@lobehub/cli 0.0.34 → 0.0.36

package/dist/index.js

@@ -3,7 +3,7 @@ import { createRequire } from "node:module";
 import { EventEmitter, once } from "node:events";
 import { execFile, execFileSync, spawn } from "node:child_process";
 import path, { basename, extname } from "node:path";
-import fs, { constants, createWriteStream, existsSync, readFileSync, realpathSync, statSync, writeFileSync } from "node:fs";
+import fs, { constants, createWriteStream, existsSync, mkdirSync, readFileSync, realpathSync, statSync, writeFileSync } from "node:fs";
 import process$1 from "node:process";
 import crypto$1, { createHash, randomUUID } from "node:crypto";
 import os, { platform, tmpdir } from "node:os";
@@ -5217,7 +5217,8 @@ const CLI_API_KEY_ENV = "LOBEHUB_CLI_API_KEY";
 
 //#endregion
 //#region src/api/client.ts
-let _client;
+const PERSONAL_KEY = "__personal__";
+const _clients = /* @__PURE__ */ new Map();
 let _toolsClient;
 async function getAuthAndServer() {
 	const envJwt = process.env.LOBEHUB_JWT;
@@ -5247,15 +5248,36 @@ async function getAuthAndServer() {
 		serverUrl
 	};
 }
-async function getTrpcClient() {
-	if (_client) return _client;
+/**
+* Resolve the workspace scope for outbound tRPC calls.
+*
+* Precedence: explicit caller arg → `LOBEHUB_WORKSPACE_ID` env (inherited
+* from a workspace-dispatched parent process, e.g. openclaw spawned by the
+* device's `runHeteroTask`) → personal mode. Without this, agentNotify
+* callbacks on workspace topics would resolve through personal-mode
+* TopicModel and 404.
+*/
+function resolveWorkspaceId(explicit) {
+	if (explicit) return explicit;
+	const fromEnv = process.env.LOBEHUB_WORKSPACE_ID;
+	return fromEnv && fromEnv.length > 0 ? fromEnv : void 0;
+}
+async function getTrpcClient(workspaceId) {
+	const wsId = resolveWorkspaceId(workspaceId);
+	const cacheKey = wsId ?? PERSONAL_KEY;
+	const cached = _clients.get(cacheKey);
+	if (cached) return cached;
 	const { headers, serverUrl } = await getAuthAndServer();
-	_client = createTRPCClient({ links: [httpLink({
-		headers,
+	const client = createTRPCClient({ links: [httpLink({
+		headers: wsId ? {
+			...headers,
+			"X-Workspace-Id": wsId
+		} : headers,
 		transformer: SuperJSON,
 		url: `${serverUrl}/trpc/lambda`
 	})] });
-	return _client;
+	_clients.set(cacheKey, client);
+	return client;
 }
 /**
 * Build a Lambda tRPC client from an already-resolved auth context, without
@@ -5264,9 +5286,12 @@ async function getTrpcClient() {
 * via env/stored creds and `process.exit(1)` when none exist, which would
 * abort an otherwise-valid explicit-token session.
 */
-function createLambdaClient(auth) {
+function createLambdaClient(auth, workspaceId) {
 	return createTRPCClient({ links: [httpLink({
-		headers: auth.tokenType === "apiKey" ? { "X-API-Key": auth.token } : { "Oidc-Auth": auth.token },
+		headers: {
+			...auth.tokenType === "apiKey" ? { "X-API-Key": auth.token } : { "Oidc-Auth": auth.token },
+			...workspaceId ? { "X-Workspace-Id": workspaceId } : {}
+		},
 		transformer: SuperJSON,
 		url: `${auth.serverUrl}/trpc/lambda`
 	})] });
@@ -7642,7 +7667,9 @@ const HotkeyEnum = {
 	DeleteLastMessage: "deleteLastMessage",
 	EditMessage: "editMessage",
 	NavigateToChat: "navigateToChat",
+	NextTab: "nextTab",
 	OpenChatSettings: "openChatSettings",
+	PrevTab: "prevTab",
 	OpenHotkeyHelper: "openHotkeyHelper",
 	RegenerateMessage: "regenerateMessage",
 	SaveDocument: "saveDocument",
@@ -7650,6 +7677,7 @@ const HotkeyEnum = {
 	Search: "search",
 	ShowApp: "showApp",
 	SwitchAgent: "switchAgent",
+	SwitchTab: "switchTab",
 	ToggleLeftPanel: "toggleLeftPanel",
 	ToggleRightPanel: "toggleRightPanel"
 };
@@ -7683,6 +7711,31 @@ const HOTKEYS_REGISTRATION = [
 		nonEditable: true,
 		scopes: [HotkeyScopeEnum.Global]
 	},
+	{
+		group: HotkeyGroupEnum.Essential,
+		id: HotkeyEnum.SwitchTab,
+		keys: combineKeys([KeyEnum.Mod, KeyEnum.Number]),
+		nonEditable: true,
+		scopes: [HotkeyScopeEnum.Global]
+	},
+	{
+		group: HotkeyGroupEnum.Essential,
+		id: HotkeyEnum.NextTab,
+		keys: combineKeys([KeyEnum.Ctrl, KeyEnum.Tab]),
+		nonEditable: true,
+		scopes: [HotkeyScopeEnum.Global]
+	},
+	{
+		group: HotkeyGroupEnum.Essential,
