-verify\`, \`rm -rf <path>\`, \`DROP TABLE\`, \`TRUNCATE\`, \`DELETE FROM\`, \`kubectl delete\`, \`terraform destroy\`, etc.) and prepends a \`\u26A0\uFE0F \u8B66\u544A:\` line to the output. These commands are NOT blocked \u2014 the warning is informational. Treat it as a signal to double-check intent and surface the warning to the user when relevant.`;
 async function call(input, signal) {
   const command = input.command;
   const timeoutMs = Math.min(input.timeout ?? DEFAULT_TIMEOUT_MS, MAX_TIMEOUT_MS);
@@ -599,6 +748,7 @@ async function call(input, signal) {
 \u547D\u4EE4\uFF1A${command}`
     };
   }
+  const destructiveWarning = scanDestructiveCommand(command);
   let stdout = "";
   let stderr = "";
   let exitCode = null;
@@ -669,16 +819,33 @@ ${stderr.replace(/\s+$/, "")}
   }
   parts.push(`
 [exit code: ${exitCode === null ? "killed" : exitCode}]`);
-  let content = parts.join("\n");
-  if (content.length > DEFAULT_MAX_RESULT_SIZE_CHARS) {
-    content = content.slice(0, DEFAULT_MAX_RESULT_SIZE_CHARS) + `
+  let combinedOutput = parts.join("\n");
+  if (combinedOutput.length > DEFAULT_MAX_RESULT_SIZE_CHARS) {
+    combinedOutput = combinedOutput.slice(0, DEFAULT_MAX_RESULT_SIZE_CHARS) + `
 
 ... (\u8F93\u51FA\u8D85\u8FC7 ${DEFAULT_MAX_RESULT_SIZE_CHARS} \u5B57\u7B26\uFF0C\u5DF2\u622A\u65AD)`;
   }
-  if (timedOut || exitCode !== null && exitCode !== 0 || killedBySignal) {
-    return { ok: false, error: content };
+  if (timedOut || killedBySignal) {
+    return { ok: false, error: combinedOutput };
   }
-  return { ok: true, content };
+  const semantic = interpretCommandResult(
+    command,
+    exitCode ?? 0,
+    stdout,
+    stderr
+  );
+  const finalContent = destructiveWarning ? `\u26A0\uFE0F \u8B66\u544A: ${destructiveWarning}
+
+${combinedOutput}` : combinedOutput;
+  if (semantic.isError) {
+    return {
+      ok: false,
+      error: `\u547D\u4EE4\u5931\u8D25 (exit ${exitCode}): ${stderr || stdout || semantic.message || ""}`.trim() + `
+
+${finalContent}`
+    };
+  }
+  return { ok: true, content: finalContent };
 }
 var bashTool = {
   name: "Bash",
@@ -694,14 +861,14 @@ var bashTool = {
 
 // src/tools/edit/edit.ts
 import { readFile as readFile6, writeFile as writeFile3, mkdir as mkdir4 } from "fs/promises";
-import { existsSync as existsSync2 } from "fs";
+import { existsSync as existsSync3 } from "fs";
 import { dirname as dirname5 } from "path";
 import { z as z2 } from "zod";
 
 // src/tools/shared/fileUtils.ts
-import { readFile as readFile5 } from "fs/promises";
+import { open, readFile as readFile5 } from "fs/promises";
 import { homedir as homedir4 } from "os";
-import { resolve as resolve4, normalize } from "path";
+import { extname, resolve as resolve4 } from "path";
 var BLOCKED_DEVICE_PATHS = /* @__PURE__ */ new Set([
   "/dev/zero",
   "/dev/random",
@@ -718,12 +885,12 @@ var BLOCKED_DEVICE_PATHS = /* @__PURE__ */ new Set([
 ]);
 var WINDOWS_BLOCKED_NAMES = /* @__PURE__ */ new Set(["NUL", "CON", "PRN", "AUX", "COM1", "COM2", "LPT1"]);
 function isBlockedDevicePath(filePath) {
-  const normalized = normalize(filePath);
-  if (BLOCKED_DEVICE_PATHS.has(normalized)) return true;
-  if (normalized.startsWith("/proc/") && (normalized.endsWith("/fd/0") || normalized.endsWith("/fd/1") || normalized.endsWith("/fd/2"))) {
+  const slashed = filePath.replaceAll("\\", "/");
+  if (BLOCKED_DEVICE_PATHS.has(slashed)) return true;
+  if (slashed.startsWith("/proc/") && (slashed.endsWith("/fd/0") || slashed.endsWith("/fd/1") || slashed.endsWith("/fd/2"))) {
     return true;
   }
-  const baseName = normalized.split(/[/\\]/).pop() ?? "";
+  const baseName = slashed.split("/").pop() ?? "";
   if (WINDOWS_BLOCKED_NAMES.has(baseName.toUpperCase())) {
     return true;
   }
@@ -733,6 +900,9 @@ function validateAndResolvePath(rawPath, workingDir) {
   if (rawPath.includes("\0")) {
     return { ok: false, error: "\u8DEF\u5F84\u5305\u542B\u975E\u6CD5\u5B57\u7B26\uFF08null byte\uFF09" };
   }
+  if (isBlockedDevicePath(rawPath)) {
+    return { ok: false, error: `\u4E0D\u5141\u8BB8\u8BFB\u53D6\u8BBE\u5907\u6587\u4EF6\uFF1A${rawPath}\u3002\u8BE5\u8DEF\u5F84\u53EF\u80FD\u4EA7\u751F\u65E0\u9650\u8F93\u51FA\u6216\u963B\u585E\u8FDB\u7A0B\u3002` };
+  }
   const expanded = expandPath(rawPath);
   const resolved = resolve4(workingDir, expanded);
   if (isBlockedDevicePath(resolved)) {
@@ -778,6 +948,88 @@ function applyLineEnding(content, ending) {
   }
   return content;
 }
+var BINARY_EXTENSIONS = /* @__PURE__ */ new Set([
+  ".png",
+  ".jpg",
+  ".jpeg",
+  ".gif",
+  ".webp",
+  ".bmp",
+  ".ico",
+  ".tiff",
+  ".tif",
+  ".pdf",
+  ".doc",
+  ".docx",
+  ".xls",
+  ".xlsx",
+  ".ppt",
+  ".pptx",
+  ".exe",
+  ".dll",
+  ".so",
+  ".dylib",
+  ".o",
+  ".a",
+  ".pyc",
+  ".pyo",
+  ".class",
+  ".jar",
+  ".zip",
+  ".tar",
+  ".gz",
+  ".bz2",
+  ".7z",
+  ".rar",
+  ".iso",
+  ".mp3",
+  ".mp4",
+  ".mov",
+  ".avi",
+  ".mkv",
+  ".wav",
+  ".flac",
+  ".ogg",
+  ".ttf",
+  ".otf",
+  ".woff",
+  ".woff2",
+  ".sqlite",
+  ".sqlite3",
+  ".db",
+  ".psd",
+  ".ai",
+  ".bin",
+  ".wasm"
+]);
+function hasBinaryExtension(filePath) {
+  const ext = extname(filePath).toLowerCase();
+  return BINARY_EXTENSIONS.has(ext);
+}
+async function detectFileBomEncoding(filePath) {
+  let fh = null;
+  try {
+    fh = await open(filePath, "r");
+    const buf = Buffer.alloc(3);
+    const { bytesRead } = await fh.read(buf, 0, 3, 0);
+    if (bytesRead >= 3 && buf[0] === 239 && buf[1] === 187 && buf[2] === 191) {
+      return "utf8-bom";
+    }
+    if (bytesRead >= 2 && buf[0] === 255 && buf[1] === 254) {
+      return "utf16le";
+    }
+    return "utf8";
+  } catch {
+    return "utf8";
+  } finally {
+    if (fh) {
+      try {
+        await fh.close();
+      } catch {
+      }
+    }
+  }
+}
 var LEFT_SINGLE_CURLY_QUOTE = "\u2018";
 var RIGHT_SINGLE_CURLY_QUOTE = "\u2019";
 var LEFT_DOUBLE_CURLY_QUOTE = "\u201C";
@@ -857,6 +1109,44 @@ function applyCurlySingleQuotes(str) {
   return result.join("");
 }
 
