@cjhyy/code-shell-core 0.6.0-rc.8 → 0.7.0-beta.1

package/dist/protocol/server.js

@@ -24,8 +24,22 @@ import { backgroundJobRegistry } from "../tool-system/builtin/background-jobs.js
 import { listBackgroundWorkForUI } from "../tool-system/builtin/background-work.js";
 import { logger } from "../logging/logger.js";
 import { nanoid } from "nanoid";
+import { SessionManager } from "../session/session-manager.js";
 import { redactLlmConfig, maskSecretValue } from "./redact.js";
 import { redactSecrets } from "../logging/sanitize-messages.js";
+const COMPACT_STREAM_STRATEGIES = new Set([
+    "micro",
+    "summary",
+    "window",
+    "snip",
+    "emergency",
+    "compacted",
+]);
+function toCompactStreamStrategy(strategy) {
+    return COMPACT_STREAM_STRATEGIES.has(strategy)
+        ? strategy
+        : "compacted";
+}
 export class AgentServer {
     chatManager;
     legacyEngine;
@@ -35,6 +49,15 @@ export class AgentServer {
     settingsReader;
     /** Disk-only active-goal reader for agent/goalGet on a non-live session. */
     readActiveGoalFromDisk;
+    workspaceBridgeEnabled;
+    /**
+     * Last per-session EngineConfigSlice supplied by agent/run. Kept even after
+     * idle eviction so background-completion wakeups can rebuild the ChatSession
+     * with the same cwd/permission/trust inputs before draining the queue.
+     */
+    lastSliceBySession = new Map();
+    /** Lazy disk reader for cold wakeup rehydrate when this process lacks a slice. */
+    diskSessionReader = null;
     /**
      * Monotonic config-reload version, bumped per reloadSettings request so each
      * Engine.refreshRuntimeConfig can drop out-of-order (stale) deliveries (Q5).
@@ -60,6 +83,14 @@ export class AgentServer {
     approvalTimers = new Map();
     /** Default approval timeout: 5 minutes */
     static APPROVAL_TIMEOUT_MS = 5 * 60 * 1000;
+    /**
+     * Wall-clock timeout for AskUserQuestion during a GOAL run (10 minutes).
+     * Plain interactive asks stay untimed; only a self-driving goal run arms this
+     * so a mid-goal question can't suspend the loop forever with nobody watching.
+     * Longer than the tool-approval timeout — a user who IS present deserves more
+     * time to compose a real answer before we assume-and-continue.
+     */
+    static GOAL_ASKUSER_TIMEOUT_MS = 10 * 60 * 1000;
     /**
      * Unsubscribe handle for the process-local `agentNotificationBus`
      * subscription set up in the constructor. Called from `close()` so a
@@ -72,6 +103,7 @@ export class AgentServer {
         this.legacyEngine = options.engine ?? null;
         this.settingsReader = options.settingsReader ?? null;
         this.readActiveGoalFromDisk = options.readActiveGoalFromDisk ?? null;
+        this.workspaceBridgeEnabled = options.workspaceBridge === true;
         if (!this.chatManager && !this.legacyEngine) {
             throw new Error("AgentServer: either chatManager or engine must be supplied");
         }
@@ -156,7 +188,7 @@ export class AgentServer {
     maybeWakeIdleSession(sessionId) {
         if (!this.chatManager)
             return;
-        const session = this.chatManager.get(sessionId);
+        const session = this.chatManager.get(sessionId) ?? this.rehydrateSessionForWake(sessionId);
         if (!session || session.isBusy())
             return;
         // Headless / automation runs are one-shot: the caller takes result.text and
@@ -216,6 +248,76 @@ export class AgentServer {
             this.maybeWakeIdleSession(sessionId);
         });
     }
+    rehydrateSessionForWake(sessionId) {
+        if (!this.chatManager)
+            return null;
+        try {
+            const pending = notificationQueue.getSnapshot(sessionId);
+            if (pending.length === 0) {
+                logger.debug("bg_wakeup.rehydrate_skipped_no_pending", { sessionId });
+                return null;
+            }
+            const slice = this.sliceForWakeRehydrate(sessionId);
+            if (!slice) {
+                logger.warn("bg_wakeup.rehydrate_skipped_missing_disk_session", {
+                    sessionId,
+                    pendingCount: pending.length,
+                    reason: "state_json_cwd_missing",
+                });
+                return null;
+            }
+            if (!this.chatManager.sessionExistsOnDisk(sessionId, slice)) {
+                logger.warn("bg_wakeup.rehydrate_skipped_missing_disk_session", {
+                    sessionId,
+                    pendingCount: pending.length,
+                });
+                return null;
+            }
