@chatcode/chatcode-cli 3.0.3 → 3.0.4-rc.1

package/README.i18n.yaml

@@ -3,20 +3,20 @@
 # After editing either side, bring the other along and re-record with:
 #   pnpm run verify-translation-pairing --write apps/cli/README.md
 /chatcode-chatcode-cli:
-  en: 5fe3726943c8a3e3
-  zh: f536c264e5300f4c
+  en: ee42a47fb770515c
+  zh: 0ab7068caff6f0d1
 /chatcode-chatcode-cli/entry-modes:
-  en: 7ce3e97e896c5faa
-  zh: c78d6da95592692d
+  en: 5a02ff3726f7fe5d
+  zh: 7c87f54334bf6048
 /chatcode-chatcode-cli/app-arguments:
-  en: 6267304ad0acefab
-  zh: cd0dd269d0608a46
+  en: 591d23e87484c54c
+  zh: fb932880cc5b3823
 /chatcode-chatcode-cli/profiles:
-  en: 0277909432b9078b
-  zh: 56b369c075a65aba
+  en: 36405fc361505950
+  zh: f6d1a6c77032276d
 /chatcode-chatcode-cli/optional-overlays:
   en: 3a40ddc44e55f79c
   zh: 8d3949132e1ef93c
 /chatcode-chatcode-cli/development:
-  en: 60435baa6e089453
-  zh: 1e602590c259b6eb
+  en: 8342d41b1add62e9
+  zh: 1104c5e8b258224d

package/README.md

@@ -4,7 +4,7 @@ English | [中文](README.zh.md)
 
 `chatcode-cli` is the formal launcher and `cco` is its short form; both commands share one parser and start the TUI/CLI profile when invoked without arguments. Profiles are ordered stacks of plugin-bundle patch layers under the user's own overrides. SDK and ACP are profiles, not separate public bins. The Python runtime wheel packages the same launcher; the SDK defaults to `sdk`, and the minimal example selects `sdk-minimal`. [`src/args.ts`](src/args.ts) owns the command grammar, and [`src/bin.ts`](src/bin.ts) loads only the selected runner. Invalid commands, options from another mode, and fatal configuration or boot failures exit nonzero.
 
-The pinned TUI supports Harness live-Config settings directly: `/settings`, `/statusline`, `/keybindings`, and provider configuration use the active profile settings service, with live display changes preserving the current session. No separate TUI dependency patch is required.
+The bundled TUI supports Harness live-Config settings directly: `/settings`, `/statusline`, `/keybindings`, and provider configuration use the active profile settings service, with live display changes preserving the current session. Builds use the adjacent `dsh-TUI` repository; published CLI packages carry its compiled frontend, standard libraries and private JavaScript dependencies in the embedded runtime.
 
 ## Entry modes
 
@@ -19,12 +19,15 @@ The pinned TUI supports Harness live-Config settings directly: `/settings`, `/st
 | `chatcode-cli --profile sdk` | Serve SDK clients over JSON-RPC stdio until shutdown or disconnect. |
 | `chatcode-cli --profile sdk-minimal` | Serve SDK clients with the standalone minimal agent tree. |
 | `chatcode-cli web` / `cco web` | Boot the Web profile. |
+| `cco web on` / `cco web off` | Start or reopen the shared Web instance / stop it and release its port. |
 | `chatcode-cli plugin --profile <name> <pnpm args>` | Manage a profile's plugins by forwarding to pnpm in the profile directory. |
 | `chatcode-cli migrate --dry-run` | Print the copy-only migration plan from legacy user homes. |
 | `chatcode-cli migrate --apply` | Revalidate and apply that plan without overwriting destination data. |
 
 The invoking directory is the default workspace root. The `web`, `headless`, `sdk`, `sdk-minimal`, and `acp` profiles auto-initialize on first use from shipped templates. Create another profile at an unused, non-shipped name with `--from-default-profile`, or initialize a base-backed profile through `chatcode-cli plugin`. The `desktop` name is reserved for the Electron-owned profile, so the CLI rejects boot, config-dump, and plugin-management requests for it.
 
+`cco web` and `pnpm cco web` default to `on`. The first launch opens its token-authenticated URL after readiness. Subsequent launches in the same ChatCode CLI home verify and reopen the existing instance using its current authenticated URL, print that URL again, and exit without binding a second port. `off` waits for the registered instance's port to close; it never kills an unrelated listener by port or PID. A private registration lives under `$CHATCODE_CLI_HOME/web/instance.json`; missing or exited instances start normally, while an alive but unverified instance fails safely. Explicit `--port 0` remains an isolated random-port launch. `--no-open` and SSH browser suppression remain supported; changing a running instance's flags or overlays requires stopping it first. The URL carries access permission and stays valid only for that server process: do not share it.
+
 ## App arguments
 
 The launcher parses only its own flags and hands everything after them to the booted profile, where any injected app plugin may parse the shared immutable snapshot ([`dsh-cmdline`](../../packages/boot/cmdline/README.md)). The first token the launcher does not recognize starts the app's arguments:
@@ -39,13 +42,19 @@ chatcode-cli --help                          # the launcher's own help
 
 `-p` and `--print` are the compatibility exception: on the default `cli` profile they select the shipped `headless` profile and remain in the app arguments for its legacy grammar. Explicit custom and non-CLI profiles retain ownership of their own `-p` option.
 
