scream-code 0.18.1 → 0.18.2

package/dist/{dispatch-FYZpdI9u.mjs → dispatch-BbGcQ7_2.mjs}

@@ -6,7 +6,7 @@ const __dirname = __cjsShimDirname(__filename);
 import { i as __require, o as __toESM, r as __exportAll, t as __commonJSMin } from "./chunk-D90kvbyJ.mjs";
 import { A as sharedMemoStore, B as buildProjectTagCloud, C as applyConsolidation, D as parseMemoryMemos, E as buildExitExtractionPrompt, F as probeLocalEmbeddingSupport, G as join$1, H as basename$1, I as createMemoryMemo, J as relative$1, K as normalize, L as toSummary, M as clearEmbeddingModelCache, N as createFastEmbedEngine, O as stripMemoryTags, P as hasEmbeddingModelCache$1, R as generateTags, S as DreamTracker, T as EXIT_EXTRACTION_SYSTEM_PROMPT, U as dirname$2, V as rankMemos, W as isAbsolute$1, Y as resolve$2, a as isSupportedFile, b as sharedKnowledgeStoreReady, i as ingestFile, j as classifyEmbeddingFailure, k as MemoryMemoStore, q as parse$7, r as ingestDirectory, t as multiSearch, w as buildConsolidationPlan, y as sharedKnowledgeStore, z as normalizeTags } from "./src-C7C9e5Ds.mjs";
 import { n as require_base64_js, t as XMLParser } from "./XMLParser-DFAnGqkc.mjs";
-import { a as setLocale, i as getLocale, n as assertScreamHostIdentity, o as t, r as createScreamDefaultHeaders, t as TextInputDialogComponent } from "./text-input-dialog-Bu8GPguU.mjs";
+import { a as setLocale, i as getLocale, n as assertScreamHostIdentity, o as t, r as createScreamDefaultHeaders, t as TextInputDialogComponent } from "./text-input-dialog-Dw-Cl3DW.mjs";
 import { createRequire } from "node:module";
 import { createHash, randomBytes, randomInt, randomUUID } from "node:crypto";
 import * as fs$1 from "node:fs/promises";
@@ -68001,7 +68001,10 @@ const PermissionRuleSchema = z.object({
 	pattern: z.string().min(1).refine(isValidPermissionPattern, { message: "Invalid permission rule pattern" }),
 	reason: z.string().optional()
 });
-const PermissionConfigSchema = z.object({ rules: z.array(PermissionRuleSchema).optional() });
+const PermissionConfigSchema = z.object({
+	rules: z.array(PermissionRuleSchema).optional(),
+	egressAllowlist: z.array(z.string()).optional()
+});
 const LoopControlSchema = z.object({
 	maxStepsPerTurn: z.number().int().min(0).optional(),
 	maxRetriesPerStep: z.number().int().min(0).optional(),
@@ -87483,6 +87486,216 @@ var AutoModeAskUserQuestionDenyPermissionPolicy = class {
 	}
 };
 //#endregion
+//#region ../../packages/agent-core/src/agent/permission/policies/private-read-egress-ask.ts
+/**
+* Hosts that may receive data even after the session read private data from
+* outside the workspace. Merged (union) with the user's configured
+* `permission.egressAllowlist`.
+*/
+const DEFAULT_EGRESS_ALLOWLIST = [
+	"github.com",
+	"api.github.com",
+	"raw.githubusercontent.com",
+	"registry.npmjs.org",
+	"pypi.org",
+	"files.pythonhosted.org",
+	"wikipedia.org",
+	"localhost",
+	"127.0.0.1",
+	"[::1]"
+];
+/**
+* Shared guard condition: returns an assessment when this call would move
+* private-read data to a destination that is not allowlisted, undefined when
+* the call is clean (or not an egress call at all).
+*
+* Two callers keep the same semantics:
+* - `PrivateReadEgressAskPermissionPolicy` — prompt the user (once or
+*   session), even in auto/yolo mode;
+* - bot mode — deny instead, because no human is there to answer a prompt.
+*
+* Fail-closed details:
+* - a candidate private read that has not settled yet counts as taint: every
+*   call in one tool batch is authorized before any result is finalized, so
+*   a same-batch `[Read /tmp/secret, Bash(curl …)]` must not slip through;
+* - every destination found in the call must be allowlisted — one unknown
+*   host in a command is enough to ask;
+* - a command whose destination cannot be extracted counts as unrecognized,
+*   never as allowlisted.
+*/
+function assessPrivateReadEgress(agent, context) {
+	const permission = agent.permission;
+	if (permission.taintedPrivateReads.length === 0 && !permission.hasPendingPrivateReads()) return;
+	const hosts = egressHosts(context);
+	if (hosts === void 0) return void 0;
+	if (hasMatchingSessionGrant(agent, context)) return void 0;
+	if (hosts.length === 0) return {
+		reason: egressReason(void 0),
+		targetKnown: false
+	};
+	const allowlist = egressAllowlist(agent);
+	const blocked = hosts.find((host) => !isAllowedEgressHost(host, allowlist));
+	if (blocked === void 0) return void 0;
+	return {
+		reason: egressReason(blocked),
+		targetKnown: true
+	};
+}
+/**
+* Once the session has successfully read data from outside the workspace,
+* sending anything to a host outside the allowlist asks first — the data may
+* have come from a private file, and an unrecognized destination cannot be
+* assumed safe.
+*
+* The chain position is the mechanism (see `createPermissionDecisionPolicies`):
+* the policy sits after `collaboration-auto-approve` and before
+* `auto-mode-approve`, so it fires even in unattended auto mode; the allowlist,
+* not the chain, is what keeps ordinary auto-mode work quiet. It sits before
+* `session-approval-history` as well, so only a memorized grant that matches
+* this exact call can silence it.
+*
+* Egress detection is deliberately narrow (MVP): `FetchURL` and the shell
+* download/remote verbs in `Bash`. Known blind spots, kept here so the next
+* batch starts from the list: egress through python, RunScript or MCP tools;
+* shell reads without a read verb or without an absolute path — `cd / && cat
+* .env`, `curl -d @file`, `-T`, `dd`; `WebSearch`/`PaperSearch` are not judged
+* as egress either, so a tainted session still reaches the network through
+* them (consistent with the allowlist being about hosts, registered as an
+* observation); and encoding tricks that hide a host or a path from the
+* command text.
+*/
+var PrivateReadEgressAskPermissionPolicy = class {
+	agent;
+	name = "private-read-egress-ask";
+	constructor(agent) {
+		this.agent = agent;
+	}
+	evaluate(context) {
+		const assessment = assessPrivateReadEgress(this.agent, context);
+		if (assessment === void 0) return;
+		return {
+			kind: "ask",
+			reason: {
+				private_read_egress: true,
+				target_known: assessment.targetKnown
+			},
+			reasons: [assessment.reason],
+			grantOptions: ["once", "session"]
+		};
+	}
+};
+/** Built-in hosts plus the configured ones; configuration only widens. */
+function egressAllowlist(agent) {
+	const configured = agent.screamConfig?.permission?.egressAllowlist;
+	if (configured === void 0 || configured.length === 0) return DEFAULT_EGRESS_ALLOWLIST;
+	return [...DEFAULT_EGRESS_ALLOWLIST, ...configured];
+}
+/** A memorized approve-for-session grant that matches this call wins. */
+function hasMatchingSessionGrant(agent, context) {
+	return agent.permission.sessionApprovalRulePatterns.some((pattern) => matchPermissionRule({
+		rule: {
+			decision: "allow",
+			scope: "session-runtime",
+			pattern,
+			reason: "approve for session"
+		},
+		toolName: context.toolCall.name,
+		execution: context.execution
+	}) !== void 0);
+}
+/**
+* Destinations this call sends to, or undefined when the call is not egress:
+*
+* - `FetchURL` — the URL argument; an unparsable URL yields no destination
+*   (unrecognized).
