@cjhyy/code-shell-pet 0.9.2 → 0.9.4

package/dist/bound-session-commands.d.ts

@@ -0,0 +1,45 @@
+/**
+ * The parts of a bound conversation that must never involve a model.
+ *
+ * Leaving a Session has to work when the model is down, the worker is wedged,
+ * or the bound Session itself is unreachable — otherwise a user can get stuck
+ * inside a Session with no way out. So /mimi is matched by exact string here
+ * and handled before anything else in the pipeline.
+ *
+ * Likewise, which assistant output reaches the chat is a fixed rule rather
+ * than a judgement call: a bound conversation shows the turn's final answer
+ * and the things the user must act on, never the intermediate stream.
+ */
+/** Commands recognized while a conversation is routed to a Work Session. */
+export type BoundSessionCommand = "leave" | "status";
+export declare function parseBoundSessionCommand(message: string): BoundSessionCommand | undefined;
+/**
+ * Assistant output a bound conversation may forward.
+ *
+ * `final` is the turn's answer. `decision` is an approval or AskUser question,
+ * which must reach the user or the Session stalls invisibly. `terminal` is the
+ * end-of-Session notice. Everything else — partial text, tool arguments, raw
+ * tool results, token stream — stays in the Session.
+ */
+export type BoundReplyKind = "final" | "decision" | "terminal";
+export interface BoundReplyCandidate {
+    kind: BoundReplyKind | "partial" | "tool" | "progress";
+    text: string;
+}
+export declare function shouldForwardBoundReply(candidate: BoundReplyCandidate): boolean;
+/**
+ * A normal message must never be read as an approval. Permission decisions
+ * carry a signed one-time token; free text like "同意" is ordinary input that
+ * happens to look like consent, and treating it as consent would let a chat
+ * message authorize a destructive action.
+ */
+export declare function isApprovalDecision(_message: string): false;
+export interface StalePromptText {
+    title: string;
+    hint: string;
+}
+/**
+ * The one-time reminder shown when a long-quiet conversation is still bound,
+ * before the message is delivered to the Session.
+ */
+export declare function boundSessionStalePrompt(sessionTitle: string): StalePromptText;

package/dist/bound-session-commands.js

@@ -0,0 +1,54 @@
+/**
+ * The parts of a bound conversation that must never involve a model.
+ *
+ * Leaving a Session has to work when the model is down, the worker is wedged,
+ * or the bound Session itself is unreachable — otherwise a user can get stuck
+ * inside a Session with no way out. So /mimi is matched by exact string here
+ * and handled before anything else in the pipeline.
+ *
+ * Likewise, which assistant output reaches the chat is a fixed rule rather
+ * than a judgement call: a bound conversation shows the turn's final answer
+ * and the things the user must act on, never the intermediate stream.
+ */
+/**
+ * Exact matches only. A fuzzy match would eventually swallow a real message
+ * that merely mentions leaving, and losing user input into a control path is
+ * worse than making the user type the command exactly.
+ */
+const LEAVE_COMMANDS = new Set(["/mimi", "/session leave", "返回 mimi", "退出 session"]);
+const STATUS_COMMANDS = new Set(["/session", "/session status"]);
+export function parseBoundSessionCommand(message) {
+    const normalized = message.trim().toLowerCase().replace(/\s+/gu, " ");
+    if (LEAVE_COMMANDS.has(normalized))
+        return "leave";
+    if (STATUS_COMMANDS.has(normalized))
+        return "status";
+    return undefined;
+}
+export function shouldForwardBoundReply(candidate) {
+    if (candidate.kind !== "final" &&
+        candidate.kind !== "decision" &&
+        candidate.kind !== "terminal") {
+        return false;
+    }
+    return candidate.text.trim().length > 0;
+}
+/**
+ * A normal message must never be read as an approval. Permission decisions
+ * carry a signed one-time token; free text like "同意" is ordinary input that
+ * happens to look like consent, and treating it as consent would let a chat
+ * message authorize a destructive action.
+ */
+export function isApprovalDecision(_message) {
+    return false;
+}
+/**
+ * The one-time reminder shown when a long-quiet conversation is still bound,
+ * before the message is delivered to the Session.
+ */
+export function boundSessionStalePrompt(sessionTitle) {
+    return {
+        title: sessionTitle,
+        hint: `这条消息会发送到「${sessionTitle}」。发送 /mimi 可以退出。`,
+    };
+}