+            const session = this.chatManager.getOrCreate(sessionId, slice);
+            this.wireInteractiveSession(session, sessionId);
+            logger.debug("bg_wakeup.rehydrated_session", {
+                sessionId,
+                pendingCount: pending.length,
+                source: this.lastSliceBySession.has(sessionId) ? "last_slice" : "state_json",
+            });
+            return session;
+        }
+        catch (err) {
+            logger.warn("bg_wakeup.rehydrate_failed", {
+                sessionId,
+                error: err instanceof Error ? err.message : String(err),
+            });
+            return null;
+        }
+    }
+    sliceForWakeRehydrate(sessionId) {
+        const cached = this.lastSliceBySession.get(sessionId);
+        if (cached)
+            return { ...cached };
+        if (!this.diskSessionReader)
+            this.diskSessionReader = new SessionManager();
+        const cwd = this.diskSessionReader.readCwd(sessionId);
+        if (!cwd)
+            return null;
+        return {
+            permissionMode: "default",
+            projectTrusted: false,
+            cwd,
+        };
+    }
+    rememberSessionSlice(sessionId, slice) {
+        this.lastSliceBySession.set(sessionId, { ...slice });
+    }
+    wireInteractiveSession(session, sid) {
+        if (session.engine.isHeadless())
+            return;
+        session.engine.setAskUser((question, opts) => this.requestAskUserForSession(session, sid, question, opts));
+        session.engine.setBrowserBridge(this.makeBrowserBridge(session, sid));
+        session.engine.setInjectCredential((credentialId, credentialScope) => this.requestCredentialInjectForSession(session, sid, credentialId, credentialScope));
+        if (this.workspaceBridgeEnabled && typeof session.engine.setWorkspaceBridge === "function") {
+            session.engine.setWorkspaceBridge(this.makeWorkspaceBridge(session, sid));
+        }
+    }
     // ─── Request Dispatch ───────────────────────────────────────────
     async handleRequest(req) {
         switch (req.method) {
@@ -246,6 +348,9 @@ export class AgentServer {
             case Methods.CloseSession:
                 this.handleCloseSession(req);
                 break;
+            case Methods.ReleaseWorkspace:
+                this.handleReleaseWorkspace(req);
+                break;
             case Methods.GoalExtend:
                 this.handleGoalExtend(req);
                 break;
@@ -285,28 +390,39 @@ export class AgentServer {
             this.transport.send(createErrorResponse(req.id, ErrorCodes.InvalidParams, "task is required"));
             return;
         }
+        const sessionConfig = {
+            permissionMode: params.permissionMode,
+            cwd: params.cwd,
+            projectTrusted: params.projectTrusted,
+            goal: typeof params.goal === "string" || (params.goal != null && typeof params.goal === "object")
+                ? params.goal
+                : undefined,
+        };
+        if (params.requireExisting === true && !cm.get(params.sessionId)) {
+            let existsOnDisk = false;
+            try {
+                existsOnDisk = cm.sessionExistsOnDisk(params.sessionId, sessionConfig);
+            }
+            catch (err) {
+                const code = err.code ?? ErrorCodes.InternalError;
+                this.transport.send(createErrorResponse(req.id, code, err.message));
+                return;
+            }
+            if (!existsOnDisk) {
+                this.transport.send(createErrorResponse(req.id, ErrorCodes.SessionNotFound, `session ${params.sessionId} does not exist`));
+                return;
+            }
+        }
         let session;
         try {
-            session = cm.getOrCreate(params.sessionId, {
-                permissionMode: params.permissionMode,
-                cwd: params.cwd,
-                projectTrusted: params.projectTrusted,
-            });
+            session = cm.getOrCreate(params.sessionId, sessionConfig);
         }
         catch (err) {
             const code = err.code ?? ErrorCodes.InternalError;
             this.transport.send(createErrorResponse(req.id, code, err.message));
             return;
         }
-        // `requireExisting`: reject if the target session isn't on disk rather than
-        // running the prompt against a freshly-created blank session. A cron
-        // "continue this conversation" job whose session the user deleted must fail
-        // loudly here (SessionNotFound) so the scheduler can auto-disable it,
-        // instead of silently executing with no transcript/goal/context.
