@logicseek/hello-cc 1.0.2 → 1.1.0-rc.1

package/lib/web/ui-interactions.mjs

@@ -1,8 +1,12 @@
+import { createMcpFormValidator } from '../integrations/mcp-elicitation.mjs';
+import { createMcpUrlValidator } from '../integrations/mcp-url-elicitation.mjs';
+
 // Shared form controls for Web-owned and independent native executors.
 export function interactionPanelScript() {
   return String.raw`(() => {
     if (window.hccInteractions) return;
-    const drafts = new Map();
+    const mcpForms = (${createMcpFormValidator.toString()})(), mcpUrls = (${createMcpUrlValidator.toString()})();
+    const drafts = new Map(), expanded = new Map();
     let focus = null;
     function remember(container) {
       container.querySelectorAll('[data-interaction-field]').forEach(control => {
@@ -10,7 +14,9 @@ export function interactionPanelScript() {
         drafts.set(control.dataset.interactionField, { value: control.value, checked: control.checked });
         if (control === document.activeElement) focus = { key: control.dataset.interactionField, start: control.selectionStart, end: control.selectionEnd };
       });
-      while (drafts.size > 256) drafts.delete(drafts.keys().next().value);
+      container.querySelectorAll('[data-interaction-details]').forEach(detail => expanded.set(detail.dataset.interactionDetails, detail.open));
+      while (expanded.size > 256) expanded.delete(expanded.keys().next().value);
+      while (drafts.size > 8192) drafts.delete(drafts.keys().next().value);
     }
     function restore(container) {
       const live = new Set();
@@ -22,8 +28,116 @@ export function interactionPanelScript() {
       });
       for (const key of drafts.keys()) if (!live.has(key)) drafts.delete(key);
       if (focus && !live.has(focus.key)) focus = null;
+      const detailKeys = new Set();
+      container.querySelectorAll('[data-interaction-details]').forEach(detail => {
+        const key = detail.dataset.interactionDetails; detailKeys.add(key);
+        if (expanded.has(key)) detail.open = expanded.get(key);
+      });
+      for (const key of expanded.keys()) if (!detailKeys.has(key)) expanded.delete(key);
+    }
+    function requiresInput(request) {
+      return request.kind === 'userInput' || (request.kind === 'mcp' && request.params?.mode === 'form' && Object.keys(request.params.requestedSchema?.properties || {}).length > 0);
+    }
+    function approvalBlocked(request) {
+      if (request.kind === 'mcp') { try { (isUrl(request) ? mcpUrls : mcpForms).describe(request.params); } catch (_) { return true; } }
+      const tool = request.params?.toolCall;
+      return Boolean(request.truncated || (request.method === 'session/request_permission' &&
+        (!tool || tool.contextPending || tool.contextTruncated || !Object.hasOwn(tool, 'rawInput') ||
+         !request.params.options?.some(option => option.kind === 'allow_once'))));
+    }
+    function isUrl(request) { return request.kind === 'mcp' && request.params?.mode === 'url'; }
+    function acceptLabel(request, text) {
+      return isUrl(request) ? text('Open authorization page', '打开授权页面') : requiresInput(request) ? text('Send answers', '提交答复')
+        : request.kind === 'permissions' ? text('Grant selected permissions', '授予所选权限') : text('Approve once', '批准本次');
+    }
+    function previewParams(request) {
+      if (!isUrl(request)) return request.params || {};
+      let destination;
+      try { destination = mcpUrls.describe(request.params).origin; } catch (_) {}
+      return { mode: 'url', serverName: request.params?.serverName, destination };
+    }
+    function prepareUrl(request, decision, text) {
+      if (!isUrl(request) || decision !== 'accept') return null;
+      if (approvalBlocked(request)) throw new Error(text('This authorization request cannot be opened.', '当前授权请求不可打开。'));
+      const { href } = mcpUrls.describe(request.params);
+      // Reserve a tab within the explicit click; navigate only after the owning
+      // executor accepts the exact request. A stale lease leaves no auth page.
