pi-web-ui 0.94.0 → 0.95.0

package/dist/server/process-utils.js

@@ -86,16 +86,22 @@ export async function snapshotProcessParents() {
         return undefined;
     }
 }
-/** Kill a pid and its whole process tree (cross-platform). */
-export function killPidTree(pid) {
+/** Kill a pid and its whole process tree (cross-platform).
+ *
+ * The returned promise is only meaningful on Windows, where taskkill is itself
+ * asynchronous. Existing callers may continue to ignore it for best-effort
+ * background cleanup; callers that own a deadline can await completion. */
+export async function killPidTree(pid) {
     try {
         if (process.platform === "win32") {
-            void import("node:child_process").then(({ spawn }) => {
-                spawn("taskkill", ["/F", "/T", "/PID", String(pid)], {
+            const { spawn } = await import("node:child_process");
+            await new Promise((resolve) => {
+                const killer = spawn("taskkill", ["/F", "/T", "/PID", String(pid)], {
                     stdio: "ignore",
-                    detached: true,
                     windowsHide: true,
-                }).unref();
+                });
+                killer.once("error", () => resolve());
+                killer.once("close", () => resolve());
             });
         }
         else {

package/dist/server/scheduler-tasks.js

@@ -347,6 +347,12 @@ export class SchedulerStore {
         if (ok) {
             this.save();
             this.changed();
+            try {
+                this.opts.onTaskRemoved?.(id);
+            }
+            catch {
+                /* 回调失败不影响删除 */
+            }
         }
         return ok;
     }

package/dist/server/serialize.js

@@ -31,21 +31,21 @@ function truncate(s, cap) {
  */
 function imageBlockToUi(b, cap = Number.POSITIVE_INFINITY) {
     const img = b;
+    const src = img.source;
+    if (typeof src?.url === "string" && src.url)
+        return { type: "image", dataUrl: src.url };
     if (typeof img.data === "string" && img.data.length > 0) {
         const dataUrl = `data:${img.mimeType ?? "image/png"};base64,${img.data}`;
         if (dataUrl.length > cap)
             return undefined;
         return { type: "image", dataUrl, mimeType: img.mimeType };
     }
-    const src = img.source;
     if (src?.type === "base64" && src.data) {
         const dataUrl = `data:${src.mediaType ?? "image/png"};base64,${src.data}`;
         if (dataUrl.length > cap)
             return undefined;
         return { type: "image", dataUrl, mimeType: src.mediaType };
     }
-    if (typeof src?.url === "string" && src.url)
-        return { type: "image", dataUrl: src.url };
     return undefined;
 }
 function serializeUserContent(content) {
@@ -227,6 +227,16 @@ export function serializeMessage(m, seq) {
                 tokensBefore: m.tokensBefore,
             };
         }
+        case "system": {
+            // SDK 的 system 消息是 prompt sections 的内部差量
+            // (content 空串 + sections 结构化内存)、compaction 的
+            // systemMessage 等——从来不面向用户。不过滤的话
+            // 会掉进 default 分支被序列化成 content: []
+            // 的空气泡、前端顶着 system 标题白显示一条
+            // (对话结束后底部冒出的空 SYSTEM 气泡就是它)。
+            // LLM 上下文不受影响——这里只决定浏览器看到什么。
+            return null;
+        }
         default:
             return {
                 id: `x-${seq}`,