+		id: HotkeyEnum.PrevTab,
+		keys: combineKeys([
+			KeyEnum.Ctrl,
+			KeyEnum.Shift,
+			KeyEnum.Tab
+		]),
+		nonEditable: true,
+		scopes: [HotkeyScopeEnum.Global]
+	},
 	{
 		group: HotkeyGroupEnum.Essential,
 		id: HotkeyEnum.NavigateToChat,
@@ -8755,7 +8808,7 @@ const MEMORY_SEARCH_TOP_K_LIMITS = {
 
 //#endregion
 //#region ../../package.json
-var version$2 = "2.2.6";
+var version$2 = "2.2.7";
 
 //#endregion
 //#region ../../packages/const/src/version.ts
@@ -204262,6 +204315,7 @@ var GatewayClient = class extends EventEmitter {
 	token;
 	tokenType;
 	userId;
+	workspaceId;
 	serverUrl;
 	logger;
 	autoReconnect;
@@ -204275,6 +204329,7 @@ var GatewayClient = class extends EventEmitter {
 		this.channel = options.channel;
 		this.serverUrl = options.serverUrl;
 		this.userId = options.userId;
+		this.workspaceId = options.workspaceId;
 		this.logger = options.logger || noopLogger;
 		this.autoReconnect = options.autoReconnect ?? true;
 	}
@@ -204380,7 +204435,8 @@ var GatewayClient = class extends EventEmitter {
 			platform: process.platform
 		});
 		if (this.channel) params.set("channel", this.channel);
-		if (this.userId) params.set("userId", this.userId);
+		if (this.workspaceId) params.set("workspaceId", this.workspaceId);
+		else if (this.userId) params.set("userId", this.userId);
 		return `${wsProtocol}://${host}/ws?${params.toString()}`;
 	}
 	handleOpen = () => {
@@ -204708,7 +204764,7 @@ const buildHeteroExecStdinPayload = (params) => {
 * instead flows back as a dispatch failure the user can see.
 */
 function spawnHeteroAgentRun(params, logger) {
-	const { agentType, cwd, imageList, jwt, operationId, prompt, resumeSessionId, serverUrl, systemContext, topicId } = params;
+	const { agentType, args: extraArgs, cwd, imageList, jwt, operationId, prompt, resumeSessionId, serverUrl, systemContext, topicId } = params;
 	const workDir = cwd ?? process.cwd();
 	const cliArgs = [
 		process.argv[1],
@@ -204726,7 +204782,8 @@ function spawnHeteroAgentRun(params, logger) {
 		"-",
 		"--cwd",
 		workDir,
-		...resumeSessionId ? ["--resume", resumeSessionId] : []
+		...resumeSessionId ? ["--resume", resumeSessionId] : [],
+		...extraArgs ?? []
 	];
 	const stdinPayload = buildHeteroExecStdinPayload({
 		imageList,
@@ -205682,6 +205739,34 @@ async function registerDevice(auth, identity) {
 		platform: process.platform
 	});
 }
+/**
+* Identity for a WORKSPACE device: derived from the workspaceId (namespaced) so
+* the same physical machine enrolled into a workspace is a distinct device from
+* its personal identity, and stable across reconnects.
+*/
+function resolveWorkspaceDeviceIdentity(workspaceId, explicitDeviceId) {
+	if (explicitDeviceId) return {
+		deviceId: explicitDeviceId,
+		identitySource: "fallback"
+	};
+	return deriveDeviceId(`workspace:${workspaceId}`);
+}
+/**
+* Mint a workspace-device connect token (owner-only on the server). The returned
+* token carries the `workspace_id` claim the gateway routes by.
+*/
+async function mintWorkspaceConnectToken(auth, workspaceId) {
+	return createLambdaClient(auth, workspaceId).device.mintWorkspaceConnectToken.mutate();
+}
+/** Register this machine as a device of the given workspace (owner-only). */
+async function registerWorkspaceDevice(auth, identity, workspaceId) {
+	await createLambdaClient(auth, workspaceId).device.registerWorkspaceDevice.mutate({
+		deviceId: identity.deviceId,
+		hostname: os.hostname(),
+		identitySource: identity.identitySource,
+		platform: process.platform
+	});
+}
 
 //#endregion
 //#region src/tools/checkPlatformCapability.ts
@@ -205916,9 +206001,9 @@ function resolveLhPath() {
 		return "lh";
 	}
 }
-async function sendAutoNotify(topicId, taskId, text, agentId) {
+async function sendAutoNotify(topicId, taskId, text, agentId, workspaceId) {
 	try {
-		await (await getTrpcClient()).agentNotify.notify.mutate({
+		await (await getTrpcClient(workspaceId)).agentNotify.notify.mutate({
 			agentId,
 			content: text,
 			role: "assistant",
@@ -205935,9 +206020,9 @@ async function sendAutoNotify(topicId, taskId, text, agentId) {
 * `sendAutoNotify` which writes an error message AND triggers completion via
 * the `done` flag.
