@keyou007/agent-bot 0.1.24-alpha.5 → 0.1.24-alpha.6

package/CHANGELOG.md

@@ -6,6 +6,32 @@ The project follows [Semantic Versioning](https://semver.org/).
 
 ## [Unreleased]
 
+## [0.1.24-alpha.6] - 2026-10-12
+
+### 中文
+
+- 修复 node-pty 预编译包缺少执行权限导致的 macOS 终端启动失败；限制 Windows CI 测试并发，避免磁盘争用引起的超时。
+- 命令卡片新增独立网页终端，支持连续输入、ANSI 颜色、调整尺寸、复制粘贴与断线重连。终端与 Preview 共用地址，在原会话/话题核对验证码并由所有者授权，以主机用户权限运行，不重放原命令；原始 HTML/SVG/XML 保持沙箱隔离。
+- 终端管理卡支持打开、恢复、关闭和刷新；使用稳定的 8 位链接标识，丢失页面后可重新授权恢复原 Shell。支持手机授权后自动恢复连接，避免历史回放产生多余输入。断开三分钟、后台无输入输出三十分钟或总时长八小时后回收；安全重启等待活动终端关闭。
+- 支持运行中预选 Provider 和模型，本轮结束后应用最后选择，待生效设置跨重启保留。切换始终保留任务 ID 和完整历史，不隐式 Fork 或替换空任务；切换失败验证回退，无法确认恢复时暂停后续消息并明确提示。设置入口不再被故障的旧 Provider 阻塞，修复默认配置并发保存、恢复/重连校验及认证失败误重试。
+- 模型卡片每页最多显示 20 个模型，支持原卡片翻页，默认定位当前模型；翻页不改变任务设置，并校验 Provider 是否已切换。
+- 修复转发消息附言被拆成追加消息、主 Prompt 错用转发内容的问题；附言作为主 Prompt，转发内容和附件保留为参考，避免慢 Reaction 拆散已关联消息。
+- 修复新建空任务无法归档或解散群的问题：仅对确认未生成历史的任务安全释放，不读取完整历史或发送虚构消息，保留活动任务和历史保护。
+- 修复 TraeX 批准方案后未继续执行的问题：在原任务、话题和思考卡片中衔接执行，保留审批记录、Reaction 与消息队列；Preview 使用同一追加日志和 SSE 连续更新，处理通知乱序、重复、取消及启动失败。
+- TraeX 规划确认遵循任务权限：auto 自动同意，confirm 保留手动按钮。思考卡片和 Preview 保留自动审批记录；自动回复失败时提示并恢复手动确认，仍遵守用户仅讨论或禁止实施的明确要求。
+
+### English
+
+- Restore missing executable permissions on node-pty's macOS helper before opening a terminal; limit Windows CI test concurrency to avoid disk-contention timeouts.
+- Add independent browser terminals to command cards, with continuous input, ANSI colors, resizing, clipboard support and reconnects. Share Preview addressing, require owner approval of a matching code in the original conversation/topic, and run as the host user without replaying the original command. Keep raw HTML/SVG/XML documents sandboxed.
+- Add terminal management cards for opening, recovering, closing and refreshing the same Shell through stable eight-character links and fresh recovery approval. Recover after mobile authorization and network interruptions without replay-generated input. Reclaim terminals after three disconnected minutes, thirty minutes of background I/O inactivity, or eight hours total; safe restart waits for active terminals.
+- Stage Provider/model choices during active turns and apply the latest selection afterward, preserving pending settings across restarts. Keep task IDs and complete history without implicit forks or empty-thread replacement. Verify rollback on failure and pause further messages if recovery cannot be confirmed. Keep settings accessible with a broken old Provider; fix concurrent defaults persistence, resume/reconnect verification and retries of permanent authentication failures.
+- Paginate model cards at twenty models per page, opening on the current model. Update the existing card without changing task settings and guard against Provider changes while paging.
+- Use the user's attached forwarding instruction as the main Prompt, retaining forwarded text and attachments as reference material. Prevent slow Reactions from splitting already-associated messages.
+- Fix archive/Dismiss for new empty tasks by safely releasing only confirmed unmaterialized tasks, without full-history reads or synthetic messages, while retaining activity and history safeguards.
+- Continue TraeX execution after plan approval in the original task, topic and progress card. Preserve approval history, reactions and queues; keep Preview live through one append-only journal and SSE, handling out-of-order notifications, duplicates, cancellation and startup failures.
+- Honor task permissions for TraeX plan confirmations: auto accepts automatically and confirm retains manual controls. Record automatic decisions in the card and Preview, fall back to manual confirmation if the response fails, and continue respecting explicit discussion-only or no-implementation instructions.
+
 ## [0.1.24-alpha.5] - 2026-09-24
 
 ### 中文

package/README.md

@@ -302,6 +302,8 @@ Ordinary tasks also load history as summary pages on demand. Task lists read onl
 
 Turn history uses fixed-width graph lanes with separate sequence numbers, keeping nodes and branch connectors aligned without adding blank continuation rows.
 
+Model cards show at most 20 models per page. Larger lists have Previous/Next controls that update the same card without changing task settings. Opening the Model tab starts on the current model's page; Provider configuration model lists use the same pagination.
+
 ## Local Commands
 
 Enter a message beginning with `!` directly in the Feishu chat box to run a local command in the current task directory.
@@ -309,6 +311,24 @@ Enter a message beginning with `!` directly in the Feishu chat box to run a loca
 For example, `! ls` lists files in the current directory, and `! git status` shows the state of the current Git repository.
 Local commands run in independent background processes without a time limit, so they do not block other messages or commands in the current conversation. The same output card refreshes while a command runs, preserves the observed order of normal and diagnostic output, and includes a `Cancel` action. Agent Bot resumes monitoring commands that are still running after a Worker restart. Long output keeps its beginning and end while the middle is truncated.
 