+// src/tools/shared/fileState.ts
+import { existsSync as existsSync2, statSync } from "fs";
+var fileState = /* @__PURE__ */ new Map();
+function recordRead(absPath) {
+  try {
+    const st = statSync(absPath);
+    fileState.set(absPath, { timestamp: st.mtimeMs, size: st.size });
+  } catch {
+  }
+}
+function assertFresh(absPath) {
+  const entry = fileState.get(absPath);
+  if (!entry) {
+    if (existsSync2(absPath)) {
+      return {
+        ok: false,
+        error: `\u6587\u4EF6 ${absPath} \u5DF2\u5B58\u5728\u4F46\u672A\u5728\u672C\u4F1A\u8BDD Read \u8FC7\u3002\u8BF7\u5148\u7528 Read \u5DE5\u5177\u8BFB\u53D6\uFF0C\u786E\u8BA4\u5185\u5BB9\u540E\u518D\u4FEE\u6539\u3002`
+      };
+    }
+    return { ok: true };
+  }
+  try {
+    const st = statSync(absPath);
+    if (st.mtimeMs > entry.timestamp) {
+      return {
+        ok: false,
+        error: `${absPath} \u5728 Read \u540E\u88AB\u5916\u90E8\u4FEE\u6539\uFF08mtime \u6F02\u79FB\uFF09\u3002\u8BF7\u91CD\u65B0\u7528 Read \u5DE5\u5177\u8BFB\u53D6\u6700\u65B0\u5185\u5BB9\u3002`
+      };
+    }
+  } catch {
+    return { ok: true };
+  }
+  return { ok: true };
+}
+function clearFileState() {
+  fileState.clear();
+}
+
 // src/tools/edit/edit.ts
 var MAX_EDIT_FILE_SIZE_BYTES = 1024 * 1024 * 1024;
 var inputSchema2 = z2.object({
@@ -885,10 +1175,14 @@ async function call2(input) {
   const pathResult = validateAndResolvePath(input.file_path, getWorkingDir());
   if (!pathResult.ok) return pathResult;
   const filePath = pathResult.resolvedPath;
+  const freshness = assertFresh(filePath);
+  if (!freshness.ok) {
+    return { ok: false, error: freshness.error };
+  }
   if (old_string === new_string) {
     return { ok: false, error: "old_string \u4E0E new_string \u5B8C\u5168\u76F8\u540C\uFF0C\u6CA1\u6709\u53EF\u6539\u7684\u5185\u5BB9\u3002" };
   }
-  if (old_string === "" && !existsSync2(filePath)) {
+  if (old_string === "" && !existsSync3(filePath)) {
     try {
       await mkdir4(dirname5(filePath), { recursive: true });
       await writeFile3(filePath, new_string, "utf8");
@@ -900,7 +1194,7 @@ async function call2(input) {
       return { ok: false, error: `\u521B\u5EFA\u6587\u4EF6\u5931\u8D25\uFF1A${e.message}` };
     }
   }
-  if (!existsSync2(filePath)) {
+  if (!existsSync3(filePath)) {
     return {
       ok: false,
       error: `\u6587\u4EF6\u4E0D\u5B58\u5728\uFF1A${filePath}
@@ -1053,22 +1347,146 @@ var editTool = {
   call: call2
 };
 