+      const page = window.open('about:blank', '_blank');
+      if (!page) throw new Error(text('Allow pop-ups for this site, then try again. The request has not been accepted.', '请允许本站弹出新标签页后重试；请求尚未接受。'));
+      let navigated = false;
+      try {
+        page.opener = null;
+        page.document.write('<meta name="referrer" content="no-referrer"><title>Authorization / 授权</title><p>Opening authorization page / 正在打开授权页面…</p>');
+        page.document.close();
+      } catch (error) { page.close(); throw error; }
+      return {
+        complete() {
+          if (page.closed) throw new Error(text('The request was accepted but the authorization tab was closed. Check the task result or request authorization again.', '请求已接受，但授权标签页已关闭。请查看任务结果或重新发起授权。'));
+          page.location.replace(href); navigated = true;
+          return text('Authorization page opened. Complete the steps there, then return to follow this task. Opening the page does not confirm authorization.', '授权页面已打开。请在该页面完成操作，再返回查看任务结果；打开页面不表示授权成功。');
+        },
+        cancel() { if (!navigated && !page.closed) page.close(); }
+      };
+    }
+    function preview(request, key, esc, text) {
+      const params = request.params || {}, tool = params.toolCall || {}, input = params.input || tool.rawInput || {};
+      const rows = [], row = (label, value) => { if (typeof value === 'string' && value) rows.push('<dt>' + esc(label) + '</dt><dd>' + esc(value) + '</dd>'); };
+      const name = params.tool || tool.title;
+      row(text('Tool', '工具'), name);
+      row(text('MCP server', 'MCP 服务'), params.serverName);
+      row(text('Command', '命令'), params.command || input.command);
+      row(text('File', '文件'), input.file_path || input.path || params.path || params.grantRoot);
+      row(text('Working directory', '工作目录'), params.cwd || input.cwd);
+      row(text('Reason', '原因'), params.reason || params.message);
+      const content = typeof input.content === 'string' ? input.content : null;
+      const previewLimit = 1024;
+      const contentPreview = content === null ? '' : '<p>' + esc(text('Content preview', '内容预览')) + '</p><pre class="hcc-interaction-content">' + esc(content.slice(0, previewLimit)) + '</pre>'
+        + (content.length > previewLimit ? '<p>' + esc(text('Preview shortened; expand the full operation details to review all content.', '预览已缩短，展开完整操作详情可核对全部内容。')) + '</p>' : '');
+      const known = rows.length || ['permissions', 'userInput'].includes(request.kind);
+      const missingContext = request.method === 'session/request_permission' && approvalBlocked(request);
+      return (rows.length ? '<dl class="hcc-interaction-summary">' + rows.join('') + '</dl>' : '') + contentPreview
+        + (missingContext ? '<p role="alert">' + esc(text('The operation input or one-time approval option is unavailable. Only rejection is available.', '操作输入或单次批准选项不可用，目前只能拒绝。')) + '</p>' : '')
+        + (request.kind === 'approval' && !missingContext ? '<p>' + esc(text('Approval applies only to this operation. Later requests require another decision.', '仅批准本次操作，后续请求仍需单独确认。')) + '</p>' : '')
+        + '<details class="hcc-interaction-details" data-interaction-details="' + esc(key) + '"' + (known ? '' : ' open') + '><summary>' + esc(text('Full operation details', '完整操作详情')) + '</summary><pre>' + esc(JSON.stringify(previewParams(request), null, 2)) + '</pre></details>';
+    }
+    function mcpForm(request, key, esc, text) {
+      let fields;
+      try { ({ fields } = mcpForms.describe(request.params)); }
+      catch (_) { return '<p role="alert">' + esc(text('This MCP request mode or schema is unsupported. Decline or cancel this request.', '暂不支持此 MCP 请求模式或表单结构，请拒绝或取消请求。')) + '</p>'; }
+      if (!fields.length) return '';
+      const attr = suffix => ' data-interaction-field="' + esc(key + ':mcp:' + suffix) + '"';
+      const select = (i, choices, value) => '<select data-mcp-field="' + i + '"' + attr(i) + '><option value="">' + esc(text('Choose a value', '请选择')) + '</option>'
+        + choices.map((choice, n) => '<option value="' + n + '"' + (value === choice.value ? ' selected' : '') + '>' + esc(choice.label) + '</option>').join('') + '</select>';
