@cjhyy/code-shell-core 0.9.4 → 0.9.6

package/dist/protocol/server.js

@@ -17,6 +17,10 @@ import { Methods, ErrorCodes, createResponse, createErrorResponse, createNotific
 import { diskDefaultsFrom } from "../engine/engine.js";
 import { ISOLATED_TASK_BEHAVIOR_MODE } from "../engine/run-types.js";
 import { isProtectedSettingKey, SettingsManager } from "../settings/manager.js";
+import { sessionMessageOutcome, sessionMessageFailure, sessionMessageResultNotification, } from "./session-message-result.js";
+import { resolveSessionMessageWorkspace } from "./session-message-workspace.js";
+import { validateWorkspaceContext, workspacePrimaryRoot } from "../workspace/workspace-context.js";
+import { canonicalKey } from "../workspace/canonical-key.js";
 import { getApprovalRouter, getInteractiveApprovalBackend, } from "../tool-system/permission.js";
 import { agentNotificationBus, notificationQueue, notificationEnvelopeToLegacyStreamEvent, } from "../tool-system/builtin/agent-notifications.js";
 import { backgroundShellManager } from "../runtime/background-shell.js";
@@ -593,6 +597,13 @@ export class AgentServer {
             approvalRouter: this.approvalRouter,
             onStream: (event) => this.notify(Methods.StreamEvent, { sessionId, event }),
             notificationMailbox: this.notificationMailbox,
+            resolveWorkspace: this.workspaceBridgeEnabled
+                ? async (session) => {
+                    const slice = await this.resolveHostSessionWorkspace(session, sessionId);
+                    this.rememberSessionSlice(sessionId, slice);
+                    return slice;
+                }
+                : undefined,
         });
     }
     async rehydrateSessionForWake(sessionId) {
@@ -622,7 +633,8 @@ export class AgentServer {
                 });
                 return null;
             }
-            const session = await this.chatManager.getOrCreate(sessionId, slice);
+            const session = await this.chatManager.getOrCreate(sessionId, slice, { allowReopen: false });
+            session.engine.restoreSessionModel?.(sessionId);
             this.wireInteractiveSession(session, sessionId);
             logger.debug("bg_wakeup.rehydrated_session", {
                 sessionId,
@@ -672,6 +684,7 @@ export class AgentServer {
     }
     /** Queue a model-sent message as an ordinary user turn in another Session. */
     async routeSessionMessage(input) {
+        input.signal?.throwIfAborted();
         const manager = this.chatManager;
         if (!manager)
             throw new Error("cross-Session messaging requires a multi-session host");
@@ -680,12 +693,49 @@ export class AgentServer {
             throw new Error(`target Session is closing or closed: ${targetId}`);
         }
         const sourceSlice = this.lastSliceBySession.get(input.sourceSessionId);
-        const targetSlice = {
-            cwd: input.target.workspaceRoot,
-            projectTrusted: sourceSlice?.projectTrusted ?? false,
+        const sourceSession = manager.get(input.sourceSessionId);
+        const assertStillAuthorized = () => {
+            input.signal?.throwIfAborted();
+            if (this.disconnected || manager.isUnavailable(targetId)) {
+                throw new Error(`target Session is closing or closed: ${targetId}`);
+            }
+            if (sourceSession &&
+                (manager.get(input.sourceSessionId) !== sourceSession ||
+                    sourceSession.wasCancelledSinceLastTurn())) {
+                throw new Error("source Session was cancelled or closed before the message was queued");
+            }
         };
+        let targetSlice;
+        if (this.workspaceBridgeEnabled) {
+            if (!sourceSession)
+                throw new Error("source Session is no longer available");
+            targetSlice = await this.resolveHostSessionWorkspace(sourceSession, targetId);
+        }
+        else {
+            const sessionManager = sourceSession?.engine.getSessionManager?.() ??
+                (this.diskSessionReader ??= new SessionManager(this.sessionDiskRoot));