+// src/tools/edit/multi-edit.ts
+import { readFile as readFile7, writeFile as writeFile4 } from "fs/promises";
+import { existsSync as existsSync4 } from "fs";
+import { z as z3 } from "zod";
+var editItemSchema = z3.object({
+  old_string: z3.string().min(1).describe("\u8981\u66FF\u6362\u7684\u539F\u6587\u672C\uFF08\u4E0D\u5141\u8BB8\u4E3A\u7A7A \u2014\u2014 \u521B\u5EFA\u65B0\u6587\u4EF6\u8BF7\u7528 Edit \u5DE5\u5177\uFF09"),
+  new_string: z3.string().describe("\u66FF\u6362\u4E3A\u7684\u65B0\u6587\u672C"),
+  replace_all: z3.boolean().optional().describe("\u662F\u5426\u66FF\u6362\u6240\u6709\u51FA\u73B0\u4F4D\u7F6E\uFF08\u9ED8\u8BA4 false\uFF0C\u8981\u6C42 old_string \u5728\u5F53\u524D\u5185\u5BB9\u4E2D\u552F\u4E00\uFF09")
+});
+var inputSchema3 = z3.object({
+  file_path: z3.string().min(1).describe("\u8981\u7F16\u8F91\u7684\u6587\u4EF6\u8DEF\u5F84"),
+  edits: z3.array(editItemSchema).min(1).max(50).describe("\u6309\u987A\u5E8F\u5E94\u7528\u7684 edit \u5217\u8868\uFF081-50 \u6761\uFF09\uFF0C\u539F\u5B50\u5316\u6267\u884C\uFF1A\u5168\u90E8\u6210\u529F\u624D\u843D\u76D8")
+});
+var parameters3 = toToolParameters(inputSchema3);
+var description3 = `Performs multiple exact string replacements in a single file, applied atomically (all-or-nothing).
+
+Usage:
+- You MUST use your \`Read\` tool to read the current content of the file BEFORE calling MultiEdit.
+- Provide a list of \`edits\`, each with \`old_string\`, \`new_string\`, and optional \`replace_all\`.
+- All edits are applied sequentially in memory; if ANY edit fails (string not found, ambiguous match, or dependency conflict), the file on disk is UNTOUCHED.
+- Order matters: later edits operate on the result of earlier edits. If a later edit's \`old_string\` is a substring of an earlier edit's \`new_string\`, MultiEdit refuses (reorder or merge instead).
+- Each \`old_string\` must be unique in the current content (after prior edits) unless \`replace_all=true\`.
+- Empty \`old_string\` is NOT allowed in MultiEdit. To create a new file, use the \`Edit\` tool with a single empty-old_string call.
+- Preserve exact indentation (tabs/spaces).`;
+function countOccurrences2(haystack, needle) {
+  if (needle.length === 0) return 0;
+  let count = 0;
+  let pos = 0;
+  while ((pos = haystack.indexOf(needle, pos)) !== -1) {
+    count++;
+    pos += needle.length;
+  }
+  return count;
+}
+function splitReplaceAll2(haystack, needle, replacement) {
+  return haystack.split(needle).join(replacement);
+}
+async function call3(input) {
+  const pathResult = validateAndResolvePath(input.file_path, getWorkingDir());
+  if (!pathResult.ok) return pathResult;
+  const filePath = pathResult.resolvedPath;
+  const freshness = assertFresh(filePath);
+  if (!freshness.ok) {
+    return { ok: false, error: freshness.error };
+  }
+  if (!existsSync4(filePath)) {
+    return {
+      ok: false,
+      error: `\u6587\u4EF6\u4E0D\u5B58\u5728\uFF1A${filePath}
+\uFF08MultiEdit \u4E0D\u652F\u6301\u521B\u5EFA\u65B0\u6587\u4EF6\uFF0C\u8BF7\u6539\u7528 Edit \u5DE5\u5177\uFF09`
+    };
+  }
+  const edits = input.edits;
+  for (let i = 0; i < edits.length; i++) {
+    for (let j = 0; j < i; j++) {
+      if (edits[j].new_string.includes(edits[i].old_string)) {
+        return {
+          ok: false,
+          error: `edits[${i}].old_string \u662F edits[${j}].new_string \u7684\u5B50\u4E32\uFF0C\u4F1A\u5BFC\u81F4\u540E\u7EED edit \u547D\u4E2D\u524D\u5E8F\u4EA7\u7269\uFF0C\u8BF7\u91CD\u65B0\u6392\u5E8F\u6216\u5408\u5E76`
+        };
+      }
+    }
+  }
+  let originalContent;
+  try {
+    originalContent = await readFile7(filePath, "utf8");
+  } catch (e) {
+    return { ok: false, error: `\u8BFB\u53D6\u5931\u8D25\uFF1A${e.message}` };
+  }
+  let currentContent = originalContent;
+  for (let i = 0; i < edits.length; i++) {
+    const edit = edits[i];
+    const replaceAll = edit.replace_all ?? false;
+    let searchTarget = edit.old_string;
+    let processedNewString = edit.new_string;
+    const actualOld = findActualString(currentContent, edit.old_string);
+    if (actualOld === null) {
+      return {
+        ok: false,
+        error: `edits[${i}] \u672A\u5339\u914D\u5230 old_string\uFF08\u5728\u5DF2\u5E94\u7528\u524D\u5E8F ${i} \u5904\u4FEE\u6539\u540E\u7684\u5185\u5BB9\u4E2D\u627E\u4E0D\u5230\uFF09\u3002\u8BF7\u5148\u7528 Read \u5DE5\u5177\u6838\u5BF9\u5F53\u524D\u5185\u5BB9\uFF08\u6CE8\u610F\u7A7A\u683C/\u7F29\u8FDB/\u6362\u884C\uFF09\uFF0C\u5E76\u68C0\u67E5 edit \u987A\u5E8F\u3002`
+      };
+    }
+    if (actualOld !== edit.old_string) {
+      searchTarget = actualOld;
+      processedNewString = preserveQuoteStyle(edit.old_string, actualOld, edit.new_string);
+    }
+    const occurrences = countOccurrences2(currentContent, searchTarget);
+    if (occurrences === 0) {
+      return {
+        ok: false,
+        error: `edits[${i}] \u672A\u5339\u914D\u5230 old_string\uFF08\u5DF2\u5E94\u7528\u524D\u5E8F ${i} \u5904\u4FEE\u6539\u540E\u5185\u5BB9\u4E2D\u51FA\u73B0 0 \u6B21\uFF09\u3002`
+      };
+    }
+    if (occurrences > 1 && !replaceAll) {
+      return {
+        ok: false,
+        error: `edits[${i}].old_string \u5728\u5F53\u524D\u5185\u5BB9\u4E2D\u51FA\u73B0 ${occurrences} \u6B21\uFF0C\u4E0D\u552F\u4E00\u3002\u8BF7\u6269\u5927 old_string \u5305\u542B\u66F4\u591A\u4E0A\u4E0B\u6587\uFF0C\u6216\u663E\u5F0F\u4F20 replace_all=true\u3002`
+      };
+    }
+    currentContent = replaceAll ? splitReplaceAll2(currentContent, searchTarget, processedNewString) : currentContent.replace(searchTarget, processedNewString);
+  }
+  const lineEnding = await detectFileLineEndings(filePath);
+  const finalContent = applyLineEnding(currentContent, lineEnding);
+  try {
+    await writeFile4(filePath, finalContent, "utf8");
+  } catch (e) {
+    return { ok: false, error: `\u5199\u5165\u5931\u8D25\uFF1A${e.message}` };
+  }
+  return {
+    ok: true,
+    content: `\u5DF2\u5BF9 ${filePath} \u5E94\u7528 ${edits.length} \u5904\u4FEE\u6539`
+  };
+}
+var multiEditTool = {
+  name: "MultiEdit",
+  description: description3,
+  inputSchema: inputSchema3,
+  parameters: parameters3,
+  isReadOnly: false,
+  isConcurrencySafe: false,
+  maxResultSizeChars: DEFAULT_MAX_RESULT_SIZE_CHARS,
+  call: call3
+};
+
 // src/tools/glob/glob.ts
 import { stat as stat2 } from "fs/promises";
 import { isAbsolute, resolve as resolve5 } from "path";
 import fg from "fast-glob";
-import { z as z3 } from "zod";
-var inputSchema3 = z3.object({
-  pattern: z3.string().min(1).describe('glob \u6A21\u5F0F\uFF0C\u4F8B\u5982 "**/*.ts" \u6216 "src/components/**/*.tsx"'),
-  path: z3.string().optional().describe('\u641C\u7D22\u7684\u6839\u76EE\u5F55\uFF08\u9ED8\u8BA4\u5F53\u524D\u5DE5\u4F5C\u76EE\u5F55\uFF09\uFF1B\u7701\u7565\u65F6\u4E0D\u8981\u4F20 "undefined" \u5B57\u7B26\u4E32')
+import { z as z4 } from "zod";
+var inputSchema4 = z4.object({
+  pattern: z4.string().min(1).describe('glob \u6A21\u5F0F\uFF0C\u4F8B\u5982 "**/*.ts" \u6216 "src/components/**/*.tsx"'),
+  path: z4.string().optional().describe('\u641C\u7D22\u7684\u6839\u76EE\u5F55\uFF08\u9ED8\u8BA4\u5F53\u524D\u5DE5\u4F5C\u76EE\u5F55\uFF09\uFF1B\u7701\u7565\u65F6\u4E0D\u8981\u4F20 "undefined" \u5B57\u7B26\u4E32')
 });
-var parameters3 = toToolParameters(inputSchema3);
-var description3 = `- Fast file pattern matching tool that works with any codebase size
+var parameters4 = toToolParameters(inputSchema4);
+var description4 = `- Fast file pattern matching tool that works with any codebase size
 - Supports glob patterns like "**/*.js" or "src/**/*.ts"
 - Returns matching file paths sorted by modification time (oldest first)
 - Use this tool when you need to find files by name patterns
 - When you need to do an open ended search that may require multiple rounds, prefer the Grep tool for content search`;
-async function call3(input) {
+async function call4(input) {
   const cwd = input.path ? resolve5(input.path) : getWorkingDir();
   const pattern = input.pattern.replace(/\\/g, "/");
   let matches;
@@ -1115,23 +1533,23 @@ async function call3(input) {
 }
 var globTool = {
   name: "Glob",
-  description: description3,
-  inputSchema: inputSchema3,
-  parameters: parameters3,
+  description: description4,
+  inputSchema: inputSchema4,
+  parameters: parameters4,
   isReadOnly: true,
   isConcurrencySafe: true,
   maxResultSizeChars: DEFAULT_MAX_RESULT_SIZE_CHARS,
-  call: call3
+  call: call4
 };
 