+`cco --dangerously-skip-permissions` permits unrestricted file access and automatically approves tool permission requests for that process. The spelling `--dangerouslv-skip-permissions` is also accepted. The flag works with TUI, Web, `--resume`, and `-p`; it leaves saved permission events and profile settings unchanged, including for resumed sessions. Use it only in a workspace you trust. Account sign-in, feature enablement, operating-system permissions, and cancellation remain required. After `--`, the flag is literal application input.
+
 The headless profile loads the same ChatCode model adapter as the interactive CLI, so a saved `chatcode-codingplan`, `chatcode-maas`, or custom ChatCode model selection remains available to `-p` runs.
 
+ChatCode model requests in CLI, Web, and headless use the profile's [durable LLM retry executor](../../packages/llm/llm-retry/README.md) for bounded exponential recovery from transient errors such as HTTP 429. The ChatCode model bundle supplies the retry budget and backoff through `retryPolicy`; retries keep the same selected model and stop when cancelled or exhausted.
+
 The installed `@deepseek-ai/dsh-headless` package owns its native task, `--json`, and `--session-id` interface. `@chatcode/chatcode-cli-test` ships a separate compatibility overlay and runner for `-p`, `--print`, `--output-format`, and `--input-format`; those arguments select the owned runner while native headless invocations use the upstream package. Publishing or patching a private build of `@deepseek-ai/dsh-headless` is not required.
 
 <a id="profiles"></a>
 ## Profiles
 
+The `web` and `cli` profiles include `@chatcode/cco-computer-use` through the compatibility alias `dsh-computer-use` by default. Existing base-backed product profiles retain custom bundles and patches when it is added. Its live master switch is available under the independent **Settings → Computer use** page and through TUI `/settings`; the switch defaults off and requires confirmation to enable. Web and CLI persist this one value in `$CHATCODE_CLI_HOME/cordis.patch.yml` (default `~/.chatcode-cli/cordis.patch.yml`), share live updates, and remember it across restarts. Disabling leaves only the read-only status tool. Browser automation uses text observations; the native Cua Driver backend selects Windows, macOS, or Linux binaries. Source checkouts select the sibling implementation with `pnpm plugins:local` or the exact published version with `pnpm plugins:registry`; `pnpm build:computer-use` builds only the local source. Publish the plugin before the CLI; the installed CLI obtains the plugin from npm and needs no sibling checkout. See the [release and development guide](../../打包发布及开发指南.md) for packaging commands.
+
 A profile directory holds a `package.json` (out-of-tree plugin dependencies plus the profile manifest `dsh.profile` with its ordered `bundles` list) and a `cordis.patch.yml` (the user's own patch layer). `dsh-hmr`, when enabled in YAML, watches the profile manifest and both profile and home patch files, then recomposes all layers through one serialized reload. Without HMR, changes apply on restart. Edits arriving during watcher registration use the same nonfatal reload reporting as later edits. [Plugin Manager](../../packages/boot/plugin-manager/README.md) shares package operations and the profile write lock with `chatcode-cli plugin`; package updates retain disabled bundle selections. CLI package commands inherit authentication variables and terminal descriptors, including interactive build approval; service calls retain their scrubbed environment and captured diagnostics.
 
 Installation and profile startup enforce declared DSH peer ranges against the same runtime version shown by `dsh --version`. Incompatible plugins require an explicitly acknowledged exact-version exemption. The [plugin manager's compatibility reference](../../packages/boot/plugin-manager/README.md#version-compatibility-and-exemptions) documents `version-exemptions`, `allow-version`, `revoke-version`, persistence, and risks.
@@ -69,6 +78,8 @@ The legacy-data startup reminder checks only the top-level entries of the old ho
 
 Set `CHATCODE_CLI_STARTUP_TRACE=1` to print phase and plugin activation durations to stderr for either `cco` or `cco web`. A `begin` line without a matching duration identifies unfinished work. Tracing is off by default and records labels and elapsed times, not environment values or plugin configuration.
 
+Product and command-line overlays that resolve to the same physical file are applied once, retaining the first path and its relative-resource base. Distinct overlays retain their order and override precedence. Source launches ignore embedded-runtime staging left by packaging and resolve the live workspace packages.
+
 The [CLI behavior reference](reference/README.md) owns exact layer precedence, flags, shutdown behavior, deployment defaults, and source execution. The [startup and reload failure table](../../packages/boot/app-boot/README.md#startup-and-reload-failures) compares optional and required plugin failures with configuration HMR.
 