+* - `Bash` — a download/remote verb (curl, wget, nc, netcat, ssh, scp,
+*   rsync, telnet) marks the call as egress; every host the command spells
+*   out is collected, so a second URL cannot hide behind an allowlisted one.
+*/
+function egressHosts(context) {
+	if (context.toolCall.name === "FetchURL") {
+		const url = context.args?.url;
+		if (typeof url !== "string") return void 0;
+		const host = hostFromUrl(url);
+		return host === void 0 ? [] : [host];
+	}
+	if (context.toolCall.name === "Bash") {
+		const command = context.args?.command;
+		if (typeof command !== "string") return void 0;
+		if (!EGRESS_COMMAND_PATTERN.test(command)) return void 0;
+		return hostsFromCommand(command);
+	}
+}
+/**
+* Shell download/remote verbs. Shared with the private-read taint scan
+* (`permission/index.ts`): an egress command reads local files through upload
+* flags (`-d @file`, `-T`) without any read verb, so it must not be filtered
+* out by that scan's read-verb gate.
+*/
+const EGRESS_COMMAND_PATTERN = /\b(curl|wget|nc|netcat|ssh(?!-)|scp|rsync|telnet)\b/;
+/**
+* Authority of a URL. The character class stops at `/`, `#`, `?`, quotes,
+* backticks and whitespace, so a fragment or a path cannot extend the
+* authority into a different host.
+*/
+const URL_AUTHORITY = /https?:\/\/([^\s/'"`#?]+)/gi;
+/** `user@host` (ssh/scp style). */
+const USER_HOST = /[\w.-]+@([A-Za-z0-9][A-Za-z0-9.-]*)/g;
+/** `host:path` remote targets (scp/rsync style). */
+const HOST_PATH = /(?:^|\s)([A-Za-z0-9][A-Za-z0-9.-]*\.[A-Za-z]{2,}):\S/g;
+function hostsFromCommand(command) {
+	const hosts = /* @__PURE__ */ new Set();
+	for (const match of command.matchAll(URL_AUTHORITY)) {
+		const host = hostFromAuthority(match[1] ?? "");
+		if (host !== void 0) hosts.add(host);
+	}
+	for (const match of command.matchAll(USER_HOST)) {
+		const host = match[1]?.toLowerCase();
+		if (host !== void 0 && host.length > 0) hosts.add(host);
+	}
+	for (const match of command.matchAll(HOST_PATH)) {
+		const host = match[1]?.toLowerCase();
+		if (host !== void 0 && host.length > 0) hosts.add(host);
+	}
+	return [...hosts];
+}
+function hostFromUrl(url) {
+	try {
+		const hostname = new URL(url).hostname.toLowerCase();
+		return hostname.length > 0 ? hostname : void 0;
+	} catch {
+		return;
+	}
+}
+function hostFromAuthority(authority) {
+	const withoutUser = authority.slice(authority.indexOf("@") + 1);
+	if (withoutUser.startsWith("[")) {
+		const end = withoutUser.indexOf("]");
+		return end === -1 ? void 0 : withoutUser.slice(0, end + 1).toLowerCase();
+	}
+	const host = withoutUser.split(":")[0]?.toLowerCase();
+	return host !== void 0 && host.length > 0 ? host : void 0;
+}
+/**
+* Case-insensitive exact match; a `*.` entry also covers its apex
+* (`*.example.com` matches `example.com` and `a.example.com`).
+*/
+function isAllowedEgressHost(host, allowlist) {
+	const normalized = host.toLowerCase();
+	return allowlist.some((entry) => {
+		const candidate = entry.trim().toLowerCase();
+		if (candidate.length === 0) return false;
+		if (candidate.startsWith("*.")) {
+			const suffix = candidate.slice(2);
+			return normalized === suffix || normalized.endsWith(`.${suffix}`);
+		}
+		return normalized === candidate;
+	});
+}
+function egressReason(host) {
+	return `private data was read outside the workspace in this session; sending it to ${host ?? "an unrecognized destination"} needs your confirmation`;
+}
+//#endregion
 //#region ../../packages/agent-core/src/agent/permission/policies/bot-mode-permission.ts
 /**
 * Tools whose effects are reversible within the workspace (safe to run
@@ -87585,10 +87798,16 @@ var BotModePermissionPolicy = class BotModePermissionPolicy {
 				reason: { reason: "bot: in-workspace reversible edit" }
 			};
 		}
-		if (REVERSIBLE_TOOLS.has(tool)) return {
-			kind: "approve",
-			reason: { reason: "bot: reversible tool" }
-		};
+		if (REVERSIBLE_TOOLS.has(tool)) {
+			if (assessPrivateReadEgress(this.agent, context) !== void 0) return {
+				kind: "deny",
+				reason: { reason: "bot: egress after private read blocked (unattended)" }
+			};
+			return {
+				kind: "approve",
+				reason: { reason: "bot: reversible tool" }
+			};
+		}
 		return {
 			kind: "deny",
 			reason: { reason: `bot: tool '${tool}' not in the reversible allowlist` }
@@ -88366,6 +88585,99 @@ function formatPermissionRuleDenyMessage(tool, reason, agentType) {
 	return `Tool "${tool}" was denied by permission rule.${suffix}`;
 }
 //#endregion
+//#region ../../packages/agent-core/src/agent/permission/warnings.ts
+/**
+* Declaration order is the display order, so the riskiest families come first.
+* Every warning is a standalone English sentence; consumers render them as-is.
+*/
+const DANGEROUS_COMMAND_PATTERNS = [
+	{
+		pattern: /\brm\s+(?=[^|;&\n]*(?<![\w])(?:-[a-zA-Z]*r[a-zA-Z]*\b|--recursive\b))(?=[^|;&\n]*(?<![\w])(?:-[a-zA-Z]*f[a-zA-Z]*\b|--force\b))/i,
+		warning: "dangerous command: recursive force delete"
+	},
+	{
+		pattern: /\bsudo\b/,
+		warning: "dangerous command: privilege escalation"
+	},
+	{
+		pattern: /\bmkfs\b/,
+		warning: "dangerous command: filesystem format"
+	},
+	{
+		pattern: /\bdd\s+if=/,
+		warning: "dangerous command: raw disk write"
+	},
+	{
+		pattern: /curl[^|]*\|\s*(ba)?sh|wget[^|]*\|\s*(ba)?sh/,
+		warning: "dangerous command: download piped into a shell"
+	},
+	{
+		pattern: /\bchmod\s+-R\s+777\b/,
+		warning: "dangerous command: world-writable recursive chmod"
+	},
+	{
+		pattern: />\s*\/dev\/sd/,
+		warning: "dangerous command: write to a raw disk device"
+	},
+	{
+		pattern: /\bshutdown\b/,
+		warning: "dangerous command: system shutdown"
+	},
+	{
+		pattern: /\breboot\b/,
+		warning: "dangerous command: system reboot"
+	},
+	{
+		pattern: /\bgit\s+(?:-C\s+\S+\s+)?push\b.*(?:\s-f\b|--force\b)/,
+		warning: "dangerous command: force push"
+	}
+];
+/**
+* Warnings triggered by `command`, in declaration order. Returns an empty
+* array for ordinary commands, and for input that is not a command string.
+*/
+function dangerousCommandWarnings(command) {
+	if (command.length === 0) return [];
+	const warnings = [];
+	for (const { pattern, warning } of DANGEROUS_COMMAND_PATTERNS) if (pattern.test(command)) warnings.push(warning);
+	return warnings;
+}
+//#endregion
+//#region ../../packages/agent-core/src/agent/permission/policies/warnings-ask.ts
+/**
+* Dangerous shell commands always ask — even in `yolo` mode and even when a
+* session grant already covers Bash.