package/dist/capability.js

@@ -15,7 +15,7 @@ import { mobileRemoteAvailability, mobileRemoteTool, mobileRemoteToolDef, } from
 import { gatewayAvailability, gatewayTool, gatewayToolDef } from "./gateway.js";
 import { sessionsAvailability, sessionsTool, sessionsToolDef } from "./sessions-tool.js";
 import { currentTimeAvailability, currentTimeTool, currentTimeToolDef } from "./current-time.js";
-import { manageSessionsAvailability, manageSessionsTool, manageSessionsToolDef, watchSessionAvailability, watchSessionTool, watchSessionToolDef, } from "./session-control.js";
+import { bindConversationSessionAvailability, bindConversationSessionTool, bindConversationSessionToolDef, manageSessionsAvailability, manageSessionsTool, manageSessionsToolDef, watchSessionAvailability, watchSessionTool, watchSessionToolDef, } from "./session-control.js";
 import { followUpsAvailability, followUpsTool, followUpsToolDef, manageFollowUpAvailability, manageFollowUpTool, manageFollowUpToolDef, } from "./follow-ups.js";
 import { rewriteSendMessageDef, sendMessageAvailability, sendMessageTool, sendMessageToolDef, } from "./outbound-message.js";
 import { controlLongTaskAvailability, controlLongTaskTool, controlLongTaskToolDef, gatewayReplyAvailability, gatewayReplyTool, gatewayReplyToolDef, memoryAvailability, memoryTool, memoryToolDef, rewriteGatewayReplyDef, } from "./host-actions.js";
@@ -264,6 +264,23 @@ function buildPetParts() {
                     availability: manageSessionsAvailability,
                 },
             },
+            {
+                definition: {
+                    ...bindConversationSessionToolDef,
+                    source: "builtin",
+                    permissionDefault: "allow",
+                    isReadOnly: false,
+                    isConcurrencySafe: false,
+                },
+                execute: bindConversationSessionTool,
+                exposure: {
+                    presetTags: ["harness-min", "general"],
+                    defaultPermissionRules: [
+                        { tool: bindConversationSessionToolDef.name, decision: "allow" },
+                    ],
+                    availability: bindConversationSessionAvailability,
+                },
+            },
             {
                 definition: {
                     ...currentTimeToolDef,