+### Interactive browser terminal
+
+With terminal text selected, **Ctrl+C** copies without interrupting the command; without a selection it still interrupts. **Ctrl+V** pastes through the browser's native clipboard events, including on HTTP deployments, and preserves xterm's newline and bracketed-paste handling. **Cmd+C / Cmd+V** remain available on macOS. The toolbar's **Ctrl+C** button always interrupts.
+
+The **Terminal** field on authorization and management cards shows the 8-character token from that terminal's recovery URL (`/terminal/<token>`), preserving case. It stays the same across reconnects and fresh approvals; terminals created from the same command have different tokens. Internal IDs and authorization credentials remain separate.
+
+Terminal authorization and recovery cards are sent to the original command conversation, staying inside the original topic when applicable, never redirected to the owner’s private chat. Only the configured owner may approve or manage them. After approval, the card becomes a **terminal management card**: before the first connection it offers **Open Terminal**; after the Shell starts it offers **Reopen Terminal**. Both identify the same terminal. A new tab requires fresh verification-code approval before the previous tab loses access; opening a lost, not-yet-connected terminal starts its Shell only after WebSocket authentication, while a running terminal reuses the same Shell. Close Terminal and Refresh remain available without the webpage. Running Shells can be recovered or closed while safe restart is pending; starting a not-yet-connected Shell is blocked. Ended terminals and terminals from before service restart cannot be recovered. Open Terminal on the original command card still creates a new terminal.
+
+Refresh/reconnect restores terminal output without sending historical device-query responses back to the Shell, preventing stray input such as `?1;2c`. Initial startup and live queries still receive normal responses.
+
+Returning from Feishu authorization or restoring network connectivity automatically resumes the existing session. Transient failures retry without revoking approval; Reconnect reuses the session instead of closing its Shell or sending another approval card. Explicit rejection/expiry stops recovery. Errors distinguish authorization polling, WebSocket connection and Shell startup.
+
+Feishu `!` command cards offer **Open Terminal**. Use **Request Connection** in the welcome section or the top-right toolbar, then have the owner approve the matching six-digit code in the original command conversation/topic. This starts a **separate Shell in the card's working directory**: it never replays, attaches to, or stops the original command. Commands run as the Agent Bot host's OS user, not in the Agent sandbox.
+
+xterm.js supports continuous input, ANSI colors, Ctrl+C, resize, and refresh/reconnect in the same browser tab. Windows uses ConPTY/PowerShell (preferring `pwsh`); macOS/Linux use a Unix PTY with the user's Shell. Input highlighting depends on the Shell and plugins such as PSReadLine. Up to three sessions may be open. Close Terminal ends the Shell immediately. Closing a tab starts a three-minute disconnect timeout; successfully reconnecting in time cancels it and restarts the thirty-minute idle timeout, but background output does not extend the disconnect deadline. A connected foreground page prevents idle closure. Hiding it starts the thirty-minute input/output idle timeout; input/output resets that timeout. Background idle and disconnect timeouts are independent: either can close the Shell. Sessions expire after eight hours total and do not survive Agent Bot restart. Detached background processes may outlive the Shell.
+
+Terminal links share **the exact Preview protocol, host, port and base path**. Command and management-card links both use `/terminal/<8-character-token>`; the server selects new-shell or recovery behavior from the token. Tokens are URL-safe and case-sensitive references, not execution credentials. Command links remain valid after restart, while recovery links expire with their Shell. Only this terminal link format is supported. They reuse `fileViewer` network selection and `publicBaseUrl`; no separate terminal address or port is needed. HTTP Preview deployments also support terminals: use only trusted networks and configure HTTPS for untrusted/Internet access. Owner approval remains mandatory and Preview remains read-only. See [terminal configuration](docs/technical-reference.md#interactive-browser-terminal). Set `terminal.enabled: false` to disable; disabling Preview also disables terminals. Safe restart waits for active terminals and temporarily blocks new ones.
+
 ## Configuration And Data
 
 Agent Bot keeps user-owned files outside the repository:
@@ -348,7 +368,7 @@ Tool titles start with the same status icons as the thinking card: an hourglass
 
 Command approval cards use a short heading and show the reason first, with the command in a collapsed panel instead of repeating it as a long bold title. The summary omits recognized shell wrappers, but the expanded command retains them. Oversized commands and reasons show an explicit truncation notice; check the complete original command in Turn Preview before authorizing. The four approval actions and their permission scope are unchanged. Preview remains read-only and preserves command expansion and scroll position during live updates.
 
-TraeX plan-mode confirmations appear on the existing progress card as **Waiting for approval**, with the plan text and `Approve Plan` (or `Enter Plan Mode`), `Reject`, and `Cancel Request` actions. They require an explicit decision even with automatic permissions; cancelling the request is not the same as stopping the task. Turn Preview shows the plan and pending confirmation but remains read-only: respond in Feishu. Waiting turns remain active and continue to block safe restart until they finish or are explicitly stopped. Notifications missed by an older running version cannot be recovered automatically by this adaptation.
+TraeX plan-mode confirmations follow the task permission setting: **auto** automatically approves entering Plan mode and approving the plan, while **confirm** shows the plan with `Approve Plan` (or `Enter Plan Mode`), `Reject`, and `Cancel Request` actions. Requests and decisions remain in the card history and live Preview; automatic decisions are labeled as automatic, not as a user click. Approval continues implementation in the same task and on the same progress card when TraeX ends its planning turn. Explicit user instructions to discuss or plan only still apply. If automatic confirmation fails, the card reports it and offers manual confirmation. Preview remains read-only. Cancelling a confirmation is not the same as stopping the task, and waiting turns still block safe restart. Notifications missed by an older running version are not automatically replayed.
 
 Local images in Turn Preview Prompts, Commentary, and results load through signed file URLs, including live updates. Relative image paths resolve from the task's project directory.
 
@@ -378,7 +398,7 @@ For App Server tasks, permission changes apply both approval and sandbox policie
 
 The execution settings card ends with a one-sentence Markdown blockquote for the selected tab's scope and timing. Agent selection changes only the default for new tasks in that conversation, without migrating the current task. Model, reasoning, and permission changes apply from the next turn. Agent and Provider options show their identifiers without duplicate display names, while retaining current/default indicators. `/provider` opens this card even when only one Provider is available, keeping the Model, Thinking, and Permission tabs accessible.
 
