mocode-ai 0.7.0 → 0.7.2

package/dist/agent/index.js

@@ -14,6 +14,7 @@ import { runAgentCore, isMutationTool, } from './core.js';
 import { createPetHooks } from '../pet/state.js';
 import { t } from '../i18n/index.js';
 import { isToolErrorOutput } from '../tools/result.js';
+import { appendCurrentSessionTraceEvent } from '../session/index.js';
 /** 当前 turn 的 batch id(runAgent 内闭包变量;一条 turn 一轮 tool batch 结束即清空)。 */
 let currentBatchId = null;
 /** 取 userInput 的首行:字符串直接 split;多模态 parts 找首个 text part 再 split。 */
@@ -187,6 +188,23 @@ onContextUpdate) {
             flushToolBatch();
             layout.contentWrite(`${ui.dim}${t('agent.aborted')}${ui.reset}\n`);
         },
+        onValidationStart: (command) => {
+            flushToolBatch();
+            spinner.start(t('agent.validating', { command }));
+        },
+        onValidationResult: (validation) => {
+            spinner.stop();
+            const color = validation.status === 'passed'
+                ? ui.green
+                : validation.status === 'failed'
+                    ? ui.red
+                    : ui.yellow;
+            const command = validation.command ?? t('agent.validationNoCommand');
+            const detail = validation.status === 'skipped' && validation.skipReason
+                ? `${validation.status}: ${validation.skipReason}`
+                : validation.status;
+            layout.contentWrite(`  ${color}●${ui.reset} ${t('agent.validationResult', { command, status: detail })}\n`);
+        },
         onDone: (elapsedMs, usage) => {
             flushToolBatch();
             const tok = formatTurnTokens(usage);
@@ -210,6 +228,8 @@ onContextUpdate) {
             signal,
             onContextUpdate,
             hooks: combinedHooks,
+            autoValidate: config.autoValidate,
+            onTraceEvent: appendCurrentSessionTraceEvent,
         });
     }
     finally {

package/dist/agent/spawn.js

@@ -12,7 +12,7 @@
 //  - 中断透传:opts.signal(主 agent 的 abort signal)透传给 runAgentCore → chat/executeTool,
 //    主 Ctrl+C 树杀子 agent(chat 流式 abort + run_command/web_fetch 即时取消)。
 import { chatTools } from '../llm/index.js';
-import { config, isMemoryEnabled } from '../config/index.js';
+import { config, isMemoryEnabled, isSubAgentEnabled } from '../config/index.js';
 import { effectiveSystemPrompt } from '../skills/index.js';
 import { buildMemorySection, buildMemoryIndexSection } from '../memory/index.js';
 import { ui } from '../ui/theme.js';
@@ -40,6 +40,13 @@ You are a sub-agent spawned by the main agent to handle an isolated sub-task. Yo
  * 子 agent 跑在主 signal 下,主 abort 即子 abort;子 agent 的 abortRestore 还原子 history + 模式。
  */
 export async function spawnAgent(opts) {
+    if (!isSubAgentEnabled()) {
+        return {
+            summary: null,
+            completed: false,
+            transcript: 'Sub-agent execution is disabled. Enable it with /subagent on.',
+        };
+    }
     const maxSteps = opts.maxSteps ?? config.subAgentMaxSteps ?? 50;
     // 构造子 agent 系统提示:复用主 agent 组装链 + 子 agent 角色后缀 + 自定义后缀。
     // config.systemPrompt 是 getter(每次访问现拼 buildBasePrompt,反映 isMemoryEnabled),
@@ -124,6 +131,7 @@ export async function spawnAgent(opts) {
         maxSteps,
         toolsOverride,
         contextState: localContextState,
+        autoValidate: false, // 子 Agent 共享主轮工作区，由主 Agent 收尾统一验证
     });
     return {
         summary: result.finalText,

