minimal-agent 0.12.0 → 0.14.0

package/src/tools/bash/bash.ts

@@ -63,7 +63,10 @@ import { requestUserChoice } from '../../askBridge.js';
 import { classifyCommand } from '../../irreversible/rules.js';
 import { startBackgroundTask } from '../tasks/backgroundTaskService.js';
 import { processExecutionMetadata } from '../tasks/processEvidence.js';
-import { permanentDeleteReason } from '../shared/permanentDeleteGuard.js';
+import {
+  permanentDeleteReason,
+  type ShellKind,
+} from '../shared/permanentDeleteGuard.js';
 import { ToolOutputStore } from '../shared/toolOutputStore.js';
 
 // ---------------- 0. 常量 ----------------
@@ -112,6 +115,37 @@ function detectWindowsBash(): string | null {
 
 const WIN_BASH = detectWindowsBash();
 
+/**
+ * 本工具这一刻**真正**把命令交给谁执行。
+ *
+ * 单一出处：description（告诉模型该写哪种语法）与 permanentDeleteGuard（按哪套动词
+ * 匹配删除命令）必须看同一个判断，否则就会出现「description 说这是 cmd、守卫却按
+ * bash 匹配」这种两头对不上的裂缝 —— del / rd 会因此直接穿过全部三层防护。
+ */
+function effectiveShellKind(): ShellKind {
+  return process.platform === 'win32' && !WIN_BASH ? 'cmd' : 'bash';
+}
+
+/**
+ * 每台机器不同、只能运行时探测的 shell 方言警告（K1 事故修复的核心内容）。
+ * 单一出处：完整 description（下方）和 toolPromptGuides.ts 的压缩 override
+ * 都调这个函数，不允许各自抄一份文案——否则「压缩省 token」的那份会在
+ * 无 Git Bash 的机器上悄悄丢掉这条警告，模型照抄 POSIX 语法必挂
+ * （`mkdir -p` 在 cmd.exe 下不生成中间目录、`$VAR`/`export` 不存在）。
+ */
+export function bashShellNotice(): string {
+  if (process.platform !== 'win32') return '';
+  return WIN_BASH
+    ? `# Shell (this machine)
+Commands run in a real bash (Git Bash at ${WIN_BASH}). POSIX syntax works: \`mkdir -p\`, \`$VAR\`, \`$(...)\`, \`&&\`, \`[ -f x ]\` are all fine. Note the working directory is a Windows path — both \`D:\\path\` and \`/d/path\` forms work in this bash.`
+    : `# Shell (this machine) — IMPORTANT
+No bash found on this Windows machine: commands run in cmd.exe (UTF-8 enforced). POSIX syntax does NOT work here:
+ - NO \`mkdir -p\` — cmd's \`mkdir a\\b\\c\` creates intermediate directories by default; better: the Write tool auto-creates parent directories
+ - NO \`$VAR\` / \`$(...)\` / \`[ -f x ]\` / \`export\` — use \`%VAR%\`, \`if exist\`, \`set\`
+ - Use \`dir\` / \`copy\` / \`del\` / \`type\` instead of \`ls\` / \`cp\` / \`rm\` / \`cat\`
+\`&&\` and \`;\`-style chaining: \`&&\` works in cmd; \`;\` does not (use \`&\`).`;
+}
+
 /**
  * G1：stdout / stderr 即时缓冲上限（各自）。命令狂输出（如 cat 大文件 / yes）时，
  * 在最终统一截断之前先把内存封顶，防 OOM。取最终展示截断阈值的 2 倍 —— 正常输出不受影响，
@@ -289,6 +323,8 @@ const parameters = toToolParameters(inputSchema);
 //   - 先点明"专用工具优先"的原则，把每类操作映射到对应工具
 //   - 再列 Bash 自身的使用规范（绝对路径 / 不 cd / 超时 / 多命令并行...）
 //   - 最后强调安全黑名单（让模型知道哪些命令会被拒，避免反复试）
+const shellNotice = bashShellNotice();
+
 const description = `Executes a given bash command and returns its output.
 
 The working directory persists between commands, but shell state does not. The shell environment is initialized from the user's profile.
@@ -332,8 +368,11 @@ Some commands return non-zero exit codes for informational (non-error) reasons.
  - \`test\` / \`[\` exit 1 → condition is false (the answer to a question, not a failure)
 Only exit codes ≥ 2 from these commands indicate a real failure. For all other commands, non-zero exit codes are treated as failures normally.
 