 // src/tools/grep/grep.ts
 import { spawn as spawn3 } from "child_process";
 import { resolve as resolve7 } from "path";
-import { z as z4 } from "zod";
+import { z as z5 } from "zod";
 
 // src/tools/grep/rgPath.ts
 import { spawn as spawn2 } from "child_process";
-import { chmodSync, existsSync as existsSync3 } from "fs";
+import { chmodSync, existsSync as existsSync5 } from "fs";
 import { resolve as resolve6 } from "path";
 var cached;
 async function resolveRgPath() {
@@ -1141,15 +1559,15 @@ async function resolveRgPath() {
 }
 async function detect() {
   const fromEnv = process.env.MINIMAL_AGENT_RIPGREP_PATH;
-  if (fromEnv && existsSync3(fromEnv)) return fromEnv;
+  if (fromEnv && existsSync5(fromEnv)) return fromEnv;
   const vendored = vendoredRgPath();
-  if (vendored && existsSync3(vendored)) {
+  if (vendored && existsSync5(vendored)) {
     ensureExecutable(vendored);
     return vendored;
   }
   if (await trySpawn("rg")) return "rg";
   for (const candidate of claudeCodeCandidates()) {
-    if (existsSync3(candidate)) {
+    if (existsSync5(candidate)) {
       ensureExecutable(candidate);
       return candidate;
     }
@@ -1242,21 +1660,21 @@ function claudeCodeCandidates() {
 }
 
 // src/tools/grep/grep.ts
-var inputSchema4 = z4.object({
-  pattern: z4.string().min(1).describe("\u6B63\u5219\u8868\u8FBE\u5F0F\uFF08ripgrep \u517C\u5BB9\u8BED\u6CD5\uFF09"),
-  path: z4.string().optional().describe("\u641C\u7D22\u7684\u6839\u76EE\u5F55\u6216\u6587\u4EF6\uFF08\u9ED8\u8BA4\u5F53\u524D\u5DE5\u4F5C\u76EE\u5F55\uFF09"),
-  glob: z4.string().optional().describe('\u6587\u4EF6\u540D glob \u8FC7\u6EE4\uFF0C\u5982 "*.ts"'),
-  type: z4.string().optional().describe('rg \u7684\u6587\u4EF6\u7C7B\u578B\u5FEB\u6377\u540D\uFF0C\u5982 "py"\u3001"rust"\u3001"js"'),
-  output_mode: z4.enum(["content", "files_with_matches", "count"]).optional().describe("\u8F93\u51FA\u6A21\u5F0F\uFF1Acontent=\u5339\u914D\u884C\uFF1Bfiles_with_matches=\u53EA\u5217\u6587\u4EF6\uFF1Bcount=\u6BCF\u6587\u4EF6\u8BA1\u6570"),
-  "-i": z4.boolean().optional().describe("\u5FFD\u7565\u5927\u5C0F\u5199"),
-  "-n": z4.boolean().optional().describe("\u663E\u793A\u884C\u53F7\uFF08\u4EC5 content \u6A21\u5F0F\uFF09"),
-  "-A": z4.number().int().min(0).optional().describe("\u5339\u914D\u540E\u5C55\u793A\u51E0\u884C\u4E0A\u4E0B\u6587"),
-  "-B": z4.number().int().min(0).optional().describe("\u5339\u914D\u524D\u5C55\u793A\u51E0\u884C\u4E0A\u4E0B\u6587"),
-  "-C": z4.number().int().min(0).optional().describe("\u5339\u914D\u524D\u540E\u5404\u5C55\u793A\u51E0\u884C\uFF08\u8986\u76D6 -A/-B\uFF09"),
-  head_limit: z4.number().int().positive().optional().describe("\u8F93\u51FA\u6700\u591A\u4FDD\u7559\u524D N \u884C\uFF08\u9632\u6B62\u7ED3\u679C\u8FC7\u5927\uFF09")
+var inputSchema5 = z5.object({
+  pattern: z5.string().min(1).describe("\u6B63\u5219\u8868\u8FBE\u5F0F\uFF08ripgrep \u517C\u5BB9\u8BED\u6CD5\uFF09"),
+  path: z5.string().optional().describe("\u641C\u7D22\u7684\u6839\u76EE\u5F55\u6216\u6587\u4EF6\uFF08\u9ED8\u8BA4\u5F53\u524D\u5DE5\u4F5C\u76EE\u5F55\uFF09"),
+  glob: z5.string().optional().describe('\u6587\u4EF6\u540D glob \u8FC7\u6EE4\uFF0C\u5982 "*.ts"'),
+  type: z5.string().optional().describe('rg \u7684\u6587\u4EF6\u7C7B\u578B\u5FEB\u6377\u540D\uFF0C\u5982 "py"\u3001"rust"\u3001"js"'),
+  output_mode: z5.enum(["content", "files_with_matches", "count"]).optional().describe("\u8F93\u51FA\u6A21\u5F0F\uFF1Acontent=\u5339\u914D\u884C\uFF1Bfiles_with_matches=\u53EA\u5217\u6587\u4EF6\uFF1Bcount=\u6BCF\u6587\u4EF6\u8BA1\u6570"),
+  "-i": z5.boolean().optional().describe("\u5FFD\u7565\u5927\u5C0F\u5199"),
+  "-n": z5.boolean().optional().describe("\u663E\u793A\u884C\u53F7\uFF08\u4EC5 content \u6A21\u5F0F\uFF09"),
+  "-A": z5.number().int().min(0).optional().describe("\u5339\u914D\u540E\u5C55\u793A\u51E0\u884C\u4E0A\u4E0B\u6587"),
+  "-B": z5.number().int().min(0).optional().describe("\u5339\u914D\u524D\u5C55\u793A\u51E0\u884C\u4E0A\u4E0B\u6587"),
+  "-C": z5.number().int().min(0).optional().describe("\u5339\u914D\u524D\u540E\u5404\u5C55\u793A\u51E0\u884C\uFF08\u8986\u76D6 -A/-B\uFF09"),
+  head_limit: z5.number().int().positive().optional().describe("\u8F93\u51FA\u6700\u591A\u4FDD\u7559\u524D N \u884C\uFF08\u9632\u6B62\u7ED3\u679C\u8FC7\u5927\uFF09")
 });
-var parameters4 = toToolParameters(inputSchema4);
-var description4 = `A powerful search tool built on ripgrep.
+var parameters5 = toToolParameters(inputSchema5);
+var description5 = `A powerful search tool built on ripgrep.
 