-Provider changes require an idle task. Wait for an active turn to finish, or stop it before switching. For a custom Provider, Agent Bot uses its OpenAI-compatible `/models` endpoint when available and shows only that Provider's models. A switch keeps the previous model when the target supports it, otherwise selects the target's default model or its first returned model. Providers without a model-list endpoint remain usable: Agent Bot keeps the current or configured model as the single fallback candidate and lets Codex apply it. Agent Bot unloads only the selected idle thread, resumes it with the resolved Provider and model, and verifies both before saving settings or reporting success. A known fresh, empty thread may be replaced while keeping its task identity, title, and directory; forked or resumed tasks are not treated as empty merely because they have no new messages. If a switch fails, the previous settings are retained and remote recovery is attempted. If recovery also fails, further turns are blocked until a Provider switch succeeds.
+Provider changes requested during an Agent Bot turn are saved as pending without interrupting it. The settings card immediately shows the target Provider and the model that will be used; the Model tab lists that Provider’s models, and later selections replace the pending choice. Thinking and permission changes made while a Provider switch is pending are staged with it. The switch is applied after the current turn ends, before a queued, retried, or new turn starts; idle tasks switch immediately. Pending settings survive restarts and do not overwrite active settings or Agent defaults until applied. If a deferred switch fails, Agent Bot restores the previous Provider and model. After verified rollback, the card returns to the original settings with an error notice, clears the pending choice, and queued/new turns continue using the original settings. Only failed or unverified rollback pauses further turns and keeps queued prompts for manual recovery. For a custom Provider, Agent Bot uses its OpenAI-compatible `/models` endpoint when available and shows only that Provider's models. A switch keeps the previous model when the target supports it, otherwise selects the target's default model or its first returned model. Providers without a model-list endpoint remain usable: Agent Bot keeps the current or configured model as the single fallback candidate and lets Codex apply it. Agent Bot releases its subscription only to the selected idle thread, resumes that same thread with the resolved Provider and model, and verifies the ID and both settings before saving or reporting success. Unsubscribing does not itself prove that App Server unloaded the thread. Settings changes always preserve the remote thread ID and all history, including failed and interrupted Turns. They never start, fork, truncate, or replace a thread. A pristine thread without a saved rollout is refused before detaching rather than silently replaced. If a switch fails, the previous settings are retained and remote recovery is attempted. If recovery also fails, further turns are blocked until a Provider switch succeeds.
 
 For TraeX's built-in `trae` Provider, Agent Bot uses the complete native `model/list` catalog, including model names and reasoning options, without requiring a custom Provider `base_url`. Other custom Providers keep their own model discovery and fallback behavior.
 
@@ -388,7 +408,7 @@ Some Responses-compatible Providers omit assistant message phases. Their text st
 
 `feishu.groupNameFormat` defines separate name templates for new Project and Projectless groups, with variables for the operating system, Agent, project, task name, and date. See the [technical reference](docs/technical-reference.md#configuration-model) for the complete format.
 
-If Codex ignores the requested Provider or model when resuming an existing task, Agent Bot retries on a new Codex thread forked through the latest completed Turn. The local task, title, and directory remain unchanged; later failed or interrupted Turns remain only in the original thread. The replacement is adopted only after the settings are verified.
+If App Server ignores the requested Provider/model, Agent Bot reports the requested and actual settings and verifies restoration on the same thread. It never forks to bypass an upstream limitation. Codex 0.153.4 can retain the old Provider after a failed model request even after unsubscribe; an explicit safe restart followed by retry can clear this in-memory state without changing history. Agent Bot does not restart a shared App Server as a side effect of switching settings. Settings pages can load saved task metadata without first resuming a broken old Provider; ordinary resume/reconnect verifies thread identity and known Provider before allowing a new Turn. Permanent authentication failures are not automatically retried by Agent Bot.
 
 Agent processes inherit ordinary parent-process variables and their explicit `agents.<name>.env` settings. Before starting an Agent, Agent Bot removes inherited `FEISHU_*` credentials and internal `AGENT_BOT_*` state, then provides only namespaced, non-secret Profile and Lark identity context. `FEISHU_APP_SECRET` is never forwarded to an Agent process.
 
@@ -406,8 +426,12 @@ Turn Preview shows each saved reasoning item in a collapsed panel. A leading Mar
 
 Quoted cards and cards inside merged forwards include their available original text and images in the Agent's context.
 
+When forwarding rich text, images, files, or chat records with an attached message, Agent Bot combines the associated messages into one request: your attached text is the main Prompt, and the forwarded content remains reference material.
+
 File-change summaries display paths as plain text, preserving Windows separators and literal underscores (including `\__init__.py`) instead of interpreting them as Markdown formatting.
 
+`/archive` and `/dismiss` also work for a newly created task before its first conversation. Empty tasks are released without generating a dummy message; tasks with history keep the normal archive path. Group dismissal still requires confirmation.
+
 ## Troubleshooting
 
 After a crash, an unfinished Codex rollout alone no longer means the task is running: unloaded threads also require a live writer process. Agent Bot confirms session resume before creating a new running card. Writer conflicts stop automatic recovery with an occupancy card; other unconfirmed recovery failures are retried every five seconds for a one-minute window, then marked interrupted with a notification. No external process is closed automatically. Already-confirmed live turns remain monitored, including during temporary connection outages, and are not subject to this recovery timeout.

package/README.zh.md

@@ -297,6 +297,8 @@ Fork 只记录来源任务和分支轮次，不同步完整历史。普通任务
 
 发送 `/update` 可同时检查最新正式版和 Alpha 版，查看更新简介后，点击 **Update <版本号>** 选择更新。更新简介优先显示对应版本的中文内容（包括随包提供的已发布版本译文），没有中文时回退原文。只有配置的机器人所有者可以执行安装；仅检查不会安装。已安装或低于当前版本的版本不提供更新按钮。下载校验在后台进行，随后等待任务和最终回复完成，再安全重启；失败时沿用现有回滚保护。关闭自动检查后仍可使用此命令；源码或 `npm link` 安装只能查看版本，不能原地更新。选择过期或下载失败后，请重新发送 `/update`。
 
+模型卡片每页最多显示 20 个模型，超过时提供上一页、下一页，在原卡片内更新，翻页不会改变任务设置。打开 Model tab 时默认显示当前模型所在页；Provider 配置中的模型列表也采用相同分页。
+
 ## 本地命令
 
 在飞书聊天框直接输入 `!` 开头的消息会作为本地命令处理，命令会在当前任务目录执行。
@@ -304,6 +306,24 @@ Fork 只记录来源任务和分支轮次，不同步完整历史。普通任务
 比如 `! ls` 会列出当前目录下的文件，`! git status` 会显示当前 Git 仓库的状态。
 本地命令由独立后台进程执行，不设运行超时，也不会阻塞当前会话中的其他消息或命令。运行期间会动态刷新同一张输出卡片，并按观察到的先后顺序显示正常输出和诊断输出；可通过卡片中的 `Cancel` 停止命令。Agent Bot Worker 重启后会自动恢复监控仍在运行的命令。内容过长时会保留开头和结尾，并截断中间部分。
 
