@cjhyy/code-shell-core 0.7.0 → 0.7.1

package/dist/protocol/server.js

@@ -16,7 +16,7 @@
 import { Methods, ErrorCodes, createResponse, createErrorResponse, createNotification, isRequest, } from "./types.js";
 import { diskDefaultsFrom } from "../engine/engine.js";
 import { isProtectedSettingKey } from "../settings/manager.js";
-import { setInteractiveApprovalFn } from "../tool-system/permission.js";
+import { getApprovalRouter, getInteractiveApprovalBackend, } from "../tool-system/permission.js";
 import { getArenaStatus } from "../tool-system/builtin/arena.js";
 import { agentNotificationBus, notificationQueue, buildNotificationMessage, } from "../tool-system/builtin/agent-notifications.js";
 import { backgroundShellManager } from "../runtime/background-shell.js";
@@ -24,9 +24,32 @@ import { backgroundJobRegistry } from "../tool-system/builtin/background-jobs.js
 import { listBackgroundWorkForUI } from "../tool-system/builtin/background-work.js";
 import { logger } from "../logging/logger.js";
 import { nanoid } from "nanoid";
-import { SessionManager } from "../session/session-manager.js";
+import { assertSafeSessionId, SessionManager } from "../session/session-manager.js";
 import { redactLlmConfig, maskSecretValue } from "./redact.js";
 import { redactSecrets } from "../logging/sanitize-messages.js";
+function isValidRunAttachment(value) {
+    if (!value || typeof value !== "object")
+        return false;
+    const attachment = value;
+    const hasPath = [attachment.path, attachment.relPath, attachment.absPath].some((path) => typeof path === "string" && path.trim().length > 0);
+    return (typeof attachment.id === "string" &&
+        attachment.id.length > 0 &&
+        typeof attachment.sessionId === "string" &&
+        attachment.sessionId.length > 0 &&
+        (attachment.kind === "image" ||
+            attachment.kind === "file" ||
+            attachment.kind === "directory") &&
+        hasPath);
+}
+function runInputError(params) {
+    if (typeof params.task !== "string")
+        return "task must be a string";
+    const hasAttachment = Array.isArray(params.attachments) && params.attachments.some(isValidRunAttachment);
+    if (params.task.trim().length === 0 && !hasAttachment) {
+        return "task or a valid attachment is required";
+    }
+    return null;
+}
 const COMPACT_STREAM_STRATEGIES = new Set([
     "micro",
     "summary",
@@ -50,10 +73,17 @@ export class AgentServer {
     /** Disk-only active-goal reader for agent/goalGet on a non-live session. */
     readActiveGoalFromDisk;
     workspaceBridgeEnabled;
+    connectionId;
+    strictApprovalRouting;
+    approvalRouter;
+    approvalConnectionUnregister = null;
+    disconnected = false;
+    pendingApprovalTargets = new Map();
     /**
      * Last per-session EngineConfigSlice supplied by agent/run. Kept even after
      * idle eviction so background-completion wakeups can rebuild the ChatSession
-     * with the same cwd/permission/trust inputs before draining the queue.
+     * with the same cwd/trust inputs before draining the queue. Per-turn
+     * permission/plan overrides deliberately do not survive into wakeup turns.
      */
     lastSliceBySession = new Map();
     /** Lazy disk reader for cold wakeup rehydrate when this process lacks a slice. */
@@ -98,12 +128,20 @@ export class AgentServer {
      * itself outlives the server (it's a process-local singleton).