+            const sourceWorkspace = sourceSession?.engine.resolveSessionRunWorkspace?.(input.sourceSessionId);
+            targetSlice = resolveSessionMessageWorkspace({
+                sessionManager,
+                sourceSessionId: input.sourceSessionId,
+                targetSessionId: targetId,
+                sourceWorkspace: {
+                    cwd: sourceWorkspace?.cwd ?? sourceSlice?.cwd ?? input.target.workspaceRoot,
+                    workspaceContext: sourceWorkspace?.workspaceContext ?? sourceSlice?.workspaceContext,
+                    projectTrusted: sourceSlice?.projectTrusted ?? false,
+                },
+            });
+        }
+        assertStillAuthorized();
         const targetAlreadyExists = manager.sessionExistsOnDisk(targetId, targetSlice);
-        const targetSession = await manager.getOrCreate(targetId, targetSlice);
+        const targetWasResident = manager.get(targetId) !== undefined;
+        const targetSession = await manager.getOrCreate(targetId, targetSlice, {
+            allowReopen: false,
+            signal: input.signal,
+        });
+        assertStillAuthorized();
+        if (targetAlreadyExists && !targetWasResident)
+            targetSession.engine.restoreSessionModel?.(targetId);
         const approvalRegistration = this.approvalRouter.register(targetId, this.connectionId);
         if (!approvalRegistration.ok) {
             throw new Error(`target Session ${targetId} is owned by another connection`);
@@ -693,6 +743,43 @@ export class AgentServer {
         this.rememberSessionSlice(targetId, targetSlice);
         this.observeSessionAttached(targetId, targetSession.lastActivityAt);
         this.wireInteractiveSession(targetSession, targetId);
+        const messageId = `session-message-${nanoid(12)}`;
+        const state = { started: false, acknowledged: false, errorStreamed: false };
+        const finish = (outcome, result) => {
+            state.outcome = outcome;
+            state.result = result;
+            if (state.started)
+                this.observeRunBoundary(targetId, "end");
+            if (outcome.status !== "completed") {
+                logger.warn("session_message.turn_failed", {
+                    sourceSessionId: input.sourceSessionId,
+                    targetSessionId: targetId,
+                    messageId,
+                    error: outcome.error,
+                });
+                // Setup can return a failure without ever emitting an error event.
+                // UI observation must not prevent the durable reply from being queued.
+                try {
+                    if (!state.errorStreamed) {
+                        this.notify(Methods.StreamEvent, {
+                            sessionId: targetId,
+                            event: { type: "error", error: outcome.error ?? "cross-Session message failed" },
+                        });
+                    }
+                }
+                catch (error) {
+                    logger.warn("session_message.error_observation_failed", {
+                        messageId,
+                        error: String(error),
+                    });
+                }
+            }
+            if (state.acknowledged) {
+                this.notificationMailbox.enqueue(sessionMessageResultNotification(input, messageId, outcome));
+            }
+            if (result && result.turnCount > 0)
+                void this.maybeWakeIdleSession(targetId);
+        };
         const userMessageEvent = {
             type: "session_user_message",
             text: input.message,
@@ -700,50 +787,43 @@ export class AgentServer {
         this.observeSessionStream(targetId, userMessageEvent);
         this.notify(Methods.StreamEvent, { sessionId: targetId, event: userMessageEvent });
         const run = targetSession.enqueueTurn(input.message, {
-            cwd: input.target.workspaceRoot,
+            cwd: targetSlice.cwd,
+            workspaceContext: targetSlice.workspaceContext,
             // A planned Session needs its renderer-selected initial profile. Once a
             // Session exists, omitting this field makes Engine use the target's own
