wayang-ai 0.8.0 → 0.8.3

package/dist/cli.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 
 // src/cli.ts
-import * as path8 from "path";
+import * as path9 from "path";
 
 // src/cli-args.ts
 import meow from "meow";
@@ -463,11 +463,11 @@ var RemoteStateStore = class {
   rpc;
   entries = /* @__PURE__ */ new Map();
   byId = /* @__PURE__ */ new Map();
-  subscribe(target, path9, callback) {
-    const key = `${target}:${path9}`;
+  subscribe(target, path10, callback) {
+    const key = `${target}:${path10}`;
     let entry = this.entries.get(key);
     if (!entry) {
-      entry = { subscriptionId: "", target, path: path9, data: void 0, listeners: /* @__PURE__ */ new Set(), settled: false };
+      entry = { subscriptionId: "", target, path: path10, data: void 0, listeners: /* @__PURE__ */ new Set(), settled: false };
       this.entries.set(key, entry);
       this.connect(entry, key);
     }
@@ -477,8 +477,8 @@ var RemoteStateStore = class {
       if (entry.listeners.size === 0) this.teardown(entry, key);
     };
   }
-  getSnapshot(target, path9) {
-    return this.entries.get(`${target}:${path9}`)?.data;
+  getSnapshot(target, path10) {
+    return this.entries.get(`${target}:${path10}`)?.data;
   }
   connect(entry, key) {
     this.rpc.request(METHOD.SUBSCRIBE, { target: entry.target, path: entry.path }).then((res) => {
@@ -516,11 +516,11 @@ var RemoteSubscribable = class {
   }
   store;
   target;
-  subscribe(path9, callback) {
-    return this.store.subscribe(this.target, path9, callback);
+  subscribe(path10, callback) {
+    return this.store.subscribe(this.target, path10, callback);
   }
-  getSnapshot(path9) {
-    return this.store.getSnapshot(this.target, path9);
+  getSnapshot(path10) {
+    return this.store.getSnapshot(this.target, path10);
   }
 };
 
@@ -683,6 +683,7 @@ ${getStderrTail()}`));
 
 // src/infra/session-helpers.ts
 import * as fs3 from "fs";
+import { closeSync as closeSync2, openSync as openSync2, readSync, statSync } from "fs";
 import * as path3 from "path";
 
 // src/infra/session-index.ts
@@ -1021,8 +1022,115 @@ function listSessions(homeDir2, query2 = {}) {
 function getSession(homeDir2, sessionId) {
   return createSessionIndex(homeDir2).get(sessionId);
 }
-function getLatestSessionForWorkspace(homeDir2, workspaceDir2) {
-  return createSessionIndex(homeDir2).latestForWorkspace(workspaceDir2);
+var CONVERSATION_FILENAME = "conversation.jsonl";
+var ACTIVITY_WINDOW_BYTES = 64 * 1024;
+var MAX_ACTIVITY_WINDOW_BYTES = 2 * 1024 * 1024;
+function entryTimestamp(entry) {
+  if (entry === null || typeof entry !== "object") return null;
+  const e = entry;
+  for (const raw of [e.timestamp, e.endedAt, e.startedAt]) {
+    if (typeof raw === "string") {
+      const ms = Date.parse(raw);
+      if (Number.isFinite(ms)) return ms;
+    }
+  }
+  return null;
+}
+function readTailEntryTimestamp(filePath) {
+  let size;
+  try {
+    size = statSync(filePath).size;
+  } catch {
+    return null;
+  }
+  if (size === 0) return null;
+  let windowBytes = Math.min(size, ACTIVITY_WINDOW_BYTES);
+  for (; ; ) {
+    const start = size - windowBytes;
+    const chunk = Buffer.alloc(windowBytes);
+    let fd = null;
+    try {
+      fd = openSync2(filePath, "r");
+      readSync(fd, chunk, 0, windowBytes, start);
+    } catch {
+      return null;
+    } finally {
+      if (fd !== null) closeSync2(fd);
+    }
+    let body = chunk.toString("utf-8");
+    if (start > 0) {
+      const nl = body.indexOf("\n");
+      if (nl === -1) {
+        if (windowBytes >= MAX_ACTIVITY_WINDOW_BYTES) return null;
+        windowBytes = Math.min(size, windowBytes * 2);
+        continue;
+      }
+      body = body.slice(nl + 1);
+    }
+    let latest = null;
+    for (const line of body.split("\n")) {
+      if (line.length === 0) continue;
+      let parsed;
+      try {
+        parsed = JSON.parse(line);
+      } catch {
+        continue;
+      }
+      const ts = entryTimestamp(parsed);
+      if (ts !== null && (latest === null || ts > latest)) latest = ts;
+    }
+    if (latest !== null) return latest;
+    if (start === 0 || windowBytes >= MAX_ACTIVITY_WINDOW_BYTES) return null;
+    windowBytes = Math.min(size, windowBytes * 2);
+  }
+}
+function readMetaForActivity(sessionDir) {
+  try {
+    const raw = fs3.readFileSync(path3.join(sessionDir, "meta.json"), "utf-8");
+    const meta = JSON.parse(raw);
+    return meta !== null && typeof meta === "object" ? meta : null;
+  } catch {
+    return null;
+  }
+}
+function usableTimestamp(value) {
+  return typeof value === "number" && Number.isFinite(value) && value > 0 ? value : null;
+}
+function readSessionLastActivity(sessionDir) {
+  const meta = readMetaForActivity(sessionDir);
+  const candidates = [];
+  const conversationAt = readTailEntryTimestamp(path3.join(sessionDir, CONVERSATION_FILENAME));
+  if (conversationAt !== null) candidates.push({ at: conversationAt, source: "conversation" });
+  const lastActiveAt = usableTimestamp(meta?.lastActiveAt);
+  if (lastActiveAt !== null) candidates.push({ at: lastActiveAt, source: "meta.lastActiveAt" });
+  const createdAt = usableTimestamp(meta?.createdAt);
+  if (createdAt !== null) candidates.push({ at: createdAt, source: "meta.createdAt" });
+  if (candidates.length === 0) return null;
+  return candidates.reduce((best, candidate) => candidate.at > best.at ? candidate : best);
+}
+function pickMostRecentlyActive(candidates, activityOf) {
+  let best = null;
+  let bestAt = 0;
+  for (const candidate of candidates) {
+    const at = activityOf(candidate);
+    if (best === null || at > bestAt || at === bestAt && candidate.sessionId > best.sessionId) {
+      best = candidate;
+      bestAt = at;
+    }
+  }
+  return best;
+}
+function activityAtForEntry(entry) {
+  const activity = readSessionLastActivity(entry.sessionDir);
+  if (activity) return activity.at;
+  return usableTimestamp(entry.meta.createdAt) ?? 0;
+}
+function getLatestSessionForWorkspace(homeDir2, workspaceDir2, opts = {}) {
+  const candidates = createSessionIndex(homeDir2).list({
+    workspace: workspaceDir2,
+    includeArchived: opts.includeArchived
+  });
+  return pickMostRecentlyActive(candidates, activityAtForEntry);
 }
 function readSessionUnfinishedTasks(sessionDir) {
   const tasksPath = path3.join(sessionDir, "tasks.json");
@@ -1303,7 +1411,7 @@ function validateConfig(config) {
   if (!config.providers[wp]) return `worker.provider "${wp}" not found`;
   const permission = config.permission;
   if (permission !== void 0 && permission !== null) {
-    const keys = ["allowedDirs", "autoAllowRoots", "deniedDirs"];
+    const keys = ["allowedDirs", "autoAllowRoots", "sensitiveDirs", "deniedDirs"];
     for (const key of keys) {
       const value = permission[key];
       if (value === void 0) continue;
@@ -1311,6 +1419,10 @@ function validateConfig(config) {
         return `permission.${key} must be an array of strings (got ${JSON.stringify(value)})`;
       }
     }
+    const mode = permission.sensitiveMode;
+    if (mode !== void 0 && mode !== "ask" && mode !== "deny") {
+      return `permission.sensitiveMode must be 'ask' or 'deny' (got ${JSON.stringify(mode)})`;
+    }
   }
   return null;
 }
@@ -1363,43 +1475,43 @@ var BaseWayangState = class {
   }
   // --- Read ---
   // eslint-disable-next-line @typescript-eslint/no-explicit-any -- public default generic: bare get() callers across the repo rely on it; per-call sites pass an explicit T
-  get(path9) {
-    return get(this.data, path9);
+  get(path10) {
+    return get(this.data, path10);
   }
   // --- Write operations ---
-  set(path9, value) {
-    const prev = get(this.data, path9);
-    set(this.data, path9, value);
-    this.persist(path9, "set");
-    this.notify(path9, "set", prev);
+  set(path10, value) {
+    const prev = get(this.data, path10);
+    set(this.data, path10, value);
+    this.persist(path10, "set");
+    this.notify(path10, "set", prev);
   }
   // eslint-disable-next-line @typescript-eslint/no-explicit-any -- partial update merges an untyped object into the state tree root (see `data`)
-  update(path9, partial) {
-    const prev = cloneDeep(get(this.data, path9));
-    const target = get(this.data, path9);
+  update(path10, partial) {
+    const prev = cloneDeep(get(this.data, path10));
+    const target = get(this.data, path10);
     if (target && typeof target === "object") {
       Object.assign(target, partial);
     } else {
-      set(this.data, path9, partial);
+      set(this.data, path10, partial);
     }
-    this.persist(path9, "update");
-    this.notify(path9, "update", prev);
+    this.persist(path10, "update");
+    this.notify(path10, "update", prev);
   }
-  append(path9, entry) {
-    const arr = get(this.data, path9);
+  append(path10, entry) {
+    const arr = get(this.data, path10);
     if (!Array.isArray(arr)) {
-      throw new Error(`State.append: path "${path9}" is not an array`);
+      throw new Error(`State.append: path "${path10}" is not an array`);
     }
-    const stamped = path9 === "conversation" ? applyAppendEnvelope(entry, arr) : entry;
+    const stamped = path10 === "conversation" ? applyAppendEnvelope(entry, arr) : entry;
     arr.push(stamped);
-    set(this.data, path9, [...arr]);
-    this.persist(path9, "append", stamped);
-    this.notify(path9, "append", void 0);
+    set(this.data, path10, [...arr]);
+    this.persist(path10, "append", stamped);
+    this.notify(path10, "append", void 0);
   }
-  remove(path9, idx) {
-    const arr = get(this.data, path9);
+  remove(path10, idx) {
+    const arr = get(this.data, path10);
     if (!Array.isArray(arr)) {
-      throw new Error(`State.remove: path "${path9}" is not an array`);
+      throw new Error(`State.remove: path "${path10}" is not an array`);
     }
     const prev = idx !== void 0 ? arr[idx] : arr[arr.length - 1];
     if (idx === void 0) {
@@ -1407,16 +1519,16 @@ var BaseWayangState = class {
     } else {
       arr.splice(idx, 1);
     }
-    this.persist(path9, "remove");
-    this.notify(path9, "remove", prev);
+    this.persist(path10, "remove");
+    this.notify(path10, "remove", prev);
   }
   // --- Subscription ---
-  on(path9, callback) {
-    if (!this.subscriptions.has(path9)) {
-      this.subscriptions.set(path9, /* @__PURE__ */ new Set());
+  on(path10, callback) {
+    if (!this.subscriptions.has(path10)) {
+      this.subscriptions.set(path10, /* @__PURE__ */ new Set());
     }
-    this.subscriptions.get(path9).add(callback);
-    return () => this.subscriptions.get(path9)?.delete(callback);
+    this.subscriptions.get(path10).add(callback);
+    return () => this.subscriptions.get(path10)?.delete(callback);
   }
   // --- Persistence ---
   /**
@@ -1424,8 +1536,8 @@ var BaseWayangState = class {
    * for the helper to pick its own strategy. Snapshot helpers replace the
    * file; append helpers write only the new entry and ignore window edits.
    */
-  persist(path9, op, entry) {
-    const topKey = path9.split(".")[0];
+  persist(path10, op, entry) {
+    const topKey = path10.split(".")[0];
     for (const mapping of this.persistMappings) {
       if (mapping.path !== topKey) continue;
       mapping.helper.write({
@@ -1466,10 +1578,10 @@ import {
   existsSync as existsSync4,
   mkdirSync as mkdirSync3,
   renameSync as renameSync4,
-  openSync as openSync2,
+  openSync as openSync3,
   writeSync as writeSync2,
   fsyncSync as fsyncSync2,
-  closeSync as closeSync2,
+  closeSync as closeSync3,
   unlinkSync as unlinkSync3,
   copyFileSync
 } from "fs";
@@ -1498,16 +1610,16 @@ var JSONFileHelper = class {
     const tmp = this.tempPath();
     let fd = null;
     try {
-      fd = openSync2(tmp, "w");
+      fd = openSync3(tmp, "w");
       writeSync2(fd, JSON.stringify(value, null, 2));
       fsyncSync2(fd);
-      closeSync2(fd);
+      closeSync3(fd);
       fd = null;
       renameSync4(tmp, this.filePath);
     } catch (err) {
       if (fd !== null) {
         try {
-          closeSync2(fd);
+          closeSync3(fd);
         } catch {
         }
       }
@@ -1958,56 +2070,6 @@ var theme = {
   }
 };
 
-// src/tui/utils/chat-lookups.ts
-var EMPTY_CHAT_LOOKUPS = {
-  permissionRequests: /* @__PURE__ */ new Map(),
-  inquiries: /* @__PURE__ */ new Map(),
-  workers: /* @__PURE__ */ new Map(),
-  workerTypeEmoji: /* @__PURE__ */ new Map()
-};
-function buildChatLookups(items) {
-  const permissionRequests = /* @__PURE__ */ new Map();
-  const inquiries = /* @__PURE__ */ new Map();
-  const workers = /* @__PURE__ */ new Map();
-  const workerTypeEmoji = /* @__PURE__ */ new Map();
-  for (const item of items) {
-    if (item.role !== "signal") continue;
-    if (item.workerType && item.emoji && !workerTypeEmoji.has(item.workerType)) {
-      workerTypeEmoji.set(item.workerType, item.emoji);
-    }
-    let worker;
-    if (item.workerId) {
-      const prev = workers.get(item.workerId);
-      worker = {
-        workerId: item.workerId,
-        emoji: item.emoji ?? prev?.emoji,
-        workerType: item.workerType ?? prev?.workerType,
-        taskTitle: item.taskTitle ?? prev?.taskTitle
-      };
-      workers.set(item.workerId, worker);
-    }
-    const requestId = item.permissionMeta?.requestId;
-    if (item.permissionMeta && requestId) {
-      permissionRequests.set(requestId, { meta: item.permissionMeta, ...worker && { worker } });
-    }
-    const inquiryId = item.inquiryMeta?.inquiryId;
-    if (item.inquiryMeta && inquiryId) {
-      inquiries.set(inquiryId, { meta: item.inquiryMeta, ...worker && { worker } });
-    }
-  }
-  return { permissionRequests, inquiries, workers, workerTypeEmoji };
-}
-function formatWorkerTag(ctx) {
-  const parts = [];
-  if (ctx.taskTitle) parts.push(ctx.taskTitle);
-  if (ctx.workerId) parts.push(`w:${ctx.workerId.slice(-4)}`);
-  const body = parts.join(" \xB7 ");
-  return [ctx.emoji, body].filter(Boolean).join(" ");
-}
-
-// src/tui/components/chat-area/user-row.tsx
-import { Box, Text } from "ink";
-
 // src/tui/utils/text-width.ts
 function charWidth(cp) {
   if (cp >= 768 && cp <= 879) return 0;
@@ -2049,6 +2111,28 @@ function sliceToWidth(s, maxWidth) {
   }
   return out;
 }
+function sliceToWidthFromEnd(s, maxWidth) {
+  if (maxWidth <= 0) return "";
+  const chars = Array.from(s);
+  let w = 0;
+  let out = "";
+  for (let i = chars.length - 1; i >= 0; i -= 1) {
+    const cw = charWidth(chars[i].codePointAt(0) ?? 0);
+    if (w + cw > maxWidth) break;
+    out = chars[i] + out;
+    w += cw;
+  }
+  return out;
+}
+function truncateMiddleToWidth(s, maxWidth) {
+  if (maxWidth <= 0) return "";
+  if (stringWidth(s) <= maxWidth) return s;
+  if (maxWidth === 1) return "\u2026";
+  const keep = maxWidth - 1;
+  const headBudget = Math.ceil(keep / 2);
+  const tailBudget = keep - headBudget;
+  return sliceToWidth(s, headBudget) + "\u2026" + sliceToWidthFromEnd(s, tailBudget);
+}
 function collapseWhitespace(s) {
   return s.replace(/\s+/g, " ").trim();
 }
@@ -2063,7 +2147,144 @@ function shortId(id) {
   return id.slice(-4);
 }
 
