暴走抑止

src/agents/ai-judge.ts

@@ -55,7 +55,7 @@ export const callAiJudge: AiJudgeCaller = async (
   const response = await runAgent(undefined, prompt, {
     cwd: options.cwd,
     maxTurns: 1,
-    allowedTools: [],
+    permissionMode: 'readonly',
   });
 
   if (response.status !== 'done') {

src/core/piece/engine/OptionsBuilder.ts

@@ -82,8 +82,8 @@ export class OptionsBuilder {
   ): RunAgentOptions {
     return {
       ...this.buildBaseOptions(step),
-      // Do not pass permission mode in report/status phases.
+      // Report/status phases are read-only regardless of movement settings.
-      permissionMode: undefined,
+      permissionMode: 'readonly',
       sessionId,
       allowedTools: overrides.allowedTools,
       maxTurns: overrides.maxTurns,

src/core/piece/judgment/FallbackStrategy.ts

@@ -69,8 +69,8 @@ abstract class JudgmentStrategyBase implements JudgmentStrategy {
   protected async runConductor(instruction: string, context: JudgmentContext): Promise<string> {
     const response = await runAgent('conductor', instruction, {
       cwd: context.cwd,
-      allowedTools: [],
       maxTurns: 3,
+      permissionMode: 'readonly',
       language: context.language,
     });