package/dist/config/index.js

@@ -358,6 +358,7 @@ export const config = {
     compactThreshold: Number(process.env.COMPACT_THRESHOLD) || 0.85,
     includeUsage: process.env.LLM_STREAM_USAGE !== 'false',
     autoCompact: process.env.AUTO_COMPACT !== 'false',
+    autoValidate: process.env.MOCODE_AUTO_VALIDATE !== 'false',
     contextOptimize: process.env.MOCODE_CONTEXT_OPTIMIZE !== 'false',
     contextRelprune: process.env.MOCODE_CONTEXT_RELPRUNE !== 'false',
     contextLifecycle: process.env.MOCODE_LIFECYCLE !== 'false',
@@ -366,6 +367,7 @@ export const config = {
     memoryEnabled: process.env.MEMORY_ENABLED === 'true',
     reflectEveryN: Number(process.env.REFLECT_EVERY_N) || 5,
     maxSteps: Number(process.env.MAX_STEPS) || 200,
+    subAgentEnabled: process.env.MOCODE_SUBAGENT_ENABLED === 'true',
     subAgentMaxSteps: Number(process.env.SUB_AGENT_MAX_STEPS) || 50,
     sessionDir: path.join(process.cwd(), '.mocode', 'sessions'),
     searchApiKey: process.env.ANYSEARCH_API_KEY,
@@ -379,6 +381,7 @@ export const config = {
     llmKeysFromShell,
     projectSnapshotEnabled: process.env.MOCODE_PROJECT_SNAPSHOT !== 'false',
     permissionEnabled: process.env.MOCODE_PERMISSION !== 'false',
+    permissionNonInteractiveAllow: process.env.MOCODE_PERMISSION_NON_INTERACTIVE_ALLOW === 'true',
     projectSkillEnabled: process.env.MOCODE_PROJECT_SKILL === 'true',
 };
 /**
@@ -407,6 +410,15 @@ export function updateModelConfig(opts) {
         process.env.CONTEXT_WINDOW_TOKENS = String(opts.contextWindowTokens);
     }
 }
+/** 子 Agent 总开关；默认 false，关闭时 task 不进入模型工具表。 */
+export function isSubAgentEnabled() {
+    return config.subAgentEnabled;
+}
+/** 运行时切换子 Agent；工具 schema 刷新与持久化由 REPL 调用方完成。 */
+export function updateSubAgentConfig(enabled) {
+    config.subAgentEnabled = enabled;
+    process.env.MOCODE_SUBAGENT_ENABLED = enabled ? 'true' : 'false';
+}
 /**
  * 记忆子系统总开关:单一来源。/memory_switch、/memory_status、buildSystemPrompt、
  * tools/builtins/index.ts、tools/constants.ts 的 plan-mode 列表都从这里查。