package/dist/server/settings-service.js

@@ -18,6 +18,7 @@ import { deriveLegacy, foldLegacyIntoDisabled, normalizeDisabledAgentTools } fro
 export class SettingsService {
     host;
     templates;
+    approvalRules;
     settings;
     presets;
     knownSkills = new Map();
@@ -26,9 +27,12 @@ export class SettingsService {
     pendingReload = false;
     constructor(host, 
     /** 全局子代理模板库（所有客户端共享；模板改动无需 reload runtime）。 */
-    templates) {
+    templates, 
+    /** 全局审批规则库（所有客户端共享；修改实时生效无需 reload runtime）。 */
+    approvalRules) {
         this.host = host;
         this.templates = templates;
+        this.approvalRules = approvalRules;
         this.settings = host.stateStore.getSettings(host.clientId);
         this.presets = host.stateStore.getPresets(host.clientId);
     }
@@ -289,8 +293,12 @@ export class SettingsService {
                 terminalToolsEnabled: legacyTools.terminalToolsEnabled,
                 terminalBash: this.settings.terminalBash,
                 terminalBashIdleMs: this.settings.terminalBashIdleMs,
+                terminalBashMaxForegroundMs: this.settings.terminalBashMaxForegroundMs,
                 toolWatchdogTimeoutMs: this.settings.toolWatchdogTimeoutMs,
                 readDirEnabled: this.settings.readDirEnabled !== false,
+                toolApprovalEnabled: this.settings.toolApprovalEnabled !== false,
+                approvalPolicy: this.host.getApprovalPolicy?.() ?? { allowAll: false, categories: [] },
+                approvalRules: this.approvalRules?.list() ?? [],
                 editSoftEnabled: legacyTools.editSoftEnabled,
                 questionnaireEnabled: legacyTools.questionnaireEnabled,
                 parallelReminderEnabled: this.settings.parallelReminderEnabled ?? true,
@@ -461,6 +469,9 @@ export class SettingsService {
         if (partial.terminalBashIdleMs !== undefined) {
             this.settings.terminalBashIdleMs = Math.max(0, Math.floor(partial.terminalBashIdleMs) || 0);
         }
+        if (partial.terminalBashMaxForegroundMs !== undefined) {
+            this.settings.terminalBashMaxForegroundMs = Math.max(0, Math.floor(partial.terminalBashMaxForegroundMs) || 0);
+        }
         if (partial.toolWatchdogTimeoutMs !== undefined) {
             this.settings.toolWatchdogTimeoutMs = normalizeToolWatchdogTimeoutMs(partial.toolWatchdogTimeoutMs);
         }
@@ -468,6 +479,10 @@ export class SettingsService {
         if (partial.readDirEnabled !== undefined) {
             this.settings.readDirEnabled = partial.readDirEnabled;
         }
+        // 工具执行审批总开关：审批入口每次实时读取（askApproval 顶部门禁），无需 reload。
+        if (partial.toolApprovalEnabled !== undefined) {
+            this.settings.toolApprovalEnabled = partial.toolApprovalEnabled;
+        }
         // 目标模式总开关：运行时无需重载（goal bar / 服务端入口实时读取）。
         if (partial.goalModeEnabled !== undefined) {
             this.settings.goalModeEnabled = partial.goalModeEnabled;
@@ -587,6 +602,7 @@ export class SettingsService {
             terminalToolsEnabled: this.settings.terminalToolsEnabled,
             terminalBash: this.settings.terminalBash,
             terminalBashIdleMs: this.settings.terminalBashIdleMs,
+            terminalBashMaxForegroundMs: this.settings.terminalBashMaxForegroundMs,
             editSoftEnabled: this.settings.editSoftEnabled,
             retryMaxAttempts: this.settings.retryMaxAttempts,
             softCapTokens: this.settings.softCapTokens,
@@ -636,8 +652,11 @@ export class SettingsService {
             // 终端接管偏好随预设走；旧预设缺字段时保留当前值。
             terminalBash: p.terminalBash ?? this.settings.terminalBash,