             // persisted binding, so a stale source catalog cannot switch it back.
             workspaceProfile: targetAlreadyExists ? undefined : input.target.workspaceProfile,
             sessionMessageTargets: input.catalog,
             onStream: (event) => {
+                if (event.type === "session_started" && !state.started) {
+                    state.started = true;
+                    this.observeRunBoundary(targetId, "start");
+                }
+                if (event.type === "error")
+                    state.errorStreamed = true;
                 this.observeSessionStream(targetId, event);
                 this.notify(Methods.StreamEvent, { sessionId: targetId, event });
             },
             approvalRouter: this.approvalRouter,
         });
-        // The turn itself must NOT block the sender — a member's work can take
-        // minutes and the lead has more to dispatch. But a turn that fails to *start*
-        // (most often: the target's digital human is not installed, so run-setup
-        // throws "Workspace profile ... is unavailable") used to be reported only to
-        // the log while SendMessageToSession still answered "has queued the turn".
-        // A real lead then waited two hours and re-sent, never learning the reason.
-        // So: surface an immediate failure to the caller, keep a slow turn detached.
-        let startupError;
-        const tracked = run
-            .then(() => this.maybeWakeIdleSession(targetId))
-            .catch((error) => {
-            startupError = error;
-            logger.warn("session_message.turn_failed", {
-                sourceSessionId: input.sourceSessionId,
-                targetSessionId: targetId,
-                error: error instanceof Error ? error.message : String(error),
-            });
-            this.notify(Methods.StreamEvent, {
-                sessionId: targetId,
-                event: {
-                    type: "error",
-                    error: error instanceof Error ? error.message : "cross-Session message failed",
-                },
-            });
-        });
-        // One macrotask is enough for a synchronous-throw path to settle; anything
-        // still running by then is genuine work and stays detached.
+        const tracked = run.then((result) => finish(sessionMessageOutcome(result), result), (error) => finish(sessionMessageFailure(error)));
+        // Acknowledge promptly, but never infer "started" from elapsed time. If
+        // setup/work is still pending, its eventual outcome takes the mailbox path.
         await Promise.race([tracked, new Promise((resolve) => setTimeout(resolve, 0))]);
-        if (startupError) {
-            throw startupError instanceof Error ? startupError : new Error(String(startupError));
+        if (state.outcome) {
+            if (state.outcome.status !== "completed")
+                throw new Error(state.outcome.error);
+            return {
+                messageId,
+                status: "completed",
+                result: { text: state.outcome.text, reason: state.result.reason },
+            };
         }
-        void tracked;
+        state.acknowledged = true;
+        void tracked.catch((error) => {
+            logger.warn("session_message.result_delivery_failed", { messageId, error: String(error) });
+        });
+        return { messageId, status: state.started ? "started" : "queued" };
     }
     // ─── Request Dispatch ───────────────────────────────────────────
     async handleRequest(req) {
@@ -1233,6 +1313,7 @@ export class AgentServer {
                     (params.goal != null && typeof params.goal === "object")
                     ? params.goal
                     : undefined,
+                disableGoal: params.disableGoal === true,
                 onStream: (event) => {
                     this.observeSessionStream(sid, event);
                     this.notify(Methods.StreamEvent, { sessionId: sid, event });
@@ -3075,13 +3156,37 @@ export class AgentServer {
             });
         });
     }
-    requestWorkspaceSwitchForSession(session, sessionId, target) {