 ## Optional overlays
@@ -79,6 +90,10 @@ The [CLI behavior reference](reference/README.md) owns exact layer precedence, f
 
 Production runs require built package and frontend artifacts. From the repository root, run `pnpm run build` separately, then use `pnpm cco <args...>` to run the TypeScript entry and forward every argument; the [source-execution reference](reference/README.md#source-execution) owns the module-resolution contract.
 
+Run `pnpm exec vitest run apps/cli/tests/chatcode-rate-limit.spec.ts apps/cli/tests/permission-bypass.spec.ts` from the repository root to check retry and launch-permission behavior. The retry tests mount the installed `dsh-llm-chatcode-config` plugin through its public package entry and use fixture responses for catalog and model HTTP requests.
+
+The TUI bridge validates its declared live fields with the launcher's schema runtime, including volatile metadata emitted by older TUI schema versions. This keeps settings editable without replacing the running session.
+
 The published CLI directly pins every Harness runtime package referenced by the base/Web bundles and every required peer of its bundled ChatCode plugins. Keep those entries on the same Harness release when publishing: npm's global installer does not preserve pnpm workspace peer unification, and otherwise may hoist an older ABI beside the current runtime.
 
 The npm artifact carries fork-owned JavaScript packages under `runtime/node_modules` and lists them in `runtime/manifest.json`. Platform-specific `node-addon-system` binaries remain exact-version optional npm dependencies, selected for the installation host; they are excluded from the embedded runtime. It also carries the TUI admission registry, protocols, and schemas under `lib/dsh-ecosystem-spec`, where command authorization reads its permission defaults before applying the user's grants file. Profile startup includes the complete runtime package list when resolving presets and plugins, including packages absent from the slim npm dependency list. The launcher resolves embedded packages in memory for both ESM and CommonJS, including imports from external plugins. Startup does not modify the installation directory, so a root-owned installation can be launched by an ordinary user with read access; the user still needs a writable ChatCode CLI home. CLI and Web share the [startup model preference](../../packages/core/agent-default-model/README.md); already running frontends do not switch each other's model.

package/README.zh.md

@@ -4,7 +4,7 @@
 
 `chatcode-cli` 是正式启动命令，`cco` 是其简写；两者共用同一解析器，且无参数时都启动 TUI/CLI profile。profile 由多个插件组合包 patch 层按顺序叠加而成，其上再应用用户自己的覆盖配置。SDK 与 ACP（Agent Client Protocol）都是 profile，而不是独立的公开可执行命令。Python 运行时 wheel 包中也包含同一个启动器；SDK 默认使用 `sdk`，极简示例选择 `sdk-minimal`。[`src/args.ts`](src/args.ts) 负责命令语法，[`src/bin.ts`](src/bin.ts) 只加载选中的运行器。无效命令、来自其他模式的选项，以及致命的配置或启动错误都会以非零状态退出。
 
-固定版本的 TUI 直接支持 Harness 动态配置设置：`/settings`、`/statusline`、`/keybindings` 及供应商配置使用当前 profile 的设置服务，显示偏好即时更新且保留当前会话。无需额外的 TUI 依赖补丁。
+随附的 TUI 直接支持 Harness 动态配置设置：`/settings`、`/statusline`、`/keybindings` 及供应商配置使用当前 profile 的设置服务，显示偏好即时更新且保留当前会话。构建使用相邻的 `dsh-TUI` 仓库；发布的 CLI 包在嵌入 runtime 中包含其编译前端、标准库和独立的 JavaScript 依赖。
 
 ## 入口模式
 
@@ -19,12 +19,15 @@
 | `chatcode-cli --profile sdk` | 通过 JSON-RPC stdio 为 SDK 客户端提供服务，直至关闭或断开连接。 |
 | `chatcode-cli --profile sdk-minimal` | 以独立极简 agent（智能体）配置树为 SDK 客户端提供服务。 |
 | `chatcode-cli web` / `cco web` | 启动 Web profile。 |
+| `cco web on` / `cco web off` | 启动或重新打开共用 Web 实例 / 关闭服务并释放端口。 |
 | `chatcode-cli plugin --profile <name> <pnpm args>` | 通过在 profile 目录中转发给 pnpm 来管理该 profile 的插件。 |
 | `chatcode-cli migrate --dry-run` | 输出旧版用户目录的只复制迁移计划。 |
 | `chatcode-cli migrate --apply` | 重新校验并应用计划，绝不覆盖目标数据。 |
 
 运行命令时所在的目录将作为默认 workspace 根目录。`web`、`headless`、`sdk`、`sdk-minimal` 和 `acp` profile 在首次使用时会从随附模板自动初始化。使用 `--from-default-profile` 可以基于这些模板之一，在尚未使用的非内置名称处创建其他 profile；通过 `chatcode-cli plugin` 则可以初始化一个以 base 为基础的 profile。`desktop` 名称保留给 Electron 持有的 profile，因此 CLI（命令行界面）会拒绝针对它的启动、配置 dump 和插件管理请求。
 
