s-app-scoder-agent 0.6.0 → 0.7.0

package/dist/model-catalog.js

@@ -0,0 +1,175 @@
+/**
+ * models.dev catalog (I-02) — model metadata: contextWindow, pricing,
+ * supportCache, supportReasoning.
+ *
+ * Source: anomalyco/opencode (packages/core/src/models-dev/) — pattern
+ * adapted. Sync from https://models.dev/api.json into ~/.scoder/
+ * models-cache.json (TTL 24h); offline fallback = small built-in snapshot.
+ */
+import { readFileSync, writeFileSync, renameSync, existsSync, mkdirSync, statSync } from "node:fs";
+import { homedir } from "node:os";
+import { join } from "node:path";
+const CACHE_PATH = join(homedir(), ".scoder", "models-cache.json");
+const TTL_MS = 24 * 60 * 60 * 1000;
+const CATALOG_URL = "https://models.dev/api.json";
+/** Offline snapshot — ~25 popular models (fallback when fetch fails / no network). */
+const FALLBACK = [
+    { id: "gpt-4o", provider: "openai", contextWindow: 128_000, input: 2.5, output: 10 },
+    { id: "gpt-4o-mini", provider: "openai", contextWindow: 128_000, input: 0.15, output: 0.6 },
+    { id: "gpt-4.1", provider: "openai", contextWindow: 1_047_576, input: 2, output: 8 },
+    { id: "gpt-4.1-mini", provider: "openai", contextWindow: 1_047_576, input: 0.4, output: 1.6 },
+    { id: "o3", provider: "openai", contextWindow: 200_000, input: 2, output: 8, reasoning: true },
+    { id: "o4-mini", provider: "openai", contextWindow: 200_000, input: 1.1, output: 4.4, reasoning: true },
+    { id: "claude-sonnet-4-5", provider: "anthropic", contextWindow: 200_000, input: 3, output: 15, cache: true, reasoning: true },
+    { id: "claude-opus-4-1", provider: "anthropic", contextWindow: 200_000, input: 15, output: 75, cache: true, reasoning: true },
+    { id: "claude-haiku-4-5", provider: "anthropic", contextWindow: 200_000, input: 1, output: 5, cache: true, reasoning: true },
+    { id: "claude-3-5-haiku", provider: "anthropic", contextWindow: 200_000, input: 0.8, output: 4, cache: true },
+    { id: "gemini-2.5-pro", provider: "google", contextWindow: 1_048_576, input: 1.25, output: 10, reasoning: true },
+    { id: "gemini-2.5-flash", provider: "google", contextWindow: 1_048_576, input: 0.3, output: 2.5, reasoning: true },
+    { id: "deepseek-chat", provider: "deepseek", contextWindow: 128_000, input: 0.27, output: 1.1 },
+    { id: "deepseek-reasoner", provider: "deepseek", contextWindow: 128_000, input: 0.55, output: 2.19, reasoning: true },
+    { id: "glm-4.6", provider: "zai", contextWindow: 200_000, input: 0.6, output: 2.2, reasoning: true },
+    { id: "glm-4.5-air", provider: "zai", contextWindow: 128_000, input: 0.2, output: 1.1 },
+    { id: "qwen3-coder", provider: "qwen", contextWindow: 262_144, input: 0.3, output: 1.2 },
+    { id: "kimi-k2", provider: "moonshotai", contextWindow: 200_000, input: 0.6, output: 2.5 },
+    { id: "llama-3.3-70b", provider: "groq", contextWindow: 131_072, input: 0.59, output: 0.79 },
+    { id: "llama-4-scout", provider: "groq", contextWindow: 131_072, input: 0.11, output: 0.34 },
+    { id: "mistral-large", provider: "mistral", contextWindow: 128_000, input: 2, output: 6 },
+    { id: "command-r-plus", provider: "cohere", contextWindow: 128_000, input: 2.5, output: 10 },
+    { id: "jamba-1.5-large", provider: "ai21", contextWindow: 256_000, input: 2, output: 8 },
+    { id: "grok-4", provider: "xai", contextWindow: 256_000, input: 3, output: 15, reasoning: true },