+    async requestWorkspaceSwitchForSession(session, sessionId, target) {
+        return (await this.requestWorkspaceActionForSession(session, sessionId, "switch", target));
+    }
+    /** The same host authority resolves both dispatched turns and their reply wakeups. */
+    async resolveHostSessionWorkspace(source, targetId) {
+        const registration = this.approvalRouter.register(source.id, this.connectionId);
+        if (!registration.ok)
+            throw new Error(`source Session ${source.id} is owned by another connection`);
+        const resolved = (await this.requestWorkspaceActionForSession(source, source.id, "resolve_session_run", targetId));
+        if (typeof resolved.cwd !== "string" ||
+            !resolved.cwd ||
+            typeof resolved.projectTrusted !== "boolean") {
+            throw new Error("host returned an invalid Session workspace");
+        }
+        const workspaceContext = resolved.workspaceContext === undefined
+            ? undefined
+            : validateWorkspaceContext(resolved.workspaceContext);
+        if (workspaceContext &&
+            canonicalKey(workspacePrimaryRoot(workspaceContext).path) !== canonicalKey(resolved.cwd)) {
+            throw new Error("host Session workspace does not match its working directory");
+        }
+        return { cwd: resolved.cwd, workspaceContext, projectTrusted: resolved.projectTrusted };
+    }
+    requestWorkspaceActionForSession(session, sessionId, action, target) {
+        const label = action === "switch" ? "workspace switch" : "Session workspace resolution";
         return new Promise((resolve, reject) => {
             const requestId = nanoid(12);
             const routeEnvelope = this.approvalRouteEnvelope(sessionId, requestId);
             this.registerSessionApproval(session, this.internalPendingMetadata(sessionId, requestId, routeEnvelope, "__workspace_action__"), (decision) => {
                 this.clearApprovalTimer(requestId);
-                const outcome = parseHostLoopbackDecision(decision, "workspace switch");
+                const outcome = parseHostLoopbackDecision(decision, label);
                 if (!outcome.ok) {
                     reject(new Error(outcome.detail));
                     return;
@@ -3094,11 +3199,11 @@ export class AgentServer {
                 // parsed` TypeError happened to be caught and turned into a rejection;
                 // this states the requirement instead of relying on that.)
                 if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
-                    reject(new Error(`workspace switch ${HOST_LOOPBACK_FAILURE_DETAIL.malformed}`));
+                    reject(new Error(`${label} ${HOST_LOOPBACK_FAILURE_DETAIL.malformed}`));
                     return;
                 }
                 if ("ok" in parsed && parsed.ok === false) {
-                    reject(new Error(parsed.error ?? "workspace switch failed"));
+                    reject(new Error(parsed.error ?? `${label} failed`));
                     return;
                 }
                 resolve(parsed);
@@ -3108,7 +3213,7 @@ export class AgentServer {
                     this.takeSessionApproval(session, requestId, "expired");
                     this.pendingApprovalTargets.delete(requestId);
                     this.approvalTimers.delete(requestId);
-                    reject(new Error(`workspace switch ${HOST_LOOPBACK_FAILURE_DETAIL.timed_out}`));
+                    reject(new Error(`${label} ${HOST_LOOPBACK_FAILURE_DETAIL.timed_out}`));
                 }
             }, AgentServer.APPROVAL_TIMEOUT_MS);
             this.approvalTimers.set(requestId, timer);
@@ -3116,8 +3221,8 @@ export class AgentServer {
                 ...routeEnvelope,
                 request: {
                     toolName: "__workspace_action__",
-                    args: { action: "switch", target },
-                    description: `workspace:switch:${target}`,
+                    args: { action, target },
+                    description: `workspace:${action}:${target}`,
                     riskLevel: "low",
                 },
             });