package/dist/i18n/index.js

@@ -19,6 +19,10 @@ const zhCN = {
     'commands.memoryStatus': '查看当前开关与原理',
     'commands.memoryReflect': '手动触发后台记忆反思',
     'commands.memoryInit': '扫描项目生成 MOCODE.md 项目记忆',
+    'commands.subagent': '子 Agent 开关（默认关闭）',
+    'commands.subagentOn': '开启子 Agent',
+    'commands.subagentOff': '关闭子 Agent',
+    'commands.subagentStatus': '查看子 Agent 状态',
     'commands.skill': '项目专属 Skill 管理',
     'commands.toggle': '切换开关',
     'commands.skillOn': '开启项目 Skill',
@@ -84,6 +88,7 @@ const zhCN = {
     'running.memory': '切记忆开关',
     'running.switching': '切换中…',
     'running.memoryStatus': '查记忆状态',
+    'running.subagent': '子 Agent',
     'running.skill': '项目 Skill',
     'running.language': '切语言',
     'running.chooseLanguage': '选择语言…',
@@ -160,6 +165,9 @@ const zhCN = {
     'agent.noReply': '(无回复)',
     'agent.maxSteps': '达到最大步数({count})，本轮停止。',
     'agent.aborted': '(已中断)',
+    'agent.validating': '自动验证 {command}',
+    'agent.validationNoCommand': '未发现验证命令',
+    'agent.validationResult': '自动验证 {command} → {status}',
     'agent.workedFor': '耗时 {elapsed}',
     'toolSummary.lines': '{count} 行',
     'toolSummary.files': '{count} 个文件',
@@ -191,13 +199,22 @@ const zhCN = {
     'permission.deny': '拒绝',
     'permission.allow': '允许',
     'permission.allowSession': '本次会话始终允许此工具',
+    'permission.allowSessionResource': '本次会话允许相同命令/资源',
+    'permission.allowProjectResource': '对此项目永久允许相同命令/资源',
     'askHuman.cancelled': '用户取消了选择。请考虑是否有不依赖用户输入的替代方案，或换个角度重新提问。',
     'askHuman.submitted': '用户回答:{value}',
     'askHuman.selected': '用户选择:{value}',
     'task.missingPrompt': '错误:缺少 prompt（子任务指令）。',
+    'task.disabled': '错误:子 Agent 当前已关闭。需要时请先运行 /subagent on。',
     'task.interrupted': '子 agent 被中断，未完成。',
     'task.noSummary': '子 agent 完成但未返回文本摘要（可能只调了工具或达到步数上限）。',
     'task.summaryTruncated': '…（子 agent 摘要已截断 {count} 字符）',
+    'subagent.status': '子 Agent：{state}',
+    'subagent.stateOn': '开启',
+    'subagent.stateOff': '关闭',
+    'subagent.changedOn': '已开启子 Agent；task 将从下一次模型请求起可用。',
+    'subagent.changedOff': '已关闭子 Agent；task 已从模型工具表移除。',
+    'subagent.usage': '用法：/subagent on|off|status',
     'plan.ready': '计划已就绪',
     'plan.approvalDetail': '切换到 auto 模式按上述计划执行？（plan 模式只读探查，执行需切 auto）',
     'plan.execute': '切 auto 执行',
@@ -228,6 +245,10 @@ const en = {
     'commands.memoryStatus': 'Show current state and behavior',
     'commands.memoryReflect': 'Run background memory reflection',
     'commands.memoryInit': 'Scan project and generate MOCODE.md',
+    'commands.subagent': 'Sub-agent controls (disabled by default)',
+    'commands.subagentOn': 'Enable sub-agents',
+    'commands.subagentOff': 'Disable sub-agents',
+    'commands.subagentStatus': 'Show sub-agent status',
     'commands.skill': 'Manage the project-specific Skill',
     'commands.toggle': 'Toggle the feature',
     'commands.skillOn': 'Enable the project Skill',
@@ -293,6 +314,7 @@ const en = {
     'running.memory': 'Memory',
     'running.switching': 'Switching…',
     'running.memoryStatus': 'Memory status',
+    'running.subagent': 'Sub-agent',
     'running.skill': 'Project Skill',
     'running.language': 'Language',
     'running.chooseLanguage': 'Choose a language…',
@@ -369,6 +391,9 @@ const en = {
     'agent.noReply': '(no reply)',
     'agent.maxSteps': 'Maximum steps reached ({count}); this turn has stopped.',
     'agent.aborted': '(aborted)',
+    'agent.validating': 'Validating {command}',
+    'agent.validationNoCommand': 'no validation command',
+    'agent.validationResult': 'Automatic validation {command} → {status}',
     'agent.workedFor': 'Worked for {elapsed}',
     'toolSummary.lines': '{count} lines',
     'toolSummary.files': '{count} files',
@@ -400,13 +425,22 @@ const en = {
     'permission.deny': 'Deny',
     'permission.allow': 'Allow',
     'permission.allowSession': 'Always allow this tool for this session',
+    'permission.allowSessionResource': 'Allow this command/resource for this session',
+    'permission.allowProjectResource': 'Always allow this command/resource for this project',
     'askHuman.cancelled': 'The user cancelled the choice. Consider an alternative that does not require user input, or ask from a different angle.',
     'askHuman.submitted': 'User response: {value}',
     'askHuman.selected': 'User selected: {value}',
     'task.missingPrompt': 'Error: missing prompt (sub-task instruction).',
+    'task.disabled': 'Error: sub-agents are disabled. Run /subagent on first if needed.',
     'task.interrupted': 'The sub-agent was interrupted before completion.',
     'task.noSummary': 'The sub-agent completed without a text summary (it may only have used tools or reached its step limit).',
     'task.summaryTruncated': '…(sub-agent summary truncated by {count} characters)',
+    'subagent.status': 'Sub-agent: {state}',
+    'subagent.stateOn': 'enabled',
+    'subagent.stateOff': 'disabled',
+    'subagent.changedOn': 'Sub-agents enabled; task will be available from the next model request.',
+    'subagent.changedOff': 'Sub-agents disabled; task has been removed from the model tool list.',
+    'subagent.usage': 'Usage: /subagent on|off|status',
     'plan.ready': 'Plan ready',
     'plan.approvalDetail': 'Switch to auto mode and execute the plan above? (Plan mode is read-only; execution requires auto mode.)',
     'plan.execute': 'Switch to auto and execute',

