newmark-agent 0.4.0 → 0.4.2

package/dist/conversation-utility-host.bundle.cjs

@@ -327541,6 +327541,7 @@ var NATIVE_TOOL_CATALOG = [
   { name: "read", label: "Read file", description: "Read workspace file contents.", category: "core", defaultEnabled: true, protected: true, availability: "required" },
   { name: "write", label: "Write file", description: "Create or overwrite workspace files.", category: "core", defaultEnabled: true },
   { name: "edit", label: "Edit file", description: "Patch workspace files through exact find and replace.", category: "core", defaultEnabled: true },
+  { name: "delete_file", label: "Delete file", description: "Delete one file at a time under Agent supervision; refuses directory and wildcard deletion.", category: "core", defaultEnabled: true },
   { name: "glob", label: "Glob files", description: "Find files by glob pattern.", category: "core", defaultEnabled: true, protected: true, availability: "required" },
   { name: "grep", label: "Search files", description: "Search workspace text by regex.", category: "core", defaultEnabled: true, protected: true, availability: "required" },
   { name: "web_search", label: "Web search", description: "Search the web from the Agent.", category: "web", defaultEnabled: true },
@@ -335289,6 +335290,91 @@ function planModePolicyPrompt() {
     "Runtime policy rejects stale or hidden mutating tool calls even if a prompt asks for them."
   ].join(" ");
 }
+var DELETE_VERB_SOURCE = "(?:remove-item|rmdir|unlink|erase|del|rm|rd|ri)";
+var DELETE_VERB_BOUNDARY = new RegExp(`(?:^|[\\s;&|()\\n])${DELETE_VERB_SOURCE}(?:\\s|$)`, "i");
+function hasDeletionVerb(text) {
+  return DELETE_VERB_BOUNDARY.test(text);
+}
+function deletionVerbCount(text) {
+  const matches = text.match(new RegExp(DELETE_VERB_BOUNDARY.source, "gi"));
+  return matches ? matches.length : 0;
+}
+function hasLoopDeletion(text) {
+  const lower = text.toLowerCase();
+  if (/\bforeach\b/.test(lower)) return true;
+  if (/\bfor\b\s*[$({]/.test(lower)) return true;
+  if (/\bfor\b\s+\S+\s+in\b/.test(lower)) return true;
+  if (/\bwhile\b\s*[({]/.test(lower)) return true;
+  if (/\bwhile\b\s+\S/.test(lower) && /\bdo\b/.test(lower)) return true;
+  if (/\bdone\b/.test(lower)) return true;
+  return false;
+}
+function hasFindXargsDeletion(text) {
+  if (/\bfind\b[^\n;&|]*-(?:delete\b|exec(?:dir)?\s+(?:rm|del|erase)\b)/i.test(text)) return true;
+  if (/\bxargs\b[^\n;&|]*\b(?:rm|del|erase|remove-item)\b/i.test(text)) return true;
+  return false;
+}
+function splitCommandArgs(args) {
+  const tokens = [];
+  const re = /"([^"]*)"|'([^']*)'|(\S+)/g;
+  let m2;
+  while ((m2 = re.exec(args)) !== null) {
+    const token = m2[1] ?? m2[2] ?? m2[3] ?? "";
+    if (token) tokens.push(token);
+  }
+  return tokens;
+}
+function hasPipeDeletion(text) {
+  return new RegExp(`\\|\\s*${DELETE_VERB_SOURCE}\\b`, "i").test(text);
+}
+function hasRecursiveDeletionFlag(text) {
+  const lower = text.toLowerCase();
+  if (/\brm\b\s+(-[a-z]*r[a-z]*|--recursive)\b/.test(lower)) return true;
+  if (/\bremove-item\b[^\n;&|]*\s+-(?:recurse|r)\b/.test(lower)) return true;
+  if (/\b(?:rmdir|rd)\b\s+(-r\b|\/[s]\b)/.test(lower)) return true;
+  if (/\bdel\b\s+\/[s]\b/.test(lower)) return true;
+  return false;
+}
+function hasWildcardDeletionTarget(text) {
+  const segmentRe = new RegExp(`(?:^|[\\s;&|()\\n])${DELETE_VERB_SOURCE}([\\s][^;&|\\n]*)?`, "gi");
+  let m2;
+  while ((m2 = segmentRe.exec(text)) !== null) {
+    const args = m2[1] || "";
+    for (const token of splitCommandArgs(args)) {
+      if (!token || token.startsWith("-") || /^\/[A-Za-z]/.test(token)) continue;
+      if (/[*?]/.test(token)) return true;
+    }
+  }
+  return false;
+}
+function hasMultipleDeleteTargets(text) {
+  const segmentRe = new RegExp(`(?:^|[\\s;&|()\\n])${DELETE_VERB_SOURCE}([\\s][^;&|\\n]*)?`, "gi");
+  let m2;
+  while ((m2 = segmentRe.exec(text)) !== null) {
+    const args = m2[1] || "";
+    const targets = splitCommandArgs(args).filter((t3) => t3 && !t3.startsWith("-") && !/^\/[A-Za-z]/.test(t3) && !/^(&&|\|\||;|\||&|>|>>|<|2>&1)$/.test(t3));
+    if (targets.length >= 2) return true;
+  }
+  return false;
+}
+function evaluateDeletionGuard(command) {
+  const text = String(command || "");
+  if (!text.trim()) return { blocked: false };
+  const findXargs = hasFindXargsDeletion(text);
+  if (!hasDeletionVerb(text) && !findXargs) return { blocked: false };
+  const refuse = (kind) => ({
+    blocked: true,
+    reason: `[deletion guard] ${kind} batch deletion is not allowed. Delete files one by one with the delete_file tool under Agent supervision.`
+  });
+  if (hasLoopDeletion(text)) return refuse("Loop-based");
+  if (findXargs) return refuse("find/xargs");
+  if (hasPipeDeletion(text)) return refuse("Pipe-fed");
+  if (hasRecursiveDeletionFlag(text)) return refuse("Recursive");
+  if (hasWildcardDeletionTarget(text)) return refuse("Wildcard");
+  if (hasMultipleDeleteTargets(text)) return refuse("Multiple-target");
+  if (deletionVerbCount(text) >= 2) return refuse("Multiple-statement");
+  return { blocked: false };
+}
 