package/dist/protocol/session-message-result.d.ts

@@ -0,0 +1,12 @@
+import type { EngineResult } from "../engine/types.js";
+import type { RouteSessionMessageInput } from "../session/session-message.js";
+import type { ResultEnvelopeDraft } from "../tool-system/builtin/agent-notifications.js";
+export interface SessionMessageOutcome {
+    status: "completed" | "failed" | "cancelled";
+    text: string;
+    error?: string;
+}
+export declare function sessionMessageFailure(error: unknown): SessionMessageOutcome;
+/** A resolved Engine promise can still represent a refusal or failed run. */
+export declare function sessionMessageOutcome(result: EngineResult): SessionMessageOutcome;
+export declare function sessionMessageResultNotification(input: RouteSessionMessageInput, messageId: string, outcome: SessionMessageOutcome): ResultEnvelopeDraft;

package/dist/protocol/session-message-result.js

@@ -0,0 +1,42 @@
+export function sessionMessageFailure(error) {
+    return {
+        status: error instanceof Error && error.name === "AbortError" ? "cancelled" : "failed",
+        text: "",
+        error: error instanceof Error ? error.message : String(error),
+    };
+}
+/** A resolved Engine promise can still represent a refusal or failed run. */
+export function sessionMessageOutcome(result) {
+    if (result.reason === "aborted_streaming" || result.reason === "aborted_tools") {
+        return {
+            status: "cancelled",
+            text: result.text,
+            error: result.text || "Target turn was cancelled.",
+        };
+    }
+    if (result.reason === "completed" && result.turnCount > 0) {
+        return { status: "completed", text: result.text };
+    }
+    const detail = result.text ||
+        (result.turnCount === 0 ? "Target turn did not start." : "Target turn did not complete.");
+    return { status: "failed", text: result.text, error: `${detail} (reason: ${result.reason})` };
+}
+export function sessionMessageResultNotification(input, messageId, outcome) {
+    return {
+        kind: "result",
+        from: { sessionId: input.target.sessionId, authority: "agent" },
+        to: { sessionId: input.sourceSessionId, authority: "system" },
+        correlationId: messageId,
+        delivery: "idle-drain",
+        payload: {
+            workId: messageId,
+            name: input.target.title,
+            description: `Reply to message ${messageId} from Session ${input.target.sessionId}: ${input.message.slice(0, 240)}`,
+            workKind: "agent",
+            status: outcome.status,
+            finalText: outcome.text,
+            ...(outcome.error ? { error: outcome.error } : {}),
+            finishedAt: Date.now(),
+        },
+    };
+}

package/dist/protocol/session-message-workspace.d.ts

@@ -0,0 +1,21 @@
+import type { SessionManager } from "../session/session-manager.js";
+import { type WorkspaceContext } from "../workspace/workspace-context.js";
+export interface SessionMessageWorkspace {
+    cwd: string;
+    workspaceContext?: WorkspaceContext;
+    projectTrusted?: boolean;
+}
+/**
+ * Protocol-only hosts can reuse already trusted mounted roots. Desktop should
+ * ask its project registry for fresh authority instead. Persisted Session ids,
+ * bindings and runtime roots always take precedence over a caller's catalog.
+ */
+export declare function resolveSessionMessageWorkspace(input: {
+    sessionManager: Pick<SessionManager, "readSessionMainRoot" | "readSessionProjectBinding" | "getSessionWorkspace">;
+    sourceSessionId: string;
+    targetSessionId: string;
+    sourceWorkspace: SessionMessageWorkspace;
+    targetWorkspace?: SessionMessageWorkspace;
+}): SessionMessageWorkspace & {
+    projectTrusted: boolean;
+};