             terminalBashIdleMs: p.terminalBashIdleMs ?? this.settings.terminalBashIdleMs,
+            terminalBashMaxForegroundMs: p.terminalBashMaxForegroundMs ?? this.settings.terminalBashMaxForegroundMs,
             // read 读目录是纯运行行为开关，不进预设——保留当前值。
             readDirEnabled: this.settings.readDirEnabled !== false,
+            // 工具审批总开关同样是纯运行开关，不进预设——保留当前值。
+            toolApprovalEnabled: this.settings.toolApprovalEnabled !== false,
             // toolWatchdogTimeoutMs 是纯运行行为参数，不进预设——保留当前值。
             toolWatchdogTimeoutMs: this.settings.toolWatchdogTimeoutMs,
             editSoftEnabled: presetLegacy.editSoftEnabled,
@@ -725,6 +744,94 @@ export class SettingsService {
             textEn: `Subagent template deleted: ${name}`,
         });
     }
+    /** Upsert 一条审批规则（全局共享）。 */
+    async saveApprovalRule(rule) {
+        if (!this.approvalRules)
+            return;
+        const err = this.approvalRules.upsert(rule);
+        if (err) {
+            this.host.emit({
+                type: "notice",
+                level: "error",
+                text: `审批规则保存失败：${err}`,
+                textEn: `Failed to save approval rule: ${err}`,
+            });
+            return;
+        }
+        this.push();
+        this.host.emit({
+            type: "notice",
+            level: "info",
+            text: `审批规则已保存：${rule.label}`,
+            textEn: `Approval rule saved: ${rule.labelEn || rule.label}`,
+        });
+    }
+    /** 批量更新审批规则列表（重排或批量保存，全局共享）。 */
+    async saveApprovalRules(rules) {
+        if (!this.approvalRules)
+            return;
+        const err = this.approvalRules.saveAll(rules);
+        if (err) {
+            this.host.emit({
+                type: "notice",
+                level: "error",
+                text: `审批规则列表保存失败：${err}`,
+                textEn: `Failed to save approval rules: ${err}`,
+            });
+            return;
+        }
+        this.push();
+        this.host.emit({
+            type: "notice",
+            level: "info",
+            text: "审批规则列表已更新",
+            textEn: "Approval rules updated",
+        });
+    }
+    /** 删除一条自定义审批规则。 */
+    async deleteApprovalRule(id) {
+        if (!this.approvalRules)
+            return;
+        const ok = this.approvalRules.remove(id);
+        if (!ok) {
+            this.host.emit({
+                type: "notice",
+                level: "error",
+                text: "审批规则删除失败（内置规则不可删除）",
+                textEn: "Failed to delete approval rule (built-in rules cannot be deleted)",
+            });
+            return;
+        }
+        this.push();
+        this.host.emit({
+            type: "notice",
+            level: "info",
+            text: "审批规则已删除",
+            textEn: "Approval rule deleted",
+        });
+    }
+    /** 恢复某条内置审批规则到系统默认设定。 */
+    async resetBuiltinApprovalRule(id) {
+        if (!this.approvalRules)
+            return;
+        const ok = this.approvalRules.resetBuiltin(id);
+        if (!ok) {
+            this.host.emit({
+                type: "notice",
+                level: "error",
+                text: "恢复默认失败：未找到对应内置规则",
+                textEn: "Failed to reset: built-in rule not found",
+            });
+            return;
+        }
+        this.push();
+        this.host.emit({
+            type: "notice",
+            level: "info",
+            text: "内置规则已恢复默认",
+            textEn: "Built-in rule reset to default",
+        });
+    }
     /**
      * Make settings changes effective in the running runtime. The resource-loader
      * overrides read this.settings at call time, so a reload re-applies them.