+      return '<p>' + esc(text('Required fields are marked *. Optional fields are sent only when selected. Responses are not saved in browser storage.', '带 * 的为必填项；可选项仅在勾选填写后发送。答复不会保存到浏览器存储。')) + '</p>'
+        + fields.map((field, i) => {
+          const label = esc(field.title || field.key) + (field.required ? ' *' : '');
+          const optional = field.required ? '' : '<label><input type="checkbox" data-mcp-use="' + i + '"' + attr(i + ':use') + '> ' + esc(text('Provide this optional field', '填写此可选项')) + '</label>';
+          let control;
+          if (field.kind === 'enum') control = select(i, field.options, field.default);
+          else if (field.type === 'boolean') control = select(i, [{ value: true, label: text('Yes', '是') }, { value: false, label: text('No', '否') }], field.default);
+          else if (field.kind === 'multi') control = field.options.map((option, n) => '<label><input type="checkbox" data-mcp-field="' + i + '" data-mcp-option="' + n + '"' + attr(i + ':' + n)
+            + (field.default?.includes(option.value) ? ' checked' : '') + '> ' + esc(option.label) + '</label>').join('');
+          else control = '<input data-mcp-field="' + i + '"' + attr(i) + ' type="' + (['number', 'integer'].includes(field.type) ? 'number' : 'text') + '"'
+            + (field.type === 'integer' ? ' step="1"' : field.type === 'number' ? ' step="any"' : ' maxlength="8192"')
+            + (field.minimum != null ? ' min="' + esc(field.minimum) + '"' : '') + (field.maximum != null ? ' max="' + esc(field.maximum) + '"' : '')
+            + ' value="' + esc(field.default ?? '') + '" autocomplete="off">';
+          const limits = [field.format, field.minLength != null ? text('Min length: ', '最短长度：') + field.minLength : '', field.maxLength != null ? text('Max length: ', '最长长度：') + field.maxLength : '',
+            field.minimum != null ? text('Minimum: ', '最小值：') + field.minimum : '', field.maximum != null ? text('Maximum: ', '最大值：') + field.maximum : '',
+            field.minItems != null ? text('Min selections: ', '至少选择：') + field.minItems : '', field.maxItems != null ? text('Max selections: ', '最多选择：') + field.maxItems : ''].filter(Boolean).join(' · ');
+          return '<fieldset class="hcc-mcp-field"><legend>' + label + '</legend>' + (field.description ? '<p>' + esc(field.description) + '</p>' : '') + optional
+            + (field.kind === 'multi' ? control : '<label><span class="sr-only">' + label + '</span>' + control + '</label>') + (limits ? '<small>' + esc(limits) + '</small>' : '') + '</fieldset>';
+        }).join('');
     }
     function form(request, key, esc, text) {
+      if (isUrl(request)) {
+        let destination;
+        try { destination = mcpUrls.describe(request.params); }
+        catch (_) { return '<p role="alert">' + esc(text('This authorization URL or identity is invalid. Decline or cancel this request.', '授权链接或请求标识无效，请拒绝或取消请求。')) + '</p>'; }
+        return '<p class="hcc-url-destination">' + esc(text('Authorization destination: ', '授权目标：')) + '<strong>' + esc(destination.origin) + '</strong></p>'
+          + '<p>' + esc(text('Open this page only if you trust the MCP server and destination. Finish authorization there, then return to this task. Opening acknowledges the request; it does not confirm authorization.', '确认信任此 MCP 服务和目标后打开页面，在该页面完成授权，再返回本任务查看结果。打开仅表示接受请求，不表示授权成功。')) + '</p>'
+          + (destination.loopback ? '<p>' + esc(text('This address belongs to the executor computer. A browser on another device may not reach it; open this task on the executor computer to authorize.', '此地址位于执行器所在电脑。其他设备的浏览器可能无法访问，请在执行器所在电脑打开本任务完成授权。')) + '</p>' : '');
+      }
+      if (request.kind === 'mcp') return mcpForm(request, key, esc, text);
       const field = suffix => ' data-interaction-field="' + esc(key + ':' + suffix) + '"';
       if (request.kind === 'userInput') return (request.params?.questions || []).map((q, i) => {
         const label = '<label>' + esc(q.header || '') + '<p>' + esc(q.question || '') + '</p>';
