wayang-ai 0.8.0 → 0.8.2

package/dist/cli.js

@@ -683,6 +683,7 @@ ${getStderrTail()}`));
 
 // src/infra/session-helpers.ts
 import * as fs3 from "fs";
+import { closeSync as closeSync2, openSync as openSync2, readSync, statSync } from "fs";
 import * as path3 from "path";
 
 // src/infra/session-index.ts
@@ -1021,8 +1022,115 @@ function listSessions(homeDir2, query2 = {}) {
 function getSession(homeDir2, sessionId) {
   return createSessionIndex(homeDir2).get(sessionId);
 }
-function getLatestSessionForWorkspace(homeDir2, workspaceDir2) {
-  return createSessionIndex(homeDir2).latestForWorkspace(workspaceDir2);
+var CONVERSATION_FILENAME = "conversation.jsonl";
+var ACTIVITY_WINDOW_BYTES = 64 * 1024;
+var MAX_ACTIVITY_WINDOW_BYTES = 2 * 1024 * 1024;
+function entryTimestamp(entry) {
+  if (entry === null || typeof entry !== "object") return null;
+  const e = entry;
+  for (const raw of [e.timestamp, e.endedAt, e.startedAt]) {
+    if (typeof raw === "string") {
+      const ms = Date.parse(raw);
+      if (Number.isFinite(ms)) return ms;
+    }
+  }
+  return null;
+}
+function readTailEntryTimestamp(filePath) {
+  let size;
+  try {
+    size = statSync(filePath).size;
+  } catch {
+    return null;
+  }
+  if (size === 0) return null;
+  let windowBytes = Math.min(size, ACTIVITY_WINDOW_BYTES);
+  for (; ; ) {
+    const start = size - windowBytes;
+    const chunk = Buffer.alloc(windowBytes);
+    let fd = null;
+    try {
+      fd = openSync2(filePath, "r");
+      readSync(fd, chunk, 0, windowBytes, start);
+    } catch {
+      return null;
+    } finally {
+      if (fd !== null) closeSync2(fd);
+    }
+    let body = chunk.toString("utf-8");
+    if (start > 0) {
+      const nl = body.indexOf("\n");
+      if (nl === -1) {
+        if (windowBytes >= MAX_ACTIVITY_WINDOW_BYTES) return null;
+        windowBytes = Math.min(size, windowBytes * 2);
+        continue;
+      }
+      body = body.slice(nl + 1);
+    }
+    let latest = null;
+    for (const line of body.split("\n")) {
+      if (line.length === 0) continue;
+      let parsed;
+      try {
+        parsed = JSON.parse(line);
+      } catch {
+        continue;
+      }
+      const ts = entryTimestamp(parsed);
+      if (ts !== null && (latest === null || ts > latest)) latest = ts;
+    }
+    if (latest !== null) return latest;
+    if (start === 0 || windowBytes >= MAX_ACTIVITY_WINDOW_BYTES) return null;
+    windowBytes = Math.min(size, windowBytes * 2);
+  }
+}
+function readMetaForActivity(sessionDir) {
+  try {
+    const raw = fs3.readFileSync(path3.join(sessionDir, "meta.json"), "utf-8");
+    const meta = JSON.parse(raw);
+    return meta !== null && typeof meta === "object" ? meta : null;
+  } catch {
+    return null;
+  }
+}
+function usableTimestamp(value) {
+  return typeof value === "number" && Number.isFinite(value) && value > 0 ? value : null;
+}
+function readSessionLastActivity(sessionDir) {
+  const meta = readMetaForActivity(sessionDir);
+  const candidates = [];
+  const conversationAt = readTailEntryTimestamp(path3.join(sessionDir, CONVERSATION_FILENAME));
+  if (conversationAt !== null) candidates.push({ at: conversationAt, source: "conversation" });
+  const lastActiveAt = usableTimestamp(meta?.lastActiveAt);
+  if (lastActiveAt !== null) candidates.push({ at: lastActiveAt, source: "meta.lastActiveAt" });
+  const createdAt = usableTimestamp(meta?.createdAt);
+  if (createdAt !== null) candidates.push({ at: createdAt, source: "meta.createdAt" });
+  if (candidates.length === 0) return null;
+  return candidates.reduce((best, candidate) => candidate.at > best.at ? candidate : best);
+}
+function pickMostRecentlyActive(candidates, activityOf) {
+  let best = null;
+  let bestAt = 0;
+  for (const candidate of candidates) {
+    const at = activityOf(candidate);
+    if (best === null || at > bestAt || at === bestAt && candidate.sessionId > best.sessionId) {
+      best = candidate;
+      bestAt = at;
+    }
+  }
+  return best;
+}
+function activityAtForEntry(entry) {
+  const activity = readSessionLastActivity(entry.sessionDir);
+  if (activity) return activity.at;
+  return usableTimestamp(entry.meta.createdAt) ?? 0;
+}
+function getLatestSessionForWorkspace(homeDir2, workspaceDir2, opts = {}) {
+  const candidates = createSessionIndex(homeDir2).list({
+    workspace: workspaceDir2,
+    includeArchived: opts.includeArchived
+  });
+  return pickMostRecentlyActive(candidates, activityAtForEntry);
 }
 function readSessionUnfinishedTasks(sessionDir) {
   const tasksPath = path3.join(sessionDir, "tasks.json");
@@ -1303,7 +1411,7 @@ function validateConfig(config) {
   if (!config.providers[wp]) return `worker.provider "${wp}" not found`;
   const permission = config.permission;
   if (permission !== void 0 && permission !== null) {
-    const keys = ["allowedDirs", "autoAllowRoots", "deniedDirs"];
+    const keys = ["allowedDirs", "autoAllowRoots", "sensitiveDirs", "deniedDirs"];
     for (const key of keys) {
       const value = permission[key];
       if (value === void 0) continue;
@@ -1311,6 +1419,10 @@ function validateConfig(config) {
         return `permission.${key} must be an array of strings (got ${JSON.stringify(value)})`;
       }
     }
+    const mode = permission.sensitiveMode;
+    if (mode !== void 0 && mode !== "ask" && mode !== "deny") {
+      return `permission.sensitiveMode must be 'ask' or 'deny' (got ${JSON.stringify(mode)})`;
+    }
   }
   return null;
 }
@@ -1466,10 +1578,10 @@ import {
   existsSync as existsSync4,
   mkdirSync as mkdirSync3,
   renameSync as renameSync4,
-  openSync as openSync2,
+  openSync as openSync3,
   writeSync as writeSync2,
   fsyncSync as fsyncSync2,
-  closeSync as closeSync2,
+  closeSync as closeSync3,
   unlinkSync as unlinkSync3,
   copyFileSync
 } from "fs";
@@ -1498,16 +1610,16 @@ var JSONFileHelper = class {
     const tmp = this.tempPath();
     let fd = null;
     try {
-      fd = openSync2(tmp, "w");
+      fd = openSync3(tmp, "w");
       writeSync2(fd, JSON.stringify(value, null, 2));
       fsyncSync2(fd);
-      closeSync2(fd);
+      closeSync3(fd);
       fd = null;
       renameSync4(tmp, this.filePath);
     } catch (err) {
       if (fd !== null) {
         try {
-          closeSync2(fd);
+          closeSync3(fd);
         } catch {
         }
       }
@@ -1958,56 +2070,6 @@ var theme = {
   }
 };
 
-// src/tui/utils/chat-lookups.ts
-var EMPTY_CHAT_LOOKUPS = {
-  permissionRequests: /* @__PURE__ */ new Map(),
-  inquiries: /* @__PURE__ */ new Map(),
-  workers: /* @__PURE__ */ new Map(),
-  workerTypeEmoji: /* @__PURE__ */ new Map()
-};
-function buildChatLookups(items) {
-  const permissionRequests = /* @__PURE__ */ new Map();
-  const inquiries = /* @__PURE__ */ new Map();
-  const workers = /* @__PURE__ */ new Map();
-  const workerTypeEmoji = /* @__PURE__ */ new Map();
-  for (const item of items) {
-    if (item.role !== "signal") continue;
-    if (item.workerType && item.emoji && !workerTypeEmoji.has(item.workerType)) {
-      workerTypeEmoji.set(item.workerType, item.emoji);
-    }
-    let worker;
-    if (item.workerId) {
-      const prev = workers.get(item.workerId);
-      worker = {
-        workerId: item.workerId,
-        emoji: item.emoji ?? prev?.emoji,
-        workerType: item.workerType ?? prev?.workerType,
-        taskTitle: item.taskTitle ?? prev?.taskTitle
-      };
-      workers.set(item.workerId, worker);
-    }
-    const requestId = item.permissionMeta?.requestId;
-    if (item.permissionMeta && requestId) {
-      permissionRequests.set(requestId, { meta: item.permissionMeta, ...worker && { worker } });
-    }
-    const inquiryId = item.inquiryMeta?.inquiryId;
-    if (item.inquiryMeta && inquiryId) {
-      inquiries.set(inquiryId, { meta: item.inquiryMeta, ...worker && { worker } });
-    }
-  }
-  return { permissionRequests, inquiries, workers, workerTypeEmoji };
-}
-function formatWorkerTag(ctx) {
-  const parts = [];
-  if (ctx.taskTitle) parts.push(ctx.taskTitle);
-  if (ctx.workerId) parts.push(`w:${ctx.workerId.slice(-4)}`);
-  const body = parts.join(" \xB7 ");
-  return [ctx.emoji, body].filter(Boolean).join(" ");
-}
-
-// src/tui/components/chat-area/user-row.tsx
-import { Box, Text } from "ink";
-
 // src/tui/utils/text-width.ts
 function charWidth(cp) {
   if (cp >= 768 && cp <= 879) return 0;
@@ -2049,6 +2111,28 @@ function sliceToWidth(s, maxWidth) {
   }
   return out;
 }
+function sliceToWidthFromEnd(s, maxWidth) {
+  if (maxWidth <= 0) return "";
+  const chars = Array.from(s);
+  let w = 0;
+  let out = "";
+  for (let i = chars.length - 1; i >= 0; i -= 1) {
+    const cw = charWidth(chars[i].codePointAt(0) ?? 0);
+    if (w + cw > maxWidth) break;
+    out = chars[i] + out;
+    w += cw;
+  }
+  return out;
+}
+function truncateMiddleToWidth(s, maxWidth) {
+  if (maxWidth <= 0) return "";
+  if (stringWidth(s) <= maxWidth) return s;
+  if (maxWidth === 1) return "\u2026";
+  const keep = maxWidth - 1;
+  const headBudget = Math.ceil(keep / 2);
+  const tailBudget = keep - headBudget;
+  return sliceToWidth(s, headBudget) + "\u2026" + sliceToWidthFromEnd(s, tailBudget);
+}
 function collapseWhitespace(s) {
   return s.replace(/\s+/g, " ").trim();
 }
@@ -2063,7 +2147,144 @@ function shortId(id) {
   return id.slice(-4);
 }
 