package/dist/server/subagents.js

@@ -62,6 +62,7 @@ export function withSubagentOwner(host, ownerId) {
     return {
         ...host,
         spawnSubagent: (prompt, type, cwd, templateName, model, _parentId, persist) => host.spawnSubagent(prompt, type, cwd, templateName, model, ownerId, persist),
+        handoffSubagent: (fromRunId, toRunId, payload) => host.handoffSubagent(fromRunId || ownerId, toRunId, payload),
     };
 }
 /**
@@ -491,6 +492,46 @@ export function makeSubagentTools(host, lang, selfConvId) {
                 return text(pick(getLang(), `可用的子代理模板（subagent_spawn 的 template 参数传名字，如 subagent_spawn(template="${firstTemplateName}"))：\n${templateLines}`, `Available subagent templates (pass the name as subagent_spawn's template param, e.g. subagent_spawn(template="${firstTemplateName}")):\n${templateLines}`, "subagents.templates.list", { firstTemplateName: firstTemplateName, templateLines: templateLines }));
             },
         }),
+        defineTool({
+            name: "subagent_handoff",
+            label: "Hand off to peer subagent",
+            description: bilingual("Hand off task artifacts, context, or results directly to another peer subagent (peer-to-peer routing), " +
+                "without routing through the parent conversation. Enables direct multi-agent pipeline collaboration.", "将任务产物、上下文或分析结果直接交接给另一个同行子代理（对等消息路由），" +
+                "无需通过主会话中转，实现多智能体同行流水线协作。"),
+            promptSnippet: "hand off task artifacts or results directly to another peer subagent",
+            parameters: Type.Object({
+                toRunId: Type.String({
+                    description: bilingual("Target peer subagent convId (from subagent_list).", "目标同行子代理 convId（通过 subagent_list 获取）。"),
+                }),
+                payload: Type.String({
+                    description: bilingual("The artifact, analysis result, or instruction to hand off to the peer subagent.", "要交接给同行子代理的产物、分析结果或后续任务指令。"),
+                }),
+                fromRunId: Type.Optional(Type.String({
+                    description: bilingual("Source subagent convId. Optional: defaults to the current calling subagent.", "来源子代理 convId。可选：默认自动使用当前调用的子代理。"),
+                })),
+            }),
+            execute: async (_id, p) => {
+                const fromId = p.fromRunId || selfConvId || "unknown";
+                if (fromId === p.toRunId) {
+                    return text(pick(getLang(), `交接失败：不能交接给自身（${shortId(fromId)}）。请指定其他同行子代理。`, `Handoff failed: cannot hand off to oneself (${shortId(fromId)}). Please specify a different peer subagent.`, "subagents.handoff.self", { id: shortId(fromId) }));
+                }
+                const target = host.getSubagent(p.toRunId);
+                if (!target) {
+                    const missingId = shortId(p.toRunId);
+                    return text(pick(getLang(), `未找到目标子代理 ${missingId}（可能已移出或不存在）。请用 subagent_list 确认可用的子代理。`, `Target subagent ${missingId} not found (may have been dismissed or non-existent). Use subagent_list to check available subagents.`, "subagents.handoff.not.found", { missingId }));
+                }
+                try {
+                    await host.handoffSubagent(fromId, p.toRunId, p.payload);
+                    const fromShort = shortId(fromId);
+                    const toShort = shortId(p.toRunId);
+                    return text(pick(getLang(), `已成功将产物交接给同行子代理 ${toShort}（${target.type}），协同路由已建立并开始执行。`, `Successfully handed off payload to peer subagent ${toShort} (${target.type}); peer routing established and executing.`, "subagents.handoff.success", { from: fromShort, to: toShort, type: target.type }), { fromRunId: fromId, toRunId: p.toRunId, timestamp: Date.now() });
+                }
+                catch (err) {
+                    const msg = err instanceof Error ? err.message : String(err);
+                    return text(pick(getLang(), `交接失败：${msg}`, `Handoff failed: ${msg}`, "subagents.handoff.failed", { error: msg }));
+                }
+            },
+        }),
     ];
 }
 /** 短 id 前缀（前端展示/日志用）。 */