 // src/core/wslHostToolBridge.ts
 var ROOT_AGENT_ACTOR_ID = "00000000-0000-4000-8000-000000000001";
@@ -336165,6 +336251,7 @@ var ToolExecutor = class {
       t3("read", "Read file contents. Use ABSOLUTE paths. The working directory is given in system prompt.", { path: { type: "string" } }, ["path"]),
       t3("write", "Write/create a file. Use ABSOLUTE paths.", { path: { type: "string" }, content: { type: "string" } }, ["path", "content"]),
       t3("edit", "Edit file with find-and-replace. Use ABSOLUTE paths.", { path: { type: "string" }, old_str: { type: "string" }, new_str: { type: "string" } }, ["path", "old_str", "new_str"]),
+      t3("delete_file", "Delete ONE file under Agent supervision. Use ABSOLUTE paths. This tool refuses directory deletion and wildcard paths; delete files one by one. Never use bash rm/del/Remove-Item for batch (recursive/wildcard/loop/pipe/multi-target) deletion \u2014 the runtime hard-blocks such commands.", { path: { type: "string" } }, ["path"]),
       t3("glob", "Find files by glob pattern (e.g. **/*.ts, src/**/*.html)", { pattern: { type: "string" } }, ["pattern"]),
       t3("grep", "Search file content with regex", { pattern: { type: "string" }, path: { type: "string" } }, ["pattern", "path"]),
       t3("web_search", "Search the web", { query: { type: "string" } }, ["query"]),
@@ -336499,6 +336586,7 @@ var ToolExecutor = class {
         case "read":
         case "write":
         case "edit":
+        case "delete_file":
         case "grep":
         case "file_audit":
         case "pdf_read":
@@ -336515,6 +336603,11 @@ var ToolExecutor = class {
     if (permissionGuard) return permissionGuard;
     const bashGuard = tool === "bash" || tool === "terminal_takeover" && g2("action") === "write" ? this.checkBashWorkspaceAccess(g2("command"), context.workspacePath || wsPath) : null;
     if (bashGuard) return bashGuard;
+    const deletionGuardTarget = tool === "bash" || tool === "terminal_takeover" && g2("action") === "write" ? g2("command") : null;
+    if (deletionGuardTarget !== null) {
+      const deletionGuard = evaluateDeletionGuard(deletionGuardTarget);
+      if (deletionGuard.blocked) return deletionGuard.reason || "[deletion guard] Batch deletion is not allowed.";
+    }
     try {
       switch (tool) {
         case "bash":
@@ -336527,6 +336620,8 @@ var ToolExecutor = class {
           return this.fwrite(resolve16(g2("path")), g2("content"));
         case "edit":
           return this.fedit(resolve16(g2("path")), g2("old_str"), g2("new_str"));
+        case "delete_file":
+          return this.fdelete(resolve16(g2("path")));
         case "glob":
           return this.glob(g2("pattern"), wsPath);
         case "grep":
@@ -337060,6 +337155,20 @@ var ToolExecutor = class {
       return `[edit] ${e3}`;
     }
   }
+  fdelete(p) {
+    try {
+      if (/[*?]/.test(p)) return "[delete_file] Refused: wildcard paths are not allowed. Delete one file per call.";
+      const resolved = path15.resolve(p);
+      const stat = fs13.lstatSync(resolved);
+      if (stat.isDirectory()) {
+        return "[delete_file] Refused: deleting a directory is not allowed. Delete files one by one under Agent supervision.";
+      }
+      fs13.unlinkSync(resolved);
+      return `[delete_file] OK: ${resolved}`;
+    } catch (e3) {
+      return `[delete_file] ${e3 instanceof Error ? e3.message : String(e3)}`;
+    }
+  }
   glob(pattern, ws) {
     try {
       const results = globSync(pattern, {