@@ -46,6 +160,25 @@ export function interactionPanelScript() {
     }
     function payload(request, container, decision) {
       if (decision !== 'accept') return { decision };
+      if (isUrl(request)) { mcpUrls.describe(request.params); return { decision }; }
+      if (request.kind === 'mcp') {
+        const { fields } = mcpForms.describe(request.params), content = Object.create(null);
+        for (const [i, field] of fields.entries()) {
+          if (!field.required && !container?.querySelector('[data-mcp-use="' + i + '"]')?.checked) continue;
+          const controls = container?.querySelectorAll('[data-mcp-field="' + i + '"]');
+          if (!controls?.length) throw new Error('MCP form is unavailable / MCP 表单不可用');
+          const control = controls[0];
+          if (field.kind === 'multi') content[field.key] = Array.from(controls).filter(item => item.checked).map(item => field.options[Number(item.dataset.mcpOption)]?.value);
+          else if (field.kind === 'enum' || field.type === 'boolean') {
+            if (!/^\d+$/.test(control.value)) throw new Error('Choose a value / 请选择：' + field.key);
+            content[field.key] = field.kind === 'enum' ? field.options[Number(control.value)]?.value : control.value === '0' ? true : control.value === '1' ? false : undefined;
+          } else if (['number', 'integer'].includes(field.type)) {
+            if (!control.value.trim()) throw new Error('Enter a number / 请填写数值：' + field.key);
+            content[field.key] = Number(control.value);
+          } else content[field.key] = control.value;
+        }
+        return { decision, content: mcpForms.validate(request.params, content) };
+      }
       if (request.kind === 'userInput') {
         const answers = Object.create(null);
         for (const [i, q] of (request.params?.questions || []).entries()) {
@@ -72,7 +205,7 @@ export function interactionPanelScript() {
       }
       return { decision, permissions, scope: container.querySelector('[data-scope]').value };
     }
-    function forget(key) { for (const field of drafts.keys()) if (field.startsWith(key + ':')) drafts.delete(field); }
-    window.hccInteractions = { form, payload, remember, restore, forget };
+    function forget(key) { for (const field of drafts.keys()) if (field.startsWith(key + ':')) drafts.delete(field); expanded.delete(key); }
+    window.hccInteractions = { preview, previewParams, approvalBlocked, requiresInput, acceptLabel, prepareUrl, form, payload, remember, restore, forget };
   })();`;
 }

package/lib/web/ui-native.mjs

@@ -15,6 +15,9 @@ export function nativePanelHtml() {
     .native-receipt { border:1px solid var(--border); border-radius:7px; padding:9px; font-size:var(--small-font); overflow-wrap:anywhere; }
     .native-composer { border-top:1px solid var(--border); max-height:45%; overflow:auto; }
     #nativeDraft { width:100%; min-height:70px; max-height:170px; resize:vertical; padding:10px; font:inherit; background:var(--input-bg); color:var(--text); border:1px solid var(--border); border-radius:7px; }
+    .hcc-interaction-content,.hcc-interaction-details pre { white-space:pre-wrap; overflow-wrap:anywhere; max-height:180px; overflow:auto; margin:6px 0; }
+    .hcc-interaction-details { margin:8px 0; }
+    .hcc-interaction-details summary { cursor:pointer; color:var(--muted); }
     .native-controls { display:flex; flex-wrap:wrap; gap:8px; align-items:center; margin-top:8px; }
     .native-controls label { display:flex; gap:6px; align-items:center; font-size:var(--small-font); }
     #nativeNotice { color:var(--muted); font-size:var(--small-font); overflow-wrap:anywhere; }
@@ -67,7 +70,12 @@ export function nativePanelScript() {
       if (stored.pending?.id !== submissionId) return false;
       if (stored.text === stored.pending.text) stored.text = '';
       stored.pending = null; window.hccUi.safeSet(target.key,JSON.stringify(stored));
-      if (matches(target)) { draft.value = stored.text || ''; pending = null; notice(tr('native.queued')); }
+      // A-B-A navigation can return before its fresh executor snapshot arrives.