package/dist/conversation-session-route.d.ts

@@ -0,0 +1,115 @@
+/**
+ * Durable routing between one external IM conversation and one Work Session.
+ *
+ * Three relationships already pointed an IM conversation at a Work Session
+ * before this module existed: a DelegateWork launch (PetLongTask
+ * completionTarget), a WatchSession subscription, and — new — explicitly
+ * entering a Session so the chat talks to it directly. All three need the same
+ * things: existence checks, terminal reconciliation, restart recovery and
+ * fail-closed revocation. They are therefore one record with a `mode`, not
+ * three stores.
+ *
+ * `notify` means "send this conversation the Session's terminal outcome".
+ * `bound` means "this conversation currently IS the Session's chat". Entering
+ * upgrades notify → bound; leaving downgrades bound → notify rather than
+ * deleting, so a user who exits still receives the completion they were
+ * waiting for.
+ *
+ * This module is pure domain logic: no fs, no clock, no channel access. The
+ * host owns persistence (desktop conversation-session-route-store.ts) and
+ * every authorization decision.
+ */
+export declare const CONVERSATION_SESSION_ROUTE_SCHEMA_VERSION = 1;
+export type ConversationSessionRouteMode = "notify" | "bound";
+export type ConversationSessionRouteOrigin = "delegate" | "watch" | "enter";
+export type ConversationSessionRouteStatus = "active" | "suspended";
+/**
+ * Why a bound route stopped being usable. Every reason is terminal for the
+ * `bound` mode: the next inbound message goes back to Mimi rather than being
+ * delivered somewhere the user did not intend.
+ */
+export type ConversationSessionRouteSuspendReason = "session-missing" | "session-archived" | "workspace-missing" | "worktree-missing" | "authorization-revoked" | "session-terminal";
+/** Why a bound route was downgraded back to notify. */
+export type ConversationSessionRouteLeaveReason = "user" | "expired" | "terminal" | "suspended";
+export interface ConversationSessionRoute {
+    schemaVersion: typeof CONVERSATION_SESSION_ROUTE_SCHEMA_VERSION;
+    id: string;
+    /**
+     * Stable conversation identity: `im:<channel>\0<target>\0<senderId>`. Built
+     * by the host (petChatRouteKey) and never by the model. A route key missing
+     * target or sender is not addressable and must be rejected, not guessed.
+     */
+    routeKey: string;
+    channel: string;
+    target: string;
+    senderId: string;
+    sessionId: string;
+    /** Display cache only. `sessionId` is the sole authority for identity. */
+    sessionTitle: string;
+    mode: ConversationSessionRouteMode;
+    origin: ConversationSessionRouteOrigin;
+    status: ConversationSessionRouteStatus;
+    suspendedReason?: ConversationSessionRouteSuspendReason;
+    revision: number;
+    createdAt: number;
+    updatedAt: number;
+    lastInboundAt?: number;
+    /** When a bound route auto-downgrades for inactivity. Unset for notify. */
+    expiresAt?: number;
+    /** Last time the user was told they are still inside a Session. */
+    stalePromptAt?: number;
+}
+/** A bound route with no inbound traffic for this long downgrades itself. */
+export declare const BOUND_ROUTE_IDLE_EXPIRY_MS: number;
+/**
+ * After this much silence the next message gets one deterministic reminder
+ * that it is about to enter a Session, before it is delivered. Prevents a
+ * next-day "check the weather" from landing in yesterday's coding Session
+ * with no warning.
+ */
+export declare const BOUND_ROUTE_STALE_PROMPT_MS: number;
+export interface CreateConversationSessionRouteInput {
+    id: string;
+    routeKey: string;
+    channel: string;
+    target: string;
+    senderId: string;
+    sessionId: string;
+    sessionTitle: string;
+    mode: ConversationSessionRouteMode;
+    origin: ConversationSessionRouteOrigin;
+    now: number;
+}
+export declare function createConversationSessionRoute(input: CreateConversationSessionRouteInput): ConversationSessionRoute | undefined;
+/**
+ * Reject anything that is not a well-formed route rather than repairing it.
+ * A half-understood route could deliver a user's message into the wrong
+ * Session, so an unreadable row is dropped and the conversation falls back to
+ * Mimi. One bad row never blocks the rest of the file.
+ */
+export declare function parseConversationSessionRoute(value: unknown): ConversationSessionRoute | undefined;
+/** Upgrade a route to `bound`: this conversation now talks to the Session. */
+export declare function enterConversationSessionRoute(route: ConversationSessionRoute, now: number): ConversationSessionRoute;
+/**
+ * Downgrade to `notify` instead of deleting. The user stops chatting with the
+ * Session but still gets told when it finishes — that is what makes Mimi a
+ * front desk rather than a switch.
+ */
+export declare function leaveConversationSessionRoute(route: ConversationSessionRoute, now: number, reason: ConversationSessionRouteLeaveReason): ConversationSessionRoute;
+/** Mark a route unusable. The caller then routes the message back to Mimi. */
+export declare function suspendConversationSessionRoute(route: ConversationSessionRoute, now: number, reason: ConversationSessionRouteSuspendReason): ConversationSessionRoute;
+export declare function recordConversationSessionRouteInbound(route: ConversationSessionRoute, now: number): ConversationSessionRoute;
+export declare function markConversationSessionRouteStalePrompted(route: ConversationSessionRoute, now: number): ConversationSessionRoute;
+export declare function isConversationSessionRouteExpired(route: ConversationSessionRoute, now: number): boolean;
+/**
+ * True when the user should get one reminder that they are still inside a
+ * Session before this message is delivered to it. Sent at most once per quiet
+ * period so an active conversation is never nagged.
+ */
+export declare function shouldPromptConversationSessionRouteStale(route: ConversationSessionRoute, now: number): boolean;
+/**
+ * The bound route for a conversation, if it is still usable right now.
+ * Expiry is evaluated at read time so a route that aged out while the app was
+ * closed never captures the next message.
+ */
+export declare function activeBoundRoute(routes: readonly ConversationSessionRoute[], routeKey: string, now: number): ConversationSessionRoute | undefined;