      */
     bgAgentBusUnsubscribe = null;
+    wakeupsInFlight = new Set();
     constructor(options) {
         this.chatManager = options.chatManager ?? null;
         this.legacyEngine = options.engine ?? null;
         this.settingsReader = options.settingsReader ?? null;
         this.readActiveGoalFromDisk = options.readActiveGoalFromDisk ?? null;
         this.workspaceBridgeEnabled = options.workspaceBridge === true;
+        this.connectionId = options.connectionId ?? "legacy-agent-server";
+        this.strictApprovalRouting = options.connectionId !== undefined;
+        this.approvalRouter = options.approvalRouter ?? getApprovalRouter();
+        if (!this.strictApprovalRouting) {
+            this.approvalRouter.deregister(this.connectionId, "legacy approval host replaced");
+        }
+        getInteractiveApprovalBackend().clearPromptFn();
         if (!this.chatManager && !this.legacyEngine) {
             throw new Error("AgentServer: either chatManager or engine must be supplied");
         }
@@ -116,9 +154,10 @@ export class AgentServer {
                 });
             }
         });
-        setInteractiveApprovalFn((request) => {
-            return this.requestApprovalFromClient(request);
-        });
+        this.approvalConnectionUnregister = this.approvalRouter.addConnection(this.connectionId, {
+            requestApproval: (request, target) => this.requestApprovalFromClient(request, target),
+            ownershipLost: (targets, reason) => this.failClosedApprovalTargets(targets, reason),
+        }, { claimUnownedSessions: !this.strictApprovalRouting });
         if (this.legacyEngine) {
             // Only wire an interactive askUser when a human is present. For
             // unattended (headless) runs we leave askUser undefined so
@@ -174,48 +213,60 @@ export class AgentServer {
      *   the first drains all currently-pending items; subsequent bus events for
      *   the same session find it busy (or find an empty queue) and no-op.
      *
-     * INVARIANT (the burst-merge correctness depends on it): the merge only
-     * holds because (a) the bus fans out to subscribers SYNCHRONOUSLY, and (b)
-     * `enqueueTurn` sets the session's `active` (→ isBusy()===true) SYNCHRONOUSLY
-     * before its first await. So when bus events #2..N arrive — still on the same
-     * synchronous fan-out as #1 — they already see the session as busy and no-op.
-     * If either path is ever made async (e.g. an await is added inside
-     * enqueueTurn before `active` is set, or the bus starts deferring delivery),
-     * this degrades into N concurrent wakeups for N completions. Keep both
-     * synchronous, or replace this comment's assumption with an explicit
-     * "wakeup in flight" guard flag.
+     * `wakeupsInFlight` serializes the now-async rehydrate path, so a burst of
+     * completion events cannot create duplicate sessions or enqueue duplicate
+     * wakeup turns while getOrCreate waits for a closing generation to settle.
      */
     maybeWakeIdleSession(sessionId) {
-        if (!this.chatManager)
+        if (this.wakeupsInFlight.has(sessionId))
             return;
-        const session = this.chatManager.get(sessionId) ?? this.rehydrateSessionForWake(sessionId);
+        this.wakeupsInFlight.add(sessionId);
+        void this.wakeIdleSession(sessionId)
+            .then((ranTurn) => {
+            this.wakeupsInFlight.delete(sessionId);
+            if (ranTurn && notificationQueue.getSnapshot(sessionId).length > 0) {
+                this.maybeWakeIdleSession(sessionId);
+            }
+        })
+            .catch(() => {
+            this.wakeupsInFlight.delete(sessionId);
+        });
+    }
+    async wakeIdleSession(sessionId) {
+        if (!this.chatManager)
+            return false;
+        if (this.chatManager.isUnavailable(sessionId))
+            return false;
+        const session = this.chatManager.get(sessionId) ?? (await this.rehydrateSessionForWake(sessionId));
         if (!session || session.isBusy())
-            return;
+            return false;
         // Headless / automation runs are one-shot: the caller takes result.text and
         // is gone, so there's no consumer for a woken continuation turn. Headless
         // already drained its background sub-agents inside engine.run before
         // returning; any remaining queued notification (video/shell) must NOT spin
         // an orphan turn. Only the interactive path auto-continues.
         if (session.engine.isHeadless())
-            return;
+            return false;
         // Don't resurrect a session the user just Stopped: cancel() leaves it idle
         // (active=null) so isBusy() reads false, but auto-running a fresh turn here
         // would defeat the Stop. The flag clears the moment the user sends again.
         if (session.wasCancelledSinceLastTurn())
-            return;
+            return false;
         const pending = notificationQueue.drainAll(sessionId);
         if (pending.length === 0)
-            return;
+            return false;
         const task = `<system-reminder>\n${buildNotificationMessage(pending)}\n</system-reminder>`;
-        void session
-            .enqueueTurn(task, {
-            // Synthetic notification, not the user's own input: persisted with an
-            // `injected` flag so a disk rebuild doesn't render it as a phantom user
-            // bubble (the live UI shows only the woken assistant's reply).