 Usage:
 - ALWAYS use Grep for content search tasks. Do NOT invoke \`grep\` or \`rg\` directly via Bash.
@@ -1264,7 +1682,7 @@ Usage:
 - Filter files with glob parameter (e.g., "*.js", "**/*.tsx") or type parameter (e.g., "js", "py", "rust")
 - Output modes: "content" shows matching lines, "files_with_matches" shows only file paths (default), "count" shows match counts
 - Pattern syntax: Uses ripgrep (not classic grep)`;
-async function call4(input, signal) {
+async function call5(input, signal) {
   const args = [];
   const mode = input.output_mode ?? "files_with_matches";
   if (mode === "files_with_matches") args.push("-l");
@@ -1341,27 +1759,27 @@ async function call4(input, signal) {
 }
 var grepTool = {
   name: "Grep",
-  description: description4,
-  inputSchema: inputSchema4,
-  parameters: parameters4,
+  description: description5,
+  inputSchema: inputSchema5,
+  parameters: parameters5,
   isReadOnly: true,
   isConcurrencySafe: true,
   maxResultSizeChars: DEFAULT_MAX_RESULT_SIZE_CHARS,
-  call: call4
+  call: call5
 };
 
 // src/tools/read/read.ts
 import { createReadStream } from "fs";
-import { readFile as readFile7, stat as stat3 } from "fs/promises";
+import { readFile as readFile8, stat as stat3 } from "fs/promises";
 import { createInterface } from "readline";
-import { z as z5 } from "zod";
-var inputSchema5 = z5.object({
-  file_path: z5.string().min(1, "\u5FC5\u987B\u63D0\u4F9B file_path").describe("\u8981\u8BFB\u53D6\u7684\u6587\u4EF6\u8DEF\u5F84\uFF0C\u7EDD\u5BF9\u8DEF\u5F84\u4F18\u5148"),
-  offset: z5.number().int().positive().optional().describe("\u8D77\u59CB\u884C\u53F7\uFF081-indexed\uFF09\uFF1B\u4E0D\u586B\u5219\u4ECE\u6587\u4EF6\u5F00\u5934\u8BFB"),
-  limit: z5.number().int().positive().optional().describe(`\u6700\u591A\u8BFB\u591A\u5C11\u884C\uFF1B\u4E0D\u586B\u5219\u7528\u9ED8\u8BA4\u503C ${MAX_LINES_TO_READ}`)
+import { z as z6 } from "zod";
+var inputSchema6 = z6.object({
+  file_path: z6.string().min(1, "\u5FC5\u987B\u63D0\u4F9B file_path").describe("\u8981\u8BFB\u53D6\u7684\u6587\u4EF6\u8DEF\u5F84\uFF0C\u7EDD\u5BF9\u8DEF\u5F84\u4F18\u5148"),
+  offset: z6.number().int().positive().optional().describe("\u8D77\u59CB\u884C\u53F7\uFF081-indexed\uFF09\uFF1B\u4E0D\u586B\u5219\u4ECE\u6587\u4EF6\u5F00\u5934\u8BFB"),
+  limit: z6.number().int().positive().optional().describe(`\u6700\u591A\u8BFB\u591A\u5C11\u884C\uFF1B\u4E0D\u586B\u5219\u7528\u9ED8\u8BA4\u503C ${MAX_LINES_TO_READ}`)
 });
-var parameters5 = toToolParameters(inputSchema5);
-var description5 = `Reads a file from the local filesystem. You can access any file directly by using this tool.
+var parameters6 = toToolParameters(inputSchema6);
+var description6 = `Reads a file from the local filesystem. You can access any file directly by using this tool.
 Assume this tool is able to read all files on the machine. If the User provides a path to a file assume that path is valid. It is okay to read a file that does not exist; an error will be returned.
 
 Usage:
@@ -1370,9 +1788,10 @@ Usage:
 - You can optionally specify a line offset and limit (especially handy for long files)
 - Results are returned using cat -n format, with line numbers starting at 1
 - This tool can only read text files, not directories. To read a directory, use the Glob tool.
-- If you read a file that exists but has empty contents you will receive a warning in place of file contents.`;
+- If you read a file that exists but has empty contents you will receive a warning in place of file contents.
+- This tool cannot read binary files. Files whose extensions are on the binary blocklist (images: .png/.jpg/.gif/.webp/..., documents: .pdf/.docx/.xlsx/..., executables: .exe/.dll/.so/..., archives: .zip/.tar/.gz/..., and others) will be rejected with a clear error. If the file is actually text despite the extension (e.g., a misnamed log), rename it or use Bash \`cat\` to read it directly \u2014 do not retry Read with the same path.`;
 var STREAM_THRESHOLD = 1024 * 1024;
-async function call5(input) {
+async function call6(input) {
   const offset = input.offset ?? 1;
   const limit = input.limit ?? MAX_LINES_TO_READ;
   const pathResult = validateAndResolvePath(input.file_path, getWorkingDir());
@@ -1383,6 +1802,12 @@ async function call5(input) {
   if (isBlockedDevicePath(filePath)) {
     return { ok: false, error: `\u4E0D\u5141\u8BB8\u8BFB\u53D6\u8BBE\u5907\u6587\u4EF6\uFF1A${filePath}\u3002\u8BE5\u8DEF\u5F84\u53EF\u80FD\u4EA7\u751F\u65E0\u9650\u8F93\u51FA\u6216\u963B\u585E\u8FDB\u7A0B\u3002` };
   }
+  if (hasBinaryExtension(filePath)) {
+    return {
+      ok: false,
+      error: `\u4E0D\u652F\u6301\u8BFB\u53D6\u4E8C\u8FDB\u5236\u6587\u4EF6\uFF1A${filePath}\uFF08\u6269\u5C55\u540D\u547D\u4E2D\u4E8C\u8FDB\u5236\u9ED1\u540D\u5355\uFF09\u3002\u82E5\u8BE5\u6587\u4EF6\u5B9E\u9645\u4E3A\u6587\u672C\uFF0C\u53EF\u6539\u540E\u7F00\u6216\u7528 Bash cat \u65C1\u8DEF\u3002`
+    };
+  }
   let st;
   try {
     st = await stat3(filePath);
@@ -1408,6 +1833,7 @@ async function call5(input) {
     numbered = result.numbered;
     totalLines = result.totalLines;
     if (result.isEmpty) {
+      recordRead(filePath);
       return { ok: true, content: "<file is empty>" };
     }
   } else {
@@ -1416,6 +1842,7 @@ async function call5(input) {
     totalLines = result.totalLines;
   }
   if (totalLines === 0 || !numbered) {
+    recordRead(filePath);
     return { ok: true, content: "<file is empty>" };
   }
   let content = numbered;
@@ -1438,10 +1865,11 @@ async function call5(input) {
 
 \u26A0\uFE0F \u6CE8\u610F\uFF1A\u8FD9\u662F\u4E00\u4E2A\u5927\u6587\u4EF6\uFF08${(st.size / 1024).toFixed(1)} KB\uFF09\u3002\u5EFA\u8BAE\u7528 offset/limit \u5206\u6BB5\u8BFB\u53D6\uFF0C\u4F8B\u5982\u5148\u8BFB\u5173\u952E\u90E8\u5206\uFF08imports\u3001exports\u3001\u51FD\u6570\u7B7E\u540D\uFF09\u3002`;
   }
+  recordRead(filePath);
   return { ok: true, content };
 }
 async function readSmallFile(filePath, offset, limit) {
-  const raw = await readFile7(filePath, "utf8");
+  const raw = await readFile8(filePath, "utf8");
   if (raw.length === 0) {
     return { numbered: "", totalLines: 0, isEmpty: true };
   }
@@ -1491,17 +1919,17 @@ async function readLargeFileStream(filePath, offset, limit) {
 }
 var readTool = {
   name: "Read",
-  description: description5,
-  inputSchema: inputSchema5,
-  parameters: parameters5,
+  description: description6,
+  inputSchema: inputSchema6,
+  parameters: parameters6,
   isReadOnly: true,
   isConcurrencySafe: true,
   maxResultSizeChars: DEFAULT_MAX_RESULT_SIZE_CHARS,
-  call: call5
+  call: call6
 };
 