+      // Reconcile the matching local submission even while state is still null.
+      if (key === target.key && pending?.id === submissionId) {
+        draft.value = stored.text || ''; pending = null;
+        notice(matches(target) ? tr('native.queued') : '');
+      }
       return true;
     }
     function render(value) {
@@ -76,7 +84,8 @@ export function nativePanelScript() {
       if (Number.isSafeInteger(state?.generation) && Number.isSafeInteger(value.generation) && value.generation < state.generation) return;
       const replaced = state && (state.generation !== value.generation || state.owner !== value.owner);
       if (replaced) { events.clear(); document.getElementById('nativeCloseConfirmed').checked = false; }
-      state = value; observed++;
+      if (state !== value) observed++;
+      state = value;
       for (const entry of value.events || []) events.set(entry.id,entry);
       while (events.size > 100) events.delete(events.keys().next().value);
       document.getElementById('nativeStatus').textContent = tr('native.sameExecutor') + ' · ' + (state.provider || '') + ' · ' + tr('native.state.' + state.status, state.status || '');
@@ -93,25 +102,34 @@ export function nativePanelScript() {
       const text = (en, zh) => ['zh','zh-CN'].includes(window.hccUi.language) ? zh : en;
       window.hccInteractions.remember(container);
       container.innerHTML = approvals.map((request, index) => '<article class="codex-card codex-approval"><h3>'
-        + esc(request.kind === 'userInput' ? text('Your input is required', '等待您的答复') : text('Approval required', '等待人工审批'))
-        + '</h3><pre>' + esc(JSON.stringify(request.params, null, 2)) + '</pre>'
+        + esc(window.hccInteractions.requiresInput(request) ? text('Your input is required', '等待您的答复') : text('Approval required', '等待人工审批'))
+        + '</h3>' + window.hccInteractions.preview(request, requestKey(request), esc, text)
         + (request.truncated ? '<p>' + esc(text('Truncated; cancel or decline only.', '参数已截断，只能取消或拒绝。')) + '</p>' : '')
         + '<div class="hcc-interaction-form">' + window.hccInteractions.form(request, requestKey(request), esc, text) + '</div><div class="native-controls">'
-        + '<button data-response="' + index + '" data-decision="accept" data-truncated="' + !!request.truncated + '" data-request-key="' + esc(requestKey(request)) + '">' + esc(request.kind === 'userInput' ? text('Send answers', '提交答复') : request.kind === 'permissions' ? text('Grant selected permissions', '授予所选权限') : text('Approve once', '批准本次')) + '</button>'
-        + '<button data-response="' + index + '" data-decision="' + (request.kind === 'userInput' ? 'cancel' : 'decline') + '" data-request-key="' + esc(requestKey(request)) + '">' + esc(text('Decline / cancel', '拒绝 / 取消')) + '</button></div></article>').join('');
+        + '<button data-response="' + index + '" data-decision="accept" data-truncated="' + window.hccInteractions.approvalBlocked(request) + '" data-request-key="' + esc(requestKey(request)) + '">' + esc(window.hccInteractions.acceptLabel(request, text)) + '</button>'
+        + '<button data-response="' + index + '" data-decision="' + (request.kind === 'userInput' ? 'cancel' : 'decline') + '" data-request-key="' + esc(requestKey(request)) + '">' + esc(request.kind === 'mcp' ? text('Decline', '拒绝') : text('Decline / cancel', '拒绝 / 取消')) + '</button>'