+// src/tui/utils/workspace-display.ts
+var EMPTY_WORKSPACE_CONTEXT = { workspaces: [] };
+function formatWorkspaceSlug(workspace) {
+  const slug = workspace?.slug?.trim();
+  return slug ? slug : null;
+}
+function formatWorkspaceSummary(workspaces) {
+  if (!workspaces || workspaces.length === 0) return null;
+  const slugs = workspaces.map((workspace) => workspace?.slug?.trim()).filter((slug) => !!slug);
+  if (slugs.length === 0) return null;
+  if (slugs.length === 1) return slugs[0];
+  return `${slugs[0]} +${slugs.length - 1}`;
+}
+function isSameWorkspacePath(a, b) {
+  const left = a?.trim();
+  const right = b?.trim();
+  if (!left || !right) return false;
+  return normalizeWorkspacePath(left) === normalizeWorkspacePath(right);
+}
+function resolveWorkspaceSlug(workspace) {
+  const slug = workspace?.slug?.trim();
+  if (slug) return slug;
+  const path9 = workspace?.path?.trim();
+  return path9 ? workspaceSlugFromPath(path9) : null;
+}
+function formatTaskWorkspaceMark(workspace, defaultWorkspacePath) {
+  const slug = resolveWorkspaceSlug(workspace);
+  if (!slug) return "";
+  if (defaultWorkspacePath && isSameWorkspacePath(workspace?.path, defaultWorkspacePath)) {
+    return "";
+  }
+  return ` \u2014 ${slug}`;
+}
+function resolveDeclaredWorkspaceSlug(declaredPath, options = {}) {
+  const raw = declaredPath?.trim();
+  if (!raw) return null;
+  if (options.defaultWorkspacePath && isSameWorkspacePath(raw, options.defaultWorkspacePath)) {
+    return null;
+  }
+  const known = (options.workspaces ?? []).find(
+    (workspace) => workspace?.path && isSameWorkspacePath(workspace.path, raw)
+  );
+  if (known) return resolveWorkspaceSlug(known);
+  return resolveWorkspaceSlug({ path: normalizeWorkspacePath(raw) });
+}
+var PROJECT_LIST_MAX_WIDTH = 80;
+var PROJECT_DEFAULT_MARKER = "*";
+var PROJECT_DEFAULT_LEGEND = "* = default workspace";
+function collectProjectEntries(input2) {
+  const defaultPath = input2.defaultWorkspacePath?.trim();
+  const seen = /* @__PURE__ */ new Set();
+  const entries = [];
+  const candidates = [
+    ...input2.workspaces ?? [],
+    ...input2.taskWorkspaces ?? [],
+    ...defaultPath ? [{ path: defaultPath }] : []
+  ];
+  for (const candidate of candidates) {
+    const rawPath = candidate?.path?.trim();
+    if (!rawPath) continue;
+    const canonical = normalizeWorkspacePath(rawPath);
+    if (seen.has(canonical)) continue;
+    const slug = resolveWorkspaceSlug({ ...candidate, path: rawPath });
+    if (!slug) continue;
+    seen.add(canonical);
+    entries.push({
+      slug,
+      path: rawPath,
+      isDefault: defaultPath !== void 0 && isSameWorkspacePath(rawPath, defaultPath)
+    });
+  }
+  const defaultEntry = entries.find((entry) => entry.isDefault);
+  return defaultEntry ? [defaultEntry, ...entries.filter((entry) => entry !== defaultEntry)] : entries;
+}
+function formatProjectList(input2, options = {}) {
+  const maxWidth = options.maxWidth ?? PROJECT_LIST_MAX_WIDTH;
+  const entries = collectProjectEntries(input2);
+  if (entries.length === 0) return "No projects";
+  const lines = entries.map((entry) => {
+    const suffix = entry.isDefault ? `  ${PROJECT_DEFAULT_MARKER}` : "";
+    const prefix = `${entry.slug}  `;
+    const pathBudget = Math.max(1, maxWidth - stringWidth(prefix) - stringWidth(suffix));
+    return prefix + truncateMiddleToWidth(entry.path, pathBudget) + suffix;
+  });
+  if (entries.some((entry) => entry.isDefault)) lines.push(PROJECT_DEFAULT_LEGEND);
+  return lines.join("\n");
+}
+
+// src/tui/utils/chat-lookups.ts
+var EMPTY_CHAT_LOOKUPS = {
+  permissionRequests: /* @__PURE__ */ new Map(),
+  inquiries: /* @__PURE__ */ new Map(),
+  workers: /* @__PURE__ */ new Map(),
+  workerTypeEmoji: /* @__PURE__ */ new Map(),
+  workspace: EMPTY_WORKSPACE_CONTEXT
+};
+function buildChatLookups(items, workspace = EMPTY_WORKSPACE_CONTEXT) {
+  const permissionRequests = /* @__PURE__ */ new Map();
+  const inquiries = /* @__PURE__ */ new Map();
+  const workers = /* @__PURE__ */ new Map();
+  const workerTypeEmoji = /* @__PURE__ */ new Map();
+  for (const item of items) {
+    if (item.role !== "signal") continue;
+    if (item.workerType && item.emoji && !workerTypeEmoji.has(item.workerType)) {
+      workerTypeEmoji.set(item.workerType, item.emoji);
+    }
+    let worker;
+    if (item.workerId) {
+      const prev = workers.get(item.workerId);
+      worker = {
+        workerId: item.workerId,
+        emoji: item.emoji ?? prev?.emoji,
+        workerType: item.workerType ?? prev?.workerType,
+        taskTitle: item.taskTitle ?? prev?.taskTitle
+      };
+      workers.set(item.workerId, worker);
+    }
+    const requestId = item.permissionMeta?.requestId;
+    if (item.permissionMeta && requestId) {
+      permissionRequests.set(requestId, { meta: item.permissionMeta, ...worker && { worker } });
+    }
+    const inquiryId = item.inquiryMeta?.inquiryId;
+    if (item.inquiryMeta && inquiryId) {
+      inquiries.set(inquiryId, { meta: item.inquiryMeta, ...worker && { worker } });
+    }
+  }
+  return { permissionRequests, inquiries, workers, workerTypeEmoji, workspace };
+}
+function formatWorkerTag(ctx) {
+  const parts = [];
+  if (ctx.taskTitle) parts.push(ctx.taskTitle);
+  if (ctx.workerId) parts.push(`w:${ctx.workerId.slice(-4)}`);
+  const body = parts.join(" \xB7 ");
+  return [ctx.emoji, body].filter(Boolean).join(" ");
+}
+
 // src/tui/components/chat-area/user-row.tsx
+import { Box, Text } from "ink";
 import { jsx as jsx2, jsxs } from "react/jsx-runtime";
 var PREFIX = `${theme.user.prefix} `;
 var PREFIX_WIDTH = stringWidth(PREFIX);
@@ -2199,15 +2420,18 @@ function toolTarget(toolName, args, budget) {
 function requestArgs(meta) {
   return meta.toolArgs && typeof meta.toolArgs === "object" && !Array.isArray(meta.toolArgs) ? meta.toolArgs : {};
 }
-var RESOLVED_PATH_RE = /^\S+: (.*) \(resolved: (.*)\)$/s;
+var RESOLVED_PATH_RE = /^\S+: (.*) \(resolved: (.*?)\)(?: \[(.*)\])?$/s;
 function meaningfulDescription(description) {
   if (!description) return "";
   const text = description.trim();
   if (/^execute shell command:/i.test(text)) return "";
   const m = RESOLVED_PATH_RE.exec(text);
   if (m) {
-    const [, rawPath, resolved] = m;
-    return resolved && resolved !== rawPath ? `\u89E3\u6790\u4E3A ${resolved}` : "";
+    const [, rawPath, resolved, hit] = m;
+    const parts = [];
+    if (resolved && resolved !== rawPath) parts.push(`\u89E3\u6790\u4E3A ${resolved}`);
+    if (hit) parts.push(`[${hit}]`);
+    return collapseWhitespace(parts.join(" "));
   }
   return collapseWhitespace(text);
 }
@@ -2318,11 +2542,25 @@ function summarizeWorkerMessage(argsJson, width, result2, maxLines = 3) {
   };
 }
 var TASK_ID_RE = /^Task (\S+) (?:added|assigned)/;
-function summarizeAddTask(argsJson, width, result2, maxLines = 2) {
+var ADD_TASK_HEADER_CHROME = 27;
+var ADD_TASK_TAG_INSET = 1;
+var ADD_TASK_WORKSPACE_TAG_MAX_WIDTH = 16;
+function formatAddTaskWorkspaceTag(slug, maxWidth = ADD_TASK_WORKSPACE_TAG_MAX_WIDTH) {
+  const label = slug?.trim();
+  if (!label) return "";
+  return truncateToWidth(` \u2014 ${label}`, maxWidth);
+}
+function summarizeAddTask(argsJson, width, result2, options = {}) {
   const args = parseArgs(argsJson) ?? {};
+  const maxLines = options.maxLines ?? 2;
   const title = str(args.title) ?? "(untitled)";
   const description = str(args.description) ?? "";
   const { lines, hidden } = previewLines(description, maxLines, width);
+  const declaredWorkspaceSlug = resolveDeclaredWorkspaceSlug(str(args.workspace), {
+    defaultWorkspacePath: options.defaultWorkspacePath,
+    workspaces: options.workspaces
+  });
+  const workspaceTag = formatAddTaskWorkspaceTag(declaredWorkspaceSlug);
   let outcome = "pending";
   let taskShortId;
   let failure = "";
@@ -2336,8 +2574,11 @@ function summarizeAddTask(argsJson, width, result2, maxLines = 2) {
       failure = failureText(result2.text, width);
     }
   }
+  const tagCost = workspaceTag ? stringWidth(workspaceTag) + ADD_TASK_TAG_INSET : 0;
+  const titleBudget = Math.max(1, width - ADD_TASK_HEADER_CHROME - tagCost);
   return {
-    title: fitWithSuffix(collapseWhitespace(title), "", width),
+    title: fitWithSuffix(collapseWhitespace(title), "", titleBudget),
+    ...declaredWorkspaceSlug && { workspaceSlug: declaredWorkspaceSlug },
     workerType: str(args.workerType) ?? str(args.worker_type) ?? "puppet",
     ...str(args.priority) && { priority: str(args.priority) },
     multiStage: args.multiStage === true,
@@ -2597,8 +2838,13 @@ function AddTaskRow({ section: section2, result: result2, lookups }) {
   const summary = summarizeAddTask(
     section2.text,
     SECONDARY_WIDTH,
-    result2 ? { text: result2.text, isError: result2.isError } : void 0
+    result2 ? { text: result2.text, isError: result2.isError } : void 0,
+    {
+      defaultWorkspacePath: lookups.workspace.defaultWorkspacePath,
+      workspaces: lookups.workspace.workspaces
+    }
   );
+  const workspaceTag = formatAddTaskWorkspaceTag(summary.workspaceSlug);
   const reuse = summary.assignToWorker !== void 0;
   const iconColor = summary.outcome === "failed" ? theme.action.failColor : theme.action.color;
   const reusedWorker = reuse ? lookups.workers.get(summary.assignToWorker) : void 0;
@@ -2623,6 +2869,7 @@ function AddTaskRow({ section: section2, result: result2, lookups }) {
         " #",
         summary.taskShortId
       ] }),
+      workspaceTag ? /* @__PURE__ */ jsx3(Text2, { color: theme.secondary.color, children: workspaceTag }) : null,
       /* @__PURE__ */ jsx3(OutcomeMark, { outcome: summary.outcome, ok: "\u5DF2\u6D3E\u53D1", failed: "\u6D3E\u53D1\u5931\u8D25" })
     ] }),
     /* @__PURE__ */ jsx3(SecondaryLine, { children: metaLine }),
@@ -2817,14 +3064,20 @@ function shouldShowGap(prev, _current) {
   if (!prev) return false;
   return true;
 }
-var ChatArea = React2.memo(function ChatArea2({ items, busy, streamingItems, contentWidth }) {
+var ChatArea = React2.memo(function ChatArea2({
+  items,
+  busy,
+  streamingItems,
+  contentWidth,
+  workspace = EMPTY_WORKSPACE_CONTEXT
+}) {
   const width = contentWidth ?? 78;
   const { staticItems, dynamicItems } = useMemo(() => {
     const read = items.filter((i) => i.read);
     const unread = items.filter((i) => !i.read);
     return { staticItems: read, dynamicItems: unread };
   }, [items]);
-  const lookups = useMemo(() => buildChatLookups(items), [items]);
+  const lookups = useMemo(() => buildChatLookups(items, workspace), [items, workspace]);
   return /* @__PURE__ */ jsxs5(Fragment2, { children: [
     /* @__PURE__ */ jsx8(Static, { items: staticItems, children: (item, idx) => /* @__PURE__ */ jsx8(
       Box5,
@@ -2975,29 +3228,61 @@ function renderShortcutList() {
   return lines.join("\n");
 }
 
-// src/tui/utils/workspace-display.ts
-function formatWorkspaceSlug(workspace) {
-  const slug = workspace?.slug?.trim();
-  return slug ? slug : null;
+// src/tui/utils/task-list.ts
+var TASK_LIST_DESCRIPTION_MAX_WIDTH = 80;
+var TASK_LIST_MAX_ITEMS = 20;
+function truncateForList(text, maxWidth = TASK_LIST_DESCRIPTION_MAX_WIDTH) {
+  return truncateToWidth(collapseWhitespace(text), maxWidth);
 }
-function formatWorkspaceSummary(workspaces) {
-  if (!workspaces || workspaces.length === 0) return null;
-  const slugs = workspaces.map((workspace) => workspace?.slug?.trim()).filter((slug) => !!slug);
-  if (slugs.length === 0) return null;
-  if (slugs.length === 1) return slugs[0];
-  return `${slugs[0]} +${slugs.length - 1}`;
-}
-function formatWorkspaceDetail(workspace) {
-  const path9 = workspace?.path?.trim();
-  const slug = workspace?.slug?.trim();
-  if (path9 && slug) return `${slug} (${path9})`;
-  return path9 || slug || null;
+var ACTIVE_TASK_STATUSES = /* @__PURE__ */ new Set([
+  "pending",
+  "running"
+]);
+function isActiveTask(task) {
+  return ACTIVE_TASK_STATUSES.has(task.status);
+}
+function limitForList(items, max = TASK_LIST_MAX_ITEMS, options = {}) {
+  const isActive = options.isActive ?? (() => false);
+  const total = items.length;
+  if (total === 0) {
+    return { items: [], total, hidden: 0, note: null };
+  }
+  const activeIndices = [];
+  const historyIndices = [];
+  items.forEach((item, index) => {
+    (isActive(item) ? activeIndices : historyIndices).push(index);
+  });
+  const historyBudget = Math.max(0, max - activeIndices.length);
+  const keptHistory = historyBudget === 0 ? [] : historyIndices.slice(-historyBudget);
+  const keep = /* @__PURE__ */ new Set([...activeIndices, ...keptHistory]);
+  const kept = items.filter((_, index) => keep.has(index));
+  const hidden = total - kept.length;
+  if (hidden === 0) {
+    return { items: kept, total, hidden: 0, note: null };
+  }
+  const note = activeIndices.length > 0 ? `${noteFor(total, kept.length)}\uFF08\u53E6\u6709 ${hidden} \u6761\u5386\u53F2\u672A\u663E\u793A\uFF09` : noteFor(total, kept.length);
+  return { items: kept, total, hidden, note };
+}
+function noteFor(total, shown) {
+  return `\u2026 \u663E\u793A\u6700\u8FD1 ${shown} / \u5171 ${total} \u6761`;
+}
+function formatTaskRow(task, options = {}) {
+  const workspacePart = formatTaskWorkspaceMark(task.workspace, options.defaultWorkspacePath);
+  const description = truncateForList(task.description, options.descriptionMaxWidth);
+  return `[${task.status}] ${task.id}: ${description}${workspacePart}${task.result ? ` \u2192 ${task.result}` : ""}`;
+}
+function formatTaskList(tasks, options = {}) {
+  const limited = limitForList(tasks, options.maxItems, { isActive: isActiveTask });
+  const lines = limited.items.map((task) => formatTaskRow(task, options));
+  if (limited.note) lines.push(limited.note);
+  return lines.join("\n");
 }
 