package/dist/protocol/session-message-workspace.js

@@ -0,0 +1,57 @@
+import { canonicalKey } from "../workspace/canonical-key.js";
+import { createWorkspaceContext, validateWorkspaceContext, } from "../workspace/workspace-context.js";
+/**
+ * Protocol-only hosts can reuse already trusted mounted roots. Desktop should
+ * ask its project registry for fresh authority instead. Persisted Session ids,
+ * bindings and runtime roots always take precedence over a caller's catalog.
+ */
+export function resolveSessionMessageWorkspace(input) {
+    const { sessionManager, sourceSessionId, targetSessionId, sourceWorkspace, targetWorkspace } = input;
+    const sourceMain = sessionManager.readSessionMainRoot(sourceSessionId) ?? sourceWorkspace.cwd;
+    const targetMain = sessionManager.readSessionMainRoot(targetSessionId);
+    const sourceBinding = sessionManager.readSessionProjectBinding(sourceSessionId);
+    const targetBinding = sessionManager.readSessionProjectBinding(targetSessionId);
+    const cwd = sessionManager.getSessionWorkspace(targetSessionId)?.root ?? targetMain ?? sourceMain;
+    const sameMainRoot = !targetMain || canonicalKey(sourceMain) === canonicalKey(targetMain);
+    const projectTrusted = targetWorkspace?.projectTrusted ?? (sameMainRoot && sourceWorkspace.projectTrusted === true);
+    if (targetMain && !targetBinding) {
+        if (!sameMainRoot)
+            throw new Error("target Session does not share the source's authorized main root");
+        return { cwd, projectTrusted };
+    }
+    if (!targetBinding && !sourceBinding)
+        return { cwd, projectTrusted };
+    if (targetBinding && (!sourceBinding || targetBinding.projectId !== sourceBinding.projectId)) {
+        throw new Error("target Session project binding is not authorized by the source Session");
+    }
+    const binding = targetBinding ?? sourceBinding;
+    if (!sourceWorkspace.workspaceContext) {
+        throw new Error("cross-Session run requires an authoritative WorkspaceContext from the host");
+    }
+    const context = validateWorkspaceContext(sourceWorkspace.workspaceContext);
+    if (context.projectId !== sourceBinding?.projectId ||
+        context.sessionMainRootId !== sourceBinding.mainRootId) {
+        throw new Error("source WorkspaceContext does not match its persisted project binding");
+    }
+    // A source worktree is a runtime substitution, not a project mount that may
+    // be propagated into another Session's secondary roots.
+    const mountedRoots = context.roots.map((root) => root.id === sourceBinding.mainRootId ? { ...root, path: sourceMain } : { ...root });
+    const targetRoot = mountedRoots.find((root) => root.id === binding.mainRootId);
+    if (!targetRoot || (targetMain && canonicalKey(targetRoot.path) !== canonicalKey(targetMain))) {
+        throw new Error("target Session main root is not present in the host-authorized project roots");
+    }
+    return {
+        cwd,
+        projectTrusted,
+        workspaceContext: createWorkspaceContext({
+            projectId: context.projectId,
+            projectRevision: context.projectRevision,
+            sessionMainRootId: binding.mainRootId,
+            roots: mountedRoots.map((root) => ({
+                ...root,
+                path: root.id === binding.mainRootId ? cwd : root.path,
+                role: root.id === binding.mainRootId ? "primary" : "secondary",
+            })),
+        }),
+    };
+}

package/dist/protocol/types.d.ts

@@ -198,6 +198,8 @@ export interface RunParams {
      * optional token/time budgets). Normalized at the engine run boundary.
      */
     goal?: string | import("../goal/lifecycle.js").GoalConfig;
+    /** Disable explicit, persisted, and configured Goal mode for this standalone turn. */
+    disableGoal?: boolean;
 }
 export interface RunResult {
     text: string;

package/dist/session/session-message.d.ts

@@ -9,14 +9,29 @@ export interface RouteSessionMessageInput {
     sourceSessionId: string;
     target: SessionMessageTarget;
     message: string;
+    /** Sender tool cancellation; never serialized or supplied by the model. */
+    signal?: AbortSignal;
     /** Full same-project catalog so the target can send a later message onward. */
     catalog: readonly SessionMessageTarget[];
 }
-export type SessionMessageRouter = (input: RouteSessionMessageInput) => Promise<void>;
+/** One dispatch acknowledgement, not a subscription to future target turns. */
+export interface SessionMessageReceipt {
+    messageId: string;
+    status: "queued" | "started" | "completed";
+    /** Present when the target finished before the dispatch returned. */
+    result?: {
+        text: string;
+        reason: import("../types.js").TerminalReason;
+    };
+}
+export type SessionMessageRouter = (input: RouteSessionMessageInput) => Promise<SessionMessageReceipt | void>;
 export interface SessionMessageToolService {
     targets: readonly SessionMessageTarget[];
     send(input: {
         targetSessionId: string;
         message: string;
-    }): Promise<SessionMessageTarget>;
+        signal?: AbortSignal;
+    }): Promise<SessionMessageTarget & {
+        receipt?: SessionMessageReceipt;
+    }>;
 }