+### 交互式网页终端
+
+选中终端文字时，**Ctrl+C** 复制，不中断命令；没有选中文字时仍用于中断。**Ctrl+V** 通过浏览器原生剪贴板事件粘贴，HTTP 页面同样支持，并保留 xterm 的换行和括号粘贴处理。macOS 同时支持 **Cmd+C / Cmd+V**。顶部 **Ctrl+C** 按钮始终用于中断。
+
+授权卡和管理卡中的“终端”显示该终端恢复链接 `/terminal/<token>` 中的 8 位 token，保留大小写。重连和重新授权后不变；同一命令创建的不同终端使用不同 token。内部 ID 和授权凭证仍独立保留。
+
+终端授权卡和重新授权卡发送到**原命令所在会话**；命令在话题内时仍留在原话题，不再转发到所有者私聊。仅配置的所有者可授权或管理。授权后卡片变为**终端管理卡**：首次连接前提供“打开终端”，Shell 启动后提供“重新打开终端”，两者都指向同一个终端。原网页丢失时，新网页核对验证码并重新授权后，才撤销旧网页访问；尚未连接的终端在 WebSocket 鉴权后启动 Shell，已运行的终端复用原 Shell。无需找回网页，也可点击“关闭终端”或“刷新”。安全重启等待期间允许恢复或关闭已运行的 Shell，但不允许启动尚未连接的 Shell。已结束或服务重启前的终端不能恢复。原命令卡片的 Open Terminal 仍用于创建新终端。
+
+刷新/重连仅回放终端画面，不会将历史中的设备查询响应再次送入 Shell，避免命令行出现 `?1;2c` 等多余字符；首次启动和实时查询仍正常响应。
+
+手机切到飞书授权再返回网页时会自动恢复查询/连接。短暂断网会保留已有授权并自动重试；“重新连接”复用当前会话，不会关闭 Shell 或重复发送授权卡。明确拒绝/过期时才停止恢复；页面区分授权查询、WebSocket 连接和 Shell 启动错误。
+
+飞书 `!` 命令卡片新增 **Open Terminal**。点击网页说明区或右上角的“请求连接”，由所有者到原命令所在会话/话题核对六位验证码并授权，即可在卡片目录启动**独立 Shell**；不会重复执行、接管或停止原命令。命令以 Agent Bot 主机的系统用户权限运行，不受 Agent 沙箱限制。
+
+xterm.js 支持连续输入、ANSI 颜色、Ctrl+C、尺寸调整和同一浏览器标签页刷新重连。Windows 使用 ConPTY/PowerShell（优先 `pwsh`），macOS/Linux 使用 Unix PTY/用户 Shell。输入语法高亮由 Shell 和 PSReadLine 等插件提供。最多三个会话；“关闭终端”立即停止 Shell；关闭标签页后开始三分钟断开计时，期间成功重连会取消断开计时并重置 30 分钟空闲计时，后台输出不会延长断开时限。页面连接正常且处于前台时不因空闲关闭；切到后台后开始 30 分钟无输入/输出计时，输入/输出会刷新计时。后台空闲与断开超时是“或”的关系，先到者生效；累计八小时后仍会自动关闭；会话不跨 Agent Bot 重启保留。脱离终端的后台进程可能继续运行。
+
+终端链接与 Preview **共用协议、主机、端口及路径前缀**，新建和管理卡恢复入口统一为 `/terminal/<8位token>`，由服务端根据 token 判断新建或恢复。token 使用区分大小写的 URL 安全字符，仅用于定位，不是执行凭证。新建链接重启后仍有效，恢复链接随 Shell 结束失效。终端仅支持这一链接格式，复用 `fileViewer` 的网卡选择和 `publicBaseUrl`，无需独立地址或端口。Preview 使用 HTTP 时终端同样可用，仅用于可信网络，不可信网络/互联网访问请配置 HTTPS。仍需所有者授权，Preview 保持只读。详见[网页终端配置](docs/technical-reference.zh.md#交互式网页终端)。`terminal.enabled: false` 可禁用，关闭 Preview 也会关闭终端。安全重启等待活动终端关闭，等待期间禁止创建新终端。
+
 ## 配置与数据
 
 Agent Bot 将用户相关文件保存在仓库之外：
@@ -343,7 +363,7 @@ Turn Preview 顶部用点分隔各项信息，保留“耗时”标签，Token
 
 命令授权卡片使用简短的“命令执行确认”标题，优先显示申请原因，命令放入默认折叠的区域，不再把整条命令重复显示为加粗标题。摘要省略可识别的 Shell 包装，展开后仍保留原始包装。命令或说明超长时明确提示截断，请在 Turn Preview 查看完整原始命令后再授权。四个授权操作及其权限范围不变；Preview 保持只读，实时更新保留命令展开状态和滚动位置。
 
-TraeX 请求进入规划模式或确认方案开始执行时，现有思考卡片会显示“等待确认”、方案正文，以及 `Approve Plan`（或 `Enter Plan Mode`）、`Reject`、`Cancel Request` 操作。即使使用自动执行权限，也必须明确确认；取消确认请求不等同于停止任务。Turn Preview 会展示方案及待确认提示，但保持只读，请在飞书卡片中操作。等待确认的轮次仍是活动任务，在完成或被明确停止前继续阻止安全重启。旧版本运行时已经丢失的确认通知无法通过此次适配自动补回。
+TraeX 的规划模式确认遵循任务权限设置：**auto** 自动同意进入规划模式及批准方案；**confirm** 显示方案和 `Approve Plan`（或 `Enter Plan Mode`）、`Reject`、`Cancel Request` 按钮，等待用户选择。请求和结果保留在思考卡片及实时 Preview 中，自动处理明确标记为“自动同意”，不记为用户点击。方案获批后，TraeX 结束规划轮次时，Agent Bot 在同一任务、同一张思考卡片中继续执行。用户明确要求“仅讨论”“先不要实现”时仍须遵守。自动确认失败会显示提示并恢复手动确认按钮。Preview 保持只读。取消确认不等同于停止任务，等待确认的轮次仍阻止安全重启。旧版本已丢失的确认通知不会自动补回。
 
 Turn Preview 的 Prompt、Commentary 和结果中的本地图片通过签名文件链接加载，实时更新时同样生效。相对图片路径按任务的项目目录解析。
 
@@ -369,7 +389,7 @@ App Server 任务切换权限时，下一轮会同时应用审批与沙箱策略
 
 运行设置卡片末尾以 Markdown 引用块显示当前选项页的一句重点提示，标明作用范围和生效时机。Agent 只改变本聊天或话题中新任务的默认 Agent，不迁移当前任务；模型、思考强度和权限从下一轮生效。Agent 和 Provider 选项只显示标识，去掉重复的展示名称，保留当前与默认状态标记。只有一个 Provider 时，`/provider` 仍会打开运行设置卡片，可以继续切换到 Model、Thinking 和 Permission 页。
 