+    { id: "nova-pro", provider: "amazon", contextWindow: 300_000, input: 0.8, output: 3.2 },
+];
+function key(provider, id) {
+    return `${provider}/${id}`;
+}
+function fromFallback() {
+    const models = {};
+    for (const m of FALLBACK) {
+        models[key(m.provider, m.id)] = {
+            id: m.id,
+            provider: m.provider,
+            contextWindow: m.contextWindow,
+            pricing: { input: m.input, output: m.output },
+            supportCache: m.cache === true,
+            supportReasoning: m.reasoning === true,
+        };
+    }
+    return { fetchedAt: 0, models };
+}
+/** Read the cache file; null when missing/malformed. */
+function readCache() {
+    if (!existsSync(CACHE_PATH))
+        return null;
+    try {
+        const c = JSON.parse(readFileSync(CACHE_PATH, "utf8"));
+        if (typeof c.fetchedAt !== "number" || typeof c.models !== "object")
+            return null;
+        return c;
+    }
+    catch {
+        return null;
+    }
+}
+function writeCache(c) {
+    try {
+        mkdirSync(join(CACHE_PATH, ".."), { recursive: true });
+        const tmp = `${CACHE_PATH}.tmp`;
+        writeFileSync(tmp, JSON.stringify(c));
+        renameSync(tmp, CACHE_PATH);
+    }
+    catch { /* best-effort */ }
+}
+/** Fetch models.dev and update the cache. Returns null on failure. */
+async function fetchCatalog() {
+    try {
+        const res = await fetch(CATALOG_URL, { signal: AbortSignal.timeout(10_000) });
+        if (!res.ok)
+            return null;
+        const raw = (await res.json());
+        const models = {};
+        for (const [provider, entry] of Object.entries(raw)) {
+            for (const [id, m] of Object.entries(entry.models ?? {})) {
+                models[key(provider, id)] = {
+                    id,
+                    provider,
+                    contextWindow: m.limit?.context ?? 128_000,
+                    maxTokens: m.limit?.output,
+                    pricing: m.cost ? { input: m.cost.input ?? 0, output: m.cost.output ?? 0 } : undefined,
+                    supportCache: m.cache === true,
+                    supportReasoning: m.reasoning === true,
+                };
+            }
+        }
+        if (Object.keys(models).length === 0)
+            return null;
+        return { fetchedAt: Date.now(), models };
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * Load the catalog: cache (fresh ≤24h) → fetch → fallback snapshot.
+ * Never throws; offline-safe.
+ */
+export async function loadCatalog(forceRefresh = false) {
+    if (!forceRefresh) {
+        const cached = readCache();
+        if (cached && Date.now() - cached.fetchedAt < TTL_MS) {
+            return { models: cached.models, source: "cache" };
+        }
+    }
+    const fresh = await fetchCatalog();
+    if (fresh) {
+        writeCache(fresh);
+        return { models: fresh.models, source: "network" };
+    }
+    const stale = readCache();
+    if (stale)
+        return { models: stale.models, source: "cache" };
+    return { models: fromFallback().models, source: "fallback" };
+}
+/** Synchronous metadata lookup — cache then fallback (never fetches). */
+export function lookupModel(provider, id) {
+    const cached = readCache();
+    if (cached) {
+        const m = cached.models[key(provider, id)];
+        if (m)
+            return m;
+    }
+    const fb = fromFallback();
+    // Exact key, then bare-id match across providers.