package/dist/conversation-session-route.js

@@ -0,0 +1,251 @@
+/**
+ * Durable routing between one external IM conversation and one Work Session.
+ *
+ * Three relationships already pointed an IM conversation at a Work Session
+ * before this module existed: a DelegateWork launch (PetLongTask
+ * completionTarget), a WatchSession subscription, and — new — explicitly
+ * entering a Session so the chat talks to it directly. All three need the same
+ * things: existence checks, terminal reconciliation, restart recovery and
+ * fail-closed revocation. They are therefore one record with a `mode`, not
+ * three stores.
+ *
+ * `notify` means "send this conversation the Session's terminal outcome".
+ * `bound` means "this conversation currently IS the Session's chat". Entering
+ * upgrades notify → bound; leaving downgrades bound → notify rather than
+ * deleting, so a user who exits still receives the completion they were
+ * waiting for.
+ *
+ * This module is pure domain logic: no fs, no clock, no channel access. The
+ * host owns persistence (desktop conversation-session-route-store.ts) and
+ * every authorization decision.
+ */
+export const CONVERSATION_SESSION_ROUTE_SCHEMA_VERSION = 1;
+/** A bound route with no inbound traffic for this long downgrades itself. */
+export const BOUND_ROUTE_IDLE_EXPIRY_MS = 24 * 60 * 60 * 1000;
+/**
+ * After this much silence the next message gets one deterministic reminder
+ * that it is about to enter a Session, before it is delivered. Prevents a
+ * next-day "check the weather" from landing in yesterday's coding Session
+ * with no warning.
+ */
+export const BOUND_ROUTE_STALE_PROMPT_MS = 2 * 60 * 60 * 1000;
+const MAX_ID_LENGTH = 128;
+const MAX_ROUTE_KEY_LENGTH = 512;
+const MAX_TITLE_LENGTH = 160;
+const CONTROL_CHARACTER_RE = /[\u0000-\u001f\u007f]/u;
+function isPlainRecord(value) {
+    return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function safeInteger(value) {
+    return typeof value === "number" && Number.isSafeInteger(value) && value >= 0 ? value : undefined;
+}
+/**
+ * A route key embeds NUL separators by construction, so it is checked for
+ * length and shape rather than for control characters.
+ */
+function isRouteKey(value) {
+    return typeof value === "string" && value.length > 0 && value.length <= MAX_ROUTE_KEY_LENGTH;
+}
+function isBoundedText(value, maxLength) {
+    return (typeof value === "string" &&
+        value.length > 0 &&
+        value.length <= maxLength &&
+        !CONTROL_CHARACTER_RE.test(value));
+}
+function isMode(value) {
+    return value === "notify" || value === "bound";
+}
+function isOrigin(value) {
+    return value === "delegate" || value === "watch" || value === "enter";
+}
+function isSuspendReason(value) {
+    return (value === "session-missing" ||
+        value === "session-archived" ||
+        value === "workspace-missing" ||
+        value === "worktree-missing" ||
+        value === "authorization-revoked" ||
+        value === "session-terminal");
+}
+export function createConversationSessionRoute(input) {
+    if (!isBoundedText(input.id, MAX_ID_LENGTH) ||
+        !isRouteKey(input.routeKey) ||
+        !isBoundedText(input.channel, 64) ||
+        !isBoundedText(input.target, 256) ||
+        !isBoundedText(input.senderId, 256) ||
+        !isBoundedText(input.sessionId, MAX_ID_LENGTH) ||
+        !isMode(input.mode) ||
+        !isOrigin(input.origin) ||
+        safeInteger(input.now) === undefined) {
+        return undefined;
+    }
+    // Validate the title AFTER normalizing it: trimming and slicing must not be
+    // able to smuggle a control character past the check, and the session-id
+    // fallback has to satisfy the same rule the stored value does.
+    const normalizedTitle = input.sessionTitle.trim().slice(0, MAX_TITLE_LENGTH);
+    const title = normalizedTitle || input.sessionId;
+    if (!isBoundedText(title, MAX_TITLE_LENGTH))
+        return undefined;
+    return {
+        schemaVersion: CONVERSATION_SESSION_ROUTE_SCHEMA_VERSION,
+        id: input.id,
+        routeKey: input.routeKey,
+        channel: input.channel,
+        target: input.target,
+        senderId: input.senderId,
+        sessionId: input.sessionId,
+        sessionTitle: title,
+        mode: input.mode,
+        origin: input.origin,
+        status: "active",
+        revision: 1,
+        createdAt: input.now,
+        updatedAt: input.now,
+        ...(input.mode === "bound" ? { expiresAt: input.now + BOUND_ROUTE_IDLE_EXPIRY_MS } : {}),
+    };
+}
+/**
+ * Reject anything that is not a well-formed route rather than repairing it.
+ * A half-understood route could deliver a user's message into the wrong
+ * Session, so an unreadable row is dropped and the conversation falls back to
+ * Mimi. One bad row never blocks the rest of the file.
+ */
+export function parseConversationSessionRoute(value) {
+    if (!isPlainRecord(value))
+        return undefined;
+    if (value.schemaVersion !== CONVERSATION_SESSION_ROUTE_SCHEMA_VERSION)
+        return undefined;
+    const createdAt = safeInteger(value.createdAt);
+    const updatedAt = safeInteger(value.updatedAt);
+    const revision = safeInteger(value.revision);