+*
+* The chain position is the mechanism (see `createPermissionDecisionPolicies`):
+* the policy sits after `auto-mode-approve`, so unattended auto mode keeps
+* running without prompts, and before `session-approval-history`, so a
+* memorized grant cannot silence the warning. The prompt offers `once` only —
+* a dangerous command is never memorizable.
+*/
+var WarningsAskPermissionPolicy = class {
+	agent;
+	name = "dangerous-command-warnings-ask";
+	constructor(agent) {
+		this.agent = agent;
+	}
+	evaluate(context) {
+		if (context.toolCall.name !== "Bash") return;
+		const command = context.args?.command;
+		if (typeof command !== "string") return;
+		const warnings = dangerousCommandWarnings(command);
+		if (warnings.length === 0) return;
+		return {
+			kind: "ask",
+			reason: {
+				dangerous_command: true,
+				warning_count: warnings.length
+			},
+			reasons: warnings,
+			grantOptions: ["once"]
+		};
+	}
+};
+//#endregion
 //#region ../../packages/agent-core/src/agent/permission/policies/collaboration-auto-approve.ts
 /**
 * Coordination tools are conversation, not mutation: a subagent asking its
@@ -88435,7 +88747,9 @@ function createPermissionDecisionPolicies(agent) {
 		new UserConfiguredDenyPermissionPolicy(agent),
 		new BotModePermissionPolicy(agent),
 		new CollaborationAutoApprovePermissionPolicy(),
+		new PrivateReadEgressAskPermissionPolicy(agent),
 		new AutoModeApprovePermissionPolicy(agent),
+		new WarningsAskPermissionPolicy(agent),
 		new SessionApprovalHistoryPermissionPolicy(agent),
 		new UserConfiguredAskPermissionPolicy(agent),
 		new UserConfiguredAllowPermissionPolicy(agent),
@@ -88464,6 +88778,15 @@ var PermissionManager = class {
 	localSessionApprovalRulePatterns = /* @__PURE__ */ new Set();
 	policies;
 	pendingApprovals = /* @__PURE__ */ new Map();
+	/**
+	* Two-phase private-read tracking (see `trackPendingPrivateRead` /
+	* `settlePrivateRead`): the first phase records a candidate read of
+	* outside-workspace data keyed by tool call id, the second promotes it to
+	* `localTaintedPrivateReads` only after the call is known to have
+	* succeeded. Both maps are in-memory session state — never persisted.
+	*/
+	localPendingPrivateReads = /* @__PURE__ */ new Map();
+	localTaintedPrivateReads = /* @__PURE__ */ new Set();
 	nextApprovalId = 0;
 	constructor(agent, options = {}) {
 		this.agent = agent;
@@ -88547,10 +88870,89 @@ var PermissionManager = class {
 	get sessionApprovalRulePatterns() {
 		return [...this.localSessionApprovalRulePatterns, ...this.parent?.sessionApprovalRulePatterns ?? []];
 	}
+	/**
+	* Forget one memorized approve-for-session pattern. Revocation is local
+	* only: `sessionApprovalRulePatterns` merges the parent chain read-only, so
+	* this manager cannot drop a grant its parent holds (and a child's grant is
+	* invisible to the parent). Returns true when a local grant was removed.
+	*
+	* A real removal is recorded on the wire, otherwise a resumed session would
+	* re-add the pattern from its own approval-result record and prompt again
+	* for a grant the user took back. The same method serves the replay path:
+	* `AgentRecords.logRecord` is a no-op while restoring, so restore cannot
+	* re-write the record it is replaying.
+	*/
+	revokeSessionGrant(pattern) {
+		const removed = this.localSessionApprovalRulePatterns.delete(pattern);
+		if (removed) this.agent.records.logRecord({
+			type: "permission.record_grant_revocation",
+			pattern
+		});
+		return removed;
+	}
+	/**
+	* Descriptions of the successful reads of outside-workspace data this
+	* session has performed, merged with the parent chain read-only (same
+	* shape as `sessionApprovalRulePatterns`). A subagent sees its parent's
+	* taint but cannot add to it, and the taint dies with the agent: it is
+	* never persisted.
+	*/
+	get taintedPrivateReads() {
+		return [...this.localTaintedPrivateReads, ...this.parent?.taintedPrivateReads ?? []];
+	}
+	/**
+	* True while a candidate private read has not settled yet, on this agent or
+	* anywhere up the parent chain. Every call in one tool batch is authorized
+	* before any of their results is finalized, so a same-batch
+	* `[Read /tmp/secret, Bash(curl …)]` never sees the taint — the egress
+	* guard reads this flag too and fails closed during that window.
+	*/
+	hasPendingPrivateReads() {
+		return this.localPendingPrivateReads.size > 0 || (this.parent?.hasPendingPrivateReads() ?? false);
+	}
+	/**
+	* Second half of two-phase private-read tracking. A pending candidate read
+	* is promoted to the tainted set only when the call succeeded; a failed
+	* call never delivered its content to the model, so it is dropped. Both
+	* outcomes clear the pending entry, so the map cannot grow unbounded.
+	*/
+	settlePrivateRead(toolCallId, failed) {
+		const description = this.localPendingPrivateReads.get(toolCallId);
+		if (description === void 0) return;
+		this.localPendingPrivateReads.delete(toolCallId);
+		if (failed) return;
+		this.localTaintedPrivateReads.add(description);
+	}
+	/**
+	* First half of two-phase private-read tracking: a call that reads,
+	* searches, or read-writes a path outside the workspace is recorded as a
+	* pending candidate here. Promotion happens in `settlePrivateRead` once the
+	* result is known — denied, blocked, and failed calls must not taint the
+	* session. The description never carries file content, only the path.
+	*/
+	trackPendingPrivateRead(context) {
+		const cwd = this.agent.config.cwd;
+		if (cwd.length === 0) return;
+		const pathClass = this.agent.jian.pathClass();
+		const accesses = context.execution.accesses;
+		if (accesses === void 0 || accesses.some((access) => access.kind === "all")) {
+			const path = outsidePathInShellCommand(context, cwd, pathClass, this.agent.jian.gethome());
+			if (path !== void 0) this.localPendingPrivateReads.set(context.toolCall.id, formatPrivateReadDescription(path));
+			return;
+		}
+		const privateReads = accesses.filter(isPrivateReadAccess);
+		if (privateReads.length === 0) return;
+		const access = privateReads.find((fileAccess) => !isWithinDirectory$1(fileAccess.path, cwd, pathClass));
+		if (access === void 0) return;
+		this.localPendingPrivateReads.set(context.toolCall.id, formatPrivateReadDescription(access.path));
+	}
 	async beforeToolCall(context) {
+		this.trackPendingPrivateRead(context);
 		const evaluation = await this.evaluatePolicies(context);
 		if (evaluation === void 0) return void 0;
-		return this.permissionPolicyResolutionToPrepare(evaluation.result, context, evaluation.policyName);
+		const prepared = await this.permissionPolicyResolutionToPrepare(evaluation.result, context, evaluation.policyName);
+		if (prepared?.block === true || prepared?.syntheticResult !== void 0) this.localPendingPrivateReads.delete(context.toolCall.id);
+		return prepared;
 	}
 	async requestToolApproval(context, result, policyName) {
 		const { signal } = context;
@@ -88572,10 +88974,12 @@ var PermissionManager = class {
 			...sourceCapabilityMode !== "all" ? { sourceCapabilityMode } : {},
 			sourceToolName: name
 		};
+		const requestSummary = this.agent.turn.getLastPromptSummary();
 		let response;
 		if (this.agent.rpc?.requestApproval) {
 			const approvalId = `approval-${String(++this.nextApprovalId)}`;
 			let timeoutHandle;
+			let timedOut = false;
 			try {
 				const customPromise = new Promise((resolve, reject) => {
 					this.pendingApprovals.set(approvalId, {
@@ -88595,27 +88999,42 @@ var PermissionManager = class {
 						toolName: name,
 						action,
 						display,
+						reasons: result.reasons,
+						grantOptions: result.grantOptions,
+						...requestSummary !== void 0 ? { requestSummary } : {},
 						...source
 					}, { signal }).then(resolve, reject);
 				});
 				const timeoutPromise = new Promise((_, reject) => {
 					timeoutHandle = setTimeout(() => {
+						timedOut = true;
 						reject(/* @__PURE__ */ new Error(`Approval request timed out after ${String(APPROVAL_TIMEOUT_MS)}ms`));
 					}, APPROVAL_TIMEOUT_MS);
 				});
 				response = await Promise.race([customPromise, timeoutPromise]);
 			} catch (error) {
 				this.pendingApprovals.delete(approvalId);
+				this.recordDecision(context, {
+					decision: timedOut ? "timeout" : "cancelled",
+					reason: errorText(error)
+				});
 				const resolved = result.resolveError?.(error);
 				return await (resolved === void 0 ? Promise.reject(error) : this.permissionPolicyResolutionToPrepare(resolved, context, policyName));
 			} finally {
 				if (timeoutHandle !== void 0) clearTimeout(timeoutHandle);
 				this.pendingApprovals.delete(approvalId);
 			}
-		} else response = {
-			decision: "cancelled",
-			feedback: "Approval handler is unavailable."