+    return fb.models[key(provider, id)] ?? fb.models[key("openai", id)] ?? null;
+}
+/** contextWindow for the compaction budget (I-02 → H-10). Fallback 128k. */
+export function contextWindowFor(provider, id) {
+    return lookupModel(provider, id)?.contextWindow ?? 128_000;
+}
+/** Catalog age in hours (for `scoder models --refresh` UX). -1 when no cache. */
+export function cacheAgeHours() {
+    if (!existsSync(CACHE_PATH))
+        return -1;
+    try {
+        return (Date.now() - statSync(CACHE_PATH).mtimeMs) / 3_600_000;
+    }
+    catch {
+        return -1;
+    }
+}
+/** I6: TTL cho refresh() — 1h. */
+const REFRESH_TTL_MS = 3_600_000;
+/** Monotonic last-refresh stamp (process lifetime — tránh re-fetch mỗi lookup). */
+let lastRefreshAt = 0;
+/**
+ * I6: đảm bảo catalog tươi (TTL 1h) — process dùng lâu (server/TUI) gọi trước
+ * khi tra cứu. Cache còn mới → no-op. Lỗi network → giữ catalogue hiện có
+ * (không bao giờ throw). Returns source hiện hành.
+ */
+export async function refreshCatalog() {
+    if (Date.now() - lastRefreshAt < REFRESH_TTL_MS)
+        return "cache";
+    const r = await loadCatalog(false);
+    lastRefreshAt = Date.now();
+    return r.source;
+}

package/dist/permissions.js

@@ -5,6 +5,7 @@
  * Cung cấp 3 mode: auto (run everything), ask (prompt for shell commands), readonly.
  * Luôn deny catastrophic commands bất kể mode nào.
  */
+import { createRequire } from "node:module";
 import { createInterface } from "node:readline";
 // ---------------------------------------------------------------------------
 // Catastrophic command patterns — always denied, no exceptions
@@ -32,6 +33,7 @@ const CATASTROPHIC_PATTERNS = [
     /chmod\s+-R\s+0[77][07][07]\s+[/~]/i,
     // chmod -R 777 on / or ~ (any flag spelling: -R, -r, -Rf, --recursive)
     /\bchmod\s+(?:-{1,2}[\w-]+\s+)+[0-7]{3,4}\s+["']?[/~](?:\s|$|\/)/,
+    /\bchmod\s+--recursive\s+[0-7]{3,4}\s+\/(?!home\/)[^\n]*/,
     // Redirect raw writes to block devices: > /dev/sda, > /dev/nvme0n1, dd > disk...
     />\s*\/dev\/(?:sd[a-z]+|hd[a-z]+|nvme\d+n\d+(?:p\d+)?|disk\d|rdisk\d)/i,
     /:\s*\(\s*\)\s*\{\s*:\s*\|\s*:\s*&\s*\}\s*;/i,
@@ -49,10 +51,72 @@ const CATASTROPHIC_PATTERNS = [
     /\|\s*bash\s+-i/i,
     /sysctl\s+-w\s+kernel\.panic=/i,
     /echo\s+[^|]*>\s*\/etc\/sudoers/i,
+    // H-13 additions: remote-code-exec variants + macOS host tampering
+    /curl\s+.*[/.].*\s*\|\s*python(?:\d)?\b/i,
+    /wget\s+.*[/.].*\s*\|\s*python(?:\d)?\b/i,
+    /\bpowershell(?:\.exe)?\s+(-enc|-e\b|-encodedcommand\b)/i,
+    /\bdscl\s+\.\s+-create\s+\/Users\//i,
+    /\bdefaults\s+write\s+com\.apple/i,
+    /\bmv\s+(-\w+\s+)*["']?~(?:\s|$|\/(?!Projects|work))/,
+    /\bcurl\s+.*[/.].*\s*\|\s*python3?\s+-c\b/i,
+    /\bperl\s+-e\b.*\bsystem\s*\(/i,
 ];
 function isCatastrophic(command) {
     return CATASTROPHIC_PATTERNS.some((p) => p.test(command));
 }
+/** Wildcard match: supports * (any run) and ? (single char). */
+export function wildcardMatch(pattern, value) {
+    if (pattern === "*")
+        return true;
+    if (!pattern.includes("*") && !pattern.includes("?")) {
+        // Literal match — also accept prefix semantics for shell resources
+        // ("npm " allows "npm run build") to stay compatible with legacy lists.