package/dist/llm/index.js

@@ -1,5 +1,5 @@
 import OpenAI from 'openai';
-import { config } from '../config/index.js';
+import { config, isSubAgentEnabled } from '../config/index.js';
 import { tools } from '../tools/registry.js';
 import { getPlanDisabledTools } from '../tools/constants.js';
 import { ThinkTagFilter } from './think-filter.js';
@@ -149,7 +149,11 @@ export function __setChatCreateImpl(impl) {
 export const chatTools = [];
 export const planChatTools = [];
 export function refreshChatTools() {
-    const next = tools.map((t) => ({
+    // task 常驻内部 registry，运行时开关只控制模型可见 schema，因而 on/off 可即时生效。
+    const visibleTools = isSubAgentEnabled()
+        ? tools
+        : tools.filter((tool) => tool.name !== 'task');
+    const next = visibleTools.map((t) => ({
         type: 'function',
         function: {
             name: t.name,
@@ -225,6 +229,14 @@ function firstNumber(arr) {
     }
     return undefined;
 }
+function retryErrorCode(error) {
+    if (!error || typeof error !== 'object')
+        return 'RETRYABLE_ERROR';
+    const value = error;
+    if (typeof value.status === 'number')
+        return `HTTP_${value.status}`;
+    return value.code ?? value.name ?? 'RETRYABLE_ERROR';
+}
 /**
  * 流式调一次 LLM:增量回调文本,内部累加 tool_calls 片段。
  * tool_calls 跨 chunk 按 index 累加(id / name / arguments 拼接)。
@@ -250,6 +262,12 @@ toolsOverride) {
                 throw err;
             }
             const wait = computeBackoff(attempt, getRetryAfterMs(err));
+            handlers.onRetry?.({
+                attempt,
+                nextAttempt: attempt + 1,
+                waitMs: wait,
+                code: retryErrorCode(err),
+            });
             logRetry(attempt, err, wait);
             // sleep 自己会在 signal abort 时抛 AbortError——透传,让 runAgentCore 的 catch 按中断处理。
             await sleep(wait, signal);

package/dist/mcp/index.js

@@ -41,9 +41,22 @@ export function getMcpTools() {
                 parameters: remote.inputSchema && typeof remote.inputSchema === 'object'
                     ? remote.inputSchema
                     : { type: 'object', properties: {} },
-                // 远程/本地 server 均可能读写系统或网络；协议没有副作用声明，必须保守处理。
+                // MCP 协议没有可靠副作用声明：未知能力、workspace 串行、每次确认。
                 risk: 'dangerous',
-                execute: async (args, ctx) => formatToolResult(await client.callTool(remote.name, args, ctx?.signal)),
+                capabilities: {
+                    effect: 'unknown',
+                    concurrency: 'serial',
+                    retry: 'never',
+                    resources: () => ['workspace'],
+                    supportsAbort: true,
+                },
+                execute: async (args, ctx) => {
+                    const result = await client.callTool(remote.name, args, ctx?.signal);
+                    const output = formatToolResult(result);
+                    return result.isError
+                        ? { status: 'error', code: 'MCP_ERROR', retryable: false, output }
+                        : { status: 'success', code: 'OK', retryable: false, output };
+                },
             });
         }
     }