-		};
+		} else {
+			response = {
+				decision: "cancelled",
+				feedback: "Approval handler is unavailable."
+			};
+			this.recordDecision(context, {
+				decision: "cancelled",
+				reason: "Approval handler is unavailable."
+			});
+		}
+		response = this.downgradeUnofferedSessionScope(response, result.grantOptions, name);
 		const sessionApprovalRule = response.decision === "approved" && response.scope === "session" ? context.execution.approvalRule : void 0;
 		this.recordApprovalResult({
 			turnId: Number(context.turnId),
@@ -88633,6 +89052,23 @@ var PermissionManager = class {
 			reason: this.formatApprovalRejectionMessage(name, response)
 		};
 	}
+	/**
+	* Drop a session scope the policy never offered. Panels filter their buttons
+	* by `grantOptions`, but the response is wire input — the core is the only
+	* place that can guarantee a once-only prompt never memorizes a session
+	* grant. Runs before the session rule is derived, so a downgraded response
+	* leaves no `session-runtime` rule behind.
+	*/
+	downgradeUnofferedSessionScope(response, grantOptions, toolName) {
+		if (response.decision !== "approved" || response.scope !== "session") return response;
+		if (grantOptions === void 0 || grantOptions.includes("session")) return response;
+		this.agent.log.warn("Approval response requested a session grant that was not offered; downgrading to a one-time grant.", {
+			toolName,
+			grantOptions: [...grantOptions]
+		});
+		const { scope: _scope, ...rest } = response;
+		return rest;
+	}
 	async evaluatePolicies(context) {
 		for (const policy of this.policies) {
 			const result = await policy.evaluate(context);
@@ -88645,13 +89081,37 @@ var PermissionManager = class {
 	get effectiveRules() {
 		return [...this.rules, ...this.parent?.effectiveRules ?? []];
 	}
+	/**
+	* Append a stop decision to the wire, so a session's denials and aborted
+	* approvals stay auditable. Uses the low-level record API on purpose: the
+	* record is an audit trail, and replaying a session must not re-run a
+	* decision (the live UI state already comes from the approval-result
+	* records and the blocked tool's own error result).
+	*/
+	recordDecision(context, decision) {
+		this.agent.records.logRecord({
+			type: "permission.record_decision",
+			turnId: Number(context.turnId),
+			toolCallId: context.toolCall.id,
+			toolName: context.toolCall.name,
+			...decision
+		});
+	}
 	permissionPolicyResolutionToPrepare(result, context, policyName) {
 		switch (result.kind) {
 			case "approve": return result.executionMetadata === void 0 ? void 0 : { executionMetadata: result.executionMetadata };
-			case "deny": return {
-				block: true,
-				reason: result.message ?? (typeof result.reason === "object" && result.reason !== null && typeof result.reason.reason === "string" ? `Tool "${context.toolCall.name}" was denied by permission policy: ${result.reason.reason}` : this.formatPolicyDenyMessage(context.toolCall.name))
-			};
+			case "deny": {
+				const reason = result.message ?? (typeof result.reason === "object" && result.reason !== null && typeof result.reason.reason === "string" ? `Tool "${context.toolCall.name}" was denied by permission policy: ${result.reason.reason}` : this.formatPolicyDenyMessage(context.toolCall.name));
+				this.recordDecision(context, {
+					...policyName !== void 0 ? { policyName } : {},
+					decision: "deny",
+					reason
+				});
+				return {
+					block: true,
+					reason
+				};
+			}
 			case "ask": return this.requestToolApproval(context, result, policyName);
 			case "result": {
 				const { kind: _kind, ...prepareResult } = result;
@@ -88672,6 +89132,96 @@ var PermissionManager = class {
 		return prefix;
 	}
 };
+function errorText(error) {
+	return error instanceof Error ? error.message : String(error);
+}
+/** Operations that pull outside-workspace data into the session. */
+const PRIVATE_READ_OPERATIONS = new Set([
+	"read",
+	"search",
+	"readwrite"
+]);
+function isPrivateReadAccess(access) {
+	return access.kind === "file" && PRIVATE_READ_OPERATIONS.has(access.operation);
+}
+/** Longest path kept in a taint description; the tail is what identifies the file. */
+const PRIVATE_READ_PATH_LIMIT = 120;
+function formatPrivateReadDescription(path) {
+	return `read outside the workspace: ${path.length > PRIVATE_READ_PATH_LIMIT ? `…${path.slice(-120)}` : path}`;
+}
+/** Absolute paths, `~/…` and `$HOME/…` references in shell command text. */
+const SHELL_PATH_REFERENCE = /(?<!:)(?:~|\$\{?HOME\}?)?\/[^\s'"`;|&<>()]*/g;
+/** URLs are stripped before the scan: their host part is not a file path. */
+const SHELL_URL_REFERENCE = /[a-z][a-z0-9+.-]*:\/\/[^\s'"`]+/gi;
+/**
+* Read-class commands: only these pull file *content* into the session. A
+* command that merely names a path — `ls /tmp`, `echo /etc`, a redirect
+* target, an env assignment — must not taint it, or ordinary build/test
+* commands would leave a permanent taint (and a permanent bot-mode denial).
+*/
+const SHELL_READ_VERB = /\b(cat|head|tail|grep|rg|less|more|xxd|od|strings|base64|awk|sed|sort|uniq|cut)\b/;
+/** Tokens that introduce a write target. */
+const SHELL_WRITE_OPERATORS = new Set([
+	">",
+	">>",
+	"-o",
+	"-O",
+	"--output",
+	"tee"
+]);
+/** Environment assignment (`PATH=…`), never a read. */
+const SHELL_ASSIGNMENT = /^[A-Za-z_][A-Za-z0-9_]*=/;
+/** Glued redirects: `>/tmp/log` and fd forms like `2>/tmp/err`. */
+const SHELL_REDIRECT_PREFIX = /^\d*>>?/;
+/**
+* `github.com/foo` — a bare host followed by a path, as `curl`/`scp` accept
+* it. The leading segment makes it look like an absolute path to the scanner,
+* but it names a remote resource, not a local file.
+*/
+const SHELL_HOST_SHAPED_TOKEN = /^[A-Za-z0-9-]+(\.[A-Za-z0-9-]+)+\//;
+/**
+* First path reference in a shell command that resolves outside the workspace
+* (home expanded), or undefined.