-            injected: true,
-            onStream: (event) => this.notify(Methods.StreamEvent, { sessionId, event }),
-        })
-            .catch((err) => {
+        try {
+            await session.enqueueTurn(task, {
+                // Synthetic notification, not the user's own input: persisted with an
+                // `injected` flag so a disk rebuild doesn't render it as a phantom user
+                // bubble (the live UI shows only the woken assistant's reply).
+                injected: true,
+                onStream: (event) => this.notify(Methods.StreamEvent, { sessionId, event }),
+                approvalRouter: this.approvalRouter,
+            });
+        }
+        catch (err) {
             // A wakeup turn failing must not crash the bus fan-out. The drained
             // notifications are already in the transcript via the run's messages;
             // log and move on.
@@ -236,21 +287,14 @@ export class AgentServer {
                 sessionId,
                 event: { type: "error", error: err?.message ?? "background wakeup failed" },
             });
-        })
-            .finally(() => {
-            // Run-boundary re-check (trigger B): the woken summarize turn may have
-            // spawned NEW background work (e.g. goal "generate 2 videos" → after #1
-            // completes, this turn submits #2). When #2 finishes its notification
-            // arrives while we're idle again — but if it arrived DURING this turn
-            // (busy), trigger A skipped it. Re-checking at the run boundary drains
-            // anything that landed while busy, chaining wakeups until the queue is
-            // truly empty. Replaces the old engine for(;;) outer loop.
-            this.maybeWakeIdleSession(sessionId);
-        });
+        }
+        return true;
     }
-    rehydrateSessionForWake(sessionId) {
+    async rehydrateSessionForWake(sessionId) {
         if (!this.chatManager)
             return null;
+        if (this.chatManager.isUnavailable(sessionId))
+            return null;
         try {
             const pending = notificationQueue.getSnapshot(sessionId);
             if (pending.length === 0) {
@@ -273,7 +317,7 @@ export class AgentServer {
                 });
                 return null;
             }
-            const session = this.chatManager.getOrCreate(sessionId, slice);
+            const session = await this.chatManager.getOrCreate(sessionId, slice);
             this.wireInteractiveSession(session, sessionId);
             logger.debug("bg_wakeup.rehydrated_session", {
                 sessionId,
@@ -300,7 +344,6 @@ export class AgentServer {
         if (!cwd)
             return null;
         return {
-            permissionMode: "default",
             projectTrusted: false,
             cwd,
         };
@@ -324,6 +367,9 @@ export class AgentServer {
             case Methods.Run:
                 await this.handleRun(req);
                 break;
+            case Methods.ForkSession:
+                this.handleForkSession(req);
+                break;
             case Methods.Approve:
                 this.handleApprove(req);
                 break;
@@ -346,7 +392,7 @@ export class AgentServer {
                 this.handleUnsteer(req);
                 break;
             case Methods.CloseSession:
-                this.handleCloseSession(req);
+                await this.handleCloseSession(req);
                 break;
             case Methods.ReleaseWorkspace:
                 this.handleReleaseWorkspace(req);
@@ -371,6 +417,73 @@ export class AgentServer {
         }
     }
     // ─── Run ────────────────────────────────────────────────────────
+    handleForkSession(req) {
+        const params = req.params ?? {};
+        const sourceSessionId = typeof params.sourceSessionId === "string" ? params.sourceSessionId : "";
+        const targetSessionId = typeof params.targetSessionId === "string" ? params.targetSessionId : undefined;
+        const throughEventId = typeof params.throughEventId === "string" ? params.throughEventId : undefined;
+        if (!sourceSessionId || params.mode !== "full") {
+            this.transport.send(createErrorResponse(req.id, ErrorCodes.InvalidParams, "forkSession requires sourceSessionId and mode=full"));
+            return;
+        }
+        if (params.targetSessionId !== undefined && typeof params.targetSessionId !== "string") {
+            this.transport.send(createErrorResponse(req.id, ErrorCodes.InvalidParams, "targetSessionId must be a string"));
+            return;
+        }
+        if (params.throughEventId !== undefined && typeof params.throughEventId !== "string") {
+            this.transport.send(createErrorResponse(req.id, ErrorCodes.InvalidParams, "throughEventId must be a string"));