-切换 Provider 要求任务处于空闲状态；任务执行中请等待完成，或停止任务后再切换。对于自定义 Provider，Agent Bot 会在接口可用时读取其 OpenAI 兼容 `/models` 接口，并只展示该 Provider 返回的模型。切换时优先保留目标 Provider 也支持的原模型；否则选择目标 Provider 的默认模型，没有默认模型时选择返回列表中的第一个模型。未提供模型列表接口的 Provider 仍可使用：Agent Bot 会把当前或已配置模型作为唯一候选交给 Codex 应用。Agent Bot 只卸载选中的空闲任务，再使用解析出的 Provider 和模型恢复，校验两者后才保存设置并提示成功。确认由当前实例新建的空任务可以重建底层线程，但保留本地任务标识、标题和目录；Fork 或恢复的任务不会仅因尚未发送新消息而被当作空任务。切换失败时保留原设置并尝试恢复远端；如果恢复也失败，将阻止后续执行，直到重新切换 Provider 成功。
+任务正在 Agent Bot 中执行时，切换 Provider 会保存为待生效设置，不中断本轮。运行设置卡片立即显示目标 Provider 和将使用的模型，Model 页切换为该 Provider 的模型列表，可继续选择，以最后选择为准；此时修改思考强度和权限也一起暂存。本轮结束后、排队消息、重试或新轮次开始前实际应用，空闲任务则立即切换。待生效设置重启后保留，应用前不改动实际运行设置或 Agent 默认值。如果延迟切换失败，自动回退之前的 Provider 和模型；确认回退成功后，卡片恢复显示原设置并提示失败原因，清除待生效选择，排队消息和后续轮次继续使用原设置。只有回退也失败或无法确认时才暂停后续轮次、保留排队消息，等待重新选择恢复。对于自定义 Provider，Agent Bot 会在接口可用时读取其 OpenAI 兼容 `/models` 接口，并只展示该 Provider 返回的模型。切换时优先保留目标 Provider 也支持的原模型；否则选择目标 Provider 的默认模型，没有默认模型时选择返回列表中的第一个模型。未提供模型列表接口的 Provider 仍可使用：Agent Bot 会把当前或已配置模型作为唯一候选交给 Codex 应用。Agent Bot 只取消选中空闲任务的订阅，再使用解析出的 Provider 和模型恢复同一线程，校验 ID 和两项设置后才保存并提示成功；取消订阅本身不代表 App Server 已卸载线程。设置切换始终保留远端线程 ID 和全部历史，包括失败、中断的轮次；绝不新建、Fork、截断或替换线程。尚未保存 rollout 的全新空会话会在取消订阅前明确拒绝切换，不会偷偷替换。切换失败时保留原设置并尝试恢复远端；如果恢复也失败，将阻止后续执行，直到重新切换 Provider 成功。
 
 `feishu.groupNameFormat` 可分别设置 Project 与 Projectless 新群的名称模板，支持系统、Agent、项目、任务名和日期变量。完整格式说明见[技术参考](docs/technical-reference.zh.md#配置模型)。
 
@@ -379,7 +399,7 @@ Provider 模型列表读取失败时，设置卡片保留降级候选模型，
 
 部分 Responses 兼容 Provider 不返回助手消息阶段。这类文本先按顺序显示在进度时间线，不再提前拼接成最终回答；轮次成功结束时，只有最后一条且之后未开始工具调用的未标记消息会成为最终回答。明确的 `commentary` 和 `final_answer` 标记优先。思考卡片和 Preview 使用同一分类结果，不自动改写此前保存的快照。
 
-如果 Codex 在恢复已有任务时忽略指定的 Provider 或模型，Agent Bot 会从最新已完成轮次创建新的 Codex 分支重试。本地任务、标题和目录保持不变，之后失败或中断的轮次仅保留在原线程中。新线程的设置通过校验后才会被采用。
+如果 App Server 忽略指定的 Provider 或模型，Agent Bot 会报告请求值和实际值，并在同一线程上验证恢复原设置，绝不通过 Fork 绕过上游限制。实测 Codex 0.153.4 在模型请求失败后，取消订阅再恢复仍可能保留旧 Provider；显式安全重启后重试可以清除此内存状态，不需要改变历史。切换设置不会自动重启共享 App Server。设置入口可直接加载保存的任务元数据，无需先用故障的旧 Provider 恢复任务；普通恢复和断线重连会验证线程 ID 与已知 Provider，再允许发起新轮次。明确的认证失败不再触发 Agent Bot 自动重试。
 
 Agent 进程会继承普通父进程变量及其显式配置的 `agents.<name>.env`。启动 Agent 前，Agent Bot 会移除继承的 `FEISHU_*` 凭据和内部 `AGENT_BOT_*` 状态，再仅提供带命名空间的非敏感 Profile 与 Lark 身份上下文；`FEISHU_APP_SECRET` 永远不会传入 Agent 进程。
 
@@ -397,8 +417,12 @@ Turn Preview 中每个已保存的思考项默认折叠，开头的 Markdown 标
 
 引用卡片或合并转发中的卡片时，Agent 会收到可读取的原始文字和图片。
 
+转发富文本、图片、文件或聊天记录并附言时，Agent Bot 会将关联消息合并为一次请求：你的附言作为主 Prompt，转发内容保留为参考材料。
+
 文件变更摘要中的路径保持普通文本样式，完整保留 Windows 路径分隔符和下划线（包括 `\__init__.py`），不会将其解析为 Markdown 格式。
 
+新建任务尚未开始对话时，也可以使用 `/archive` 或 `/dismiss`。空任务会直接释放，不会为了归档而发送虚构消息；已有历史的任务仍按正常流程归档。解散群聊仍需确认。
+
 ## 常见问题
 
 异常崩溃后，不再仅凭 Codex 日志缺少结束事件就把任务判为运行中：未加载的任务还需要确认有存活的写入进程。Agent Bot 确认会话恢复成功后才创建新的运行卡片；写锁冲突会停止自动恢复并显示占用卡片，其他尚未确认恢复成功的故障每 5 秒重试，在 1 分钟重试窗口耗尽后标记中断并通知用户，不会自动关闭外部进程。已经确认仍在执行的轮次继续监控，临时断连也不会被该恢复超时误判为空闲。

package/SECURITY.md

@@ -4,6 +4,18 @@
 
 Security fixes are released for the latest published version of Agent Bot.
 