package/dist/permissions/index.js

@@ -1,142 +1,198 @@
+import crypto from 'node:crypto';
 import fs from 'node:fs';
 import os from 'node:os';
 import path from 'node:path';
 import { promptIntervention } from '../ui/intervention.js';
 import { config } from '../config/index.js';
+import { getSandboxRoot } from '../sandbox/index.js';
 import { t } from '../i18n/index.js';
-/**
- * 工具权限系统:基于 risk 字段在执行前拦截确认。
- *
- * 设计:
- *  - safe      → 直接放行(只读工具,零交互)
- *  - confirm   → 弹面板确认,同工具同会话缓存(避免重复打断)
- *  - dangerous → 每次都弹(高风险,命令内容不可预测)
- *
- * 三层允许(优先级从高到低):
- *  1. 永久允许(permanentAllow,跨会话持久化到 ~/.mocode/permissions.json)
- *  2. 会话允许(approvedTools,本次进程内缓存)
- *  3. 面板询问(promptIntervention,复用 ask_human UI)
- *
- * 复用 promptIntervention:统一 UI 面板,非 TTY 自动降级(第一项 = 允许)。
- */
-/** 跨会话持久化允许列表路径 */
 const PERMISSIONS_PATH = path.join(os.homedir(), '.mocode', 'permissions.json');
-/** 永久允许:跨会话持久化(用户选了"以后不再询问此工具") */
-let permanentAllow = new Set();
+const PERMISSIONS_VERSION = 3;
+let permanentGrants = [];
+let permanentToolAllows = new Set();
 let permanentLoaded = false;
-/** 会话级缓存:confirm 级工具批准后,后续调用不再弹 */
-const approvedTools = new Set();
-/** 从磁盘加载永久允许列表(首调时触发,之后用内存缓存;文件不存在/解析失败返空集合) */
+const sessionGrants = [];
+function stable(value) {
+    if (Array.isArray(value))
+        return value.map(stable);
+    if (value && typeof value === 'object') {
+        return Object.fromEntries(Object.entries(value)
+            .sort(([a], [b]) => a.localeCompare(b))
+            .map(([key, item]) => [key, stable(item)]));
+    }
+    return value;
+}
+function canonicalProjectRoot(root) {
+    const resolved = path.resolve(root);
+    return process.platform === 'win32' ? resolved.toLowerCase() : resolved;
+}
+/** A grant is bound to the actual command or logical resources, never merely a tool name. */
+export function permissionFingerprint(tool, args) {
+    let subject;
+    if (tool.name === 'run_command' && typeof args.command === 'string') {
+        subject = { command: args.command.trim() };
+    }
+    else {
+        const resources = tool.capabilities?.resources?.(args).filter(Boolean).sort();
+        // File mutations may be granted by their concrete resource. Coarse resources such as
+        // "workspace" must retain arguments so task/process-like calls cannot become tool-wide.
+        subject = resources?.length && typeof args.path === 'string'
+            ? { resources }
+            : stable(args);
+    }
+    return crypto.createHash('sha256').update(JSON.stringify(subject)).digest('hex');
+}
+function validGrant(value) {
+    if (!value || typeof value !== 'object')
+        return false;
+    const grant = value;
+    return typeof grant.tool === 'string'
+        && typeof grant.fingerprint === 'string'
+        && grant.fingerprint.length > 0
+        && (grant.scope === 'project' || grant.scope === 'session' || grant.scope === 'once');
+}
 function loadPermanent() {
     if (permanentLoaded)
-        return permanentAllow;
+        return permanentGrants;
     permanentLoaded = true;
     try {
-        const raw = fs.readFileSync(PERMISSIONS_PATH, 'utf8');
-        const parsed = JSON.parse(raw);
-        if (parsed && Array.isArray(parsed.allowForever)) {
-            permanentAllow = new Set(parsed.allowForever.filter((x) => typeof x === 'string'));
-        }
+        const parsed = JSON.parse(fs.readFileSync(PERMISSIONS_PATH, 'utf8'));
+        permanentGrants = Array.isArray(parsed.grants)
+            ? parsed.grants.filter(validGrant).filter((grant) => grant.scope === 'project')
+            : [];
+        // Only the explicit v3 field enables broad grants. The retired legacy allowForever
+        // field remains ignored so upgrades cannot silently restore old authorization.
+        permanentToolAllows = parsed.version === PERMISSIONS_VERSION && Array.isArray(parsed.alwaysAllowTools)
+            ? new Set(parsed.alwaysAllowTools.filter((tool) => typeof tool === 'string' && tool.length > 0))
+            : new Set();
     }
     catch {
-        // 文件不存在 / 解析失败 → 空集合(不阻断,用户首次使用或配置损坏均安全降级)