-        if (params.requireExisting === true && !session.engine.sessionExistsOnDisk(params.sessionId)) {
-            this.transport.send(createErrorResponse(req.id, ErrorCodes.SessionNotFound, `session ${params.sessionId} does not exist`));
-            return;
-        }
+        this.rememberSessionSlice(params.sessionId, sessionConfig);
         if (params.model !== undefined) {
             if (typeof params.model !== "string" || params.model.length === 0) {
                 this.transport.send(createErrorResponse(req.id, ErrorCodes.InvalidParams, "model must be a non-empty string"));
@@ -324,34 +440,20 @@ export class AgentServer {
             session.engine.setPlanMode(params.planMode);
         }
         const sid = params.sessionId;
-        // Wire AskUserQuestion for this interactive session. The chatManager path
-        // builds a fresh per-session Engine via engineFactory, which (unlike the
-        // legacy single-engine path) never had askUser wired — so AskUserQuestion
-        // always fell into its "not available in headless mode" branch in normal
-        // chat (and in a resumed automation session). Route it to the client with
-        // this session's id so the renderer attributes the question to the right
-        // tab, resolving via the session's own pendingApprovals. Skip genuinely
-        // headless engines (no human to answer).
-        if (!session.engine.isHeadless()) {
-            session.engine.setAskUser((question, opts) => this.requestAskUserForSession(session, sid, question, opts));
-            // Browser automation bridge: each method routes a browser action to the
-            // client (Electron main drives the webview via CDP) over the SAME
-            // request/response channel as askUser (pendingApprovals + requestId),
-            // reusing its proven resolve/timeout/cleanup. The main-side handler
-            // replies with the action's JSON result.
-            session.engine.setBrowserBridge(this.makeBrowserBridge(session, sid));
-            // Cookie→browser injection (InjectCredential tool): same cross-process
-            // channel; main restores the cookie jar into the built-in browser.
-            session.engine.setInjectCredential((credentialId) => this.requestCredentialInjectForSession(session, sid, credentialId));
-        }
+        // Wire AskUserQuestion and host bridges for this interactive session. The
+        // chatManager path builds a fresh per-session Engine via engineFactory, so
+        // these host callbacks must be installed after every create/recreate.
+        this.wireInteractiveSession(session, sid);
         try {
             const result = await session.enqueueTurn(params.task, {
                 cwd: params.cwd,
+                attachments: Array.isArray(params.attachments) ? params.attachments : undefined,
                 goal: typeof params.goal === "string" ||
                     (params.goal != null && typeof params.goal === "object")
                     ? params.goal
                     : undefined,
                 onStream: (event) => this.notify(Methods.StreamEvent, { sessionId: sid, event }),
+                clientMessageId: typeof params.clientMessageId === "string" ? params.clientMessageId : undefined,
             });
             const runResult = {
                 text: result.text,
@@ -431,6 +533,7 @@ export class AgentServer {
                 sessionId: params.sessionId,
                 signal: runController.signal,
                 onStream: streamToClient,
+                clientMessageId: typeof params.clientMessageId === "string" ? params.clientMessageId : undefined,
                 goal: typeof params.goal === "string" ||
                     (params.goal != null && typeof params.goal === "object")
                     ? params.goal
@@ -452,9 +555,7 @@ export class AgentServer {
             // the user already knows they pressed stop; clients should
             // just clear busy.
             const errName = err.name;
-            const aborted = runController.signal.aborted ||
-                errName === "AbortError" ||
-                errName === "APIUserAbortError";
+            const aborted = runController.signal.aborted || errName === "AbortError" || errName === "APIUserAbortError";
             if (aborted) {
                 const cancelledResult = {
                     text: "",
@@ -478,7 +579,10 @@ export class AgentServer {
     // ─── Approve ────────────────────────────────────────────────────
     handleApprove(req) {
         const params = (req.params ?? {});
-        // ChatSessionManager path: look up per-session pendingApprovals
+        // ChatSessionManager path: approvals are scoped by (sessionId, requestId).