+// src/tui/utils/workspace-display.ts
+var EMPTY_WORKSPACE_CONTEXT = { workspaces: [] };
+function formatWorkspaceSlug(workspace) {
+  const slug = workspace?.slug?.trim();
+  return slug ? slug : null;
+}
+function formatWorkspaceSummary(workspaces) {
+  if (!workspaces || workspaces.length === 0) return null;
+  const slugs = workspaces.map((workspace) => workspace?.slug?.trim()).filter((slug) => !!slug);
+  if (slugs.length === 0) return null;
+  if (slugs.length === 1) return slugs[0];
+  return `${slugs[0]} +${slugs.length - 1}`;
+}
+function isSameWorkspacePath(a, b) {
+  const left = a?.trim();
+  const right = b?.trim();
+  if (!left || !right) return false;
+  return normalizeWorkspacePath(left) === normalizeWorkspacePath(right);
+}
+function resolveWorkspaceSlug(workspace) {
+  const slug = workspace?.slug?.trim();
+  if (slug) return slug;
+  const path10 = workspace?.path?.trim();
+  return path10 ? workspaceSlugFromPath(path10) : null;
+}
+function formatTaskWorkspaceMark(workspace, defaultWorkspacePath) {
+  const slug = resolveWorkspaceSlug(workspace);
+  if (!slug) return "";
+  if (defaultWorkspacePath && isSameWorkspacePath(workspace?.path, defaultWorkspacePath)) {
+    return "";
+  }
+  return ` \u2014 ${slug}`;
+}
+function resolveDeclaredWorkspaceSlug(declaredPath, options = {}) {
+  const raw = declaredPath?.trim();
+  if (!raw) return null;
+  if (options.defaultWorkspacePath && isSameWorkspacePath(raw, options.defaultWorkspacePath)) {
+    return null;
+  }
+  const known = (options.workspaces ?? []).find(
+    (workspace) => workspace?.path && isSameWorkspacePath(workspace.path, raw)
+  );
+  if (known) return resolveWorkspaceSlug(known);
+  return resolveWorkspaceSlug({ path: normalizeWorkspacePath(raw) });
+}
+var PROJECT_LIST_MAX_WIDTH = 80;
+var PROJECT_DEFAULT_MARKER = "*";
+var PROJECT_DEFAULT_LEGEND = "* = default workspace";
+function collectProjectEntries(input2) {
+  const defaultPath = input2.defaultWorkspacePath?.trim();
+  const seen = /* @__PURE__ */ new Set();
+  const entries = [];
+  const candidates = [
+    ...input2.workspaces ?? [],
+    ...input2.taskWorkspaces ?? [],
+    ...defaultPath ? [{ path: defaultPath }] : []
+  ];
+  for (const candidate of candidates) {
+    const rawPath = candidate?.path?.trim();
+    if (!rawPath) continue;
+    const canonical = normalizeWorkspacePath(rawPath);
+    if (seen.has(canonical)) continue;
+    const slug = resolveWorkspaceSlug({ ...candidate, path: rawPath });
+    if (!slug) continue;
+    seen.add(canonical);
+    entries.push({
+      slug,
+      path: rawPath,
+      isDefault: defaultPath !== void 0 && isSameWorkspacePath(rawPath, defaultPath)
+    });
+  }
+  const defaultEntry = entries.find((entry) => entry.isDefault);
+  return defaultEntry ? [defaultEntry, ...entries.filter((entry) => entry !== defaultEntry)] : entries;
+}
+function formatProjectList(input2, options = {}) {
+  const maxWidth = options.maxWidth ?? PROJECT_LIST_MAX_WIDTH;
+  const entries = collectProjectEntries(input2);
+  if (entries.length === 0) return "No projects";
+  const lines = entries.map((entry) => {
+    const suffix = entry.isDefault ? `  ${PROJECT_DEFAULT_MARKER}` : "";
+    const prefix = `${entry.slug}  `;
+    const pathBudget = Math.max(1, maxWidth - stringWidth(prefix) - stringWidth(suffix));
+    return prefix + truncateMiddleToWidth(entry.path, pathBudget) + suffix;
+  });
+  if (entries.some((entry) => entry.isDefault)) lines.push(PROJECT_DEFAULT_LEGEND);
+  return lines.join("\n");
+}
+
+// src/tui/utils/chat-lookups.ts
+var EMPTY_CHAT_LOOKUPS = {
+  permissionRequests: /* @__PURE__ */ new Map(),
+  inquiries: /* @__PURE__ */ new Map(),
+  workers: /* @__PURE__ */ new Map(),
+  workerTypeEmoji: /* @__PURE__ */ new Map(),
+  workspace: EMPTY_WORKSPACE_CONTEXT
+};
+function buildChatLookups(items, workspace = EMPTY_WORKSPACE_CONTEXT) {
+  const permissionRequests = /* @__PURE__ */ new Map();
+  const inquiries = /* @__PURE__ */ new Map();
+  const workers = /* @__PURE__ */ new Map();
+  const workerTypeEmoji = /* @__PURE__ */ new Map();
+  for (const item of items) {
+    if (item.role !== "signal") continue;
+    if (item.workerType && item.emoji && !workerTypeEmoji.has(item.workerType)) {
+      workerTypeEmoji.set(item.workerType, item.emoji);
+    }
+    let worker;
+    if (item.workerId) {
+      const prev = workers.get(item.workerId);
+      worker = {
+        workerId: item.workerId,
+        emoji: item.emoji ?? prev?.emoji,
+        workerType: item.workerType ?? prev?.workerType,
+        taskTitle: item.taskTitle ?? prev?.taskTitle
+      };
+      workers.set(item.workerId, worker);
+    }
+    const requestId = item.permissionMeta?.requestId;
+    if (item.permissionMeta && requestId) {
+      permissionRequests.set(requestId, { meta: item.permissionMeta, ...worker && { worker } });
+    }
+    const inquiryId = item.inquiryMeta?.inquiryId;
+    if (item.inquiryMeta && inquiryId) {
+      inquiries.set(inquiryId, { meta: item.inquiryMeta, ...worker && { worker } });
+    }
+  }
+  return { permissionRequests, inquiries, workers, workerTypeEmoji, workspace };
+}
+function formatWorkerTag(ctx) {
+  const parts = [];
+  if (ctx.taskTitle) parts.push(ctx.taskTitle);
+  if (ctx.workerId) parts.push(`w:${ctx.workerId.slice(-4)}`);
+  const body = parts.join(" \xB7 ");
+  return [ctx.emoji, body].filter(Boolean).join(" ");
+}
+
 // src/tui/components/chat-area/user-row.tsx
+import { Box, Text } from "ink";
 import { jsx as jsx2, jsxs } from "react/jsx-runtime";
 var PREFIX = `${theme.user.prefix} `;
 var PREFIX_WIDTH = stringWidth(PREFIX);
@@ -2143,27 +2364,27 @@ function toolTarget(toolName, args, budget) {
       return fitWithSuffix(lines[0].trim(), note, budget);
     }
     case "write_file": {
-      const path9 = argString(args, ["path", "file_path"]);
-      if (!path9) return "";
+      const path10 = argString(args, ["path", "file_path"]);
+      if (!path10) return "";
       const lines = lineCount(args.content);
       const note = lines > 0 ? ` (+${lines})` : "";
-      return fitWithSuffix(shortenPath(path9), note, budget);
+      return fitWithSuffix(shortenPath(path10), note, budget);
     }
     case "edit_file": {
-      const path9 = argString(args, ["path", "file_path"]);
-      if (!path9) return "";
+      const path10 = argString(args, ["path", "file_path"]);
+      if (!path10) return "";
       const oldLines = lineCount(args.old_string);
       const newLines = lineCount(args.new_string);
       const note = oldLines > 0 || newLines > 0 ? ` (${oldLines}\u2192${newLines} \u884C)` : "";
-      return fitWithSuffix(shortenPath(path9), note, budget);
+      return fitWithSuffix(shortenPath(path10), note, budget);
     }
     case "read_file": {
-      const path9 = argString(args, ["path", "file_path"]);
-      if (!path9) return "";
+      const path10 = argString(args, ["path", "file_path"]);
+      if (!path10) return "";
       const offset = argNumber(args, ["offset"]);
       const limit = argNumber(args, ["limit"]);
       const range = offset !== void 0 ? `:${offset}${limit !== void 0 ? `+${limit}` : ""}` : "";
-      return truncateToWidth(shortenPath(path9) + range, budget);
+      return truncateToWidth(shortenPath(path10) + range, budget);
     }
     case "search_files":
       return truncateToWidth(argString(args, ["pattern"]) ?? "", budget);
@@ -2199,15 +2420,18 @@ function toolTarget(toolName, args, budget) {
 function requestArgs(meta) {
   return meta.toolArgs && typeof meta.toolArgs === "object" && !Array.isArray(meta.toolArgs) ? meta.toolArgs : {};
 }
-var RESOLVED_PATH_RE = /^\S+: (.*) \(resolved: (.*)\)$/s;
+var RESOLVED_PATH_RE = /^\S+: (.*) \(resolved: (.*?)\)(?: \[(.*)\])?$/s;
 function meaningfulDescription(description) {
   if (!description) return "";
   const text = description.trim();
   if (/^execute shell command:/i.test(text)) return "";
   const m = RESOLVED_PATH_RE.exec(text);
   if (m) {
-    const [, rawPath, resolved] = m;
-    return resolved && resolved !== rawPath ? `\u89E3\u6790\u4E3A ${resolved}` : "";
+    const [, rawPath, resolved, hit] = m;
+    const parts = [];
+    if (resolved && resolved !== rawPath) parts.push(`\u89E3\u6790\u4E3A ${resolved}`);
+    if (hit) parts.push(`[${hit}]`);
+    return collapseWhitespace(parts.join(" "));
   }
   return collapseWhitespace(text);
 }
@@ -2318,11 +2542,25 @@ function summarizeWorkerMessage(argsJson, width, result2, maxLines = 3) {
   };
 }
 var TASK_ID_RE = /^Task (\S+) (?:added|assigned)/;
-function summarizeAddTask(argsJson, width, result2, maxLines = 2) {
+var ADD_TASK_HEADER_CHROME = 27;
+var ADD_TASK_TAG_INSET = 1;
+var ADD_TASK_WORKSPACE_TAG_MAX_WIDTH = 16;
+function formatAddTaskWorkspaceTag(slug, maxWidth = ADD_TASK_WORKSPACE_TAG_MAX_WIDTH) {
+  const label = slug?.trim();
+  if (!label) return "";
+  return truncateToWidth(` \u2014 ${label}`, maxWidth);
+}
+function summarizeAddTask(argsJson, width, result2, options = {}) {
   const args = parseArgs(argsJson) ?? {};
+  const maxLines = options.maxLines ?? 2;
   const title = str(args.title) ?? "(untitled)";
   const description = str(args.description) ?? "";
   const { lines, hidden } = previewLines(description, maxLines, width);
+  const declaredWorkspaceSlug = resolveDeclaredWorkspaceSlug(str(args.workspace), {
+    defaultWorkspacePath: options.defaultWorkspacePath,
+    workspaces: options.workspaces
+  });
+  const workspaceTag = formatAddTaskWorkspaceTag(declaredWorkspaceSlug);
   let outcome = "pending";
   let taskShortId;
   let failure = "";
@@ -2336,8 +2574,11 @@ function summarizeAddTask(argsJson, width, result2, maxLines = 2) {
       failure = failureText(result2.text, width);
     }
   }
+  const tagCost = workspaceTag ? stringWidth(workspaceTag) + ADD_TASK_TAG_INSET : 0;
+  const titleBudget = Math.max(1, width - ADD_TASK_HEADER_CHROME - tagCost);
   return {
-    title: fitWithSuffix(collapseWhitespace(title), "", width),
+    title: fitWithSuffix(collapseWhitespace(title), "", titleBudget),
+    ...declaredWorkspaceSlug && { workspaceSlug: declaredWorkspaceSlug },
     workerType: str(args.workerType) ?? str(args.worker_type) ?? "puppet",
     ...str(args.priority) && { priority: str(args.priority) },
     multiStage: args.multiStage === true,
@@ -2597,8 +2838,13 @@ function AddTaskRow({ section: section2, result: result2, lookups }) {
   const summary = summarizeAddTask(
     section2.text,
     SECONDARY_WIDTH,
-    result2 ? { text: result2.text, isError: result2.isError } : void 0
+    result2 ? { text: result2.text, isError: result2.isError } : void 0,
+    {
+      defaultWorkspacePath: lookups.workspace.defaultWorkspacePath,
+      workspaces: lookups.workspace.workspaces
+    }
   );
+  const workspaceTag = formatAddTaskWorkspaceTag(summary.workspaceSlug);
   const reuse = summary.assignToWorker !== void 0;
   const iconColor = summary.outcome === "failed" ? theme.action.failColor : theme.action.color;
   const reusedWorker = reuse ? lookups.workers.get(summary.assignToWorker) : void 0;
@@ -2623,6 +2869,7 @@ function AddTaskRow({ section: section2, result: result2, lookups }) {
         " #",
         summary.taskShortId
       ] }),
+      workspaceTag ? /* @__PURE__ */ jsx3(Text2, { color: theme.secondary.color, children: workspaceTag }) : null,
       /* @__PURE__ */ jsx3(OutcomeMark, { outcome: summary.outcome, ok: "\u5DF2\u6D3E\u53D1", failed: "\u6D3E\u53D1\u5931\u8D25" })
     ] }),
     /* @__PURE__ */ jsx3(SecondaryLine, { children: metaLine }),
@@ -2817,14 +3064,20 @@ function shouldShowGap(prev, _current) {
   if (!prev) return false;
   return true;
 }
-var ChatArea = React2.memo(function ChatArea2({ items, busy, streamingItems, contentWidth }) {
+var ChatArea = React2.memo(function ChatArea2({
+  items,
+  busy,
+  streamingItems,
+  contentWidth,
+  workspace = EMPTY_WORKSPACE_CONTEXT
+}) {
   const width = contentWidth ?? 78;
   const { staticItems, dynamicItems } = useMemo(() => {
     const read = items.filter((i) => i.read);
     const unread = items.filter((i) => !i.read);
     return { staticItems: read, dynamicItems: unread };
   }, [items]);
-  const lookups = useMemo(() => buildChatLookups(items), [items]);
+  const lookups = useMemo(() => buildChatLookups(items, workspace), [items, workspace]);
   return /* @__PURE__ */ jsxs5(Fragment2, { children: [
     /* @__PURE__ */ jsx8(Static, { items: staticItems, children: (item, idx) => /* @__PURE__ */ jsx8(
       Box5,
@@ -2975,29 +3228,61 @@ function renderShortcutList() {
   return lines.join("\n");
 }
 
-// src/tui/utils/workspace-display.ts
-function formatWorkspaceSlug(workspace) {
-  const slug = workspace?.slug?.trim();
-  return slug ? slug : null;
-}
-function formatWorkspaceSummary(workspaces) {
-  if (!workspaces || workspaces.length === 0) return null;
-  const slugs = workspaces.map((workspace) => workspace?.slug?.trim()).filter((slug) => !!slug);
-  if (slugs.length === 0) return null;
-  if (slugs.length === 1) return slugs[0];
-  return `${slugs[0]} +${slugs.length - 1}`;
+// src/tui/utils/task-list.ts
+var TASK_LIST_DESCRIPTION_MAX_WIDTH = 80;
+var TASK_LIST_MAX_ITEMS = 20;
+function truncateForList(text, maxWidth = TASK_LIST_DESCRIPTION_MAX_WIDTH) {
+  return truncateToWidth(collapseWhitespace(text), maxWidth);
 }
-function formatWorkspaceDetail(workspace) {
-  const path9 = workspace?.path?.trim();
-  const slug = workspace?.slug?.trim();
-  if (path9 && slug) return `${slug} (${path9})`;
-  return path9 || slug || null;
+var ACTIVE_TASK_STATUSES = /* @__PURE__ */ new Set([
+  "pending",
+  "running"
+]);
+function isActiveTask(task) {
+  return ACTIVE_TASK_STATUSES.has(task.status);
+}
+function limitForList(items, max = TASK_LIST_MAX_ITEMS, options = {}) {
+  const isActive = options.isActive ?? (() => false);
+  const total = items.length;
+  if (total === 0) {
+    return { items: [], total, hidden: 0, note: null };
+  }
+  const activeIndices = [];
+  const historyIndices = [];
+  items.forEach((item, index) => {
+    (isActive(item) ? activeIndices : historyIndices).push(index);
+  });
+  const historyBudget = Math.max(0, max - activeIndices.length);
+  const keptHistory = historyBudget === 0 ? [] : historyIndices.slice(-historyBudget);
+  const keep = /* @__PURE__ */ new Set([...activeIndices, ...keptHistory]);
+  const kept = items.filter((_, index) => keep.has(index));
+  const hidden = total - kept.length;
+  if (hidden === 0) {
+    return { items: kept, total, hidden: 0, note: null };
+  }
+  const note = activeIndices.length > 0 ? `${noteFor(total, kept.length)}\uFF08\u53E6\u6709 ${hidden} \u6761\u5386\u53F2\u672A\u663E\u793A\uFF09` : noteFor(total, kept.length);
+  return { items: kept, total, hidden, note };
+}
+function noteFor(total, shown) {
+  return `\u2026 \u663E\u793A\u6700\u8FD1 ${shown} / \u5171 ${total} \u6761`;
+}
+function formatTaskRow(task, options = {}) {
+  const workspacePart = formatTaskWorkspaceMark(task.workspace, options.defaultWorkspacePath);
+  const description = truncateForList(task.description, options.descriptionMaxWidth);
+  return `[${task.status}] ${task.id}: ${description}${workspacePart}${task.result ? ` \u2192 ${task.result}` : ""}`;
+}
+function formatTaskList(tasks, options = {}) {
+  const limited = limitForList(tasks, options.maxItems, { isActive: isActiveTask });
+  const lines = limited.items.map((task) => formatTaskRow(task, options));
+  if (limited.note) lines.push(limited.note);
+  return lines.join("\n");
 }
 
 // src/tui/hooks/use-slash-commands.ts
 var SLASH_COMMANDS = [
   { name: "tasks", args: "[status]", description: "List tasks" },
   { name: "workers", description: "List active workers" },
+  { name: "projects", description: "List session workspaces" },
   { name: "cancel", args: "<id>", description: "Cancel a task" },
   { name: "context", description: "Show context token breakdown" },
   { name: "compact", description: "Compact context" },
@@ -3018,12 +3303,21 @@ function useSlashCommands(supervisor) {
         const status = parts[1];
         const tasks = await supervisor.engine.list(status);
         if (tasks.length === 0) return { handled: true, output: "No tasks" };
-        const lines = tasks.map((t) => {
-          const workspace = formatWorkspaceDetail(t.workspace);
-          const workspacePart = workspace ? ` \u2014 ${workspace}` : "";
-          return `[${t.status}] ${t.id}: ${t.description}${workspacePart}${t.result ? ` \u2192 ${t.result}` : ""}`;
-        });
-        return { handled: true, output: lines.join("\n") };
+        return {
+          handled: true,
+          output: formatTaskList(tasks, { defaultWorkspacePath: supervisor.ctx.workspaceDir })
+        };
+      }
+      case "projects": {
+        const tasks = await supervisor.engine.list();
+        return {
+          handled: true,
+          output: formatProjectList({
+            workspaces: supervisor.ctx.workspaces,
+            taskWorkspaces: tasks.map((task) => task.workspace ?? {}),
+            defaultWorkspacePath: supervisor.ctx.workspaceDir
+          })
+        };
       }
       case "workers": {
         const activeWorkers = supervisor.engine.getActiveWorkers();
@@ -3057,8 +3351,9 @@ function useSlashCommands(supervisor) {
           handled: true,
           output: [
             "Commands:",
-            "  /tasks [status]   \u2014 List tasks",
+            "  /tasks [status]   \u2014 List tasks (workspace slug when not the default)",
             "  /workers          \u2014 List active workers",
+            "  /projects         \u2014 List session workspaces (* = default workspace)",
             "  /cancel <id>      \u2014 Cancel a task and abort its worker",
             "  /context          \u2014 Show context token breakdown",
             "  /compact          \u2014 Compact conversation context",
@@ -3768,15 +4063,15 @@ import { Box as Box8, Text as Text9, useStdout } from "ink";
 