-# Safety
-The following command patterns are blocked at the tool level and will fail before execution (no need to try them):
+# Safety - three levels, from strict to lenient
+
+## 1. Blocked outright (fails before execution - do NOT retry with variants)
+
+Catastrophic commands (no legitimate use):
  - \`rm -rf /\` and variants targeting root, $HOME, ~, or system directories (/etc, /usr, /bin, /Windows, /Users, /home, ...)
  - Filesystem destruction: \`mkfs\`, \`format X:\`, \`dd of=/dev/sdX\`, redirects to raw block devices
  - Power management: \`shutdown\`, \`reboot\`, \`halt\`, \`poweroff\`, \`init 0/6\`
@@ -341,25 +380,37 @@ The following command patterns are blocked at the tool level and will fail befor
  - Pipe-to-shell from network: \`curl ... | sh\`, \`wget ... | bash\`, etc.
  - \`chmod 777 /\`, Windows full-disk \`del /s\` / \`rmdir /s\`, \`diskpart\`
 
-If you have a legitimate use case that requires one of the above patterns, ask the user to run the command themselves in their terminal — do not try to bypass the check.
+Permanent deletion (bypasses the OS Trash / Recycle Bin - use the Trash tool instead):
+ - \`rm\`, \`unlink\`, \`rmdir\` (any shell-level file/dir deletion, any target)
+ - \`find ... -delete\`
+ - \`git clean -f\` / \`git clean --force\` (\`-n\` / \`--dry-run\` is fine)
 
-Separately, Bash scans for common destructive-but-recoverable patterns (\`git reset --hard\`, \`git push -f\` / \`--force\` / \`--force-with-lease\`, \`git checkout .\`, \`git restore .\`, \`git clean -f\`, \`git stash drop/clear\`, \`git branch -D\`, \`git commit --amend\` / \`--no-verify\`, \`rm -rf <path>\`, \`DROP TABLE\`, \`TRUNCATE\`, \`DELETE FROM\`, \`kubectl delete\`, \`terraform destroy\`, etc.) and prepends a \`⚠️ 警告:\` line to the output. These commands are NOT blocked — the warning is informational. Treat it as a signal to double-check intent and surface the warning to the user when relevant.${
-  process.platform !== 'win32'
-    ? ''
-    : WIN_BASH
-      ? `
+To delete files or directories use the **Trash** tool (\`action: "move"\` - recoverable); to clean Git untracked files use Trash with \`action: "git-clean"\`.
+Do NOT work around this by switching to \`find -delete\`, Python \`os.remove\`, Node \`fs.rm\`, or other shell variants - they are blocked the same way.
+If a permanent deletion is truly required, ask the user to run it themselves in their terminal.
 
-# Shell (this machine)
-Commands run in a real bash (Git Bash at ${WIN_BASH}). POSIX syntax works: \`mkdir -p\`, \`$VAR\`, \`$(...)\`, \`&&\`, \`[ -f x ]\` are all fine. Note the working directory is a Windows path — both \`D:\\path\` and \`/d/path\` forms work in this bash.`
-      : `
+## 2. Requires user confirmation (irreversible)
 
-# Shell (this machine) — IMPORTANT
-No bash found on this Windows machine: commands run in cmd.exe (UTF-8 enforced). POSIX syntax does NOT work here:
- - NO \`mkdir -p\` — cmd's \`mkdir a\\b\\c\` creates intermediate directories by default; better: the Write tool auto-creates parent directories
- - NO \`$VAR\` / \`$(...)\` / \`[ -f x ]\` / \`export\` — use \`%VAR%\`, \`if exist\`, \`set\`
- - Use \`dir\` / \`copy\` / \`del\` / \`type\` instead of \`ls\` / \`cp\` / \`rm\` / \`cat\`
-\`&&\` and \`;\`-style chaining: \`&&\` works in cmd; \`;\` does not (use \`&\`).`
-}`;
+These have legitimate uses but destroy the last copy - execution pauses and asks the user to confirm. In non-interactive contexts (sub-agents, cron, batch mode) they are automatically cancelled.
+ - \`git push --force\` / \`-f\`, and \`git push origin +branch\` (+refspec = force push)
+ - \`git push --delete <branch>\` / \`git push :<branch>\` (deleting remote branches)
+ - \`git filter-branch\` / \`git filter-repo\` (rewriting history)
+ - \`git reflog expire --expire=now\` / \`git gc --prune=now\` (destroying reflog)
+ - \`shred -u\` / \`shred --remove\` (overwrite and delete - unrecoverable)
+ - SQL data destruction: \`DROP DATABASE\`, \`DROP TABLE\`, \`TRUNCATE TABLE\`
+
+## 3. Warning only (command still runs)
+
+These execute normally; a \`⚠️ 警告:\` line is prepended to the output as a reminder. They are NOT blocked.
+ - \`git reset --hard\` (reflog keeps it recoverable)
+ - \`git push --force-with-lease\` (rejects if the remote has unseen commits - the safe force-push form)
+ - \`git checkout -- .\` / \`git restore .\` (discards uncommitted changes)
+ - \`git branch -D\`, \`git stash drop\` / \`git stash clear\` (local, recoverable via reflog in most cases)
+ - \`git commit --amend\`, \`git commit --no-verify\`
+ - \`DELETE FROM ...\` (SQL row deletion; DROP/TRUNCATE are in level 2)
+ - \`kubectl delete\`, \`terraform destroy\`
+
+Regular Git operations (commit, add, status, log, diff, pull, fetch, checkout <branch>, merge, rebase, etc.) run without extra restrictions.${shellNotice ? `\n\n${shellNotice}` : ''}`;
 