 // src/tui/hooks/use-slash-commands.ts
 var SLASH_COMMANDS = [
   { name: "tasks", args: "[status]", description: "List tasks" },
   { name: "workers", description: "List active workers" },
+  { name: "projects", description: "List session workspaces" },
   { name: "cancel", args: "<id>", description: "Cancel a task" },
   { name: "context", description: "Show context token breakdown" },
   { name: "compact", description: "Compact context" },
@@ -3018,12 +3303,21 @@ function useSlashCommands(supervisor) {
         const status = parts[1];
         const tasks = await supervisor.engine.list(status);
         if (tasks.length === 0) return { handled: true, output: "No tasks" };
-        const lines = tasks.map((t) => {
-          const workspace = formatWorkspaceDetail(t.workspace);
-          const workspacePart = workspace ? ` \u2014 ${workspace}` : "";
-          return `[${t.status}] ${t.id}: ${t.description}${workspacePart}${t.result ? ` \u2192 ${t.result}` : ""}`;
-        });
-        return { handled: true, output: lines.join("\n") };
+        return {
+          handled: true,
+          output: formatTaskList(tasks, { defaultWorkspacePath: supervisor.ctx.workspaceDir })
+        };
+      }
+      case "projects": {
+        const tasks = await supervisor.engine.list();
+        return {
+          handled: true,
+          output: formatProjectList({
+            workspaces: supervisor.ctx.workspaces,
+            taskWorkspaces: tasks.map((task) => task.workspace ?? {}),
+            defaultWorkspacePath: supervisor.ctx.workspaceDir
+          })
+        };
       }
       case "workers": {
         const activeWorkers = supervisor.engine.getActiveWorkers();
@@ -3057,8 +3351,9 @@ function useSlashCommands(supervisor) {
           handled: true,
           output: [
             "Commands:",
-            "  /tasks [status]   \u2014 List tasks",
+            "  /tasks [status]   \u2014 List tasks (workspace slug when not the default)",
             "  /workers          \u2014 List active workers",
+            "  /projects         \u2014 List session workspaces (* = default workspace)",
             "  /cancel <id>      \u2014 Cancel a task and abort its worker",
             "  /context          \u2014 Show context token breakdown",
             "  /compact          \u2014 Compact conversation context",
@@ -4162,6 +4457,13 @@ function ControllerPage({ onExit }) {
         break;
     }
   });
+  const workspaceContext = useMemo4(
+    () => ({
+      defaultWorkspacePath: supervisor.ctx.workspaceDir,
+      workspaces: supervisor.ctx.workspaces
+    }),
+    [supervisor]
+  );
   const { handleCommand } = useSlashCommands(supervisor);
   const handleSubmit = useMemoizedFn(async (input2) => {
     let cmdResult;
@@ -4201,7 +4503,8 @@ function ControllerPage({ onExit }) {
         items: displayItems,
         busy,
         streamingItems,
-        contentWidth: chatContentWidth
+        contentWidth: chatContentWidth,
+        workspace: workspaceContext
       }
     ) }),
     overlay && /* @__PURE__ */ jsx13(OverlayPanel, { overlay }),
@@ -4268,7 +4571,7 @@ function AppContent() {
 // package.json
 var package_default = {
   name: "wayang-ai",
-  version: "0.8.0",
+  version: "0.8.2",
   description: "Multi-agent orchestration platform",
   type: "module",
   license: "MIT",
@@ -4395,6 +4698,36 @@ import * as fs5 from "fs";
 import * as path6 from "path";
 import * as childProcess from "child_process";
 import prompts from "prompts";
+
+// src/infra/permission/permission-config.ts
+var DEFAULT_SENSITIVE_MODE = "ask";
+function mergeSensitiveDirs(permission) {
+  const entries = [...permission?.sensitiveDirs ?? [], ...permission?.deniedDirs ?? []];
+  const seen = /* @__PURE__ */ new Set();
+  const merged = [];
+  for (const entry of entries) {
+    if (typeof entry !== "string" || entry.length === 0) continue;
+    if (seen.has(entry)) continue;
+    seen.add(entry);
+    merged.push(entry);
+  }
+  return merged;
+}
+function resolveSensitiveMode(permission) {
+  return permission?.sensitiveMode ?? DEFAULT_SENSITIVE_MODE;
+}
+var deprecatedDeniedDirsWarned = false;
+function warnDeprecatedPermissionKeys(permission, warn) {
+  if (deprecatedDeniedDirsWarned) return;
+  const legacy = permission?.deniedDirs;
+  if (!Array.isArray(legacy) || legacy.length === 0) return;
+  deprecatedDeniedDirsWarned = true;
+  warn(
+    "permission.deniedDirs is deprecated and will be removed in a future release \u2014 use permission.sensitiveDirs instead (both keys are read and merged)."
+  );
+}
+
+// src/onboard.ts
 function fillApiKeys(config) {
   const envKey = process.env.WAYANG_LLM_API_KEY || "";
   for (const provider of Object.values(config.providers)) {
@@ -4549,6 +4882,7 @@ async function loadConfig(configPath2, options = {}) {
     }
   }
   fillApiKeys(config);
+  warnDeprecatedPermissionKeys(config.permission, (message) => console.warn(`Warning: ${message}`));
   const err = validateConfig(config);
   if (err) {
     if (nonInteractive) throw new Error(`Invalid config: ${err}`);
@@ -5261,7 +5595,7 @@ var SignalQueue = class {
 };
 
 // src/services/worker-transcript.ts
-import { closeSync as closeSync3, existsSync as existsSync8, openSync as openSync3, readSync, statSync } from "fs";
+import { closeSync as closeSync4, existsSync as existsSync8, openSync as openSync4, readSync as readSync2, statSync as statSync2 } from "fs";
 import { join as join12 } from "path";
 
 // src/services/agents/worker-state.ts
@@ -5805,7 +6139,7 @@ function readWorkerTranscriptWindow(sessionDir, workerId, opts = {}) {
   const path9 = workerTranscriptPath(sessionDir, workerId);
   let size;
   try {
-    size = statSync(path9).size;
+    size = statSync2(path9).size;
   } catch {
     return null;
   }
@@ -5819,11 +6153,11 @@ function readWorkerTranscriptWindow(sessionDir, workerId, opts = {}) {
     const readLen = Math.min(size, windowBytes);
     const start = size - readLen;
     const chunk = Buffer.alloc(readLen);
-    const fd = openSync3(path9, "r");
+    const fd = openSync4(path9, "r");
     try {
-      readSync(fd, chunk, 0, readLen, start);
+      readSync2(fd, chunk, 0, readLen, start);
     } finally {
-      closeSync3(fd);
+      closeSync4(fd);
     }
     const parsed = parseWindow(chunk.toString("utf8"), start === 0);
     const enough = parsed.entries.filter(matches).length >= need;
@@ -5873,7 +6207,7 @@ function entryLabel(entry) {
   return subtype ? `${entry.type}/${subtype}` : entry.type;
 }
 var TERMINAL_SUBTYPES = /* @__PURE__ */ new Set(["task_result" /* TaskResult */, "error" /* Error */]);
-function entryTimestamp(entry) {
+function entryTimestamp2(entry) {
   const e = entry;
   for (const raw of [e.timestamp, e.endedAt, e.startedAt]) {
     if (typeof raw === "string") {
@@ -5886,7 +6220,7 @@ function entryTimestamp(entry) {
 function summarizeTranscript(entries) {
   let lastActivityAt = null;
   for (let i = entries.length - 1; i >= 0; i--) {
-    lastActivityAt = entryTimestamp(entries[i]);
+    lastActivityAt = entryTimestamp2(entries[i]);
     if (lastActivityAt !== null) break;
   }
   let currentTool = null;
@@ -7050,7 +7384,7 @@ function buildWorkerList(workers) {
   }
   return section("Available workers", lines.join("\n"));
 }
-function buildControllerSystemPrompt(ctx, skills) {
+function buildControllerSystemPrompt(ctx, skills, opts) {
   return assemble(
     IDENTITY,
     RESPONSE_STYLE,
@@ -7061,13 +7395,82 @@ function buildControllerSystemPrompt(ctx, skills) {
     HARD_CONSTRAINTS,
     buildWorkerList(ctx.config.workers),
     buildSkillCatalog(skills),
-    buildEnvironment(ctx)
+    buildEnvironment(ctx),
+    // Project conventions go last: they are the most specific instruction and
+    // the last word on conflicts with the generic sections above.
+    opts?.rules
   );
 }
 
+// src/services/agents/prompts/controller-rules.ts
+import { readFileSync as readFileSync8, realpathSync as realpathSync2, statSync as statSync3 } from "fs";
+import { join as join14 } from "path";
+var CONTROLLER_RULES_FILENAME = "AGENTS.md";
+var CONTROLLER_RULES_MAX_BYTES = 32 * 1024;
+function loadControllerRules(opts) {
+  const maxBytes = opts.maxBytes ?? CONTROLLER_RULES_MAX_BYTES;
+  const files = [];
+  for (const dir of [opts.homeDir, opts.cwd]) {
+    if (!dir) continue;
+    const file = readRulesFile(dir);
+    if (!file) continue;
+    if (files.some((seen) => seen.path === file.path)) continue;
+    files.push(file);
+  }
+  if (files.length === 0) return "";
+  const bodies = [];
+  let usedBytes = 0;
+  let truncated = false;
+  for (const file of files) {
+    const heading = `## Project rules (from ${file.path})`;
+    const size = Buffer.byteLength(file.content, "utf8");
+    if (usedBytes + size <= maxBytes) {
+      bodies.push(`${heading}
+
+${file.content.trimEnd()}`);
+      usedBytes += size;
+      continue;
+    }
+    const budget = maxBytes - usedBytes;
+    const head = budget > 0 ? truncateToBytes(file.content, budget).trimEnd() : "";
+    bodies.push(head ? `${heading}
+
+${head}` : heading);
+    truncated = true;
+    break;
+  }
+  const intro = `${CONTROLLER_RULES_FILENAME} content loaded once at startup. The home directory file comes first as the baseline; the working directory file comes second and takes precedence wherever the two disagree. Follow these rules unless the user explicitly overrides them.`;
+  const parts = [`# Project rules
+
+${intro}`, ...bodies];
+  if (truncated) {
+    parts.push(
+      `...truncated at ${maxBytes} bytes (rules content exceeded the ${maxBytes}-byte total limit: the rest of the last file and any later files were dropped)`
+    );
+  }
+  return parts.join("\n\n");
+}
+function readRulesFile(dir) {
+  const candidate = join14(dir, CONTROLLER_RULES_FILENAME);
+  try {
+    const path9 = realpathSync2(candidate);
+    if (!statSync3(path9).isFile()) return null;
+    const content = readFileSync8(path9, "utf8");
+    if (!content.trim()) return null;
+    return { path: path9, content };
+  } catch {
+    return null;
+  }
+}
+function truncateToBytes(text, maxBytes) {
+  const buf = Buffer.from(text, "utf8");
+  if (buf.length <= maxBytes) return text;
+  return buf.subarray(0, maxBytes).toString("utf8").replace(/\uFFFD+$/, "");
+}
+
 // src/services/agents/prompts/project-rules.ts
-import { existsSync as existsSync9, readFileSync as readFileSync8, statSync as statSync2 } from "fs";
-import { basename as basename5, dirname as dirname6, join as join14, resolve as resolve3 } from "path";
+import { existsSync as existsSync9, readFileSync as readFileSync9, statSync as statSync4 } from "fs";
+import { basename as basename5, dirname as dirname6, join as join15, resolve as resolve3 } from "path";
 var RULE_FILE_NAMES = ["AGENTS.md", "CLAUDE.md"];
 var MAX_LEVELS = 5;
 var PROJECT_RULES_MAX_LENGTH = 8e3;
@@ -7076,7 +7479,7 @@ function findProjectRules(startDir) {
   for (let level = 0; level < MAX_LEVELS; level++) {
     const found = readRuleFile(current);
     if (found) return found;
-    if (existsSync9(join14(current, ".git"))) break;
+    if (existsSync9(join15(current, ".git"))) break;
     const parent = dirname6(current);
     if (parent === current) break;
     current = parent;
@@ -7085,10 +7488,10 @@ function findProjectRules(startDir) {
 }
 function readRuleFile(dir) {
   for (const name of RULE_FILE_NAMES) {
-    const path9 = join14(dir, name);
+    const path9 = join15(dir, name);
     try {
-      if (!statSync2(path9).isFile()) continue;
-      const content = readFileSync8(path9, "utf8");
+      if (!statSync4(path9).isFile()) continue;
+      const content = readFileSync9(path9, "utf8");
       if (!content.trim()) continue;
       return { path: path9, content };
     } catch {
@@ -7588,9 +7991,9 @@ function toolResultBlockToRecord(block, toolName, endedAt) {
 import { resolve as resolve5 } from "path";
 