 */
-async function sendDoneSignal(topicId, agentId) {
+async function sendDoneSignal(topicId, agentId, workspaceId) {
 	try {
-		await (await getTrpcClient()).agentNotify.notify.mutate({
+		await (await getTrpcClient(workspaceId)).agentNotify.notify.mutate({
 			agentId,
 			content: "",
 			done: true,
@@ -205966,9 +206051,13 @@ This conversation / task was sent to you by the **LobeHub platform** on behalf o
 Use the \`${lhPath} notify\` command. All your updates appear as a **single message bubble** in the UI — create it once and update it in place.\n\n**Step 1 — Open the bubble on your first meaningful update** (captures the messageId):\n\`\`\`\nMSG_ID=$(${lhPath} notify --topic ${topicId} --role assistant --content "Starting..." --json | grep -o '"messageId":"[^"]*"' | cut -d'"' -f4)\n\`\`\`\n\n**Step 2 — Update the same bubble as you make progress**:\n\`\`\`\n${lhPath} notify --topic ${topicId} --role assistant --message-id "$MSG_ID" --content "Still working..."\n\`\`\`\n\n**Step 3 — Replace with your complete, final response when done**:\n\`\`\`\n${lhPath} notify --topic ${topicId} --role assistant --message-id "$MSG_ID" --content "<your full response here>"\n\`\`\`\n\nRules:\n- Always use \`--json\` on the first call and capture \`messageId\` from the output.\n- Always pass \`--message-id\` on every subsequent call so updates overwrite the same bubble.\n- Write what matters to the user — not implementation steps or internal tool calls.\n- Call notify at least once when the task is done, even if there were no intermediate updates.`;
 }
 async function runHeteroTask(params) {
-	const { agentId, agentType, cwd, operationId, prompt, taskId, topicId } = params;
+	const { agentId, agentType, cwd, operationId, prompt, taskId, topicId, workspaceId } = params;
 	const workDir = cwd || process.cwd();
 	const lhPath = resolveLhPath();
+	const childEnv = workspaceId ? {
+		...process.env,
+		LOBEHUB_WORKSPACE_ID: workspaceId
+	} : { ...process.env };
 	if (agentType === "openclaw") {
 		const openclawAgent = process.env.OPENCLAW_AGENT_ID ?? "main";
 		const enrichedPrompt = `${prompt}\n\n${buildNotifyProtocol(lhPath, topicId)}`;
@@ -205990,7 +206079,7 @@ async function runHeteroTask(params) {
 		], {
 			cwd: workDir,
 			detached: true,
-			env: { ...process.env },
+			env: childEnv,
 			stdio: "ignore"
 		});
 		const pid = child.pid;
@@ -206003,13 +206092,14 @@ async function runHeteroTask(params) {
 			pid,
 			startedAt: (/* @__PURE__ */ new Date()).toISOString(),
 			taskId,
-			topicId
+			topicId,
+			workspaceId
 		});
 		log$10.info(`OpenClaw task started: taskId=${taskId} pid=${pid} agent=${openclawAgent}`);
 		child.on("close", (code, signal) => {
 			removeTask(taskId);
-			if (code !== 0 || signal !== null) sendAutoNotify(topicId, taskId, signal ? `Task cancelled (signal: ${signal})` : `Task failed (exit code: ${code})`, agentId).finally(() => sendDoneSignal(topicId, agentId));
-			else sendDoneSignal(topicId, agentId);
+			if (code !== 0 || signal !== null) sendAutoNotify(topicId, taskId, signal ? `Task cancelled (signal: ${signal})` : `Task failed (exit code: ${code})`, agentId, workspaceId).finally(() => sendDoneSignal(topicId, agentId, workspaceId));
+			else sendDoneSignal(topicId, agentId, workspaceId);
 		});
 		return JSON.stringify({
 			pid,
@@ -206035,7 +206125,7 @@ async function runHeteroTask(params) {
 		const child = spawn("hermes", hermesArgs, {
 			cwd: workDir,
 			detached: true,
-			env: { ...process.env },
+			env: childEnv,
 			stdio: [
 				"ignore",
 				"pipe",
@@ -206052,7 +206142,8 @@ async function runHeteroTask(params) {
 			pid,
 			startedAt: (/* @__PURE__ */ new Date()).toISOString(),
 			taskId,
-			topicId
+			topicId,
+			workspaceId
 		});
 		log$10.info(`Hermes task started: taskId=${taskId} pid=${pid}`);
 		let stdout = "";
@@ -206062,14 +206153,14 @@ async function runHeteroTask(params) {
 		child.on("close", (code, signal) => {
 			removeTask(taskId);
 			if (code !== 0 || signal !== null) {
-				sendAutoNotify(topicId, taskId, signal ? `Task cancelled (signal: ${signal})` : `Task failed (exit code: ${code})`, agentId).finally(() => sendDoneSignal(topicId, agentId));
+				sendAutoNotify(topicId, taskId, signal ? `Task cancelled (signal: ${signal})` : `Task failed (exit code: ${code})`, agentId, workspaceId).finally(() => sendDoneSignal(topicId, agentId, workspaceId));
 				return;
 			}
 			const sessionId = stdout.match(/^session_id:\s*(\S+)/m)?.[1];
 			const response = stdout.replace(/^session_id:[^\n]*\n?/, "").trim();
 			if (sessionId) saveHermesSessionId(topicId, sessionId);
-			if (response) sendAutoNotify(topicId, taskId, response, agentId).finally(() => sendDoneSignal(topicId, agentId));
-			else sendDoneSignal(topicId, agentId);