@@ -339928,7 +340037,7 @@ var DOMAIN_PREFIXES = [
   [/^web_/, "web"],
   [/^computer_use$/, "computer"],
   [/^(image_|ocr_|pdf_)/, "media"],
-  [/^(bash|pwd|read|write|edit|glob|grep)$/, "core"]
+  [/^(bash|pwd|read|write|edit|delete_file|glob|grep)$/, "core"]
 ];
 var READ_TOOL_PATTERN = /^(pwd|read|glob|grep|git_status|git_log|git_diff|git_branch|git_show|memory_lab_read|memory_lab_query|skill|linked_plan|build_history_query|subagent_read|subagent_result|subagent_list|subagent_progress|question|image_inspect|image_display|ocr_read|pdf_read|automation_list|automation_status)$/;
 var DESTRUCTIVE_PATTERN = /(?<!\b(?:are|is|be|being|was|were|will be|would be|gets?|become)\s)\b(?:destroy|delete|erase|remove|rm\s|force|shutdown|kill|terminate|drop\s|prune)\b/;
@@ -344417,6 +344526,7 @@ var CORE_SYSTEM_PROMPT = `You are Newmark Agent, a powerful AI coding assistant
 - read: Read file contents
 - write: Write a new file
 - edit: Edit a file with search-and-replace
+- delete_file: Delete ONE file at a time under Agent supervision (absolute path; refuses directories and wildcards)
 - glob: Find files by pattern
 - grep: Search file contents with regex
 - web_search: Search the web via DuckDuckGo
@@ -344478,6 +344588,7 @@ var CORE_SYSTEM_PROMPT = `You are Newmark Agent, a powerful AI coding assistant
 - Visible replies must be concise, direct engineering prose. Do not wrap replies in chat bubbles or role labels.
 - Be thorough and precise. Verify your work.
 - Use tools appropriately - don't just describe, do it.
+- Deletion safety (intrinsic, non-overridable): file deletion is allowed only ONE file at a time under Agent supervision. Use the delete_file tool with an absolute path for every single-file delete. Never use bash or the terminal to delete files in bulk: recursive deletes (rm -r/-rf, Remove-Item -Recurse, rmdir /s, del /s), wildcard deletes (rm *.log, del *), loop deletes (for/foreach/while + rm), pipe-fed deletes (Get-ChildItem | Remove-Item), find/xargs deletes, and multi-target or multi-statement deletes are hard-blocked by the runtime and will be rejected. To remove a directory, delete its files one by one first, then remove the now-empty directory without a recursive flag.
 - For desktop Computer Use requests, follow observe -> decide -> act -> observe. Start visible takeover with computer_use takeover_start before multi-step desktop control and stop it when finished. Prefer app-scoped actions through app_list/app_observe/app_* when controlling one taskbar application, because this preserves human collaboration around other windows. Prefer target_id from the latest high-priority semantic UI objects, otherwise precise coordinates from the latest observation. Use vision plus UI controls together when the selected model has vision input. Avoid destructive UI actions unless the user asked for them, and do not claim YOLO/OCR perception unless an actual detector/OCR result is present.
 - For browser buttons and scanned document pages, the strict recognition sequence is text layer/DOM -> screenshot to a validated vision model -> local OCR. Do not skip directly to OCR. If OCR is used, treat it as approximate evidence and repair only what surrounding context supports.
 - Multiple tool calls emitted in one provider turn run concurrently. Treat their returned records as one barrier: continue reasoning only after every call in that batch has returned either a successful receipt or a failure receipt.