 // src/tui/hooks/use-wayang-state.ts
 import { useState as useState4, useEffect as useEffect3 } from "react";
-function useWayangState(source, path9) {
-  const [value, setValue] = useState4(() => source.getSnapshot(path9));
+function useWayangState(source, path10) {
+  const [value, setValue] = useState4(() => source.getSnapshot(path10));
   useEffect3(() => {
-    const unSub = source.subscribe(path9, () => {
-      setValue(source.getSnapshot(path9));
+    const unSub = source.subscribe(path10, () => {
+      setValue(source.getSnapshot(path10));
     });
-    setValue(source.getSnapshot(path9));
+    setValue(source.getSnapshot(path10));
     return unSub;
-  }, [source, path9]);
+  }, [source, path10]);
   return value;
 }
 
@@ -4162,6 +4457,13 @@ function ControllerPage({ onExit }) {
         break;
     }
   });
+  const workspaceContext = useMemo4(
+    () => ({
+      defaultWorkspacePath: supervisor.ctx.workspaceDir,
+      workspaces: supervisor.ctx.workspaces
+    }),
+    [supervisor]
+  );
   const { handleCommand } = useSlashCommands(supervisor);
   const handleSubmit = useMemoizedFn(async (input2) => {
     let cmdResult;
@@ -4201,7 +4503,8 @@ function ControllerPage({ onExit }) {
         items: displayItems,
         busy,
         streamingItems,
-        contentWidth: chatContentWidth
+        contentWidth: chatContentWidth,
+        workspace: workspaceContext
       }
     ) }),
     overlay && /* @__PURE__ */ jsx13(OverlayPanel, { overlay }),
@@ -4268,7 +4571,7 @@ function AppContent() {
 // package.json
 var package_default = {
   name: "wayang-ai",
-  version: "0.8.0",
+  version: "0.8.3",
   description: "Multi-agent orchestration platform",
   type: "module",
   license: "MIT",
@@ -4395,6 +4698,36 @@ import * as fs5 from "fs";
 import * as path6 from "path";
 import * as childProcess from "child_process";
 import prompts from "prompts";
+
+// src/infra/permission/permission-config.ts
+var DEFAULT_SENSITIVE_MODE = "ask";
+function mergeSensitiveDirs(permission) {
+  const entries = [...permission?.sensitiveDirs ?? [], ...permission?.deniedDirs ?? []];
+  const seen = /* @__PURE__ */ new Set();
+  const merged = [];
+  for (const entry of entries) {
+    if (typeof entry !== "string" || entry.length === 0) continue;
+    if (seen.has(entry)) continue;
+    seen.add(entry);
+    merged.push(entry);
+  }
+  return merged;
+}
+function resolveSensitiveMode(permission) {
+  return permission?.sensitiveMode ?? DEFAULT_SENSITIVE_MODE;
+}
+var deprecatedDeniedDirsWarned = false;
+function warnDeprecatedPermissionKeys(permission, warn) {
+  if (deprecatedDeniedDirsWarned) return;
+  const legacy = permission?.deniedDirs;
+  if (!Array.isArray(legacy) || legacy.length === 0) return;
+  deprecatedDeniedDirsWarned = true;
+  warn(
+    "permission.deniedDirs is deprecated and will be removed in a future release \u2014 use permission.sensitiveDirs instead (both keys are read and merged)."
+  );
+}
+
+// src/onboard.ts
 function fillApiKeys(config) {
   const envKey = process.env.WAYANG_LLM_API_KEY || "";
   for (const provider of Object.values(config.providers)) {
@@ -4549,6 +4882,7 @@ async function loadConfig(configPath2, options = {}) {
     }
   }
   fillApiKeys(config);
+  warnDeprecatedPermissionKeys(config.permission, (message) => console.warn(`Warning: ${message}`));
   const err = validateConfig(config);
   if (err) {
     if (nonInteractive) throw new Error(`Invalid config: ${err}`);
@@ -5137,11 +5471,11 @@ var SignalQueue = class {
     this.counter = Math.max(mark, this.maxIdInWindow());
   }
   // --- Subscribable ---
-  subscribe(path9, callback) {
-    return this.state.on(path9, callback);
+  subscribe(path10, callback) {
+    return this.state.on(path10, callback);
   }
-  getSnapshot(path9) {
-    return this.state.get(path9);
+  getSnapshot(path10) {
+    return this.state.get(path10);
   }
   enqueue(sig) {
     const id = `sig-${++this.counter}`;
@@ -5261,7 +5595,7 @@ var SignalQueue = class {
 };
 
 // src/services/worker-transcript.ts
-import { closeSync as closeSync3, existsSync as existsSync8, openSync as openSync3, readSync, statSync } from "fs";
+import { closeSync as closeSync4, existsSync as existsSync8, openSync as openSync4, readSync as readSync2, statSync as statSync2 } from "fs";
 import { join as join12 } from "path";
 
 // src/services/agents/worker-state.ts
@@ -5770,9 +6104,9 @@ function workerTranscriptPath(sessionDir, workerId) {
 }
 function readWorkerTranscript(sessionDir, workerId) {
   if (!isValidWorkerId(workerId)) return null;
-  const path9 = workerTranscriptPath(sessionDir, workerId);
-  if (!existsSync8(path9)) return null;
-  return new JSONLFileHelper(path9).read();
+  const path10 = workerTranscriptPath(sessionDir, workerId);
+  if (!existsSync8(path10)) return null;
+  return new JSONLFileHelper(path10).read();
 }
 var MAX_TRANSCRIPT_WINDOW_BYTES = 2 * 1024 * 1024;
 var MIN_WINDOW_BYTES = 64 * 1024;
@@ -5802,10 +6136,10 @@ function parseWindow(text, startsAtFileHead) {
 }
 function readWorkerTranscriptWindow(sessionDir, workerId, opts = {}) {
   if (!isValidWorkerId(workerId)) return null;
-  const path9 = workerTranscriptPath(sessionDir, workerId);
+  const path10 = workerTranscriptPath(sessionDir, workerId);
   let size;
   try {
-    size = statSync(path9).size;
+    size = statSync2(path10).size;
   } catch {
     return null;
   }
@@ -5819,11 +6153,11 @@ function readWorkerTranscriptWindow(sessionDir, workerId, opts = {}) {
     const readLen = Math.min(size, windowBytes);
     const start = size - readLen;
     const chunk = Buffer.alloc(readLen);
-    const fd = openSync3(path9, "r");
+    const fd = openSync4(path10, "r");
     try {
-      readSync(fd, chunk, 0, readLen, start);
+      readSync2(fd, chunk, 0, readLen, start);
     } finally {
-      closeSync3(fd);
+      closeSync4(fd);
     }
     const parsed = parseWindow(chunk.toString("utf8"), start === 0);
     const enough = parsed.entries.filter(matches).length >= need;
@@ -5873,7 +6207,7 @@ function entryLabel(entry) {
   return subtype ? `${entry.type}/${subtype}` : entry.type;
 }
 var TERMINAL_SUBTYPES = /* @__PURE__ */ new Set(["task_result" /* TaskResult */, "error" /* Error */]);
-function entryTimestamp(entry) {
+function entryTimestamp2(entry) {
   const e = entry;
   for (const raw of [e.timestamp, e.endedAt, e.startedAt]) {
     if (typeof raw === "string") {
@@ -5886,7 +6220,7 @@ function entryTimestamp(entry) {
 function summarizeTranscript(entries) {
   let lastActivityAt = null;
   for (let i = entries.length - 1; i >= 0; i--) {
-    lastActivityAt = entryTimestamp(entries[i]);
+    lastActivityAt = entryTimestamp2(entries[i]);
     if (lastActivityAt !== null) break;
   }
   let currentTool = null;
@@ -6723,6 +7057,23 @@ ${lines}`
   );
 }
 
+// src/infra/general-workspace.ts
+import { mkdirSync as mkdirSync6 } from "fs";
+import { homedir } from "os";
+import { join as join14 } from "path";
+var GENERAL_WORKSPACE_DIRNAME = "workspace";
+function wayangDirFor(ctx) {
+  return wayangDirForSessionDir(ctx.sessionDir) ?? join14(homedir(), ".wayang");
+}
+function resolveGeneralWorkspace(ctx) {
+  return join14(wayangDirFor(ctx), GENERAL_WORKSPACE_DIRNAME);
+}
+function ensureGeneralWorkspace(ctx) {
+  const dir = resolveGeneralWorkspace(ctx);
+  mkdirSync6(dir, { recursive: true });
+  return dir;
+}
+
 // src/services/agents/prompts/controller-prompt.ts
 var IDENTITY = section(
   "Identity",
@@ -6999,13 +7350,17 @@ You resumed a previous session that had unfinished tasks. Workers were NOT autom
 
 Do NOT blindly re-create everything. The user may have moved on. Prefer to summarize and ask unless the intent is obvious.`
 );
-var WORKING_PRINCIPLES = section(
-  "Working principles",
-  `\u3010\u4EFB\u52A1\u62C6\u5206\u3011
+function buildWorkingPrinciples(generalWorkspace) {
+  const body = `\u3010\u4EFB\u52A1\u62C6\u5206\u3011
 - \u4E00\u4E2A\u4EFB\u52A1\u53EA\u4EA4\u4ED8\u4E00\u4E2A\u53EF\u72EC\u7ACB\u9A8C\u6536\u7684\u7ED3\u679C\uFF1B\u4E0D\u8981\u628A\u8BBE\u8BA1\u3001\u5B9E\u73B0\u3001\u6D4B\u8BD5\u585E\u8FDB\u540C\u4E00\u6BB5\u3002
 - \u5148\u505A\u80FD\u88AB\u5355\u6D4B\u65AD\u8A00\u7684\u6838\u5FC3\u903B\u8F91\uFF0C\u628A\u8FB9\u754C\uFF08\u5BBD\u5B57\u7B26\u3001\u4EE3\u7406\u5BF9\u3001\u6298\u884C\u4F4D\u7F6E\u4E4B\u7C7B\uFF09\u56FA\u5316\u6210\u7528\u4F8B\uFF0C\u518D\u53E0\u52A0\u96C6\u6210\u4E0E\u4EA4\u4E92\u5C42\u3002
 - \u4EFB\u52A1\u63CF\u8FF0\u5FC5\u987B\u81EA\u5305\u542B\uFF1A\u80CC\u666F\u3001\u76EE\u6807\u3001\u8F93\u5165\u8F93\u51FA\u3001\u7EA6\u675F\u3001\u9A8C\u6536\u6807\u51C6\u3002\u6267\u884C\u65B9\u770B\u4E0D\u5230\u4F60\u7684\u5BF9\u8BDD\u3002
 
+\u3010\u5DE5\u4F5C\u533A\u3011
+- \u7528\u6237\u7ED9\u4E86\u76EE\u5F55\uFF0C\u6216\u4EFB\u52A1\u660E\u663E\u5C5E\u4E8E\u67D0\u4E2A\u4EE3\u7801\u5E93\uFF1A\u7528\u90A3\u4E2A\u76EE\u5F55\u3002
+- \u7528\u6237\u6CA1\u6307\u5B9A\u3001\u6216\u4EFB\u52A1\u4E0E\u4EE3\u7801\u5E93\u65E0\u5173\uFF08\u8C03\u7814\u3001\u8D44\u6599\u6574\u7406\u3001\u4FE1\u606F\u67E5\u8BE2\u3001\u5199\u6587\u6863\u8349\u7A3F\uFF09\uFF1A\u7528\u901A\u7528\u5DE5\u4F5C\u533A ${generalWorkspace}\uFF0C\u5B83\u4E0D\u5C5E\u4E8E\u4EFB\u4F55\u4ED3\u5E93\uFF0C\u9996\u6B21\u4F7F\u7528\u81EA\u52A8\u521B\u5EFA\u3002
+- \u4EFB\u52A1\u4F1A\u7559\u4E0B\u4E2D\u95F4\u4EA7\u7269\u65F6\u5199\u8FDB\u63CF\u8FF0\uFF1A\u4E34\u65F6\u6587\u4EF6\u653E\u4EFB\u52A1 workspace \u5185\u7684 .agents/tmp/\uFF0C\u4E0D\u8981\u7528 /tmp\u3002
+
 \u3010\u5206\u5DE5\u4E0E\u5BA1\u6838\u3011
 - \u8BBE\u8BA1\u5224\u65AD\u4E0E\u673A\u68B0\u5B9E\u73B0\u5206\u5F00\u6D3E\uFF1A\u8BBE\u8BA1\u65B9\u5148\u5B9E\u6D4B\u5173\u952E\u884C\u4E3A\uFF0C\u4EA7\u51FA\u300C\u6539\u54EA\u4E2A\u6587\u4EF6\u3001\u51FD\u6570\u7B7E\u540D\u3001\u6570\u636E\u7ED3\u6784\u3001\u8FB9\u754C\u60C5\u51B5\u3001\u6D4B\u8BD5\u6E05\u5355\u300D\u7684\u65B9\u6848\uFF1B\u6267\u884C\u65B9\u7167\u65B9\u6848\u7F16\u7801\uFF0C\u4E0D\u505A\u8BBE\u8BA1\u51B3\u7B56\u3002
 - \u65B9\u6848\u91CC\u8981\u663E\u5F0F\u5199\u51FA\u300C\u4E0D\u8981\u505A\u4EC0\u4E48\u300D\uFF0C\u5426\u5219\u6267\u884C\u65B9\u4F1A\u987A\u624B\u91CD\u6784\u65E0\u5173\u4EE3\u7801\u3002
@@ -7030,8 +7385,9 @@ var WORKING_PRINCIPLES = section(
 - \u540C\u533A\u4E92\u5377 \u2014\u2014 \u8BA9\u4E24\u4E2A\u6267\u884C\u8005\u5728\u540C\u4E00\u5DE5\u4F5C\u533A\u5E76\u53D1\u63D0\u4EA4\uFF0C\u4E92\u76F8\u628A\u5BF9\u65B9\u7684\u6539\u52A8\u5377\u8FDB\u81EA\u5DF1\u7684 commit\u3002
 - \u9759\u9ED8\u5224\u6B7B \u2014\u2014 \u51ED\u8F93\u51FA\u9759\u9ED8\u5224\u65AD\u6B7B\u6D3B\uFF1A\u628A\u5728\u8DD1\u957F\u4EFB\u52A1\u5F53\u6210\u5361\u6B7B\u6740\u6389\uFF0C\u6216\u628A\u6D3B\u9501\u5F53\u6210\u6162\u4EFB\u52A1\u6B7B\u7B49\u3002
 - \u7EFF\u706F\u5373\u5B8C\u6210 \u2014\u2014 \u5355\u6D4B\u6216\u6D41\u7A0B\u5168\u7EFF\u5C31\u5BA3\u5E03\u5B8C\u6210\uFF1B\u5076\u53D1\u5931\u8D25\u590D\u8DD1\u4E00\u6B21\u901A\u8FC7\u5C31\u5F53\u6CA1\u53D1\u751F\uFF0C\u4E0D\u505A\u8BB0\u5F55\u3002
-- \u96F6\u788E\u53D6\u8BC1 \u2014\u2014 \u628A\u4E00\u6B21\u53D6\u8BC1\u62C6\u6210\u51E0\u5341\u6761\u96F6\u788E\u53EA\u8BFB\u547D\u4EE4\u9010\u6761\u7B49\u6279\u51C6\uFF0C\u6392\u969C\u88AB\u6D41\u7A0B\u672C\u8EAB\u62D6\u6B7B\u3002`
-);
+- \u96F6\u788E\u53D6\u8BC1 \u2014\u2014 \u628A\u4E00\u6B21\u53D6\u8BC1\u62C6\u6210\u51E0\u5341\u6761\u96F6\u788E\u53EA\u8BFB\u547D\u4EE4\u9010\u6761\u7B49\u6279\u51C6\uFF0C\u6392\u969C\u88AB\u6D41\u7A0B\u672C\u8EAB\u62D6\u6B7B\u3002`;
+  return section("Working principles", body);
+}
 var HARD_CONSTRAINTS = section(
   "Hard constraints",
   `- NEVER execute commands or write files yourself. Delegate via add_task\uFF08worker will execute\uFF09.
@@ -7050,24 +7406,93 @@ function buildWorkerList(workers) {
   }
   return section("Available workers", lines.join("\n"));
 }
-function buildControllerSystemPrompt(ctx, skills) {
+function buildControllerSystemPrompt(ctx, skills, opts) {
   return assemble(
     IDENTITY,
     RESPONSE_STYLE,
     TOOL_USAGE,
     PLANNING_TOOLS,
     SIGNAL_HANDLING,
-    WORKING_PRINCIPLES,
+    buildWorkingPrinciples(resolveGeneralWorkspace(ctx)),
     HARD_CONSTRAINTS,
     buildWorkerList(ctx.config.workers),
     buildSkillCatalog(skills),
-    buildEnvironment(ctx)
+    buildEnvironment(ctx),
+    // Project conventions go last: they are the most specific instruction and
+    // the last word on conflicts with the generic sections above.
+    opts?.rules
   );
 }
 