+			if (response) sendAutoNotify(topicId, taskId, response, agentId, workspaceId).finally(() => sendDoneSignal(topicId, agentId, workspaceId));
+			else sendDoneSignal(topicId, agentId, workspaceId);
 		});
 		return JSON.stringify({
 			pid,
@@ -206090,7 +206181,7 @@ async function cancelHeteroTask(params) {
 	} catch (err) {
 		log$10.warn(`Failed to send ${signal} to pid ${entry.pid}: ${err instanceof Error ? err.message : String(err)}`);
 		removeTask(taskId);
-		await sendAutoNotify(entry.topicId, taskId, "Task already completed or cancelled", entry.agentId);
+		await sendAutoNotify(entry.topicId, taskId, "Task already completed or cancelled", entry.agentId, entry.workspaceId);
 	}
 	return JSON.stringify({
 		pid: entry.pid,
@@ -207160,7 +207251,7 @@ async function executeToolCall(apiName, argsStr, timeout) {
 //#endregion
 //#region src/commands/connect.ts
 function registerConnectCommand(program) {
-	const connectCmd = program.command("connect").description("Connect to the device gateway and listen for tool calls").option("--token <jwt>", "JWT access token").option("--gateway <url>", "Device gateway URL").option("--device-id <id>", "Device ID (auto-generated if not provided)").option("-v, --verbose", "Enable verbose logging").option("-d, --daemon", "Run as a background daemon process").option("--daemon-child", "Internal: runs as the daemon child process").action(async (options) => {
+	const connectCmd = program.command("connect").description("Connect to the device gateway and listen for tool calls").option("--token <jwt>", "JWT access token").option("--gateway <url>", "Device gateway URL").option("--device-id <id>", "Device ID (auto-generated if not provided)").option("--workspace <id>", "Enroll as a device of this workspace (admin only)").option("-v, --verbose", "Enable verbose logging").option("-d, --daemon", "Run as a background daemon process").option("--daemon-child", "Internal: runs as the daemon child process").action(async (options) => {
 		if (options.verbose) setVerbose(true);
 		if (options.daemon) return handleDaemonStart(options);
 		await runConnect(options, options.daemonChild || process.env.LOBEHUB_DAEMON === "1");
@@ -207228,6 +207319,7 @@ function buildDaemonArgs(options) {
 	if (options.token) args.push("--token", options.token);
 	if (options.gateway) args.push("--gateway", options.gateway);
 	if (options.deviceId) args.push("--device-id", options.deviceId);
+	if (options.workspace) args.push("--workspace", options.workspace);
 	if (options.verbose) args.push("--verbose");
 	return args;
 }
@@ -207245,7 +207337,25 @@ async function runConnect(options, isDaemonChild) {
 		gatewayUrl
 	});
 	const resolvedGatewayUrl = gatewayUrl || "https://device-gateway.lobehub.com";
-	const identity = resolveDeviceIdentity(auth.userId, options.deviceId);
+	const workspaceId = options.workspace;
+	const identity = workspaceId ? resolveWorkspaceDeviceIdentity(workspaceId, options.deviceId) : resolveDeviceIdentity(auth.userId, options.deviceId);
+	let connectToken = auth.token;
+	let connectTokenType = auth.tokenType;
+	if (workspaceId) {
+		connectToken = (await mintWorkspaceConnectToken(auth, workspaceId)).token;
+		connectTokenType = "jwt";
+	}
+	const refreshConnectToken = async () => {
+		const refreshed = await resolveToken({});
+		if (!refreshed) return void 0;
+		auth = refreshed;
+		if (workspaceId) {
+			connectToken = (await mintWorkspaceConnectToken(auth, workspaceId)).token;
+			return connectToken;
+		}
+		connectToken = refreshed.token;
+		return connectToken;
+	};
 	const client = new GatewayClient({
 		channel: process.env.LOBEHUB_CLI_CHANNEL || "cli",
 		connectionId: loadOrCreateConnectionId(),
@@ -207253,9 +207363,10 @@ async function runConnect(options, isDaemonChild) {
 		gatewayUrl: resolvedGatewayUrl,
 		logger: isDaemonChild ? createDaemonLogger() : log$10,
 		serverUrl: auth.serverUrl,
-		token: auth.token,
-		tokenType: auth.tokenType,
-		userId: auth.userId
+		token: connectToken,
+		tokenType: connectTokenType,
+		userId: workspaceId ? void 0 : auth.userId,
+		workspaceId
 	});
 	const info = (msg) => {
 		if (isDaemonChild) appendLog(msg);
@@ -207347,6 +207458,7 @@ async function runConnect(options, isDaemonChild) {
 		try {
 			const ack = await spawnHeteroAgentRun({
 				agentType: request.agentType,
+				args: request.args,
 				cwd: request.cwd,
 				imageList: request.imageList,
 				jwt: request.jwt,
@@ -207383,23 +207495,26 @@ async function runConnect(options, isDaemonChild) {
 	client.on("reconnecting", () => {
 		updateStatus("reconnecting");
 	});
-	const startProactiveRefresh = () => scheduleProactiveRefresh(auth, (refreshed) => {
-		client.updateToken(refreshed.token);
-		auth = refreshed;
-		cancelRefreshTimer = startProactiveRefresh();