+## Interactive Terminal Trust Boundary
+
+Terminal management cards in the original command conversation/topic can close their associated Shell without browser credentials. They validate the current owner, exact card and action token. Eight-character URL tokens share `/terminal/<token>` and identify a stored command or terminal but grant no execution access; the server selects behavior, and retired recovery tokens stay reserved so they never become new-shell links; do not shorten the independent browser keys or approval tokens. Reopen links identify a terminal but grant no access: recovery requires fresh code approval, rotates browser authorization and revokes old access. Denying a recovery request leaves the original terminal unaffected; ended terminals cannot be recovered. Never approve recovery on the owner's behalf.
+
+The browser terminal executes arbitrary commands as the Agent Bot OS user, outside Agent sandbox settings. Disable it with `terminal.enabled: false` or disable `fileViewer`. Terminal and Preview share `fileViewer` networking and the same origin, but not authorization. Raw files have a no-script response sandbox; rendered HTML has an opaque-origin sandbox without same-origin privilege or network requests. Do not remove those boundaries or serve other arbitrary scripts in this origin. Protect profile files/signing secrets with local user access controls.
+
+HTTP terminals are supported for trusted LAN use; traffic is unencrypted. Network interception/tampering can compromise terminal traffic and credentials; owner approval is not transport encryption. Use HTTPS on untrusted networks or the Internet, preserve Host/Origin and proxy WebSocket upgrades. Never log terminal credentials or traffic.
+
+Every browser session needs matching-code owner approval in the original Feishu command conversation/topic. Group members may see the card and verification code but cannot authorize: current owner, exact card ID and action token are checked independently of the delivery destination. A launch link or Preview token alone cannot execute commands. Never approve unsolicited requests or log/share browser credentials. Keys live in sessionStorage, not URLs; access to that browser tab or OS account is inside the trust boundary. Shells can read host files and other environment credentials even though internal Feishu/Agent Bot variables are filtered. Shell profiles also execute as that user.
+
+Disconnecting retains the Shell for three minutes; a successful authenticated reconnection cancels this deadline and restarts thirty idle minutes, but command output does not extend the disconnect deadline. A connected foreground page with fresh visibility heartbeats prevents idle closure; hiding it starts thirty minutes of input/output inactivity. Either timeout closes it. Explicit close, the eight-hour absolute limit and service shutdown still end it. Detached processes may survive. Safe restart waits for active terminals; forced restart interrupts them.
+
 ## Reporting A Vulnerability
 
 Do not open a public issue for a suspected vulnerability.

package/config.example.yaml

@@ -23,6 +23,11 @@ console:
 updates:
   enabled: true
 
+# Interactive terminal: independent authorization, not a read-only Preview.
+terminal:
+  enabled: true
+  # Shares fileViewer host, port and publicBaseUrl; keeps independent owner authorization.
+
 # Signed, read-only pages for local files referenced in Agent replies.
 fileViewer:
   enabled: true

package/dist/cli/controlProtocol.js.map

@@ -1 +1 @@
-{"version":3,"file":"controlProtocol.js","sourceRoot":"","sources":["../../src/cli/controlProtocol.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,IAAI,MAAM,WAAW,CAAC;AAyL7B,MAAM,UAAU,eAAe,CAAC,UAAkB;IAChD,MAAM,YAAY,GAAG,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;IAC9C,MAAM,GAAG,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,YAAY,CAAC,WAAW,EAAE,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IAC/F,OAAO,OAAO,CAAC,QAAQ,KAAK,OAAO;QACjC,CAAC,CAAC,0BAA0B,GAAG,EAAE;QACjC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,EAAE,cAAc,GAAG,OAAO,CAAC,CAAC;AACtE,CAAC"}
+{"version":3,"file":"controlProtocol.js","sourceRoot":"","sources":["../../src/cli/controlProtocol.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,IAAI,MAAM,WAAW,CAAC;AA0L7B,MAAM,UAAU,eAAe,CAAC,UAAkB;IAChD,MAAM,YAAY,GAAG,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;IAC9C,MAAM,GAAG,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,YAAY,CAAC,WAAW,EAAE,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IAC/F,OAAO,OAAO,CAAC,QAAQ,KAAK,OAAO;QACjC,CAAC,CAAC,0BAA0B,GAAG,EAAE;QACjC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,EAAE,cAAc,GAAG,OAAO,CAAC,CAAC;AACtE,CAAC"}

package/dist/cli/serverStatus.js

@@ -31,6 +31,7 @@ export function formatServerStatus(data, language = cliLanguage) {
         `${cliText("Supervisor: ", "Supervisor：", language)}${value.supervised ? cliText("enabled", "已启用", language) : cliText("disabled", "未启用", language)}`,
         ...agents,
         `${cliText("Running tasks: ", "运行中任务：", language)}${activity.runningSessions ?? 0}`,
+        ...(activity.activeTerminals ? [`${cliText("Active terminals: ", "活动终端：", language)}${activity.activeTerminals}`] : []),
         `${cliText("Pending final deliveries: ", "待发送最终结果：", language)}${activity.pendingFinalDeliveries ?? 0}`,
         `${cliText("Safe restart: ", "安全重启：", language)}${safeRestart}`,
         "",