 // src/infra/permission/policy.ts
-import { realpathSync as realpathSync2 } from "fs";
-import { basename as basename6, dirname as dirname7, isAbsolute, join as join15, resolve as resolve4, sep } from "path";
-var DEFAULT_DENIED_RELATIVE_PATHS = [
+import { realpathSync as realpathSync3 } from "fs";
+import { basename as basename6, dirname as dirname7, isAbsolute, join as join16, resolve as resolve4, sep } from "path";
+var DEFAULT_SENSITIVE_RELATIVE_PATHS = [
   ".ssh",
   ".gnupg",
   ".aws",
@@ -7624,12 +8027,15 @@ var SENSITIVE_SEGMENTS = /* @__PURE__ */ new Set([
 var SENSITIVE_FILENAMES = /* @__PURE__ */ new Set([
   ".wayang.config.json"
 ]);
+var SENSITIVE_SEGMENT_PAIRS = [
+  [".docker", "config.json"]
+];
 var MAX_ANCESTOR_DEPTH = 32;
 function normalizePath(p, opts = {}) {
   const base = opts.base ?? process.cwd();
   const lexical = isAbsolute(p) ? resolve4(p) : resolve4(base, p);
   try {
-    return realpathSync2(lexical);
+    return realpathSync3(lexical);
   } catch {
     return resolveDeepestExistingAncestor(lexical);
   }
@@ -7639,8 +8045,8 @@ function resolveDeepestExistingAncestor(lexical) {
   let candidate = lexical;
   for (let depth = 0; depth <= MAX_ANCESTOR_DEPTH; depth += 1) {
     try {
-      const resolved = realpathSync2(candidate);
-      return peeled.length === 0 ? resolved : resolve4(join15(resolved, ...peeled));
+      const resolved = realpathSync3(candidate);
+      return peeled.length === 0 ? resolved : resolve4(join16(resolved, ...peeled));
     } catch {
     }
     const parent = dirname7(candidate);
@@ -7650,8 +8056,8 @@ function resolveDeepestExistingAncestor(lexical) {
   }
   return lexical;
 }
-function defaultDeniedPaths(homeDir2) {
-  return DEFAULT_DENIED_RELATIVE_PATHS.map((rel) => resolve4(homeDir2, rel));
+function defaultSensitivePaths(homeDir2) {
+  return DEFAULT_SENSITIVE_RELATIVE_PATHS.map((rel) => resolve4(homeDir2, rel));
 }
 function isPathWithin(parent, child) {
   if (parent === sep) return child.startsWith(sep);
@@ -7659,21 +8065,39 @@ function isPathWithin(parent, child) {
   const prefix = parent.endsWith(sep) ? parent : parent + sep;
   return child.startsWith(prefix);
 }
-function isDenied(absPath, deniedPaths) {
-  return deniedPaths.some((denied) => isPathWithin(denied, absPath));
+function isDenied(absPath, sensitivePaths) {
+  return sensitivePaths.some((sensitive) => isPathWithin(sensitive, absPath));
 }
-function isSensitiveSegmentPath(absPath) {
+function matchSensitiveEntry(absPath) {
   const segments = absPath.split(sep).filter((s) => s.length > 0);
   for (let i = 0; i < segments.length; i += 1) {
     const segment = segments[i];
-    if (SENSITIVE_SEGMENTS.has(segment) || SENSITIVE_FILENAMES.has(segment)) {
-      return true;
-    }
-    if (segment === ".docker" && segments[i + 1] === "config.json") {
-      return true;
+    if (SENSITIVE_SEGMENTS.has(segment)) return { entry: segment, source: "segment" };
+    if (SENSITIVE_FILENAMES.has(segment)) return { entry: segment, source: "filename" };
+    for (const [dir, child] of SENSITIVE_SEGMENT_PAIRS) {
+      if (segment === dir && segments[i + 1] === child) {
+        return { entry: `${dir}/${child}`, source: "pair" };
+      }
     }
   }
-  return false;
+  return void 0;
+}
+function sensitivePathEntries(homeDir2, extraSensitiveDirs) {
+  const builtIn = DEFAULT_SENSITIVE_RELATIVE_PATHS.map((rel) => ({
+    absPath: normalizePath(resolve4(homeDir2, rel)),
+    entry: rel,
+    source: "home-default"
+  }));
+  const configured = (extraSensitiveDirs ?? []).filter((d) => typeof d === "string" && d.length > 0).map((d) => ({
+    absPath: normalizePath(d, { base: homeDir2 }),
+    entry: d,
+    source: "config-dir"
+  }));
+  return [...builtIn, ...configured];
+}
+function matchSensitivePath(homeDir2, absPath, extraSensitiveDirs) {
+  const hit = sensitivePathEntries(homeDir2, extraSensitiveDirs).find((entry) => isPathWithin(entry.absPath, absPath));
+  return hit ? { entry: hit.entry, source: hit.source } : void 0;
 }
 function normalizeDirs(dirs, base) {
   if (!dirs) return [];
@@ -7689,15 +8113,17 @@ function decideAccess(input2) {
   const taskAllowedDirs = normalizeDirs(input2.taskAllowedDirs, taskWorkspace ?? homeDir2);
   const configAllowedDirs = normalizeDirs(input2.configAllowedDirs, homeDir2);
   const autoAllowRoots = normalizeDirs(input2.autoAllowRoots, homeDir2);
-  const deniedPaths = [
-    ...defaultDeniedPaths(homeDir2),
-    ...normalizeDirs(input2.extraDeniedDirs, homeDir2)
-  ].map((d) => normalizePath(d));
-  if (isSensitiveSegmentPath(resolvedPath)) {
-    return { decision: "deny", matchedRule: "denylist", resolvedPath };
-  }
-  if (isDenied(resolvedPath, deniedPaths)) {
-    return { decision: "deny", matchedRule: "denylist", resolvedPath };
+  const sensitiveMode = input2.sensitiveMode ?? "ask";
+  const sensitive = matchSensitiveEntry(resolvedPath) ?? matchSensitivePath(homeDir2, resolvedPath, input2.extraSensitiveDirs);
+  if (sensitive) {
+    const hit = { matchedEntry: sensitive.entry, matchedSource: sensitive.source, sensitive: true };
+    if (input2.access === "write") {
+      return { decision: "deny", matchedRule: "sensitive-list-write", resolvedPath, ...hit };
+    }
+    if (sensitiveMode === "deny") {
+      return { decision: "deny", matchedRule: "sensitive-list", resolvedPath, ...hit };
+    }
+    return { decision: "ask", matchedRule: "sensitive-list", resolvedPath, ...hit };
   }
   if (findContaining(configAllowedDirs, resolvedPath) !== void 0) {
     return { decision: "allow", matchedRule: "config-allowed", resolvedPath };
@@ -7717,11 +8143,403 @@ function decideAccess(input2) {
   return { decision: "ask", matchedRule: "outside-all", resolvedPath };
 }
 