+        return value === pattern || value.startsWith(pattern);
+    }
+    const rx = new RegExp("^" +
+        pattern
+            .split("")
+            .map((c) => c === "*" ? "[\\s\\S]*" : c === "?" ? "." : c.replace(/[.+^${}()|[\]\\]/g, "\\$&"))
+            .join("") +
+        "$");
+    return rx.test(value);
+}
+export function matchRule(rules, action, resource) {
+    let effect = null;
+    for (const r of rules) {
+        // Action match: exact, or a wildcard action pattern (e.g. "mcp__prompt-gate__*").
+        if (r.action !== action && !wildcardMatch(r.action, action))
+            continue;
+        if (!wildcardMatch(r.resource, resource))
+            continue;
+        effect = r.effect; // last match wins
+    }
+    return effect;
+}
+/**
+ * Aggregate a multi-resource operation (a shell command produces several
+ * subcommand resources): deny wins over ask wins over allow; null when no
+ * rule matched at all.
+ */
+export function aggregate(effects) {
+    if (effects.length === 0)
+        return null;
+    let sawAsk = false;
+    let sawAllow = false;
+    for (const e of effects) {
+        if (e === "deny")
+            return "deny";
+        if (e === "ask")
+            sawAsk = true;
+        if (e === "allow")
+            sawAllow = true;
+    }
+    if (sawAsk)
+        return "ask";
+    if (sawAllow)
+        return "allow";
+    return null;
+}
 export function isDangerousCommand(command) {
     return isCatastrophic(command);
 }
@@ -82,40 +146,22 @@ function extractFirstWord(command) {
 /**
  * Classify a command given current permission config and session allowlist.
  */
+/**
+ * G2: classifyCommand đã bị xoá — dùng `PermissionChecker.classify()`.
+ * Giữ lại chỉ vì test cũ; body chuyển hướng sang checker thuần (không
+ * config lists — G2 lists là builtin rules trong checker).
+ */
 export function classifyCommand(command, mode, configAllow, configDeny, sessionAllow) {
-    const safeFirst = extractFirstWord(command);
-    // 1. Catastrophic — always deny
-    if (isCatastrophic(command)) {
-        return { decision: "deny", reason: "matches catastrophic command pattern" };
-    }
-    // 2. Config deny list
-    if (configDeny.some((p) => command.startsWith(p.trim()))) {
-        return { decision: "deny", reason: "matches denyCommands pattern in config" };
-    }
-    // 3. Session allowlist
-    if (sessionAllow.hasMatch(command)) {
+    // Reconstruct semantics qua rule engine: lists → builtin rules.
+    const checker = new PermissionChecker({
+        mode,
+        allowCommands: configAllow,
+        denyCommands: configDeny,
+        nonInteractive: true,
+    });
+    if (sessionAllow.hasMatch(command))
         return { decision: "allow", reason: "allowed by session allowlist" };
-    }
-    // 4. Config allow list
-    if (configAllow.some((p) => command.startsWith(p.trim()))) {
-        return { decision: "allow", reason: "allowed by config allowCommands" };
-    }
-    // 5. Mode-dependent
-    switch (mode) {
-        case "auto":
-            return { decision: "allow", reason: "auto mode — run without confirmation" };
-        case "readonly":
-            return {
-                decision: "deny",
-                reason: "readonly mode — shell commands are disabled",
-            };
-        case "ask":
-            return {
-                decision: "ask",
-                reason: "requires user confirmation",
-                alwaysAllowPrefix: safeFirst + " ",
-            };
-    }
+    return checker.classify(command);
 }
 /**
  * Prompt user for permission. Returns true/false. "always" is signaled via
@@ -195,19 +241,212 @@ export async function promptForPermission(opts, onAlwaysAllow) {
         catch { /* already closed */ }
     }
 }
+/**
+ * G2: legacy allow/deny prefix lists → builtin rules (last-match-wins:
+ * deny list đặt sau allow list để deny luôn thắng khi cả hai khớp).