+        + (request.kind === 'mcp' ? '<button data-response="' + index + '" data-decision="cancel" data-request-key="' + esc(requestKey(request)) + '">' + esc(text('Cancel request', '取消请求')) + '</button>' : '') + '</div></article>').join('');
       window.hccInteractions.restore(container);
       container.querySelectorAll('button[data-response]').forEach(button => button.addEventListener('click', async () => {
         if (!matches(target) || !bridge().canControl || responding.has(button.dataset.requestKey)) return;
         const request = approvals[Number(button.dataset.response)], key = button.dataset.requestKey;
-        responding.add(key); sync();
+        const version = observed;
+        notice(''); responding.add(key); sync();
+        let authorization;
         try {
-          const payload = window.hccInteractions.payload(request, ['permissions','userInput'].includes(request.kind) ? button.closest('article') : null, button.dataset.decision);
+          const payload = window.hccInteractions.payload(request, ['permissions','userInput','mcp'].includes(request.kind) ? button.closest('article') : null, button.dataset.decision);
+          authorization = window.hccInteractions.prepareUrl(request, button.dataset.decision, text);
           const result = await bridge().api(route(target, 'respond'), {method:'POST', body:JSON.stringify({
             executorId:request.executorId, sessionId:request.sessionId, turnId:request.turnId, requestId:request.requestId,
             ...payload, action_token:bridge().actionToken, epoch:bridge().epoch })});
           window.hccInteractions.forget(key);
-          if (matches(target)) { if (result.state) render(result.state); else void read(); }
-        } catch(error) { if(matches(target)) notice(error.detail || error.message); }
+          const opened = authorization?.complete();
+          if (opened && matches(target)) notice(opened);
+          if (matches(target) && version === observed) { if (result.state) render(result.state); else void read(); }
+        } catch(error) {
+          authorization?.cancel();
+          if (matches(target) && (state?.pendingApprovals || []).some(current => current.requestId === request.requestId && current.executorId === request.executorId)) notice(error.detail || error.message);
+        }
         finally { responding.delete(key); sync(); }
       }));
       if (pending && (state.deliveries || []).some(delivery => delivery.submission_id === pending.id && delivery.message_id)) acknowledge(subject(),pending.id);
@@ -128,15 +146,15 @@ export function nativePanelScript() {
     draft.addEventListener('input',()=>{ save(); sync(); });
     document.getElementById('nativeSend').addEventListener('click',async()=>{
       sync(); if (document.getElementById('nativeSend').disabled) return;
-      const target = subject(), text = draft.value, id = 's_' + crypto.randomUUID();
+      const target = subject(), text = draft.value, id = 's_' + crypto.randomUUID(), version = observed;
       pending = {id,text,generation:target.generation}; save(); inflight.add(target.key); sync(); notice(tr('native.sending'));
       try {
         const result = await bridge().api(route(target,'send'),{method:'POST',body:JSON.stringify({text,submissionId:id,action_token:target.token,epoch:target.epoch})});