package/dist/core/agent.js

@@ -103,6 +103,7 @@ let CORE_SYSTEM_PROMPT = `You are Newmark Agent, a powerful AI coding assistant
 - read: Read file contents
 - write: Write a new file
 - edit: Edit a file with search-and-replace
+- delete_file: Delete ONE file at a time under Agent supervision (absolute path; refuses directories and wildcards)
 - glob: Find files by pattern
 - grep: Search file contents with regex
 - web_search: Search the web via DuckDuckGo
@@ -164,6 +165,7 @@ let CORE_SYSTEM_PROMPT = `You are Newmark Agent, a powerful AI coding assistant
 - Visible replies must be concise, direct engineering prose. Do not wrap replies in chat bubbles or role labels.
 - Be thorough and precise. Verify your work.
 - Use tools appropriately - don't just describe, do it.
+- Deletion safety (intrinsic, non-overridable): file deletion is allowed only ONE file at a time under Agent supervision. Use the delete_file tool with an absolute path for every single-file delete. Never use bash or the terminal to delete files in bulk: recursive deletes (rm -r/-rf, Remove-Item -Recurse, rmdir /s, del /s), wildcard deletes (rm *.log, del *), loop deletes (for/foreach/while + rm), pipe-fed deletes (Get-ChildItem | Remove-Item), find/xargs deletes, and multi-target or multi-statement deletes are hard-blocked by the runtime and will be rejected. To remove a directory, delete its files one by one first, then remove the now-empty directory without a recursive flag.
 - For desktop Computer Use requests, follow observe -> decide -> act -> observe. Start visible takeover with computer_use takeover_start before multi-step desktop control and stop it when finished. Prefer app-scoped actions through app_list/app_observe/app_* when controlling one taskbar application, because this preserves human collaboration around other windows. Prefer target_id from the latest high-priority semantic UI objects, otherwise precise coordinates from the latest observation. Use vision plus UI controls together when the selected model has vision input. Avoid destructive UI actions unless the user asked for them, and do not claim YOLO/OCR perception unless an actual detector/OCR result is present.
 - For browser buttons and scanned document pages, the strict recognition sequence is text layer/DOM -> screenshot to a validated vision model -> local OCR. Do not skip directly to OCR. If OCR is used, treat it as approximate evidence and repair only what surrounding context supports.
 - Multiple tool calls emitted in one provider turn run concurrently. Treat their returned records as one barrier: continue reasoning only after every call in that batch has returned either a successful receipt or a failure receipt.

package/dist/core/toolPolicy.d.ts

@@ -25,4 +25,13 @@ export declare function toolAvailability(name: string): ToolAvailability;
 export declare function evaluateToolPolicy(request: ToolPolicyRequest): ToolPolicyDecision;
 export declare function filterToolDefinitions<T>(definitions: T[], request: Omit<ToolPolicyRequest, 'name' | 'args'>): T[];
 export declare function planModePolicyPrompt(): string;
+export interface DeletionGuardDecision {
+    blocked: boolean;
+    reason?: string;
+}
+/**
+ * 硬性删除命令审查。blocked=true 表示该命令构成脚本/命令批量删除，必须拒绝并
+ * 引导 Agent 使用受监管的 delete_file 工具逐个删除。
+ */
+export declare function evaluateDeletionGuard(command: string): DeletionGuardDecision;
 //# sourceMappingURL=toolPolicy.d.ts.map