+        // Never fall back from a session-tagged response to the legacy global map:
+        // a stale/misrouted UI response must fail closed instead of resolving a
+        // pending prompt from another session.
         if (this.chatManager && typeof params.sessionId === "string") {
             const s = this.chatManager.get(params.sessionId);
             if (!s) {
@@ -487,25 +591,13 @@ export class AgentServer {
             }
             const resolve = s.pendingApprovals.get(params.requestId);
             if (!resolve) {
-                // Tool approvals still resolve through the interactive backend's
-                // legacy pending map; the sessionId on their envelope is UI routing
-                // metadata. Accept a session-tagged response for those requests too.
-                const legacyResolve = this.pendingApprovals.get(params.requestId);
-                if (!legacyResolve) {
-                    this.transport.send(createErrorResponse(req.id, ErrorCodes.InvalidParams, `No pending approval: ${params.requestId}`));
-                    return;
-                }
-                this.pendingApprovals.delete(params.requestId);
-                this.clearApprovalTimer(params.requestId);
-                legacyResolve(params.decision);
-                this.transport.send(createResponse(req.id, { ok: true }));
+                this.transport.send(createErrorResponse(req.id, ErrorCodes.InvalidParams, `No pending approval for session ${params.sessionId}: ${params.requestId}`));
                 return;
             }
             s.pendingApprovals.delete(params.requestId);
-            // Cancel the pending timeout for THIS request (the ask path armed one).
-            // The legacy single-engine branch below already does this; without it
-            // here a decided request leaves a live timer that fires at
-            // APPROVAL_TIMEOUT_MS and churns a dead map entry.
+            // Cancel the pending timeout for requests that arm one (browser actions,
+            // credential injection, and tool approvals). AskUserQuestion does not use
+            // a timeout; this is harmless for those request ids.
             this.clearApprovalTimer(params.requestId);
             resolve(params.decision);
             this.transport.send(createResponse(req.id, { ok: true }));
@@ -539,11 +631,10 @@ export class AgentServer {
             s.cancel();
             // s.cancel() only aborts the engine controller + drains queued turns. The
             // session's pendingApprovals (askUser / browser_action / tool approvals)
-            // are NOT driven by the abort signal — they only settle on a client reply
-            // or the 5-minute APPROVAL_TIMEOUT_MS. Left alone, the awaiting tool call
-            // hangs until that timeout (delaying run wind-down) and the server-side
-            // approvalTimers entry leaks. Resolve them as cancelled now and clear the
-            // matching timers, mirroring the legacy path below.
+            // are NOT driven directly by the abort signal. Left alone, an awaiting
+            // AskUserQuestion would now wait forever, while bounded request types
+            // would wait until APPROVAL_TIMEOUT_MS. Resolve them as cancelled now and
+            // clear any matching timers, mirroring the legacy path below.
             this.cancelSessionApprovals(s);
             this.transport.send(createResponse(req.id, { ok: true }));
             return;
@@ -618,6 +709,12 @@ export class AgentServer {
             : params.sessionId
                 ? (this.legacyEngine.clearGoal(params.sessionId) ?? false)
                 : false;
+        if (cleared && typeof params.sessionId === "string" && params.sessionId.length > 0) {
+            this.notify(Methods.StreamEvent, {
+                sessionId: params.sessionId,
+                event: { type: "goal_cleared" },
+            });
+        }
         this.transport.send(createResponse(req.id, { ok: true, cleared }));
     }
     /**
@@ -715,7 +812,8 @@ export class AgentServer {
             this.transport.send(createErrorResponse(req.id, ErrorCodes.InvalidParams, "sessionId is required"));
             return;
         }
-        const items = listBackgroundWorkForUI(sessionId);
+        const scope = params.scope === "all" ? "all" : "session";
+        const items = listBackgroundWorkForUI(sessionId, { scope });
         this.transport.send(createResponse(req.id, { items }));
     }
     // ─── CloseSession ───────────────────────────────────────────────
@@ -726,6 +824,10 @@ export class AgentServer {
             return;
         }
         if (this.chatManager) {
+            const session = this.chatManager.get(params.sessionId);
+            if (session) {
+                this.cancelSessionApprovals(session, "session closed");
+            }
             this.chatManager.close(params.sessionId);
         }
         // Explicit session teardown — reap that session's background shells
@@ -738,6 +840,28 @@ export class AgentServer {
         backgroundJobRegistry.dropForSession(params.sessionId);
         this.transport.send(createResponse(req.id, { ok: true }));
     }
+    // ─── ReleaseWorkspace ──────────────────────────────────────────
+    handleReleaseWorkspace(req) {
+        const params = (req.params ?? {});
+        if (typeof params.sessionId !== "string" || params.sessionId.length === 0) {