+            return;
+        }
+        try {
+            assertSafeSessionId(sourceSessionId);
+            if (targetSessionId)
+                assertSafeSessionId(targetSessionId);
+        }
+        catch (err) {
+            this.transport.send(createErrorResponse(req.id, ErrorCodes.InvalidParams, err instanceof Error ? err.message : String(err)));
+            return;
+        }
+        let source;
+        try {
+            source = this.chatManager?.get(sourceSessionId);
+        }
+        catch (err) {
+            this.transport.send(createErrorResponse(req.id, ErrorCodes.Overloaded, err instanceof Error ? err.message : String(err)));
+            return;
+        }
+        const engine = source?.engine ?? this.legacyEngine ?? this.anyEngine();
+        if (!engine || !engine.sessionExistsOnDisk(sourceSessionId)) {
+            this.transport.send(createErrorResponse(req.id, ErrorCodes.SessionNotFound, `Session not found: ${sourceSessionId}`));
+            return;
+        }
+        if (targetSessionId && engine.sessionExistsOnDisk(targetSessionId)) {
+            this.transport.send(createErrorResponse(req.id, ErrorCodes.InvalidParams, `Session already exists: ${targetSessionId}`));
+            return;
+        }
+        try {
+            const result = engine.forkSession(sourceSessionId, { targetSessionId, throughEventId });
+            const workspace = result.bundle.state.workspace ?? {
+                root: result.bundle.state.cwd,
+                kind: "main",
+            };
+            this.transport.send(createResponse(req.id, {
+                sessionId: result.bundle.state.sessionId,
+                mode: "full",
+                forkedFrom: result.lineage,
+                workspace,
+                copiedEventCount: result.copiedEventCount,
+            }));
+        }
+        catch (err) {
+            const message = err instanceof Error ? err.message : String(err);
+            const code = /not found/i.test(message)
+                ? ErrorCodes.SessionNotFound
+                : /already exists|invalid|cursor|metadata|unfinished|orphaned|unsupported|malformed/i.test(message)
+                    ? ErrorCodes.InvalidParams
+                    : ErrorCodes.InternalError;
+            this.transport.send(createErrorResponse(req.id, code, message));
+        }
+    }
     async handleRun(req) {
         // ── ChatSessionManager path (multi-session) ──────────────────
         if (this.chatManager) {
@@ -386,12 +499,12 @@ export class AgentServer {
             this.transport.send(createErrorResponse(req.id, ErrorCodes.InvalidParams, "sessionId is required"));
             return;
         }
-        if (!params.task) {
-            this.transport.send(createErrorResponse(req.id, ErrorCodes.InvalidParams, "task is required"));
+        const inputError = runInputError(params);
+        if (inputError) {
+            this.transport.send(createErrorResponse(req.id, ErrorCodes.InvalidParams, inputError));
             return;
         }
         const sessionConfig = {
-            permissionMode: params.permissionMode,
             cwd: params.cwd,
             projectTrusted: params.projectTrusted,
             goal: typeof params.goal === "string" || (params.goal != null && typeof params.goal === "object")
@@ -415,13 +528,19 @@ export class AgentServer {
         }
         let session;
         try {
-            session = cm.getOrCreate(params.sessionId, sessionConfig);
+            session = await cm.getOrCreate(params.sessionId, sessionConfig);
         }
         catch (err) {
             const code = err.code ?? ErrorCodes.InternalError;
             this.transport.send(createErrorResponse(req.id, code, err.message));
             return;
         }
+        const sid = params.sessionId;
+        const approvalRegistration = this.approvalRouter.register(sid, this.connectionId);
+        if (!approvalRegistration.ok) {
+            this.transport.send(createErrorResponse(req.id, ErrorCodes.Overloaded, `Session ${sid} is owned by another connection`));
+            return;
+        }
         this.rememberSessionSlice(params.sessionId, sessionConfig);
         if (params.model !== undefined) {
             if (typeof params.model !== "string" || params.model.length === 0) {
@@ -436,16 +555,12 @@ export class AgentServer {
                 return;
             }
         }
-        if (typeof params.planMode === "boolean") {
-            session.engine.setPlanMode(params.planMode);
-        }
-        const sid = params.sessionId;
         // Wire AskUserQuestion and host bridges for this interactive session. The
         // chatManager path builds a fresh per-session Engine via engineFactory, so
         // these host callbacks must be installed after every create/recreate.