+// src/services/agents/prompts/controller-rules.ts
+import { readFileSync as readFileSync8, realpathSync as realpathSync2, statSync as statSync3 } from "fs";
+import { join as join15 } from "path";
+var CONTROLLER_RULES_FILENAME = "AGENTS.md";
+var CONTROLLER_RULES_MAX_BYTES = 32 * 1024;
+function loadControllerRules(opts) {
+  const maxBytes = opts.maxBytes ?? CONTROLLER_RULES_MAX_BYTES;
+  const files = [];
+  for (const dir of [opts.homeDir, opts.cwd]) {
+    if (!dir) continue;
+    const file = readRulesFile(dir);
+    if (!file) continue;
+    if (files.some((seen) => seen.path === file.path)) continue;
+    files.push(file);
+  }
+  if (files.length === 0) return "";
+  const bodies = [];
+  let usedBytes = 0;
+  let truncated = false;
+  for (const file of files) {
+    const heading = `## Project rules (from ${file.path})`;
+    const size = Buffer.byteLength(file.content, "utf8");
+    if (usedBytes + size <= maxBytes) {
+      bodies.push(`${heading}
+
+${file.content.trimEnd()}`);
+      usedBytes += size;
+      continue;
+    }
+    const budget = maxBytes - usedBytes;
+    const head = budget > 0 ? truncateToBytes(file.content, budget).trimEnd() : "";
+    bodies.push(head ? `${heading}
+
+${head}` : heading);
+    truncated = true;
+    break;
+  }
+  const intro = `${CONTROLLER_RULES_FILENAME} content loaded once at startup. The home directory file comes first as the baseline; the working directory file comes second and takes precedence wherever the two disagree. Follow these rules unless the user explicitly overrides them.`;
+  const parts = [`# Project rules
+
+${intro}`, ...bodies];
+  if (truncated) {
+    parts.push(
+      `...truncated at ${maxBytes} bytes (rules content exceeded the ${maxBytes}-byte total limit: the rest of the last file and any later files were dropped)`
+    );
+  }
+  return parts.join("\n\n");
+}
+function readRulesFile(dir) {
+  const candidate = join15(dir, CONTROLLER_RULES_FILENAME);
+  try {
+    const path10 = realpathSync2(candidate);
+    if (!statSync3(path10).isFile()) return null;
+    const content = readFileSync8(path10, "utf8");
+    if (!content.trim()) return null;
+    return { path: path10, content };
+  } catch {
+    return null;
+  }
+}
+function truncateToBytes(text, maxBytes) {
+  const buf = Buffer.from(text, "utf8");
+  if (buf.length <= maxBytes) return text;
+  return buf.subarray(0, maxBytes).toString("utf8").replace(/\uFFFD+$/, "");
+}
+
 // src/services/agents/prompts/project-rules.ts
-import { existsSync as existsSync9, readFileSync as readFileSync8, statSync as statSync2 } from "fs";
-import { basename as basename5, dirname as dirname6, join as join14, resolve as resolve3 } from "path";
+import { existsSync as existsSync9, readFileSync as readFileSync9, statSync as statSync4 } from "fs";
+import { basename as basename5, dirname as dirname6, join as join16, resolve as resolve3 } from "path";
 var RULE_FILE_NAMES = ["AGENTS.md", "CLAUDE.md"];
 var MAX_LEVELS = 5;
 var PROJECT_RULES_MAX_LENGTH = 8e3;
@@ -7076,7 +7501,7 @@ function findProjectRules(startDir) {
   for (let level = 0; level < MAX_LEVELS; level++) {
     const found = readRuleFile(current);
     if (found) return found;
-    if (existsSync9(join14(current, ".git"))) break;
+    if (existsSync9(join16(current, ".git"))) break;
     const parent = dirname6(current);
     if (parent === current) break;
     current = parent;
@@ -7085,12 +7510,12 @@ function findProjectRules(startDir) {
 }
 function readRuleFile(dir) {
   for (const name of RULE_FILE_NAMES) {
-    const path9 = join14(dir, name);
+    const path10 = join16(dir, name);
     try {
-      if (!statSync2(path9).isFile()) continue;
-      const content = readFileSync8(path9, "utf8");
+      if (!statSync4(path10).isFile()) continue;
+      const content = readFileSync9(path10, "utf8");
       if (!content.trim()) continue;
-      return { path: path9, content };
+      return { path: path10, content };
     } catch {
     }
   }
@@ -7166,6 +7591,9 @@ Only use bash when no dedicated tool fits the task (e.g. running builds, install
 - edit_file modifies an existing file by replacing a unique string. The old_string must appear exactly once. If it matches multiple times, the tool will tell you \u2014 expand the surrounding context to make it unique.
 - Always verify changes: after write_file or edit_file, use read_file to confirm the content is correct. For large files, use offset and limit to read specific sections instead of the entire file.
 - Use relative paths (relative to workspace). Accessing files outside workspace requires controller approval.
+- Scratch files and intermediate artifacts go to \`.agents/tmp/\` inside the current task workspace. Never \`/tmp\` \u2014 it sits outside the workspace, so every command there costs an approval \u2014 and never the home directory or the repository root.
+- Anything worth keeping goes to a normal path in the workspace (it is version-controlled); one-off intermediates stay in \`.agents/tmp/\`.
+- Before writing, confirm which workspace you are in: \`pwd\`, or the workspace named in the task description \u2014 that one outranks any path you assume.
 
 ## Web search
 
@@ -7285,6 +7713,7 @@ var RULES = [
   "Report meaningful progress as you work (entering a new phase, completing a sub-step, recovering from an error).",
   "Do NOT output a final summary right before completing \u2014 the system already captures the result separately.",
   "Match the language of the task description.",
+  "Keep scratch files and intermediate artifacts in `.agents/tmp/` inside the task workspace \u2014 never `/tmp`, the home directory, or the repository root.",
   "</Rules>"
 ].join("\n");
 function buildThirdPartyPrompt(skills) {
@@ -7477,11 +7906,11 @@ var WorkerAgent = class extends BaseAgent {
     return this.state.get("conversation") ?? [];
   }
   // --- Subscribable ---
-  subscribe(path9, callback) {
-    return this.state.on(path9, callback);
+  subscribe(path10, callback) {
+    return this.state.on(path10, callback);
   }
-  getSnapshot(path9) {
-    return this.state.get(path9);
+  getSnapshot(path10) {
+    return this.state.get(path10);
   }
   /**
    * Accept a message from the controller — writes to internal inbox. The
@@ -7588,9 +8017,9 @@ function toolResultBlockToRecord(block, toolName, endedAt) {
 import { resolve as resolve5 } from "path";
 
 // src/infra/permission/policy.ts
-import { realpathSync as realpathSync2 } from "fs";
-import { basename as basename6, dirname as dirname7, isAbsolute, join as join15, resolve as resolve4, sep } from "path";
-var DEFAULT_DENIED_RELATIVE_PATHS = [
+import { realpathSync as realpathSync3 } from "fs";
+import { basename as basename6, dirname as dirname7, isAbsolute, join as join17, resolve as resolve4, sep } from "path";
+var DEFAULT_SENSITIVE_RELATIVE_PATHS = [
   ".ssh",
   ".gnupg",
   ".aws",
@@ -7602,9 +8031,7 @@ var DEFAULT_DENIED_RELATIVE_PATHS = [
   ".git-credentials",
   ".npmrc",
   ".pypirc",
-  ".config/gh",
-  ".wayang.config.json",
-  ".wayang"
+  ".config/gh"
 ];
 var SENSITIVE_SEGMENTS = /* @__PURE__ */ new Set([
   ".ssh",
@@ -7616,20 +8043,17 @@ var SENSITIVE_SEGMENTS = /* @__PURE__ */ new Set([
   ".netrc",
   ".git-credentials",
   ".npmrc",
-  ".pypirc",
-  // The wayang data dir (sessions/conversations) — same intent as the
-  // home-anchored `.wayang` entry, but applied wherever it appears.
-  ".wayang"
-]);
-var SENSITIVE_FILENAMES = /* @__PURE__ */ new Set([
-  ".wayang.config.json"
+  ".pypirc"
 ]);
+var SENSITIVE_SEGMENT_PAIRS = [
+  [".docker", "config.json"]
+];
 var MAX_ANCESTOR_DEPTH = 32;
 function normalizePath(p, opts = {}) {
   const base = opts.base ?? process.cwd();
   const lexical = isAbsolute(p) ? resolve4(p) : resolve4(base, p);
   try {
-    return realpathSync2(lexical);
+    return realpathSync3(lexical);
   } catch {
     return resolveDeepestExistingAncestor(lexical);
   }
@@ -7639,8 +8063,8 @@ function resolveDeepestExistingAncestor(lexical) {
   let candidate = lexical;
   for (let depth = 0; depth <= MAX_ANCESTOR_DEPTH; depth += 1) {
     try {
-      const resolved = realpathSync2(candidate);
-      return peeled.length === 0 ? resolved : resolve4(join15(resolved, ...peeled));
+      const resolved = realpathSync3(candidate);
+      return peeled.length === 0 ? resolved : resolve4(join17(resolved, ...peeled));
     } catch {
     }
     const parent = dirname7(candidate);
@@ -7650,8 +8074,8 @@ function resolveDeepestExistingAncestor(lexical) {
   }
   return lexical;
 }
-function defaultDeniedPaths(homeDir2) {
-  return DEFAULT_DENIED_RELATIVE_PATHS.map((rel) => resolve4(homeDir2, rel));
+function defaultSensitivePaths(homeDir2) {
+  return DEFAULT_SENSITIVE_RELATIVE_PATHS.map((rel) => resolve4(homeDir2, rel));
 }
 function isPathWithin(parent, child) {
   if (parent === sep) return child.startsWith(sep);
@@ -7659,21 +8083,38 @@ function isPathWithin(parent, child) {
   const prefix = parent.endsWith(sep) ? parent : parent + sep;
   return child.startsWith(prefix);
 }
-function isDenied(absPath, deniedPaths) {
-  return deniedPaths.some((denied) => isPathWithin(denied, absPath));
+function isDenied(absPath, sensitivePaths) {
+  return sensitivePaths.some((sensitive) => isPathWithin(sensitive, absPath));
 }
-function isSensitiveSegmentPath(absPath) {
+function matchSensitiveEntry(absPath) {
   const segments = absPath.split(sep).filter((s) => s.length > 0);
   for (let i = 0; i < segments.length; i += 1) {
     const segment = segments[i];
-    if (SENSITIVE_SEGMENTS.has(segment) || SENSITIVE_FILENAMES.has(segment)) {
-      return true;
-    }
-    if (segment === ".docker" && segments[i + 1] === "config.json") {
-      return true;
+    if (SENSITIVE_SEGMENTS.has(segment)) return { entry: segment, source: "segment" };
+    for (const [dir, child] of SENSITIVE_SEGMENT_PAIRS) {
+      if (segment === dir && segments[i + 1] === child) {
+        return { entry: `${dir}/${child}`, source: "pair" };
+      }
     }
   }
-  return false;
+  return void 0;
+}
+function sensitivePathEntries(homeDir2, extraSensitiveDirs) {
+  const builtIn = DEFAULT_SENSITIVE_RELATIVE_PATHS.map((rel) => ({
+    absPath: normalizePath(resolve4(homeDir2, rel)),
+    entry: rel,
+    source: "home-default"
+  }));
+  const configured = (extraSensitiveDirs ?? []).filter((d) => typeof d === "string" && d.length > 0).map((d) => ({
+    absPath: normalizePath(d, { base: homeDir2 }),
+    entry: d,
+    source: "config-dir"
+  }));
+  return [...builtIn, ...configured];
+}
+function matchSensitivePath(homeDir2, absPath, extraSensitiveDirs) {
+  const hit = sensitivePathEntries(homeDir2, extraSensitiveDirs).find((entry) => isPathWithin(entry.absPath, absPath));
+  return hit ? { entry: hit.entry, source: hit.source } : void 0;
 }
 function normalizeDirs(dirs, base) {
   if (!dirs) return [];
@@ -7689,15 +8130,17 @@ function decideAccess(input2) {
   const taskAllowedDirs = normalizeDirs(input2.taskAllowedDirs, taskWorkspace ?? homeDir2);
   const configAllowedDirs = normalizeDirs(input2.configAllowedDirs, homeDir2);
   const autoAllowRoots = normalizeDirs(input2.autoAllowRoots, homeDir2);
-  const deniedPaths = [
-    ...defaultDeniedPaths(homeDir2),
-    ...normalizeDirs(input2.extraDeniedDirs, homeDir2)
-  ].map((d) => normalizePath(d));
-  if (isSensitiveSegmentPath(resolvedPath)) {
-    return { decision: "deny", matchedRule: "denylist", resolvedPath };
-  }
-  if (isDenied(resolvedPath, deniedPaths)) {
-    return { decision: "deny", matchedRule: "denylist", resolvedPath };
+  const sensitiveMode = input2.sensitiveMode ?? "ask";
+  const sensitive = matchSensitiveEntry(resolvedPath) ?? matchSensitivePath(homeDir2, resolvedPath, input2.extraSensitiveDirs);
+  if (sensitive) {
+    const hit = { matchedEntry: sensitive.entry, matchedSource: sensitive.source, sensitive: true };
+    if (input2.access === "write") {
+      return { decision: "deny", matchedRule: "sensitive-list-write", resolvedPath, ...hit };
+    }
+    if (sensitiveMode === "deny") {
+      return { decision: "deny", matchedRule: "sensitive-list", resolvedPath, ...hit };
+    }
+    return { decision: "ask", matchedRule: "sensitive-list", resolvedPath, ...hit };
   }
   if (findContaining(configAllowedDirs, resolvedPath) !== void 0) {
     return { decision: "allow", matchedRule: "config-allowed", resolvedPath };
@@ -7717,11 +8160,403 @@ function decideAccess(input2) {
   return { decision: "ask", matchedRule: "outside-all", resolvedPath };
 }
 