         const receipt = result.receipt || result;
         if (receipt.submission_id !== id || !Number.isSafeInteger(receipt.message_id)) throw new Error(tr('native.invalidReceipt'));
         acknowledge(target,id);
-        if (matches(target)) { if (result.state) render(result.state); else void read(); }
-      } catch(error) { if (matches(target)) notice((error.detail || error.message) + ' ' + tr('native.uncertain')); }
+        if (matches(target) && version === observed) { if (result.state) render(result.state); else void read(); }
+      } catch(error) { if (matches(target) && pending?.id === id) notice((error.detail || error.message) + ' ' + tr('native.uncertain')); }
       finally { inflight.delete(target.key); sync(); }
     });
     document.getElementById('nativeInterrupt').addEventListener('click',async()=>{

package/lib/web/ui-template.mjs

@@ -11,6 +11,8 @@ import { commandPaletteCss, commandPaletteHtml, commandPaletteScript } from './u
 import { terminalFindCss, terminalFindHtml, terminalFindScript } from './ui-terminal-find.mjs';
 import { workspaceCss, workspaceBarHtml, workspaceSecondaryHtml, workspaceScript } from './ui-workspace.mjs';
 
+const SHELL_APOSTROPHE_ESCAPE = JSON.stringify(`'"'"'`);
+
 function nonceAttribute(nonce) {
   const value = String(nonce || '');
   if (!/^[A-Za-z0-9_-]{16,}$/.test(value)) {
@@ -604,7 +606,8 @@ export function webIndexHtml({ nonce, pane = false } = {}) {
     @media (max-width: 480px) {
       .global-header { padding: 0 10px; }
       .global-header > strong { font-size: 15px; }
-      .header-controls { gap: 6px; }
+      .header-controls { gap: 6px; flex: 1; min-width: 0; overflow-x: auto; scrollbar-width: thin; }
+      .header-controls > * { flex-shrink: 0; }
       .global-header #connState { max-width: 88px; overflow: hidden; text-overflow: ellipsis; }
       .toolbar { flex-wrap: wrap; padding: 8px 10px; }
       .toolbar .title { flex-basis: 100%; }
@@ -2130,11 +2133,15 @@ export function webIndexHtml({ nonce, pane = false } = {}) {
       };
     }
 
+    function terminalShellQuote(value) {
+      return "'" + String(value).split("'").join(${SHELL_APOSTROPHE_ESCAPE}) + "'";
+    }
+
     function terminalCommandForAction(action, info) {
       const session = info.session || {};
-      const peerId = info.peerId;
+      const peerId = terminalShellQuote(info.peerId);
       const lines = {
-        register: \`hcc register --peer \${peerId} --kind \${session.kind || 'other'} --role \${session.role || 'peer'}\`,
+        register: \`hcc register --peer \${peerId} --kind \${terminalShellQuote(session.kind || 'other')} --role \${terminalShellQuote(session.role || 'peer')}\`,
         inbox:    \`hcc msg inbox --peer \${peerId}\`,
         'task-next': \`hcc task next --peer \${peerId}\`,
         state:    \`hcc state --peer \${peerId}\`,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@logicseek/hello-cc",
-  "version": "1.0.2",
+  "version": "1.1.0-rc.1",
   "description": "Local control plane for coordinating Claude Code, Codex, and other coding CLI sessions.",
   "type": "module",
   "bin": {

package/scripts/mcp-form-live-fixture.mjs

@@ -0,0 +1,81 @@
+// Disposable stdio MCP server for installed-model form acceptance.
+// Only synthetic inputs from this harness are recorded; no provider credentials.