package/dist/tool-system/browser-bridge.d.ts

@@ -25,6 +25,22 @@ export interface BrowserElement {
     /** Optional value for non-sensitive inputs (e.g. current textbox text). */
     value?: string;
 }
+/**
+ * Which browser identity a page is being viewed as.
+ *
+ * The model cannot otherwise tell a throwaway sandbox partition from the user's
+ * real logged-in browser, and the consequences of a click differ sharply
+ * between them. Optional so a host that only ever drives its own sandbox need
+ * not supply it. See docs/todo/browser-profile-workspace-lease-design.md §8.3.
+ */
+export interface BrowserIdentity {
+    /** Profile the partition is derived from (e.g. "p:<project>" / "u:<name>"). */
+    profileId: string;
+    /** Where the browser itself comes from. */
+    sourceKind?: "builtin-panel" | "builtin-headless" | "attached-chrome" | "remote";
+    /** True when this is the user's own browser, carrying their real logins. */
+    isUserBrowser?: boolean;
+}
 export interface BrowserSnapshot {
     url: string;
     title?: string;
@@ -38,6 +54,8 @@ export interface BrowserSnapshot {
     /** Set when the page needs the user to act (login wall / 2FA) — agent should
      *  hand control back to the user rather than retry. */
     needsHuman?: string;
+    /** Which login identity this page is being viewed as (§8.3). */
+    identity?: BrowserIdentity;
 }
 export type BrowserResultCode = "OK" | "STALE_SNAPSHOT" | "STALE_CURSOR" | "NO_PROGRESS" | "NAVIGATION" | "BLOCKED" | "NEEDS_HUMAN" | "FAILED";
 export interface BrowserScrollState {

package/dist/tool-system/builtin/agent.js

@@ -257,8 +257,8 @@ async function runSubAgent(spawner, opts,
 uiStream, 
 /**
  * Optional override for the spawned child Engine's per-event stream.
- * Background path passes a transcriptSink here so per-event detail is
- * captured into the agent's transcript rather than the main feed. Sync
+ * Background path mirrors per-event detail into its transcript and the
+ * parent stream, where agentId keeps it scoped to the child card. Sync
  * calls leave undefined; engine.ts falls back to `spawner.parentStream`
  * (the parent UI), preserving the inline rendering of synchronous
  * sub-agents.
@@ -388,12 +388,27 @@ export async function agentTool(args, ctx) {
         // (per-instance closure state), so it doesn't interleave with other
         // agents.
         //
-        // Sub-agent runs detached from the parent turn — the parent feed only
-        // sees the agent_start / agent_end markers via `parentStream` (the
-        // 4th arg to runSubAgent); per-event detail goes through the
-        // `streamOverride` (5th arg → SubAgentSpawnRequest.streamOverride →
-        // engine.ts spawn closure routes to it instead of the main UI).
+        // Also forward the agent-scoped events so a desktop child card can show
+        // live operations even after the spawning parent turn has finished.
         const transcriptSink = createTranscriptTranslator(agentId);
+        const detailSink = (event) => {
+            transcriptSink(event);
+            safeEmit(parentStream, event);
+        };
+        const lifecycleSink = (event) => {
+            safeEmit(parentStream, event);
+            if (event.type === "agent_start") {
+                // Mark detached before spawn can emit any detail. Otherwise the parent
+                // turn's completion sweep prematurely seals this still-running card.
+                safeEmit(parentStream, {
+                    type: "agent_backgrounded",
+                    agentId,
+                    name,
+                    description,
+                    agentType: overrides.resolvedType,
+                });
+            }
+        };
         void runSubAgent(spawner, {
             agentId,
             name,
@@ -429,8 +444,7 @@ export async function agentTool(args, ctx) {
             onProgressEvent: progressTracker.onEvent,
             onAgentProgress: progressTracker.onRuntime,
             signal: controller.signal,
-        }, parentStream, // uiStream: agent_start/end → main feed
-        transcriptSink)
+        }, lifecycleSink, detailSink)
             .then((text) => {
             if (controller.signal.aborted) {
                 if (liveLease)