         this.wireInteractiveSession(session, sid);
         try {
-            const result = await session.enqueueTurn(params.task, {
+            const run = session.enqueueTurn(params.task, {
                 cwd: params.cwd,
                 attachments: Array.isArray(params.attachments) ? params.attachments : undefined,
                 goal: typeof params.goal === "string" ||
@@ -454,7 +569,12 @@ export class AgentServer {
                     : undefined,
                 onStream: (event) => this.notify(Methods.StreamEvent, { sessionId: sid, event }),
                 clientMessageId: typeof params.clientMessageId === "string" ? params.clientMessageId : undefined,
+                permissionMode: params.permissionMode,
+                planMode: params.planMode,
+                approvalRouter: this.approvalRouter,
             });
+            this.notify(Methods.RunAccepted, { requestId: req.id, sessionId: sid });
+            const result = await run;
             const runResult = {
                 text: result.text,
                 reason: result.reason,
@@ -483,10 +603,18 @@ export class AgentServer {
             return;
         }
         const params = (req.params ?? {});
-        if (!params.task) {
-            this.transport.send(createErrorResponse(req.id, ErrorCodes.InvalidParams, "task is required"));
+        const inputError = runInputError(params);
+        if (inputError) {
+            this.transport.send(createErrorResponse(req.id, ErrorCodes.InvalidParams, inputError));
             return;
         }
+        if (typeof params.sessionId === "string" && params.sessionId.length > 0) {
+            const approvalRegistration = this.approvalRouter.register(params.sessionId, this.connectionId);
+            if (!approvalRegistration.ok) {
+                this.transport.send(createErrorResponse(req.id, ErrorCodes.Overloaded, `Session ${params.sessionId} is owned by another connection`));
+                return;
+            }
+        }
         if (params.cwd !== undefined && (typeof params.cwd !== "string" || params.cwd.length === 0)) {
             this.transport.send(createErrorResponse(req.id, ErrorCodes.InvalidParams, "cwd must be a non-empty string"));
             return;
@@ -528,12 +656,17 @@ export class AgentServer {
         // `signal.aborted` below it's already gone.
         const runController = this.abortController;
         try {
+            this.notify(Methods.RunAccepted, {
+                requestId: req.id,
+                sessionId: params.sessionId ?? "",
+            });
             const result = await this.legacyEngine.run(params.task, {
                 cwd: params.cwd,
                 sessionId: params.sessionId,
                 signal: runController.signal,
                 onStream: streamToClient,
                 clientMessageId: typeof params.clientMessageId === "string" ? params.clientMessageId : undefined,
+                attachments: Array.isArray(params.attachments) ? params.attachments : undefined,
                 goal: typeof params.goal === "string" ||
                     (params.goal != null && typeof params.goal === "object")
                     ? params.goal
@@ -579,6 +712,19 @@ export class AgentServer {
     // ─── Approve ────────────────────────────────────────────────────
     handleApprove(req) {
         const params = (req.params ?? {});
+        if (this.strictApprovalRouting) {
+            const pending = this.pendingApprovalTargets.get(params.requestId);
+            const matchesPending = pending !== undefined &&
+                params.connectionId === this.connectionId &&
+                params.sessionId === pending.sessionId &&
+                params.connectionId === pending.connectionId &&
+                params.generation === pending.generation &&
+                this.approvalRouter.matches(pending);
+            if (!matchesPending) {
+                this.transport.send(createErrorResponse(req.id, ErrorCodes.InvalidParams, "Approval response does not match connectionId, sessionId, generation, and requestId"));
+                return;
+            }
+        }
         // ChatSessionManager path: approvals are scoped by (sessionId, requestId).
         // Never fall back from a session-tagged response to the legacy global map:
         // a stale/misrouted UI response must fail closed instead of resolving a
@@ -595,6 +741,7 @@ export class AgentServer {
                 return;
             }
             s.pendingApprovals.delete(params.requestId);
+            this.pendingApprovalTargets.delete(params.requestId);
             // Cancel the pending timeout for requests that arm one (browser actions,
             // credential injection, and tool approvals). AskUserQuestion does not use
             // a timeout; this is harmless for those request ids.