+// src/services/tools/shell-lexer.ts
+var CMDSUBST_PLACEHOLDER = "__cmdsubst__";
+var DISCARD_TARGETS = /* @__PURE__ */ new Set(["/dev/null", "/dev/stdout", "/dev/stderr"]);
+function isDiscardRedirectTarget(target) {
+  return target !== void 0 && DISCARD_TARGETS.has(target);
+}
+function isWordTerminator(ch) {
+  return ch === " " || ch === "	" || ch === "\n" || ch === "\r" || ch === "|" || ch === ";" || ch === "&" || ch === "<" || ch === ">";
+}
+function findClosingDoubleQuote(command, start) {
+  let i = start + 1;
+  while (i < command.length) {
+    const ch = command[i];
+    if (ch === "\\") {
+      i += 2;
+      continue;
+    }
+    if (ch === '"') return i;
+    i += 1;
+  }
+  return -1;
+}
+function findClosingBacktick(command, start) {
+  let i = start + 1;
+  while (i < command.length) {
+    const ch = command[i];
+    if (ch === "\\") {
+      i += 2;
+      continue;
+    }
+    if (ch === "`") return i;
+    i += 1;
+  }
+  return -1;
+}
+function scanBacktickSubstitution(command, start) {
+  const end = findClosingBacktick(command, start);
+  if (end === -1) return { error: 'unbalanced backtick \u2014 no closing "`"' };
+  return { inner: command.slice(start + 1, end), next: end + 1 };
+}
+function scanDollarSubstitution(command, start) {
+  const n = command.length;
+  let i = start + 2;
+  let depth = 1;
+  let inner = "";
+  while (i < n) {
+    const ch = command[i];
+    if (ch === "\\") {
+      inner += command.slice(i, i + 2);
+      i += 2;
+      continue;
+    }
+    if (ch === "'") {
+      const end = command.indexOf("'", i + 1);
+      if (end === -1) return { error: "unterminated single quote inside command substitution" };
+      inner += command.slice(i, end + 1);
+      i = end + 1;
+      continue;
+    }
+    if (ch === '"') {
+      const end = findClosingDoubleQuote(command, i);
+      if (end === -1) return { error: "unterminated double quote inside command substitution" };
+      inner += command.slice(i, end + 1);
+      i = end + 1;
+      continue;
+    }
+    if (ch === "`") {
+      const end = findClosingBacktick(command, i);
+      if (end === -1) return { error: "unterminated backtick inside command substitution" };
+      inner += command.slice(i, end + 1);
+      i = end + 1;
+      continue;
+    }
+    if (ch === "(") {
+      depth += 1;
+      inner += ch;
+      i += 1;
+      continue;
+    }
+    if (ch === ")") {
+      depth -= 1;
+      if (depth === 0) return { inner, next: i + 1 };
+      inner += ch;
+      i += 1;
+      continue;
+    }
+    inner += ch;
+    i += 1;
+  }
+  return { error: 'unbalanced "$(" \u2014 no closing ")"' };
+}
+function scanSubstitutionAt(command, start) {
+  const dollarForm = command[start] === "$" && command[start + 1] === "(";
+  const backtickForm = command[start] === "`";
+  if (!dollarForm && !backtickForm) return void 0;
+  const scanned = dollarForm ? scanDollarSubstitution(command, start) : scanBacktickSubstitution(command, start);
+  if ("error" in scanned) return scanned;
+  return {
+    substitution: { inner: scanned.inner, raw: command.slice(start, scanned.next) },
+    next: scanned.next
+  };
+}
+function scanWordLite(command, start) {
+  const n = command.length;
+  let i = start;
+  let text = "";
+  const substitutions = [];
+  const takeSubstitution = () => {
+    const scanned = scanSubstitutionAt(command, i);
+    if (!scanned) return { ok: true, consumed: false };
+    if ("error" in scanned) return { ok: false, error: scanned.error };
+    substitutions.push(scanned.substitution);
+    text += CMDSUBST_PLACEHOLDER;
+    i = scanned.next;
+    return { ok: true, consumed: true };
+  };
+  while (i < n) {
+    const ch = command[i];
+    if (ch === "\\") {
+      if (i + 1 < n) {
+        text += command[i + 1];
+        i += 2;
+      } else {
+        text += ch;
+        i += 1;
+      }
+      continue;
+    }
+    if (ch === "'") {
+      const end = command.indexOf("'", i + 1);
+      if (end === -1) return { error: "unterminated single quote" };
+      text += command.slice(i + 1, end);
+      i = end + 1;
+      continue;
+    }
+    if (ch === '"') {
+      i += 1;
+      let closed = false;
+      while (i < n) {
+        const inner = command[i];
+        if (inner === "\\") {
+          if (i + 1 < n) {
+            text += command[i + 1];
+            i += 2;
+          } else {
+            text += inner;
+            i += 1;
+          }
+          continue;
+        }
+        if (inner === '"') {
+          i += 1;
+          closed = true;
+          break;
+        }
+        const taken2 = takeSubstitution();
+        if (!taken2.ok) return { error: taken2.error };
+        if (taken2.consumed) continue;
+        text += inner;
+        i += 1;
+      }
+      if (!closed) return { error: "unterminated double quote" };
+      continue;
+    }
+    const taken = takeSubstitution();
+    if (!taken.ok) return { error: taken.error };
+    if (taken.consumed) continue;
+    if (isWordTerminator(ch)) break;
+    text += ch;
+    i += 1;
+  }
+  return { word: { text, substitutions }, next: i };
+}
+function scanFdDupTail(command, start) {
+  const match = /^&(\d+|-)/.exec(command.slice(start, start + 8));
+  if (!match) return { error: "unrecognised file-descriptor redirection" };
+  return { tail: match[0], next: start + match[0].length };
+}
+function scanRedirectTarget(command, start) {
+  let i = start;
+  while (i < command.length && (command[i] === " " || command[i] === "	")) i += 1;
+  const ch = command[i];
+  if (ch === void 0 || isWordTerminator(ch)) return { error: "redirection without a target" };
+  const scanned = scanWordLite(command, i);
+  if ("error" in scanned) return scanned;
+  if (scanned.word.text.length === 0 && scanned.word.substitutions.length === 0) {
+    return { error: "redirection without a target" };
+  }
+  return scanned;
+}
+function scanRedirect(command, start, fd) {
+  const ch = command[start];
+  if (ch === "&") {
+    if (command[start + 1] !== ">") return { error: 'unexpected "&" in a redirection' };
+    const append2 = command[start + 2] === ">";
+    const target2 = scanRedirectTarget(command, start + (append2 ? 3 : 2));
+    if ("error" in target2) return target2;
+    return {
+      redirect: { operator: append2 ? "&>>" : "&>", kind: "output", fd: 2, target: target2.word },
+      next: target2.next
+    };
+  }
+  if (ch === "<") {
+    if (command[start + 1] === "<") {
+      if (command[start + 2] === "<") {
+        const target4 = scanRedirectTarget(command, start + 3);
+        if ("error" in target4) return target4;
+        return {
+          redirect: { operator: "<<<", kind: "here-string", target: target4.word },
+          next: target4.next
+        };
+      }
+      const stripTabs = command[start + 2] === "-";
+      const target3 = scanRedirectTarget(command, start + (stripTabs ? 3 : 2));
+      if ("error" in target3) return target3;
+      return {
+        redirect: { operator: stripTabs ? "<<-" : "<<", kind: "here-doc", target: target3.word },
+        next: target3.next,
+        heredoc: { delimiter: target3.word.text, stripTabs }
+      };
+    }
+    if (command[start + 1] === "&") {
+      const dup = scanFdDupTail(command, start + 1);
+      if ("error" in dup) return dup;
+      return { redirect: { operator: `${fd ?? ""}<${dup.tail}`, kind: "fd-dup" }, next: dup.next };
+    }
+    if (command[start + 1] === ">") {
+      const target3 = scanRedirectTarget(command, start + 2);
+      if ("error" in target3) return target3;
+      return {
+        redirect: { operator: `${fd ?? ""}<>`, kind: "output", fd: fd ?? 0, target: target3.word },
+        next: target3.next
+      };
+    }
+    const target2 = scanRedirectTarget(command, start + 1);
+    if ("error" in target2) return target2;
+    return {
+      redirect: { operator: `${fd ?? ""}<`, kind: "input", target: target2.word },
+      next: target2.next
+    };
+  }
+  const append = command[start + 1] === ">";
+  let cursor = start + (append ? 2 : 1);
+  const clobber = !append && command[cursor] === "|";
+  if (clobber) cursor += 1;
+  const operator = `${fd ?? ""}${append ? ">>" : ">"}${clobber ? "|" : ""}`;
+  if (command[cursor] === "&") {
+    const dup = scanFdDupTail(command, cursor);
+    if ("error" in dup) return dup;
+    return { redirect: { operator: `${operator}${dup.tail}`, kind: "fd-dup" }, next: dup.next };
+  }
+  const target = scanRedirectTarget(command, cursor);
+  if ("error" in target) return target;
+  return {
+    redirect: { operator, kind: "output", fd: fd ?? 1, target: target.word },
+    next: target.next
+  };
+}
+function consumeHeredocBodies(command, start, heredocs) {
+  let pos = start;
+  for (const heredoc of heredocs) {
+    let matched = false;
+    while (pos < command.length) {
+      const newline = command.indexOf("\n", pos);
+      const lineEnd2 = newline === -1 ? command.length : newline;
+      const raw = command.slice(pos, lineEnd2);
+      const line = heredoc.stripTabs ? raw.replace(/^\t+/, "") : raw;
+      pos = lineEnd2 + 1;
+      if (line === heredoc.delimiter) {
+        matched = true;
+        break;
+      }
+      if (newline === -1) break;
+    }
+    if (!matched) return void 0;
+  }
+  return pos;
+}
+function tokenizeShellLite(command) {
+  const n = command.length;
+  const segments = [];
+  let tokens = [];
+  let pendingHeredocs = [];
+  let i = 0;
+  const endSegment = () => {
+    if (tokens.length > 0) segments.push({ tokens });
+    tokens = [];
+  };
+  const takeRedirect = (redirectStart, fd) => {
+    const scanned = scanRedirect(command, redirectStart, fd);
+    if ("error" in scanned) return { ok: false, error: scanned.error };
+    tokens.push({ kind: "redirect", redirect: scanned.redirect });
+    if (scanned.heredoc) pendingHeredocs.push(scanned.heredoc);
+    i = scanned.next;
+    return void 0;
+  };
+  while (i < n) {
+    const ch = command[i];
+    if (ch === " " || ch === "	" || ch === "\r") {
+      i += 1;
+      continue;
+    }
+    if (ch === "\\" && command[i + 1] === "\n") {
+      i += 2;
+      continue;
+    }
+    if (ch === "\n") {
+      endSegment();
+      i += 1;
+      if (pendingHeredocs.length > 0) {
+        const after = consumeHeredocBodies(command, i, pendingHeredocs);
+        if (after === void 0) return { ok: false, error: "here-document without its terminator line" };
+        i = after;
+        pendingHeredocs = [];
+      }
+      continue;
+    }
+    if (ch === "#") {
+      while (i < n && command[i] !== "\n") i += 1;
+      continue;
+    }
+    if (ch === "|" || ch === ";" || ch === "&") {
+      if (ch === "&" && command[i + 1] === ">") {
+        const failed = takeRedirect(i);
+        if (failed) return failed;
+        continue;
+      }
+      i += 1;
+      while (i < n && (command[i] === "|" || command[i] === ";" || command[i] === "&")) i += 1;
+      endSegment();
+      continue;
+    }
+    const fdMatch = /^(\d+)(?=>>|>|<>|<)/.exec(command.slice(i, i + 24));
+    const fd = fdMatch ? Number(fdMatch[1]) : void 0;
+    const redirectStart = i + (fdMatch ? fdMatch[1].length : 0);
+    const redirectChar = command[redirectStart];
+    if (redirectChar === "<" || redirectChar === ">") {
+      const failed = takeRedirect(redirectStart, fd);
+      if (failed) return failed;
+      continue;
+    }
+    const scanned = scanWordLite(command, i);
+    if ("error" in scanned) return { ok: false, error: scanned.error };
+    if (scanned.next === i) return { ok: false, error: `unexpected character "${ch}"` };
+    tokens.push({ kind: "word", word: scanned.word });
+    i = scanned.next;
+  }
+  if (pendingHeredocs.length > 0) {
+    return { ok: false, error: "here-document without a body" };
+  }
+  endSegment();
+  return { ok: true, segments };
+}
+function classifyRedirections(segments) {
+  const result2 = {
+    writeTargets: [],
+    readTargets: [],
+    duplicates: [],
+    discarded: []
+  };
+  for (const segment of segments) {
+    for (const token of segment.tokens) {
+      if (token.kind !== "redirect") continue;
+      const { redirect } = token;
+      const target = redirect.target?.text;
+      if (redirect.kind === "fd-dup") {
+        result2.duplicates.push(redirect.operator);
+        continue;
+      }
+      if (redirect.kind === "here-string" || redirect.kind === "here-doc") continue;
+      if (target === void 0) continue;
+      if (isDiscardRedirectTarget(target)) {
+        result2.discarded.push(target);
+        continue;
+      }
+      if (redirect.kind === "input") {
+        if (target.includes(CMDSUBST_PLACEHOLDER)) {
+          result2.unresolved ??= `${redirect.operator} ${target}`;
+          continue;
+        }
+        result2.readTargets.push(target);
+        continue;
+      }
+      if (target.includes(CMDSUBST_PLACEHOLDER)) {
+        result2.unresolved ??= `${redirect.operator} ${target}`;
+        continue;
+      }
+      result2.writeTargets.push(target);
+    }
+  }
+  return result2;
+}
+
 // src/services/tools/permission-rules.ts
 var FILE_TOOL_NAMES = ["read_file", "write_file", "edit_file", "search_files", "search_content"];
 var READ_ONLY_FILE_TOOLS = /* @__PURE__ */ new Set(["read_file", "search_files", "search_content"]);
 var DANGEROUS_BASH_PATTERN = /(?:^|\||;|&&)\s*(?:rm\s|sudo\b|chmod\b|chown\b|mkfs\b|dd\s|shutdown\b|reboot\b|kill\s+-9)/;
-var URL_RE = /[a-zA-Z][a-zA-Z0-9+.-]*:\/\/\S+/g;
 function expandHome(p, homeDir2) {
   if (p === "~") return { path: homeDir2, unresolvable: false };
   if (p.startsWith("~/")) return { path: resolve5(homeDir2, p.slice(2)), unresolvable: false };
@@ -7731,37 +8566,139 @@ function expandHome(p, homeDir2) {
 function expandHomeVars(command, homeDir2) {
   return command.replace(/\$\{HOME\}/g, homeDir2).replace(/\$HOME(?![A-Za-z0-9_])/g, homeDir2);
 }
-function detectUnsafeDynamicTarget(command) {
-  if (command.includes("`")) return "command substitution (backticks)";
-  if (/\$\(/.test(command)) return "command substitution ($(...))";
-  if (hasOutputRedirection(command)) return "output redirection";
-  return void 0;
+var CMDSUBST_READONLY_VERBS = /* @__PURE__ */ new Set([
+  "cat",
+  "ls",
+  "grep",
+  "head",
+  "tail",
+  "wc",
+  "stat",
+  "file",
+  "which",
+  "command",
+  "readlink",
+  "echo",
+  "printf",
+  "date",
+  "pwd"
+]);
+var MAX_CMDSUBST_DEPTH = 5;
+var BASH_WRITE_VERBS = /* @__PURE__ */ new Set([
+  "rm",
+  "rmdir",
+  "mv",
+  "cp",
+  "ln",
+  "tee",
+  "dd",
+  "truncate",
+  "install",
+  "mkdir",
+  "touch",
+  "chmod",
+  "chown",
+  "chgrp",
+  "shred",
+  "unlink",
+  "chattr",
+  "mkfs",
+  "mkswap",
+  "mount",
+  "umount"
+]);
+var BASH_FLAGGED_WRITE_VERBS = /* @__PURE__ */ new Map([
+  ["sed", ["-i", "--in-place"]],
+  ["perl", ["-i"]],
+  ["ruby", ["-i"]],
+  ["find", ["-delete", "-fprint", "-fls", "-fprintf", "-exec", "-execdir", "-ok"]]
+]);
+function isWriteSegment(segment) {
+  const words = [];
+  for (const token of segment.tokens) {
+    if (token.kind === "word") {
+      words.push(token.word.text);
+      continue;
+    }
+    const { redirect } = token;
+    if (redirect.kind !== "output") continue;
+    if (isDiscardRedirectTarget(redirect.target?.text)) continue;
+    return true;
+  }
+  for (const word of words) {
+    if (BASH_WRITE_VERBS.has(word)) return true;
+    const flags2 = BASH_FLAGGED_WRITE_VERBS.get(word);
+    if (flags2 && flags2.some((flag) => words.includes(flag))) return true;
+  }
+  return false;
 }
-function hasOutputRedirection(command) {
-  return /(?:^|[^<>])>>?\s*(?!&)\S/.test(command);
+function pathPieces(text, access) {
+  const candidates = [];
+  for (const piece of text.split("=")) {
+    if (!piece.startsWith("/") && !piece.startsWith("~")) continue;
+    if (isDiscardRedirectTarget(piece)) continue;
+    candidates.push({ path: piece, access });
+  }
+  return candidates;
 }
-function extractPathCandidates(command) {
-  const withoutUrls = command.replace(URL_RE, " ");
+function extractPathCandidates(segments) {
   const candidates = [];
-  for (const raw of withoutUrls.split(/[\s=;|&]+/)) {
-    const word = raw.replace(/^['"]+/, "").replace(/['",;|&()<>'`]+$/, "");
-    if (word.startsWith("/") || word.startsWith("~")) candidates.push(word);
+  for (const segment of segments) {
+    const segmentAccess = isWriteSegment(segment) ? "write" : "unknown";
+    for (const token of segment.tokens) {
+      if (token.kind === "word") {
+        candidates.push(...pathPieces(token.word.text, segmentAccess));
+        continue;
+      }
+      const { redirect } = token;
+      if (redirect.kind === "fd-dup" || redirect.kind === "here-doc" || redirect.kind === "here-string") continue;
+      const target = redirect.target?.text;
+      if (target === void 0 || isDiscardRedirectTarget(target)) continue;
+      if (target.includes(CMDSUBST_PLACEHOLDER)) continue;
+      const access = redirect.kind === "output" ? "write" : segmentAccess;
+      for (const candidate of pathPieces(target, access)) {
+        candidates.push(
+          redirect.kind === "output" ? { ...candidate, reason: `output redirection to "${target}"` } : candidate
+        );
+      }
+    }
   }
   return candidates;
 }
-function decidePath(scope, path9, access) {
+function commandAccess(candidates) {
+  return candidates.some((candidate) => candidate.access === "write") ? "write" : "unknown";
+}
+function decidePath(scope, path10, access) {
+  const permission = scope.permission;
   return decideAccess({
-    path: path9,
+    path: path10,
     access,
     cwd: scope.workspace,
     homeDir: scope.homeDir,
     taskWorkspace: scope.workspace,
     taskAllowedDirs: scope.taskAllowedDirs,
-    configAllowedDirs: scope.permission?.allowedDirs,
-    autoAllowRoots: scope.permission?.autoAllowRoots,
-    extraDeniedDirs: scope.permission?.deniedDirs
+    configAllowedDirs: permission?.allowedDirs,
+    autoAllowRoots: permission?.autoAllowRoots,
+    // `sensitiveDirs` is the current key; `deniedDirs` is its deprecated alias
+    // and is merged (deduped) here so a legacy config keeps protecting exactly
+    // the directories it declares.
+    extraSensitiveDirs: mergeSensitiveDirs(permission),
+    sensitiveMode: resolveSensitiveMode(permission)
   });
 }
+function toToolDecision(verdict, access) {
+  return {
+    decision: verdict.decision,
+    matchedRule: verdict.matchedRule,
+    resolvedPath: verdict.resolvedPath,
+    access,
+    ...verdict.matchedEntry !== void 0 && {
+      matchedEntry: verdict.matchedEntry,
+      matchedSource: verdict.matchedSource,
+      sensitive: true
+    }
+  };
+}
 function evaluateFileAccess(scope, toolName, args) {
   const rawPath = args.path;
   if (typeof rawPath !== "string" || !rawPath) return { decision: "allow", matchedRule: "no-path" };
@@ -7776,35 +8713,163 @@ function evaluateFileAccess(scope, toolName, args) {
   }
   const verdict = decidePath(scope, expanded.path, access);
   if (verdict.decision === "allow" && verdict.withinReadScope) {
-    return { decision: "ask", matchedRule: "read-within-home" };
+    return { decision: "ask", matchedRule: "read-within-home", resolvedPath: verdict.resolvedPath, access };
+  }
+  return toToolDecision(verdict, access);
+}
+function collectSubstitutions(segments) {
+  const substitutions = [];
+  for (const segment of segments) {
+    for (const token of segment.tokens) {
+      const word = token.kind === "word" ? token.word : token.redirect.target;
+      if (word) substitutions.push(...word.substitutions);
+    }
+  }
+  return substitutions;
+}
+function checkSubstitutionInner(inner) {
+  const tokenized = tokenizeShellLite(inner);
+  if (!tokenized.ok) return { ok: false, reason: `cannot parse it (${tokenized.error})` };
+  if (tokenized.segments.length === 0) return { ok: false, reason: "it is empty" };
+  for (const segment of tokenized.segments) {
+    const verb = segment.tokens.find((token) => token.kind === "word");
+    if (!verb || verb.kind !== "word" || verb.word.text === CMDSUBST_PLACEHOLDER) {
+      return { ok: false, reason: "it has no command word to judge" };
+    }
+    if (!CMDSUBST_READONLY_VERBS.has(verb.word.text)) {
+      return { ok: false, reason: `\`${verb.word.text}\` is not a read-only command` };
+    }
+    if (isWriteSegment(segment)) return { ok: false, reason: `\`${verb.word.text}\` writes` };
+  }
+  return { ok: true };
+}
+function evaluateSubstitutions(scope, segments, depth) {
+  const substitutions = collectSubstitutions(segments);
+  if (substitutions.length === 0) return void 0;
+  if (depth + 1 > MAX_CMDSUBST_DEPTH) {
+    return {
+      decision: "ask",
+      matchedRule: "dynamic-shell",
+      reason: `command substitution nested deeper than ${MAX_CMDSUBST_DEPTH} levels`
+    };
+  }
+  for (const substitution of substitutions) {
+    const inner = substitution.inner.trim();
+    if (inner.length === 0) {
+      return { decision: "ask", matchedRule: "dynamic-shell", reason: `empty command substitution ${substitution.raw}` };
+    }
+    const readOnly = checkSubstitutionInner(inner);
+    if (!readOnly.ok) {
+      return {
+        decision: "ask",
+        matchedRule: "dynamic-shell",
+        reason: `command substitution ${substitution.raw}: ${readOnly.reason}`
+      };
+    }
+    const verdict = evaluateBashCommand(scope, inner, depth + 1);
+    if (verdict.decision === "deny") return verdict;
+    if (verdict.decision === "ask") {
+      const detail = verdict.reason ?? (verdict.resolvedPath ? `target ${verdict.resolvedPath}` : verdict.matchedRule);
+      return {
+        decision: "ask",
+        matchedRule: "dynamic-shell",
+        reason: `command substitution ${substitution.raw} needs approval: ${detail}`,
+        // Carry the inner hit through, so an approval request still names the
+        // path (and the sensitive entry) the substituted command would touch.
+        ...verdict.resolvedPath !== void 0 && { resolvedPath: verdict.resolvedPath },
+        ...verdict.matchedEntry !== void 0 && {
+          matchedEntry: verdict.matchedEntry,
+          matchedSource: verdict.matchedSource,
+          sensitive: true
+        }
+      };
+    }
   }
-  return { decision: verdict.decision, matchedRule: verdict.matchedRule };
+  return void 0;
+}
+function fallbackSensitiveWrite(scope, expandedCommand) {
+  for (const raw of expandedCommand.split(/[\s=]+/)) {
+    const word = raw.replace(/^['"]+/, "").replace(/['"]+$/, "");
+    if (!word.startsWith("/") && !word.startsWith("~")) continue;
+    const expanded = expandHome(word, scope.homeDir);
+    if (expanded.unresolvable) continue;
+    const verdict = decidePath(scope, expanded.path, "write");
+    if (verdict.decision === "deny") return toToolDecision(verdict, "write");
+  }
+  return void 0;
 }
 function evaluateBashAccess(scope, command) {
+  return evaluateBashCommand(scope, command, 0);
+}
+function evaluateBashCommand(scope, command, depth) {
   const expandedCommand = expandHomeVars(command, scope.homeDir);
+  const tokenized = tokenizeShellLite(expandedCommand);
+  if (!tokenized.ok) {
+    const refusal = fallbackSensitiveWrite(scope, expandedCommand);
+    if (refusal) return refusal;
+    return {
+      decision: "ask",
+      matchedRule: "dynamic-shell",
+      reason: `could not parse the shell command (${tokenized.error})`
+    };
+  }
+  const segments = tokenized.segments;
+  const redirections = classifyRedirections(segments);
   const candidates = [];
   let hasUnresolvableHome = false;
-  for (const raw of extractPathCandidates(expandedCommand)) {
-    const expanded = expandHome(raw, scope.homeDir);
+  for (const candidate of extractPathCandidates(segments)) {
+    const expanded = expandHome(candidate.path, scope.homeDir);
     if (expanded.unresolvable) {
       hasUnresolvableHome = true;
       continue;
     }
-    candidates.push(expanded.path);
+    candidates.push({ ...candidate, path: expanded.path });
   }
   let firstAsk;
   let firstAllow;
   for (const candidate of candidates) {
-    const verdict = decidePath(scope, candidate, "write");
-    if (verdict.decision === "deny") return verdict;
-    if (verdict.decision === "ask") firstAsk ??= verdict;
-    else firstAllow ??= verdict;
+    const verdict = decidePath(scope, candidate.path, candidate.access);
+    if (verdict.decision === "deny") return toToolDecision(verdict, candidate.access);
+    if (verdict.decision === "ask") {
+      firstAsk ??= {
+        ...toToolDecision(verdict, candidate.access),
+        ...candidate.reason !== void 0 && { reason: candidate.reason }
+      };
+    } else firstAllow ??= toToolDecision(verdict, candidate.access);
   }
+  const lineAccess = commandAccess(candidates);
+  if (firstAsk) firstAsk = { ...firstAsk, access: lineAccess };
+  if (firstAllow) firstAllow = { ...firstAllow, access: lineAccess };
   if (DANGEROUS_BASH_PATTERN.test(expandedCommand)) {
-    return { decision: "ask", matchedRule: "dangerous-bash" };
+    const hit = firstAsk?.matchedEntry !== void 0 ? firstAsk : void 0;
+    return {
+      decision: "ask",
+      matchedRule: "dangerous-bash",
+      access: lineAccess,
+      ...hit !== void 0 && {
+        matchedEntry: hit.matchedEntry,
+        matchedSource: hit.matchedSource,
+        resolvedPath: hit.resolvedPath,
+        sensitive: true
+      }
+    };
+  }
+  const substitution = evaluateSubstitutions(scope, segments, depth);
+  if (substitution) return substitution;
+  if (redirections.unresolved !== void 0) {
+    return {
+      decision: "ask",
+      matchedRule: "dynamic-shell",
+      reason: `output redirection target cannot be determined statically (${redirections.unresolved})`
+    };
+  }
+  if (redirections.writeTargets.length > 0 && !firstAsk) {
+    return {
+      decision: "ask",
+      matchedRule: "dynamic-shell",
+      reason: `output redirection writes a file ("${redirections.writeTargets.join('", "')}")`
+    };
   }
-  const dynamic = detectUnsafeDynamicTarget(expandedCommand);
-  if (dynamic) return { decision: "ask", matchedRule: "dynamic-shell", reason: dynamic };
   if (hasUnresolvableHome) {
     return {
       decision: "ask",
@@ -7815,12 +8880,13 @@ function evaluateBashAccess(scope, command) {
   if (firstAsk) return firstAsk;
   return firstAllow ?? { decision: "allow", matchedRule: "no-path" };
 }
-function denyMessage(toolName, requestedPath) {
+function denyMessage(toolName, requestedPath, matchedRule) {
+  const write = matchedRule === "sensitive-list-write";
   if (toolName === "bash") {
-    return "[ERROR] bash: refusing to run this command \u2014 it touches a path on the deny list (a sensitive location).";
+    return write ? "[ERROR] bash: refusing to run this command \u2014 it would write to a path on the sensitive list (sensitive paths are never writable)." : "[ERROR] bash: refusing to run this command \u2014 it touches a path on the sensitive list (a protected location).";
   }
   const target = requestedPath ? ` "${requestedPath}"` : "";
-  return `[ERROR] ${toolName}: refusing access to${target} \u2014 the path is on the deny list (a sensitive location).`;
+  return write ? `[ERROR] ${toolName}: refusing to write${target} \u2014 the path is on the sensitive list (sensitive paths are never writable).` : `[ERROR] ${toolName}: refusing access to${target} \u2014 the path is on the sensitive list (a protected location).`;
 }
 function decideToolAccess(scope, toolName, args) {
   let verdict;
@@ -7832,7 +8898,51 @@ function decideToolAccess(scope, toolName, args) {
     return { decision: "allow", matchedRule: "no-path" };
   }
   if (verdict.decision !== "deny") return verdict;
-  return { ...verdict, message: denyMessage(toolName, typeof args.path === "string" ? args.path : void 0) };
+  return {
+    ...verdict,
+    message: denyMessage(toolName, typeof args.path === "string" ? args.path : void 0, verdict.matchedRule)
+  };
+}
+
+// src/services/permission/permission-audit.ts
+function operationForTool(toolName) {
+  if (toolName === "bash") return "exec";
+  if (toolName === "read_file" || toolName === "search_files" || toolName === "search_content") return "read";
+  return "write";
+}
+function auditAccessFor(access) {
+  return access ?? "unknown";
+}
+function recordPermissionAudit(logger, entry) {
+  if (!logger) return;
+  logger.info(
+    {
+      audit: "permission",
+      decision: entry.decision,
+      operation: entry.operation,
+      ...entry.access !== void 0 && { access: entry.access },
+      ts: (/* @__PURE__ */ new Date()).toISOString(),
+      ...entry.resolvedPath !== void 0 && { resolvedPath: entry.resolvedPath },
+      ...entry.requestedPath !== void 0 && { requestedPath: entry.requestedPath },
+      ...entry.matchedEntry !== void 0 && { matchedEntry: entry.matchedEntry },
+      ...entry.matchedSource !== void 0 && { matchedSource: entry.matchedSource },
+      ...entry.matchedRule !== void 0 && { matchedRule: entry.matchedRule },
+      ...entry.taskId !== void 0 && { taskId: entry.taskId },
+      ...entry.workerId !== void 0 && { workerId: entry.workerId },
+      ...entry.toolName !== void 0 && { toolName: entry.toolName },
+      ...entry.source !== void 0 && { source: entry.source }
+    },
+    "permission audit"
+  );
+}
+function verdictDetailSuffix(detail) {
+  const parts = [];
+  if (detail.matchedEntry) {
+    parts.push(`hit: ${detail.matchedEntry}${detail.matchedSource ? ` (${detail.matchedSource})` : ""}`);
+  }
+  if (detail.matchedRule) parts.push(`rule: ${detail.matchedRule}`);
+  if (detail.operation) parts.push(`op: ${detail.operation}`);
+  return parts.length > 0 ? ` [${parts.join(" ; ")}]` : "";
 }
 