 // src/tools/webfetch/webfetch.ts
-import { z as z6 } from "zod";
+import { z as z7 } from "zod";
 
 // src/tools/webfetch/preapproved.ts
 var PREAPPROVED_HOSTS = /* @__PURE__ */ new Set([
@@ -1786,12 +2214,12 @@ function cleanCache() {
     }
   }
 }
-var inputSchema6 = z6.object({
-  url: z6.string().describe("\u8981\u83B7\u53D6\u5185\u5BB9\u7684 URL"),
-  prompt: z6.string().describe("\u5BF9\u5185\u5BB9\u8FDB\u884C\u5904\u7406\u7684\u6307\u4EE4\uFF0C\u63CF\u8FF0\u4F60\u60F3\u4ECE\u9875\u9762\u63D0\u53D6\u4EC0\u4E48\u4FE1\u606F")
+var inputSchema7 = z7.object({
+  url: z7.string().describe("\u8981\u83B7\u53D6\u5185\u5BB9\u7684 URL"),
+  prompt: z7.string().describe("\u5BF9\u5185\u5BB9\u8FDB\u884C\u5904\u7406\u7684\u6307\u4EE4\uFF0C\u63CF\u8FF0\u4F60\u60F3\u4ECE\u9875\u9762\u63D0\u53D6\u4EC0\u4E48\u4FE1\u606F")
 });
-var parameters6 = toToolParameters(inputSchema6);
-var description6 = `- Fetches content from a specified URL and processes it using an AI model.
+var parameters7 = toToolParameters(inputSchema7);
+var description7 = `- Fetches content from a specified URL and processes it using an AI model.
 - Takes a URL and a prompt as input.
 - Fetches the URL content, converts HTML to markdown.
 - Processes the content with the prompt (e.g., extract summary, find specific info).
@@ -1900,7 +2328,7 @@ async function htmlToMarkdown(html) {
   const td = new TurndownService();
   return td.turndown(html);
 }
-async function call6(input, signal) {
+async function call7(input, signal) {
   const { url } = input;
   const start = Date.now();
   const cacheKey = url;
@@ -1998,17 +2426,17 @@ ${content}`;
 }
 var webfetchTool = {
   name: "WebFetch",
-  description: description6,
-  inputSchema: inputSchema6,
-  parameters: parameters6,
+  description: description7,
+  inputSchema: inputSchema7,
+  parameters: parameters7,
   isReadOnly: true,
   isConcurrencySafe: true,
   maxResultSizeChars: DEFAULT_MAX_RESULT_SIZE_CHARS,
-  call: call6
+  call: call7
 };
 
 // src/tools/webbrowser/webbrowser.ts
-import { z as z7 } from "zod";
+import { z as z8 } from "zod";
 
 // src/tools/webbrowser/browser.ts
 import os from "os";
@@ -2044,15 +2472,15 @@ function screenshotPath(prefix = "browser") {
 }
 
 // src/tools/webbrowser/webbrowser.ts
-var inputSchema7 = z7.object({
-  action: z7.enum(["navigate", "screenshot", "getContent", "click", "fill", "submit"]).describe("Browser action to perform"),
-  url: z7.string().url().optional().describe("URL to navigate to (required for navigate action)"),
-  selector: z7.string().optional().describe("CSS selector for click/fill/submit actions"),
-  value: z7.string().optional().describe("Value to fill in input fields"),
-  timeout: z7.number().int().positive().optional().describe("Timeout in milliseconds (default: 30000)")
+var inputSchema8 = z8.object({
+  action: z8.enum(["navigate", "screenshot", "getContent", "click", "fill", "submit"]).describe("Browser action to perform"),
+  url: z8.string().url().optional().describe("URL to navigate to (required for navigate action)"),
+  selector: z8.string().optional().describe("CSS selector for click/fill/submit actions"),
+  value: z8.string().optional().describe("Value to fill in input fields"),
+  timeout: z8.number().int().positive().optional().describe("Timeout in milliseconds (default: 30000)")
 });
-var parameters7 = toToolParameters(inputSchema7);
-var description7 = `Control a headless web browser. Navigate to URLs, take screenshots, and interact with web pages.
+var parameters8 = toToolParameters(inputSchema8);
+var description8 = `Control a headless web browser. Navigate to URLs, take screenshots, and interact with web pages.
 
 When to use WebBrowser vs WebSearch:
 - WebSearch: When you need to find information or discover URLs through search
@@ -2083,7 +2511,7 @@ Example actions:
   - Take screenshot: { action: "screenshot" }
   - Click element: { action: "click", selector: "#submit-btn" }
   - Fill form field: { action: "fill", selector: "input[name='email']", value: "user@example.com" }`;
-async function call7(input, signal) {
+async function call8(input, signal) {
   const { action, url, selector, value, timeout = 3e4 } = input;
   let page;
   try {
@@ -2187,30 +2615,30 @@ Current URL: ${page.url()}`
 }
 var webbrowserTool = {
   name: "WebBrowser",
-  description: description7,
-  inputSchema: inputSchema7,
-  parameters: parameters7,
+  description: description8,
+  inputSchema: inputSchema8,
+  parameters: parameters8,
   isReadOnly: false,
   isConcurrencySafe: false,
   maxResultSizeChars: DEFAULT_MAX_RESULT_SIZE_CHARS,
-  call: call7
+  call: call8
 };
 
 // src/tools/websearch/websearch.ts
-import { z as z8 } from "zod";
-var inputSchema8 = z8.object({
-  query: z8.string().min(1, "\u5FC5\u987B\u63D0\u4F9B\u641C\u7D22\u5173\u952E\u8BCD").max(400, "\u641C\u7D22\u5173\u952E\u8BCD\u592A\u957F\uFF08>400 \u5B57\uFF09").describe("\u641C\u7D22\u5173\u952E\u8BCD\uFF0C\u5EFA\u8BAE\u81EA\u7136\u8BED\u8A00\u63CF\u8FF0\u9700\u8981\u67E5\u7684\u4FE1\u606F"),
-  max_results: z8.number().int().min(1).max(20).optional().describe("\u8FD4\u56DE\u7ED3\u679C\u6570\u91CF\uFF0C1-20\uFF0C\u9ED8\u8BA4 5"),
-  search_depth: z8.enum(["basic", "advanced"]).optional().describe("basic \u5FEB\u4F46\u6D45\uFF1Badvanced \u6162\u4F46\u6DF1\uFF08\u542B answer \u6458\u8981\uFF09\uFF0C\u9ED8\u8BA4 basic"),
-  topic: z8.enum(["general", "news"]).optional().describe("general=\u901A\u7528\u7F51\u9875\uFF1Bnews=\u504F\u65B0\u95FB\u6E90\uFF1B\u9ED8\u8BA4 general")
+import { z as z9 } from "zod";
+var inputSchema9 = z9.object({
+  query: z9.string().min(1, "\u5FC5\u987B\u63D0\u4F9B\u641C\u7D22\u5173\u952E\u8BCD").max(400, "\u641C\u7D22\u5173\u952E\u8BCD\u592A\u957F\uFF08>400 \u5B57\uFF09").describe("\u641C\u7D22\u5173\u952E\u8BCD\uFF0C\u5EFA\u8BAE\u81EA\u7136\u8BED\u8A00\u63CF\u8FF0\u9700\u8981\u67E5\u7684\u4FE1\u606F"),
+  max_results: z9.number().int().min(1).max(20).optional().describe("\u8FD4\u56DE\u7ED3\u679C\u6570\u91CF\uFF0C1-20\uFF0C\u9ED8\u8BA4 5"),
+  search_depth: z9.enum(["basic", "advanced"]).optional().describe("basic \u5FEB\u4F46\u6D45\uFF1Badvanced \u6162\u4F46\u6DF1\uFF08\u542B answer \u6458\u8981\uFF09\uFF0C\u9ED8\u8BA4 basic"),
+  topic: z9.enum(["general", "news"]).optional().describe("general=\u901A\u7528\u7F51\u9875\uFF1Bnews=\u504F\u65B0\u95FB\u6E90\uFF1B\u9ED8\u8BA4 general")
 });
-var parameters8 = toToolParameters(inputSchema8);
-var description8 = `- Searches the public web via the Tavily Search API and returns structured results.
+var parameters9 = toToolParameters(inputSchema9);
+var description9 = `- Searches the public web via the Tavily Search API and returns structured results.
 - Use this when you need up-to-date information that is not in your training data, or when the user asks for recent news / docs / API references.
 - Returns the top N results, each with a title, URL, and content snippet. With \`search_depth: "advanced"\` Tavily also returns a synthesized answer at the top.
 - Prefer specific natural-language queries over keyword soup (e.g. "how does Bun handle .env files in version 1.1").
 - Requires the TAVILY_API_KEY environment variable to be set; if missing the tool returns a friendly error.`;
-async function call8(input, signal) {
+async function call9(input, signal) {
   const apiKey = process.env.TAVILY_API_KEY;
   if (!apiKey) {
     return {
@@ -2292,37 +2720,42 @@ ${(r.content ?? "").trim()}`
 }
 var webSearchTool = {
   name: "WebSearch",
-  description: description8,
-  inputSchema: inputSchema8,
-  parameters: parameters8,
+  description: description9,
+  inputSchema: inputSchema9,
+  parameters: parameters9,
   isReadOnly: true,
   isConcurrencySafe: true,
   maxResultSizeChars: DEFAULT_MAX_RESULT_SIZE_CHARS,
-  call: call8
+  call: call9
 };
 