package/dist/core/toolPolicy.js

@@ -7,6 +7,7 @@ exports.toolAvailability = toolAvailability;
 exports.evaluateToolPolicy = evaluateToolPolicy;
 exports.filterToolDefinitions = filterToolDefinitions;
 exports.planModePolicyPrompt = planModePolicyPrompt;
+exports.evaluateDeletionGuard = evaluateDeletionGuard;
 const REQUIRED_TOOLS = new Set(['pwd', 'read', 'glob', 'grep']);
 const MODE_SCOPED_TOOLS = new Set([
     'image_inspect',
@@ -167,4 +168,128 @@ function planModePolicyPrompt() {
         'Runtime policy rejects stale or hidden mutating tool calls even if a prompt asks for them.',
     ].join(' ');
 }
+/** 删除命令动词（跨 POSIX / PowerShell / cmd）。注意：不含单独 "remove"（避免匹配普通英文）。 */
+const DELETE_VERB_SOURCE = '(?:remove-item|rmdir|unlink|erase|del|rm|rd|ri)';
+const DELETE_VERB_BOUNDARY = new RegExp(`(?:^|[\\s;&|()\\n])${DELETE_VERB_SOURCE}(?:\\s|$)`, 'i');
+function hasDeletionVerb(text) {
+    return DELETE_VERB_BOUNDARY.test(text);
+}
+function deletionVerbCount(text) {
+    const matches = text.match(new RegExp(DELETE_VERB_BOUNDARY.source, 'gi'));
+    return matches ? matches.length : 0;
+}
+/** 循环结构批量删除：foreach / for…in / for( / while( / bash do…done。 */
+function hasLoopDeletion(text) {
+    const lower = text.toLowerCase();
+    if (/\bforeach\b/.test(lower))
+        return true; // PowerShell foreach
+    if (/\bfor\b\s*[$({]/.test(lower))
+        return true; // PowerShell/C for(...)
+    if (/\bfor\b\s+\S+\s+in\b/.test(lower))
+        return true; // bash for f in ...
+    if (/\bwhile\b\s*[({]/.test(lower))
+        return true; // while(...)
+    if (/\bwhile\b\s+\S/.test(lower) && /\bdo\b/.test(lower))
+        return true; // bash while ... do
+    if (/\bdone\b/.test(lower))
+        return true; // bash 循环结束标记
+    return false;
+}
+/** find -delete / find -exec rm / xargs rm 批量删除。 */
+function hasFindXargsDeletion(text) {
+    if (/\bfind\b[^\n;&|]*-(?:delete\b|exec(?:dir)?\s+(?:rm|del|erase)\b)/i.test(text))
+        return true;
+    if (/\bxargs\b[^\n;&|]*\b(?:rm|del|erase|remove-item)\b/i.test(text))
+        return true;
+    return false;
+}
+/** 按 shell 语义切分参数：引号内的空格不拆分，返回去引号后的 token。 */
+function splitCommandArgs(args) {
+    const tokens = [];
+    const re = /"([^"]*)"|'([^']*)'|(\S+)/g;
+    let m;
+    while ((m = re.exec(args)) !== null) {
+        const token = m[1] ?? m[2] ?? m[3] ?? '';
+        if (token)
+            tokens.push(token);
+    }
+    return tokens;
+}
+/** 管道接收端删除：上游产出多项，删除动词作为接收端即批量删除。 */
+function hasPipeDeletion(text) {
+    return new RegExp(`\\|\\s*${DELETE_VERB_SOURCE}\\b`, 'i').test(text);
+}
+/** 递归删除标志：rm -r/-R/--recursive、Remove-Item -Recurse、rmdir/rd /s、del /s。 */
+function hasRecursiveDeletionFlag(text) {
+    const lower = text.toLowerCase();
+    if (/\brm\b\s+(-[a-z]*r[a-z]*|--recursive)\b/.test(lower))
+        return true;
+    if (/\bremove-item\b[^\n;&|]*\s+-(?:recurse|r)\b/.test(lower))
+        return true;
+    if (/\b(?:rmdir|rd)\b\s+(-r\b|\/[s]\b)/.test(lower))
+        return true;
+    if (/\bdel\b\s+\/[s]\b/.test(lower))
+        return true;
+    return false;
+}
+/** 删除命令后跟含通配符的目标 token。 */
+function hasWildcardDeletionTarget(text) {
+    const segmentRe = new RegExp(`(?:^|[\\s;&|()\\n])${DELETE_VERB_SOURCE}([\\s][^;&|\\n]*)?`, 'gi');
+    let m;
+    while ((m = segmentRe.exec(text)) !== null) {
+        const args = m[1] || '';
+        for (const token of splitCommandArgs(args)) {
+            if (!token || token.startsWith('-') || /^\/[A-Za-z]/.test(token))
+                continue;
+            if (/[*?]/.test(token))
+                return true;
+        }
+    }
+    return false;
+}
+/** 单条删除命令后跟 >= 2 个明确目标（非 flag、非 shell 开关）。 */
+function hasMultipleDeleteTargets(text) {
+    const segmentRe = new RegExp(`(?:^|[\\s;&|()\\n])${DELETE_VERB_SOURCE}([\\s][^;&|\\n]*)?`, 'gi');
+    let m;
+    while ((m = segmentRe.exec(text)) !== null) {
+        const args = m[1] || '';
+        const targets = splitCommandArgs(args)
+            .filter(t => t && !t.startsWith('-') && !/^\/[A-Za-z]/.test(t) && !/^(&&|\|\||;|\||&|>|>>|<|2>&1)$/.test(t));
+        if (targets.length >= 2)
+            return true;
+    }
+    return false;
+}
+/**
+ * 硬性删除命令审查。blocked=true 表示该命令构成脚本/命令批量删除，必须拒绝并
+ * 引导 Agent 使用受监管的 delete_file 工具逐个删除。
+ */
+function evaluateDeletionGuard(command) {
+    const text = String(command || '');
+    if (!text.trim())
+        return { blocked: false };
+    // find -delete / find -exec rm 中，-delete 不含标准删除动词，需在入口单独识别为批量删除意图。
+    const findXargs = hasFindXargsDeletion(text);
+    if (!hasDeletionVerb(text) && !findXargs)
+        return { blocked: false };
+    const refuse = (kind) => ({
+        blocked: true,
+        reason: `[deletion guard] ${kind} batch deletion is not allowed. Delete files one by one with the delete_file tool under Agent supervision.`,
+    });
+    if (hasLoopDeletion(text))
+        return refuse('Loop-based');
+    if (findXargs)
+        return refuse('find/xargs');
+    if (hasPipeDeletion(text))
+        return refuse('Pipe-fed');
+    if (hasRecursiveDeletionFlag(text))
+        return refuse('Recursive');
+    if (hasWildcardDeletionTarget(text))
+        return refuse('Wildcard');
+    if (hasMultipleDeleteTargets(text))
+        return refuse('Multiple-target');
+    if (deletionVerbCount(text) >= 2)
+        return refuse('Multiple-statement');
+    return { blocked: false };
+}
 //# sourceMappingURL=toolPolicy.js.map