+*
+* The scan only runs for read-class or egress commands and skips write targets,
+* assignments, and host-shaped tokens, because the guard exists to catch file
+* content entering the session — not every mention of a path. Known residues,
+* registered with the egress policy's blind-spot note: relative paths
+* (`cd / && cat .env`); readers or interpreters outside the verb list
+* (`python3 -c`, `perl -ne`, `dd`), which never taint through this scan; write
+* flag families that name a file without a redirect (`ssh-keygen -f`,
+* `openssl -i`) and commands such as `ssh-copy-id` that are not judged at all;
+* and paths hidden behind quoting or encoding.
+*/
+function outsidePathInShellCommand(context, cwd, pathClass, homeDir) {
+	if (context.toolCall.name !== "Bash") return void 0;
+	const command = context.args?.command;
+	if (typeof command !== "string") return void 0;
+	if (!EGRESS_COMMAND_PATTERN.test(command) && !SHELL_READ_VERB.test(command)) return void 0;
+	const tokens = command.replace(SHELL_URL_REFERENCE, " ").split(/\s+/);
+	for (let index = 0; index < tokens.length; index += 1) {
+		const token = tokens[index] ?? "";
+		if (isShellWriteTarget(token, tokens[index - 1])) continue;
+		if (SHELL_HOST_SHAPED_TOKEN.test(token)) continue;
+		for (const match of token.matchAll(SHELL_PATH_REFERENCE)) {
+			const path = expandHomeReference(match[0], homeDir);
+			if (!isWithinDirectory$1(path, cwd, pathClass)) return path;
+		}
+	}
+}
+function isShellWriteTarget(token, previous) {
+	if (token.length === 0) return false;
+	if (SHELL_ASSIGNMENT.test(token)) return true;
+	if (SHELL_REDIRECT_PREFIX.test(token)) return true;
+	if (SHELL_WRITE_OPERATORS.has(token)) return true;
+	return previous !== void 0 && SHELL_WRITE_OPERATORS.has(previous);
+}
+function expandHomeReference(path, homeDir) {
+	if (path.startsWith("~/")) return `${homeDir}${path.slice(1)}`;
+	if (path.startsWith("${HOME}/")) return `${homeDir}${path.slice(7)}`;
+	if (path.startsWith("$HOME/")) return `${homeDir}${path.slice(5)}`;
+	return path;
+}
 //#endregion
 //#region ../../packages/agent-core/src/utils/hero-slug.ts
 /** Hero-name slug generator: produces "hero-hero-hero" with collision fallback. */
@@ -89767,16 +90317,30 @@ const MIGRATIONS = [
 		migrateRecord(record) {
 			return record;
 		}
+	},
+	{
+		sourceVersion: "1.6",
+		targetVersion: "1.7",
+		migrateRecord(record) {
+			return record;
+		}
+	},
+	{
+		sourceVersion: "1.7",
+		targetVersion: "1.8",
+		migrateRecord(record) {
+			return record;
+		}
 	}
 ];
 function isNewerWireVersion(readVersion) {
-	return compareWireVersions(readVersion, "1.6") > 0;
+	return compareWireVersions(readVersion, "1.8") > 0;
 }
 function resolveWireMigrations(readVersion) {
-	if (compareWireVersions(readVersion, "1.6") >= 0) return [];
+	if (compareWireVersions(readVersion, "1.8") >= 0) return [];
 	const migrations = [];
 	let version = readVersion;
-	while (compareWireVersions(version, "1.6") < 0) {
+	while (compareWireVersions(version, "1.8") < 0) {
 		const migration = findMigration(version);
 		if (migration === void 0) throw new Error(`Missing wire migration for version ${version}`);
 		migrations.push(migration);
@@ -89884,7 +90448,7 @@ function headStartsWithAnyPrefix(head, headLength, prefixes) {
 */
 function readSkipFoldedFlag(headerText) {
 	try {
-		return JSON.parse(headerText).protocol_version === "1.6";
+		return JSON.parse(headerText).protocol_version === "1.8";
 	} catch {
 		return false;
 	}
@@ -90623,6 +91187,10 @@ function restoreAgentRecord(agent, input) {
 		case "permission.record_approval_result":
 			agent.permission.recordApprovalResult(input);
 			return;
+		case "permission.record_grant_revocation":
+			agent.permission.revokeSessionGrant(input.pattern);
+			return;
+		case "permission.record_decision": return;
 		case "usage.record":
 			agent.usage.record(input.model, input.usage, input.usageScope ?? "session", { skipCurrentTurn: true });
 			return;
@@ -90743,7 +91311,7 @@ var AgentRecords = class {
 		if (this.persistence !== void 0 && !this.metadataInitialized && stamped.type !== "metadata") {
 			this.persistence.append({
 				type: "metadata",
-				protocol_version: "1.6",
+				protocol_version: "1.8",
 				created_at: Date.now()
 			});
 			this.metadataInitialized = true;
@@ -90774,18 +91342,18 @@ var AgentRecords = class {
 				this.metadataInitialized = true;
 				const readVersion = record.protocol_version;
 				if (isNewerWireVersion(readVersion)) {
-					warning = `Session wire protocol version ${readVersion} is newer than the current version 1.6. Records will be replayed without migration.`;
+					warning = `Session wire protocol version ${readVersion} is newer than the current version 1.8. Records will be replayed without migration.`;
 					shouldRewrite = false;
 				} else {
 					migrations = resolveWireMigrations(readVersion);
-					shouldRewrite = readVersion !== "1.6";
+					shouldRewrite = readVersion !== "1.8";
 				}
 				buffered = shouldRewrite || warning !== void 0;
 			}
 			let migratedRecord = migrateWireRecord(record, migrations);
 			if (migratedRecord.type === "metadata") migratedRecord = {
 				...migratedRecord,
-				protocol_version: "1.6"
+				protocol_version: "1.8"
 			};
 			if (buffered) {
 				replayedRecords.push(migratedRecord);
@@ -103281,6 +103849,11 @@ const SCREAM_MCP_CLIENT_VERSION = getCoreVersion();
 * including either the configured tool-call timeout, an in-flight abort
 * signal, both, or neither. Returns `undefined` when nothing needs to be
 * passed so the SDK falls back to its defaults.
+*
+* `McpServerConfig.toolTimeoutMs` resolves to `DEFAULT_TOOL_TIMEOUT_MS` when
+* unset, which equals the SDK's own request timeout — a config-derived call
+* therefore arrives here with the same budget the SDK would have applied on
+* its own.
 */
 function buildRequestOptions(toolCallTimeoutMs, signal) {
 	if (toolCallTimeoutMs === void 0 && signal === void 0) return void 0;
@@ -105262,10 +105835,21 @@ var TurnFlow = class {
 	turnStartWorkingSetPathCount = 0;
 	turnStartVerificationCount = 0;
 	verificationFailureInjected = false;
+	/**
+	* Plain-text summary of the most recent prompt, carried onto approval
+	* requests so the panel can attribute a prompt to what the user asked for.
+	* In-memory only: it is UI context, not session state.
+	*/
+	lastPromptSummary;
 	constructor(agent) {
 		this.agent = agent;
 	}
+	/** See {@link lastPromptSummary}. Undefined until a text prompt arrives. */
+	getLastPromptSummary() {
+		return this.lastPromptSummary;
+	}
 	prompt(input, origin = USER_PROMPT_ORIGIN) {
+		this.lastPromptSummary = summarizePrompt(input);
 		this.agent.records.logRecord({
 			type: "turn.prompt",
 			input,
@@ -105795,6 +106379,7 @@ var TurnFlow = class {
 						finalizeToolResult: async (ctx) => {
 							const finalResult = ctx.nested === true ? ctx.result : await deduper.finalizeResult(ctx.toolCall.id, ctx.toolCall.name, ctx.args, ctx.result);
 							const { isError, output } = finalResult;
+							this.agent.permission.settlePrivateRead(ctx.toolCall.id, isError === true);
 							this.agent.sessionMemory.recordToolExecution(ctx.toolCall.name, summarizeToolArgs(ctx.args), isError === true, ctx.stepNumber);
 							this.recordWorkingSetPaths(ctx.toolCall.name, ctx.args, Number(ctx.turnId));
 							if (ctx.toolCall.name === "Bash" && typeof ctx.args.command === "string") {
@@ -105924,6 +106509,18 @@ var TurnFlow = class {
 		return false;
 	}
 };
+/** Longest prompt summary kept for the approval card. */
+const PROMPT_SUMMARY_LIMIT = 120;
+/**
+* Plain text of a prompt, whitespace-collapsed and truncated. Returns
+* undefined for input without text (attachments only), so consumers can omit
+* the field instead of rendering an empty row.