 // ---------------- 4. call() —— 真正干活 ----------------
 async function call(input: BashInput, signal?: AbortSignal, context?: ToolCallContext): Promise<ToolResult> {
@@ -374,7 +425,11 @@ async function call(input: BashInput, signal?: AbortSignal, context?: ToolCallCo
       error: `安全检查拒绝执行：${forbiddenReason}\n命令：${command}`,
     };
   }
-  const permanentDelete = permanentDeleteReason(command, 'bash');
+  // 传**实际执行命令的 shell**，不是工具名：win32 上找不到 Git Bash 时下面走的是
+  // cmd.exe（见 WIN_BASH 探测），description 也会告诉模型「这里是 cmd」，模型于是写
+  // del / rd —— 按 'bash' 匹配的话这两个词一个都拦不住（黑名单与 irreversible 规则表
+  // 同样只认 POSIX 形态），等于三层全空。
+  const permanentDelete = permanentDeleteReason(command, effectiveShellKind());
   if (permanentDelete) return { ok:false, error:`永久删除检查拒绝执行：${permanentDelete}\n命令：${command}` };
 
   // 4a-1. 不可逆动作闸门：毁掉「最后一份副本」的命令要**停下来问人**。

package/src/tools/capabilities.js

@@ -1,7 +1,7 @@
 const TOOL_CAPABILITIES = Object.freeze({
     Read: 'files.read', Glob: 'files.read', Grep: 'files.read',
     Snip: 'files.read',
-    Edit: 'files.write', MultiEdit: 'files.write', Write: 'files.write',
+    Edit: 'files.write', MultiEdit: 'files.write', Write: 'files.write', ApplyPatch: 'files.write',
     Bash: 'shell',
     PowerShell: 'shell', TaskOutput: 'background.process', TaskStop: 'background.process',
     Trash: 'files.trash',
@@ -9,9 +9,11 @@ const TOOL_CAPABILITIES = Object.freeze({
     Skill: 'skill.invoke', EnterWorktree: 'worktree.session', ExitWorktree: 'worktree.session',
     TerminalCapture: 'terminal.capture',
     LSP: 'code.intelligence', NotebookEdit: 'files.write',
-    WebSearch: 'web.search', WebFetch: 'web.fetch', WebBrowser: 'web.browser',
+    WebSearch: 'web.search', WebFetch: 'web.fetch', WebBrowser: 'web.browser', BrowserBatch: 'web.browser', BrowserCDP: 'web.browser',
     Download: 'network.download',
-    ComputerUse: 'computer.use', AskUserQuestion: 'ask', Advisor: 'advisor', Agent: 'subagent',
+    ComputerUse: 'computer.use', AskUserQuestion: 'ask', Advisor: 'advisor', AdvisorDecision: 'advisor',
+    Agent: 'subagent', AgentMessage: 'subagent', AgentList: 'subagent', AgentWait: 'subagent',
+    AgentInterrupt: 'subagent', AgentFollowup: 'subagent',
     PresentResult: 'delivery', GenerateImage: 'media', GenerateSpeech: 'media',
     RecallMemory: 'memory', RememberMemory: 'memory', UpdateMemory: 'memory',
     ListMemories: 'memory', ForgetMemory: 'memory', SetPersona: 'memory',
@@ -19,9 +21,12 @@ const TOOL_CAPABILITIES = Object.freeze({
     SearchConversations: 'memory',
 });
 const CORE_TOOLS = new Set([
-    'Read', 'Glob', 'Grep', 'Edit', 'MultiEdit', 'Write', 'NotebookEdit', 'Bash',
+    'Read', 'Glob', 'Grep', 'Edit', 'MultiEdit', 'Write', 'ApplyPatch', 'NotebookEdit', 'Bash',
+]);
+const AUXILIARY_TOOLS = new Set([
+    'Advisor', 'AdvisorDecision', 'Agent', 'AgentMessage', 'AgentList',
+    'AgentWait', 'AgentInterrupt', 'AgentFollowup',
 ]);
-const AUXILIARY_TOOLS = new Set(['Advisor', 'Agent']);
 export function budgetClassForToolName(name) {
     if (CORE_TOOLS.has(name))
         return 'core';

package/src/tools/capabilities.ts

@@ -26,7 +26,7 @@ export type ToolBudgetClass = 'core' | 'task' | 'auxiliary';
 const TOOL_CAPABILITIES: Readonly<Record<string, CapabilityId>> = Object.freeze({
   Read: 'files.read', Glob: 'files.read', Grep: 'files.read',
   Snip: 'files.read',
-  Edit: 'files.write', MultiEdit: 'files.write', Write: 'files.write',
+  Edit: 'files.write', MultiEdit: 'files.write', Write: 'files.write', ApplyPatch: 'files.write',
   Bash: 'shell',
   PowerShell: 'shell', TaskOutput: 'background.process', TaskStop: 'background.process',
   Trash: 'files.trash',
@@ -34,9 +34,11 @@ const TOOL_CAPABILITIES: Readonly<Record<string, CapabilityId>> = Object.freeze(
   Skill: 'skill.invoke', EnterWorktree: 'worktree.session', ExitWorktree: 'worktree.session',
   TerminalCapture: 'terminal.capture',
   LSP: 'code.intelligence', NotebookEdit: 'files.write',
-  WebSearch: 'web.search', WebFetch: 'web.fetch', WebBrowser: 'web.browser',
+  WebSearch: 'web.search', WebFetch: 'web.fetch', WebBrowser: 'web.browser', BrowserBatch: 'web.browser', BrowserCDP: 'web.browser',
   Download: 'network.download',
-  ComputerUse: 'computer.use', AskUserQuestion: 'ask', Advisor: 'advisor', Agent: 'subagent',
+  ComputerUse: 'computer.use', AskUserQuestion: 'ask', Advisor: 'advisor', AdvisorDecision: 'advisor',
+  Agent: 'subagent', AgentMessage: 'subagent', AgentList: 'subagent', AgentWait: 'subagent',
+  AgentInterrupt: 'subagent', AgentFollowup: 'subagent',
   PresentResult: 'delivery', GenerateImage: 'media', GenerateSpeech: 'media',
   RecallMemory: 'memory', RememberMemory: 'memory', UpdateMemory: 'memory',
   ListMemories: 'memory', ForgetMemory: 'memory', SetPersona: 'memory',
@@ -45,9 +47,12 @@ const TOOL_CAPABILITIES: Readonly<Record<string, CapabilityId>> = Object.freeze(
 });
 