+    if (!isBoundedText(value.id, MAX_ID_LENGTH) ||
+        !isRouteKey(value.routeKey) ||
+        !isBoundedText(value.channel, 64) ||
+        !isBoundedText(value.target, 256) ||
+        !isBoundedText(value.senderId, 256) ||
+        !isBoundedText(value.sessionId, MAX_ID_LENGTH) ||
+        !isBoundedText(value.sessionTitle, MAX_TITLE_LENGTH) ||
+        !isMode(value.mode) ||
+        !isOrigin(value.origin) ||
+        (value.status !== "active" && value.status !== "suspended") ||
+        createdAt === undefined ||
+        updatedAt === undefined ||
+        revision === undefined) {
+        return undefined;
+    }
+    if (value.suspendedReason !== undefined && !isSuspendReason(value.suspendedReason)) {
+        return undefined;
+    }
+    const lastInboundAt = value.lastInboundAt === undefined ? undefined : safeInteger(value.lastInboundAt);
+    if (value.lastInboundAt !== undefined && lastInboundAt === undefined)
+        return undefined;
+    const expiresAt = value.expiresAt === undefined ? undefined : safeInteger(value.expiresAt);
+    if (value.expiresAt !== undefined && expiresAt === undefined)
+        return undefined;
+    const stalePromptAt = value.stalePromptAt === undefined ? undefined : safeInteger(value.stalePromptAt);
+    if (value.stalePromptAt !== undefined && stalePromptAt === undefined)
+        return undefined;
+    return {
+        schemaVersion: CONVERSATION_SESSION_ROUTE_SCHEMA_VERSION,
+        id: value.id,
+        routeKey: value.routeKey,
+        channel: value.channel,
+        target: value.target,
+        senderId: value.senderId,
+        sessionId: value.sessionId,
+        sessionTitle: value.sessionTitle,
+        mode: value.mode,
+        origin: value.origin,
+        status: value.status,
+        ...(value.suspendedReason ? { suspendedReason: value.suspendedReason } : {}),
+        revision,
+        createdAt,
+        updatedAt,
+        ...(lastInboundAt !== undefined ? { lastInboundAt } : {}),
+        ...(expiresAt !== undefined ? { expiresAt } : {}),
+        ...(stalePromptAt !== undefined ? { stalePromptAt } : {}),
+    };
+}
+/** Upgrade a route to `bound`: this conversation now talks to the Session. */
+export function enterConversationSessionRoute(route, now) {
+    return {
+        ...route,
+        mode: "bound",
+        origin: "enter",
+        status: "active",
+        suspendedReason: undefined,
+        revision: route.revision + 1,
+        updatedAt: now,
+        expiresAt: now + BOUND_ROUTE_IDLE_EXPIRY_MS,
+        stalePromptAt: undefined,
+    };
+}
+/**
+ * Downgrade to `notify` instead of deleting. The user stops chatting with the
+ * Session but still gets told when it finishes — that is what makes Mimi a
+ * front desk rather than a switch.
+ */
+export function leaveConversationSessionRoute(route, now, reason) {
+    return {
+        ...route,
+        mode: "notify",
+        status: reason === "suspended" ? route.status : "active",
+        revision: route.revision + 1,
+        updatedAt: now,
+        expiresAt: undefined,
+        stalePromptAt: undefined,
+    };
+}
+/** Mark a route unusable. The caller then routes the message back to Mimi. */
+export function suspendConversationSessionRoute(route, now, reason) {
+    return {
+        ...route,
+        mode: "notify",
+        status: "suspended",
+        suspendedReason: reason,
+        revision: route.revision + 1,
+        updatedAt: now,
+        expiresAt: undefined,
+        stalePromptAt: undefined,
+    };
+}
+export function recordConversationSessionRouteInbound(route, now) {
+    return {
+        ...route,
+        revision: route.revision + 1,
+        updatedAt: now,
+        lastInboundAt: now,
+        ...(route.mode === "bound" ? { expiresAt: now + BOUND_ROUTE_IDLE_EXPIRY_MS } : {}),
+    };
+}
+export function markConversationSessionRouteStalePrompted(route, now) {
+    return { ...route, revision: route.revision + 1, updatedAt: now, stalePromptAt: now };
+}
+export function isConversationSessionRouteExpired(route, now) {
+    if (route.mode !== "bound")
+        return false;
+    return route.expiresAt !== undefined && now >= route.expiresAt;
+}
+/**
+ * True when the user should get one reminder that they are still inside a
+ * Session before this message is delivered to it. Sent at most once per quiet
+ * period so an active conversation is never nagged.
+ */
+export function shouldPromptConversationSessionRouteStale(route, now) {
+    if (route.mode !== "bound" || route.status !== "active")
+        return false;
+    const since = route.lastInboundAt ?? route.createdAt;
+    if (now - since < BOUND_ROUTE_STALE_PROMPT_MS)
+        return false;
+    return route.stalePromptAt === undefined || route.stalePromptAt <= since;
+}
+/**
+ * The bound route for a conversation, if it is still usable right now.
+ * Expiry is evaluated at read time so a route that aged out while the app was
+ * closed never captures the next message.
+ */
+export function activeBoundRoute(routes, routeKey, now) {
+    return routes.find((route) => route.routeKey === routeKey &&
+        route.mode === "bound" &&
+        route.status === "active" &&
+        !isConversationSessionRouteExpired(route, now));
+}