+*/
+function summarizePrompt(input) {
+	const text = input.filter((part) => part.type === "text").map((part) => part.text).join(" ").replaceAll(/\s+/g, " ").trim();
+	if (text.length === 0) return void 0;
+	return text.length > PROMPT_SUMMARY_LIMIT ? `${text.slice(0, PROMPT_SUMMARY_LIMIT)}…` : text;
+}
 //#endregion
 //#region ../../packages/agent-core/src/utils/completion-budget.ts
 const MIN_FLOOR = 1;
@@ -107442,6 +108039,7 @@ function transformPermissionData(data) {
 	appendPermissionRules(rules, raw["allow"], "allow");
 	appendPermissionRules(rules, raw["ask"], "ask");
 	if (rules.length > 0) out["rules"] = rules;
+	if (raw["egressAllowlist"] !== void 0) out["egressAllowlist"] = raw["egressAllowlist"];
 	return out;
 }
 function appendPermissionRules(target, value, decision) {
@@ -107561,6 +108159,8 @@ function permissionToToml(permission, rawPermission) {
 	delete out["ask"];
 	if (permission.rules !== void 0) out["rules"] = permission.rules.map(permissionRuleToToml);
 	else delete out["rules"];
+	if (permission.egressAllowlist !== void 0) out["egress_allowlist"] = [...permission.egressAllowlist];
+	else delete out["egress_allowlist"];
 	return out;
 }
 function permissionRuleToToml(rule) {
@@ -110863,6 +111463,10 @@ function assertMcpInputSchema(toolName, inputSchema) {
 //#endregion
 //#region ../../packages/agent-core/src/mcp/connection-manager.ts
 const DEFAULT_STARTUP_TIMEOUT_MS = 6e4;
+/** Effective tool-call budget for a server: configured value or the default. */
+function resolveToolCallTimeoutMs(config) {
+	return config.toolTimeoutMs ?? 6e4;
+}
 /**
 * Owns the lifecycle of every configured MCP server for a Session.
 *
@@ -111088,7 +111692,7 @@ var McpConnectionManager = class {
 		return entry.attemptId;
 	}
 	createClient(config, name) {
-		const toolCallTimeoutMs = config.toolTimeoutMs;
+		const toolCallTimeoutMs = resolveToolCallTimeoutMs(config);
 		if (config.transport === "stdio") return new StdioMcpClient(config, { toolCallTimeoutMs });
 		return new HttpMcpClient(config, {
 			toolCallTimeoutMs,
@@ -112628,6 +113232,22 @@ var Session$1 = class {
 		return this.skills.listSkills().map(summarizeSkill);
 	}
 	/**
+	* Approval patterns with an active approve-for-session grant in this
+	* session, in insertion order. Empty when the main agent has not been
+	* instantiated (or has no grants).
+	*/
+	getSessionApprovalGrants() {
+		return this.agents.get("main")?.permission.sessionApprovalRulePatterns.slice() ?? [];
+	}
+	/**
+	* Revoke one approve-for-session grant held by the main agent. Returns true
+	* when a grant was removed; false when the pattern was not granted (or the
+	* main agent does not exist yet).
+	*/
+	revokeSessionApprovalGrant(pattern) {
+		return this.agents.get("main")?.permission.revokeSessionGrant(pattern) ?? false;
+	}
+	/**
 	* Dynamically load additional skill roots into the running session.
 	* Used after a plugin is installed so its skills become available
 	* without requiring the user to create a new session.
@@ -127257,7 +127877,7 @@ var OpenAlexPaperSource = class {
 };
 //#endregion
 //#region ../../packages/agent-core/src/session/export/manifest.ts
-const WIRE_PROTOCOL_VERSION = "1.6";
+const WIRE_PROTOCOL_VERSION = "1.8";
 function buildExportManifest(args) {
 	return {
 		sessionId: args.summary.id,
@@ -128628,6 +129248,12 @@ var SessionAPIImpl = class {
 	async removeSkill(payload) {
 		return this.session.removeSkill(payload.skillName);
 	}
+	getSessionApprovalGrants(_payload) {
+		return this.session.getSessionApprovalGrants();
+	}
+	revokeSessionApprovalGrant(payload) {
+		return this.session.revokeSessionApprovalGrant(payload.pattern);
+	}
 	listMcpServers(_payload) {
 		return this.session.mcp.list();
 	}
@@ -129852,6 +130478,12 @@ var ScreamCore = class {
 	listMcpServers({ sessionId, ...payload }) {
 		return this.sessionApi(sessionId).listMcpServers(payload);
 	}
+	getSessionApprovalGrants({ sessionId, ...payload }) {
+		return this.sessionApi(sessionId).getSessionApprovalGrants(payload);
+	}
+	revokeSessionApprovalGrant({ sessionId, ...payload }) {
+		return this.sessionApi(sessionId).revokeSessionApprovalGrant(payload);
+	}
 	getMcpStartupMetrics({ sessionId, ...payload }) {
 		return this.sessionApi(sessionId).getMcpStartupMetrics(payload);
 	}
@@ -130777,6 +131409,15 @@ var SDKRpcClient = class {
 			skillName: input.skillName
 		});
 	}
+	async getSessionApprovalGrants(input) {
+		return (await this.getRpc()).getSessionApprovalGrants({ sessionId: input.sessionId });
+	}
+	async revokeSessionApprovalGrant(input) {
+		return (await this.getRpc()).revokeSessionApprovalGrant({
+			sessionId: input.sessionId,
+			pattern: input.pattern
+		});
+	}
 	/**
 	* Background tasks are registered per agent: a subagent's Bash/Agent task
 	* lives in that subagent's own registry, so `agentId` selects whose registry
@@ -131342,6 +131983,19 @@ var Session = class {
 		this.ensureOpen();
 		return this.rpc.listMcpServers({ sessionId: this.id });
 	}
+	/** Approval patterns with an active approve-for-session grant. */
+	async getSessionApprovalGrants() {
+		this.ensureOpen();
+		return this.rpc.getSessionApprovalGrants({ sessionId: this.id });
+	}
+	/** Revoke one approve-for-session grant; true when a grant was removed. */
+	async revokeSessionApprovalGrant(pattern) {
+		this.ensureOpen();
+		return this.rpc.revokeSessionApprovalGrant({
+			sessionId: this.id,
+			pattern
+		});
+	}
 	async getMcpStartupMetrics() {
 		this.ensureOpen();
 		return this.rpc.getMcpStartupMetrics({ sessionId: this.id });
@@ -132724,6 +133378,13 @@ const BUILTIN_SLASH_COMMANDS = [
 		priority: 188,
 		availability: "always"
 	},
+	{
+		name: "grants",
+		aliases: [],
+		description: "registry.grants_desc",
+		priority: 188,
+		availability: "always"
+	},
 	{
 		name: "editor",
 		aliases: [],
@@ -134658,6 +135319,17 @@ function buildTraceCells({ wirePath }) {
 				}, time);
 				break;
 			}
+			case "permission.record_decision": {
+				const decision = asString(record["decision"]) ?? "";
+				const toolName = asString(record["toolName"]) ?? "";
+				const policyName = asString(record["policyName"]);
+				const reason = asString(record["reason"]);