 const CORE_TOOLS = new Set([
-  'Read', 'Glob', 'Grep', 'Edit', 'MultiEdit', 'Write', 'NotebookEdit', 'Bash',
+  'Read', 'Glob', 'Grep', 'Edit', 'MultiEdit', 'Write', 'ApplyPatch', 'NotebookEdit', 'Bash',
+]);
+const AUXILIARY_TOOLS = new Set([
+  'Advisor', 'AdvisorDecision', 'Agent', 'AgentMessage', 'AgentList',
+  'AgentWait', 'AgentInterrupt', 'AgentFollowup',
 ]);
-const AUXILIARY_TOOLS = new Set(['Advisor', 'Agent']);
 
 export function budgetClassForToolName(name: string): ToolBudgetClass {
   if (CORE_TOOLS.has(name)) return 'core';

package/src/tools/computeruse/computerIntent.js

@@ -0,0 +1,32 @@
+const CONTINUATION_WINDOW_MS = 30 * 60_000;
+const CONTINUATION_ONLY = /^(?:请)?(?:继续|接着(?:做|操作)?|重试|再试一次|往下做|恢复操作)[。！!\s]*$/i;
+const DIRECT_DESKTOP = /(?:操作(?:电脑|桌面|屏幕|窗口|系统|本机)|电脑自动化|桌面自动化|查看(?:当前)?(?:桌面|屏幕|前台窗口)|截(?:取)?(?:当前)?屏|系统设置|控制面板|任务管理器|资源管理器|访达|Finder)/i;
+const GUI_ACTION = /(?:点击|双击|右键|拖拽|滚动|输入|粘贴|按(?:键|快捷键)|切换|激活|关闭|移动|调整窗口|发送|发布|上传)/i;
+const APP_TARGET = /(?:在|用|打开|切换到|进入)[^，。\n]{0,28}(?:应用|软件|客户端|微信|WeChat|钉钉|飞书|Slack|QQ|邮件|Outlook|Word|Excel|PowerPoint|设置|窗口)(?:里|中|上|内|给|向|并|，|。|\s|$)/i;
+const DISCUSSION_ONLY = /(?:解释|介绍|讨论|分析|评审|代码|源码|实现|设计|为什么|是什么|如何实现|测试.*ComputerUse|ComputerUse.*测试)/i;
+const DIRECT_TOOL_TASK = /(?:读取|分析|查看|理解).{0,12}(?:图片|照片|截图文件|PDF|文件|附件)|(?:搜索|修改|编写|重构|构建|运行测试|查找).{0,12}(?:代码|文件|网页)|(?:搜索网页|打开网址|访问网站|网页中)/i;
+/**
+ * Conservative, deterministic exposure classifier. It only consumes the
+ * current human input and a short-lived record of a real prior ComputerUse
+ * call; model output, page content, and tool arguments can never enable it.
+ */
+export function classifyComputerAutomationIntent(input, continuation, now = Date.now()) {
+    const text = input.trim();
+    if (continuation
+        && now - continuation.lastUsedAt <= CONTINUATION_WINDOW_MS
+        && CONTINUATION_ONLY.test(text)) {
+        return { needed: true, source: 'continuation', reason: '继续最近一次桌面自动化任务' };
+    }
+    if (!text)
+        return { needed: false, source: 'none', reason: '没有桌面操作请求' };
+    if (DIRECT_TOOL_TASK.test(text) && !DIRECT_DESKTOP.test(text)) {
+        return { needed: false, source: 'none', reason: '专用文件、图片或 Web 工具可直接完成' };
+    }
+    if (DISCUSSION_ONLY.test(text) && !DIRECT_DESKTOP.test(text) && !GUI_ACTION.test(text)) {
+        return { needed: false, source: 'none', reason: '仅讨论桌面能力，没有要求实际操作' };
+    }
+    if (DIRECT_DESKTOP.test(text) || (GUI_ACTION.test(text) && APP_TARGET.test(text))) {
+        return { needed: true, source: 'explicit-current', reason: '用户明确要求操作原生桌面界面' };
+    }
+    return { needed: false, source: 'none', reason: '未发现明确的原生桌面操作意图' };
+}