+// src/services/tools/shell-lexer.ts
+var CMDSUBST_PLACEHOLDER = "__cmdsubst__";
+var DISCARD_TARGETS = /* @__PURE__ */ new Set(["/dev/null", "/dev/stdout", "/dev/stderr"]);
+function isDiscardRedirectTarget(target) {
+  return target !== void 0 && DISCARD_TARGETS.has(target);
+}
+function isWordTerminator(ch) {
+  return ch === " " || ch === "	" || ch === "\n" || ch === "\r" || ch === "|" || ch === ";" || ch === "&" || ch === "<" || ch === ">";
+}
+function findClosingDoubleQuote(command, start) {
+  let i = start + 1;
+  while (i < command.length) {
+    const ch = command[i];
+    if (ch === "\\") {
+      i += 2;
+      continue;
+    }
+    if (ch === '"') return i;
+    i += 1;
+  }
+  return -1;
+}
+function findClosingBacktick(command, start) {
+  let i = start + 1;
+  while (i < command.length) {
+    const ch = command[i];
+    if (ch === "\\") {
+      i += 2;
+      continue;
+    }
+    if (ch === "`") return i;
+    i += 1;
+  }
+  return -1;
+}
+function scanBacktickSubstitution(command, start) {
+  const end = findClosingBacktick(command, start);
+  if (end === -1) return { error: 'unbalanced backtick \u2014 no closing "`"' };
+  return { inner: command.slice(start + 1, end), next: end + 1 };
+}
+function scanDollarSubstitution(command, start) {
+  const n = command.length;
+  let i = start + 2;
+  let depth = 1;
+  let inner = "";
+  while (i < n) {
+    const ch = command[i];
+    if (ch === "\\") {
+      inner += command.slice(i, i + 2);
+      i += 2;
+      continue;
+    }
+    if (ch === "'") {
+      const end = command.indexOf("'", i + 1);
+      if (end === -1) return { error: "unterminated single quote inside command substitution" };
+      inner += command.slice(i, end + 1);
+      i = end + 1;
+      continue;
+    }
+    if (ch === '"') {
+      const end = findClosingDoubleQuote(command, i);
+      if (end === -1) return { error: "unterminated double quote inside command substitution" };
+      inner += command.slice(i, end + 1);
+      i = end + 1;
+      continue;
+    }
+    if (ch === "`") {
+      const end = findClosingBacktick(command, i);
+      if (end === -1) return { error: "unterminated backtick inside command substitution" };
+      inner += command.slice(i, end + 1);
+      i = end + 1;
+      continue;
+    }
+    if (ch === "(") {
+      depth += 1;
+      inner += ch;
+      i += 1;
+      continue;
+    }
+    if (ch === ")") {
+      depth -= 1;
+      if (depth === 0) return { inner, next: i + 1 };
+      inner += ch;
+      i += 1;
+      continue;
+    }
+    inner += ch;
+    i += 1;
+  }
+  return { error: 'unbalanced "$(" \u2014 no closing ")"' };
+}
+function scanSubstitutionAt(command, start) {
+  const dollarForm = command[start] === "$" && command[start + 1] === "(";
+  const backtickForm = command[start] === "`";
+  if (!dollarForm && !backtickForm) return void 0;
+  const scanned = dollarForm ? scanDollarSubstitution(command, start) : scanBacktickSubstitution(command, start);
+  if ("error" in scanned) return scanned;
+  return {
+    substitution: { inner: scanned.inner, raw: command.slice(start, scanned.next) },
+    next: scanned.next
+  };
+}
+function scanWordLite(command, start) {
+  const n = command.length;
+  let i = start;
+  let text = "";
+  const substitutions = [];
+  const takeSubstitution = () => {
+    const scanned = scanSubstitutionAt(command, i);
+    if (!scanned) return { ok: true, consumed: false };
+    if ("error" in scanned) return { ok: false, error: scanned.error };
+    substitutions.push(scanned.substitution);
+    text += CMDSUBST_PLACEHOLDER;
+    i = scanned.next;
+    return { ok: true, consumed: true };
+  };
+  while (i < n) {
+    const ch = command[i];
+    if (ch === "\\") {
+      if (i + 1 < n) {
+        text += command[i + 1];
+        i += 2;
+      } else {
+        text += ch;
+        i += 1;
+      }
+      continue;
+    }
+    if (ch === "'") {
+      const end = command.indexOf("'", i + 1);
+      if (end === -1) return { error: "unterminated single quote" };
+      text += command.slice(i + 1, end);
+      i = end + 1;
+      continue;
+    }
+    if (ch === '"') {
+      i += 1;
+      let closed = false;
+      while (i < n) {
+        const inner = command[i];
+        if (inner === "\\") {
+          if (i + 1 < n) {
+            text += command[i + 1];
+            i += 2;
+          } else {
+            text += inner;
+            i += 1;
+          }
+          continue;
+        }
+        if (inner === '"') {
+          i += 1;
+          closed = true;
+          break;
+        }
+        const taken2 = takeSubstitution();
+        if (!taken2.ok) return { error: taken2.error };
+        if (taken2.consumed) continue;
+        text += inner;
+        i += 1;
+      }
+      if (!closed) return { error: "unterminated double quote" };
+      continue;
+    }
+    const taken = takeSubstitution();
+    if (!taken.ok) return { error: taken.error };
+    if (taken.consumed) continue;
+    if (isWordTerminator(ch)) break;
+    text += ch;
+    i += 1;
+  }
+  return { word: { text, substitutions }, next: i };
+}
+function scanFdDupTail(command, start) {
+  const match = /^&(\d+|-)/.exec(command.slice(start, start + 8));
+  if (!match) return { error: "unrecognised file-descriptor redirection" };
+  return { tail: match[0], next: start + match[0].length };
+}
+function scanRedirectTarget(command, start) {
+  let i = start;
+  while (i < command.length && (command[i] === " " || command[i] === "	")) i += 1;
+  const ch = command[i];
+  if (ch === void 0 || isWordTerminator(ch)) return { error: "redirection without a target" };
+  const scanned = scanWordLite(command, i);
+  if ("error" in scanned) return scanned;
+  if (scanned.word.text.length === 0 && scanned.word.substitutions.length === 0) {
+    return { error: "redirection without a target" };
+  }
+  return scanned;
+}
+function scanRedirect(command, start, fd) {
+  const ch = command[start];
+  if (ch === "&") {
+    if (command[start + 1] !== ">") return { error: 'unexpected "&" in a redirection' };
+    const append2 = command[start + 2] === ">";
+    const target2 = scanRedirectTarget(command, start + (append2 ? 3 : 2));
+    if ("error" in target2) return target2;
+    return {
+      redirect: { operator: append2 ? "&>>" : "&>", kind: "output", fd: 2, target: target2.word },
+      next: target2.next
+    };
+  }
+  if (ch === "<") {
+    if (command[start + 1] === "<") {
+      if (command[start + 2] === "<") {
+        const target4 = scanRedirectTarget(command, start + 3);
+        if ("error" in target4) return target4;
+        return {
+          redirect: { operator: "<<<", kind: "here-string", target: target4.word },
+          next: target4.next
+        };
+      }
+      const stripTabs = command[start + 2] === "-";
+      const target3 = scanRedirectTarget(command, start + (stripTabs ? 3 : 2));
+      if ("error" in target3) return target3;
+      return {
+        redirect: { operator: stripTabs ? "<<-" : "<<", kind: "here-doc", target: target3.word },
+        next: target3.next,
+        heredoc: { delimiter: target3.word.text, stripTabs }
+      };
+    }
+    if (command[start + 1] === "&") {
+      const dup = scanFdDupTail(command, start + 1);
+      if ("error" in dup) return dup;
+      return { redirect: { operator: `${fd ?? ""}<${dup.tail}`, kind: "fd-dup" }, next: dup.next };
+    }
+    if (command[start + 1] === ">") {
+      const target3 = scanRedirectTarget(command, start + 2);
+      if ("error" in target3) return target3;
+      return {
+        redirect: { operator: `${fd ?? ""}<>`, kind: "output", fd: fd ?? 0, target: target3.word },
+        next: target3.next
+      };
+    }
+    const target2 = scanRedirectTarget(command, start + 1);
+    if ("error" in target2) return target2;
+    return {
+      redirect: { operator: `${fd ?? ""}<`, kind: "input", target: target2.word },
+      next: target2.next
+    };
+  }
+  const append = command[start + 1] === ">";
+  let cursor = start + (append ? 2 : 1);
+  const clobber = !append && command[cursor] === "|";
+  if (clobber) cursor += 1;
+  const operator = `${fd ?? ""}${append ? ">>" : ">"}${clobber ? "|" : ""}`;
+  if (command[cursor] === "&") {
+    const dup = scanFdDupTail(command, cursor);
+    if ("error" in dup) return dup;
+    return { redirect: { operator: `${operator}${dup.tail}`, kind: "fd-dup" }, next: dup.next };
+  }
+  const target = scanRedirectTarget(command, cursor);
+  if ("error" in target) return target;
+  return {
+    redirect: { operator, kind: "output", fd: fd ?? 1, target: target.word },
+    next: target.next
+  };
+}
+function consumeHeredocBodies(command, start, heredocs) {
+  let pos = start;
+  for (const heredoc of heredocs) {
+    let matched = false;
+    while (pos < command.length) {
+      const newline = command.indexOf("\n", pos);
+      const lineEnd2 = newline === -1 ? command.length : newline;
+      const raw = command.slice(pos, lineEnd2);
+      const line = heredoc.stripTabs ? raw.replace(/^\t+/, "") : raw;
+      pos = lineEnd2 + 1;
+      if (line === heredoc.delimiter) {
+        matched = true;
+        break;
+      }
+      if (newline === -1) break;
+    }
+    if (!matched) return void 0;
+  }
+  return pos;
+}
+function tokenizeShellLite(command) {
+  const n = command.length;
+  const segments = [];
+  let tokens = [];
+  let pendingHeredocs = [];
+  let i = 0;
+  const endSegment = () => {
+    if (tokens.length > 0) segments.push({ tokens });
+    tokens = [];
+  };
+  const takeRedirect = (redirectStart, fd) => {
+    const scanned = scanRedirect(command, redirectStart, fd);
+    if ("error" in scanned) return { ok: false, error: scanned.error };
+    tokens.push({ kind: "redirect", redirect: scanned.redirect });
+    if (scanned.heredoc) pendingHeredocs.push(scanned.heredoc);
+    i = scanned.next;
+    return void 0;
+  };
+  while (i < n) {
+    const ch = command[i];
+    if (ch === " " || ch === "	" || ch === "\r") {
+      i += 1;
+      continue;
+    }
+    if (ch === "\\" && command[i + 1] === "\n") {
+      i += 2;
+      continue;
+    }
+    if (ch === "\n") {
+      endSegment();
+      i += 1;
+      if (pendingHeredocs.length > 0) {
+        const after = consumeHeredocBodies(command, i, pendingHeredocs);
+        if (after === void 0) return { ok: false, error: "here-document without its terminator line" };
+        i = after;
+        pendingHeredocs = [];
+      }
+      continue;
+    }
+    if (ch === "#") {
+      while (i < n && command[i] !== "\n") i += 1;
+      continue;
+    }
+    if (ch === "|" || ch === ";" || ch === "&") {
+      if (ch === "&" && command[i + 1] === ">") {
+        const failed = takeRedirect(i);
+        if (failed) return failed;
+        continue;
+      }
+      i += 1;
+      while (i < n && (command[i] === "|" || command[i] === ";" || command[i] === "&")) i += 1;
+      endSegment();
+      continue;
+    }
+    const fdMatch = /^(\d+)(?=>>|>|<>|<)/.exec(command.slice(i, i + 24));
+    const fd = fdMatch ? Number(fdMatch[1]) : void 0;
+    const redirectStart = i + (fdMatch ? fdMatch[1].length : 0);
+    const redirectChar = command[redirectStart];
+    if (redirectChar === "<" || redirectChar === ">") {
+      const failed = takeRedirect(redirectStart, fd);
+      if (failed) return failed;
+      continue;
+    }
+    const scanned = scanWordLite(command, i);
+    if ("error" in scanned) return { ok: false, error: scanned.error };
+    if (scanned.next === i) return { ok: false, error: `unexpected character "${ch}"` };
+    tokens.push({ kind: "word", word: scanned.word });
+    i = scanned.next;
+  }
+  if (pendingHeredocs.length > 0) {
+    return { ok: false, error: "here-document without a body" };
+  }
+  endSegment();
+  return { ok: true, segments };
+}
+function classifyRedirections(segments) {
+  const result2 = {
+    writeTargets: [],
+    readTargets: [],
+    duplicates: [],
+    discarded: []
+  };
+  for (const segment of segments) {
+    for (const token of segment.tokens) {
+      if (token.kind !== "redirect") continue;
+      const { redirect } = token;
+      const target = redirect.target?.text;
+      if (redirect.kind === "fd-dup") {
+        result2.duplicates.push(redirect.operator);
+        continue;
+      }
+      if (redirect.kind === "here-string" || redirect.kind === "here-doc") continue;
+      if (target === void 0) continue;
+      if (isDiscardRedirectTarget(target)) {
+        result2.discarded.push(target);
+        continue;
+      }
+      if (redirect.kind === "input") {
+        if (target.includes(CMDSUBST_PLACEHOLDER)) {
+          result2.unresolved ??= `${redirect.operator} ${target}`;
+          continue;
+        }
+        result2.readTargets.push(target);
+        continue;
+      }
+      if (target.includes(CMDSUBST_PLACEHOLDER)) {
+        result2.unresolved ??= `${redirect.operator} ${target}`;
+        continue;
+      }
+      result2.writeTargets.push(target);
+    }
+  }
+  return result2;
+}
+
 // src/services/tools/permission-rules.ts
 var FILE_TOOL_NAMES = ["read_file", "write_file", "edit_file", "search_files", "search_content"];
 var READ_ONLY_FILE_TOOLS = /* @__PURE__ */ new Set(["read_file", "search_files", "search_content"]);
 var DANGEROUS_BASH_PATTERN = /(?:^|\||;|&&)\s*(?:rm\s|sudo\b|chmod\b|chown\b|mkfs\b|dd\s|shutdown\b|reboot\b|kill\s+-9)/;
-var URL_RE = /[a-zA-Z][a-zA-Z0-9+.-]*:\/\/\S+/g;
 function expandHome(p, homeDir2) {
   if (p === "~") return { path: homeDir2, unresolvable: false };
   if (p.startsWith("~/")) return { path: resolve5(homeDir2, p.slice(2)), unresolvable: false };
@@ -7731,25 +8549,110 @@ function expandHome(p, homeDir2) {
 function expandHomeVars(command, homeDir2) {
   return command.replace(/\$\{HOME\}/g, homeDir2).replace(/\$HOME(?![A-Za-z0-9_])/g, homeDir2);
 }
-function detectUnsafeDynamicTarget(command) {
-  if (command.includes("`")) return "command substitution (backticks)";
-  if (/\$\(/.test(command)) return "command substitution ($(...))";
-  if (hasOutputRedirection(command)) return "output redirection";
-  return void 0;
+var CMDSUBST_READONLY_VERBS = /* @__PURE__ */ new Set([
+  "cat",
+  "ls",
+  "grep",
+  "head",
+  "tail",
+  "wc",
+  "stat",
+  "file",
+  "which",
+  "command",
+  "readlink",
+  "echo",
+  "printf",
+  "date",
+  "pwd"
+]);
+var MAX_CMDSUBST_DEPTH = 5;
+var BASH_WRITE_VERBS = /* @__PURE__ */ new Set([
+  "rm",
+  "rmdir",
+  "mv",
+  "cp",
+  "ln",
+  "tee",
+  "dd",
+  "truncate",
+  "install",
+  "mkdir",
+  "touch",
+  "chmod",
+  "chown",
+  "chgrp",
+  "shred",
+  "unlink",
+  "chattr",
+  "mkfs",
+  "mkswap",
+  "mount",
+  "umount"
+]);
+var BASH_FLAGGED_WRITE_VERBS = /* @__PURE__ */ new Map([
+  ["sed", ["-i", "--in-place"]],
+  ["perl", ["-i"]],
+  ["ruby", ["-i"]],
+  ["find", ["-delete", "-fprint", "-fls", "-fprintf", "-exec", "-execdir", "-ok"]]
+]);
+function isWriteSegment(segment) {
+  const words = [];
+  for (const token of segment.tokens) {
+    if (token.kind === "word") {
+      words.push(token.word.text);
+      continue;
+    }
+    const { redirect } = token;
+    if (redirect.kind !== "output") continue;
+    if (isDiscardRedirectTarget(redirect.target?.text)) continue;
+    return true;
+  }
+  for (const word of words) {
+    if (BASH_WRITE_VERBS.has(word)) return true;
+    const flags2 = BASH_FLAGGED_WRITE_VERBS.get(word);
+    if (flags2 && flags2.some((flag) => words.includes(flag))) return true;
+  }
+  return false;
 }
-function hasOutputRedirection(command) {
-  return /(?:^|[^<>])>>?\s*(?!&)\S/.test(command);
+function pathPieces(text, access) {
+  const candidates = [];
+  for (const piece of text.split("=")) {
+    if (!piece.startsWith("/") && !piece.startsWith("~")) continue;
+    if (isDiscardRedirectTarget(piece)) continue;
+    candidates.push({ path: piece, access });
+  }
+  return candidates;
 }
-function extractPathCandidates(command) {
-  const withoutUrls = command.replace(URL_RE, " ");
+function extractPathCandidates(segments) {
   const candidates = [];
-  for (const raw of withoutUrls.split(/[\s=;|&]+/)) {
-    const word = raw.replace(/^['"]+/, "").replace(/['",;|&()<>'`]+$/, "");
-    if (word.startsWith("/") || word.startsWith("~")) candidates.push(word);
+  for (const segment of segments) {
+    const segmentAccess = isWriteSegment(segment) ? "write" : "unknown";
+    for (const token of segment.tokens) {
+      if (token.kind === "word") {
+        candidates.push(...pathPieces(token.word.text, segmentAccess));
+        continue;
+      }
+      const { redirect } = token;
+      if (redirect.kind === "fd-dup" || redirect.kind === "here-doc" || redirect.kind === "here-string") continue;
+      const target = redirect.target?.text;
+      if (target === void 0 || isDiscardRedirectTarget(target)) continue;
+      if (target.includes(CMDSUBST_PLACEHOLDER)) continue;
+      const access = redirect.kind === "output" ? "write" : segmentAccess;
+      for (const candidate of pathPieces(target, access)) {
+        candidates.push(
+          redirect.kind === "output" ? { ...candidate, reason: `output redirection to "${target}"` } : candidate
+        );
+      }
+    }
   }
   return candidates;
 }
+function commandAccess(candidates) {
+  return candidates.some((candidate) => candidate.access === "write") ? "write" : "unknown";
+}
 function decidePath(scope, path9, access) {
+  const permission = scope.permission;
   return decideAccess({
     path: path9,
     access,
@@ -7757,11 +8660,28 @@ function decidePath(scope, path9, access) {
     homeDir: scope.homeDir,
     taskWorkspace: scope.workspace,
     taskAllowedDirs: scope.taskAllowedDirs,
-    configAllowedDirs: scope.permission?.allowedDirs,
-    autoAllowRoots: scope.permission?.autoAllowRoots,
-    extraDeniedDirs: scope.permission?.deniedDirs
+    configAllowedDirs: permission?.allowedDirs,
+    autoAllowRoots: permission?.autoAllowRoots,
+    // `sensitiveDirs` is the current key; `deniedDirs` is its deprecated alias
+    // and is merged (deduped) here so a legacy config keeps protecting exactly
+    // the directories it declares.
+    extraSensitiveDirs: mergeSensitiveDirs(permission),
+    sensitiveMode: resolveSensitiveMode(permission)
   });
 }
+function toToolDecision(verdict, access) {
+  return {
+    decision: verdict.decision,
+    matchedRule: verdict.matchedRule,
+    resolvedPath: verdict.resolvedPath,
+    access,
+    ...verdict.matchedEntry !== void 0 && {
+      matchedEntry: verdict.matchedEntry,
+      matchedSource: verdict.matchedSource,
+      sensitive: true
+    }
+  };
+}
 function evaluateFileAccess(scope, toolName, args) {
   const rawPath = args.path;
   if (typeof rawPath !== "string" || !rawPath) return { decision: "allow", matchedRule: "no-path" };
@@ -7776,35 +8696,163 @@ function evaluateFileAccess(scope, toolName, args) {
   }
   const verdict = decidePath(scope, expanded.path, access);
   if (verdict.decision === "allow" && verdict.withinReadScope) {
-    return { decision: "ask", matchedRule: "read-within-home" };
+    return { decision: "ask", matchedRule: "read-within-home", resolvedPath: verdict.resolvedPath, access };
   }
-  return { decision: verdict.decision, matchedRule: verdict.matchedRule };
+  return toToolDecision(verdict, access);
+}
+function collectSubstitutions(segments) {
+  const substitutions = [];
+  for (const segment of segments) {
+    for (const token of segment.tokens) {
+      const word = token.kind === "word" ? token.word : token.redirect.target;
+      if (word) substitutions.push(...word.substitutions);
+    }
+  }
+  return substitutions;
+}
+function checkSubstitutionInner(inner) {
+  const tokenized = tokenizeShellLite(inner);
+  if (!tokenized.ok) return { ok: false, reason: `cannot parse it (${tokenized.error})` };
+  if (tokenized.segments.length === 0) return { ok: false, reason: "it is empty" };
+  for (const segment of tokenized.segments) {
+    const verb = segment.tokens.find((token) => token.kind === "word");
+    if (!verb || verb.kind !== "word" || verb.word.text === CMDSUBST_PLACEHOLDER) {
+      return { ok: false, reason: "it has no command word to judge" };
+    }
+    if (!CMDSUBST_READONLY_VERBS.has(verb.word.text)) {
+      return { ok: false, reason: `\`${verb.word.text}\` is not a read-only command` };
+    }
+    if (isWriteSegment(segment)) return { ok: false, reason: `\`${verb.word.text}\` writes` };
+  }
+  return { ok: true };
+}
+function evaluateSubstitutions(scope, segments, depth) {
+  const substitutions = collectSubstitutions(segments);
+  if (substitutions.length === 0) return void 0;
+  if (depth + 1 > MAX_CMDSUBST_DEPTH) {
+    return {
+      decision: "ask",
+      matchedRule: "dynamic-shell",
+      reason: `command substitution nested deeper than ${MAX_CMDSUBST_DEPTH} levels`
+    };
+  }
+  for (const substitution of substitutions) {
+    const inner = substitution.inner.trim();
+    if (inner.length === 0) {
+      return { decision: "ask", matchedRule: "dynamic-shell", reason: `empty command substitution ${substitution.raw}` };
+    }
+    const readOnly = checkSubstitutionInner(inner);
+    if (!readOnly.ok) {
+      return {
+        decision: "ask",
+        matchedRule: "dynamic-shell",
+        reason: `command substitution ${substitution.raw}: ${readOnly.reason}`
+      };
+    }
+    const verdict = evaluateBashCommand(scope, inner, depth + 1);
+    if (verdict.decision === "deny") return verdict;
+    if (verdict.decision === "ask") {
+      const detail = verdict.reason ?? (verdict.resolvedPath ? `target ${verdict.resolvedPath}` : verdict.matchedRule);
+      return {
+        decision: "ask",
+        matchedRule: "dynamic-shell",
+        reason: `command substitution ${substitution.raw} needs approval: ${detail}`,
+        // Carry the inner hit through, so an approval request still names the
+        // path (and the sensitive entry) the substituted command would touch.
+        ...verdict.resolvedPath !== void 0 && { resolvedPath: verdict.resolvedPath },
+        ...verdict.matchedEntry !== void 0 && {
+          matchedEntry: verdict.matchedEntry,
+          matchedSource: verdict.matchedSource,
+          sensitive: true
+        }
+      };
+    }
+  }
+  return void 0;
+}
+function fallbackSensitiveWrite(scope, expandedCommand) {
+  for (const raw of expandedCommand.split(/[\s=]+/)) {
+    const word = raw.replace(/^['"]+/, "").replace(/['"]+$/, "");
+    if (!word.startsWith("/") && !word.startsWith("~")) continue;
+    const expanded = expandHome(word, scope.homeDir);
+    if (expanded.unresolvable) continue;
+    const verdict = decidePath(scope, expanded.path, "write");
+    if (verdict.decision === "deny") return toToolDecision(verdict, "write");
+  }
+  return void 0;
 }
 function evaluateBashAccess(scope, command) {
+  return evaluateBashCommand(scope, command, 0);
+}
+function evaluateBashCommand(scope, command, depth) {
   const expandedCommand = expandHomeVars(command, scope.homeDir);
+  const tokenized = tokenizeShellLite(expandedCommand);
+  if (!tokenized.ok) {
+    const refusal = fallbackSensitiveWrite(scope, expandedCommand);
+    if (refusal) return refusal;
+    return {
+      decision: "ask",
+      matchedRule: "dynamic-shell",
+      reason: `could not parse the shell command (${tokenized.error})`
+    };
+  }
+  const segments = tokenized.segments;
+  const redirections = classifyRedirections(segments);
   const candidates = [];
   let hasUnresolvableHome = false;
-  for (const raw of extractPathCandidates(expandedCommand)) {
-    const expanded = expandHome(raw, scope.homeDir);
+  for (const candidate of extractPathCandidates(segments)) {
+    const expanded = expandHome(candidate.path, scope.homeDir);
     if (expanded.unresolvable) {
       hasUnresolvableHome = true;
       continue;
     }
-    candidates.push(expanded.path);
+    candidates.push({ ...candidate, path: expanded.path });
   }
   let firstAsk;
   let firstAllow;
   for (const candidate of candidates) {
-    const verdict = decidePath(scope, candidate, "write");
-    if (verdict.decision === "deny") return verdict;
-    if (verdict.decision === "ask") firstAsk ??= verdict;
-    else firstAllow ??= verdict;
+    const verdict = decidePath(scope, candidate.path, candidate.access);
+    if (verdict.decision === "deny") return toToolDecision(verdict, candidate.access);
+    if (verdict.decision === "ask") {
+      firstAsk ??= {
+        ...toToolDecision(verdict, candidate.access),
+        ...candidate.reason !== void 0 && { reason: candidate.reason }
+      };
+    } else firstAllow ??= toToolDecision(verdict, candidate.access);
   }
+  const lineAccess = commandAccess(candidates);
+  if (firstAsk) firstAsk = { ...firstAsk, access: lineAccess };
+  if (firstAllow) firstAllow = { ...firstAllow, access: lineAccess };
   if (DANGEROUS_BASH_PATTERN.test(expandedCommand)) {
-    return { decision: "ask", matchedRule: "dangerous-bash" };
+    const hit = firstAsk?.matchedEntry !== void 0 ? firstAsk : void 0;
+    return {
+      decision: "ask",
+      matchedRule: "dangerous-bash",
+      access: lineAccess,
+      ...hit !== void 0 && {
+        matchedEntry: hit.matchedEntry,
+        matchedSource: hit.matchedSource,
+        resolvedPath: hit.resolvedPath,
+        sensitive: true
+      }
+    };
+  }
+  const substitution = evaluateSubstitutions(scope, segments, depth);
+  if (substitution) return substitution;
+  if (redirections.unresolved !== void 0) {
+    return {
+      decision: "ask",
+      matchedRule: "dynamic-shell",
+      reason: `output redirection target cannot be determined statically (${redirections.unresolved})`
+    };
+  }
+  if (redirections.writeTargets.length > 0 && !firstAsk) {
+    return {
+      decision: "ask",
+      matchedRule: "dynamic-shell",
+      reason: `output redirection writes a file ("${redirections.writeTargets.join('", "')}")`
+    };
   }
-  const dynamic = detectUnsafeDynamicTarget(expandedCommand);
-  if (dynamic) return { decision: "ask", matchedRule: "dynamic-shell", reason: dynamic };
   if (hasUnresolvableHome) {
     return {
       decision: "ask",
@@ -7815,12 +8863,13 @@ function evaluateBashAccess(scope, command) {
   if (firstAsk) return firstAsk;
   return firstAllow ?? { decision: "allow", matchedRule: "no-path" };
 }
-function denyMessage(toolName, requestedPath) {
+function denyMessage(toolName, requestedPath, matchedRule) {
+  const write = matchedRule === "sensitive-list-write";
   if (toolName === "bash") {
-    return "[ERROR] bash: refusing to run this command \u2014 it touches a path on the deny list (a sensitive location).";
+    return write ? "[ERROR] bash: refusing to run this command \u2014 it would write to a path on the sensitive list (sensitive paths are never writable)." : "[ERROR] bash: refusing to run this command \u2014 it touches a path on the sensitive list (a protected location).";
   }
   const target = requestedPath ? ` "${requestedPath}"` : "";
-  return `[ERROR] ${toolName}: refusing access to${target} \u2014 the path is on the deny list (a sensitive location).`;
+  return write ? `[ERROR] ${toolName}: refusing to write${target} \u2014 the path is on the sensitive list (sensitive paths are never writable).` : `[ERROR] ${toolName}: refusing access to${target} \u2014 the path is on the sensitive list (a protected location).`;
 }
 function decideToolAccess(scope, toolName, args) {
   let verdict;
@@ -7832,7 +8881,51 @@ function decideToolAccess(scope, toolName, args) {
     return { decision: "allow", matchedRule: "no-path" };
   }
   if (verdict.decision !== "deny") return verdict;
-  return { ...verdict, message: denyMessage(toolName, typeof args.path === "string" ? args.path : void 0) };
+  return {
+    ...verdict,
+    message: denyMessage(toolName, typeof args.path === "string" ? args.path : void 0, verdict.matchedRule)
+  };
+}
+
+// src/services/permission/permission-audit.ts
+function operationForTool(toolName) {
+  if (toolName === "bash") return "exec";
+  if (toolName === "read_file" || toolName === "search_files" || toolName === "search_content") return "read";
+  return "write";
+}
+function auditAccessFor(access) {
+  return access ?? "unknown";
+}
+function recordPermissionAudit(logger, entry) {
+  if (!logger) return;
+  logger.info(
+    {
+      audit: "permission",
+      decision: entry.decision,
+      operation: entry.operation,
+      ...entry.access !== void 0 && { access: entry.access },
+      ts: (/* @__PURE__ */ new Date()).toISOString(),
+      ...entry.resolvedPath !== void 0 && { resolvedPath: entry.resolvedPath },
+      ...entry.requestedPath !== void 0 && { requestedPath: entry.requestedPath },
+      ...entry.matchedEntry !== void 0 && { matchedEntry: entry.matchedEntry },
+      ...entry.matchedSource !== void 0 && { matchedSource: entry.matchedSource },
+      ...entry.matchedRule !== void 0 && { matchedRule: entry.matchedRule },
+      ...entry.taskId !== void 0 && { taskId: entry.taskId },
+      ...entry.workerId !== void 0 && { workerId: entry.workerId },
+      ...entry.toolName !== void 0 && { toolName: entry.toolName },
+      ...entry.source !== void 0 && { source: entry.source }
+    },
+    "permission audit"
+  );
+}
+function verdictDetailSuffix(detail) {
+  const parts = [];
+  if (detail.matchedEntry) {
+    parts.push(`hit: ${detail.matchedEntry}${detail.matchedSource ? ` (${detail.matchedSource})` : ""}`);
+  }
+  if (detail.matchedRule) parts.push(`rule: ${detail.matchedRule}`);
+  if (detail.operation) parts.push(`op: ${detail.operation}`);
+  return parts.length > 0 ? ` [${parts.join(" ; ")}]` : "";
 }
 