@@ -610,6 +757,7 @@ export class AgentServer {
             return;
         }
         this.pendingApprovals.delete(params.requestId);
+        this.pendingApprovalTargets.delete(params.requestId);
         this.clearApprovalTimer(params.requestId);
         resolve(params.decision);
         this.transport.send(createResponse(req.id, { ok: true }));
@@ -817,7 +965,7 @@ export class AgentServer {
         this.transport.send(createResponse(req.id, { items }));
     }
     // ─── CloseSession ───────────────────────────────────────────────
-    handleCloseSession(req) {
+    async handleCloseSession(req) {
         const params = (req.params ?? {});
         if (typeof params.sessionId !== "string" || params.sessionId.length === 0) {
             this.transport.send(createErrorResponse(req.id, ErrorCodes.InvalidParams, "sessionId is required"));
@@ -828,13 +976,15 @@ export class AgentServer {
             if (session) {
                 this.cancelSessionApprovals(session, "session closed");
             }
-            this.chatManager.close(params.sessionId);
+            this.approvalRouter.release(params.sessionId, this.connectionId, "session closed");
+            await this.chatManager.close(params.sessionId);
         }
         // Explicit session teardown — reap that session's background shells
         // (design §6 "session 被显式删除 → killSession"). This is the RPC path
         // (agent/closeSession from the host on delete), distinct from the idle
-        // sweeper's chatManager.close() which must NOT kill (§6). Fire-and-forget.
-        void backgroundShellManager.killSession(params.sessionId);
+        // sweeper's idle eviction which must NOT kill (§6). Await teardown so the
+        // close RPC is a real deletion barrier for Desktop.
+        await backgroundShellManager.killSession(params.sessionId);
         // Drop this session's retained background jobs too (#2/#5): finished jobs
         // are kept for the panel, so explicit teardown is where they're released.
         backgroundJobRegistry.dropForSession(params.sessionId);
@@ -1127,6 +1277,10 @@ export class AgentServer {
                 let compactEngine = engine;
                 if (this.chatManager) {
                     if (compactSessionId) {
+                        if (this.chatManager.isUnavailable(compactSessionId)) {
+                            this.transport.send(createErrorResponse(req.id, ErrorCodes.SessionClosed, `Session is closing or closed: ${compactSessionId}`));
+                            return;
+                        }
                         let session = this.chatManager.get(compactSessionId);
                         if (!session) {
                             const probeEngine = this.anyEngine();
@@ -1135,7 +1289,7 @@ export class AgentServer {
                                 return;
                             }
                             try {
-                                session = this.chatManager.getOrCreate(compactSessionId, {
+                                session = await this.chatManager.getOrCreate(compactSessionId, {
                                     cwd: probeEngine.getSessionManager().readCwd(compactSessionId),
                                 });
                             }
@@ -1452,6 +1606,10 @@ export class AgentServer {
         }
         // In the chatManager path, inject into the session's engine
         if (this.chatManager) {
+            if (this.chatManager.isUnavailable(params.sessionId)) {
+                this.transport.send(createErrorResponse(req.id, ErrorCodes.SessionClosed, `Session is closing or closed: ${params.sessionId}`));
+                return;
+            }
             const s = this.chatManager.get(params.sessionId);
             if (!s) {
                 this.transport.send(createErrorResponse(req.id, ErrorCodes.SessionClosed, `No such session: ${params.sessionId}`));
@@ -1485,6 +1643,10 @@ export class AgentServer {
             this.transport.send(createErrorResponse(req.id, ErrorCodes.InvalidParams, "text and sessionId required"));
             return;
         }
+        if (this.chatManager?.isUnavailable(params.sessionId)) {
+            this.transport.send(createErrorResponse(req.id, ErrorCodes.SessionClosed, `Session is closing or closed: ${params.sessionId}`));
+            return;
+        }
         const engine = this.chatManager
             ? this.chatManager.get(params.sessionId)?.engine
             : this.legacyEngine;
@@ -1506,6 +1668,10 @@ export class AgentServer {
             this.transport.send(createErrorResponse(req.id, ErrorCodes.InvalidParams, "id and sessionId required"));
             return;
         }
+        if (this.chatManager?.isUnavailable(params.sessionId)) {
+            this.transport.send(createErrorResponse(req.id, ErrorCodes.SessionClosed, `Session is closing or closed: ${params.sessionId}`));
+            return;
+        }
         const engine = this.chatManager
             ? this.chatManager.get(params.sessionId)?.engine
             : this.legacyEngine;
@@ -1527,10 +1693,15 @@ export class AgentServer {
     /**
      * Ask the client to approve a tool operation (legacy single-engine path).