package/src/tools/computeruse/computerIntent.ts

@@ -0,0 +1,46 @@
+export type ComputerAutomationIntent =
+  | { needed: true; source: 'explicit-current' | 'continuation'; reason: string }
+  | { needed: false; source: 'none'; reason: string };
+
+export interface ComputerAutomationContinuationState {
+  lastUsedAt: number;
+}
+
+const CONTINUATION_WINDOW_MS = 30 * 60_000;
+const CONTINUATION_ONLY = /^(?:请)?(?:继续|接着(?:做|操作)?|重试|再试一次|往下做|恢复操作)[。！!\s]*$/i;
+const DIRECT_DESKTOP = /(?:操作(?:电脑|桌面|屏幕|窗口|系统|本机)|电脑自动化|桌面自动化|查看(?:当前)?(?:桌面|屏幕|前台窗口)|截(?:取)?(?:当前)?屏|系统设置|控制面板|任务管理器|资源管理器|访达|Finder)/i;
+const GUI_ACTION = /(?:点击|双击|右键|拖拽|滚动|输入|粘贴|按(?:键|快捷键)|切换|激活|关闭|移动|调整窗口|发送|发布|上传)/i;
+const APP_TARGET = /(?:在|用|打开|切换到|进入)[^，。\n]{0,28}(?:应用|软件|客户端|微信|WeChat|钉钉|飞书|Slack|QQ|邮件|Outlook|Word|Excel|PowerPoint|设置|窗口)(?:里|中|上|内|给|向|并|，|。|\s|$)/i;
+const DISCUSSION_ONLY = /(?:解释|介绍|讨论|分析|评审|代码|源码|实现|设计|为什么|是什么|如何实现|测试.*ComputerUse|ComputerUse.*测试)/i;
+const DIRECT_TOOL_TASK = /(?:读取|分析|查看|理解).{0,12}(?:图片|照片|截图文件|PDF|文件|附件)|(?:搜索|修改|编写|重构|构建|运行测试|查找).{0,12}(?:代码|文件|网页)|(?:搜索网页|打开网址|访问网站|网页中)/i;
+
+/**
+ * Conservative, deterministic exposure classifier. It only consumes the
+ * current human input and a short-lived record of a real prior ComputerUse
+ * call; model output, page content, and tool arguments can never enable it.
+ */
+export function classifyComputerAutomationIntent(
+  input: string,
+  continuation?: ComputerAutomationContinuationState,
+  now = Date.now(),
+): ComputerAutomationIntent {
+  const text = input.trim();
+  if (
+    continuation
+    && now - continuation.lastUsedAt <= CONTINUATION_WINDOW_MS
+    && CONTINUATION_ONLY.test(text)
+  ) {
+    return { needed: true, source: 'continuation', reason: '继续最近一次桌面自动化任务' };
+  }
+  if (!text) return { needed: false, source: 'none', reason: '没有桌面操作请求' };
+  if (DIRECT_TOOL_TASK.test(text) && !DIRECT_DESKTOP.test(text)) {
+    return { needed: false, source: 'none', reason: '专用文件、图片或 Web 工具可直接完成' };
+  }
+  if (DISCUSSION_ONLY.test(text) && !DIRECT_DESKTOP.test(text) && !GUI_ACTION.test(text)) {
+    return { needed: false, source: 'none', reason: '仅讨论桌面能力，没有要求实际操作' };
+  }
+  if (DIRECT_DESKTOP.test(text) || (GUI_ACTION.test(text) && APP_TARGET.test(text))) {
+    return { needed: true, source: 'explicit-current', reason: '用户明确要求操作原生桌面界面' };
+  }
+  return { needed: false, source: 'none', reason: '未发现明确的原生桌面操作意图' };
+}

package/src/tools/computeruse/telemetryLog.js

@@ -28,6 +28,9 @@ import { CONSECUTIVE_FAILURE_LIMIT, readRecords, record, renderReport, summarize
 function logPath() {
     return join(computerUseStateDir(), 'telemetry.jsonl');
 }
+function exposureLogPath() {
+    return join(computerUseStateDir(), 'exposure.jsonl');
+}
 /**
  * 记一条调用元数据。
  *
@@ -42,6 +45,15 @@ export async function recordComputerUseCall(raw) {
         /* 观测失败不影响功能 */
     }
 }
+/** Records only the boolean exposure decision and a bounded enum source. */
+export async function recordComputerUseExposure(exposed, intentSource) {
+    try {
+        await record(exposureLogPath(), { exposed, intentSource });
+    }
+    catch {
+        /* observability must never affect a turn */
+    }
+}
 export { CONSECUTIVE_FAILURE_LIMIT };
 /**
  * 人类可读的遥测汇总，给 CLI/诊断用。

package/src/tools/computeruse/telemetryLog.ts

@@ -38,6 +38,10 @@ function logPath(): string {
   return join(computerUseStateDir(), 'telemetry.jsonl');
 }
 
+function exposureLogPath(): string {
+  return join(computerUseStateDir(), 'exposure.jsonl');
+}
+
 /**
  * 记一条调用元数据。
  *
@@ -52,6 +56,18 @@ export async function recordComputerUseCall(raw: Record<string, unknown>): Promi
   }
 }
 