+	const startProactiveRefresh = () => scheduleProactiveRefresh(connectToken, connectTokenType, async () => {
+		const newToken = await refreshConnectToken();
+		if (newToken) {
+			client.updateToken(newToken);
+			cancelRefreshTimer = startProactiveRefresh();
+		}
+		return newToken;
 	}, info, error);
 	let cancelRefreshTimer = startProactiveRefresh();
 	let authFailedRefreshAttempted = false;
 	client.on("auth_failed", async (reason) => {
-		if (auth.tokenType === "jwt" && !authFailedRefreshAttempted) {
+		if (connectTokenType === "jwt" && !authFailedRefreshAttempted) {
 			authFailedRefreshAttempted = true;
 			info(`Authentication failed (${reason}). Attempting token refresh...`);
 			try {
-				const refreshed = await resolveToken({});
-				if (refreshed && refreshed.token !== auth.token) {
+				const prev = connectToken;
+				const newToken = await refreshConnectToken();
+				if (newToken && newToken !== prev) {
 					info("Token refreshed successfully. Reconnecting...");
-					client.updateToken(refreshed.token);
-					auth = refreshed;
+					client.updateToken(newToken);
 					authFailedRefreshAttempted = false;
 					cancelRefreshTimer = startProactiveRefresh();
 					await client.reconnect();
@@ -207413,14 +207528,13 @@ async function runConnect(options, isDaemonChild) {
 		process.exit(1);
 	});
 	client.on("auth_expired", async () => {
-		if (auth.tokenType === "apiKey") return;
+		if (connectTokenType === "apiKey") return;
 		info("Authentication expired. Attempting to refresh token...");
 		try {
-			const refreshed = await resolveToken({});
-			if (refreshed) {
+			const newToken = await refreshConnectToken();
+			if (newToken) {
 				info("Token refreshed successfully. Reconnecting...");
-				client.updateToken(refreshed.token);
-				auth = refreshed;
+				client.updateToken(newToken);
 				cancelRefreshTimer = startProactiveRefresh();
 				await client.reconnect();
 				return;
@@ -207450,7 +207564,8 @@ async function runConnect(options, isDaemonChild) {
 		process.exit(0);
 	});
 	if (identity) try {
-		await registerDevice(auth, identity);
+		if (workspaceId) await registerWorkspaceDevice(auth, identity, workspaceId);
+		else await registerDevice(auth, identity);
 	} catch (err) {
 		error(`Device registration failed (non-fatal): ${err.message}`);
 	}
@@ -207488,31 +207603,31 @@ function parseJwtExp(token) {
 	}
 }
 /**
-* Schedule a proactive token refresh before the JWT expires.
-* Returns a cleanup function that cancels the scheduled timer.
+* Schedule a proactive token refresh before the (connect) token expires.
+* `refresh` performs the actual refresh — re-minting a workspace token or
+* refreshing the user token — and returns the new token. Returns a cleanup
+* function that cancels the scheduled timer.
 */
-function scheduleProactiveRefresh(auth, onRefreshed, info, error) {
-	if (auth.tokenType !== "jwt") return null;
-	const exp = parseJwtExp(auth.token);
+function scheduleProactiveRefresh(token, tokenType, refresh, info, error) {
+	if (tokenType !== "jwt") return null;
+	const exp = parseJwtExp(token);
 	if (!exp) return null;
-	const delay = (exp - PROACTIVE_REFRESH_BUFFER) * 1e3 - Date.now();
-	if (delay < 0) {
+	const lifetimeMs = exp * 1e3 - Date.now();
+	if (lifetimeMs <= 0) {
 		doRefresh();
 		return null;
 	}
+	const delay = lifetimeMs - Math.min(PROACTIVE_REFRESH_BUFFER * 1e3, lifetimeMs / 2);
 	const timer = setTimeout(() => void doRefresh(), delay);
 	return () => clearTimeout(timer);
 	async function doRefresh() {
 		try {
-			if (!await getValidToken(PROACTIVE_REFRESH_BUFFER)) {
+			const newToken = await refresh();
+			if (!newToken) {
 				error("Proactive token refresh failed — no valid credentials.");
 				return;
 			}
-			const refreshed = await resolveToken({});
-			if (refreshed.token !== auth.token) {
-				info("Proactively refreshed token.");
-				onRefreshed(refreshed);
-			}
+			if (newToken !== token) info("Proactively refreshed token.");
 		} catch {
 			error("Proactive token refresh failed.");
 		}
@@ -209109,6 +209224,17 @@ var ClaudeCodeAdapter = class {
 	sawStreamEvent = false;
 	/** Track current message.id to detect step boundaries */
 	currentMessageId;
+	/**
+	* Whether the current turn (the in-flight `currentMessageId`) has already
+	* emitted a `tool_use`. When CC reuses the SAME `message.id` to stream the
+	* model's post-tool answer (it continues after the `tool_result` without
+	* minting a fresh id — seen on device/batch `lh hetero exec` runs), that
+	* trailing text must NOT coalesce onto the tool-issuing assistant. We force a
+	* step boundary so the answer anchors to its own assistant, chained after the
+	* tool results — otherwise text + `tool_use` share one message and the
+	* renderer drops the tool block below the answer.