+ * Được append SAU user rules trong activeRules() — giữ nguyên ngữ nghĩa cũ
+ * (config lists override rules cho prefix trùng).
+ */
+function builtinRulesFromLists(allow, deny) {
+    const toRules = (list, effect) => list.filter((p) => p.trim().length > 0).map((p) => ({ action: "shell", resource: p.trim(), effect }));
+    return [...toRules(allow, "allow"), ...toRules(deny, "deny")];
+}
 export class PermissionChecker {
     config;
     sessionAllow = new SessionAllowlist();
     allowAllEdits = false;
+    /**
+     * T-03: programmatic prompt hook (TUI). When set, confirm/confirmEdit/
+     * confirmAsk route through it instead of readline stdin (which corrupts
+     * alt-screen). Returns a Promise resolved by the frontend modal.
+     */
+    promptHandler = null;
     constructor(config) {
         this.config = config;
     }
+    /** Dispatch to promptHandler with timeout ⇒ deny (safe default). */
+    async ask(req) {
+        if (!this.promptHandler)
+            return false; // no handler in alt-screen = deny
+        try {
+            // T3: timeout enforced HERE (checker-level) — a hung frontend handler
+            // (TUI modal never answered, server client disconnected) must not leak
+            // the pending permission promise forever.
+            const answer = await Promise.race([
+                this.promptHandler(req),
+                new Promise((_, rej) => setTimeout(() => {
+                    const e = new Error("permission handler timed out");
+                    e.name = "AbortError";
+                    rej(e);
+                }, req.timeoutSecs * 1000)),
+            ]);
+            if (answer === "quit")
+                this.abortRequested = true;
+            if (answer === "always" && req.kind === "edit")
+                this.allowAllEdits = true;
+            if (answer === "always" && req.kind === "shell" && req.alwaysAllowPrefix) {
+                this.sessionAllow.addPrefix(req.alwaysAllowPrefix);
+            }
+            return answer === "yes" || answer === "always";
+        }
+        catch {
+            return false; // handler error/timeout — deny
+        }
+    }
+    /** Rules for one evaluation: config rules + saved rules (config wins on deny). */
+    activeRules() {
+        // G2: legacy allow/deny lists trở thành builtin rules (priority thấp
+        // nhất — user/saved rules override). Deny list sau allow list trong
+        // builtin để deny thắng khi cả hai khớp (last-match-wins).
+        return [
+            ...builtinRulesFromLists(this.config.allowCommands, this.config.denyCommands),
+            ...(this.config.savedRules ?? []),
+            ...(this.config.rules ?? []),
+        ];
+    }
+    /**
+     * Policy hard-floor check: policy deny wins over everything except the
+     * catastrophic list; policy allow bypasses ask-requirements.
+     */
+    policyEffect(action, resource) {
+        if (!this.config.policyRules || this.config.policyRules.length === 0)
+            return null;
+        return matchRule(this.config.policyRules, action, resource);
+    }
+    /**
+     * Rule-engine classify for a (action, resource) pair.
+     * Order: config/saved rules (last match wins) → mode fallback.
+     * Returns null when nothing matched (caller decides via mode).
+     */
+    classifyAction(action, resource) {
+        const effect = matchRule(this.activeRules(), action, resource);
+        if (effect === "deny")
+            return { decision: "deny", reason: `denied by permission rule (${action}: ${resource})` };
+        if (effect === "allow")
+            return { decision: "allow", reason: `allowed by permission rule (${action}: ${resource})` };
+        if (effect === "ask")
+            return { decision: "ask", reason: `requires approval by permission rule (${action}: ${resource})` };
+        return null;
+    }
     /**
-     * Check if a command should run. Returns null = allowed immediately,
-     * or a PermissionResult if user needs to be consulted.