+/** Records only the boolean exposure decision and a bounded enum source. */
+export async function recordComputerUseExposure(
+  exposed: boolean,
+  intentSource: 'explicit-current' | 'continuation' | 'none',
+): Promise<void> {
+  try {
+    await record(exposureLogPath(), { exposed, intentSource });
+  } catch {
+    /* observability must never affect a turn */
+  }
+}
+
 export { CONSECUTIVE_FAILURE_LIMIT };
 
 /**

package/src/tools/computeruse/vision/telemetry.js

@@ -30,6 +30,7 @@ const ALLOWED_FIELDS = new Set([
     'changeRatio', 'settled', 'stableMs', 'settleConfidence', 'focusChange',
     'settleMode', 'interrupted', 'refused', 'ok',
     'frames', 'axNodes', 'axTruncated',
+    'exposed', 'intentSource',
     // 不可逆动作审批的结局（短枚举，如 irreversible_approved / irreversible_denied）。
     //
     // 刻意**不**复用 `refused`：那个字段参与连续失败计数，而「用户不批准这次

package/src/tools/computeruse/vision/telemetry.ts

@@ -33,6 +33,7 @@ const ALLOWED_FIELDS = new Set([
   'changeRatio', 'settled', 'stableMs', 'settleConfidence', 'focusChange',
   'settleMode', 'interrupted', 'refused', 'ok',
   'frames', 'axNodes', 'axTruncated',
+  'exposed', 'intentSource',
   // 不可逆动作审批的结局（短枚举，如 irreversible_approved / irreversible_denied）。
   //
   // 刻意**不**复用 `refused`：那个字段参与连续失败计数，而「用户不批准这次

package/src/tools/effectiveToolSet.js

@@ -29,9 +29,13 @@ export function createEffectiveToolSet(input) {
         input.runtime.cwd,
         input.runtime.surface,
         input.runtime.profile,
+        input.runtime.conversationMode ?? 'private',
         input.runtime.memoryAccess,
         input.runtime.browser?.supervised === true ? 'supervised-browser' : 'no-browser',
         input.runtime.computer ? 'computer' : 'no-computer',
+        input.runtime.computerIntent?.needed === true
+            ? `computer-intent:${input.runtime.computerIntent.source}`
+            : 'no-computer-intent',
         input.availableTools.map(identity).join(','),
         availability.join(','),
         input.allowedNames?.join(',') ?? '*',

package/src/tools/effectiveToolSet.ts

@@ -46,9 +46,13 @@ export function createEffectiveToolSet(input: {
     input.runtime.cwd,
     input.runtime.surface,
     input.runtime.profile,
+    input.runtime.conversationMode ?? 'private',
     input.runtime.memoryAccess,
     input.runtime.browser?.supervised === true ? 'supervised-browser' : 'no-browser',
     input.runtime.computer ? 'computer' : 'no-computer',
+    input.runtime.computerIntent?.needed === true
+      ? `computer-intent:${input.runtime.computerIntent.source}`
+      : 'no-computer-intent',
     input.availableTools.map(identity).join(','),
     availability.join(','),
     input.allowedNames?.join(',') ?? '*',

package/src/tools/index.js

@@ -13,10 +13,13 @@
  * ============================================================
  */
 import { advisorTool } from './advisor/advisor.js';
+import { advisorDecisionTool } from './advisor/advisorDecision.js';
+import { applyPatchTool } from './applypatch/applyPatch.js';
 // ⚠️ agent.ts 与本模块构成环（tools/index → agent → loop → tools/index）：
 // agent.ts 顶层不求值本模块/loop 的任何导出、loop.ts 的工具 token 估算已懒化，
 // 环在运行时是安全的（详见 agent.ts 文件头「循环依赖纪律」）。
 import { agentTool } from './agent/agent.js';
+import { agentFollowupTool, agentInterruptTool, agentListTool, agentMessageTool, agentWaitTool, } from './agent/agentControl.js';
 import { askUserQuestionTool } from './ask/ask.js';
 import { bashTool } from './bash/bash.js';
 import { assertCapabilityRegistry } from './capabilities.js';
@@ -40,14 +43,17 @@ import { taskCreateTool, taskGetTool, taskListTool, taskUpdateTool, } from './ta
 import { taskOutputTool } from './tasks/taskOutput.js';
 import { taskStopTool } from './tasks/taskStop.js';
 import { terminalCaptureTool } from './terminal/terminalCapture.js';
+import { attachBuiltinPromptGuides } from './toolPromptGuides.js';
 import { trashTool } from './trash/trash.js';
 import { webbrowserTool } from './webbrowser/webbrowser.js';
+import { browserBatchTool } from './webbrowser/browserBatch.js';
+import { browserCdpTool } from './webbrowser/browserCdp.js';
 import { webfetchTool } from './webfetch/webfetch.js';
 import { webSearchTool } from './websearch/websearch.js';
 import { enterWorktreeTool, exitWorktreeTool, } from './worktree/sessionWorktree.js';
 import { writeTool } from './write/write.js';
 /** 所有内置工具（顺序 = 给 LLM 呈现的顺序，不影响代码执行，但会影响模型的优先级直觉） */
-export const ALL_TOOLS = [
+export const ALL_TOOLS = attachBuiltinPromptGuides([
     readTool,
     editTool,
     multiEditTool,
@@ -79,9 +85,15 @@ export const ALL_TOOLS = [
     taskStopTool,
     askUserQuestionTool,
     advisorTool,
+    advisorDecisionTool,
     computerUseTool,
     // 追加在末尾：主循环 tools schema 的原有前缀字节不动（提示词缓存友好）
     agentTool,
+    agentMessageTool,
+    agentListTool,
+    agentWaitTool,
+    agentInterruptTool,
+    agentFollowupTool,
     // Product tools append at the end to preserve the existing schema prefix cache.
     trashTool,
     taskCreateTool,
@@ -93,7 +105,11 @@ export const ALL_TOOLS = [
     exitWorktreeTool,
     terminalCaptureTool,
     snipTool,
-];
+    applyPatchTool,
+    // Browser extensions append after the stable legacy schema prefix.
+    browserBatchTool,
+    browserCdpTool,
+]);
 assertCapabilityRegistry(ALL_TOOLS.map((tool) => tool.name));
 /** 按名字查表 */
 export function getToolByName(name) {
@@ -197,7 +213,10 @@ export { clearPersonaTool, confirmMemoryTool, forgetMemoryTool, listMemoriesTool
 export { multiEditTool } from './edit/multi-edit.js';
 export { genImageTool } from './genimage/genimage.js';
 export { advisorTool } from './advisor/advisor.js';
+export { advisorDecisionTool } from './advisor/advisorDecision.js';
+export { applyPatchTool } from './applypatch/applyPatch.js';
 export { agentTool } from './agent/agent.js';
+export { agentFollowupTool, agentInterruptTool, agentListTool, agentMessageTool, agentWaitTool, } from './agent/agentControl.js';
 export { createGenerateSpeechTool, generateSpeechTool, } from './genspeech/genspeech.js';
 export { createWebSearchTool } from './websearch/websearch.js';
 export { lspTool } from './lsp/lsp.js';