 // src/tools/write/write.ts
-import { existsSync as existsSync4 } from "fs";
-import { mkdir as mkdir5, stat as stat4, writeFile as writeFile4 } from "fs/promises";
+import { existsSync as existsSync6 } from "fs";
+import { mkdir as mkdir5, stat as stat4, writeFile as writeFile5 } from "fs/promises";
 import { dirname as dirname6 } from "path";
-import { z as z9 } from "zod";
+import { z as z10 } from "zod";
 var MAX_WRITE_SIZE_BYTES = 1024 * 1024 * 1024;
-var inputSchema9 = z9.object({
-  file_path: z9.string().min(1).describe("\u8981\u5199\u5165\u7684\u6587\u4EF6\u8DEF\u5F84"),
-  content: z9.string().describe("\u6587\u4EF6\u5B8C\u6574\u5185\u5BB9\uFF08\u4F1A\u8986\u76D6\u65E2\u6709\u5185\u5BB9\uFF09")
+var inputSchema10 = z10.object({
+  file_path: z10.string().min(1).describe("\u8981\u5199\u5165\u7684\u6587\u4EF6\u8DEF\u5F84"),
+  content: z10.string().describe("\u6587\u4EF6\u5B8C\u6574\u5185\u5BB9\uFF08\u4F1A\u8986\u76D6\u65E2\u6709\u5185\u5BB9\uFF09")
 });
-var parameters9 = toToolParameters(inputSchema9);
-var description9 = `Writes a file to the local filesystem.
+var parameters10 = toToolParameters(inputSchema10);
+var description10 = `Writes a file to the local filesystem.
 
 Usage:
 - This tool will overwrite the existing file if there is one at the provided path.
+- If you intend to overwrite an existing file, you MUST use your \`Read\` tool to read its current content at least once in the current session BEFORE calling Write. This tool will error with a "\u8BF7\u5148 Read" message if you attempt to overwrite a file that has not been read. To create a new file (path does not yet exist), you can call Write directly without a prior Read.
 - If the parent directory does not exist, it will be created recursively.
 - ALWAYS prefer editing existing files in the codebase via the Edit tool. NEVER write new files unless explicitly required.
 - NEVER create documentation files (*.md) or README files unless explicitly requested by the User.`;
-async function call9(input) {
+async function call10(input) {
   const pathResult = validateAndResolvePath(input.file_path, getWorkingDir());
   if (!pathResult.ok) return pathResult;
   const filePath = pathResult.resolvedPath;
+  const freshness = assertFresh(filePath);
+  if (!freshness.ok) {
+    return { ok: false, error: freshness.error };
+  }
   const contentSize = Buffer.byteLength(input.content, "utf8");
   if (contentSize > MAX_WRITE_SIZE_BYTES) {
     return {
@@ -2333,7 +2766,7 @@ async function call9(input) {
   try {
     await mkdir5(dirname6(filePath), { recursive: true });
     let originalSize = 0;
-    const fileExisted = existsSync4(filePath);
+    const fileExisted = existsSync6(filePath);
     if (fileExisted) {
       try {
         const st = await stat4(filePath);
@@ -2342,16 +2775,32 @@ async function call9(input) {
       }
     }
     let contentToWrite = input.content;
+    let bomEncoding = "utf8";
     if (fileExisted) {
+      const detected = await detectFileBomEncoding(filePath);
+      if (detected === "utf16le") {
+        return {
+          ok: false,
+          error: "\u6682\u4E0D\u652F\u6301\u6539\u5199 UTF-16 LE \u6587\u4EF6\uFF08BOM=FF FE\uFF09\u3002\u8BF7\u6539\u7528 UTF-8 \u7F16\u7801\u3002"
+        };
+      }
+      bomEncoding = detected;
       const lineEnding = await detectFileLineEndings(filePath);
       contentToWrite = applyLineEnding(input.content, lineEnding);
     }
-    await writeFile4(filePath, contentToWrite, "utf8");
+    if (bomEncoding === "utf8-bom") {
+      const bomBytes = Buffer.from([239, 187, 191]);
+      const bodyBytes = Buffer.from(contentToWrite, "utf8");
+      await writeFile5(filePath, Buffer.concat([bomBytes, bodyBytes]));
+    } else {
+      await writeFile5(filePath, contentToWrite, "utf8");
+    }
     const action = fileExisted ? "\u5DF2\u8986\u76D6" : "\u5DF2\u521B\u5EFA\u65B0\u6587\u4EF6";
     const sizeInfo = fileExisted ? `\uFF08\u539F\u6587\u4EF6 ${originalSize} \u5B57\u7B26 \u2192 \u65B0\u5185\u5BB9 ${contentToWrite.length} \u5B57\u7B26\uFF09` : `\uFF08${contentToWrite.length} \u5B57\u7B26\uFF09`;
+    const bomInfo = bomEncoding === "utf8-bom" ? "\uFF0C\u5DF2\u4FDD\u7559 UTF-8 BOM" : "";
     return {
       ok: true,
-      content: `${action} ${filePath}${sizeInfo}`
+      content: `${action} ${filePath}${sizeInfo}${bomInfo}`
     };
   } catch (e) {
     return { ok: false, error: `\u5199\u5165\u5931\u8D25\uFF1A${e.message}` };
@@ -2359,19 +2808,20 @@ async function call9(input) {
 }
 var writeTool = {
   name: "Write",
-  description: description9,
-  inputSchema: inputSchema9,
-  parameters: parameters9,
+  description: description10,
+  inputSchema: inputSchema10,
+  parameters: parameters10,
   isReadOnly: false,
   isConcurrencySafe: false,
   maxResultSizeChars: DEFAULT_MAX_RESULT_SIZE_CHARS,
-  call: call9
+  call: call10
 };
 
