# v1.3.7 Release Notes

> v1.3.6 -> v1.3.7

## Summary

Moves permission enforcement out of the system prompt and into the harness, scoping auto mode to the working directory and gating irreversible commands the way Claude Code's auto mode does. Trims the per-turn context so only relevant memory and changing values are rewritten each turn. Tool descriptions and prompts are rewritten in English and corrected against what each tool actually does.

<details>
<summary>翻譯</summary>

把權限把關從 system prompt 移到 harness，auto 模式限縮在工作目錄內，並比照 Claude Code 的 auto mode 攔下不可逆指令。精簡每輪注入的 context，只重寫相關記憶與會變動的值。工具描述與 prompt 改寫為英文，並依各工具的實際行為修正。

</details>

## Changes

### FIX

- Stop every running daemon on `agen stop` / `make stop`, not only the pid in the runtime record, so stale daemons no longer conflict (@pardnchiu) [ed2cf0f6]
- List the background tasks a task still has running in the turn context when a follow-up joins it, so the agent no longer claims a started task never ran and points the user to the client to cancel it (@pardnchiu) [d5d3df29]
- Correct tool descriptions that contradicted the handlers: a blank `edit_file` path does not land in the output directory, overlapping patch targets are rejected rather than applied in order, `edit_tool` / `edit_skill` patches replace only the first match, `calculate` has no unit conversion, `ask_user` answers inline in the TUI, and `reasoning_guide` is called with `topics=[...]` (@pardnchiu) [ceab7f0c]

<details>
<summary>翻譯</summary>

- `agen stop`／`make stop` 改為停止所有執行中的 daemon，不再只停 runtime 記錄中的 pid，避免殘留的 daemon 互相衝突
- follow-up 併入仍有背景任務在執行的 task 時，turn context 會列出這些任務，agent 不再誤稱已啟動的任務沒有執行，並會引導使用者從 client 取消
- 修正與 handler 行為不符的工具描述：`edit_file` 空路徑不會寫到 output 目錄、重疊的 patch 目標會被拒絕而非依序套用、`edit_tool`／`edit_skill` 的 patch 只取代第一個符合處、`calculate` 不支援單位換算、`ask_user` 在 TUI 直接回傳答案、`reasoning_guide` 參數為 `topics=[...]`

</details>

### UPDATE

- Start the TUI in `⏵⏵ auto` when the working directory is a non-sensitive subdirectory of `$HOME` and in `⏸ safe` otherwise, replacing the `[auto]` / `[safe]` labels (@pardnchiu) [d5d3df29]
- Inject only the rolling-summary entries the decision model judges relevant to the request, as JSON inside the turn context; the summary usage rules move to the system prompt and entries are kept when no decision model is set (@pardnchiu) [d5d3df29]
- Merge MCP server instructions into the main system prompt ahead of the guardrails instead of sending them as a second system message (@pardnchiu) [d5d3df29]
- Remove the Permission Mode section from the system prompt and the turn context, shorten the summary rules and output-language directive, and keep prompt templates in English (@pardnchiu) [d5d3df29]
- Group MCP tool names by server prefix in the turn context tool list (@pardnchiu) [d5d3df29]
- Rewrite every tool description as three lines (what it returns, English trigger phrasings, the neighbouring tool), move per-parameter rules into the parameter docs, and ask for English keywords in `find_tools` queries (@pardnchiu) [ceab7f0c]
- Replace the remaining Chinese examples and keywords in system prompts (chatbot, voice, summary, follow-up, confirmation explanation) with English (@pardnchiu) [ceab7f0c]

<details>
<summary>翻譯</summary>

- 工作目錄是 `$HOME` 底下的非敏感子目錄時，TUI 以 `⏵⏵ auto` 啟動，其餘情況為 `⏸ safe`，取代原本的 `[auto]`／`[safe]` 標籤
- 滾動摘要只注入 decision model 判定與請求相關的條目，以 JSON 放在 turn context；摘要使用規則移到 system prompt，未設定 decision model 時保留全部條目
- MCP server instructions 併入主 system prompt、放在 guardrail 之前，不再另送一則 system 訊息
- 從 system prompt 與 turn context 移除 Permission Mode 段落，精簡摘要規則與輸出語言指示，prompt 模板維持全英文
- turn context 的工具清單中，MCP 工具名稱依 server 前綴分組
- 所有工具描述改為三行：回傳內容、英文觸發問法、相鄰工具；參數專屬規則移入參數說明，`find_tools` 的 query 要求英文關鍵字
- system prompt 中剩餘的中文範例與關鍵字（chatbot、voice、摘要、followup、確認說明）改為英文