+     * G5: unified MCP tool decision — policy floor → rules → null (caller
+     * falls back to mode). Every mcp__* call goes through here; no bypass.
      */
+    classifyMcpTool(fullName) {
+        const policy = this.policyEffect(fullName, "*");
+        if (policy === "deny")
+            return { decision: "deny", reason: "denied by policy (hard floor)" };
+        if (policy === "allow")
+            return { decision: "allow", reason: "allowed by policy" };
+        return this.classifyAction(fullName, "*");
+    }
+    /** Shell decision: policy floor → rules → legacy lists/mode. */
     classify(command) {
-        return classifyCommand(command, this.config.mode, this.config.allowCommands, this.config.denyCommands, this.sessionAllow);
+        // Catastrophic deny is the absolute floor.
+        if (isCatastrophic(command)) {
+            return { decision: "deny", reason: "matches catastrophic command pattern" };
+        }
+        // Policy deny wins over everything (enterprise hard floor).
+        const policy = this.policyEffect("shell", command);
+        if (policy === "deny")
+            return { decision: "deny", reason: "denied by policy (hard floor)" };
+        if (policy === "allow") {
+            const deny = matchRule(this.activeRules(), "shell", command);
+            if (deny === "deny")
+                return { decision: "deny", reason: "denied by permission rule" };
+            return { decision: "allow", reason: "allowed by policy" };
+        }
+        if (policy === "ask") {
+            const deny = matchRule(this.activeRules(), "shell", command);
+            if (deny === "deny")
+                return { decision: "deny", reason: "denied by permission rule" };
+            const allow = matchRule(this.activeRules(), "shell", command);
+            if (allow === "allow")
+                return { decision: "allow", reason: "allowed by permission rule" };
+            return { decision: "ask", reason: "requires approval by policy", alwaysAllowPrefix: extractFirstWord(command) + " " };
+        }
+        // G2: một đường duy nhất — rules (bao gồm builtin từ allow/deny lists,
+        // last-match-wins) → mode fallback. Session allowlist map thành rule allow.
+        if (this.sessionAllow.hasMatch(command)) {
+            return { decision: "allow", reason: "allowed by session allowlist" };
+        }
+        const ruleEffect = matchRule(this.activeRules(), "shell", command);
+        if (ruleEffect === "allow")
+            return { decision: "allow", reason: "allowed by permission rule" };
+        if (ruleEffect === "deny")
+            return { decision: "deny", reason: "denied by permission rule" };
+        if (ruleEffect === "ask") {
+            return { decision: "ask", reason: "requires approval by permission rule", alwaysAllowPrefix: extractFirstWord(command) + " " };
+        }
+        switch (this.config.mode) {
+            case "auto":
+                return { decision: "allow", reason: "auto mode — run without confirmation" };
+            case "readonly":
+                return { decision: "deny", reason: "readonly mode — shell commands are disabled" };
+            case "ask":
+                return { decision: "ask", reason: "requires user confirmation", alwaysAllowPrefix: extractFirstWord(command) + " " };
+        }
+    }
+    /**
+     * Shell decision with AST scanner (pattern from opencode: every extracted
+     * subcommand is checked individually; scanner errors ⇒ ask, never execute
+     * unverified). Falls back to whole-line rules when the scanner is
+     * unavailable (e.g. native module failed to load).
+     */
+    classifyShell(command) {
+        // Catastrophic deny is the absolute floor — before scanner/splitting.
+        if (isCatastrophic(command)) {
+            return { decision: "deny", reason: "matches catastrophic command pattern" };
+        }
+        let scan;
+        try {
+            // Lazy require so a broken native build degrades instead of crashing.
+            // (ESM dist — plain `require` is undefined; use createRequire.)