+            this.transport.send(createErrorResponse(req.id, ErrorCodes.InvalidParams, "sessionId is required"));
+            return;
+        }
+        if (this.chatManager) {
+            const session = this.chatManager.get(params.sessionId);
+            if (!session) {
+                this.transport.send(createResponse(req.id, { ok: true, workspace: null }));
+                return;
+            }
+            const engine = session.engine;
+            const workspace = engine.releaseSessionWorkspace?.(params.sessionId) ?? null;
+            this.transport.send(createResponse(req.id, { ok: true, workspace }));
+            return;
+        }
+        const engine = this.legacyEngine;
+        const workspace = engine?.releaseSessionWorkspace?.(params.sessionId) ?? null;
+        this.transport.send(createResponse(req.id, { ok: true, workspace }));
+    }
     // ─── Configure ──────────────────────────────────────────────────
     handleConfigure(req) {
         const params = (req.params ?? {});
@@ -1031,7 +1155,19 @@ export class AgentServer {
                     return;
                 }
                 try {
-                    const result = compactEngine.forceCompact(compactSessionId);
+                    const result = await compactEngine.forceCompact(compactSessionId);
+                    if (result.before > result.after) {
+                        const event = {
+                            type: "context_compact",
+                            strategy: toCompactStreamStrategy(result.strategy),
+                            before: result.before,
+                            after: result.after,
+                        };
+                        this.notify(Methods.StreamEvent, {
+                            sessionId: compactSessionId ?? "",
+                            event,
+                        });
+                    }
                     this.transport.send(createResponse(req.id, {
                         type: "compact",
                         data: result,
@@ -1218,8 +1354,7 @@ export class AgentServer {
                     const key = params.key;
                     if (!key)
                         throw new Error("provider_refresh: key required");
-                    const providers = engine.readSetting("providers") ??
-                        [];
+                    const providers = engine.readSetting("providers") ?? [];
                     const p = providers.find((x) => x.key === key);
                     if (!p)
                         throw new Error(`provider not found: ${key}`);
@@ -1255,8 +1390,7 @@ export class AgentServer {
                     if (refs.length > 0) {
                         throw new Error(`provider ${key} referenced by models: ${refs.join(", ")}`);
                     }
-                    const providers = engine.readSetting("providers") ??
-                        [];
+                    const providers = engine.readSetting("providers") ?? [];
                     const next = providers.filter((p) => p.key !== key);
                     engine.updateConfig("providers", next);
                     this.transport.send(createResponse(req.id, { type: "provider_delete", data: { ok: true } }));
@@ -1359,8 +1493,8 @@ export class AgentServer {
             return;
         }
         try {
-            engine.enqueueSteer(params.sessionId, params.text, params.id);
-            this.transport.send(createResponse(req.id, { ok: true }));
+            const result = engine.enqueueSteer(params.sessionId, params.text, params.id, params.clientMessageId);
+            this.transport.send(createResponse(req.id, { ok: true, ...result }));
         }
         catch (err) {
             this.transport.send(createErrorResponse(req.id, ErrorCodes.InternalError, err.message));
@@ -1397,10 +1531,23 @@ export class AgentServer {
         return new Promise((resolve) => {
             const requestId = nanoid(12);
             const sessionId = typeof request.sessionId === "string" ? request.sessionId : undefined;
-            this.pendingApprovals.set(requestId, resolve);
+            const session = this.chatManager && sessionId ? this.chatManager.get(sessionId) : undefined;
+            if (this.chatManager && sessionId && !session) {
+                resolve({ approved: false, reason: `session closed: ${sessionId}` });
+                return;
+            }
+            if (session) {
+                session.pendingApprovals.set(requestId, (decision) => {
+                    resolve(decision);
+                });
+            }
+            else {
+                this.pendingApprovals.set(requestId, resolve);
+            }
             const timer = setTimeout(() => {
-                if (this.pendingApprovals.has(requestId)) {
-                    this.pendingApprovals.delete(requestId);
+                const pending = session?.pendingApprovals ?? this.pendingApprovals;
+                if (pending.has(requestId)) {
+                    pending.delete(requestId);
                     this.approvalTimers.delete(requestId);
                     resolve({ approved: false, reason: "approval timed out" });
                 }
@@ -1414,14 +1561,11 @@ export class AgentServer {
         });
     }
     /**
-     * Ask the client to answer a question from the agent (legacy single-engine path).