 // src/infra/blocking-requests.ts
@@ -8243,10 +9336,11 @@ var ClaudeCodeWorker = class _ClaudeCodeWorker {
   }
   /**
    * Route a Claude Code tool call through the SAME access policy a puppet
-   * worker uses (`decideToolAccess`). A denylisted path is denied outright
-   * (no approval prompt); an ambiguous target asks the controller; a path
-   * inside the allowed scope runs immediately. This closes the parity gap where
-   * the old regex-only gate let denylisted paths through silently.
+   * worker uses (`decideToolAccess`). A sensitive WRITE is denied outright
+   * (no approval prompt), a sensitive READ asks with the matched entry named,
+   * an ambiguous target asks the controller and a path inside the allowed scope
+   * runs immediately. This closes the parity gap where the old regex-only gate
+   * let sensitive paths through silently.
    */
   async handleCanUseTool(toolName, input2) {
     if (!this._signalQueue || !this._runContext) {
@@ -8255,42 +9349,91 @@ var ClaudeCodeWorker = class _ClaudeCodeWorker {
     const scope = this.effectiveAccessScope();
     if (toolName === "Bash") {
       const verdict = decideToolAccess(scope, "bash", { command: String(input2.command ?? "") });
-      if (verdict.decision === "deny") {
-        return { behavior: "deny", message: verdict.message ?? "Denied by the permission policy" };
-      }
-      if (verdict.decision === "ask") return this.requestPermission(toolName, input2, verdict.reason);
+      const operation = operationForTool("bash");
+      if (verdict.decision === "deny") return this.denyWithAudit(toolName, input2, verdict, operation);
+      if (verdict.decision === "ask") return this.requestPermission(toolName, input2, this.askOf(verdict, operation));
       return { behavior: "allow" };
     }
     const fileTool = _ClaudeCodeWorker.SDK_FILE_TOOL_MAP[toolName];
     if (fileTool) {
+      const operation = operationForTool(fileTool.policyTool);
       const rawPath = input2[fileTool.pathKey];
       if (typeof rawPath !== "string" || rawPath.length === 0) {
         if (fileTool.pathRequired) {
-          return this.requestPermission(toolName, input2, "the target path could not be determined");
+          return this.requestPermission(toolName, input2, {
+            reason: "the target path could not be determined",
+            operation
+          });
         }
         return { behavior: "allow" };
       }
       const verdict = decideToolAccess(scope, fileTool.policyTool, { path: rawPath });
-      if (verdict.decision === "deny") {
-        return { behavior: "deny", message: verdict.message ?? "Denied by the permission policy" };
-      }
-      if (verdict.decision === "ask") return this.requestPermission(toolName, input2, verdict.reason);
+      if (verdict.decision === "deny") return this.denyWithAudit(toolName, input2, verdict, operation);
+      if (verdict.decision === "ask") return this.requestPermission(toolName, input2, this.askOf(verdict, operation));
       return { behavior: "allow" };
     }
     if (_ClaudeCodeWorker.SDK_NON_PATH_TOOLS.has(toolName)) {
       return { behavior: "allow" };
     }
-    return this.requestPermission(toolName, input2, "the tool is not recognized by the permission policy");
+    return this.requestPermission(toolName, input2, {
+      reason: "the tool is not recognized by the permission policy",
+      operation: operationForTool("bash")
+    });
+  }
+  /**
+   * Refuse a call the policy hard-denied (sensitive write) and record it.
+   *
+   * The worker receives the policy's disclosure-safe message (its own path
+   * spelling, never the matched entry); the audit trail gets the metadata.
+   * Same shape as the puppet worker's audit, so both entries agree.
+   */
+  denyWithAudit(toolName, input2, verdict, operation) {
+    recordPermissionAudit(this.logger, {
+      decision: "hard-denied",
+      operation,
+      access: auditAccessFor(verdict.access),
+      resolvedPath: verdict.resolvedPath,
+      requestedPath: this.requestedPathOf(input2),
+      matchedEntry: verdict.matchedEntry,
+      matchedSource: verdict.matchedSource,
+      matchedRule: verdict.matchedRule,
+      taskId: this._runContext?.taskId,
+      workerId: this._runContext?.workerId,
+      toolName
+    });
+    return { behavior: "deny", message: verdict.message ?? "Denied by the permission policy" };
+  }
+  /** Project a policy verdict onto the approval-request/audit fields. */
+  askOf(verdict, operation) {
+    return {
+      reason: verdict.reason,
+      matchedRule: verdict.matchedRule,
+      matchedEntry: verdict.matchedEntry,
+      matchedSource: verdict.matchedSource,
+      resolvedPath: verdict.resolvedPath,
+      operation,
+      sensitive: verdict.sensitive,
+      access: verdict.access
+    };
+  }
+  /** The target as the worker spelled it (for auditing against the prompt). */
+  requestedPathOf(input2) {
+    for (const key of ["file_path", "notebook_path", "path"]) {
+      const value = input2[key];
+      if (typeof value === "string" && value.length > 0) return value;
+    }
+    return void 0;
   }
   /**
    * Emit a permission_request and block until the controller answers (or it
    * times out → deny). Shared by every `ask` verdict so the request flow stays
    * identical to the puppet worker's.
    */
-  async requestPermission(toolName, input2, reason) {
+  async requestPermission(toolName, input2, ask) {
     if (!this._signalQueue || !this._runContext) return { behavior: "allow" };
     const requestId = generateId("perm");
-    const description = this.describePermissionRequest(toolName, input2, reason);
+    const description = this.describePermissionRequest(toolName, input2, ask);
+    const operation = ask.operation;
     this._signalQueue.enqueue({
       source: "worker",
       type: "permission_request",
@@ -8303,16 +9446,43 @@ var ClaudeCodeWorker = class _ClaudeCodeWorker {
         emoji: this._runContext.emoji,
         toolName,
         toolArgs: input2,
-        description
+        description,
+        ...ask.matchedRule !== void 0 && { matchedRule: ask.matchedRule },
+        ...ask.matchedEntry !== void 0 && { matchedEntry: ask.matchedEntry },
+        ...ask.matchedSource !== void 0 && { matchedSource: ask.matchedSource },
+        ...ask.resolvedPath !== void 0 && { resolvedPath: ask.resolvedPath },
+        ...ask.sensitive !== void 0 && { sensitive: ask.sensitive },
+        ...ask.access !== void 0 && { access: ask.access },
+        operation
       },
       ...this._turnLineage
     });
-    return this._pendingPermissions.wait(requestId, _ClaudeCodeWorker.PERMISSION_TIMEOUT_MS, () => {
-      return { behavior: "deny", message: "Permission request timed out" };
+    const result2 = await this._pendingPermissions.wait(
+      requestId,
+      _ClaudeCodeWorker.PERMISSION_TIMEOUT_MS,
+      () => ({ behavior: "deny", message: "Permission request timed out" })
+    );
+    const denied = result2.behavior === "deny";
+    recordPermissionAudit(this.logger, {
+      decision: denied ? "denied" : "approved",
+      operation,
+      access: auditAccessFor(ask.access),
+      resolvedPath: ask.resolvedPath,
+      requestedPath: this.requestedPathOf(input2),
+      matchedEntry: ask.matchedEntry,
+      matchedSource: ask.matchedSource,
+      matchedRule: ask.matchedRule,
+      taskId: this._runContext.taskId,
+      workerId: this._runContext.workerId,
+      toolName,
+      ...denied && {
+        source: result2.message === "Permission request timed out" ? "timeout" : "controller"
+      }
     });
+    return result2;
   }
   /** Human-readable summary of a gated call for the approval prompt. */
-  describePermissionRequest(toolName, input2, reason) {
+  describePermissionRequest(toolName, input2, ask) {
     let detail;
     if (toolName === "Bash") {
       detail = `Execute shell command: ${String(input2.command ?? "")}`;
@@ -8325,7 +9495,15 @@ var ClaudeCodeWorker = class _ClaudeCodeWorker {
     } else {
       detail = `${toolName}: ${JSON.stringify(input2)}`;
     }
-    return reason ? `${detail} (${reason})` : detail;
+    const hit = ask.sensitive ? verdictDetailSuffix({
+      matchedRule: ask.matchedRule,
+      matchedEntry: ask.matchedEntry,
+      matchedSource: ask.matchedSource,
+      resolvedPath: ask.resolvedPath,
+      operation: ask.operation
+    }) : "";
+    const withHit = `${detail}${hit}`;
+    return ask.reason ? `${withHit} (${ask.reason})` : withHit;
   }
   // --- Prompt as AsyncIterable (supports follow-up messages) ---
   buildPromptIterable(initialPrompt) {
@@ -8633,8 +9811,8 @@ controller: ${answer}`,
 import { z as z3 } from "zod";
 