+            const req = createRequire(import.meta.url);
+            const { scanCommand } = req("./shell-scanner.js");
+            scan = scanCommand(command);
+        }
+        catch {
+            scan = null; // scanner unavailable — fall back to whole-line behavior
+        }
+        if (scan && !scan.ok) {
+            return {
+                decision: "ask",
+                reason: `shell scanner: ${scan.error}`,
+                alwaysAllowPrefix: extractFirstWord(command) + " ",
+            };
+        }
+        if (scan && scan.ok && scan.commandLines.length > 1) {
+            // Compound command — aggregate per-subcommand rule effects.
+            const effects = scan.commandLines.map((l) => {
+                const e = matchRule(this.activeRules(), "shell", l);
+                if (e)
+                    return e;
+                // No rule for this subcommand → fall back to whole-line decision chain
+                // to keep legacy behavior (allowCommands/denyCommands prefixes).
+                return this.classify(l).decision;
+            });
+            const agg = aggregate(effects);
+            if (agg) {
+                return {
+                    decision: agg,
+                    reason: `compound command (${scan.commandLines.length} subcommands) — aggregated: ${agg}`,
+                    alwaysAllowPrefix: agg === "ask" ? extractFirstWord(command) + " " : undefined,
+                };
+            }
+        }
+        // Dynamic eval without a rule → ask (never execute unverified dynamic code).
+        if (scan?.ok && scan.hasDynamicEval) {
+            const e = matchRule(this.activeRules(), "shell", command);
+            if (e !== "allow") {
+                return {
+                    decision: "ask",
+                    reason: "dynamic evaluation (eval/source) — approval required",
+                    alwaysAllowPrefix: extractFirstWord(command) + " ",
+                };
+            }
+        }
+        return this.classify(command);
     }
     /**
      * Ask user interactively. Returns true = allowed, false = denied.
@@ -224,6 +463,16 @@ export class PermissionChecker {
             // In non-interactive (CI), deny commands that need asking
             return false;
         }
+        // T-03: programmatic handler (TUI) — no stdin readline.
+        if (this.promptHandler) {
+            return this.ask({
+                kind: "shell",
+                label: command.length > 80 ? command.slice(0, 80) + "..." : command,
+                command,
+                alwaysAllowPrefix: result.alwaysAllowPrefix,
+                timeoutSecs: 60,
+            });
+        }
         return promptForPermission({
             command,
             alwaysAllowPrefix: result.alwaysAllowPrefix,
@@ -240,9 +489,30 @@ export class PermissionChecker {
     async confirmEdit(path, diffText, timeoutSecs = 120) {
         if (this.allowAllEdits)
             return true;
+        // Rule engine for edit action (deny wins, ask prompts, allow skips).
+        const ruleDecision = this.classifyAction("edit", path);
+        if (ruleDecision?.decision === "deny")
+            return false;
+        if (ruleDecision?.decision === "allow")
+            return true;
+        // Policy floor for edit.
+        const policy = this.policyEffect("edit", path);
+        if (policy === "deny")
+            return false;
+        if (policy === "allow")
+            return true;
         if (this.config.nonInteractive) {
             return false;
         }
+        // T-03: programmatic handler (TUI) — modal shows the diff.
+        if (this.promptHandler) {
+            return this.ask({
+                kind: "edit",
+                label: path,
+                diff: diffText.length > 4000 ? diffText.slice(0, 4000) + "\n… (truncated)" : diffText,
+                timeoutSecs,
+            });
+        }
         const ac = new AbortController();
         const timer = setTimeout(() => ac.abort(), timeoutSecs * 1000);
         const rl = createInterface({ input: process.stdin, output: process.stdout, signal: ac.signal });
@@ -293,6 +563,29 @@ export class PermissionChecker {
             catch { /* already closed */ }
         }
     }
+    /** Ask user to approve an MCP tool call; "always" persists via onAlways callback. */
+    async confirmMcpTool(fullName, onAlwaysAllow) {
+        return this.confirmAsk(`MCP tool ${fullName}`, onAlwaysAllow);
+    }
+    /**
+     * Generic interactive ask (used for MCP tool approval etc.). Reuses the
+     * same readline prompt as shell confirm. onAlways is invoked when the
+     * user answers "a" (persist a saved approval).