+`cco web` 和 `pnpm cco web` 默认为 `on`。首次启动在服务就绪后打开带认证 token 的 URL；同一 ChatCode CLI 用户目录中的后续启动会验证已有实例，获取并再次打印其当前有效认证链接，打开网页后退出，不绑定第二个端口。`off` 等待登记实例的端口关闭，不会按端口或 PID 杀死无关服务。私有登记位于 `$CHATCODE_CLI_HOME/web/instance.json`：没有实例或旧进程已退出时正常启动，仍存活但无法验证的实例安全拒绝。显式 `--port 0` 仍是隔离的随机端口启动。保留 `--no-open` 与 SSH 下不自动打开浏览器的行为；修改运行实例的参数或覆盖层需先关闭。链接包含访问权限，仅在对应服务进程存活期间有效，请勿分享。
+
 ## 应用参数
 
 启动器只解析自身的 flag，并将其后的所有内容交给已启动的 profile；注入该 profile 的任意应用插件都可以解析这份共享的不可变快照（[`dsh-cmdline`](../../packages/boot/cmdline/README.zh.md)）。启动器无法识别的第一个 token 标志着应用参数的开始：
@@ -39,13 +42,19 @@ chatcode-cli --help                          # the launcher's own help
 
 `-p` 与 `--print` 是兼容性例外：用于默认 `cli` profile 时，它们会选择随附的 `headless` profile，并保留在应用参数中供旧版语法解析。显式指定的自定义或非 CLI profile 仍自行拥有其 `-p` 选项。
 
+`cco --dangerously-skip-permissions` 在本次进程中放开文件访问范围，并自动批准工具权限请求；同时兼容 `--dangerouslv-skip-permissions` 拼写。它支持 TUI、Web、`--resume` 和 `-p`，不改写已存权限事件或 profile 设置，恢复会话也保持原记录。仅在可信工作区使用。账号登录、功能启用、操作系统授权和取消机制仍然有效。放在 `--` 后的参数按应用输入原样处理。
+
 headless profile 会加载与交互式 CLI 相同的 ChatCode 模型适配器，因此已保存的 `chatcode-codingplan`、`chatcode-maas` 或自定义 ChatCode 模型选择仍可用于 `-p` 调用。
 
+CLI、Web 和 headless 的 ChatCode 模型请求通过 profile 中的[持久化 LLM 重试执行器](../../packages/llm/llm-retry/README.zh.md)，对 HTTP 429 等暂时性错误执行有上限的指数退避恢复。ChatCode 模型组合包通过 `retryPolicy` 提供次数和退避策略；重试保持所选模型，取消或预算耗尽时停止。
+
 已安装的 `@deepseek-ai/dsh-headless` 包负责原生任务、`--json` 与 `--session-id` 接口。`@chatcode/chatcode-cli-test` 单独交付用于 `-p`、`--print`、`--output-format` 与 `--input-format` 的兼容覆盖层和运行器；这些参数会选择自有运行器，原生 headless 调用使用上游包。无需发布或修补私有版本的 `@deepseek-ai/dsh-headless`。
 
 <a id="profiles"></a>
 ## Profile
 
+`web` 和 `cli` profile 默认通过兼容别名 `dsh-computer-use` 加载 `@chatcode/cco-computer-use`；现有基于 base 的产品 profile 添加它时保留自定义插件与 patch。实时总开关位于 独立菜单 **设置 → 电脑操作** 和 TUI `/settings`，总开关默认关闭，开启前需确认。Web 与 CLI 将这一个值保存到 `$CHATCODE_CLI_HOME/cordis.patch.yml`（默认为 `~/.chatcode-cli/cordis.patch.yml`），实时同步并在重启后保留；关闭时只保留只读状态工具。浏览器自动化使用文本观察，原生 Cua Driver 后端自动选择 Windows、macOS 或 Linux 二进制。源码 checkout 使用 `pnpm plugins:local` 选择相邻仓库，使用 `pnpm plugins:registry` 选择精确线上版本；`pnpm build:computer-use` 只编译本地来源。先发布插件，再发布 CLI；安装后的 CLI 从 npm 获取插件，不依赖相邻源码目录。打包命令见[发布及开发指南](../../打包发布及开发指南.md)。
+
 profile 目录包含一个 `package.json`，其中记录树外插件依赖，以及 profile manifest（元数据清单）`dsh.profile`、其中按顺序排列的 `bundles` 列表；还包含一个 `cordis.patch.yml`，其中保存用户自己的 patch 层。在 YAML 中启用的 `dsh-hmr` 监视 profile manifest、profile 与 home 级 patch 文件，再通过统一串行重载重新组合所有层。未启用 HMR 时，更改在重启后生效。监听器注册期间发生的编辑与后续编辑使用相同的非致命重载错误报告。[插件管理器](../../packages/boot/plugin-manager/README.zh.md) 与 `chatcode-cli plugin` 共享包操作和 profile 写锁；更新依赖会保留已停用的组合包选择。CLI 包操作继承认证环境和终端描述符，支持交互式构建批准；service 调用保留清理后的环境并捕获诊断。
 