 // src/infra/blocking-requests.ts
@@ -7882,7 +8992,7 @@ var BlockingRequestMap = class {
 
 // src/services/agents/claude-code-worker.ts
 import { basename as basename7, dirname as dirname8 } from "path";
-import { homedir } from "os";
+import { homedir as homedir2 } from "os";
 var INQUIRY_STREAM_CLOSE_TIMEOUT_MS = 36e4;
 var ClaudeCodeWorker = class _ClaudeCodeWorker {
   id;
@@ -8146,11 +9256,11 @@ var ClaudeCodeWorker = class _ClaudeCodeWorker {
     return this.state.get("conversation") ?? [];
   }
   // --- Subscribable ---
-  subscribe(path9, callback) {
-    return this.state.on(path9, callback);
+  subscribe(path10, callback) {
+    return this.state.on(path10, callback);
   }
-  getSnapshot(path9) {
-    return this.state.get(path9);
+  getSnapshot(path10) {
+    return this.state.get(path10);
   }
   /**
    * Accept a message from the controller. The message is queued and handed
@@ -8238,15 +9348,16 @@ var ClaudeCodeWorker = class _ClaudeCodeWorker {
   effectiveAccessScope() {
     if (this._accessScope) return this._accessScope;
     const wayangDir = wayangDirForSessionDir(this.sessionDir);
-    const homeDir2 = wayangDir && basename7(wayangDir) === ".wayang" ? dirname8(wayangDir) : homedir();
+    const homeDir2 = wayangDir && basename7(wayangDir) === ".wayang" ? dirname8(wayangDir) : homedir2();
     return { homeDir: homeDir2, workspace: this.workspaceDir };
   }
   /**
    * Route a Claude Code tool call through the SAME access policy a puppet
-   * worker uses (`decideToolAccess`). A denylisted path is denied outright
-   * (no approval prompt); an ambiguous target asks the controller; a path
-   * inside the allowed scope runs immediately. This closes the parity gap where
-   * the old regex-only gate let denylisted paths through silently.
+   * worker uses (`decideToolAccess`). A sensitive WRITE is denied outright
+   * (no approval prompt), a sensitive READ asks with the matched entry named,
+   * an ambiguous target asks the controller and a path inside the allowed scope
+   * runs immediately. This closes the parity gap where the old regex-only gate
+   * let sensitive paths through silently.
    */
   async handleCanUseTool(toolName, input2) {
     if (!this._signalQueue || !this._runContext) {
@@ -8255,42 +9366,91 @@ var ClaudeCodeWorker = class _ClaudeCodeWorker {
     const scope = this.effectiveAccessScope();
     if (toolName === "Bash") {
       const verdict = decideToolAccess(scope, "bash", { command: String(input2.command ?? "") });
-      if (verdict.decision === "deny") {
-        return { behavior: "deny", message: verdict.message ?? "Denied by the permission policy" };
-      }
-      if (verdict.decision === "ask") return this.requestPermission(toolName, input2, verdict.reason);
+      const operation = operationForTool("bash");
+      if (verdict.decision === "deny") return this.denyWithAudit(toolName, input2, verdict, operation);
+      if (verdict.decision === "ask") return this.requestPermission(toolName, input2, this.askOf(verdict, operation));
       return { behavior: "allow" };
     }
     const fileTool = _ClaudeCodeWorker.SDK_FILE_TOOL_MAP[toolName];
     if (fileTool) {
+      const operation = operationForTool(fileTool.policyTool);
       const rawPath = input2[fileTool.pathKey];
       if (typeof rawPath !== "string" || rawPath.length === 0) {
         if (fileTool.pathRequired) {
-          return this.requestPermission(toolName, input2, "the target path could not be determined");
+          return this.requestPermission(toolName, input2, {
+            reason: "the target path could not be determined",
+            operation
+          });
         }
         return { behavior: "allow" };
       }
       const verdict = decideToolAccess(scope, fileTool.policyTool, { path: rawPath });
-      if (verdict.decision === "deny") {
-        return { behavior: "deny", message: verdict.message ?? "Denied by the permission policy" };
-      }
-      if (verdict.decision === "ask") return this.requestPermission(toolName, input2, verdict.reason);
+      if (verdict.decision === "deny") return this.denyWithAudit(toolName, input2, verdict, operation);
+      if (verdict.decision === "ask") return this.requestPermission(toolName, input2, this.askOf(verdict, operation));
       return { behavior: "allow" };
     }
     if (_ClaudeCodeWorker.SDK_NON_PATH_TOOLS.has(toolName)) {
       return { behavior: "allow" };
     }
-    return this.requestPermission(toolName, input2, "the tool is not recognized by the permission policy");
+    return this.requestPermission(toolName, input2, {
+      reason: "the tool is not recognized by the permission policy",
+      operation: operationForTool("bash")
+    });
+  }
+  /**
+   * Refuse a call the policy hard-denied (sensitive write) and record it.
+   *
+   * The worker receives the policy's disclosure-safe message (its own path
+   * spelling, never the matched entry); the audit trail gets the metadata.
+   * Same shape as the puppet worker's audit, so both entries agree.
+   */
+  denyWithAudit(toolName, input2, verdict, operation) {
+    recordPermissionAudit(this.logger, {
+      decision: "hard-denied",
+      operation,
+      access: auditAccessFor(verdict.access),
+      resolvedPath: verdict.resolvedPath,
+      requestedPath: this.requestedPathOf(input2),
+      matchedEntry: verdict.matchedEntry,
+      matchedSource: verdict.matchedSource,
+      matchedRule: verdict.matchedRule,
+      taskId: this._runContext?.taskId,
+      workerId: this._runContext?.workerId,
+      toolName
+    });
+    return { behavior: "deny", message: verdict.message ?? "Denied by the permission policy" };
+  }
+  /** Project a policy verdict onto the approval-request/audit fields. */
+  askOf(verdict, operation) {
+    return {
+      reason: verdict.reason,
+      matchedRule: verdict.matchedRule,
+      matchedEntry: verdict.matchedEntry,
+      matchedSource: verdict.matchedSource,
+      resolvedPath: verdict.resolvedPath,
+      operation,
+      sensitive: verdict.sensitive,
+      access: verdict.access
+    };
+  }
+  /** The target as the worker spelled it (for auditing against the prompt). */
+  requestedPathOf(input2) {
+    for (const key of ["file_path", "notebook_path", "path"]) {
+      const value = input2[key];
+      if (typeof value === "string" && value.length > 0) return value;
+    }
+    return void 0;
   }
   /**
    * Emit a permission_request and block until the controller answers (or it
    * times out → deny). Shared by every `ask` verdict so the request flow stays
    * identical to the puppet worker's.
    */
-  async requestPermission(toolName, input2, reason) {
+  async requestPermission(toolName, input2, ask) {
     if (!this._signalQueue || !this._runContext) return { behavior: "allow" };
     const requestId = generateId("perm");
-    const description = this.describePermissionRequest(toolName, input2, reason);
+    const description = this.describePermissionRequest(toolName, input2, ask);
+    const operation = ask.operation;
     this._signalQueue.enqueue({
       source: "worker",
       type: "permission_request",
@@ -8303,16 +9463,43 @@ var ClaudeCodeWorker = class _ClaudeCodeWorker {
         emoji: this._runContext.emoji,
         toolName,
         toolArgs: input2,
-        description
+        description,
+        ...ask.matchedRule !== void 0 && { matchedRule: ask.matchedRule },
+        ...ask.matchedEntry !== void 0 && { matchedEntry: ask.matchedEntry },
+        ...ask.matchedSource !== void 0 && { matchedSource: ask.matchedSource },
+        ...ask.resolvedPath !== void 0 && { resolvedPath: ask.resolvedPath },
+        ...ask.sensitive !== void 0 && { sensitive: ask.sensitive },
+        ...ask.access !== void 0 && { access: ask.access },
+        operation
       },
       ...this._turnLineage
     });
-    return this._pendingPermissions.wait(requestId, _ClaudeCodeWorker.PERMISSION_TIMEOUT_MS, () => {
-      return { behavior: "deny", message: "Permission request timed out" };
+    const result2 = await this._pendingPermissions.wait(
+      requestId,
+      _ClaudeCodeWorker.PERMISSION_TIMEOUT_MS,
+      () => ({ behavior: "deny", message: "Permission request timed out" })
+    );
+    const denied = result2.behavior === "deny";
+    recordPermissionAudit(this.logger, {
+      decision: denied ? "denied" : "approved",
+      operation,
+      access: auditAccessFor(ask.access),
+      resolvedPath: ask.resolvedPath,
+      requestedPath: this.requestedPathOf(input2),
+      matchedEntry: ask.matchedEntry,
+      matchedSource: ask.matchedSource,
+      matchedRule: ask.matchedRule,
+      taskId: this._runContext.taskId,
+      workerId: this._runContext.workerId,
+      toolName,
+      ...denied && {
+        source: result2.message === "Permission request timed out" ? "timeout" : "controller"
+      }
     });
+    return result2;
   }
   /** Human-readable summary of a gated call for the approval prompt. */
-  describePermissionRequest(toolName, input2, reason) {
+  describePermissionRequest(toolName, input2, ask) {
     let detail;
     if (toolName === "Bash") {
       detail = `Execute shell command: ${String(input2.command ?? "")}`;
@@ -8325,7 +9512,15 @@ var ClaudeCodeWorker = class _ClaudeCodeWorker {
     } else {
       detail = `${toolName}: ${JSON.stringify(input2)}`;
     }
-    return reason ? `${detail} (${reason})` : detail;
+    const hit = ask.sensitive ? verdictDetailSuffix({
+      matchedRule: ask.matchedRule,
+      matchedEntry: ask.matchedEntry,
+      matchedSource: ask.matchedSource,
+      resolvedPath: ask.resolvedPath,
+      operation: ask.operation
+    }) : "";
+    const withHit = `${detail}${hit}`;
+    return ask.reason ? `${withHit} (${ask.reason})` : withHit;
   }
   // --- Prompt as AsyncIterable (supports follow-up messages) ---
   buildPromptIterable(initialPrompt) {
@@ -8630,11 +9825,14 @@ controller: ${answer}`,
 };
 