+	*/
+	currentTurnHadToolUse = false;
 	/** message.id of the stream_event delta flow currently in flight */
 	currentStreamEventMessageId;
 	/**
@@ -209299,7 +209425,10 @@ var ClaudeCodeAdapter = class {
 		if (parentToolUseId) return this.handleSubagentAssistant(raw, parentToolUseId);
 		const events = [];
 		const messageId = raw.message?.id;
-		events.push(...this.openMainMessage(messageId, raw.message?.model));
+		const hasTextBlock = content.some((b) => b?.type === "text" && b.text);
+		const hasToolUseBlock = content.some((b) => b?.type === "tool_use");
+		const isPostToolTextReusingId = hasTextBlock && !hasToolUseBlock && messageId !== void 0 && messageId === this.currentMessageId && this.currentTurnHadToolUse;
+		events.push(...this.openMainMessage(messageId, raw.message?.model, isPostToolTextReusingId));
 		if (raw.message?.model) this.currentStreamEventModel = raw.message.model;
 		const textParts = [];
 		const reasoningParts = [];
@@ -209330,7 +209459,10 @@ var ClaudeCodeAdapter = class {
 				break;
 			}
 		}
-		if (newToolCalls.length > 0) this.pendingExternalSignal = void 0;
+		if (newToolCalls.length > 0) {
+			this.pendingExternalSignal = void 0;
+			this.currentTurnHadToolUse = true;
+		}
 		const textCompletion = this.getTrailingCompletion(messageId, textParts.join(""), this.streamedTextByMessageId);
 		const thinkingCompletion = this.getTrailingCompletion(messageId, reasoningParts.join(""), this.streamedThinkingByMessageId);
 		if (thinkingCompletion) events.push(this.makeChunkEvent({
@@ -209699,22 +209831,37 @@ var ClaudeCodeAdapter = class {
 	*   record the id (init already primed the executor).
 	* - Otherwise: advance stepIndex and emit stream_end + stream_start(newStep).
 	*/
-	openMainMessage(messageId, model) {
+	openMainMessage(messageId, model, forcePostToolBoundary = false) {
 		if (!messageId) return [];
 		if (!this.started) {
 			this.started = true;
 			this.currentMessageId = messageId;
+			this.currentTurnHadToolUse = false;
 			return [this.makeEvent("stream_start", {
 				model,
 				provider: "claude-code"
 			})];
 		}
-		if (messageId === this.currentMessageId) return [];
+		if (messageId === this.currentMessageId) {
+			if (!forcePostToolBoundary) return [];
+			this.stepIndex++;
+			this.currentTurnHadToolUse = false;
+			this.hasUnhandledUserInput = false;
+			this.pendingExternalSignal = void 0;
+			return [this.makeEvent("stream_end", {}), this.makeEvent("stream_start", {
+				messageId: `${messageId}:s${this.stepIndex}`,
+				model,
+				newStep: true,
+				provider: "claude-code"
+			})];
+		}
 		if (this.currentMessageId === void 0) {
 			this.currentMessageId = messageId;
+			this.currentTurnHadToolUse = false;
 			return [];
 		}
 		this.currentMessageId = messageId;
+		this.currentTurnHadToolUse = false;
 		this.stepIndex++;
 		if (!this.hasUnhandledUserInput && this.activeTasks.size > 0) {
 			const lastTaskKey = [...this.activeTasks.keys()].at(-1);
@@ -211530,6 +211677,7 @@ var TrpcIngestSink = class {
 //#endregion
 //#region src/commands/hetero.ts
 const SUPPORTED_AGENT_TYPES = new Set(["claude-code", "codex"]);
+const CODEX_REASONING_EFFORT_CONFIG_KEY = "model_reasoning_effort";
 /**
 * Patterns that indicate a `--resume <sessionId>` run should be retried
 * without `--resume`.  Two classes of failure:
@@ -211560,6 +211708,12 @@ const RESUME_RETRY_PATTERNS = [
 ];
 const looksLikeNeedsRetryWithoutResume = (text) => RESUME_RETRY_PATTERNS.some((p) => p.test(text));
 const collectImage = (value, previous = []) => [...previous, value];
+const collectAgentArg = (value, previous = []) => [...previous, value];
+const buildExtraArgs = (options) => {
+	const selectorArgs = options.type === "codex" ? [...options.model ? ["--model", options.model] : [], ...options.effort ? ["-c", `${CODEX_REASONING_EFFORT_CONFIG_KEY}="${options.effort}"`] : []] : [...options.model ? ["--model", options.model] : [], ...options.effort ? ["--effort", options.effort] : []];
+	const extraArgs = [...options.agentArg ?? [], ...selectorArgs];
+	return extraArgs.length > 0 ? extraArgs : void 0;
+};
 const readStdin = async () => {
 	const chunks = [];
 	for await (const chunk of process.stdin) chunks.push(typeof chunk === "string" ? Buffer.from(chunk) : chunk);
@@ -211940,10 +212094,12 @@ const exec = async (options) => {
 		};
 	};
 	const interceptResume = !!options.resume;
+	const extraArgs = buildExtraArgs(options);
 	const first = await runOneAgent({
 		agentType: options.type,
 		command: options.command,
 		cwd: options.cwd || process.cwd(),
+		extraArgs,
 		operationId,
 		prompt: resolved.prompt,
 		resumeSessionId: options.resume
@@ -211955,6 +212111,7 @@ const exec = async (options) => {
 			agentType: options.type,
 			command: options.command,
 			cwd: options.cwd || process.cwd(),
+			extraArgs,
 			operationId,
 			prompt: resolved.prompt
 		}, false, "attempt-2-noresume");
@@ -211994,7 +212151,7 @@ const exec = async (options) => {
 	process.exit(1);
 };
 function registerHeteroCommand(program) {