 安装和 profile 启动会按声明的 DSH peer 范围，检查与 `dsh --version` 显示值相同的运行时版本。不兼容插件需要用户明确确认精确版本豁免。[插件管理器的兼容性参考](../../packages/boot/plugin-manager/README.zh.md#version-compatibility-and-exemptions)说明 `version-exemptions`、`allow-version`、`revoke-version`、持久化规则与风险。
@@ -69,6 +78,8 @@ TUI 等待共用默认模型服务就绪后才创建首个会话。ChatCode 模
 
 设置 `CHATCODE_CLI_STARTUP_TRACE=1`，即可在运行 `cco` 或 `cco web` 时向 stderr 输出启动阶段与插件激活耗时。只有 `begin` 而没有对应耗时的条目表示尚未完成的工作。默认不启用诊断；日志只记录标签与耗时，不记录环境变量值或插件配置。
 
+产品覆盖层与命令行覆盖层如果解析到同一个物理文件，只应用一次，并保留首个路径及其相对资源解析基准。不同文件的覆盖层保留原有顺序与覆盖优先级。源码启动忽略打包留下的内嵌运行时暂存文件，解析当前工作区中的包。
+
 层的确切优先级、flag、关闭行为、部署默认值和源码执行方式，以 [CLI 行为参考](reference/README.zh.md)为准。[启动与重载失败表](../../packages/boot/app-boot/README.zh.md#startup-and-reload-failures)对比 optional、required 插件启动失败与配置 HMR 的行为。
 
 ## 可选覆盖层
@@ -79,6 +90,10 @@ TUI 等待共用默认模型服务就绪后才创建首个会话。ChatCode 模
 
 生产运行需要已构建的包与前端产物。请在仓库根目录单独运行 `pnpm run build`，然后使用 `pnpm cco <args...>` 运行 TypeScript 入口并转发所有参数；模块解析约定以[源码执行参考](reference/README.zh.md#source-execution)为准。
 
+在仓库根目录运行 `pnpm exec vitest run apps/cli/tests/chatcode-rate-limit.spec.ts apps/cli/tests/permission-bypass.spec.ts`，检查重试与启动权限行为。重试测试通过公开包入口挂载已安装的 `dsh-llm-chatcode-config` 插件，并为目录与模型 HTTP 请求提供 fixture 响应。
+
+TUI 适配层使用启动器自身的 schema 运行时校验其声明的动态配置字段，包括旧版 TUI schema 输出的 volatile 元数据，从而保持设置可编辑且不替换正在运行的会话。
+
 发布版 CLI 会直接固定 base/Web 组合包实际引用的所有 Harness 运行时包，以及随附 ChatCode 插件的全部必需 peer。发布时必须让这些依赖保持在同一个 Harness 版本：npm 全局安装不会保留 pnpm workspace 对 peer 的统一解析，否则可能把旧 ABI 提升到顶层并与当前运行时混用。
 
 npm 产物把分支自有的 JavaScript 包放在 `runtime/node_modules`，并通过 `runtime/manifest.json` 列出它们。各平台的 `node-addon-system` 二进制使用固定版本的 npm 可选依赖，由安装器按目标机器的平台选择，不加入内嵌 runtime。产物还在 `lib/dsh-ecosystem-spec` 中携带 TUI 准入注册表、协议和 schema；命令授权先从该目录读取权限默认值，再应用用户的授权文件。Profile 启动解析预设和插件时使用完整的运行时包列表，包括精简 npm 依赖列表中没有的包。启动器在内存中统一解析内嵌包的 ESM 与 CommonJS 导入，也覆盖外部插件的导入。启动不会修改安装目录，因此普通用户只需对 root 安装的目录具有读取权限；用户自己的 ChatCode CLI home 仍须可写。CLI 与 Web 共用[启动模型偏好](../../packages/core/agent-default-model/README.zh.md)；已运行的两端不会互相切换模型。