-     */
-    /**
-     * Per-session AskUserQuestion for the chatManager path. Mirrors
-     * requestAskUserFromClient but resolves via the SESSION's pendingApprovals
-     * (the chatManager approve handler looks there, keyed by sessionId+requestId)
-     * and tags the notify with sessionId so the renderer routes the question to
-     * the right chat tab.
+     * Per-session AskUserQuestion for the chatManager path. Resolves via the
+     * SESSION's pendingApprovals (the chatManager approve handler looks there,
+     * keyed by sessionId+requestId) and tags the notify with sessionId so the
+     * renderer routes the question to the right chat tab. This intentionally has
+     * no wall-clock timeout; Stop/cancel drains the pending ask.
      */
     requestAskUserForSession(session, sessionId, question, opts) {
         return new Promise((resolve) => {
@@ -1430,21 +1574,15 @@ export class AgentServer {
                 this.clearApprovalTimer(requestId);
                 const result = decision;
                 if (result && typeof result === "object" && "approved" in result) {
-                    resolve(result.approved ? (result.answer ?? "") : (result.reason ?? "(user declined to answer)"));
+                    resolve(result.approved
+                        ? (result.answer ?? "")
+                        : (result.reason ?? "(user declined to answer)"));
                 }
                 else {
                     // chatManager approve handler resolves with the raw decision value.
                     resolve(typeof decision === "string" ? decision : "");
                 }
             });
-            const timer = setTimeout(() => {
-                if (session.pendingApprovals.has(requestId)) {
-                    session.pendingApprovals.delete(requestId);
-                    this.approvalTimers.delete(requestId);
-                    resolve("(approval timed out)");
-                }
-            }, AgentServer.APPROVAL_TIMEOUT_MS);
-            this.approvalTimers.set(requestId, timer);
             const args = { question };
             if (opts?.header !== undefined)
                 args.header = opts.header;
@@ -1464,6 +1602,37 @@ export class AgentServer {
                     riskLevel: "low",
                 },
             });
+            // Goal mode is an unattended, self-driving run: nobody may be watching to
+            // answer, and this ask channel otherwise has NO wall-clock timeout — so a
+            // model that calls AskUserQuestion mid-goal would suspend the turn loop
+            // forever (only a manual Stop could unblock it). When a goal is active,
+            // arm the shared 10-minute approval timeout: on expiry, drain the pending
+            // ask and resolve with a nudge so the loop keeps making progress instead
+            // of hanging. Plain interactive (no-goal) asks keep their intentional
+            // no-timeout behavior — a human can take as long as they like.
+            let goalActive;
+            try {
+                goalActive = !!session.getGoal();
+            }
+            catch {
+                goalActive = false;
+            }
+            if (goalActive) {
+                const timer = setTimeout(() => {
+                    const resolveFn = session.pendingApprovals.get(requestId);
+                    if (resolveFn) {
+                        session.pendingApprovals.delete(requestId);
+                        this.approvalTimers.delete(requestId);
+                        resolveFn("(用户未在限定时间内回答;目标运行中请自行做出合理假设并继续推进。)");
+                        // Tell every client the ask is resolved (nobody answered) so the
+                        // stale AskUserQuestion card is dismissed instead of lingering as
+                        // if still waiting. Reuses the same envelope shape the desktop main
+                        // already broadcasts / the renderer's onApprovalResolved consumes.
+                        this.notify(Methods.ApprovalResolved, { sessionId, requestId });
+                    }
+                }, AgentServer.GOAL_ASKUSER_TIMEOUT_MS);
+                this.approvalTimers.set(requestId, timer);
+            }
         });
     }
     /**
@@ -1545,7 +1714,7 @@ export class AgentServer {
      * calls restoreCookiesToBrowser and replies with a JSON result string we
      * parse into { ok, count?, error? }. Degrades to ok:false on timeout/malformed.