-	program.command("hetero").description("Run heterogeneous agent CLIs (Claude Code / Codex) and stream their output").command("exec").description("Spawn a heterogeneous agent CLI and stream its events as JSONL on stdout. Standalone mode (no server ingest).").requiredOption("-t, --type <type>", `Agent type: ${[...SUPPORTED_AGENT_TYPES].join(" | ")}`).option("-p, --prompt [text]", "Prompt text. Pass `-` (or omit the value) to read from stdin.").option("-i, --image <path|url>", "Attach an image (repeatable). Accepts a local path, http(s) URL, or data: URL.", collectImage).option("--input-json <path>", "Read full multimodal prompt as JSON content blocks from a file. Use `-` for stdin.").option("-r, --resume <sessionId>", "Resume an existing agent session by its native id").option("-d, --cwd <path>", "Working directory for the spawned agent (default: process.cwd())").option("-c, --command <bin>", "Override the agent CLI binary name (default: `claude` or `codex`)").option("--operation-id <id>", "Operation id stamped onto every emitted event. Required in server-ingest mode (--topic). Generated as a UUID if omitted (standalone).").option("--topic <topicId>", "Server topic id. Enables server-ingest mode: events are batch-POSTed to aiAgent.heteroIngest. Requires --operation-id.").option("--render <mode>", "Output mode: jsonl (emit events as JSONL on stdout) | none (suppress stdout). Defaults to jsonl in standalone, none in server-ingest mode.").option("--raw-dump <dir>", "Persist the agent process RAW stdout/stderr (pre-adapter stream-json) under <dir>/<timestamp>-<operationId>/ for debugging. Each spawn attempt writes its own .stdout.jsonl / .stderr.log. Best-effort; never affects the run.").action(exec);
+	program.command("hetero").description("Run heterogeneous agent CLIs (Claude Code / Codex) and stream their output").command("exec").description("Spawn a heterogeneous agent CLI and stream its events as JSONL on stdout. Standalone mode (no server ingest).").requiredOption("-t, --type <type>", `Agent type: ${[...SUPPORTED_AGENT_TYPES].join(" | ")}`).option("-p, --prompt [text]", "Prompt text. Pass `-` (or omit the value) to read from stdin.").option("-i, --image <path|url>", "Attach an image (repeatable). Accepts a local path, http(s) URL, or data: URL.", collectImage).option("--input-json <path>", "Read full multimodal prompt as JSON content blocks from a file. Use `-` for stdin.").option("-r, --resume <sessionId>", "Resume an existing agent session by its native id").option("-d, --cwd <path>", "Working directory for the spawned agent (default: process.cwd())").option("--model <model>", "Forward a resolved model selection to the agent CLI").option("--effort <level>", "Forward a resolved reasoning effort selection to the agent CLI").option("--agent-arg <arg>", "Forward one native agent CLI argument after wrapper parsing (repeatable)", collectAgentArg).option("-c, --command <bin>", "Override the agent CLI binary name (default: `claude` or `codex`)").option("--operation-id <id>", "Operation id stamped onto every emitted event. Required in server-ingest mode (--topic). Generated as a UUID if omitted (standalone).").option("--topic <topicId>", "Server topic id. Enables server-ingest mode: events are batch-POSTed to aiAgent.heteroIngest. Requires --operation-id.").option("--render <mode>", "Output mode: jsonl (emit events as JSONL on stdout) | none (suppress stdout). Defaults to jsonl in standalone, none in server-ingest mode.").option("--raw-dump <dir>", "Persist the agent process RAW stdout/stderr (pre-adapter stream-json) under <dir>/<timestamp>-<operationId>/ for debugging. Each spawn attempt writes its own .stdout.jsonl / .stderr.log. Best-effort; never affects the run.").action(exec);
 }
 
 //#endregion
@@ -217544,6 +217701,37 @@ function evidencePaths(evidence) {
 }
 function registerVerifyCommand(program) {
 	const verify = program.command("verify").description("Manage the Agent Run delivery checker (criteria, rubrics, plans, results)");
+	verify.command("init").description("Write the portable verify skill into a working dir (.claude/skills/verify)").option("--dir <path>", "Target working directory (default: current dir)").option("--skill <id>", "Skill identifier to pull", "verify").option("--force", "Overwrite existing skill files").option("--json [fields]", "Output JSON").action(async (options) => {
+		const bundle = await (await getTrpcClient()).verify.getSkillBundle.query({ identifier: options.skill });
+		const baseDir = options.dir ? path.resolve(options.dir) : process.cwd();
+		const skillDir = path.join(baseDir, ".claude", "skills", bundle.identifier);
+		const entries = [["SKILL.md", bundle.content], ...Object.entries(bundle.files)];
+		const written = [];
+		const skipped = [];
+		for (const [rel, content] of entries) {
+			const dest = path.join(skillDir, rel);
+			if (existsSync(dest) && !options.force) {
+				skipped.push(rel);
+				continue;
+			}
+			mkdirSync(path.dirname(dest), { recursive: true });
+			writeFileSync(dest, content, "utf8");
+			written.push(rel);
+		}
+		const result = {
+			dir: skillDir,
+			skill: bundle.identifier,