+				pushCell("context", `${decision === "timeout" ? "审批超时" : decision === "cancelled" ? "审批取消" : "审批拒绝"}: ${toolName}${policyName !== void 0 ? ` (${policyName})` : ""}`, {
+					inputDetail: reason,
+					sourceSeq: seq
+				}, time);
+				break;
+			}
 			case "request.header": {
 				const provider = asString(record["provider"]) ?? "";
 				const model = asString(record["model"]) ?? "";
@@ -139300,7 +139972,7 @@ async function guidedGoalSetup(host) {
 		host.showNotice(t("goal.storm_breaker"), t("goal.conflict_loop"));
 		return;
 	}
-	const { TextInputDialogComponent } = await import("./text-input-dialog-b-TqTP2z.mjs");
+	const { TextInputDialogComponent } = await import("./text-input-dialog-DCMeCMoC.mjs");
 	const initialDesc = await promptText(host, TextInputDialogComponent, {
 		title: t("goal.setup_title_initial"),
 		subtitle: t("goal.setup_desc_hint"),
@@ -139321,7 +139993,7 @@ async function guidedGoalSetup(host) {
 	await showGoalConfigWizard(host, session, confirmed.trim() || objective, false);
 }
 async function showGoalConfigWizard(host, session, objective, replace) {
-	const { TextInputDialogComponent } = await import("./text-input-dialog-b-TqTP2z.mjs");
+	const { TextInputDialogComponent } = await import("./text-input-dialog-DCMeCMoC.mjs");
 	const turnInput = await promptNumber(host, TextInputDialogComponent, {
 		title: t("goal.wizard_title", { objective }),
 		subtitle: t("goal.budget_turns_hint"),
@@ -150747,6 +151419,53 @@ async function handleKnowledgeCommand(host, _args) {
 	showMenu();
 }
 //#endregion
+//#region src/tui/commands/grants.ts
+async function handleGrantsCommand(host) {
+	const session = host.session;
+	if (session === void 0) {
+		host.showError(getNoActiveSessionMessage());
+		return;
+	}
+	let grants;
+	try {
+		grants = await session.getSessionApprovalGrants();
+	} catch (error) {
+		host.showError(t("grants.load_failed", { msg: formatErrorMessage(error) }));
+		return;
+	}
+	if (grants.length === 0) {
+		host.showStatus(t("grants.empty"), host.state.theme.colors.textDim);
+		return;
+	}
+	host.mountEditorReplacement(new ChoicePickerComponent({
+		title: t("grants.title", { count: String(grants.length) }),
+		hint: t("grants.hint"),
+		colors: host.state.theme.colors,
+		options: grants.map((pattern) => ({
+			value: pattern,
+			label: pattern,
+			tone: "danger"
+		})),
+		onSelect: (pattern) => {
+			revokeGrant(host, session, pattern);
+		},
+		onCancel: () => {
+			host.restoreEditor();
+		}
+	}));
+}
+async function revokeGrant(host, session, pattern) {
+	try {
+		const revoked = await session.revokeSessionApprovalGrant(pattern);
+		host.restoreEditor();
+		if (revoked) host.showStatus(t("grants.revoked", { pattern }), host.state.theme.colors.success);
+		else host.showError(t("grants.revoke_failed", { pattern }));
+	} catch {
+		host.restoreEditor();
+		host.showError(t("grants.revoke_failed", { pattern }));
+	}
+}
+//#endregion
 //#region ../../packages/evals/src/judge.ts
 /** Runs every rule against the input; a rule passes when its check is true. */
 function judgeOutput(input, rules) {
@@ -151287,6 +152006,9 @@ async function handleBuiltInSlashCommand(host, name, args) {
 		case "permission":
 			showPermissionPicker(host);
 			return;
+		case "grants":
+			await handleGrantsCommand(host);
+			return;
 		case "settings":
 			showSettingsSelector(host);
 			return;
@@ -151405,4 +152127,4 @@ async function handleBuiltInSlashCommand(host, name, args) {
 	}
 }
 //#endregion
-export { handleExportDebugZipCommand as $, encodeWorkDirKey as $n, lerpGradient as $t, highlightLines as A, embeddingFailureDetail as An, isTurnElapsedEnabled as At, ActivityGroupComponent as B, detectShellEnvironment as Bn, ENABLE_TERMINAL_THEME_REPORTING as Bt, handleCcCommand as C, getLlmNotSetMessage as Cn, clearInfoPanelState as Ct, ToolCallComponent as D, sortSlashCommands as Dn, createEditorTheme as Dt, UserMessageComponent as E, BUILTIN_SLASH_COMMANDS as En, resolveThemeSync as Et, StatusMessageComponent as F, PULSE_WAVE_FRAMES as Fn, detectTerminalTheme as Ft, AgentGroupComponent as G, CLI_COMMAND_NAME as Gn, QUERY_TERMINAL_THEME as Gt, estimateTokens as H, getInputHistoryFile as Hn, OSC11_RESPONSE as Ht, replaceTabs as I, TuiConfigParseError as In, parseOsc11BackgroundTheme as It, getBreathingFrame as J, PRODUCT_NAME as Jn, TERMINAL_THEME_DARK as Jt, WelcomeComponent as K, CLI_UI_MODE as Kn, TERMINAL_FOCUS_IN as Kt, sanitizeShellOutput as L, TuiLikePreferencesSchema as Ln, DISABLE_TERMINAL_FOCUS_REPORTING as Lt, CachedContainer as M, hasEmbeddingModelCache as Mn, createThemeStyles as Mt, ThinkingComponent as N, startManualEmbeddingDownload as Nn, contrastTextHex as Nt, renderDiffLines as O, isExperimentalFlagEnabled as On, createMarkdownTheme as Ot, NoticeMessageComponent as P, PIXEL_PULSE_FRAMES as Pn, getColorPalette as Pt, refineGoal as Q, ScreamHarness as Qn, FooterComponent as Qt, SkillActivationComponent as R, loadTuiConfig as Rn, DISABLE_TERMINAL_THEME_REPORTING as Rt, readJsonlFile as S, getCtrlDHint as Sn, supportsBalance as St, handleRevokeCommand as T, buildSkillSlashCommands as Tn, showUsage as Tt, getSharedSpeedTracker as U, getLogDir as Un, OSC11_RESPONSE_PREFIX as Ut, charsForTokenBudget as V, getDataDir as Vn, OSC11_QUERY as Vt, BackgroundAgentStatusComponent as W, detectInstallSource as Wn, OSC11_RESPONSE_PREFIX_NO_ESC as Wt, CompactionComponent as X, fetchCatalog as Xn, isBusy as Xt, resetBreathingClock as Y, DEFAULT_CATALOG_URL as Yn, TERMINAL_THEME_LIGHT as Yt, clearGoalState as Z, saveCatalogCache as Zn, isStreaming as Zt, handleUpdateCommand as _, EXIT_CONFIRM_WINDOW_MS as _n, handleYoloCommand as _t, syncDiagramCapabilityPrompt as a, printableChar as an, isRealUserPrompt as ar, toTerminalHyperlink as at, readUpdateCache as b, TIP_ROTATION_INTERVAL_MS as bn, showSettingsSelector as bt, disposeChildren as c, appendStreamingArgsPreview as cn, flushDiagnosticLogs as cr, handleAutoCommand as ct, isPlanExpandable as d, isTodoItemShape as dn, isScreamError as dr, handleEditorCommand as dt, SubagentSlots as en, normalizeWorkDir as er, handleExportMdCommand as et, MoonLoader as f, parseStreamingArgs as fn, isOrphanedToolCallError as fr, handleFusionPlanCommand as ft, handleMcpCommand as g, EMPTY_SESSION_HINT_URL as gn, handleWolfpackCommand as gt, handleChannelCommand as h, truncateErrorMessage as