      */
-    requestCredentialInjectForSession(session, sessionId, credentialId) {
+    requestCredentialInjectForSession(session, sessionId, credentialId, credentialScope = "full") {
         return new Promise((resolve) => {
             const requestId = nanoid(12);
             session.pendingApprovals.set(requestId, (decision) => {
@@ -1582,13 +1751,72 @@ export class AgentServer {
                 requestId,
                 request: {
                     toolName: "__credential_action__",
-                    args: { action: "injectCookie", credentialId },
+                    args: { action: "injectCookie", credentialId, credentialScope },
                     description: `credential:inject:${credentialId}`,
                     riskLevel: "low",
                 },
             });
         });
     }
+    makeWorkspaceBridge(session, sessionId) {
+        return {
+            switch: (target) => this.requestWorkspaceSwitchForSession(session, sessionId, target),
+        };
+    }
+    requestWorkspaceSwitchForSession(session, sessionId, target) {
+        return new Promise((resolve, reject) => {
+            const requestId = nanoid(12);
+            session.pendingApprovals.set(requestId, (decision) => {
+                this.clearApprovalTimer(requestId);
+                let raw;
+                if (decision && typeof decision === "object" && "approved" in decision) {
+                    const r = decision;
+                    raw = r.approved ? r.answer : undefined;
+                }
+                else if (typeof decision === "string") {
+                    raw = decision;
+                }
+                if (raw === undefined) {
+                    reject(new Error("workspace switch declined or unavailable"));
+                    return;
+                }
+                try {
+                    const parsed = JSON.parse(raw);
+                    if ("ok" in parsed && parsed.ok === false) {
+                        reject(new Error(parsed.error ?? "workspace switch failed"));
+                        return;
+                    }
+                    resolve(parsed);
+                }
+                catch {
+                    reject(new Error("malformed workspace switch result"));
+                }
+            });
+            const timer = setTimeout(() => {
+                if (session.pendingApprovals.has(requestId)) {
+                    session.pendingApprovals.delete(requestId);
+                    this.approvalTimers.delete(requestId);
+                    reject(new Error("workspace switch timed out"));
+                }
+            }, AgentServer.APPROVAL_TIMEOUT_MS);
+            this.approvalTimers.set(requestId, timer);
+            this.notify(Methods.ApprovalRequest, {
+                sessionId,
+                requestId,
+                request: {
+                    toolName: "__workspace_action__",
+                    args: { action: "switch", target },
+                    description: `workspace:switch:${target}`,
+                    riskLevel: "low",
+                },
+            });
+        });
+    }
+    /**
+     * Ask the client to answer a question from the agent (legacy single-engine
+     * path). This intentionally has no wall-clock timeout; Stop/cancel drains
+     * the pending ask.
+     */
     requestAskUserFromClient(question, opts) {
         return new Promise((resolve) => {
             const requestId = nanoid(12);
@@ -1601,14 +1829,6 @@ export class AgentServer {
                     resolve(result.reason ?? "(user declined to answer)");
                 }
             });
-            const timer = setTimeout(() => {
-                if (this.pendingApprovals.has(requestId)) {
-                    this.pendingApprovals.delete(requestId);
-                    this.approvalTimers.delete(requestId);
-                    resolve("(approval timed out)");
-                }
-            }, AgentServer.APPROVAL_TIMEOUT_MS);
-            this.approvalTimers.set(requestId, timer);
             const args = { question };
             if (opts?.header !== undefined)
                 args.header = opts.header;
@@ -1670,6 +1890,9 @@ export class AgentServer {
             this.bgAgentBusUnsubscribe = null;
         }
         if (this.chatManager) {
+            this.chatManager.forEachSession((session) => {
+                this.cancelSessionApprovals(session, "server closing");
+            });
             this.chatManager.closeAll();
         }
         // Legacy path cleanup
@@ -1698,17 +1921,16 @@ export class AgentServer {
     }
     /**
      * Resolve all of a chat session's pending approvals as cancelled and clear
-     * the matching server-side approval timers. Used by handleCancel's
+     * any matching server-side approval timers. Used by handleCancel's
      * per-session path so a Stop while a tool is awaiting approval doesn't leave
-     * the tool hanging until APPROVAL_TIMEOUT_MS (and leak the timer). Each
-     * requestId in the session map has a same-keyed entry in this.approvalTimers
-     * (see requestAskUserForSession / makeBrowserBridge).
+     * the tool hanging. Bounded request types have same-keyed timer entries;
+     * AskUserQuestion does not.
      */
-    cancelSessionApprovals(session) {
+    cancelSessionApprovals(session, reason = "cancelled") {
         for (const [requestId, resolve] of session.pendingApprovals) {
             this.clearApprovalTimer(requestId);
             try {
-                resolve({ approved: false, reason: "cancelled" });
+                resolve({ approved: false, reason });
             }
             catch {
                 /* a resolver must never break cancel cleanup */