package/dist/server/terminals.js

@@ -1583,6 +1583,8 @@ export function makeTerminalBashTool(terminals, opts) {
                     void terminals.inputChecked(termId, "exit\r");
             };
             const idleMs = Math.max(0, opts.idleMs());
+            const maxForegroundMs = Math.max(0, opts.maxForegroundMs?.() ?? 0);
+            const startTime = Date.now();
             const deadline = p.timeout && p.timeout > 0 ? Date.now() + p.timeout * 1000 : null;
             // 拆掉模型常写的尾部输出限制/过滤管道（`| tail -N` / `| less` / `| more` / `| cat`）：
             // 这类管道在终端里 ①缓冲输出——可见终端全程哑火、无法感知实时进度；②吞掉真实退出码——
@@ -1656,7 +1658,11 @@ export function makeTerminalBashTool(terminals, opts) {
                     }
                     // 静默解阻（仅持久终端）：转后台 + 注册完成观察器，立即把控制权还给模型。
                     if (persist && idleMs > 0 && Date.now() - lastDataAt >= idleMs) {
-                        return backgroundResult(terminals, opts, runCommand, applyHeadTail(cleanBashOutput(collected), p.head, effectiveTail, lang), Math.round((Date.now() - lastDataAt) / 1000), lang);
+                        return backgroundResult(terminals, opts, runCommand, applyHeadTail(cleanBashOutput(collected), p.head, effectiveTail, lang), Math.round((Date.now() - lastDataAt) / 1000), lang, termId, persist, "idle");
+                    }
+                    // 总时长解阻（持久与一次性终端）：前台运行达到上限，转入后台继续执行，避免卡死。
+                    if (maxForegroundMs > 0 && Date.now() - startTime >= maxForegroundMs) {
+                        return backgroundResult(terminals, opts, runCommand, applyHeadTail(cleanBashOutput(collected), p.head, effectiveTail, lang), Math.round((Date.now() - startTime) / 1000), lang, termId, persist, "elapsed");
                     }
                 }
             }
@@ -1666,36 +1672,85 @@ export function makeTerminalBashTool(terminals, opts) {
         },
     });
 }
-/** 静默解阻路径：注册完成观察器后立即返回「仍在后台运行」。 */
-function backgroundResult(terminals, opts, command, partialText, silentSeconds, lang) {
-    terminals.watchOutput("ai-bash", BASH_SENTINEL_RE, (m) => {
+/** 静默 / 总时长解阻路径：注册完成观察器后立即返回「仍在后台运行」。 */
+function backgroundResult(terminals, opts, command, partialText, durationSeconds, lang, termId = "ai-bash", persist = true, reason = "idle") {
+    terminals.watchOutput(termId, BASH_SENTINEL_RE, (m) => {
         // 后台命令最终结束（或终端被关）→ 清除待决标记，terminal_wait 不再适用。
-        terminals.setSentinelPending("ai-bash", false);
+        terminals.setSentinelPending(termId, false);
         opts.notifyBackgroundDone({
-            terminalId: "ai-bash",
+            terminalId: termId,
             command,
             exitCode: m ? Number(m[1]) : null,
         });
+        if (!persist) {
+            void terminals.inputChecked(termId, "exit\r");
+        }
     });
     // partialText 已在调用方做过 cleanBashOutput + applyTail。
     const partial = truncateMiddle(partialText, 6000);
     // 空输出占位按语言预渲染（issue #91 v2：vars 只收干净标识）。
     const partialZh = partial || "（暂无输出）";
     const partialEn = partial || "(no output yet)";
+    let descZh = "";
+    let descEn = "";
+    if (reason === "elapsed") {
+        descZh =
+            `命令仍在终端 ${termId} 中运行（前台执行已达 ${durationSeconds} 秒上限，自动转入后台）。` +
+                `本次调用不阻塞——命令继续在后台执行，结束时你会收到自动通知。\n` +
+                `已有输出：\n${partialZh}\n`;
+        descEn =
+            `Command still running in terminal ${termId} (foreground execution reached ${durationSeconds}s limit, moved to background). ` +
+                `This call does not block — the command keeps running in the background and you will be notified automatically when it finishes.\n` +
+                `Partial output:\n${partialEn}\n`;
+    }
+    else {
+        descZh =
+            `命令仍在持久终端 ${termId} 中运行（已连续 ${durationSeconds} 秒无输出，未结束）。` +
+                `本次调用不阻塞——命令继续在后台执行，结束时你会收到自动通知。\n` +
+                `已有输出：\n${partialZh}\n`;
+        descEn =
+            `Command still running in the persistent terminal ${termId} (no output for ${durationSeconds}s, not finished). ` +
+                `This call does not block — the command keeps running in the background and you will be notified automatically when it finishes.\n` +
+                `Partial output:\n${partialEn}\n`;
+    }
+    if (persist) {
+        descZh += `要重新阻塞等它结束就用 terminal_wait(terminalId="${termId}")（无需反复轮询）；需要交互用 terminal_input / terminal_key（Ctrl+C 可终止）。`;
+        descEn += `To block until it finishes, use terminal_wait(terminalId="${termId}") (no polling needed); use terminal_input / terminal_key to interact (Ctrl+C aborts).`;
+    }
+    else {
+        descZh += `命令完成后该终端将自动退出并发送通知；如需查看输出可用 terminal_read(terminalId="${termId}")。`;
+        descEn += `When completed, this terminal will exit automatically and notify; to inspect output, use terminal_read(terminalId="${termId}").`;
+    }
+    if (reason === "elapsed") {
+        return {
+            content: [
+                {
+                    type: "text",
+                    text: pick(lang, descZh, descEn, "terminals.bash.background.elapsed", {
+                        durationSeconds,
+                        partialZh,
+                        partialEn,
+                        termId,
+                    }),
+                },
+            ],
+            details: { running: true, terminalId: termId, persist, durationSeconds, reason },
+        };
+    }
     return {
         content: [
             {
                 type: "text",
-                text: pick(lang, `命令仍在持久终端 ai-bash 中运行（已连续 ${silentSeconds} 秒无输出，未结束）。` +
-                    `本次调用不阻塞——命令继续在后台执行，结束时你会收到自动通知。\n` +
-                    `已有输出：\n${partialZh}\n` +
-                    `要重新阻塞等它结束就用 terminal_wait(terminalId="ai-bash")（无需反复轮询）；需要交互用 terminal_input / terminal_key（Ctrl+C 可终止）。`, `Command still running in the persistent terminal ai-bash (no output for ${silentSeconds}s, not finished). ` +
-                    `This call does not block — the command keeps running in the background and you will be notified automatically when it finishes.\n` +
-                    `Partial output:\n${partialEn}\n` +
-                    `To block until it finishes, use terminal_wait(terminalId="ai-bash") (no polling needed); use terminal_input / terminal_key to interact (Ctrl+C aborts).`, "terminals.bash.background.running", { silentSeconds, partialZh, partialEn }),
+                text: pick(lang, descZh, descEn, "terminals.bash.background.running", {
+                    silentSeconds: durationSeconds,
+                    durationSeconds,
+                    partialZh,
+                    partialEn,
+                    termId,
+                }),
             },
         ],
-        details: { running: true, terminalId: "ai-bash", silentSeconds },
+        details: { running: true, terminalId: termId, persist, durationSeconds, reason },
     };
 }
 /** Agent 持久终端工具名（唯一登记见 tool-manager.ts；此处 re-export 保兼容）。 */