+			skipped,
+			written
+		};
+		if (options.json !== void 0) {
+			outputJson(result, typeof options.json === "string" ? options.json : void 0);
+			return;
+		}
+		console.log(`${import_picocolors.default.green("✓")} ${import_picocolors.default.bold(bundle.name)} skill → ${import_picocolors.default.dim(path.relative(process.cwd(), skillDir) || skillDir)}`);
+		console.log(`  ${written.length} written${skipped.length ? `, ${skipped.length} skipped` : ""}`);
+		if (skipped.length > 0) console.log(import_picocolors.default.dim(`  (skipped existing — pass --force to overwrite)`));
+	});
 	const criterion = verify.command("criterion").description("Reusable pass/fail standards");
 	criterion.command("list").description("List criteria").option("--json [fields]", "Output JSON, optionally specify fields (comma-separated)").action(async (options) => {
 		const items = await (await getTrpcClient()).verify.listCriteria.query();
@@ -217935,10 +218123,23 @@ function registerVerifyCommand(program) {
 		const summary = result.summary ?? {};
 		const reportMdPath = path.join(dir, "report.md");
 		const content = existsSync(reportMdPath) ? readFileSync(reportMdPath, "utf8") : void 0;
+		const surfaces = Array.isArray(result.surfaces) ? result.surfaces.filter((s) => typeof s === "string") : void 0;
+		const contextEntries = Object.entries({
+			branch: typeof result.branch === "string" ? result.branch : void 0,
+			commit: typeof result.commit === "string" ? result.commit : void 0,
+			entry: typeof result.entry === "string" ? result.entry : void 0,
+			focus: typeof result.focus === "string" ? result.focus : options.goal,
+			surfaces: surfaces && surfaces.length > 0 ? surfaces : void 0,
+			testedAt: typeof result.createdAt === "string" ? result.createdAt : void 0
+		}).filter(([, v]) => v !== void 0);
+		const context = contextEntries.length > 0 ? Object.fromEntries(contextEntries) : void 0;
+		const scenario = result.scenario === "coding" ? "coding" : "coding";
 		const client = await getTrpcClient();
 		const run = await client.verify.createRun.mutate({
-			goal: options.goal,
+			context,
+			goal: options.goal ?? (typeof result.focus === "string" ? result.focus : void 0),
 			operationId: options.operation,
+			scenario,
 			source: options.source,
 			title: options.title ?? result.title
 		});
@@ -217964,22 +218165,29 @@ function registerVerifyCommand(program) {
 					log$10.warn(`evidence not found, skipping: ${rel}`);
 					continue;
 				}
-				const file = await uploadLocalFile(client, abs);
-				await client.verify.uploadEvidence.mutate({
-					capturedBy: "cli",
-					checkResultId: checkResult.id,
-					description: c.name ?? path.basename(abs),
-					fileId: file.id,
-					type: evidenceTypeForFile(abs)
-				});
-				uploaded += 1;
+				try {
+					const file = await uploadLocalFile(client, abs);
+					await client.verify.uploadEvidence.mutate({
+						capturedBy: "cli",
+						checkResultId: checkResult.id,
+						description: path.basename(abs),
+						fileId: file.id,
+						type: evidenceTypeForFile(abs)
+					});
+					uploaded += 1;
+				} catch (e) {
+					log$10.warn(`evidence upload failed, skipping ${path.basename(abs)}: ${String(e)}`);
+				}
 			}
 		}
+		const conclusion = typeof summary.conclusion === "string" ? summary.conclusion : typeof summary.note === "string" ? summary.note : void 0;
+		const score = typeof summary.score === "number" ? Math.max(0, Math.min(1, summary.score / 100)) : void 0;
 		await client.verify.upsertReport.mutate({
 			content,
 			failedChecks: summary.failed,
+			overallConfidence: score,
 			passedChecks: summary.passed,
-			summary: typeof summary.note === "string" ? summary.note : void 0,
+			summary: conclusion,
 			totalChecks: summary.total ?? cases.length,
 			uncertainChecks: (summary.blocked ?? 0) + (summary.uncertain ?? 0) || void 0,
 			verdict: summary.verdict ? toVerdict(summary.verdict) : void 0,

package/man/man1/lh.1

@@ -1,6 +1,6 @@
 .\" Code generated by `npm run man:generate`; DO NOT EDIT.
 .\" Manual command details come from the Commander command tree.
-.TH LH 1 "" "@lobehub/cli 0.0.34" "User Commands"
+.TH LH 1 "" "@lobehub/cli 0.0.36" "User Commands"
 .SH NAME
 lh \- LobeHub CLI \- manage and connect to LobeHub services
 .SH SYNOPSIS

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lobehub/cli",
-  "version": "0.0.34",
+  "version": "0.0.36",
   "type": "module",
   "bin": {
     "lh": "./dist/index.js",
@@ -33,12 +33,12 @@
     "tsdown": "^0.21.4",
     "typescript": "^6.0.3",
     "ws": "^8.18.1",
-    "@lobechat/agent-gateway-client": "1.0.0",
-    "@lobechat/device-gateway-client": "1.0.0",
-    "@lobechat/device-control": "1.0.0",
     "@lobechat/device-identity": "1.0.0",
-    "@lobechat/local-file-shell": "1.0.0",
     "@lobechat/heterogeneous-agents": "1.0.0",
+    "@lobechat/device-control": "1.0.0",
+    "@lobechat/device-gateway-client": "1.0.0",
+    "@lobechat/agent-gateway-client": "1.0.0",
+    "@lobechat/local-file-shell": "1.0.0",
     "@lobechat/tool-runtime": "1.0.0"
   },
   "publishConfig": {