+     */
+    async confirmAsk(label, onAlways) {
+        if (this.config.nonInteractive)
+            return false;
+        // T-03: programmatic handler (TUI).
+        if (this.promptHandler) {
+            const ok = await this.ask({ kind: "mcp", label, timeoutSecs: 60 });
+            if (ok && onAlways)
+                onAlways();
+            return ok;
+        }
+        return promptForPermission({ command: label, alwaysAllowPrefix: undefined }, 
+        // promptForPermission passes a prefix; we only need the "a" signal.
+        () => onAlways?.());
+    }
     /** Set when the user pressed [q]uit in confirmEdit — the agent should stop. */
     abortRequested = false;
 }

package/dist/prompt-builder.js

@@ -0,0 +1,47 @@
+/**
+ * I3: Prompt builder — lắp system prompt từ các phần: base + env snapshot +
+ * skills advertised + subagents. Module thuần (chỉ spawnSync git), test được
+ * độc lập. Trước đây logic này rải trong agent.ts (~50 dòng).
+ */
+import { spawnSync } from "node:child_process";
+import { formatSkillIndex } from "./skills.js";
+/** One-line environment snapshot for the system prompt (cache-stable per run). */
+export function buildEnvInfo(workdir) {
+    let git = "";
+    try {
+        const branch = spawnSync("git", ["rev-parse", "--abbrev-ref", "HEAD"], { cwd: workdir, encoding: "utf8" });
+        if (branch.status === 0)
+            git = ` · git:${branch.stdout.trim()}`;
+    }
+    catch {
+        /* git unavailable */
+    }
+    return `Environment: ${process.platform} · node ${process.version}${git} · today ${new Date().toISOString().slice(0, 10)}`;
+}
+/** Skills advertised in system prompt (passive listing only — agent does NOT auto-load). */
+export function buildSkillsBlock(skills) {
+    if (skills.length === 0)
+        return "";
+    return (`\n\nAVAILABLE SKILLS (load with /skill <name> or when the task clearly matches a skill domain):\n${formatSkillIndex(skills)}\n` +
+        "Only load a skill when the user explicitly requests it with /skill, or when the task description clearly matches a skill's domain. Do NOT load skills merely because they are listed.");
+}
+/** Subagents khả dụng (task tool) — chỉ khi agent được phép spawn. */
+export function buildAgentsBlock(agents, allowSubagents) {
+    const usable = agents.filter((a) => a.mode !== "subagent" || a.name === "explore");
+    if (!allowSubagents || usable.length === 0)
+        return "";
+    return (`\n\nSUBAGENTS (via the task tool — delegate focused sub-work):\n` +
+        usable.map((a) => `  ${a.name.padEnd(12)} ${a.description}`).join("\n") +
+        "\nDelegate exploration or planning when it keeps the main loop focused.");
+}
+/** MCP servers advertised in system prompt (passive listing only — never auto-used). */
+export function buildMcpBlock(config) {
+    const servers = Object.keys(config.mcpServers ?? {});
+    if (servers.length === 0)
+        return "";
+    return (`\n\nMCP SERVERS (available tools — use mcp__<server>__<tool> ONLY when the task explicitly requires external integration):\n` +
+        servers.map((n) => `- ${n}`).join("\n") +
+        "\nDo NOT call MCP tools unless the user explicitly asks for external integration or the task requires it.");
+}
+/** Ghép phần động vào system prompt gốc (buildSystemPrompt giữ ở prompt.ts). */
+export { buildSystemPrompt } from "./prompt.js";