package/dist/server/tool-approval.js

@@ -0,0 +1,84 @@
+/**
+ * server/tool-approval.ts
+ *
+ * 人机协同拦截与「改写执行」（Human-in-the-Loop: Edit & Run）。
+ *
+ * 功能：
+ * 1. 高危操作识别与规则裁决（Dangerous Tool Call & Rule Evaluation）：
+ *    - 委托 server/approval-rules.ts 的规则引擎评估
+ *    - 支持三种动作：ask（弹窗审批）、deny（直接拒绝报错）、allow（白名单放行）
+ * 2. 审批事件挂起与答复处理（askApproval / resolveApproval）：
+ *    - 用户可「批准」（Approve）
+ *    - 用户可「拒绝」（Deny）
+ *    - 用户可就地修改参数后「修改并放行」（Edit & Run）
+ * 3. 三档放行策略（省去反复弹窗）：
+ *    - 全局关（设置 →「工具」页的「工具执行审批」总开关）→ 一律不弹；
+ *    - 本对话「全部允许」→ 该对话内一律不弹；
+ *    - 本对话「允许同类」→ 该对话内同一规则档位（category）不再弹。
+ *    策略只活在内存里（挂在 Conversation 上，过户随对话搬走），重启/新对话即恢复询问。
+ */
+import { DEFAULT_APPROVAL_RULES, evaluateApprovalRules } from "./approval-rules.js";
+/** 策略为空（既没全部允许也没记同类）：调用方据此不挂空策略、面板据此不显示撤销区。 */
+export function isApprovalPolicyEmpty(policy) {
+    return !policy || (!policy.allowAll && policy.categories.size === 0);
+}
+/**
+ * 三档放行的纯判定：返回 null = 需要弹审批，否则返回放行的原因。
+ * - `disabled`：全局开关关（设置 →「工具」页）→ 一切审批都不弹（插件显式 ask 也放行）；
+ * - `allow-all`：本对话已「全部允许」；
+ * - `category`：本对话已记住该同类档位。
+ */
+export function approvalSuppressionReason(policy, enabled, categoryId) {
+    if (!enabled)
+        return "disabled";
+    if (!policy)
+        return null;
+    if (policy.allowAll)
+        return "allow-all";
+    if (categoryId && policy.categories.has(categoryId))
+        return "category";
+    return null;
+}
+/** 插件显式要求确认（pre guard 的 ask）对应的档位：按插件 id 分档，可「允许同类」。 */
+export function pluginApprovalCategory(pluginId) {
+    return {
+        id: `plugin:${pluginId}`,
+        label: `插件 ${pluginId} 要求确认`,
+        labelEn: `Plugin ${pluginId} requested confirmation`,
+    };
+}
+/**
+ * 检测某个工具调用是否属于高危操作，或命中用户自定义规则。
+ * 可选接收 rules 规则集；缺省时以内置默认高危规则集判定。
+ */
+export function checkDangerousToolCall(toolName, params, cwd, workspaceRoots = [], rules) {
+    if (!params || typeof params !== "object") {
+        return { dangerous: false };
+    }
+    const res = evaluateApprovalRules(rules ?? DEFAULT_APPROVAL_RULES, toolName, params, cwd, workspaceRoots);
+    if (res.action === "deny") {
+        return {
+            dangerous: true,
+            denied: true,
+            reason: res.reason,
+            reasonEn: res.reasonEn,
+            category: res.category,
+        };
+    }
+    if (res.action === "allow") {
+        return {
+            dangerous: false,
+            allowed: true,
+        };
+    }
+    if (res.action === "ask") {
+        return {
+            dangerous: true,
+            denied: false,
+            reason: res.reason,
+            reasonEn: res.reasonEn,
+            category: res.category,
+        };
+    }
+    return { dangerous: false };
+}