package/dist/tool-system/builtin/browser-tools.js

@@ -30,6 +30,23 @@ function bridge(ctx) {
     return ctx?.browser;
 }
 const STALE = (ref) => `Error: ref ${ref} is no longer valid (page changed). Re-run browser_observe.`;
+/**
+ * One line naming the login identity this page is being viewed as.
+ *
+ * A profile id alone does not convey risk, so the user's own browser gets an
+ * explicit warning: actions there hit their real accounts, not a sandbox.
+ * Renders nothing when the host reports no identity, so hosts that only drive
+ * their own sandbox are unaffected.
+ */
+function renderIdentity(identity) {
+    if (!identity)
+        return "";
+    const source = identity.sourceKind ? ` (${identity.sourceKind})` : "";
+    const warning = identity.isUserBrowser
+        ? " — this is the user's own browser: actions here affect their real accounts"
+        : "";
+    return `\nIdentity: ${identity.profileId}${source}${warning}`;
+}
 // ════════════════════════════════════════════════════════════════════════════
 // browser_observe — observe the page (snapshot / read / extract)
 // ════════════════════════════════════════════════════════════════════════════
@@ -103,7 +120,7 @@ export async function browserObserveTool(args, ctx) {
             const snap = await b.snapshot();
             if (snap.detail)
                 return `Error: ${snap.detail}`;
-            const header = `URL: ${snap.url}${snap.title ? `\nTitle: ${snap.title}` : ""}`;
+            const header = `URL: ${snap.url}${snap.title ? `\nTitle: ${snap.title}` : ""}${renderIdentity(snap.identity)}`;
             const human = snap.needsHuman
                 ? `\n\n⚠ ${snap.needsHuman} — please complete it in the browser window, then continue.`
                 : "";

package/dist/tool-system/builtin/index.js

@@ -41,7 +41,7 @@ import { sendMessageToSessionToolDef, sendMessageToSessionTool, rewriteSendMessa
 import { useCredentialToolDef, useCredentialBuiltinTool, } from "../../credentials/use-credential-tool.js";
 import { injectCredentialToolDef, injectCredentialTool, isInjectCredentialAvailable, } from "../../credentials/inject-credential-tool.js";
 import { credentialAccessScope, getCredentialAccess } from "../../credentials/access.js";
-import { linkActionToolDef, linkActionTool, isLinkActionAvailable, } from "../../links/link-action-tool.js";
+import { linkActionToolDef, linkActionTool } from "../../links/link-action-tool.js";
 const FAILURE_TEXT = /^(?:error\b|failed\b|failure\b|skill\b.*(?:not found\b|disabled\b|not available\b|allowlist\b|denied\b)|(?:[a-z][\w-]*\s+){1,3}(?:error\b|failed\b|failure\b|aborted\b|timed out\b))/i;
 function failureMessage(result) {
     if (typeof result.error === "string" && result.error)
@@ -831,7 +831,8 @@ const BUILTIN_CONTRIBUTIONS = [
             availability: (ctx) => isUseCredentialAvailable(ctx.cwd, ctx.settingsScope),
         }),
     },
-    // Local Link actions resolve their provider-owned credential on every call.
+    // Link discovery remains available even when no saved connection is usable.
+    // Actions resolve their provider-owned credential on every call.
     // Read actions are allowed after the user connects a provider; write actions
     // use a closed, in-tool approval prompt so read and write share one catalog.
     {
@@ -845,7 +846,6 @@ const BUILTIN_CONTRIBUTIONS = [
         execute: linkActionTool,
         exposure: expose(GENERAL_TAGS, {
             defaultPermissionRules: allow(linkActionToolDef.name),
-            availability: (ctx) => isLinkActionAvailable(ctx.cwd, ctx.settingsScope),
         }),
     },
     // InjectCredential:把 cookie 凭证注入内置浏览器(恢复登录态)。审批由工具内部