package/dist/toolchain/registry-seeder.js

@@ -15,7 +15,7 @@ const DOMAIN_PREFIXES = [
     [/^web_/, 'web'],
     [/^computer_use$/, 'computer'],
     [/^(image_|ocr_|pdf_)/, 'media'],
-    [/^(bash|pwd|read|write|edit|glob|grep)$/, 'core'],
+    [/^(bash|pwd|read|write|edit|delete_file|glob|grep)$/, 'core'],
 ];
 const READ_TOOL_PATTERN = /^(pwd|read|glob|grep|git_status|git_log|git_diff|git_branch|git_show|memory_lab_read|memory_lab_query|skill|linked_plan|build_history_query|subagent_read|subagent_result|subagent_list|subagent_progress|question|image_inspect|image_display|ocr_read|pdf_read|automation_list|automation_status)$/;
 /**

package/dist/tools/index.d.ts

@@ -59,6 +59,7 @@ export declare class ToolExecutor {
     private fread;
     private fwrite;
     private fedit;
+    private fdelete;
     private glob;
     private grep;
     private createProxyAgent;

package/dist/tools/index.js

@@ -227,6 +227,7 @@ class ToolExecutor {
             t('read', 'Read file contents. Use ABSOLUTE paths. The working directory is given in system prompt.', { path: { type: 'string' } }, ['path']),
             t('write', 'Write/create a file. Use ABSOLUTE paths.', { path: { type: 'string' }, content: { type: 'string' } }, ['path', 'content']),
             t('edit', 'Edit file with find-and-replace. Use ABSOLUTE paths.', { path: { type: 'string' }, old_str: { type: 'string' }, new_str: { type: 'string' } }, ['path', 'old_str', 'new_str']),
+            t('delete_file', 'Delete ONE file under Agent supervision. Use ABSOLUTE paths. This tool refuses directory deletion and wildcard paths; delete files one by one. Never use bash rm/del/Remove-Item for batch (recursive/wildcard/loop/pipe/multi-target) deletion — the runtime hard-blocks such commands.', { path: { type: 'string' } }, ['path']),
             t('glob', 'Find files by glob pattern (e.g. **/*.ts, src/**/*.html)', { pattern: { type: 'string' } }, ['pattern']),
             t('grep', 'Search file content with regex', { pattern: { type: 'string' }, path: { type: 'string' } }, ['pattern', 'path']),
             t('web_search', 'Search the web', { query: { type: 'string' } }, ['query']),
@@ -578,6 +579,7 @@ class ToolExecutor {
                 case 'read':
                 case 'write':
                 case 'edit':
+                case 'delete_file':
                 case 'grep':
                 case 'file_audit':
                 case 'pdf_read':
@@ -598,6 +600,15 @@ class ToolExecutor {
             : null;
         if (bashGuard)
             return bashGuard;
+        // 硬性删除审查：允许单文件删除，拒绝脚本/命令批量删除。
+        const deletionGuardTarget = tool === 'bash' || (tool === 'terminal_takeover' && g('action') === 'write')
+            ? g('command')
+            : null;
+        if (deletionGuardTarget !== null) {
+            const deletionGuard = (0, toolPolicy_1.evaluateDeletionGuard)(deletionGuardTarget);
+            if (deletionGuard.blocked)
+                return deletionGuard.reason || '[deletion guard] Batch deletion is not allowed.';
+        }
         try {
             switch (tool) {
                 case 'bash': return await this.bash(g('command'), wsPath, args.timeout_ms, context.signal);
@@ -605,6 +616,7 @@ class ToolExecutor {
                 case 'read': return this.fread(resolve(g('path')));
                 case 'write': return this.fwrite(resolve(g('path')), g('content'));
                 case 'edit': return this.fedit(resolve(g('path')), g('old_str'), g('new_str'));
+                case 'delete_file': return this.fdelete(resolve(g('path')));
                 case 'glob': return this.glob(g('pattern'), wsPath);
                 case 'grep': return this.grep(g('pattern'), resolve(g('path')));
                 case 'web_search': return await this.wsearch(g('query'), context.signal);
@@ -1136,6 +1148,22 @@ class ToolExecutor {
             return `[edit] ${e}`;
         }
     }
+    fdelete(p) {
+        try {
+            if (/[*?]/.test(p))
+                return '[delete_file] Refused: wildcard paths are not allowed. Delete one file per call.';
+            const resolved = path.resolve(p);
+            const stat = fs.lstatSync(resolved);
+            if (stat.isDirectory()) {
+                return '[delete_file] Refused: deleting a directory is not allowed. Delete files one by one under Agent supervision.';
+            }
+            fs.unlinkSync(resolved);
+            return `[delete_file] OK: ${resolved}`;
+        }
+        catch (e) {
+            return `[delete_file] ${e instanceof Error ? e.message : String(e)}`;
+        }
+    }
     glob(pattern, ws) {
         try {
             const results = globSync(pattern, {