package/dist/cli/serverStatus.js.map

@@ -1 +1 @@
-{"version":3,"file":"serverStatus.js","sourceRoot":"","sources":["../../src/cli/serverStatus.ts"],"names":[],"mappings":"AAAA,MAAM,UAAU,yBAAyB,CACvC,IAAa,EACb,qBAA8B;IAE9B,MAAM,KAAK,GAAG,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ;QAC5C,CAAC,CAAC,IAA+B;QACjC,CAAC,CAAC,EAAE,CAAC;IACP,IAAI,MAAM,CAAC,MAAM,CAAC,KAAK,EAAE,aAAa,CAAC;QAAE,OAAO,KAAK,CAAC;IACtD,OAAO;QACL,GAAG,KAAK;QACR,WAAW,EAAE,qBAAqB,IAAI,IAAI;KAC3C,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,IAAa,EAAE,QAAQ,GAAgB,WAAW;IACnF,MAAM,KAAK,GAAG,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAA+B,CAAC,CAAC,CAAC,EAAE,CAAC;IACtF,MAAM,QAAQ,GAAG,KAAK,CAAC,QAAQ,IAAI,OAAO,KAAK,CAAC,QAAQ,KAAK,QAAQ;QACnE,CAAC,CAAC,KAAK,CAAC,QAAmC;QAC3C,CAAC,CAAC,EAAE,CAAC;IACP,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,KAAK,KAAK;QACnC,CAAC,CAAC,OAAO,CAAC,aAAa,EAAE,KAAK,EAAE,QAAQ,CAAC;QACzC,CAAC,CAAC,KAAK,CAAC,KAAK,KAAK,KAAK;YACrB,CAAC,CAAC,OAAO,CAAC,+BAA+B,EAAE,aAAa,EAAE,QAAQ,CAAC;YACnE,CAAC,CAAC,OAAO,CAAC,SAAS,EAAE,KAAK,EAAE,QAAQ,CAAC,CAAC;IAC1C,MAAM,WAAW,GAAG,KAAK,CAAC,oBAAoB;QAC5C,CAAC,CAAC,OAAO,CACL,YAAY,MAAM,CAAC,KAAK,CAAC,iBAAiB,IAAI,oBAAoB,CAAC,GAAG,EACtE,OAAO,MAAM,CAAC,KAAK,CAAC,iBAAiB,IAAI,OAAO,CAAC,GAAG,EACpD,QAAQ,CACT;QACH,CAAC,CAAC,OAAO,CAAC,eAAe,EAAE,KAAK,EAAE,QAAQ,CAAC,CAAC;IAC9C,MAAM,MAAM,GAAG,oBAAoB,CAAC,KAAK,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;IAC5D,OAAO;QACL,GAAG,OAAO,CAAC,oBAAoB,EAAE,eAAe,EAAE,QAAQ,CAAC,GAAG,KAAK,EAAE;QACrE,GAAG,OAAO,CAAC,eAAe,EAAE,YAAY,EAAE,QAAQ,CAAC,GAAG,KAAK,CAAC,WAAW,IAAI,OAAO,CAAC,gBAAgB,EAAE,KAAK,EAAE,QAAQ,CAAC,EAAE;QACvH,GAAG,OAAO,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,CAAC,GAAG,KAAK,CAAC,GAAG,IAAI,GAAG,EAAE;QAC1D,GAAG,OAAO,CAAC,cAAc,EAAE,OAAO,EAAE,QAAQ,CAAC,GAAG,KAAK,CAAC,SAAS,IAAI,GAAG,EAAE;QACxE,GAAG,OAAO,CAAC,cAAc,EAAE,aAAa,EAAE,QAAQ,CAAC,GAAG,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,OAAO,CAAC,SAAS,EAAE,KAAK,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,UAAU,EAAE,KAAK,EAAE,QAAQ,CAAC,EAAE;QACrJ,GAAG,MAAM;QACT,GAAG,OAAO,CAAC,iBAAiB,EAAE,QAAQ,EAAE,QAAQ,CAAC,GAAG,QAAQ,CAAC,eAAe,IAAI,CAAC,EAAE;QACnF,GAAG,OAAO,CAAC,4BAA4B,EAAE,UAAU,EAAE,QAAQ,CAAC,GAAG,QAAQ,CAAC,sBAAsB,IAAI,CAAC,EAAE;QACvG,GAAG,OAAO,CAAC,gBAAgB,EAAE,OAAO,EAAE,QAAQ,CAAC,GAAG,WAAW,EAAE;QAC/D,EAAE;KACH,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACf,CAAC;AAED,SAAS,oBAAoB,CAAC,KAAc,EAAE,QAAqB;IACjE,MAAM,MAAM,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QACjC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,EAAmC,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,OAAO,IAAI,KAAK,QAAQ,CAAC;QACpG,CAAC,CAAC,EAAE,CAAC;IACP,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxB,OAAO,CAAC,GAAG,OAAO,CAAC,UAAU,EAAE,WAAW,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAC;IAC5D,CAAC;IACD,OAAO;QACL,OAAO,CAAC,SAAS,EAAE,WAAW,EAAE,QAAQ,CAAC;QACzC,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE;YACtB,MAAM,IAAI,GAAG,OAAO,KAAK,CAAC,IAAI,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC;YAC3F,MAAM,KAAK,GAAG,OAAO,KAAK,CAAC,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;YACrG,MAAM,KAAK,GAAG,KAAK,IAAI,KAAK,KAAK,IAAI,CAAC,CAAC,CAAC,GAAG,IAAI,KAAK,KAAK,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;YACpE,MAAM,GAAG,GAAG,OAAO,KAAK,CAAC,GAAG,KAAK,QAAQ,IAAI,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,GAAG,GAAG,CAAC;gBACvF,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC;gBACnB,CAAC,CAAC,GAAG,CAAC;YACR,MAAM,OAAO,GAAG,OAAO,KAAK,CAAC,OAAO,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE;gBACvE,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE;gBACtB,CAAC,CAAC,GAAG,CAAC;YACR,OAAO,QAAQ,KAAK,IAAI;gBACtB,CAAC,CAAC,KAAK,KAAK,QAAQ,GAAG,OAAO,OAAO,EAAE;gBACvC,CAAC,CAAC,KAAK,KAAK,SAAS,GAAG,aAAa,OAAO,EAAE,CAAC;QACnD,CAAC,CAAC;KACH,CAAC;AACJ,CAAC;AACD,OAAO,EAAE,WAAW,EAAE,OAAO,EAAoB,MAAM,WAAW,CAAC"}