package/dist/conversation-session.d.ts

@@ -0,0 +1,12 @@
+/**
+ * Everything about a conversation that has entered a Work Session.
+ *
+ * These four modules are one feature and are always consumed together, so the
+ * package barrel re-exports this file rather than each of them: the durable
+ * route record, the chat-facing Session list, the receipt Mimi reads after a
+ * visit, and the deterministic commands that must work without a model.
+ */
+export * from "./conversation-session-route.js";
+export * from "./im-session-list.js";
+export * from "./session-visit-receipt.js";
+export * from "./bound-session-commands.js";

package/dist/conversation-session.js

@@ -0,0 +1,12 @@
+/**
+ * Everything about a conversation that has entered a Work Session.
+ *
+ * These four modules are one feature and are always consumed together, so the
+ * package barrel re-exports this file rather than each of them: the durable
+ * route record, the chat-facing Session list, the receipt Mimi reads after a
+ * visit, and the deterministic commands that must work without a model.
+ */
+export * from "./conversation-session-route.js";
+export * from "./im-session-list.js";
+export * from "./session-visit-receipt.js";
+export * from "./bound-session-commands.js";

package/dist/delegate-work.js

@@ -126,10 +126,19 @@ export async function delegateWorkTool(args, ctx) {
         ? reusableSessions.find((candidate) => candidate?.id === reusableSessionId)
         : undefined;
     if (reusableSessionId && !reusableSession) {
-        return `Error: unknown session_id ${JSON.stringify(reusableSessionId)}. Copy one exact id from the reusable Session list or omit session_id.`;
+        return (`Error: unknown session_id ${JSON.stringify(reusableSessionId)}. ` +
+            "Do not send it again. Omit session_id to start a new Session, or copy one exact id " +
+            "from the reusable Session list above.");
     }
     if (reusableSession && reusableSession.workspaceId !== workspaceId) {
-        return "Error: session_id does not belong to workspace_id.";
+        // A bare "does not belong" is a dead end: the model has no action to take
+        // and re-sends the same pair. Name both halves and the two ways out, so
+        // the next call is a correction rather than a repeat.
+        return (`Error: session_id ${JSON.stringify(reusableSessionId)} belongs to Workspace ` +
+            `${JSON.stringify(reusableSession.workspaceId)}, not ${JSON.stringify(workspaceId)}. ` +
+            "Do not send this pair again. Either omit session_id to start a new Session in " +
+            `${JSON.stringify(workspaceId)}, or set workspace_id to ` +
+            `${JSON.stringify(reusableSession.workspaceId)} if you meant to continue that Session.`);
     }
     const decision = services.requestPetWorkDelegation({
         workspaceId,