      */
-    requestApprovalFromClient(request) {
+    requestApprovalFromClient(request, route) {
         return new Promise((resolve) => {
             const requestId = nanoid(12);
-            const sessionId = typeof request.sessionId === "string" ? request.sessionId : undefined;
+            const effectiveRoute = route ?? {
+                connectionId: this.connectionId,
+                sessionId: request.sessionId ?? "",
+                generation: 0,
+            };
+            const sessionId = effectiveRoute.sessionId;
             const session = this.chatManager && sessionId ? this.chatManager.get(sessionId) : undefined;
             if (this.chatManager && sessionId && !session) {
                 resolve({ approved: false, reason: `session closed: ${sessionId}` });
@@ -1544,22 +1715,34 @@ export class AgentServer {
             else {
                 this.pendingApprovals.set(requestId, resolve);
             }
+            this.pendingApprovalTargets.set(requestId, { ...effectiveRoute, requestId });
             const timer = setTimeout(() => {
                 const pending = session?.pendingApprovals ?? this.pendingApprovals;
                 if (pending.has(requestId)) {
                     pending.delete(requestId);
+                    this.pendingApprovalTargets.delete(requestId);
                     this.approvalTimers.delete(requestId);
                     resolve({ approved: false, reason: "approval timed out" });
                 }
             }, AgentServer.APPROVAL_TIMEOUT_MS);
             this.approvalTimers.set(requestId, timer);
             this.notify(Methods.ApprovalRequest, {
+                connectionId: effectiveRoute.connectionId,
                 ...(sessionId ? { sessionId } : {}),
+                generation: effectiveRoute.generation,
                 requestId,
                 request,
             });
         });
     }
+    approvalRouteEnvelope(sessionId, requestId) {
+        const route = this.approvalRouter.current(sessionId);
+        if (!route || route.connectionId !== this.connectionId)
+            return { sessionId, requestId };
+        const target = { ...route, requestId };
+        this.pendingApprovalTargets.set(requestId, target);
+        return target;
+    }
     /**
      * Per-session AskUserQuestion for the chatManager path. Resolves via the
      * SESSION's pendingApprovals (the chatManager approve handler looks there,
@@ -1593,8 +1776,7 @@ export class AgentServer {
             if (opts?.optionsOnly !== undefined)
                 args.optionsOnly = opts.optionsOnly;
             this.notify(Methods.ApprovalRequest, {
-                sessionId,
-                requestId,
+                ...this.approvalRouteEnvelope(sessionId, requestId),
                 request: {
                     toolName: "__ask_user__",
                     args,
@@ -1622,6 +1804,7 @@ export class AgentServer {
                     const resolveFn = session.pendingApprovals.get(requestId);
                     if (resolveFn) {
                         session.pendingApprovals.delete(requestId);
+                        this.pendingApprovalTargets.delete(requestId);
                         this.approvalTimers.delete(requestId);
                         resolveFn("(用户未在限定时间内回答;目标运行中请自行做出合理假设并继续推进。)");
                         // Tell every client the ask is resolved (nobody answered) so the
@@ -1691,14 +1874,14 @@ export class AgentServer {
             const timer = setTimeout(() => {
                 if (session.pendingApprovals.has(requestId)) {
                     session.pendingApprovals.delete(requestId);
+                    this.pendingApprovalTargets.delete(requestId);
                     this.approvalTimers.delete(requestId);
                     resolve({ ok: false, detail: "browser action timed out" });
                 }
             }, AgentServer.APPROVAL_TIMEOUT_MS);
             this.approvalTimers.set(requestId, timer);
             this.notify(Methods.ApprovalRequest, {
-                sessionId,
-                requestId,
+                ...this.approvalRouteEnvelope(sessionId, requestId),
                 request: {
                     toolName: "__browser_action__",
                     args: { action, ...payload },
@@ -1741,14 +1924,14 @@ export class AgentServer {
             const timer = setTimeout(() => {
                 if (session.pendingApprovals.has(requestId)) {