+        permanentGrants = [];
+        permanentToolAllows = new Set();
     }
-    return permanentAllow;
+    return permanentGrants;
 }
-/** 写入永久允许列表(覆盖写;失败静默,下次启动丢失但不阻断当前会话) */
 function savePermanent() {
     try {
         fs.mkdirSync(path.dirname(PERMISSIONS_PATH), { recursive: true });
-        fs.writeFileSync(PERMISSIONS_PATH, JSON.stringify({ allowForever: Array.from(permanentAllow) }, null, 2) + '\n', 'utf8');
+        const data = {
+            version: PERMISSIONS_VERSION,
+            grants: permanentGrants,
+            alwaysAllowTools: [...permanentToolAllows].sort(),
+        };
+        fs.writeFileSync(PERMISSIONS_PATH, `${JSON.stringify(data, null, 2)}\n`, 'utf8');
     }
     catch {
-        // 写失败静默(与 updateConfigKey 一致:UI 偏好路径,不阻断 REPL)
+        // A failed persistence write must never turn into broader authorization.
     }
 }
-/** 从 Tool 解析 risk,缺省返 'safe'(只读工具无需标注)。 */
 export function getToolRisk(tool) {
     return tool.risk ?? 'safe';
 }
-/** 参数摘要:提取关键参数供确认面板展示(path / command 等)。 */
-function summarizeArgs(tool, args) {
+function summarizeArgs(args) {
     const lines = [];
     if (typeof args.path === 'string')
         lines.push(t('permission.path', { value: args.path }));
     if (typeof args.command === 'string')
         lines.push(t('permission.command', { value: args.command }));
     if (typeof args.prompt === 'string') {
-        const preview = String(args.prompt).slice(0, 100);
-        lines.push(t('permission.task', { value: `${preview}${String(args.prompt).length > 100 ? '…' : ''}` }));
+        const preview = args.prompt.slice(0, 100);
+        lines.push(t('permission.task', { value: `${preview}${args.prompt.length > 100 ? '…' : ''}` }));
     }
-    return lines.length > 0 ? lines.join('\n') : t('permission.noArgs');
-}
-/**
- * 检查权限:safe 直接放行;confirm/dangerous 弹面板让用户确认。
- *
- * 返回 'allow' = 放行, 'deny' = 拒绝(不执行,也不记回滚快照)。
- * 非 TTY 环境(promptIntervention 内部处理):自动选第一项(允许)并打 stderr 日志,不阻塞。
- */
-export async function checkPermission(tool, args, signal) {
-    // 总开关关闭 → 全部放行(零行为变化,向后兼容)
-    if (!config.permissionEnabled)
+    return lines.length ? lines.join('\n') : t('permission.noArgs');
+}
+function matches(grant, tool, fingerprint, projectRoot) {
+    return grant.tool === tool
+        && grant.fingerprint === fingerprint
+        && (grant.scope !== 'project' || grant.projectRoot === projectRoot);
+}
+export async function checkPermission(tool, args, signal, options = {}) {
+    if (!config.permissionEnabled || getToolRisk(tool) === 'safe')
         return 'allow';
-    const risk = getToolRisk(tool);
-    if (risk === 'safe')
+    if (signal?.aborted)
+        return 'deny';
+    loadPermanent();
+    if (permanentToolAllows.has(tool.name))
         return 'allow';
-    // 永久允许(跨会话):命中则放行,不弹面板
-    if (loadPermanent().has(tool.name))
+    const fingerprint = permissionFingerprint(tool, args);
+    const projectRoot = canonicalProjectRoot(options.projectRoot ?? getSandboxRoot() ?? process.cwd());
+    if (sessionGrants.some((grant) => matches(grant, tool.name, fingerprint, projectRoot)))
         return 'allow';
-    // 会话允许(confirm 级):同进程内缓存,命中则放行
-    if (risk === 'confirm' && approvedTools.has(tool.name))
+    if (permanentGrants.some((grant) => matches(grant, tool.name, fingerprint, projectRoot)))
         return 'allow';
-    // 构建确认面板
-    const isDangerous = risk === 'dangerous';
+    // CI/pipes must fail closed. Operators can deliberately restore unattended behavior.
+    if (!process.stdin.isTTY && !config.permissionNonInteractiveAllow && !options.prompt)
+        return 'deny';
+    if (signal?.aborted)
+        return 'deny';
+    const onceOption = t('permission.allow');
+    const sessionOption = t('permission.allowSessionResource');
+    const projectOption = t('permission.allowProjectResource');
+    const alwaysOption = t('permission.allowForever');
     const denyOption = t('permission.deny');
-    const foreverOption = t('permission.allowForever');
-    const sessionOption = t('permission.allowSession');
-    const title = isDangerous