 // src/tools/index.ts
 var ALL_TOOLS = [
   readTool,
   editTool,
+  multiEditTool,
   writeTool,
   globTool,
   grepTool,
@@ -3780,7 +4230,7 @@ async function reactiveCompactIfApplicable(messages, provider, error, state = de
 }
 
 // src/plugins/commandRouter.ts
-import { readFile as readFile8, readdir as readdir3 } from "fs/promises";
+import { readFile as readFile9, readdir as readdir3 } from "fs/promises";
 import { join as join6 } from "path";
 var PLUGINS_DIR = join6(findPackageRoot(import.meta.url), "plugins");
 var pluginCache = /* @__PURE__ */ new Map();
@@ -3812,7 +4262,7 @@ async function loadPlugin(pluginDirPath) {
   let manifestVersion;
   let manifestDesc;
   try {
-    const raw = await readFile8(manifestPath, "utf8");
+    const raw = await readFile9(manifestPath, "utf8");
     const parsed = JSON.parse(raw);
     manifestName = parsed.name ?? dirName;
     manifestVersion = parsed.version;
@@ -3827,7 +4277,7 @@ async function loadPlugin(pluginDirPath) {
       if (!entry.name.endsWith(".md")) continue;
       const cmdPath = join6(commandsDir, entry.name);
       try {
-        const content = await readFile8(cmdPath, "utf8");
+        const content = await readFile9(cmdPath, "utf8");
         const fm = parseMarkdownFrontmatter(content);
         const sep2 = content.indexOf("\n---", 4);
         const body = sep2 >= 0 ? content.slice(sep2 + 4).trim() : content.trim();
@@ -3847,7 +4297,7 @@ async function loadPlugin(pluginDirPath) {
   const hooksJsonPath = join6(pluginDirPath, "hooks", "hooks.json");
   let hasStopHook = false;
   try {
-    const hooksRaw = await readFile8(hooksJsonPath, "utf8");
+    const hooksRaw = await readFile9(hooksJsonPath, "utf8");
     const hooksParsed = JSON.parse(hooksRaw);
     const stopHooks = hooksParsed?.hooks?.Stop;
     if (Array.isArray(stopHooks) && stopHooks.length > 0) {
@@ -3940,13 +4390,13 @@ function getActiveStopHookPlugins() {
 }
 
 // src/plugins/stopHook.ts
-import { readFile as readFile9 } from "fs/promises";
+import { readFile as readFile10 } from "fs/promises";
 import { join as join7 } from "path";
 import { spawn as spawn4 } from "child_process";
 async function loadStopHookConfig(pluginRoot) {
   const hooksJsonPath = join7(pluginRoot, "hooks", "hooks.json");
   try {
-    const raw = await readFile9(hooksJsonPath, "utf8");
+    const raw = await readFile10(hooksJsonPath, "utf8");
     const parsed = JSON.parse(raw);
     const stopEntries = parsed?.hooks?.Stop;
     if (!Array.isArray(stopEntries)) return [];
@@ -4028,7 +4478,7 @@ function runSingleStopHook(hookConfig, pluginRoot, transcriptText) {
 }
 
 // src/plugins/verificationGate.ts
-import { existsSync as existsSync5, readFileSync } from "fs";
+import { existsSync as existsSync7, readFileSync } from "fs";
 import { spawn as spawn5 } from "child_process";
 function parseVerifyArg(arg) {
   const colonIdx = arg.indexOf(":");
@@ -4105,7 +4555,7 @@ async function verifyShell(command, timeout) {
   };
 }
 function verifyFileExists(file) {
-  const exists = existsSync5(file);
+  const exists = existsSync7(file);
   return {
     check: { type: "file_exists", file },
     passed: exists,
@@ -4205,8 +4655,8 @@ function formatCheckName(check) {
 }
 
 // src/plugins/goalState.ts
-import { mkdir as mkdir6, appendFile, writeFile as writeFile5, unlink as unlink2, rmdir as rmdir2 } from "fs/promises";
-import { existsSync as existsSync6, readFileSync as readFileSync2 } from "fs";
+import { mkdir as mkdir6, appendFile, writeFile as writeFile6, unlink as unlink2, rmdir as rmdir2 } from "fs/promises";
+import { existsSync as existsSync8, readFileSync as readFileSync2 } from "fs";
 import { join as join8 } from "path";
 var Phase = /* @__PURE__ */ ((Phase2) => {
   Phase2["PLAN"] = "plan";
@@ -4275,8 +4725,8 @@ ${goal}
     };
     for (const [name, content] of Object.entries(files)) {
       const path2 = join8(this.dir, `${name}.md`);
-      if (!existsSync6(path2)) {
-        await writeFile5(path2, content);
+      if (!existsSync8(path2)) {
+        await writeFile6(path2, content);
       }
     }
   }
@@ -4320,14 +4770,14 @@ ${goal}
         `\u975E\u6CD5\u9636\u6BB5\u5207\u6362: ${current} \u2192 ${phase}\u3002\u8BE5\u76EE\u6807\u9636\u6BB5\u4E0D\u5728 PHASE_TRANSITIONS[${current}] \u7684\u53EF\u8FBE\u96C6\u5408\u5185\uFF0C\u9700\u8981\u8D70 forceSetPhase\u3002`
       );
     }
-    await writeFile5(join8(this.dir, "phase.md"), phase);
+    await writeFile6(join8(this.dir, "phase.md"), phase);
     await this.appendProgress(`PHASE \u2192 ${phase}: ${reason}`);
   }
   async forceSetPhase(phase, reason) {
     if (!VALID_PHASES.has(phase)) {
       throw new Error(`Invalid phase: ${phase}`);
     }
-    await writeFile5(join8(this.dir, "phase.md"), phase);
+    await writeFile6(join8(this.dir, "phase.md"), phase);
     await this.appendProgress(`PHASE \u2192 ${phase}: ${reason}`);
   }
   async appendProgress(line) {
@@ -4945,6 +5395,7 @@ function useChat(args) {
     setCompacting(false);
     bump();
     await clearContext();
+    clearFileState();
   }, [bump, isLoading]);
   const compactNow = useCallback5(async () => {
     if (isLoading) return;
@@ -5298,7 +5749,7 @@ async function main() {
   const dirArg = extractCwdArg(args);
   if (dirArg) {
     const abs = resolve8(dirArg);
-    if (!existsSync7(abs)) {
+    if (!existsSync9(abs)) {
       mkdirSync(abs, { recursive: true });
     }
     process.chdir(abs);

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "minimal-agent",
-  "version": "0.1.6",
-  "description": "最小化 Agent 系统 —— 单对话 + 9 工具 + 自动压缩 + OpenAI 兼容 + Ink TUI（学习/教学用）",
+  "version": "0.1.8",
+  "description": "最小化 Agent 系统 —— 单对话 + 10 工具 + MultiEdit + Pre-read Guard + 自动压缩 + OpenAI 兼容 + Ink TUI",
   "license": "SEE LICENSE IN LICENSE",
   "author": "Bill Wang <leiwang0359@gmail.com>",
   "repository": {