package/src/tools/index.ts

@@ -15,10 +15,19 @@
 
 import type { Tool, ToolCallContext, ToolResult } from '../types.js';
 import { advisorTool } from './advisor/advisor.js';
+import { advisorDecisionTool } from './advisor/advisorDecision.js';
+import { applyPatchTool } from './applypatch/applyPatch.js';
 // ⚠️ agent.ts 与本模块构成环（tools/index → agent → loop → tools/index）：
 // agent.ts 顶层不求值本模块/loop 的任何导出、loop.ts 的工具 token 估算已懒化，
 // 环在运行时是安全的（详见 agent.ts 文件头「循环依赖纪律」）。
 import { agentTool } from './agent/agent.js';
+import {
+  agentFollowupTool,
+  agentInterruptTool,
+  agentListTool,
+  agentMessageTool,
+  agentWaitTool,
+} from './agent/agentControl.js';
 import { askUserQuestionTool } from './ask/ask.js';
 import { bashTool } from './bash/bash.js';
 import { assertCapabilityRegistry } from './capabilities.js';
@@ -58,8 +67,11 @@ import {
 import { taskOutputTool } from './tasks/taskOutput.js';
 import { taskStopTool } from './tasks/taskStop.js';
 import { terminalCaptureTool } from './terminal/terminalCapture.js';
+import { attachBuiltinPromptGuides } from './toolPromptGuides.js';
 import { trashTool } from './trash/trash.js';
 import { webbrowserTool } from './webbrowser/webbrowser.js';
+import { browserBatchTool } from './webbrowser/browserBatch.js';
+import { browserCdpTool } from './webbrowser/browserCdp.js';
 import { webfetchTool } from './webfetch/webfetch.js';
 import { webSearchTool } from './websearch/websearch.js';
 import {
@@ -69,7 +81,7 @@ import {
 import { writeTool } from './write/write.js';
 
 /** 所有内置工具（顺序 = 给 LLM 呈现的顺序，不影响代码执行，但会影响模型的优先级直觉） */
-export const ALL_TOOLS: Tool[] = [
+export const ALL_TOOLS: Tool[] = attachBuiltinPromptGuides([
   readTool,
   editTool,
   multiEditTool,
@@ -101,9 +113,15 @@ export const ALL_TOOLS: Tool[] = [
   taskStopTool,
   askUserQuestionTool,
   advisorTool,
+  advisorDecisionTool,
   computerUseTool,
   // 追加在末尾：主循环 tools schema 的原有前缀字节不动（提示词缓存友好）
   agentTool,
+  agentMessageTool,
+  agentListTool,
+  agentWaitTool,
+  agentInterruptTool,
+  agentFollowupTool,
   // Product tools append at the end to preserve the existing schema prefix cache.
   trashTool,
   taskCreateTool,
@@ -115,7 +133,11 @@ export const ALL_TOOLS: Tool[] = [
   exitWorktreeTool,
   terminalCaptureTool,
   snipTool,
-];
+  applyPatchTool,
+  // Browser extensions append after the stable legacy schema prefix.
+  browserBatchTool,
+  browserCdpTool,
+]);
 
 assertCapabilityRegistry(ALL_TOOLS.map((tool) => tool.name));
 