package/lib/bin.js

@@ -57,6 +57,7 @@ Examples:
   chatcode-cli headless "run the tests"     answer one task, print the result, and exit
   chatcode-cli cli --patch ./extra.yml      boot the CLI profile with one extra overlay
   chatcode-cli cli --resume <session>       arguments after launcher flags reach the app
+  cco --dangerously-skip-permissions        unrestricted file access and automatic tool approval
   chatcode-cli web --help                   the web app's own flags and help
   chatcode-cli plugin --profile cli add <package>
                                             install a plugin into the CLI profile
@@ -143,6 +144,19 @@ function isLegacyPrintInvocation(invocation) {
 * @returns the resolved invocation.
 */
 function parseChatCodeCliArgs(argv, version) {
+	const separator = argv.indexOf("--");
+	const optionEnd = separator === -1 ? argv.length : separator;
+	const management = argv[0] === "plugin" || argv[0] === "migrate";
+	let dangerouslySkipPermissions = false;
+	const launcherArgs = [];
+	for (const [index, argument] of argv.entries()) {
+		if (!management && index < optionEnd && (argument === "--dangerously-skip-permissions" || argument === "--dangerouslv-skip-permissions")) {
+			dangerouslySkipPermissions = true;
+			continue;
+		}
+		launcherArgs.push(argument);
+	}
+	argv = launcherArgs;
 	const first = argv[0];
 	let resolved;
 	const program = new Command();
@@ -191,7 +205,13 @@ function parseChatCodeCliArgs(argv, version) {
 	}
 	/* v8 ignore next -- an action resolves or Commander throws */
 	if (resolved === void 0) throw new Error("ChatCode CLI: no invocation resolved");
-	return routeLegacyPrint(resolved, argv);
+	const invocation = routeLegacyPrint(resolved, argv);
+	if (!dangerouslySkipPermissions || invocation.mode !== "profile") return invocation;
+	return {
+		...invocation,
+		dangerouslySkipPermissions: true,
+		args: isLegacyPrintInvocation(invocation) ? ["--dangerously-skip-permissions", ...invocation.args] : invocation.args
+	};
 }
 //#endregion
 //#region lib/types/bin.js
@@ -239,14 +259,45 @@ async function runCli() {
 			const { runProfile } = await import("./profile-boot.js");
 			finishProfileImport();
 			try {
-				await runProfile({
-					environment: loadLayeredEnv("ChatCode CLI"),
-					profile: invocation.profile,
-					fromDefaultProfile: invocation.fromDefaultProfile,
-					patchFiles: invocation.patches,
-					args: invocation.args
-				});
+				const environment = loadLayeredEnv("ChatCode CLI");
+				const start = async (webInstance, args) => {
+					await runProfile({
+						environment,
+						profile: invocation.profile,
+						fromDefaultProfile: invocation.fromDefaultProfile,
+						patchFiles: invocation.patches,
+						args,
+						webInstance,
+						dangerouslySkipPermissions: invocation.dangerouslySkipPermissions
+					});
+				};
+				if (invocation.profile === "web") {
+					const { runManagedWeb } = await import("./web-instance-B0jec7cq.js");
+					const { launchedThroughSsh } = await import("@deepseek-ai/dsh-launch-environment");
+					await runManagedWeb({
+						home: resolveChatCodeCliHome(),
+						args: invocation.args,
+						start,
+						print: (line) => {
+							process.stdout.write(`${line}\n`);
+						},
+						open: async (url) => {
+							if (launchedThroughSsh(environment)) return;
+							const { openWebBrowser } = await import("./web-browser-Vcgfdsv_.js");
+							try {
+								await openWebBrowser(url);
+							} catch (error) {
+								process.stderr.write(`${error instanceof Error ? error.message : String(error)}\n`);
+							}
+						}
+					});
+				} else await start(void 0, invocation.args);
 			} catch (error) {
+				const { WebUsageError } = await import("./web-instance-B0jec7cq.js");
+				if (error instanceof WebUsageError) {
+					process.exitCode = error.exitCode;
+					break;
+				}
 				if (!(error instanceof StartupError)) throw error;
 				await reportStartupFailure(error, {
 					home: resolveChatCodeCliHome(),
@@ -276,17 +327,17 @@ async function runCli() {
 			break;
 		}
 		case "plugin": {
-			const { runPlugin } = await import("./plugin-Cn-hyYY8.js");
+			const { runPlugin } = await import("./plugin-eJjD6r12.js");
 			process.exit(await runPlugin(invocation.profile, invocation.args));
 			break;
 		}
 		case "dump-config": {
-			const { runDumpConfig } = await import("./dump-config-CijLv_kn.js");
+			const { runDumpConfig } = await import("./dump-config-CyopmD85.js");
 			runDumpConfig(invocation.profile, invocation.defaultOnly, invocation.patches, invocation.fromDefaultProfile);
 			break;
 		}
 		case "dump-config-schema": {
-			const { runDumpConfigSchema } = await import("./dump-config-schema-CObLWWaW.js");
+			const { runDumpConfigSchema } = await import("./dump-config-schema-DM0fb6Ns.js");
 			await runDumpConfigSchema(invocation.profile, invocation.patches, invocation.fromDefaultProfile);
 			break;
 		}