 // src/services/tools/add-task.ts
+import { mkdirSync as mkdirSync7 } from "fs";
+import { homedir as homedir3 } from "os";
+import * as path8 from "path";
 import { z as z3 } from "zod";
 
 // src/services/tools/workspace-rules.ts
-import { readFileSync as readFileSync9, statSync as statSync3 } from "fs";
-import { join as join16 } from "path";
+import { readFileSync as readFileSync10, statSync as statSync5 } from "fs";
+import { join as join18 } from "path";
 var RULE_FILE_NAMES2 = ["AGENTS.md", "CLAUDE.md"];
 var WORKSPACE_RULES_MAX_LINES = 40;
 var WORKSPACE_RULES_MAX_CHARS = 2e3;
@@ -8642,7 +9840,7 @@ function buildWorkspaceRulesSummary(input2) {
   const workspacePath = input2.workspacePath;
   if (!workspacePath) return "";
   for (const name of RULE_FILE_NAMES2) {
-    const rulesPath = join16(workspacePath, name);
+    const rulesPath = join18(workspacePath, name);
     if (!isRegularFile(rulesPath)) continue;
     const header = `Workspace rules (from ${rulesPath}):`;
     const refusal = describeRefusal(rulesPath, workspacePath, input2);
@@ -8664,16 +9862,17 @@ function describeRefusal(rulesPath, workspacePath, input2) {
   if (!homeDir2) {
     return "unavailable \u2014 the permission policy cannot be evaluated here (no home directory in this context), so the file was not read.";
   }
-  const { decision } = decideAccess({
+  const { decision, matchedEntry } = decideAccess({
     access: "read",
     path: rulesPath,
     cwd: workspacePath,
     homeDir: homeDir2,
     taskWorkspace: workspacePath,
-    extraDeniedDirs: input2.permissionConfig?.deniedDirs
+    extraSensitiveDirs: mergeSensitiveDirs(input2.permissionConfig),
+    sensitiveMode: resolveSensitiveMode(input2.permissionConfig)
   });
-  if (decision === "deny") {
-    return "unavailable \u2014 the file resolves to a denied location (a sensitive one such as credentials or tool config), so its content was not read.";
+  if (matchedEntry !== void 0 || decision === "deny") {
+    return "unavailable \u2014 the file resolves to a sensitive location (a protected path such as credentials or tool config), so its content was not read.";
   }
   if (decision === "ask") {
     return "unavailable \u2014 reading it was not approved by the permission policy (the path is outside the readable scope), so its content was not read.";
@@ -8700,31 +9899,64 @@ function summarizeRules(content) {
 }
 function isRegularFile(p) {
   try {
-    return statSync3(p).isFile();
+    return statSync5(p).isFile();
   } catch {
     return false;
   }
 }
 function readTextFile(p) {
   try {
-    return readFileSync9(p, "utf8");
+    return readFileSync10(p, "utf8");
   } catch {
     return null;
   }
 }
 
 // src/services/tools/add-task.ts
+var HOME_VAR_PREFIX = /^\$(?:\{HOME\}|HOME)(?=\/|$)/;
+function expandHomePrefix(raw, homeDir2) {
+  if (raw === "~") return homeDir2;
+  if (raw.startsWith("~/")) return path8.join(homeDir2, raw.slice(2));
+  const match = HOME_VAR_PREFIX.exec(raw);
+  if (match) {
+    const rest = raw.slice(match[0].length);
+    return rest === "" ? homeDir2 : path8.join(homeDir2, rest);
+  }
+  return raw.startsWith("~") ? null : raw;
+}
+function ensureWorkspaceDir(dirPath) {
+  try {
+    mkdirSync7(dirPath, { recursive: true });
+    return null;
+  } catch (err) {
+    return `Cannot create workspace ${dirPath}: ${err.message}. The task was NOT created.`;
+  }
+}
 function resolveTaskWorkspace(requested, deps) {
   const current = deps.workspaceDir;
-  const requestedPath = requested !== void 0 && requested.trim() !== "" ? normalizeWorkspacePath(requested) : void 0;
+  let declared;
+  if (requested !== void 0 && requested.trim() !== "") {
+    const expanded = expandHomePrefix(requested.trim(), deps.homeDir ?? homedir3());
+    if (expanded === null) {
+      return {
+        error: `Cannot resolve workspace "${requested}": only "~" and "$HOME" expand to the home directory, so no readable path was left. The task was NOT created.`
+      };
+    }
+    declared = expanded;
+  }
   if (!current) {
-    if (requestedPath !== void 0) {
+    if (declared !== void 0) {
       return {
-        error: `Cannot resolve workspace ${requestedPath}: the current workspace is unknown in this context, so the task was NOT created.`
+        error: `Cannot resolve workspace ${normalizeWorkspacePath(declared)}: the current workspace is unknown in this context, so the task was NOT created.`
       };
     }
     return {};
   }
+  if (declared !== void 0 && path8.isAbsolute(declared)) {
+    const dirError = ensureWorkspaceDir(declared);
+    if (dirError !== null) return { error: dirError };
+  }
+  const requestedPath = declared !== void 0 ? normalizeWorkspacePath(declared) : void 0;
   const targetPath = requestedPath ?? normalizeWorkspacePath(current);
   const ref = resolveWorkspaceRef(deps.wayangDir ?? null, targetPath);
   return { workspace: { path: ref.path, slug: ref.slug } };
@@ -8739,9 +9971,9 @@ function resolveTaskAllowedDirs(requested, workspacePath, deps) {
   }
   const home = normalizePath(homeDir2);
   const base = workspacePath !== void 0 ? normalizePath(workspacePath, { base: home }) : home;
-  const deniedPaths = [
-    ...defaultDeniedPaths(home),
-    ...(deps.permissionConfig?.deniedDirs ?? []).filter((d) => typeof d === "string" && d.length > 0).map((d) => normalizePath(d, { base: home }))
+  const sensitivePaths = [
+    ...defaultSensitivePaths(home),
+    ...mergeSensitiveDirs(deps.permissionConfig).map((d) => normalizePath(d, { base: home }))
   ].map((d) => normalizePath(d));
   const seen = /* @__PURE__ */ new Set();
   const allowedDirs = [];
@@ -8757,9 +9989,9 @@ function resolveTaskAllowedDirs(requested, workspacePath, deps) {
         error: `Invalid allowedDirs entry "${raw}" (resolved to ${resolved}): it is outside the home directory (${home}). Only directories under home can be granted to a task. The task was NOT created.`
       };
     }
-    if (isDenied(resolved, deniedPaths)) {
+    if (isDenied(resolved, sensitivePaths)) {
       return {
-        error: `Invalid allowedDirs entry "${raw}" (resolved to ${resolved}): it matches the denied-path list (a sensitive location such as credentials or tool config). The task was NOT created.`
+        error: `Invalid allowedDirs entry "${raw}" (resolved to ${resolved}): it matches the sensitive list (a protected location such as credentials or tool config). The task was NOT created.`
       };
     }
     if (!seen.has(resolved)) {
@@ -8780,6 +10012,7 @@ function withWorkspaceRules(resultText, workspacePath, deps) {
 ${summary}`;
 }
 function addTaskTool(deps) {
+  const generalWorkspaceNote = deps.generalWorkspaceDir ? ` Tasks that belong to no codebase (research, collecting material, drafting a document) run in the general workspace ${deps.generalWorkspaceDir} \u2014 it is created on first use.` : "";
   return defineTool({
     description: "Add a new task to the queue. A Worker will execute it automatically.",
     parameters: z3.object({
@@ -8794,7 +10027,7 @@ function addTaskTool(deps) {
         "Dispatch this task to an existing idle worker (the workerId returned from a prior multiStage task). The worker resumes with its accumulated context. Omit for a fresh worker."
       ),
       workspace: z3.string().optional().describe(
-        "Target workspace path; defaults to the current workspace. A different path runs this task there \u2014 the worker, its tools and its permission checks use it as their root."
+        `Target workspace path; defaults to the current workspace. A different path runs this task there \u2014 the worker, its tools and its permission checks use it as their root. A leading ~ or $HOME expands to the home directory, and a missing directory is created.${generalWorkspaceNote}`
       ),
       allowedDirs: z3.array(z3.string()).optional().describe(
         "Extra directories this task may access, in addition to its workspace. Only this task is affected \u2014 the grant is NOT inherited by other tasks. Each entry must be inside the user home and off the denied-path list (credentials, tool config); an invalid entry fails the whole call and no task is created. Paths are normalized; relative entries resolve against the task workspace."
@@ -9362,7 +10595,7 @@ ${detail}`;
 
 // src/services/tools/read-file.ts
 import { z as z14 } from "zod";
-import { readFileSync as readFileSync10 } from "fs";
+import { readFileSync as readFileSync11 } from "fs";
 import { resolve as resolve6 } from "path";
 var DEFAULT_MAX_LINES = 500;
 function readFileTool(deps = {}) {
@@ -9374,9 +10607,9 @@ function readFileTool(deps = {}) {
       offset: z14.number().int().min(1).optional().describe("Start line number (1-based)"),
       limit: z14.number().int().min(1).optional().describe("Number of lines to read")
     }),
-    execute: safeExecute("read_file", async ({ path: path9, offset, limit }) => {
-      const resolved = resolve6(workspace, path9);
-      const content = readFileSync10(resolved, "utf-8");
+    execute: safeExecute("read_file", async ({ path: path10, offset, limit }) => {
+      const resolved = resolve6(workspace, path10);
+      const content = readFileSync11(resolved, "utf-8");
       const lines = content.split("\n");
       const totalLines = lines.length;
       const start = offset ? offset - 1 : 0;
@@ -9396,7 +10629,7 @@ function readFileTool(deps = {}) {
 
 // src/services/tools/write-file.ts
 import { z as z15 } from "zod";
-import { writeFileSync as writeFileSync4, mkdirSync as mkdirSync6, existsSync as existsSync10 } from "fs";
+import { writeFileSync as writeFileSync4, mkdirSync as mkdirSync8, existsSync as existsSync10 } from "fs";
 import { dirname as dirname9, resolve as resolve7 } from "path";
 function writeFileTool(deps = {}) {
   const workspace = deps.cwd ?? process.cwd();
@@ -9406,12 +10639,12 @@ function writeFileTool(deps = {}) {
       path: z15.string().describe("File path (relative to workspace or absolute)"),
       content: z15.string().describe("File content")
     }),
-    execute: safeExecute("write_file", async ({ path: path9, content }) => {
-      const resolved = resolve7(workspace, path9);
+    execute: safeExecute("write_file", async ({ path: path10, content }) => {
+      const resolved = resolve7(workspace, path10);
       if (existsSync10(resolved)) {
-        return `[ERROR] write_file: File already exists: ${path9}. Use edit_file to modify existing files.`;
+        return `[ERROR] write_file: File already exists: ${path10}. Use edit_file to modify existing files.`;
       }
-      mkdirSync6(dirname9(resolved), { recursive: true });
+      mkdirSync8(dirname9(resolved), { recursive: true });
       writeFileSync4(resolved, content, "utf-8");
       return `Written ${content.length} chars to ${resolved}`;
     })
@@ -9419,7 +10652,7 @@ function writeFileTool(deps = {}) {
 }
 
 // src/services/tools/edit-file.ts
-import { readFileSync as readFileSync11, writeFileSync as writeFileSync5 } from "fs";
+import { readFileSync as readFileSync12, writeFileSync as writeFileSync5 } from "fs";
 import { resolve as resolve8 } from "path";
 import { z as z16 } from "zod";
 function editFileTool(deps) {
@@ -9431,22 +10664,22 @@ function editFileTool(deps) {
       old_string: z16.string().describe("Exact text to find (must be unique in file)"),
       new_string: z16.string().describe("Replacement text")
     }),
-    execute: safeExecute("edit_file", async ({ path: path9, old_string, new_string }) => {
-      const resolved = resolve8(workspace, path9);
+    execute: safeExecute("edit_file", async ({ path: path10, old_string, new_string }) => {
+      const resolved = resolve8(workspace, path10);
       let content;
       try {
-        content = readFileSync11(resolved, "utf-8");
+        content = readFileSync12(resolved, "utf-8");
       } catch {
-        return `[ERROR] edit_file: File not found: ${path9}`;
+        return `[ERROR] edit_file: File not found: ${path10}`;
       }
       const count = content.split(old_string).length - 1;
       if (count === 0)
-        return `[ERROR] edit_file: old_string not found in ${path9}, read the file content and provide a correct old_string.`;
+        return `[ERROR] edit_file: old_string not found in ${path10}, read the file content and provide a correct old_string.`;
       if (count > 1)
-        return `[ERROR] edit_file: old_string found ${count} times in ${path9}. Provide more surrounding context to make it unique.`;
+        return `[ERROR] edit_file: old_string found ${count} times in ${path10}. Provide more surrounding context to make it unique.`;
       const newContent = content.replace(old_string, new_string);
       writeFileSync5(resolved, newContent, "utf-8");
-      return `Replaced ${old_string.length} chars with ${new_string.length} chars in ${path9}`;
+      return `Replaced ${old_string.length} chars with ${new_string.length} chars in ${path10}`;
     })
   });
 }
@@ -9463,18 +10696,18 @@ function searchFilesTool(deps) {
       pattern: z17.string().describe('Glob pattern (e.g. "**/*.ts", "src/**/*.test.ts")'),
       path: z17.string().optional().describe("Base directory for search (default: workspace root)")
     }),
-    execute: safeExecute("search_files", async ({ pattern, path: path9 }) => {
-      const basePath = path9 ? normalizePath(path9, { base: workspace }) : normalizePath(workspace);
+    execute: safeExecute("search_files", async ({ pattern, path: path10 }) => {
+      const basePath = path10 ? normalizePath(path10, { base: workspace }) : normalizePath(workspace);
       if (homeDir2) {
-        const { decision } = decideAccess({
+        const { decision, matchedEntry } = decideAccess({
           access: "read",
           homeDir: homeDir2,
           cwd: workspace,
           path: basePath
         });
-        const requested = path9 ?? workspace;
-        if (decision === "deny") {
-          return `[ERROR] search_files: refusing to search "${requested}" \u2014 the path is on the read denylist (a sensitive location).`;
+        const requested = path10 ?? workspace;
+        if (matchedEntry !== void 0 || decision === "deny") {
+          return `[ERROR] search_files: refusing to search "${requested}" \u2014 the path is on the sensitive list (a protected location).`;
         }
         if (decision === "ask") {
           return `[ERROR] search_files: refusing to search "${requested}" \u2014 the path is outside the home boundary (${homeDir2}). The controller can only read files under the home directory.`;
@@ -9507,8 +10740,8 @@ function searchContentTool(deps) {
       path: z18.string().optional().describe("Directory to search in (default: workspace root)"),
       include: z18.string().optional().describe('File pattern to include (e.g. "*.ts", "*.py")')
     }),
-    execute: safeExecute("search_content", async ({ query: query2, path: path9, include }) => {
-      const searchDir = path9 ? resolve9(workspace, path9) : workspace;
+    execute: safeExecute("search_content", async ({ query: query2, path: path10, include }) => {
+      const searchDir = path10 ? resolve9(workspace, path10) : workspace;
       const cmd = `grep -rn${include ? ` --include=${shellQuote(include)}` : ""} -- ${shellQuote(query2)} ${shellQuote(searchDir)}`;
       try {
         const output = execSync3(cmd, {
@@ -9771,6 +11004,7 @@ function createControllerTools(deps) {
       onTaskDispatched: deps.onTaskDispatched,
       workspaceDir: deps.workspaceDir,
       wayangDir: deps.wayangDir,
+      generalWorkspaceDir: deps.generalWorkspaceDir,
       homeDir: deps.homeDir,
       permissionConfig: deps.permissionConfig
     }),
@@ -9878,11 +11112,32 @@ function wrapWithPermissionMiddleware(tools, config, deps) {
           return originalExecute(args, options);
         }
         if (verdict.decision === "deny") {
+          recordPermissionAudit(deps.logger, {
+            decision: "hard-denied",
+            operation: verdict.operation ?? operationForTool(toolName),
+            access: auditAccessFor(verdict.access),
+            resolvedPath: verdict.resolvedPath,
+            requestedPath: typeof args.path === "string" ? args.path : void 0,
+            matchedEntry: verdict.matchedEntry,
+            matchedSource: verdict.matchedSource,
+            matchedRule: verdict.matchedRule,
+            taskId: deps.taskId,
+            workerId: deps.workerId,
+            toolName
+          });
           return verdict.message ?? `[ERROR] ${toolName}: refused by the path permission policy`;
         }
         const requestId = generateId("perm");
+        const operation = verdict.operation ?? operationForTool(toolName);
         const baseDescription = config.describeCall(toolName, args);
-        const description = verdict.reason ? `${baseDescription} [reason: ${verdict.reason}]` : baseDescription;
+        const hitDetail = verdict.sensitive ? verdictDetailSuffix({
+          matchedRule: verdict.matchedRule,
+          matchedEntry: verdict.matchedEntry,
+          matchedSource: verdict.matchedSource,
+          resolvedPath: verdict.resolvedPath,
+          operation
+        }) : "";
+        const description = `${baseDescription}${hitDetail}${verdict.reason ? ` [reason: ${verdict.reason}]` : ""}`;
         deps.signalQueue.enqueue({
           source: "worker",
           type: "permission_request",
@@ -9895,7 +11150,14 @@ function wrapWithPermissionMiddleware(tools, config, deps) {
             emoji: deps.emoji,
             toolName,
             toolArgs: args,
-            description
+            description,
+            ...verdict.matchedRule !== void 0 && { matchedRule: verdict.matchedRule },
+            ...verdict.matchedEntry !== void 0 && { matchedEntry: verdict.matchedEntry },
+            ...verdict.matchedSource !== void 0 && { matchedSource: verdict.matchedSource },
+            ...verdict.resolvedPath !== void 0 && { resolvedPath: verdict.resolvedPath },
+            ...verdict.sensitive !== void 0 && { sensitive: verdict.sensitive },
+            ...verdict.access !== void 0 && { access: verdict.access },
+            operation
           },
           ...deps.turnLineage ?? {}
         });
@@ -9913,6 +11175,22 @@ function wrapWithPermissionMiddleware(tools, config, deps) {
             timer
           });
         });
+        recordPermissionAudit(deps.logger, {
+          decision: result2.approved ? "approved" : "denied",
+          operation,
+          access: auditAccessFor(verdict.access),
+          resolvedPath: verdict.resolvedPath,
+          requestedPath: typeof args.path === "string" ? args.path : void 0,
+          matchedEntry: verdict.matchedEntry,
+          matchedSource: verdict.matchedSource,
+          matchedRule: verdict.matchedRule,
+          taskId: deps.taskId,
+          workerId: deps.workerId,
+          toolName,
+          ...!result2.approved && {
+            source: result2.reason === "timeout" ? "timeout" : result2.reason === "Worker aborted" ? "aborted" : "controller"
+          }
+        });
         if (!result2.approved) {
           if (result2.reason === "timeout") {
             return `[ERROR] Permission request timed out for ${toolName}`;
@@ -9985,7 +11263,7 @@ function formatApiCallError(err) {
 