 // src/services/tools/workspace-rules.ts
-import { readFileSync as readFileSync9, statSync as statSync3 } from "fs";
-import { join as join16 } from "path";
+import { readFileSync as readFileSync10, statSync as statSync5 } from "fs";
+import { join as join17 } from "path";
 var RULE_FILE_NAMES2 = ["AGENTS.md", "CLAUDE.md"];
 var WORKSPACE_RULES_MAX_LINES = 40;
 var WORKSPACE_RULES_MAX_CHARS = 2e3;
@@ -8642,7 +9820,7 @@ function buildWorkspaceRulesSummary(input2) {
   const workspacePath = input2.workspacePath;
   if (!workspacePath) return "";
   for (const name of RULE_FILE_NAMES2) {
-    const rulesPath = join16(workspacePath, name);
+    const rulesPath = join17(workspacePath, name);
     if (!isRegularFile(rulesPath)) continue;
     const header = `Workspace rules (from ${rulesPath}):`;
     const refusal = describeRefusal(rulesPath, workspacePath, input2);
@@ -8664,16 +9842,17 @@ function describeRefusal(rulesPath, workspacePath, input2) {
   if (!homeDir2) {
     return "unavailable \u2014 the permission policy cannot be evaluated here (no home directory in this context), so the file was not read.";
   }
-  const { decision } = decideAccess({
+  const { decision, matchedEntry } = decideAccess({
     access: "read",
     path: rulesPath,
     cwd: workspacePath,
     homeDir: homeDir2,
     taskWorkspace: workspacePath,
-    extraDeniedDirs: input2.permissionConfig?.deniedDirs
+    extraSensitiveDirs: mergeSensitiveDirs(input2.permissionConfig),
+    sensitiveMode: resolveSensitiveMode(input2.permissionConfig)
   });
-  if (decision === "deny") {
-    return "unavailable \u2014 the file resolves to a denied location (a sensitive one such as credentials or tool config), so its content was not read.";
+  if (matchedEntry !== void 0 || decision === "deny") {
+    return "unavailable \u2014 the file resolves to a sensitive location (a protected path such as credentials or tool config), so its content was not read.";
   }
   if (decision === "ask") {
     return "unavailable \u2014 reading it was not approved by the permission policy (the path is outside the readable scope), so its content was not read.";
@@ -8700,14 +9879,14 @@ function summarizeRules(content) {
 }
 function isRegularFile(p) {
   try {
-    return statSync3(p).isFile();
+    return statSync5(p).isFile();
   } catch {
     return false;
   }
 }
 function readTextFile(p) {
   try {
-    return readFileSync9(p, "utf8");
+    return readFileSync10(p, "utf8");
   } catch {
     return null;
   }
@@ -8739,9 +9918,9 @@ function resolveTaskAllowedDirs(requested, workspacePath, deps) {
   }
   const home = normalizePath(homeDir2);
   const base = workspacePath !== void 0 ? normalizePath(workspacePath, { base: home }) : home;
-  const deniedPaths = [
-    ...defaultDeniedPaths(home),
-    ...(deps.permissionConfig?.deniedDirs ?? []).filter((d) => typeof d === "string" && d.length > 0).map((d) => normalizePath(d, { base: home }))
+  const sensitivePaths = [
+    ...defaultSensitivePaths(home),
+    ...mergeSensitiveDirs(deps.permissionConfig).map((d) => normalizePath(d, { base: home }))
   ].map((d) => normalizePath(d));
   const seen = /* @__PURE__ */ new Set();
   const allowedDirs = [];
@@ -8757,9 +9936,9 @@ function resolveTaskAllowedDirs(requested, workspacePath, deps) {
         error: `Invalid allowedDirs entry "${raw}" (resolved to ${resolved}): it is outside the home directory (${home}). Only directories under home can be granted to a task. The task was NOT created.`
       };
     }
-    if (isDenied(resolved, deniedPaths)) {
+    if (isDenied(resolved, sensitivePaths)) {
       return {
-        error: `Invalid allowedDirs entry "${raw}" (resolved to ${resolved}): it matches the denied-path list (a sensitive location such as credentials or tool config). The task was NOT created.`
+        error: `Invalid allowedDirs entry "${raw}" (resolved to ${resolved}): it matches the sensitive list (a protected location such as credentials or tool config). The task was NOT created.`
       };
     }
     if (!seen.has(resolved)) {
@@ -9362,7 +10541,7 @@ ${detail}`;
 
 // src/services/tools/read-file.ts
 import { z as z14 } from "zod";
-import { readFileSync as readFileSync10 } from "fs";
+import { readFileSync as readFileSync11 } from "fs";
 import { resolve as resolve6 } from "path";
 var DEFAULT_MAX_LINES = 500;
 function readFileTool(deps = {}) {
@@ -9376,7 +10555,7 @@ function readFileTool(deps = {}) {
     }),
     execute: safeExecute("read_file", async ({ path: path9, offset, limit }) => {
       const resolved = resolve6(workspace, path9);
-      const content = readFileSync10(resolved, "utf-8");
+      const content = readFileSync11(resolved, "utf-8");
       const lines = content.split("\n");
       const totalLines = lines.length;
       const start = offset ? offset - 1 : 0;
@@ -9419,7 +10598,7 @@ function writeFileTool(deps = {}) {
 }
 