-        ? t('permission.dangerTitle', { tool: tool.name })
-        : t('permission.confirmTitle', { tool: tool.name });
-    const detail = summarizeArgs(tool, args) + (isDangerous ? `\n\n${t('permission.dangerWarning')}` : '');
-    // 选项统一结构:dangerous 也提供"以后不再询问"(用户明确授权即尊重,即使 run_command)
-    const options = isDangerous
-        ? [t('permission.confirmExecute'), foreverOption, denyOption]
-        : [t('permission.allow'), sessionOption, foreverOption, denyOption];
-    // 弹面板(阻塞直到用户选择;signal 中断时 promptIntervention 内部处理)
-    const result = await promptIntervention({
+    const dangerous = getToolRisk(tool) === 'dangerous';
+    const choices = [onceOption, sessionOption, projectOption, alwaysOption, denyOption];
+    const result = await (options.prompt ?? promptIntervention)({
         type: 'choice',
-        title,
-        detail,
-        options,
+        title: dangerous
+            ? t('permission.dangerTitle', { tool: tool.name })
+            : t('permission.confirmTitle', { tool: tool.name }),
+        detail: summarizeArgs(args) + (dangerous ? `\n\n${t('permission.dangerWarning')}` : ''),
+        options: choices,
         allowCustom: false,
     });
-    // 用户取消(Esc / Ctrl+C)→ 拒绝
-    if (result.action === 'cancelled')
-        return 'deny';
-    // 解析选择
-    const value = result.value ?? '';
-    if (value === denyOption)
+    if (signal?.aborted || result.action === 'cancelled' || result.value === denyOption)
         return 'deny';
-    // 永久允许:写入磁盘 + 加入内存集合(跨会话生效)
-    if (value === foreverOption) {
-        permanentAllow.add(tool.name);
-        savePermanent();
-        return 'allow';
+    if (result.value === sessionOption) {
+        sessionGrants.push({ tool: tool.name, fingerprint, scope: 'session' });
     }
-    // 会话允许(confirm 级):加入内存缓存,本次进程内不再弹
-    if (!isDangerous && value === sessionOption) {
-        approvedTools.add(tool.name);
+    else if (result.value === projectOption) {
+        const grant = { tool: tool.name, fingerprint, scope: 'project', projectRoot };
+        permanentGrants = permanentGrants.filter((item) => !matches(item, tool.name, fingerprint, projectRoot));
+        permanentGrants.push(grant);
+        if (options.persistProjectGrant !== false)
+            savePermanent();
+    }
+    else if (result.value === alwaysOption) {
+        permanentToolAllows.add(tool.name);
+        if (options.persistProjectGrant !== false)
+            savePermanent();
     }
     return 'allow';
 }
-/** 移除工具的永久允许(撤销"以后不再询问"授权)。供未来 `/permissions` 管理命令使用。 */
-export function revokePermanentAllow(toolName) {
-    if (permanentAllow.has(toolName)) {
-        permanentAllow.delete(toolName);
-        savePermanent();
-    }
+export function revokePermanentAllow(toolName, fingerprint) {
+    loadPermanent();
+    permanentGrants = permanentGrants.filter((grant) => grant.tool !== toolName || (fingerprint !== undefined && grant.fingerprint !== fingerprint));
+    if (fingerprint === undefined)
+        permanentToolAllows.delete(toolName);
+    savePermanent();
+}
+export function revokePermanentToolAllow(toolName) {
+    loadPermanent();
+    permanentToolAllows.delete(toolName);
+    savePermanent();
 }
-/** 列出所有永久允许的工具名(供未来 `/permissions` 管理命令使用)。 */
+export function listPermanentGrants() {
+    return loadPermanent().map((grant) => ({ ...grant }));
+}
+export function listPermanentToolAllows() {
+    loadPermanent();
+    return [...permanentToolAllows].sort();
+}
+/** Compatibility API: returns tools having any persistent resource or tool-wide grant. */
 export function listPermanentAllow() {
-    return Array.from(loadPermanent());
+    loadPermanent();
+    return [...new Set([
+            ...permanentGrants.map((grant) => grant.tool),
+            ...permanentToolAllows,
+        ])].sort();
+}
+export function clearSessionPermissionGrants() {
+    sessionGrants.length = 0;
+}
+export function resetPermissionGrantsForTests() {
+    sessionGrants.length = 0;
+    permanentGrants = [];
+    permanentToolAllows = new Set();
+    permanentLoaded = true;
 }