@@ -263,7 +285,16 @@ export {
 export { multiEditTool } from './edit/multi-edit.js';
 export { genImageTool } from './genimage/genimage.js';
 export { advisorTool } from './advisor/advisor.js';
+export { advisorDecisionTool } from './advisor/advisorDecision.js';
+export { applyPatchTool } from './applypatch/applyPatch.js';
 export { agentTool } from './agent/agent.js';
+export {
+  agentFollowupTool,
+  agentInterruptTool,
+  agentListTool,
+  agentMessageTool,
+  agentWaitTool,
+} from './agent/agentControl.js';
 export {
   createGenerateSpeechTool,
   generateSpeechTool,

package/src/tools/powershell/powershell.js

@@ -191,7 +191,24 @@ async function call(input, signal, context) {
 }
 export const powerShellTool = {
     name: 'PowerShell',
-    description: 'Executes native PowerShell on Windows. Use for Windows-specific administration and scripts; use run_in_background for long builds, tests, or servers, then TaskOutput/TaskStop.',
+    description: `Executes native PowerShell on Windows. Use for Windows-specific administration and scripts; use run_in_background for long builds, tests, or servers, then TaskOutput/TaskStop.
+
+# Safety - two levels, from strict to lenient
+
+## 1. Blocked outright (fails before execution - do NOT retry with variants)
+
+Catastrophic commands (no legitimate use): \`rm -rf /\`-class deletions of root/$HOME/system directories, \`mkfs\`, \`format X:\`, \`dd\` to raw devices, shutdown/reboot, fork bombs, pipe-to-shell from network (\`curl ... | sh\`), \`chmod 777 /\`, full-disk \`del /s\` / \`rmdir /s\`, \`diskpart\`.
+
+Permanent deletion (bypasses the Recycle Bin - use the Trash tool instead): \`Remove-Item\`, \`Clear-RecycleBin\`, \`del\` / \`erase\` / \`rd\` / \`rmdir\` / \`rm\` / \`ri\`, and \`.Delete()\` method calls - all fail before execution.
+To delete files or directories use the **Trash** tool (\`action: "move"\` - recoverable); to clean Git untracked files use Trash with \`action: "git-clean"\`. Do NOT try other deletion spellings - they are blocked the same way. If a permanent deletion is truly required, ask the user to run it themselves.
+
+## 2. Requires user confirmation (irreversible)
+
+These have legitimate uses but destroy the last copy - execution pauses and asks the user to confirm. In non-interactive contexts they are automatically cancelled.
+ - \`git push --force\` / \`-f\` / \`+refspec\`, \`git push --delete <branch>\`
+ - \`git filter-branch\` / \`git filter-repo\`, \`git reflog expire --expire=now\` / \`git gc --prune=now\`
+ - \`shred -u\` / \`shred --remove\`
+ - SQL data destruction: \`DROP DATABASE\`, \`DROP TABLE\`, \`TRUNCATE TABLE\``,
     inputSchema,
     parameters: toToolParameters(inputSchema),
     isReadOnly: false,

package/src/tools/powershell/powershell.ts

@@ -219,8 +219,24 @@ async function call(
 
 export const powerShellTool: Tool<PowerShellInput> = {
   name: 'PowerShell',
-  description:
-    'Executes native PowerShell on Windows. Use for Windows-specific administration and scripts; use run_in_background for long builds, tests, or servers, then TaskOutput/TaskStop.',
+  description: `Executes native PowerShell on Windows. Use for Windows-specific administration and scripts; use run_in_background for long builds, tests, or servers, then TaskOutput/TaskStop.
+
+# Safety - two levels, from strict to lenient
+
+## 1. Blocked outright (fails before execution - do NOT retry with variants)
+
+Catastrophic commands (no legitimate use): \`rm -rf /\`-class deletions of root/$HOME/system directories, \`mkfs\`, \`format X:\`, \`dd\` to raw devices, shutdown/reboot, fork bombs, pipe-to-shell from network (\`curl ... | sh\`), \`chmod 777 /\`, full-disk \`del /s\` / \`rmdir /s\`, \`diskpart\`.
+
+Permanent deletion (bypasses the Recycle Bin - use the Trash tool instead): \`Remove-Item\`, \`Clear-RecycleBin\`, \`del\` / \`erase\` / \`rd\` / \`rmdir\` / \`rm\` / \`ri\`, and \`.Delete()\` method calls - all fail before execution.
+To delete files or directories use the **Trash** tool (\`action: "move"\` - recoverable); to clean Git untracked files use Trash with \`action: "git-clean"\`. Do NOT try other deletion spellings - they are blocked the same way. If a permanent deletion is truly required, ask the user to run it themselves.
+
+## 2. Requires user confirmation (irreversible)
+
+These have legitimate uses but destroy the last copy - execution pauses and asks the user to confirm. In non-interactive contexts they are automatically cancelled.
+ - \`git push --force\` / \`-f\` / \`+refspec\`, \`git push --delete <branch>\`
+ - \`git filter-branch\` / \`git filter-repo\`, \`git reflog expire --expire=now\` / \`git gc --prune=now\`
+ - \`shred -u\` / \`shred --remove\`
+ - SQL data destruction: \`DROP DATABASE\`, \`DROP TABLE\`, \`TRUNCATE TABLE\``,
   inputSchema,
   parameters: toToolParameters(inputSchema),
   isReadOnly: false,