package/dist/tools/nativeTools.js

@@ -11,6 +11,7 @@ exports.NATIVE_TOOL_CATALOG = [
     { name: 'read', label: 'Read file', description: 'Read workspace file contents.', category: 'core', defaultEnabled: true, protected: true, availability: 'required' },
     { name: 'write', label: 'Write file', description: 'Create or overwrite workspace files.', category: 'core', defaultEnabled: true },
     { name: 'edit', label: 'Edit file', description: 'Patch workspace files through exact find and replace.', category: 'core', defaultEnabled: true },
+    { name: 'delete_file', label: 'Delete file', description: 'Delete one file at a time under Agent supervision; refuses directory and wildcard deletion.', category: 'core', defaultEnabled: true },
     { name: 'glob', label: 'Glob files', description: 'Find files by glob pattern.', category: 'core', defaultEnabled: true, protected: true, availability: 'required' },
     { name: 'grep', label: 'Search files', description: 'Search workspace text by regex.', category: 'core', defaultEnabled: true, protected: true, availability: 'required' },
     { name: 'web_search', label: 'Web search', description: 'Search the web from the Agent.', category: 'web', defaultEnabled: true },

package/dist/tui/src/app.js

@@ -17,9 +17,12 @@ const {
   createState,
   cycleConversationMode,
   enterConversation,
+  enterHistoryEventFocus,
+  exitHistoryEventFocus,
   filteredCommands,
   moveFocusHorizontal,
   moveConversationHistoryCursor,
+  moveHistoryEventCursor,
   moveInputCursorVertical,
   moveMenuSelection,
   moveSettingChoiceSelection,
@@ -37,6 +40,7 @@ const {
   toggleAgentHistory,
   toggleConversationPinned,
   toggleSelectedBuildBlock,
+  toggleSelectedBuildEvent,
   toggleSelected,
   toggleWorkflowDetails,
   validateSelectedModel
@@ -330,7 +334,21 @@ function start(options = {}) {
         Promise.resolve(requestConversationStop(state)).finally(paint);
       } else if (key.name === "tab") {
         state.conversationHistoryFocus = false;
+        state.historyEventFocus = false;
+        state.historyEventIndex = -1;
         returnToConversationSelection(state);
+      } else if (state.historyEventFocus) {
+        if (key.name === "left") {
+          exitHistoryEventFocus(state);
+        } else if (key.name === "up") {
+          moveHistoryEventCursor(state, -1);
+        } else if (key.name === "down") {
+          moveHistoryEventCursor(state, 1);
+        } else if (key.name === "return" || key.name === "space") {
+          toggleSelectedBuildEvent(state);
+        }
+      } else if (key.name === "right") {
+        enterHistoryEventFocus(state);
       } else if (key.name === "up") {
         moveConversationHistoryCursor(state, -1);
       } else if (key.name === "down") {
@@ -490,6 +508,12 @@ function start(options = {}) {
       state.focusRegion = "content";
       state.contentColumn = 0;
       state.notice = "Search Memory Lab tags";
+    } else if (state.view === "memory" && !state.inputMode && (str === "o" || str === "O")) {
+      state.notice = "Opening Memory Lab Overview";
+      var overviewResult = state.adapter.openMemoryOverview();
+      if (overviewResult && typeof overviewResult.then === "function") {
+        overviewResult.catch(function(error) { state.notice = "Overview failed: " + error.message; }).finally(paint);
+      }
     } else if (key.name === "tab") {
       state.focusRegion = "menu";
       state.contentColumn = 0;

