v0.18.2

Highlights

• Approval trust model upgraded. Dangerous shell commands (recursive force delete, force push, a download piped into a shell, and similar) now always prompt in yolo and manual modes, and the prompt offers a single "allow once" choice — the decision is never remembered. Auto mode stays unattended by design. Prompts carry only the grant options the policy allows (unexpected answers downgrade to once), the new /grants command lists and revokes session approvals, and revocations are recorded on the wire so a resume cannot resurrect them.
• Egress guard after private reads. Reading files outside the workspace taints the session; later network sends to non-allowlisted hosts require approval even in auto mode. FetchURL and shell commands are covered, and unknown destinations fail closed.
• Auditable approval decisions. Denied, cancelled, and timed-out approvals are recorded on the wire and rendered in the trace view; approval prompts also carry a request summary so the card shows what the run is working on.
• Maintenance. Workspace packages bump to 0.18.2; the MCP tool-call timeout is made explicit (60000 ms, the SDK's own default — no behavior change).

Package versions

All packages bumped to 0.18.2.

中文补充

• 审批信任模型升级：危险 shell 命令（递归强删、强推、下载管道进 shell 等）在 yolo/手动模式一律弹审批，且只给「允许一次」——永不被记住；auto 模式按设计保持无人值守。审批卡只携带策略允许的档位（越档自动降级为一次）；新增 /grants 命令列出并撤销本会话授权；撤销落 wire，resume 不会复活。
• 读过工作区外文件后的外发门：会话被标记后，向非白名单主机的联网发送即使在 auto 模式也需审批；覆盖 FetchURL 与 shell 命令，未知目的地一律失败关闭。
• 审批决策可审计：拒绝/取消/超时的审批落 wire，并在 trace 视图可见；审批卡附「本回合请求摘要」，一眼知道它在忙哪件事。
• 维护：工作区包版本升到 0.18.2；MCP 工具调用超时显式化（60000 毫秒，即 SDK 默认值，行为不变）。