 // src/services/tools/edit-file.ts
-import { readFileSync as readFileSync11, writeFileSync as writeFileSync5 } from "fs";
+import { readFileSync as readFileSync12, writeFileSync as writeFileSync5 } from "fs";
 import { resolve as resolve8 } from "path";
 import { z as z16 } from "zod";
 function editFileTool(deps) {
@@ -9435,7 +10614,7 @@ function editFileTool(deps) {
       const resolved = resolve8(workspace, path9);
       let content;
       try {
-        content = readFileSync11(resolved, "utf-8");
+        content = readFileSync12(resolved, "utf-8");
       } catch {
         return `[ERROR] edit_file: File not found: ${path9}`;
       }
@@ -9466,15 +10645,15 @@ function searchFilesTool(deps) {
     execute: safeExecute("search_files", async ({ pattern, path: path9 }) => {
       const basePath = path9 ? normalizePath(path9, { base: workspace }) : normalizePath(workspace);
       if (homeDir2) {
-        const { decision } = decideAccess({
+        const { decision, matchedEntry } = decideAccess({
           access: "read",
           homeDir: homeDir2,
           cwd: workspace,
           path: basePath
         });
         const requested = path9 ?? workspace;
-        if (decision === "deny") {
-          return `[ERROR] search_files: refusing to search "${requested}" \u2014 the path is on the read denylist (a sensitive location).`;
+        if (matchedEntry !== void 0 || decision === "deny") {
+          return `[ERROR] search_files: refusing to search "${requested}" \u2014 the path is on the sensitive list (a protected location).`;
         }
         if (decision === "ask") {
           return `[ERROR] search_files: refusing to search "${requested}" \u2014 the path is outside the home boundary (${homeDir2}). The controller can only read files under the home directory.`;
@@ -9878,11 +11057,32 @@ function wrapWithPermissionMiddleware(tools, config, deps) {
           return originalExecute(args, options);
         }
         if (verdict.decision === "deny") {
+          recordPermissionAudit(deps.logger, {
+            decision: "hard-denied",
+            operation: verdict.operation ?? operationForTool(toolName),
+            access: auditAccessFor(verdict.access),
+            resolvedPath: verdict.resolvedPath,
+            requestedPath: typeof args.path === "string" ? args.path : void 0,
+            matchedEntry: verdict.matchedEntry,
+            matchedSource: verdict.matchedSource,
+            matchedRule: verdict.matchedRule,
+            taskId: deps.taskId,
+            workerId: deps.workerId,
+            toolName
+          });
           return verdict.message ?? `[ERROR] ${toolName}: refused by the path permission policy`;
         }
         const requestId = generateId("perm");
+        const operation = verdict.operation ?? operationForTool(toolName);
         const baseDescription = config.describeCall(toolName, args);
-        const description = verdict.reason ? `${baseDescription} [reason: ${verdict.reason}]` : baseDescription;
+        const hitDetail = verdict.sensitive ? verdictDetailSuffix({
+          matchedRule: verdict.matchedRule,
+          matchedEntry: verdict.matchedEntry,
+          matchedSource: verdict.matchedSource,
+          resolvedPath: verdict.resolvedPath,
+          operation
+        }) : "";
+        const description = `${baseDescription}${hitDetail}${verdict.reason ? ` [reason: ${verdict.reason}]` : ""}`;
         deps.signalQueue.enqueue({
           source: "worker",
           type: "permission_request",
@@ -9895,7 +11095,14 @@ function wrapWithPermissionMiddleware(tools, config, deps) {
             emoji: deps.emoji,
             toolName,
             toolArgs: args,
-            description
+            description,
+            ...verdict.matchedRule !== void 0 && { matchedRule: verdict.matchedRule },
+            ...verdict.matchedEntry !== void 0 && { matchedEntry: verdict.matchedEntry },
+            ...verdict.matchedSource !== void 0 && { matchedSource: verdict.matchedSource },
+            ...verdict.resolvedPath !== void 0 && { resolvedPath: verdict.resolvedPath },
+            ...verdict.sensitive !== void 0 && { sensitive: verdict.sensitive },
+            ...verdict.access !== void 0 && { access: verdict.access },
+            operation
           },
           ...deps.turnLineage ?? {}
         });
@@ -9913,6 +11120,22 @@ function wrapWithPermissionMiddleware(tools, config, deps) {
             timer
           });
         });
+        recordPermissionAudit(deps.logger, {
+          decision: result2.approved ? "approved" : "denied",
+          operation,
+          access: auditAccessFor(verdict.access),
+          resolvedPath: verdict.resolvedPath,
+          requestedPath: typeof args.path === "string" ? args.path : void 0,
+          matchedEntry: verdict.matchedEntry,
+          matchedSource: verdict.matchedSource,
+          matchedRule: verdict.matchedRule,
+          taskId: deps.taskId,
+          workerId: deps.workerId,
+          toolName,
+          ...!result2.approved && {
+            source: result2.reason === "timeout" ? "timeout" : result2.reason === "Worker aborted" ? "aborted" : "controller"
+          }
+        });
         if (!result2.approved) {
           if (result2.reason === "timeout") {
             return `[ERROR] Permission request timed out for ${toolName}`;
@@ -10944,9 +12167,10 @@ var TaskExecuteEngine = class {
     if (workerType === PUPPET_WORKER_TYPE) {
       const middleware = wrapWithPermissionMiddleware(tools, {
         gatedTools: ["bash", ...FILE_TOOL_NAMES],
-        // Single decision source: the shared access policy (denylist →
+        // Single decision source: the shared access policy (sensitive list →
         // config roots → task allowedDirs → task workspace → read-in-home →
-        // ask). `deny` refuses here without ever emitting a permission_request.
+        // ask). `deny` refuses here without ever emitting a permission_request;
+        // both `deny` and every answered `ask` are audited (see the middleware).
         decide: (toolName, args) => decideToolAccess(accessScope, toolName, args),
         describeCall: (toolName, args) => {
           if (toolName === "bash") return `Execute shell command: ${args.command}`;
@@ -10964,7 +12188,9 @@ var TaskExecuteEngine = class {
         workerType,
         emoji: workerMeta.emoji,
         signalQueue: this.signalQueue,
-        turnLineage: this.workerLineage(workerId)
+        turnLineage: this.workerLineage(workerId),
+        // Permission audit trail (metadata only) shares the session logger.
+        logger: this.ctx.logger
       });
       tools = middleware.wrappedTools;
       this.permissionResolvers.set(workerId, middleware);
@@ -11218,7 +12444,7 @@ var ControllerLoop = class {
 };
 
 // src/services/agents/controller-state.ts
-import { join as join17 } from "path";
+import { join as join18 } from "path";
 
 // src/services/conversation/conversation-index.ts
 function emptyUsage() {
@@ -11442,8 +12668,8 @@ var ControllerAgentState = class extends BaseWayangState {
   /** In-memory resolve function for the current inquiry — never persisted. */
   inquiryResolver = null;
   constructor(ctx) {
-    const jsonFile = new JSONFileHelper(join17(ctx.sessionDir, "runtime-state.json"));
-    const jsonlFile = new JSONLFileHelper(join17(ctx.sessionDir, "conversation.jsonl"));
+    const jsonFile = new JSONFileHelper(join18(ctx.sessionDir, "runtime-state.json"));
+    const jsonlFile = new JSONLFileHelper(join18(ctx.sessionDir, "conversation.jsonl"));
     const initialData = {
       runtimeState: {
         session: { id: "", startedAt: 0 },
@@ -11613,8 +12839,8 @@ function buildSummaryInput(entries, maxChars) {
     lines = formatAll(entries, caps);
     if (totalLength(lines) <= maxChars) return lines;
   }
-  const noteFor = (n) => `[${n} older entries omitted \u2014 over the summarizer input budget]`;
-  const reserve = noteFor(lines.length).length + 1;
+  const noteFor2 = (n) => `[${n} older entries omitted \u2014 over the summarizer input budget]`;
+  const reserve = noteFor2(lines.length).length + 1;
   const kept = [];
   let used = 0;
   for (let i = lines.length - 1; i >= 0; i--) {
@@ -11624,7 +12850,7 @@ function buildSummaryInput(entries, maxChars) {
     used += size;
   }
   const omitted = lines.length - kept.length;
-  return omitted > 0 ? [noteFor(omitted), ...kept] : kept;
+  return omitted > 0 ? [noteFor2(omitted), ...kept] : kept;
 }
 
 // src/services/agents/controller-agent.ts
@@ -11662,7 +12888,7 @@ var ControllerAgent = class _ControllerAgent extends BaseAgent {
    * cancelled while its workers are still running.
    */
   turnInterruptRecorded = false;
-  constructor(ctx, state, provider, tools, skills, recorder = new ToolCallRecorder()) {
+  constructor(ctx, state, provider, tools, skills, recorder = new ToolCallRecorder(), controllerRules) {
     super(provider);
     this.ctx = ctx;
     this.state = state;
@@ -11673,7 +12899,7 @@ var ControllerAgent = class _ControllerAgent extends BaseAgent {
     this.workspaceSlug = ctx.workspaceDir ? resolveWorkspaceRef(wayangDirForSessionDir(ctx.sessionDir), ctx.workspaceDir).slug : void 0;
     this.contextManager = new ContextManager(
       state,
-      buildControllerSystemPrompt(this.ctx, skills),
+      buildControllerSystemPrompt(this.ctx, skills, { rules: controllerRules }),
       provider.contextWindowTokens
     );
     this.setHooks({
@@ -11696,6 +12922,10 @@ var ControllerAgent = class _ControllerAgent extends BaseAgent {
     const recorder = new ToolCallRecorder(ctx.logger);
     const wayangDir = wayangDirForSessionDir(ctx.sessionDir);
     const homeDir2 = wayangDir && basename9(wayangDir) === ".wayang" ? dirname11(wayangDir) : homedir3();
+    const controllerRules = loadControllerRules({
+      homeDir: homeDir2,
+      cwd: ctx.workspaceDir || process.cwd()
+    });
     const tools = createControllerTools({
       addTask: (task) => engine.add(task),
       validateWorkerType: (type) => engine.validateWorkerType(type),
@@ -11725,7 +12955,8 @@ var ControllerAgent = class _ControllerAgent extends BaseAgent {
       cwd: ctx.workspaceDir,
       homeDir: homeDir2,
       // User-config permission section: add_task validates a task's allowedDirs
-      // against the built-in denylist plus these configured deniedDirs.
+      // against the built-in sensitive list plus these configured
+      // sensitiveDirs (the deprecated deniedDirs alias is merged in).
       permissionConfig: opts.config.permission,
       getNotebook: () => state.get("runtimeState.notebook") ?? "",
       setNotebook: (content, mode) => {
@@ -11750,7 +12981,7 @@ var ControllerAgent = class _ControllerAgent extends BaseAgent {
       workspaceDir: ctx.workspaceDir,
       wayangDir
     });
-    return new _ControllerAgent(ctx, state, provider, tools, skills, recorder);
+    return new _ControllerAgent(ctx, state, provider, tools, skills, recorder, controllerRules);
   }
   /** Run the controller agent — streams text chunks while updating streamingEntries in state. */
   async run(signals) {
@@ -12347,8 +13578,8 @@ function signalToEntry(sig, ts, sessionId) {
 }
 
 // src/services/skills/registry.ts
-import { readFileSync as readFileSync12, readdirSync as readdirSync2, statSync as statSync4 } from "fs";
-import { join as join18 } from "path";
+import { readFileSync as readFileSync13, readdirSync as readdirSync2, statSync as statSync6 } from "fs";
+import { join as join19 } from "path";
 import { parse as parseYaml } from "yaml";
 var SKILL_FILE = "SKILL.md";
 function parseFrontmatter(raw) {
@@ -12383,7 +13614,7 @@ function listResources(skillDir) {
   const walk = (relDir) => {
     let entries;
     try {
-      entries = readdirSync2(join18(skillDir, relDir), { withFileTypes: true });
+      entries = readdirSync2(join19(skillDir, relDir), { withFileTypes: true });
     } catch {
       return;
     }
@@ -12430,10 +13661,10 @@ var SkillRegistry = class {
     if (existing) return existing;
     const desc = this.descriptors.get(name);
     if (!desc) return void 0;
-    const filePath = join18(desc.dir, SKILL_FILE);
+    const filePath = join19(desc.dir, SKILL_FILE);
     let raw;
     try {
-      raw = readFileSync12(filePath, "utf-8");
+      raw = readFileSync13(filePath, "utf-8");
     } catch (err) {
       this.logger?.warn({ skill: name, error: err instanceof Error ? err.message : String(err) }, "Failed to read skill file");
       return void 0;
@@ -12461,8 +13692,8 @@ var SkillRegistry = class {
     for (const entry of entries) {
       if (!entry.isDirectory()) continue;
       if (entry.name.startsWith(".") || entry.name === "node_modules") continue;
-      const skillDir = join18(dir, entry.name);
-      const skillFile = join18(skillDir, SKILL_FILE);
+      const skillDir = join19(dir, entry.name);
+      const skillFile = join19(skillDir, SKILL_FILE);
       if (!existsAsFile(skillFile)) continue;
       const { frontmatter } = safeReadFrontmatter(skillFile);
       const description = asString(frontmatter.description);
@@ -12477,14 +13708,14 @@ var SkillRegistry = class {
 };
 function existsAsFile(path9) {
   try {
-    return statSync4(path9).isFile();
+    return statSync6(path9).isFile();
   } catch {
     return false;
   }
 }
 function safeReadFrontmatter(path9) {
   try {
-    return parseFrontmatter(readFileSync12(path9, "utf-8"));
+    return parseFrontmatter(readFileSync13(path9, "utf-8"));
   } catch {
     return { frontmatter: {}, body: "" };
   }
@@ -12493,11 +13724,11 @@ function safeReadFrontmatter(path9) {
 // src/services/skills/skill-dir.ts
 import { existsSync as existsSync11 } from "fs";
 import { homedir as homedir4 } from "os";
-import { join as join19, resolve as resolve11 } from "path";
+import { join as join20, resolve as resolve11 } from "path";
 function resolveSkillDirs(workspaceDir2, configDirs) {
   const candidates = [
-    join19(homedir4(), ".wayang", "skills"),
-    join19(workspaceDir2, ".wayang", "skills"),
+    join20(homedir4(), ".wayang", "skills"),
+    join20(workspaceDir2, ".wayang", "skills"),
     ...(configDirs ?? []).map((d) => resolve11(d))
   ];
   const seen = /* @__PURE__ */ new Set();