</details>

### SECURITY

- Gate irreversible commands in the harness instead of the system prompt: in auto mode `git reset --hard` / `git clean`, force pushes and remote branch deletion, downloads piped into an interpreter, scripts that read a secret and reach the network, sensitive-file uploads, infrastructure apply and destroy, cloud delete / deploy / IAM changes, deploy CLIs, database migrations, destructive SQL, `gh pr merge` and mutating `gh api` calls still ask, and allow rules cannot skip them (@pardnchiu) [d5d3df29]
- Scope auto mode to the working directory: writes, commands and `rm` targets inside `$HOME` but outside it ask once per path, while targets outside `$HOME`, `sudo` and `sandbox: false` need the system password in every mode; auto mode no longer silently rejects outside-home paths it could not approve (@pardnchiu) [d5d3df29]
- Keep `rm` trash-backed and route its operands through the path boundary, so removals inside the working directory run, those elsewhere in `$HOME` ask and those outside need the password (@pardnchiu) [d5d3df29]
- Add `.git`, `.claude`, shell startup files and `.mcp.json` to the sensitive path list; sensitive paths inside `$HOME` now need a plain confirmation instead of the system password (@pardnchiu) [d5d3df29]

<details>
<summary>翻譯</summary>

- 不可逆指令改由 harness 攔截、不再靠 system prompt：auto 模式下 `git reset --hard`／`git clean`、force push 與刪除遠端分支、下載後接直譯器、讀取密鑰並連網的腳本、上傳敏感檔、基礎設施的套用與刪除、雲端刪除／部署／IAM 變更、部署 CLI、資料庫 migration、破壞性 SQL、`gh pr merge` 與寫入型 `gh api` 仍需確認，且 allow rule 不能略過
- auto 模式限縮在工作目錄：寫入、指令與 `rm` 的目標在 `$HOME` 內但在工作目錄外時，每個路徑確認一次；`$HOME` 以外、`sudo` 與 `sandbox: false` 在任何模式都要系統密碼；auto 模式不再對無法核准的 `$HOME` 外路徑直接拒絕
- `rm` 維持移到垃圾桶，並把目標交給路徑邊界判斷：工作目錄內直接執行，`$HOME` 內其他位置需確認，`$HOME` 外需密碼
- 敏感路徑清單加入 `.git`、`.claude`、shell 啟動檔與 `.mcp.json`；`$HOME` 內的敏感路徑改為一般確認，不再要求系統密碼

</details>

### REFACTOR

- Move the sensitive and denied path checks and the working-directory classification from the tool boundary package into the filesystem package (@pardnchiu) [d5d3df29]

<details>
<summary>翻譯</summary>

- 敏感與禁止路徑判斷、工作目錄分類從工具層的 boundary 套件移到 filesystem 套件

</details>

## Scope

- `cmd/app/`, `internal/runtime/` — FIX (`main.go`, `runtime.go`)
- `internal/agents/exec/` — FIX, UPDATE, SECURITY (multiple files)
- `internal/agents/types/` — SECURITY (`agent.go`)
- `internal/tools/interactive/` — FIX, UPDATE (`background.go`, `askUser.go`, `storeSecret.go`, `writeTodo.go`)
- `internal/tools/file/boundary/` — SECURITY, REFACTOR (`boundary.go`, `workDir.go`, `sensitive.go`)
- `internal/filesystem/` — REFACTOR, UPDATE (`pathRule.go`, `replyLang.go`)
- `internal/runtime/tui/` — UPDATE (`init.go`, `view.go`)
- `internal/runtime/routes/handler/` — REFACTOR (`file.go`, `fileLocate.go`)
- `internal/session/summary/` — UPDATE (`prompt.go`)
- `internal/tools/` — FIX, UPDATE (multiple files)
- `internal/utils/` — UPDATE (`event.go`, `utils.go`)
- `configs/` — UPDATE, SECURITY (`configs.go`, `jsons/`, `prompts/system_prompt/`)
- `doc/` — DOC

---

Generated by [SKILL](https://github.com/pardnchiu/skill-version-generate)