hn, handleThemeCommand as ht, buildRoleAdditionalText as i, handleLogoutCommand as in, MCP_OAUTH_AUTHORIZATION_URL_TOOL_UPDATE as ir, isInternalMessage as it, langFromPath as j, getKnowledgeStore as jn, toggleEmptySessionHint as jt, renderDiffLinesClustered as k, setExperimentalFlags as kn, isEmptySessionHintDismissed as kt, hasDispose as l, argsRecord as ln, log as lr, handleBotCommand as lt, handleMemoryCommand as m, stringValue as mn, SCREAM_ERROR_INFO as mr, handlePlanCommand as mt, clearEvalPanelState as n, handleSearchCommand as nn, readSessionIndex as nr, handleInitCommand as nt, handleExtensionCommand as o, STATUS_BULLET as on, parseRlmMaxDepthArg as or, changeThinkingLevel as ot, formatMemoryMemoForInjection as p, serializeToolResultOutput as pn, ErrorCodes as pr, handleModelCommand as pt, BREATHE_CYCLE_MS as q, CLI_USER_AGENT_PRODUCT as qn, TERMINAL_FOCUS_OUT as qt, openUrl as r, handleConnectCommand as rn, removeSessionIndexEntry as rr, handleTitleCommand as rt, handleSkillCommand as s, appendSessionHeaderHint as sn, resolveScreamHome as sr, getModelCycleLevel as st, dispatchInput as t, handleTraceCommand as tn, appendSessionIndexEntry as tr, handleForkCommand as tt, isExpandable as u, formatErrorMessage as un, resolveGlobalLogPath as ur, handleCompactCommand as ut, selectUpdateTarget as v, MAIN_AGENT_ID$1 as vn, showModelPicker as vt, getDaemonInstructions as w, getNoActiveSessionMessage as wn, showStatusReport as wt, appendJsonlLine as x, getCtrlCHint as xn, refreshProviderBalance as xt, refreshUpdateCache as y, SESSION_TIPS as yn, showPermissionPicker as yt, AssistantMessageComponent as z, saveTuiConfig as zn, ENABLE_TERMINAL_FOCUS_REPORTING as zt };
+export { refineGoal as $, ScreamHarness as $n, FooterComponent as $t, renderDiffLinesClustered as A, setExperimentalFlags as An, isEmptySessionHintDismissed as At, AssistantMessageComponent as B, saveTuiConfig as Bn, ENABLE_TERMINAL_FOCUS_REPORTING as Bt, readJsonlFile as C, getCtrlDHint as Cn, supportsBalance as Ct, UserMessageComponent as D, BUILTIN_SLASH_COMMANDS as Dn, resolveThemeSync as Dt, handleRevokeCommand as E, buildSkillSlashCommands as En, showUsage as Et, NoticeMessageComponent as F, PIXEL_PULSE_FRAMES as Fn, getColorPalette as Ft, BackgroundAgentStatusComponent as G, detectInstallSource as Gn, OSC11_RESPONSE_PREFIX_NO_ESC as Gt, charsForTokenBudget as H, getDataDir as Hn, OSC11_QUERY as Ht, StatusMessageComponent as I, PULSE_WAVE_FRAMES as In, detectTerminalTheme as It, BREATHE_CYCLE_MS as J, CLI_USER_AGENT_PRODUCT as Jn, TERMINAL_FOCUS_OUT as Jt, AgentGroupComponent as K, CLI_COMMAND_NAME as Kn, QUERY_TERMINAL_THEME as Kt, replaceTabs as L, TuiConfigParseError as Ln, parseOsc11BackgroundTheme as Lt, langFromPath as M, getKnowledgeStore as Mn, toggleEmptySessionHint as Mt, CachedContainer as N, hasEmbeddingModelCache as Nn, createThemeStyles as Nt, ToolCallComponent as O, sortSlashCommands as On, createEditorTheme as Ot, ThinkingComponent as P, startManualEmbeddingDownload as Pn, contrastTextHex as Pt, clearGoalState as Q, saveCatalogCache as Qn, isStreaming as Qt, sanitizeShellOutput as R, TuiLikePreferencesSchema as Rn, DISABLE_TERMINAL_FOCUS_REPORTING as Rt, appendJsonlLine as S, getCtrlCHint as Sn, refreshProviderBalance as St, getDaemonInstructions as T, getNoActiveSessionMessage as Tn, showStatusReport as Tt, estimateTokens as U, getInputHistoryFile as Un, OSC11_RESPONSE as Ut, ActivityGroupComponent as V, detectShellEnvironment as Vn, ENABLE_TERMINAL_THEME_REPORTING as Vt, getSharedSpeedTracker as W, getLogDir as Wn, OSC11_RESPONSE_PREFIX as Wt, resetBreathingClock as X, DEFAULT_CATALOG_URL as Xn, TERMINAL_THEME_LIGHT as Xt, getBreathingFrame as Y, PRODUCT_NAME as Yn, TERMINAL_THEME_DARK as Yt, CompactionComponent as Z, fetchCatalog as Zn, isBusy as Zt, handleMcpCommand as _, EMPTY_SESSION_HINT_URL as _n, handleWolfpackCommand as _t, buildRoleAdditionalText as a, handleLogoutCommand as an, MCP_OAUTH_AUTHORIZATION_URL_TOOL_UPDATE as ar, isInternalMessage as at, refreshUpdateCache as b, SESSION_TIPS as bn, showPermissionPicker as bt, handleSkillCommand as c, appendSessionHeaderHint as cn, resolveScreamHome as cr, getModelCycleLevel as ct, isExpandable as d, formatErrorMessage as dn, resolveGlobalLogPath as dr, handleCompactCommand as dt, lerpGradient as en, encodeWorkDirKey as er, handleExportDebugZipCommand as et, isPlanExpandable as f, isTodoItemShape as fn, isScreamError as fr, handleEditorCommand as ft, handleChannelCommand as g, truncateErrorMessage as gn, handleThemeCommand as gt, handleMemoryCommand as h, stringValue as hn, SCREAM_ERROR_INFO as hr, handlePlanCommand as ht, openUrl as i, handleConnectCommand as in, removeSessionIndexEntry as ir, handleTitleCommand as it, highlightLines as j, embeddingFailureDetail as jn, isTurnElapsedEnabled as jt, renderDiffLines as k, isExperimentalFlagEnabled as kn, createMarkdownTheme as kt, disposeChildren as l, appendStreamingArgsPreview as ln, flushDiagnosticLogs as lr, handleAutoCommand as lt, formatMemoryMemoForInjection as m, serializeToolResultOutput as mn, ErrorCodes as mr, handleModelCommand as mt, clearEvalPanelState as n, handleTraceCommand as nn, appendSessionIndexEntry as nr, handleForkCommand as nt, syncDiagramCapabilityPrompt as o, printableChar as on, isRealUserPrompt as or, toTerminalHyperlink as ot, MoonLoader as p, parseStreamingArgs as pn, isOrphanedToolCallError as pr, handleFusionPlanCommand as pt, WelcomeComponent as q, CLI_UI_MODE as qn, TERMINAL_FOCUS_IN as qt, handleGrantsCommand as r, handleSearchCommand as rn, readSessionIndex as rr, handleInitCommand as rt, handleExtensionCommand as s, STATUS_BULLET as sn, parseRlmMaxDepthArg as sr, changeThinkingLevel as st, dispatchInput as t, SubagentSlots as tn, normalizeWorkDir as tr, handleExportMdCommand as tt, hasDispose as u, argsRecord as un, log as ur, handleBotCommand as ut, handleUpdateCommand as v, EXIT_CONFIRM_WINDOW_MS as vn, handleYoloCommand as vt, handleCcCommand as w, getLlmNotSetMessage as wn, clearInfoPanelState as wt, readUpdateCache as x, TIP_ROTATION_INTERVAL_MS as xn, showSettingsSelector as xt, selectUpdateTarget as y, MAIN_AGENT_ID$1 as yn, showModelPicker as yt, SkillActivationComponent as z, loadTuiConfig as zn, DISABLE_TERMINAL_THEME_REPORTING as zt };