                     session.pendingApprovals.delete(requestId);
+                    this.pendingApprovalTargets.delete(requestId);
                     this.approvalTimers.delete(requestId);
                     resolve({ ok: false, error: "credential inject timed out" });
                 }
             }, AgentServer.APPROVAL_TIMEOUT_MS);
             this.approvalTimers.set(requestId, timer);
             this.notify(Methods.ApprovalRequest, {
-                sessionId,
-                requestId,
+                ...this.approvalRouteEnvelope(sessionId, requestId),
                 request: {
                     toolName: "__credential_action__",
                     args: { action: "injectCookie", credentialId, credentialScope },
@@ -1795,14 +1978,14 @@ export class AgentServer {
             const timer = setTimeout(() => {
                 if (session.pendingApprovals.has(requestId)) {
                     session.pendingApprovals.delete(requestId);
+                    this.pendingApprovalTargets.delete(requestId);
                     this.approvalTimers.delete(requestId);
                     reject(new Error("workspace switch timed out"));
                 }
             }, AgentServer.APPROVAL_TIMEOUT_MS);
             this.approvalTimers.set(requestId, timer);
             this.notify(Methods.ApprovalRequest, {
-                sessionId,
-                requestId,
+                ...this.approvalRouteEnvelope(sessionId, requestId),
                 request: {
                     toolName: "__workspace_action__",
                     args: { action: "switch", target },
@@ -1876,6 +2059,7 @@ export class AgentServer {
     }
     // ─── Lifecycle ──────────────────────────────────────────────────
     close() {
+        this.disconnect("server closing");
         // Detach the bg-agent bus subscription first so a final flurry of
         // completions during shutdown can't race the `shutdown` status
         // notify below. Safe to call repeatedly — the unsubscribe is a
@@ -1912,6 +2096,18 @@ export class AgentServer {
         this.notify(Methods.Status, { status: "shutdown" });
         this.transport.close();
     }
+    /** Release only this transport's approval ownership. Safe on socket close
+     * even when the ChatSessionManager is shared by other TCP connections. */
+    disconnect(reason = "approval connection disconnected") {
+        if (this.disconnected)
+            return;
+        this.disconnected = true;
+        const unregister = this.approvalConnectionUnregister;
+        this.approvalConnectionUnregister = null;
+        if (unregister) {
+            this.approvalRouter.deregister(this.connectionId, reason);
+        }
+    }
     clearApprovalTimer(requestId) {
         const timer = this.approvalTimers.get(requestId);
         if (timer) {
@@ -1929,6 +2125,7 @@ export class AgentServer {
     cancelSessionApprovals(session, reason = "cancelled") {
         for (const [requestId, resolve] of session.pendingApprovals) {
             this.clearApprovalTimer(requestId);
+            this.pendingApprovalTargets.delete(requestId);
             try {
                 resolve({ approved: false, reason });
             }
@@ -1938,6 +2135,27 @@ export class AgentServer {
         }
         session.pendingApprovals.clear();
     }
+    failClosedApprovalTargets(targets, reason) {
+        for (const target of targets) {
+            const session = this.chatManager?.get(target.sessionId);
+            if (session) {
+                this.cancelSessionApprovals(session, reason);
+                continue;
+            }
+            for (const [requestId, pending] of this.pendingApprovalTargets) {
+                if (pending.connectionId !== target.connectionId ||
+                    pending.sessionId !== target.sessionId ||
+                    pending.generation !== target.generation) {
+                    continue;
+                }
+                const resolve = this.pendingApprovals.get(requestId);
+                this.pendingApprovals.delete(requestId);
+                this.pendingApprovalTargets.delete(requestId);
+                this.clearApprovalTimer(requestId);
+                resolve?.({ approved: false, reason });
+            }
+        }
+    }
     clearAllApprovalTimers() {
         for (const timer of this.approvalTimers.values()) {
             clearTimeout(timer);