package/lib/{command-errors-CBJRI2gy.js → command-errors-BkCHTQHj.js}

@@ -1,12 +1,12 @@
-import { a as compositionRoot, i as bindCallerEffect, o as concreteService, r as assertCallerContext, t as activationContext } from "./host-access-DeCjoRQP.js";
-import { a as declaresPermission, d as normalizePermissionScope, i as declaresObserverScope, m as scopeCovers, n as componentIdentityOf, o as requireComponentIdentity, p as rawScopeCovers, s as requiresContract, u as INTERCEPT_PERMISSIONS } from "./component-identity-DPdJglJO.js";
-import { B as createAdmissionCatalog, G as validateSetInput, H as validateDeleteOutput, K as validateSetOutput, L as TUI_DECISION_EVENT_NAMES, M as loadSpecData, N as registryEntries, P as verifyContractProfiles, S as DATA_DIR, U as validateGetInput, V as validateDeleteInput, W as validateGetOutput, X as defineProtocolDeclaration, Y as projectManifest, j as digestFile, p as cleanScalarText, q as validateMessageEvent, x as readGrantStore } from "./extension-events-Be9LWvHD.js";
+import { a as compositionRoot, i as bindCallerEffect, o as concreteService, r as assertCallerContext, t as activationContext } from "./host-access-Bk4xps5E.js";
+import { a as declaresPermission, d as normalizePermissionScope, i as declaresObserverScope, m as scopeCovers, n as componentIdentityOf, o as requireComponentIdentity, p as rawScopeCovers, s as requiresContract, u as INTERCEPT_PERMISSIONS } from "./component-identity-De91VHwW.js";
+import { B as createAdmissionCatalog, G as validateSetInput, H as validateDeleteOutput, K as validateSetOutput, L as TUI_DECISION_EVENT_NAMES, M as loadSpecData, N as registryEntries, P as verifyContractProfiles, S as DATA_DIR, U as validateGetInput, V as validateDeleteInput, W as validateGetOutput, X as defineProtocolDeclaration, Y as projectManifest, j as digestFile, p as cleanScalarText, q as validateMessageEvent, x as readGrantStore } from "./extension-events-CdYCRP0o.js";
 import { appendFileSync, mkdirSync, readFileSync } from "node:fs";
 import { fileURLToPath } from "node:url";
 import { dirname, join } from "node:path";
 import { Service } from "@deepseek-ai/cordis";
 import { withFileLock, writeFileAtomic } from "@deepseek-ai/dsh-atomic-write";
-//#region ../../node_modules/.pnpm/@chatcode+cco-tui@0.10.0-rc.16_08ea48c8555976e562c6368d51cb542b/node_modules/@chatcode/cco-tui/lib/types/plugin-spec/validate.js
+//#region ../../../dsh-TUI/lib/types/plugin-spec/validate.js
 /** Semantic validation layered on the official manifest parser/projection. */
 const coordinateKey$1 = (coordinate) => `${coordinate.apiVersion}#${coordinate.kind}`;
 const groupOf = (apiVersion) => apiVersion.split("/")[0] ?? "";
@@ -124,7 +124,7 @@ function validateHost(index, host) {
 	}
 }
 //#endregion
-//#region ../../node_modules/.pnpm/@chatcode+cco-tui@0.10.0-rc.16_08ea48c8555976e562c6368d51cb542b/node_modules/@chatcode/cco-tui/lib/types/plugin-spec/negotiate.js
+//#region ../../../dsh-TUI/lib/types/plugin-spec/negotiate.js
 /** Five-state admission decision using dsh-std projection and ProtocolCatalog. */
 const coordinateKey = (ref) => `${ref.apiVersion}#${ref.kind}`;
 function negotiate(index, manifest, host, grants = []) {
@@ -197,7 +197,7 @@ function negotiate(index, manifest, host, grants = []) {
 	} : { decision: "compatible" };
 }
 //#endregion
-//#region ../../node_modules/.pnpm/@chatcode+cco-tui@0.10.0-rc.16_08ea48c8555976e562c6368d51cb542b/node_modules/@chatcode/cco-tui/lib/types/plugin-spec/schema-check.js
+//#region ../../../dsh-TUI/lib/types/plugin-spec/schema-check.js
 /**
 * 零依赖 JSON Schema 校验器——上游 `conformance/tests/run.js` 的 check()
 * 的保真 TS 移植。刻意只实现 vendored schemas 用到的子集：本地 $ref、
@@ -301,7 +301,7 @@ function check(value, schema, rootSchema = schema, where = "$") {
 	}
 }
 //#endregion
-//#region ../../node_modules/.pnpm/@chatcode+cco-tui@0.10.0-rc.16_08ea48c8555976e562c6368d51cb542b/node_modules/@chatcode/cco-tui/lib/types/dsh-adapter/host-descriptor.js
+//#region ../../../dsh-TUI/lib/types/dsh-adapter/host-descriptor.js
 /** Build the current ChatCode CLI TUI Host Descriptor from the pinned admission profile. */
 const HOST_SUPPORTED_CONTRACTS = Object.freeze([
 	{
@@ -453,7 +453,7 @@ function buildHostDescriptor(options) {
 	});
 }
 //#endregion
-//#region ../../node_modules/.pnpm/@chatcode+cco-tui@0.10.0-rc.16_08ea48c8555976e562c6368d51cb542b/node_modules/@chatcode/cco-tui/lib/types/dsh-adapter/effect-ledger.js
+//#region ../../../dsh-TUI/lib/types/dsh-adapter/effect-ledger.js
 /**
 * Effect ledger (C-060): an append-only JSONL journal of plugin-visible
 * effects at `~/.chatcode-cli/tui/effect-ledger.jsonl`, mounted by the
@@ -645,7 +645,7 @@ function resumeSequence(file) {
 	return max + 1;
 }
 //#endregion
-//#region ../../node_modules/.pnpm/@chatcode+cco-tui@0.10.0-rc.16_08ea48c8555976e562c6368d51cb542b/node_modules/@chatcode/cco-tui/lib/types/dsh-adapter/plugin-storage.js
+//#region ../../../dsh-TUI/lib/types/dsh-adapter/plugin-storage.js
 /**
 * storage.local contract surface (C-040, `storage.dsh/v1alpha1#LocalStorage`):
 * per-plugin private persistence, mounted by the dsh-tui-plugin-host row as
@@ -986,7 +986,7 @@ var TuiPluginStorageRuntime = class extends Service {
 	}
 };
 //#endregion
-//#region ../../node_modules/.pnpm/@chatcode+cco-tui@0.10.0-rc.16_08ea48c8555976e562c6368d51cb542b/node_modules/@chatcode/cco-tui/lib/types/dsh-adapter/message-observer.js
+//#region ../../../dsh-TUI/lib/types/dsh-adapter/message-observer.js
 /**
 * messages.observe contract surface (C-042,
 * `messages.dsh/v1alpha1#MessageObserver`): the host event broker, mounted
@@ -1494,7 +1494,7 @@ function observerStateFor(runtime) {
 	return state;
 }
 //#endregion
-//#region ../../node_modules/.pnpm/@chatcode+cco-tui@0.10.0-rc.16_08ea48c8555976e562c6368d51cb542b/node_modules/@chatcode/cco-tui/lib/types/dsh-adapter/command-attribution.js
+//#region ../../../dsh-TUI/lib/types/dsh-adapter/command-attribution.js
 /**
 * Command ownership attribution — the data source for the C-041 invoke
 * checkpoint's per-owner grant decision.
@@ -1572,7 +1572,7 @@ function commandOwner(ctx, definition) {
 	return ownerMaps.get(key)?.get(handler);
 }
 //#endregion
-//#region ../../node_modules/.pnpm/@chatcode+cco-tui@0.10.0-rc.16_08ea48c8555976e562c6368d51cb542b/node_modules/@chatcode/cco-tui/lib/types/dsh-adapter/command-errors.js
+//#region ../../../dsh-TUI/lib/types/dsh-adapter/command-errors.js
 /**
 * commands contract error-code alignment (C-041,
 * `commands.dsh/v1alpha1#Command`): the official `dsh-commands` runtime