 // src/services/task-execute-engine.ts
 import { basename as basename8, dirname as dirname10, resolve as resolve10 } from "path";
-import { homedir as homedir2 } from "os";
+import { homedir as homedir4 } from "os";
 var RuntimeState = class extends BaseWayangState {
   constructor(initialData) {
     super(initialData, []);
@@ -9996,7 +11274,7 @@ var RuntimeState = class extends BaseWayangState {
 var PUPPET_WORKER_TYPE = "puppet";
 function resolveUserHomeDir(sessionDir) {
   const wayangDir = wayangDirForSessionDir(sessionDir);
-  return wayangDir && basename8(wayangDir) === ".wayang" ? dirname10(wayangDir) : homedir2();
+  return wayangDir && basename8(wayangDir) === ".wayang" ? dirname10(wayangDir) : homedir4();
 }
 var DEFAULT_IDLE_TIMEOUT_MS = 30 * 60 * 1e3;
 var INQUIRY_TIMEOUT_MS = 3e5;
@@ -10065,15 +11343,15 @@ var TaskExecuteEngine = class {
   // ---------------------------------------------------------------------------
   // Subscribable
   // ---------------------------------------------------------------------------
-  subscribe(path9, callback) {
-    if (path9.startsWith("tasks.")) return this.taskState.on(path9, callback);
-    if (path9 === "activeWorkers" || path9.startsWith("activeWorkers.")) return this.workerState.on(path9, callback);
-    throw new Error(`TaskExecuteEngine: unknown subscription path "${path9}"`);
+  subscribe(path10, callback) {
+    if (path10.startsWith("tasks.")) return this.taskState.on(path10, callback);
+    if (path10 === "activeWorkers" || path10.startsWith("activeWorkers.")) return this.workerState.on(path10, callback);
+    throw new Error(`TaskExecuteEngine: unknown subscription path "${path10}"`);
   }
-  getSnapshot(path9) {
-    if (path9.startsWith("tasks.")) return this.taskState.get(path9);
-    if (path9 === "activeWorkers" || path9.startsWith("activeWorkers.")) return this.workerState.get(path9);
-    throw new Error(`TaskExecuteEngine: unknown snapshot path "${path9}"`);
+  getSnapshot(path10) {
+    if (path10.startsWith("tasks.")) return this.taskState.get(path10);
+    if (path10 === "activeWorkers" || path10.startsWith("activeWorkers.")) return this.workerState.get(path10);
+    throw new Error(`TaskExecuteEngine: unknown snapshot path "${path10}"`);
   }
   // ---------------------------------------------------------------------------
   // Task management
@@ -10944,9 +12222,10 @@ var TaskExecuteEngine = class {
     if (workerType === PUPPET_WORKER_TYPE) {
       const middleware = wrapWithPermissionMiddleware(tools, {
         gatedTools: ["bash", ...FILE_TOOL_NAMES],
-        // Single decision source: the shared access policy (denylist →
+        // Single decision source: the shared access policy (sensitive list →
         // config roots → task allowedDirs → task workspace → read-in-home →
-        // ask). `deny` refuses here without ever emitting a permission_request.
+        // ask). `deny` refuses here without ever emitting a permission_request;
+        // both `deny` and every answered `ask` are audited (see the middleware).
         decide: (toolName, args) => decideToolAccess(accessScope, toolName, args),
         describeCall: (toolName, args) => {
           if (toolName === "bash") return `Execute shell command: ${args.command}`;
@@ -10964,7 +12243,9 @@ var TaskExecuteEngine = class {
         workerType,
         emoji: workerMeta.emoji,
         signalQueue: this.signalQueue,
-        turnLineage: this.workerLineage(workerId)
+        turnLineage: this.workerLineage(workerId),
+        // Permission audit trail (metadata only) shares the session logger.
+        logger: this.ctx.logger
       });
       tools = middleware.wrappedTools;
       this.permissionResolvers.set(workerId, middleware);
@@ -11218,7 +12499,7 @@ var ControllerLoop = class {
 };
 
 // src/services/agents/controller-state.ts
-import { join as join17 } from "path";
+import { join as join20 } from "path";
 
 // src/services/conversation/conversation-index.ts
 function emptyUsage() {
@@ -11442,8 +12723,8 @@ var ControllerAgentState = class extends BaseWayangState {
   /** In-memory resolve function for the current inquiry — never persisted. */
   inquiryResolver = null;
   constructor(ctx) {
-    const jsonFile = new JSONFileHelper(join17(ctx.sessionDir, "runtime-state.json"));
-    const jsonlFile = new JSONLFileHelper(join17(ctx.sessionDir, "conversation.jsonl"));
+    const jsonFile = new JSONFileHelper(join20(ctx.sessionDir, "runtime-state.json"));
+    const jsonlFile = new JSONLFileHelper(join20(ctx.sessionDir, "conversation.jsonl"));
     const initialData = {
       runtimeState: {
         session: { id: "", startedAt: 0 },
@@ -11468,9 +12749,9 @@ var ControllerAgentState = class extends BaseWayangState {
    * shared conversation-envelope module — the single source of truth. This
    * override only feeds the in-memory turn index incrementally.
    */
-  append(path9, entry) {
-    super.append(path9, entry);
-    if (path9 === "conversation" && this.convIndex) {
+  append(path10, entry) {
+    super.append(path10, entry);
+    if (path10 === "conversation" && this.convIndex) {
       this.convIndex.onAppend(entry);
     }
   }
@@ -11613,8 +12894,8 @@ function buildSummaryInput(entries, maxChars) {
     lines = formatAll(entries, caps);
     if (totalLength(lines) <= maxChars) return lines;
   }
-  const noteFor = (n) => `[${n} older entries omitted \u2014 over the summarizer input budget]`;
-  const reserve = noteFor(lines.length).length + 1;
+  const noteFor2 = (n) => `[${n} older entries omitted \u2014 over the summarizer input budget]`;
+  const reserve = noteFor2(lines.length).length + 1;
   const kept = [];
   let used = 0;
   for (let i = lines.length - 1; i >= 0; i--) {
@@ -11624,12 +12905,12 @@ function buildSummaryInput(entries, maxChars) {
     used += size;
   }
   const omitted = lines.length - kept.length;
-  return omitted > 0 ? [noteFor(omitted), ...kept] : kept;
+  return omitted > 0 ? [noteFor2(omitted), ...kept] : kept;
 }
 
 // src/services/agents/controller-agent.ts
 import { basename as basename9, dirname as dirname11 } from "path";
-import { homedir as homedir3 } from "os";
+import { homedir as homedir5 } from "os";
 var SUMMARIZER_INPUT_RATIO = 0.5;
 var ControllerAgent = class _ControllerAgent extends BaseAgent {
   state;
@@ -11662,7 +12943,7 @@ var ControllerAgent = class _ControllerAgent extends BaseAgent {
    * cancelled while its workers are still running.
    */
   turnInterruptRecorded = false;
-  constructor(ctx, state, provider, tools, skills, recorder = new ToolCallRecorder()) {
+  constructor(ctx, state, provider, tools, skills, recorder = new ToolCallRecorder(), controllerRules) {
     super(provider);
     this.ctx = ctx;
     this.state = state;
@@ -11673,7 +12954,7 @@ var ControllerAgent = class _ControllerAgent extends BaseAgent {
     this.workspaceSlug = ctx.workspaceDir ? resolveWorkspaceRef(wayangDirForSessionDir(ctx.sessionDir), ctx.workspaceDir).slug : void 0;
     this.contextManager = new ContextManager(
       state,
-      buildControllerSystemPrompt(this.ctx, skills),
+      buildControllerSystemPrompt(this.ctx, skills, { rules: controllerRules }),
       provider.contextWindowTokens
     );
     this.setHooks({
@@ -11695,7 +12976,17 @@ var ControllerAgent = class _ControllerAgent extends BaseAgent {
     const state = new ControllerAgentState(ctx);
     const recorder = new ToolCallRecorder(ctx.logger);
     const wayangDir = wayangDirForSessionDir(ctx.sessionDir);
-    const homeDir2 = wayangDir && basename9(wayangDir) === ".wayang" ? dirname11(wayangDir) : homedir3();
+    const homeDir2 = wayangDir && basename9(wayangDir) === ".wayang" ? dirname11(wayangDir) : homedir5();
+    const generalWorkspaceDir = resolveGeneralWorkspace(ctx);
+    try {
+      ensureGeneralWorkspace(ctx);
+    } catch {
+      ctx.logger.warn(`could not create the general workspace at ${generalWorkspaceDir}`);
+    }
+    const controllerRules = loadControllerRules({
+      homeDir: homeDir2,
+      cwd: ctx.workspaceDir || process.cwd()
+    });
     const tools = createControllerTools({
       addTask: (task) => engine.add(task),
       validateWorkerType: (type) => engine.validateWorkerType(type),
@@ -11725,7 +13016,8 @@ var ControllerAgent = class _ControllerAgent extends BaseAgent {
       cwd: ctx.workspaceDir,
       homeDir: homeDir2,
       // User-config permission section: add_task validates a task's allowedDirs
-      // against the built-in denylist plus these configured deniedDirs.
+      // against the built-in sensitive list plus these configured
+      // sensitiveDirs (the deprecated deniedDirs alias is merged in).
       permissionConfig: opts.config.permission,
       getNotebook: () => state.get("runtimeState.notebook") ?? "",
       setNotebook: (content, mode) => {
@@ -11748,9 +13040,10 @@ var ControllerAgent = class _ControllerAgent extends BaseAgent {
       // Default workspace for tasks created by add_task; a declared workspace
       // is stamped instead and the engine executes the task there.
       workspaceDir: ctx.workspaceDir,
-      wayangDir
+      wayangDir,
+      generalWorkspaceDir
     });
-    return new _ControllerAgent(ctx, state, provider, tools, skills, recorder);
+    return new _ControllerAgent(ctx, state, provider, tools, skills, recorder, controllerRules);
   }
   /** Run the controller agent — streams text chunks while updating streamingEntries in state. */
   async run(signals) {
@@ -12015,11 +13308,11 @@ var ControllerAgent = class _ControllerAgent extends BaseAgent {
     return this.state.getTurn(turnId);
   }
   // --- Subscribable ---
-  subscribe(path9, callback) {
-    return this.state.on(path9, callback);
+  subscribe(path10, callback) {
+    return this.state.on(path10, callback);
   }
-  getSnapshot(path9) {
-    return this.state.get(path9);
+  getSnapshot(path10) {
+    return this.state.get(path10);
   }
   /** Check if context needs compaction. */
   needsCompaction() {
@@ -12347,8 +13640,8 @@ function signalToEntry(sig, ts, sessionId) {
 }
 
 // src/services/skills/registry.ts
-import { readFileSync as readFileSync12, readdirSync as readdirSync2, statSync as statSync4 } from "fs";
-import { join as join18 } from "path";
+import { readFileSync as readFileSync13, readdirSync as readdirSync2, statSync as statSync6 } from "fs";
+import { join as join21 } from "path";
 import { parse as parseYaml } from "yaml";
 var SKILL_FILE = "SKILL.md";
 function parseFrontmatter(raw) {
@@ -12383,7 +13676,7 @@ function listResources(skillDir) {
   const walk = (relDir) => {
     let entries;
     try {
-      entries = readdirSync2(join18(skillDir, relDir), { withFileTypes: true });
+      entries = readdirSync2(join21(skillDir, relDir), { withFileTypes: true });
     } catch {
       return;
     }
@@ -12430,10 +13723,10 @@ var SkillRegistry = class {
     if (existing) return existing;
     const desc = this.descriptors.get(name);
     if (!desc) return void 0;
-    const filePath = join18(desc.dir, SKILL_FILE);
+    const filePath = join21(desc.dir, SKILL_FILE);
     let raw;
     try {
-      raw = readFileSync12(filePath, "utf-8");
+      raw = readFileSync13(filePath, "utf-8");
     } catch (err) {
       this.logger?.warn({ skill: name, error: err instanceof Error ? err.message : String(err) }, "Failed to read skill file");
       return void 0;
@@ -12461,8 +13754,8 @@ var SkillRegistry = class {
     for (const entry of entries) {
       if (!entry.isDirectory()) continue;
       if (entry.name.startsWith(".") || entry.name === "node_modules") continue;
-      const skillDir = join18(dir, entry.name);
-      const skillFile = join18(skillDir, SKILL_FILE);
+      const skillDir = join21(dir, entry.name);
+      const skillFile = join21(skillDir, SKILL_FILE);
       if (!existsAsFile(skillFile)) continue;
       const { frontmatter } = safeReadFrontmatter(skillFile);
       const description = asString(frontmatter.description);
@@ -12475,16 +13768,16 @@ var SkillRegistry = class {
     }
   }
 };
-function existsAsFile(path9) {
+function existsAsFile(path10) {
   try {
-    return statSync4(path9).isFile();
+    return statSync6(path10).isFile();
   } catch {
     return false;
   }
 }
-function safeReadFrontmatter(path9) {
+function safeReadFrontmatter(path10) {
   try {
-    return parseFrontmatter(readFileSync12(path9, "utf-8"));
+    return parseFrontmatter(readFileSync13(path10, "utf-8"));
   } catch {
     return { frontmatter: {}, body: "" };
   }
@@ -12492,12 +13785,12 @@ function safeReadFrontmatter(path9) {
 
 // src/services/skills/skill-dir.ts
 import { existsSync as existsSync11 } from "fs";
-import { homedir as homedir4 } from "os";
-import { join as join19, resolve as resolve11 } from "path";
+import { homedir as homedir6 } from "os";
+import { join as join22, resolve as resolve11 } from "path";
 function resolveSkillDirs(workspaceDir2, configDirs) {
   const candidates = [
-    join19(homedir4(), ".wayang", "skills"),
-    join19(workspaceDir2, ".wayang", "skills"),
+    join22(homedir6(), ".wayang", "skills"),
+    join22(workspaceDir2, ".wayang", "skills"),
     ...(configDirs ?? []).map((d) => resolve11(d))
   ];
   const seen = /* @__PURE__ */ new Set();
@@ -12824,11 +14117,11 @@ async function runWayangServer(options, io = process) {
   let nextSubscriptionId = 1;
   rpc.register(METHOD.SUBSCRIBE, (params) => {
     const target = resolveTarget(params.target);
-    const path9 = requiredString(params, "path");
-    const data = target.getSnapshot(path9);
+    const path10 = requiredString(params, "path");
+    const data = target.getSnapshot(path10);
     const subscriptionId = `sub-${nextSubscriptionId++}`;
-    subscriptions.set(subscriptionId, target.subscribe(path9, (event) => {
-      rpc.notify(NOTIFY.STATE_EVENT, { subscriptionId, target: params.target, path: path9, data: event.data });
+    subscriptions.set(subscriptionId, target.subscribe(path10, (event) => {
+      rpc.notify(NOTIFY.STATE_EVENT, { subscriptionId, target: params.target, path: path10, data: event.data });
     }));
     return { subscriptionId, data: data === void 0 ? null : data };
   });
@@ -13009,9 +14302,9 @@ if (result.status === "error") {
   process.exit(1);
 }
 var { input, flags } = result;
-var homeDir = path8.resolve(flags.homeDir ?? (process.env.HOME || "~"));
+var homeDir = path9.resolve(flags.homeDir ?? (process.env.HOME || "~"));
 var workspaceDir = normalizeWorkspacePath(flags.workspaceDir ?? process.cwd());
-var configPath = flags.config ? path8.resolve(flags.config) : path8.join(homeDir, ".wayang.config.json");
+var configPath = flags.config ? path9.resolve(flags.config) : path9.join(homeDir, ".wayang.config.json");
 function fatal(err) {
   if (err instanceof SessionLockedError) {
     console.error(formatSessionLockHint(err));
@@ -13023,7 +14316,7 @@ function fatal(err) {
 if (input[0] === "server") {
   serverMain({
     configPath,
-    homeDir: path8.join(homeDir, ".wayang"),
+    homeDir: path9.join(homeDir, ".wayang"),
     workspaceDir,
     session: flags.session ?? "new",
     injectPreviousTasks: flags.injectPreviousTasks,