package/dist/tui/src/i18n.js

@@ -0,0 +1,151 @@
+"use strict";
+
+/**
+ * Lightweight terminal i18n for the Newmark TUI.
+ *
+ * The TUI chrome (navigation, section headers, view titles, and hints) is
+ * rendered in the language chosen under Settings → General → Language. Model,
+ * tool, provider, conversation, and workspace names are user data and stay
+ * verbatim. Keys are the English source strings, so an untranslated string
+ * silently falls back to English rather than dropping text.
+ */
+
+const ZH = Object.freeze({
+  // Sidebar sections
+  "WORKSPACES": "工作区",
+  "OPERATIONS": "操作",
+  "ACTIVE TARGET": "当前目标",
+  "ACTIVE CONVERSATION": "当前对话",
+  "Agent TUI": "Agent 终端",
+
+  // Navigation labels (TUI/src/data.js)
+  "Conversations": "对话",
+  "Plan": "计划",
+  "Goal": "目标",
+  "Subagents": "子代理",
+  "Model": "模型",
+  "Flow Bar": "流程条",
+  "Flow List": "流程列表",
+  "Flow Task": "流程任务",
+  "Tools": "工具",
+  "Memory Lab": "记忆实验室",
+  "Automations": "自动化",
+  "WorkFlow": "工作流",
+  "Settings": "设置",
+  "Help": "帮助",
+
+  // Conversation context
+  "Conversation plan": "对话计划",
+  "Conversation goal": "对话目标",
+  "Conversation subagents": "对话子代理",
+  "Model and reasoning effort": "模型与推理档位",
+  "Flow bar": "流程条",
+  "Flow list": "流程列表",
+  "Flow task": "流程任务",
+
+  // Model view
+  "Reasoning effort": "推理档位",
+  "Deployment": "部署",
+  "Shared GUI/TUI request tier · ←/→ changes section": "GUI/TUI 共享请求档位 · ←/→ 切换区块",
+  "Used by this conversation, including its Plan and Subagents": "当前对话使用（含计划与子代理）",
+  "Enter applies the focused tier or deployment. Effort persists globally; deployments remain per conversation.":
+    "Enter 应用当前档位或部署。档位全局持久化，部署按对话保存。",
+
+  // Memory Lab
+  "Tags": "标签",
+  "Selected tag": "已选标签",
+  "Child tags": "子标签",
+  "Memory components": "记忆组件",
+  "Core memory": "核心记忆",
+  "No memory components": "无记忆组件",
+  "No component selected": "未选择组件",
+  "Overview": "总览",
+  "Memory overview": "记忆总览",
+  "Memory tag": "记忆标签",
+
+  // Chat view
+  "N new": "N 新建",
+  "Workspace": "工作区",
+  "Current": "当前",
+  "Preview": "预览",
+  "Current conversation": "当前对话",
+  "Enter to open this conversation": "Enter 打开此对话",
+  "Type a message · Shift+Enter newline · Enter send": "输入消息 · Shift+Enter 换行 · Enter 发送",
+  "Select a conversation · Enter to edit": "选择对话 · Enter 编辑",
+
+  // Settings categories
+  "General": "通用",
+  "Personalization": "个性化",
+  "Runtime": "运行时",
+  "Providers": "服务商",
+  "Models": "模型",
+  "Archive": "归档",
+  "Updates": "更新",
+
+  // Settings
+  "Categories": "分类",
+  "Language": "语言",
+  "Input mode": "输入模式",
+  "Conversation style": "对话风格",
+  "Option feedback": "选项反馈",
+  "Close behavior": "关闭行为",
+  "Expand tool usage": "展开工具使用",
+  "Theme": "主题",
+  "Application font": "应用字体",
+  "Font color": "字体颜色",
+  "Background color": "背景颜色",
+  "Glass intensity": "玻璃强度",
+  "Agent backend": "Agent 后端",
+  "WSL distribution": "WSL 发行版",
+  "Terminal timeout cap": "终端超时上限",
+  "Default shell": "默认 Shell",
+  "Automatic archive": "自动归档",
+  "Retention": "保留期",
+  "Include Memory Lab": "包含记忆实验室",
+  "Export format": "导出格式",
+  "Update channel": "更新通道",
+  "Automatic checks": "自动检查",
+  "Automatic download": "自动下载",
+  "Update source": "更新来源",
+  "Live color preview": "实时颜色预览",
+
+  // Plan / Goal / Agents
+  "Linked Plan": "关联计划",
+  "Next handoff": "下一交接",
+  "Linked goal": "关联目标",
+  "No active goal": "无活动目标",
+  "RESULT": "结果",
+  "No messages recorded yet.": "暂无消息记录。",
+  "Records come from the active Newmark conversation": "记录来自当前 Newmark 对话",
+
+  // Tools
+  "Tools & connectors": "工具与连接器",
+  "Live runtime": "实时运行时",
+  "Safety boundary": "安全边界",
+
+  // Automation / Workflow
+  "[+] New automation": "[+] 新建自动化",
+  "[+] New workflow": "[+] 新建工作流",
+  "No workflows configured.": "未配置工作流。",
+
+  // Help
+  "SHORTCUT GUIDE": "快捷键指南",
+  "Navigation": "导航",
+  "Conversation editing": "对话编辑",
+  "Running work": "运行中的工作",
+  "Operation content": "操作内容",
+  "Global": "全局"
+});
+
+function resolveLanguage(state) {
+  const value = String(state?.settings?.general?.language || "Auto");
+  return value === "中文" || value === "zh" ? "zh" : "en";
+}
+
+function tr(state, text) {
+  const value = String(text ?? "");
+  if (resolveLanguage(state) === "zh") return ZH[value] || value;
+  return value;
+}
+
+module.exports = { resolveLanguage, tr };