package/dist/host-actions.d.ts

@@ -7,7 +7,7 @@
  * executor instead of a bespoke wire per feature.
  */
 import type { ToolContext, ToolDefinition, ToolVisibilityContext } from "@cjhyy/code-shell-core/extension";
-export declare const PET_HOST_ACTION_KINDS: readonly ["mobileRemote", "longTaskControl", "memory", "gatewayReply", "followUpMutation", "sessionWatch", "sessionArchive", "outboundMessage"];
+export declare const PET_HOST_ACTION_KINDS: readonly ["mobileRemote", "longTaskControl", "memory", "gatewayReply", "followUpMutation", "sessionWatch", "sessionArchive", "sessionBind", "outboundMessage"];
 export type PetHostActionKind = (typeof PET_HOST_ACTION_KINDS)[number];
 export declare function isPetHostActionKind(value: unknown): value is PetHostActionKind;
 export interface PetHostActionRequest {
@@ -17,6 +17,13 @@ export interface PetHostActionRequest {
 export interface PetHostActionDecision {
     ok: boolean;
     error?: string;
+    /**
+     * Why the host refused, as a code rather than prose. `already_accepted` means
+     * this kind was already recorded for the turn, so the work is done and the
+     * turn should end; every other refusal leaves the turn open. Callers branch
+     * on this, never on `error` — that text is for the model to read.
+     */
+    reason?: "already_accepted";
 }
 export type PetHostActionService = (request: PetHostActionRequest) => PetHostActionDecision;
 export type PetGatewayReplyAttachmentKind = "image" | "file" | "audio" | "video";

package/dist/host-actions.js

@@ -7,6 +7,7 @@ export const PET_HOST_ACTION_KINDS = [
     "followUpMutation",
     "sessionWatch",
     "sessionArchive",
+    "sessionBind",
     "outboundMessage",
 ];
 export function isPetHostActionKind(value) {
@@ -289,12 +290,28 @@ export async function gatewayReplyTool(args, ctx) {
         }
     }
     const decision = request({ kind: "gatewayReply", payload });
-    if (!decision.ok)
+    if (!decision.ok) {
+        // A repeat call means the authoritative reply is ALREADY recorded, so the
+        // turn has nothing left to do. Returning only an error string let the model
+        // reword and retry indefinitely — real WeChat transcripts show 20+ calls in
+        // three minutes, degrading into "我在，卡密sama。继续发任务即可。". Re-raise
+        // the reply barrier so the turn loop stops this round; the host's
+        // per-turn dedupe still prevents a second delivery.
+        //
+        // Only for the repeat case: a genuine rejection (closed route, bad
+        // capability) delivered nothing, so that turn must stay open for the model
+        // to report the failure.
+        if (decision.reason === "already_accepted") {
+            ctx?.runYield?.request("reply_committed");
+        }
         return `Error: ${decision.error ?? "Gateway reply was rejected"}`;
+    }
+    ctx?.runYield?.request("reply_committed");
     return ("ACCEPTED EXACTLY ONCE — NOT SENT YET. The Gateway reply was recorded for host validation " +
-        "after this turn. End the turn now without producing any assistant text; do not call " +
-        "GatewayReply again, repeat the user-facing reply, or claim sent, attached, or delivered. " +
-        "The host will supply the only visible reply.");
+        "after this turn. End the turn now without producing any assistant text. If a later user " +
+        "message is injected before the turn ends, call GatewayReply once with a complete replacement " +
+        "for the merged inputs; otherwise do not call it again. Never repeat the user-facing reply or " +
+        "claim sent, attached, or delivered. The host will supply the only visible reply.");
 }
 // ---------------------------------------------------------------------------
 // ControlLongTask