+import fs from 'node:fs';
+import readline from 'node:readline';
+import { randomUUID } from 'node:crypto';
+
+const args = process.argv.slice(2);
+if (!args.includes('--stdio')) {
+  console.log('Acceptance fixture only: node scripts/mcp-form-live-fixture.mjs --stdio --log FILE');
+  process.exit(0);
+}
+const logIndex = args.indexOf('--log');
+if (logIndex < 0 || !args[logIndex + 1]) throw new Error('--log FILE is required');
+const logPath = args[logIndex + 1];
+const pending = new Map();
+const write = value => process.stdout.write(JSON.stringify({ jsonrpc: '2.0', ...value }) + '\n');
+const record = value => fs.appendFileSync(logPath, JSON.stringify({ at: new Date().toISOString(), pid: process.pid, ...value }) + '\n', { mode: 0o600 });
+const reply = (id, result) => write({ id, result });
+const schema = {
+  type: 'object',
+  properties: {
+    project: { type: 'string', title: 'Project name / 项目名', minLength: 3, maxLength: 64 },
+    count: { type: 'integer', title: 'Run count / 次数', minimum: 1, maximum: 4 },
+    enabled: { type: 'boolean', title: 'Enable extra operation / 开启额外操作' },
+    region: { type: 'string', title: 'Region / 地区', enum: ['eu', 'us'], enumNames: ['Europe', 'USA'] },
+    features: { type: 'array', title: 'Features / 功能', minItems: 1, maxItems: 2,
+      items: { type: 'string', enum: ['logs', 'tests'] } },
+    note: { type: 'string', title: 'Optional note / 可选备注', default: 'suggested-but-not-automatically-submitted' }
+  },
+  required: ['project', 'count', 'enabled', 'region', 'features']
+};
+const lines = readline.createInterface({ input: process.stdin });
+lines.on('line', line => {
+  let message;
+  try { message = JSON.parse(line); } catch { write({ id: null, error: { code: -32700, message: 'Invalid JSON' } }); return; }
+  const { id, method, params = {} } = message;
+  if (!method) {
+    const entry = pending.get(id);
+    if (!entry) return;
+    pending.delete(id); clearTimeout(entry.timer);
+    record({ event: 'form-response', phase: entry.phase, elicitationId: id, response: message.result ?? null,
+      ...(message.error ? { error: { code: message.error.code } } : {}) });
+    if (message.error) { reply(entry.callId, { content: [{ type: 'text', text: 'Form failed' }], isError: true }); return; }
+    reply(entry.callId, { content: [{ type: 'text', text: JSON.stringify({ phase: entry.phase, ...message.result }) }] });
+    return;
+  }
+  if (method === 'initialize') {
+    record({ event: 'initialize', protocolVersion: params.protocolVersion, clientName: params.clientInfo?.name,
+      elicitationCapabilities: params.capabilities?.elicitation ?? null });
+    reply(id, { protocolVersion: params.protocolVersion, capabilities: { tools: {} },
+      serverInfo: { name: 'hcc-form-live-acceptance', version: '1.0.0' } });
+  } else if (method === 'notifications/initialized') {
+    record({ event: 'ready' });
+  } else if (method === 'ping') {
+    reply(id, {});
+  } else if (method === 'tools/list') {
+    reply(id, { tools: [{ name: 'collect_project_settings',
+      description: 'Ask the human for project settings in a typed MCP form. Wait for their response and return the selected values.',
+      inputSchema: { type: 'object', properties: { phase: { type: 'string', enum: ['native', 'web-owned'] } },
+        required: ['phase'], additionalProperties: false } }] });
+  } else if (method === 'tools/call') {
+    const phase = params.arguments?.phase;
+    if (params.name !== 'collect_project_settings' || !['native', 'web-owned'].includes(phase)) {
+      write({ id, error: { code: -32602, message: 'Unknown acceptance tool or phase' } }); return;
+    }
+    const elicitationId = 'acceptance-form-' + randomUUID();
+    const timer = setTimeout(() => {
+      if (!pending.delete(elicitationId)) return;
+      record({ event: 'form-timeout', phase, elicitationId });
+      reply(id, { content: [{ type: 'text', text: 'Acceptance form timed out' }], isError: true });
+    }, 240000);
+    pending.set(elicitationId, { callId: id, phase, timer });
+    record({ event: 'tool-called', phase, elicitationId });
+    write({ id: elicitationId, method: 'elicitation/create', params: { mode: 'form',
+      message: 'Acceptance only: provide synthetic project settings / 验收表单：填写合成项目参数', requestedSchema: schema } });
+    record({ event: 'form-requested', phase, elicitationId });
+  } else if (id !== undefined) {
+    write({ id, error: { code: -32601, message: 'Method not found' } });
+  }
+});
+lines.on('close', () => { for (const entry of pending.values()) clearTimeout(entry.timer); pending.clear(); });