+{"version":3,"file":"serverStatus.js","sourceRoot":"","sources":["../../src/cli/serverStatus.ts"],"names":[],"mappings":"AAAA,MAAM,UAAU,yBAAyB,CACvC,IAAa,EACb,qBAA8B;IAE9B,MAAM,KAAK,GAAG,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ;QAC5C,CAAC,CAAC,IAA+B;QACjC,CAAC,CAAC,EAAE,CAAC;IACP,IAAI,MAAM,CAAC,MAAM,CAAC,KAAK,EAAE,aAAa,CAAC;QAAE,OAAO,KAAK,CAAC;IACtD,OAAO;QACL,GAAG,KAAK;QACR,WAAW,EAAE,qBAAqB,IAAI,IAAI;KAC3C,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,IAAa,EAAE,QAAQ,GAAgB,WAAW;IACnF,MAAM,KAAK,GAAG,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAA+B,CAAC,CAAC,CAAC,EAAE,CAAC;IACtF,MAAM,QAAQ,GAAG,KAAK,CAAC,QAAQ,IAAI,OAAO,KAAK,CAAC,QAAQ,KAAK,QAAQ;QACnE,CAAC,CAAC,KAAK,CAAC,QAAmC;QAC3C,CAAC,CAAC,EAAE,CAAC;IACP,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,KAAK,KAAK;QACnC,CAAC,CAAC,OAAO,CAAC,aAAa,EAAE,KAAK,EAAE,QAAQ,CAAC;QACzC,CAAC,CAAC,KAAK,CAAC,KAAK,KAAK,KAAK;YACrB,CAAC,CAAC,OAAO,CAAC,+BAA+B,EAAE,aAAa,EAAE,QAAQ,CAAC;YACnE,CAAC,CAAC,OAAO,CAAC,SAAS,EAAE,KAAK,EAAE,QAAQ,CAAC,CAAC;IAC1C,MAAM,WAAW,GAAG,KAAK,CAAC,oBAAoB;QAC5C,CAAC,CAAC,OAAO,CACL,YAAY,MAAM,CAAC,KAAK,CAAC,iBAAiB,IAAI,oBAAoB,CAAC,GAAG,EACtE,OAAO,MAAM,CAAC,KAAK,CAAC,iBAAiB,IAAI,OAAO,CAAC,GAAG,EACpD,QAAQ,CACT;QACH,CAAC,CAAC,OAAO,CAAC,eAAe,EAAE,KAAK,EAAE,QAAQ,CAAC,CAAC;IAC9C,MAAM,MAAM,GAAG,oBAAoB,CAAC,KAAK,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;IAC5D,OAAO;QACL,GAAG,OAAO,CAAC,oBAAoB,EAAE,eAAe,EAAE,QAAQ,CAAC,GAAG,KAAK,EAAE;QACrE,GAAG,OAAO,CAAC,eAAe,EAAE,YAAY,EAAE,QAAQ,CAAC,GAAG,KAAK,CAAC,WAAW,IAAI,OAAO,CAAC,gBAAgB,EAAE,KAAK,EAAE,QAAQ,CAAC,EAAE;QACvH,GAAG,OAAO,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,CAAC,GAAG,KAAK,CAAC,GAAG,IAAI,GAAG,EAAE;QAC1D,GAAG,OAAO,CAAC,cAAc,EAAE,OAAO,EAAE,QAAQ,CAAC,GAAG,KAAK,CAAC,SAAS,IAAI,GAAG,EAAE;QACxE,GAAG,OAAO,CAAC,cAAc,EAAE,aAAa,EAAE,QAAQ,CAAC,GAAG,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,OAAO,CAAC,SAAS,EAAE,KAAK,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,UAAU,EAAE,KAAK,EAAE,QAAQ,CAAC,EAAE;QACrJ,GAAG,MAAM;QACT,GAAG,OAAO,CAAC,iBAAiB,EAAE,QAAQ,EAAE,QAAQ,CAAC,GAAG,QAAQ,CAAC,eAAe,IAAI,CAAC,EAAE;QACnF,GAAG,CAAC,QAAQ,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,oBAAoB,EAAE,OAAO,EAAE,QAAQ,CAAC,GAAG,QAAQ,CAAC,eAAe,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACvH,GAAG,OAAO,CAAC,4BAA4B,EAAE,UAAU,EAAE,QAAQ,CAAC,GAAG,QAAQ,CAAC,sBAAsB,IAAI,CAAC,EAAE;QACvG,GAAG,OAAO,CAAC,gBAAgB,EAAE,OAAO,EAAE,QAAQ,CAAC,GAAG,WAAW,EAAE;QAC/D,EAAE;KACH,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACf,CAAC;AAED,SAAS,oBAAoB,CAAC,KAAc,EAAE,QAAqB;IACjE,MAAM,MAAM,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QACjC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,EAAmC,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,OAAO,IAAI,KAAK,QAAQ,CAAC;QACpG,CAAC,CAAC,EAAE,CAAC;IACP,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxB,OAAO,CAAC,GAAG,OAAO,CAAC,UAAU,EAAE,WAAW,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAC;IAC5D,CAAC;IACD,OAAO;QACL,OAAO,CAAC,SAAS,EAAE,WAAW,EAAE,QAAQ,CAAC;QACzC,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE;YACtB,MAAM,IAAI,GAAG,OAAO,KAAK,CAAC,IAAI,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC;YAC3F,MAAM,KAAK,GAAG,OAAO,KAAK,CAAC,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;YACrG,MAAM,KAAK,GAAG,KAAK,IAAI,KAAK,KAAK,IAAI,CAAC,CAAC,CAAC,GAAG,IAAI,KAAK,KAAK,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;YACpE,MAAM,GAAG,GAAG,OAAO,KAAK,CAAC,GAAG,KAAK,QAAQ,IAAI,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,GAAG,GAAG,CAAC;gBACvF,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC;gBACnB,CAAC,CAAC,GAAG,CAAC;YACR,MAAM,OAAO,GAAG,OAAO,KAAK,CAAC,OAAO,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE;gBACvE,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE;gBACtB,CAAC,CAAC,GAAG,CAAC;YACR,OAAO,QAAQ,KAAK,IAAI;gBACtB,CAAC,CAAC,KAAK,KAAK,QAAQ,GAAG,OAAO,OAAO,EAAE;gBACvC,CAAC,CAAC,KAAK,KAAK,SAAS,GAAG,aAAa,OAAO,EAAE,CAAC;QACnD,CAAC,CAAC;KACH,CAAC;AACJ,CAAC;AACD,OAAO,EAAE,WAAW,EAAE,OAAO,EAAoB,MAAM,WAAW,CAAC"}

package/dist/cli.js

@@ -1391,7 +1391,12 @@ function printTaskAgentSettings(result) {
     process.stdout.write(`${cliText("Available Agents: ", "可用 Agent：")}${result.agents.map((agent) => `${agent.name} (${agent.title})`).join(", ")}\n`);
 }
 function printTaskSettings(result, setting) {
-    const session = result.session;
+    const session = result.pendingProvider?.settings ?? result.session;
+    if (result.pendingProvider) {
+        const status = cliText("Pending Provider switch (after current turn)", "Provider 待切换（本轮结束后生效）");
+        const error = result.pendingProvider.error ? `: ${result.pendingProvider.error}` : "";
+        process.stdout.write(`${status}${error}\n`);
+    }
     process.stdout.write(`${cliText("Provider: ", "Provider：")}${session.modelProvider ?? cliText("Agent default", "Agent 默认")}\n`);
     process.stdout.write(`${cliText("Model: ", "模型：")}${session.model ?? cliText("default", "默认")}\n`);
     process.stdout.write(`${cliText("Thinking: ", "思考强度：")}${session.reasoningEffort ?? cliText("automatic", "自动")}\n`);