package/lib/{command-trees-Dvq4C7a4.js → command-trees-5HFyC5sI.js}

@@ -1,6 +1,6 @@
-import { a as compositionRoot, i as bindCallerEffect, n as activationFiber, o as concreteService, s as requirePluginCaller } from "./host-access-DeCjoRQP.js";
+import { a as compositionRoot, i as bindCallerEffect, n as activationFiber, o as concreteService, s as requirePluginCaller } from "./host-access-Bk4xps5E.js";
 import { Service } from "@deepseek-ai/cordis";
-//#region ../../node_modules/.pnpm/@chatcode+cco-tui@0.10.0-rc.16_08ea48c8555976e562c6368d51cb542b/node_modules/@chatcode/cco-tui/lib/types/dsh-adapter/command-trees.js
+//#region ../../../dsh-TUI/lib/types/dsh-adapter/command-trees.js
 /** Provider-neutral subcommand completion registry for terminal front doors. */
 const name = "dsh-tui-command-trees";
 /** Small host-only registry; command execution remains owned by dsh-commands. */

package/lib/{component-identity-DPdJglJO.js → component-identity-De91VHwW.js}

@@ -1,6 +1,6 @@
-import { i as bindCallerEffect, n as activationFiber } from "./host-access-DeCjoRQP.js";
+import { i as bindCallerEffect, n as activationFiber } from "./host-access-Bk4xps5E.js";
 import { randomUUID } from "node:crypto";
-//#region ../../node_modules/.pnpm/@chatcode+cco-tui@0.10.0-rc.16_08ea48c8555976e562c6368d51cb542b/node_modules/@chatcode/cco-tui/lib/types/plugin-spec/permission-scope.js
+//#region ../../../dsh-TUI/lib/types/plugin-spec/permission-scope.js
 /** Permission scope normalization shared by admission and runtime checks. */
 const STORAGE_PERMISSIONS = new Set(["storage.local.read", "storage.local.write"]);
 const INTERCEPT_PERMISSIONS = new Set([
@@ -76,7 +76,7 @@ function rawScopeCovers(permission, declared, actual, componentId) {
 	return normalizedDeclared !== void 0 && normalizedActual !== void 0 && permissionScopeCovers(permission, normalizedDeclared, normalizedActual);
 }
 //#endregion
-//#region ../../node_modules/.pnpm/@chatcode+cco-tui@0.10.0-rc.16_08ea48c8555976e562c6368d51cb542b/node_modules/@chatcode/cco-tui/lib/types/dsh-adapter/component-identity.js
+//#region ../../../dsh-TUI/lib/types/dsh-adapter/component-identity.js
 /** Verified Component identity bound to one Cordis activation owner. */
 var ComponentIdentityError = class extends Error {
 	code;